@goodandready/dsh-subscriptions 0.6.41 → 0.6.44

package/lib/import-auth.js

@@ -39,6 +39,7 @@ async function discoverLocalCliSessionsInner() {
     const tok = codex.tokens || codex
     detected.codex = {
       provider: 'codex',
+      source: 'file',
       path: homeFile('.codex', 'auth.json'),
       email: codex.email || codex.account || '',
       hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -54,6 +55,7 @@ async function discoverLocalCliSessionsInner() {
     if (grok && (grok.access_token || grok.token || (grok.tokens && grok.tokens.access_token))) {
       detected.grok = {
         provider: 'grok',
+        source: 'file',
         path: p,
         email: grok.email || grok.account || '',
         hasRefreshToken: !!(grok.refresh_token || (grok.tokens && grok.tokens.refresh_token)),
@@ -73,6 +75,7 @@ async function discoverLocalCliSessionsInner() {
     if (tok && (tok.access_token || tok.accessToken)) {
       detected.antigravity = {
         provider: 'antigravity',
+        source: 'file',
         path: p,
         email: agy.email || tok.account || '',
         hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
@@ -86,6 +89,7 @@ async function discoverLocalCliSessionsInner() {
   if (kimi && (kimi.access_token || kimi.token)) {
     detected.kimi = {
       provider: 'kimi',
+      source: 'file',
       path: homeFile('.kimi-code', 'credentials', 'kimi-code.json'),
       email: kimi.email || kimi.account || '',
       hasRefreshToken: !!(kimi.refresh_token || kimi.refreshToken),
@@ -103,6 +107,7 @@ async function discoverLocalCliSessionsInner() {
     if (glm && (glm.apiKey || glm.api_key || (glm.provider && glm.provider.apiKey))) {
       detected.glm = {
         provider: 'glm',
+        source: 'file',
         path: p,
         email: 'ZCode CLI Account',
         hasRefreshToken: false,
@@ -111,20 +116,31 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  // 6. Cursor Token (env, CLI config or IDE state)
+  // 6. Cursor Token (CLI config, auth.json, or env)
   const cursorCliConfig = await readJson(homeFile('.cursor', 'cli-config.json'))
-  if (process.env.CURSOR_ACCESS_TOKEN) {
+  const cursorAuthConfig = await readJson(homeFile('.cursor', 'auth.json'))
+  if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
     detected.cursor = {
       provider: 'cursor',
-      path: 'CURSOR_ACCESS_TOKEN env',
-      email: 'Cursor IDE User',
+      source: 'file',
+      path: homeFile('.cursor', 'cli-config.json'),
+      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
       hasRefreshToken: false,
     }
-  } else if (cursorCliConfig && (cursorCliConfig.authInfo || cursorCliConfig.serverConfigCache)) {
+  } else if (cursorAuthConfig && (cursorAuthConfig.accessToken || cursorAuthConfig.access_token || (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.authId))) {
     detected.cursor = {
       provider: 'cursor',
-      path: homeFile('.cursor', 'cli-config.json'),
-      email: (cursorCliConfig.authInfo && cursorCliConfig.authInfo.email) || 'Cursor CLI User',
+      source: 'file',
+      path: homeFile('.cursor', 'auth.json'),
+      email: (cursorAuthConfig.authInfo && cursorAuthConfig.authInfo.email) || cursorAuthConfig.email || 'Cursor User',
+      hasRefreshToken: false,
+    }
+  } else if (process.env.CURSOR_ACCESS_TOKEN) {
+    detected.cursor = {
+      provider: 'cursor',
+      source: 'env',
+      path: 'CURSOR_ACCESS_TOKEN',
+      email: 'Cursor IDE User',
       hasRefreshToken: false,
     }
   }
@@ -139,6 +155,7 @@ async function discoverLocalCliSessionsInner() {
     if (k && (k.accessToken || k.access_token || k.token)) {
       detected.kiro = {
         provider: 'kiro',
+        source: 'file',
         path: p,
         email: k.email || k.account || 'AWS Kiro User',
         hasRefreshToken: !!(k.refreshToken || k.refresh_token),
@@ -149,7 +166,8 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.kiro && process.env.KIRO_API_KEY) {
     detected.kiro = {
       provider: 'kiro',
-      path: 'KIRO_API_KEY env',
+      source: 'env',
+      path: 'KIRO_API_KEY',
       email: 'AWS Kiro API Key',
       hasRefreshToken: false,
     }
@@ -158,12 +176,15 @@ async function discoverLocalCliSessionsInner() {
   // 8. Claude CLI Direct Import
   const claudeCreds = await readClaudeCredentials(activeHome)
   if (claudeCreds) {
-    detected['claude-cli'] = {
+    const claudeEntry = {
       provider: 'claude',
+      source: 'file',
       path: homeFile('.claude', 'credentials.json'),
-      email: 'Claude Code CLI User',
+      email: claudeCreds.email || 'Claude Code CLI User',
       hasRefreshToken: !!claudeCreds.refreshToken,
     }
+    detected.claude = claudeEntry
+    detected['claude-cli'] = claudeEntry
   }
 
   // 9. GitHub Copilot token
@@ -179,6 +200,7 @@ async function discoverLocalCliSessionsInner() {
       if (tok) {
         detected.copilot = {
           provider: 'copilot',
+          source: 'file',
           path: p,
           email: gh.user || 'GitHub Copilot User',
           hasRefreshToken: false,
@@ -190,37 +212,37 @@ async function discoverLocalCliSessionsInner() {
   if (!detected.copilot && (process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN)) {
     detected.copilot = {
       provider: 'copilot',
-      path: 'GITHUB_COPILOT_TOKEN env',
+      source: 'env',
+      path: process.env.GITHUB_COPILOT_TOKEN ? 'GITHUB_COPILOT_TOKEN' : 'GH_TOKEN',
       email: 'GitHub Copilot User',
       hasRefreshToken: false,
     }
   }
 
-
-
   return detected
 }
 
 export async function loadLocalCliBlob(provider, options = {}) {
+  const canonical = (provider === 'claude-cli') ? 'claude' : provider
   const discovered = await discoverLocalCliSessions(options)
-  const info = discovered[provider]
+  const info = discovered[canonical] || discovered[provider]
   if (!info) throw new Error(`no local CLI session found for ${provider}`)
 
-  if (provider === 'claude-cli' || (provider === 'claude' && info.provider === 'claude')) {
+  if (canonical === 'claude') {
     const creds = await readClaudeCredentials(options && options.home)
     if (!creds) throw new Error('Claude CLI credentials not found')
     return {
       accessToken: creds.accessToken,
-      refreshToken: creds.refreshToken,
+      refreshToken: creds.refreshToken || '',
       expiresAt: creds.expiresAt,
-      email: 'Claude Code CLI User'
+      email: creds.email || 'Claude Code CLI User',
     }
   }
 
-  if (provider === 'copilot') {
+  if (canonical === 'copilot') {
     let tok = process.env.GITHUB_COPILOT_TOKEN || process.env.GH_TOKEN || ''
     let email = 'GitHub Copilot User'
-    if (info.path && info.path !== 'GITHUB_COPILOT_TOKEN env') {
+    if (info.source === 'file' && info.path) {
       const cp = await readJson(info.path)
       if (cp) {
         const gh = cp['github.com'] || cp
@@ -228,6 +250,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
         email = gh.user || email
       }
     }
+    if (!tok) throw new Error('no Copilot token found')
     return {
       accessToken: tok,
       refreshToken: tok,
@@ -238,10 +261,54 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
+  if (canonical === 'cursor') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'CURSOR_ACCESS_TOKEN') {
+      const token = process.env.CURSOR_ACCESS_TOKEN
+      if (!token) throw new Error('CURSOR_ACCESS_TOKEN environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'Cursor IDE User',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || process.env.CURSOR_ACCESS_TOKEN || ''
+    return {
+      accessToken: token,
+      refreshToken: '',
+      expiresAt: Date.now() + 30 * 86400 * 1000,
+      email: (raw && raw.authInfo && raw.authInfo.email) || raw.email || 'Cursor User',
+    }
+  }
+
+  if (canonical === 'kiro') {
+    if (info.source === 'env' || !info.path || info.path.includes('env') || info.path === 'KIRO_API_KEY') {
+      const token = process.env.KIRO_API_KEY
+      if (!token) throw new Error('KIRO_API_KEY environment variable not set')
+      return {
+        accessToken: token,
+        refreshToken: '',
+        expiresAt: Date.now() + 30 * 86400 * 1000,
+        email: 'AWS Kiro API Key',
+      }
+    }
+    const raw = await readJson(info.path)
+    if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
+    const token = (raw && (raw.accessToken || raw.access_token || raw.token)) || process.env.KIRO_API_KEY || ''
+    return {
+      accessToken: token,
+      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
+      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
+      email: (raw && raw.email) || 'AWS Kiro User',
+    }
+  }
+
   const raw = await readJson(info.path)
   if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
 
-  if (provider === 'codex') {
+  if (canonical === 'codex') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -252,7 +319,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'grok') {
+  if (canonical === 'grok') {
     const tok = raw.tokens || raw
     return {
       accessToken: tok.access_token || tok.token || '',
@@ -262,7 +329,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'antigravity') {
+  if (canonical === 'antigravity') {
     const tok = raw.token || raw
     return {
       accessToken: tok.access_token || tok.accessToken || '',
@@ -273,7 +340,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'kimi') {
+  if (canonical === 'kimi') {
     return {
       accessToken: raw.access_token || raw.token || '',
       refreshToken: raw.refresh_token || '',
@@ -282,7 +349,7 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'glm') {
+  if (canonical === 'glm') {
     const apiKey = raw.apiKey || raw.api_key || (raw.provider && raw.provider.apiKey) || ''
     return {
       accessToken: apiKey,
@@ -292,25 +359,5 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  if (provider === 'cursor') {
-    const token = process.env.CURSOR_ACCESS_TOKEN || (raw && (raw.accessToken || raw.access_token || (raw.authInfo && raw.authInfo.authId))) || ''
-    return {
-      accessToken: token,
-      refreshToken: '',
-      expiresAt: Date.now() + 30 * 86400 * 1000,
-      email: (raw && raw.authInfo && raw.authInfo.email) || 'Cursor User',
-    }
-  }
-
-  if (provider === 'kiro') {
-    const token = process.env.KIRO_API_KEY || (raw && (raw.accessToken || raw.access_token || raw.token)) || ''
-    return {
-      accessToken: token,
-      refreshToken: (raw && (raw.refreshToken || raw.refresh_token)) || '',
-      expiresAt: (raw && raw.expiresAt) || (Date.now() + 30 * 86400 * 1000),
-      email: (raw && raw.email) || 'AWS Kiro User',
-    }
-  }
-
   throw new Error(`unsupported local CLI import for provider ${provider}`)
 }

package/lib/index.js

@@ -131,17 +131,23 @@ export function apply(ctx, rawConfig) {
     get: () => live(),
     replace: async (next) => {
       const parsed = plainConfig(next)
-      cachedConfig = parsed
-      syncCustomVendors()
-      if (typeof settingsSvc?.update === 'function') {
-        await settingsSvc.update(NS, structuredClone(parsed), describeRow()?.revision)
-      } else if (typeof settingsSvc?.replace === 'function') {
-        await settingsSvc.replace(NS, structuredClone(parsed), describeRow()?.revision)
+      const prevConfig = cachedConfig
+      try {
+        if (typeof settingsSvc?.update === 'function') {
+          await settingsSvc.update(NS, structuredClone(parsed), describeRow()?.revision)
+        } else if (typeof settingsSvc?.replace === 'function') {
+          await settingsSvc.replace(NS, structuredClone(parsed), describeRow()?.revision)
+        }
+        cachedConfig = parsed
+        syncCustomVendors()
+      } catch (err) {
+        cachedConfig = prevConfig
+        try { syncCustomVendors() } catch {}
+        throw err
       }
       return parsed
     },
   }
-  // Consumers (routes, adapter manager) call getSettingsApi().replace(config). The host
   // service offers describe/update/replace with a revision, so adapt it here: the adapter
   // keeps the cached snapshot current and persists through the real service.
   const getSettingsApi = () => (settingsSvc ? settingsApi : null)
@@ -210,7 +216,8 @@ export function apply(ctx, rawConfig) {
       const origin = reqOrigin || ((ctx.webServer && typeof ctx.webServer.url === "string") ? ctx.webServer.url : "")
       return webCallbackUri(origin)
     }
-    return getVendor(provider).redirectUri(vendorConfig(provider, live()))
+    const vCfg = vendorConfig(provider, live())
+    return vCfg.redirectUri || (getVendor(provider).defaults ? getVendor(provider).defaults()?.redirectUri : "") || ""
   }
 
   const store = createAccountStore({
@@ -291,6 +298,7 @@ export function apply(ctx, rawConfig) {
     fetchForRef,
     recordHistory,
     getSettingsApi,
+    describeRow,
     syncCustomVendors,
     syncOllama,
     stripLegacySlots,

package/lib/oauth.js

@@ -1,3 +1,15 @@
+/**
+ * @param {{
+ *   authUrl: string,
+ *   clientId: string,
+ *   redirectUri: string,
+ *   challenge: string,
+ *   state: string,
+ *   extra?: Record<string, any>,
+ *   scope?: string,
+ * }} params
+ * @returns {string}
+ */
 export function buildAuthorizeUrl({
   authUrl,
   clientId,

package/lib/routes/accounts.js

@@ -143,7 +143,9 @@ export function registerAccountsRoutes(ctx, state) {
       } catch {
         body = null
       }
-      if (!body || !body.provider || !isProvider(body.provider)) {
+      const rawProv = body && body.provider
+      const prov = (rawProv === 'claude-cli') ? 'claude' : rawProv
+      if (!prov || !isProvider(prov)) {
         writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'unknown or missing provider' } })
         return
       }
@@ -153,9 +155,8 @@ export function registerAccountsRoutes(ctx, state) {
         return
       }
       try {
-        const blob = await loadLocalCliBlob(body.provider)
-        const prov = body.provider
-        const idx = Number(body.index) || 1
+        const blob = await loadLocalCliBlob(prov)
+        const idx = idxNum
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {
@@ -211,7 +212,7 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase must be at least 12 characters' } })
         return
       }
-      const algorithm = payload.algorithm === 'pbkdf2' || payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'scrypt'
+      const algorithm = payload.algorithm === 'scrypt' ? 'scrypt' : (payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'pbkdf2')
       try {
         const accounts = []
         for (const slot of normalizeSlots(live().slots)) {

package/lib/routes/status.js

@@ -1,8 +1,9 @@
 // #374: Sensitive GET routes protected by same-origin check
+import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -12,6 +13,7 @@ export function registerStatusRoutes(ctx, state) {
     accountsView,
     live,
     getSettingsApi,
+    describeRow,
     syncCustomVendors,
     syncAdapter,
     stripLegacySlots,
@@ -25,16 +27,39 @@ export function registerStatusRoutes(ctx, state) {
 
   let currentRevision = 1
 
+  function getCurrentRevision() {
+    const row = typeof describeRow === "function" ? describeRow() : null
+    if (row && row.revision != null) {
+      return row.revision
+    }
+    return currentRevision
+  }
+
   async function configResponse() {
     return {
       ok: true,
-      revision: currentRevision,
+      revision: getCurrentRevision(),
       config: publicConfig(live()),
       accounts: await accountsView(),
       providers: PROVIDERS.map((id) => ({ id, name: displayName(id) })),
     }
   }
 
+  let pkgVersion = ''
+  try { pkgVersion = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version || '' } catch { /* ignore */ }
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/health',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      writeJson(res, 200, { ok: true, status: 'healthy', version: pkgVersion || 'unknown' })
+    }),
+  }), 'dsh-subscriptions: /health')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/config',
@@ -64,16 +89,31 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
-      // #379: revision conflict detection (CAS)
+      // #379: revision required and CAS conflict detection
       const rawRev = payload?.revision ?? payload?.config?.revision ?? req.headers?.['if-match']
-      const baseRev = rawRev != null ? Number(rawRev) : null
-      if (baseRev != null && !Number.isNaN(baseRev) && baseRev !== currentRevision) {
+      if (rawRev == null || (typeof rawRev === 'string' && rawRev.trim() === '')) {
+        writeJson(res, 428, {
+          ok: false,
+          error: {
+            code: 'precondition_required',
+            message: 'revision is required for settings updates',
+            currentRevision: getCurrentRevision(),
+          },
+        })
+        return
+      }
+      const curRev = getCurrentRevision()
+      let normalizedRaw = String(rawRev)
+      if (normalizedRaw.startsWith('"') && normalizedRaw.endsWith('"')) {
+        normalizedRaw = normalizedRaw.slice(1, -1)
+      }
+      if (curRev != null && String(normalizedRaw) !== String(curRev)) {
         writeJson(res, 409, {
           ok: false,
           error: {
             code: 'conflict',
             message: 'configuration has been modified concurrently',
-            currentRevision,
+            currentRevision: curRev,
           },
         })
         return
@@ -257,10 +297,8 @@ export function registerStatusRoutes(ctx, state) {
       }
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const timeoutSignal = AbortSignal.timeout(15_000)
-        const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
         const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await doFetch(url, { ...init, signal })
+        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -272,12 +310,14 @@ export function registerStatusRoutes(ctx, state) {
         const latencyMs = Date.now() - t0;
         writeJson(res, 200, { ok: true, provider, index: index, ref, latencyMs, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
       } catch (e) {
+        const isTimeout = isTimeoutError(e)
         writeJson(res, 200, {
           ok: false, provider, index: index, ref,
           latencyMs: Date.now() - t0,
           email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: capturedQuota || info.quota || null,
-          error: { code: e && e.code ? e.code : 'VENDOR', message: String(e && e.message || e).slice(0, 300) },
+          isTimeout,
+          error: { code: isTimeout ? 'TIMEOUT' : (e && e.code ? e.code : 'VENDOR'), message: String(e && e.message || e).slice(0, 300) },
         })
       }
     }),
@@ -384,10 +424,8 @@ export function registerStatusRoutes(ctx, state) {
       if (typeof vendor.check === 'function') {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
-          const timeoutSignal = AbortSignal.timeout(15_000)
-          const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await doFetch(url, { ...init, signal })
+          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/runaway-guard.js

@@ -68,6 +68,11 @@ export class RunawayDetector {
   }
 }
 
+/**
+ * @param {AsyncIterable<any>} stream
+ * @param {Record<string, any>} [options]
+ * @returns {AsyncGenerator<any, void, unknown>}
+ */
 export async function* withRunawayGuard(stream, options = {}) {
   if (options && options.enabled === false) {
     yield* stream

package/lib/session-pin.js

@@ -2,10 +2,8 @@ const sessionPins = new Map()
 const DEFAULT_TTL_MS = 30 * 60 * 1000 // 30 mins
 
 /**
- * Bind a session id to an account ref for ttlMs (default 30 minutes).
- * @param {string|undefined} sessionId
- * @param {string|undefined} accountRef
- * @param {number} [ttlMs]
+ * Prune expired session pin entries.
+ * @param {number} [now]
  * @returns {void}
  */
 export function pruneSessionPins(now = Date.now()) {
@@ -16,6 +14,13 @@ export function pruneSessionPins(now = Date.now()) {
   }
 }
 
+/**
+ * Bind a session id to an account ref for ttlMs (default 30 minutes).
+ * @param {string|undefined} sessionId
+ * @param {string|undefined} accountRef
+ * @param {number} [ttlMs]
+ * @returns {void}
+ */
 export function pinSession(sessionId, accountRef, ttlMs = DEFAULT_TTL_MS) {
   if (!sessionId || !accountRef) return
   if (sessionPins.size >= 50) {

package/lib/sse.js

@@ -1,3 +1,8 @@
+/**
+ * @param {any} body
+ * @param {{ idleTimeoutMs?: number, signal?: AbortSignal }} [options]
+ * @returns {AsyncGenerator<string, void, unknown>}
+ */
 export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {}) {
   const reader = body && typeof body.getReader === 'function' ? body.getReader() : null
   const decoder = new TextDecoder()
@@ -38,7 +43,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     const timeoutPromise = new Promise((_, reject) => {
       if (!idleTimeoutMs || idleTimeoutMs <= 0) return
       timer = setTimeout(() => {
-        const err = new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`)
+        const err = /** @type {Error & { code?: string }} */ (new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`))
         err.code = 'TIMEOUT'
         reject(err)
       }, idleTimeoutMs)

package/lib/stream-rotate.js

@@ -41,7 +41,7 @@ export async function* streamWithRotation({
         return
       }
       if (lastError) throw lastError
-      const err = new Error('no usable subscription account for this provider')
+      const err = /** @type {Error & { code?: string }} */ (new Error('no usable subscription account for this provider'))
       err.code = 'RATE_LIMIT'
       throw err
     }

package/lib/subscriptions.js

@@ -86,6 +86,19 @@ export function createSubscriptionsService(deps) {
         err.code = "FORBIDDEN"
         throw err
       }
+      const rawPath = String(path || "")
+      if (rawPath.startsWith("http://") || rawPath.startsWith("https://")) {
+        const initialCfg = typeof deps.vendorConfig === "function" ? deps.vendorConfig(provider) : {}
+        const initialBase = baseFor(provider, initialCfg || {})
+        let targetOrigin, baseOrigin
+        try { targetOrigin = new URL(rawPath).origin } catch { /* ignore */ }
+        try { baseOrigin = new URL(initialBase).origin } catch { /* ignore */ }
+        if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
+          const err = new Error("external origin rejected for provider " + provider + ": " + rawPath)
+          err.code = "FORBIDDEN"
+          throw err
+        }
+      }
       const list = await deps.listAccounts(provider)
       const thr = typeof deps.switchAtRemaining === "function" ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0)
       const cooldownMs = typeof deps.cooldownMs === "function" ? deps.cooldownMs() : (deps.cooldownMs ?? 30 * 60 * 1000)
@@ -115,11 +128,17 @@ export function createSubscriptionsService(deps) {
           // normalize path
           let p = String(path)
           if (p.startsWith("http://") || p.startsWith("https://")) {
-            // full URL, use as is
+            // #445: enforce provider origin policy before Bearer dispatch
+            let targetOrigin, baseOrigin
+            try { targetOrigin = new URL(p).origin } catch { /* ignore */ }
+            try { baseOrigin = new URL(base).origin } catch { /* ignore */ }
+            if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
+              const err = new Error("external origin rejected for provider " + provider + ": " + p)
+              err.code = "FORBIDDEN"
+              throw err
+            }
           } else {
             if (!p.startsWith("/")) p = "/" + p
-            // for codex, path /responses should become base + /responses
-            // for claude, path /v1/messages with base https://api.anthropic.com => https://api.anthropic.com/v1/messages
             p = base + p
           }
           const url = p

package/lib/vault.js

@@ -9,7 +9,7 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
-export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
+export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'pbkdf2' }, passphrase) {
   const pass = String(passphrase || '').trim()
   if (!pass || pass.length < 12) {
     throw new Error('passphrase must be at least 12 characters')