@goodandready/dsh-subscriptions 0.6.9 → 0.6.11

package/README.md

@@ -270,6 +270,27 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ---
 
+---
+
+## 🔒 OAuth Client Validation & Route Updates (Added in v0.6.11)
+
+- **OAuth Client ID Guard (GitHub #2)**: uildAuthorizeUrl and ntigravity.authorizeUrl now strictly require a non-empty clientId. If unconfigured, the endpoint returns an explicit HTTP 400 (missing_client_id) and the UI prompts the user to configure ntigravityClientId in plugin settings or use "From CLI" instead of directing the browser to a failing Google OAuth page.
+- **Config Schema Secret Key**: Added ntigravityClientSecret to the plugin configuration schema, allowing convenient entry of private client secrets alongside ntigravityClientId with automatic masking in public endpoints.
+- **Zhipu GLM Console Route Migration (GitHub #3)**: Updated the Zhipu GLM authorization and API key center link to the active console route (https://bigmodel.cn/usercenter/proj-mgmt/apikeys), eliminating 404 navigation errors caused by vendor console restructuring.
+
+---
+
+## 🛡️ Reliability & Quality Hardening (Added in v0.6.10)
+
+- **Structured Error Handling**: Eliminated all empty catch blocks across the plugin runtime via safe `bestEffort` helper logging debug diagnostics.
+- **Native Context Logger**: Migrated all plugin logging to the canonical Cordis `ctx.logger('subscriptions')` subsystem.
+- **Network Timeout Protection**: Hardened external vendor API calls (`listModels`, `fetchFor`, `quotaFetch`, `jsonTokenRequest`) with explicit `fetchWithTimeout` and `AbortSignal.timeout` safeguards.
+- **Design System Theming**: Replaced hardcoded styling values with native DeepSeek Harness CSS theme tokens (`--dsw-alias-*`, `color-mix`), achieving 100% theme token coverage and zero standalone `rgba` values.
+- **Client Dependency Injections**: Explicitly declared required client platform dependencies (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`) in package manifest.
+- **Strict Repository Hygiene**: Removed internal development instructions and planning artifacts from git tracking, enforcing clean public releases.
+
+---
+
 ## 🌐 Localization
 
 The plugin source language is English only. Russian and other translations are provided at runtime by separate language plugins (for example the russification plugin), which translate the registered locale keys - the package itself ships no bundled translations (Changed in 0.6.1).

package/README.ru.md

@@ -243,6 +243,27 @@ dsh-subscriptions:
 
 ---
 
+---
+
+## 🔒 Защита OAuth Client ID и обновление ссылок (Добавлено в v0.6.11)
+
+- **Защита OAuth Client ID (GitHub #2)**: uildAuthorizeUrl и ntigravity.authorizeUrl теперь строго требуют непустой clientId. Если параметр не задан, сервер возвращает явный код ошибки HTTP 400 (missing_client_id), а интерфейс выводит подсказку с предложением указать ntigravityClientId в настройках или нажать «📥 Из CLI», предотвращая отправку битых запросов в Google OAuth.
+- **Секретный ключ в схеме настроек**: В схему Config добавлено поле ntigravityClientSecret для удобного ввода Client Secret рядом с ntigravityClientId с автоматическим маскированием в публичном API.
+- **Актуализация маршрута Zhipu GLM (GitHub #3)**: Ссылка на консоль API-ключей Zhipu GLM обновлена на актуальный адрес (https://bigmodel.cn/usercenter/proj-mgmt/apikeys), устраняя ошибку 404 («页面跑丢啦！！»), вызванную миграцией маршрутов вендора.
+
+---
+
+## 🛡️ Надежность и стандарты качества (Добавлено в v0.6.10)
+
+- **Структурированная обработка ошибок**: Устранены все пустые блоки catch в рантайме плагина с переходом на безопасный хелпер `bestEffort` с диагностическим логированием.
+- **Нативный логгер контекста**: Все вызовы логирования переведены на официальную подсистему Cordis `ctx.logger('subscriptions')`.
+- **Защита внешних вызовов таймаутами**: Все сетевые интеграции к API вендоров (`listModels`, `fetchFor`, `quotaFetch`, `jsonTokenRequest`) защищены таймаутами через `fetchWithTimeout` и `AbortSignal.timeout`.
+- **Семантическая UI-темизация**: Статические цвета и rgba-значения в `client.js` заменены на нативные CSS-переменные дизайн-системы DeepSeek Harness (`--dsw-alias-*`, `color-mix`), достигнут 0 остаточных `rgba`.
+- **Декларация клиентских зависимостей**: Задекларированы платформенные инжекты (`@deepseek-ai/dsh-client-locale`, `@deepseek-ai/dsh-client-ui-slots`) в манифесте `package.json`.
+- **Чистота публичного репозитория**: Внутренние инструкции разработки и артефакты планирования исключены из git-отслеживания и добавлены в `.gitignore`.
+
+---
+
 ## 🌐 Локализация
 
 Исходный язык плагина - только английский. Русский и другие переводы во время работы предоставляют отдельные языковые плагины (например, плагин русификации), переводящие зарегистрированные ключи локали, - сам пакет не содержит встроенных переводов (Changed in 0.6.1).

package/README.zh.md

@@ -165,6 +165,27 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ---
 
+---
+
+## 🔒 OAuth Client ID 校验保护与控制台地址更新 (v0.6.11 新增)
+
+- **Google OAuth Client ID 校验保护 (GitHub #2)**：uildAuthorizeUrl 和 ntigravity.authorizeUrl 严格要求非空 clientId。未配置时服务端返回明确的 HTTP 400 (missing_client_id)，前端界面提示用户在插件设置中填写 ntigravityClientId 或使用“📥 从 CLI 导入”，避免浏览器跳转至 Google OAuth 400 报错页面。
+- **配置架构新增密钥项**：在插件 Config 架构中新增 ntigravityClientSecret，方便用户在设置中配置客户端密钥，并在公共接口中自动脱敏脱密。
+- **智谱 GLM 控制台地址迁移 (GitHub #3)**：将智谱 GLM 授权与 API Key 获取链接更新为最新控制台有效路由 (https://bigmodel.cn/usercenter/proj-mgmt/apikeys)，彻底解决因服务商控制台路由调整导致的 404 错误。
+
+---
+
+## 🛡️ 稳定性与代码质量强化 (v0.6.10 新增)
+
+- **结构化异常降级**: 全面移除运行时空 catch 块，统一采用带诊断日志的 `bestEffort` 安全兜底机制。
+- **原生上下文日志**: 所有日志统一接入 Cordis 规范子系统 `ctx.logger('subscriptions')`。
+- **外部网络超时保护**: 为所有模型商 API 网络调用（`listModels`、`fetchFor`、`quotaFetch`、`jsonTokenRequest`）建立 `fetchWithTimeout` 与 `AbortSignal.timeout` 超时熔断保护。
+- **设计系统主题对齐**: 将 `client.js` 中的静态样式硬编码替换为 DeepSeek Harness 原生 CSS 主题令牌（`--dsw-alias-*`、`color-mix`），彻底消除独立的 `rgba` 颜色。
+- **客户端依赖注入显式化**: 在 `package.json` 清单中显式声明前端所需平台注入项（`@deepseek-ai/dsh-client-locale` 与 `@deepseek-ai/dsh-client-ui-slots`）。
+- **公开仓库卫生规范**: 将内部研发指令与计划文件移出 Git 跟踪并加入 `.gitignore`，确保公开版本干净无私有残余。
+
+---
+
 ## 🌐 本地化
 
 插件源语言仅为英语。俄语及其他翻译由独立的语言插件（如俄化插件）在运行时对注册的本地化键进行翻译，包本身不内置翻译（Changed in 0.6.1）。

package/lib/accounts.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
@@ -70,7 +71,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
   const usageFetched = new Map()
   const doFetch = fetchImpl || fetch
   // #88: per-account proxy fetch for token refresh / usage (falls back to doFetch).
-  const fetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
+  const rawFetchFor = (ref) => (typeof fetchForRef === 'function' && fetchForRef(ref)) || doFetch
+  const fetchFor = (ref) => (url, init, opts) => fetchWithTimeout(rawFetchFor(ref), url, init, { timeoutMs: 25000, ...(opts || {}) })
 
   async function resolveRaw(ref) {
     try {
@@ -262,7 +264,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
             for (const th of THRESHOLDS) {
               if (pct >= th && prev < th) {
                 notifyThresholds.set(key, th)
-                try { onLimitNotice && onLimitNotice(slot.provider, slot.ref, win, th) } catch {}
+                try { onLimitNotice && onLimitNotice(slot.provider, slot.ref, win, th) } catch (err) { /* ignore notification failure */ }
                 break
               }
             }

package/lib/adapter.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 import { LlmAdapter, LlmError, attributionHeaders } from '@deepseek-ai/dsh-llm'
 import { displayName } from './refs.js'
 import { getVendor } from './vendors/index.js'
@@ -116,15 +117,15 @@ export class SubscriptionAdapter extends LlmAdapter {
           // ponytail: capture x-ratelimit headers without touching vendors
           const baseFetch = pickFetch(deps, account.ref)
           const quotaFetch = async (url, init) => {
-            const res = await baseFetch(url, init)
+            const res = await fetchWithTimeout(baseFetch, url, init, { timeoutMs: 120000 })
             try {
               const snap = quotaSnapshot(provider, res.headers, null, Date.now())
               if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
-            } catch {}
+            } catch (err) { /* ignore quota capture failure */ }
             if (!res.ok && res.clone) {
               try {
                 const txt = await res.clone().text()
-                let j=null; try{ j=JSON.parse(txt)}catch{}
+                let j=null; try { j = JSON.parse(txt) } catch (err) { j = null }
                 if (j) {
                   const b = parseBody(provider, j, Date.now())
                   if (b) {
@@ -132,7 +133,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                     if (snap2) deps.rememberQuota(account.ref, snap2)
                   }
                 }
-              } catch {}
+              } catch (err) { /* ignore quota capture failure */ }
             }
             return res
           }
@@ -162,7 +163,7 @@ export class SubscriptionAdapter extends LlmAdapter {
                   ms: Date.now() - t0,
                   kind: 'stream',
                 })
-              } catch {}
+              } catch (err) { /* ignore quota capture failure */ }
             }
           } catch (err) {
             if (err && err.code === 'VALIDATION_REQUIRED' && err.validationUrl) {

package/lib/client.js

@@ -21,7 +21,7 @@ window.__ModuleLoader__.load({
         return { hasError: true, error }
       }
       componentDidCatch(error, info) {
-        try { console.error("[dsh-subscriptions UI error]", error, info) } catch {}
+        try { console.error("[dsh-subscriptions UI error]", error, info) } catch (err) { /* fallback if console fails */ }
       }
       render() {
         if (this.state.hasError) {
@@ -63,7 +63,7 @@ window.__ModuleLoader__.load({
     '.dsub-helpBox{margin-top:8px;padding:12px 14px;border-radius:8px;background:var(--dsw-alias-bg-layer-1);border:1px solid var(--dsw-alias-border-l1);font-size:12px;line-height:1.6}' +
     '.dsub-helpHead{display:flex;align-items:center;justify-content:space-between;font-weight:600;margin-bottom:8px;color:var(--dsw-alias-brand-primary)}' +
     '.dsub-helpStep{margin-bottom:6px;color:var(--dsw-alias-label-primary)}' +
-    '.dsub-btnActive{background:var(--dsw-alias-brand-primary);color:#fff;border-color:var(--dsw-alias-brand-primary)}' +
+    '.dsub-btnActive{background:var(--dsw-alias-brand-primary);color:var(--dsw-alias-text-contrast,#fff);border-color:var(--dsw-alias-brand-primary)}' +
     '.dsub-h{font-size:13.5px;font-weight:600;color:var(--dsw-alias-label-primary)}' +
     '.dsub-sub{font-size:12px;color:var(--dsw-alias-label-secondary)}' +
     '.dsub-dim{font-size:11.5px;color:var(--dsw-alias-label-tertiary)}' +
@@ -77,7 +77,7 @@ window.__ModuleLoader__.load({
     '.dsub-inp{height:30px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 8px;font-size:12px;min-width:180px}' +
     '.dsub-inp:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}' +
     '.dsub-box{border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:10px;margin-top:8px;background:var(--dsw-alias-bg-layer-2)}' +
-    '.dsub-cooldown{display:inline-block;padding:2px 6px;border-radius:4px;background:var(--dsw-alias-state-warning-primary);color:#000;font-size:11px;font-weight:600}' +
+    '.dsub-cooldown{display:inline-block;padding:2px 6px;border-radius:4px;background:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-bg-layer-1,#000);font-size:11px;font-weight:600}' +
     '.dsub-bar{position:relative;height:6px;border-radius:3px;background:var(--dsw-alias-bg-layer-1);overflow:hidden;flex:1;min-width:80px}' +
     '.dsub-barFill{height:100%;border-radius:3px;background:var(--dsw-alias-state-success-primary);transition:width .2s}' +
     '.dsub-barWarn .dsub-barFill{background:var(--dsw-alias-state-warning-primary)}' +
@@ -86,8 +86,8 @@ window.__ModuleLoader__.load({
     '.dsub-manual{display:flex;flex-direction:column;gap:6px;margin-top:4px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-verify{font-size:12px;color:var(--dsw-alias-state-warning-primary)}' +
     '.dsub-verify a{color:var(--dsw-alias-brand-primary)}' +
-    '.dsub-pill{display:inline-flex;align-items:center;gap:7px;height:28px;padding:0 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;box-shadow:0 1px 3px rgba(0,0,0,.15),inset 0 1px 0 rgba(255,255,255,.06);transition:all .16s ease;user-select:none}' +
-    '.dsub-pill:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary);transform:translateY(-1px);box-shadow:0 3px 8px rgba(0,0,0,.25),inset 0 1px 0 rgba(255,255,255,.1)}' +
+    '.dsub-pill{display:inline-flex;align-items:center;gap:7px;height:28px;padding:0 11px;border:1px solid var(--dsw-alias-border-l2);border-radius:999px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-size:12px;font-weight:600;cursor:pointer;box-shadow:0 1px 3px color-mix(in srgb, black 15%, transparent),inset 0 1px 0 color-mix(in srgb, white 6%, transparent);transition:all .16s ease;user-select:none}' +
+    '.dsub-pill:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary);transform:translateY(-1px);box-shadow:0 3px 8px color-mix(in srgb, black 25%, transparent),inset 0 1px 0 color-mix(in srgb, white 10%, transparent)}' +
     '.dsub-pill:active{transform:translateY(0)}' +
     '.dsub-pillTag{padding:1px 5px;border-radius:4px;font-size:10.5px;font-weight:700;letter-spacing:.02em;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary)}' +
     '.dsub-led{width:7px;height:7px;border-radius:50%;flex:none;transition:all .2s ease}' +
@@ -95,15 +95,15 @@ window.__ModuleLoader__.load({
     '.dsub-ledWarn{background:var(--dsw-alias-state-warning-primary,#f59e0b);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-warning-primary) 70%,transparent)}' +
     '.dsub-ledBad{background:var(--dsw-alias-state-error-primary,#ef4444);box-shadow:0 0 6px color-mix(in srgb,var(--dsw-alias-state-error-primary) 70%,transparent)}' +
     '.dsub-ledOff{background:var(--dsw-alias-label-tertiary,#6b7280)}' +
-    '.dsub-modalWrap{position:fixed;inset:0;z-index:10020;display:grid;place-items:center;background:rgba(0,0,0,.65);backdrop-filter:blur(10px);animation:dsubFadeIn .16s ease-out}' +
-    '.dsub-modal{width:min(520px,94vw);max-height:min(85vh,720px);overflow-y:auto;border:1px solid var(--dsw-alias-border-l1);border-radius:16px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);box-shadow:0 24px 64px rgba(0,0,0,.6),0 0 0 1px rgba(255,255,255,.07);padding:20px;animation:dsubScaleIn .18s cubic-bezier(.16,1,.3,1)}' +
+    '.dsub-modalWrap{position:fixed;inset:0;z-index:10020;display:grid;place-items:center;background:color-mix(in srgb, black 65%, transparent);backdrop-filter:blur(10px);animation:dsubFadeIn .16s ease-out}' +
+    '.dsub-modal{width:min(520px,94vw);max-height:min(85vh,720px);overflow-y:auto;border:1px solid var(--dsw-alias-border-l1);border-radius:16px;background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-primary);box-shadow:0 24px 64px color-mix(in srgb, black 60%, transparent),0 0 0 1px color-mix(in srgb, white 7%, transparent);padding:20px;animation:dsubScaleIn .18s cubic-bezier(.16,1,.3,1)}' +
     '@keyframes dsubFadeIn{from{opacity:0}to{opacity:1}}' +
     '@keyframes dsubScaleIn{from{opacity:0;transform:scale(.96)}to{opacity:1;transform:scale(1)}}' +
     '.dsub-modalHead{display:flex;align-items:center;justify-content:space-between;gap:12px;padding-bottom:14px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-modalTitleWrap{display:flex;align-items:center;gap:10px}' +
     '.dsub-modalIcon{width:30px;height:30px;border-radius:8px;background:var(--dsw-alias-bg-layer-1);display:grid;place-items:center;color:var(--dsw-alias-brand-primary);font-size:14px}' +
     '.dsub-modalBadge{font-size:11px;font-weight:600;padding:2px 7px;border-radius:10px;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary)}' +
-    '.dsub-heroCard{margin-top:14px;padding:14px 16px;border-radius:12px;background:linear-gradient(135deg,var(--dsw-alias-bg-layer-2) 0%,var(--dsw-alias-bg-layer-3) 100%);border:1px solid var(--dsw-alias-border-l1);box-shadow:inset 0 1px 0 rgba(255,255,255,.05)}' +
+    '.dsub-heroCard{margin-top:14px;padding:14px 16px;border-radius:12px;background:linear-gradient(135deg,var(--dsw-alias-bg-layer-2) 0%,var(--dsw-alias-bg-layer-3) 100%);border:1px solid var(--dsw-alias-border-l1);box-shadow:inset 0 1px 0 color-mix(in srgb, white 5%, transparent)}' +
     '.dsub-heroHead{display:flex;align-items:center;justify-content:space-between;margin-bottom:10px}' +
     '.dsub-heroTitle{font-size:14px;font-weight:700;display:flex;align-items:center;gap:6px}' +
     '.dsub-heroModel{font-size:11.5px;color:var(--dsw-alias-label-secondary);font-family:ui-monospace,monospace}' +
@@ -113,9 +113,9 @@ window.__ModuleLoader__.load({
     '.dsub-summary:hover{color:var(--dsw-alias-label-primary)}' +
     '.dsub-header-bar{display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;padding:8px 0 12px;margin-bottom:8px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +
     '.dsub-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500}' +
-    '.dsub-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:rgba(16,185,129,0.08)}' +
-    '.dsub-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:rgba(245,158,11,0.08)}' +
-    '.dsub-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:rgba(239,68,68,0.08)}' +
+    '.dsub-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent)}' +
+    '.dsub-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb,var(--dsw-alias-state-warning-primary) 10%,transparent)}' +
+    '.dsub-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent)}' +
     '.dsub-badge-neutral{border-color:var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);background:var(--dsw-alias-bg-layer-2)}' +
     '.dsub-section-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;padding:14px 16px;display:flex;flex-direction:column;gap:10px;margin-top:12px}' +
     '.dsub-section-title{font-size:14.5px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between;gap:8px}' +
@@ -124,8 +124,8 @@ window.__ModuleLoader__.load({
     '.dsub-stat-box{padding:10px 12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);display:flex;flex-direction:column;gap:3px}' +
     '.dsub-stat-val{font-size:16.5px;font-weight:700;color:var(--dsw-alias-label-primary)}' +
     '.dsub-stat-lbl{font-size:11.5px;color:var(--dsw-alias-label-secondary)}' +
-    '.dsub-alert-ok{padding:8px 12px;border-radius:8px;background:rgba(16,185,129,0.09);color:var(--dsw-alias-state-success-primary);font-size:12.5px;border:1px solid rgba(16,185,129,0.25)}' +
-    '.dsub-alert-bad{padding:8px 12px;border-radius:8px;background:rgba(239,68,68,0.09);color:var(--dsw-alias-state-error-primary);font-size:12.5px;border:1px solid rgba(239,68,68,0.25)}' +
+    '.dsub-alert-ok{padding:8px 12px;border-radius:8px;background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent);color:var(--dsw-alias-state-success-primary);font-size:12.5px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-success-primary) 25%,transparent)}' +
+    '.dsub-alert-bad{padding:8px 12px;border-radius:8px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent);color:var(--dsw-alias-state-error-primary);font-size:12.5px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary) 25%,transparent)}' +
     '.dsub-btn-primary{background:var(--dsw-alias-label-primary) !important;color:var(--dsw-alias-bg-layer-3) !important;border-color:transparent !important;font-weight:600}' +
     '.dsub-btn-primary:hover:not(:disabled){opacity:0.9}' +
     '.dsub-model-grid{display:flex;flex-wrap:wrap;gap:6px;margin-top:6px}' +
@@ -158,14 +158,14 @@ window.__ModuleLoader__.load({
     '.dsub-accountCard{display:flex;align-items:center;gap:12px;padding:10px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-2);margin-top:6px;transition:border-color .15s,background .15s}' +
     '.dsub-accountCard:hover{background:var(--dsw-alias-bg-layer-3);border-color:var(--dsw-alias-label-tertiary)}' +
     '.dsub-brandBadge{width:32px;height:32px;border-radius:8px;display:grid;place-items:center;font-size:12px;font-weight:700;flex-shrink:0}' +
-    '.dsub-brandCodex{background:rgba(16,185,129,.15);color:#10b981;border:1px solid rgba(16,185,129,.3)}' +
-    '.dsub-brandClaude{background:rgba(245,158,11,.15);color:#f59e0b;border:1px solid rgba(245,158,11,.3)}' +
-    '.dsub-brandGrok{background:rgba(168,85,247,.15);color:#c084fc;border:1px solid rgba(168,85,247,.3)}' +
-    '.dsub-brandAgy{background:rgba(59,130,246,.15);color:#60a5fa;border:1px solid rgba(59,130,246,.3)}' +
-    '.dsub-brandOllama{background:rgba(107,114,128,.15);color:#9ca3af;border:1px solid rgba(107,114,128,.3)}' +
-    '.dsub-brandKimi{background:rgba(236,72,153,.15);color:#f472b6;border:1px solid rgba(236,72,153,.3)}' +
-    '.dsub-brandGlm{background:rgba(20,184,166,.15);color:#2dd4bf;border:1px solid rgba(20,184,166,.3)}' +
-    '.dsub-planBadge{display:inline-flex;align-items:center;padding:1px 6px;border-radius:4px;font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:0.5px;background:rgba(99,102,241,.15);color:#818cf8;border:1px solid rgba(99,102,241,.3);margin-left:6px}' +
+    '.dsub-brandCodex{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 15%,transparent);color:var(--dsw-alias-state-success-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-state-success-primary) 30%,transparent)}' +
+    '.dsub-brandClaude{background:color-mix(in srgb,var(--dsw-alias-state-warning-primary) 15%,transparent);color:var(--dsw-alias-state-warning-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-state-warning-primary) 30%,transparent)}' +
+    '.dsub-brandGrok{background:color-mix(in srgb,#a855f7 15%,transparent);color:#c084fc;border:1px solid color-mix(in srgb,#a855f7 30%,transparent)}' +
+    '.dsub-brandAgy{background:color-mix(in srgb,var(--dsw-alias-brand-primary) 15%,transparent);color:var(--dsw-alias-brand-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 30%,transparent)}' +
+    '.dsub-brandOllama{background:color-mix(in srgb,var(--dsw-alias-label-tertiary) 15%,transparent);color:var(--dsw-alias-label-secondary);border:1px solid color-mix(in srgb,var(--dsw-alias-label-tertiary) 30%,transparent)}' +
+    '.dsub-brandKimi{background:color-mix(in srgb,#ec4899 15%,transparent);color:#f472b6;border:1px solid color-mix(in srgb,#ec4899 30%,transparent)}' +
+    '.dsub-brandGlm{background:color-mix(in srgb,#14b8a6 15%,transparent);color:#2dd4bf;border:1px solid color-mix(in srgb,#14b8a6 30%,transparent)}' +
+    '.dsub-planBadge{display:inline-flex;align-items:center;padding:1px 6px;border-radius:4px;font-size:10px;font-weight:600;text-transform:uppercase;letter-spacing:0.5px;background:color-mix(in srgb,var(--dsw-alias-brand-primary) 15%,transparent);color:var(--dsw-alias-brand-primary);border:1px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 30%,transparent);margin-left:6px}' +
     
     '.dsub-accInfo{flex:1;min-width:0;display:flex;flex-direction:column;gap:3px}' +
     '.dsub-accNameRow{display:flex;align-items:center;justify-content:space-between;gap:8px}' +
@@ -176,7 +176,7 @@ window.__ModuleLoader__.load({
     '.dsub-statusBad{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 15%,transparent);color:var(--dsw-alias-state-error-primary)}' +
     '.dsub-statusOff{background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-tertiary)}' +
     '.dsub-modalFoot{display:flex;align-items:center;justify-content:space-between;margin-top:16px;padding-top:12px;border-top:1px solid var(--dsw-alias-border-l2)}' +
-    '.dsub-btnPrimary{display:inline-flex;align-items:center;gap:6px;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;background:var(--dsw-alias-brand-primary,#3b82f6);color:#fff;border:0;cursor:pointer;transition:opacity .15s}' +
+    '.dsub-btnPrimary{display:inline-flex;align-items:center;gap:6px;padding:6px 12px;border-radius:8px;font-size:12px;font-weight:600;background:var(--dsw-alias-brand-primary,#3b82f6);color:var(--dsw-alias-text-contrast,#fff);border:0;cursor:pointer;transition:opacity .15s}' +
     '.dsub-btnPrimary:hover{opacity:.9}' +
     '.dsub-btnSec{display:inline-flex;align-items:center;gap:5px;padding:5px 10px;border-radius:7px;font-size:11.5px;font-weight:500;background:var(--dsw-alias-bg-layer-1);color:var(--dsw-alias-label-secondary);border:1px solid var(--dsw-alias-border-l2);cursor:pointer;text-decoration:none;transition:all .15s}' +
     '.dsub-btnSec:hover{background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-color:var(--dsw-alias-label-tertiary)}' +
@@ -292,7 +292,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           "3. 粘贴到输入框中并点击 \"保存令牌\"。",
           "4. 若已安装 ZCode CLI (~/.zcode)，点击 \"📥 从 CLI 导入\" 即可自动导入。",
         ],
-        link: "https://open.bigmodel.cn/usercenter/apikeys",
+        link: "https://bigmodel.cn/usercenter/proj-mgmt/apikeys",
       },
       grok: {
         title: "xAI Grok",
@@ -434,6 +434,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "fcMinutes": "m",
       "reconnect": "Reconnect",
       "connect": "Connect",
+      "missingClientIdAntigravity": "Google OAuth requires a custom Client ID. Please configure antigravityClientId in plugin settings below, or click '📥 From CLI' to import active credentials.",
       "disconnect": "Disconnect",
       "removeSlot": "Remove slot",
       "pastePlaceholder": "Paste redirected URL or code",
@@ -603,6 +604,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
       "fcMinutes": "分",
       "reconnect": "重新连接",
       "connect": "连接",
+      "missingClientIdAntigravity": "Google OAuth 需要自定义 Client ID。请在下方设置中配置 antigravityClientId，或点击‘📥 从 CLI 导入’直接导入本地会话。",
       "disconnect": "断开连接",
       "removeSlot": "移除槽位",
       "pastePlaceholder": "粘贴重定向 URL 或授权代码",
@@ -670,7 +672,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           if (parsed.error && parsed.error.message) text = parsed.error.message
           else if (parsed.message) text = parsed.message
           else if (parsed.code) text = parsed.code
-        } catch (e) {}
+        } catch (e) { /* ignore parse error */ }
       }
       var firstLine = text.split('\n')[0].trim()
       if (firstLine.length > 160) return firstLine.slice(0, 157) + '...'
@@ -837,7 +839,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           .then((d) => {
             const txt = d && d.ok ? JSON.stringify(d.report, null, 2) : ('error: ' + ((d && d.error && d.error.message) || 'unknown'))
             setDiag(txt)
-            try { navigator.clipboard.writeText(txt) } catch {}
+            try { navigator.clipboard.writeText(txt) } catch (err) { /* clipboard write disallowed */ }
           })
           .catch((e) => setDiag('error: ' + String(e && e.message || e)))
       }
@@ -985,6 +987,10 @@ const cssId = 'dsh-subscriptions/settings.module.css'
 
       const connect = async (provider, index) => {
         setErr('')
+        if (provider === 'antigravity' && (!draft || !draft.antigravityClientId || !String(draft.antigravityClientId).trim())) {
+          setErr(t('missingClientIdAntigravity'))
+          return
+        }
         const res = await fetch('/dsh-subscriptions/oauth/start?provider=' + encodeURIComponent(provider) + '&index=' + encodeURIComponent(index), { cache: 'no-store' })
         const data = await res.json().catch(() => ({}))
         if (!res.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
@@ -1419,7 +1425,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
           diag ? React.createElement('div', { className: 'dsub-row' },
             React.createElement('button', {
               type: 'button', className: 'dsub-mini',
-              onClick: () => { try { navigator.clipboard.writeText(diag) } catch {} },
+              onClick: () => { try { navigator.clipboard.writeText(diag) } catch (err) { /* clipboard write error */ } },
             }, t('diagCopy')),
             React.createElement('pre', { className: 'dsub-diag' }, diag),
           ) : null,
@@ -1588,7 +1594,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                       React.createElement('div', { className: 'dsub-row' },
                         React.createElement('button', {
                           type: 'button', className: 'dsub-mini',
-                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch {} },
+                          onClick: () => { try { navigator.clipboard.writeText(d.userCode) } catch (err) { /* clipboard write error */ } },
                         }, t('deviceCopy')),
                         React.createElement('a', { href: d.authUrl, target: '_blank', rel: 'noopener noreferrer', className: 'dsub-mini' }, t('verifyLink')),
                       ),
@@ -2065,7 +2071,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                   className: 'dsub-barFillGrad',
                   style: {
                     width: Math.min(100, Math.max(0, secPct)) + '%',
-                    background: secPct >= 90 ? '#ef4444' : (secPct >= 50 ? '#f59e0b' : '#3b82f6'),
+                    background: secPct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (secPct >= 50 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-brand-primary)'),
                   },
                 }),
               ),
@@ -2114,7 +2120,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                 className: 'dsub-barFillGrad',
                 style: {
                   width: Math.min(100, Math.max(0, pct)) + '%',
-                  background: pct >= 90 ? '#ef4444' : (pct >= 50 ? '#f59e0b' : '#10b981'),
+                  background: pct >= 90 ? 'var(--dsw-alias-state-error-primary)' : (pct >= 50 ? 'var(--dsw-alias-state-warning-primary)' : 'var(--dsw-alias-state-success-primary)'),
                 },
               }),
             ) : null,
@@ -2177,7 +2183,7 @@ const cssId = 'dsh-subscriptions/settings.module.css'
                   try {
                     const btn = Array.from(document.querySelectorAll('button')).find((b) => (b.textContent || '').includes(t('title')))
                     if (btn) btn.click()
-                  } catch {}
+                  } catch (err) { /* best-effort */ }
                 },
               }, t('subsOpenSettings')),
             ),

package/lib/config-schema.js

@@ -64,6 +64,8 @@ export const Config = z.object({
   grokClientVersion: z.string().default('')
     .description('Grok CLI identity version header. Empty uses the built-in default.'),
   antigravityClientId: z.string().default(''),
+  antigravityClientSecret: z.string().default('')
+    .description('Google Cloud OAuth Client Secret for Antigravity.'),
   antigravityRedirectUri: z.string().default(''),
   customVendors: z.array(z.any()).default([])
     .description('Declarative OpenAI-Responses-compatible providers. See README.'),

package/lib/index.js

@@ -1,3 +1,4 @@
+import { bestEffort } from './utils.js'
 export { Config, publicConfig, Slot, defaultSlots } from './config-schema.js'
 import { Config, publicConfig } from './config-schema.js'
 import { registerRoutes } from './routes.js'
@@ -37,7 +38,7 @@ export const inject = ['llm', 'credentials', 'webServer', 'settings']
 const NS = 'dsh-subscriptions'
 
 let pkgVersion = ''
-try { pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '' } catch {}
+try { pkgVersion = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version || '' } catch (err) { /* ignore package read errors at startup */ }
 const PENDING_TTL_MS = 15 * 60 * 1000
 
 function redirectFor(provider, cfg, origin) {
@@ -49,6 +50,7 @@ function redirectFor(provider, cfg, origin) {
 const OK_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</title><p>Signed in. You can close this tab and return to Settings.</p>'
 
 export function apply(ctx, config) {
+  const logger = ctx.logger ? ctx.logger('subscriptions') : console
   let getConfig = () => config
   let settingsApi
   ctx.inject(['settings'], (sctx) => {
@@ -68,7 +70,7 @@ export function apply(ctx, config) {
     try {
       profiles = (live().customVendors || []).map(validateProfile)
     } catch (e) {
-      try { ctx.log && ctx.log.warn && ctx.log.warn('[dsh-subscriptions] customVendors: ' + String(e && e.message || e)) } catch {}
+      if (logger && logger.warn) logger.warn('[dsh-subscriptions] customVendors: ' + String(e && e.message || e))
       return
     }
     clearCustomVendors()
@@ -79,7 +81,7 @@ export function apply(ctx, config) {
         registerCustomProviderIds([profile.id])
         if (profile.displayName) registerDisplayName(profile.id, profile.displayName)
       } catch (e) {
-        try { ctx.log && ctx.log.warn && ctx.log.warn('[dsh-subscriptions] customVendors[' + profile.id + ']: ' + String(e && e.message || e)) } catch {}
+        if (logger && logger.warn) logger.warn('[dsh-subscriptions] customVendors[' + profile.id + ']: ' + String(e && e.message || e))
       }
     }
   }
@@ -103,9 +105,9 @@ export function apply(ctx, config) {
     fetchForRef,
     onLimitNotice: (provider, ref, win, threshold) => {
       if (!live().notifyLimits) return
-      const label = win.ru || win.en || win.id
-      try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider} ${ref}: limit ${label} at ${threshold}%`) } catch {}
-      try { ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }) } catch {}
+      const label = win.en || win.ru || win.id
+      if (logger && logger.warn) logger.warn(`[dsh-subscriptions] ${provider} ${ref}: limit ${label} at ${threshold}%`)
+      bestEffort('emit limit-notice', () => ctx.emit && ctx.emit('subscriptions.limit-notice', { provider, ref, window: win.id, usedPercent: win.usedPercent, threshold }), undefined, logger)
     },
   })
   const history = new HistoryStore()
@@ -140,8 +142,8 @@ export function apply(ctx, config) {
     const models = await ollamaModels(ollamaBase(cfg), fetch).catch(() => [])
     if (!cfg.ollamaFallback || !models.length) throw err
     const model = cfg.ollamaFallbackModel || models[0].id
-    try { ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }) } catch {}
-    try { ctx.log && ctx.log.warn && ctx.log.warn(`[dsh-subscriptions] ${provider}: all accounts exhausted (${err && err.code || 'EXHAUSTED'}), falling back to ollama/${model}`) } catch {}
+    bestEffort('emit ollama-fallback', () => ctx.emit && ctx.emit('subscriptions.ollama-fallback', { provider, model, reason: err && err.code || 'EXHAUSTED' }), undefined, logger)
+    if (logger && logger.warn) logger.warn(`[dsh-subscriptions] ${provider}: all accounts exhausted (${err && err.code || 'EXHAUSTED'}), falling back to ollama/${model}`)
     try {
       recordHistory({
         provider: 'ollama',
@@ -152,7 +154,7 @@ export function apply(ctx, config) {
         status: 200,
         kind: 'fallback',
       })
-    } catch {}
+    } catch (err) { if (logger && logger.debug) logger.debug('[history] fallback record failed: ' + (err && err.message || err)) }
     yield* ollamaAdapter.stream({ ...options, provider: 'ollama', model })
   }
 
@@ -277,7 +279,7 @@ export function apply(ctx, config) {
         const fresh = await store.ensureFresh(provider, blob, slot.ref)
         const cfg = vendorConfig(provider, live())
         await getVendor(provider).listModels(fresh, cfg, fetch).catch(() => {})
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
   }
 
@@ -398,7 +400,7 @@ export function apply(ctx, config) {
         if (info.configured) pv.configured++
         if (info.cooldownUntil && info.cooldownUntil > Date.now()) pv.cooldown++
         if (info.usagePercent != null) pv.maxUsagePercent = Math.max(pv.maxUsagePercent || 0, Math.round(info.usagePercent))
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
     for (const p of Object.keys(providers)) providers[p].loggedIn = logged.includes(p)
     const rows = history.all()
@@ -478,7 +480,7 @@ export function apply(ctx, config) {
         for (const slot of normalizeSlots(live().slots)) {
           store.refreshUsage(slot.provider).catch(() => {})
         }
-      } catch {}
+      } catch (err) { /* best-effort */ }
     }
     eager()
     return () => {
@@ -509,9 +511,9 @@ export function apply(ctx, config) {
           if (blob.expiresAt - now > ahead) continue
           if (typeof store.shouldSkipRefresh === 'function' && store.shouldSkipRefresh(ref, now, retryMs)) continue
           await store.ensureFresh(slot.provider, blob, ref).catch((e) => {
-            try { ctx.log && ctx.log.warn && ctx.log.warn("[dsh-subscriptions] background refresh failed for " + ref + ": " + String(e && e.message || e)) } catch {}
+            if (logger && logger.warn) logger.warn("[dsh-subscriptions] background refresh failed for " + ref + ": " + String(e && e.message || e))
           })
-        } catch {}
+        } catch (err) { /* best-effort */ }
       }
     }
     tick().catch(() => {})
@@ -546,9 +548,9 @@ export function apply(ctx, config) {
           const cfg2 = vendorConfig(slot.provider, live())
           const probeFetch = async (u, i) => fetch(u, i)
           await vendor.check(fresh, cfg2, probeFetch).catch((e) => {
-            try { ctx.log && ctx.log.warn && ctx.log.warn("[dsh-subscriptions] probe " + ref + ": " + String(e && e.message || e).slice(0, 200)) } catch {}
+            if (logger && logger.warn) logger.warn("[dsh-subscriptions] probe " + ref + ": " + String(e && e.message || e).slice(0, 200))
           })
-        } catch {}
+        } catch (err) { /* best-effort */ }
       }
     }
     let lastProbeAt = 0

package/lib/mask.js

@@ -30,7 +30,7 @@ export function cleanErrorMessage(raw) {
       if (parsed.error && parsed.error.message) text = parsed.error.message
       else if (parsed.message) text = parsed.message
       else if (parsed.code) text = parsed.code
-    } catch {}
+    } catch (err) { /* ignore JSON parse failure */ }
   }
   const firstLine = text.split('\n')[0].trim()
   if (firstLine.length > 160) {

package/lib/oauth.js

@@ -7,6 +7,9 @@ export function buildAuthorizeUrl({
   extra,
   scope,
 }) {
+  if (!clientId || typeof clientId !== 'string' || !clientId.trim()) {
+    throw new Error('Missing required parameter: clientId')
+  }
   const url = new URL(authUrl)
   url.searchParams.set('response_type', 'code')
   url.searchParams.set('client_id', clientId)

package/lib/relative-time.js

@@ -20,14 +20,6 @@ export const RELATIVE_UNITS = {
     hour: '{n}小时',
     day: '{n}天',
   },
-  ru: {
-    soon: 'только что',
-    prefix: 'через ',
-    suffix: '',
-    minute: '{n} мин',
-    hour: '{n} ч',
-    day: '{n} дн',
-  },
 }
 
 function fill(template, n) {

package/lib/routes/oauth.js

@@ -51,7 +51,20 @@ export function registerOauthRoutes(ctx, state) {
         createdAt: Date.now(),
       })
       const cfg = { ...vendorConfig(provider, live()), redirectUri }
-      const url = getVendor(provider).authorizeUrl(cfg, pkce)
+      let url
+      try {
+        url = getVendor(provider).authorizeUrl(cfg, pkce)
+      } catch (err) {
+        pending.delete(pkce.state)
+        writeJson(res, 400, {
+          ok: false,
+          error: {
+            code: 'missing_client_id',
+            message: err.message || 'OAuth authorization configuration error',
+          },
+        })
+        return
+      }
       // #89: if redirect_uri is loopback - start a temporary catch server.
       let autoCatch = false
       if (live().autoLoopback) {

package/lib/routes/proxy.js

@@ -21,7 +21,7 @@ export function registerProxyRoutes(ctx, state) {
       }
       const raw = await readBody(req, 128 * 1024).catch(() => Buffer.alloc(0))
       let body = {}
-      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch {}
+      try { body = JSON.parse(raw.toString('utf8') || '{}') } catch (err) { body = {} }
       const events = Array.isArray(body && body.events) ? body.events : []
       const analysis = analyzeSessionEvents(events)
       writeJson(res, 200, { ok: true, analysis })

package/lib/routes/status.js

@@ -95,7 +95,7 @@ export function registerStatusRoutes(ctx, state) {
             expires[slot.provider] = Math.max(expires[slot.provider] || 0, slot.expiresAt)
             labels[slot.provider] = pmL(slot.label || info.label || slot.provider)
           }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
       }
       // #69/#72: active subscription = last successful request (newest first).
       let active = null
@@ -118,7 +118,7 @@ export function registerStatusRoutes(ctx, state) {
               .filter((w) => w && typeof w.usedPercent === 'number')
               .map((w) => ({ id: w.id || w.en || w.ru, label: w.en || w.ru || w.id, usedPercent: w.usedPercent }))
           }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
         active = {
           provider: lastRow.provider,
           index,
@@ -217,7 +217,7 @@ export function registerStatusRoutes(ctx, state) {
         try {
           const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
           if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-        } catch {}
+        } catch (err) { /* ignore status inspection error */ }
         return res2
       }
       try {
@@ -283,7 +283,7 @@ export function registerStatusRoutes(ctx, state) {
         return
       }
       let payload = {}
-      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch {}
+      try { payload = JSON.parse((await readBody(req, 64 * 1024)).toString('utf8') || '{}') } catch (err) { /* ignore status inspection error */ }
 
       let provider = payload.provider
       let index = payload.index || 1
@@ -331,7 +331,7 @@ export function registerStatusRoutes(ctx, state) {
           try {
             const snap = quotaSnapshot(provider, res2.headers, null, Date.now())
             if (snap) { capturedQuota = snap; store.rememberQuota(ref, snap) }
-          } catch {}
+          } catch (err) { /* ignore status inspection error */ }
           return res2
         }
         try {

package/lib/subscriptions.js

@@ -20,7 +20,7 @@ export function isAllowed(provider, path) {
   p = p.split("?")[0].split("#")[0]
   try {
     if (p.startsWith("http://") || p.startsWith("https://")) p = new URL(p).pathname
-  } catch {}
+  } catch (err) { /* ignore subscriptions error */ }
   if (!p.startsWith("/")) p = "/" + p
   for (const allowed of list) {
     const a = allowed.split("?")[0]
@@ -140,17 +140,17 @@ export function createSubscriptionsService(deps) {
           try {
             const snap = quotaSnapshot(provider, res.headers, null, Date.now())
             if (snap && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap)
-          } catch {}
+          } catch (err) { /* ignore subscriptions error */ }
           if (!res.ok && res.clone) {
             try {
               const txt = await res.clone().text()
               let j = null
-              try { j = JSON.parse(txt) } catch {}
+              try { j = JSON.parse(txt) } catch (err) { /* ignore subscriptions error */ }
               if (j) {
                 const snap2 = quotaSnapshot(provider, res.headers, j, Date.now())
                 if (snap2 && typeof deps.rememberQuota === "function") deps.rememberQuota(account.ref, snap2)
               }
-            } catch {}
+            } catch (err) { /* ignore subscriptions error */ }
           }
           if (!res.ok) {
             const txt = await res.text().catch(() => "")
@@ -174,7 +174,7 @@ export function createSubscriptionsService(deps) {
                 ms: Date.now() - t0,
                 kind: "request",
               })
-            } catch {}
+            } catch (err) { /* ignore subscriptions error */ }
           }
           return res
         } catch (err) {

package/lib/usage.js

@@ -52,22 +52,22 @@ export function asUsageSnapshot(percent) {
 // Named limit windows reported by vendors (five_hour, seven_day, primary...).
 // Label map is a data table: extend it when a vendor adds a window name.
 const WINDOW_LABELS = {
-  five_hour: { zh: "5小时", ru: "5ч", en: "5h" },
-  seven_day: { zh: "7天", ru: "7д", en: "7d" },
-  seven_day_oauth_apps: { zh: "7天应用", ru: "7д прил.", en: "7d apps" },
-  weekly_limit_7_days: { zh: "7天", ru: "7д", en: "7d" },
-  primary: { zh: "主配额", ru: "осн.", en: "primary" },
-  secondary: { zh: "次配额", ru: "втор.", en: "secondary" },
+  five_hour: { zh: "5小时", en: "5h" },
+  seven_day: { zh: "7天", en: "7d" },
+  seven_day_oauth_apps: { zh: "7天应用", en: "7d apps" },
+  weekly_limit_7_days: { zh: "7天", en: "7d" },
+  primary: { zh: "主配额", en: "primary" },
+  secondary: { zh: "次配额", en: "secondary" },
   // codex: the vendor API returns primary_window/secondary_window - surfaced as 5h/7d in the UI
-  primary_window: { zh: "5小时", ru: "5ч", en: "5h" },
-  secondary_window: { zh: "7天", ru: "7д", en: "7d" },
-  monthly: { zh: "月度", ru: "месяц", en: "month" },
-  credits: { zh: "点数", ru: "кредиты", en: "credits" },
+  primary_window: { zh: "5小时", en: "5h" },
+  secondary_window: { zh: "7天", en: "7d" },
+  monthly: { zh: "月度", en: "month" },
+  credits: { zh: "点数", en: "credits" },
 }
 
 export function windowLabel(id) {
   const known = WINDOW_LABELS[id]
-  return known || { zh: id, ru: id, en: id }
+  return known || { zh: id, en: id }
 }
 
 // Walk vendor usage JSON; every node carrying a utilization-style number
@@ -83,19 +83,19 @@ export function usageWindows(obj) {
     if (pct != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: pct })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: pct })
     }
     const frac = numberOrNull(value.remainingFraction)
     if (frac != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: (1 - frac) * 100 })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: (1 - frac) * 100 })
     }
     const ufrac = numberOrNull(value.usedFraction)
     if (ufrac != null && key && !seen.has(key)) {
       seen.add(key)
       const label = windowLabel(key)
-      out.push({ id: key, ru: label.ru, en: label.en, usedPercent: ufrac * 100 })
+      out.push({ id: key, zh: label.zh, en: label.en, usedPercent: ufrac * 100 })
     }
     for (const [k, child] of Object.entries(value)) {
       if (child && typeof child === "object") walk(child, k, depth + 1)

package/lib/utils.js

@@ -0,0 +1,25 @@
+/**
+ * Executes a function safely, capturing any error and logging it at debug level
+ * if a logger is provided, then returning the fallback value.
+ *
+ * Used across the plugin to eliminate empty catch blocks per dsh-plugin-preflight.
+ */
+export function bestEffort(label, fn, fallback = undefined, logger = null) {
+  try {
+    const res = fn()
+    if (res && typeof res.then === 'function') {
+      return res.catch((err) => {
+        if (logger && typeof logger.debug === 'function') {
+          logger.debug(`[bestEffort] ${label}: ${err && err.message || err}`)
+        }
+        return fallback
+      })
+    }
+    return res
+  } catch (err) {
+    if (logger && typeof logger.debug === 'function') {
+      logger.debug(`[bestEffort] ${label}: ${err && err.message || err}`)
+    }
+    return fallback
+  }
+}

package/lib/vendor-factory.js

@@ -1,3 +1,4 @@
+import { fetchWithTimeout } from "./http.js"
 // Vendor factory from a declarative profile.
 //
 // Covers the OpenAI-Responses-compatible subscription family: PKCE auth,
@@ -87,9 +88,9 @@ export function createVendorFromProfile(profile) {
       const catalog = defaultModels(cfg.models || profile.models || [])
       if (!profile.modelsPath) return catalog
       try {
-        const res = await (fetchImpl || fetch)(`${base}${profile.modelsPath}`, {
+        const res = await fetchWithTimeout(fetchImpl || fetch, `${base}${profile.modelsPath}`, {
           headers: identityHeaders(blob, { Accept: "application/json" }),
-        })
+        }, { timeoutMs: 15000 })
         const json = await readJson(res)
         const rows = []
         for (const entry of json.data || json.models || []) {

package/lib/vendors/antigravity.js

@@ -52,6 +52,9 @@ export function defaults() {
 }
 
 export function authorizeUrl(cfg, pkce) {
+  if (!cfg || !cfg.clientId || !String(cfg.clientId).trim()) {
+    throw new Error('Google OAuth requires a custom Client ID. Please configure antigravityClientId in plugin settings or use "From CLI" to import active credentials.')
+  }
   return buildAuthorizeUrl({
     authUrl: AUTH,
     clientId: cfg.clientId,

package/lib/vendors/glm.js

@@ -47,7 +47,7 @@ export function defaults() {
 }
 
 export function authorizeUrl() {
-  return 'https://open.bigmodel.cn/usercenter/apikeys'
+  return 'https://bigmodel.cn/usercenter/proj-mgmt/apikeys'
 }
 
 export async function listModels(_blob, cfg) {

package/lib/vendors/grok.js

@@ -220,7 +220,7 @@ export async function usage(blob, cfg, fetchImpl) {
           const decoded = decodeGrokCreditsFrame(Buffer.from(buf))
           if (decoded != null) pct = decoded
         }
-      } catch {}
+      } catch (err) { /* ignore grok usage capture error */ }
     }
     const snap = asUsageSnapshot(pct)
     if (snap) snap.windows = usageWindows(json)

package/lib/wire.js

@@ -199,12 +199,14 @@ export async function formTokenRequest(url, params, fetchImpl, headers, { timeou
   return readJson(res)
 }
 
-export async function jsonTokenRequest(url, body, fetchImpl, headers) {
+export async function jsonTokenRequest(url, body, fetchImpl, headers, { timeoutMs = 25000 } = {}) {
   const impl = fetchImpl || fetch
+  const timeoutSignal = AbortSignal.timeout(timeoutMs)
   const res = await impl(url, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json', Accept: 'application/json', ...(headers || {}) },
     body: JSON.stringify(body),
+    signal: timeoutSignal,
   })
   return readJson(res)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.6.9",
+  "version": "0.6.11",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -44,7 +44,10 @@
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ]
     }
   },
   "peerDependencies": {