@goodandready/dsh-subscriptions 0.7.10 → 0.7.12

package/bin/dsh-subscriptions.mjs

@@ -6,11 +6,12 @@ import { readFile } from 'node:fs/promises'
 export function parseArgs(argv) {
   const args = Array.isArray(argv) ? argv.slice() : []
   const command = args.shift() || 'status'
-  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
+  const options = { command, csv: false, json: false, once: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i]
     if (arg === '--csv') options.csv = true
     else if (arg === '--json') options.json = true
+    else if (arg === '--once') options.once = true
     else if (arg === '--help' || arg === '-h') options.help = true
     else if (arg === '--type') options.type = args[++i] || 'accounts'
     else if (arg === '--session') options.sessionId = args[++i] || ''
@@ -125,6 +126,36 @@ export function formatPacks(packs) {
   return JSON.stringify((Array.isArray(packs) ? packs : []).map(sanitizePack), null, 2) + '\\n'
 }
 
+export function renderTui(data, { color = false } = {}) {
+  const health = (data && data.health) || {}
+  const checks = health.checks || {}
+  const sources = (data && data.sources) || {}
+  const snapshots = (data && data.snapshots && data.snapshots.stats) || {}
+  const accounts = Array.isArray(data && data.accounts) ? data.accounts : []
+  const dim = (text) => color ? '\x1b[2m' + text + '\x1b[0m' : text
+  const green = (text) => color ? '\x1b[32m' + text + '\x1b[0m' : text
+  const red = (text) => color ? '\x1b[31m' + text + '\x1b[0m' : text
+  const lines = []
+  lines.push('DSH Subscriptions' + (health.version ? ' ' + health.version : '') + '  ' + (health.status === 'healthy' ? green('healthy') : red(health.status || 'unknown')))
+  lines.push(dim('accounts: ' + (checks.connectedAccounts || 0) + ' configured · key-rotation: ' + (checks.keyRotation ? 'yes' : 'no') + ' · ollama: ' + (checks.ollama ? 'yes' : 'no') + ' · webhook: ' + (checks.webhook ? 'yes' : 'no')))
+  lines.push('')
+  lines.push('ACCOUNTS')
+  for (const account of accounts) {
+    if (!account || !account.provider) continue
+    const usage = account.usagePercent == null ? '-' : Math.round(account.usagePercent) + '%'
+    lines.push('  ' + String(account.provider).padEnd(14) + '#' + (account.index || 1) + '  ' + (account.configured ? green('ok') : dim('off')) + '  ' + usage)
+  }
+  lines.push('')
+  lines.push('SOURCES')
+  for (const row of (sources.providers || [])) lines.push('  ' + String(row.provider).padEnd(14) + (row.selected || dim('none')))
+  lines.push('')
+  lines.push('VAULT')
+  lines.push('  snapshots: ' + (snapshots.count || 0) + ' · ' + (snapshots.bytes || 0) + ' bytes')
+  lines.push('')
+  lines.push(dim('r refresh · q quit'))
+  return lines.join('\n')
+}
+
 export function formatSnapshotStatus(payload) {
   const stats = (payload && payload.stats) || {}
   return 'snapshots: ' + (stats.count || 0) + '  bytes: ' + (stats.bytes || 0) + '  path: ' + (stats.path || '-')
@@ -176,6 +207,21 @@ export function buildSetRequest(options, configPayload, env = process.env) {
 export async function run(argv = process.argv.slice(2), env = process.env, fetchImpl = fetch) {
   const options = parseArgs(argv)
   if (options.help) return { help: true }
+  if (options.command === 'tui') {
+    const base = String(env.DSH_SUBS_URL || 'http://127.0.0.1:3080/dsh-subscriptions').replace(/\/$/, '')
+    const headers = { Accept: 'application/json' }
+    if (env.DSH_AUTH_TOKEN) headers.Authorization = 'Bearer ' + env.DSH_AUTH_TOKEN
+    const get = (path) => fetchImpl(base + path, { method: 'GET', headers }).then(async (res) => {
+      const text = await res.text()
+      if (!res.ok) throw new Error('HTTP ' + res.status + ': ' + text.slice(0, 300))
+      return JSON.parse(text || '{}')
+    })
+    const [health, sources, snapshots, config] = await Promise.all([
+      get('/health'), get('/sources'), get('/vault/snapshots'), get('/config'),
+    ])
+    const data = { health, sources, snapshots, accounts: (config && config.accounts) || [] }
+    return { text: renderTui(data, { color: false }), tuiData: data, contentType: 'text/plain' }
+  }
   if (options.command === 'doctor') {
     const diagReq = buildRequest({ command: 'diagnostics' }, env)
     const srcReq = buildRequest({ command: 'sources' }, env)
@@ -242,12 +288,41 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
   return { text, contentType: res.headers.get('content-type') || '' }
 }
 
+async function runTui(initial) {
+  let cleanup = () => {}
+  const paint = (data) => process.stdout.write('\x1b[2J\x1b[H' + renderTui(data, { color: true }) + '\n')
+  paint(initial)
+  const onKey = async (buf) => {
+    const key = String(buf)
+    if (key === 'q' || key === '\u0003') { cleanup(); process.exit(0) }
+    if (key === 'r') {
+      try {
+        const next = await run(['tui', '--once'])
+        if (next.tuiData) paint(next.tuiData)
+      } catch (err) { process.stdout.write('\n' + String(err && err.message || err) + '\n') }
+    }
+  }
+  if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {
+    process.stdin.setRawMode(true)
+    process.stdin.resume()
+    process.stdin.on('data', onKey)
+    cleanup = () => {
+      process.stdin.removeListener('data', onKey)
+      process.stdin.setRawMode(false)
+      process.stdin.pause()
+    }
+  }
+}
+
 async function main() {
-  const result = await run()
+  const argv = process.argv.slice(2)
+  const options = parseArgs(argv)
+  const result = await run(argv)
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  doctor [--json]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|tui|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  tui [--once]\n  doctor [--json]\n')
     return
   }
+  if (result.tuiData && !options.once) { await runTui(result.tuiData); return }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')
   if (result.code) process.exitCode = result.code
 }

package/lib/alerts.js

@@ -16,6 +16,7 @@ try {
 const MAX_ALERTS = 100
 let defaultWebhookSecret = ''
 let defaultAllowPrivate = false
+let defaultWebhookFormat = 'native'
 
 export function setWebhookSecret(secret) {
   defaultWebhookSecret = String(secret || '')
@@ -24,6 +25,35 @@ export function setWebhookSecret(secret) {
 export function setWebhookAllowPrivate(allow) {
   defaultAllowPrivate = Boolean(allow)
 }
+
+export function setWebhookFormat(format) {
+  defaultWebhookFormat = format === 'notify' ? 'notify' : 'native'
+}
+
+export function toNotifyPayload(body) {
+  const sentAt = new Date().toISOString()
+  if (body && body.alert) {
+    return {
+      kind: body.alert.severity === 'info' ? 'task_done' : 'error',
+      title: 'DSH Subscriptions',
+      sessionId: 'dsh-subscriptions',
+      summary: body.alert.message || body.alert.type || 'subscription alert',
+      reason: body.alert.type || null,
+      source: 'dsh-subscriptions',
+      sentAt,
+    }
+  }
+  const digest = (body && body.digest) || { total: 0 }
+  return {
+    kind: digest.total > 0 ? 'error' : 'task_done',
+    title: 'DSH Subscriptions digest',
+    sessionId: 'dsh-subscriptions',
+    summary: String(digest.total || 0) + ' alerts in the digest',
+    reason: 'digest',
+    source: 'dsh-subscriptions',
+    sentAt,
+  }
+}
 const DEDUP_WINDOW_MS = 10 * 60 * 1000 // 10 minutes cooldown per (ref + type)
 
 const alertBuffer = []
@@ -106,10 +136,13 @@ async function dispatchNotification(body, webhookUrl, fetchImpl, options) {
   const { retries = 1, timeoutMs = 5000, sleep } = opts
   const secret = opts.secret == null ? defaultWebhookSecret : opts.secret
   const allowPrivate = opts.allowPrivate == null ? defaultAllowPrivate : Boolean(opts.allowPrivate)
+  const format = opts.format == null ? defaultWebhookFormat : opts.format
   const checked = validateWebhookUrl(webhookUrl, { allowPrivate })
   if (!checked.ok) return false
   webhookUrl = checked.url
-  const payload = { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
+  const payload = format === 'notify'
+    ? toNotifyPayload(body)
+    : { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
   const raw = JSON.stringify(payload)
   const headers = {
     'content-type': 'application/json',

package/lib/client.js

@@ -390,6 +390,47 @@ window.__ModuleLoader__.load({
       "cachePinnedBadge": "Cache Pinned",
       "reasoningEffortTitle": "Reasoning Effort Control",
       "reasoningEffortDesc": "Configure reasoning depth for models with extended thinking capabilities.",
+      "quotaWidget": "Quota widget",
+      "quotaWidgetOff": "Off",
+      "quotaWidgetDocked": "Docked",
+      "quotaWidgetFloating": "Floating (draggable)",
+      "quotaWidgetHint": "Floating: draggable; docked.",
+      "webhookUrl": "Webhook URL",
+      "webhookUrlHint": "Signed POST target for alerts.",
+      "webhookSecret": "Webhook secret",
+      "webhookFormat": "Webhook format",
+      "webhookFormatNative": "Native",
+      "webhookFormatNotify": "dsh-plugin-notify compatible",
+      "digestIntervalHours": "Digest interval (hours)",
+      "digestHint": "0 disables digests; needs a URL.",
+      "sendTest": "Send test",
+      "delivered": "delivered",
+      "vaultSnapshots": "Vault snapshots",
+      "vaultSnapshotsHint": "Encrypted slots; auto pre-pull.",
+      "createSnapshot": "Create snapshot",
+      "restoreSnapshot": "Restore",
+      "noSnapshots": "No snapshots yet.",
+      "created": "created",
+      "restoredSlots": "restored slots:",
+      "providerPacks": "Provider packs",
+      "providerPacksHint": "Add a Responses provider as JSON.",
+      "noPacks": "No packs yet.",
+      "validateAndSave": "Validate & save",
+      "exportPacks": "Export",
+      "exported": "exported",
+      "saved": "saved",
+      "sources": "Sources",
+      "sourcesHint": "Subscription → API key → Ollama.",
+      "keyRotationOffline": "key-rotation not installed/offline",
+      "keyRotationHealth": "key-rotation health",
+      "apiKeySource": "API key",
+      "oauthSource": "OAuth",
+      "ollamaSource": "Ollama",
+      "sourceNone": "none",
+      "openSettings": "Open settings",
+      "sourceAvailable": "available",
+      "sourceUnavailable": "unavailable",
+      "cooldownLabel": "cooldown",
       "reasoningLevelOff": "Off"
 };
 
@@ -704,6 +745,47 @@ window.__ModuleLoader__.load({
       "cachePinnedBadge": "缓存粘性",
       "reasoningEffortTitle": "推理强度控制",
       "reasoningEffortDesc": "为具备扩展思考能力的模型配置推理深度与思考预算。",
+      "quotaWidget": "额度组件",
+      "quotaWidgetOff": "关闭",
+      "quotaWidgetDocked": "停靠",
+      "quotaWidgetFloating": "浮动（可拖动）",
+      "quotaWidgetHint": "浮动可拖动；停靠右下。",
+      "webhookUrl": "Webhook 地址",
+      "webhookUrlHint": "警报的签名 POST 目标。",
+      "webhookSecret": "Webhook 密钥",
+      "webhookFormat": "Webhook 格式",
+      "webhookFormatNative": "原生",
+      "webhookFormatNotify": "兼容 dsh-plugin-notify",
+      "digestIntervalHours": "摘要间隔（小时）",
+      "digestHint": "0 关闭摘要；需要地址。",
+      "sendTest": "发送测试",
+      "delivered": "已送达",
+      "vaultSnapshots": "Vault 快照",
+      "vaultSnapshotsHint": "加密 slots 快照。",
+      "createSnapshot": "创建快照",
+      "restoreSnapshot": "恢复",
+      "noSnapshots": "尚无快照。",
+      "created": "已创建",
+      "restoredSlots": "已恢复 slots：",
+      "providerPacks": "供应商包",
+      "providerPacksHint": "JSON 添加供应商。",
+      "noPacks": "尚无供应商包。",
+      "validateAndSave": "验证并保存",
+      "exportPacks": "导出",
+      "exported": "已导出",
+      "saved": "已保存",
+      "sources": "来源",
+      "sourcesHint": "订阅 → 密钥 → Ollama。",
+      "keyRotationOffline": "key-rotation 未安装或离线",
+      "keyRotationHealth": "key-rotation 健康度",
+      "apiKeySource": "API 密钥",
+      "oauthSource": "OAuth",
+      "ollamaSource": "Ollama",
+      "sourceNone": "无",
+      "openSettings": "打开设置",
+      "sourceAvailable": "可用",
+      "sourceUnavailable": "不可用",
+      "cooldownLabel": "冷却",
       "reasoningLevelOff": "关闭"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
@@ -1829,21 +1911,21 @@ window.__ModuleLoader__.load({
             ),
           ),
           h('div', { className: 'dsub-sub' }, t('composerQuotaDisplayHint')),          h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Quota widget'),
+            h('span', { className: 'dsub-h' }, t('quotaWidget')),
             h('select', {
               className: 'dsub-select',
               value: draft.quotaWidget || 'docked',
               onChange: (e) => setDraft((d) => Object.assign({}, d, { quotaWidget: e.target.value })),
             },
-              h('option', { value: 'off' }, 'Off'),
-              h('option', { value: 'docked' }, 'Docked'),
-              h('option', { value: 'floating' }, 'Floating (draggable)'),
+              h('option', { value: 'off' }, t('quotaWidgetOff')),
+              h('option', { value: 'docked' }, t('quotaWidgetDocked')),
+              h('option', { value: 'floating' }, t('quotaWidgetFloating')),
             ),
           ),
-          h('div', { className: 'dsub-sub' }, 'Floating capsule can be dragged; docked stays bottom-right.'),
+          h('div', { className: 'dsub-sub' }, t('quotaWidgetHint')),
           h(SourcesPanel, { t }),
-          h(ProviderPacksPanel),
-          h(VaultSnapshotsPanel),
+          h(ProviderPacksPanel, { t }),
+          h(VaultSnapshotsPanel, { t }),
 
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, t('composerQuota')),
@@ -1875,7 +1957,7 @@ window.__ModuleLoader__.load({
           h('div', { className: 'dsub-sub' },
             t('expiryNotifyDaysHint')),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Webhook URL'),
+            h('span', { className: 'dsub-h' }, t('webhookUrl')),
             h('input', {
               type: 'url',
               className: 'dsub-inp',
@@ -1884,9 +1966,20 @@ window.__ModuleLoader__.load({
               onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookUrl: e.target.value })),
             }),
           ),
-          h('div', { className: 'dsub-sub' }, 'Signed POST target for quota, session and billing alerts.'),
+          h('div', { className: 'dsub-sub' }, t('webhookUrlHint')),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Webhook secret'),
+            h('span', { className: 'dsub-h' }, t('webhookFormat')),
+            h('select', {
+              className: 'dsub-select',
+              value: draft.webhookFormat || 'native',
+              onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookFormat: e.target.value })),
+            },
+              h('option', { value: 'native' }, t('webhookFormatNative')),
+              h('option', { value: 'notify' }, t('webhookFormatNotify')),
+            ),
+          ),
+          h('div', { className: 'dsub-row' },
+            h('span', { className: 'dsub-h' }, t('webhookSecret')),
             h('input', {
               type: 'password',
               className: 'dsub-inp',
@@ -1896,7 +1989,7 @@ window.__ModuleLoader__.load({
             }),
           ),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Digest interval (hours)'),
+            h('span', { className: 'dsub-h' }, t('digestIntervalHours')),
             h('input', {
               type: 'number',
               className: 'dsub-inp',
@@ -1907,8 +2000,8 @@ window.__ModuleLoader__.load({
               onChange: (e) => setDraft((d) => Object.assign({}, d, { digestIntervalHours: Number(e.target.value) || 0 })),
             }),
           ),
-          h('div', { className: 'dsub-sub' }, '0 disables digests. Requires a Webhook URL.'),
-          h(WebhookTestButton),
+          h('div', { className: 'dsub-sub' }, t('digestHint')),
+          h(WebhookTestButton, { t }),
           ),
           h('details', { className: 'dsub-group', open: true },
             h('summary', { className: 'dsub-groupHead' }, '🚦 ' + t('groupQueue')),
@@ -2049,19 +2142,19 @@ window.__ModuleLoader__.load({
             h('div', { className: 'dsub-sub', style: { marginTop: '4px' } }, t('modelsCatalogDesc')),
             h('div', { className: 'dsub-model-grid' },
               (Array.isArray(modelsCatalog) && modelsCatalog.length ? modelsCatalog : [
-                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: 'available' } },
-                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
-                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
-                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: 'available' } },
-                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: 'available' } },
-                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: 'available' } },
-                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: 'available' } },
-                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: 'available' } },
+                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: t('sourceAvailable') } },
+                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: t('sourceAvailable') } },
+                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: t('sourceAvailable') } },
+                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: t('sourceAvailable') } },
               ]).map((m, idx) => {
                 const poolStatus = m.pool ? m.pool.status : 'unconfigured'
                 const statusClass = 'dsub-model-status-' + poolStatus
                 let poolLabel = ''
-                if (poolStatus === 'available') {
+                if (poolStatus === t('sourceAvailable')) {
                   poolLabel = '🟢 ' + (m.pool && m.pool.remainingPercent != null ? (m.pool.remainingPercent + '%') : t('modelPoolAvailable'))
                 } else if (poolStatus === 'degraded') {
                   poolLabel = '🟡 ' + t('modelPoolDegraded') + (m.pool ? ' (' + m.pool.healthyAccounts + '/' + m.pool.totalAccounts + ')' : '')
@@ -3692,7 +3785,8 @@ window.__ModuleLoader__.load({
       )
     }
 
-    function WebhookTestButton() {
+    function WebhookTestButton(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ busy: false, message: '', error: null })
       const send = () => {
         setState({ busy: true, message: '', error: null })
@@ -3700,19 +3794,20 @@ window.__ModuleLoader__.load({
           .then(async (res) => {
             const data = await res.json().catch(() => ({}))
             if (!res.ok || !data.delivered) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
-            setState({ busy: false, message: 'delivered', error: null })
+            setState({ busy: false, message: t('delivered'), error: null })
           })
           .catch((err) => setState({ busy: false, message: '', error: String(err && err.message || err) }))
       }
       return h('div', { className: 'dsub-row' },
-        h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: send }, state.busy ? '…' : 'Send test'),
+        h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: send }, state.busy ? '…' : t('sendTest')),
         state.message ? h('span', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('span', { className: 'dsub-bad' }, state.error) : null,
       )
     }
 
     // #736: vault snapshot list with create/restore. Payload stays server-side.
-    function VaultSnapshotsPanel() {
+    function VaultSnapshotsPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ snapshots: [], stats: null, message: '', error: null, busy: false })
       const pull = () => {
         fetch('/dsh-subscriptions/vault/snapshots', { cache: 'no-store' })
@@ -3733,31 +3828,32 @@ window.__ModuleLoader__.load({
       const create = () => {
         setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
         call('/dsh-subscriptions/vault/snapshots', { label: 'manual' })
-          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'created ' + data.snapshot.id })); pull() })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: t('created') + ' ' + data.snapshot.id })); pull() })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
       const restore = (id) => {
         setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
         call('/dsh-subscriptions/vault/snapshots/restore', { id })
-          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'restored ' + data.slotCount + ' slots' })); pull() })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: t('restoredSlots') + ' ' + data.slotCount })); pull() })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Vault snapshots', h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : 'Create snapshot')),
-        h('div', { className: 'dsub-section-desc' }, 'Encrypted slots snapshots. A pre-pull snapshot is created automatically. Payload stays on the host.'),
+        h('div', { className: 'dsub-section-title' }, t('vaultSnapshots'), h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : t('createSnapshot'))),
+        h('div', { className: 'dsub-section-desc' }, t('vaultSnapshotsHint')),
         state.stats ? h('div', { className: 'dsub-dim' }, state.stats.count + ' snapshots · ' + state.stats.bytes + ' bytes · ' + state.stats.path) : null,
         state.snapshots.length ? state.snapshots.map((snap) => h('div', { className: 'dsub-row', key: snap.id },
           h('span', { className: 'dsub-h' }, snap.id),
           h('span', { className: 'dsub-dim' }, (snap.label || '-') + ' · ' + snap.slotCount + ' slots · ' + snap.createdAt),
-          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: () => restore(snap.id) }, 'Restore'),
-        )) : h('div', { className: 'dsub-dim' }, 'No snapshots yet.'),
+          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: () => restore(snap.id) }, t('restoreSnapshot')),
+        )) : h('div', { className: 'dsub-dim' }, t('noSnapshots')),
         state.message ? h('div', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
       )
     }
 
     // #724: provider pack manager. Displays ids/models only; headers are masked.
-    function ProviderPacksPanel() {
+    function ProviderPacksPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ packs: [], text: '', message: '', error: null, busy: false })
       const publicPack = (pack) => {
         const copy = Object.assign({}, pack)
@@ -3801,18 +3897,18 @@ window.__ModuleLoader__.load({
               body: JSON.stringify({ config: Object.assign({}, cfg.config, { providerPacks: packs }), revision: cfg.revision }),
             })
             if (!res.ok) throw new Error('HTTP ' + res.status)
-            setState((st) => Object.assign({}, st, { packs, busy: false, message: 'saved ' + checked.id, text: '' }))
+            setState((st) => Object.assign({}, st, { packs, busy: false, message: t('saved') + ' ' + checked.id, text: '' }))
           })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
-      const exportPacks = () => setState((st) => Object.assign({}, st, { text: JSON.stringify(st.packs.map(publicPack), null, 2), message: 'exported' }))
+      const exportPacks = () => setState((st) => Object.assign({}, st, { text: JSON.stringify(st.packs.map(publicPack), null, 2), message: t('exported') }))
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Provider packs', h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, '↻')),
-        h('div', { className: 'dsub-section-desc' }, 'Add an OpenAI-Responses-compatible provider as a JSON manifest. Headers are masked in the editor.'),
+        h('div', { className: 'dsub-section-title' }, t('providerPacks'), h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, '↻')),
+        h('div', { className: 'dsub-section-desc' }, t('providerPacksHint')),
         state.packs.length ? state.packs.map((pack) => h('div', { className: 'dsub-row', key: pack.id },
           h('span', { className: 'dsub-h' }, pack.id),
           h('span', { className: 'dsub-dim' }, (pack.displayName || '') + ' · ' + ((pack.models || []).length) + ' models'),
-        )) : h('div', { className: 'dsub-dim' }, 'No packs yet.'),
+        )) : h('div', { className: 'dsub-dim' }, t('noPacks')),
         h('textarea', {
           className: 'dsub-inp',
           style: { width: '100%', minHeight: 120, fontFamily: 'ui-monospace,monospace', padding: 8 },
@@ -3821,8 +3917,8 @@ window.__ModuleLoader__.load({
           onChange: (e) => setState((st) => Object.assign({}, st, { text: e.target.value, message: '', error: null })),
         }),
         h('div', { className: 'dsub-row' },
-          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: save }, state.busy ? '…' : 'Validate & save'),
-          h('button', { type: 'button', className: 'dsub-mini', onClick: exportPacks }, 'Export'),
+          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: save }, state.busy ? '…' : t('validateAndSave')),
+          h('button', { type: 'button', className: 'dsub-mini', onClick: exportPacks }, t('exportPacks')),
         ),
         state.message ? h('div', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
@@ -3830,7 +3926,8 @@ window.__ModuleLoader__.load({
     }
 
     // #713: read-only source chain panel. Never renders key values.
-    function SourcesPanel() {
+    function SourcesPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ loading: true, data: null, error: null })
       const pull = () => {
         fetch('/dsh-subscriptions/sources', { cache: 'no-store' })
@@ -3843,16 +3940,16 @@ window.__ModuleLoader__.load({
         const id = setInterval(pull, 30 * 1000)
         return () => clearInterval(id)
       }, [])
-      const sourceLabel = (source) => source === 'api-key' ? 'API key' : (source === 'oauth' ? 'OAuth' : (source === 'ollama' ? 'Ollama' : 'none'))
+      const sourceLabel = (source) => source === 'api-key' ? t('apiKeySource') : (source === 'oauth' ? t('oauthSource') : (source === 'ollama' ? t('ollamaSource') : t('sourceNone')))
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Sources', h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, state.loading ? '…' : '↻')),
-        h('div', { className: 'dsub-section-desc' }, 'Subscription → API key → Ollama. Read-only: key rotation owns its cooldowns.'),
+        h('div', { className: 'dsub-section-title' }, t('sources'), h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, state.loading ? '…' : '↻')),
+        h('div', { className: 'dsub-section-desc' }, t('sourcesHint')),
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
         state.data && state.data.keyRotation && !state.data.keyRotation.available
-          ? h('div', { className: 'dsub-dim' }, 'key-rotation not installed/offline' + (state.data.keyRotation.reason ? ': ' + state.data.keyRotation.reason : ''))
+          ? h('div', { className: 'dsub-dim' }, t('keyRotationOffline') + (state.data.keyRotation.reason ? ': ' + state.data.keyRotation.reason : ''))
           : null,
         state.data && state.data.keyRotation && state.data.keyRotation.available
-          ? h('div', { className: 'dsub-dim' }, 'key-rotation: ' + state.data.keyRotation.healthyKeys + '/' + state.data.keyRotation.totalKeys + ' healthy keys')
+          ? h('div', { className: 'dsub-dim' }, t('keyRotationHealth') + ': ' + state.data.keyRotation.healthyKeys + '/' + state.data.keyRotation.totalKeys + ' healthy keys')
           : null,
         (state.data && state.data.providers ? state.data.providers : []).map((row) => h('div', { className: 'dsub-row', key: row.provider },
           h('span', { className: 'dsub-h' }, row.provider),
@@ -3982,16 +4079,16 @@ window.__ModuleLoader__.load({
       },
         h('div', { className: 'dsub-h' }, String(state.active.provider || '').toUpperCase() + ' sources'),
         (state.candidates || []).map((c, i) => {
-          const label = c.source === 'api-key' ? 'API key' : (c.source === 'oauth' ? 'OAuth' : 'Ollama')
+          const label = c.source === 'api-key' ? t('apiKeySource') : (c.source === 'oauth' ? t('oauthSource') : t('ollamaSource'))
           const cd = c.detail && Array.isArray(c.detail.keys) ? Math.max(0, ...c.detail.keys.map((k) => Number(k.cooldownMsLeft) || 0)) : 0
           return h('div', { className: 'dsub-row', key: i },
             h('span', { className: 'dsub-h' }, label),
-            h('span', { className: c.available ? 'dsub-ok' : 'dsub-dim' }, c.available ? 'available' : 'unavailable'),
-            cd > 0 ? h('span', { className: 'dsub-dim' }, 'cooldown ' + Math.ceil(cd / 1000) + 's') : null,
+            h('span', { className: c.available ? 'dsub-ok' : 'dsub-dim' }, c.available ? t('sourceAvailable') : t('sourceUnavailable')),
+            cd > 0 ? h('span', { className: 'dsub-dim' }, t('cooldownLabel') + ' ' + Math.ceil(cd / 1000) + 's') : null,
             c.detail && c.detail.healthyKeys != null ? h('span', { className: 'dsub-dim' }, c.detail.healthyKeys + '/' + c.detail.totalKeys + ' keys') : null,
           )
         }),
-        h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setOpen(false); openSettings() } }, 'Open settings'),
+        h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setOpen(false); openSettings() } }, t('openSettings')),
       ) : null
       return h(React.Fragment, null, h('div', {
         className: 'dsub-qw' + (docked ? ' dsub-qwDocked' : '') + tone,

package/lib/config-schema.js

@@ -161,6 +161,8 @@ export const Config = z.object({
     .description('#720 HMAC-SHA256 secret used to sign webhook payloads.'),
   webhookAllowPrivate: z.boolean().volatile().default(false)
     .description('#729 Allow webhook URLs that resolve to private or loopback hosts.'),
+  webhookFormat: z.string().volatile().default('native')
+    .description('#751 Webhook payload format: native or notify (dsh-plugin-notify compatible).'),
   digestIntervalHours: z.number().volatile().default(0)
     .description('#720 Send an alert digest every N hours (0 disables digests).'),
   alertThresholds: z.array(z.number()).volatile().default([80, 90, 95])
@@ -189,6 +191,12 @@ export const Config = z.object({
     .description('#562 Remote storage backend: webdav, gist, or s3.'),
   vaultSyncPassphrase: z.string().role('secret').default('')
     .description('#562 Passphrase used to encrypt/decrypt the remote vault archive.'),
+  vaultDeviceId: z.string().volatile().default('')
+    .description('#749 Stable per-device vault id. Empty derives one from the host.'),
+  vaultDeviceLabel: z.string().volatile().default('')
+    .description('#749 Human-readable device label for vault metadata.'),
+  vaultPerDeviceKeys: z.boolean().volatile().default(true)
+    .description('#749 Derive a per-device passphrase and remote object; legacy shared vault stays readable.'),
   vaultSyncProviders: z.array(z.string()).volatile().default([])
     .description('#691 Optional provider allowlist for selective vault sync. Empty means all providers.'),
   vaultSyncIntervalHours: z.number().volatile().default(24)

package/lib/device-identity.js

@@ -0,0 +1,41 @@
+// #749: stable per-device identity. The passphrase is derived per device so
+// one device cannot decrypt another device's remote object with only the base
+// passphrase; the legacy shared object remains readable as a fallback.
+import { createHash } from 'node:crypto'
+import { hostname, platform, arch } from 'node:os'
+
+export function resolveDeviceIdentity({ id = '', label = '' } = {}) {
+  const host = hostname()
+  const derived = createHash('sha256').update(host + '|' + platform() + '|' + arch()).digest('hex').slice(0, 12)
+  const clean = String(id || derived).replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 32)
+  return { id: clean || derived, label: String(label || host) }
+}
+
+export function devicePassphrase(passphrase, deviceId) {
+  return deviceId ? String(passphrase) + '#' + String(deviceId) : String(passphrase)
+}
+
+export function withDeviceSuffix(name, deviceId) {
+  if (!deviceId) return name
+  const match = String(name).match(/^(.*?)(.[^./]+)?$/)
+  return (match && match[1] ? match[1] : String(name)) + '.' + deviceId + (match && match[2] ? match[2] : '')
+}
+
+export function deviceWebdavUrl(url, deviceId) {
+  if (!url || !deviceId) return url
+  try {
+    const parsed = new URL(url)
+    parsed.pathname = withDeviceSuffix(parsed.pathname, deviceId)
+    return parsed.toString()
+  } catch {
+    return url
+  }
+}
+
+export function deviceGistName(deviceId) {
+  return withDeviceSuffix('dsh-subscriptions-vault.enc', deviceId)
+}
+
+export function deviceS3Key(key, deviceId) {
+  return withDeviceSuffix(key || 'dsh-subscriptions-vault.enc', deviceId)
+}

package/lib/http.js

@@ -104,14 +104,11 @@ function configuredTrustedHosts(targetCtx) {
 }
 
 /**
- * @param {import('node:http').IncomingMessage} request
- * @param {any} [targetCtx]
- * @returns {boolean}/**
+ * Reject cross-site and untrusted writes and sensitive reads.
+ * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  * @param {import('node:http').IncomingMessage} request
  * @param {any} [targetCtx]
  * @returns {boolean}
- * Reject cross-site and untrusted writes and sensitive reads.
- * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  */
 export function isTrustedSettingsRequest(request, targetCtx) {
   const headers = request?.headers || {}

package/lib/index.js

@@ -28,7 +28,7 @@ import { createAccountsView } from './accounts-view.js'
 import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
 import { pickAccount, isAuthError } from './rotate.js'
-import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate } from './alerts.js'
+import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate, setWebhookFormat } from './alerts.js'
 import { isDigestDue } from './notification-scheduler.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
@@ -95,6 +95,7 @@ export function apply(ctx, rawConfig) {
   const live = () => {
     setWebhookSecret(cachedConfig.webhookSecret)
     setWebhookAllowPrivate(cachedConfig.webhookAllowPrivate)
+    setWebhookFormat(cachedConfig.webhookFormat)
     return cachedConfig
   }
 
@@ -616,7 +617,7 @@ export function apply(ctx, rawConfig) {
       const cfg = live()
       const alerts = getRecentAlerts(100)
       if (!isDigestDue({ lastDigestAt, nowMs: Date.now(), intervalHours: cfg.digestIntervalHours, alertCount: alerts.length })) return
-      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate })
+      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate, format: cfg.webhookFormat })
         .then((ok) => { if (ok) lastDigestAt = Date.now() })
         .catch(() => {})
     }

package/lib/mask.js

@@ -20,6 +20,7 @@ export function maskText(value) {
   return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
 }
 
+/** @type {Array<[RegExp, string]>} */
 const SECRET_PATTERNS = [
   [/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]'],
   [/\b(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|xox[baprs])[-_][A-Za-z0-9._-]{8,}/g, '[REDACTED]'],

package/lib/ollama-health.js

@@ -0,0 +1,25 @@
+// #755: health must probe the actual Ollama endpoint, not the fallback flag.
+let cache = { base: '', at: 0, value: false }
+
+export function clearOllamaHealthCache() {
+  cache = { base: '', at: 0, value: false }
+}
+
+export async function probeOllama(baseUrl, { fetchImpl = fetch, timeoutMs = 800, ttlMs = 10000, now = Date.now } = {}) {
+  if (!baseUrl) return false
+  const base = String(baseUrl).replace(/\/$/, '')
+  if (cache.base === base && (now() - cache.at) < ttlMs) return cache.value
+  let value = false
+  try {
+    const init = { method: 'GET' }
+    if (timeoutMs > 0 && typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') {
+      init.signal = AbortSignal.timeout(timeoutMs)
+    }
+    const res = await fetchImpl(base + '/api/tags', init)
+    value = Boolean(res && res.ok)
+  } catch {
+    value = false
+  }
+  cache = { base, at: now(), value }
+  return value
+}

package/lib/routes/oauth.js

@@ -292,10 +292,27 @@ export function registerOauthRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin or loopback only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const redirectUri = q.get('redirectUri') || ''
       const authUrl = q.get('authUrl') || ''
+      for (const [name, value] of [['redirectUri', redirectUri], ['authUrl', authUrl]]) {
+        if (!value) continue
+        try {
+          const parsed = new URL(value)
+          if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            writeJson(res, 400, { ok: false, error: { code: 'url', message: name + ' must use http(s)' } })
+            return
+          }
+        } catch {
+          writeJson(res, 400, { ok: false, error: { code: 'url', message: name + ' is invalid' } })
+          return
+        }
+      }
       const host = (req.headers && req.headers.host) || ''
       const user = process.env.USER || process.env.USERNAME || 'user'
       const info = getHeadlessAuthInfo({ provider, redirectUri, authUrl, host, user })

package/lib/routes/sources.js

@@ -1,11 +1,11 @@
 import { isTrustedSettingsRequest, safeJsonHandler, writeJson } from '../http.js'
 import { buildSourceChain, readKeyRotationStatus, subscriptionCandidate } from '../key-rotation-bridge.js'
 
-export async function collectSourceChain(state, port) {
+export async function collectSourceChain(state, port, { accounts } = {}) {
   const { accountsView, live } = state
   let subscriptions = []
   try {
-    const rows = await accountsView()
+    const rows = accounts || await accountsView()
     subscriptions = (rows || []).map(subscriptionCandidate)
   } catch { /* keep the chain available */ }
   const keyRotation = port

package/lib/routes/status.js

@@ -27,6 +27,7 @@ import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } f
 import { getVendor } from '../vendors/index.js'
 import { defaultErrorBuffer } from '../error-buffer.js'
 import { assessHealth } from '../health-report.js'
+import { probeOllama } from '../ollama-health.js'
 import { defaultSnapshotStore } from '../vault-snapshots.js'
 import { collectSourceChain } from './sources.js'
 
@@ -85,14 +86,15 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
-      const accounts = await accountsView().catch(() => [])
-      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const logged = typeof store.loggedInProviders === 'function' ? await store.loggedInProviders().catch(() => []) : []
+      const accounts = logged.map((provider) => ({ provider, configured: true }))
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort, { accounts })
       const health = assessHealth({
         accounts,
         sources,
         snapshots: defaultSnapshotStore.stats(),
         webhookUrl: live().webhookUrl,
-        ollama: live().ollamaFallback !== false,
+        ollama: await probeOllama(live().ollamaBaseUrl),
       })
       writeJson(res, 200, { ok: true, status: health.status, version: pkgVersion || 'unknown', checks: health.checks })
     }),

package/lib/routes/vault.js

@@ -1,6 +1,6 @@
 import { Config, plainConfig, revisionOf } from '../config-schema.js'
 import { isTrustedSettingsRequest, readBody, safeJsonHandler, writeJson } from '../http.js'
-import { capturePrePullSnapshot, restoreVaultSnapshot } from '../vault-sync.js'
+import { capturePrePullSnapshot, restoreSnapshotWithConfig, resolveVaultKey } from '../vault-sync.js'
 import { defaultSnapshotStore } from '../vault-snapshots.js'
 
 export function registerVaultRoutes(ctx, state) {
@@ -33,7 +33,11 @@ export function registerVaultRoutes(ctx, state) {
         return
       }
       try {
-        const snapshot = capturePrePullSnapshot(live().slots || [], passphrase, String(body.label || 'manual'))
+        const key = resolveVaultKey(live(), passphrase)
+        const snapshot = capturePrePullSnapshot(live().slots || [], key.passphrase, String(body.label || 'manual'), {
+          keyMode: key.keyMode,
+          deviceId: key.deviceId,
+        })
         writeJson(res, 200, { ok: true, snapshot })
       } catch (err) {
         writeJson(res, 400, { ok: false, error: { code: 'vault', message: String(err && err.message || err) } })
@@ -74,7 +78,7 @@ export function registerVaultRoutes(ctx, state) {
         return
       }
       try {
-        const restored = restoreVaultSnapshot(snapshot, passphrase)
+        const restored = restoreSnapshotWithConfig(snapshot, live())
         const cfg = live()
         const slots = stripLegacySlots(restored.slots || [])
         await api.replace(plainConfig(Config({ ...cfg, slots })), revisionOf(api))

package/lib/vault-snapshots.js

@@ -28,6 +28,8 @@ function meta(snapshot) {
     version: snapshot.version || 2,
     slotCount: Number(snapshot.slotCount) || 0,
     blobCount: Number(snapshot.blobCount) || 0,
+    keyMode: snapshot.keyMode || 'base',
+    deviceId: snapshot.deviceId || '',
   }
 }
 

package/lib/vault-sync.js

@@ -7,6 +7,7 @@ import { normalizeSlots } from './accounts.js'
 import { Config, plainConfig, revisionOf } from './config-schema.js'
 import { validateCredentialBlob } from './blob.js'
 import { defaultSnapshotStore } from './vault-snapshots.js'
+import { resolveDeviceIdentity, devicePassphrase, deviceWebdavUrl, deviceGistName, deviceS3Key } from './device-identity.js'
 
 let syncStatus = {
   enabled: false,
@@ -75,7 +76,7 @@ export async function pullFromWebdav({ url, username, password, fetchFn = fetch
 
 // --- Driver: Gist (GitHub / Gitea) ---
 
-export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fetchFn = fetch }) {
+export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!token) throw new Error('Gist access token is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -86,7 +87,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   }
 
   const files = {
-    'dsh-subscriptions-vault.enc': { content: encryptedData },
+    [fileName]: { content: encryptedData },
   }
 
   if (gistId) {
@@ -118,7 +119,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   return { ok: true, gistId: json.id }
 }
 
-export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fetchFn = fetch }) {
+export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!gistId) throw new Error('Gist ID is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -133,9 +134,9 @@ export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId,
   })
   if (!res.ok) throw new Error(`Gist pull failed: HTTP ${res.status} ${res.statusText}`)
   const json = await res.json()
-  const file = json.files && json.files['dsh-subscriptions-vault.enc']
+  const file = json.files && json.files[fileName]
   if (!file || !file.content) {
-    throw new Error('dsh-subscriptions-vault.enc not found in Gist')
+    throw new Error(fileName + ' not found in Gist')
   }
   return file.content
 }
@@ -268,14 +269,44 @@ export function mergeVaultSlots(localSlots, remoteSlots) {
   return { slots: out, conflicts }
 }
 
-export function createVaultSnapshot({ slots, blobs = {} }, passphrase, label = '') {
+export function createVaultSnapshot({ slots, blobs = {} }, passphrase, label = '', meta = {}) {
   if (!passphrase) throw new Error('passphrase is required for a vault snapshot')
   const { vault, slotCount, blobCount } = exportVault({ slots: slots || [], blobs }, passphrase)
-  return { version: 2, label: String(label || ''), createdAt: new Date().toISOString(), vault, slotCount, blobCount }
+  return { version: 2, label: String(label || ''), createdAt: new Date().toISOString(), vault, slotCount, blobCount, ...meta }
 }
 
-export function capturePrePullSnapshot(slots, passphrase, label = 'pre-pull') {
-  return defaultSnapshotStore.add(createVaultSnapshot({ slots: slots || [], blobs: {} }, passphrase, label))
+export function capturePrePullSnapshot(slots, passphrase, label = 'pre-pull', meta = {}) {
+  return defaultSnapshotStore.add(createVaultSnapshot({ slots: slots || [], blobs: {} }, passphrase, label, meta))
+}
+
+export function resolveVaultKey(cfg, passphrase) {
+  const perDevice = cfg && cfg.vaultPerDeviceKeys !== false
+  const device = resolveDeviceIdentity({ id: cfg && cfg.vaultDeviceId, label: cfg && cfg.vaultDeviceLabel })
+  return {
+    passphrase: perDevice ? devicePassphrase(passphrase, device.id) : passphrase,
+    keyMode: perDevice ? 'device' : 'base',
+    deviceId: perDevice ? device.id : '',
+  }
+}
+
+export function restoreSnapshotWithConfig(snapshot, cfg) {
+  const base = String((cfg && cfg.vaultSyncPassphrase) || '').trim()
+  if (!base) throw new Error('vaultSyncPassphrase is required to restore a snapshot')
+  const attempts = []
+  if (snapshot && snapshot.keyMode === 'device') {
+    attempts.push(devicePassphrase(base, snapshot.deviceId || resolveVaultKey(cfg, base).deviceId))
+  } else if (snapshot && snapshot.keyMode === 'base') {
+    attempts.push(base)
+  } else {
+    // Snapshots written before #749/#754 have no keyMode. Try the legacy
+    // base key first, then the current device key.
+    attempts.push(base, resolveVaultKey(cfg, base).passphrase)
+  }
+  let lastError = null
+  for (const pass of attempts) {
+    try { return restoreVaultSnapshot(snapshot, pass) } catch (err) { lastError = err }
+  }
+  throw lastError || new Error('unable to restore snapshot')
 }
 
 export function restoreVaultSnapshot(snapshot, passphrase) {
@@ -308,12 +339,15 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       } catch { /* ignore */ }
     }
 
-    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, passphrase)
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    const activePass = resolveVaultKey(cfg, passphrase).passphrase
+    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, activePass)
     const backend = cfg.vaultSyncBackend || 'webdav'
 
     if (backend === 'webdav') {
       await pushToWebdav({
-        url: cfg.vaultSyncWebdavUrl,
+        url: perDevice ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
         username: cfg.vaultSyncWebdavUsername,
         password: cfg.vaultSyncWebdavPassword,
         encryptedData: vault,
@@ -325,6 +359,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
         gistId: cfg.vaultSyncGistId,
         token: cfg.vaultSyncGistToken,
         encryptedData: vault,
+        fileName: perDevice ? deviceGistName(device.id) : undefined,
         fetchFn,
       })
       if (res.gistId && !cfg.vaultSyncGistId) {
@@ -334,7 +369,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       await pushToS3({
         endpoint: cfg.vaultSyncS3Endpoint,
         bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        key: perDevice ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
         region: cfg.vaultSyncS3Region || 'us-east-1',
         accessKey: cfg.vaultSyncS3AccessKey,
         secretKey: cfg.vaultSyncS3SecretKey,
@@ -376,38 +411,60 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
 
   try {
     const backend = cfg.vaultSyncBackend || 'webdav'
-    let encryptedData = ''
-
-    if (backend === 'webdav') {
-      encryptedData = await pullFromWebdav({
-        url: cfg.vaultSyncWebdavUrl,
-        username: cfg.vaultSyncWebdavUsername,
-        password: cfg.vaultSyncWebdavPassword,
-        fetchFn,
-      })
-    } else if (backend === 'gist') {
-      encryptedData = await pullFromGist({
-        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
-        gistId: cfg.vaultSyncGistId,
-        token: cfg.vaultSyncGistToken,
-        fetchFn,
-      })
-    } else if (backend === 's3') {
-      encryptedData = await pullFromS3({
-        endpoint: cfg.vaultSyncS3Endpoint,
-        bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
-        region: cfg.vaultSyncS3Region || 'us-east-1',
-        accessKey: cfg.vaultSyncS3AccessKey,
-        secretKey: cfg.vaultSyncS3SecretKey,
-        fetchFn,
-      })
-    } else {
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    let activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    let snapshotKeyMode = perDevice ? 'device' : 'base'
+    let usedLegacy = false
+    const load = async (deviceMode) => {
+      if (backend === 'webdav') {
+        return pullFromWebdav({
+          url: deviceMode ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
+          username: cfg.vaultSyncWebdavUsername,
+          password: cfg.vaultSyncWebdavPassword,
+          fetchFn,
+        })
+      }
+      if (backend === 'gist') {
+        return pullFromGist({
+          baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+          gistId: cfg.vaultSyncGistId,
+          token: cfg.vaultSyncGistToken,
+          fileName: deviceMode ? deviceGistName(device.id) : undefined,
+          fetchFn,
+        })
+      }
+      if (backend === 's3') {
+        return pullFromS3({
+          endpoint: cfg.vaultSyncS3Endpoint,
+          bucket: cfg.vaultSyncS3Bucket,
+          key: deviceMode ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
+          region: cfg.vaultSyncS3Region || 'us-east-1',
+          accessKey: cfg.vaultSyncS3AccessKey,
+          secretKey: cfg.vaultSyncS3SecretKey,
+          fetchFn,
+        })
+      }
       throw new Error(`unsupported vault sync backend: ${backend}`)
     }
+    let encryptedData
+    try {
+      encryptedData = await load(perDevice)
+    } catch (err) {
+      if (!perDevice) throw err
+      encryptedData = await load(false)
+      activePass = passphrase
+      snapshotKeyMode = 'base'
+      usedLegacy = true
+    }
 
-    try { capturePrePullSnapshot(cfg.slots || [], passphrase) } catch { /* snapshot is best-effort */ }
-    const result = importVault(encryptedData, passphrase)
+    try {
+      capturePrePullSnapshot(cfg.slots || [], activePass, 'pre-pull', {
+        keyMode: snapshotKeyMode,
+        deviceId: snapshotKeyMode === 'device' ? device.id : '',
+      })
+    } catch { /* snapshot is best-effort */ }
+    const result = importVault(encryptedData, activePass)
     const providerFilter = new Set((cfg.vaultSyncProviders || []).map((p) => String(p)))
     const remoteSlots = providerFilter.size
       ? result.slots.filter((slot) => providerFilter.has(String(slot && slot.provider)))
@@ -447,6 +504,9 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
       slotCount: result.slots.length,
       blobCount,
       conflicts: conflicts.length,
+      deviceId: device.id,
+      perDevice,
+      legacy: usedLegacy,
       exportedAt: result.exportedAt,
       timestamp: syncStatus.lastPullAt,
     }

package/lib/vendors/grok.js

@@ -132,6 +132,7 @@ function streamHeaders(blob, config, extra) {
     hostname = ''
   }
   if (!isTrustedAuthHost(hostname)) {
+    /** @type {Error & { code?: string }} */
     const err = new Error(`Untrusted Grok baseUrl host: ${hostname || base}`)
     err.code = 'GROK_UNTRUSTED_HOST'
     throw err

package/lib/vendors/index.js

@@ -51,6 +51,7 @@ export function clearCustomVendors() {
 
 const vendors = new Proxy({}, {
   get(_t, prop) {
+    if (typeof prop === 'symbol') return undefined
     if (prop in builtins) return builtins[prop]
     return customVendors.get(prop)
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.10",
+  "version": "0.7.12",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -39,7 +39,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && node --import ./test/_setup.mjs --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && npm run typecheck && node --import ./test/_setup.mjs --test test/*.test.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {