@goodandready/dsh-subscriptions 0.6.53 → 0.6.55

package/lib/adapter-manager.js

@@ -42,6 +42,8 @@ export function createAdapterManager({
     vendorConfig: (provider) => vendorConfig(provider, live()),
     cooldownMs: () => live().cooldownMs,
     autoPacing: () => live().autoPacing,
+    drainBeforeReset: () => live().drainBeforeReset,
+    drainSafetyPercent: () => live().drainSafetyPercent,
     switchAtRemaining: () => live().switchAtRemaining,
     rememberCooldown: (ref, until, families) => store.rememberCooldown(ref, until, families),
     rememberQuarantine: (ref, reason, until, attempts) => store.rememberQuarantine(ref, reason, until, attempts),

package/lib/adapter.js

@@ -121,7 +121,18 @@ export class SubscriptionAdapter extends LlmAdapter {
       const effectiveAutoPacing = options.autoPacing !== undefined
         ? options.autoPacing
         : (typeof deps.autoPacing === 'function' ? deps.autoPacing() : (deps.autoPacing ?? true))
-      const streamOptions = { ...options, autoPacing: effectiveAutoPacing }
+      const effectiveDrainBeforeReset = options.drainBeforeReset !== undefined
+        ? options.drainBeforeReset
+        : (typeof deps.drainBeforeReset === 'function' ? deps.drainBeforeReset() : (deps.drainBeforeReset ?? false))
+      const effectiveDrainSafetyPercent = options.drainSafetyPercent !== undefined
+        ? options.drainSafetyPercent
+        : (typeof deps.drainSafetyPercent === 'function' ? deps.drainSafetyPercent() : (deps.drainSafetyPercent ?? 5))
+      const streamOptions = {
+        ...options,
+        autoPacing: effectiveAutoPacing,
+        drainBeforeReset: effectiveDrainBeforeReset,
+        drainSafetyPercent: effectiveDrainSafetyPercent,
+      }
       for await (const event of streamWithRotation({
         accounts: await deps.listAccounts(provider),
         nowMs: () => Date.now(),

package/lib/config-schema.js

@@ -94,6 +94,10 @@ export const Config = z.object({
     .description('#351 Quota usage percentage thresholds for firing alerts.'),
   autoPacing: z.boolean().volatile().default(true)
     .description('#352 Predictive burn-rate load balancing between accounts.'),
+  drainBeforeReset: z.boolean().volatile().default(false)
+    .description('#485 Prioritize accounts with closest reset window to burn expiring quota first.'),
+  drainSafetyPercent: z.number().volatile().default(5)
+    .description('#485 Safety margin percent: avoid draining accounts below this threshold when alternatives exist.'),
   customVendors: z.array(z.any()).volatile().default([])
     .description('Declarative OpenAI-Responses-compatible providers. See README.'),
 })

package/lib/forecast.js

@@ -125,3 +125,19 @@ export function computePacingRisk(remainingPercent, pacePerHour, resetsAt, now =
     pacingRisk: hoursUntilExhaustion < 1 ? 50 : 0,
   }
 }
+
+// #485: Smart Quota Drainer urgency calculation
+export function calculateBurnUrgency(remainingPercent, resetAt, nowMs = Date.now(), safetyFloor = 5) {
+  const rem = Number(remainingPercent)
+  if (!Number.isFinite(rem) || rem <= 0) return 0
+  const floor = Number(safetyFloor) || 0
+  if (rem <= floor) return 0
+
+  const reset = Number(resetAt)
+  if (!Number.isFinite(reset) || reset <= nowMs) return 0
+
+  const hoursUntilReset = (reset - nowMs) / HOUR_MS
+  // Denominator clamped to minimum 0.05 hours (3 mins) to avoid infinity
+  const clampedHours = Math.max(hoursUntilReset, 0.05)
+  return rem / clampedHours
+}

package/lib/http.js

@@ -1,3 +1,5 @@
+import { timingSafeEqual } from 'node:crypto'
+
 export function writeJson(res, code, body) {
   try {
     res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
@@ -12,6 +14,14 @@ export function writeHtml(res, code, html) {
   } catch { /* socket closed */ }
 }
 
+export function timingSafeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false
+  const bufA = Buffer.from(a, 'utf8')
+  const bufB = Buffer.from(b, 'utf8')
+  if (bufA.length !== bufB.length) return false
+  return timingSafeEqual(bufA, bufB)
+}
+
 export function readBody(req, maxBytes = 64 * 1024) {
   return new Promise((resolve, reject) => {
     const chunks = []
@@ -126,11 +136,11 @@ export function isTrustedSettingsRequest(request, targetCtx) {
   // 5. Loopback request (CLI, local daemon, localhost test)
   if (isLoopback(request)) return true
 
-  // 6. Verified server secret token with exact cookie matching (#374)
+  // 6. Verified server secret token with exact cookie matching (#374, #492)
   const expectedToken = process.env.DSH_AUTH_TOKEN
   if (expectedToken) {
     const auth = headers.authorization
-    if (typeof auth === 'string' && auth.startsWith('Bearer ') && auth.slice(7).trim() === expectedToken) {
+    if (typeof auth === 'string' && auth.startsWith('Bearer ') && timingSafeCompare(auth.slice(7).trim(), expectedToken)) {
       return true
     }
     const cookieHeader = headers.cookie
@@ -142,7 +152,7 @@ export function isTrustedSettingsRequest(request, targetCtx) {
           cookies[part.slice(0, eq).trim()] = part.slice(eq + 1).trim()
         }
       }
-      if (cookies.token === expectedToken || cookies.dsh_token === expectedToken) {
+      if (timingSafeCompare(cookies.token, expectedToken) || timingSafeCompare(cookies.dsh_token, expectedToken)) {
         return true
       }
     }
@@ -261,10 +271,12 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
       clearTimeout(timer)
       return res
     }
+    if (typeof timer?.unref === 'function') timer.unref()
     const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
     const origText = typeof res.text === 'function' ? res.text.bind(res) : null
     if (origJson) {
       res.json = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }
@@ -292,6 +304,7 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     }
     if (origText) {
       res.text = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }

package/lib/index.js

@@ -314,6 +314,8 @@ export function apply(ctx, rawConfig) {
     ensureFresh: (provider, blob, ref) => store.ensureFresh(provider, blob, ref),
     vendorConfig: (provider) => vendorConfig(provider, live()),
     cooldownMs: () => live().cooldownMs,
+    drainBeforeReset: () => live().drainBeforeReset,
+    drainSafetyPercent: () => live().drainSafetyPercent,
     switchAtRemaining: () => live().switchAtRemaining,
     rememberCooldown: (ref, until, families) => store.rememberCooldown(ref, until, families),
     rememberQuarantine: (ref, reason, until, attempts) => store.rememberQuarantine(ref, reason, until, attempts),
@@ -348,7 +350,11 @@ export function apply(ctx, rawConfig) {
         throw new Error(`unknown subscription provider: ${provider}`)
       }
       const accounts = await store.listAccounts(provider)
-      const eligible = pickAccount(accounts || [], Date.now(), { family: provider === 'codex' ? 'gpt' : 'grok' })
+      const eligible = pickAccount(accounts || [], Date.now(), {
+        family: provider === 'codex' ? 'gpt' : 'grok',
+        drainBeforeReset: live().drainBeforeReset,
+        drainSafetyPercent: live().drainSafetyPercent,
+      })
       const slot = eligible || (accounts || []).find((row) => row && row.ref && row.hasToken)
       if (!slot) throw new Error(`not logged in to ${provider}: sign in in the Subscriptions section`)
       const raw = await store.resolveRaw(slot.ref)
@@ -436,10 +442,8 @@ export function apply(ctx, rawConfig) {
       }
     }
     tick().catch(() => {})
-    const timer = setInterval
-    const clear = clearInterval
-    const id = timer(() => { tick().catch(() => {}) }, 60 * 1000)
-    return () => clear(id)
+    const id = setInterval(() => { tick().catch(() => {}) }, 60 * 1000)
+    return () => clearInterval(id)
   }, 'dsh-subscriptions: refresh ahead')
 
   // Background health-check probe loop

package/lib/rotate.js

@@ -1,4 +1,4 @@
-import { computePacingRisk, calculateBurnRatePerHour } from "./forecast.js"
+import { computePacingRisk, calculateBurnRatePerHour, calculateBurnUrgency } from "./forecast.js"
 import { isQuarantined } from './quarantine.js'
 import { getPinnedAccountRef, pinSession } from './session-pin.js'
 
@@ -41,6 +41,28 @@ export function cooldownBlocks(acc, family) {
   return fams.includes(family)
 }
 
+
+export function getAccountRemainingPercent(acc) {
+  if (!acc) return null
+  if (acc.quota?.remainingPercent != null) {
+    const val = Number(acc.quota.remainingPercent)
+    return Number.isFinite(val) ? val : null
+  }
+  if (acc.quota?.usedPercent != null) {
+    const val = 100 - Number(acc.quota.usedPercent)
+    return Number.isFinite(val) ? val : null
+  }
+  if (acc.usagePercent != null) {
+    const val = 100 - Number(acc.usagePercent)
+    return Number.isFinite(val) ? val : null
+  }
+  if (acc.quota?.remaining != null && acc.quota?.limit != null && Number(acc.quota.limit) > 0) {
+    const val = (Number(acc.quota.remaining) / Number(acc.quota.limit)) * 100
+    return Number.isFinite(val) ? val : null
+  }
+  return null
+}
+
 export function pickAccount(accounts, nowMs, opts) {
   const list = Array.isArray(accounts) ? accounts : []
   const now = Number(nowMs) || 0
@@ -111,6 +133,15 @@ export function pickAccount(accounts, nowMs, opts) {
       }
     }
 
+    if (opts && opts.drainBeforeReset) {
+      if (acc.burnUrgency === undefined) {
+        const rem = getAccountRemainingPercent(acc)
+        const resetAt = acc.quota?.resetAt || 0
+        const safetyFloor = opts.drainSafetyPercent != null ? Number(opts.drainSafetyPercent) : 5
+        acc.burnUrgency = calculateBurnUrgency(rem, resetAt, now, safetyFloor)
+      }
+    }
+
     // VIP Slot Reservation (#175)
     if (acc.vipOnly && !isVipRequest) continue
 
@@ -142,6 +173,15 @@ export function pickAccount(accounts, nowMs, opts) {
   for (const tier of tiers) {
     if (tier.length) {
       tier.sort((a, b) => {
+        // #485: Smart Quota Drainer - prioritize higher burn urgency first
+        if (opts && opts.drainBeforeReset) {
+          const aUrg = Number(a.burnUrgency) || 0
+          const bUrg = Number(b.burnUrgency) || 0
+          if (Math.abs(aUrg - bUrg) > 0.01) {
+            return bUrg - aUrg
+          }
+        }
+
         // 0. Auto-Pacing: lower pacing risk preferred (#352)
         const aRisk = Number(a.pacingRisk) || 0
         const bRisk = Number(b.pacingRisk) || 0

package/lib/routes/oauth.js

@@ -31,6 +31,10 @@ export function registerOauthRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const index = Number(q.get('index') || '1')

package/lib/routes/status.js

@@ -354,7 +354,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'localhost only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '10'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '10'), 100))
       writeJson(res, 200, { ok: true, total: history.size(), items: history.recent(limit) })
     }),
   }), 'dsh-subscriptions: /history')
@@ -502,7 +502,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '50'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '50'), 100))
       writeJson(res, 200, { ok: true, alerts: getRecentAlerts(limit) })
     }),
   }), 'dsh-subscriptions: /alerts')

package/lib/stream-rotate.js

@@ -28,6 +28,8 @@ export async function* streamWithRotation({
       tag: options && options.tag,
       vip: options && options.vip,
       autoPacing: options && (options.autoPacing !== undefined ? options.autoPacing : (options.config && options.config.autoPacing)),
+      drainBeforeReset: options && (options.drainBeforeReset !== undefined ? options.drainBeforeReset : (options.config && options.config.drainBeforeReset)),
+      drainSafetyPercent: options && (options.drainSafetyPercent !== undefined ? options.drainSafetyPercent : (options.config && options.config.drainSafetyPercent)),
     })
 
     if (!account || tried.has(account.ref || account.id)) {

package/lib/subscriptions.js

@@ -18,9 +18,16 @@ export function isAllowed(provider, path) {
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]
+  if (p.startsWith("//")) return false
   try {
-    if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch { /* ignore subscriptions error */ }
+    if (p.startsWith("http://") || p.startsWith("https://")) {
+      p = new URL(p).pathname
+    } else {
+      p = new URL(p.startsWith("/") ? p : "/" + p, "http://localhost").pathname
+    }
+  } catch {
+    return false
+  }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -88,6 +95,11 @@ export function createSubscriptionsService(deps) {
         throw err
       }
       const rawPath = String(path || "")
+      if (rawPath.startsWith("//")) {
+        const err = new Error("protocol-relative URL rejected: " + rawPath)
+        err.code = "FORBIDDEN"
+        throw err
+      }
       if (rawPath.startsWith("http://") || rawPath.startsWith("https://")) {
         const initialCfg = typeof deps.vendorConfig === "function" ? deps.vendorConfig(provider) : {}
         const initialBase = baseFor(provider, initialCfg || {})
@@ -108,7 +120,12 @@ export function createSubscriptionsService(deps) {
       const tried = new Set()
       let lastError = null
       while (true) {
-        const account = pickAccount(pool, Date.now(), { switchAtRemaining: thr, family: modelFamily(provider, body && body.model) })
+        const account = pickAccount(pool, Date.now(), {
+          switchAtRemaining: thr,
+          family: modelFamily(provider, body && body.model),
+          drainBeforeReset: typeof deps.drainBeforeReset === 'function' ? deps.drainBeforeReset() : deps.drainBeforeReset,
+          drainSafetyPercent: typeof deps.drainSafetyPercent === 'function' ? deps.drainSafetyPercent() : deps.drainSafetyPercent,
+        })
         if (!account) {
           if (lastError) throw lastError
           const err = new Error("no usable subscription account for this provider")
@@ -126,23 +143,57 @@ export function createSubscriptionsService(deps) {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const cfg = deps.vendorConfig(provider)
           const base = baseFor(provider, cfg)
-          // normalize path
-          let p = String(path)
-          if (p.startsWith("http://") || p.startsWith("https://")) {
-            // #445: enforce provider origin policy before Bearer dispatch
-            let targetOrigin, baseOrigin
-            try { targetOrigin = new URL(p).origin } catch { /* ignore */ }
-            try { baseOrigin = new URL(base).origin } catch { /* ignore */ }
-            if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
-              const err = new Error("external origin rejected for provider " + provider + ": " + p)
+
+          // normalize path and resolve target URL (#487)
+          let targetUrl
+          let baseOrigin = ""
+          let basePath = ""
+          try {
+            const bUrl = new URL(base)
+            baseOrigin = bUrl.origin
+            basePath = bUrl.pathname.replace(/\/$/, "")
+          } catch { /* ignore */ }
+
+          const isAbsolute = rawPath.startsWith("http://") || rawPath.startsWith("https://")
+          try {
+            if (isAbsolute) {
+              targetUrl = new URL(rawPath)
+            } else {
+              const cleanRel = rawPath.startsWith("/") ? rawPath : "/" + rawPath
+              if (basePath && (cleanRel === basePath || cleanRel.startsWith(basePath + "/"))) {
+                targetUrl = new URL(baseOrigin + cleanRel)
+              } else {
+                const cleanBase = base.replace(/\/$/, "")
+                targetUrl = new URL(cleanBase + cleanRel)
+              }
+            }
+          } catch {
+            const err = new Error("invalid URL for " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!baseOrigin || targetUrl.origin.toLowerCase() !== baseOrigin.toLowerCase()) {
+            const err = new Error("external origin rejected for provider " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!isAbsolute) {
+            if (basePath && targetUrl.pathname !== basePath && !targetUrl.pathname.startsWith(basePath + "/")) {
+              const err = new Error("path traversal rejected for provider " + provider + ": " + rawPath)
               err.code = "FORBIDDEN"
               throw err
             }
-          } else {
-            if (!p.startsWith("/")) p = "/" + p
-            p = base + p
           }
-          const url = p
+
+          if (!isAllowed(provider, targetUrl.pathname)) {
+            const err = new Error("path not allowed for " + provider + ": " + targetUrl.pathname)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          const url = targetUrl.toString()
           const extraHeaders = headersFor(provider, blob, cfg)
           const fetchImpl = pickFetch(deps, account.ref)
           const requestTimeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 30000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.53",
+  "version": "0.6.55",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",