@goodandready/dsh-subscriptions 0.6.83 → 0.6.84

package/README.md

@@ -310,6 +310,7 @@ dsh-subscriptions:
 - `customVendors.authUrl`, `tokenUrl` and `baseUrl` must use `https://`. Plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.1`, `::1`).
 - Grok `baseUrl` overrides must point to `api.x.ai`, `grok.com` / `*.grok.com`, or a loopback host; other hosts are rejected with `GROK_UNTRUSTED_HOST` so bearer tokens never leave trusted xAI infrastructure.
 - Antigravity CLI imports must configure `antigravityClientSecret`; the embedded default was removed.
+- `copilotCliPath` must point to a `copilot`, `github-copilot-cli` or `copilot-cli` binary; rename custom wrappers.
 - The error buffer and diagnostics reports redact bearer tokens, API keys, JWTs and `key=value` credentials before storing or returning them.
 
 

package/README.ru.md

@@ -283,6 +283,7 @@ dsh-subscriptions:
 - `customVendors.authUrl`, `tokenUrl` и `baseUrl` обязаны использовать `https://`. Открытый `http://` допускается только для loopback-хостов (`localhost`, `127.0.0.1`, `::1`).
 - Переопределение Grok `baseUrl` должно указывать на `api.x.ai`, `grok.com` / `*.grok.com` или loopback-хост; остальные хосты отклоняются с `GROK_UNTRUSTED_HOST`, чтобы bearer-токен не покидал доверенную инфраструктуру xAI.
 - Импорт Antigravity CLI требует явного `antigravityClientSecret`; встроенный default удалён.
+- `copilotCliPath` должен указывать на бинарь `copilot`, `github-copilot-cli` или `copilot-cli`; кастомные обёртки переименуйте.
 - Error buffer и диагностические отчёты редактируют bearer-токены, API-ключи, JWT и `key=value`-credentials до сохранения и выдачи.
 
 

package/README.zh.md

@@ -189,6 +189,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 - `customVendors.authUrl`、`tokenUrl` 和 `baseUrl` 必须使用 `https://`。明文 `http://` 仅允许用于回环主机（`localhost`、`127.0.0.1`、`::1`）。
 - Grok `baseUrl` 覆盖只能指向 `api.x.ai`、`grok.com` / `*.grok.com` 或回环主机；其他主机会以 `GROK_UNTRUSTED_HOST` 拒绝，避免 bearer 令牌离开可信的 xAI 基础设施。
 - Antigravity CLI 导入必须配置 `antigravityClientSecret`；内置默认值已移除。
+- `copilotCliPath` 必须指向 `copilot`、`github-copilot-cli` 或 `copilot-cli` 可执行文件；自定义包装器请重命名。
 - 错误缓冲区和诊断报告会在存储或返回前脱敏 bearer 令牌、API 密钥、JWT 和 `key=value` 凭据。
 
 

package/lib/accounts.js

@@ -379,6 +379,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         label: slot.label || info.label,
         pacePerHour: info.pacePerHour || 0,
         maxConcurrency: slot.maxConcurrency !== undefined ? slot.maxConcurrency : (curConfig.accountMaxConcurrency || 1),
+        maxQueueSize: slot.maxQueueSize > 0 ? Number(slot.maxQueueSize) : (curConfig.maxQueueSize || 20),
       })
     }
     return out

package/lib/client.js

@@ -56,9 +56,19 @@ window.__ModuleLoader__.load({
     const PKG = '@goodandready/dsh-subscriptions'
     const ROW_ID = 'dsh-subscriptions'
     const ROW_CONFIG_KEY = PKG + '#' + ROW_ID
-    
-    let INSTRUCTIONS = {};
 
+    function safeExternalUrl(raw, allowDataImage) {
+      const text = String(raw == null ? '' : raw).trim()
+      if (!text) return ''
+      if (allowDataImage && /^data:image\/(?:png|jpe?g|gif|webp|svg\+xml)[;,]/i.test(text)) return text
+      try {
+        const base = (typeof window !== 'undefined' && window.location && window.location.origin) || 'http://127.0.0.1'
+        const url = new URL(text, base)
+        if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'dsh-app:') return url.href
+      } catch { /* invalid url */ }
+      return ''
+    }
+    
     const en = {
       "syncModels": "Sync Models",
       "syncModelsTitle": "Discover and synchronize available models from vendor API",
@@ -157,6 +167,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "Encrypted at Rest (AES-256-GCM)",
       "atRestEncryptedTitle": "Credentials are protected at rest with master key encryption.",
       "maxConcurrencySlotTitle": "Max parallel streams for this account slot (default: 1)",
+      "monthlyCostSlotTitle": "Monthly subscription cost in USD for this account (default: 20)",
       "concurrencyQueueHint": "Active and queued parallel requests for this account",
       "activeStreams": "active",
       "queuedStreams": "queued",
@@ -489,6 +500,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "静态存储加密 (AES-256-GCM)",
       "atRestEncryptedTitle": "凭据已通过主密钥进行静态 AES-256-GCM 加密保护。",
       "maxConcurrencySlotTitle": "当前账户槽位最大并发请求数（默认：1）",
+      "monthlyCostSlotTitle": "该账户每月订阅费用（美元，默认：20）",
       "concurrencyQueueHint": "当前账户槽位进行中与排队中的并发请求",
       "activeStreams": "活跃",
       "queuedStreams": "排队中",
@@ -1253,10 +1265,10 @@ window.__ModuleLoader__.load({
         const pendingKeys = Object.entries(device).filter(([, d]) => d && d.status === 'pending')
         if (!pendingKeys.length) return
         const timers = pendingKeys.map(([key, d]) => setInterval(() => {
-          devicePollOnce(key.split(':')[0], Number(key.split(':')[1]))
+          devicePollOnce(key.split(':')[0], Number(key.split(':')[1])).catch(() => {})
         }, d.intervalMs || 5000))
         return () => timers.forEach(clearInterval)
-      })
+      }, [device])
 
       // #81: settings snapshot status - never render phantom inputs before the
       // config snapshot arrives, and offer a retry when the store is unavailable.
@@ -1274,7 +1286,13 @@ window.__ModuleLoader__.load({
       }
 
       const slots = Array.isArray(draft.slots) ? draft.slots : []
-      const setSlots = (next) => setDraft((d) => Object.assign({}, d, { slots: next }))
+      const setSlots = (next) => setDraft((d) => {
+        const base = Array.isArray(d && d.slots) ? d.slots : []
+        return Object.assign({}, d, { slots: typeof next === 'function' ? next(base) : next })
+      })
+      const updateSlot = (provider, index, patch) => setSlots((prev) => prev.map((s) => (
+        s && s.provider === provider && Number(s.index) === Number(index) ? Object.assign({}, s, patch) : s
+      )))
       const accountOf = (provider, index) => accounts.find((a) => a.provider === provider && a.index === index) || {}
 
       const save = async () => {
@@ -1311,7 +1329,8 @@ window.__ModuleLoader__.load({
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
         const key = provider + ':' + index
         if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
-        if (data.url) window.open(data.url, '_blank', 'noopener')
+        const authTarget = safeExternalUrl(data.url)
+        if (authTarget) window.open(authTarget, '_blank', 'noopener')
       }
 
       // #90: device-code login (headless). Server mints user_code; we show it,
@@ -1509,7 +1528,7 @@ window.__ModuleLoader__.load({
         const used = slots.filter((s) => s.provider === provider).map((s) => s.index)
         let index = 1
         while (used.indexOf(index) >= 0) index++
-        setSlots(slots.concat([{ provider: provider, index: index, label: '' }]))
+        setSlots((prev) => prev.concat([{ provider: provider, index: index, label: '' }]))
       }
 
       const names = providers.length ? providers : [
@@ -2338,8 +2357,9 @@ window.__ModuleLoader__.load({
               const account = accountOf(row.slot.provider, row.slot.index)
               const key = row.slot.provider + ':' + row.slot.index
               const on = !!account.configured
-              const avatarEl = (account.avatarUrl ? h('img', {
-                src: account.avatarUrl,
+              const avatarSrc = safeExternalUrl(account.avatarUrl, true)
+              const avatarEl = (avatarSrc ? h('img', {
+                src: avatarSrc,
                 alt: account.email || account.label || 'Avatar',
                 className: 'dsub-avatar',
                 onError: (e) => { e.target.style.display = 'none' },
@@ -2355,9 +2375,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.label || '',
                     placeholder: account.email || account.label || (t('accountLabel') + ' ' + row.slot.index),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { label: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { label: e.target.value })
                     },
                   }),
                   h('span', { className: 'dsub-badge' + (account.isRevoked ? ' dsub-badge-bad' : (account.validationUrl ? ' dsub-badge-warn' : (on ? ' dsub-badge-on' : ''))) }, badgeFor(account, t)),
@@ -2431,7 +2449,7 @@ window.__ModuleLoader__.load({
                     onClick: () => {
                       const slot = row.slot
                       Promise.resolve(on ? logout(slot.provider, slot.index) : null)
-                        .then(() => setSlots(slots.filter((_, k) => k !== row.i)))
+                        .then(() => setSlots((prev) => prev.filter((s) => !(s && s.provider === slot.provider && Number(s.index) === Number(slot.index)))))
                         .catch((e) => setErr(cleanErrorMessage(e.message || e)))
                     },
                   }, '\u00d7'),
@@ -2478,10 +2496,10 @@ window.__ModuleLoader__.load({
                   h('div', { style: { fontFamily: 'monospace', fontSize: '11px', margin: '4px 0', wordBreak: 'break-all' } },
                     headlessInfo[key].sshTunnelCommand
                   ),
-                  headlessInfo[key].svgDataUrl ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
+                  safeExternalUrl(headlessInfo[key].svgDataUrl, true) ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
                     h('div', { className: 'dsub-sub', style: { marginBottom: 4 } }, t('headlessScanQr')),
                     h('img', {
-                      src: headlessInfo[key].svgDataUrl,
+                      src: safeExternalUrl(headlessInfo[key].svgDataUrl, true),
                       alt: 'QR Code',
                       style: { width: '130px', height: '130px', borderRadius: '4px', background: '#fff', padding: '4px' }
                     })
@@ -2537,7 +2555,7 @@ window.__ModuleLoader__.load({
                 })() : null),
                 (openHelp[key] ? (function renderInlineHelp(){
                   const prov = row.slot.provider;
-                  const info = (typeof INSTRUCTIONS !== 'undefined' && INSTRUCTIONS[prov]) || {
+                  const info = {
                     title: prov,
                     stepsZh: ['请在上方输入框中粘贴令牌或 API Key 并点击“保存令牌”。'],
                     stepsEn: ['Paste your token or API key into the field above and click "Save token".'],
@@ -2575,9 +2593,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.proxyUrl || '',
                     placeholder: t('proxyPlaceholder'),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { proxyUrl: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { proxyUrl: e.target.value })
                     },
                   }),
                   h('button', {
@@ -2598,10 +2614,26 @@ window.__ModuleLoader__.load({
                       value: row.slot.maxConcurrency !== undefined ? row.slot.maxConcurrency : 1,
                       title: t('maxConcurrencySlotTitle'),
                       onChange: (e) => {
-                        const next = slots.slice()
                         const val = parseInt(e.target.value, 10)
-                        next[row.i] = Object.assign({}, next[row.i], { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
-                        setSlots(next)
+                        updateSlot(row.slot.provider, row.slot.index, { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
+                      },
+                    })
+                  ),
+                  h('span', {
+                    style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'inline-flex', alignItems: 'center', gap: '3px' },
+                    title: t('monthlyCostSlotTitle')
+                  },
+                    '💰',
+                    h('input', {
+                      type: 'number',
+                      min: 0,
+                      step: 0.01,
+                      style: { width: '56px', padding: '1px 4px', fontSize: '11px', textAlign: 'center' },
+                      value: row.slot.monthlyCost !== undefined ? row.slot.monthlyCost : 20,
+                      title: t('monthlyCostSlotTitle'),
+                      onChange: (e) => {
+                        const val = parseFloat(e.target.value)
+                        updateSlot(row.slot.provider, row.slot.index, { monthlyCost: isNaN(val) ? 20 : Math.max(0, val) })
                       },
                     })
                   ),
@@ -2627,7 +2659,7 @@ window.__ModuleLoader__.load({
                           type: 'button', className: 'dsub-mini',
                           onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch { /* clipboard write error */ } },
                         }, t('deviceCopy')),
-                        h('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
+                        h('a', { href: safeExternalUrl(d.authUrl) || undefined, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
                       h('div', { className: 'dsub-sub' }, t('deviceHint')),
                     ) : null,
@@ -2721,9 +2753,9 @@ window.__ModuleLoader__.load({
                   }, '🔄 ' + t('reconnectNow'))
                 ) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return h('div', {className: cls}, txt) })(),
-                account.validationUrl ? h('div', { className: 'dsub-verify' },
+                safeExternalUrl(account.validationUrl) ? h('div', { className: 'dsub-verify' },
                   t('verifyPrefix'),
-                  h('a', { href: account.validationUrl, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
+                  h('a', { href: safeExternalUrl(account.validationUrl) || undefined, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
                   t('verifySuffix'),
                 ) : null,
                 (function usageLimitsBlock(){
@@ -3626,7 +3658,8 @@ window.__ModuleLoader__.load({
           if (!prov || !providerMatch.test(prov)) return
           fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(prov) + '&index=1', { cache: 'no-store' })
             .then((r) => r.json()).then((data) => {
-              if (data && data.url) window.open(data.url, '_blank', 'noopener')
+              const target = data && safeExternalUrl(data.url)
+              if (target) window.open(target, '_blank', 'noopener')
             }).catch(() => {})
         }
         const line = (line) => line.trim()

package/lib/config-schema.js

@@ -22,6 +22,10 @@ export const Slot = z.object({
     .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
   maxConcurrency: z.number().default(1)
     .description('#555 Per-slot max concurrent requests before queuing. Defaults to 1 for subscription safety.'),
+  monthlyCost: z.number().default(20)
+    .description('#590 Optional monthly subscription cost in USD for analytics. Defaults to 20.'),
+  maxQueueSize: z.number().default(0)
+    .description('#592 Per-account queue depth before overflow. 0 = use the global maxQueueSize.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))

package/lib/diagnostic-wizard.js

@@ -3,6 +3,8 @@
 
 import { maskEmail, maskSecrets, cleanErrorMessage } from './mask.js'
 import { getVendor } from './vendors/index.js'
+import { vendorFetch } from './http.js'
+import { proxyFetch } from './proxy.js'
 
 /**
  * Mask sensitive credentials inside diagnostic reports.
@@ -50,6 +52,8 @@ export async function runDiagnosticWizard(options = {}) {
   const includeNetwork = Boolean(options.includeNetwork)
   const fetchImpl = options.fetchImpl || globalThis.fetch || fetch
   const timeoutMs = options.timeoutMs || 8000
+  const vendorCallFetch = vendorFetch(fetchImpl, timeoutMs)
+  const proxyImplFactory = typeof options.proxyFetchImpl === 'function' ? options.proxyFetchImpl : proxyFetch
   const now = Date.now()
 
   let raw = options.rawBlob || null
@@ -140,7 +144,7 @@ export async function runDiagnosticWizard(options = {}) {
   // -------------------------------------------------------------
   // STEP 2: Network & Proxy Verification
   // -------------------------------------------------------------
-  const proxyUrl = account.proxyUrl || (options.live && options.live() && options.live().proxyUrl) || null
+  const proxyUrl = account.proxyUrl || null
   let proxyStatus = 'pass'
   let proxyCode = 'DIRECT_CONNECTION'
   let proxyMsg = 'Direct network connection configured'
@@ -171,16 +175,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        // Light probe: connect to target or HEAD request
-        await fetchImpl(proxyUrl, {
+        const impl = proxyImplFactory(proxyUrl)
+        if (!impl) throw new Error('invalid proxy URL')
+        await impl('https://api.openai.com/v1/models', {
           method: 'HEAD',
           signal: controller.signal,
-        }).catch((e) => {
-          // If proxy accepts HTTP or rejects HEAD with 405/404, TCP connection succeeded
-          if (e && e.name !== 'AbortError' && e.code !== 'ECONNREFUSED' && e.code !== 'ENOTFOUND') {
-            return { ok: true }
-          }
-          throw e
         })
         clearTimeout(timer)
         proxyLatencyMs = Date.now() - t0
@@ -238,18 +237,18 @@ export async function runDiagnosticWizard(options = {}) {
       // Attempt safe singleflight token refresh if vendor supports it
       let vendor = null
       try { vendor = getVendor(provider) } catch { /* unknown provider */ }
-      if (vendor && typeof vendor.refresh === 'function' && blob.refresh_token) {
+      if (vendor && typeof vendor.refresh === 'function' && (blob.refreshToken || blob.refresh_token)) {
         try {
           const controller = new AbortController()
           const timer = setTimeout(() => controller.abort(), timeoutMs)
-          const refreshed = await vendor.refresh(blob, {
-            fetchImpl,
-            signal: controller.signal,
-            config: options.live ? options.live() : {},
-          })
+          const refreshed = await vendor.refresh(
+            options.live ? options.live() : {},
+            blob,
+            (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+          )
           clearTimeout(timer)
           tokenLatencyMs = Date.now() - t0
-          if (refreshed && (refreshed.access_token || refreshed.token)) {
+          if (refreshed && (refreshed.accessToken || refreshed.access_token || refreshed.token)) {
             tokenStatus = 'pass'
             tokenCode = 'TOKEN_REFRESH_OK'
             tokenMsg = `Token refreshed successfully (${tokenLatencyMs}ms)`
@@ -313,11 +312,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        const models = await vendor.listModels(account, {
-          fetchImpl,
-          signal: controller.signal,
-          config: options.live ? options.live() : {},
-        })
+        const models = await vendor.listModels(
+          blob,
+          options.live ? options.live() : {},
+          (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+        )
         clearTimeout(timer)
         catalogLatencyMs = Date.now() - t0
         modelCount = Array.isArray(models) ? models.length : 0

package/lib/http.js

@@ -441,3 +441,7 @@ export function escapeHtml(text) {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')
 }
+
+export function vendorFetch(fetchImpl, timeoutMs = 15000) {
+  return (url, init, options) => fetchWithTimeout(fetchImpl || fetch, url, init, { timeoutMs, ...(options || {}) })
+}

package/lib/routes/status.js

@@ -17,7 +17,7 @@ import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, isTimeoutError, vendorFetch } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -384,8 +384,8 @@ export function registerStatusRoutes(ctx, state) {
       const vendor = getVendor(provider)
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+        const doFetch = vendorFetch((typeof fetchForRef === "function" && fetchForRef(ref)) || fetch, 15_000)
+        const res2 = await vendorFetch(doFetch, 15_000)(url, init)
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -522,7 +522,7 @@ export function registerStatusRoutes(ctx, state) {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+          const res2 = await vendorFetch(doFetch, 15_000)(url, init)
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/vault.js

@@ -1,11 +1,32 @@
 // #353 & #360: Encrypted Vault Export/Import for Subscriptions
 // Secure migration and backup of slots and credentials using AES-256-GCM.
 
+import { readFileSync } from 'node:fs'
 import { encryptWithPassphrase, decryptWithPassphrase } from './crypto.js'
 import { isProvider, oauthRef } from './refs.js'
 
 export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 
+let cachedVersion = ''
+function pluginVersion() {
+  if (!cachedVersion) {
+    try {
+      cachedVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '0.0.0'
+    } catch {
+      cachedVersion = '0.0.0'
+    }
+  }
+  return cachedVersion
+}
+
+export function assertSupportedVaultVersion(version) {
+  const text = String(version == null ? '' : version).trim()
+  if (!text) return
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(text)
+  if (!match) throw new Error('invalid vault version')
+  if (Number(match[1]) > 0) throw new Error('vault version ' + text + ' is newer than this plugin supports')
+}
+
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
@@ -17,7 +38,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
 
   const payload = {
     format: VAULT_FORMAT,
-    version: '0.6.77',
+    version: pluginVersion(),
     exportedAt: new Date().toISOString(),
     exportedBy,
     slots: Array.isArray(slots) ? slots : [],
@@ -66,6 +87,8 @@ export function importVault(encryptedPayload, passphrase) {
     throw new Error('invalid vault schema: unsupported structure')
   }
 
+  assertSupportedVaultVersion(data.version)
+
   const refs = new Set()
   for (const slot of data.slots) {
     if (!slot || !isProvider(slot.provider) || !Number.isSafeInteger(slot.index) || slot.index < 1) {

package/lib/vendors/copilot-cli.js

@@ -11,6 +11,12 @@ import { LlmError } from '@deepseek-ai/dsh-llm'
 const MAX_STDERR_CHARS = 2048
 const GITHUB_TOKEN_PATTERN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g
 
+const COPILOT_CLI_BASENAME = /^(?:copilot|github-copilot-cli|copilot-cli)(?:\.(?:cmd|bat|exe))?$/i
+
+export function isAllowedCopilotBinary(binaryPath) {
+  return COPILOT_CLI_BASENAME.test(String(binaryPath || '').split(/[\\/]/).pop())
+}
+
 export function redactCopilotStderr(text) {
   return String(text || '').replace(GITHUB_TOKEN_PATTERN, '[REDACTED]')
 }
@@ -134,9 +140,14 @@ export async function readCopilotCredentials(home, env = process.env) {
 export function findCopilotCli(customPath, env = process.env, platform = process.platform) {
   if (customPath && typeof customPath === 'string' && customPath.trim()) {
     const p = customPath.trim()
-    try {
-      if (existsSync(p)) return p
-    } catch { /* best-effort */ }
+    let exists = false
+    try { exists = existsSync(p) } catch { /* best-effort */ }
+    if (exists) {
+      if (!isAllowedCopilotBinary(p)) {
+        throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+      }
+      return p
+    }
   }
 
   const pathVar = env.PATH || ''
@@ -265,6 +276,9 @@ export function resolveSpawnCommand(binaryPath, args, platform = process.platfor
  * @returns {AsyncGenerator<any, void, unknown>}
  */
 export async function* streamCopilotCli({ binaryPath, options, blob, config: _config, signal, spawnImpl }) {
+  if (!isAllowedCopilotBinary(binaryPath)) {
+    throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+  }
   if (signal && signal.aborted) {
     throw new LlmError('Request aborted by client', 'ABORTED')
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.83",
+  "version": "0.6.84",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",