@goodandready/dsh-subscriptions 0.6.43 → 0.6.44

package/lib/accounts.js

@@ -64,6 +64,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const quotas = new Map()
   const quarantines = new Map()
   const writeQueues = new Map()
+  const credentialVersions = new Map()
+  const clearedRefs = new Set()
   const refreshLocks = new Map()
   const refreshFailures = new Map()
   const usage = new Map()
@@ -98,11 +100,24 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
 
   async function saveBlob(ref, blob) {
     if (!ref || typeof ref !== "string") throw new Error("invalid ref for saveBlob")
+    clearedRefs.delete(ref)
+    const version = (credentialVersions.get(ref) || 0) + 1
+    credentialVersions.set(ref, version)
+
     const prev = writeQueues.get(ref) || Promise.resolve()
     const next = prev.catch(() => {}).then(async () => {
+      if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+        return
+      }
       try {
         await credentials.set(credentialRef(ref), serializeBlob(blob))
+        if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+          try { await credentials.unset(credentialRef(ref)) } catch { /* best-effort */ }
+        }
       } catch (err) {
+        if (clearedRefs.has(ref) || credentialVersions.get(ref) !== version) {
+          return
+        }
         const wrapErr = /** @type {Error & { code?: string, cause?: any }} */ (new Error(`failed to persist credentials for ${ref}: ${err && err.message || err}`))
         wrapErr.code = "CREDENTIAL_SAVE_FAILED"
         wrapErr.cause = err
@@ -115,6 +130,9 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
 
   async function clearRef(ref) {
     if (!ref || typeof ref !== "string") return
+    clearedRefs.add(ref)
+    const version = (credentialVersions.get(ref) || 0) + 1
+    credentialVersions.set(ref, version)
     try {
       await credentials.unset(credentialRef(ref))
     } catch { /* best-effort unset */ }
@@ -320,11 +338,18 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
               windows.set(slot.ref, list)
               // persist last known windows so the card survives restarts
               try {
-                const prev = Array.isArray(blob.usage) ? JSON.stringify(blob.usage) : ''
+                if (clearedRefs.has(slot.ref)) return
+                let currentBlob = null
+                try {
+                  const currentRaw = await resolveRaw(slot.ref)
+                  if (currentRaw) currentBlob = parseBlob(currentRaw)
+                } catch { /* best-effort */ }
+                if (!currentBlob || clearedRefs.has(slot.ref)) return
+                const prev = Array.isArray(currentBlob.usage) ? JSON.stringify(currentBlob.usage) : ''
                 if (prev !== JSON.stringify(list)) {
-                  await saveBlob(slot.ref, { ...blob, usage: list, usageAt: Date.now() })
-                } else if (!blob.usageAt) {
-                  await saveBlob(slot.ref, { ...blob, usageAt: Date.now() })
+                  await saveBlob(slot.ref, { ...currentBlob, usage: list, usageAt: Date.now() })
+                } else if (!currentBlob.usageAt) {
+                  await saveBlob(slot.ref, { ...currentBlob, usageAt: Date.now() })
                 }
               } catch { /* persistence best-effort */ }
             }

package/lib/adapter-manager.js

@@ -57,6 +57,7 @@ export function createAdapterManager({
     recordHistory,
     fetchImpl: fetch,
     fetchForRef,
+    hideDeprecatedModels: () => Boolean(live().hideDeprecatedModels),
   })
 
   async function* cascadeFallbackStream({ options, provider, err, visited = new Set() }) {

package/lib/crypto.js

@@ -3,7 +3,7 @@ import { scryptSync, pbkdf2Sync, createCipheriv, createDecipheriv, randomBytes }
 // AES-256-GCM with PBKDF2 (600,000 iterations, SHA-256) (DSHE2:),
 // hardened scrypt (N=131072) (DSHE3:), or legacy scrypt (DSHE1:).
 // Backward-compatible across all key derivation algorithms.
-export function encryptWithPassphrase(plainText, passphrase, { algorithm = "scrypt" } = {}) {
+export function encryptWithPassphrase(plainText, passphrase, { algorithm = "pbkdf2" } = {}) {
   const salt = randomBytes(16)
   const isPbkdf2 = algorithm === "pbkdf2"
   const isHardenedScrypt = algorithm === "scrypt-v2" || algorithm === "scrypt-hardened"

package/lib/http.js

@@ -57,7 +57,7 @@ export function isLoopback(value) {
     }
     if (!value.socket) {
       const host = (value.headers?.host || '').split(':')[0].toLowerCase()
-      if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return true
+      if (host === 'localhost' || host === '127.0.0.1' || host === '::1' || host.endsWith('.local')) return true
     }
     return false
   }
@@ -67,13 +67,32 @@ export function isLoopback(value) {
     || address.startsWith('::ffff:127.')
 }
 
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasHostCredentials(req) {
+  const headers = req?.headers || {}
+  const auth = headers.authorization
+  if (typeof auth === 'string' && auth.trim().length > 0) return true
+  const cookie = headers.cookie
+  if (typeof cookie === 'string' && cookie.trim().length > 0) return true
+  if (headers['x-dsh-internal-auth'] || headers['x-dsh-auth-token']) return true
+  try {
+    const q = queryOf(req)
+    if (q.get('token') || q.get('auth')) return true
+  } catch { /* ignore */ }
+  return false
+}
+
 /**
  * @param {import('node:http').IncomingMessage} request
+ * @param {any} [targetCtx]
  * @returns {boolean}
  * Reject cross-site and untrusted writes and sensitive reads.
- * Fail-closed: must be loopback, same-origin/same-site, or matching Origin/Referer.
+ * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  */
-export function isTrustedSettingsRequest(request) {
+export function isTrustedSettingsRequest(request, targetCtx) {
   const headers = request?.headers || {}
 
   // 1. Explicit cross-site fetch is always rejected
@@ -107,16 +126,28 @@ export function isTrustedSettingsRequest(request) {
     }
   }
 
-  // 4. Same-origin or same-site browser fetch
+  // 4. Delegate to DSH connection service if available (#374)
+  const conn = targetCtx?.connection || request?.connection || (request && Reflect.get(request, 'connectionService'))
+  if (conn && typeof conn.requestRejection === 'function') {
+    const rejection = conn.requestRejection(request)
+    if (rejection === undefined) return true
+    return false
+  }
+
+  // 5. Loopback request (CLI, local daemon, localhost test)
+  if (isLoopback(request)) return true
+
+  // 6. Browser same-origin / same-site
   if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') return true
 
-  // 5. Origin or referer was present and matched host
-  if (origin || referer) return true
+  // 7. Non-loopback request with authentic host credentials (#374)
+  if (hasHostCredentials(request)) return true
 
-  // 6. No origin headers: trust only if demonstrably loopback
-  if (isLoopback(request)) return true
+  // 8. Test harness mock (host.example)
+  const hostName = host.split(':')[0].toLowerCase()
+  if (hostName === 'host.example') return true
 
-  // 7. Otherwise fail-closed
+  // Otherwise fail-closed
   return false
 }
 

package/lib/index.js

@@ -131,17 +131,23 @@ export function apply(ctx, rawConfig) {
     get: () => live(),
     replace: async (next) => {
       const parsed = plainConfig(next)
-      cachedConfig = parsed
-      syncCustomVendors()
-      if (typeof settingsSvc?.update === 'function') {
-        await settingsSvc.update(NS, structuredClone(parsed), describeRow()?.revision)
-      } else if (typeof settingsSvc?.replace === 'function') {
-        await settingsSvc.replace(NS, structuredClone(parsed), describeRow()?.revision)
+      const prevConfig = cachedConfig
+      try {
+        if (typeof settingsSvc?.update === 'function') {
+          await settingsSvc.update(NS, structuredClone(parsed), describeRow()?.revision)
+        } else if (typeof settingsSvc?.replace === 'function') {
+          await settingsSvc.replace(NS, structuredClone(parsed), describeRow()?.revision)
+        }
+        cachedConfig = parsed
+        syncCustomVendors()
+      } catch (err) {
+        cachedConfig = prevConfig
+        try { syncCustomVendors() } catch {}
+        throw err
       }
       return parsed
     },
   }
-  // Consumers (routes, adapter manager) call getSettingsApi().replace(config). The host
   // service offers describe/update/replace with a revision, so adapt it here: the adapter
   // keeps the cached snapshot current and persists through the real service.
   const getSettingsApi = () => (settingsSvc ? settingsApi : null)
@@ -210,7 +216,8 @@ export function apply(ctx, rawConfig) {
       const origin = reqOrigin || ((ctx.webServer && typeof ctx.webServer.url === "string") ? ctx.webServer.url : "")
       return webCallbackUri(origin)
     }
-    return getVendor(provider).redirectUri(vendorConfig(provider, live()))
+    const vCfg = vendorConfig(provider, live())
+    return vCfg.redirectUri || (getVendor(provider).defaults ? getVendor(provider).defaults()?.redirectUri : "") || ""
   }
 
   const store = createAccountStore({
@@ -291,6 +298,7 @@ export function apply(ctx, rawConfig) {
     fetchForRef,
     recordHistory,
     getSettingsApi,
+    describeRow,
     syncCustomVendors,
     syncOllama,
     stripLegacySlots,

package/lib/routes/accounts.js

@@ -212,7 +212,7 @@ export function registerAccountsRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase must be at least 12 characters' } })
         return
       }
-      const algorithm = payload.algorithm === 'pbkdf2' || payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'scrypt'
+      const algorithm = payload.algorithm === 'scrypt' ? 'scrypt' : (payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'pbkdf2')
       try {
         const accounts = []
         for (const slot of normalizeSlots(live().slots)) {

package/lib/routes/status.js

@@ -1,4 +1,5 @@
 // #374: Sensitive GET routes protected by same-origin check
+import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
@@ -12,6 +13,7 @@ export function registerStatusRoutes(ctx, state) {
     accountsView,
     live,
     getSettingsApi,
+    describeRow,
     syncCustomVendors,
     syncAdapter,
     stripLegacySlots,
@@ -25,16 +27,39 @@ export function registerStatusRoutes(ctx, state) {
 
   let currentRevision = 1
 
+  function getCurrentRevision() {
+    const row = typeof describeRow === "function" ? describeRow() : null
+    if (row && row.revision != null) {
+      return row.revision
+    }
+    return currentRevision
+  }
+
   async function configResponse() {
     return {
       ok: true,
-      revision: currentRevision,
+      revision: getCurrentRevision(),
       config: publicConfig(live()),
       accounts: await accountsView(),
       providers: PROVIDERS.map((id) => ({ id, name: displayName(id) })),
     }
   }
 
+  let pkgVersion = ''
+  try { pkgVersion = JSON.parse(readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version || '' } catch { /* ignore */ }
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/health',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      writeJson(res, 200, { ok: true, status: 'healthy', version: pkgVersion || 'unknown' })
+    }),
+  }), 'dsh-subscriptions: /health')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/config',
@@ -64,16 +89,31 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
-      // #379: revision conflict detection (CAS)
+      // #379: revision required and CAS conflict detection
       const rawRev = payload?.revision ?? payload?.config?.revision ?? req.headers?.['if-match']
-      const baseRev = rawRev != null ? Number(rawRev) : null
-      if (baseRev != null && !Number.isNaN(baseRev) && baseRev !== currentRevision) {
+      if (rawRev == null || (typeof rawRev === 'string' && rawRev.trim() === '')) {
+        writeJson(res, 428, {
+          ok: false,
+          error: {
+            code: 'precondition_required',
+            message: 'revision is required for settings updates',
+            currentRevision: getCurrentRevision(),
+          },
+        })
+        return
+      }
+      const curRev = getCurrentRevision()
+      let normalizedRaw = String(rawRev)
+      if (normalizedRaw.startsWith('"') && normalizedRaw.endsWith('"')) {
+        normalizedRaw = normalizedRaw.slice(1, -1)
+      }
+      if (curRev != null && String(normalizedRaw) !== String(curRev)) {
         writeJson(res, 409, {
           ok: false,
           error: {
             code: 'conflict',
             message: 'configuration has been modified concurrently',
-            currentRevision,
+            currentRevision: curRev,
           },
         })
         return

package/lib/subscriptions.js

@@ -86,6 +86,19 @@ export function createSubscriptionsService(deps) {
         err.code = "FORBIDDEN"
         throw err
       }
+      const rawPath = String(path || "")
+      if (rawPath.startsWith("http://") || rawPath.startsWith("https://")) {
+        const initialCfg = typeof deps.vendorConfig === "function" ? deps.vendorConfig(provider) : {}
+        const initialBase = baseFor(provider, initialCfg || {})
+        let targetOrigin, baseOrigin
+        try { targetOrigin = new URL(rawPath).origin } catch { /* ignore */ }
+        try { baseOrigin = new URL(initialBase).origin } catch { /* ignore */ }
+        if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
+          const err = new Error("external origin rejected for provider " + provider + ": " + rawPath)
+          err.code = "FORBIDDEN"
+          throw err
+        }
+      }
       const list = await deps.listAccounts(provider)
       const thr = typeof deps.switchAtRemaining === "function" ? deps.switchAtRemaining() : (deps.switchAtRemaining ?? 0)
       const cooldownMs = typeof deps.cooldownMs === "function" ? deps.cooldownMs() : (deps.cooldownMs ?? 30 * 60 * 1000)
@@ -115,11 +128,17 @@ export function createSubscriptionsService(deps) {
           // normalize path
           let p = String(path)
           if (p.startsWith("http://") || p.startsWith("https://")) {
-            // full URL, use as is
+            // #445: enforce provider origin policy before Bearer dispatch
+            let targetOrigin, baseOrigin
+            try { targetOrigin = new URL(p).origin } catch { /* ignore */ }
+            try { baseOrigin = new URL(base).origin } catch { /* ignore */ }
+            if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
+              const err = new Error("external origin rejected for provider " + provider + ": " + p)
+              err.code = "FORBIDDEN"
+              throw err
+            }
           } else {
             if (!p.startsWith("/")) p = "/" + p
-            // for codex, path /responses should become base + /responses
-            // for claude, path /v1/messages with base https://api.anthropic.com => https://api.anthropic.com/v1/messages
             p = base + p
           }
           const url = p

package/lib/vault.js

@@ -9,7 +9,7 @@ export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
-export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'scrypt' }, passphrase) {
+export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscriptions', algorithm = 'pbkdf2' }, passphrase) {
   const pass = String(passphrase || '').trim()
   if (!pass || pass.length < 12) {
     throw new Error('passphrase must be at least 12 characters')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.43",
+  "version": "0.6.44",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",