@goodandready/dsh-subscriptions 0.6.87 → 0.6.89

package/lib/accounts.js

@@ -380,6 +380,10 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         pacePerHour: info.pacePerHour || 0,
         maxConcurrency: slot.maxConcurrency !== undefined ? slot.maxConcurrency : (curConfig.accountMaxConcurrency || 1),
         maxQueueSize: slot.maxQueueSize > 0 ? Number(slot.maxQueueSize) : (curConfig.maxQueueSize || 20),
+        vipOnly: !!slot.vipOnly,
+        tags: Array.isArray(slot.tags) ? slot.tags : [],
+        weight: Number(slot.weight) || 0,
+        isPro: !!slot.isPro,
       })
     }
     return out

package/lib/client.js

@@ -83,18 +83,13 @@ window.__ModuleLoader__.load({
       "syncModels": "Sync Models",
       "syncModelsTitle": "Discover and synchronize available models from vendor API",
       "modelsSynced": "Models synchronized",
-      "doctorDiagnosis": "Doctor Verdict",
       "recommendation": "Recommendation",
-      "pingTitle": "Measure network latency to provider API",
       "notConnected": "Not connected",
       "verifyAccount": "Verify account",
       "coolingDown": "Cooling down",
       "usageFull": "Usage 100%",
       "connected": "Connected",
       "title": "Subscriptions",
-      "cardIntro": "Subscription accounts, rotation and limits.",
-      "show": "Show",
-      "hide": "Hide",
       "intro": "Log in with a consumer subscription. Tokens stay on the host credentials store. The browser never reads them back. After Connect, if the provider lands on localhost or a vendor page, paste the redirected URL or the code here.",
       "useOrigin": "Use this Web UI origin as OAuth redirect_uri",
       "useOriginHint": "Leave off unless you registered your own OAuth client for this origin. Vendor CLI clients usually require their published redirect URI plus the paste step.",
@@ -135,8 +130,6 @@ window.__ModuleLoader__.load({
       "copilotCliPathHint": "Optional path to copilot or github-copilot-cli binary.",
       "ollamaFallback": "Ollama local fallback",
       "ollamaFallbackHint": "Automatically route queries to a local Ollama instance when cloud quota is exhausted.",
-      "ollamaBaseUrl": "Ollama Base URL",
-      "ollamaFallbackModel": "Ollama Fallback Model",
       "advancedSettings": "Advanced Settings & Monitoring",
       "cooldownMs": "Failure cooldown (minutes)",
       "cooldownMsHint": "How long to pause a failing or rate-limited account before retrying.",
@@ -146,12 +139,10 @@ window.__ModuleLoader__.load({
       "notifyLimitsHint": "Show notification alerts when account usage reaches quota ceiling.",
       "hostOnline": "Host online",
       "hostOffline": "Host unreachable",
-      "statsTitle": "Session Telemetry",
       "statsRequests": "Successful / Total Requests",
       "statsLatency": "Avg Response Latency",
       "statsSuccessRate": "Session Success Rate",
       "statsLastActivity": "Last Activity",
-      "smokeTitle": "Connection Smoke Test (Ping)",
       "smokeDesc": "Test live upstream connectivity and measure round-trip latency to the subscription provider.",
       "runSmoke": "⚡ Run Smoke Test (Ping)",
       "smokeTesting": "Pinging…",
@@ -189,10 +180,7 @@ window.__ModuleLoader__.load({
       "capabilitiesHint": "Subscription capabilities, context window and model features",
       "orPasteVaultPayload": "or paste vault payload below",
       "workspaceTitle": "Organization / Workspace",
-      "workspaceSelect": "Select active organization/workspace",
-      "personalWorkspace": "Personal Default",
       "windowResetsAt": "Window resets at",
-      "quotaRecovery": "Quota recovery",
       "toastCooldownRecovered": "is now available (cooldown expired)",
       "modelsCatalogTitle": "Curated Subscription Models",
       "modelsCatalogDesc": "Available model catalog across active subscriptions in DeepSeek Harness.",
@@ -211,7 +199,6 @@ window.__ModuleLoader__.load({
       "resetCreditsHint": "ChatGPT reset cards: emergency reset for the 5-hour window. Requires a 5s confirmation.",
       "resetCreditsAction": "Reset ChatGPT Limit",
       "usageLimitsTitle": "Usage Limits",
-      "slotDetailsTitle": "Slot Details",
       "resetAvailable": "Reset attempts available",
       "resetExpires": "earliest expires",
       "resetAck": "I understand one attempt will be consumed",
@@ -232,23 +219,17 @@ window.__ModuleLoader__.load({
       "tokensSaved": "Saved Tokens",
       "subsPill": "SUBS",
       "subsModalTitle": "Subscription Hub",
-      "subsActiveHero": "Active Subscription",
       "subsPoolTitle": "Provider Accounts",
       "subsRefresh": "Refresh",
       "subsOpenSettings": "All Settings →",
-      "subsFastMode": "Fast Mode 1.5x",
-      "subsHealthy": "Healthy",
       "subsFree": "free",
       "subsUsed": "used",
-      "subsModalClose": "Close",
       "subsLogged": "connected",
       "subsNotLogged": "not connected",
       "subsCooldown": "cooldown",
-      "hudTitle": "Subscription balance",
       "settingsLoading": "Loading settings…",
       "settingsUnavailable": "Settings are unavailable",
       "settingsRetry": "Retry",
-      "hudHint": "drag · edge docks · click refresh",
       "fcCalibrating": "calibrating…",
       "fcIdle": "no usage",
       "fcHours": "h",
@@ -276,23 +257,14 @@ window.__ModuleLoader__.load({
       "addAccount": "+ Add account",
       "save": "Save",
       "saved": "Saved",
-      "loading": "Loading…",
-      "unavailable": "Settings are unavailable",
       "accountLabel": "Account",
       "plan": "Plan",
       "storedAs": "Stored as",
-      "switchLabel": "Provider",
-      "chipActive": "Subscriptions",
-      "expiryLabel": "expires",
       "slashLogin": "Login to a subscription provider",
       "slashLogout": "Log out a subscription provider",
-      "slashStatus": "Subscription status",
-      "none": "none",
       "forecast": "≈",
       "windowPrimary": "Primary window",
       "windowSecondary": "Secondary window",
-      "resetLabel": "reset",
-      "check": "Check",
       "checking": "Checking…",
       "importToken": "Save token",
       "importTokenPlace": "Paste token or API key",
@@ -302,7 +274,12 @@ window.__ModuleLoader__.load({
       "howToGetToken": "❓ Instructions",
       "howToGetTokenTitle": "How to get token / API key for this provider",
       "instructionsTitle": "How to obtain token",
-      "close": "Close",
+      "lang": "en",
+      "cardIntro": "Subscription accounts, rotation and limits.",
+      "loading": "Loading…",
+      "unavailable": "Settings are unavailable",
+      "error": "Error",
+      "settingsError": "Settings error",
       "cancel": "Cancel",
       "quota": "Quota",
       "subs5hWindow": "5h window",
@@ -313,8 +290,6 @@ window.__ModuleLoader__.load({
       "sessionRevokedBadge": "Revoked / Expired",
       "sessionRevokedWarning": "Session expired / revoked — re-authorization required",
       "manualTitle": "If the browser did not come back",
-      "updateChecking": "Checking updates…",
-      "updateUpToDate": "Up to date",
       "updateAvailable": "Update available",
       "updateNow": "Update",
       "updating": "Updating…",
@@ -339,7 +314,6 @@ window.__ModuleLoader__.load({
       "backupImportAction": "Import",
       "backupPassphrase": "Vault Passphrase (min 12 chars)",
       "backupExportHint": "Encrypt connected subscription accounts and slots with AES-256-GCM. ⚠️ Contains sensitive OAuth refresh tokens; use a strong password (min 12 chars).",
-      "vaultTokenWarning": "⚠️ Contains sensitive OAuth refresh tokens",
       "backupImportHint": "Restore encrypted subscription accounts and credentials from a vault payload.",
       "backupPayloadPlaceholder": "Paste DSHE... encrypted string here",
       "backupExportOk": "Backup exported successfully",
@@ -354,10 +328,7 @@ window.__ModuleLoader__.load({
       "resetsIn": "Resets in",
       "toastQuarantined": "Account placed in quarantine",
       "toastReleased": "Account active and healthy",
-      "toastQuotaWarning": "Quota threshold exceeded",
-      "enableToasts": "In-app toast alerts",
       "headlessTip": "Headless / Remote Server?",
-      "headlessSshCommand": "SSH Port Forward Command:",
       "headlessCopySsh": "Copy SSH Command",
       "headlessCopied": "Copied!",
       "headlessScanQr": "Scan with Mobile to Authenticate:",
@@ -395,23 +366,14 @@ window.__ModuleLoader__.load({
       "wizardAll": "Account Wizard",
       "wizardIncludeNetwork": "Include active network checks (proxy ping & model catalog discovery)",
       "wizardRunning": "Running diagnostic checklist...",
-      "wizardStepCreds": "Credentials & Expiry",
-      "wizardStepProxy": "Proxy & Gateway",
-      "wizardStepToken": "Token Validation",
-      "wizardStepCatalog": "Model Catalog Reachability",
       "wizardHealthy": "Healthy",
       "wizardDegraded": "Degraded / Warnings",
       "wizardFailing": "Issues Detected",
       "wizardRecommendations": "Recommendations & Next Steps",
       "wizardCopy": "Copy Masked Diagnostic Report",
       "cachePinnedBadge": "Cache Pinned",
-      "field.enableToasts": "Show popup toast notifications on quarantine or quota events",
       "reasoningEffortTitle": "Reasoning Effort Control",
       "reasoningEffortDesc": "Configure reasoning depth for models with extended thinking capabilities.",
-      "reasoningLevelLow": "Low",
-      "reasoningLevelMed": "Medium",
-      "reasoningLevelHigh": "High",
-      "reasoningLevelMax": "Max",
       "reasoningLevelOff": "Off"
 };
 
@@ -419,18 +381,13 @@ window.__ModuleLoader__.load({
       "syncModels": "同步模型",
       "syncModelsTitle": "从服务商 API 实时发现并同步可用模型列表",
       "modelsSynced": "模型已同步",
-      "doctorDiagnosis": "诊断结论",
       "recommendation": "修复建议",
-      "pingTitle": "测试到服务商 API 的网络往返延迟",
       "notConnected": "未连接",
       "verifyAccount": "需要验证账户",
       "coolingDown": "冷却等待中",
       "usageFull": "用量已达 100%",
       "connected": "已连接",
       "title": "个人订阅管理",
-      "cardIntro": "AI 服务订阅账户、自动轮换与速率限制管理。",
-      "show": "展开",
-      "hide": "收起",
       "intro": "通过个人订阅登录。凭据安全保存在服务器端凭据库中，浏览器不回读敏感令牌。点击“连接”后，若页面跳转至 localhost 或服务商页面，请将重定向网址或授权代码粘贴到下方。",
       "useOrigin": "将当前 Web UI 地址作为 OAuth 重定向地址 (redirect_uri)",
       "useOriginHint": "除非您为当前域名申请了专属 OAuth 客户端，否则请保持关闭。官方 CLI 客户端通常需使用其公开重定向地址并配合粘贴代码流程。",
@@ -471,8 +428,6 @@ window.__ModuleLoader__.load({
       "copilotCliPathHint": "可选的 copilot 或 github-copilot-cli 二进制文件路径。",
       "ollamaFallback": "Ollama 本地模型自动兜底",
       "ollamaFallbackHint": "当云端配额耗尽或服务商故障时，自动将请求转发给本地 Ollama 实例。",
-      "ollamaBaseUrl": "Ollama 服务基础 URL",
-      "ollamaFallbackModel": "Ollama 兜底模型名称",
       "advancedSettings": "高级配置与监控",
       "cooldownMs": "故障与限流冷却时间（分钟）",
       "cooldownMsHint": "当账户遇到 429 或故障时暂停该账户的分钟数。",
@@ -482,12 +437,10 @@ window.__ModuleLoader__.load({
       "notifyLimitsHint": "当账户使用量达到上限时触发系统通知提醒。",
       "hostOnline": "主机在线",
       "hostOffline": "主机无法连接",
-      "statsTitle": "会话遥测统计",
       "statsRequests": "成功 / 总请求数",
       "statsLatency": "平均响应延迟",
       "statsSuccessRate": "会话成功率",
       "statsLastActivity": "最近活跃时间",
-      "smokeTitle": "链路连通性冒烟测试 (Ping)",
       "smokeDesc": "向当前订阅服务商发起实时探活并测量双向网络往返延迟 (RTT)。",
       "runSmoke": "⚡ 执行冒烟探活 (Ping)",
       "smokeTesting": "正在探活…",
@@ -525,10 +478,7 @@ window.__ModuleLoader__.load({
       "capabilitiesHint": "订阅账号模型上下文窗口与特权特性",
       "orPasteVaultPayload": "或在下方粘贴保险库文本",
       "workspaceTitle": "工作区与组织",
-      "workspaceSelect": "选择生效的工作区或组织",
-      "personalWorkspace": "个人默认",
       "windowResetsAt": "额度重置于",
-      "quotaRecovery": "额度恢复",
       "toastCooldownRecovered": "已解除冷却恢复可用",
       "modelsCatalogTitle": "精选订阅模型",
       "modelsCatalogDesc": "当前 DeepSeek Harness 活跃订阅下可用模型一览。",
@@ -547,7 +497,6 @@ window.__ModuleLoader__.load({
       "resetCreditsHint": "ChatGPT 重置卡：紧急重置 5 小时额度窗口。扣除前需等待 5 秒倒计时确认。",
       "resetCreditsAction": "重置 ChatGPT 限制",
       "usageLimitsTitle": "用量限制",
-      "slotDetailsTitle": "槽位详情",
       "resetAvailable": "可用重置次数",
       "resetExpires": "最早到期时间",
       "resetAck": "我确认将消耗一次重置机会",
@@ -568,23 +517,17 @@ window.__ModuleLoader__.load({
       "tokensSaved": "已节省 Token",
       "subsPill": "订阅",
       "subsModalTitle": "订阅管理中心",
-      "subsActiveHero": "当前主用订阅",
       "subsPoolTitle": "服务商账户池",
       "subsRefresh": "刷新",
       "subsOpenSettings": "全部设置 →",
-      "subsFastMode": "加速模式 1.5x",
-      "subsHealthy": "健康运行中",
       "subsFree": "空闲可用",
       "subsUsed": "已用",
-      "subsModalClose": "关闭",
       "subsLogged": "已连接",
       "subsNotLogged": "未连接",
       "subsCooldown": "冷却中",
-      "hudTitle": "订阅额度余量",
       "settingsLoading": "正在加载设置…",
       "settingsUnavailable": "设置加载失败",
       "settingsRetry": "重试",
-      "hudHint": "可拖拽 · 边缘停靠 · 点击刷新",
       "fcCalibrating": "校准中…",
       "fcIdle": "暂无消耗",
       "fcHours": "小时",
@@ -612,23 +555,14 @@ window.__ModuleLoader__.load({
       "addAccount": "+ 添加账户",
       "save": "保存",
       "saved": "已保存",
-      "loading": "加载中…",
-      "unavailable": "设置不可用",
       "accountLabel": "账户",
       "plan": "套餐方案",
       "storedAs": "存储标识",
-      "switchLabel": "切换服务商",
-      "chipActive": "已启用订阅",
-      "expiryLabel": "到期时间",
       "slashLogin": "登录订阅服务商",
       "slashLogout": "登出订阅服务商",
-      "slashStatus": "查看订阅状态",
-      "none": "无",
       "forecast": "≈",
       "windowPrimary": "主配额窗口",
       "windowSecondary": "次配额窗口",
-      "resetLabel": "重置倒计时",
-      "check": "检测",
       "checking": "检测中…",
       "importToken": "保存令牌",
       "importTokenPlace": "粘贴令牌或 API Key",
@@ -638,7 +572,12 @@ window.__ModuleLoader__.load({
       "howToGetToken": "❓ 获取指引",
       "howToGetTokenTitle": "如何获取此服务商的令牌或 API 密钥",
       "instructionsTitle": "获取令牌指引",
-      "close": "关闭",
+      "lang": "zh",
+      "cardIntro": "AI 服务订阅账户、自动轮换与速率限制管理。",
+      "loading": "加载中…",
+      "unavailable": "设置不可用",
+      "error": "错误",
+      "settingsError": "设置错误",
       "cancel": "取消",
       "quota": "配额",
       "subs5hWindow": "5小时窗口",
@@ -649,8 +588,6 @@ window.__ModuleLoader__.load({
       "sessionRevokedBadge": "已失效 / 过期",
       "sessionRevokedWarning": "会话已过期或失效 — 需要重新授权",
       "manualTitle": "若浏览器未能自动跳转回调",
-      "updateChecking": "检查更新中…",
-      "updateUpToDate": "已是最新版本",
       "updateAvailable": "有新版本可用",
       "updateNow": "立即更新",
       "updating": "正在更新…",
@@ -675,7 +612,6 @@ window.__ModuleLoader__.load({
       "backupImportAction": "导入",
       "backupPassphrase": "凭据库密码（至少 12 位）",
       "backupExportHint": "使用 AES-256-GCM 安全加密导出所有订阅账户与配置。⚠️ 包含敏感的 OAuth 刷新令牌，请使用至少 12 位的强密码保护。",
-      "vaultTokenWarning": "⚠️ 包含敏感的 OAuth 刷新令牌",
       "backupImportHint": "从已加密的备份内容中导入并恢复订阅账户与凭据。",
       "backupPayloadPlaceholder": "在此粘贴 DSHE... 加密内容",
       "backupExportOk": "备份导出成功",
@@ -690,7 +626,6 @@ window.__ModuleLoader__.load({
       "resetsIn": "重置倒计时",
       "toastQuarantined": "账户进入隔离期",
       "headlessTip": "无头环境 / 远程服务器？",
-      "headlessSshCommand": "SSH 端口转发命令：",
       "headlessCopySsh": "复制 SSH 命令",
       "headlessCopied": "已复制！",
       "headlessScanQr": "使用手机扫描以登录：",
@@ -703,8 +638,6 @@ window.__ModuleLoader__.load({
       "vaultSyncLastPush": "上次推送：",
       "vaultSyncLastPull": "上次拉取：",
       "toastReleased": "账户已解除隔离恢复使用",
-      "toastQuotaWarning": "额度预警",
-      "enableToasts": "应用内弹窗提醒",
       "groupQueue": "并发限制与请求队列",
       "enableQueue": "启用并发请求排队",
       "enableQueueHint": "当账户达到并发上限时将多余请求排队等待，避免直接触发 429 报错",
@@ -731,23 +664,14 @@ window.__ModuleLoader__.load({
       "wizardAll": "诊断向导",
       "wizardIncludeNetwork": "包含活跃网络探测（代理连通性与模型目录探测）",
       "wizardRunning": "正在执行诊断检查清单...",
-      "wizardStepCreds": "凭据完整性与有效期",
-      "wizardStepProxy": "网络代理与网关",
-      "wizardStepToken": "令牌有效性验证",
-      "wizardStepCatalog": "模型目录可达性",
       "wizardHealthy": "健康正常",
       "wizardDegraded": "降级预警",
       "wizardFailing": "发现故障",
       "wizardRecommendations": "排查建议与修复步骤",
       "wizardCopy": "复制脱敏诊断报告",
       "cachePinnedBadge": "缓存粘性",
-      "field.enableToasts": "当账户发生隔离或额度达到警戒线时显示即时弹窗提醒",
       "reasoningEffortTitle": "推理强度控制",
       "reasoningEffortDesc": "为具备扩展思考能力的模型配置推理深度与思考预算。",
-      "reasoningLevelLow": "低",
-      "reasoningLevelMed": "中",
-      "reasoningLevelHigh": "高",
-      "reasoningLevelMax": "最高",
       "reasoningLevelOff": "关闭"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
@@ -802,6 +726,27 @@ window.__ModuleLoader__.load({
       return label ? h('span', { className: 'dsub-planBadge' }, label) : null
     }
 
+    function pad2(n) {
+      return String(n).padStart(2, '0')
+    }
+
+    function formatMmSs(totalSeconds) {
+      const total = Math.max(0, Math.ceil(Number(totalSeconds) || 0))
+      return pad2(Math.floor(total / 60)) + ':' + pad2(total % 60)
+    }
+
+    function barTone(pct, normalColor = 'var(--dsw-alias-state-success-primary)') {
+      const p = Number(pct) || 0
+      if (p >= 90) return { cls: 'dsub-barFull', tag: 'dsub-tag-bad', color: 'var(--dsw-alias-state-error-primary)' }
+      if (p >= 70) return { cls: 'dsub-barWarn', tag: 'dsub-tag-warn', color: 'var(--dsw-alias-state-warn-primary)' }
+      return { cls: '', tag: 'dsub-tag-ok', color: normalColor }
+    }
+
+    function ledClass(pct) {
+      const p = Number(pct) || 0
+      return p >= 90 ? 'dsub-ledBad' : (p >= 70 ? 'dsub-ledWarn' : 'dsub-ledOk')
+    }
+
     function formatRelativeReset(resetAt, lang, now) {
       if (!resetAt || !Number.isFinite(resetAt) || resetAt <= 0) return ''
       var delta = resetAt - (now || Date.now())
@@ -828,17 +773,14 @@ window.__ModuleLoader__.load({
       if (ms <= 0) return null
       const total = Math.floor(ms / 1000)
       const d = new Date(props.resetAt)
-      const pad = (n) => String(n).padStart(2, '0')
-      const timeStr = pad(d.getHours()) + ':' + pad(d.getMinutes())
+      const timeStr = pad2(d.getHours()) + ':' + pad2(d.getMinutes())
       const relStr = formatRelativeReset(props.resetAt, t('lang'), now)
       if (total > 3600) {
         return h('span', { className: 'dsub-sub', style: { fontVariantNumeric: 'tabular-nums' } },
           '⏳ ' + t('windowResetsAt') + ' ' + timeStr + ' (' + relStr + ')')
       }
-      const m = Math.floor(total / 60)
-      const sec = total % 60
       return h('span', { className: 'dsub-sub', style: { fontVariantNumeric: 'tabular-nums' } },
-        '⏳ ' + t('windowResetsAt') + ' ' + timeStr + ' (' + relStr + ' · ' + pad(m) + ':' + pad(sec) + ')')
+        '⏳ ' + t('windowResetsAt') + ' ' + timeStr + ' (' + relStr + ' · ' + formatMmSs(total) + ')')
     }
 
     function badgeFor(account, t) {
@@ -852,10 +794,7 @@ window.__ModuleLoader__.load({
       }
       if (account.cooldownUntil && account.cooldownUntil > Date.now()) {
         const leftSec = Math.max(0, Math.ceil((account.cooldownUntil - Date.now()) / 1000))
-        const m = Math.floor(leftSec / 60)
-        const s = leftSec % 60
-        const pad = (n) => String(n).padStart(2, "0")
-        return t("coolingDown") + " (" + pad(m) + ":" + pad(s) + ")"
+        return t("coolingDown") + " (" + formatMmSs(leftSec) + ")"
       }
       if (account.usagePercent != null && account.usagePercent >= 100) return t('usageFull')
       return t('connected')
@@ -1009,7 +948,7 @@ window.__ModuleLoader__.load({
         fetch('/dsh-subscriptions/vault/sync/status')
           .then((r) => r.json())
           .then((d) => { if (d && d.ok) setVaultSyncInfo(d.status) })
-          .catch(() => {})
+          .catch((e) => setBackupErr(cleanErrorMessage(e && e.message ? e.message : e)))
       }
 
       const doVaultSyncPush = async () => {
@@ -2622,7 +2561,7 @@ window.__ModuleLoader__.load({
                     stepsEn: ['Paste your token or API key into the field above and click "Save token".'],
                   };
                   // Determine language safely from current locale (fallback to zh if Chinese or en)
-                  const isZh = t('instructionsTitle').indexOf('获取') >= 0 || t('close') === '关闭';
+                  const isZh = t('lang') === 'zh';
                   const steps = (isZh && info.stepsZh) ? info.stepsZh : (info.stepsEn || []);
                   return h('div', { className: 'dsub-helpBox' },
                     h('div', { className: 'dsub-helpHead' },
@@ -2843,8 +2782,9 @@ window.__ModuleLoader__.load({
 
                   function renderItem(label, pct, detail){
                     var p = Math.min(100, Math.max(0, Math.round(pct)))
-                    var tagCls = p >= 90 ? 'dsub-tag-bad' : (p >= 70 ? 'dsub-tag-warn' : 'dsub-tag-ok')
-                    var fillBg = p >= 90 ? 'var(--dsw-alias-state-error-primary)' : (p >= 70 ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)')
+                    var tone = barTone(p)
+                    var tagCls = tone.tag
+                    var fillBg = tone.color
                     return h('div', { key: label, className: 'dsub-usage-card' },
                       h('div', { className: 'dsub-usage-head' },
                         h('span', null, label),
@@ -2888,7 +2828,7 @@ window.__ModuleLoader__.load({
                   var agoStr = null
                   if (at) {
                     var m = Math.round((Date.now() - at) / 60000)
-                    if (m >= 1) agoStr = m + 'm ' + (t('close') === '关闭' ? '前' : 'ago')
+                    if (m >= 1) agoStr = m + 'm ' + (t('lang') === 'zh' ? '前' : 'ago')
                   }
 
                   return h('div', { className: 'dsub-panel-box' },
@@ -3164,47 +3104,9 @@ window.__ModuleLoader__.load({
           expiryNotifyDays: (data && data.expiryNotifyDays) || 7,
           composerQuota: (data && data.composerQuota) || 'off',
           active: (data && data.active) || null,
+          error: null,
         }
-      } catch { return { logged: [], usage: 0, expiresAt: {}, labels: {}, expiryNotifyDays: 7, fastMode: false, composerQuota: 'off', active: null } }
-    }
-
-    // #84: compact quota indicator of the active subscription in the input area.
-    // The runway forecast uses a rolling window of /status samples.
-    const fcSamples = { windows: {} }
-
-    function fcObserve(key, remaining, now) {
-      const windows = fcSamples.windows
-      const prev = windows[key]
-      const samples = (prev && prev.samples) || []
-      const last = samples[samples.length - 1]
-      if (!last || (now > last.at && (Math.abs(remaining - last.pct) >= 0.1 || now - last.at >= 15 * 60 * 1000))) {
-        samples.push({ at: now, pct: remaining })
-      }
-      windows[key] = { samples: samples.filter((x) => x.at >= now - 24 * 60 * 60 * 1000).slice(-192) }
-    }
-
-    function fcEstimate(key, remaining) {
-      const rec = fcSamples.windows[key]
-      if (!rec) return { status: 'calibrating' }
-      const samples = rec.samples
-      if (samples.length < 3) return { status: 'calibrating' }
-      const first = samples[0]
-      const last = samples[samples.length - 1]
-      const span = last.at - first.at
-      const consumed = first.pct - last.pct
-      if (span < 30 * 60 * 1000 || consumed < 1) return { status: 'calibrating' }
-      const t0 = first.at
-      let sw = 0, sx = 0, sy = 0, sxx = 0, sxy = 0
-      for (const x of samples) {
-        const wx = (x.at - t0) / 3600000
-        const wy = first.pct - x.pct
-        const w = Math.exp((x.at - last.at) / (6 * 3600000))
-        sw += w; sx += w * wx; sy += w * wy; sxx += w * wx * wx; sxy += w * wx * wy
-      }
-      const den = sw * sxx - sx * sx
-      const pace = den > 0 ? (sw * sxy - sx * sy) / den : 0
-      if (!Number.isFinite(pace) || pace < 0.02) return { status: 'idle' }
-      return { status: 'ready', runwaySeconds: Math.round((remaining / pace) * 3600) }
+      } catch { return { logged: [], usage: 0, expiresAt: {}, labels: {}, expiryNotifyDays: 7, fastMode: false, composerQuota: 'off', active: null, error: 'status unavailable' } }
     }
 
     function ComposerQuota(props) {
@@ -3213,15 +3115,25 @@ window.__ModuleLoader__.load({
       React.useEffect(() => {
         let alive = true
         const pull = () => {
-          refreshLoggedIn().then((r) => {
+          Promise.all([
+            refreshLoggedIn(),
+            fetch('/dsh-subscriptions/analytics', { cache: 'no-store' })
+              .then((res) => res.json())
+              .catch(() => ({})),
+          ]).then(([r, analyticsPayload]) => {
             if (!alive) return
             const mode = r.composerQuota || 'off'
             const a = r.active
             if (mode !== 'off' && a && a.provider && a.provider !== 'ollama' && a.usagePercent != null) {
               const remaining = Math.max(0, 100 - a.usagePercent)
-              const key = 'subs:' + a.provider
-              fcObserve(key, remaining, Date.now())
-              const est = fcEstimate(key, remaining, Date.now())
+              const forecast = (analyticsPayload && analyticsPayload.analytics && analyticsPayload.analytics.forecast) || []
+              const row = forecast.find((f) => f.provider === a.provider && (!f.ref || !a.ref || f.ref === a.ref))
+              let est = { status: 'calibrating' }
+              if (row) {
+                est = row.hoursToExhaustion == null
+                  ? { status: 'idle' }
+                  : { status: 'forecast', runwaySeconds: Math.max(0, Number(row.hoursToExhaustion) * 3600) }
+              }
               setState({ mode, active: a, remaining, est })
             } else {
               setState({ mode, active: a, remaining: null, est: null })
@@ -3277,102 +3189,6 @@ window.__ModuleLoader__.load({
       return { label: (p.charAt(0).toUpperCase() || 'P'), cls: 'dsub-brandCodex', icon: '●' }
     }
 
-    const PLUGIN_LABELS = new Set(['plugins', '插件', 'plugin'])
-
-    function resolvePluginLabels(customCtx) {
-      const labels = new Set(PLUGIN_LABELS)
-      const loc = (customCtx && customCtx.locale) || (typeof window !== 'undefined' && window.__dshCtx && window.__dshCtx.locale)
-      if (loc && typeof loc.bind === 'function') {
-        try {
-          const sp = loc.bind('settings.plugins')
-          const nav = typeof sp === 'function' ? sp('nav') : null
-          if (nav && typeof nav === 'string') labels.add(nav.trim().toLowerCase())
-        } catch { /* bestEffort */ }
-        try {
-          const pm = loc.bind('pluginManager')
-          const panel = typeof pm === 'function' ? (pm('panel') || pm('title')) : null
-          if (panel && typeof panel === 'string') labels.add(panel.trim().toLowerCase())
-        } catch { /* bestEffort */ }
-      }
-      return labels
-    }
-
-    function matchesPluginLabel(el, customLabels) {
-      if (!el) return false
-      const dataTab = (el.getAttribute('data-tab') || '').trim().toLowerCase()
-      const dataSection = (el.getAttribute('data-section') || '').trim().toLowerCase()
-      const dataKey = (el.getAttribute('data-key') || '').trim().toLowerCase()
-      const id = (el.getAttribute('id') || '').trim().toLowerCase()
-      if (dataTab === 'plugins' || dataSection === 'plugins' || dataKey === 'plugins' || id === 'plugins') return true
-
-      if (el.querySelector && el.querySelector('path[d*="M10.3232"]')) return true
-
-      const txt = (el.textContent || '').trim().toLowerCase()
-      const aria = (el.getAttribute('aria-label') || '').trim().toLowerCase()
-      const title = (el.getAttribute('title') || '').trim().toLowerCase()
-      const labels = customLabels || PLUGIN_LABELS
-      return labels.has(txt) || labels.has(aria) || labels.has(title) || labels.has(dataTab)
-    }
-
-    function findAndClickCard(doc) {
-      for (const key of [PKG, 'dsh-subscriptions', '@goodandready/dsh-subscriptions']) {
-        const card = doc.querySelector(`[data-plugin-package="${key}"]`) || doc.querySelector(`[data-plugin-item="${ROW_ID}"]`)
-        if (card) {
-          const open = [...card.querySelectorAll('button')].filter((b) => b.getAttribute('role') !== 'switch')
-          const target = open.length >= 1 ? open[0] : card
-          if (typeof target.click === 'function') {
-            target.click()
-            return true
-          }
-        }
-      }
-      return false
-    }
-
-    function openPluginSettings(doc = document, schedule = (run, ms) => window.setTimeout(run, ms), navCtx) {
-      try {
-        if (findAndClickCard(doc)) return
-
-        const activeLabels = resolvePluginLabels(navCtx)
-        const checkEl = (el) => matchesPluginLabel(el, activeLabels)
-
-        const buttons = [...doc.querySelectorAll('button, a, div[role="button"], div[role="tab"]')]
-        const panel = buttons.find(checkEl)
-        if (panel) {
-          panel.click()
-          const poll = (left) => {
-            if (findAndClickCard(doc)) return
-            if (left > 0) schedule(() => poll(left - 1), 100)
-          }
-          schedule(() => poll(40), 100)
-          return
-        }
-
-        const triggers = buttons.filter((b) => b.getAttribute('aria-haspopup') === 'dialog' && b.hasAttribute('aria-expanded'))
-        if (triggers.length > 0) {
-          const trigger = triggers.find((b) => b.getAttribute('aria-expanded') !== 'true') || triggers[0]
-          if (trigger && typeof trigger.click === 'function') {
-            trigger.click()
-            const pollSection = (left) => {
-              try {
-                const section = [...doc.querySelectorAll('button, a, div[role="tab"], [role="button"]')].find(checkEl)
-                if (section && typeof section.click === 'function') {
-                  section.click()
-                  const poll = (cLeft) => {
-                    if (findAndClickCard(doc)) return
-                    if (cLeft > 0) schedule(() => poll(cLeft - 1), 100)
-                  }
-                  schedule(() => poll(40), 100)
-                  return
-                }
-              } catch { /* bestEffort */ }
-              if (left > 0) schedule(() => pollSection(left - 1), 80)
-            }
-            schedule(() => pollSection(20), 80)
-          }
-        }
-      } catch { /* bestEffort */ }
-    }
     function SubsPill(props) {
       const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ logged: [], usage: 0, accounts: [], open: false, active: null, loading: false })
@@ -3382,6 +3198,13 @@ window.__ModuleLoader__.load({
       const dismissToast = (id) => {
         setToasts((prev) => prev.filter((t) => t.id !== id))
       }
+      const reportError = (message) => {
+        const text = cleanErrorMessage(message)
+        if (!text) return
+        setToasts((prev) => prev.some((toast) => toast.message === text)
+          ? prev
+          : [{ id: 'err_' + Date.now(), message: text, cls: 'dsub-toast-bad' }, ...prev].slice(0, 3))
+      }
 
       const pollAlerts = () => {
         fetch('/dsh-subscriptions/alerts?limit=5', { cache: 'no-store' })
@@ -3401,22 +3224,25 @@ window.__ModuleLoader__.load({
               }
             }
           })
-          .catch(() => {})
+          .catch((e) => reportError(t('hostOffline') + ': ' + String(e && e.message || e)))
       }
 
       const pull = () => {
         setState((s) => Object.assign({}, s, { loading: true }))
         refreshLoggedIn().then((r) => {
+          if (r.error) reportError(t('hostOffline') + ': ' + r.error)
           const logged = r.logged || []
           fetch('/dsh-subscriptions/config', { cache: 'no-store' })
             .then((res) => res.json())
             .then((cfg) => {
               setState((s) => Object.assign({}, s, { logged, usage: r.usage, accounts: (cfg && cfg.accounts) || [], active: r.active, loading: false }))
             })
-            .catch(() => {
+            .catch((e) => {
+              reportError(t('hostOffline') + ': ' + String(e && e.message || e))
               setState((s) => Object.assign({}, s, { logged, usage: r.usage, accounts: [], active: r.active, loading: false }))
             })
-        }).catch(() => {
+        }).catch((e) => {
+          reportError(t('hostOffline') + ': ' + String(e && e.message || e))
           setState((s) => Object.assign({}, s, { loading: false }))
         })
       }
@@ -3437,7 +3263,7 @@ window.__ModuleLoader__.load({
 
       const n = state.logged.length
       const total = state.accounts.length || n
-      const led = n === 0 ? 'dsub-ledOff' : (state.usage >= 90 ? 'dsub-ledBad' : (state.usage >= 50 ? 'dsub-ledWarn' : 'dsub-ledOk'))
+      const led = n === 0 ? 'dsub-ledOff' : ledClass(state.usage)
       const now = Date.now()
 
       // Header Pill Label
@@ -3487,7 +3313,7 @@ window.__ModuleLoader__.load({
                   className: 'dsub-barFillGrad',
                   style: {
                     width: Math.min(100, Math.max(0, primPct)) + '%',
-                    background: primPct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (primPct >= 50 ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)'),
+                    background: barTone(primPct).color,
                   },
                 }),
               ),
@@ -3502,7 +3328,7 @@ window.__ModuleLoader__.load({
                   className: 'dsub-barFillGrad',
                   style: {
                     width: Math.min(100, Math.max(0, secPct)) + '%',
-                    background: secPct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (secPct >= 50 ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-brand-primary)'),
+                    background: barTone(secPct, 'var(--dsw-alias-brand-primary)').color,
                   },
                 }),
               ),
@@ -3546,11 +3372,8 @@ window.__ModuleLoader__.load({
         } else if (cooled) {
           statusClass = 'dsub-statusWarn'
           const leftSec = Math.max(0, Math.ceil((a.cooldownUntil - now) / 1000))
-          const m = Math.floor(leftSec / 60)
-          const s = leftSec % 60
-          const pad = (n) => String(n).padStart(2, '0')
           const fams = Array.isArray(a.cooldownFamilies) && a.cooldownFamilies.length ? ' · ' + a.cooldownFamilies.join('/') : ''
-          statusText = t('subsCooldown') + ' (' + pad(m) + ':' + pad(s) + ')' + fams
+          statusText = t('subsCooldown') + ' (' + formatMmSs(leftSec) + ')' + fams
         } else if (isLogged) {
           if (pct >= 90) { statusClass = 'dsub-statusBad'; statusText = '90%+ ' + t('subsUsed') }
           else if (pct >= 50) { statusClass = 'dsub-statusWarn'; statusText = pct + '% ' + t('subsUsed') }
@@ -3573,7 +3396,7 @@ window.__ModuleLoader__.load({
                 className: 'dsub-barFillGrad',
                 style: {
                   width: Math.min(100, Math.max(0, pct)) + '%',
-                  background: pct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (pct >= 50 ? 'var(--dsw-alias-state-warn-primary)' : 'var(--dsw-alias-state-success-primary)'),
+                  background: barTone(pct).color,
                 },
               }),
             ) : null,
@@ -3658,8 +3481,6 @@ window.__ModuleLoader__.load({
                       layout.selectPanel('plugins')
                     }
                   } catch { /* bestEffort */ }
-
-                  openPluginSettings(document, undefined, clientCtx)
                 },
               }, t('subsOpenSettings')),
             ),
@@ -3767,7 +3588,7 @@ window.__ModuleLoader__.load({
       }, 'dsh-subscriptions: slash commands')
     }
 
-    exports.inject = ['slots', 'locale', 'sessions']
+    exports.inject = ['slots', 'locale']
     exports.apply = function apply(ctx) {
       if (typeof window !== 'undefined') {
         window.__dshCtx = ctx

package/lib/config-schema.js

@@ -26,6 +26,14 @@ export const Slot = z.object({
     .description('#590 Optional monthly subscription cost in USD for analytics. Defaults to 20.'),
   maxQueueSize: z.number().default(0)
     .description('#592 Per-account queue depth before overflow. 0 = use the global maxQueueSize.'),
+  vipOnly: z.boolean().default(false)
+    .description('#175 Reserve this account for VIP requests only.'),
+  tags: z.array(z.string()).default([])
+    .description('#173 Tags used by tag-filtered rotation.'),
+  weight: z.number().default(0)
+    .description('#171 Weighted rotation priority. 0 = derive from isPro.'),
+  isPro: z.boolean().default(false)
+    .description('#171 Treat this account as Pro for weighted rotation.'),
 })
 
 export const defaultSlots = PROVIDERS.map((provider) => ({ provider, index: 1, label: '' }))

package/lib/http.js

@@ -282,8 +282,23 @@ export function isSameOrigin(url1, url2) {
   }
 }
 
+export function headerSafeValue(value) {
+  return String(value == null ? '' : value)
+    .replace(/[\r\n]+/g, ' ')
+    .replace(/[^\t\x20-\x7e\x80-\xff]/g, '')
+}
+
+export function sanitizeHeaderValues(headers) {
+  const out = {}
+  for (const [key, value] of Object.entries(headers || {})) {
+    if (value === undefined || value === null) continue
+    out[key] = headerSafeValue(value)
+  }
+  return out
+}
+
 export function sanitizeRequestHeaders(url, init = {}, options = {}) {
-  const headers = { ...(init.headers || {}) }
+  const headers = sanitizeHeaderValues(init.headers || {})
   if (!url) return headers
   try {
     const parsed = new URL(url)
@@ -351,64 +366,6 @@ export async function fetchWithTimeout(fetchImpl, url, init = {}, { timeoutMs =
       return res
     }
     if (typeof timer?.unref === 'function') timer.unref()
-    const origJson = typeof res.json === 'function' ? res.json.bind(res) : null
-    const origText = typeof res.text === 'function' ? res.text.bind(res) : null
-    if (origJson) {
-      res.json = () => {
-        if (typeof timer?.ref === 'function') timer.ref()
-        if (controller.signal.aborted) {
-          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-        }
-        return new Promise((resolve, reject) => {
-          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-          controller.signal.addEventListener('abort', onAbort, { once: true })
-          origJson().then(
-            (val) => {
-              controller.signal.removeEventListener('abort', onAbort)
-              clearTimeout(timer)
-              resolve(val)
-            },
-            (err) => {
-              controller.signal.removeEventListener('abort', onAbort)
-              clearTimeout(timer)
-              if (controller.signal.aborted) {
-                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-              } else {
-                reject(err)
-              }
-            }
-          )
-        })
-      }
-    }
-    if (origText) {
-      res.text = () => {
-        if (typeof timer?.ref === 'function') timer.ref()
-        if (controller.signal.aborted) {
-          return Promise.reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-        }
-        return new Promise((resolve, reject) => {
-          const onAbort = () => reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-          controller.signal.addEventListener('abort', onAbort, { once: true })
-          origText().then(
-            (val) => {
-              controller.signal.removeEventListener('abort', onAbort)
-              clearTimeout(timer)
-              resolve(val)
-            },
-            (err) => {
-              controller.signal.removeEventListener('abort', onAbort)
-              clearTimeout(timer)
-              if (controller.signal.aborted) {
-                reject(new DOMException('The operation was aborted due to timeout', 'TimeoutError'))
-              } else {
-                reject(err)
-              }
-            }
-          )
-        })
-      }
-    }
     return res
   } catch (err) {
     clearTimeout(timer)

package/lib/providers.js

@@ -0,0 +1,64 @@
+export const BUILTIN_PROVIDERS = Object.freeze([
+  'codex',
+  'claude',
+  'grok',
+  'antigravity',
+  'kimi',
+  'glm',
+  'cursor',
+  'kiro',
+  'copilot',
+  'qwen',
+  'ernie',
+  'spark',
+  'jetbrains',
+  'perplexity',
+  'replit',
+  'cody',
+])
+
+const DISPLAY = {
+  codex: 'ChatGPT Codex',
+  claude: 'Claude',
+  grok: 'Grok',
+  antigravity: 'Antigravity',
+  kimi: 'Moonshot Kimi',
+  glm: 'Zhipu GLM',
+  cursor: 'Cursor',
+  kiro: 'AWS Kiro',
+  copilot: 'GitHub Copilot',
+  perplexity: 'Perplexity Pro',
+  jetbrains: 'JetBrains AI',
+}
+
+const dynamicIds = new Set()
+const displayExtra = {}
+
+export let PROVIDERS = [...BUILTIN_PROVIDERS]
+
+export function registerCustomProviderIds(ids) {
+  let changed = false
+  for (const id of ids || []) {
+    if (typeof id === 'string' && /^[a-z][a-z0-9_]*$/.test(id) && !dynamicIds.has(id)) {
+      dynamicIds.add(id)
+      changed = true
+    }
+  }
+  if (changed) PROVIDERS = listProviders()
+}
+
+export function listProviders() {
+  return [...BUILTIN_PROVIDERS, ...dynamicIds]
+}
+
+export function registerDisplayName(id, name) {
+  if (id && name) displayExtra[id] = name
+}
+
+export function isProvider(value) {
+  return BUILTIN_PROVIDERS.includes(value) || dynamicIds.has(value)
+}
+
+export function displayName(provider) {
+  return DISPLAY[provider] || displayExtra[provider] || provider
+}

package/lib/refs.js

@@ -1,68 +1,12 @@
-// Built-in providers + dynamic ones from Config.customVendors.
-export const BUILTIN_PROVIDERS = Object.freeze([
-  'codex',
-  'claude',
-  'grok',
-  'antigravity',
-  'kimi',
-  'glm',
-  'cursor',
-  'kiro',
-  'copilot',
-  'qwen',
-  'ernie',
-  'spark',
-  'jetbrains',
-  'perplexity',
-  'replit',
-  'cody',
-])
-
-const dynamicIds = new Set()
-const displayExtra = {}
-
-export let PROVIDERS = [...BUILTIN_PROVIDERS]
-
-export function registerCustomProviderIds(ids) {
-  let changed = false
-  for (const id of ids || []) {
-    if (typeof id === 'string' && /^[a-z][a-z0-9_]*$/.test(id) && !dynamicIds.has(id)) {
-      dynamicIds.add(id)
-      changed = true
-    }
-  }
-  if (changed) PROVIDERS = listProviders()
-}
-
-export function listProviders() {
-  return [...BUILTIN_PROVIDERS, ...dynamicIds]
-}
-
-export function registerDisplayName(id, name) {
-  if (id && name) displayExtra[id] = name
-}
-
-export function isProvider(value) {
-  return BUILTIN_PROVIDERS.includes(value) || dynamicIds.has(value)
-}
-
-const DISPLAY = {
-  codex: 'ChatGPT Codex',
-  claude: 'Claude',
-  grok: 'Grok',
-  antigravity: 'Antigravity',
-  kimi: 'Moonshot Kimi',
-  glm: 'Zhipu GLM',
-  cursor: 'Cursor',
-  kiro: 'AWS Kiro',
-  copilot: 'GitHub Copilot',
-  perplexity: 'Perplexity Pro',
-  jetbrains: 'JetBrains AI',
-}
-
-export function displayName(provider) {
-  return DISPLAY[provider] || displayExtra[provider] || provider
-}
+export {
+  BUILTIN_PROVIDERS,
+  PROVIDERS,
+  registerCustomProviderIds,
+  listProviders,
+  registerDisplayName,
+  displayName,
+  isProvider,
+} from './providers.js'
 
 /**
  * @param {string} provider

package/lib/vendor-factory.js

@@ -1,4 +1,4 @@
-import { fetchWithTimeout } from "./http.js"
+import { fetchWithTimeout, sanitizeHeaderValues } from "./http.js"
 // Vendor factory from a declarative profile.
 //
 // Covers the OpenAI-Responses-compatible subscription family: PKCE auth,
@@ -30,11 +30,11 @@ export function createVendorFromProfile(profile) {
   const tokenStyle = profile.tokenStyle === "json" ? "json" : "form"
 
   function identityHeaders(blob, extra) {
-    return {
+    return sanitizeHeaderValues({
       Authorization: `Bearer ${blob.accessToken}`,
       ...(profile.headers || {}),
       ...(extra || {}),
-    }
+    })
   }
 
   return {

package/lib/vendors/codex.js

@@ -1,4 +1,4 @@
-import { isTimeoutError, fetchWithTimeout } from "../http.js"
+import { isTimeoutError, fetchWithTimeout, headerSafeValue } from "../http.js"
 import { randomUUID, createHash } from 'node:crypto'
 import { buildAuthorizeUrl } from '../oauth.js'
 import { codexResponsesBody, modelCatalog } from '../messages.js'
@@ -61,10 +61,10 @@ export function authorizeUrl(cfg, pkce) {
 }
 
 function identityHeaders(blob, config, extra) {
-  const originator = config.originator || 'codex_cli_rs'
-  const activeOrgId = blob.selectedOrgId || blob.accountId || ''
+  const originator = headerSafeValue(config.originator || 'codex_cli_rs')
+  const activeOrgId = headerSafeValue(blob.selectedOrgId || blob.accountId || '')
   return {
-    Authorization: `Bearer ${blob.accessToken}`,
+    Authorization: `Bearer ${headerSafeValue(blob.accessToken)}`,
     originator,
     'chatgpt-account-id': activeOrgId,
     'ChatGPT-Account-ID': activeOrgId,
@@ -260,7 +260,7 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     Accept: 'text/event-stream',
     'session-id': sessionId,
     'x-client-request-id': sessionId,
-    ...(isFast ? { 'x-codex-routing-hint': `model=${(options && options.model) || 'gpt-5.6-luna'};tier=priority` } : {}),
+    ...(isFast ? { 'x-codex-routing-hint': `model=${headerSafeValue((options && options.model) || 'gpt-5.6-luna')};tier=priority` } : {}),
   }
 
   const res = await fetchImpl(`${base}/responses`, {

package/lib/vendors/cody.js

@@ -39,10 +39,7 @@ export async function listModels() {
   return CODY_MODELS
 }
 
-export async function usage(blob) {
-  if (blob && (blob.accessToken || blob.token)) {
-    return { usedPercent: null, plan: 'Cody Pro', timestamp: Date.now() }
-  }
+export async function usage() {
   return null
 }
 

package/lib/vendors/copilot.js

@@ -81,6 +81,7 @@ export async function listModels(blob, cfg, fetchImpl) {
   const impl = fetchImpl || fetch
   const fallback = modelCatalog(id, (cfg && cfg.models) || COPILOT_MODELS)
   if (!blob) return fallback
+  blob = { ...blob }
   const githubToken = blob.refreshToken || blob.githubToken
   let copilotToken = blob.accessToken
   try {
@@ -279,6 +280,8 @@ export async function usage(blob, config, fetchImpl) {
     const usedPercent = user && typeof user.used_percent === "number" && Number.isFinite(user.used_percent)
       ? user.used_percent
       : null
+
+    if (usedPercent == null) return null
     return {
       usedPercent,
       plan: user && user.plan ? (user.plan.name || String(user.plan)) : "Copilot",
@@ -290,6 +293,7 @@ export async function usage(blob, config, fetchImpl) {
 }
 
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal, spawnImpl }) {
+  blob = blob ? { ...blob } : blob
   const mode = (config && config.copilotMode) || (blob && blob.copilotMode) || 'auto'
   const customPath = (config && config.copilotCliPath) || (blob && blob.copilotCliPath) || ''
 

package/lib/vendors/ernie.js

@@ -74,7 +74,6 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
     const auth = await refreshErnieToken(blob.apiKey, blob.secretKey, impl)
     if (auth && auth.access_token) {
       token = auth.access_token
-      blob.accessToken = token
     }
   }
   if (!token) throw new LlmError('Baidu ERNIE requires access token or API Key + Secret Key', 'AUTH')

package/lib/vendors/grok.js

@@ -262,26 +262,7 @@ export async function usage(blob, cfg, fetchImpl) {
       headers: { ...identityHeaders(blob, cfg), Accept: 'application/json' },
     })
     const json = await readJson(res)
-    let pct = grokBillingPercent(json)
-    if (pct == null) {
-      // Fallback to gRPC-web GetGrokCreditsConfig
-      try {
-        const gRes = await impl('https://grok.com/rest/app-chat/get-grok-credits-config', {
-          method: 'POST',
-          headers: {
-            ...identityHeaders(blob, cfg),
-            'Content-Type': 'application/grpc-web+proto',
-            'X-User-Agent': 'grpc-web-javascript/0.1',
-          },
-          body: Buffer.from([0, 0, 0, 0, 0]),
-        })
-        if (gRes.ok) {
-          const buf = await gRes.arrayBuffer()
-          const decoded = decodeGrokCreditsFrame(Buffer.from(buf))
-          if (decoded != null) pct = decoded
-        }
-      } catch { /* ignore grok usage capture error */ }
-    }
+    const pct = grokBillingPercent(json)
     const snap = asUsageSnapshot(pct)
     if (snap) snap.windows = usageWindows(json)
     return snap
@@ -394,81 +375,3 @@ export async function* streamOnce({ blob, options, fetchImpl, headers, config, s
   if (!res.ok) throw httpError(res.status, await readErrorBody(res))
   yield* codexResponsesStream(res.body)
 }
-
-function readVarint(bytes, offset) {
-  let value = 0, shift = 0, index = offset
-  while (index < bytes.length) {
-    const byte = bytes[index]
-    index += 1
-    value += (byte & 0x7f) * (2 ** shift)
-    if ((byte & 0x80) === 0) return { value, next: index }
-    shift += 7
-    if (shift > 63) return undefined
-  }
-  return undefined
-}
-function readLength(bytes, offset, size) {
-  if (offset + size > bytes.length) return undefined
-  return { bytes: bytes.subarray(offset, offset + size), next: offset + size }
-}
-function decodeFields(bytes) {
-  const fields = new Map()
-  let offset = 0
-  while (offset < bytes.length) {
-    const tag = readVarint(bytes, offset)
-    if (!tag) break
-    const fieldNumber = Math.floor(tag.value / 8)
-    const wireType = tag.value % 8
-    offset = tag.next
-    if (fieldNumber <= 0) return undefined
-    let value
-    if (wireType === 0) {
-      const next = readVarint(bytes, offset)
-      if (!next) return undefined
-      value = { wireType, value: next.value }
-      offset = next.next
-    } else if (wireType === 5) {
-      const next = readLength(bytes, offset, 4)
-      if (!next) return undefined
-      value = { wireType, bytes: next.bytes }
-      offset = next.next
-    } else if (wireType === 1) {
-      const next = readLength(bytes, offset, 8)
-      if (!next) return undefined
-      value = { wireType, bytes: next.bytes }
-      offset = next.next
-    } else if (wireType === 2) {
-      const length = readVarint(bytes, offset)
-      if (!length) return undefined
-      const next = readLength(bytes, length.next, length.value)
-      if (!next) return undefined
-      value = { wireType, bytes: next.bytes }
-      offset = next.next
-    } else return undefined
-    if (!fields.has(fieldNumber)) fields.set(fieldNumber, value)
-  }
-  return fields
-}
-function float32Le(field) {
-  if (!field || field.wireType !== 5 || !field.bytes || field.bytes.length < 4) return undefined
-  const val = Buffer.from(field.bytes).readFloatLE(0)
-  return Number.isFinite(val) ? val : undefined
-}
-export function decodeGrokCreditsFrame(buffer) {
-  try {
-    const bytes = Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer)
-    if (!bytes.length) return undefined
-    const payload = bytes.length > 5 && bytes[0] === 0 ? bytes.subarray(5) : bytes
-    const top = decodeFields(payload)
-    if (!top) return undefined
-    const nested = top.get(1)?.wireType === 2 ? decodeFields(top.get(1).bytes) : undefined
-    const credits = nested ?? top
-    if (!credits) return undefined
-    const ratio = float32Le(credits.get(1))
-    if (ratio == null) return undefined
-    const pct = ratio <= 1 ? Math.round(ratio * 100) : Math.round(ratio)
-    return Math.max(0, Math.min(100, pct))
-  } catch {
-    return undefined
-  }
-}

package/lib/vendors/index.js

@@ -14,8 +14,9 @@ import * as grok from './grok.js'
 import * as antigravity from './antigravity.js'
 import * as kimi from './kimi.js'
 import * as glm from './glm.js'
+import { BUILTIN_PROVIDERS, isProvider as isRegisteredProvider, registerCustomProviderIds } from '../providers.js'
 
-const builtins = {
+const BUILTIN_MODULES = {
   codex,
   claude,
   grok,
@@ -31,14 +32,17 @@ const builtins = {
   jetbrains,
   perplexity,
   replit,
-  cody
+  cody,
 }
 
+const builtins = Object.fromEntries(BUILTIN_PROVIDERS.map((id) => [id, BUILTIN_MODULES[id]]))
+
 const customVendors = new Map()
 
 export function registerCustomVendor(vendor) {
   if (!vendor || !vendor.id) throw new Error('custom vendor needs id')
   customVendors.set(vendor.id, vendor)
+  registerCustomProviderIds([vendor.id])
 }
 
 export function clearCustomVendors() {
@@ -62,7 +66,7 @@ const vendors = new Proxy({}, {
 })
 
 export function isProvider(value) {
-  return Boolean(vendors[value])
+  return isRegisteredProvider(value) && Boolean(vendors[value])
 }
 
 export function getVendor(provider) {

package/lib/vendors/perplexity.js

@@ -171,15 +171,16 @@ export async function usage(blob, _cfg, fetchImpl) {
     })
     if (res.ok) {
       const d = await readJson(res)
+      if (typeof d.used_percent !== 'number') return null
       return {
-        usedPercent: typeof d.used_percent === 'number' ? d.used_percent : null,
+        usedPercent: d.used_percent,
         plan: d.plan || blob.plan || 'Perplexity Pro',
         timestamp: Date.now(),
         quota: d.quota ? { used: d.quota.used, limit: d.quota.limit, resetAt: d.quota.reset_at } : undefined,
       }
     }
   } catch { /* usage endpoint is optional */ }
-  return { usedPercent: null, plan: blob.plan || 'Perplexity Pro', timestamp: Date.now() }
+  return null
 }
 
 export async function* streamOnce({ blob, options, fetchImpl, headers, config, signal }) {

package/lib/vendors/replit.js

@@ -34,10 +34,7 @@ export async function listModels() {
   return REPLIT_MODELS
 }
 
-export async function usage(blob) {
-  if (blob && (blob.accessToken || blob.token)) {
-    return { usedPercent: null, plan: 'Replit Core', timestamp: Date.now() }
-  }
+export async function usage() {
   return null
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.87",
+  "version": "0.6.89",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",