@goodandready/dsh-subscriptions 0.6.72 → 0.6.82

package/lib/client.js

@@ -154,6 +154,24 @@ window.__ModuleLoader__.load({
       "recentErrorsDesc": "Last 20 runtime failures across model streams and providers (sanitized).",
       "recentErrorsClear": "Clear Log",
       "recentErrorsEmpty": "No recent errors recorded",
+      "atRestEncrypted": "Encrypted at Rest (AES-256-GCM)",
+      "atRestEncryptedTitle": "Credentials are protected at rest with master key encryption.",
+      "maxConcurrencySlotTitle": "Max parallel streams for this account slot (default: 1)",
+      "concurrencyQueueHint": "Active and queued parallel requests for this account",
+      "activeStreams": "active",
+      "queuedStreams": "queued",
+      "pacingRunwayHint": "Estimated time before quota exhausts at current pace",
+      "runwayPrefix": "Runway",
+      "billingAlertHint": "Billing status notice from provider",
+      "renewalHint": "Subscription billing cycle renewal date",
+      "valueDeliveredHint": "Equivalent official API cost of consumed tokens vs subscription price",
+      "capabilitiesHint": "Subscription capabilities, context window and model features",
+      "orPasteVaultPayload": "or paste vault payload below",
+      "workspaceTitle": "Organization / Workspace",
+      "workspaceSelect": "Select active organization/workspace",
+      "personalWorkspace": "Personal Default",
+      "windowResetsAt": "Window resets at",
+      "quotaRecovery": "Quota recovery",
       "toastCooldownRecovered": "is now available (cooldown expired)",
       "modelsCatalogTitle": "Curated Subscription Models",
       "modelsCatalogDesc": "Available model catalog across active subscriptions in DeepSeek Harness.",
@@ -265,6 +283,11 @@ window.__ModuleLoader__.load({
       "instructionsTitle": "How to obtain token",
       "close": "Close",
       "reconnectRequired": "Reconnect required",
+      "reconnectNow": "Re-authenticate now",
+      "scopeWarning": "OAuth scope warning",
+      "reconnectScope": "Re-grant scopes",
+      "sessionRevokedBadge": "Revoked / Expired",
+      "sessionRevokedWarning": "Session expired / revoked — re-authorization required",
       "manualTitle": "If the browser did not come back",
       "updateChecking": "Checking updates…",
       "updateUpToDate": "Up to date",
@@ -309,6 +332,19 @@ window.__ModuleLoader__.load({
       "toastReleased": "Account active and healthy",
       "toastQuotaWarning": "Quota threshold exceeded",
       "enableToasts": "In-app toast alerts",
+      "headlessTip": "Headless / Remote Server?",
+      "headlessSshCommand": "SSH Port Forward Command:",
+      "headlessCopySsh": "Copy SSH Command",
+      "headlessCopied": "Copied!",
+      "headlessScanQr": "Scan with Mobile to Authenticate:",
+      "vaultSyncTitle": "Automated Remote Vault Sync",
+      "vaultSyncPush": "Sync Now (Push)",
+      "vaultSyncPull": "Sync Now (Pull)",
+      "vaultSyncPushOk": "Vault successfully pushed to remote storage",
+      "vaultSyncPullOk": "Vault successfully pulled and merged from remote storage",
+      "vaultSyncBackend": "Backend:",
+      "vaultSyncLastPush": "Last Push:",
+      "vaultSyncLastPull": "Last Pull:",
       "groupQueue": "Concurrency & Request Queue",
       "enableQueue": "Enable request queue",
       "enableQueueHint": "Queue excess requests when account hits concurrency limit instead of failing with 429",
@@ -450,6 +486,24 @@ window.__ModuleLoader__.load({
       "recentErrorsDesc": "最近 20 条流式传输与 API 调用失败记录（已脱敏）。",
       "recentErrorsClear": "清空记录",
       "recentErrorsEmpty": "暂无错误记录",
+      "atRestEncrypted": "静态存储加密 (AES-256-GCM)",
+      "atRestEncryptedTitle": "凭据已通过主密钥进行静态 AES-256-GCM 加密保护。",
+      "maxConcurrencySlotTitle": "当前账户槽位最大并发请求数（默认：1）",
+      "concurrencyQueueHint": "当前账户槽位进行中与排队中的并发请求",
+      "activeStreams": "活跃",
+      "queuedStreams": "排队中",
+      "pacingRunwayHint": "当前调用速度下的预计剩余可用时间",
+      "runwayPrefix": "可用时长",
+      "billingAlertHint": "服务商账单状态提示",
+      "renewalHint": "订阅账单周期续费日期",
+      "valueDeliveredHint": "消耗 Token 对应的官方 API 价值对比订阅费用",
+      "capabilitiesHint": "订阅账号模型上下文窗口与特权特性",
+      "orPasteVaultPayload": "或在下方粘贴保险库文本",
+      "workspaceTitle": "工作区与组织",
+      "workspaceSelect": "选择生效的工作区或组织",
+      "personalWorkspace": "个人默认",
+      "windowResetsAt": "额度重置于",
+      "quotaRecovery": "额度恢复",
       "toastCooldownRecovered": "已解除冷却恢复可用",
       "modelsCatalogTitle": "精选订阅模型",
       "modelsCatalogDesc": "当前 DeepSeek Harness 活跃订阅下可用模型一览。",
@@ -561,6 +615,11 @@ window.__ModuleLoader__.load({
       "instructionsTitle": "获取令牌指引",
       "close": "关闭",
       "reconnectRequired": "需要重新连接",
+      "reconnectNow": "立即重新认证",
+      "scopeWarning": "OAuth权限范围警告",
+      "reconnectScope": "重新授权权限",
+      "sessionRevokedBadge": "已失效 / 过期",
+      "sessionRevokedWarning": "会话已过期或失效 — 需要重新授权",
       "manualTitle": "若浏览器未能自动跳转回调",
       "updateChecking": "检查更新中…",
       "updateUpToDate": "已是最新版本",
@@ -602,6 +661,19 @@ window.__ModuleLoader__.load({
       "releaseQuarantineTitle": "立即解除账户隔离状态",
       "resetsIn": "重置倒计时",
       "toastQuarantined": "账户进入隔离期",
+      "headlessTip": "无头环境 / 远程服务器？",
+      "headlessSshCommand": "SSH 端口转发命令：",
+      "headlessCopySsh": "复制 SSH 命令",
+      "headlessCopied": "已复制！",
+      "headlessScanQr": "使用手机扫描以登录：",
+      "vaultSyncTitle": "远程加密保管库自动同步",
+      "vaultSyncPush": "立即同步 (推送)",
+      "vaultSyncPull": "立即同步 (拉取)",
+      "vaultSyncPushOk": "保管库已成功推送到远程存储",
+      "vaultSyncPullOk": "已从远程存储拉取并合并保管库",
+      "vaultSyncBackend": "存储后端：",
+      "vaultSyncLastPush": "上次推送：",
+      "vaultSyncLastPull": "上次拉取：",
       "toastReleased": "账户已解除隔离恢复使用",
       "toastQuotaWarning": "额度预警",
       "enableToasts": "应用内弹窗提醒",
@@ -678,6 +750,11 @@ window.__ModuleLoader__.load({
         else if (p.indexOf('team') >= 0) label = 'Team'
         else if (p.indexOf('plus') >= 0) label = 'Plus'
         else if (p.indexOf('enterp') >= 0) label = 'Enterprise'
+      } else if (provider === 'claude') {
+        if (p.indexOf('enterp') >= 0) label = 'Enterprise'
+        else if (p.indexOf('team') >= 0) label = 'Team'
+        else if (p.indexOf('max') >= 0) label = 'Max'
+        else if (p.indexOf('pro') >= 0) label = 'Pro'
       } else if (provider === 'grok') {
         if (p.indexOf('super') >= 0) label = 'SuperGrok'
         else if (p.indexOf('plus') >= 0) label = 'X Premium+'
@@ -689,6 +766,10 @@ window.__ModuleLoader__.load({
         label = 'Coding Plan'
       } else if (provider === 'glm') {
         label = '150% Boost'
+      } else if (provider === 'perplexity') {
+        label = 'Pro'
+      } else if (provider === 'jetbrains') {
+        label = 'AI Assistant'
       }
       return label ? h('span', { className: 'dsub-planBadge' }, label) : null
     }
@@ -718,22 +799,27 @@ window.__ModuleLoader__.load({
       const ms = (props.resetAt || 0) - now
       if (ms <= 0) return null
       const total = Math.floor(ms / 1000)
+      const d = new Date(props.resetAt)
+      const pad = (n) => String(n).padStart(2, '0')
+      const timeStr = pad(d.getHours()) + ':' + pad(d.getMinutes())
+      const relStr = formatRelativeReset(props.resetAt, t('lang'), now)
       if (total > 3600) {
         return h('span', { className: 'dsub-sub', style: { fontVariantNumeric: 'tabular-nums' } },
-          t('resetLabel') + ' ' + formatRelativeReset(props.resetAt, t('lang'), now))
+          '⏳ ' + t('windowResetsAt') + ' ' + timeStr + ' (' + relStr + ')')
       }
       const m = Math.floor(total / 60)
       const sec = total % 60
-      const pad = (n) => String(n).padStart(2, '0')
       return h('span', { className: 'dsub-sub', style: { fontVariantNumeric: 'tabular-nums' } },
-        t('resetLabel') + ' ' + pad(m) + ':' + pad(sec))
+        '⏳ ' + t('windowResetsAt') + ' ' + timeStr + ' (' + relStr + ' · ' + pad(m) + ':' + pad(sec) + ')')
     }
 
     function badgeFor(account, t) {
       if (!account || !account.configured) return t('notConnected')
+      if (account.isRevoked) return t('sessionRevokedBadge')
       if (account.validationUrl) return t('verifyAccount')
       // Issue 303: a quarantined account says why it is parked.
       if (account.quarantineReason && account.quarantineUntil && account.quarantineUntil > Date.now()) {
+        if (account.quarantineReason === 'SESSION_REVOKED' || account.quarantineReason === 'REVOKED') return t('sessionRevokedBadge')
         return account.quarantineReason === 'VERIFY' ? t('verifyAccount') : String(account.quarantineReason)
       }
       if (account.cooldownUntil && account.cooldownUntil > Date.now()) {
@@ -885,6 +971,53 @@ window.__ModuleLoader__.load({
       const [smoke, setSmoke] = React.useState({ testing: false, result: null })
       const [updater, setUpdater] = React.useState({ checking: false, updating: false, status: null, message: '' })
       const [backupModal, setBackupModal] = React.useState(null)
+      const [vaultSyncInfo, setVaultSyncInfo] = React.useState(null)
+      const [vaultSyncLoading, setVaultSyncLoading] = React.useState(false)
+      const [headlessInfo, setHeadlessInfo] = React.useState({})
+      const [copiedSsh, setCopiedSsh] = React.useState({})
+
+      const loadVaultSyncStatus = () => {
+        fetch('/dsh-subscriptions/vault/sync/status')
+          .then((r) => r.json())
+          .then((d) => { if (d && d.ok) setVaultSyncInfo(d.status) })
+          .catch(() => {})
+      }
+
+      const doVaultSyncPush = async () => {
+        setBackupErr(''); setBackupInfo(''); setVaultSyncLoading(true)
+        try {
+          const res = await fetch('/dsh-subscriptions/vault/sync/push', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+          })
+          const d = await res.json().catch(() => ({}))
+          if (!res.ok || !d.ok) throw new Error((d.error && d.error.message) || ('HTTP ' + res.status))
+          setBackupInfo(t('vaultSyncPushOk'))
+          if (d.status) setVaultSyncInfo(d.status)
+        } catch (e) {
+          setBackupErr(cleanErrorMessage(e.message || e))
+        }
+        setVaultSyncLoading(false)
+      }
+
+      const doVaultSyncPull = async () => {
+        setBackupErr(''); setBackupInfo(''); setVaultSyncLoading(true)
+        try {
+          const res = await fetch('/dsh-subscriptions/vault/sync/pull', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+          })
+          const d = await res.json().catch(() => ({}))
+          if (!res.ok || !d.ok) throw new Error((d.error && d.error.message) || ('HTTP ' + res.status))
+          setBackupInfo(t('vaultSyncPullOk') + (d.result ? ' (' + d.result.slotCount + ' slots)' : ''))
+          if (d.status) setVaultSyncInfo(d.status)
+          if (d.accounts) setAccounts(d.accounts)
+          await reload()
+        } catch (e) {
+          setBackupErr(cleanErrorMessage(e.message || e))
+        }
+        setVaultSyncLoading(false)
+      }
       const [backupPass, setBackupPass] = React.useState('')
       const [backupData, setBackupData] = React.useState('')
       const [backupErr, setBackupErr] = React.useState('')
@@ -959,7 +1092,7 @@ window.__ModuleLoader__.load({
           const url = URL.createObjectURL(blob)
           const a = document.createElement('a')
           a.href = url
-          a.download = 'dsh-subscriptions-backup.enc'
+          a.download = 'dsh-subscriptions-vault.enc'
           document.body.appendChild(a)
           a.click()
           document.body.removeChild(a)
@@ -1176,6 +1309,8 @@ window.__ModuleLoader__.load({
         const res = await fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(provider) + '&index=' + encodeURIComponent(index), { cache: 'no-store' })
         const data = await res.json().catch(() => ({}))
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+        const key = provider + ':' + index
+        if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
         if (data.url) window.open(data.url, '_blank', 'noopener')
       }
 
@@ -1191,6 +1326,7 @@ window.__ModuleLoader__.load({
         })
         const data = await res.json().catch(() => ({}))
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+        if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
         setDevice((m) => Object.assign({}, m, { [key]: { state: data.state, userCode: data.userCode, authUrl: data.authUrl, intervalMs: data.intervalMs || 5000, status: 'pending' } }))
       }
 
@@ -1353,6 +1489,22 @@ window.__ModuleLoader__.load({
         setTokenDraft((d) => Object.assign({}, d, { [provider + ':' + index]: '' }))
       }
 
+      const switchOrg = async (provider, index, organizationId) => {
+        setErr('')
+        try {
+          const res = await fetch('/dsh-subscriptions/accounts/switch-organization', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ provider, index, organizationId }),
+          })
+          const data = await res.json().catch(() => ({}))
+          if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+          if (data.accounts) setAccounts(data.accounts)
+        } catch (e) {
+          setErr(cleanErrorMessage(e.message || e))
+        }
+      }
+
       const addSlot = (provider) => {
         const used = slots.filter((s) => s.provider === provider).map((s) => s.index)
         let index = 1
@@ -1958,8 +2110,8 @@ window.__ModuleLoader__.load({
             h('button', { type: 'button', className: 'dsub-mini', onClick: () => runWizard(null, null, null, false) }, '🩺 ' + t('wizardAll')),
             h('button', { type: 'button', className: 'dsub-mini', onClick: genDiag }, t('diagGenerate')),
             h('button', { type: 'button', className: 'dsub-mini', onClick: runAnalyzeSession }, analyzingCache ? '…' : t('cacheAnalyze')),
-            h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('export'); setBackupErr(''); setBackupInfo('') } }, '🔒 ' + t('backupExport')),
-            h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('import'); setBackupErr(''); setBackupInfo('') } }, '📥 ' + t('backupImport')),
+            h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('export'); setBackupErr(''); setBackupInfo(''); loadVaultSyncStatus() } }, '🔒 ' + t('backupExport')),
+            h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setBackupModal('import'); setBackupErr(''); setBackupInfo(''); loadVaultSyncStatus() } }, '📥 ' + t('backupImport')),
             h('a', { href: 'https://github.com/GooDAnDReaDY/dsh-subscriptions/issues', target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('diagIssues')),
           ),
           h('div', { className: 'dsub-sub' }, t('diagHint')),
@@ -2086,6 +2238,24 @@ window.__ModuleLoader__.load({
               backupModal === 'export' ? t('backupExportHint') : t('backupImportHint')
             ),
             h('div', { style: { display: 'flex', flexDirection: 'column', gap: '8px', marginTop: '8px' } },
+              backupModal === 'import' ? h('div', { className: 'dsub-row', style: { gap: '8px', alignItems: 'center' } },
+                h('input', {
+                  type: 'file',
+                  accept: '.enc,.txt',
+                  className: 'dsub-mini',
+                  style: { maxWidth: '220px' },
+                  onChange: (e) => {
+                    const f = e.target.files && e.target.files[0]
+                    if (!f) return
+                    const reader = new window.FileReader()
+                    reader.onload = (evt) => {
+                      if (evt.target && evt.target.result) setBackupData(String(evt.target.result))
+                    }
+                    reader.readAsText(f)
+                  },
+                }),
+                h('span', { className: 'dsub-sub' }, t('orPasteVaultPayload'))
+              ) : null,
               backupModal === 'import' ? h('textarea', {
                 className: 'dsub-diag',
                 style: { width: '100%', height: '80px', fontFamily: 'monospace', fontSize: '11px' },
@@ -2127,7 +2297,34 @@ window.__ModuleLoader__.load({
                   onClick: downloadBackupFile,
                 }, t('backupDownload')),
                 h('pre', { className: 'dsub-diag', style: { maxHeight: '60px', overflow: 'hidden', textOverflow: 'ellipsis' } }, backupData)
-              ) : null
+              ) : null,
+              h('div', {
+                className: 'dsub-panel-box',
+                style: { marginTop: 10, padding: '10px 12px', borderTop: '1px solid var(--dsw-alias-border-l2)' }
+              },
+                h('div', { className: 'dsub-panel-title' },
+                  h('span', null, '☁️ ' + t('vaultSyncTitle')),
+                  h('div', { style: { display: 'flex', gap: 6 } },
+                    h('button', {
+                      type: 'button',
+                      className: 'dsub-mini',
+                      disabled: vaultSyncLoading,
+                      onClick: doVaultSyncPush,
+                    }, vaultSyncLoading ? '…' : t('vaultSyncPush')),
+                    h('button', {
+                      type: 'button',
+                      className: 'dsub-mini',
+                      disabled: vaultSyncLoading,
+                      onClick: doVaultSyncPull,
+                    }, vaultSyncLoading ? '…' : t('vaultSyncPull'))
+                  )
+                ),
+                vaultSyncInfo ? h('div', { className: 'dsub-sub', style: { marginTop: 4 } },
+                  t('vaultSyncBackend') + ' ' + (vaultSyncInfo.backend || 'webdav') + ' · ' +
+                  t('vaultSyncLastPush') + ' ' + (vaultSyncInfo.lastPushAt ? new Date(vaultSyncInfo.lastPushAt).toLocaleTimeString() : 'never') + ' · ' +
+                  t('vaultSyncLastPull') + ' ' + (vaultSyncInfo.lastPullAt ? new Date(vaultSyncInfo.lastPullAt).toLocaleTimeString() : 'never')
+                ) : null
+              )
             )
           ) : null,
         ),
@@ -2141,20 +2338,30 @@ window.__ModuleLoader__.load({
               const account = accountOf(row.slot.provider, row.slot.index)
               const key = row.slot.provider + ':' + row.slot.index
               const on = !!account.configured
+              const avatarEl = (account.avatarUrl ? h('img', {
+                src: account.avatarUrl,
+                alt: account.email || account.label || 'Avatar',
+                className: 'dsub-avatar',
+                onError: (e) => { e.target.style.display = 'none' },
+              }) : (account.email ? h('span', {
+                className: 'dsub-avatar dsub-avatar-initials',
+                title: account.email,
+              }, (account.email.charAt(0) || '?').toUpperCase()) : null))
               return h('div', { className: 'dsub-card', key: key },
-                h('div', { className: 'dsub-row' },
+                h('div', { className: 'dsub-row', style: { alignItems: 'center' } },
+                  avatarEl,
                   h('input', {
                     className: 'dsub-grow',
                     value: row.slot.label || '',
-                    placeholder: account.label || (t('accountLabel') + ' ' + row.slot.index),
+                    placeholder: account.email || account.label || (t('accountLabel') + ' ' + row.slot.index),
                     onChange: (e) => {
                       const next = slots.slice()
                       next[row.i] = Object.assign({}, next[row.i], { label: e.target.value })
                       setSlots(next)
                     },
                   }),
-                  h('span', { className: 'dsub-badge' + (account.validationUrl ? ' dsub-badge-warn' : (on ? ' dsub-badge-on' : '')) }, badgeFor(account, t)),
-                  normalizePlanBadge(row.slot.provider, account.plan || (account.quota && account.quota.plan)),
+                  h('span', { className: 'dsub-badge' + (account.isRevoked ? ' dsub-badge-bad' : (account.validationUrl ? ' dsub-badge-warn' : (on ? ' dsub-badge-on' : ''))) }, badgeFor(account, t)),
+                  normalizePlanBadge(row.slot.provider, account.plan || account.paidTierName || (account.quota && account.quota.plan)),
                   h('button', {
                     type: 'button', className: 'dsub-mini',
                     onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
@@ -2233,8 +2440,8 @@ window.__ModuleLoader__.load({
                   h('span', { className: 'dsub-sub', style: { color: 'var(--dsw-alias-state-error-primary)', fontVariantNumeric: 'tabular-nums' } },
                     '⛔ ' + (account.quarantineReason || 'QUARANTINE') + ' · ' + t('resetsIn') + ' ' + formatRelativeReset(account.quarantineUntil, t('lang'), Date.now())
                   ),
-                ) : (account && account.quota && account.quota.resetAt && Number(account.quota.resetAt) > Date.now()) ? h('div', { className: 'dsub-row', style: { marginTop: 4 } },
-                  h(ResetCountdown, { resetAt: account.quota.resetAt }),
+                ) : (account && (account.resetAt || (account.quota && account.quota.resetAt)) && Number(account.resetAt || account.quota.resetAt) > Date.now()) ? h('div', { className: 'dsub-row', style: { marginTop: 4 } },
+                  h(ResetCountdown, { resetAt: account.resetAt || account.quota.resetAt }),
                 ) : null,
                 h('div', { className: 'dsub-manual' },
                   h('span', { className: 'dsub-sub' }, t('manualTitle')),
@@ -2250,6 +2457,36 @@ window.__ModuleLoader__.load({
                     onClick: () => complete(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, t('submitCode')),
                 ),
+                (headlessInfo[key] ? h('div', {
+                  className: 'dsub-panel-box',
+                  style: { marginTop: 6, padding: '8px 12px', background: 'var(--dsw-alias-bg-layer-2)' }
+                },
+                  h('div', { style: { fontWeight: 600, fontSize: '11px', display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
+                    h('span', null, '🌐 ' + t('headlessTip')),
+                    h('button', {
+                      type: 'button',
+                      className: 'dsub-mini',
+                      onClick: () => {
+                        try {
+                          navigator.clipboard.writeText(headlessInfo[key].sshTunnelCommand)
+                          setCopiedSsh((m) => Object.assign({}, m, { [key]: true }))
+                          setTimeout(() => setCopiedSsh((m) => Object.assign({}, m, { [key]: false })), 2000)
+                        } catch { /* ignore */ }
+                      }
+                    }, copiedSsh[key] ? ('✓ ' + t('headlessCopied')) : ('📋 ' + t('headlessCopySsh')))
+                  ),
+                  h('div', { style: { fontFamily: 'monospace', fontSize: '11px', margin: '4px 0', wordBreak: 'break-all' } },
+                    headlessInfo[key].sshTunnelCommand
+                  ),
+                  headlessInfo[key].svgDataUrl ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
+                    h('div', { className: 'dsub-sub', style: { marginBottom: 4 } }, t('headlessScanQr')),
+                    h('img', {
+                      src: headlessInfo[key].svgDataUrl,
+                      alt: 'QR Code',
+                      style: { width: '130px', height: '130px', borderRadius: '4px', background: '#fff', padding: '4px' }
+                    })
+                  ) : null
+                ) : null),
                 h('div', { className: 'dsub-row', style: { justifyContent: 'space-between' } },
                   h('button', {
                     type: 'button',
@@ -2348,6 +2585,26 @@ window.__ModuleLoader__.load({
                     disabled: checking['proxy:' + key],
                     onClick: () => doProxyCheck(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
                   }, checking['proxy:' + key] ? '\u2026' : t('proxyCheck')),
+                  h('span', {
+                    style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'inline-flex', alignItems: 'center', gap: '3px' },
+                    title: t('maxConcurrencySlotTitle')
+                  },
+                    '⚡',
+                    h('input', {
+                      type: 'number',
+                      min: 1,
+                      max: 20,
+                      style: { width: '44px', padding: '1px 4px', fontSize: '11px', textAlign: 'center' },
+                      value: row.slot.maxConcurrency !== undefined ? row.slot.maxConcurrency : 1,
+                      title: t('maxConcurrencySlotTitle'),
+                      onChange: (e) => {
+                        const next = slots.slice()
+                        const val = parseInt(e.target.value, 10)
+                        next[row.i] = Object.assign({}, next[row.i], { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
+                        setSlots(next)
+                      },
+                    })
+                  ),
                 ),
                 (function(){
                   var r = proxyRes[key]
@@ -2439,7 +2696,30 @@ window.__ModuleLoader__.load({
                   )
                 })() : null),
                 account.accountNotice ? h('div', { className: 'dsub-verify' }, account.accountNotice) : null,
-                account.refreshError ? h('div', { className: 'dsub-bad' }, t('reconnectRequired') + ': ' + account.refreshError) : null,
+                account.scopeWarning ? h('div', { className: 'dsub-scope-banner' },
+                  h('span', { style: { color: 'var(--dsw-alias-state-warn-primary)' } }, '⚠️ ' + t('scopeWarning') + ': ' + account.scopeWarning),
+                  h('button', {
+                    type: 'button',
+                    className: 'dsub-mini',
+                    onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
+                  }, '🔄 ' + t('reconnectScope'))
+                ) : null,
+                (account.isRevoked || account.authWarning) ? h('div', { className: 'dsub-bad dsub-row', style: { alignItems: 'center', justifyContent: 'space-between', gap: '8px', marginBottom: '6px' } },
+                  h('span', null, '⛔ ' + (account.authWarning || t('sessionRevokedWarning'))),
+                  h('button', {
+                    type: 'button',
+                    className: 'dsub-mini dsub-btn-primary',
+                    onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
+                  }, '🔄 ' + t('reconnectNow'))
+                ) : null,
+                account.refreshError ? h('div', { className: 'dsub-bad dsub-row', style: { alignItems: 'center', justifyContent: 'space-between', gap: '8px' } },
+                  h('span', null, t('reconnectRequired') + ': ' + account.refreshError),
+                  h('button', {
+                    type: 'button',
+                    className: 'dsub-mini dsub-btn-primary',
+                    onClick: () => connect(row.slot.provider, row.slot.index).catch((e) => setErr(cleanErrorMessage(e.message || e))),
+                  }, '🔄 ' + t('reconnectNow'))
+                ) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return h('div', {className: cls}, txt) })(),
                 account.validationUrl ? h('div', { className: 'dsub-verify' },
                   t('verifyPrefix'),
@@ -2523,10 +2803,25 @@ window.__ModuleLoader__.load({
                     h('div', { className: 'dsub-usage-grid' }, items)
                   )
                 })(),
-                ((account.paidTierName || account.ref || (telemetry && telemetry.accounts && telemetry.accounts[account.ref])) ? h('div', { className: 'dsub-slot-meta-row' },
-                  account.paidTierName ? h('span', { className: 'dsub-sub' },
+                ((account.email || account.plan || account.paidTierName || account.ref || (telemetry && telemetry.accounts && telemetry.accounts[account.ref])) ? h('div', { className: 'dsub-slot-meta-row' },
+                  account.email ? h('span', { className: 'dsub-sub' },
+                    h('strong', null, '👤 '),
+                    account.email
+                  ) : null,
+                  (account.plan || account.paidTierName) ? h('span', { className: 'dsub-sub' },
                     h('strong', null, t('plan') + ': '),
-                    account.paidTierName
+                    account.plan || account.paidTierName
+                  ) : null,
+                  (account.organizations && account.organizations.length > 0) ? h('span', { className: 'dsub-sub', style: { display: 'inline-flex', alignItems: 'center', gap: 4 } },
+                    h('strong', null, '🏢 ' + t('workspaceTitle') + ':'),
+                    h('select', {
+                      className: 'dsub-select',
+                      style: { padding: '1px 6px', fontSize: '12px' },
+                      value: account.selectedOrgId || '',
+                      onChange: (e) => switchOrg(account.provider, account.index, e.target.value),
+                    },
+                      account.organizations.map((org) => h('option', { key: org.id, value: org.id }, org.name + (org.role ? ' (' + org.role + ')' : '')))
+                    )
                   ) : null,
                   (function(){
                     const accTelem = telemetry && telemetry.accounts && telemetry.accounts[account.ref]
@@ -2541,6 +2836,38 @@ window.__ModuleLoader__.load({
                       '⚡ ' + parts.join(' · ')
                     )
                   })(),
+                  (account.activeStreams > 0 || account.queuedStreams > 0) ? h('span', { className: 'dsub-ref-tag', title: t('concurrencyQueueHint') },
+                    account.activeStreams > 0 ? ('⚡ ' + account.activeStreams + ' ' + t('activeStreams')) : null,
+                    (account.activeStreams > 0 && account.queuedStreams > 0) ? ' · ' : null,
+                    account.queuedStreams > 0 ? ('⏳ ' + account.queuedStreams + ' ' + t('queuedStreams')) : null
+                  ) : null,
+                  account.runwayText ? h('span', {
+                    className: 'dsub-ref-tag',
+                    style: {
+                      color: account.pacingStatus === 'critical' ? 'var(--dsw-alias-state-error-primary)' : (account.pacingStatus === 'elevated' ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)'),
+                    },
+                    title: t('pacingRunwayHint')
+                  }, '⏱️ ' + t('runwayPrefix') + ': ' + account.runwayText) : null,
+                  (account.valueDelivered && account.valueDelivered.equivalentCost > 0) ? h('span', {
+                    className: 'dsub-speed-tag',
+                    title: t('valueDeliveredHint')
+                  }, '📊 ' + account.valueDelivered.formattedCost + ' (' + account.valueDelivered.roiLabel + ' ROI)') : null,
+                  (account.billing && account.billing.badgeText) ? h('span', {
+                    className: 'dsub-ref-tag',
+                    style: { color: 'var(--dsw-alias-state-error-primary)', fontWeight: 600 },
+                    title: account.billing.warning || t('billingAlertHint')
+                  }, '⚠️ ' + account.billing.badgeText) : null,
+                  (!account.billing?.badgeText && account.renewalCountdown) ? h('span', {
+                    className: 'dsub-ref-tag',
+                    title: t('renewalHint')
+                  }, '📅 ' + account.renewalCountdown) : null,
+                  (account.capabilities && Array.isArray(account.capabilities.tags) && account.capabilities.tags.length > 0) ? h('span', {
+                    className: 'dsub-ref-tag',
+                    title: t('capabilitiesHint')
+                  }, '⚡ ' + account.capabilities.tags.join(' · ')) : null,
+                  account.isEncryptedAtRest ? h('span', { className: 'dsub-ref-tag', title: t('atRestEncryptedTitle') },
+                    '🔒 ' + t('atRestEncrypted')
+                  ) : null,
                   account.ref ? h('span', { className: 'dsub-ref-tag' },
                     h('span', null, t('storedAs')),
                     h('code', null, account.ref)

package/lib/config-schema.js

@@ -20,6 +20,8 @@ export const Slot = z.object({
     .description('#67 Optional subscription expiry timestamp (ms). When set and within expiryNotifyDays, the header chip shows the account and expiry date.'),
   proxyUrl: z.string().default('')
     .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
+  maxConcurrency: z.number().default(1)
+    .description('#555 Per-slot max concurrent requests before queuing. Defaults to 1 for subscription safety.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))
@@ -86,6 +88,10 @@ export const Config = z.object({
   antigravityClientSecret: z.string().role('secret').default('')
     .description('Google OAuth client secret for custom confidential clients or CLI tokens requiring secret refresh.'),
   antigravityRedirectUri: z.string().volatile().default(''),
+  perplexityClientId: z.string().volatile().default(''),
+  perplexityRedirectUri: z.string().volatile().default(''),
+  jetbrainsClientId: z.string().volatile().default(''),
+  jetbrainsRedirectUri: z.string().volatile().default(''),
   antigravityModels: z.array(z.any()).volatile().default([])
     .description('Custom model catalog for Antigravity.'),
   codexOriginator: z.string().volatile().default('')
@@ -130,12 +136,48 @@ export const Config = z.object({
     .description('#485 Safety margin percent: avoid draining accounts below this threshold when alternatives exist.'),
   enableQueue: z.boolean().volatile().default(true)
     .description('#518 Bounded concurrency queue to prevent bursts of 429 errors.'),
-  accountMaxConcurrency: z.number().volatile().default(2)
-    .description('#518 Max concurrent requests per account before queuing.'),
+  accountMaxConcurrency: z.number().volatile().default(1)
+    .description('#518 #555 Default max concurrent requests per account before queuing (1 for OAuth subscription safety).'),
   maxQueueSize: z.number().volatile().default(20)
     .description('#518 Max requests waiting in queue before reject.'),
   queueTimeoutMs: z.number().volatile().default(30000)
     .description('#518 Max queue wait time in ms before timeout.'),
+  masterKey: z.string().role('secret').default('')
+    .description('#550 Optional master passphrase for encrypting OAuth credentials at rest (defaults to DSH_SUBSCRIPTIONS_MASTER_KEY env).'),
+  vaultSyncEnabled: z.boolean().volatile().default(false)
+    .description('#562 Enable automated encrypted vault sync to remote storage.'),
+  vaultSyncBackend: z.string().volatile().default('webdav')
+    .description('#562 Remote storage backend: webdav, gist, or s3.'),
+  vaultSyncPassphrase: z.string().role('secret').default('')
+    .description('#562 Passphrase used to encrypt/decrypt the remote vault archive.'),
+  vaultSyncIntervalHours: z.number().volatile().default(24)
+    .description('#562 Automated periodic sync interval in hours (0 disables periodic pull).'),
+  vaultSyncAutoPush: z.boolean().volatile().default(true)
+    .description('#562 Automatically push encrypted vault after successful OAuth login/refresh.'),
+  vaultSyncWebdavUrl: z.string().volatile().default('')
+    .description('#562 WebDAV target URL.'),
+  vaultSyncWebdavUsername: z.string().volatile().default('')
+    .description('#562 WebDAV username.'),
+  vaultSyncWebdavPassword: z.string().role('secret').default('')
+    .description('#562 WebDAV password or app token.'),
+  vaultSyncGistId: z.string().volatile().default('')
+    .description('#562 GitHub or Gitea Gist ID.'),
+  vaultSyncGistToken: z.string().role('secret').default('')
+    .description('#562 Personal access token with gist permission.'),
+  vaultSyncGistBaseUrl: z.string().volatile().default('https://api.github.com')
+    .description('#562 Gist API base URL.'),
+  vaultSyncS3Endpoint: z.string().volatile().default('')
+    .description('#562 S3 endpoint URL.'),
+  vaultSyncS3Bucket: z.string().volatile().default('')
+    .description('#562 S3 bucket name.'),
+  vaultSyncS3Key: z.string().volatile().default('dsh-subscriptions-vault.enc')
+    .description('#562 S3 object key.'),
+  vaultSyncS3Region: z.string().volatile().default('us-east-1')
+    .description('#562 S3 region.'),
+  vaultSyncS3AccessKey: z.string().volatile().default('')
+    .description('#562 S3 Access Key ID.'),
+  vaultSyncS3SecretKey: z.string().role('secret').default('')
+    .description('#562 S3 Secret Access Key.'),
   customVendors: z.array(z.any()).volatile().default([])
     .description('Declarative OpenAI-Responses-compatible providers. See README.'),
 })
@@ -145,7 +187,7 @@ export function publicConfig(cfg) {
   const clone = { ...cfg }
   // #242, #252: redact secret fields before exposing config via GET /config.
   for (const key of Object.keys(clone)) {
-    if (key.endsWith("ClientSecret") || key.endsWith("Secret")) {
+    if (key.endsWith("ClientSecret") || key.endsWith("Secret") || key.endsWith("SecretKey") || key.endsWith("Password") || key.endsWith("Token") || key.endsWith("Passphrase") || key === "masterKey") {
       clone[key] = clone[key] ? "••••••" : ""
     }
   }
@@ -199,7 +241,7 @@ export function restoreMaskedSecrets(incoming, existing) {
   const out = { ...incoming }
 
   for (const key of Object.keys(out)) {
-    if ((key.endsWith("ClientSecret") || key.endsWith("Secret")) && typeof out[key] === "string") {
+    if ((key.endsWith("ClientSecret") || key.endsWith("Secret") || key.endsWith("SecretKey") || key.endsWith("Password") || key.endsWith("Token") || key.endsWith("Passphrase") || key === "masterKey") && typeof out[key] === "string") {
       if (out[key].includes("••••")) {
         out[key] = existing[key] || ""
       }