@goodandready/dsh-subscriptions 0.6.8 → 0.6.10

package/lib/mask.js

@@ -30,7 +30,7 @@ export function cleanErrorMessage(raw) {
       if (parsed.error && parsed.error.message) text = parsed.error.message
       else if (parsed.message) text = parsed.message
       else if (parsed.code) text = parsed.code
-    } catch {}
+    } catch (err) { /* ignore JSON parse failure */ }
   }
   const firstLine = text.split('\n')[0].trim()
   if (firstLine.length > 160) {

package/lib/relative-time.js

@@ -20,14 +20,6 @@ export const RELATIVE_UNITS = {
     hour: '{n}小时',
     day: '{n}天',
   },
-  ru: {
-    soon: 'только что',
-    prefix: 'через ',
-    suffix: '',
-    minute: '{n} мин',
-    hour: '{n} ч',
-    day: '{n} дн',
-  },
 }
 
 function fill(template, n) {

package/lib/routes/proxy.js

@@ -21,7 +21,7 @@ export function registerProxyRoutes(ctx, state) {
       }
       const raw = await readBody(req, 128 * 1024).catch(() => Buffer.alloc(0))
       let body = {}
-      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch {}
+      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch (err) { body = {} }
       const events = Array.isArray(body && body.events) ? body.events : []
       const analysis = analyzeSessionEvents(events)
       writeJson(res, 200, { ok: true, analysis })

package/lib/routes/status.js

@@ -95,7 +95,7 @@ export function registerStatusRoutes(ctx, state) {
             expires[slot.provider] = Math.max(expires[slot.provider] || 0, slot.expiresAt)
             labels[slot.provider] = pmL(slot.label || info.label || slot.provider)
           }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
       }
       // #69/#72: active subscription = last successful request (newest first).
       let active = null
@@ -118,7 +118,7 @@ export function registerStatusRoutes(ctx, state) {
               .filter((w) => w && typeof w.usedPercent === 'number')
               .map((w) => ({ id: w.id || w.en || w.ru, label: w.en || w.ru || w.id, usedPercent: w.usedPercent }))
           }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
         active = {
           provider: lastRow.provider,
           index,
@@ -177,26 +177,27 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
         return
       }
-      const provider = payload.provider
+      const provider = payload.provider || payload.vendor
+      const index = payload.index || (payload.accountIndex != null ? payload.accountIndex + 1 : 1)
       if (!isProvider(provider)) {
         writeJson(res, 200, { ok: false, provider, error: { code: 'provider', message: 'unknown provider' } })
         return
       }
       const t0 = Date.now()
-      const ref = oauthRef(provider, payload.index)
+      const ref = oauthRef(provider, index)
       const info = await store.describeRef(ref)
       if (!info.configured) {
-        writeJson(res, 200, { ok: false, provider, index: payload.index, ref, error: { code: 'not_connected', message: 'not connected' } })
+        writeJson(res, 200, { ok: false, provider, index: index, ref, error: { code: 'not_connected', message: 'not connected' } })
         return
       }
       let blob
       try { blob = await store.loadBlob(ref) } catch (e) {
-        writeJson(res, 200, { ok: false, provider, index: payload.index, ref, error: { code: 'auth', message: String(e && e.message || e) } })
+        writeJson(res, 200, { ok: false, provider, index: index, ref, error: { code: 'auth', message: String(e && e.message || e) } })
         return
       }
       try { blob = await store.ensureFresh(provider, blob, ref) } catch (e) {
         writeJson(res, 200, {
-          ok: false, provider, index: payload.index, ref,
+          ok: false, provider, index: index, ref,
           email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: info.quota || null,
           error: { code: 'refresh', message: String(e && e.message || e) },
@@ -205,25 +206,27 @@ export function registerStatusRoutes(ctx, state) {
       }
       const vendor = getVendor(provider)
       if (typeof vendor.check !== 'function') {
-        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: info.quota || null })
+        writeJson(res, 200, { ok: true, provider, index: index, ref, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: info.quota || null })
         return
       }
       let capturedQuota = null
-      const probeFetch = async (url, init) => {
-        const res2 = await fetch(url, init)
+      const probeFetch = async (url, init = {}) => {
+        const timeoutSignal = AbortSignal.timeout(15_000)
+        const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
+        const res2 = await fetch(url, { ...init, signal })
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
         return res2
       }
       try {
         await vendor.check(blob, vendorConfig(provider, live()), probeFetch)
         const latencyMs = Date.now() - t0;
-        writeJson(res, 200, { ok: true, provider, index: payload.index, ref, latencyMs, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
+        writeJson(res, 200, { ok: true, provider, index: index, ref, latencyMs, email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null, quota: capturedQuota || info.quota || null, usagePercent: info.usagePercent ?? null })
       } catch (e) {
         writeJson(res, 200, {
-          ok: false, provider, index: payload.index, ref,
+          ok: false, provider, index: index, ref,
           latencyMs: Date.now() - t0,
           email: pmE(blob.email), label: pmL(blob.label), expiresAt: blob.expiresAt || null,
           quota: capturedQuota || info.quota || null,
@@ -280,7 +283,7 @@ export function registerStatusRoutes(ctx, state) {
         return
       }
       let payload = {}
-      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch {}
+      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch (err) { /* ignore status inspection error */ }
 
       let provider = payload.provider
       let index = payload.index || 1
@@ -321,12 +324,14 @@ export function registerStatusRoutes(ctx, state) {
       const vendor = getVendor(provider)
       if (typeof vendor.check === 'function') {
         let capturedQuota = null
-        const probeFetch = async (url, init) => {
-          const res2 = await fetch(url, init)
+        const probeFetch = async (url, init = {}) => {
+          const timeoutSignal = AbortSignal.timeout(15_000)
+          const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
+          const res2 = await fetch(url, { ...init, signal })
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-          } catch {}
+          } catch (err) { /* ignore status inspection error */ }
           return res2
         }
         try {

package/lib/routes.js

@@ -1,10 +1,11 @@
 import { publicConfig } from './config-schema.js'
 import { PROVIDERS, displayName } from './refs.js'
-import { escapeHtml, writeHtml, writeJson } from './http.js'
+import { escapeHtml, isLoopback, writeHtml, writeJson } from './http.js'
 import { registerStatusRoutes } from './routes/status.js'
 import { registerOauthRoutes } from './routes/oauth.js'
 import { registerAccountsRoutes } from './routes/accounts.js'
 import { registerProxyRoutes } from './routes/proxy.js'
+import { registerPluginUpdater } from './updater.js'
 
 export function registerRoutes(ctx, state) {
   const {
@@ -22,6 +23,11 @@ export function registerRoutes(ctx, state) {
     }
   }
 
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    endpoint: '/dsh-subscriptions/update',
+    packageName: '@goodandready/dsh-subscriptions',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-subscriptions: /update')
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -32,7 +38,8 @@ export function registerRoutes(ctx, state) {
         return
       }
       const host = (req.headers.host || '').split(':')[0]
-      if (host !== 'localhost' && host !== '127.0.0.1') {
+      const remote = req.socket?.remoteAddress
+      if (!isLoopback(host) || (remote && !isLoopback(remote))) {
         writeHtml(res, 403, '<!doctype html><meta charset="utf-8"><p>Subscriptions overview is localhost-only.</p>')
         return
       }

package/lib/subscriptions.js

@@ -20,7 +20,7 @@ export function isAllowed(provider, path) {
   p = p.split("?")[0].split("#")[0]
   try {
     if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch {}
+  } catch (err) { /* ignore subscriptions error */ }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -140,17 +140,17 @@ export function createSubscriptionsService(deps) {
           try {
             const snap = quotaSnapshot(provider, res.headers, null, Date.now())
             if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
-          } catch {}
+          } catch (err) { /* ignore subscriptions error */ }
           if (!res.ok && res.clone) {
             try {
               const txt = await res.clone().text()
               let j = null
-              try { j = JSON.parse(txt) } catch {}
+              try { j = JSON.parse(txt) } catch (err) { /* ignore subscriptions error */ }
               if (j) {
                 const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
                 if (snap2 && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap2)
               }
-            } catch {}
+            } catch (err) { /* ignore subscriptions error */ }
           }
           if (!res.ok) {
             const txt = await res.text().catch(() => "")
@@ -174,7 +174,7 @@ export function createSubscriptionsService(deps) {
                 ms: Date.now() - t0,
                 kind: "request",
               })
-            } catch {}
+            } catch (err) { /* ignore subscriptions error */ }
           }
           return res
         } catch (err) {

package/lib/updater.js

@@ -0,0 +1,260 @@
+import { spawn } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { basename, dirname, isAbsolute, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { writeJson } from './http.js'
+
+const UPDATE_HEADER = 'x-dsh-plugin-update'
+const UPDATE_TIMEOUT_MS = 10 * 60_000
+const VERSION_CACHE_MS = 5 * 60_000
+let latestCache
+
+function header(request, name) {
+  const value = request.headers?.[name]
+  return Array.isArray(value) ? value[0] : value
+}
+
+export function isLoopback(value) {
+  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address?.startsWith('127.') === true
+    || address?.startsWith('::ffff:127.') === true
+}
+
+export function isTrustedUpdateRequest(request) {
+  const customHeader = header(request, UPDATE_HEADER)
+  if (customHeader !== '1') {
+    // In browser fetch, allow if sec-fetch-site is same-origin or same-site
+    const site = header(request, 'sec-fetch-site')
+    if (site === 'cross-site') return false
+  }
+  const remote = request.socket?.remoteAddress
+  if (remote && !isLoopback(remote)) return false
+  const origin = header(request, 'origin')
+  const host = header(request, 'host')
+  if (origin && host) {
+    try {
+      const url = new URL(origin)
+      if (url.host !== host && !isLoopback(url.hostname)) return false
+    } catch {
+      return false
+    }
+  }
+  return true
+}
+
+function validProfileName(value) {
+  return typeof value === 'string' && value !== '' && value !== '.' && value !== '..'
+    && !value.includes('/') && !value.includes('\\') && !/[\0-\x1f\x7f]/.test(value)
+}
+
+function profileNameFromArgv(argv) {
+  for (let index = 2; index < argv.length; index += 1) {
+    if (argv[index] === '--profile') return argv[index + 1]
+    if (argv[index]?.startsWith('--profile=')) return argv[index].slice('--profile='.length)
+  }
+  return argv[2] === 'web' ? 'web' : undefined
+}
+
+function findDshCliEntry() {
+  const value = process.argv[1]
+  if (value === undefined || value === '') return undefined
+  const entry = value.startsWith('file:') ? fileURLToPath(value) : resolve(process.cwd(), value)
+  if (!existsSync(entry)) return undefined
+  for (let directory = dirname(entry); ; directory = dirname(directory)) {
+    const manifestPath = resolve(directory, 'package.json')
+    if (existsSync(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'))
+        const bin = typeof manifest.bin === 'string'
+          ? manifest.bin
+          : typeof manifest.bin === 'object' && manifest.bin !== null
+            ? manifest.bin.dsh
+            : undefined
+        if (manifest.name === '@deepseek-ai/dsh' && typeof bin === 'string'
+          && !isAbsolute(bin) && resolve(directory, bin) === resolve(entry)) return entry
+      } catch {
+        // Continue searching parent package directories.
+      }
+    }
+    const parent = dirname(directory)
+    if (parent === directory) return undefined
+  }
+}
+
+function getRuntime() {
+  const profileDir = resolve(process.env.DSH_PROFILE_DIR
+    ?? resolve(homedir(), '.dsh', 'profiles', 'web'))
+  const selected = profileNameFromArgv(process.argv)
+  const profileName = validProfileName(selected)
+    ? selected
+    : validProfileName(basename(profileDir)) ? basename(profileDir) : 'web'
+  const cliEntry = findDshCliEntry()
+  return cliEntry === undefined ? { profileName, profileDir } : { profileName, profileDir, cliEntry }
+}
+
+export function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value)
+  if (match === null) return undefined
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4]?.split('.') ?? [],
+  }
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 || right.length === 0) return left.length === right.length ? 0 : left.length === 0 ? 1 : -1
+  const length = Math.max(left.length, right.length)
+  for (let index = 0; index < length; index += 1) {
+    const a = left[index]
+    const b = right[index]
+    if (a === undefined || b === undefined) return a === b ? 0 : a === undefined ? -1 : 1
+    if (a === b) continue
+    const aNumeric = /^\d+$/.test(a)
+    const bNumeric = /^\d+$/.test(b)
+    if (aNumeric && bNumeric) {
+      const aNumber = BigInt(a)
+      const bNumber = BigInt(b)
+      if (aNumber !== bNumber) return aNumber > bNumber ? 1 : -1
+      continue
+    }
+    if (aNumeric !== bNumeric) return aNumeric ? -1 : 1
+    return a > b ? 1 : -1
+  }
+  return 0
+}
+
+export function isNewerVersion(currentValue, candidateValue) {
+  const current = parseSemver(currentValue)
+  const candidate = parseSemver(candidateValue)
+  if (current === undefined || candidate === undefined) return false
+  for (let index = 0; index < 3; index += 1) {
+    if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
+  }
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
+}
+
+export async function fetchLatestVersion(packageName, registry = 'https://registry.npmjs.org') {
+  if (latestCache?.packageName === packageName && latestCache.registry === registry && Date.now() < latestCache.expiresAt) {
+    return latestCache.version
+  }
+  try {
+    const response = await fetch(`${registry.replace(/\/$/, '')}/${encodeURIComponent(packageName)}/latest`, {
+      signal: AbortSignal.timeout(8_000),
+    })
+    if (!response.ok) return undefined
+    const value = await response.json()
+    if (typeof value?.version !== 'string' || value.version === '') return undefined
+    latestCache = { packageName, registry, version: value.version, expiresAt: Date.now() + VERSION_CACHE_MS }
+    return value.version
+  } catch {
+    return undefined
+  }
+}
+
+export async function readCurrentVersion(manifestUrl) {
+  const value = JSON.parse(await readFile(manifestUrl, 'utf8'))
+  if (typeof value?.version !== 'string' || value.version === '') throw new Error('Cannot read current plugin version.')
+  return value.version
+}
+
+export async function getUpdaterStatus(options, target = getRuntime()) {
+  const current = await readCurrentVersion(options.manifestUrl)
+  const latest = await fetchLatestVersion(options.packageName, options.registry ?? 'https://registry.npmjs.org')
+  return {
+    ok: true,
+    packageName: options.packageName,
+    currentVersion: current,
+    ...(latest === undefined ? {} : { latestVersion: latest }),
+    latestCheckFailed: latest === undefined,
+    updateAvailable: latest !== undefined && isNewerVersion(current, latest),
+    profileName: target.profileName,
+    canAutoUpdate: target.cliEntry !== undefined,
+  }
+}
+
+export async function installExactPackage(target, packageSpec, options) {
+  if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.')
+  await new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [
+      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
+      '--config.minimumReleaseAge=0', packageSpec,
+      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+    ], {
+      cwd: target.profileDir,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, NO_COLOR: '1' },
+    })
+    let detail = ''
+    child.stdout?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    child.stderr?.on('data', chunk => { detail = (detail + String(chunk)).slice(-4_000) })
+    const timer = setTimeout(() => {
+      child.kill()
+      reject(new Error('Update timed out; use the normal DSH update flow.'))
+    }, UPDATE_TIMEOUT_MS)
+    child.once('error', error => { clearTimeout(timer); reject(error) })
+    child.once('exit', code => {
+      clearTimeout(timer)
+      if (code === 0) resolvePromise()
+      else reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+    })
+  })
+}
+
+export function registerPluginUpdater(ctx, options) {
+  let installing = false
+  return ctx.webServer.register({
+    kind: 'exact',
+    path: options.endpoint,
+    handler: async (request, response) => {
+      try {
+        const target = getRuntime()
+        if (request.method === 'GET' || request.method === 'HEAD') {
+          const payload = await getUpdaterStatus(options, target)
+          writeJson(response, 200, payload)
+          return
+        }
+        if (request.method !== 'POST') {
+          response.writeHead(405, { allow: 'GET, HEAD, POST' })
+          response.end()
+          return
+        }
+        if (!isTrustedUpdateRequest(request)) {
+          writeJson(response, 403, { ok: false, error: { code: 'forbidden', message: 'Rejected non-local or cross-origin update request.' } })
+          return
+        }
+        if (installing) {
+          writeJson(response, 409, { ok: false, error: { code: 'busy', message: 'This plugin is already updating.' } })
+          return
+        }
+        installing = true
+        try {
+          const before = await getUpdaterStatus(options, target)
+          if (before.latestVersion === undefined) {
+            writeJson(response, 503, { ok: false, error: { code: 'unavailable', message: 'The latest version is temporarily unavailable.' } })
+            return
+          }
+          if (!before.updateAvailable) {
+            writeJson(response, 200, { ok: true, ...before })
+            return
+          }
+          await installExactPackage(target, `${options.packageName}@${before.latestVersion}`, options)
+          writeJson(response, 200, {
+            ok: true,
+            ...before,
+            updatedVersion: before.latestVersion,
+            restartRequired: true,
+          })
+        } finally {
+          installing = false
+        }
+      } catch (error) {
+        ctx.logger?.warn?.(`plugin updater failed: ${String(error)}`)
+        writeJson(response, 503, { ok: false, error: { code: 'update_failed', message: String(error?.message || error) } })
+      }
+    },
+  })
+}

package/lib/usage.js

@@ -52,22 +52,22 @@ export function asUsageSnapshot(percent) {
 // Named limit windows reported by vendors (five_hour, seven_day, primary...).
 // Label map is a data table: extend it when a vendor adds a window name.
 const WINDOW_LABELS = {
-  five_hour: { zh: "5小时", ru: "5ч", en: "5h" },
-  seven_day: { zh: "7天", ru: "7д", en: "7d" },
-  seven_day_oauth_apps: { zh: "7天应用", ru: "7д прил.", en: "7d apps" },
-  weekly_limit_7_days: { zh: "7天", ru: "7д", en: "7d" },
-  primary: { zh: "主配额", ru: "осн.", en: "primary" },
-  secondary: { zh: "次配额", ru: "втор.", en: "secondary" },
+  five_hour: { zh: "5小时", en: "5h" },
+  seven_day: { zh: "7天", en: "7d" },
+  seven_day_oauth_apps: { zh: "7天应用", en: "7d apps" },
+  weekly_limit_7_days: { zh: "7天", en: "7d" },
+  primary: { zh: "主配额", en: "primary" },
+  secondary: { zh: "次配额", en: "secondary" },
   // codex: the vendor API returns primary_window/secondary_window - surfaced as 5h/7d in the UI
-  primary_window: { zh: "5小时", ru: "5ч", en: "5h" },
-  secondary_window: { zh: "7天", ru: "7д", en: "7d" },
-  monthly: { zh: "月度", ru: "месяц", en: "month" },
-  credits: { zh: "点数", ru: "кредиты", en: "credits" },
+  primary_window: { zh: "5小时", en: "5h" },
+  secondary_window: { zh: "7天", en: "7d" },
+  monthly: { zh: "月度", en: "month" },
+  credits: { zh: "点数", en: "credits" },
 }
 
 export function windowLabel(id) {
   const known = WINDOW_LABELS[id]
-  return known || { zh: id, ru: id, en: id }
+  return known || { zh: id, en: id }
 }
 
 // Walk vendor usage JSON; every node carrying a utilization-style number
@@ -83,19 +83,19 @@ export function usageWindows(obj) {
     if (pct != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: pct })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: pct })
     }
     const frac = numberOrNull(value.remainingFraction)
     if (frac != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: (1 - frac) * 100 })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: (1 - frac) * 100 })
     }
     const ufrac = numberOrNull(value.usedFraction)
     if (ufrac != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: ufrac * 100 })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: ufrac * 100 })
     }
     for (const [k, child] of Object.entries(value)) {
       if (child && typeof child === "object") walk(child, k, depth + 1)

package/lib/utils.js

@@ -0,0 +1,25 @@
+/**
+ * Executes a function safely, capturing any error and logging it at debug level
+ * if a logger is provided, then returning the fallback value.
+ *
+ * Used across the plugin to eliminate empty catch blocks per dsh-plugin-preflight.
+ */
+export function bestEffort(label, fn, fallback = undefined, logger = null) {
+  try {
+    const res = fn()
+    if (res && typeof res.then === 'function') {
+      return res.catch((err) => {
+        if (logger && typeof logger.debug === 'function') {
+          logger.debug(`[bestEffort] ${label}: ${err && err.message || err}`)
+        }
+        return fallback
+      })
+    }
+    return res
+  } catch (err) {
+    if (logger && typeof logger.debug === 'function') {
+      logger.debug(`[bestEffort] ${label}: ${err && err.message || err}`)
+    }
+    return fallback
+  }
+}

package/lib/vendor-factory.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 // Vendor factory from a declarative profile.
 //
 // Covers the OpenAI-Responses-compatible subscription family: PKCE auth,
@@ -87,9 +88,9 @@ export function createVendorFromProfile(profile) {
       const catalog = defaultModels(cfg.models || profile.models || [])
       if (!profile.modelsPath) return catalog
       try {
-        const res = await (fetchImpl || fetch)(`${base}${profile.modelsPath}`, {
+        const res = await fetchWithTimeout(fetchImpl || fetch, `${base}${profile.modelsPath}`, {
           headers: identityHeaders(blob, { Accept: "application/json" }),
-        })
+        }, { timeoutMs: 15000 })
         const json = await readJson(res)
         const rows = []
         for (const entry of json.data || json.models || []) {

package/lib/vendors/grok.js

@@ -220,7 +220,7 @@ export async function usage(blob, cfg, fetchImpl) {
           const decoded = decodeGrokCreditsFrame(Buffer.from(buf))
           if (decoded != null) pct = decoded
         }
-      } catch {}
+      } catch (err) { /* ignore grok usage capture error */ }
     }
     const snap = asUsageSnapshot(pct)
     if (snap) snap.windows = usageWindows(json)

package/lib/wire.js

@@ -199,12 +199,14 @@ export async function formTokenRequest(url, params, fetchImpl, headers, { timeou
   return readJson(res)
 }
 
-export async function jsonTokenRequest(url, body, fetchImpl, headers) {
+export async function jsonTokenRequest(url, body, fetchImpl, headers, { timeoutMs = 25000 } = {}) {
   const impl = fetchImpl || fetch
+  const timeoutSignal = AbortSignal.timeout(timeoutMs)
   const res = await impl(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(headers || {}) },
     body: JSON.stringify(body),
+    signal: timeoutSignal,
   })
   return readJson(res)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -34,13 +34,20 @@
   "bugs": {
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
+  "scripts": {
+    "test": "eslint lib/ && node --test test/*.test.mjs",
+    "typecheck": "tsc -p tsconfig.checkjs.json"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ]
     }
   },
   "peerDependencies": {
@@ -62,9 +69,5 @@
     "@deepseek-ai/dsh-llm": "0.1.0-rc.8",
     "@types/node": "^22.20.2",
     "typescript": "^7.0.2"
-  },
-  "scripts": {
-    "test": "eslint lib/ && node --test test/*.test.mjs",
-    "typecheck": "tsc -p tsconfig.checkjs.json"
   }
-}
+}