@goodandready/dsh-subscriptions 0.7.18 → 0.7.20

package/README.md

@@ -372,6 +372,26 @@ Supports Anthropic's adaptive thinking (`thinking: { type: "adaptive" }`) and re
 
 ---
 
+## 🔌 HTTP API
+
+The plugin registers these exact routes on the DSH web server. Unless noted, they accept same-origin or loopback requests; mutating requests must carry `Origin` or `Referer` matching the host (#782). Responses are JSON unless noted.
+
+| Method | Path | Purpose |
+|---|---|---|
+| GET | `/dsh-subscriptions/usage?type=accounts\|calls&format=json\|csv` | Quota snapshot and per-call ledger for external quota plugins (#687). |
+| GET | `/dsh-subscriptions/instructions` | Dynamic vendor connection instructions (#540). |
+| GET | `/dsh-subscriptions/metrics` | Prometheus text exposition (#744); loopback or same-origin only. |
+| GET | `/dsh-subscriptions/health` | Deep health report used by monitoring (#745); public GET. |
+| GET | `/dsh-subscriptions/models` | Enriched model catalog for active subscriptions. |
+| POST | `/dsh-subscriptions/heartbeat/run` | Trigger one quota/health refresh; returns `{ok, refreshed}`. |
+| GET | `/dsh-subscriptions/discover-local` | Detect locally installed CLI sessions available for import. |
+| GET | `/dsh-subscriptions/subscriptions` | Localhost-only HTML overview of subscriptions. |
+| GET | `/dsh-subscriptions/session-reasoning?sessionId=…&provider=…&model=…` | Read reasoning effort/capabilities for a session. |
+| POST | `/dsh-subscriptions/session-reasoning` | Set `{sessionId, provider, model, effort, budgetTokens}`. |
+| DELETE | `/dsh-subscriptions/session-reasoning?sessionId=…` | Clear session reasoning override. |
+
+`/discover-local` and `/subscriptions` are retained as supported API/UI surfaces (decision recorded in `docs/design/DESIGN.md`).
+
 ## 🌐 Localization
 
 The plugin source language is English only. Russian and other translations are provided at runtime by separate language plugins (for example the russification plugin), which translate the registered locale keys - the package itself ships no bundled translations (Changed in 0.6.1).

package/README.ru.md

@@ -345,6 +345,26 @@ dsh-subscriptions:
 
 ---
 
+## 🔌 HTTP API
+
+Плагин регистрирует на веб-сервере DSH следующие точные маршруты. Если не указано иное, они принимают same-origin или loopback-запросы; изменяющие запросы обязаны содержать `Origin` или `Referer`, совпадающий с хостом (#782). Ответы — JSON, если не указано иное.
+
+| Метод | Путь | Назначение |
+|---|---|---|
+| GET | `/dsh-subscriptions/usage?type=accounts\|calls&format=json\|csv` | Снимок квоты и журнал вызовов для внешних плагинов квот (#687). |
+| GET | `/dsh-subscriptions/instructions` | Динамические инструкции по подключению вендоров (#540). |
+| GET | `/dsh-subscriptions/metrics` | Prometheus text exposition (#744); только loopback или same-origin. |
+| GET | `/dsh-subscriptions/health` | Подробный отчёт здоровья для мониторинга (#745); публичный GET. |
+| GET | `/dsh-subscriptions/models` | Обогащённый каталог моделей активных подписок. |
+| POST | `/dsh-subscriptions/heartbeat/run` | Запустить одно обновление квот/здоровья; возвращает `{ok, refreshed}`. |
+| GET | `/dsh-subscriptions/discover-local` | Найти локально установленные CLI-сессии для импорта. |
+| GET | `/dsh-subscriptions/subscriptions` | HTML-обзор подписок только с localhost. |
+| GET | `/dsh-subscriptions/session-reasoning?sessionId=…&provider=…&model=…` | Прочитать reasoning effort и возможности модели для сессии. |
+| POST | `/dsh-subscriptions/session-reasoning` | Установить `{sessionId, provider, model, effort, budgetTokens}`. |
+| DELETE | `/dsh-subscriptions/session-reasoning?sessionId=…` | Сбросить переопределение reasoning для сессии. |
+
+`/discover-local` и `/subscriptions` сохранены как поддерживаемые API/UI-поверхности (решение записано в `docs/design/DESIGN.md`).
+
 ## 🌐 Локализация
 
 Исходный язык плагина - только английский. Русский и другие переводы во время работы предоставляют отдельные языковые плагины (например, плагин русификации), переводящие зарегистрированные ключи локали, - сам пакет не содержит встроенных переводов (Changed in 0.6.1).

package/README.zh.md

@@ -251,6 +251,26 @@ dsh plugin --profile web add @goodandready/dsh-subscriptions
 
 ---
 
+## 🔌 HTTP API
+
+插件在 DSH Web 服务器上注册以下精确路由。除非另有说明，仅接受同源或 loopback 请求；写入请求必须携带与 Host 匹配的 `Origin` 或 `Referer`（#782）。除特别说明外返回 JSON。
+
+| 方法 | 路径 | 用途 |
+|---|---|---|
+| GET | `/dsh-subscriptions/usage?type=accounts\|calls&format=json\|csv` | 面向外部配额插件的额度快照与调用账本（#687）。 |
+| GET | `/dsh-subscriptions/instructions` | 动态供应商接入说明（#540）。 |
+| GET | `/dsh-subscriptions/metrics` | Prometheus 文本指标（#744）；仅 loopback 或同源。 |
+| GET | `/dsh-subscriptions/health` | 供监控使用的深度健康报告（#745）；公开 GET。 |
+| GET | `/dsh-subscriptions/models` | 当前订阅的增强模型目录。 |
+| POST | `/dsh-subscriptions/heartbeat/run` | 触发一次额度/健康刷新；返回 `{ok, refreshed}`。 |
+| GET | `/dsh-subscriptions/discover-local` | 发现可导入的本地 CLI 会话。 |
+| GET | `/dsh-subscriptions/subscriptions` | 仅限 localhost 的 HTML 订阅概览。 |
+| GET | `/dsh-subscriptions/session-reasoning?sessionId=…&provider=…&model=…` | 读取会话的 reasoning effort 与模型能力。 |
+| POST | `/dsh-subscriptions/session-reasoning` | 设置 `{sessionId, provider, model, effort, budgetTokens}`。 |
+| DELETE | `/dsh-subscriptions/session-reasoning?sessionId=…` | 清除会话 reasoning 覆盖。 |
+
+`/discover-local` 与 `/subscriptions` 保留为受支持的 API/UI 接口（决策记录于 `docs/design/DESIGN.md`）。
+
 ## 🌐 本地化
 
 插件源语言仅为英语。俄语及其他翻译由独立的语言插件（如俄化插件）在运行时对注册的本地化键进行翻译，包本身不内置翻译（Changed in 0.6.1）。

package/lib/client.js

@@ -4118,6 +4118,16 @@ h('div', { className: 'dsub-row' },
         const id = setInterval(pull, 60 * 1000)
         return () => { alive = false; clearInterval(id) }
       }, [])
+      React.useEffect(() => {
+        if (!open) return undefined
+        const onDoc = (e) => {
+          if (popRef.current && !popRef.current.contains(e.target) && !(e.target.closest && e.target.closest('.dsub-qw'))) setOpen(false)
+        }
+        const onKey = (e) => { if (e.key === 'Escape') setOpen(false) }
+        document.addEventListener('pointerdown', onDoc)
+        document.addEventListener('keydown', onKey)
+        return () => { document.removeEventListener('pointerdown', onDoc); document.removeEventListener('keydown', onKey) }
+      }, [open])
       if (state.mode === 'off' || !state.active || state.remaining == null) return null
       const docked = state.mode !== 'floating'
       const tone = state.remaining <= 10 ? ' dsub-qwFull' : (state.remaining <= 30 ? ' dsub-qwWarn' : '')
@@ -4132,16 +4142,6 @@ h('div', { className: 'dsub-row' },
           if (layout && typeof layout.selectPanel === 'function') layout.selectPanel('plugins')
         } catch { /* bestEffort */ }
       }
-      React.useEffect(() => {
-        if (!open) return undefined
-        const onDoc = (e) => {
-          if (popRef.current && !popRef.current.contains(e.target) && !(e.target.closest && e.target.closest('.dsub-qw'))) setOpen(false)
-        }
-        const onKey = (e) => { if (e.key === 'Escape') setOpen(false) }
-        document.addEventListener('pointerdown', onDoc)
-        document.addEventListener('keydown', onKey)
-        return () => { document.removeEventListener('pointerdown', onDoc); document.removeEventListener('keydown', onKey) }
-      }, [open])
       const onPointerDown = (e) => {
         if (docked) return
         drag.current = { x: e.clientX, y: e.clientY, right: pos.right, bottom: pos.bottom, moved: false }
@@ -4358,4 +4358,4 @@ h('div', { className: 'dsub-row' },
     }
     return module.exports
   },
-})
+})

package/lib/diagnostics.js

@@ -7,6 +7,7 @@ import { maskSecrets } from './mask.js'
 import { normalizeSlots } from './accounts.js'
 import { PROVIDERS } from './refs.js'
 import { defaultErrorBuffer } from './error-buffer.js'
+import { grokCatalogCacheSize } from './vendors/grok.js'
 
 function scrubReport(v) {
   if (typeof v === 'string') return maskSecrets(v)
@@ -55,6 +56,7 @@ export async function createDiagnosticsReport({ live, store, history, NS, pkgVer
     recentErrors: defaultErrorBuffer.getEntries(),
     heartbeat: heartbeatStats || { lastRunAt: null, proactiveRefreshCount: 0 },
     cache: calculateCacheMetrics(rows),
+    grokCatalogCacheEntries: grokCatalogCacheSize(),
     queue: defaultConcurrencyQueue.stats(),
     pins: getSessionPinStats(),
     reasoning: getSessionReasoningStats(),

package/lib/http.js

@@ -113,6 +113,12 @@ function configuredTrustedHosts(targetCtx) {
 export function isTrustedSettingsRequest(request, targetCtx) {
   const headers = request?.headers || {}
 
+  // #782: every mutation must prove its browser origin. A loopback socket is
+  // not enough because the LAN bridge rewrites Host and connects over loopback.
+  const method = String(request?.method || '').toUpperCase()
+  const mutating = method !== '' && method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS'
+  if (mutating && !headers.origin && !headers.referer) return false
+
   // 1. Explicit cross-site fetch is always rejected
   const secFetchSite = String(headers['sec-fetch-site'] || '').toLowerCase()
   if (secFetchSite === 'cross-site') return false
@@ -269,16 +275,6 @@ export function queryOf(req) {
  * Fetch with connect/overall timeout using AbortSignal.any.
  */
 
-export function isSameOrigin(url1, url2) {
-  try {
-    const u1 = new URL(url1)
-    const u2 = new URL(url2)
-    return u1.origin.toLowerCase() === u2.origin.toLowerCase()
-  } catch {
-    return false
-  }
-}
-
 export function headerSafeValue(value) {
   return String(value == null ? '' : value)
     .replace(/[\r\n]+/g, ' ')

package/lib/import-auth.js

@@ -11,15 +11,12 @@ import { isGoogleClientId, extractGoogleClientIdFromJwt, emailFromToken } from '
 // Test seam: a fixture root overrides the real home for the duration of a
 // public call. Undefined (the default) keeps production behaviour.
 let activeHome = null
-let activeWindowsCredentialReader = null
-
-export function setWindowsCredentialReaderForTest(fn) {
-  activeWindowsCredentialReader = fn
-}
+// Injectable Windows Credential Manager reader used by fixture tests.
+export const windowsCredentialReader = { current: null }
 
 export function readWindowsAntigravityCredential() {
-  if (activeWindowsCredentialReader) {
-    return activeWindowsCredentialReader()
+  if (windowsCredentialReader.current) {
+    return windowsCredentialReader.current()
   }
   if (process.platform !== 'win32') return null
   try {
@@ -146,7 +143,7 @@ async function discoverLocalCliSessionsInner() {
     }
   }
 
-  const canReadWindowsCredentialManager = Boolean(activeWindowsCredentialReader) || (!activeHome && process.platform === 'win32')
+  const canReadWindowsCredentialManager = Boolean(windowsCredentialReader.current) || (!activeHome && process.platform === 'win32')
   if (!detected.antigravity && canReadWindowsCredentialManager) {
     const winCred = readWindowsAntigravityCredential()
     const tok = winCred && winCred.token ? winCred.token : winCred

package/lib/index.js

@@ -30,6 +30,10 @@ import { createAdapterManager } from './adapter-manager.js'
 import { pickAccount, isAuthError } from './rotate.js'
 import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate, setWebhookFormat } from './alerts.js'
 import { isDigestDue } from './notification-scheduler.js'
+import { clearSessionPins } from './session-pin.js'
+import { clearKeyRotationCache } from './key-rotation-bridge.js'
+import { clearOllamaHealthCache } from './ollama-health.js'
+import { clearGrokCatalogCache } from './vendors/grok.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
 export { formatRelativeReset } from './relative-time.js'
@@ -100,6 +104,7 @@ export function apply(ctx, rawConfig) {
   }
 
   function syncCustomVendors() {
+    clearGrokCatalogCache()
     const profiles = validateProfiles(live().customVendors)
     clearCustomVendors()
     for (const profile of profiles) {
@@ -130,6 +135,8 @@ export function apply(ctx, rawConfig) {
     try {
       const fresh = next !== undefined ? next : resolveEntry()
       cachedConfig = fresh
+      clearKeyRotationCache()
+      clearOllamaHealthCache()
       syncCustomVendors()
       syncAdapter().catch(() => {})
       syncOllama().catch(() => {})
@@ -165,6 +172,8 @@ export function apply(ctx, rawConfig) {
           await settingsSvc.replace(NS, structuredClone(parsed), expectedRevision !== undefined ? expectedRevision : describeRow()?.revision)
         }
         cachedConfig = parsed
+        clearKeyRotationCache()
+        clearOllamaHealthCache()
         syncCustomVendors()
       } catch (err) {
         cachedConfig = prevConfig
@@ -406,6 +415,7 @@ export function apply(ctx, rawConfig) {
     subscriptions,
     images: () => ctx.subscriptionImages,
   }, { enabled: live().nativeTools || process.env.DSH_SUBSCRIPTIONS_NATIVE_TOOLS === '1' }), 'dsh-subscriptions: native tools')
+  ctx.effect(() => () => clearSessionPins(), 'dsh-subscriptions: session pins cleanup')
 
   const pending = new Map()
 

package/lib/loopback.js

@@ -18,12 +18,12 @@ const ERR_HTML = '<!doctype html><meta charset="utf-8"><title>Subscriptions</tit
  *        Throwing means an authorization error (ERR_HTML is served).
  * @returns {Promise<{url: string, close: () => void}>}
  */
-export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode }) {
+export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode, onListening }) {
   const parsed = new URL(redirectUri)
   if (parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
     throw new Error(`loopback redirect requires localhost, got ${parsed.hostname}`)
   }
-  const port = Number(parsed.port) || 80
+  const port = parsed.port === '' ? 80 : Number(parsed.port)
   const path = parsed.pathname
 
   const state = { server: null, timer: null, done: false }
@@ -55,7 +55,12 @@ export function startLoopback({ redirectUri, timeoutMs = 10 * 60 * 1000, onCode
       reject(err)
     })
     state.server = server
-    server.listen(port, parsed.hostname, () => {})
+    server.listen(port, parsed.hostname, () => {
+      if (typeof onListening === 'function') {
+        const address = server.address()
+        onListening(address && typeof address === 'object' ? address.port : port)
+      }
+    })
     state.timer = setTimeout(() => {
       if (state.done) return
       state.done = true

package/lib/session-pin.js

@@ -124,15 +124,8 @@ export function pinSession(sessionId, accountRef, options = {}) {
  * @returns {string|null}
  */
 export function getPinnedAccountRef(sessionId, now = Date.now()) {
-  if (!sessionId) return null
-  const entry = sessionPins.get(sessionId)
-  if (!entry) return null
-  if (now > entry.expiresAt) {
-    sessionPins.delete(sessionId)
-    recordReleaseReason('pin_released_expired')
-    return null
-  }
-  return entry.accountRef
+  const details = getPinnedSessionDetails(sessionId, now)
+  return details ? details.accountRef : null
 }
 
 /**

package/lib/usage.js

@@ -1,7 +1,7 @@
-export function numberOrNull(value) {
-  const n = Number(value)
-  return Number.isFinite(n) ? n : null
-}
+import { numberOrNull } from './ratelimit.js'
+
+// Keep the historical import path: usage.js is the public home for these helpers.
+export { numberOrNull }
 
 export function windowPercent(obj, key) {
   if (!obj || typeof obj !== 'object') return null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.18",
+  "version": "0.7.20",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",
@@ -39,7 +39,7 @@
     "url": "https://github.com/GooDAnDReaDY/dsh-subscriptions/issues"
   },
   "scripts": {
-    "test": "eslint lib/ test/ && npm run typecheck && node --import ./test/_setup.mjs --test test/*.test.mjs",
+    "test": "eslint lib/ test/ && npm run typecheck && node --import ./test/_setup.mjs --test test/*.test.mjs && node scripts/check-pack-size.mjs",
     "typecheck": "tsc -p tsconfig.checkjs.json"
   },
   "dsh": {