@goodandready/dsh-subscriptions 0.7.11 → 0.7.13

package/lib/client.js

@@ -390,6 +390,47 @@ window.__ModuleLoader__.load({
       "cachePinnedBadge": "Cache Pinned",
       "reasoningEffortTitle": "Reasoning Effort Control",
       "reasoningEffortDesc": "Configure reasoning depth for models with extended thinking capabilities.",
+      "quotaWidget": "Quota widget",
+      "quotaWidgetOff": "Off",
+      "quotaWidgetDocked": "Docked",
+      "quotaWidgetFloating": "Floating (draggable)",
+      "quotaWidgetHint": "Drag/dock.",
+      "webhookUrl": "Webhook URL",
+      "webhookUrlHint": "Signed target.",
+      "webhookSecret": "Webhook secret",
+      "webhookFormat": "Webhook format",
+      "webhookFormatNative": "Native",
+      "webhookFormatNotify": "dsh-plugin-notify compatible",
+      "digestIntervalHours": "Digest interval (hours)",
+      "digestHint": "0 = off.",
+      "sendTest": "Send test",
+      "delivered": "delivered",
+      "vaultSnapshots": "Vault snapshots",
+      "vaultSnapshotsHint": "Auto pre-pull.",
+      "createSnapshot": "Create snapshot",
+      "restoreSnapshot": "Restore",
+      "noSnapshots": "No snapshots yet.",
+      "created": "created",
+      "restoredSlots": "restored slots:",
+      "providerPacks": "Provider packs",
+      "providerPacksHint": "Add provider JSON.",
+      "noPacks": "No packs yet.",
+      "validateAndSave": "Validate & save",
+      "exportPacks": "Export",
+      "exported": "exported",
+      "saved": "saved",
+      "sources": "Sources",
+      "sourcesHint": "OAuth → key → Ollama.",
+      "keyRotationOffline": "key-rotation not installed/offline",
+      "keyRotationHealth": "key-rotation health",
+      "apiKeySource": "API key",
+      "oauthSource": "OAuth",
+      "ollamaSource": "Ollama",
+      "sourceNone": "none",
+      "openSettings": "Open settings",
+      "sourceAvailable": "available",
+      "sourceUnavailable": "unavailable",
+      "cooldownLabel": "cooldown",
       "reasoningLevelOff": "Off"
 };
 
@@ -704,6 +745,47 @@ window.__ModuleLoader__.load({
       "cachePinnedBadge": "缓存粘性",
       "reasoningEffortTitle": "推理强度控制",
       "reasoningEffortDesc": "为具备扩展思考能力的模型配置推理深度与思考预算。",
+      "quotaWidget": "额度组件",
+      "quotaWidgetOff": "关闭",
+      "quotaWidgetDocked": "停靠",
+      "quotaWidgetFloating": "浮动（可拖动）",
+      "quotaWidgetHint": "拖动/停靠",
+      "webhookUrl": "Webhook 地址",
+      "webhookUrlHint": "签名目标。",
+      "webhookSecret": "Webhook 密钥",
+      "webhookFormat": "Webhook 格式",
+      "webhookFormatNative": "原生",
+      "webhookFormatNotify": "兼容 dsh-plugin-notify",
+      "digestIntervalHours": "摘要间隔（小时）",
+      "digestHint": "0 关闭。",
+      "sendTest": "发送测试",
+      "delivered": "已送达",
+      "vaultSnapshots": "Vault 快照",
+      "vaultSnapshotsHint": "自动预拉取",
+      "createSnapshot": "创建快照",
+      "restoreSnapshot": "恢复",
+      "noSnapshots": "尚无快照。",
+      "created": "已创建",
+      "restoredSlots": "已恢复 slots：",
+      "providerPacks": "供应商包",
+      "providerPacksHint": "JSON 添加",
+      "noPacks": "尚无供应商包。",
+      "validateAndSave": "验证并保存",
+      "exportPacks": "导出",
+      "exported": "已导出",
+      "saved": "已保存",
+      "sources": "来源",
+      "sourcesHint": "订阅→密钥→Ollama",
+      "keyRotationOffline": "key-rotation 未安装或离线",
+      "keyRotationHealth": "key-rotation 健康度",
+      "apiKeySource": "API 密钥",
+      "oauthSource": "OAuth",
+      "ollamaSource": "Ollama",
+      "sourceNone": "无",
+      "openSettings": "打开设置",
+      "sourceAvailable": "可用",
+      "sourceUnavailable": "不可用",
+      "cooldownLabel": "冷却",
       "reasoningLevelOff": "关闭"
 };
     // #51: live countdown to the quota window reset (account.quota.resetAt).
@@ -855,6 +937,7 @@ window.__ModuleLoader__.load({
       // The translator comes from the slot because its registration declares locale.
       const t = (props && props.t) || ((key) => key)
       const [draft, setDraft] = React.useState(null)
+      const [newProviders, setNewProviders] = React.useState([])
       const [accounts, setAccounts] = React.useState([])
       const [providers, setProviders] = React.useState([])
       const [modelsCatalog, setModelsCatalog] = React.useState([])
@@ -1560,6 +1643,7 @@ window.__ModuleLoader__.load({
         const used = slots.filter((s) => s.provider === provider).map((s) => s.index)
         let index = 1
         while (used.indexOf(index) >= 0) index++
+        setNewProviders((prev) => prev.includes(provider) ? prev : prev.concat([provider]))
         setSlots((prev) => prev.concat([{ provider: provider, index: index, label: '' }]))
       }
 
@@ -1829,21 +1913,21 @@ window.__ModuleLoader__.load({
             ),
           ),
           h('div', { className: 'dsub-sub' }, t('composerQuotaDisplayHint')),          h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Quota widget'),
+            h('span', { className: 'dsub-h' }, t('quotaWidget')),
             h('select', {
               className: 'dsub-select',
               value: draft.quotaWidget || 'docked',
               onChange: (e) => setDraft((d) => Object.assign({}, d, { quotaWidget: e.target.value })),
             },
-              h('option', { value: 'off' }, 'Off'),
-              h('option', { value: 'docked' }, 'Docked'),
-              h('option', { value: 'floating' }, 'Floating (draggable)'),
+              h('option', { value: 'off' }, t('quotaWidgetOff')),
+              h('option', { value: 'docked' }, t('quotaWidgetDocked')),
+              h('option', { value: 'floating' }, t('quotaWidgetFloating')),
             ),
           ),
-          h('div', { className: 'dsub-sub' }, 'Floating capsule can be dragged; docked stays bottom-right.'),
+          h('div', { className: 'dsub-sub' }, t('quotaWidgetHint')),
           h(SourcesPanel, { t }),
-          h(ProviderPacksPanel),
-          h(VaultSnapshotsPanel),
+          h(ProviderPacksPanel, { t }),
+          h(VaultSnapshotsPanel, { t }),
 
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, t('composerQuota')),
@@ -1875,7 +1959,7 @@ window.__ModuleLoader__.load({
           h('div', { className: 'dsub-sub' },
             t('expiryNotifyDaysHint')),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Webhook URL'),
+            h('span', { className: 'dsub-h' }, t('webhookUrl')),
             h('input', {
               type: 'url',
               className: 'dsub-inp',
@@ -1884,20 +1968,20 @@ window.__ModuleLoader__.load({
               onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookUrl: e.target.value })),
             }),
           ),
-          h('div', { className: 'dsub-sub' }, 'Signed POST target for quota, session and billing alerts.'),
+          h('div', { className: 'dsub-sub' }, t('webhookUrlHint')),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Webhook format'),
+            h('span', { className: 'dsub-h' }, t('webhookFormat')),
             h('select', {
               className: 'dsub-select',
               value: draft.webhookFormat || 'native',
               onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookFormat: e.target.value })),
             },
-              h('option', { value: 'native' }, 'Native'),
-              h('option', { value: 'notify' }, 'dsh-plugin-notify compatible'),
+              h('option', { value: 'native' }, t('webhookFormatNative')),
+              h('option', { value: 'notify' }, t('webhookFormatNotify')),
             ),
           ),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Webhook secret'),
+            h('span', { className: 'dsub-h' }, t('webhookSecret')),
             h('input', {
               type: 'password',
               className: 'dsub-inp',
@@ -1907,7 +1991,7 @@ window.__ModuleLoader__.load({
             }),
           ),
           h('div', { className: 'dsub-row' },
-            h('span', { className: 'dsub-h' }, 'Digest interval (hours)'),
+            h('span', { className: 'dsub-h' }, t('digestIntervalHours')),
             h('input', {
               type: 'number',
               className: 'dsub-inp',
@@ -1918,8 +2002,8 @@ window.__ModuleLoader__.load({
               onChange: (e) => setDraft((d) => Object.assign({}, d, { digestIntervalHours: Number(e.target.value) || 0 })),
             }),
           ),
-          h('div', { className: 'dsub-sub' }, '0 disables digests. Requires a Webhook URL.'),
-          h(WebhookTestButton),
+          h('div', { className: 'dsub-sub' }, t('digestHint')),
+          h(WebhookTestButton, { t }),
           ),
           h('details', { className: 'dsub-group', open: true },
             h('summary', { className: 'dsub-groupHead' }, '🚦 ' + t('groupQueue')),
@@ -2060,19 +2144,19 @@ window.__ModuleLoader__.load({
             h('div', { className: 'dsub-sub', style: { marginTop: '4px' } }, t('modelsCatalogDesc')),
             h('div', { className: 'dsub-model-grid' },
               (Array.isArray(modelsCatalog) && modelsCatalog.length ? modelsCatalog : [
-                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: 'available' } },
-                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
-                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: 'available' } },
-                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: 'available' } },
-                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: 'available' } },
-                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: 'available' } },
-                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: 'available' } },
-                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: 'available' } },
+                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: t('sourceAvailable') } },
+                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: t('sourceAvailable') } },
+                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: t('sourceAvailable') } },
+                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: t('sourceAvailable') } },
               ]).map((m, idx) => {
                 const poolStatus = m.pool ? m.pool.status : 'unconfigured'
                 const statusClass = 'dsub-model-status-' + poolStatus
                 let poolLabel = ''
-                if (poolStatus === 'available') {
+                if (poolStatus === t('sourceAvailable')) {
                   poolLabel = '🟢 ' + (m.pool && m.pool.remainingPercent != null ? (m.pool.remainingPercent + '%') : t('modelPoolAvailable'))
                 } else if (poolStatus === 'degraded') {
                   poolLabel = '🟡 ' + t('modelPoolDegraded') + (m.pool ? ' (' + m.pool.healthyAccounts + '/' + m.pool.totalAccounts + ')' : '')
@@ -2460,7 +2544,8 @@ window.__ModuleLoader__.load({
               || slot.label || slot.proxyUrl || slot.expiresAt
               || (Array.isArray(slot.tags) && slot.tags.length) || slot.vipOnly || slot.isPro || slot.weight)
           }
-          const visibleNames = names.filter((prov) => slots.some((slot) => slot.provider === prov.id && configuredSlot(slot)))
+          const visibleNames = names.filter((prov) => newProviders.includes(prov.id)
+            || slots.some((slot) => slot.provider === prov.id && configuredSlot(slot)))
           const hiddenNames = names.filter((prov) => visibleNames.indexOf(prov) < 0)
           return h(React.Fragment, null,
             visibleNames.map((prov) => {
@@ -3703,7 +3788,8 @@ window.__ModuleLoader__.load({
       )
     }
 
-    function WebhookTestButton() {
+    function WebhookTestButton(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ busy: false, message: '', error: null })
       const send = () => {
         setState({ busy: true, message: '', error: null })
@@ -3711,19 +3797,20 @@ window.__ModuleLoader__.load({
           .then(async (res) => {
             const data = await res.json().catch(() => ({}))
             if (!res.ok || !data.delivered) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
-            setState({ busy: false, message: 'delivered', error: null })
+            setState({ busy: false, message: t('delivered'), error: null })
           })
           .catch((err) => setState({ busy: false, message: '', error: String(err && err.message || err) }))
       }
       return h('div', { className: 'dsub-row' },
-        h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: send }, state.busy ? '…' : 'Send test'),
+        h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: send }, state.busy ? '…' : t('sendTest')),
         state.message ? h('span', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('span', { className: 'dsub-bad' }, state.error) : null,
       )
     }
 
     // #736: vault snapshot list with create/restore. Payload stays server-side.
-    function VaultSnapshotsPanel() {
+    function VaultSnapshotsPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ snapshots: [], stats: null, message: '', error: null, busy: false })
       const pull = () => {
         fetch('/dsh-subscriptions/vault/snapshots', { cache: 'no-store' })
@@ -3744,31 +3831,32 @@ window.__ModuleLoader__.load({
       const create = () => {
         setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
         call('/dsh-subscriptions/vault/snapshots', { label: 'manual' })
-          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'created ' + data.snapshot.id })); pull() })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: t('created') + ' ' + data.snapshot.id })); pull() })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
       const restore = (id) => {
         setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
         call('/dsh-subscriptions/vault/snapshots/restore', { id })
-          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'restored ' + data.slotCount + ' slots' })); pull() })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: t('restoredSlots') + ' ' + data.slotCount })); pull() })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Vault snapshots', h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : 'Create snapshot')),
-        h('div', { className: 'dsub-section-desc' }, 'Encrypted slots snapshots. A pre-pull snapshot is created automatically. Payload stays on the host.'),
+        h('div', { className: 'dsub-section-title' }, t('vaultSnapshots'), h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : t('createSnapshot'))),
+        h('div', { className: 'dsub-section-desc' }, t('vaultSnapshotsHint')),
         state.stats ? h('div', { className: 'dsub-dim' }, state.stats.count + ' snapshots · ' + state.stats.bytes + ' bytes · ' + state.stats.path) : null,
         state.snapshots.length ? state.snapshots.map((snap) => h('div', { className: 'dsub-row', key: snap.id },
           h('span', { className: 'dsub-h' }, snap.id),
           h('span', { className: 'dsub-dim' }, (snap.label || '-') + ' · ' + snap.slotCount + ' slots · ' + snap.createdAt),
-          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: () => restore(snap.id) }, 'Restore'),
-        )) : h('div', { className: 'dsub-dim' }, 'No snapshots yet.'),
+          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: () => restore(snap.id) }, t('restoreSnapshot')),
+        )) : h('div', { className: 'dsub-dim' }, t('noSnapshots')),
         state.message ? h('div', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
       )
     }
 
     // #724: provider pack manager. Displays ids/models only; headers are masked.
-    function ProviderPacksPanel() {
+    function ProviderPacksPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ packs: [], text: '', message: '', error: null, busy: false })
       const publicPack = (pack) => {
         const copy = Object.assign({}, pack)
@@ -3812,18 +3900,18 @@ window.__ModuleLoader__.load({
               body: JSON.stringify({ config: Object.assign({}, cfg.config, { providerPacks: packs }), revision: cfg.revision }),
             })
             if (!res.ok) throw new Error('HTTP ' + res.status)
-            setState((st) => Object.assign({}, st, { packs, busy: false, message: 'saved ' + checked.id, text: '' }))
+            setState((st) => Object.assign({}, st, { packs, busy: false, message: t('saved') + ' ' + checked.id, text: '' }))
           })
           .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
       }
-      const exportPacks = () => setState((st) => Object.assign({}, st, { text: JSON.stringify(st.packs.map(publicPack), null, 2), message: 'exported' }))
+      const exportPacks = () => setState((st) => Object.assign({}, st, { text: JSON.stringify(st.packs.map(publicPack), null, 2), message: t('exported') }))
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Provider packs', h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, '↻')),
-        h('div', { className: 'dsub-section-desc' }, 'Add an OpenAI-Responses-compatible provider as a JSON manifest. Headers are masked in the editor.'),
+        h('div', { className: 'dsub-section-title' }, t('providerPacks'), h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, '↻')),
+        h('div', { className: 'dsub-section-desc' }, t('providerPacksHint')),
         state.packs.length ? state.packs.map((pack) => h('div', { className: 'dsub-row', key: pack.id },
           h('span', { className: 'dsub-h' }, pack.id),
           h('span', { className: 'dsub-dim' }, (pack.displayName || '') + ' · ' + ((pack.models || []).length) + ' models'),
-        )) : h('div', { className: 'dsub-dim' }, 'No packs yet.'),
+        )) : h('div', { className: 'dsub-dim' }, t('noPacks')),
         h('textarea', {
           className: 'dsub-inp',
           style: { width: '100%', minHeight: 120, fontFamily: 'ui-monospace,monospace', padding: 8 },
@@ -3832,8 +3920,8 @@ window.__ModuleLoader__.load({
           onChange: (e) => setState((st) => Object.assign({}, st, { text: e.target.value, message: '', error: null })),
         }),
         h('div', { className: 'dsub-row' },
-          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: save }, state.busy ? '…' : 'Validate & save'),
-          h('button', { type: 'button', className: 'dsub-mini', onClick: exportPacks }, 'Export'),
+          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: save }, state.busy ? '…' : t('validateAndSave')),
+          h('button', { type: 'button', className: 'dsub-mini', onClick: exportPacks }, t('exportPacks')),
         ),
         state.message ? h('div', { className: 'dsub-ok' }, state.message) : null,
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
@@ -3841,7 +3929,8 @@ window.__ModuleLoader__.load({
     }
 
     // #713: read-only source chain panel. Never renders key values.
-    function SourcesPanel() {
+    function SourcesPanel(props) {
+      const t = (props && props.t) || ((k) => k)
       const [state, setState] = React.useState({ loading: true, data: null, error: null })
       const pull = () => {
         fetch('/dsh-subscriptions/sources', { cache: 'no-store' })
@@ -3854,16 +3943,16 @@ window.__ModuleLoader__.load({
         const id = setInterval(pull, 30 * 1000)
         return () => clearInterval(id)
       }, [])
-      const sourceLabel = (source) => source === 'api-key' ? 'API key' : (source === 'oauth' ? 'OAuth' : (source === 'ollama' ? 'Ollama' : 'none'))
+      const sourceLabel = (source) => source === 'api-key' ? t('apiKeySource') : (source === 'oauth' ? t('oauthSource') : (source === 'ollama' ? t('ollamaSource') : t('sourceNone')))
       return h('div', { className: 'dsub-section-card' },
-        h('div', { className: 'dsub-section-title' }, 'Sources', h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, state.loading ? '…' : '↻')),
-        h('div', { className: 'dsub-section-desc' }, 'Subscription → API key → Ollama. Read-only: key rotation owns its cooldowns.'),
+        h('div', { className: 'dsub-section-title' }, t('sources'), h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, state.loading ? '…' : '↻')),
+        h('div', { className: 'dsub-section-desc' }, t('sourcesHint')),
         state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
         state.data && state.data.keyRotation && !state.data.keyRotation.available
-          ? h('div', { className: 'dsub-dim' }, 'key-rotation not installed/offline' + (state.data.keyRotation.reason ? ': ' + state.data.keyRotation.reason : ''))
+          ? h('div', { className: 'dsub-dim' }, t('keyRotationOffline') + (state.data.keyRotation.reason ? ': ' + state.data.keyRotation.reason : ''))
           : null,
         state.data && state.data.keyRotation && state.data.keyRotation.available
-          ? h('div', { className: 'dsub-dim' }, 'key-rotation: ' + state.data.keyRotation.healthyKeys + '/' + state.data.keyRotation.totalKeys + ' healthy keys')
+          ? h('div', { className: 'dsub-dim' }, t('keyRotationHealth') + ': ' + state.data.keyRotation.healthyKeys + '/' + state.data.keyRotation.totalKeys + ' healthy keys')
           : null,
         (state.data && state.data.providers ? state.data.providers : []).map((row) => h('div', { className: 'dsub-row', key: row.provider },
           h('span', { className: 'dsub-h' }, row.provider),
@@ -3993,16 +4082,16 @@ window.__ModuleLoader__.load({
       },
         h('div', { className: 'dsub-h' }, String(state.active.provider || '').toUpperCase() + ' sources'),
         (state.candidates || []).map((c, i) => {
-          const label = c.source === 'api-key' ? 'API key' : (c.source === 'oauth' ? 'OAuth' : 'Ollama')
+          const label = c.source === 'api-key' ? t('apiKeySource') : (c.source === 'oauth' ? t('oauthSource') : t('ollamaSource'))
           const cd = c.detail && Array.isArray(c.detail.keys) ? Math.max(0, ...c.detail.keys.map((k) => Number(k.cooldownMsLeft) || 0)) : 0
           return h('div', { className: 'dsub-row', key: i },
             h('span', { className: 'dsub-h' }, label),
-            h('span', { className: c.available ? 'dsub-ok' : 'dsub-dim' }, c.available ? 'available' : 'unavailable'),
-            cd > 0 ? h('span', { className: 'dsub-dim' }, 'cooldown ' + Math.ceil(cd / 1000) + 's') : null,
+            h('span', { className: c.available ? 'dsub-ok' : 'dsub-dim' }, c.available ? t('sourceAvailable') : t('sourceUnavailable')),
+            cd > 0 ? h('span', { className: 'dsub-dim' }, t('cooldownLabel') + ' ' + Math.ceil(cd / 1000) + 's') : null,
             c.detail && c.detail.healthyKeys != null ? h('span', { className: 'dsub-dim' }, c.detail.healthyKeys + '/' + c.detail.totalKeys + ' keys') : null,
           )
         }),
-        h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setOpen(false); openSettings() } }, 'Open settings'),
+        h('button', { type: 'button', className: 'dsub-mini', onClick: () => { setOpen(false); openSettings() } }, t('openSettings')),
       ) : null
       return h(React.Fragment, null, h('div', {
         className: 'dsub-qw' + (docked ? ' dsub-qwDocked' : '') + tone,

package/lib/http.js

@@ -104,14 +104,11 @@ function configuredTrustedHosts(targetCtx) {
 }
 
 /**
- * @param {import('node:http').IncomingMessage} request
- * @param {any} [targetCtx]
- * @returns {boolean}/**
+ * Reject cross-site and untrusted writes and sensitive reads.
+ * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  * @param {import('node:http').IncomingMessage} request
  * @param {any} [targetCtx]
  * @returns {boolean}
- * Reject cross-site and untrusted writes and sensitive reads.
- * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
  */
 export function isTrustedSettingsRequest(request, targetCtx) {
   const headers = request?.headers || {}

package/lib/mask.js

@@ -20,6 +20,7 @@ export function maskText(value) {
   return String(value || '').replace(EMAIL_RE, (m) => maskEmail(m))
 }
 
+/** @type {Array<[RegExp, string]>} */
 const SECRET_PATTERNS = [
   [/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]'],
   [/\b(?:sk|ghp|gho|ghu|ghs|ghr|github_pat|xox[baprs])[-_][A-Za-z0-9._-]{8,}/g, '[REDACTED]'],

package/lib/ollama-health.js

@@ -0,0 +1,25 @@
+// #755: health must probe the actual Ollama endpoint, not the fallback flag.
+let cache = { base: '', at: 0, value: false }
+
+export function clearOllamaHealthCache() {
+  cache = { base: '', at: 0, value: false }
+}
+
+export async function probeOllama(baseUrl, { fetchImpl = fetch, timeoutMs = 800, ttlMs = 10000, now = Date.now } = {}) {
+  if (!baseUrl) return false
+  const base = String(baseUrl).replace(/\/$/, '')
+  if (cache.base === base && (now() - cache.at) < ttlMs) return cache.value
+  let value = false
+  try {
+    const init = { method: 'GET' }
+    if (timeoutMs > 0 && typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') {
+      init.signal = AbortSignal.timeout(timeoutMs)
+    }
+    const res = await fetchImpl(base + '/api/tags', init)
+    value = Boolean(res && res.ok)
+  } catch {
+    value = false
+  }
+  cache = { base, at: now(), value }
+  return value
+}

package/lib/routes/oauth.js

@@ -292,10 +292,27 @@ export function registerOauthRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin or loopback only' } })
+        return
+      }
       const q = queryOf(req)
       const provider = q.get('provider') || ''
       const redirectUri = q.get('redirectUri') || ''
       const authUrl = q.get('authUrl') || ''
+      for (const [name, value] of [['redirectUri', redirectUri], ['authUrl', authUrl]]) {
+        if (!value) continue
+        try {
+          const parsed = new URL(value)
+          if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            writeJson(res, 400, { ok: false, error: { code: 'url', message: name + ' must use http(s)' } })
+            return
+          }
+        } catch {
+          writeJson(res, 400, { ok: false, error: { code: 'url', message: name + ' is invalid' } })
+          return
+        }
+      }
       const host = (req.headers && req.headers.host) || ''
       const user = process.env.USER || process.env.USERNAME || 'user'
       const info = getHeadlessAuthInfo({ provider, redirectUri, authUrl, host, user })

package/lib/routes/sources.js

@@ -1,11 +1,11 @@
 import { isTrustedSettingsRequest, safeJsonHandler, writeJson } from '../http.js'
 import { buildSourceChain, readKeyRotationStatus, subscriptionCandidate } from '../key-rotation-bridge.js'
 
-export async function collectSourceChain(state, port) {
+export async function collectSourceChain(state, port, { accounts } = {}) {
   const { accountsView, live } = state
   let subscriptions = []
   try {
-    const rows = await accountsView()
+    const rows = accounts || await accountsView()
     subscriptions = (rows || []).map(subscriptionCandidate)
   } catch { /* keep the chain available */ }
   const keyRotation = port

package/lib/routes/status.js

@@ -27,6 +27,7 @@ import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } f
 import { getVendor } from '../vendors/index.js'
 import { defaultErrorBuffer } from '../error-buffer.js'
 import { assessHealth } from '../health-report.js'
+import { probeOllama } from '../ollama-health.js'
 import { defaultSnapshotStore } from '../vault-snapshots.js'
 import { collectSourceChain } from './sources.js'
 
@@ -85,14 +86,15 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
-      const accounts = await accountsView().catch(() => [])
-      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const logged = typeof store.loggedInProviders === 'function' ? await store.loggedInProviders().catch(() => []) : []
+      const accounts = logged.map((provider) => ({ provider, configured: true }))
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort, { accounts })
       const health = assessHealth({
         accounts,
         sources,
         snapshots: defaultSnapshotStore.stats(),
         webhookUrl: live().webhookUrl,
-        ollama: live().ollamaFallback !== false,
+        ollama: await probeOllama(live().ollamaBaseUrl),
       })
       writeJson(res, 200, { ok: true, status: health.status, version: pkgVersion || 'unknown', checks: health.checks })
     }),

package/lib/routes/vault.js

@@ -1,6 +1,6 @@
 import { Config, plainConfig, revisionOf } from '../config-schema.js'
 import { isTrustedSettingsRequest, readBody, safeJsonHandler, writeJson } from '../http.js'
-import { capturePrePullSnapshot, restoreVaultSnapshot } from '../vault-sync.js'
+import { capturePrePullSnapshot, restoreSnapshotWithConfig, resolveVaultKey } from '../vault-sync.js'
 import { defaultSnapshotStore } from '../vault-snapshots.js'
 
 export function registerVaultRoutes(ctx, state) {
@@ -33,7 +33,11 @@ export function registerVaultRoutes(ctx, state) {
         return
       }
       try {
-        const snapshot = capturePrePullSnapshot(live().slots || [], passphrase, String(body.label || 'manual'))
+        const key = resolveVaultKey(live(), passphrase)
+        const snapshot = capturePrePullSnapshot(live().slots || [], key.passphrase, String(body.label || 'manual'), {
+          keyMode: key.keyMode,
+          deviceId: key.deviceId,
+        })
         writeJson(res, 200, { ok: true, snapshot })
       } catch (err) {
         writeJson(res, 400, { ok: false, error: { code: 'vault', message: String(err && err.message || err) } })
@@ -74,7 +78,7 @@ export function registerVaultRoutes(ctx, state) {
         return
       }
       try {
-        const restored = restoreVaultSnapshot(snapshot, passphrase)
+        const restored = restoreSnapshotWithConfig(snapshot, live())
         const cfg = live()
         const slots = stripLegacySlots(restored.slots || [])
         await api.replace(plainConfig(Config({ ...cfg, slots })), revisionOf(api))

package/lib/vault-snapshots.js

@@ -28,6 +28,8 @@ function meta(snapshot) {
     version: snapshot.version || 2,
     slotCount: Number(snapshot.slotCount) || 0,
     blobCount: Number(snapshot.blobCount) || 0,
+    keyMode: snapshot.keyMode || 'base',
+    deviceId: snapshot.deviceId || '',
   }
 }
 

package/lib/vault-sync.js

@@ -269,14 +269,44 @@ export function mergeVaultSlots(localSlots, remoteSlots) {
   return { slots: out, conflicts }
 }
 
-export function createVaultSnapshot({ slots, blobs = {} }, passphrase, label = '') {
+export function createVaultSnapshot({ slots, blobs = {} }, passphrase, label = '', meta = {}) {
   if (!passphrase) throw new Error('passphrase is required for a vault snapshot')
   const { vault, slotCount, blobCount } = exportVault({ slots: slots || [], blobs }, passphrase)
-  return { version: 2, label: String(label || ''), createdAt: new Date().toISOString(), vault, slotCount, blobCount }
+  return { version: 2, label: String(label || ''), createdAt: new Date().toISOString(), vault, slotCount, blobCount, ...meta }
 }
 
-export function capturePrePullSnapshot(slots, passphrase, label = 'pre-pull') {
-  return defaultSnapshotStore.add(createVaultSnapshot({ slots: slots || [], blobs: {} }, passphrase, label))
+export function capturePrePullSnapshot(slots, passphrase, label = 'pre-pull', meta = {}) {
+  return defaultSnapshotStore.add(createVaultSnapshot({ slots: slots || [], blobs: {} }, passphrase, label, meta))
+}
+
+export function resolveVaultKey(cfg, passphrase) {
+  const perDevice = cfg && cfg.vaultPerDeviceKeys !== false
+  const device = resolveDeviceIdentity({ id: cfg && cfg.vaultDeviceId, label: cfg && cfg.vaultDeviceLabel })
+  return {
+    passphrase: perDevice ? devicePassphrase(passphrase, device.id) : passphrase,
+    keyMode: perDevice ? 'device' : 'base',
+    deviceId: perDevice ? device.id : '',
+  }
+}
+
+export function restoreSnapshotWithConfig(snapshot, cfg) {
+  const base = String((cfg && cfg.vaultSyncPassphrase) || '').trim()
+  if (!base) throw new Error('vaultSyncPassphrase is required to restore a snapshot')
+  const attempts = []
+  if (snapshot && snapshot.keyMode === 'device') {
+    attempts.push(devicePassphrase(base, snapshot.deviceId || resolveVaultKey(cfg, base).deviceId))
+  } else if (snapshot && snapshot.keyMode === 'base') {
+    attempts.push(base)
+  } else {
+    // Snapshots written before #749/#754 have no keyMode. Try the legacy
+    // base key first, then the current device key.
+    attempts.push(base, resolveVaultKey(cfg, base).passphrase)
+  }
+  let lastError = null
+  for (const pass of attempts) {
+    try { return restoreVaultSnapshot(snapshot, pass) } catch (err) { lastError = err }
+  }
+  throw lastError || new Error('unable to restore snapshot')
 }
 
 export function restoreVaultSnapshot(snapshot, passphrase) {
@@ -311,7 +341,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
 
     const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
     const perDevice = cfg.vaultPerDeviceKeys !== false
-    const activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    const activePass = resolveVaultKey(cfg, passphrase).passphrase
     const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, activePass)
     const backend = cfg.vaultSyncBackend || 'webdav'
 
@@ -384,6 +414,7 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
     const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
     const perDevice = cfg.vaultPerDeviceKeys !== false
     let activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    let snapshotKeyMode = perDevice ? 'device' : 'base'
     let usedLegacy = false
     const load = async (deviceMode) => {
       if (backend === 'webdav') {
@@ -423,10 +454,16 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
       if (!perDevice) throw err
       encryptedData = await load(false)
       activePass = passphrase
+      snapshotKeyMode = 'base'
       usedLegacy = true
     }
 
-    try { capturePrePullSnapshot(cfg.slots || [], activePass) } catch { /* snapshot is best-effort */ }
+    try {
+      capturePrePullSnapshot(cfg.slots || [], activePass, 'pre-pull', {
+        keyMode: snapshotKeyMode,
+        deviceId: snapshotKeyMode === 'device' ? device.id : '',
+      })
+    } catch { /* snapshot is best-effort */ }
     const result = importVault(encryptedData, activePass)
     const providerFilter = new Set((cfg.vaultSyncProviders || []).map((p) => String(p)))
     const remoteSlots = providerFilter.size

package/lib/vendors/grok.js

@@ -132,6 +132,7 @@ function streamHeaders(blob, config, extra) {
     hostname = ''
   }
   if (!isTrustedAuthHost(hostname)) {
+    /** @type {Error & { code?: string }} */
     const err = new Error(`Untrusted Grok baseUrl host: ${hostname || base}`)
     err.code = 'GROK_UNTRUSTED_HOST'
     throw err

package/lib/vendors/index.js

@@ -51,6 +51,7 @@ export function clearCustomVendors() {
 
 const vendors = new Proxy({}, {
   get(_t, prop) {
+    if (typeof prop === 'symbol') return undefined
     if (prop in builtins) return builtins[prop]
     return customVendors.get(prop)
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -39,7 +39,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && node --import ./test/_setup.mjs --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && npm run typecheck && node --import ./test/_setup.mjs --test test/*.test.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {