@goodandready/dsh-subscriptions 0.6.82 → 0.6.84

package/README.md

@@ -309,6 +309,8 @@ dsh-subscriptions:
 
 - `customVendors.authUrl`, `tokenUrl` and `baseUrl` must use `https://`. Plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.1`, `::1`).
 - Grok `baseUrl` overrides must point to `api.x.ai`, `grok.com` / `*.grok.com`, or a loopback host; other hosts are rejected with `GROK_UNTRUSTED_HOST` so bearer tokens never leave trusted xAI infrastructure.
+- Antigravity CLI imports must configure `antigravityClientSecret`; the embedded default was removed.
+- `copilotCliPath` must point to a `copilot`, `github-copilot-cli` or `copilot-cli` binary; rename custom wrappers.
 - The error buffer and diagnostics reports redact bearer tokens, API keys, JWTs and `key=value` credentials before storing or returning them.
 
 

package/README.ru.md

@@ -282,6 +282,8 @@ dsh-subscriptions:
 
 - `customVendors.authUrl`, `tokenUrl` и `baseUrl` обязаны использовать `https://`. Открытый `http://` допускается только для loopback-хостов (`localhost`, `127.0.0.1`, `::1`).
 - Переопределение Grok `baseUrl` должно указывать на `api.x.ai`, `grok.com` / `*.grok.com` или loopback-хост; остальные хосты отклоняются с `GROK_UNTRUSTED_HOST`, чтобы bearer-токен не покидал доверенную инфраструктуру xAI.
+- Импорт Antigravity CLI требует явного `antigravityClientSecret`; встроенный default удалён.
+- `copilotCliPath` должен указывать на бинарь `copilot`, `github-copilot-cli` или `copilot-cli`; кастомные обёртки переименуйте.
 - Error buffer и диагностические отчёты редактируют bearer-токены, API-ключи, JWT и `key=value`-credentials до сохранения и выдачи.
 
 

package/README.zh.md

@@ -188,6 +188,8 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 - `customVendors.authUrl`、`tokenUrl` 和 `baseUrl` 必须使用 `https://`。明文 `http://` 仅允许用于回环主机（`localhost`、`127.0.0.1`、`::1`）。
 - Grok `baseUrl` 覆盖只能指向 `api.x.ai`、`grok.com` / `*.grok.com` 或回环主机；其他主机会以 `GROK_UNTRUSTED_HOST` 拒绝，避免 bearer 令牌离开可信的 xAI 基础设施。
+- Antigravity CLI 导入必须配置 `antigravityClientSecret`；内置默认值已移除。
+- `copilotCliPath` 必须指向 `copilot`、`github-copilot-cli` 或 `copilot-cli` 可执行文件；自定义包装器请重命名。
 - 错误缓冲区和诊断报告会在存储或返回前脱敏 bearer 令牌、API 密钥、JWT 和 `key=value` 凭据。
 
 

package/lib/accounts.js

@@ -379,6 +379,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         label: slot.label || info.label,
         pacePerHour: info.pacePerHour || 0,
         maxConcurrency: slot.maxConcurrency !== undefined ? slot.maxConcurrency : (curConfig.accountMaxConcurrency || 1),
+        maxQueueSize: slot.maxQueueSize > 0 ? Number(slot.maxQueueSize) : (curConfig.maxQueueSize || 20),
       })
     }
     return out

package/lib/blob.js

@@ -90,3 +90,7 @@ export function parseBlob(text) {
     ...(obj.usageAt ? { usageAt: Number(obj.usageAt) } : {}),
   }
 }
+
+export function validateCredentialBlob(blob) {
+  return parseBlob(serializeBlob(blob))
+}

package/lib/client.js

@@ -56,9 +56,19 @@ window.__ModuleLoader__.load({
     const PKG = '@goodandready/dsh-subscriptions'
     const ROW_ID = 'dsh-subscriptions'
     const ROW_CONFIG_KEY = PKG + '#' + ROW_ID
-    
-    let INSTRUCTIONS = {};
 
+    function safeExternalUrl(raw, allowDataImage) {
+      const text = String(raw == null ? '' : raw).trim()
+      if (!text) return ''
+      if (allowDataImage && /^data:image\/(?:png|jpe?g|gif|webp|svg\+xml)[;,]/i.test(text)) return text
+      try {
+        const base = (typeof window !== 'undefined' && window.location && window.location.origin) || 'http://127.0.0.1'
+        const url = new URL(text, base)
+        if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'dsh-app:') return url.href
+      } catch { /* invalid url */ }
+      return ''
+    }
+    
     const en = {
       "syncModels": "Sync Models",
       "syncModelsTitle": "Discover and synchronize available models from vendor API",
@@ -157,6 +167,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "Encrypted at Rest (AES-256-GCM)",
       "atRestEncryptedTitle": "Credentials are protected at rest with master key encryption.",
       "maxConcurrencySlotTitle": "Max parallel streams for this account slot (default: 1)",
+      "monthlyCostSlotTitle": "Monthly subscription cost in USD for this account (default: 20)",
       "concurrencyQueueHint": "Active and queued parallel requests for this account",
       "activeStreams": "active",
       "queuedStreams": "queued",
@@ -489,6 +500,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "静态存储加密 (AES-256-GCM)",
       "atRestEncryptedTitle": "凭据已通过主密钥进行静态 AES-256-GCM 加密保护。",
       "maxConcurrencySlotTitle": "当前账户槽位最大并发请求数（默认：1）",
+      "monthlyCostSlotTitle": "该账户每月订阅费用（美元，默认：20）",
       "concurrencyQueueHint": "当前账户槽位进行中与排队中的并发请求",
       "activeStreams": "活跃",
       "queuedStreams": "排队中",
@@ -1253,10 +1265,10 @@ window.__ModuleLoader__.load({
         const pendingKeys = Object.entries(device).filter(([, d]) => d && d.status === 'pending')
         if (!pendingKeys.length) return
         const timers = pendingKeys.map(([key, d]) => setInterval(() => {
-          devicePollOnce(key.split(':')[0], Number(key.split(':')[1]))
+          devicePollOnce(key.split(':')[0], Number(key.split(':')[1])).catch(() => {})
         }, d.intervalMs || 5000))
         return () => timers.forEach(clearInterval)
-      })
+      }, [device])
 
       // #81: settings snapshot status - never render phantom inputs before the
       // config snapshot arrives, and offer a retry when the store is unavailable.
@@ -1274,7 +1286,13 @@ window.__ModuleLoader__.load({
       }
 
       const slots = Array.isArray(draft.slots) ? draft.slots : []
-      const setSlots = (next) => setDraft((d) => Object.assign({}, d, { slots: next }))
+      const setSlots = (next) => setDraft((d) => {
+        const base = Array.isArray(d && d.slots) ? d.slots : []
+        return Object.assign({}, d, { slots: typeof next === 'function' ? next(base) : next })
+      })
+      const updateSlot = (provider, index, patch) => setSlots((prev) => prev.map((s) => (
+        s && s.provider === provider && Number(s.index) === Number(index) ? Object.assign({}, s, patch) : s
+      )))
       const accountOf = (provider, index) => accounts.find((a) => a.provider === provider && a.index === index) || {}
 
       const save = async () => {
@@ -1311,7 +1329,8 @@ window.__ModuleLoader__.load({
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
         const key = provider + ':' + index
         if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
-        if (data.url) window.open(data.url, '_blank', 'noopener')
+        const authTarget = safeExternalUrl(data.url)
+        if (authTarget) window.open(authTarget, '_blank', 'noopener')
       }
 
       // #90: device-code login (headless). Server mints user_code; we show it,
@@ -1509,7 +1528,7 @@ window.__ModuleLoader__.load({
         const used = slots.filter((s) => s.provider === provider).map((s) => s.index)
         let index = 1
         while (used.indexOf(index) >= 0) index++
-        setSlots(slots.concat([{ provider: provider, index: index, label: '' }]))
+        setSlots((prev) => prev.concat([{ provider: provider, index: index, label: '' }]))
       }
 
       const names = providers.length ? providers : [
@@ -2338,8 +2357,9 @@ window.__ModuleLoader__.load({
               const account = accountOf(row.slot.provider, row.slot.index)
               const key = row.slot.provider + ':' + row.slot.index
               const on = !!account.configured
-              const avatarEl = (account.avatarUrl ? h('img', {
-                src: account.avatarUrl,
+              const avatarSrc = safeExternalUrl(account.avatarUrl, true)
+              const avatarEl = (avatarSrc ? h('img', {
+                src: avatarSrc,
                 alt: account.email || account.label || 'Avatar',
                 className: 'dsub-avatar',
                 onError: (e) => { e.target.style.display = 'none' },
@@ -2355,9 +2375,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.label || '',
                     placeholder: account.email || account.label || (t('accountLabel') + ' ' + row.slot.index),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { label: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { label: e.target.value })
                     },
                   }),
                   h('span', { className: 'dsub-badge' + (account.isRevoked ? ' dsub-badge-bad' : (account.validationUrl ? ' dsub-badge-warn' : (on ? ' dsub-badge-on' : ''))) }, badgeFor(account, t)),
@@ -2431,7 +2449,7 @@ window.__ModuleLoader__.load({
                     onClick: () => {
                       const slot = row.slot
                       Promise.resolve(on ? logout(slot.provider, slot.index) : null)
-                        .then(() => setSlots(slots.filter((_, k) => k !== row.i)))
+                        .then(() => setSlots((prev) => prev.filter((s) => !(s && s.provider === slot.provider && Number(s.index) === Number(slot.index)))))
                         .catch((e) => setErr(cleanErrorMessage(e.message || e)))
                     },
                   }, '\u00d7'),
@@ -2478,10 +2496,10 @@ window.__ModuleLoader__.load({
                   h('div', { style: { fontFamily: 'monospace', fontSize: '11px', margin: '4px 0', wordBreak: 'break-all' } },
                     headlessInfo[key].sshTunnelCommand
                   ),
-                  headlessInfo[key].svgDataUrl ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
+                  safeExternalUrl(headlessInfo[key].svgDataUrl, true) ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
                     h('div', { className: 'dsub-sub', style: { marginBottom: 4 } }, t('headlessScanQr')),
                     h('img', {
-                      src: headlessInfo[key].svgDataUrl,
+                      src: safeExternalUrl(headlessInfo[key].svgDataUrl, true),
                       alt: 'QR Code',
                       style: { width: '130px', height: '130px', borderRadius: '4px', background: '#fff', padding: '4px' }
                     })
@@ -2537,7 +2555,7 @@ window.__ModuleLoader__.load({
                 })() : null),
                 (openHelp[key] ? (function renderInlineHelp(){
                   const prov = row.slot.provider;
-                  const info = (typeof INSTRUCTIONS !== 'undefined' && INSTRUCTIONS[prov]) || {
+                  const info = {
                     title: prov,
                     stepsZh: ['请在上方输入框中粘贴令牌或 API Key 并点击“保存令牌”。'],
                     stepsEn: ['Paste your token or API key into the field above and click "Save token".'],
@@ -2575,9 +2593,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.proxyUrl || '',
                     placeholder: t('proxyPlaceholder'),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { proxyUrl: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { proxyUrl: e.target.value })
                     },
                   }),
                   h('button', {
@@ -2598,10 +2614,26 @@ window.__ModuleLoader__.load({
                       value: row.slot.maxConcurrency !== undefined ? row.slot.maxConcurrency : 1,
                       title: t('maxConcurrencySlotTitle'),
                       onChange: (e) => {
-                        const next = slots.slice()
                         const val = parseInt(e.target.value, 10)
-                        next[row.i] = Object.assign({}, next[row.i], { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
-                        setSlots(next)
+                        updateSlot(row.slot.provider, row.slot.index, { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
+                      },
+                    })
+                  ),
+                  h('span', {
+                    style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'inline-flex', alignItems: 'center', gap: '3px' },
+                    title: t('monthlyCostSlotTitle')
+                  },
+                    '💰',
+                    h('input', {
+                      type: 'number',
+                      min: 0,
+                      step: 0.01,
+                      style: { width: '56px', padding: '1px 4px', fontSize: '11px', textAlign: 'center' },
+                      value: row.slot.monthlyCost !== undefined ? row.slot.monthlyCost : 20,
+                      title: t('monthlyCostSlotTitle'),
+                      onChange: (e) => {
+                        const val = parseFloat(e.target.value)
+                        updateSlot(row.slot.provider, row.slot.index, { monthlyCost: isNaN(val) ? 20 : Math.max(0, val) })
                       },
                     })
                   ),
@@ -2627,7 +2659,7 @@ window.__ModuleLoader__.load({
                           type: 'button', className: 'dsub-mini',
                           onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch { /* clipboard write error */ } },
                         }, t('deviceCopy')),
-                        h('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
+                        h('a', { href: safeExternalUrl(d.authUrl) || undefined, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
                       h('div', { className: 'dsub-sub' }, t('deviceHint')),
                     ) : null,
@@ -2721,9 +2753,9 @@ window.__ModuleLoader__.load({
                   }, '🔄 ' + t('reconnectNow'))
                 ) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return h('div', {className: cls}, txt) })(),
-                account.validationUrl ? h('div', { className: 'dsub-verify' },
+                safeExternalUrl(account.validationUrl) ? h('div', { className: 'dsub-verify' },
                   t('verifyPrefix'),
-                  h('a', { href: account.validationUrl, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
+                  h('a', { href: safeExternalUrl(account.validationUrl) || undefined, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
                   t('verifySuffix'),
                 ) : null,
                 (function usageLimitsBlock(){
@@ -3626,7 +3658,8 @@ window.__ModuleLoader__.load({
           if (!prov || !providerMatch.test(prov)) return
           fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(prov) + '&index=1', { cache: 'no-store' })
             .then((r) => r.json()).then((data) => {
-              if (data && data.url) window.open(data.url, '_blank', 'noopener')
+              const target = data && safeExternalUrl(data.url)
+              if (target) window.open(target, '_blank', 'noopener')
             }).catch(() => {})
         }
         const line = (line) => line.trim()

package/lib/config-schema.js

@@ -22,6 +22,10 @@ export const Slot = z.object({
     .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
   maxConcurrency: z.number().default(1)
     .description('#555 Per-slot max concurrent requests before queuing. Defaults to 1 for subscription safety.'),
+  monthlyCost: z.number().default(20)
+    .description('#590 Optional monthly subscription cost in USD for analytics. Defaults to 20.'),
+  maxQueueSize: z.number().default(0)
+    .description('#592 Per-account queue depth before overflow. 0 = use the global maxQueueSize.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))
@@ -285,3 +289,7 @@ export function restoreMaskedSecrets(incoming, existing) {
 
   return out
 }
+
+export function revisionOf(settingsApi) {
+  return settingsApi && typeof settingsApi.revision === 'function' ? settingsApi.revision() : undefined
+}

package/lib/diagnostic-wizard.js

@@ -3,6 +3,8 @@
 
 import { maskEmail, maskSecrets, cleanErrorMessage } from './mask.js'
 import { getVendor } from './vendors/index.js'
+import { vendorFetch } from './http.js'
+import { proxyFetch } from './proxy.js'
 
 /**
  * Mask sensitive credentials inside diagnostic reports.
@@ -50,6 +52,8 @@ export async function runDiagnosticWizard(options = {}) {
   const includeNetwork = Boolean(options.includeNetwork)
   const fetchImpl = options.fetchImpl || globalThis.fetch || fetch
   const timeoutMs = options.timeoutMs || 8000
+  const vendorCallFetch = vendorFetch(fetchImpl, timeoutMs)
+  const proxyImplFactory = typeof options.proxyFetchImpl === 'function' ? options.proxyFetchImpl : proxyFetch
   const now = Date.now()
 
   let raw = options.rawBlob || null
@@ -140,7 +144,7 @@ export async function runDiagnosticWizard(options = {}) {
   // -------------------------------------------------------------
   // STEP 2: Network & Proxy Verification
   // -------------------------------------------------------------
-  const proxyUrl = account.proxyUrl || (options.live && options.live() && options.live().proxyUrl) || null
+  const proxyUrl = account.proxyUrl || null
   let proxyStatus = 'pass'
   let proxyCode = 'DIRECT_CONNECTION'
   let proxyMsg = 'Direct network connection configured'
@@ -171,16 +175,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        // Light probe: connect to target or HEAD request
-        await fetchImpl(proxyUrl, {
+        const impl = proxyImplFactory(proxyUrl)
+        if (!impl) throw new Error('invalid proxy URL')
+        await impl('https://api.openai.com/v1/models', {
           method: 'HEAD',
           signal: controller.signal,
-        }).catch((e) => {
-          // If proxy accepts HTTP or rejects HEAD with 405/404, TCP connection succeeded
-          if (e && e.name !== 'AbortError' && e.code !== 'ECONNREFUSED' && e.code !== 'ENOTFOUND') {
-            return { ok: true }
-          }
-          throw e
         })
         clearTimeout(timer)
         proxyLatencyMs = Date.now() - t0
@@ -238,18 +237,18 @@ export async function runDiagnosticWizard(options = {}) {
       // Attempt safe singleflight token refresh if vendor supports it
       let vendor = null
       try { vendor = getVendor(provider) } catch { /* unknown provider */ }
-      if (vendor && typeof vendor.refresh === 'function' && blob.refresh_token) {
+      if (vendor && typeof vendor.refresh === 'function' && (blob.refreshToken || blob.refresh_token)) {
         try {
           const controller = new AbortController()
           const timer = setTimeout(() => controller.abort(), timeoutMs)
-          const refreshed = await vendor.refresh(blob, {
-            fetchImpl,
-            signal: controller.signal,
-            config: options.live ? options.live() : {},
-          })
+          const refreshed = await vendor.refresh(
+            options.live ? options.live() : {},
+            blob,
+            (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+          )
           clearTimeout(timer)
           tokenLatencyMs = Date.now() - t0
-          if (refreshed && (refreshed.access_token || refreshed.token)) {
+          if (refreshed && (refreshed.accessToken || refreshed.access_token || refreshed.token)) {
             tokenStatus = 'pass'
             tokenCode = 'TOKEN_REFRESH_OK'
             tokenMsg = `Token refreshed successfully (${tokenLatencyMs}ms)`
@@ -313,11 +312,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        const models = await vendor.listModels(account, {
-          fetchImpl,
-          signal: controller.signal,
-          config: options.live ? options.live() : {},
-        })
+        const models = await vendor.listModels(
+          blob,
+          options.live ? options.live() : {},
+          (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+        )
         clearTimeout(timer)
         catalogLatencyMs = Date.now() - t0
         modelCount = Array.isArray(models) ? models.length : 0

package/lib/headless-auth.js

@@ -326,6 +326,15 @@ export function getHeadlessAuthInfo({ provider = '', redirectUri = '', authUrl =
   }
 }
 
+export function safePostMessageOrigin(originHeader) {
+  try {
+    const u = new URL(String(originHeader || ''))
+    if (u.protocol === 'http:' || u.protocol === 'https:') return u.origin
+    if (u.protocol === 'dsh-app:') return 'dsh-app://' + u.host
+  } catch { /* invalid origin */ }
+  return ''
+}
+
 export async function handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }) {
   const rawUrl = new URL(req.url || '/', 'http://127.0.0.1')
   const code = rawUrl.searchParams.get('code') || ''
@@ -353,11 +362,15 @@ export async function handleHeadlessRedirect(req, res, { pending, completeOAuth,
     try {
       await completeOAuth({ provider: row.provider, index: row.index, code, state })
       if (typeof accountsView === 'function') await accountsView()
+      const targetOrigin = safePostMessageOrigin(req && req.headers && req.headers.origin)
+      const relay = targetOrigin
+        ? `<script>if (window.opener) { window.opener.postMessage({ type: 'dsh-oauth-success', state: ${JSON.stringify(String(state))} }, ${JSON.stringify(targetOrigin)}); }</script>`
+        : ''
       res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
       res.end(`<!doctype html><meta charset="utf-8"><title>Subscriptions</title><body style="font-family:sans-serif;padding:2rem;">` +
         `<h2 style="color:#2e7d32;">Signed In Successfully</h2>` +
         `<p>Your account has been authorized. You can close this window and return to Settings.</p>` +
-        `<script>if (window.opener) { window.opener.postMessage({ type: 'dsh-oauth-success', state: '${escapeHtml(state)}' }, '*'); }</script>` +
+        relay +
         `</body>`)
       return
     } catch (e) {

package/lib/http.js

@@ -79,7 +79,34 @@ export function isLoopback(value) {
 
 
 
+function hostNameOf(hostHeader) {
+  const raw = String(Array.isArray(hostHeader) ? (hostHeader[0] || '') : (hostHeader || '')).trim().toLowerCase()
+  if (!raw) return ''
+  if (raw === '::1') return '::1'
+  if (raw.startsWith('[')) {
+    const end = raw.indexOf(']')
+    return end > 0 ? raw.slice(0, end + 1) : raw
+  }
+  return raw.split(':')[0]
+}
+
+function configuredTrustedHosts(targetCtx) {
+  const out = new Set()
+  for (const part of String(process.env.DSH_TRUSTED_HOSTS || '').split(',')) {
+    const host = hostNameOf(part)
+    if (host) out.add(host)
+  }
+  try {
+    const url = targetCtx && targetCtx.webServer && targetCtx.webServer.url
+    if (url) out.add(hostNameOf(new URL(url).host))
+  } catch { /* ignore malformed web server url */ }
+  return out
+}
+
 /**
+ * @param {import('node:http').IncomingMessage} request
+ * @param {any} [targetCtx]
+ * @returns {boolean}/**
  * @param {import('node:http').IncomingMessage} request
  * @param {any} [targetCtx]
  * @returns {boolean}
@@ -148,6 +175,20 @@ export function isTrustedSettingsRequest(request, targetCtx) {
     }
   }
 
+  // 4a. Loopback peers must present a loopback or configured Host.
+  // A loopback socket with a foreign Host is a DNS-rebinding attempt.
+  const peerAddress = request?.socket?.remoteAddress || request?.connection?.remoteAddress
+  if (peerAddress && isLoopback(peerAddress)) {
+    const host = hostNameOf(headers.host)
+    const loopbackHost = host === ''
+      || host === 'localhost'
+      || host === 'localhost.'
+      || host === '127.0.0.1'
+      || host === '::1'
+      || host === '[::1]'
+    if (!loopbackHost && !configuredTrustedHosts(targetCtx).has(host)) return false
+  }
+
   // 4. Delegate to DSH connection service if available (#374)
   let conn = null
   try {
@@ -400,3 +441,7 @@ export function escapeHtml(text) {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')
 }
+
+export function vendorFetch(fetchImpl, timeoutMs = 15000) {
+  return (url, init, options) => fetchWithTimeout(fetchImpl || fetch, url, init, { timeoutMs, ...(options || {}) })
+}

package/lib/import-auth.js

@@ -6,7 +6,7 @@ import { readClaudeCredentials } from './vendors/claude-cli.js'
 import { readCopilotCredentials } from './vendors/copilot-cli.js'
 import { normalizeExpiresAt } from './blob.js'
 import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from './jwt.js'
-import { DEFAULT_CLI_CLIENT_ID, DEFAULT_CLI_CLIENT_SECRET } from './vendors/antigravity.js'
+
 
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
@@ -146,7 +146,8 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  if (!detected.antigravity && (process.platform === 'win32' || activeWindowsCredentialReader)) {
+  const canReadWindowsCredentialManager = Boolean(activeWindowsCredentialReader) || (!activeHome && process.platform === 'win32')
+  if (!detected.antigravity && canReadWindowsCredentialManager) {
     const winCred = readWindowsAntigravityCredential()
     const tok = winCred && winCred.token ? winCred.token : winCred
     if (tok && (tok.access_token || tok.accessToken)) {
@@ -453,10 +454,6 @@ export async function loadLocalCliBlob(provider, options = {}) {
       raw.installed?.client_secret || raw.web?.client_secret || ''
     let clientSecret = typeof directSecret === 'string' ? directSecret.trim() : ''
 
-    if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-      clientSecret = DEFAULT_CLI_CLIENT_SECRET
-    }
-
     const rawExpiry = tok.expiry ?? tok.expires_at ?? tok.expiresAt ?? tok.expiry_date ?? raw.expiry_date ?? raw.expiry ?? (tok.expires_in ? Date.now() + Number(tok.expires_in) * 1000 : 0)
     const expiresAt = normalizeExpiresAt(rawExpiry)
 

package/lib/index.js

@@ -135,6 +135,7 @@ export function apply(ctx, rawConfig) {
 
   const settingsApi = {
     get: () => live(),
+    revision: () => describeRow()?.revision,
     replace: async (next, expectedRevision) => {
       const parsed = plainConfig(next)
       const prevConfig = cachedConfig

package/lib/routes/accounts.js

@@ -4,10 +4,11 @@ import { syncVaultPush, syncVaultPull, getVaultSyncStatus } from '../vault-sync.
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { getVendor } from '../vendors/index.js'
 import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
-import { Config, plainConfig, publicConfig } from '../config-schema.js'
+import { Config, plainConfig, publicConfig, revisionOf } from '../config-schema.js'
 import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
+import { validateCredentialBlob } from '../blob.js'
 import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
@@ -276,18 +277,20 @@ export function registerAccountsRoutes(ctx, state) {
         const curSlots = Array.isArray(live().slots) ? live().slots.slice() : []
         const exists = curSlots.some((s) => s && s.provider === prov && Number(s.index) === idx)
         if (!exists && getSettingsApi()) {
+          const settings = getSettingsApi()
+          const revision = revisionOf(settings)
           const nextSlots = curSlots.concat([{
             provider: prov,
             index: idx,
             label: blob.email || '',
           }])
           const parsed = plainConfig(Config({ ...live(), slots: stripLegacySlots(nextSlots) }))
-          await getSettingsApi().replace(parsed)
+          await settings.replace(parsed, revision)
           syncCustomVendors()
         }
         const slot = normalizeSlots(live().slots).find((s) => s.provider === prov && s.index === idx)
         const ref = slot ? slot.ref : oauthRef(prov, idx)
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, {
@@ -389,7 +392,7 @@ export function registerAccountsRoutes(ctx, state) {
       for (const row of bundle.accounts) {
         try {
           if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
-          await store.saveBlob(row.ref, row.blob)
+          await store.saveBlob(row.ref, validateCredentialBlob(row.blob))
           imported++
         } catch { /* skip broken */ }
       }
@@ -437,7 +440,7 @@ export function registerAccountsRoutes(ctx, state) {
         const ref = oauthRef(provider, index)
         const blob = { accessToken: apiKey || refreshToken, refreshToken: refreshToken || apiKey }
         if (apiKey) { blob.apiKey = apiKey; blob.apiKeyOnly = true }
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         await syncAdapter()
         refreshModels().catch(() => {})
         writeJson(res, 200, { ok: true, ref, accounts: await accountsView() })
@@ -674,6 +677,7 @@ export function registerAccountsRoutes(ctx, state) {
     try {
       const result = importVault(vault, passphrase)
       const settings = getSettingsApi()
+      const revision = revisionOf(settings)
       let parsed
       if (result.slots.length) {
         if (!settings) throw new Error('settings are unavailable for vault import')
@@ -690,11 +694,11 @@ export function registerAccountsRoutes(ctx, state) {
       }
       let blobCount = 0
       for (const [ref, blob] of Object.entries(result.blobs)) {
-        await store.saveBlob(ref, blob)
+        await store.saveBlob(ref, validateCredentialBlob(blob))
         blobCount++
       }
       if (parsed) {
-        await settings.replace(parsed)
+        await settings.replace(parsed, revision)
         syncCustomVendors()
       }
       await syncAdapter()

package/lib/routes/oauth.js

@@ -301,6 +301,13 @@ export function registerOauthRoutes(ctx, state) {
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-subscriptions/oauth/headless-redirect',
-    handler: (req, res) => handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView }),
+    handler: (req, res) => {
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        res.writeHead(403, { 'Content-Type': 'text/html; charset=utf-8' })
+        res.end('<!doctype html><meta charset="utf-8"><p>Forbidden: same-origin or loopback requests only.</p>')
+        return
+      }
+      return handleHeadlessRedirect(req, res, { pending, completeOAuth, accountsView })
+    },
   }), 'dsh-subscriptions: /oauth/headless-redirect')
 }

package/lib/routes/status.js

@@ -17,7 +17,7 @@ import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, isTimeoutError, vendorFetch } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -384,8 +384,8 @@ export function registerStatusRoutes(ctx, state) {
       const vendor = getVendor(provider)
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+        const doFetch = vendorFetch((typeof fetchForRef === "function" && fetchForRef(ref)) || fetch, 15_000)
+        const res2 = await vendorFetch(doFetch, 15_000)(url, init)
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -522,7 +522,7 @@ export function registerStatusRoutes(ctx, state) {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+          const res2 = await vendorFetch(doFetch, 15_000)(url, init)
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/subscriptions.js

@@ -5,16 +5,39 @@ import { pickFetch } from "./proxy.js"
 import { fetchWithTimeout } from "./http.js"
 
 // ponytail: allowlist per provider — add path to extend without touching request logic
+const OPENAI_COMPAT = [
+  "/models",
+  "/v1/models",
+  "/chat/completions",
+  "/v1/chat/completions",
+  "/responses",
+  "/v1/responses",
+  "/images/generations",
+  "/v1/images/generations",
+]
+
 export const ALLOWLIST = {
   codex: ["/responses", "/models", "/images/generations", "/backend-api/codex/responses", "/backend-api/codex/models", "/backend-api/codex/images/generations"],
   claude: ["/v1/messages", "/api/oauth/profile", "/api/oauth/usage", "/v1/models"],
   grok: ["/v1/models", "/responses", "/v1/responses", "/v1/billing", "/v1/chat/completions", "/images/generations", "/v1/images/generations"],
   antigravity: ["/v1/models", "/v1/generateContent", "/v1/streamGenerateContent", "/v1/loadCodeAssist", "/v1/fetchAvailableModels", "/v1/countTokens", "/v1/internal:loadCodeAssist"],
+  kimi: OPENAI_COMPAT,
+  glm: [...OPENAI_COMPAT, "/api/paas/v4/chat/completions", "/api/paas/v4/models"],
+  cursor: OPENAI_COMPAT,
+  kiro: OPENAI_COMPAT,
+  copilot: OPENAI_COMPAT,
+  qwen: [...OPENAI_COMPAT, "/compatible-mode/v1/chat/completions", "/compatible-mode/v1/models"],
+  ernie: [...OPENAI_COMPAT, "/rpc/2.0/ai_custom/v1/wenxinworkshop/chat", "/oauth/2.0/token"],
+  spark: OPENAI_COMPAT,
+  jetbrains: OPENAI_COMPAT,
+  perplexity: [...OPENAI_COMPAT, "/api/v1/user/profile", "/api/v1/user/usage"],
+  replit: [...OPENAI_COMPAT, "/api/v1/ai"],
+  cody: OPENAI_COMPAT,
 }
 
 export function isAllowed(provider, path) {
   if (!isProvider(provider)) return false
-  const list = ALLOWLIST[provider] || []
+  const list = ALLOWLIST[provider] || OPENAI_COMPAT
   let p = String(path || "")
   // strip query and hash
   p = p.split("?")[0].split("#")[0]

package/lib/vault-sync.js

@@ -4,7 +4,8 @@
 import { createHmac, createHash } from 'node:crypto'
 import { exportVault, importVault } from './vault.js'
 import { normalizeSlots } from './accounts.js'
-import { Config, plainConfig } from './config-schema.js'
+import { Config, plainConfig, revisionOf } from './config-schema.js'
+import { validateCredentialBlob } from './blob.js'
 
 let syncStatus = {
   enabled: false,
@@ -368,6 +369,7 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
 
     // Merge slots into live configuration
     if (result.slots.length && settingsApi) {
+      const revision = revisionOf(settingsApi)
       const curSlots = Array.isArray(cfg.slots) ? cfg.slots.slice() : []
       for (const s of result.slots) {
         const idx = curSlots.findIndex((c) => c.provider === s.provider && Number(c.index) === Number(s.index))
@@ -378,13 +380,13 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
         }
       }
       const parsed = plainConfig(Config({ ...cfg, slots: curSlots }))
-      await settingsApi.replace(parsed)
+      await settingsApi.replace(parsed, revision)
     }
 
     // Save blobs into store
     let blobCount = 0
     for (const [ref, blob] of Object.entries(result.blobs)) {
-      await store.saveBlob(ref, blob)
+      await store.saveBlob(ref, validateCredentialBlob(blob))
       blobCount++
     }
 

package/lib/vault.js

@@ -1,11 +1,32 @@
 // #353 & #360: Encrypted Vault Export/Import for Subscriptions
 // Secure migration and backup of slots and credentials using AES-256-GCM.
 
+import { readFileSync } from 'node:fs'
 import { encryptWithPassphrase, decryptWithPassphrase } from './crypto.js'
 import { isProvider, oauthRef } from './refs.js'
 
 export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 
+let cachedVersion = ''
+function pluginVersion() {
+  if (!cachedVersion) {
+    try {
+      cachedVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '0.0.0'
+    } catch {
+      cachedVersion = '0.0.0'
+    }
+  }
+  return cachedVersion
+}
+
+export function assertSupportedVaultVersion(version) {
+  const text = String(version == null ? '' : version).trim()
+  if (!text) return
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(text)
+  if (!match) throw new Error('invalid vault version')
+  if (Number(match[1]) > 0) throw new Error('vault version ' + text + ' is newer than this plugin supports')
+}
+
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
@@ -17,7 +38,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
 
   const payload = {
     format: VAULT_FORMAT,
-    version: '0.6.77',
+    version: pluginVersion(),
     exportedAt: new Date().toISOString(),
     exportedBy,
     slots: Array.isArray(slots) ? slots : [],
@@ -66,6 +87,8 @@ export function importVault(encryptedPayload, passphrase) {
     throw new Error('invalid vault schema: unsupported structure')
   }
 
+  assertSupportedVaultVersion(data.version)
+
   const refs = new Set()
   for (const slot of data.slots) {
     if (!slot || !isProvider(slot.provider) || !Number.isSafeInteger(slot.index) || slot.index < 1) {

package/lib/vendors/antigravity.js

@@ -18,7 +18,7 @@ import {
 
 export const id = 'antigravity'
 export const DEFAULT_CLI_CLIENT_ID = ['681255809395', 'oo8ft2oprdrnp9e3aqf6av3hmdib135j'].join('-') + '.' + 'apps.googleusercontent.com'
-export const DEFAULT_CLI_CLIENT_SECRET = ['GOCSPX', '4uHgMPm', '1o7Sk', 'geV6Cu5clXFsxl'].join('-')
+
 
 const AUTH = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN = 'https://oauth2.googleapis.com/token'
@@ -143,7 +143,7 @@ export async function refresh(cfg, blob, fetchImpl) {
   let clientSecret = (cfg?.clientSecret && String(cfg.clientSecret).trim()) || (blob?.clientSecret && String(blob.clientSecret).trim()) || ''
 
   if (!clientSecret && clientId === DEFAULT_CLI_CLIENT_ID) {
-    clientSecret = DEFAULT_CLI_CLIENT_SECRET
+    throw new Error('Google OAuth refresh requires a client secret for the default Gemini CLI client. Configure antigravityClientSecret in plugin settings.')
   }
 
   if (!clientId) {

package/lib/vendors/copilot-cli.js

@@ -8,6 +8,19 @@ import { join, delimiter } from 'node:path'
 import { spawn } from 'node:child_process'
 import { LlmError } from '@deepseek-ai/dsh-llm'
 
+const MAX_STDERR_CHARS = 2048
+const GITHUB_TOKEN_PATTERN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g
+
+const COPILOT_CLI_BASENAME = /^(?:copilot|github-copilot-cli|copilot-cli)(?:\.(?:cmd|bat|exe))?$/i
+
+export function isAllowedCopilotBinary(binaryPath) {
+  return COPILOT_CLI_BASENAME.test(String(binaryPath || '').split(/[\\/]/).pop())
+}
+
+export function redactCopilotStderr(text) {
+  return String(text || '').replace(GITHUB_TOKEN_PATTERN, '[REDACTED]')
+}
+
 /**
  * Standard candidate binary names for GitHub Copilot CLI.
  */
@@ -127,9 +140,14 @@ export async function readCopilotCredentials(home, env = process.env) {
 export function findCopilotCli(customPath, env = process.env, platform = process.platform) {
   if (customPath && typeof customPath === 'string' && customPath.trim()) {
     const p = customPath.trim()
-    try {
-      if (existsSync(p)) return p
-    } catch { /* best-effort */ }
+    let exists = false
+    try { exists = existsSync(p) } catch { /* best-effort */ }
+    if (exists) {
+      if (!isAllowedCopilotBinary(p)) {
+        throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+      }
+      return p
+    }
   }
 
   const pathVar = env.PATH || ''
@@ -144,8 +162,11 @@ export function findCopilotCli(customPath, env = process.env, platform = process
     )
   }
 
+  const candidates = platform === 'win32'
+    ? COPILOT_CLI_BINARIES.filter((bin) => /\.(cmd|exe|bat)$/i.test(bin))
+    : COPILOT_CLI_BINARIES.filter((bin) => !/\.(cmd|exe|bat)$/i.test(bin))
   for (const dir of pathDirs) {
-    for (const bin of COPILOT_CLI_BINARIES) {
+    for (const bin of candidates) {
       const fullPath = join(dir, bin)
       try {
         if (existsSync(fullPath)) {
@@ -232,6 +253,16 @@ export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'c
   return { args, env, inputPayload }
 }
 
+export function resolveSpawnCommand(binaryPath, args, platform = process.platform) {
+  if (platform === 'win32' && /\.(cmd|bat)$/i.test(String(binaryPath))) {
+    return {
+      command: process.env.ComSpec || 'cmd.exe',
+      args: ['/d', '/s', '/c', binaryPath, ...args],
+    }
+  }
+  return { command: binaryPath, args }
+}
+
 /**
  * Stream execution from local Copilot CLI process.
  * Yields canonical DSH events: block-start, text-delta, tool-call-delta, finish, usage.
@@ -245,16 +276,20 @@ export function prepareCopilotCliInvocation(options, blob = {}, _binaryPath = 'c
  * @returns {AsyncGenerator<any, void, unknown>}
  */
 export async function* streamCopilotCli({ binaryPath, options, blob, config: _config, signal, spawnImpl }) {
+  if (!isAllowedCopilotBinary(binaryPath)) {
+    throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+  }
   if (signal && signal.aborted) {
     throw new LlmError('Request aborted by client', 'ABORTED')
   }
 
   const { args, env, inputPayload } = prepareCopilotCliInvocation(options, blob, binaryPath)
   const spawner = spawnImpl || spawn
+  const invocation = resolveSpawnCommand(binaryPath, args)
 
   let child
   try {
-    child = spawner(binaryPath, args, {
+    child = spawner(invocation.command, invocation.args, {
       env,
       stdio: ['pipe', 'pipe', 'pipe'],
     })
@@ -285,7 +320,10 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
   let stderrBuffer = ''
 
   if (child.stderr) {
-    child.stderr.on('data', (d) => { stderrBuffer += d.toString() })
+    child.stderr.on('data', (d) => {
+      if (stderrBuffer.length >= MAX_STDERR_CHARS) return
+      stderrBuffer += String(d).slice(0, MAX_STDERR_CHARS - stderrBuffer.length)
+    })
   }
 
   const chunkQueue = []
@@ -326,7 +364,7 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
       stdoutBuffer = ''
     }
     if (code !== 0 && !chunkQueue.length) {
-      processError = new LlmError(`Copilot CLI exited with code ${code}: ${stderrBuffer.trim() || 'unknown error'}`, 'VENDOR')
+      processError = new LlmError(`Copilot CLI exited with code ${code}: ${redactCopilotStderr(stderrBuffer.trim()) || 'unknown error'}`, 'VENDOR')
     }
     if (resolveNext) {
       const r = resolveNext

package/lib/vendors/jetbrains.js

@@ -83,12 +83,15 @@ export function defaults() {
 export function authorizeUrl(cfg = {}, pkce = {}) {
   const c = cfg || {}
   const p = pkce || {}
+  if (!p.challenge || !p.state) {
+    throw new Error('JetBrains OAuth requires PKCE challenge and state')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: c.clientId || defaults().clientId,
     redirectUri: c.redirectUri || defaults().redirectUri,
-    challenge: p.challenge || 'challenge',
-    state: p.state || 'state',
+    challenge: p.challenge,
+    state: p.state,
     scope: SCOPE,
   })
 }

package/lib/vendors/perplexity.js

@@ -77,12 +77,15 @@ export function defaults() {
 export function authorizeUrl(cfg = {}, pkce = {}) {
   const c = cfg || {}
   const p = pkce || {}
+  if (!p.challenge || !p.state) {
+    throw new Error('Perplexity OAuth requires PKCE challenge and state')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: c.clientId || defaults().clientId,
     redirectUri: c.redirectUri || defaults().redirectUri,
-    challenge: p.challenge || 'challenge',
-    state: p.state || 'state',
+    challenge: p.challenge,
+    state: p.state,
     scope: SCOPE,
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.82",
+  "version": "0.6.84",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",