@goodandready/dsh-subscriptions 0.6.83 → 0.6.85

package/README.md

@@ -310,6 +310,7 @@ dsh-subscriptions:
 - `customVendors.authUrl`, `tokenUrl` and `baseUrl` must use `https://`. Plain `http://` is accepted only for loopback hosts (`localhost`, `127.0.0.1`, `::1`).
 - Grok `baseUrl` overrides must point to `api.x.ai`, `grok.com` / `*.grok.com`, or a loopback host; other hosts are rejected with `GROK_UNTRUSTED_HOST` so bearer tokens never leave trusted xAI infrastructure.
 - Antigravity CLI imports must configure `antigravityClientSecret`; the embedded default was removed.
+- `copilotCliPath` must point to a `copilot`, `github-copilot-cli` or `copilot-cli` binary; rename custom wrappers.
 - The error buffer and diagnostics reports redact bearer tokens, API keys, JWTs and `key=value` credentials before storing or returning them.
 
 

package/README.ru.md

@@ -283,6 +283,7 @@ dsh-subscriptions:
 - `customVendors.authUrl`, `tokenUrl` и `baseUrl` обязаны использовать `https://`. Открытый `http://` допускается только для loopback-хостов (`localhost`, `127.0.0.1`, `::1`).
 - Переопределение Grok `baseUrl` должно указывать на `api.x.ai`, `grok.com` / `*.grok.com` или loopback-хост; остальные хосты отклоняются с `GROK_UNTRUSTED_HOST`, чтобы bearer-токен не покидал доверенную инфраструктуру xAI.
 - Импорт Antigravity CLI требует явного `antigravityClientSecret`; встроенный default удалён.
+- `copilotCliPath` должен указывать на бинарь `copilot`, `github-copilot-cli` или `copilot-cli`; кастомные обёртки переименуйте.
 - Error buffer и диагностические отчёты редактируют bearer-токены, API-ключи, JWT и `key=value`-credentials до сохранения и выдачи.
 
 

package/README.zh.md

@@ -189,6 +189,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 - `customVendors.authUrl`、`tokenUrl` 和 `baseUrl` 必须使用 `https://`。明文 `http://` 仅允许用于回环主机（`localhost`、`127.0.0.1`、`::1`）。
 - Grok `baseUrl` 覆盖只能指向 `api.x.ai`、`grok.com` / `*.grok.com` 或回环主机；其他主机会以 `GROK_UNTRUSTED_HOST` 拒绝，避免 bearer 令牌离开可信的 xAI 基础设施。
 - Antigravity CLI 导入必须配置 `antigravityClientSecret`；内置默认值已移除。
+- `copilotCliPath` 必须指向 `copilot`、`github-copilot-cli` 或 `copilot-cli` 可执行文件；自定义包装器请重命名。
 - 错误缓冲区和诊断报告会在存储或返回前脱敏 bearer 令牌、API 密钥、JWT 和 `key=value` 凭据。
 
 

package/lib/accounts.js

@@ -379,6 +379,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         label: slot.label || info.label,
         pacePerHour: info.pacePerHour || 0,
         maxConcurrency: slot.maxConcurrency !== undefined ? slot.maxConcurrency : (curConfig.accountMaxConcurrency || 1),
+        maxQueueSize: slot.maxQueueSize > 0 ? Number(slot.maxQueueSize) : (curConfig.maxQueueSize || 20),
       })
     }
     return out

package/lib/client.js

@@ -56,9 +56,19 @@ window.__ModuleLoader__.load({
     const PKG = '@goodandready/dsh-subscriptions'
     const ROW_ID = 'dsh-subscriptions'
     const ROW_CONFIG_KEY = PKG + '#' + ROW_ID
-    
-    let INSTRUCTIONS = {};
 
+    function safeExternalUrl(raw, allowDataImage) {
+      const text = String(raw == null ? '' : raw).trim()
+      if (!text) return ''
+      if (allowDataImage && /^data:image\/(?:png|jpe?g|gif|webp|svg\+xml)[;,]/i.test(text)) return text
+      try {
+        const base = (typeof window !== 'undefined' && window.location && window.location.origin) || 'http://127.0.0.1'
+        const url = new URL(text, base)
+        if (url.protocol === 'http:' || url.protocol === 'https:' || url.protocol === 'dsh-app:') return url.href
+      } catch { /* invalid url */ }
+      return ''
+    }
+    
     const en = {
       "syncModels": "Sync Models",
       "syncModelsTitle": "Discover and synchronize available models from vendor API",
@@ -157,6 +167,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "Encrypted at Rest (AES-256-GCM)",
       "atRestEncryptedTitle": "Credentials are protected at rest with master key encryption.",
       "maxConcurrencySlotTitle": "Max parallel streams for this account slot (default: 1)",
+      "monthlyCostSlotTitle": "Monthly subscription cost in USD for this account (default: 20)",
       "concurrencyQueueHint": "Active and queued parallel requests for this account",
       "activeStreams": "active",
       "queuedStreams": "queued",
@@ -489,6 +500,7 @@ window.__ModuleLoader__.load({
       "atRestEncrypted": "静态存储加密 (AES-256-GCM)",
       "atRestEncryptedTitle": "凭据已通过主密钥进行静态 AES-256-GCM 加密保护。",
       "maxConcurrencySlotTitle": "当前账户槽位最大并发请求数（默认：1）",
+      "monthlyCostSlotTitle": "该账户每月订阅费用（美元，默认：20）",
       "concurrencyQueueHint": "当前账户槽位进行中与排队中的并发请求",
       "activeStreams": "活跃",
       "queuedStreams": "排队中",
@@ -861,6 +873,7 @@ window.__ModuleLoader__.load({
       const [modelsCatalog, setModelsCatalog] = React.useState([])
       const [paste, setPaste] = React.useState({})
       const [device, setDevice] = React.useState({})  // #90 key -> {state,userCode,authUrl,intervalMs,status}
+      const [loginLinks, setLoginLinks] = React.useState({})  // #595 provider:index -> fallback auth URL when a popup is blocked
       const [proxyRes, setProxyRes] = React.useState({})  // #88 key -> {ok,latencyMs,error}
       const [diag, setDiag] = React.useState('')
       const [sessionAnalysis, setSessionAnalysis] = React.useState(null)
@@ -1253,10 +1266,10 @@ window.__ModuleLoader__.load({
         const pendingKeys = Object.entries(device).filter(([, d]) => d && d.status === 'pending')
         if (!pendingKeys.length) return
         const timers = pendingKeys.map(([key, d]) => setInterval(() => {
-          devicePollOnce(key.split(':')[0], Number(key.split(':')[1]))
+          devicePollOnce(key.split(':')[0], Number(key.split(':')[1])).catch(() => {})
         }, d.intervalMs || 5000))
         return () => timers.forEach(clearInterval)
-      })
+      }, [device])
 
       // #81: settings snapshot status - never render phantom inputs before the
       // config snapshot arrives, and offer a retry when the store is unavailable.
@@ -1274,7 +1287,13 @@ window.__ModuleLoader__.load({
       }
 
       const slots = Array.isArray(draft.slots) ? draft.slots : []
-      const setSlots = (next) => setDraft((d) => Object.assign({}, d, { slots: next }))
+      const setSlots = (next) => setDraft((d) => {
+        const base = Array.isArray(d && d.slots) ? d.slots : []
+        return Object.assign({}, d, { slots: typeof next === 'function' ? next(base) : next })
+      })
+      const updateSlot = (provider, index, patch) => setSlots((prev) => prev.map((s) => (
+        s && s.provider === provider && Number(s.index) === Number(index) ? Object.assign({}, s, patch) : s
+      )))
       const accountOf = (provider, index) => accounts.find((a) => a.provider === provider && a.index === index) || {}
 
       const save = async () => {
@@ -1306,12 +1325,31 @@ window.__ModuleLoader__.load({
           setErr(t('missingClientIdAntigravity'))
           return
         }
-        const res = await fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(provider) + '&index=' + encodeURIComponent(index), { cache: 'no-store' })
-        const data = await res.json().catch(() => ({}))
-        if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
-        const key = provider + ':' + index
-        if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
-        if (data.url) window.open(data.url, '_blank', 'noopener')
+        // #595: open the popup synchronously, before the first await, so the
+        // click gesture is still valid in Chrome and Firefox.
+        let popup = null
+        try { popup = window.open('', '_blank') } catch { popup = null }
+        try {
+          const res = await fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(provider) + '&index=' + encodeURIComponent(index), { cache: 'no-store' })
+          const data = await res.json().catch(() => ({}))
+          if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+          const key = provider + ':' + index
+          if (data.headless) setHeadlessInfo((m) => Object.assign({}, m, { [key]: data.headless }))
+          const authTarget = safeExternalUrl(data.url)
+          if (authTarget) {
+            if (popup && !popup.closed) {
+              popup.location.href = authTarget
+              try { popup.opener = null } catch { /* cross-origin */ }
+            } else {
+              setLoginLinks((m) => Object.assign({}, m, { [key]: authTarget }))
+            }
+          } else if (popup && !popup.closed) {
+            popup.close()
+          }
+        } catch (e) {
+          if (popup && !popup.closed) popup.close()
+          throw e
+        }
       }
 
       // #90: device-code login (headless). Server mints user_code; we show it,
@@ -1509,7 +1547,7 @@ window.__ModuleLoader__.load({
         const used = slots.filter((s) => s.provider === provider).map((s) => s.index)
         let index = 1
         while (used.indexOf(index) >= 0) index++
-        setSlots(slots.concat([{ provider: provider, index: index, label: '' }]))
+        setSlots((prev) => prev.concat([{ provider: provider, index: index, label: '' }]))
       }
 
       const names = providers.length ? providers : [
@@ -2338,8 +2376,9 @@ window.__ModuleLoader__.load({
               const account = accountOf(row.slot.provider, row.slot.index)
               const key = row.slot.provider + ':' + row.slot.index
               const on = !!account.configured
-              const avatarEl = (account.avatarUrl ? h('img', {
-                src: account.avatarUrl,
+              const avatarSrc = safeExternalUrl(account.avatarUrl, true)
+              const avatarEl = (avatarSrc ? h('img', {
+                src: avatarSrc,
                 alt: account.email || account.label || 'Avatar',
                 className: 'dsub-avatar',
                 onError: (e) => { e.target.style.display = 'none' },
@@ -2355,9 +2394,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.label || '',
                     placeholder: account.email || account.label || (t('accountLabel') + ' ' + row.slot.index),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { label: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { label: e.target.value })
                     },
                   }),
                   h('span', { className: 'dsub-badge' + (account.isRevoked ? ' dsub-badge-bad' : (account.validationUrl ? ' dsub-badge-warn' : (on ? ' dsub-badge-on' : ''))) }, badgeFor(account, t)),
@@ -2431,7 +2468,7 @@ window.__ModuleLoader__.load({
                     onClick: () => {
                       const slot = row.slot
                       Promise.resolve(on ? logout(slot.provider, slot.index) : null)
-                        .then(() => setSlots(slots.filter((_, k) => k !== row.i)))
+                        .then(() => setSlots((prev) => prev.filter((s) => !(s && s.provider === slot.provider && Number(s.index) === Number(slot.index)))))
                         .catch((e) => setErr(cleanErrorMessage(e.message || e)))
                     },
                   }, '\u00d7'),
@@ -2478,10 +2515,10 @@ window.__ModuleLoader__.load({
                   h('div', { style: { fontFamily: 'monospace', fontSize: '11px', margin: '4px 0', wordBreak: 'break-all' } },
                     headlessInfo[key].sshTunnelCommand
                   ),
-                  headlessInfo[key].svgDataUrl ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
+                  safeExternalUrl(headlessInfo[key].svgDataUrl, true) ? h('div', { style: { marginTop: 6, textAlign: 'center' } },
                     h('div', { className: 'dsub-sub', style: { marginBottom: 4 } }, t('headlessScanQr')),
                     h('img', {
-                      src: headlessInfo[key].svgDataUrl,
+                      src: safeExternalUrl(headlessInfo[key].svgDataUrl, true),
                       alt: 'QR Code',
                       style: { width: '130px', height: '130px', borderRadius: '4px', background: '#fff', padding: '4px' }
                     })
@@ -2537,7 +2574,7 @@ window.__ModuleLoader__.load({
                 })() : null),
                 (openHelp[key] ? (function renderInlineHelp(){
                   const prov = row.slot.provider;
-                  const info = (typeof INSTRUCTIONS !== 'undefined' && INSTRUCTIONS[prov]) || {
+                  const info = {
                     title: prov,
                     stepsZh: ['请在上方输入框中粘贴令牌或 API Key 并点击“保存令牌”。'],
                     stepsEn: ['Paste your token or API key into the field above and click "Save token".'],
@@ -2575,9 +2612,7 @@ window.__ModuleLoader__.load({
                     value: row.slot.proxyUrl || '',
                     placeholder: t('proxyPlaceholder'),
                     onChange: (e) => {
-                      const next = slots.slice()
-                      next[row.i] = Object.assign({}, next[row.i], { proxyUrl: e.target.value })
-                      setSlots(next)
+                      updateSlot(row.slot.provider, row.slot.index, { proxyUrl: e.target.value })
                     },
                   }),
                   h('button', {
@@ -2598,10 +2633,26 @@ window.__ModuleLoader__.load({
                       value: row.slot.maxConcurrency !== undefined ? row.slot.maxConcurrency : 1,
                       title: t('maxConcurrencySlotTitle'),
                       onChange: (e) => {
-                        const next = slots.slice()
                         const val = parseInt(e.target.value, 10)
-                        next[row.i] = Object.assign({}, next[row.i], { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
-                        setSlots(next)
+                        updateSlot(row.slot.provider, row.slot.index, { maxConcurrency: isNaN(val) ? 1 : Math.max(1, val) })
+                      },
+                    })
+                  ),
+                  h('span', {
+                    style: { fontSize: '11px', color: 'var(--dsw-alias-label-secondary)', display: 'inline-flex', alignItems: 'center', gap: '3px' },
+                    title: t('monthlyCostSlotTitle')
+                  },
+                    '💰',
+                    h('input', {
+                      type: 'number',
+                      min: 0,
+                      step: 0.01,
+                      style: { width: '56px', padding: '1px 4px', fontSize: '11px', textAlign: 'center' },
+                      value: row.slot.monthlyCost !== undefined ? row.slot.monthlyCost : 20,
+                      title: t('monthlyCostSlotTitle'),
+                      onChange: (e) => {
+                        const val = parseFloat(e.target.value)
+                        updateSlot(row.slot.provider, row.slot.index, { monthlyCost: isNaN(val) ? 20 : Math.max(0, val) })
                       },
                     })
                   ),
@@ -2627,7 +2678,7 @@ window.__ModuleLoader__.load({
                           type: 'button', className: 'dsub-mini',
                           onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch { /* clipboard write error */ } },
                         }, t('deviceCopy')),
-                        h('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
+                        h('a', { href: safeExternalUrl(d.authUrl) || undefined, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
                       h('div', { className: 'dsub-sub' }, t('deviceHint')),
                     ) : null,
@@ -2721,9 +2772,12 @@ window.__ModuleLoader__.load({
                   }, '🔄 ' + t('reconnectNow'))
                 ) : null,
                 (function(){ var r=checkRes[key]; if(!r) return null; var txt=r.ok ? ('ok ' + (r.email||'')) : ('fail ' + (r.error && r.error.message || '')); var cls=r.ok ? 'dsub-ok' : 'dsub-bad'; var q=r.quota; if(q && q.remaining!=null) txt += ' quota:'+q.remaining+(q.limit!=null?'/'+q.limit:''); return h('div', {className: cls}, txt) })(),
-                account.validationUrl ? h('div', { className: 'dsub-verify' },
+                loginLinks[key] ? h('div', { className: 'dsub-verify' },
+                  h('a', { href: loginLinks[key], target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink'))
+                ) : null,
+                safeExternalUrl(account.validationUrl) ? h('div', { className: 'dsub-verify' },
                   t('verifyPrefix'),
-                  h('a', { href: account.validationUrl, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
+                  h('a', { href: safeExternalUrl(account.validationUrl) || undefined, target: '_blank', rel: 'noopener noreferrer' }, t('verifyLink')),
                   t('verifySuffix'),
                 ) : null,
                 (function usageLimitsBlock(){
@@ -3626,7 +3680,13 @@ window.__ModuleLoader__.load({
           if (!prov || !providerMatch.test(prov)) return
           fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(prov) + '&index=1', { cache: 'no-store' })
             .then((r) => r.json()).then((data) => {
-              if (data && data.url) window.open(data.url, '_blank', 'noopener')
+              const target = data && safeExternalUrl(data.url)
+              if (target) {
+                const popup = window.open(target, '_blank', 'noopener')
+                if (!popup) {
+                  try { navigator.clipboard.writeText(target) } catch { /* clipboard blocked */ }
+                }
+              }
             }).catch(() => {})
         }
         const line = (line) => line.trim()

package/lib/config-schema.js

@@ -22,6 +22,10 @@ export const Slot = z.object({
     .description('#88 Per-account proxy URL (http://, https://, socks5://). All requests for this account route through it. Empty = direct connection.'),
   maxConcurrency: z.number().default(1)
     .description('#555 Per-slot max concurrent requests before queuing. Defaults to 1 for subscription safety.'),
+  monthlyCost: z.number().default(20)
+    .description('#590 Optional monthly subscription cost in USD for analytics. Defaults to 20.'),
+  maxQueueSize: z.number().default(0)
+    .description('#592 Per-account queue depth before overflow. 0 = use the global maxQueueSize.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))

package/lib/diagnostic-wizard.js

@@ -3,6 +3,8 @@
 
 import { maskEmail, maskSecrets, cleanErrorMessage } from './mask.js'
 import { getVendor } from './vendors/index.js'
+import { vendorFetch } from './http.js'
+import { proxyFetch } from './proxy.js'
 
 /**
  * Mask sensitive credentials inside diagnostic reports.
@@ -50,6 +52,8 @@ export async function runDiagnosticWizard(options = {}) {
   const includeNetwork = Boolean(options.includeNetwork)
   const fetchImpl = options.fetchImpl || globalThis.fetch || fetch
   const timeoutMs = options.timeoutMs || 8000
+  const vendorCallFetch = vendorFetch(fetchImpl, timeoutMs)
+  const proxyImplFactory = typeof options.proxyFetchImpl === 'function' ? options.proxyFetchImpl : proxyFetch
   const now = Date.now()
 
   let raw = options.rawBlob || null
@@ -140,7 +144,7 @@ export async function runDiagnosticWizard(options = {}) {
   // -------------------------------------------------------------
   // STEP 2: Network & Proxy Verification
   // -------------------------------------------------------------
-  const proxyUrl = account.proxyUrl || (options.live && options.live() && options.live().proxyUrl) || null
+  const proxyUrl = account.proxyUrl || null
   let proxyStatus = 'pass'
   let proxyCode = 'DIRECT_CONNECTION'
   let proxyMsg = 'Direct network connection configured'
@@ -171,16 +175,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        // Light probe: connect to target or HEAD request
-        await fetchImpl(proxyUrl, {
+        const impl = proxyImplFactory(proxyUrl)
+        if (!impl) throw new Error('invalid proxy URL')
+        await impl('https://api.openai.com/v1/models', {
           method: 'HEAD',
           signal: controller.signal,
-        }).catch((e) => {
-          // If proxy accepts HTTP or rejects HEAD with 405/404, TCP connection succeeded
-          if (e && e.name !== 'AbortError' && e.code !== 'ECONNREFUSED' && e.code !== 'ENOTFOUND') {
-            return { ok: true }
-          }
-          throw e
         })
         clearTimeout(timer)
         proxyLatencyMs = Date.now() - t0
@@ -238,18 +237,18 @@ export async function runDiagnosticWizard(options = {}) {
       // Attempt safe singleflight token refresh if vendor supports it
       let vendor = null
       try { vendor = getVendor(provider) } catch { /* unknown provider */ }
-      if (vendor && typeof vendor.refresh === 'function' && blob.refresh_token) {
+      if (vendor && typeof vendor.refresh === 'function' && (blob.refreshToken || blob.refresh_token)) {
         try {
           const controller = new AbortController()
           const timer = setTimeout(() => controller.abort(), timeoutMs)
-          const refreshed = await vendor.refresh(blob, {
-            fetchImpl,
-            signal: controller.signal,
-            config: options.live ? options.live() : {},
-          })
+          const refreshed = await vendor.refresh(
+            options.live ? options.live() : {},
+            blob,
+            (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+          )
           clearTimeout(timer)
           tokenLatencyMs = Date.now() - t0
-          if (refreshed && (refreshed.access_token || refreshed.token)) {
+          if (refreshed && (refreshed.accessToken || refreshed.access_token || refreshed.token)) {
             tokenStatus = 'pass'
             tokenCode = 'TOKEN_REFRESH_OK'
             tokenMsg = `Token refreshed successfully (${tokenLatencyMs}ms)`
@@ -313,11 +312,11 @@ export async function runDiagnosticWizard(options = {}) {
       try {
         const controller = new AbortController()
         const timer = setTimeout(() => controller.abort(), timeoutMs)
-        const models = await vendor.listModels(account, {
-          fetchImpl,
-          signal: controller.signal,
-          config: options.live ? options.live() : {},
-        })
+        const models = await vendor.listModels(
+          blob,
+          options.live ? options.live() : {},
+          (url, init) => vendorCallFetch(url, { ...(init || {}), signal: controller.signal }),
+        )
         clearTimeout(timer)
         catalogLatencyMs = Date.now() - t0
         modelCount = Array.isArray(models) ? models.length : 0

package/lib/http.js

@@ -72,9 +72,9 @@ export function isLoopback(value) {
     return false
   }
   const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '')
-  return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address.startsWith('127.')
-    || address.startsWith('::ffff:127.')
+  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
+  if (address.startsWith('::ffff:')) return isLoopbackIPv4(address.slice('::ffff:'.length))
+  return isLoopbackIPv4(address)
 }
 
 
@@ -441,3 +441,7 @@ export function escapeHtml(text) {
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')
 }
+
+export function vendorFetch(fetchImpl, timeoutMs = 15000) {
+  return (url, init, options) => fetchWithTimeout(fetchImpl || fetch, url, init, { timeoutMs, ...(options || {}) })
+}

package/lib/routes/accounts.js

@@ -603,7 +603,13 @@ export function registerAccountsRoutes(ctx, state) {
         return
       }
       try {
-        const ref = oauthRef(payload.provider, payload.index)
+        const provider = String(payload.provider || '')
+        const index = Number(payload.index)
+        if (!isProvider(provider) || !Number.isInteger(index) || index < 1 || index > 99) {
+          writeJson(res, 400, { ok: false, error: { code: 'bad_request', message: 'invalid provider or index' } })
+          return
+        }
+        const ref = oauthRef(provider, index)
         await store.clearRef(ref)
         await syncAdapter()
         refreshModels().catch(() => {})

package/lib/routes/status.js

@@ -17,7 +17,7 @@ import { readFileSync } from 'node:fs'
 import { getRecentAlerts, clearAlerts } from '../alerts.js'
 import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { Config, plainConfig, publicConfig, restoreMaskedSecrets } from '../config-schema.js'
-import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, fetchWithTimeout, isTimeoutError } from '../http.js'
+import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson, isTimeoutError, vendorFetch } from '../http.js'
 import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
@@ -384,8 +384,8 @@ export function registerStatusRoutes(ctx, state) {
       const vendor = getVendor(provider)
       let capturedQuota = null
       const probeFetch = async (url, init = {}) => {
-        const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-        const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+        const doFetch = vendorFetch((typeof fetchForRef === "function" && fetchForRef(ref)) || fetch, 15_000)
+        const res2 = await vendorFetch(doFetch, 15_000)(url, init)
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
@@ -431,11 +431,6 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      const host = (req.headers.host || '').split(':')[0]
-      if (host !== 'localhost' && host !== '127.0.0.1') {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'localhost only' } })
-        return
-      }
       const limit = Math.max(1, Math.min(Number(queryOf(req).get('limit') || '10'), 100))
       writeJson(res, 200, { ok: true, total: history.size(), items: history.recent(limit) })
     }),
@@ -522,7 +517,7 @@ export function registerStatusRoutes(ctx, state) {
         let capturedQuota = null
         const probeFetch = async (url, init = {}) => {
           const doFetch = (typeof fetchForRef === "function" && fetchForRef(ref)) || fetch
-          const res2 = await fetchWithTimeout(doFetch, url, init, { timeoutMs: 15_000 })
+          const res2 = await vendorFetch(doFetch, 15_000)(url, init)
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }

package/lib/sse.js

@@ -1,17 +1,24 @@
 /**
  * @param {any} body
- * @param {{ idleTimeoutMs?: number, signal?: AbortSignal }} [options]
+ * @param {{ idleTimeoutMs?: number, totalTimeoutMs?: number, maxBufferBytes?: number, signal?: AbortSignal }} [options]
  * @returns {AsyncGenerator<string, void, unknown>}
  */
-export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {}) {
+export async function* iterateSse(body, { idleTimeoutMs = 60000, totalTimeoutMs = 600000, maxBufferBytes = 8 * 1024 * 1024, signal } = {}) {
   const reader = body && typeof body.getReader === 'function' ? body.getReader() : null
   const decoder = new TextDecoder()
   let buffer = ''
   let terminated = false
+  const deadline = totalTimeoutMs > 0 ? Date.now() + totalTimeoutMs : 0
 
   async function* fromText(chunk) {
     if (terminated) return
+    if (chunk.length > maxBufferBytes) {
+      throw new Error('SSE buffer limit exceeded (' + maxBufferBytes + ' chars)')
+    }
     buffer += chunk
+    if (buffer.length > maxBufferBytes) {
+      throw new Error('SSE buffer limit exceeded (' + maxBufferBytes + ' chars)')
+    }
     let sep
     while ((sep = buffer.search(/\r?\n\r?\n/)) >= 0) {
       const raw = buffer.slice(0, sep)
@@ -32,7 +39,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     }
   }
 
-  async function readWithTimeout(r) {
+  async function readWithTimeout(r, timeoutMs) {
     if (signal && signal.aborted) {
       if (typeof r.cancel === 'function') await r.cancel().catch(() => {})
       const err = new Error('stream aborted by client')
@@ -41,12 +48,15 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     }
     let timer
     const timeoutPromise = new Promise((_, reject) => {
-      if (!idleTimeoutMs || idleTimeoutMs <= 0) return
+      if (!timeoutMs || timeoutMs <= 0) return
       timer = setTimeout(() => {
-        const err = /** @type {Error & { code?: string }} */ (new Error(`stream idle timeout: no data received for ${Math.round(idleTimeoutMs / 1000)}s`))
+        const message = timeoutMs === idleTimeoutMs
+          ? `stream idle timeout: no data received for ${Math.round(timeoutMs / 1000)}s`
+          : 'SSE stream deadline exceeded'
+        const err = /** @type {Error & { code?: string }} */ (new Error(message))
         err.code = 'TIMEOUT'
         reject(err)
-      }, idleTimeoutMs)
+      }, timeoutMs)
     })
 
     let abortPromise
@@ -77,7 +87,13 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
   if (reader) {
     try {
       while (!terminated) {
-        const { done, value } = await readWithTimeout(reader)
+        let wait = idleTimeoutMs
+        if (deadline) {
+          const remaining = deadline - Date.now()
+          if (remaining <= 0) throw new Error('SSE stream deadline exceeded')
+          wait = idleTimeoutMs > 0 ? Math.min(idleTimeoutMs, remaining) : remaining
+        }
+        const { done, value } = await readWithTimeout(reader, wait)
         if (done) break
         yield* fromText(decoder.decode(value, { stream: true }))
         if (terminated) break
@@ -92,6 +108,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
   }
   if (body && typeof body[Symbol.asyncIterator] === 'function') {
     for await (const chunk of body) {
+      if (deadline && Date.now() >= deadline) throw new Error('SSE stream deadline exceeded')
       if (signal && signal.aborted) {
         const err = new Error('stream aborted by client')
         err.name = 'AbortError'
@@ -108,6 +125,7 @@ export async function* iterateSse(body, { idleTimeoutMs = 60000, signal } = {})
     return
   }
   const text = typeof body === 'string' ? body : await new Response(body).text()
+  if (text.length > maxBufferBytes) throw new Error('SSE buffer limit exceeded (' + maxBufferBytes + ' chars)')
   yield* fromText(text)
 }
 

package/lib/subscriptions.js

@@ -1,3 +1,4 @@
+import { readErrorBody } from './wire.js'
 import { isProvider } from "./refs.js"
 import { pickAccountWithTrace, markCooldown, isSwitchableError, modelFamily } from "./rotate.js"
 import { quotaSnapshot } from "./ratelimit.js"
@@ -262,7 +263,7 @@ export function createSubscriptionsService(deps) {
             } catch { /* ignore subscriptions error */ }
           }
           if (!res.ok) {
-            const txt = await res.text().catch(() => "")
+            const txt = await readErrorBody(res)
             const err = new Error("vendor http " + res.status + (txt ? ": " + txt.slice(0, 200) : ""))
             err.status = res.status
             if (res.status === 429) err.code = "RATE_LIMIT"

package/lib/updater.js

@@ -16,11 +16,19 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
+function isLoopbackIPv4(address) {
+  if (!address || !address.startsWith('127.')) return false
+  const parts = address.split('.')
+  if (parts.length !== 4) return false
+  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
 export function isLoopback(value) {
   const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address?.startsWith('127.') === true
-    || address?.startsWith('::ffff:127.') === true
+  if (!address) return false
+  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
+  const ipv4 = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address
+  return isLoopbackIPv4(ipv4)
 }
 
 export function isTrustedUpdateRequest(request, targetCtx) {

package/lib/vault.js

@@ -1,11 +1,32 @@
 // #353 & #360: Encrypted Vault Export/Import for Subscriptions
 // Secure migration and backup of slots and credentials using AES-256-GCM.
 
+import { readFileSync } from 'node:fs'
 import { encryptWithPassphrase, decryptWithPassphrase } from './crypto.js'
 import { isProvider, oauthRef } from './refs.js'
 
 export const VAULT_FORMAT = 'dsh-subscriptions-vault-v1'
 
+let cachedVersion = ''
+function pluginVersion() {
+  if (!cachedVersion) {
+    try {
+      cachedVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '0.0.0'
+    } catch {
+      cachedVersion = '0.0.0'
+    }
+  }
+  return cachedVersion
+}
+
+export function assertSupportedVaultVersion(version) {
+  const text = String(version == null ? '' : version).trim()
+  if (!text) return
+  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(text)
+  if (!match) throw new Error('invalid vault version')
+  if (Number(match[1]) > 0) throw new Error('vault version ' + text + ' is newer than this plugin supports')
+}
+
 /**
  * Encrypts slots configuration and credential blobs into a portable vault string.
  */
@@ -17,7 +38,7 @@ export function exportVault({ slots = [], blobs = {}, exportedBy = 'dsh-subscrip
 
   const payload = {
     format: VAULT_FORMAT,
-    version: '0.6.77',
+    version: pluginVersion(),
     exportedAt: new Date().toISOString(),
     exportedBy,
     slots: Array.isArray(slots) ? slots : [],
@@ -66,6 +87,8 @@ export function importVault(encryptedPayload, passphrase) {
     throw new Error('invalid vault schema: unsupported structure')
   }
 
+  assertSupportedVaultVersion(data.version)
+
   const refs = new Set()
   for (const slot of data.slots) {
     if (!slot || !isProvider(slot.provider) || !Number.isSafeInteger(slot.index) || slot.index < 1) {

package/lib/vendor-factory.js

@@ -10,7 +10,7 @@ import { fetchWithTimeout } from "./http.js"
 
 import { buildAuthorizeUrl } from "./oauth.js"
 import { codexResponsesBody, modelCatalog } from "./messages.js"
-import { formTokenRequest, jsonTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from "./wire.js"
+import { formTokenRequest, jsonTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError , readErrorBody } from "./wire.js"
 import { emailFromToken } from "./jwt.js"
 
 function defaultModels(providerId, models) {
@@ -92,6 +92,7 @@ export function createVendorFromProfile(profile) {
         const res = await fetchWithTimeout(fetchImpl || fetch, `${base}${profile.modelsPath}`, {
           headers: identityHeaders(blob, { Accept: "application/json" }),
         }, { timeoutMs: 15000 })
+        if (!res.ok) throw httpError(res.status, await readErrorBody(res))
         const json = await readJson(res)
         const rows = []
         for (const entry of json.data || json.models || []) {
@@ -101,7 +102,9 @@ export function createVendorFromProfile(profile) {
         }
         if (!rows.length) throw new Error("empty catalog")
         return modelCatalog(id, rows)
-      } catch {
+      } catch (err) {
+        const status = Number(err && (err.status || err.statusCode) || 0)
+        if (status === 401 || status === 403 || (err && err.code === 'AUTH')) throw err
         return catalog
       }
     },
@@ -125,7 +128,7 @@ export function createVendorFromProfile(profile) {
         body: JSON.stringify(body),
         signal,
       }, { timeoutMs: 60000, stream: true })
-      if (!res.ok) throw httpError(res.status, await res.text())
+      if (!res.ok) throw httpError(res.status, await readErrorBody(res))
       yield* codexResponsesStream(res.body)
     },
   }

package/lib/vendors/antigravity.js

@@ -1,7 +1,7 @@
 import { randomUUID } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { googleContents } from '../messages.js'
-import { formTokenRequest, googleStream, throwHttpError, tokenBlobFromOAuth } from '../wire.js'
+import { formTokenRequest, googleStream, throwHttpError, tokenBlobFromOAuth , readErrorBody } from '../wire.js'
 import { fetchWithTimeout } from '../http.js'
 import { emailFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import {
@@ -239,7 +239,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, signal, s
         body: JSON.stringify(envelope),
         signal,
       }, { timeoutMs: RESPONSE_TIMEOUT_MS })
-      if (!res.ok) throwHttpError(res.status, await res.text())
+      if (!res.ok) throwHttpError(res.status, await readErrorBody(res))
       if (saveBlob && sessionId && sessionId !== ready.sessionId) {
         await saveBlob({ ...ready, sessionId })
       }

package/lib/vendors/claude.js

@@ -1,7 +1,8 @@
+import { createHash } from 'node:crypto'
 import { fetchWithTimeout } from '../http.js'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { anthropicPayload, modelCatalog } from '../messages.js'
-import { jsonTokenRequest, anthropicStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
+import { jsonTokenRequest, anthropicStream, httpError, tokenBlobFromOAuth, readJson , readErrorBody } from '../wire.js'
 import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
@@ -253,7 +254,7 @@ function applyClaudeThinking(payload, options) {
 export async function check(blob, _cfg, fetchImpl) {
   const impl = fetchImpl || fetch
   const res = await impl(PROFILE, { headers: oauthHeaders(blob.accessToken) })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   const json = await readJson(res)
   return { ok: true, raw: json }
 }
@@ -273,7 +274,7 @@ export async function usage(blob, _cfg, fetchImpl) {
 const billingAccountState = new Map()
 const MAX_BILLING_ACCOUNTS = 256
 
-function resolveAccountKey(cfg, context) {
+export function resolveAccountKey(cfg, context) {
   const explicit = (context && context.accountId) || (cfg && cfg.accountId)
   if (typeof explicit === 'string' && explicit.trim()) return explicit.trim()
   const blob = (context && context.blob) || (cfg && cfg.blob)
@@ -281,7 +282,7 @@ function resolveAccountKey(cfg, context) {
     const id = blob.accountId || blob.id || blob.email
     if (typeof id === 'string' && id.trim()) return id.trim()
     if (typeof blob.accessToken === 'string' && blob.accessToken.length >= 8) {
-      return `token:${blob.accessToken.slice(-12)}`
+      return 'token:' + createHash('sha256').update(String(blob.accessToken)).digest('hex').slice(0, 16)
     }
   }
   return 'default'
@@ -357,6 +358,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     body: JSON.stringify(payload),
     signal,
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* anthropicStream(res.body)
 }

package/lib/vendors/codex.js

@@ -3,7 +3,7 @@ import { randomUUID, createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { codexResponsesBody, modelCatalog } from '../messages.js'
 import { chatgptAccountId, emailFromToken, planFromToken, avatarFromToken, scopesFromToken, organizationsFromToken } from '../jwt.js'
-import { formTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError } from '../wire.js'
+import { formTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError , readErrorBody } from '../wire.js'
 import { asUsageSnapshot, usageWindows, deepestUsedPercent } from '../usage.js'
 
 export const id = 'codex'
@@ -129,7 +129,7 @@ export async function deviceStart(cfg, fetchImpl) {
     headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify({ client_id: cfg.clientId }),
   })
-  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res), 'DEVICE')
   const json = await readJson(res)
   if (!json || typeof json.user_code !== 'string' || typeof json.device_auth_id !== 'string') {
     throw httpError(502, 'device auth response is incomplete', 'DEVICE')
@@ -151,7 +151,7 @@ export async function devicePoll(cfg, session, fetchImpl) {
   })
   // 403/404 = not confirmed yet (matches reference implementations)
   if (res.status === 403 || res.status === 404) return { status: 'pending' }
-  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res), 'DEVICE')
   const json = await readJson(res)
   if (!json || typeof json.authorization_code !== 'string' || typeof json.code_verifier !== 'string') {
     throw httpError(502, 'device auth token response is incomplete', 'DEVICE')
@@ -218,7 +218,7 @@ export async function check(blob, cfg, fetchImpl) {
   const res = await fetchWithTimeout(impl, base + "/models?client_version=" + encodeURIComponent(version), {
     headers: identityHeaders(blob, cfg, { Accept: "application/json" }),
   }, { timeoutMs: 15000 })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   const json = await readJson(res)
   // quota headers may contain limits
   return { ok: true, raw: json }
@@ -272,7 +272,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     body: JSON.stringify(body),
     signal,
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* codexResponsesStream(res.body)
 }
 export function deriveSessionId(options) {

package/lib/vendors/cody.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { openaiChatStream, httpError , readErrorBody } from '../wire.js'
 
 export const id = 'cody'
 const CODY_API_BASE = 'https://sourcegraph.com/.api'
@@ -75,6 +75,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/copilot-cli.js

@@ -11,6 +11,12 @@ import { LlmError } from '@deepseek-ai/dsh-llm'
 const MAX_STDERR_CHARS = 2048
 const GITHUB_TOKEN_PATTERN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g
 
+const COPILOT_CLI_BASENAME = /^(?:copilot|github-copilot-cli|copilot-cli)(?:\.(?:cmd|bat|exe))?$/i
+
+export function isAllowedCopilotBinary(binaryPath) {
+  return COPILOT_CLI_BASENAME.test(String(binaryPath || '').split(/[\\/]/).pop())
+}
+
 export function redactCopilotStderr(text) {
   return String(text || '').replace(GITHUB_TOKEN_PATTERN, '[REDACTED]')
 }
@@ -134,9 +140,14 @@ export async function readCopilotCredentials(home, env = process.env) {
 export function findCopilotCli(customPath, env = process.env, platform = process.platform) {
   if (customPath && typeof customPath === 'string' && customPath.trim()) {
     const p = customPath.trim()
-    try {
-      if (existsSync(p)) return p
-    } catch { /* best-effort */ }
+    let exists = false
+    try { exists = existsSync(p) } catch { /* best-effort */ }
+    if (exists) {
+      if (!isAllowedCopilotBinary(p)) {
+        throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+      }
+      return p
+    }
   }
 
   const pathVar = env.PATH || ''
@@ -265,6 +276,9 @@ export function resolveSpawnCommand(binaryPath, args, platform = process.platfor
  * @returns {AsyncGenerator<any, void, unknown>}
  */
 export async function* streamCopilotCli({ binaryPath, options, blob, config: _config, signal, spawnImpl }) {
+  if (!isAllowedCopilotBinary(binaryPath)) {
+    throw new Error('copilotCliPath must point to a copilot binary (copilot, github-copilot-cli or copilot-cli)')
+  }
   if (signal && signal.aborted) {
     throw new LlmError('Request aborted by client', 'ABORTED')
   }
@@ -283,9 +297,17 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
     throw new LlmError(`Failed to spawn Copilot CLI: ${err && err.message ? err.message : err}`, 'INTERNAL_ERROR')
   }
 
+  let abortHandler = null
+  let killTimer = null
   if (signal) {
-    const abortHandler = () => {
+    abortHandler = () => {
       try { child.kill('SIGTERM') } catch { /* best-effort */ }
+      killTimer = setTimeout(() => {
+        if (!processEnded && !child.killed) {
+          try { child.kill('SIGKILL') } catch { /* best-effort */ }
+        }
+      }, 2000)
+      if (killTimer && typeof killTimer.unref === 'function') killTimer.unref()
     }
     signal.addEventListener('abort', abortHandler, { once: true })
   }
@@ -359,6 +381,7 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
     }
   })
 
+  try {
   while (true) {
     if (chunkQueue.length) {
       const line = chunkQueue.shift()
@@ -423,6 +446,10 @@ export async function* streamCopilotCli({ binaryPath, options, blob, config: _co
       if (processError && !chunkQueue.length) throw processError
     }
   }
+  } finally {
+    if (signal && abortHandler) signal.removeEventListener('abort', abortHandler)
+    if (killTimer) clearTimeout(killTimer)
+  }
 
   yield {
     type: 'finish',

package/lib/vendors/copilot.js

@@ -1,7 +1,7 @@
 import { LlmError } from "@deepseek-ai/dsh-llm"
 import { openaiMessages, openaiTools, modelCatalog } from "../messages.js"
 import { fetchWithTimeout } from "../http.js"
-import { openaiChatStream, readJson, httpError } from "../wire.js"
+import { openaiChatStream, readJson, httpError , readErrorBody } from "../wire.js"
 import { findCopilotCli, streamCopilotCli, isCopilotCliAvailable, COPILOT_CLI_BINARIES } from "./copilot-cli.js"
 
 export const id = "copilot"
@@ -148,7 +148,7 @@ export async function requestDeviceCode(fetchImpl) {
       scope: "read:user"
     })
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   return readJson(res)
 }
 
@@ -166,7 +166,7 @@ export async function pollDeviceToken(deviceCode, fetchImpl) {
       grant_type: "urn:ietf:params:oauth:grant-type:device_code"
     })
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   return readJson(res)
 }
 
@@ -259,7 +259,7 @@ async function exchangeCopilotToken(githubToken, fetchImpl) {
       "User-Agent": "GitHubCopilotChat/0.24.0"
     }
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   return readJson(res)
 }
 
@@ -354,6 +354,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/cursor.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools, modelCatalog } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, readJson, httpError , readErrorBody } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'cursor'
@@ -201,6 +201,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/ernie.js

@@ -1,11 +1,17 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, readJson, httpError , readErrorBody } from '../wire.js'
 
 export const id = 'ernie'
 export const ERNIE_OAUTH_URL = 'https://aip.baidubce.com/oauth/2.0/token'
 const ERNIE_BASE_URL = 'https://aip.baidubce.com/rpc/2.0/ai_custom/v1/wenxinworkshop/chat'
 
+export function ernieChatUrl(token, endpoint, baseUrl = ERNIE_BASE_URL) {
+  // #636: the v1 Qianfan endpoint requires access_token in the query. Always
+  // encode it so & and # cannot truncate or inject query parameters.
+  return baseUrl + '/' + endpoint + '?access_token=' + encodeURIComponent(token)
+}
+
 const ERNIE_MODELS = [
   {
     id: 'ernie-speed-128k',
@@ -53,7 +59,7 @@ async function refreshErnieToken(apiKey, secretKey, fetchImpl) {
       client_secret: secretKey,
     }),
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   return readJson(res)
 }
 
@@ -74,7 +80,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   if (!token) throw new LlmError('Baidu ERNIE requires access token or API Key + Secret Key', 'AUTH')
 
   const endpoint = options.model === 'ernie-4.0-turbo-8k' ? 'completions_pro' : 'ernie_speed'
-  const url = `${(config && config.apiBase) || ERNIE_BASE_URL}/${endpoint}?access_token=${token}`
+  const url = ernieChatUrl(token, endpoint, (config && config.apiBase) || ERNIE_BASE_URL)
 
   const messages = openaiMessages(options).map((m) => ({
     role: m.role === 'system' ? 'user' : m.role,
@@ -91,6 +97,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/glm.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools, modelCatalog } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, readJson, httpError , readErrorBody } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'glm'
@@ -109,6 +109,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/grok.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { modelCatalog, codexResponsesBody } from '../messages.js'
-import { formTokenRequest, codexResponsesStream, httpError, tokenBlobFromOAuth, readJson } from '../wire.js'
+import { formTokenRequest, codexResponsesStream, httpError, tokenBlobFromOAuth, readJson , readErrorBody } from '../wire.js'
 import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 import { asUsageSnapshot, usageWindows, grokBillingPercent } from '../usage.js'
 
@@ -250,7 +250,7 @@ export async function listModels(blob, cfg, fetchImpl) {
 export async function check(blob, cfg, fetchImpl) {
   const impl = fetchImpl || fetch
   const res = await impl(MODELS, { headers: { Authorization: "Bearer " + blob.accessToken, Accept: "application/json" } })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   const json = await readJson(res)
   return { ok: true, raw: json }
 }
@@ -308,7 +308,7 @@ export async function deviceStart(cfg, fetchImpl) {
     },
     body: params.toString(),
   })
-  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res), 'DEVICE')
   const json = await readJson(res)
   if (!json || typeof json.user_code !== 'string' || typeof json.device_code !== 'string') {
     throw httpError(502, 'xAI device authorization response is incomplete', 'DEVICE')
@@ -338,7 +338,7 @@ export async function devicePoll(cfg, session, fetchImpl) {
     body: params.toString(),
   })
   if (res.status === 400 || res.status === 403) {
-    const rawText = await res.text().catch(() => '')
+    const rawText = await readErrorBody(res)
     let errJson = {}
     try {
       errJson = JSON.parse(rawText)
@@ -356,7 +356,7 @@ export async function devicePoll(cfg, session, fetchImpl) {
     }
     throw httpError(res.status, rawText, 'DEVICE')
   }
-  if (!res.ok) throw httpError(res.status, await res.text().catch(() => ''), 'DEVICE')
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res), 'DEVICE')
   const json = await readJson(res)
   if (!json || typeof json.access_token !== 'string') {
     throw httpError(502, 'xAI device token response is incomplete', 'DEVICE')
@@ -391,7 +391,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     body: JSON.stringify(body),
     signal,
   })
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* codexResponsesStream(res.body)
 }
 

package/lib/vendors/jetbrains.js

@@ -4,7 +4,7 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { openaiMessages, modelCatalog } from '../messages.js'
-import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson } from '../wire.js'
+import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson , readErrorBody } from '../wire.js'
 import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 
 export const id = 'jetbrains'
@@ -193,6 +193,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/kimi.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools, modelCatalog } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, readJson, httpError , readErrorBody } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'kimi'
@@ -116,6 +116,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/kiro.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools, modelCatalog } from '../messages.js'
-import { openaiChatStream, readJson, httpError } from '../wire.js'
+import { openaiChatStream, readJson, httpError , readErrorBody } from '../wire.js'
 import { asUsageSnapshot } from '../usage.js'
 
 export const id = 'kiro'
@@ -112,6 +112,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/perplexity.js

@@ -4,7 +4,7 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { openaiMessages, modelCatalog } from '../messages.js'
-import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson } from '../wire.js'
+import { jsonTokenRequest, tokenBlobFromOAuth, openaiChatStream, httpError, readJson , readErrorBody } from '../wire.js'
 import { emailFromToken, planFromToken, avatarFromToken, scopesFromToken } from '../jwt.js'
 
 export const id = 'perplexity'
@@ -205,6 +205,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal,
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/qwen.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages, openaiTools } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { openaiChatStream, httpError , readErrorBody } from '../wire.js'
 
 export const id = 'qwen'
 const QWEN_API_BASE = 'https://dashscope.aliyuncs.com/compatible-mode/v1'
@@ -81,6 +81,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/replit.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { openaiChatStream, httpError , readErrorBody } from '../wire.js'
 
 export const id = 'replit'
 const REPLIT_API_BASE = 'https://replit.com/api/v1/ai'
@@ -64,6 +64,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/vendors/spark.js

@@ -1,6 +1,6 @@
 import { LlmError } from '@deepseek-ai/dsh-llm'
 import { openaiMessages } from '../messages.js'
-import { openaiChatStream, httpError } from '../wire.js'
+import { openaiChatStream, httpError , readErrorBody } from '../wire.js'
 
 export const id = 'spark'
 const SPARK_API_BASE = 'https://spark-api-open.xf-yun.com/v1'
@@ -68,6 +68,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     signal
   })
 
-  if (!res.ok) throw httpError(res.status, await res.text())
+  if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* openaiChatStream(res.body)
 }

package/lib/wire.js

@@ -432,4 +432,30 @@ export async function jsonTokenRequest(url, body, fetchImpl, headers, { timeoutM
     body: JSON.stringify(body),
   }, { timeoutMs })
   return readJson(res)
-}
+}
+
+export async function readErrorBody(res, maxChars = 4096) {
+  if (!res || typeof res !== 'object') return ''
+  try {
+    if (!res.body || typeof res.body.getReader !== 'function') {
+      const text = await res.text()
+      return String(text || '').slice(0, maxChars)
+    }
+    const reader = res.body.getReader()
+    const decoder = new TextDecoder()
+    let out = ''
+    try {
+      while (out.length < maxChars) {
+        const { done, value } = await reader.read()
+        if (done) break
+        out += decoder.decode(value, { stream: true })
+      }
+      out += decoder.decode()
+    } finally {
+      if (typeof reader.cancel === 'function') await reader.cancel().catch(() => {})
+    }
+    return out.slice(0, maxChars)
+  } catch {
+    return ''
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.83",
+  "version": "0.6.85",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",