@goodandready/dsh-subscriptions 0.6.86 → 0.6.87

package/README.md

@@ -311,6 +311,7 @@ dsh-subscriptions:
 - Grok `baseUrl` overrides must point to `api.x.ai`, `grok.com` / `*.grok.com`, or a loopback host; other hosts are rejected with `GROK_UNTRUSTED_HOST` so bearer tokens never leave trusted xAI infrastructure.
 - Antigravity CLI imports must configure `antigravityClientSecret`; the embedded default was removed.
 - `copilotCliPath` must point to a `copilot`, `github-copilot-cli` or `copilot-cli` binary; rename custom wrappers.
+- Credential backup uses `/dsh-subscriptions/vault/export` and `/vault/import`; the legacy `/export`, `/import`, `/export-backup` and `/import-backup` routes were removed.
 - The error buffer and diagnostics reports redact bearer tokens, API keys, JWTs and `key=value` credentials before storing or returning them.
 
 

package/README.ru.md

@@ -284,6 +284,7 @@ dsh-subscriptions:
 - Переопределение Grok `baseUrl` должно указывать на `api.x.ai`, `grok.com` / `*.grok.com` или loopback-хост; остальные хосты отклоняются с `GROK_UNTRUSTED_HOST`, чтобы bearer-токен не покидал доверенную инфраструктуру xAI.
 - Импорт Antigravity CLI требует явного `antigravityClientSecret`; встроенный default удалён.
 - `copilotCliPath` должен указывать на бинарь `copilot`, `github-copilot-cli` или `copilot-cli`; кастомные обёртки переименуйте.
+- Бэкап credentials использует `/dsh-subscriptions/vault/export` и `/vault/import`; legacy-маршруты `/export`, `/import`, `/export-backup` и `/import-backup` удалены.
 - Error buffer и диагностические отчёты редактируют bearer-токены, API-ключи, JWT и `key=value`-credentials до сохранения и выдачи.
 
 

package/README.zh.md

@@ -190,6 +190,7 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 - Grok `baseUrl` 覆盖只能指向 `api.x.ai`、`grok.com` / `*.grok.com` 或回环主机；其他主机会以 `GROK_UNTRUSTED_HOST` 拒绝，避免 bearer 令牌离开可信的 xAI 基础设施。
 - Antigravity CLI 导入必须配置 `antigravityClientSecret`；内置默认值已移除。
 - `copilotCliPath` 必须指向 `copilot`、`github-copilot-cli` 或 `copilot-cli` 可执行文件；自定义包装器请重命名。
+- 凭据备份使用 `/dsh-subscriptions/vault/export` 和 `/vault/import`；旧路由 `/export`、`/import`、`/export-backup`、`/import-backup` 已移除。
 - 错误缓冲区和诊断报告会在存储或返回前脱敏 bearer 令牌、API 密钥、JWT 和 `key=value` 凭据。
 
 

package/lib/client.js

@@ -68,6 +68,16 @@ window.__ModuleLoader__.load({
       } catch { /* invalid url */ }
       return ''
     }
+
+    async function copyText(text) {
+      try {
+        if (typeof navigator === 'undefined' || !navigator.clipboard || typeof navigator.clipboard.writeText !== 'function') return false
+        await navigator.clipboard.writeText(String(text == null ? '' : text))
+        return true
+      } catch {
+        return false
+      }
+    }
     
     const en = {
       "syncModels": "Sync Models",
@@ -293,6 +303,9 @@ window.__ModuleLoader__.load({
       "howToGetTokenTitle": "How to get token / API key for this provider",
       "instructionsTitle": "How to obtain token",
       "close": "Close",
+      "cancel": "Cancel",
+      "quota": "Quota",
+      "subs5hWindow": "5h window",
       "reconnectRequired": "Reconnect required",
       "reconnectNow": "Re-authenticate now",
       "scopeWarning": "OAuth scope warning",
@@ -626,6 +639,9 @@ window.__ModuleLoader__.load({
       "howToGetTokenTitle": "如何获取此服务商的令牌或 API 密钥",
       "instructionsTitle": "获取令牌指引",
       "close": "关闭",
+      "cancel": "取消",
+      "quota": "配额",
+      "subs5hWindow": "5小时窗口",
       "reconnectRequired": "需要重新连接",
       "reconnectNow": "立即重新认证",
       "scopeWarning": "OAuth权限范围警告",
@@ -971,7 +987,7 @@ window.__ModuleLoader__.load({
             if (d && d.ok && d.report) setDiagReport(d.report)
             const txt = d && d.ok ? JSON.stringify(d.report, null, 2) : ('error: ' + ((d && d.error && d.error.message) || 'unknown'))
             setDiag(txt)
-            try { navigator.clipboard.writeText(txt) } catch { /* clipboard write disallowed */ }
+            copyText(txt)
           })
           .catch((e) => setDiag('error: ' + String(e && e.message || e)))
       }
@@ -1064,7 +1080,7 @@ window.__ModuleLoader__.load({
       const doExportBackup = async () => {
         setBackupErr(''); setBackupInfo(''); setBackupLoading(true)
         try {
-          const res = await fetch('/dsh-subscriptions/export-backup', {
+          const res = await fetch('/dsh-subscriptions/vault/export', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ passphrase: backupPass, algorithm: 'pbkdf2' }),
@@ -1082,7 +1098,7 @@ window.__ModuleLoader__.load({
       const doImportBackup = async () => {
         setBackupErr(''); setBackupInfo(''); setBackupLoading(true)
         try {
-          const res = await fetch('/dsh-subscriptions/import-backup', {
+          const res = await fetch('/dsh-subscriptions/vault/import', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ passphrase: backupPass, vault: backupData.trim() }),
@@ -1229,6 +1245,19 @@ window.__ModuleLoader__.load({
       const [err, setErr] = React.useState('')
       const [info, setInfo] = React.useState('')
       const [revision, setRevision] = React.useState(null)
+      const timersRef = React.useRef(new Set())
+      React.useEffect(() => () => {
+        for (const id of timersRef.current) clearTimeout(id)
+        timersRef.current.clear()
+      }, [])
+      const later = (fn, ms) => {
+        const id = setTimeout(() => {
+          timersRef.current.delete(id)
+          fn()
+        }, ms)
+        timersRef.current.add(id)
+        return id
+      }
 
       const applyPayload = (data) => {
         if (data && data.revision != null) setRevision(data.revision)
@@ -1238,19 +1267,29 @@ window.__ModuleLoader__.load({
         setModelsCatalog((data && data.modelsCatalog) || [])
       }
 
+      let reloadSeq = 0
+      let reloadAbort = null
       const reload = () => {
+        const seq = ++reloadSeq
+        if (reloadAbort) reloadAbort.abort()
+        const controller = new AbortController()
+        reloadAbort = controller
         const t0 = Date.now()
-        return fetch('/dsh-subscriptions/config', { cache: 'no-store' })
+        return fetch('/dsh-subscriptions/config', { cache: 'no-store', signal: controller.signal })
           .then((res) => res.json())
           .then((data) => {
+            if (seq !== reloadSeq) return data
             setHostPing({ ok: true, latencyMs: Date.now() - t0 })
             applyPayload(data)
             reloadTelemetry()
             return data
           })
           .catch((err) => {
-            setHostPing({ ok: false, latencyMs: null })
-            throw err
+            if (seq === reloadSeq && err && err.name !== 'AbortError') {
+              setHostPing({ ok: false, latencyMs: null })
+              throw err
+            }
+            return null
           })
       }
 
@@ -1258,7 +1297,10 @@ window.__ModuleLoader__.load({
         let alive = true
         reload().catch((e) => { if (alive) setErr(String(e && e.message ? e.message : e)) })
         checkUpdater().catch(() => {})
-        return () => { alive = false }
+        return () => {
+          alive = false
+          if (reloadAbort) reloadAbort.abort()
+        }
       }, [])
 
       // #90: poll device login while any slot is in 'pending' state.
@@ -1313,7 +1355,7 @@ window.__ModuleLoader__.load({
           throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
         }
         applyPayload(data)
-        setSaved(true); setTimeout(() => setSaved(false), 2000)
+        setSaved(true); later(() => setSaved(false), 2000)
       }
 
       const connect = async (provider, index) => {
@@ -1438,7 +1480,7 @@ window.__ModuleLoader__.load({
           if (!res.ok) throw new Error((data.error && data.error.message) || ("HTTP " + res.status))
           setAccounts(data.accounts || [])
           setInfo(t("toastQuarantined"))
-          setTimeout(() => setInfo(""), 3000)
+          later(() => setInfo(""), 3000)
         } catch (e) { setErr(cleanErrorMessage(e.message || e)) }
       }
 
@@ -1457,7 +1499,7 @@ window.__ModuleLoader__.load({
           setAccounts(data.accounts || [])
           if (data.success || data.released) {
             setInfo(t("toastReleased"))
-            setTimeout(() => setInfo(""), 3000)
+            later(() => setInfo(""), 3000)
           } else if (data.error) {
             setErr(cleanErrorMessage(data.error))
           }
@@ -1509,7 +1551,7 @@ window.__ModuleLoader__.load({
         if (data.config) applyPayload(data)
         else await reload()
         setInfo(t('importLocalSuccess'))
-        setTimeout(() => setInfo(''), 3000)
+        later(() => setInfo(''), 3000)
       }
 
       const importToken = async (provider, index) => {
@@ -2160,7 +2202,7 @@ window.__ModuleLoader__.load({
           diag ? h('div', { className: 'dsub-row' },
             h('button', {
               type: 'button', className: 'dsub-mini',
-              onClick: () => { try { navigator.clipboard.writeText(diag) } catch { /* clipboard write error */ } },
+              onClick: () => { copyText(diag) },
             }, t('diagCopy')),
             h('pre', { className: 'dsub-diag' }, diag),
           ) : null,
@@ -2255,7 +2297,7 @@ window.__ModuleLoader__.load({
                       className: 'dsub-mini',
                       onClick: () => {
                         const txt = JSON.stringify(wizardModal.report, null, 2)
-                        try { navigator.clipboard.writeText(txt) } catch { /* ignore */ }
+                        copyText(txt)
                       },
                     }, '📋 ' + t('wizardCopy')),
                   ),
@@ -2327,7 +2369,7 @@ window.__ModuleLoader__.load({
                 h('button', {
                   type: 'button',
                   className: 'dsub-mini',
-                  onClick: () => { try { navigator.clipboard.writeText(backupData) } catch { /* ignore */ } },
+                  onClick: () => { copyText(backupData) },
                 }, t('diagCopy')),
                 h('button', {
                   type: 'button',
@@ -2504,11 +2546,11 @@ window.__ModuleLoader__.load({
                       type: 'button',
                       className: 'dsub-mini',
                       onClick: () => {
-                        try {
-                          navigator.clipboard.writeText(headlessInfo[key].sshTunnelCommand)
+                        copyText(headlessInfo[key].sshTunnelCommand).then((ok) => {
+                          if (!ok) return
                           setCopiedSsh((m) => Object.assign({}, m, { [key]: true }))
-                          setTimeout(() => setCopiedSsh((m) => Object.assign({}, m, { [key]: false })), 2000)
-                        } catch { /* ignore */ }
+                          later(() => setCopiedSsh((m) => Object.assign({}, m, { [key]: false })), 2000)
+                        })
                       }
                     }, copiedSsh[key] ? ('✓ ' + t('headlessCopied')) : ('📋 ' + t('headlessCopySsh')))
                   ),
@@ -2676,7 +2718,7 @@ window.__ModuleLoader__.load({
                       h('div', { className: 'dsub-row' },
                         h('button', {
                           type: 'button', className: 'dsub-mini',
-                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch { /* clipboard write error */ } },
+                          onClick: () => { copyText(d.userCode) },
                         }, t('deviceCopy')),
                         h('a', { href: safeExternalUrl(d.authUrl) || undefined, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
@@ -3684,7 +3726,7 @@ window.__ModuleLoader__.load({
               if (target) {
                 const popup = window.open(target, '_blank', 'noopener')
                 if (!popup) {
-                  try { navigator.clipboard.writeText(target) } catch { /* clipboard blocked */ }
+                  copyText(target)
                 }
               }
             }).catch(() => {})

package/lib/index.js

@@ -11,7 +11,7 @@ import { webCallbackUri } from './oauth.js'
 import { getVendor, registerCustomVendor, clearCustomVendors } from './vendors/index.js'
 import { generateOnce, SIZES as IMAGE_SIZES } from './images.js'
 import { parseBlob } from './blob.js'
-import { createVendorFromProfile, validateProfile } from './vendor-factory.js'
+import { createVendorFromProfile, validateProfiles } from './vendor-factory.js'
 import { registerCustomProviderIds, registerDisplayName } from './refs.js'
 import { createSubscriptionsService } from './subscriptions.js'
 import { createAccountStore, normalizeSlots, vendorConfig } from './accounts.js'
@@ -86,13 +86,7 @@ export function apply(ctx, rawConfig) {
   const live = () => cachedConfig
 
   function syncCustomVendors() {
-    let profiles
-    try {
-      profiles = (live().customVendors || []).map(validateProfile)
-    } catch (e) {
-      if (logger && logger.warn) logger.warn('[dsh-subscriptions] customVendors: ' + String(e && e.message || e))
-      return
-    }
+    const profiles = validateProfiles(live().customVendors)
     clearCustomVendors()
     for (const profile of profiles) {
       try {

package/lib/routes/accounts.js

@@ -5,11 +5,10 @@ import { normalizeSlots, vendorConfig } from '../accounts.js'
 import { getVendor } from '../vendors/index.js'
 import { notifyQuarantineEntered, notifyQuarantineReleased } from '../alerts.js'
 import { Config, plainConfig, publicConfig, revisionOf } from '../config-schema.js'
-import { decryptWithPassphrase, encryptWithPassphrase } from '../crypto.js'
 import { isTrustedSettingsRequest, queryOf, readBody, safeJsonHandler, writeJson } from '../http.js'
 import { discoverLocalCliSessions, loadLocalCliBlob } from '../import-auth.js'
 import { validateCredentialBlob } from '../blob.js'
-import { isProvider, oauthRef, parseOauthRef } from '../refs.js'
+import { isProvider, oauthRef } from '../refs.js'
 
 export function registerAccountsRoutes(ctx, state) {
   const {
@@ -308,100 +307,6 @@ export function registerAccountsRoutes(ctx, state) {
   }), 'dsh-subscriptions: /import-local')
 
 
-  // Export of the encrypted token bundle. Tokens are never logged.
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-subscriptions/export',
-    handler: safeJsonHandler(async (req, res) => {
-      if (req.method !== 'POST') {
-        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
-        return
-      }
-      if (!isTrustedSettingsRequest(req, ctx)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
-      let payload
-      try { payload = JSON.parse((await readBody(req, 8 * 1024)).toString('utf8') || '{}') } catch {
-        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
-        return
-      }
-      const passphrase = String(payload.passphrase || '').trim()
-      if (!passphrase || passphrase.length < 12) {
-        writeJson(res, 400, { ok: false, error: { code: 'passphrase', message: 'passphrase must be at least 12 characters' } })
-        return
-      }
-      const algorithm = payload.algorithm === 'scrypt' ? 'scrypt' : (payload.algorithm === 'scrypt-v2' || payload.algorithm === 'scrypt-hardened' ? payload.algorithm : 'pbkdf2')
-      try {
-        const accounts = []
-        for (const slot of normalizeSlots(live().slots)) {
-          try {
-            const blob = await store.loadBlob(slot.ref)
-            accounts.push({ ref: slot.ref, provider: slot.provider, index: slot.index, label: slot.label || blob.label || '', blob })
-          } catch { /* skip missing */ }
-        }
-        if (!accounts.length) {
-          writeJson(res, 200, { ok: false, error: { code: 'empty', message: 'no connected accounts' } })
-          return
-        }
-        const bundle = JSON.stringify({ v: 1, exportedAt: Date.now(), accounts })
-        const encrypted = encryptWithPassphrase(bundle, passphrase, { algorithm })
-        writeJson(res, 200, { ok: true, payload: encrypted, count: accounts.length })
-      } catch (e) {
-        writeJson(res, 500, { ok: false, error: { code: 'export', message: String(e && e.message || e) } })
-      }
-    }),
-  }), 'dsh-subscriptions: /export')
-
-
-  // Import of the encrypted bundle.
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-subscriptions/import',
-    handler: safeJsonHandler(async (req, res) => {
-      if (req.method !== 'POST') {
-        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
-        return
-      }
-      if (!isTrustedSettingsRequest(req, ctx)) {
-        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
-        return
-      }
-      let payload
-      try { payload = JSON.parse((await readBody(req, 1024 * 1024)).toString('utf8') || '{}') } catch {
-        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
-        return
-      }
-      const { passphrase, payload: encrypted } = payload
-      if (!passphrase || !encrypted) {
-        writeJson(res, 400, { ok: false, error: { code: 'params', message: 'passphrase and payload are required' } })
-        return
-      }
-      let bundle
-      try {
-        bundle = JSON.parse(decryptWithPassphrase(encrypted, passphrase))
-      } catch {
-        writeJson(res, 400, { ok: false, error: { code: 'decrypt', message: 'wrong passphrase or corrupted bundle' } })
-        return
-      }
-      if (!bundle || !Array.isArray(bundle.accounts)) {
-        writeJson(res, 400, { ok: false, error: { code: 'format', message: 'invalid bundle format' } })
-        return
-      }
-      let imported = 0
-      for (const row of bundle.accounts) {
-        try {
-          if (!row || typeof row.ref !== 'string' || !parseOauthRef(row.ref) || !row.blob) continue
-          await store.saveBlob(row.ref, validateCredentialBlob(row.blob))
-          imported++
-        } catch { /* skip broken */ }
-      }
-      await syncAdapter()
-      writeJson(res, 200, { ok: true, imported, total: bundle.accounts.length, accounts: await accountsView() })
-    }),
-  }), 'dsh-subscriptions: /import')
-
-
   // #45: import an existing refresh token / API key without an OAuth flow.
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -659,12 +564,6 @@ export function registerAccountsRoutes(ctx, state) {
     handler: handleVaultExport,
   }), 'dsh-subscriptions: /vault/export')
 
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-subscriptions/export-backup',
-    handler: handleVaultExport,
-  }), 'dsh-subscriptions: /export-backup')
-
   const handleVaultImport = safeJsonHandler(async (req, res) => {
     if (req.method !== 'POST') {
       writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
@@ -728,12 +627,6 @@ export function registerAccountsRoutes(ctx, state) {
     handler: handleVaultImport,
   }), 'dsh-subscriptions: /vault/import')
 
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-subscriptions/import-backup',
-    handler: handleVaultImport,
-  }), 'dsh-subscriptions: /import-backup')
-
 
   // #562: Remote Vault Sync Push
   ctx.effect(() => ctx.webServer.register({

package/lib/routes/proxy.js

@@ -40,7 +40,7 @@ export function registerProxyRoutes(ctx, state) {
   // The token never leaves the process - only the provider's response goes out.
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
-    path: '/dsh-subscriptions/proxy',
+    path: '/dsh-subscriptions/proxy/',
     handler: safeJsonHandler(async (req, res) => {
       if (req.method !== 'POST' && req.method !== 'GET') {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or POST' } })

package/lib/updater.js

@@ -4,60 +4,15 @@ import { readFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { basename, dirname, isAbsolute, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { isTrustedSettingsRequest, writeJson } from './http.js'
+import { isLoopback, isTrustedSettingsRequest, writeJson } from './http.js'
 
-const UPDATE_HEADER = 'x-dsh-plugin-update'
 const UPDATE_TIMEOUT_MS = 10 * 60_000
 const VERSION_CACHE_MS = 5 * 60_000
 let latestCache
 
-function header(request, name) {
-  const value = request.headers?.[name]
-  return Array.isArray(value) ? value[0] : value
-}
-
-function isLoopbackIPv4(address) {
-  if (!address || !address.startsWith('127.')) return false
-  const parts = address.split('.')
-  if (parts.length !== 4) return false
-  return parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255)
-}
-
-export function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  if (!address) return false
-  if (address === 'localhost' || address === 'localhost.' || address === '::1') return true
-  const ipv4 = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address
-  return isLoopbackIPv4(ipv4)
-}
+export { isLoopback }
 
 export function isTrustedUpdateRequest(request, targetCtx) {
-  const secFetchSite = String(header(request, 'sec-fetch-site') || '').toLowerCase()
-  if (secFetchSite === 'cross-site') return false
-
-  const origin = header(request, 'origin')
-  const host = header(request, 'host')
-  if (origin && host) {
-    try {
-      const u = new URL(origin)
-      if (u.protocol === 'http:' || u.protocol === 'https:') {
-        if (u.host.toLowerCase() !== host.toLowerCase()) return false
-      } else if (u.protocol === 'dsh-app:') {
-        const appHost = u.host.toLowerCase()
-        if (appHost && appHost !== 'app' && appHost !== 'localhost') return false
-      } else {
-        return false
-      }
-    } catch {
-      return false
-    }
-  }
-
-  const customHeader = header(request, UPDATE_HEADER)
-  if (customHeader === '1') {
-    const remote = request.socket?.remoteAddress
-    if (remote && isLoopback(remote)) return true
-  }
   return isTrustedSettingsRequest(request, targetCtx)
 }
 

package/lib/vendor-factory.js

@@ -12,6 +12,7 @@ import { buildAuthorizeUrl } from "./oauth.js"
 import { codexResponsesBody, modelCatalog } from "./messages.js"
 import { formTokenRequest, jsonTokenRequest, codexResponsesStream, readJson, tokenBlobFromOAuth, httpError , readErrorBody } from "./wire.js"
 import { emailFromToken } from "./jwt.js"
+import { BUILTIN_PROVIDERS } from "./refs.js"
 
 function defaultModels(providerId, models) {
   return modelCatalog(providerId, (models || []).map((row) => (typeof row === "string" ? { id: row, name: row } : row)))
@@ -108,12 +109,6 @@ export function createVendorFromProfile(profile) {
         return catalog
       }
     },
-    async usage() {
-      // Arbitrary services have no universal usage endpoint - the quota
-      // snapshot is filled from ratelimit headers via the adapter quotaFetch.
-      return null
-    },
-    check: undefined,
     async* streamOnce({ blob, options, fetchImpl, headers, signal }) {
       const body = codexResponsesBody(options, "")
       if (!body.instructions) delete body.instructions
@@ -141,6 +136,7 @@ export function validateProfile(raw) {
     if (!p[key] || typeof p[key] !== "string") throw new Error(`customVendors[${p.id || "?"}]: field ${key} is required`)
   }
   if (!/^[a-z][a-z0-9_]*$/.test(p.id)) throw new Error(`customVendors: id "${p.id}" must match [a-z][a-z0-9_]*`)
+  if (BUILTIN_PROVIDERS.includes(p.id)) throw new Error(`customVendors: id "${p.id}" conflicts with a built-in provider`)
   if (p.tokenStyle && !["form", "json"].includes(p.tokenStyle)) throw new Error(`customVendors[${p.id}]: tokenStyle must be form|json`)
   const localHostnames = new Set(["localhost", "127.0.0.1", "::1", "[::1]"])
   for (const key of ["authUrl", "tokenUrl", "baseUrl"]) {
@@ -170,4 +166,15 @@ export function validateProfile(raw) {
     models: Array.isArray(p.models) ? p.models : [],
     headers: p.headers && typeof p.headers === "object" ? p.headers : {},
   }
+}
+
+/** Validates a list of profiles, skipping invalid entries individually. */
+export function validateProfiles(list) {
+  const out = []
+  for (const raw of Array.isArray(list) ? list : []) {
+    try {
+      out.push(validateProfile(raw))
+    } catch { /* skip invalid profile */ }
+  }
+  return out
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.86",
+  "version": "0.6.87",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",