@goodandready/dsh-subscriptions 0.6.71 → 0.6.82

package/lib/index.js

@@ -2,6 +2,7 @@ import { plainConfig } from './config-schema.js'
 export { plainConfig } from './config-schema.js'
 import { readFileSync } from 'node:fs'
 import { bestEffort } from './utils.js'
+import { sweepExpiredPending } from './oauth-pending.js'
 export { Config, publicConfig, Slot, defaultSlots } from './config-schema.js'
 import { Config } from './config-schema.js'
 import { registerRoutes } from './routes.js'
@@ -21,8 +22,10 @@ import { proxyFetch } from './proxy.js'
 import { HistoryStore, resolveHistoryDir } from './history.js'
 import { createDiagnosticsReport } from './diagnostics.js'
 import { createAccountsView } from './accounts-view.js'
+import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
-import { pickAccount } from './rotate.js'
+import { pickAccount, isAuthError } from './rotate.js'
+import { notifySessionExpired } from './alerts.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
 export { formatRelativeReset } from './relative-time.js'
@@ -31,6 +34,9 @@ export { exportVault, importVault } from './vault.js'
 export { recordAlert, getRecentAlerts, checkQuotaThresholds, notifySessionExpired } from './alerts.js'
 export { calculateBurnRatePerHour, computePacingRisk } from './forecast.js'
 export { needsWarmupProbe, enterProbing, resolveWarmupSuccess, resolveWarmupFailure } from './quarantine.js'
+export { encodeQrMatrix, renderAsciiQr, renderSvgQr, renderSvgDataUrl, generateSshTunnelCommand, getHeadlessAuthInfo, handleHeadlessRedirect } from './headless-auth.js'
+export { pushToWebdav, pullFromWebdav, pushToGist, pullFromGist, buildS3SigV4Headers, pushToS3, pullFromS3, syncVaultPush, syncVaultPull, getVaultSyncStatus, resetVaultSyncStatus } from './vault-sync.js'
+import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from './vault-sync.js'
 
 export const name = '@goodandready/dsh-subscriptions'
 export const inject = ['llm', 'credentials', 'webServer', 'settings']
@@ -380,11 +386,15 @@ export function apply(ctx, rawConfig) {
   const pending = new Map()
 
   function sweepPending(now) {
-    for (const [stateKey, row] of pending) {
-      if (now - row.createdAt > PENDING_TTL_MS) pending.delete(stateKey)
-    }
+    sweepExpiredPending(pending, now, PENDING_TTL_MS)
   }
 
+  ctx.effect(() => {
+    const id = setInterval(() => sweepPending(Date.now()), 60 * 1000)
+    if (id && typeof id.unref === 'function') id.unref()
+    return () => clearInterval(id)
+  }, 'dsh-subscriptions: pending oauth sweep')
+
   async function completeOAuth({ provider, index, code, state }) {
     if (!state) throw new Error('missing oauth state')
     sweepPending(Date.now())
@@ -401,14 +411,26 @@ export function apply(ctx, rawConfig) {
       challenge: row.challenge,
       state: row.state,
     }, code, fetchForRef(ref) || fetch)
+    const inspection = inspectScopes(actualProvider, blob.scopes)
+    blob.scopes = inspection.scopes
+    blob.scopeWarning = inspection.scopeWarning || ""
     const slots = normalizeSlots(live().slots)
     const slot = slots.find((s) => s.ref === ref)
     if (slot && slot.label) blob.label = slot.label
-    await store.saveBlob(ref, blob)
+    let existing = {}
+    try { existing = await store.loadBlob(ref) } catch { /* no existing blob on fresh auth */ }
+    const merged = { ...existing, ...blob }
+    await store.saveBlob(ref, merged)
+    store.recordSuccess(ref)
+    store.clearRefreshFailure(ref)
+    store.clearCooldown(ref)
     pending.delete(row.state)
     await syncAdapter()
     refreshModels().catch(() => {})
-    return { ref, label: pmL(blob.label || blob.email) || displayName(actualProvider) }
+    if (live().vaultSyncEnabled && live().vaultSyncAutoPush) {
+      syncVaultPush({ live: live(), store }).catch(() => {})
+    }
+    return { ref, label: pmL(merged.label || merged.email) || displayName(actualProvider) }
   }
 
   // Privacy masking
@@ -449,7 +471,7 @@ export function apply(ctx, rawConfig) {
   }
 
   const diagnosticsReport = () => createDiagnosticsReport({ live, store, history, NS, pkgVersion, heartbeatStats })
-  const accountsView = () => createAccountsView({ live, store, fetch, pmL })
+  const accountsView = () => createAccountsView({ live, store, fetch, pmL, pmE, history })
 
   // Ponytail: background refresh ahead of expiry, single timer
   ctx.effect(() => {
@@ -473,15 +495,51 @@ export function apply(ctx, rawConfig) {
           if (!raw) continue
           const blob = await store.loadBlob(ref).catch(() => null)
           if (!blob || !blob.refreshToken) continue
-          const fresh = await store.ensureFresh(slot.provider, blob, ref).catch(() => null)
+          let fresh
+          try {
+            fresh = await store.ensureFresh(slot.provider, blob, ref)
+          } catch (refreshErr) {
+            if (isAuthError(refreshErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: refreshErr && refreshErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            continue
+          }
           if (!fresh) continue
           const vendor = getVendor(slot.provider)
           if (typeof vendor.check !== 'function') continue
           const cfg2 = vendorConfig(slot.provider, live())
           const probeFetch = async (u, i) => ((typeof fetchForRef === 'function' && fetchForRef(ref)) || fetch)(u, i)
-          await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
-            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(e && e.message || e).slice(0, 200))
-          })
+          try {
+            await vendor.check(fresh, cfg2, probeFetch)
+            if (typeof store.rememberDoctorVerdict === 'function') store.rememberDoctorVerdict(ref, null)
+          } catch (checkErr) {
+            if (isAuthError(checkErr)) {
+              store.recordBroken(ref)
+              store.rememberQuarantine(ref, "SESSION_REVOKED", Date.now() + 86400000, 1)
+              try {
+                notifySessionExpired({
+                  ref,
+                  provider: slot.provider,
+                  message: checkErr && checkErr.message,
+                  webhookUrl: cfg.webhookUrl,
+                  fetchImpl: fetch,
+                  nowMs: Date.now(),
+                })
+              } catch { /* alert best-effort */ }
+            }
+            if (logger && logger.warn) logger.warn('[dsh-subscriptions] probe ' + ref + ': ' + String(checkErr && checkErr.message || checkErr).slice(0, 200))
+          }
         } catch { /* best-effort */ }
       }
     }
@@ -499,6 +557,35 @@ export function apply(ctx, rawConfig) {
     return () => clearInterval(timer)
   }, 'dsh-subscriptions: probe loop')
 
+  // #562: Background automated remote vault sync loop
+  ctx.effect(() => {
+    const checkSync = async () => {
+      const cfg = live()
+      if (!cfg.vaultSyncEnabled || !cfg.vaultSyncIntervalHours || cfg.vaultSyncIntervalHours <= 0) return
+      const status = getVaultSyncStatus()
+      const now = Date.now()
+      const intervalMs = cfg.vaultSyncIntervalHours * 3600 * 1000
+      const lastPull = status.lastPullAt ? new Date(status.lastPullAt).getTime() : 0
+      if (now - lastPull >= intervalMs) {
+        try {
+          await syncVaultPull({
+            live: cfg,
+            store,
+            settingsApi: getSettingsApi(),
+            syncAdapter,
+            refreshModels,
+          })
+        } catch { /* status captures error */ }
+      }
+    }
+    const intervalId = setInterval(() => { checkSync().catch(() => {}) }, 60 * 60 * 1000)
+    const initialTimer = setTimeout(() => { checkSync().catch(() => {}) }, 30 * 1000)
+    return () => {
+      clearInterval(intervalId)
+      clearTimeout(initialTimer)
+    }
+  }, 'dsh-subscriptions: vault-sync-loop')
+
   registerRoutes(ctx, {
     NS,
     live,

package/lib/instructions.js

@@ -0,0 +1,138 @@
+export const INSTRUCTIONS = {
+  codex: {
+    title: "OpenAI / ChatGPT Codex",
+    stepsEn: [
+      "1. Log in via CLI on server: run \"codex login\" in terminal.",
+      "2. Click \"📥 From CLI\" to auto-import ~/.codex/auth.json.",
+      "3. Or click \"Device Login\" above and enter the code at auth.openai.com.",
+    ],
+    stepsZh: [
+      "1. 在服务器上通过 CLI 登录：在终端运行 \"codex login\"。",
+      "2. 点击 \"📥 从 CLI 导入\" 自动读取 ~/.codex/auth.json。",
+      "3. 或者点击上方的 \"设备码登录\" (Device Login) 并在 auth.openai.com 输入代码。",
+    ],
+    link: "https://chatgpt.com",
+  },
+  claude: {
+    title: "Claude Code",
+    stepsEn: [
+      "1. Run \"claude login\" in server console.",
+      "2. Click \"📥 From CLI\" — plugin will import ~/.claude/credentials.json.",
+      "3. Or paste your Session Token / API Key from Anthropic Console and click \"Save token\".",
+    ],
+    stepsZh: [
+      "1. 在服务器控制台运行 \"claude login\"。",
+      "2. 点击 \"📥 从 CLI 导入\" — 插件将自动导入 ~/.claude/credentials.json。",
+      "3. 或者从 Anthropic 控制台复制您的 Session Token 或 API Key 并点击 \"保存令牌\"。",
+    ],
+    link: "https://console.anthropic.com/settings/keys",
+  },
+  cursor: {
+    title: "Cursor IDE",
+    stepsEn: [
+      "1. Auto CLI: if Cursor is used on server, click \"📥 From CLI\" (reads from ~/.cursor/cli-config.json).",
+      "2. Manual: open Cursor Settings (Connect button or link below), copy your session token or API key.",
+      "3. Paste it into the input field and click \"Save token\".",
+    ],
+    stepsZh: [
+      "1. CLI 自动导入：若服务器安装了 Cursor，点击 \"📥 从 CLI 导入\" (读取自 ~/.cursor/cli-config.json)。",
+      "2. 手动导入：打开 Cursor 设置页面（点击连接或下方链接），复制 WorkOS 会话令牌或 API 密钥。",
+      "3. 将其粘贴到输入框中并点击 \"保存令牌\"。",
+    ],
+    link: "https://cursor.com/settings",
+  },
+  antigravity: {
+    title: "Google Antigravity / Gemini",
+    stepsEn: [
+      "1. Easiest way: click \"📥 From CLI\" — server already has active token in ~/.gemini/antigravity-cli/antigravity-oauth-token.",
+      "2. Clicking \"📥 From CLI\" instantly loads fresh credentials.",
+      "3. Manual: paste session JSON or OAuth tokens and click \"Save token\".",
+      "Note: \"Connect\" button requires custom Google client_id in plugin settings; use \"📥 From CLI\" for seamless login!",
+    ],
+    stepsZh: [
+      "1. 推荐方式：点击 \"📥 从 CLI 导入\" — 服务器已保存 ~/.gemini/antigravity-cli/antigravity-oauth-token 会话。",
+      "2. 点击 \"📥 从 CLI 导入\" 可即时加载最新的凭据与 refresh_token。",
+      "3. 手动输入：将会话 JSON 或 OAuth access_token/refresh_token 粘贴至输入框并保存。",
+      "注：\"连接\" 按钮需要自定义 Google OAuth Client ID，推荐直接使用 \"📥 从 CLI 导入\"！",
+    ],
+    link: "https://antigravity.google",
+  },
+  kimi: {
+    title: "Moonshot Kimi",
+    stepsEn: [
+      "1. Open Moonshot developer console (link below or click Connect).",
+      "2. Generate and copy your API Key (sk-...).",
+      "3. Paste it into the input field and click \"Save token\".",
+      "4. Or click \"📥 From CLI\" if ~/.kimi-code is configured.",
+    ],
+    stepsZh: [
+      "1. 打开 Moonshot 开发者控制台（点击下方链接或点击连接）。",
+      "2. 创建并复制您的 API 密钥 (sk-...)。",
+      "3. 将密钥粘贴到槽位输入框中并点击 \"保存令牌\"。",
+      "4. 如果配置了 Kimi Code CLI，也可点击 \"📥 从 CLI 导入\" (~/.kimi-code)。",
+    ],
+    link: "https://platform.moonshot.cn/console/api-keys",
+  },
+  glm: {
+    title: "Zhipu GLM (Z.AI)",
+    stepsEn: [
+      "1. Open Zhipu BigModel API Keys center (link below or click Connect).",
+      "2. Copy your GLM API Key.",
+      "3. Paste it into the input field and click \"Save token\".",
+      "4. Or click \"📥 From CLI\" if ZCode CLI is installed (~/.zcode).",
+    ],
+    stepsZh: [
+      "1. 打开智谱 AI 开放平台（点击下方链接或点击连接）。",
+      "2. 复制您的 GLM API 密钥。",
+      "3. 粘贴到输入框中并点击 \"保存令牌\"。",
+      "4. 若已安装 ZCode CLI (~/.zcode)，点击 \"📥 从 CLI 导入\" 即可自动导入。",
+    ],
+    link: "https://bigmodel.cn/usercenter/proj-mgmt/apikeys",
+  },
+  grok: {
+    title: "xAI Grok",
+    stepsEn: [
+      "1. Click \"Device Login\" (or \"Connect\") on the slot card.",
+      "2. A one-time code will appear on the card.",
+      "3. Open https://accounts.x.ai/oauth2/device, enter the code, and approve access for your xAI account.",
+      "4. The plugin automatically captures tokens and enables Grok models.",
+      "5. Or click \"📥 From CLI\" (~/.grok/auth.json) / paste an xAI API Key.",
+    ],
+    stepsZh: [
+      "1. 点击卡片上的 \"设备码登录\" (Device Login) 或 \"连接\"。",
+      "2. 界面将展示一次性设备授权码。",
+      "3. 打开 https://accounts.x.ai/oauth2/device，输入代码，并为您拥有 Grok 订阅的 xAI 账户授权。",
+      "4. 授权成功后，插件会自动捕获会话并激活 Grok 官方模型。",
+      "5. 或点击 \"📥 从 CLI 导入\" (~/.grok/auth.json) / 直接粘贴 xAI API 密钥。",
+    ],
+    link: "https://accounts.x.ai/oauth2/device",
+  },
+  kiro: {
+    title: "AWS Kiro",
+    stepsEn: [
+      "1. Click \"📥 From CLI\" to import from ~/.kiro/credentials.json.",
+      "2. Or paste KIRO_API_KEY and click \"Save token\".",
+    ],
+    stepsZh: [
+      "1. 点击 \"📥 从 CLI 导入\" 从 ~/.kiro/credentials.json 或 ~/.aws/sso 导入凭据。",
+      "2. 或直接粘贴 KIRO_API_KEY 并点击 \"保存令牌\"。",
+    ],
+    link: "https://aws.amazon.com",
+  },
+  copilot: {
+    title: "GitHub Copilot",
+    stepsEn: [
+      "1. Click \"Device Login\" (or \"Connect\") on the slot card.",
+      "2. A one-time code will appear on the card.",
+      "3. Open https://github.com/login/device, enter the code, and approve access for your GitHub account with Copilot subscription.",
+      "4. The plugin automatically captures tokens and enables Copilot models.",
+    ],
+    stepsZh: [
+      "1. 点击卡片上的 \"设备码登录\" (Device Login) 或 \"连接\"。",
+      "2. 界面将展示一次性设备授权码。",
+      "3. 在浏览器打开 https://github.com/login/device 输入代码，并为您拥有 Copilot 订阅的 GitHub 账户授权。",
+      "4. 授权成功后，插件会自动捕获会话并激活 GitHub Copilot 官方模型。",
+    ],
+    link: "https://github.com/login/device",
+  },
+}

package/lib/jwt.js

@@ -1,9 +1,9 @@
-function decodeJwtPayload(token) {
-  const raw = String(token || '')
-  const parts = raw.split('.')
+export function decodeJwtPayload(token) {
+  const raw = String(token || "")
+  const parts = raw.split(".")
   if (parts.length < 2) return null
   try {
-    const json = Buffer.from(parts[1], 'base64url').toString('utf8')
+    const json = Buffer.from(parts[1], "base64url").toString("utf8")
     return JSON.parse(json)
   } catch {
     return null
@@ -12,42 +12,84 @@ function decodeJwtPayload(token) {
 
 export function chatgptAccountId(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
   if (payload.chatgpt_account_id) return String(payload.chatgpt_account_id)
-  const nested = payload['https://api.openai.com/auth']
+  const nested = payload["https://api.openai.com/auth"]
   if (nested && nested.chatgpt_account_id) return String(nested.chatgpt_account_id)
+  if (nested && nested.user_id) return String(nested.user_id)
   const orgs = payload.organizations
   if (Array.isArray(orgs) && orgs[0] && orgs[0].id) return String(orgs[0].id)
-  return ''
+  if (payload.sub) return String(payload.sub)
+  return ""
 }
 
 export function emailFromToken(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload) return ''
-  return String(payload.email || payload.preferred_username || '')
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.email) return String(payload.email)
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.email) return String(openaiProf.email)
+  if (payload.preferred_username) return String(payload.preferred_username)
+  if (payload.upn) return String(payload.upn)
+  return ""
+}
+
+export function planFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  const nested = payload["https://api.openai.com/auth"]
+  if (nested && nested.chatgpt_plan_type) return String(nested.chatgpt_plan_type)
+  const anthropic = payload["https://api.anthropic.com"]
+  if (anthropic && anthropic.plan) return String(anthropic.plan)
+  if (payload.plan_type) return String(payload.plan_type)
+  if (payload.plan) return typeof payload.plan === "string" ? payload.plan : (payload.plan.name || "")
+  if (payload.subscription && payload.subscription.tier) return String(payload.subscription.tier)
+  if (payload.subscription_tier) return String(payload.subscription_tier)
+  if (payload.paidTierName) return String(payload.paidTierName)
+  return ""
+}
+
+export function avatarFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return ""
+  if (payload.picture && typeof payload.picture === "string") return payload.picture
+  if (payload.avatar_url && typeof payload.avatar_url === "string") return payload.avatar_url
+  if (payload.avatar && typeof payload.avatar === "string") return payload.avatar
+  const openaiProf = payload["https://api.openai.com/profile"]
+  if (openaiProf && openaiProf.picture && typeof openaiProf.picture === "string") return openaiProf.picture
+  return ""
+}
+
+export function scopesFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.scope || payload.scp || ""
+  if (Array.isArray(raw)) return raw.map(String).filter(Boolean)
+  if (typeof raw === "string") return raw.split(/[\s,]+/).filter(Boolean)
+  return []
 }
 
 export function isGoogleClientId(str) {
-  if (typeof str !== 'string') return false
+  if (typeof str !== "string") return false
   const trimmed = str.trim()
   return /^[0-9]+-[a-zA-Z0-9_-]+\.apps\.googleusercontent\.com$/.test(trimmed)
 }
 
 export function extractGoogleClientIdFromJwt(token) {
   const payload = decodeJwtPayload(token)
-  if (!payload || typeof payload !== 'object') return ''
+  if (!payload || typeof payload !== "object") return ""
 
-  const azp = typeof payload.azp === 'string' ? payload.azp.trim() : ''
+  const azp = typeof payload.azp === "string" ? payload.azp.trim() : ""
   const rawAud = payload.aud
 
   const audiences = Array.isArray(rawAud)
-    ? rawAud.filter(a => typeof a === 'string').map(a => a.trim())
-    : (typeof rawAud === 'string' && rawAud.trim() ? [rawAud.trim()] : [])
+    ? rawAud.filter(a => typeof a === "string").map(a => a.trim())
+    : (typeof rawAud === "string" && rawAud.trim() ? [rawAud.trim()] : [])
 
   if (azp) {
-    if (!isGoogleClientId(azp)) return ''
+    if (!isGoogleClientId(azp)) return ""
     if (audiences.length > 0 && !audiences.includes(azp)) {
-      return ''
+      return ""
     }
     return azp
   }
@@ -57,5 +99,30 @@ export function extractGoogleClientIdFromJwt(token) {
     return validAuds[0]
   }
 
-  return ''
+  return ""
+}
+
+export function organizationsFromToken(token) {
+  const payload = decodeJwtPayload(token)
+  if (!payload || typeof payload !== "object") return []
+  const raw = payload.organizations ||
+    (payload["https://api.openai.com/auth"] && payload["https://api.openai.com/auth"].organizations) ||
+    payload.orgs ||
+    (payload["https://api.anthropic.com/auth"] && payload["https://api.anthropic.com/auth"].organizations) ||
+    []
+  if (!Array.isArray(raw)) return []
+  const out = []
+  for (const item of raw) {
+    if (typeof item === "string" && item.trim()) {
+      out.push({ id: item.trim(), name: item.trim() })
+    } else if (item && typeof item === "object") {
+      const id = String(item.id || item.org_id || item.uuid || "").trim()
+      const name = String(item.title || item.name || item.org_name || id).trim()
+      const role = item.role ? String(item.role).trim() : undefined
+      if (id) {
+        out.push({ id, name: name || id, ...(role ? { role } : {}) })
+      }
+    }
+  }
+  return out
 }

package/lib/loopback.js

@@ -30,8 +30,9 @@ export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode
   const promise = new Promise((resolve, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || '/', `http://127.0.0.1:${port}`)
-      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra)
-      if (!url.pathname.startsWith(path)) {
+      // The provider may redirect to a suffixed path (e.g. /auth/callback/extra) (#545)
+      const matchesPath = url.pathname === path || (path.endsWith("/") ? url.pathname.startsWith(path) : url.pathname.startsWith(path + "/"));
+      if (!matchesPath) {
         res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' })
         res.end(ERR_HTML)
         return

package/lib/mask.js

@@ -20,6 +20,22 @@ export function maskText(value) {
   return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
 }
 
+const SECRET_PATTERNS = [
+  [/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]'],
+  [/\b(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|xox[baprs])[-_][A-Za-z0-9._-]{8,}/g, '[REDACTED]'],
+  [/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g, '[REDACTED]'],
+  [/\b(access_token|refresh_token|token|key|secret|password)=([^&\s]+)/gi, '$1=[REDACTED]'],
+]
+
+// #578: redact credentials as well as emails from free-text diagnostics.
+export function maskSecrets(value) {
+  let text = maskText(value)
+  for (const [pattern, replacement] of SECRET_PATTERNS) {
+    text = text.replace(pattern, replacement)
+  }
+  return text
+}
+
 export function cleanErrorMessage(raw) {
   if (!raw) return ''
   let text = typeof raw === 'string' ? raw : (raw.message || String(raw))

package/lib/oauth-pending.js

@@ -0,0 +1,12 @@
+// #580: shared expiry sweep for in-memory OAuth pending rows.
+export function sweepExpiredPending(pending, nowMs, ttlMs) {
+  let removed = 0
+  for (const [stateKey, row] of pending) {
+    const createdAt = Number(row && row.createdAt)
+    if (!Number.isFinite(createdAt) || Number(nowMs) - createdAt > Number(ttlMs)) {
+      pending.delete(stateKey)
+      removed += 1
+    }
+  }
+  return removed
+}

package/lib/pricing.js

@@ -0,0 +1,89 @@
+// Subscription Value Delivered & API Cost Equivalent Counter (#561)
+// Translates raw prompt, completion and cache tokens into equivalent official API pricing,
+// comparing delivered value against monthly subscription fee ($20/mo standard).
+
+export const DEFAULT_SUBSCRIPTION_MONTHLY_COST = 20.0
+
+export const TOKEN_RATES = {
+  'claude-3-7-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-sonnet': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'claude-3-5-haiku': { prompt: 0.8, completion: 4.0, cacheRead: 0.08 },
+  'claude-3-opus': { prompt: 15.0, completion: 75.0, cacheRead: 1.5 },
+  'gpt-4o': { prompt: 2.5, completion: 10.0, cacheRead: 1.25 },
+  'gpt-4o-mini': { prompt: 0.15, completion: 0.6, cacheRead: 0.075 },
+  'o1': { prompt: 15.0, completion: 60.0, cacheRead: 7.5 },
+  'o3-mini': { prompt: 1.1, completion: 4.4, cacheRead: 0.55 },
+  'grok-2': { prompt: 2.0, completion: 10.0, cacheRead: 0.2 },
+  'sonar-reasoning': { prompt: 5.0, completion: 25.0, cacheRead: 0.5 },
+  'sonar-pro': { prompt: 3.0, completion: 15.0, cacheRead: 0.3 },
+  'sonar': { prompt: 1.0, completion: 5.0, cacheRead: 0.1 },
+  'gemini-1.5-pro': { prompt: 1.25, completion: 5.0, cacheRead: 0.3 },
+  'gemini-2.0-flash': { prompt: 0.1, completion: 0.4, cacheRead: 0.025 },
+  'default': { prompt: 2.5, completion: 10.0, cacheRead: 0.5 },
+}
+
+/**
+ * Resolves standard token rates per 1M tokens for a given model identifier.
+ * @param {string} [modelId]
+ * @returns {{ prompt: number, completion: number, cacheRead: number }}
+ */
+export function lookupTokenRate(modelId = '') {
+  const m = String(modelId || '').toLowerCase()
+  for (const [key, rates] of Object.entries(TOKEN_RATES)) {
+    if (key !== 'default' && m.includes(key)) {
+      return rates
+    }
+  }
+  return TOKEN_RATES.default
+}
+
+/**
+ * Calculates dollar cost equivalent for the given token quantities.
+ * @param {number} promptTokens
+ * @param {number} completionTokens
+ * @param {number} [cacheReadTokens]
+ * @param {string} [modelId]
+ * @returns {number}
+ */
+export function calculateEquivalentCost(promptTokens = 0, completionTokens = 0, cacheReadTokens = 0, modelId = 'default') {
+  const rates = lookupTokenRate(modelId)
+  const p = (Number(promptTokens) || 0) * (rates.prompt / 1_000_000)
+  const c = (Number(completionTokens) || 0) * (rates.completion / 1_000_000)
+  const cr = (Number(cacheReadTokens) || 0) * (rates.cacheRead / 1_000_000)
+  return Math.round((p + c + cr) * 100) / 100
+}
+
+/**
+ * Computes value delivered metrics and ROI ratio for an account.
+ * @param {object} params
+ * @param {number} [params.promptTokens]
+ * @param {number} [params.completionTokens]
+ * @param {number} [params.cacheReadTokens]
+ * @param {string} [params.modelId]
+ * @param {number} [params.subscriptionCost]
+ * @returns {object}
+ */
+export function calculateValueDelivered({
+  promptTokens = 0,
+  completionTokens = 0,
+  cacheReadTokens = 0,
+  modelId = 'default',
+  subscriptionCost = DEFAULT_SUBSCRIPTION_MONTHLY_COST,
+} = {}) {
+  const equivalentCost = calculateEquivalentCost(promptTokens, completionTokens, cacheReadTokens, modelId)
+  const subCost = Number(subscriptionCost) > 0 ? Number(subscriptionCost) : DEFAULT_SUBSCRIPTION_MONTHLY_COST
+  const roiMultiplier = Math.round((equivalentCost / subCost) * 10) / 10
+  const roiLabel = `${roiMultiplier}x`
+
+  return {
+    equivalentCost,
+    formattedCost: `$${equivalentCost.toFixed(2)}`,
+    subscriptionCost: subCost,
+    formattedSubscriptionCost: `$${subCost.toFixed(2)}`,
+    roiMultiplier,
+    roiLabel,
+    promptTokens: Number(promptTokens) || 0,
+    completionTokens: Number(completionTokens) || 0,
+    cacheReadTokens: Number(cacheReadTokens) || 0,
+  }
+}

package/lib/refs.js

@@ -56,6 +56,8 @@ const DISPLAY = {
   cursor: 'Cursor',
   kiro: 'AWS Kiro',
   copilot: 'GitHub Copilot',
+  perplexity: 'Perplexity Pro',
+  jetbrains: 'JetBrains AI',
 }
 
 export function displayName(provider) {