@goodandready/dsh-subscriptions 0.6.72 → 0.6.83

package/lib/reset-clock.js

@@ -1,9 +1,12 @@
 import { parseHeaders } from './ratelimit.js'
+import { formatRelativeReset } from './relative-time.js'
 
 export const VENDOR_WINDOW_MS = {
   claude: 5 * 3600 * 1000,
   codex: 3 * 3600 * 1000,
   grok: 2 * 3600 * 1000,
+  copilot: 24 * 3600 * 1000,
+  antigravity: 24 * 3600 * 1000,
 }
 
 export function parseResetFromText(message, nowMs = Date.now()) {
@@ -85,3 +88,55 @@ export function resolveAccurateReset(err, account, provider, nowMs = Date.now(),
 
   return null
 }
+
+export function formatRollingCountdown(resetAt, lang = 'en', now = Date.now()) {
+  const ts = Number(resetAt)
+  if (!Number.isFinite(ts) || ts <= 0) return ''
+  const d = new Date(ts)
+  const pad = (n) => String(n).padStart(2, '0')
+  const timeStr = `${pad(d.getHours())}:${pad(d.getMinutes())}`
+  const relStr = formatRelativeReset(ts, lang, now)
+  if (lang === 'zh') {
+    return `额度重置于 ${timeStr} (${relStr})`
+  }
+  return `Window resets at ${timeStr} (${relStr})`
+}
+
+export function computeEffectiveResetAt(account, provider, now = Date.now()) {
+  if (!account) return null
+  const nowMs = Number(now) || Date.now()
+  const candidates = []
+
+  if (account.quota && account.quota.resetAt) {
+    const r = Number(account.quota.resetAt)
+    if (Number.isFinite(r) && r > nowMs) candidates.push(r)
+  }
+  if (account.cooldownUntil) {
+    const c = Number(account.cooldownUntil)
+    if (Number.isFinite(c) && c > nowMs) candidates.push(c)
+  }
+  if (account.quarantineUntil) {
+    const q = Number(account.quarantineUntil)
+    if (Number.isFinite(q) && q > nowMs) candidates.push(q)
+  }
+  if (Array.isArray(account.usage)) {
+    for (const w of account.usage) {
+      if (w && w.resetAt) {
+        const wr = Number(w.resetAt)
+        if (Number.isFinite(wr) && wr > nowMs) candidates.push(wr)
+      }
+    }
+  }
+
+  if (candidates.length > 0) {
+    return Math.min(...candidates)
+  }
+
+  const p = String(provider || (account && account.provider) || '').toLowerCase()
+  const windowDefault = VENDOR_WINDOW_MS[p]
+  if (windowDefault && account.usagePercent != null && Number(account.usagePercent) >= 100) {
+    return nowMs + windowDefault
+  }
+
+  return null
+}

package/lib/rotate.js

@@ -17,14 +17,28 @@ export function isRegionError(err) {
   return status === 400 && (/FAILED_PRECONDITION/i.test(msg) || /User location is not supported/i.test(msg))
 }
 
+export function isAuthError(err) {
+  if (!err || typeof err !== "object") return false
+  const status = Number(err.status || err.statusCode) || 0
+  if (status === 401) return true
+  const code = String(err.code || (err.failure && err.failure.code) || "").toUpperCase()
+  if (code === "AUTH" || code === "TOKEN_REVOKED" || code === "UNAUTHORIZED" || code === "INVALID_TOKEN" || code === "SESSION_EXPIRED") return true
+  const msg = String(err.message || "")
+  if (/invalid_grant/i.test(msg)) return true
+  if (/token (?:has been )?revoked/i.test(msg)) return true
+  if (/session (?:expired|revoked|invalid)/i.test(msg)) return true
+  if (/unauthorized/i.test(msg) && (status === 0 || status === 400 || status === 401)) return true
+  return false
+}
+
 export function isSwitchableError(err) {
-  if (!err || typeof err !== 'object') return false
-  if (err.name === 'TimeoutError' || err.code === 'TIMEOUT' || err.code === 'EMPTY_RESPONSE' || err.code === 'SOFT_FAILURE' || err.isSoftFailure) return true
-  if (err.name === 'AbortError' || err.code === 'ABORT_ERR' || err.code === 'ERR_ABORTED' || (err.message && /aborted/i.test(err.message))) return false
+  if (!err || typeof err !== "object") return false
+  if (err.name === "TimeoutError" || err.code === "TIMEOUT" || err.code === "EMPTY_RESPONSE" || err.code === "SOFT_FAILURE" || err.isSoftFailure) return true
+  if (err.name === "AbortError" || err.code === "ABORT_ERR" || err.code === "ERR_ABORTED" || (err.message && /aborted/i.test(err.message))) return false
   const code = err.code || (err.failure && err.failure.code)
   if (SWITCH_CODES.has(code)) return true
   if (isRegionError(err)) return true
-  const status = err.status || err.statusCode
+  const status = Number(err.status || err.statusCode) || 0
   return status === 401 || status === 403 || status === 429 || status === 500 || status === 502 || status === 503
 }
 

package/lib/routes/accounts.js

@@ -1,12 +1,14 @@
 import { diagnoseVendorError } from '../doctor.js'
 import { exportVault, importVault } from '../vault.js'
+import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from '../vault-sync.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { getVendor } from '../vendors/index.js'
 import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
-import { Config, plainConfig, publicConfig } from '../config-schema.js'
+import { Config, plainConfig, publicConfig, revisionOf } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
+import { validateCredentialBlob } from '../blob.js'
 import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
@@ -275,18 +277,20 @@ export function registerAccountsRoutes(ctx, state) {
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {
+          const settings = getSettingsApi()
+          const revision = revisionOf(settings)
           const nextSlots = curSlots.concat([{
             provider: prov,
             index: idx,
             label: blob.email || '',
           }])
           const parsed = plainConfig(Config({ ...live(), slots: stripLegacySlots(nextSlots) }))
-          await getSettingsApi().replace(parsed)
+          await settings.replace(parsed, revision)
           syncCustomVendors()
         }
         const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
         const ref = slot ? slot.ref : oauthRef(prov, idx)
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, {
@@ -388,7 +392,7 @@ export function registerAccountsRoutes(ctx, state) {
       for (const row of bundle.accounts) {
         try {
           if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
-          await store.saveBlob(row.ref, row.blob)
+          await store.saveBlob(row.ref, validateCredentialBlob(row.blob))
           imported++
         } catch { /* skip broken */ }
       }
@@ -436,7 +440,7 @@ export function registerAccountsRoutes(ctx, state) {
         const ref = oauthRef(provider, index)
         const blob = { accessToken: apiKey || refreshToken, refreshToken: refreshToken || apiKey }
         if (apiKey) { blob.apiKey = apiKey; blob.apiKeyOnly = true }
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
@@ -518,6 +522,69 @@ export function registerAccountsRoutes(ctx, state) {
 
 
 
+  // Issue #549: Switch active organization/workspace for an account slot
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/accounts/switch-organization',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let payload
+      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const provider = String(payload.provider || '')
+      const index = Number(payload.index || 1)
+      const organizationId = String(payload.organizationId || payload.selectedOrgId || '').trim()
+      if (!isProvider(provider)) {
+        writeJson(res, 400, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
+        return
+      }
+      const ref = refForSlot(provider, index)
+      if (!ref) {
+        writeJson(res, 404, { ok: false, error: { code: 'slot', message: 'slot not found' } })
+        return
+      }
+      let blob
+      try { blob = await store.loadBlob(ref) } catch {
+        writeJson(res, 404, { ok: false, error: { code: 'blob', message: 'credentials not configured' } })
+        return
+      }
+
+      blob.selectedOrgId = organizationId
+      if (provider === 'codex') blob.accountId = organizationId
+      if (provider === 'antigravity') blob.projectId = organizationId
+      if (provider === 'claude') blob.organizationId = organizationId
+      if (provider === 'copilot') blob.organization = organizationId
+
+      if (Array.isArray(blob.organizations)) {
+        const found = blob.organizations.find((o) => o && o.id === organizationId)
+        if (found) blob.selectedOrgName = found.name
+        else if (organizationId) blob.selectedOrgName = organizationId
+      } else if (organizationId) {
+        blob.selectedOrgName = organizationId
+      }
+
+      await store.saveBlob(ref, blob)
+      await syncAdapter()
+
+      writeJson(res, 200, {
+        ok: true,
+        ref,
+        selectedOrgId: organizationId,
+        selectedOrgName: blob.selectedOrgName || organizationId,
+        accounts: await accountsView(),
+      })
+    }),
+  }), 'dsh-subscriptions: /accounts/switch-organization')
+
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/logout',
@@ -610,6 +677,7 @@ export function registerAccountsRoutes(ctx, state) {
     try {
       const result = importVault(vault, passphrase)
       const settings = getSettingsApi()
+      const revision = revisionOf(settings)
       let parsed
       if (result.slots.length) {
         if (!settings) throw new Error('settings are unavailable for vault import')
@@ -626,11 +694,11 @@ export function registerAccountsRoutes(ctx, state) {
       }
       let blobCount = 0
       for (const [ref, blob] of Object.entries(result.blobs)) {
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         blobCount++
       }
       if (parsed) {
-        await settings.replace(parsed)
+        await settings.replace(parsed, revision)
         syncCustomVendors()
       }
       await syncAdapter()
@@ -660,4 +728,71 @@ export function registerAccountsRoutes(ctx, state) {
     handler: handleVaultImport,
   }), 'dsh-subscriptions: /import-backup')
 
+
+  // #562: Remote Vault Sync Push
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/push',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      try {
+        const result = await syncVaultPush({ live: live(), store })
+        writeJson(res, 200, { ok: true, result, status: getVaultSyncStatus() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault_sync_push', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/sync/push')
+
+  // #562: Remote Vault Sync Pull
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/pull',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      try {
+        const result = await syncVaultPull({
+          live: live(),
+          store,
+          settingsApi: getSettingsApi(),
+          syncAdapter,
+          refreshModels,
+        })
+        writeJson(res, 200, { ok: true, result, status: getVaultSyncStatus(), accounts: await accountsView() })
+      } catch (e) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault_sync_pull', message: String(e && e.message || e) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/sync/pull')
+
+  // #562: Remote Vault Sync Status
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/sync/status',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      writeJson(res, 200, { ok: true, status: getVaultSyncStatus() })
+    }),
+  }), 'dsh-subscriptions: /vault/sync/status')
 }

package/lib/routes/oauth.js

@@ -5,6 +5,8 @@ import { parseCallbackInput, requestOrigin } from '../oauth.js'
 import { createPkce } from '../pkce.js'
 import { displayName, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
+import { getHeadlessAuthInfo, handleHeadlessRedirect } from '../headless-auth.js'
+import { syncVaultPush } from '../vault-sync.js'
 
 export function registerOauthRoutes(ctx, state) {
   const {
@@ -44,6 +46,7 @@ export function registerOauthRoutes(ctx, state) {
       }
       const origin = requestOrigin(req)
       const redirectUri = redirectFor(provider, `${provider}:${index}`, origin)
+      sweepPending(Date.now())
       const pkce = await createPkce()
       pending.set(pkce.state, {
         provider,
@@ -89,7 +92,10 @@ export function registerOauthRoutes(ctx, state) {
           }
         } catch { autoCatch = false }
       }
-      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch })
+      const host = (req.headers && req.headers.host) || ''
+      const user = process.env.USER || process.env.USERNAME || 'user'
+      const headless = getHeadlessAuthInfo({ provider, redirectUri, authUrl: url, host, user })
+      writeJson(res, 200, { ok: true, url, state: pkce.state, redirectUri, autoCatch, headless })
     }),
   }), 'dsh-subscriptions: /oauth/start')
 
@@ -143,7 +149,13 @@ export function registerOauthRoutes(ctx, state) {
           intervalMs: start.intervalMs,
           createdAt: Date.now(),
         })
-        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs })
+        const host = (req.headers && req.headers.host) || ''
+        const user = process.env.USER || process.env.USERNAME || 'user'
+        const headless = getHeadlessAuthInfo({ provider, redirectUri: '', authUrl: start.authUrl, host, user })
+        if (headless.terminalQr) {
+          console.log('[dsh-subscriptions] Device OAuth initiated for ' + provider + ':\n' + headless.terminalQr)
+        }
+        writeJson(res, 200, { ok: true, state, userCode: start.userCode, authUrl: start.authUrl, intervalMs: start.intervalMs, headless })
       } catch (e) {
         writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
       }
@@ -193,6 +205,9 @@ export function registerOauthRoutes(ctx, state) {
         pending.delete(state)
         await syncAdapter()
         refreshModels().catch(() => {})
+        if (live().vaultSyncEnabled && live().vaultSyncAutoPush) {
+          syncVaultPush({ live: live(), store }).catch(() => {})
+        }
         writeJson(res, 200, { ok: true, status: 'authorized', ref: row.ref, label: pmL(blob.label || blob.email) || displayName(row.provider) })
       } catch (e) {
         writeJson(res, 502, { ok: false, error: { code: e && e.code || 'DEVICE', message: String(e && e.message || e).slice(0, 300) } })
@@ -261,4 +276,38 @@ export function registerOauthRoutes(ctx, state) {
       }
     }),
   }), 'dsh-subscriptions: /oauth/complete')
+
+  // #557: Headless auth info helper endpoint
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/headless-info',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      const q = queryOf(req)
+      const provider = q.get('provider') || ''
+      const redirectUri = q.get('redirectUri') || ''
+      const authUrl = q.get('authUrl') || ''
+      const host = (req.headers && req.headers.host) || ''
+      const user = process.env.USER || process.env.USERNAME || 'user'
+      const info = getHeadlessAuthInfo({ provider, redirectUri, authUrl, host, user })
+      writeJson(res, 200, { ok: true, ...info })
+    }),
+  }), 'dsh-subscriptions: /oauth/headless-info')
+
+  // #557: Headless re-auth callback redirector
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/oauth/headless-redirect',
+    handler: (req, res) => {
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' })
+        res.end('<!doctype html><meta charset="utf-8"><p>Forbidden: same-origin or loopback requests only.</p>')
+        return
+      }
+      return handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView })
+    },
+  }), 'dsh-subscriptions: /oauth/headless-redirect')
 }

package/lib/routes/proxy.js

@@ -58,6 +58,20 @@ export function registerProxyRoutes(ctx, state) {
         writeJson(res, 404, { ok: false, error: { code: 'provider', message: 'unknown provider' } })
         return
       }
+      const hasBackslashOrInvalid = parts.some((p) => {
+        if (p.includes("\\")) return true
+        try {
+          const dec = decodeURIComponent(p)
+          if (dec.includes("\\")) return true
+        } catch {
+          return true
+        }
+        return false
+      })
+      if (hasBackslashOrInvalid) {
+        writeJson(res, 400, { ok: false, error: { code: 'path', message: 'invalid path' } })
+        return
+      }
       let body
       if (req.method === 'POST') {
         try {

package/lib/scope-inspector.js

@@ -0,0 +1,51 @@
+export const REQUIRED_SCOPES = {
+  antigravity: [
+    { scope: "https://www.googleapis.com/auth/cloud-platform", description: "Google Cloud Platform & Code Assist" },
+  ],
+  codex: [
+    { scope: "openid", description: "OpenID authentication" },
+    { scope: "https://api.openai.com/auth", description: "ChatGPT API authorization" },
+  ],
+  claude: [
+    { scope: "user:profile", description: "Anthropic user profile" },
+  ],
+  copilot: [
+    { scope: "read:user", description: "GitHub user read" },
+  ],
+  grok: [
+    { scope: "openid", description: "OpenID authentication" },
+  ],
+}
+
+/**
+ * Inspect scopes granted by provider against required scopes.
+ * @param {string} provider
+ * @param {string[]|string} rawScopes
+ * @returns {{ scopes: string[], valid: boolean, missing: string[], warning: string, scopeWarning: string }}
+ */
+export function inspectScopes(provider, rawScopes) {
+  const scopes = Array.isArray(rawScopes)
+    ? rawScopes.map(String).filter(Boolean)
+    : String(rawScopes || "").split(/[\s,]+/).filter(Boolean)
+
+  const reqList = REQUIRED_SCOPES[provider] || []
+  if (reqList.length === 0 || scopes.length === 0) {
+    return { scopes, valid: true, missing: [], warning: "", scopeWarning: "" }
+  }
+
+  const missing = reqList.filter((r) =>
+    !scopes.some((s) => s.toLowerCase() === r.scope.toLowerCase())
+  )
+
+  const warning = missing.length > 0
+    ? `Missing required OAuth scope: ${missing.map((m) => m.description || m.scope).join(", ")}`
+    : ""
+
+  return {
+    scopes,
+    valid: missing.length === 0,
+    missing: missing.map((m) => m.scope),
+    warning,
+    scopeWarning: warning,
+  }
+}

package/lib/stream-rotate.js

@@ -1,6 +1,7 @@
+import { inspectAccountCapabilities, normalizeCapabilitiesRequest } from './capabilities.js'
 import { defaultConcurrencyQueue } from './concurrency-queue.js'
 import { recordSessionCacheUsage } from './session-pin.js'
-import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, modelFamily } from './rotate.js'
+import { pickAccountWithTrace, markCooldown, isSwitchableError, isRegionError, isAuthError, modelFamily } from './rotate.js'
 import { putInQuarantine, REASON_RATE_LIMIT, REASON_HARD_LIMIT, REASON_REVOKED, REASON_DEGRADED } from './quarantine.js'
 import { notifySessionExpired, notifyQuarantineEntered } from './alerts.js'
 import { withRunawayGuard } from './runaway-guard.js'
@@ -10,7 +11,7 @@ import { resolveAccurateReset } from './reset-clock.js'
 
 export async function* streamWithRotation({
   accounts,
-  nowMs,
+  nowMs = () => Date.now(),
   cooldownMs,
   switchAtRemaining,
   streamOnce,
@@ -111,8 +112,20 @@ export async function* streamWithRotation({
     const queueConfig = {
       signal: options && options.signal,
       timeoutMs: options && (options.queueTimeoutMs !== undefined ? options.queueTimeoutMs : (options.config && options.config.queueTimeoutMs)),
-      maxConcurrency: options && (options.accountMaxConcurrency !== undefined ? options.accountMaxConcurrency : (options.config && options.config.accountMaxConcurrency)),
-      maxQueueSize: options && (options.maxQueueSize !== undefined ? options.maxQueueSize : (options.config && options.config.maxQueueSize)),
+      maxConcurrency: account.maxConcurrency !== undefined
+        ? account.maxConcurrency
+        : (options && options.accountMaxConcurrency !== undefined
+          ? options.accountMaxConcurrency
+          : (options && options.config && options.config.accountMaxConcurrency !== undefined
+            ? options.config.accountMaxConcurrency
+            : 1)),
+      maxQueueSize: account.maxQueueSize !== undefined
+        ? account.maxQueueSize
+        : (options && options.maxQueueSize !== undefined
+          ? options.maxQueueSize
+          : (options && options.config && options.config.maxQueueSize !== undefined
+            ? options.config.maxQueueSize
+            : 20)),
       enabled: options && (options.enableQueue !== undefined ? options.enableQueue : (options.config && options.config.enableQueue !== undefined ? options.config.enableQueue : true)),
     }
 
@@ -146,15 +159,19 @@ export async function* streamWithRotation({
             runawayState.reason = reason
           },
         }
+        const accountCaps = account.capabilities || inspectAccountCapabilities(account.provider || options?.provider, account, account)
+        const adaptedOptions = normalizeCapabilitiesRequest(options, accountCaps)
         const guardedStream = withRunawayGuard(
-          streamOnce(account, { ...options, _runawayState: runawayState }),
+          streamOnce(account, { ...adaptedOptions, _runawayState: runawayState }),
           runawayOpts
         )
         const sentineledStream = withSoftFailureSentinel(guardedStream, {
           enabled: (options?.enableSoftFailureSentinel !== false) && (options?.config?.enableSoftFailureSentinel !== false),
         })
         for await (const chunk of sentineledStream) {
-          firstChunkDelivered = true
+          if (chunk && (chunk.type === 'text-delta' || chunk.type === 'delta' || chunk.text || chunk.content)) {
+            firstChunkDelivered = true
+          }
           const cachedTokens = Number(
             (chunk && chunk.usage && (chunk.usage.cacheReadTokens || chunk.usage.cachedTokens)) ||
             (chunk && chunk.tokens && (chunk.tokens.cacheRead || chunk.tokens.cached)) ||
@@ -191,7 +208,7 @@ export async function* streamWithRotation({
           continue
         }
 
-        if (!isSwitchableError(err)) {
+        if (!isSwitchableError(err) && !isAuthError(err)) {
           currentAttempt.status = 'fatal_error'
           currentAttempt.error = err ? (err.message || String(err)) : 'unknown'
           syncTrace('fatal_error')
@@ -203,9 +220,10 @@ export async function* streamWithRotation({
 
         const accurateUntil = resolveAccurateReset(err, account, options && options.provider, nowMs())
         const isSoft = Boolean(err && (err.code === 'SOFT_FAILURE' || err.isSoftFailure))
+        const isAuth = isAuthError(err)
 
         // Move slot to cooldown and quarantine (#172, #538)
-        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : cooldownMs
+        const effectiveCooldownMs = isSoft ? Math.min(cooldownMs, 5 * 60 * 1000) : (isAuth ? 86400000 : cooldownMs)
         const cooled = markCooldown(account, nowMs(), effectiveCooldownMs, modelFamily(options && options.provider, options && options.model), accurateUntil)
         account.cooldownUntil = cooled.cooldownUntil
         if (cooled.cooldownFamilies) account.cooldownFamilies = cooled.cooldownFamilies
@@ -214,7 +232,7 @@ export async function* streamWithRotation({
         const code = String(err && err.code || '')
         const reason = isSoft
           ? REASON_DEGRADED
-          : (status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
+          : (isAuth || status === 401 || code === 'AUTH' || code === 'TOKEN_REVOKED')
             ? REASON_REVOKED
             : (status === 403 || code === 'HARD_LIMIT' || code === 'LICENSE_REQUIRED')
               ? REASON_HARD_LIMIT
@@ -226,11 +244,14 @@ export async function* streamWithRotation({
           account.quarantineAttempts = err.warmupAccount.quarantineAttempts
           account.status = err.warmupAccount.status
         } else {
-          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil)
+          const quarantined = putInQuarantine(account, reason, nowMs(), accurateUntil || (nowMs() + (isAuth ? 86400000 : 3600000)))
           account.quarantineUntil = quarantined.quarantineUntil
           account.quarantineReason = quarantined.quarantineReason
           account.quarantineAttempts = (account.quarantineAttempts || 0) + 1
         }
+        if (isAuth || reason === REASON_REVOKED) {
+          account.isRevoked = true
+        }
 
         currentAttempt.quarantineReason = account.quarantineReason || reason
         currentAttempt.quarantineUntil = account.quarantineUntil

package/lib/subscriptions.js

@@ -5,16 +5,39 @@ import { pickFetch } from "./proxy.js"
 import { fetchWithTimeout } from "./http.js"
 
 // ponytail: allowlist per provider — add path to extend without touching request logic
+const OPENAI_COMPAT = [
+  "/models",
+  "/v1/models",
+  "/chat/completions",
+  "/v1/chat/completions",
+  "/responses",
+  "/v1/responses",
+  "/images/generations",
+  "/v1/images/generations",
+]
+
 export const ALLOWLIST = {
   codex: ["/responses", "/models", "/images/generations", "/backend-api/codex/responses", "/backend-api/codex/models", "/backend-api/codex/images/generations"],
   claude: ["/v1/messages", "/api/oauth/profile", "/api/oauth/usage", "/v1/models"],
   grok: ["/v1/models", "/responses", "/v1/responses", "/v1/billing", "/v1/chat/completions", "/images/generations", "/v1/images/generations"],
   antigravity: ["/v1/models", "/v1/generateContent", "/v1/streamGenerateContent", "/v1/loadCodeAssist", "/v1/fetchAvailableModels", "/v1/countTokens", "/v1/internal:loadCodeAssist"],
+  kimi: OPENAI_COMPAT,
+  glm: [...OPENAI_COMPAT, "/api/paas/v4/chat/completions", "/api/paas/v4/models"],
+  cursor: OPENAI_COMPAT,
+  kiro: OPENAI_COMPAT,
+  copilot: OPENAI_COMPAT,
+  qwen: [...OPENAI_COMPAT, "/compatible-mode/v1/chat/completions", "/compatible-mode/v1/models"],
+  ernie: [...OPENAI_COMPAT, "/rpc/2.0/ai_custom/v1/wenxinworkshop/chat", "/oauth/2.0/token"],
+  spark: OPENAI_COMPAT,
+  jetbrains: OPENAI_COMPAT,
+  perplexity: [...OPENAI_COMPAT, "/api/v1/user/profile", "/api/v1/user/usage"],
+  replit: [...OPENAI_COMPAT, "/api/v1/ai"],
+  cody: OPENAI_COMPAT,
 }
 
 export function isAllowed(provider, path) {
   if (!isProvider(provider)) return false
-  const list = ALLOWLIST[provider] || []
+  const list = ALLOWLIST[provider] || OPENAI_COMPAT
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]

package/lib/updater.js

@@ -24,6 +24,27 @@ export function isLoopback(value) {
 }
 
 export function isTrustedUpdateRequest(request, targetCtx) {
+  const secFetchSite = String(header(request, 'sec-fetch-site') || '').toLowerCase()
+  if (secFetchSite === 'cross-site') return false
+
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin && host) {
+    try {
+      const u = new URL(origin)
+      if (u.protocol === 'http:' || u.protocol === 'https:') {
+        if (u.host.toLowerCase() !== host.toLowerCase()) return false
+      } else if (u.protocol === 'dsh-app:') {
+        const appHost = u.host.toLowerCase()
+        if (appHost && appHost !== 'app' && appHost !== 'localhost') return false
+      } else {
+        return false
+      }
+    } catch {
+      return false
+    }
+  }
+
   const customHeader = header(request, UPDATE_HEADER)
   if (customHeader === '1') {
     const remote = request.socket?.remoteAddress