@goodandready/dsh-subscriptions 0.6.41 → 0.6.44

package/lib/accounts.js

@@ -1,5 +1,5 @@
 import { needsWarmupProbe, enterProbing, resolveWarmupSuccess, resolveWarmupFailure, STATUS_QUARANTINE, STATUS_PROBING } from "./quarantine.js"
-import { fetchWithTimeout } from "./http.js"
+import { fetchWithTimeout, isTimeoutError } from "./http.js"
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
@@ -64,6 +64,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const quotas = new Map()
   const quarantines = new Map()
   const writeQueues = new Map()
+  const credentialVersions = new Map()
+  const clearedRefs = new Set()
   const refreshLocks = new Map()
   const refreshFailures = new Map()
   const usage = new Map()
@@ -75,7 +77,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const doFetch = fetchImpl || fetch
   // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
   const rawFetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
-  const fetchFor = (ref) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: 25000, ...(opts || {}) })
+  const fetchFor = (ref, defaultTimeoutMs = 25000) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: defaultTimeoutMs, ...(opts || {}) })
 
   async function resolveRaw(ref) {
     try {
@@ -89,7 +91,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   async function loadBlob(ref) {
     const raw = await resolveRaw(ref)
     if (!raw) {
-      const err = new Error(`no token for ${ref}`)
+      const err = /** @type {Error & { code?: string }} */ (new Error(`no token for ${ref}`))
       err.code = 'AUTH'
       throw err
     }
@@ -98,12 +100,25 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
 
   async function saveBlob(ref, blob) {
     if (!ref || typeof ref !== "string") throw new Error("invalid ref for saveBlob")
+    clearedRefs.delete(ref)
+    const version = (credentialVersions.get(ref) || 0) + 1
+    credentialVersions.set(ref, version)
+
     const prev = writeQueues.get(ref) || Promise.resolve()
     const next = prev.catch(() => {}).then(async () => {
+      if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+        return
+      }
       try {
         await credentials.set(credentialRef(ref), serializeBlob(blob))
+        if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+          try { await credentials.unset(credentialRef(ref)) } catch { /* best-effort */ }
+        }
       } catch (err) {
-        const wrapErr = new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`)
+        if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+          return
+        }
+        const wrapErr = /** @type {Error & { code?: string, cause?: any }} */ (new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`))
         wrapErr.code = "CREDENTIAL_SAVE_FAILED"
         wrapErr.cause = err
         throw wrapErr
@@ -115,6 +130,9 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
 
   async function clearRef(ref) {
     if (!ref || typeof ref !== "string") return
+    clearedRefs.add(ref)
+    const version = (credentialVersions.get(ref) || 0) + 1
+    credentialVersions.set(ref, version)
     try {
       await credentials.unset(credentialRef(ref))
     } catch { /* best-effort unset */ }
@@ -171,6 +189,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
       healthBadge: healthBadge(computeHealthScore(health.get(ref) || null)),
       usagePercent: usage.has(ref) ? usage.get(ref) : null,
       refreshError: refreshFailures.get(ref)?.error || '',
+      isTimeout: !!refreshFailures.get(ref)?.isTimeout,
       validationUrl: base.validationUrl || '',
       validationMessage: base.validationMessage || '',
       accountNotice: base.accountNotice || '',
@@ -227,7 +246,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         const curConfig = getConfig()
         const cfg = vendorConfig(provider, curConfig)
         const next = await executeWithRetry(
-          () => getVendor(provider).refresh(cfg, blob, fetchFor(ref)),
+          () => getVendor(provider).refresh(cfg, blob, fetchFor(ref, 30000)),
           {
             maxRetries: 2,
             initialDelayMs: 300,
@@ -250,7 +269,11 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         if (ref) refreshFailures.delete(ref)
         return merged
       } catch (e) {
-        if (ref) refreshFailures.set(ref, { at: Date.now(), error: String(e && e.message || e) })
+        const isTimeout = isTimeoutError(e)
+        const errMsg = isTimeout
+          ? `Network timeout refreshing token: ${e.message || 'timed out'}`
+          : String(e && e.message || e)
+        if (ref) refreshFailures.set(ref, { at: Date.now(), error: errMsg, isTimeout })
         throw e
       } finally {
         refreshLocks.delete(lockKey)
@@ -287,7 +310,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
           try {
             usageFetched.set(slot.ref, Date.now())
             const blob = await ensureFresh(provider, parseBlob(raw), slot.ref)
-            const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref))
+            const usageTimeout = Number(curConfig?.usageTimeoutMs) || 15000
+            const snap = await vendor.usage(blob, cfg, fetchFor(slot.ref, usageTimeout))
             if (!snap) return
             if (Number.isFinite(Number(snap.usedPercent))) {
               usage.set(slot.ref, Number(snap.usedPercent))
@@ -314,16 +338,27 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
               windows.set(slot.ref, list)
               // persist last known windows so the card survives restarts
               try {
-                const prev = Array.isArray(blob.usage) ? JSON.stringify(blob.usage) : ''
+                if (clearedRefs.has(slot.ref)) return
+                let currentBlob = null
+                try {
+                  const currentRaw = await resolveRaw(slot.ref)
+                  if (currentRaw) currentBlob = parseBlob(currentRaw)
+                } catch { /* best-effort */ }
+                if (!currentBlob || clearedRefs.has(slot.ref)) return
+                const prev = Array.isArray(currentBlob.usage) ? JSON.stringify(currentBlob.usage) : ''
                 if (prev !== JSON.stringify(list)) {
-                  await saveBlob(slot.ref, { ...blob, usage: list, usageAt: Date.now() })
-                } else if (!blob.usageAt) {
-                  await saveBlob(slot.ref, { ...blob, usageAt: Date.now() })
+                  await saveBlob(slot.ref, { ...currentBlob, usage: list, usageAt: Date.now() })
+                } else if (!currentBlob.usageAt) {
+                  await saveBlob(slot.ref, { ...currentBlob, usageAt: Date.now() })
                 }
               } catch { /* persistence best-effort */ }
             }
-          } catch {
+          } catch (err) {
             usageFetched.set(slot.ref, Date.now())
+            const isTimeout = isTimeoutError(err)
+            if (isTimeout && !refreshFailures.has(slot.ref)) {
+              refreshFailures.set(slot.ref, { at: Date.now(), error: `Network timeout fetching usage: ${err.message || 'timed out'}`, isTimeout: true })
+            }
           } finally {
             slotUsageLocks.delete(slot.ref)
           }

package/lib/adapter-manager.js

@@ -57,6 +57,7 @@ export function createAdapterManager({
     recordHistory,
     fetchImpl: fetch,
     fetchForRef,
+    hideDeprecatedModels: () => Boolean(live().hideDeprecatedModels),
   })
 
   async function* cascadeFallbackStream({ options, provider, err, visited = new Set() }) {

package/lib/adapter.js

@@ -53,14 +53,16 @@ export class SubscriptionAdapter extends LlmAdapter {
     let models = null
     if (targetAccount) {
       const cfg = this.deps.vendorConfig(provider)
-      const fetchImpl = pickFetch(this.deps, targetAccount.ref)
+      const baseFetch = pickFetch(this.deps, targetAccount.ref)
+      const listModelsFetch = (url, init, opts) =>
+        fetchWithTimeout(baseFetch, url, init, { timeoutMs: 15000, ...(opts || {}) })
       try {
         const blob = await this.deps.ensureFresh(
           provider,
           await this.deps.loadBlob(targetAccount.ref),
           targetAccount.ref,
         )
-        const live = await getVendor(provider).listModels(blob, cfg, fetchImpl)
+        const live = await getVendor(provider).listModels(blob, cfg, listModelsFetch)
         if (Array.isArray(live) && live.length) models = live
       } catch { /* use built-in catalog */ }
     }
@@ -200,7 +202,7 @@ export class SubscriptionAdapter extends LlmAdapter {
           // ponytail: capture x-ratelimit headers without touching vendors
           const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
-            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
+            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 60000, stream: true })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
               if (snap && typeof deps.rememberQuota === "function") {
@@ -221,7 +223,9 @@ export class SubscriptionAdapter extends LlmAdapter {
             } catch { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
-                const txt = await res.clone().text()
+                const textPromise = res.clone().text()
+                const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 5000))
+                const txt = await Promise.race([textPromise, timeoutPromise])
                 let j=null; try { j = JSON.parse(txt) } catch { j = null }
                 if (j) {
                   const b = parseBody(provider, j, Date.now())

package/lib/backoff.js

@@ -1,9 +1,21 @@
+/**
+ * @template T
+ * @param {() => Promise<T>} fn
+ * @param {{
+ *   maxRetries?: number,
+ *   initialDelayMs?: number,
+ *   maxDelayMs?: number,
+ *   factor?: number,
+ *   isRetryable?: (err: any) => boolean,
+ * }} [options]
+ * @returns {Promise<T>}
+ */
 export async function executeWithRetry(fn, {
   maxRetries = 3,
   initialDelayMs = 200,
   maxDelayMs = 3000,
   factor = 2,
-  isRetryable = () => true
+  isRetryable = (_err) => true
 } = {}) {
   let attempt = 0
   let delay = initialDelayMs

package/lib/code-assist.js

@@ -204,6 +204,7 @@ export function streamEnvelope({ projectId, model, request, userAgent, sessionId
   const session = sessionId || randomUUID()
   const body = { ...(request || {}) }
   if (!body.session_id) body.session_id = session
+  /** @type {Record<string, any>} */
   const envelope = {
     ...(projectId ? { project: projectId } : {}),
     model,

package/lib/crypto.js

@@ -3,7 +3,7 @@ import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes }
 // AES-256-GCM with PBKDF2 (600,000 iterations, SHA-256) (DSHE2:),
 // hardened scrypt (N=131072) (DSHE3:), or legacy scrypt (DSHE1:).
 // Backward-compatible across all key derivation algorithms.
-export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
+export function encryptWithPassphrase(plainText, passphrase, { algorithm = "pbkdf2" } = {}) {
   const salt = randomBytes(16)
   const isPbkdf2 = algorithm === "pbkdf2"
   const isHardenedScrypt = algorithm === "scrypt-v2" || algorithm === "scrypt-hardened"

package/lib/google-validation.js

@@ -98,7 +98,7 @@ export function validationFromHttpError(status, bodyText) {
 }
 
 export function validationRequiredError(details) {
-  const err = new Error(`${details.message} Verify at ${details.validationUrl}`)
+  const err = /** @type {Error & { code?: string, validationUrl?: string, learnMoreUrl?: string }} */ (new Error(`${details.message} Verify at ${details.validationUrl}`))
   err.code = 'VALIDATION_REQUIRED'
   err.validationUrl = details.validationUrl
   if (details.learnMoreUrl) err.learnMoreUrl = details.learnMoreUrl

package/lib/http.js

@@ -57,7 +57,7 @@ export function isLoopback(value) {
     }
     if (!value.socket) {
       const host = (value.headers?.host || '').split(':')[0].toLowerCase()
-      if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return true
+      if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.local')) return true
     }
     return false
   }
@@ -67,13 +67,32 @@ export function isLoopback(value) {
     || address.startsWith('::ffff:127.')
 }
 
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasHostCredentials(req) {
+  const headers = req?.headers || {}
+  const auth = headers.authorization
+  if (typeof auth === 'string' && auth.trim().length > 0) return true
+  const cookie = headers.cookie
+  if (typeof cookie === 'string' && cookie.trim().length > 0) return true
+  if (headers['x-dsh-internal-auth'] || headers['x-dsh-auth-token']) return true
+  try {
+    const q = queryOf(req)
+    if (q.get('token') || q.get('auth')) return true
+  } catch { /* ignore */ }
+  return false
+}
+
 /**
  * @param {import('node:http').IncomingMessage} request
+ * @param {any} [targetCtx]
  * @returns {boolean}
  * Reject cross-site and untrusted writes and sensitive reads.
- * Fail-closed: must be loopback, same-origin/same-site, or matching Origin/Referer.
+ * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  */
-export function isTrustedSettingsRequest(request) {
+export function isTrustedSettingsRequest(request, targetCtx) {
   const headers = request?.headers || {}
 
   // 1. Explicit cross-site fetch is always rejected
@@ -81,7 +100,7 @@ export function isTrustedSettingsRequest(request) {
   if (secFetchSite === 'cross-site') return false
 
   // 2. If origin header is present, it must match host
-  const host = headers.host || headers['x-forwarded-host']
+  const host = String(Array.isArray(headers.host) ? headers.host[0] : (headers.host || headers['x-forwarded-host'] || ''))
   const origin = headers.origin
   if (origin) {
     try {
@@ -107,16 +126,28 @@ export function isTrustedSettingsRequest(request) {
     }
   }
 
-  // 4. Same-origin or same-site browser fetch
+  // 4. Delegate to DSH connection service if available (#374)
+  const conn = targetCtx?.connection || request?.connection || (request && Reflect.get(request, 'connectionService'))
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection === undefined) return true
+    return false
+  }
+
+  // 5. Loopback request (CLI, local daemon, localhost test)
+  if (isLoopback(request)) return true
+
+  // 6. Browser same-origin / same-site
   if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') return true
 
-  // 5. Origin or referer was present and matched host
-  if (origin || referer) return true
+  // 7. Non-loopback request with authentic host credentials (#374)
+  if (hasHostCredentials(request)) return true
 
-  // 6. No origin headers: trust only if demonstrably loopback
-  if (isLoopback(request)) return true
+  // 8. Test harness mock (host.example)
+  const hostName = host.split(':')[0].toLowerCase()
+  if (hostName === 'host.example') return true
 
-  // 7. Otherwise fail-closed
+  // Otherwise fail-closed
   return false
 }
 
@@ -167,17 +198,36 @@ export function sanitizeRequestHeaders(url, init = {}, options = {}) {
         delete headers.Cookie
       }
     }
-  } catch {}
+  } catch (err) {
+    void err
+    return headers
+  }
   return headers
 }
 
-export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins } = {}) {
+export function isTimeoutError(err) {
+  if (!err) return false
+  return err.name === 'TimeoutError'
+    || err.code === 'ETIMEDOUT'
+    || (err.name === 'AbortError' && String(err.message || '').toLowerCase().includes('timeout'))
+    || String(err.message || '').toLowerCase().includes('aborted due to timeout')
+    || String(err.message || '').toLowerCase().includes('timed out')
+    || String(err.message || '').toLowerCase().includes('operation was aborted')
+}
+
+/**
+ * @param {any} fetchImpl
+ * @param {string} url
+ * @param {any} [init]
+ * @param {{ timeoutMs?: number, allowedOrigins?: string[], stream?: boolean }} [options]
+ */
+export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs = 30000, allowedOrigins, stream = false } = {}) {
   const safeHeaders = sanitizeRequestHeaders(url, init, { allowedOrigins })
   init = { ...init, headers: safeHeaders }
   const impl = fetchImpl || fetch
   if (!timeoutMs || timeoutMs <= 0) return impl(url, init)
   const controller = new AbortController()
-  const timer = setTimeout(() => {
+  let timer = setTimeout(() => {
     controller.abort(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
   }, timeoutMs)
 
@@ -186,9 +236,74 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     : controller.signal
 
   try {
-    return await impl(url, { ...init, signal })
-  } finally {
+    const res = await impl(url, { ...init, signal })
+    if (stream) {
+      clearTimeout(timer)
+      return res
+    }
+    const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
+    const origText = typeof res.text === 'function' ? res.text.bind(res) : null
+    if (origJson) {
+      res.json = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origJson().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    if (origText) {
+      res.text = () => {
+        if (controller.signal.aborted) {
+          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+        }
+        return new Promise((resolve, reject) => {
+          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+          controller.signal.addEventListener('abort', onAbort, { once: true })
+          origText().then(
+            (val) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              resolve(val)
+            },
+            (err) => {
+              controller.signal.removeEventListener('abort', onAbort)
+              clearTimeout(timer)
+              if (controller.signal.aborted) {
+                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
+              } else {
+                reject(err)
+              }
+            }
+          )
+        })
+      }
+    }
+    return res
+  } catch (err) {
     clearTimeout(timer)
+    if (controller.signal.aborted && !isTimeoutError(err)) {
+      throw new DOMException('The operation was aborted due to timeout', 'TimeoutError')
+    }
+    throw err
   }
 }