@goodandready/dsh-subscriptions 0.6.71 → 0.6.82

package/lib/config-schema.js

@@ -20,6 +20,8 @@ export const Slot = z.object({
     .description('#67 Optional subscription expiry timestamp (ms). When set and within expiryNotifyDays, the header chip shows the account and expiry date.'),
   proxyUrl: z.string().default('')
     .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
+  maxConcurrency: z.number().default(1)
+    .description('#555 Per-slot max concurrent requests before queuing. Defaults to 1 for subscription safety.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))
@@ -86,6 +88,10 @@ export const Config = z.object({
   antigravityClientSecret: z.string().role('secret').default('')
     .description('Google OAuth client secret for custom confidential clients or CLI tokens requiring secret refresh.'),
   antigravityRedirectUri: z.string().volatile().default(''),
+  perplexityClientId: z.string().volatile().default(''),
+  perplexityRedirectUri: z.string().volatile().default(''),
+  jetbrainsClientId: z.string().volatile().default(''),
+  jetbrainsRedirectUri: z.string().volatile().default(''),
   antigravityModels: z.array(z.any()).volatile().default([])
     .description('Custom model catalog for Antigravity.'),
   codexOriginator: z.string().volatile().default('')
@@ -130,12 +136,48 @@ export const Config = z.object({
     .description('#485 Safety margin percent: avoid draining accounts below this threshold when alternatives exist.'),
   enableQueue: z.boolean().volatile().default(true)
     .description('#518 Bounded concurrency queue to prevent bursts of 429 errors.'),
-  accountMaxConcurrency: z.number().volatile().default(2)
-    .description('#518 Max concurrent requests per account before queuing.'),
+  accountMaxConcurrency: z.number().volatile().default(1)
+    .description('#518 #555 Default max concurrent requests per account before queuing (1 for OAuth subscription safety).'),
   maxQueueSize: z.number().volatile().default(20)
     .description('#518 Max requests waiting in queue before reject.'),
   queueTimeoutMs: z.number().volatile().default(30000)
     .description('#518 Max queue wait time in ms before timeout.'),
+  masterKey: z.string().role('secret').default('')
+    .description('#550 Optional master passphrase for encrypting OAuth credentials at rest (defaults to DSH_SUBSCRIPTIONS_MASTER_KEY env).'),
+  vaultSyncEnabled: z.boolean().volatile().default(false)
+    .description('#562 Enable automated encrypted vault sync to remote storage.'),
+  vaultSyncBackend: z.string().volatile().default('webdav')
+    .description('#562 Remote storage backend: webdav, gist, or s3.'),
+  vaultSyncPassphrase: z.string().role('secret').default('')
+    .description('#562 Passphrase used to encrypt/decrypt the remote vault archive.'),
+  vaultSyncIntervalHours: z.number().volatile().default(24)
+    .description('#562 Automated periodic sync interval in hours (0 disables periodic pull).'),
+  vaultSyncAutoPush: z.boolean().volatile().default(true)
+    .description('#562 Automatically push encrypted vault after successful OAuth login/refresh.'),
+  vaultSyncWebdavUrl: z.string().volatile().default('')
+    .description('#562 WebDAV target URL.'),
+  vaultSyncWebdavUsername: z.string().volatile().default('')
+    .description('#562 WebDAV username.'),
+  vaultSyncWebdavPassword: z.string().role('secret').default('')
+    .description('#562 WebDAV password or app token.'),
+  vaultSyncGistId: z.string().volatile().default('')
+    .description('#562 GitHub or Gitea Gist ID.'),
+  vaultSyncGistToken: z.string().role('secret').default('')
+    .description('#562 Personal access token with gist permission.'),
+  vaultSyncGistBaseUrl: z.string().volatile().default('https://api.github.com')
+    .description('#562 Gist API base URL.'),
+  vaultSyncS3Endpoint: z.string().volatile().default('')
+    .description('#562 S3 endpoint URL.'),
+  vaultSyncS3Bucket: z.string().volatile().default('')
+    .description('#562 S3 bucket name.'),
+  vaultSyncS3Key: z.string().volatile().default('dsh-subscriptions-vault.enc')
+    .description('#562 S3 object key.'),
+  vaultSyncS3Region: z.string().volatile().default('us-east-1')
+    .description('#562 S3 region.'),
+  vaultSyncS3AccessKey: z.string().volatile().default('')
+    .description('#562 S3 Access Key ID.'),
+  vaultSyncS3SecretKey: z.string().role('secret').default('')
+    .description('#562 S3 Secret Access Key.'),
   customVendors: z.array(z.any()).volatile().default([])
     .description('Declarative OpenAI-Responses-compatible providers. See README.'),
 })
@@ -145,7 +187,7 @@ export function publicConfig(cfg) {
   const clone = { ...cfg }
   // #242, #252: redact secret fields before exposing config via GET /config.
   for (const key of Object.keys(clone)) {
-    if (key.endsWith("ClientSecret") || key.endsWith("Secret")) {
+    if (key.endsWith("ClientSecret") || key.endsWith("Secret") || key.endsWith("SecretKey") || key.endsWith("Password") || key.endsWith("Token") || key.endsWith("Passphrase") || key === "masterKey") {
       clone[key] = clone[key] ? "••••••" : ""
     }
   }
@@ -199,7 +241,7 @@ export function restoreMaskedSecrets(incoming, existing) {
   const out = { ...incoming }
 
   for (const key of Object.keys(out)) {
-    if ((key.endsWith("ClientSecret") || key.endsWith("Secret")) && typeof out[key] === "string") {
+    if ((key.endsWith("ClientSecret") || key.endsWith("Secret") || key.endsWith("SecretKey") || key.endsWith("Password") || key.endsWith("Token") || key.endsWith("Passphrase") || key === "masterKey") && typeof out[key] === "string") {
       if (out[key].includes("••••")) {
         out[key] = existing[key] || ""
       }

package/lib/diagnostic-wizard.js

@@ -1,7 +1,7 @@
 // Guided Diagnostic Wizard for accounts, credentials, and network connectivity (#519).
 // Enforces 0 Cyrillic characters.
 
-import { maskEmail, maskText, cleanErrorMessage } from './mask.js'
+import { maskEmail, maskSecrets, cleanErrorMessage } from './mask.js'
 import { getVendor } from './vendors/index.js'
 
 /**
@@ -11,10 +11,7 @@ import { getVendor } from './vendors/index.js'
  */
 export function sanitizeDiagnosticData(val) {
   if (typeof val === 'string') {
-    return maskText(val)
-      .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]')
-      .replace(/key=[A-Za-z0-9._~+/-]+/gi, 'key=[REDACTED]')
-      .replace(/token=[A-Za-z0-9._~+/-]+/gi, 'token=[REDACTED]')
+    return maskSecrets(val)
   }
   if (Array.isArray(val)) {
     return val.map(sanitizeDiagnosticData)

package/lib/diagnostics.js

@@ -3,13 +3,13 @@ import { getSessionReasoningStats } from './reasoning-effort.js'
 import { defaultConcurrencyQueue } from './concurrency-queue.js'
 import { calculateCacheMetrics } from './analytics.js'
 import { getSessionPinStats } from './session-pin.js'
-import { maskText } from './mask.js'
+import { maskSecrets } from './mask.js'
 import { normalizeSlots } from './accounts.js'
 import { PROVIDERS } from './refs.js'
 import { defaultErrorBuffer } from './error-buffer.js'
 
 function scrubReport(v) {
-  if (typeof v === 'string') return maskText(v)
+  if (typeof v === 'string') return maskSecrets(v)
   if (Array.isArray(v)) return v.map(scrubReport)
   if (v && typeof v === 'object') {
     const o = {}

package/lib/doctor.js

@@ -0,0 +1,163 @@
+/**
+ * Vendor Auth Doctor: Diagnose authentication, authorization, quota, and network errors
+ * into structured, human-understandable recommendations.
+ */
+
+export const DOCTOR_CODES = {
+  GEO_BLOCKED: 'GEO_BLOCKED',
+  TOKEN_EXPIRED: 'TOKEN_EXPIRED',
+  TOKEN_REVOKED: 'TOKEN_REVOKED',
+  MISSING_SCOPE: 'MISSING_SCOPE',
+  QUOTA_EXHAUSTED: 'QUOTA_EXHAUSTED',
+  RATE_LIMIT: 'RATE_LIMIT',
+  PROXY_ERROR: 'PROXY_ERROR',
+  UNKNOWN: 'UNKNOWN',
+}
+
+/**
+ * Classifies vendor errors and generates actionable recommendations.
+ * @param {any} err
+ * @param {string} [provider]
+ * @param {any} [_account]
+ * @returns {{ code: string, title: string, details: string, recommendation: string } | null}
+ */
+export function diagnoseVendorError(err, provider = '', _account = null) {
+  if (!err) return null
+
+  const msg = String(err.message || err.error || err || '').toLowerCase()
+  const code = String(err.code || err.status || err.statusCode || '').toUpperCase()
+  const p = String(provider || '').toLowerCase()
+
+  // 1. Geo-blocking / Cloudflare Firewall (403, 1020, region forbidden)
+  if (
+    msg.includes('country') ||
+    msg.includes('location') ||
+    msg.includes('region') ||
+    msg.includes('not supported in your country') ||
+    msg.includes('cloudflare') ||
+    msg.includes('cf-ray') ||
+    msg.includes('error 1020') ||
+    msg.includes('access denied') ||
+    (code === '403' && (msg.includes('forbidden') || msg.includes('blocked') || msg.includes('geoblock')))
+  ) {
+    return {
+      code: DOCTOR_CODES.GEO_BLOCKED,
+      title: 'Region or IP Blocked by Vendor Firewall',
+      details: `The vendor (${p || 'provider'}) returned a geo-restriction or Cloudflare block.`,
+      recommendation: 'Configure a dedicated SOCKS5 or HTTP proxy located in a supported region (US, EU, JP) in proxy settings.',
+    }
+  }
+
+  // 2. Token Expired / Session Expired
+  if (
+    msg.includes('token_expired') ||
+    msg.includes('jwt expired') ||
+    msg.includes('invalid_grant') ||
+    msg.includes('session expired') ||
+    msg.includes('refresh token expired') ||
+    msg.includes('token has expired') ||
+    msg.includes('login_required')
+  ) {
+    return {
+      code: DOCTOR_CODES.TOKEN_EXPIRED,
+      title: 'OAuth Access or Refresh Token Expired',
+      details: 'The stored OAuth credentials have expired and could not be refreshed automatically.',
+      recommendation: 'Click "Connect" or "Device Login" to re-authorize the account and establish a fresh session.',
+    }
+  }
+
+  // 3. Token Revoked / Bad Credentials
+  if (
+    msg.includes('token_revoked') ||
+    msg.includes('revoked') ||
+    msg.includes('account_deactivated') ||
+    msg.includes('invalid_token') ||
+    msg.includes('bad_credentials') ||
+    code === 'TOKEN_REVOKED' ||
+    (code === '401' && (msg.includes('unauthorized') || msg.includes('invalid api key') || msg.includes('incorrect api key')))
+  ) {
+    return {
+      code: DOCTOR_CODES.TOKEN_REVOKED,
+      title: 'Token Invalid or Revoked',
+      details: 'The vendor rejected the API key or OAuth token as invalid or revoked.',
+      recommendation: 'Re-issue a fresh session token, API key, or CLI credentials in the vendor dashboard and save it.',
+    }
+  }
+
+  // 4. Missing Scope / Permissions
+  if (
+    msg.includes('insufficient_scope') ||
+    msg.includes('missing_scope') ||
+    msg.includes('scope required') ||
+    msg.includes('permission_denied') ||
+    msg.includes('model_not_found') ||
+    msg.includes('not have access') ||
+    msg.includes('license_required')
+  ) {
+    return {
+      code: DOCTOR_CODES.MISSING_SCOPE,
+      title: 'Missing Scope or Model Permissions',
+      details: 'The account does not have sufficient entitlements or required scope permissions for this model.',
+      recommendation: 'Check your organization role or subscription tier to ensure permissions and access to requested models is granted.',
+    }
+  }
+
+  // 5. Quota Exhausted / Balance Zero
+  if (
+    msg.includes('insufficient_quota') ||
+    msg.includes('exceeded your current quota') ||
+    msg.includes('credit_balance_zero') ||
+    msg.includes('billing_not_active') ||
+    msg.includes('quota exceeded') ||
+    msg.includes('run out of credits') ||
+    code === 'QUOTA'
+  ) {
+    return {
+      code: DOCTOR_CODES.QUOTA_EXHAUSTED,
+      title: 'Subscription Quota or Credits Exhausted',
+      details: 'The account has consumed 100% of its current billing cycle or token usage quota.',
+      recommendation: 'Check your subscription billing dashboard or wait until the quota window resets.',
+    }
+  }
+
+  // 6. Rate Limit / 429
+  if (
+    code === '429' ||
+    code === 'RATE_LIMIT' ||
+    msg.includes('too many requests') ||
+    msg.includes('rate_limit') ||
+    msg.includes('rate limit')
+  ) {
+    return {
+      code: DOCTOR_CODES.RATE_LIMIT,
+      title: 'Temporary Rate Limit Reached',
+      details: 'The vendor is throttling requests (RPM/TPM limit reached) for this account.',
+      recommendation: 'Account is placed in temporary cooldown. Requests will automatically route to another account.',
+    }
+  }
+
+  // 7. Network / Proxy Connectivity
+  if (
+    msg.includes('econnrefused') ||
+    msg.includes('etimedout') ||
+    msg.includes('enotfound') ||
+    msg.includes('fetch failed') ||
+    msg.includes('socks') ||
+    code === 'ENOTFOUND' ||
+    code === 'ETIMEDOUT'
+  ) {
+    return {
+      code: DOCTOR_CODES.PROXY_ERROR,
+      title: 'Network or Proxy Connection Failure',
+      details: 'Failed to establish TCP/TLS connection with the provider API or configured proxy server.',
+      recommendation: 'Check server network access, DNS resolution, and verify the configured SOCKS/HTTP proxy is online.',
+    }
+  }
+
+  return {
+    code: DOCTOR_CODES.UNKNOWN,
+    title: 'Unexpected Vendor Error',
+    details: msg.slice(0, 200) || 'Unknown error occurred during vendor request.',
+    recommendation: 'Review vendor API status or re-check account credentials.',
+  }
+}

package/lib/error-buffer.js

@@ -1,4 +1,4 @@
-import { cleanErrorMessage, maskText } from './mask.js'
+import { cleanErrorMessage, maskSecrets } from './mask.js'
 
 /**
  * Ring buffer holding the most recent runtime errors across vendors and streams.
@@ -19,7 +19,7 @@ export class ErrorRingBuffer {
    * @param {{ provider?: string, ref?: string, model?: string, status?: number|null, code?: string, message?: string }} [param0]
    */
   record({ provider = 'unknown', ref = '', model = '', status = null, code = '', message = '' } = {}) {
-    const rawMsg = cleanErrorMessage(maskText(String(message || '')))
+    const rawMsg = cleanErrorMessage(maskSecrets(message))
     const entry = {
       id: String(this._nextId++),
       ts: new Date().toISOString(),

package/lib/forecast.js

@@ -141,3 +141,59 @@ export function calculateBurnUrgency(remainingPercent, resetAt, nowMs = Date.now
   const clampedHours = Math.max(hoursUntilReset, 0.05)
   return rem / clampedHours
 }
+
+/**
+ * #559: Calculates remaining runway duration and pacing status based on burn rate.
+ * @param {number|null} remainingPercent
+ * @param {number} pacePerHour
+ * @param {number|null} [_resetAt]
+ * @param {number} [_nowMs]
+ * @returns {{ runwayMs: number|null, runwayHours: number|null, runwayText: string, pacingStatus: string }}
+ */
+export function calculatePacingRunway(remainingPercent, pacePerHour, _resetAt = null, _nowMs = Date.now()) {
+  if (remainingPercent === null || remainingPercent === undefined) {
+    return { runwayMs: null, runwayHours: null, runwayText: '', pacingStatus: 'unknown' }
+  }
+  const rem = Number(remainingPercent)
+  if (!Number.isFinite(rem)) {
+    return { runwayMs: null, runwayHours: null, runwayText: '', pacingStatus: 'unknown' }
+  }
+  if (rem <= 0) {
+    return { runwayMs: 0, runwayHours: 0, runwayText: '0m (exhausted)', pacingStatus: 'critical' }
+  }
+
+  const pace = Number(pacePerHour) || 0
+  if (pace <= 0.02) {
+    return { runwayMs: Infinity, runwayHours: Infinity, runwayText: 'Sustainable', pacingStatus: 'sustainable' }
+  }
+
+  const runwayHours = rem / pace
+  const runwayMs = Math.round(runwayHours * HOUR_MS)
+
+  let runwayText = ''
+  if (runwayHours >= 24) {
+    const days = Math.round(runwayHours / 24)
+    runwayText = `~${days}d`
+  } else if (runwayHours >= 1) {
+    const h = Math.floor(runwayHours)
+    const m = Math.round((runwayHours % 1) * 60)
+    runwayText = m > 0 ? `~${h}h ${m}m` : `~${h}h`
+  } else {
+    const m = Math.max(1, Math.round(runwayHours * 60))
+    runwayText = m <= 15 ? '< 15m' : `~${m}m`
+  }
+
+  let pacingStatus = 'sustainable'
+  if (runwayHours < 0.5) {
+    pacingStatus = 'critical'
+  } else if (runwayHours <= 2.5) {
+    pacingStatus = 'elevated'
+  }
+
+  return {
+    runwayMs,
+    runwayHours: Math.round(runwayHours * 10) / 10,
+    runwayText,
+    pacingStatus,
+  }
+}