@goodandready/dsh-subscriptions 0.6.8 → 0.6.10

package/README.md

@@ -260,6 +260,29 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ---
 
+## 🚀 One-Click Plugin Updater & Stability Hardening (Added in v0.6.9)
+
+- **Host One-Click Updater**: Automatic in-place updater mounted at `/dsh-subscriptions/update`, checking the npm registry for newer releases and executing single-flight installation via the host DSH CLI (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Security & Origin Protection**: Updater endpoints enforce strict loopback address checks (supporting IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), `x-dsh-plugin-update` header verification, and same-origin validation to prevent unauthorized updates.
+- **Header Badge & UI Action**: The settings header bar displays current plugin version, an update warning badge when a new release is detected, and an instant "Update" button with live restart countdown.
+- **Network Timeout Hardening**: Quota balance and smoke test probes now enforce guaranteed 15-second abort timeouts (`AbortSignal.timeout(15_000)`), preventing hanging sockets during vendor outages.
+- **Parameter Normalization & Deduplication**: Unified support for `provider || vendor` and `index || accountIndex` aliases in check endpoints, and deduplicated threshold notification loops.
+
+---
+
+---
+
+## 🛡️ Reliability & Quality Hardening (Added in v0.6.10)
+
+- **Structured Error Handling**: Eliminated all empty catch blocks across the plugin runtime via safe `bestEffort` helper logging debug diagnostics.
+- **Native Context Logger**: Migrated all plugin logging to the canonical Cordis `ctx.logger('subscriptions')` subsystem.
+- **Network Timeout Protection**: Hardened external vendor API calls (`listModels`, `fetchFor`, `quotaFetch`, `jsonTokenRequest`) with explicit `fetchWithTimeout` and `AbortSignal.timeout` safeguards.
+- **Design System Theming**: Replaced hardcoded styling values with native DeepSeek Harness CSS theme tokens (`--dsw-alias-*`, `color-mix`), achieving 100% theme token coverage and zero standalone `rgba` values.
+- **Client Dependency Injections**: Explicitly declared required client platform dependencies (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`) in package manifest.
+- **Strict Repository Hygiene**: Removed internal development instructions and planning artifacts from git tracking, enforcing clean public releases.
+
+---
+
 ## 🌐 Localization
 
 The plugin source language is English only. Russian and other translations are provided at runtime by separate language plugins (for example the russification plugin), which translate the registered locale keys - the package itself ships no bundled translations (Changed in 0.6.1).

package/README.ru.md

@@ -233,6 +233,29 @@ dsh-subscriptions:
 
 ---
 
+## 🚀 Обновление в один клик и повышение стабильности (Добавлено в v0.6.9)
+
+- **Встроенный апдейтер в один клик**: Фоновая проверка новых версий в npm registry и обновление на месте по маршруту `/dsh-subscriptions/update` через хостовый CLI DSH (`dsh plugin add --config.minimumReleaseAge=0`).
+- **Безопасность и защита эндпоинта**: Строгая верификация loopback-адресов (поддержка IPv4 `127.0.0.1`, IPv6 `::1`, `localhost`), валидация заголовка `x-dsh-plugin-update` и защита от CSRF/cross-origin запросов.
+- **Индикатор в шапке и кнопка обновления**: В строке состояния панели отображается текущая версия, бейдж наличия обновления и кнопка быстрого обновления («Update → vX.Y.Z») с уведомлением о перезапуске службы.
+- **Сетевые таймауты и устойчивость**: Ограничение времени ожидания запросов баланса и smoke-тестов до 15 секунд (`AbortSignal.timeout(15_000)`), предотвращающее зависание сокетов при недоступности внешних API.
+- **Нормализация параметров и дедупликация**: Поддержка алиасов параметров `provider || vendor` и `index || accountIndex` в статусных маршрутах, а также устранение дублирующего цикла нотификаций в `lib/accounts.js`.
+
+---
+
+---
+
+## 🛡️ Надежность и стандарты качества (Добавлено в v0.6.10)
+
+- **Структурированная обработка ошибок**: Устранены все пустые блоки catch в рантайме плагина с переходом на безопасный хелпер `bestEffort` с диагностическим логированием.
+- **Нативный логгер контекста**: Все вызовы логирования переведены на официальную подсистему Cordis `ctx.logger('subscriptions')`.
+- **Защита внешних вызовов таймаутами**: Все сетевые интеграции к API вендоров (`listModels`, `fetchFor`, `quotaFetch`, `jsonTokenRequest`) защищены таймаутами через `fetchWithTimeout` и `AbortSignal.timeout`.
+- **Семантическая UI-темизация**: Статические цвета и rgba-значения в `client.js` заменены на нативные CSS-переменные дизайн-системы DeepSeek Harness (`--dsw-alias-*`, `color-mix`), достигнут 0 остаточных `rgba`.
+- **Декларация клиентских зависимостей**: Задекларированы платформенные инжекты (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`) в манифесте `package.json`.
+- **Чистота публичного репозитория**: Внутренние инструкции разработки и артефакты планирования исключены из git-отслеживания и добавлены в `.gitignore`.
+
+---
+
 ## 🌐 Локализация
 
 Исходный язык плагина - только английский. Русский и другие переводы во время работы предоставляют отдельные языковые плагины (например, плагин русификации), переводящие зарегистрированные ключи локали, - сам пакет не содержит встроенных переводов (Changed in 0.6.1).

package/README.zh.md

@@ -155,6 +155,29 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ---
 
+## 🚀 一键插件自更新与稳定性强化 (v0.6.9 新增)
+
+- **宿主端一键更新**: 挂载于 `/dsh-subscriptions/update` 的就地更新机制，自动对比 npm registry 最新版本并通过宿主 DSH CLI 执行单飞安装 (`dsh plugin add --config.minimumReleaseAge=0`)。
+- **安全与来源防护**: 更新接口严格校验环回地址（支持 IPv4 `127.0.0.1`、IPv6 `::1`、`localhost`）、`x-dsh-plugin-update` 请求头及同源策略，阻断未授权跨站调用。
+- **状态栏徽章与更新按钮**: 设置面板顶部状态栏显示当前插件版本，有新版本时提示告警徽章并提供一键更新按钮与重启提示。
+- **网络超时熔断**: 配额检测与冒烟测试增加 15 秒超时信号保护 (`AbortSignal.timeout(15_000)`)，防止外部服务商接口故障导致请求挂起。
+- **参数容错与逻辑去重**: 状态接口兼容 `provider || vendor` 与 `index || accountIndex` 参数别名，并消除 `lib/accounts.js` 中的重复配额通知循环。
+
+---
+
+---
+
+## 🛡️ 稳定性与代码质量强化 (v0.6.10 新增)
+
+- **结构化异常降级**: 全面移除运行时空 catch 块，统一采用带诊断日志的 `bestEffort` 安全兜底机制。
+- **原生上下文日志**: 所有日志统一接入 Cordis 规范子系统 `ctx.logger('subscriptions')`。
+- **外部网络超时保护**: 为所有模型商 API 网络调用（`listModels`、`fetchFor`、`quotaFetch`、`jsonTokenRequest`）建立 `fetchWithTimeout` 与 `AbortSignal.timeout` 超时熔断保护。
+- **设计系统主题对齐**: 将 `client.js` 中的静态样式硬编码替换为 DeepSeek Harness 原生 CSS 主题令牌（`--dsw-alias-*`、`color-mix`），彻底消除独立的 `rgba` 颜色。
+- **客户端依赖注入显式化**: 在 `package.json` 清单中显式声明前端所需平台注入项（`@deepseek-ai/dsh-client-locale` 与 `@deepseek-ai/dsh-client-ui-slots`）。
+- **公开仓库卫生规范**: 将内部研发指令与计划文件移出 Git 跟踪并加入 `.gitignore`，确保公开版本干净无私有残余。
+
+---
+
 ## 🌐 本地化
 
 插件源语言仅为英语。俄语及其他翻译由独立的语言插件（如俄化插件）在运行时对注册的本地化键进行翻译，包本身不内置翻译（Changed in 0.6.1）。

package/lib/accounts.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
@@ -70,7 +71,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const usageFetched = new Map()
   const doFetch = fetchImpl || fetch
   // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
-  const fetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
+  const rawFetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
+  const fetchFor = (ref) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: 25000, ...(opts || {}) })
 
   async function resolveRaw(ref) {
     try {
@@ -262,24 +264,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
             for (const th of THRESHOLDS) {
               if (pct >= th && prev < th) {
                 notifyThresholds.set(key, th)
-                try { onLimitNotice && onLimitNotice(slot.provider, slot.ref, win, th) } catch {}
-                break
-              }
-            }
-          }
-        }
-        // Notification thresholds: 70/90/100% — fire once per window until reset.
-        if (Array.isArray(snap.windows)) {
-          for (const win of snap.windows) {
-            if (!win || !Number.isFinite(Number(win.usedPercent))) continue
-            const pct = Number(win.usedPercent)
-            const key = slot.ref + ':' + win.id
-            const prev = notifyThresholds.get(key) || 0
-            const THRESHOLDS = [70, 90, 100]
-            for (const th of THRESHOLDS) {
-              if (pct >= th && prev < th) {
-                notifyThresholds.set(key, th)
-                try { onLimitNotice && onLimitNotice(slot.provider, slot.ref, win, th) } catch {}
+                try { onLimitNotice && onLimitNotice(slot.provider, slot.ref, win, th) } catch (err) { /* ignore notification failure */ }
                 break
               }
             }

package/lib/adapter.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
 import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
@@ -116,15 +117,15 @@ export class SubscriptionAdapter extends LlmAdapter {
           // ponytail: capture x-ratelimit headers without touching vendors
           const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
-            const res = await baseFetch(url, init)
+            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
               if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
-            } catch {}
+            } catch (err) { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
                 const txt = await res.clone().text()
-                let j=null; try{ j=JSON.parse(txt)}catch{}
+                let j=null; try { j = JSON.parse(txt) } catch (err) { j = null }
                 if (j) {
                   const b = parseBody(provider, j, Date.now())
                   if (b) {
@@ -132,7 +133,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                     if (snap2) deps.rememberQuota(account.ref, snap2)
                   }
                 }
-              } catch {}
+              } catch (err) { /* ignore quota capture failure */ }
             }
             return res
           }
@@ -162,7 +163,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                   ms: Date.now() - t0,
                   kind: 'stream',
                 })
-              } catch {}
+              } catch (err) { /* ignore quota capture failure */ }
             }
           } catch (err) {
             if (err && err.code === 'VALIDATION_REQUIRED' && err.validationUrl) {

package/lib/client.js

@@ -21,7 +21,7 @@ window.__ModuleLoader__.load({
         return { hasError: true, error }
       }
       componentDidCatch(error, info) {
-        try { console.error("[dsh-subscriptions UI error]", error, info) } catch {}
+        try { console.error("[dsh-subscriptions UI error]", error, info) } catch (err) { /* fallback if console fails */ }
       }
       render() {
         if (this.state.hasError) {
@@ -63,7 +63,7 @@ window.__ModuleLoader__.load({
     '.dsub-helpBox{margin-top:8px;padding:12px 14px;border-radius:8px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1);font-size:12px;line-height:1.6}' +
     '.dsub-helpHead{display:flex;align-items:center;justify-content:space-between;font-weight:600;margin-bottom:8px;color:var(--dsw-alias-brand-primary)}' +
     '.dsub-helpStep{margin-bottom:6px;color:var(--dsw-alias-label-primary)}' +
-    '.dsub-btnActive{background:var(--dsw-alias-brand-primary);color:#fff;border-color:var(--dsw-alias-brand-primary)}' +
+    '.dsub-btnActive{background:var(--dsw-alias-brand-primary);color:var(--dsw-alias-text-contrast,#fff);border-color:var(--dsw-alias-brand-primary)}' +
     '.dsub-h{font-size:13.5px;font-weight:600;color:var(--dsw-alias-label-primary)}' +
     '.dsub-sub{font-size:12px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-dim{font-size:11.5px;color:var(--dsw-alias-label-tertiary)}' +
@@ -77,7 +77,7 @@ window.__ModuleLoader__.load({
     '.dsub-inp{height:30px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 8px;font-size:12px;min-width:180px}' +
     '.dsub-inp:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}' +
     '.dsub-box{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px;margin-top:8px;background:var(--dsw-alias-bg-layer-2)}' +
-    '.dsub-cooldown{display:inline-block;padding:2px 6px;border-radius:4px;background:var(--dsw-alias-state-warning-primary);color:#000;font-size:11px;font-weight:600}' +
+    '.dsub-cooldown{display:inline-block;padding:2px 6px;border-radius:4px;background:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-bg-layer-1,#000);font-size:11px;font-weight:600}' +
     '.dsub-bar{position:relative;height:6px;border-radius:3px;background:var(--dsw-alias-bg-layer-1);overflow:hidden;flex:1;min-width:80px}' +
     '.dsub-barFill{height:100%;border-radius:3px;background:var(--dsw-alias-state-success-primary);transition:width .2s}' +
     '.dsub-barWarn .dsub-barFill{background:var(--dsw-alias-state-warning-primary)}' +
@@ -86,8 +86,8 @@ window.__ModuleLoader__.load({
     '.dsub-manual{display:flex;flex-direction:column;gap:6px;margin-top:4px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-verify{font-size:12px;color:var(--dsw-alias-state-warning-primary)}' +
     '.dsub-verify a{color:var(--dsw-alias-brand-primary)}' +
-    '.dsub-pill{display:inline-flex;align-items:center;gap:7px;height:28px;padding:0 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;box-shadow:0 1px 3px rgba(0,0,0,.15),inset 0 1px 0 rgba(255,255,255,.06);transition:all .16s ease;user-select:none}' +
-    '.dsub-pill:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary);transform:translateY(-1px);box-shadow:0 3px 8px rgba(0,0,0,.25),inset 0 1px 0 rgba(255,255,255,.1)}' +
+    '.dsub-pill{display:inline-flex;align-items:center;gap:7px;height:28px;padding:0 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;box-shadow:0 1px 3px color-mix(in srgb, black 15%, transparent),inset 0 1px 0 color-mix(in srgb, white 6%, transparent);transition:all .16s ease;user-select:none}' +
+    '.dsub-pill:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary);transform:translateY(-1px);box-shadow:0 3px 8px color-mix(in srgb, black 25%, transparent),inset 0 1px 0 color-mix(in srgb, white 10%, transparent)}' +
     '.dsub-pill:active{transform:translateY(0)}' +
     '.dsub-pillTag{padding:1px 5px;border-radius:4px;font-size:10.5px;font-weight:700;letter-spacing:.02em;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary)}' +
     '.dsub-led{width:7px;height:7px;border-radius:50%;flex:none;transition:all .2s ease}' +
@@ -95,15 +95,15 @@ window.__ModuleLoader__.load({
     '.dsub-ledWarn{background:var(--dsw-alias-state-warning-primary,#f59e0b);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-warning-primary) 70%,transparent)}' +
     '.dsub-ledBad{background:var(--dsw-alias-state-error-primary,#ef4444);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-error-primary) 70%,transparent)}' +
     '.dsub-ledOff{background:var(--dsw-alias-label-tertiary,#6b7280)}' +
-    '.dsub-modalWrap{position:fixed;inset:0;z-index:10020;display:grid;place-items:center;background:rgba(0,0,0,.65);backdrop-filter:blur(10px);animation:dsubFadeIn .16s ease-out}' +
-    '.dsub-modal{width:min(520px,94vw);max-height:min(85vh,720px);overflow-y:auto;border:1px solid var(--dsw-alias-border-l1);border-radius:16px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);box-shadow:0 24px 64px rgba(0,0,0,.6),0 0 0 1px rgba(255,255,255,.07);padding:20px;animation:dsubScaleIn .18s cubic-bezier(.16,1,.3,1)}' +
+    '.dsub-modalWrap{position:fixed;inset:0;z-index:10020;display:grid;place-items:center;background:color-mix(in srgb, black 65%, transparent);backdrop-filter:blur(10px);animation:dsubFadeIn .16s ease-out}' +
+    '.dsub-modal{width:min(520px,94vw);max-height:min(85vh,720px);overflow-y:auto;border:1px solid var(--dsw-alias-border-l1);border-radius:16px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);box-shadow:0 24px 64px color-mix(in srgb, black 60%, transparent),0 0 0 1px color-mix(in srgb, white 7%, transparent);padding:20px;animation:dsubScaleIn .18s cubic-bezier(.16,1,.3,1)}' +
     '@keyframes dsubFadeIn{from{opacity:0}to{opacity:1}}' +
     '@keyframes dsubScaleIn{from{opacity:0;transform:scale(.96)}to{opacity:1;transform:scale(1)}}' +
     '.dsub-modalHead{display:flex;align-items:center;justify-content:space-between;gap:12px;padding-bottom:14px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-modalTitleWrap{display:flex;align-items:center;gap:10px}' +
     '.dsub-modalIcon{width:30px;height:30px;border-radius:8px;background:var(--dsw-alias-bg-layer-1);display:grid;place-items:center;color:var(--dsw-alias-brand-primary);font-size:14px}' +
     '.dsub-modalBadge{font-size:11px;font-weight:600;padding:2px 7px;border-radius:10px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary)}' +
-    '.dsub-heroCard{margin-top:14px;padding:14px 16px;border-radius:12px;background:linear-gradient(135deg,var(--dsw-alias-bg-layer-2) 0%,var(--dsw-alias-bg-layer-3) 100%);border:1px solid var(--dsw-alias-border-l1);box-shadow:inset 0 1px 0 rgba(255,255,255,.05)}' +
+    '.dsub-heroCard{margin-top:14px;padding:14px 16px;border-radius:12px;background:linear-gradient(135deg,var(--dsw-alias-bg-layer-2) 0%,var(--dsw-alias-bg-layer-3) 100%);border:1px solid var(--dsw-alias-border-l1);box-shadow:inset 0 1px 0 color-mix(in srgb, white 5%, transparent)}' +
     '.dsub-heroHead{display:flex;align-items:center;justify-content:space-between;margin-bottom:10px}' +
     '.dsub-heroTitle{font-size:14px;font-weight:700;display:flex;align-items:center;gap:6px}' +
     '.dsub-heroModel{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-family:ui-monospace,monospace}' +
@@ -113,9 +113,9 @@ window.__ModuleLoader__.load({
     '.dsub-summary:hover{color:var(--dsw-alias-label-primary)}' +
     '.dsub-header-bar{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;padding:8px 0 12px;margin-bottom:8px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500}' +
-    '.dsub-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:rgba(16,185,129,0.08)}' +
-    '.dsub-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:rgba(245,158,11,0.08)}' +
-    '.dsub-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:rgba(239,68,68,0.08)}' +
+    '.dsub-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent)}' +
+    '.dsub-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb,var(--dsw-alias-state-warning-primary) 10%,transparent)}' +
+    '.dsub-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent)}' +
     '.dsub-badge-neutral{border-color:var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-layer-2)}' +
     '.dsub-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;padding:14px 16px;display:flex;flex-direction:column;gap:10px;margin-top:12px}' +
     '.dsub-section-title{font-size:14.5px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px}' +
@@ -124,8 +124,8 @@ window.__ModuleLoader__.load({
     '.dsub-stat-box{padding:10px 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);display:flex;flex-direction:column;gap:3px}' +
     '.dsub-stat-val{font-size:16.5px;font-weight:700;color:var(--dsw-alias-label-primary)}' +
     '.dsub-stat-lbl{font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
-    '.dsub-alert-ok{padding:8px 12px;border-radius:8px;background:rgba(16,185,129,0.09);color:var(--dsw-alias-state-success-primary);font-size:12.5px;border:1px solid rgba(16,185,129,0.25)}' +
-    '.dsub-alert-bad{padding:8px 12px;border-radius:8px;background:rgba(239,68,68,0.09);color:var(--dsw-alias-state-error-primary);font-size:12.5px;border:1px solid rgba(239,68,68,0.25)}' +
+    '.dsub-alert-ok{padding:8px 12px;border-radius:8px;background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent);color:var(--dsw-alias-state-success-primary);font-size:12.5px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-success-primary) 25%,transparent)}' +
+    '.dsub-alert-bad{padding:8px 12px;border-radius:8px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent);color:var(--dsw-alias-state-error-primary);font-size:12.5px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary) 25%,transparent)}' +
     '.dsub-btn-primary{background:var(--dsw-alias-label-primary) !important;color:var(--dsw-alias-bg-layer-3) !important;border-color:transparent !important;font-weight:600}' +
     '.dsub-btn-primary:hover:not(:disabled){opacity:0.9}' +
     '.dsub-model-grid{display:flex;flex-wrap:wrap;gap:6px;margin-top:6px}' +
@@ -158,14 +158,14 @@ window.__ModuleLoader__.load({
     '.dsub-accountCard{display:flex;align-items:center;gap:12px;padding:10px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2);margin-top:6px;transition:border-color .15s,background .15s}' +
     '.dsub-accountCard:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary)}' +
     '.dsub-brandBadge{width:32px;height:32px;border-radius:8px;display:grid;place-items:center;font-size:12px;font-weight:700;flex-shrink:0}' +
-    '.dsub-brandCodex{background:rgba(16,185,129,.15);color:#10b981;border:1px solid rgba(16,185,129,.3)}' +
-    '.dsub-brandClaude{background:rgba(245,158,11,.15);color:#f59e0b;border:1px solid rgba(245,158,11,.3)}' +
-    '.dsub-brandGrok{background:rgba(168,85,247,.15);color:#c084fc;border:1px solid rgba(168,85,247,.3)}' +
-    '.dsub-brandAgy{background:rgba(59,130,246,.15);color:#60a5fa;border:1px solid rgba(59,130,246,.3)}' +
-    '.dsub-brandOllama{background:rgba(107,114,128,.15);color:#9ca3af;border:1px solid rgba(107,114,128,.3)}' +
-    '.dsub-brandKimi{background:rgba(236,72,153,.15);color:#f472b6;border:1px solid rgba(236,72,153,.3)}' +
-    '.dsub-brandGlm{background:rgba(20,184,166,.15);color:#2dd4bf;border:1px solid rgba(20,184,166,.3)}' +
-    '.dsub-planBadge{display:inline-flex;align-items:center;padding:1px 6px;border-radius:4px;font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:0.5px;background:rgba(99,102,241,.15);color:#818cf8;border:1px solid rgba(99,102,241,.3);margin-left:6px}' +
+    '.dsub-brandCodex{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 15%,transparent);color:var(--dsw-alias-state-success-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-state-success-primary) 30%,transparent)}' +
+    '.dsub-brandClaude{background:color-mix(in srgb,var(--dsw-alias-state-warning-primary) 15%,transparent);color:var(--dsw-alias-state-warning-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-state-warning-primary) 30%,transparent)}' +
+    '.dsub-brandGrok{background:color-mix(in srgb,#a855f7 15%,transparent);color:#c084fc;border:1px solid color-mix(in srgb,#a855f7 30%,transparent)}' +
+    '.dsub-brandAgy{background:color-mix(in srgb,var(--dsw-alias-brand-primary) 15%,transparent);color:var(--dsw-alias-brand-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 30%,transparent)}' +
+    '.dsub-brandOllama{background:color-mix(in srgb,var(--dsw-alias-label-tertiary) 15%,transparent);color:var(--dsw-alias-label-secondary);border:1px solid color-mix(in srgb,var(--dsw-alias-label-tertiary) 30%,transparent)}' +
+    '.dsub-brandKimi{background:color-mix(in srgb,#ec4899 15%,transparent);color:#f472b6;border:1px solid color-mix(in srgb,#ec4899 30%,transparent)}' +
+    '.dsub-brandGlm{background:color-mix(in srgb,#14b8a6 15%,transparent);color:#2dd4bf;border:1px solid color-mix(in srgb,#14b8a6 30%,transparent)}' +
+    '.dsub-planBadge{display:inline-flex;align-items:center;padding:1px 6px;border-radius:4px;font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:0.5px;background:color-mix(in srgb,var(--dsw-alias-brand-primary) 15%,transparent);color:var(--dsw-alias-brand-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 30%,transparent);margin-left:6px}' +
     
     '.dsub-accInfo{flex:1;min-width:0;display:flex;flex-direction:column;gap:3px}' +
     '.dsub-accNameRow{display:flex;align-items:center;justify-content:space-between;gap:8px}' +
@@ -176,7 +176,7 @@ window.__ModuleLoader__.load({
     '.dsub-statusBad{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 15%,transparent);color:var(--dsw-alias-state-error-primary)}' +
     '.dsub-statusOff{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-tertiary)}' +
     '.dsub-modalFoot{display:flex;align-items:center;justify-content:space-between;margin-top:16px;padding-top:12px;border-top:1px solid var(--dsw-alias-border-l2)}' +
-    '.dsub-btnPrimary{display:inline-flex;align-items:center;gap:6px;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;background:var(--dsw-alias-brand-primary,#3b82f6);color:#fff;border:0;cursor:pointer;transition:opacity .15s}' +
+    '.dsub-btnPrimary{display:inline-flex;align-items:center;gap:6px;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;background:var(--dsw-alias-brand-primary,#3b82f6);color:var(--dsw-alias-text-contrast,#fff);border:0;cursor:pointer;transition:opacity .15s}' +
     '.dsub-btnPrimary:hover{opacity:.9}' +
     '.dsub-btnSec{display:inline-flex;align-items:center;gap:5px;padding:5px 10px;border-radius:7px;font-size:11.5px;font-weight:500;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);border:1px solid var(--dsw-alias-border-l2);cursor:pointer;text-decoration:none;transition:all .15s}' +
     '.dsub-btnSec:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-tertiary)}' +
@@ -481,7 +481,14 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "instructionsTitle": "How to obtain token",
       "close": "Close",
       "reconnectRequired": "Reconnect required",
-      "manualTitle": "If the browser did not come back"
+      "manualTitle": "If the browser did not come back",
+      "updateChecking": "Checking updates…",
+      "updateUpToDate": "Up to date",
+      "updateAvailable": "Update available",
+      "updateNow": "Update",
+      "updating": "Updating…",
+      "updateSuccessRestart": "Update complete. Restarting service…",
+      "updateFailed": "Update failed"
 };
 
     const zh = {
@@ -643,7 +650,14 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "instructionsTitle": "获取令牌指引",
       "close": "关闭",
       "reconnectRequired": "需要重新连接",
-      "manualTitle": "若浏览器未能自动跳转回调"
+      "manualTitle": "若浏览器未能自动跳转回调",
+      "updateChecking": "检查更新中…",
+      "updateUpToDate": "已是最新版本",
+      "updateAvailable": "有新版本可用",
+      "updateNow": "立即更新",
+      "updating": "正在更新…",
+      "updateSuccessRestart": "更新成功，服务重启中…",
+      "updateFailed": "更新失败"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
                 function cleanErrorMessage(raw) {
@@ -656,7 +670,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           if (parsed.error && parsed.error.message) text = parsed.error.message
           else if (parsed.message) text = parsed.message
           else if (parsed.code) text = parsed.code
-        } catch (e) {}
+        } catch (e) { /* ignore parse error */ }
       }
       var firstLine = text.split('\n')[0].trim()
       if (firstLine.length > 160) return firstLine.slice(0, 157) + '...'
@@ -823,7 +837,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           .then((d) => {
             const txt = d && d.ok ? JSON.stringify(d.report, null, 2) : ('error: ' + ((d && d.error && d.error.message) || 'unknown'))
             setDiag(txt)
-            try { navigator.clipboard.writeText(txt) } catch {}
+            try { navigator.clipboard.writeText(txt) } catch (err) { /* clipboard write disallowed */ }
           })
           .catch((e) => setDiag('error: ' + String(e && e.message || e)))
       }
@@ -831,6 +845,43 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       const [hostPing, setHostPing] = React.useState({ ok: true, latencyMs: null })
       const [telemetry, setTelemetry] = React.useState(null)
       const [smoke, setSmoke] = React.useState({ testing: false, result: null })
+      const [updater, setUpdater] = React.useState({ checking: false, updating: false, status: null, message: '' })
+
+      const checkUpdater = () => {
+        setUpdater((u) => Object.assign({}, u, { checking: true, message: '' }))
+        return fetch('/dsh-subscriptions/update', { cache: 'no-store' })
+          .then((res) => res.json())
+          .then((data) => {
+            setUpdater((u) => Object.assign({}, u, { checking: false, status: data }))
+            return data
+          })
+          .catch((e) => {
+            setUpdater((u) => Object.assign({}, u, { checking: false, message: cleanErrorMessage(e.message || e) }))
+          })
+      }
+
+      const performUpdate = async () => {
+        setUpdater((u) => Object.assign({}, u, { updating: true, message: '' }))
+        try {
+          const res = await fetch('/dsh-subscriptions/update', {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              'x-dsh-plugin-update': '1',
+            },
+          })
+          const data = await res.json().catch(() => ({}))
+          if (!res.ok || !data.ok) {
+            throw new Error((data && data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status))
+          }
+          setUpdater((u) => Object.assign({}, u, { updating: false, message: t('updateSuccessRestart') }))
+          setTimeout(() => {
+            window.location.reload()
+          }, 3500)
+        } catch (e) {
+          setUpdater((u) => Object.assign({}, u, { updating: false, message: (t('updateFailed') + ': ' + cleanErrorMessage(e.message || e)) }))
+        }
+      }
 
       const reloadTelemetry = () => {
         fetch('/dsh-subscriptions/telemetry', { cache: 'no-store' })
@@ -886,6 +937,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       React.useEffect(() => {
         let alive = true
         reload().catch((e) => { if (alive) setErr(String(e && e.message ? e.message : e)) })
+        checkUpdater().catch(() => {})
         return () => { alive = false }
       }, [])
 
@@ -1107,14 +1159,38 @@ const cssId = 'dsh-subscriptions/settings.module.css'
             React.createElement('span', {
               className: 'dsub-badge dsub-badge-neutral'
             }, 'Pool: ' + accounts.length + ' accounts'),
+            updater.status && updater.status.updateAvailable
+              ? React.createElement('span', { className: 'dsub-badge dsub-badge-warn' },
+                  '⬆ ' + t('updateAvailable') + ' (v' + (updater.status.latestVersion || '') + ')'
+                )
+              : (updater.status && updater.status.currentVersion
+                  ? React.createElement('span', { className: 'dsub-badge dsub-badge-neutral' },
+                      'v' + updater.status.currentVersion
+                    )
+                  : null
+                ),
+          ),
+          React.createElement('div', { className: 'dsub-row', style: { marginTop: 0, gap: '8px' } },
+            updater.status && updater.status.updateAvailable && updater.status.canAutoUpdate
+              ? React.createElement('button', {
+                  type: 'button',
+                  className: 'dsub-mini dsub-btn-primary',
+                  disabled: updater.updating,
+                  onClick: () => performUpdate(),
+                }, updater.updating ? t('updating') : (t('updateNow') + ' → v' + updater.status.latestVersion))
+              : null,
+            React.createElement('button', {
+              type: 'button',
+              className: 'dsub-mini',
+              disabled: smoke.testing,
+              onClick: () => runSmokeTest(),
+            }, smoke.testing ? t('smokeTesting') : t('runSmoke')),
           ),
-          React.createElement('button', {
-            type: 'button',
-            className: 'dsub-mini dsub-btn-primary',
-            disabled: smoke.testing,
-            onClick: () => runSmokeTest(),
-          }, smoke.testing ? t('smokeTesting') : t('runSmoke')),
         ),
+        updater.message ? React.createElement('div', {
+          className: updater.message.includes(t('updateSuccessRestart')) ? 'dsub-alert-ok' : 'dsub-alert-bad',
+          style: { marginBottom: '12px' }
+        }, updater.message) : null,
         smoke.result ? React.createElement('div', {
           className: smoke.result.ok ? 'dsub-alert-ok' : 'dsub-alert-bad',
           style: { marginBottom: '12px' }
@@ -1343,7 +1419,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           diag ? React.createElement('div', { className: 'dsub-row' },
             React.createElement('button', {
               type: 'button', className: 'dsub-mini',
-              onClick: () => { try { navigator.clipboard.writeText(diag) } catch {} },
+              onClick: () => { try { navigator.clipboard.writeText(diag) } catch (err) { /* clipboard write error */ } },
             }, t('diagCopy')),
             React.createElement('pre', { className: 'dsub-diag' }, diag),
           ) : null,
@@ -1512,7 +1588,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                       React.createElement('div', { className: 'dsub-row' },
                         React.createElement('button', {
                           type: 'button', className: 'dsub-mini',
-                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch {} },
+                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch (err) { /* clipboard write error */ } },
                         }, t('deviceCopy')),
                         React.createElement('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
@@ -1989,7 +2065,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                   className: 'dsub-barFillGrad',
                   style: {
                     width: Math.min(100, Math.max(0, secPct)) + '%',
-                    background: secPct >= 90 ? '#ef4444' : (secPct >= 50 ? '#f59e0b' : '#3b82f6'),
+                    background: secPct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (secPct >= 50 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-brand-primary)'),
                   },
                 }),
               ),
@@ -2038,7 +2114,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                 className: 'dsub-barFillGrad',
                 style: {
                   width: Math.min(100, Math.max(0, pct)) + '%',
-                  background: pct >= 90 ? '#ef4444' : (pct >= 50 ? '#f59e0b' : '#10b981'),
+                  background: pct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (pct >= 50 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-state-success-primary)'),
                 },
               }),
             ) : null,
@@ -2101,7 +2177,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                   try {
                     const btn = Array.from(document.querySelectorAll('button')).find((b) => (b.textContent || '').includes(t('title')))
                     if (btn) btn.click()
-                  } catch {}
+                  } catch (err) { /* best-effort */ }
                 },
               }, t('subsOpenSettings')),
             ),

package/lib/http.js

@@ -30,6 +30,13 @@ export function readBody(req, maxBytes = 64 * 1024) {
   })
 }
 
+export function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true
+}
+
 /**
  * @param {import('node:http').IncomingMessage} request
  * @returns {boolean}

package/lib/index.js

@@ -1,3 +1,4 @@
+import { bestEffort } from './utils.js'
 export { Config, publicConfig, Slot, defaultSlots } from './config-schema.js'
 import { Config, publicConfig } from './config-schema.js'
 import { registerRoutes } from './routes.js'
@@ -37,7 +38,7 @@ export const inject = ['llm', 'credentials', 'webServer', 'settings']
 const NS = 'dsh-subscriptions'
 
 let pkgVersion = ''
-try { pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '' } catch {}
+try { pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '' } catch (err) { /* ignore package read errors at startup */ }
 const PENDING_TTL_MS = 15 * 60 * 1000
 
 function redirectFor(provider, cfg, origin) {
@@ -49,6 +50,7 @@ function redirectFor(provider, cfg, origin) {
 const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>'
 
 export function apply(ctx, config) {
+  const logger = ctx.logger ? ctx.logger('subscriptions') : console
   let getConfig = () => config
   let settingsApi
   ctx.inject(['settings'], (sctx) => {
@@ -68,7 +70,7 @@ export function apply(ctx, config) {
     try {
       profiles = (live().customVendors || []).map(validateProfile)
     } catch (e) {
-      try { ctx.log && ctx.log.warn && ctx.log.warn('[dsh-subscriptions] customVendors: ' + String(e && e.message || e)) } catch {}
+      if (logger && logger.warn) logger.warn('[dsh-subscriptions] customVendors: ' + String(e && e.message || e))
       return
     }
     clearCustomVendors()
@@ -79,7 +81,7 @@ export function apply(ctx, config) {
         registerCustomProviderIds([profile.id])
         if (profile.displayName) registerDisplayName(profile.id, profile.displayName)
       } catch (e) {
-        try { ctx.log && ctx.log.warn && ctx.log.warn('[dsh-subscriptions] customVendors[' + profile.id + ']: ' + String(e && e.message || e)) } catch {}
+        if (logger && logger.warn) logger.warn('[dsh-subscriptions] customVendors[' + profile.id + ']: ' + String(e && e.message || e))
       }
     }
   }
@@ -103,9 +105,9 @@ export function apply(ctx, config) {
     fetchForRef,
     onLimitNotice: (provider, ref, win, threshold) => {
       if (!live().notifyLimits) return
-      const label = win.ru || win.en || win.id
-      try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider} ${ref}: limit ${label} at ${threshold}%`) } catch {}
-      try { ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }) } catch {}
+      const label = win.en || win.ru || win.id
+      if (logger && logger.warn) logger.warn(`[dsh-subscriptions] ${provider} ${ref}: limit ${label} at ${threshold}%`)
+      bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
   const history = new HistoryStore()
@@ -140,8 +142,8 @@ export function apply(ctx, config) {
     const models = await ollamaModels(ollamaBase(cfg), fetch).catch(() => [])
     if (!cfg.ollamaFallback || !models.length) throw err
     const model = cfg.ollamaFallbackModel || models[0].id
-    try { ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }) } catch {}
-    try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider}: all accounts exhausted (${err && err.code || 'EXHAUSTED'}), falling back to ollama/${model}`) } catch {}
+    bestEffort('emit ollama-fallback', () => ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }), undefined, logger)
+    if (logger && logger.warn) logger.warn(`[dsh-subscriptions] ${provider}: all accounts exhausted (${err && err.code || 'EXHAUSTED'}), falling back to ollama/${model}`)
     try {
       recordHistory({
         provider: 'ollama',
@@ -152,7 +154,7 @@ export function apply(ctx, config) {
         status: 200,
         kind: 'fallback',
       })
-    } catch {}
+    } catch (err) { if (logger && logger.debug) logger.debug('[history] fallback record failed: ' + (err && err.message || err)) }
     yield* ollamaAdapter.stream({ ...options, provider: 'ollama', model })
   }
 
@@ -277,7 +279,7 @@ export function apply(ctx, config) {
         const fresh = await store.ensureFresh(provider, blob, slot.ref)
         const cfg = vendorConfig(provider, live())
         await getVendor(provider).listModels(fresh, cfg, fetch).catch(() => {})
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
   }
 
@@ -398,7 +400,7 @@ export function apply(ctx, config) {
         if (info.configured) pv.configured++
         if (info.cooldownUntil && info.cooldownUntil > Date.now()) pv.cooldown++
         if (info.usagePercent != null) pv.maxUsagePercent = Math.max(pv.maxUsagePercent || 0, Math.round(info.usagePercent))
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
     for (const p of Object.keys(providers)) providers[p].loggedIn = logged.includes(p)
     const rows = history.all()
@@ -478,7 +480,7 @@ export function apply(ctx, config) {
         for (const slot of normalizeSlots(live().slots)) {
           store.refreshUsage(slot.provider).catch(() => {})
         }
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
     eager()
     return () => {
@@ -509,9 +511,9 @@ export function apply(ctx, config) {
           if (blob.expiresAt - now > ahead) continue
           if (typeof store.shouldSkipRefresh === 'function' && store.shouldSkipRefresh(ref, now, retryMs)) continue
           await store.ensureFresh(slot.provider, blob, ref).catch((e) => {
-            try { ctx.log && ctx.log.warn && ctx.log.warn("[dsh-subscriptions] background refresh failed for " + ref + ": " + String(e && e.message || e)) } catch {}
+            if (logger && logger.warn) logger.warn("[dsh-subscriptions] background refresh failed for " + ref + ": " + String(e && e.message || e))
           })
-        } catch {}
+        } catch (err) { /* best-effort */ }
       }
     }
     tick().catch(() => {})
@@ -546,9 +548,9 @@ export function apply(ctx, config) {
           const cfg2 = vendorConfig(slot.provider, live())
           const probeFetch = async (u, i) => fetch(u, i)
           await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
-            try { ctx.log && ctx.log.warn && ctx.log.warn("[dsh-subscriptions] probe " + ref + ": " + String(e && e.message || e).slice(0, 200)) } catch {}
+            if (logger && logger.warn) logger.warn("[dsh-subscriptions] probe " + ref + ": " + String(e && e.message || e).slice(0, 200))
           })
-        } catch {}
+        } catch (err) { /* best-effort */ }
       }
     }
     let lastProbeAt = 0