@goodandready/dsh-subscriptions 0.6.72 → 0.6.82

package/lib/diagnostic-wizard.js

@@ -1,7 +1,7 @@
 // Guided Diagnostic Wizard for accounts, credentials, and network connectivity (#519).
 // Enforces 0 Cyrillic characters.
 
-import { maskEmail, maskText, cleanErrorMessage } from './mask.js'
+import { maskEmail, maskSecrets, cleanErrorMessage } from './mask.js'
 import { getVendor } from './vendors/index.js'
 
 /**
@@ -11,10 +11,7 @@ import { getVendor } from './vendors/index.js'
  */
 export function sanitizeDiagnosticData(val) {
   if (typeof val === 'string') {
-    return maskText(val)
-      .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]')
-      .replace(/key=[A-Za-z0-9._~+/-]+/gi, 'key=[REDACTED]')
-      .replace(/token=[A-Za-z0-9._~+/-]+/gi, 'token=[REDACTED]')
+    return maskSecrets(val)
   }
   if (Array.isArray(val)) {
     return val.map(sanitizeDiagnosticData)

package/lib/diagnostics.js

@@ -3,13 +3,13 @@ import { getSessionReasoningStats } from './reasoning-effort.js'
 import { defaultConcurrencyQueue } from './concurrency-queue.js'
 import { calculateCacheMetrics } from './analytics.js'
 import { getSessionPinStats } from './session-pin.js'
-import { maskText } from './mask.js'
+import { maskSecrets } from './mask.js'
 import { normalizeSlots } from './accounts.js'
 import { PROVIDERS } from './refs.js'
 import { defaultErrorBuffer } from './error-buffer.js'
 
 function scrubReport(v) {
-  if (typeof v === 'string') return maskText(v)
+  if (typeof v === 'string') return maskSecrets(v)
   if (Array.isArray(v)) return v.map(scrubReport)
   if (v && typeof v === 'object') {
     const o = {}

package/lib/error-buffer.js

@@ -1,4 +1,4 @@
-import { cleanErrorMessage, maskText } from './mask.js'
+import { cleanErrorMessage, maskSecrets } from './mask.js'
 
 /**
  * Ring buffer holding the most recent runtime errors across vendors and streams.
@@ -19,7 +19,7 @@ export class ErrorRingBuffer {
    * @param {{ provider?: string, ref?: string, model?: string, status?: number|null, code?: string, message?: string }} [param0]
    */
   record({ provider = 'unknown', ref = '', model = '', status = null, code = '', message = '' } = {}) {
-    const rawMsg = cleanErrorMessage(maskText(String(message || '')))
+    const rawMsg = cleanErrorMessage(maskSecrets(message))
     const entry = {
       id: String(this._nextId++),
       ts: new Date().toISOString(),

package/lib/forecast.js

@@ -141,3 +141,59 @@ export function calculateBurnUrgency(remainingPercent, resetAt, nowMs = Date.now
   const clampedHours = Math.max(hoursUntilReset, 0.05)
   return rem / clampedHours
 }
+
+/**
+ * #559: Calculates remaining runway duration and pacing status based on burn rate.
+ * @param {number|null} remainingPercent
+ * @param {number} pacePerHour
+ * @param {number|null} [_resetAt]
+ * @param {number} [_nowMs]
+ * @returns {{ runwayMs: number|null, runwayHours: number|null, runwayText: string, pacingStatus: string }}
+ */
+export function calculatePacingRunway(remainingPercent, pacePerHour, _resetAt = null, _nowMs = Date.now()) {
+  if (remainingPercent === null || remainingPercent === undefined) {
+    return { runwayMs: null, runwayHours: null, runwayText: '', pacingStatus: 'unknown' }
+  }
+  const rem = Number(remainingPercent)
+  if (!Number.isFinite(rem)) {
+    return { runwayMs: null, runwayHours: null, runwayText: '', pacingStatus: 'unknown' }
+  }
+  if (rem <= 0) {
+    return { runwayMs: 0, runwayHours: 0, runwayText: '0m (exhausted)', pacingStatus: 'critical' }
+  }
+
+  const pace = Number(pacePerHour) || 0
+  if (pace <= 0.02) {
+    return { runwayMs: Infinity, runwayHours: Infinity, runwayText: 'Sustainable', pacingStatus: 'sustainable' }
+  }
+
+  const runwayHours = rem / pace
+  const runwayMs = Math.round(runwayHours * HOUR_MS)
+
+  let runwayText = ''
+  if (runwayHours >= 24) {
+    const days = Math.round(runwayHours / 24)
+    runwayText = `~${days}d`
+  } else if (runwayHours >= 1) {
+    const h = Math.floor(runwayHours)
+    const m = Math.round((runwayHours % 1) * 60)
+    runwayText = m > 0 ? `~${h}h ${m}m` : `~${h}h`
+  } else {
+    const m = Math.max(1, Math.round(runwayHours * 60))
+    runwayText = m <= 15 ? '< 15m' : `~${m}m`
+  }
+
+  let pacingStatus = 'sustainable'
+  if (runwayHours < 0.5) {
+    pacingStatus = 'critical'
+  } else if (runwayHours <= 2.5) {
+    pacingStatus = 'elevated'
+  }
+
+  return {
+    runwayMs,
+    runwayHours: Math.round(runwayHours * 10) / 10,
+    runwayText,
+    pacingStatus,
+  }
+}

package/lib/headless-auth.js

@@ -0,0 +1,379 @@
+// #557: Headless Auth Helper with SSH Tunnel Command Generator and Terminal QR Code
+// Assists users logging in to OAuth providers on remote headless servers (VPS, Docker, MiniPC).
+
+import { escapeHtml } from './http.js'
+
+// --- QR Code Generator (Byte Mode, ECC Level L, Versions 1-10) ---
+
+const EXP = new Uint8Array(512)
+const LOG = new Uint8Array(256)
+for (let i = 0, x = 1; i < 255; i++) {
+  EXP[i] = x
+  LOG[x] = i
+  x = (x << 1) ^ (x >= 128 ? 0x11d : 0)
+}
+for (let i = 255; i < 512; i++) {
+  EXP[i] = EXP[i - 255]
+}
+
+function gfMul(x, y) {
+  return (x === 0 || y === 0) ? 0 : EXP[LOG[x] + LOG[y]]
+}
+
+function polyMul(p1, p2) {
+  const r = new Uint8Array(p1.length + p2.length - 1)
+  for (let i = 0; i < p1.length; i++) {
+    for (let j = 0; j < p2.length; j++) {
+      r[i + j] ^= gfMul(p1[i], p2[j])
+    }
+  }
+  return r
+}
+
+function rsGenPoly(deg) {
+  let p = new Uint8Array([1])
+  for (let i = 0; i < deg; i++) {
+    p = polyMul(p, new Uint8Array([1, EXP[i]]))
+  }
+  return p
+}
+
+function rsCompute(data, ecCount) {
+  const gen = rsGenPoly(ecCount)
+  const out = new Uint8Array(ecCount)
+  for (let i = 0; i < data.length; i++) {
+    const factor = data[i] ^ out[0]
+    for (let j = 0; j < ecCount - 1; j++) {
+      out[j] = out[j + 1] ^ gfMul(gen[j + 1], factor)
+    }
+    out[ecCount - 1] = gfMul(gen[ecCount], factor)
+  }
+  return out
+}
+
+const V_INFO = [
+  null,
+  { v: 1, total: 26, ec: 7, b: 1, align: [] },
+  { v: 2, total: 44, ec: 10, b: 1, align: [6, 18] },
+  { v: 3, total: 70, ec: 15, b: 1, align: [6, 22] },
+  { v: 4, total: 100, ec: 20, b: 1, align: [6, 26] },
+  { v: 5, total: 134, ec: 26, b: 1, align: [6, 30] },
+  { v: 6, total: 172, ec: 18, b: 2, align: [6, 34] },
+  { v: 7, total: 196, ec: 20, b: 2, align: [6, 22, 38] },
+  { v: 8, total: 242, ec: 24, b: 2, align: [6, 24, 42] },
+  { v: 9, total: 292, ec: 30, b: 2, align: [6, 26, 46] },
+  { v: 10, total: 346, ec: 18, b: 4, align: [6, 28, 50] },
+]
+
+export function encodeQrMatrix(text) {
+  const str = String(text || '')
+  const data = Buffer.from(str, 'utf8')
+  let ver = 1
+  while (ver <= 10) {
+    const info = V_INFO[ver]
+    const dataCap = info.total - info.ec * info.b
+    const lenBits = ver < 10 ? 8 : 16
+    const requiredBits = 4 + lenBits + data.length * 8
+    if (requiredBits <= dataCap * 8) break
+    ver++
+  }
+  if (ver > 10) throw new Error('text too long for QR encoder')
+
+  const info = V_INFO[ver]
+  const totalDataBytes = info.total - info.ec * info.b
+  const bits = []
+  function pushBits(val, len) {
+    for (let i = len - 1; i >= 0; i--) bits.push((val >> i) & 1)
+  }
+  pushBits(4, 4)
+  pushBits(data.length, ver < 10 ? 8 : 16)
+  for (const b of data) pushBits(b, 8)
+  const rem = totalDataBytes * 8 - bits.length
+  pushBits(0, Math.min(4, rem))
+  while (bits.length % 8 !== 0) bits.push(0)
+  const padBytes = [0xec, 0x11]
+  let pIdx = 0
+  while (bits.length < totalDataBytes * 8) {
+    pushBits(padBytes[pIdx++ % 2], 8)
+  }
+
+  const dataBytes = new Uint8Array(totalDataBytes)
+  for (let i = 0; i < totalDataBytes; i++) {
+    let byte = 0
+    for (let j = 0; j < 8; j++) byte = (byte << 1) | bits[i * 8 + j]
+    dataBytes[i] = byte
+  }
+
+  const blockSize = Math.floor(totalDataBytes / info.b)
+  const ecBlocks = []
+  const dataBlocks = []
+  for (let b = 0; b < info.b; b++) {
+    const start = b * blockSize
+    const slice = dataBytes.subarray(start, start + blockSize)
+    dataBlocks.push(slice)
+    ecBlocks.push(rsCompute(slice, info.ec))
+  }
+
+  const finalCodewords = []
+  for (let i = 0; i < blockSize; i++) {
+    for (let b = 0; b < info.b; b++) finalCodewords.push(dataBlocks[b][i])
+  }
+  for (let i = 0; i < info.ec; i++) {
+    for (let b = 0; b < info.b; b++) finalCodewords.push(ecBlocks[b][i])
+  }
+
+  const size = 17 + 4 * ver
+  const matrix = Array.from({ length: size }, () => new Int8Array(size).fill(-1))
+  const isFunc = Array.from({ length: size }, () => new Uint8Array(size))
+
+  function setFunc(r, c, val) {
+    if (r >= 0 && r < size && c >= 0 && c < size) {
+      matrix[r][c] = val
+      isFunc[r][c] = 1
+    }
+  }
+
+  function drawFinder(r0, c0) {
+    for (let r = -1; r <= 7; r++) {
+      for (let c = -1; c <= 7; c++) {
+        const nr = r0 + r
+        const nc = c0 + c
+        if (nr < 0 || nr >= size || nc < 0 || nc >= size) continue
+        if (r === -1 || r === 7 || c === -1 || c === 7) {
+          setFunc(nr, nc, 0)
+        } else if (r === 0 || r === 6 || c === 0 || c === 6 || (r >= 2 && r <= 4 && c >= 2 && c <= 4)) {
+          setFunc(nr, nc, 1)
+        } else {
+          setFunc(nr, nc, 0)
+        }
+      }
+    }
+  }
+  drawFinder(0, 0)
+  drawFinder(0, size - 7)
+  drawFinder(size - 7, 0)
+
+  for (let i = 8; i < size - 8; i++) {
+    setFunc(6, i, i % 2 === 0 ? 1 : 0)
+    setFunc(i, 6, i % 2 === 0 ? 1 : 0)
+  }
+
+  const align = info.align
+  for (let i = 0; i < align.length; i++) {
+    for (let j = 0; j < align.length; j++) {
+      const ar = align[i]
+      const ac = align[j]
+      if ((ar === 6 && ac === 6) || (ar === 6 && ac === size - 7) || (ar === size - 7 && ac === 6)) continue
+      for (let r = -2; r <= 2; r++) {
+        for (let c = -2; c <= 2; c++) {
+          const val = (Math.max(Math.abs(r), Math.abs(c)) !== 1) ? 1 : 0
+          setFunc(ar + r, ac + c, val)
+        }
+      }
+    }
+  }
+
+  setFunc(4 * ver + 9, 8, 1)
+
+  for (let i = 0; i < 9; i++) {
+    if (!isFunc[8][i]) setFunc(8, i, 0)
+    if (!isFunc[i][8]) setFunc(i, 8, 0)
+  }
+  for (let i = 0; i < 8; i++) {
+    if (!isFunc[8][size - 1 - i]) setFunc(8, size - 1 - i, 0)
+    if (!isFunc[size - 1 - i][8]) setFunc(size - 1 - i, 8, 0)
+  }
+
+  const allBits = []
+  for (const cw of finalCodewords) {
+    for (let i = 7; i >= 0; i--) allBits.push((cw >> i) & 1)
+  }
+  const remBits = [0, 0, 7, 7, 7, 7, 7, 0, 0, 0, 0][ver] || 0
+  for (let i = 0; i < remBits; i++) allBits.push(0)
+
+  let bitIdx = 0
+  let dir = -1
+  let c = size - 1
+  while (c > 0) {
+    if (c === 6) c--
+    for (let rStep = 0; rStep < size; rStep++) {
+      const r = dir === -1 ? (size - 1 - rStep) : rStep
+      for (let dc = 0; dc < 2; dc++) {
+        const col = c - dc
+        if (!isFunc[r][col]) {
+          const bit = bitIdx < allBits.length ? allBits[bitIdx++] : 0
+          const mask = ((r + col) % 2 === 0) ? 1 : 0
+          matrix[r][col] = bit ^ mask
+        }
+      }
+    }
+    dir = -dir
+    c -= 2
+  }
+
+  const formatBits = 0x77c4
+  for (let i = 0; i < 15; i++) {
+    const bit = (formatBits >> (14 - i)) & 1
+    if (i < 6) matrix[8][i] = bit
+    else if (i === 6) matrix[8][7] = bit
+    else if (i === 7) matrix[8][8] = bit
+    else if (i === 8) matrix[7][8] = bit
+    else matrix[14 - i][8] = bit
+
+    if (i < 8) matrix[size - 1 - i][8] = bit
+    else matrix[8][size - 15 + i] = bit
+  }
+
+  return matrix
+}
+
+export function renderAsciiQr(text) {
+  const m = encodeQrMatrix(text)
+  const size = m.length
+  const border = 1
+  const lines = []
+  for (let r = -border; r < size + border; r += 2) {
+    let line = ''
+    for (let c = -border; c < size + border; c++) {
+      const top = (r >= 0 && r < size && c >= 0 && c < size) ? m[r][c] : 0
+      const bot = (r + 1 >= 0 && r + 1 < size && c >= 0 && c < size) ? m[r + 1][c] : 0
+      if (top && bot) line += '█'
+      else if (top && !bot) line += '▀'
+      else if (!top && bot) line += '▄'
+      else line += ' '
+    }
+    lines.push(line)
+  }
+  return lines.join('\n')
+}
+
+export function renderSvgQr(text, { size = 200, border = 2, color = '#000000', bg = '#ffffff' } = {}) {
+  const m = encodeQrMatrix(text)
+  const n = m.length
+  const total = n + border * 2
+  let paths = ''
+  for (let r = 0; r < n; r++) {
+    for (let c = 0; c < n; c++) {
+      if (m[r][c]) {
+        paths += `M${c + border},${r + border}h1v1h-1z `
+      }
+    }
+  }
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 ${total} ${total}" width="${size}" height="${size}" shape-rendering="crispEdges">` +
+    `<rect width="${total}" height="${total}" fill="${bg}"/>` +
+    `<path d="${paths.trim()}" fill="${color}"/>` +
+    `</svg>`
+}
+
+export function renderSvgDataUrl(text, options) {
+  const svg = renderSvgQr(text, options)
+  return 'data:image/svg+xml;utf8,' + encodeURIComponent(svg)
+}
+
+// --- SSH Tunnel Command Generator ---
+
+export function generateSshTunnelCommand({ port = 1455, host = '', user = '' } = {}) {
+  const cleanPort = Number(port) || 1455
+  let cleanHost = String(host || '').trim()
+  if (!cleanHost || cleanHost === '127.0.0.1' || cleanHost === 'localhost' || cleanHost === '::1') {
+    cleanHost = '<remote-host>'
+  }
+  // Strip existing port if passed from req.headers.host
+  if (cleanHost.includes(':')) {
+    cleanHost = cleanHost.split(':')[0]
+  }
+  const cleanUser = String(user || '').trim() || (process.env.USER || process.env.USERNAME || '<user>')
+  return `ssh -N -L ${cleanPort}:127.0.0.1:${cleanPort} ${cleanUser}@${cleanHost}`
+}
+
+export function getHeadlessAuthInfo({ provider = '', redirectUri = '', authUrl = '', host = '', user = '' } = {}) {
+  let loopbackPort = 1455
+  let isLoopback = false
+  if (redirectUri) {
+    try {
+      const u = new URL(redirectUri)
+      if (u.hostname === 'localhost' || u.hostname === '127.0.0.1') {
+        isLoopback = true
+        loopbackPort = Number(u.port) || 1455
+      }
+    } catch { /* ignore malformed */ }
+  } else if (provider === 'grok') {
+    loopbackPort = 56121
+    isLoopback = true
+  } else if (provider === 'codex') {
+    loopbackPort = 1455
+    isLoopback = true
+  }
+
+  const sshTunnelCommand = generateSshTunnelCommand({ port: loopbackPort, host, user })
+  let terminalQr = ''
+  let svgDataUrl = ''
+  if (authUrl) {
+    try {
+      terminalQr = renderAsciiQr(authUrl)
+      svgDataUrl = renderSvgDataUrl(authUrl)
+    } catch { /* ignore length limits */ }
+  }
+
+  return {
+    provider,
+    isLoopback,
+    loopbackPort,
+    sshTunnelCommand,
+    authUrl,
+    terminalQr,
+    svgDataUrl,
+  }
+}
+
+export async function handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }) {
+  const rawUrl = new URL(req.url || '/', 'http://127.0.0.1')
+  const code = rawUrl.searchParams.get('code') || ''
+  const state = rawUrl.searchParams.get('state') || ''
+  const error = rawUrl.searchParams.get('error') || ''
+  const errorDesc = rawUrl.searchParams.get('error_description') || error
+
+  if (error) {
+    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' })
+    res.end(`<!doctype html><meta charset="utf-8"><title>OAuth Error</title><body style="font-family:sans-serif;padding:2rem;">` +
+      `<h2>Authorization Failed</h2><p style="color:#e53935;">${escapeHtml(errorDesc)}</p>` +
+      `<p>You can close this tab and return to Settings.</p></body>`)
+    return
+  }
+
+  if (!code) {
+    res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' })
+    res.end(`<!doctype html><meta charset="utf-8"><title>Missing Code</title><body style="font-family:sans-serif;padding:2rem;">` +
+      `<h2>Missing Authorization Code</h2><p>No authorization code found in callback query.</p></body>`)
+    return
+  }
+
+  const row = pending ? pending.get(state) : null
+  if (row && typeof completeOAuth === 'function') {
+    try {
+      await completeOAuth({ provider: row.provider, index: row.index, code, state })
+      if (typeof accountsView === 'function') await accountsView()
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+      res.end(`<!doctype html><meta charset="utf-8"><title>Subscriptions</title><body style="font-family:sans-serif;padding:2rem;">` +
+        `<h2 style="color:#2e7d32;">Signed In Successfully</h2>` +
+        `<p>Your account has been authorized. You can close this window and return to Settings.</p>` +
+        `<script>if (window.opener) { window.opener.postMessage({ type: 'dsh-oauth-success', state: '${escapeHtml(state)}' }, '*'); }</script>` +
+        `</body>`)
+      return
+    } catch (e) {
+      res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' })
+      res.end(`<!doctype html><meta charset="utf-8"><title>OAuth Exchange Failed</title><body style="font-family:sans-serif;padding:2rem;">` +
+        `<h2>Failed to Complete OAuth</h2><p style="color:#e53935;">${escapeHtml(String(e && e.message || e))}</p></body>`)
+      return
+    }
+  }
+
+  // Fallback: pending state expired or missing (show copyable code)
+  res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
+  res.end(`<!doctype html><meta charset="utf-8"><title>Authorization Code</title><body style="font-family:sans-serif;padding:2rem;">` +
+    `<h2>Authorization Code Received</h2>` +
+    `<p>Session timed out or running in manual mode. Copy the code or URL below and paste it into Settings &gt; Connect:</p>` +
+    `<textarea readonly style="width:100%;height:80px;font-family:monospace;padding:0.5rem;">${escapeHtml(rawUrl.toString())}</textarea>` +
+    `<p style="margin-top:1rem;"><strong>Code:</strong> <code>${escapeHtml(code)}</code></p>` +
+    `</body>`)
+}

package/lib/history.js

@@ -1,3 +1,4 @@
+import { calculateValueDelivered } from './pricing.js'
 import { calculateAnalytics } from './analytics.js'
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
@@ -126,7 +127,9 @@ export class HistoryStore {
     let tpsSum = 0
     let tpsCount = 0
     let lastTps = null
+    let totalPromptTokens = 0
     let totalOutputTokens = 0
+    let totalCacheReadTokens = 0
     let latencySum = 0
     let lastLatency = 0
 
@@ -147,9 +150,15 @@ export class HistoryStore {
         tpsCount++
         if (lastTps === null) lastTps = r.tps
       }
+      if (typeof r.inputTokens === "number" && r.inputTokens > 0) {
+        totalPromptTokens += r.inputTokens
+      }
       if (typeof r.outputTokens === "number" && r.outputTokens > 0) {
         totalOutputTokens += r.outputTokens
       }
+      if (typeof r.cacheReadTokens === "number" && r.cacheReadTokens > 0) {
+        totalCacheReadTokens += r.cacheReadTokens
+      }
     }
     if (count === 0) return null
     return {
@@ -160,7 +169,14 @@ export class HistoryStore {
       lastTtftMs: lastTtft,
       avgTps: tpsCount > 0 ? Math.round((tpsSum / tpsCount) * 10) / 10 : null,
       lastTps: lastTps,
+      totalPromptTokens,
       totalOutputTokens,
+      totalCacheReadTokens,
+      valueDelivered: calculateValueDelivered({
+        promptTokens: totalPromptTokens,
+        completionTokens: totalOutputTokens,
+        cacheReadTokens: totalCacheReadTokens,
+      }),
     }
   }
 
@@ -179,7 +195,9 @@ export class HistoryStore {
           tpsSum: 0,
           tpsCount: 0,
           lastTps: null,
+          totalPromptTokens: 0,
           totalOutputTokens: 0,
+          totalCacheReadTokens: 0,
         }
       }
       const st = map[r.ref]
@@ -198,9 +216,15 @@ export class HistoryStore {
         st.tpsCount++
         if (st.lastTps === null) st.lastTps = r.tps
       }
+      if (typeof r.inputTokens === "number" && r.inputTokens > 0) {
+        st.totalPromptTokens += r.inputTokens
+      }
       if (typeof r.outputTokens === "number" && r.outputTokens > 0) {
         st.totalOutputTokens += r.outputTokens
       }
+      if (typeof r.cacheReadTokens === "number" && r.cacheReadTokens > 0) {
+        st.totalCacheReadTokens += r.cacheReadTokens
+      }
     }
     const out = {}
     for (const [ref, st] of Object.entries(map)) {
@@ -212,7 +236,14 @@ export class HistoryStore {
         lastTtftMs: st.lastTtft,
         avgTps: st.tpsCount > 0 ? Math.round((st.tpsSum / st.tpsCount) * 10) / 10 : null,
         lastTps: st.lastTps,
+        totalPromptTokens: st.totalPromptTokens,
         totalOutputTokens: st.totalOutputTokens,
+        totalCacheReadTokens: st.totalCacheReadTokens,
+        valueDelivered: calculateValueDelivered({
+          promptTokens: st.totalPromptTokens,
+          completionTokens: st.totalOutputTokens,
+          cacheReadTokens: st.totalCacheReadTokens,
+        }),
       }
     }
     return out
@@ -296,6 +327,11 @@ export class HistoryStore {
         ? Math.round((totalCacheReadTokens / totalPromptTokens) * 1000) / 10
         : 0,
       accounts: this.accountsTelemetry(),
+      valueDelivered: calculateValueDelivered({
+        promptTokens: totalPromptTokens,
+        completionTokens: totalCompletionTokens,
+        cacheReadTokens: totalCacheReadTokens,
+      }),
       recentDecisions,
     }
   }

package/lib/http.js

@@ -103,7 +103,17 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
           return false
         }
-      } else if (u.protocol !== 'dsh-app:') {
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') {
+          return false
+        }
+        const remoteAddr = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+        const hasRemote = Boolean(remoteAddr || request?.socket || request?.connection)
+        if (hasRemote && !isLoopback(request)) {
+          return false
+        }
+      } else {
         return false
       }
     } catch {
@@ -120,7 +130,17 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (!host || u.host.toLowerCase() !== host.toLowerCase()) {
           return false
         }
-      } else if (u.protocol !== 'dsh-app:') {
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') {
+          return false
+        }
+        const remoteAddr = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+        const hasRemote = Boolean(remoteAddr || request?.socket || request?.connection)
+        if (hasRemote && !isLoopback(request)) {
+          return false
+        }
+      } else {
         return false
       }
     } catch {
@@ -177,7 +197,8 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (u.protocol === 'http:' || u.protocol === 'https:') {
           if (u.host.toLowerCase() === host.toLowerCase()) return true
         } else if (u.protocol === 'dsh-app:') {
-          return true
+          const appHost = u.host.toLowerCase()
+          if (!appHost || appHost === 'app' || appHost === 'localhost') return true
         }
       } catch { /* bestEffort */ }
     }
@@ -187,7 +208,8 @@ export function isTrustedSettingsRequest(request, targetCtx) {
         if (u.protocol === 'http:' || u.protocol === 'https:') {
           if (u.host.toLowerCase() === host.toLowerCase()) return true
         } else if (u.protocol === 'dsh-app:') {
-          return true
+          const appHost = u.host.toLowerCase()
+          if (!appHost || appHost === 'app' || appHost === 'localhost') return true
         }
       } catch { /* bestEffort */ }
     }