@goodandready/dsh-subscriptions 0.6.54 → 0.6.56

package/lib/adapter-manager.js

@@ -114,8 +114,10 @@ export function createAdapterManager({
 
     if (adapterDisposed) return
     if (!handle && claimable.length) {
-      handle = ctx.llm.registerAdapter(claimable, adapter)
-      registeredByUs = new Set(claimable)
+      if (ctx.llm && typeof ctx.llm.registerAdapter === 'function') {
+        handle = ctx.llm.registerAdapter(claimable, adapter)
+        registeredByUs = new Set(claimable)
+      }
       return
     }
     if (!handle) {
@@ -148,8 +150,10 @@ export function createAdapterManager({
     const currentGlobal = new Set((ctx.llm && typeof ctx.llm.listProviders === 'function' ? ctx.llm.listProviders() : []).map((p) => p.id))
     const reClaimable = desired.filter((p) => !currentGlobal.has(p))
     if (reClaimable.length) {
-      handle = ctx.llm.registerAdapter(reClaimable, adapter)
-      registeredByUs = new Set(reClaimable)
+      if (ctx.llm && typeof ctx.llm.registerAdapter === 'function') {
+        handle = ctx.llm.registerAdapter(reClaimable, adapter)
+        registeredByUs = new Set(reClaimable)
+      }
     }
   }
 

package/lib/config-schema.js

@@ -84,6 +84,20 @@ export const Config = z.object({
     .description('Grok CLI identity version header. Empty uses the built-in default.'),
   antigravityClientId: z.string().volatile().default(''),
   antigravityRedirectUri: z.string().volatile().default(''),
+  antigravityModels: z.array(z.any()).volatile().default([])
+    .description('Custom model catalog for Antigravity.'),
+  codexOriginator: z.string().volatile().default('')
+    .description('Originator header for Codex API requests (e.g. codex_cli_rs).'),
+  codexSystemPrefix: z.string().volatile().default('')
+    .description('System prompt prefix for Codex.'),
+  codexModels: z.array(z.any()).volatile().default([])
+    .description('Custom model catalog for Codex.'),
+  claudeSystemPrefix: z.string().volatile().default('')
+    .description('System prompt prefix for Claude.'),
+  claudeModels: z.array(z.any()).volatile().default([])
+    .description('Custom model catalog for Claude.'),
+  grokModels: z.array(z.any()).volatile().default([])
+    .description('Custom model catalog for Grok.'),
   cascadingFallback: z.boolean().volatile().default(false)
     .description('#349 Opt-in cross-vendor fallback when all accounts of a provider are exhausted or rate limited.'),
   cascadingChain: z.any().volatile().default({})

package/lib/http.js

@@ -1,3 +1,5 @@
+import { timingSafeEqual } from 'node:crypto'
+
 export function writeJson(res, code, body) {
   try {
     res.writeHead(code, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
@@ -12,6 +14,14 @@ export function writeHtml(res, code, html) {
   } catch { /* socket closed */ }
 }
 
+export function timingSafeCompare(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false
+  const bufA = Buffer.from(a, 'utf8')
+  const bufB = Buffer.from(b, 'utf8')
+  if (bufA.length !== bufB.length) return false
+  return timingSafeEqual(bufA, bufB)
+}
+
 export function readBody(req, maxBytes = 64 * 1024) {
   return new Promise((resolve, reject) => {
     const chunks = []
@@ -126,11 +136,11 @@ export function isTrustedSettingsRequest(request, targetCtx) {
   // 5. Loopback request (CLI, local daemon, localhost test)
   if (isLoopback(request)) return true
 
-  // 6. Verified server secret token with exact cookie matching (#374)
+  // 6. Verified server secret token with exact cookie matching (#374, #492)
   const expectedToken = process.env.DSH_AUTH_TOKEN
   if (expectedToken) {
     const auth = headers.authorization
-    if (typeof auth === 'string' && auth.startsWith('Bearer ') && auth.slice(7).trim() === expectedToken) {
+    if (typeof auth === 'string' && auth.startsWith('Bearer ') && timingSafeCompare(auth.slice(7).trim(), expectedToken)) {
       return true
     }
     const cookieHeader = headers.cookie
@@ -142,7 +152,7 @@ export function isTrustedSettingsRequest(request, targetCtx) {
           cookies[part.slice(0, eq).trim()] = part.slice(eq + 1).trim()
         }
       }
-      if (cookies.token === expectedToken || cookies.dsh_token === expectedToken) {
+      if (timingSafeCompare(cookies.token, expectedToken) || timingSafeCompare(cookies.dsh_token, expectedToken)) {
         return true
       }
     }
@@ -261,10 +271,12 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
       clearTimeout(timer)
       return res
     }
+    if (typeof timer?.unref === 'function') timer.unref()
     const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
     const origText = typeof res.text === 'function' ? res.text.bind(res) : null
     if (origJson) {
       res.json = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }
@@ -292,6 +304,7 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
     }
     if (origText) {
       res.text = () => {
+        if (typeof timer?.ref === 'function') timer.ref()
         if (controller.signal.aborted) {
           return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
         }

package/lib/index.js

@@ -260,7 +260,11 @@ export function apply(ctx, rawConfig) {
     const cfg = live()
     const alive = !!cfg.ollamaFallback && await ollamaAlive(ollamaBase(cfg), fetch)
     if (alive && !ollamaHandle) {
-      try { ollamaHandle = ctx.llm.registerAdapter(['ollama'], ollamaAdapter) } catch { /* already registered elsewhere */ }
+      try {
+        if (ctx.llm && typeof ctx.llm.registerAdapter === 'function') {
+          ollamaHandle = ctx.llm.registerAdapter(['ollama'], ollamaAdapter)
+        }
+      } catch { /* already registered elsewhere */ }
     } else if (!alive && ollamaHandle) {
       try { ollamaHandle() } catch { /* already gone */ }
       ollamaHandle = undefined
@@ -442,10 +446,8 @@ export function apply(ctx, rawConfig) {
       }
     }
     tick().catch(() => {})
-    const timer = setInterval
-    const clear = clearInterval
-    const id = timer(() => { tick().catch(() => {}) }, 60 * 1000)
-    return () => clear(id)
+    const id = setInterval(() => { tick().catch(() => {}) }, 60 * 1000)
+    return () => clearInterval(id)
   }, 'dsh-subscriptions: refresh ahead')
 
   // Background health-check probe loop

package/lib/routes/oauth.js

@@ -31,6 +31,10 @@ export function registerOauthRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const index = Number(q.get('index') || '1')

package/lib/routes/status.js

@@ -354,7 +354,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'localhost only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '10'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '10'), 100))
       writeJson(res, 200, { ok: true, total: history.size(), items: history.recent(limit) })
     }),
   }), 'dsh-subscriptions: /history')
@@ -502,7 +502,7 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      const limit = Math.min(Number(queryOf(req).get('limit') || '50'), 100)
+      const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '50'), 100))
       writeJson(res, 200, { ok: true, alerts: getRecentAlerts(limit) })
     }),
   }), 'dsh-subscriptions: /alerts')

package/lib/subscriptions.js

@@ -18,9 +18,16 @@ export function isAllowed(provider, path) {
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]
+  if (p.startsWith("//")) return false
   try {
-    if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch { /* ignore subscriptions error */ }
+    if (p.startsWith("http://") || p.startsWith("https://")) {
+      p = new URL(p).pathname
+    } else {
+      p = new URL(p.startsWith("/") ? p : "/" + p, "http://localhost").pathname
+    }
+  } catch {
+    return false
+  }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -88,6 +95,11 @@ export function createSubscriptionsService(deps) {
         throw err
       }
       const rawPath = String(path || "")
+      if (rawPath.startsWith("//")) {
+        const err = new Error("protocol-relative URL rejected: " + rawPath)
+        err.code = "FORBIDDEN"
+        throw err
+      }
       if (rawPath.startsWith("http://") || rawPath.startsWith("https://")) {
         const initialCfg = typeof deps.vendorConfig === "function" ? deps.vendorConfig(provider) : {}
         const initialBase = baseFor(provider, initialCfg || {})
@@ -131,23 +143,57 @@ export function createSubscriptionsService(deps) {
           const blob = await deps.ensureFresh(provider, await deps.loadBlob(account.ref), account.ref)
           const cfg = deps.vendorConfig(provider)
           const base = baseFor(provider, cfg)
-          // normalize path
-          let p = String(path)
-          if (p.startsWith("http://") || p.startsWith("https://")) {
-            // #445: enforce provider origin policy before Bearer dispatch
-            let targetOrigin, baseOrigin
-            try { targetOrigin = new URL(p).origin } catch { /* ignore */ }
-            try { baseOrigin = new URL(base).origin } catch { /* ignore */ }
-            if (!targetOrigin || !baseOrigin || targetOrigin.toLowerCase() !== baseOrigin.toLowerCase()) {
-              const err = new Error("external origin rejected for provider " + provider + ": " + p)
+
+          // normalize path and resolve target URL (#487)
+          let targetUrl
+          let baseOrigin = ""
+          let basePath = ""
+          try {
+            const bUrl = new URL(base)
+            baseOrigin = bUrl.origin
+            basePath = bUrl.pathname.replace(/\/$/, "")
+          } catch { /* ignore */ }
+
+          const isAbsolute = rawPath.startsWith("http://") || rawPath.startsWith("https://")
+          try {
+            if (isAbsolute) {
+              targetUrl = new URL(rawPath)
+            } else {
+              const cleanRel = rawPath.startsWith("/") ? rawPath : "/" + rawPath
+              if (basePath && (cleanRel === basePath || cleanRel.startsWith(basePath + "/"))) {
+                targetUrl = new URL(baseOrigin + cleanRel)
+              } else {
+                const cleanBase = base.replace(/\/$/, "")
+                targetUrl = new URL(cleanBase + cleanRel)
+              }
+            }
+          } catch {
+            const err = new Error("invalid URL for " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!baseOrigin || targetUrl.origin.toLowerCase() !== baseOrigin.toLowerCase()) {
+            const err = new Error("external origin rejected for provider " + provider + ": " + rawPath)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          if (!isAbsolute) {
+            if (basePath && targetUrl.pathname !== basePath && !targetUrl.pathname.startsWith(basePath + "/")) {
+              const err = new Error("path traversal rejected for provider " + provider + ": " + rawPath)
               err.code = "FORBIDDEN"
               throw err
             }
-          } else {
-            if (!p.startsWith("/")) p = "/" + p
-            p = base + p
           }
-          const url = p
+
+          if (!isAllowed(provider, targetUrl.pathname)) {
+            const err = new Error("path not allowed for " + provider + ": " + targetUrl.pathname)
+            err.code = "FORBIDDEN"
+            throw err
+          }
+
+          const url = targetUrl.toString()
           const extraHeaders = headersFor(provider, blob, cfg)
           const fetchImpl = pickFetch(deps, account.ref)
           const requestTimeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 30000

package/lib/vendor-factory.js

@@ -139,6 +139,16 @@ export function validateProfile(raw) {
   }
   if (!/^[a-z][a-z0-9_]*$/.test(p.id)) throw new Error(`customVendors: id "${p.id}" must match [a-z][a-z0-9_]*`)
   if (p.tokenStyle && !["form", "json"].includes(p.tokenStyle)) throw new Error(`customVendors[${p.id}]: tokenStyle must be form|json`)
+  for (const key of ["authUrl", "tokenUrl", "baseUrl"]) {
+    try {
+      const u = new URL(p[key])
+      if (u.protocol !== "https:" && u.protocol !== "http:") {
+        throw new Error("protocol must be http: or https:")
+      }
+    } catch (e) {
+      throw new Error(`customVendors[${p.id}]: field ${key} must be a valid http(s) URL (${e.message || e})`)
+    }
+  }
   return {
     id: p.id,
     displayName: p.displayName || p.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.54",
+  "version": "0.6.56",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",