@goodandready/dsh-subscriptions 0.6.72 → 0.6.82

package/lib/routes/accounts.js

@@ -1,5 +1,6 @@
 import { diagnoseVendorError } from '../doctor.js'
 import { exportVault, importVault } from '../vault.js'
+import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from '../vault-sync.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { getVendor } from '../vendors/index.js'
 import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
@@ -518,6 +519,69 @@ export function registerAccountsRoutes(ctx, state) {
 
 
 
+  // Issue #549: Switch active organization/workspace for an account slot
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/accounts/switch-organization',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(payload.provider || '')
+      const index = Number(payload.index || 1)
+      const organizationId = String(payload.organizationId || payload.selectedOrgId || '').trim()
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const ref = refForSlot(provider, index)
+      if (!ref) {
+        writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } })
+        return
+      }
+      let blob
+      try { blob = await store.loadBlob(ref) } catch {
+        writeJson(res, 404, { ok: false, error: { code: 'blob', message: 'credentials not configured' } })
+        return
+      }
+
+      blob.selectedOrgId = organizationId
+      if (provider === 'codex') blob.accountId = organizationId
+      if (provider === 'antigravity') blob.projectId = organizationId
+      if (provider === 'claude') blob.organizationId = organizationId
+      if (provider === 'copilot') blob.organization = organizationId
+
+      if (Array.isArray(blob.organizations)) {
+        const found = blob.organizations.find((o) => o && o.id === organizationId)
+        if (found) blob.selectedOrgName = found.name
+        else if (organizationId) blob.selectedOrgName = organizationId
+      } else if (organizationId) {
+        blob.selectedOrgName = organizationId
+      }
+
+      await store.saveBlob(ref, blob)
+      await syncAdapter()
+
+      writeJson(res, 200, {
+        ok: true,
+        ref,
+        selectedOrgId: organizationId,
+        selectedOrgName: blob.selectedOrgName || organizationId,
+        accounts: await accountsView(),
+      })
+    }),
+  }), 'dsh-subscriptions: /accounts/switch-organization')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/logout',
@@ -660,4 +724,71 @@ export function registerAccountsRoutes(ctx, state) {
     handler: handleVaultImport,
   }), 'dsh-subscriptions: /import-backup')
 
+
+  // #562: Remote Vault Sync Push
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/push',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      try {
+        const result = await syncVaultPush({ live: live(), store })
+        writeJson(res, 200, { ok: true, result, status: getVaultSyncStatus() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault_sync_push', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/sync/push')
+
+  // #562: Remote Vault Sync Pull
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/pull',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      try {
+        const result = await syncVaultPull({
+          live: live(),
+          store,
+          settingsApi: getSettingsApi(),
+          syncAdapter,
+          refreshModels,
+        })
+        writeJson(res, 200, { ok: true, result, status: getVaultSyncStatus(), accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault_sync_pull', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/sync/pull')
+
+  // #562: Remote Vault Sync Status
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/status',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      writeJson(res, 200, { ok: true, status: getVaultSyncStatus() })
+    }),
+  }), 'dsh-subscriptions: /vault/sync/status')
 }

package/lib/routes/oauth.js

@@ -5,6 +5,8 @@ import { parseCallbackInput, requestOrigin } from '../oauth.js'
 import { createPkce } from '../pkce.js'
 import { displayName, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
+import { getHeadlessAuthInfo, handleHeadlessRedirect } from '../headless-auth.js'
+import { syncVaultPush } from '../vault-sync.js'
 
 export function registerOauthRoutes(ctx, state) {
   const {
@@ -44,6 +46,7 @@ export function registerOauthRoutes(ctx, state) {
       }
       const origin = requestOrigin(req)
       const redirectUri = redirectFor(provider, `${provider}:${index}`, origin)
+      sweepPending(Date.now())
       const pkce = await createPkce()
       pending.set(pkce.state, {
         provider,
@@ -89,7 +92,10 @@ export function registerOauthRoutes(ctx, state) {
           }
         } catch { autoCatch = false }
       }
-      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch })
+      const host = (req.headers && req.headers.host) || ''
+      const user = process.env.USER || process.env.USERNAME || 'user'
+      const headless = getHeadlessAuthInfo({ provider, redirectUri, authUrl: url, host, user })
+      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch, headless })
     }),
   }), 'dsh-subscriptions: /oauth/start')
 
@@ -143,7 +149,13 @@ export function registerOauthRoutes(ctx, state) {
           intervalMs: start.intervalMs,
           createdAt: Date.now(),
         })
-        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs })
+        const host = (req.headers && req.headers.host) || ''
+        const user = process.env.USER || process.env.USERNAME || 'user'
+        const headless = getHeadlessAuthInfo({ provider, redirectUri: '', authUrl: start.authUrl, host, user })
+        if (headless.terminalQr) {
+          console.log('[dsh-subscriptions] Device OAuth initiated for ' + provider + ':\n' + headless.terminalQr)
+        }
+        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs, headless })
       } catch (e) {
         writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
       }
@@ -193,6 +205,9 @@ export function registerOauthRoutes(ctx, state) {
         pending.delete(state)
         await syncAdapter()
         refreshModels().catch(() => {})
+        if (live().vaultSyncEnabled && live().vaultSyncAutoPush) {
+          syncVaultPush({ live: live(), store }).catch(() => {})
+        }
         writeJson(res, 200, { ok: true, status: 'authorized', ref: row.ref, label: pmL(blob.label || blob.email) || displayName(row.provider) })
       } catch (e) {
         writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
@@ -261,4 +276,31 @@ export function registerOauthRoutes(ctx, state) {
       }
     }),
   }), 'dsh-subscriptions: /oauth/complete')
+
+  // #557: Headless auth info helper endpoint
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/headless-info',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const provider = q.get('provider') || ''
+      const redirectUri = q.get('redirectUri') || ''
+      const authUrl = q.get('authUrl') || ''
+      const host = (req.headers && req.headers.host) || ''
+      const user = process.env.USER || process.env.USERNAME || 'user'
+      const info = getHeadlessAuthInfo({ provider, redirectUri, authUrl, host, user })
+      writeJson(res, 200, { ok: true, ...info })
+    }),
+  }), 'dsh-subscriptions: /oauth/headless-info')
+
+  // #557: Headless re-auth callback redirector
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/headless-redirect',
+    handler: (req, res) => handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }),
+  }), 'dsh-subscriptions: /oauth/headless-redirect')
 }

package/lib/routes/proxy.js

@@ -58,6 +58,20 @@ export function registerProxyRoutes(ctx, state) {
         writeJson(res, 404, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
         return
       }
+      const hasBackslashOrInvalid = parts.some((p) => {
+        if (p.includes("\\")) return true
+        try {
+          const dec = decodeURIComponent(p)
+          if (dec.includes("\\")) return true
+        } catch {
+          return true
+        }
+        return false
+      })
+      if (hasBackslashOrInvalid) {
+        writeJson(res, 400, { ok: false, error: { code: 'path', message: 'invalid path' } })
+        return
+      }
       let body
       if (req.method === 'POST') {
         try {

package/lib/scope-inspector.js

@@ -0,0 +1,51 @@
+export const REQUIRED_SCOPES = {
+  antigravity: [
+    { scope: "https://www.googleapis.com/auth/cloud-platform", description: "Google Cloud Platform & Code Assist" },
+  ],
+  codex: [
+    { scope: "openid", description: "OpenID authentication" },
+    { scope: "https://api.openai.com/auth", description: "ChatGPT API authorization" },
+  ],
+  claude: [
+    { scope: "user:profile", description: "Anthropic user profile" },
+  ],
+  copilot: [
+    { scope: "read:user", description: "GitHub user read" },
+  ],
+  grok: [
+    { scope: "openid", description: "OpenID authentication" },
+  ],
+}
+
+/**
+ * Inspect scopes granted by provider against required scopes.
+ * @param {string} provider
+ * @param {string[]|string} rawScopes
+ * @returns {{ scopes: string[], valid: boolean, missing: string[], warning: string, scopeWarning: string }}
+ */
+export function inspectScopes(provider, rawScopes) {
+  const scopes = Array.isArray(rawScopes)
+    ? rawScopes.map(String).filter(Boolean)
+    : String(rawScopes || "").split(/[\s,]+/).filter(Boolean)
+
+  const reqList = REQUIRED_SCOPES[provider] || []
+  if (reqList.length === 0 || scopes.length === 0) {
+    return { scopes, valid: true, missing: [], warning: "", scopeWarning: "" }
+  }
+
+  const missing = reqList.filter((r) =>
+    !scopes.some((s) => s.toLowerCase() === r.scope.toLowerCase())
+  )
+
+  const warning = missing.length > 0
+    ? `Missing required OAuth scope: ${missing.map((m) => m.description || m.scope).join(", ")}`
+    : ""
+
+  return {
+    scopes,
+    valid: missing.length === 0,
+    missing: missing.map((m) => m.scope),
+    warning,
+    scopeWarning: warning,
+  }
+}

package/lib/stream-rotate.js

@@ -1,6 +1,7 @@
+import { inspectAccountCapabilities, normalizeCapabilitiesRequest } from './capabilities.js'
 import { defaultConcurrencyQueue } from './concurrency-queue.js'
 import { recordSessionCacheUsage } from './session-pin.js'
-import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
+import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, isAuthError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED, REASON_DEGRADED } from './quarantine.js'
 import { notifySessionExpired, notifyQuarantineEntered } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
@@ -10,7 +11,7 @@ import { resolveAccurateReset } from './reset-clock.js'
 
 export async function* streamWithRotation({
   accounts,
-  nowMs,
+  nowMs = () => Date.now(),
   cooldownMs,
   switchAtRemaining,
   streamOnce,
@@ -111,8 +112,20 @@ export async function* streamWithRotation({
     const queueConfig = {
       signal: options && options.signal,
       timeoutMs: options && (options.queueTimeoutMs !== undefined ? options.queueTimeoutMs : (options.config && options.config.queueTimeoutMs)),
-      maxConcurrency: options && (options.accountMaxConcurrency !== undefined ? options.accountMaxConcurrency : (options.config && options.config.accountMaxConcurrency)),
-      maxQueueSize: options && (options.maxQueueSize !== undefined ? options.maxQueueSize : (options.config && options.config.maxQueueSize)),
+      maxConcurrency: account.maxConcurrency !== undefined
+        ? account.maxConcurrency
+        : (options && options.accountMaxConcurrency !== undefined
+          ? options.accountMaxConcurrency
+          : (options && options.config && options.config.accountMaxConcurrency !== undefined
+            ? options.config.accountMaxConcurrency
+            : 1)),
+      maxQueueSize: account.maxQueueSize !== undefined
+        ? account.maxQueueSize
+        : (options && options.maxQueueSize !== undefined
+          ? options.maxQueueSize
+          : (options && options.config && options.config.maxQueueSize !== undefined
+            ? options.config.maxQueueSize
+            : 20)),
       enabled: options && (options.enableQueue !== undefined ? options.enableQueue : (options.config && options.config.enableQueue !== undefined ? options.config.enableQueue : true)),
     }
 
@@ -146,15 +159,19 @@ export async function* streamWithRotation({
             runawayState.reason = reason
           },
         }
+        const accountCaps = account.capabilities || inspectAccountCapabilities(account.provider || options?.provider, account, account)
+        const adaptedOptions = normalizeCapabilitiesRequest(options, accountCaps)
         const guardedStream = withRunawayGuard(
-          streamOnce(account, { ...options, _runawayState: runawayState }),
+          streamOnce(account, { ...adaptedOptions, _runawayState: runawayState }),
           runawayOpts
         )
         const sentineledStream = withSoftFailureSentinel(guardedStream, {
           enabled: (options?.enableSoftFailureSentinel !== false) && (options?.config?.enableSoftFailureSentinel !== false),
         })
         for await (const chunk of sentineledStream) {
-          firstChunkDelivered = true
+          if (chunk && (chunk.type === 'text-delta' || chunk.type === 'delta' || chunk.text || chunk.content)) {
+            firstChunkDelivered = true
+          }
           const cachedTokens = Number(
             (chunk && chunk.usage && (chunk.usage.cacheReadTokens || chunk.usage.cachedTokens)) ||
             (chunk && chunk.tokens && (chunk.tokens.cacheRead || chunk.tokens.cached)) ||
@@ -191,7 +208,7 @@ export async function* streamWithRotation({
           continue
         }
 
-        if (!isSwitchableError(err)) {
+        if (!isSwitchableError(err) && !isAuthError(err)) {
           currentAttempt.status = 'fatal_error'
           currentAttempt.error = err ? (err.message || String(err)) : 'unknown'
           syncTrace('fatal_error')
@@ -203,9 +220,10 @@ export async function* streamWithRotation({
 
         const accurateUntil = resolveAccurateReset(err, account, options && options.provider, nowMs())
         const isSoft = Boolean(err && (err.code === 'SOFT_FAILURE' || err.isSoftFailure))
+        const isAuth = isAuthError(err)
 
         // Move slot to cooldown and quarantine (#172, #538)
-        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : cooldownMs
+        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : (isAuth ? 86400000 : cooldownMs)
         const cooled = markCooldown(account, nowMs(), effectiveCooldownMs, modelFamily(options && options.provider, options && options.model), accurateUntil)
         account.cooldownUntil = cooled.cooldownUntil
         if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
@@ -214,7 +232,7 @@ export async function* streamWithRotation({
         const code = String(err && err.code || '')
         const reason = isSoft
           ? REASON_DEGRADED
-          : (status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
+          : (isAuth || status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
             ? REASON_REVOKED
             : (status === 403 || code === 'HARD_LIMIT' || code === 'LICENSE_REQUIRED')
               ? REASON_HARD_LIMIT
@@ -226,11 +244,14 @@ export async function* streamWithRotation({
           account.quarantineAttempts = err.warmupAccount.quarantineAttempts
           account.status = err.warmupAccount.status
         } else {
-          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil)
+          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil || (nowMs() + (isAuth ? 86400000 : 3600000)))
           account.quarantineUntil = quarantined.quarantineUntil
           account.quarantineReason = quarantined.quarantineReason
           account.quarantineAttempts = (account.quarantineAttempts || 0) + 1
         }
+        if (isAuth || reason === REASON_REVOKED) {
+          account.isRevoked = true
+        }
 
         currentAttempt.quarantineReason = account.quarantineReason || reason
         currentAttempt.quarantineUntil = account.quarantineUntil

package/lib/updater.js

@@ -24,6 +24,27 @@ export function isLoopback(value) {
 }
 
 export function isTrustedUpdateRequest(request, targetCtx) {
+  const secFetchSite = String(header(request, 'sec-fetch-site') || '').toLowerCase()
+  if (secFetchSite === 'cross-site') return false
+
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin && host) {
+    try {
+      const u = new URL(origin)
+      if (u.protocol === 'http:' || u.protocol === 'https:') {
+        if (u.host.toLowerCase() !== host.toLowerCase()) return false
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') return false
+      } else {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+
   const customHeader = header(request, UPDATE_HEADER)
   if (customHeader === '1') {
     const remote = request.socket?.remoteAddress