@goodandready/dsh-subscriptions 0.6.71 → 0.6.82

package/lib/stream-rotate.js

@@ -1,6 +1,7 @@
+import { inspectAccountCapabilities, normalizeCapabilitiesRequest } from './capabilities.js'
 import { defaultConcurrencyQueue } from './concurrency-queue.js'
 import { recordSessionCacheUsage } from './session-pin.js'
-import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
+import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, isAuthError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED, REASON_DEGRADED } from './quarantine.js'
 import { notifySessionExpired, notifyQuarantineEntered } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
@@ -10,7 +11,7 @@ import { resolveAccurateReset } from './reset-clock.js'
 
 export async function* streamWithRotation({
   accounts,
-  nowMs,
+  nowMs = () => Date.now(),
   cooldownMs,
   switchAtRemaining,
   streamOnce,
@@ -111,8 +112,20 @@ export async function* streamWithRotation({
     const queueConfig = {
       signal: options && options.signal,
       timeoutMs: options && (options.queueTimeoutMs !== undefined ? options.queueTimeoutMs : (options.config && options.config.queueTimeoutMs)),
-      maxConcurrency: options && (options.accountMaxConcurrency !== undefined ? options.accountMaxConcurrency : (options.config && options.config.accountMaxConcurrency)),
-      maxQueueSize: options && (options.maxQueueSize !== undefined ? options.maxQueueSize : (options.config && options.config.maxQueueSize)),
+      maxConcurrency: account.maxConcurrency !== undefined
+        ? account.maxConcurrency
+        : (options && options.accountMaxConcurrency !== undefined
+          ? options.accountMaxConcurrency
+          : (options && options.config && options.config.accountMaxConcurrency !== undefined
+            ? options.config.accountMaxConcurrency
+            : 1)),
+      maxQueueSize: account.maxQueueSize !== undefined
+        ? account.maxQueueSize
+        : (options && options.maxQueueSize !== undefined
+          ? options.maxQueueSize
+          : (options && options.config && options.config.maxQueueSize !== undefined
+            ? options.config.maxQueueSize
+            : 20)),
       enabled: options && (options.enableQueue !== undefined ? options.enableQueue : (options.config && options.config.enableQueue !== undefined ? options.config.enableQueue : true)),
     }
 
@@ -146,15 +159,19 @@ export async function* streamWithRotation({
             runawayState.reason = reason
           },
         }
+        const accountCaps = account.capabilities || inspectAccountCapabilities(account.provider || options?.provider, account, account)
+        const adaptedOptions = normalizeCapabilitiesRequest(options, accountCaps)
         const guardedStream = withRunawayGuard(
-          streamOnce(account, { ...options, _runawayState: runawayState }),
+          streamOnce(account, { ...adaptedOptions, _runawayState: runawayState }),
           runawayOpts
         )
         const sentineledStream = withSoftFailureSentinel(guardedStream, {
           enabled: (options?.enableSoftFailureSentinel !== false) && (options?.config?.enableSoftFailureSentinel !== false),
         })
         for await (const chunk of sentineledStream) {
-          firstChunkDelivered = true
+          if (chunk && (chunk.type === 'text-delta' || chunk.type === 'delta' || chunk.text || chunk.content)) {
+            firstChunkDelivered = true
+          }
           const cachedTokens = Number(
             (chunk && chunk.usage && (chunk.usage.cacheReadTokens || chunk.usage.cachedTokens)) ||
             (chunk && chunk.tokens && (chunk.tokens.cacheRead || chunk.tokens.cached)) ||
@@ -191,7 +208,7 @@ export async function* streamWithRotation({
           continue
         }
 
-        if (!isSwitchableError(err)) {
+        if (!isSwitchableError(err) && !isAuthError(err)) {
           currentAttempt.status = 'fatal_error'
           currentAttempt.error = err ? (err.message || String(err)) : 'unknown'
           syncTrace('fatal_error')
@@ -203,9 +220,10 @@ export async function* streamWithRotation({
 
         const accurateUntil = resolveAccurateReset(err, account, options && options.provider, nowMs())
         const isSoft = Boolean(err && (err.code === 'SOFT_FAILURE' || err.isSoftFailure))
+        const isAuth = isAuthError(err)
 
         // Move slot to cooldown and quarantine (#172, #538)
-        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : cooldownMs
+        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : (isAuth ? 86400000 : cooldownMs)
         const cooled = markCooldown(account, nowMs(), effectiveCooldownMs, modelFamily(options && options.provider, options && options.model), accurateUntil)
         account.cooldownUntil = cooled.cooldownUntil
         if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
@@ -214,7 +232,7 @@ export async function* streamWithRotation({
         const code = String(err && err.code || '')
         const reason = isSoft
           ? REASON_DEGRADED
-          : (status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
+          : (isAuth || status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
             ? REASON_REVOKED
             : (status === 403 || code === 'HARD_LIMIT' || code === 'LICENSE_REQUIRED')
               ? REASON_HARD_LIMIT
@@ -226,11 +244,14 @@ export async function* streamWithRotation({
           account.quarantineAttempts = err.warmupAccount.quarantineAttempts
           account.status = err.warmupAccount.status
         } else {
-          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil)
+          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil || (nowMs() + (isAuth ? 86400000 : 3600000)))
           account.quarantineUntil = quarantined.quarantineUntil
           account.quarantineReason = quarantined.quarantineReason
           account.quarantineAttempts = (account.quarantineAttempts || 0) + 1
         }
+        if (isAuth || reason === REASON_REVOKED) {
+          account.isRevoked = true
+        }
 
         currentAttempt.quarantineReason = account.quarantineReason || reason
         currentAttempt.quarantineUntil = account.quarantineUntil

package/lib/updater.js

@@ -24,6 +24,27 @@ export function isLoopback(value) {
 }
 
 export function isTrustedUpdateRequest(request, targetCtx) {
+  const secFetchSite = String(header(request, 'sec-fetch-site') || '').toLowerCase()
+  if (secFetchSite === 'cross-site') return false
+
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin && host) {
+    try {
+      const u = new URL(origin)
+      if (u.protocol === 'http:' || u.protocol === 'https:') {
+        if (u.host.toLowerCase() !== host.toLowerCase()) return false
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') return false
+      } else {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+
   const customHeader = header(request, UPDATE_HEADER)
   if (customHeader === '1') {
     const remote = request.socket?.remoteAddress

package/lib/vault-sync.js

@@ -0,0 +1,412 @@
+// #562: Automated Encrypted Vault Sync via WebDAV, S3, or Private Gist
+// Supports periodic or on-change backup and synchronization of credentials.
+
+import { createHmac, createHash } from 'node:crypto'
+import { exportVault, importVault } from './vault.js'
+import { normalizeSlots } from './accounts.js'
+import { Config, plainConfig } from './config-schema.js'
+
+let syncStatus = {
+  enabled: false,
+  backend: 'webdav',
+  lastPushAt: null,
+  lastPullAt: null,
+  lastPushStatus: 'idle',
+  lastPullStatus: 'idle',
+  lastExportedAt: null,
+  lastError: null,
+}
+
+export function getVaultSyncStatus() {
+  return { ...syncStatus }
+}
+
+export function resetVaultSyncStatus() {
+  syncStatus = {
+    enabled: false,
+    backend: 'webdav',
+    lastPushAt: null,
+    lastPullAt: null,
+    lastPushStatus: 'idle',
+    lastPullStatus: 'idle',
+    lastExportedAt: null,
+    lastError: null,
+  }
+}
+
+// --- Driver: WebDAV ---
+
+export async function pushToWebdav({ url, username, password, encryptedData, fetchFn = fetch }) {
+  if (!url) throw new Error('WebDAV URL is required')
+  const headers = {
+    'Content-Type': 'text/plain; charset=utf-8',
+  }
+  if (username || password) {
+    headers['Authorization'] = 'Basic ' + Buffer.from(`${username || ''}:${password || ''}`).toString('base64')
+  }
+  const res = await fetchFn(url, {
+    method: 'PUT',
+    headers,
+    body: encryptedData,
+  })
+  if (!res.ok && res.status !== 201 && res.status !== 204) {
+    throw new Error(`WebDAV push failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return { ok: true, status: res.status }
+}
+
+export async function pullFromWebdav({ url, username, password, fetchFn = fetch }) {
+  if (!url) throw new Error('WebDAV URL is required')
+  const headers = {}
+  if (username || password) {
+    headers['Authorization'] = 'Basic ' + Buffer.from(`${username || ''}:${password || ''}`).toString('base64')
+  }
+  const res = await fetchFn(url, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) {
+    throw new Error(`WebDAV pull failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return res.text()
+}
+
+// --- Driver: Gist (GitHub / Gitea) ---
+
+export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fetchFn = fetch }) {
+  if (!token) throw new Error('Gist access token is required')
+  const cleanBase = baseUrl.replace(/\/+$/, '')
+  const headers = {
+    'Authorization': `token ${token}`,
+    'Accept': 'application/vnd.github.v3+json, application/json',
+    'Content-Type': 'application/json',
+    'User-Agent': 'dsh-subscriptions-vault-sync',
+  }
+
+  const files = {
+    'dsh-subscriptions-vault.enc': { content: encryptedData },
+  }
+
+  if (gistId) {
+    const res = await fetchFn(`${cleanBase}/gists/${gistId}`, {
+      method: 'PATCH',
+      headers,
+      body: JSON.stringify({
+        description: 'dsh-subscriptions encrypted vault',
+        files,
+      }),
+    })
+    if (!res.ok) throw new Error(`Gist update failed: HTTP ${res.status} ${res.statusText}`)
+    const json = await res.json()
+    return { ok: true, gistId: json.id || gistId }
+  }
+
+  // Create new secret gist
+  const res = await fetchFn(`${cleanBase}/gists`, {
+    method: 'POST',
+    headers,
+    body: JSON.stringify({
+      description: 'dsh-subscriptions encrypted vault',
+      public: false,
+      files,
+    }),
+  })
+  if (!res.ok) throw new Error(`Gist creation failed: HTTP ${res.status} ${res.statusText}`)
+  const json = await res.json()
+  return { ok: true, gistId: json.id }
+}
+
+export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fetchFn = fetch }) {
+  if (!gistId) throw new Error('Gist ID is required')
+  const cleanBase = baseUrl.replace(/\/+$/, '')
+  const headers = {
+    'Accept': 'application/vnd.github.v3+json, application/json',
+    'User-Agent': 'dsh-subscriptions-vault-sync',
+  }
+  if (token) headers['Authorization'] = `token ${token}`
+
+  const res = await fetchFn(`${cleanBase}/gists/${gistId}`, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) throw new Error(`Gist pull failed: HTTP ${res.status} ${res.statusText}`)
+  const json = await res.json()
+  const file = json.files && json.files['dsh-subscriptions-vault.enc']
+  if (!file || !file.content) {
+    throw new Error('dsh-subscriptions-vault.enc not found in Gist')
+  }
+  return file.content
+}
+
+// --- Driver: S3 (SigV4) ---
+
+function hmac(key, str) {
+  return createHmac('sha256', key).update(str, 'utf8').digest()
+}
+
+function sha256Hex(data) {
+  return createHash('sha256').update(data, 'utf8').digest('hex')
+}
+
+export function buildS3SigV4Headers({ method, url, region = 'us-east-1', accessKey, secretKey, body = '', date = new Date() }) {
+  const parsed = new URL(url)
+  const host = parsed.host
+  const path = parsed.pathname || '/'
+
+  const amzDate = date.toISOString().replace(/[:-]|\.\d{3}/g, '')
+  const dateStamp = amzDate.slice(0, 8)
+
+  const payloadHash = sha256Hex(body)
+  const canonicalHeaders = `host:${host}\nx-amz-content-sha256:${payloadHash}\nx-amz-date:${amzDate}\n`
+  const signedHeaders = 'host;x-amz-content-sha256;x-amz-date'
+
+  const canonicalReq = [
+    method.toUpperCase(),
+    path,
+    parsed.search.slice(1),
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join('\n')
+
+  const credentialScope = `${dateStamp}/${region}/s3/aws4_request`
+  const stringToSign = [
+    'AWS4-HMAC-SHA256',
+    amzDate,
+    credentialScope,
+    sha256Hex(canonicalReq),
+  ].join('\n')
+
+  const kDate = hmac('AWS4' + secretKey, dateStamp)
+  const kRegion = hmac(kDate, region)
+  const kService = hmac(kRegion, 's3')
+  const kSigning = hmac(kService, 'aws4_request')
+  const signature = createHmac('sha256', kSigning).update(stringToSign, 'utf8').digest('hex')
+
+  const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+
+  return {
+    'host': host,
+    'x-amz-date': amzDate,
+    'x-amz-content-sha256': payloadHash,
+    'Authorization': authHeader,
+  }
+}
+
+export async function pushToS3({ endpoint, bucket, key = 'dsh-subscriptions-vault.enc', region = 'us-east-1', accessKey, secretKey, encryptedData, fetchFn = fetch }) {
+  if (!endpoint || !accessKey || !secretKey) throw new Error('S3 endpoint, access key, and secret key are required')
+  let cleanEndpoint = endpoint.replace(/\/+$/, '')
+  let targetUrl = bucket ? `${cleanEndpoint}/${bucket}/${key.replace(/^\/+/, '')}` : `${cleanEndpoint}/${key.replace(/^\/+/, '')}`
+
+  const headers = buildS3SigV4Headers({
+    method: 'PUT',
+    url: targetUrl,
+    region,
+    accessKey,
+    secretKey,
+    body: encryptedData,
+  })
+  headers['Content-Type'] = 'text/plain; charset=utf-8'
+
+  const res = await fetchFn(targetUrl, {
+    method: 'PUT',
+    headers,
+    body: encryptedData,
+  })
+  if (!res.ok && res.status !== 200 && res.status !== 204) {
+    throw new Error(`S3 push failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return { ok: true, status: res.status }
+}
+
+export async function pullFromS3({ endpoint, bucket, key = 'dsh-subscriptions-vault.enc', region = 'us-east-1', accessKey, secretKey, fetchFn = fetch }) {
+  if (!endpoint || !accessKey || !secretKey) throw new Error('S3 endpoint, access key, and secret key are required')
+  let cleanEndpoint = endpoint.replace(/\/+$/, '')
+  let targetUrl = bucket ? `${cleanEndpoint}/${bucket}/${key.replace(/^\/+/, '')}` : `${cleanEndpoint}/${key.replace(/^\/+/, '')}`
+
+  const headers = buildS3SigV4Headers({
+    method: 'GET',
+    url: targetUrl,
+    region,
+    accessKey,
+    secretKey,
+    body: '',
+  })
+
+  const res = await fetchFn(targetUrl, {
+    method: 'GET',
+    headers,
+  })
+  if (!res.ok) {
+    throw new Error(`S3 pull failed: HTTP ${res.status} ${res.statusText}`)
+  }
+  return res.text()
+}
+
+// --- Sync Coordination: Push & Pull ---
+
+export async function syncVaultPush({ live, store, fetchFn = fetch }) {
+  const cfg = live && typeof live === 'function' ? live() : (live || {})
+  const passphrase = String(cfg.vaultSyncPassphrase || '').trim()
+  if (!passphrase) {
+    throw new Error('vaultSyncPassphrase is required to sync vault')
+  }
+
+  syncStatus.enabled = Boolean(cfg.vaultSyncEnabled)
+  syncStatus.backend = cfg.vaultSyncBackend || 'webdav'
+  syncStatus.lastPushStatus = 'running'
+
+  try {
+    const slots = cfg.slots || []
+    const blobs = {}
+    for (const slot of normalizeSlots(slots)) {
+      try {
+        const blob = await store.loadBlob(slot.ref)
+        if (blob) blobs[slot.ref] = blob
+      } catch { /* ignore */ }
+    }
+
+    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, passphrase)
+    const backend = cfg.vaultSyncBackend || 'webdav'
+
+    if (backend === 'webdav') {
+      await pushToWebdav({
+        url: cfg.vaultSyncWebdavUrl,
+        username: cfg.vaultSyncWebdavUsername,
+        password: cfg.vaultSyncWebdavPassword,
+        encryptedData: vault,
+        fetchFn,
+      })
+    } else if (backend === 'gist') {
+      const res = await pushToGist({
+        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+        gistId: cfg.vaultSyncGistId,
+        token: cfg.vaultSyncGistToken,
+        encryptedData: vault,
+        fetchFn,
+      })
+      if (res.gistId && !cfg.vaultSyncGistId) {
+        syncStatus.lastGistId = res.gistId
+      }
+    } else if (backend === 's3') {
+      await pushToS3({
+        endpoint: cfg.vaultSyncS3Endpoint,
+        bucket: cfg.vaultSyncS3Bucket,
+        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        region: cfg.vaultSyncS3Region || 'us-east-1',
+        accessKey: cfg.vaultSyncS3AccessKey,
+        secretKey: cfg.vaultSyncS3SecretKey,
+        encryptedData: vault,
+        fetchFn,
+      })
+    } else {
+      throw new Error(`unsupported vault sync backend: ${backend}`)
+    }
+
+    syncStatus.lastPushAt = new Date().toISOString()
+    syncStatus.lastPushStatus = 'ok'
+    syncStatus.lastError = null
+
+    return {
+      ok: true,
+      backend,
+      slotCount,
+      blobCount,
+      timestamp: syncStatus.lastPushAt,
+    }
+  } catch (err) {
+    syncStatus.lastPushStatus = 'error'
+    syncStatus.lastError = String(err && err.message || err)
+    throw err
+  }
+}
+
+export async function syncVaultPull({ live, store, settingsApi, syncAdapter, refreshModels, fetchFn = fetch }) {
+  const cfg = live && typeof live === 'function' ? live() : (live || {})
+  const passphrase = String(cfg.vaultSyncPassphrase || '').trim()
+  if (!passphrase) {
+    throw new Error('vaultSyncPassphrase is required to sync vault')
+  }
+
+  syncStatus.enabled = Boolean(cfg.vaultSyncEnabled)
+  syncStatus.backend = cfg.vaultSyncBackend || 'webdav'
+  syncStatus.lastPullStatus = 'running'
+
+  try {
+    const backend = cfg.vaultSyncBackend || 'webdav'
+    let encryptedData = ''
+
+    if (backend === 'webdav') {
+      encryptedData = await pullFromWebdav({
+        url: cfg.vaultSyncWebdavUrl,
+        username: cfg.vaultSyncWebdavUsername,
+        password: cfg.vaultSyncWebdavPassword,
+        fetchFn,
+      })
+    } else if (backend === 'gist') {
+      encryptedData = await pullFromGist({
+        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+        gistId: cfg.vaultSyncGistId,
+        token: cfg.vaultSyncGistToken,
+        fetchFn,
+      })
+    } else if (backend === 's3') {
+      encryptedData = await pullFromS3({
+        endpoint: cfg.vaultSyncS3Endpoint,
+        bucket: cfg.vaultSyncS3Bucket,
+        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        region: cfg.vaultSyncS3Region || 'us-east-1',
+        accessKey: cfg.vaultSyncS3AccessKey,
+        secretKey: cfg.vaultSyncS3SecretKey,
+        fetchFn,
+      })
+    } else {
+      throw new Error(`unsupported vault sync backend: ${backend}`)
+    }
+
+    const result = importVault(encryptedData, passphrase)
+
+    // Merge slots into live configuration
+    if (result.slots.length && settingsApi) {
+      const curSlots = Array.isArray(cfg.slots) ? cfg.slots.slice() : []
+      for (const s of result.slots) {
+        const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
+        if (idx >= 0) {
+          curSlots[idx] = { ...curSlots[idx], ...s }
+        } else {
+          curSlots.push(s)
+        }
+      }
+      const parsed = plainConfig(Config({ ...cfg, slots: curSlots }))
+      await settingsApi.replace(parsed)
+    }
+
+    // Save blobs into store
+    let blobCount = 0
+    for (const [ref, blob] of Object.entries(result.blobs)) {
+      await store.saveBlob(ref, blob)
+      blobCount++
+    }
+
+    if (typeof syncAdapter === 'function') await syncAdapter()
+    if (typeof refreshModels === 'function') refreshModels().catch(() => {})
+
+    syncStatus.lastPullAt = new Date().toISOString()
+    syncStatus.lastExportedAt = result.exportedAt
+    syncStatus.lastPullStatus = 'ok'
+    syncStatus.lastError = null
+
+    return {
+      ok: true,
+      backend,
+      slotCount: result.slots.length,
+      blobCount,
+      exportedAt: result.exportedAt,
+      timestamp: syncStatus.lastPullAt,
+    }
+  } catch (err) {
+    syncStatus.lastPullStatus = 'error'
+    syncStatus.lastError = String(err && err.message || err)
+    throw err
+  }
+}

package/lib/vault.js

@@ -17,7 +17,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
 
   const payload = {
     format: VAULT_FORMAT,
-    version: '0.6.18',
+    version: '0.6.77',
     exportedAt: new Date().toISOString(),
     exportedBy,
     slots: Array.isArray(slots) ? slots : [],

package/lib/vendor-factory.js

@@ -111,14 +111,14 @@ export function createVendorFromProfile(profile) {
       return null
     },
     check: undefined,
-    async* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {
+    async* streamOnce({ blob, options, fetchImpl, headers, signal }) {
       const body = codexResponsesBody(options, "")
       if (!body.instructions) delete body.instructions
       const res = await fetchWithTimeout(fetchImpl || fetch, `${base}/responses`, {
         method: "POST",
         headers: {
           ...headers,
-          ...identityHeaders(blob, config),
+          ...identityHeaders(blob),
           "Content-Type": "application/json",
           Accept: "text/event-stream",
         },
@@ -139,12 +139,16 @@ export function validateProfile(raw) {
   }
   if (!/^[a-z][a-z0-9_]*$/.test(p.id)) throw new Error(`customVendors: id "${p.id}" must match [a-z][a-z0-9_]*`)
   if (p.tokenStyle && !["form", "json"].includes(p.tokenStyle)) throw new Error(`customVendors[${p.id}]: tokenStyle must be form|json`)
+  const localHostnames = new Set(["localhost", "127.0.0.1", "::1", "[::1]"])
   for (const key of ["authUrl", "tokenUrl", "baseUrl"]) {
     try {
       const u = new URL(p[key])
       if (u.protocol !== "https:" && u.protocol !== "http:") {
         throw new Error("protocol must be http: or https:")
       }
+      if (u.protocol === "http:" && !localHostnames.has(u.hostname)) {
+        throw new Error("http is allowed only for localhost")
+      }
     } catch (e) {
       throw new Error(`customVendors[${p.id}]: field ${key} must be a valid http(s) URL (${e.message || e})`)
     }

package/lib/vendors/antigravity.js

@@ -3,7 +3,7 @@ import { buildAuthorizeUrl } from '../oauth.js'
 import { googleContents } from '../messages.js'
 import { formTokenRequest, googleStream, throwHttpError, tokenBlobFromOAuth } from '../wire.js'
 import { fetchWithTimeout } from '../http.js'
-import { emailFromToken } from '../jwt.js'
+import { emailFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import {
   CODE_ASSIST_STREAM,
   antigravityMetadata,
@@ -125,7 +125,16 @@ export async function exchangeCode(cfg, pkce, code, fetchImpl) {
     clientId: cfg.clientId,
     ...(cfg.clientSecret ? { clientSecret: cfg.clientSecret } : {}),
   })
-  const labeled = { ...blob, email: blob.email || emailFromToken(blob.accessToken), label: blob.label || 'Antigravity' }
+  const email = blob.email || emailFromToken(blob.idToken || blob.accessToken)
+  const avatarUrl = blob.avatarUrl || avatarFromToken(blob.idToken || blob.accessToken)
+  const scopes = blob.scopes?.length ? blob.scopes : (json?.scope ? String(json.scope).split(/[\s,]+/).filter(Boolean) : scopesFromToken(blob.idToken || blob.accessToken))
+  const labeled = {
+    ...blob,
+    email,
+    avatarUrl,
+    scopes,
+    label: blob.label || email || "Antigravity",
+  }
   return withProject(labeled, fetchImpl)
 }