@goodandready/dsh-subscriptions 0.7.23 → 0.7.25

package/lib/client.js

@@ -186,6 +186,16 @@ window.__ModuleLoader__.load({
       "toastCooldownRecovered": "is now available (cooldown expired)",
       "modelsCatalogTitle": "Curated Subscription Models",
       "modelsCatalogDesc": "Available model catalog across active subscriptions in DeepSeek Harness.",
+      "modelSearchPlaceholder": "Search models by id, name or alias",
+      "modelSortLabel": "Sort models",
+      "modelSortName": "Name",
+      "modelSortProvider": "Provider",
+      "modelSortContext": "Context window",
+      "modelSortAvailability": "Availability",
+      "modelListCounts": "{shown} of {matched} shown · {hidden} hidden · {total} total",
+      "modelShowMore": "Show more",
+      "modelShowAll": "Show all",
+      "modelNoMatches": "No models match this search.",
       "rotationDecisionsTitle": "Rotation & Routing Decisions",
       "rotationDecisionsDesc": "Real-time decision trace explaining account selection, skips, and fallback reasons.",
       "rotationAttempt": "attempt",
@@ -550,6 +560,16 @@ window.__ModuleLoader__.load({
       "toastCooldownRecovered": "已解除冷却恢复可用",
       "modelsCatalogTitle": "精选订阅模型",
       "modelsCatalogDesc": "当前 DeepSeek Harness 活跃订阅下可用模型一览。",
+      "modelSearchPlaceholder": "搜索模型 ID、名称或别名",
+      "modelSortLabel": "模型排序",
+      "modelSortName": "名称",
+      "modelSortProvider": "服务商",
+      "modelSortContext": "上下文窗口",
+      "modelSortAvailability": "可用性",
+      "modelListCounts": "已显示 {shown} / {matched} · 隐藏 {hidden} · 共 {total} 个",
+      "modelShowMore": "显示更多",
+      "modelShowAll": "显示全部",
+      "modelNoMatches": "没有匹配的模型。",
       "rotationDecisionsTitle": "轮询调度与路由决策",
       "rotationDecisionsDesc": "实时决策追踪，透明展示每次请求的账号选择、跳过与回退原因。",
       "rotationAttempt": "次尝试",
@@ -948,7 +968,52 @@ window.__ModuleLoader__.load({
     }
     const Chevron = ChevronIcon || FallbackChevron
 
+    // #839 model-list helpers
+    function modelListSearchText(model) {
+      const parts = [model && model.id, model && model.name, model && model.alias, model && model.provider, model && model.providerName]
+      if (model && Array.isArray(model.aliases)) parts.push.apply(parts, model.aliases)
+      return parts.filter(Boolean).join(' ').toLowerCase()
+    }
+
+    function filterModelList(models, query) {
+      const list = Array.isArray(models) ? models : []
+      const q = String(query || '').trim().toLowerCase()
+      if (!q) return list.slice()
+      return list.filter((model) => modelListSearchText(model).includes(q))
+    }
 
+    function modelAvailabilityRank(model) {
+      const status = String(model && model.pool && model.pool.status || 'unconfigured').toLowerCase()
+      const order = { available: 0, degraded: 1, cooldown: 2, quarantined: 3, exhausted: 4, unconfigured: 5 }
+      return order[status] != null ? order[status] : 6
+    }
+
+    function sortModelList(models, sortKey) {
+      const list = Array.isArray(models) ? models.slice() : []
+      const key = String(sortKey || 'name')
+      const byName = (a, b) => String(a && (a.name || a.id) || '').localeCompare(String(b && (b.name || b.id) || ''), undefined, { numeric: true, sensitivity: 'base' })
+      list.sort((a, b) => {
+        if (key === 'provider') {
+          const byProvider = String(a && (a.providerName || a.provider) || '').localeCompare(String(b && (b.providerName || b.provider) || ''), undefined, { sensitivity: 'base' })
+          if (byProvider) return byProvider
+        } else if (key === 'context') {
+          const delta = Number(b && b.contextWindow || 0) - Number(a && a.contextWindow || 0)
+          if (delta) return delta
+        } else if (key === 'availability') {
+          const delta = modelAvailabilityRank(a) - modelAvailabilityRank(b)
+          if (delta) return delta
+        }
+        return byName(a, b)
+      })
+      return list
+    }
+
+    function modelListCounts(all, shown) {
+      const total = Array.isArray(all) ? all.length : 0
+      const visible = Array.isArray(shown) ? shown.length : 0
+      return { total, shown: visible, hidden: Math.max(0, total - visible) }
+    }
+    // #839 end model-list helpers
 
     function SubsSection(props) {
       // The translator comes from the slot because its registration declares locale.
@@ -961,6 +1026,9 @@ window.__ModuleLoader__.load({
       const [accounts, setAccounts] = React.useState([])
       const [providers, setProviders] = React.useState([])
       const [modelsCatalog, setModelsCatalog] = React.useState([])
+      const [modelQuery, setModelQuery] = React.useState('')
+      const [modelSort, setModelSort] = React.useState('name')
+      const [modelLimit, setModelLimit] = React.useState(40)
       const [paste, setPaste] = React.useState({})
       const [device, setDevice] = React.useState({})  // #90 key -> {state,userCode,authUrl,intervalMs,status}
       const [loginLinks, setLoginLinks] = React.useState({})  // #595 provider:index -> fallback auth URL when a popup is blocked
@@ -1676,6 +1744,20 @@ window.__ModuleLoader__.load({
 
       const connectedCount = accounts.filter((a) => a.configured).length
 
+      const catalogAll = Array.isArray(modelsCatalog) && modelsCatalog.length ? modelsCatalog : [
+        { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+        { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+        { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
+        { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: t('sourceAvailable') } },
+        { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: t('sourceAvailable') } },
+        { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
+        { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: t('sourceAvailable') } },
+        { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: t('sourceAvailable') } },
+      ]
+      const catalogSorted = sortModelList(filterModelList(catalogAll, modelQuery), modelSort)
+      const catalogShown = catalogSorted.slice(0, modelLimit)
+      const catalogCounts = modelListCounts(catalogAll, catalogShown)
+
       return h('div', { className: 'dsub-wrap', 'data-tab': tab },
         h('div', { className: 'dsub-header-bar' },
           h('div', { className: 'dsub-row', style: { marginTop: 0 } },
@@ -2197,17 +2279,36 @@ h('div', { className: 'dsub-row' },
           h('details', { className: 'dsub-group', 'data-pane': 'models' },
             h('summary', { className: 'dsub-groupHead' }, '🎯 ' + t('modelsCatalogTitle')),
             h('div', { className: 'dsub-sub', style: { marginTop: '4px' } }, t('modelsCatalogDesc')),
+            h('div', { className: 'dsub-row', style: { marginTop: 8, gap: 6, alignItems: 'center' } },
+              h('input', {
+                className: 'dsub-inp dsub-grow',
+                value: modelQuery,
+                placeholder: t('modelSearchPlaceholder'),
+                'aria-label': t('modelSearchPlaceholder'),
+                onChange: (e) => { setModelQuery(e.target.value); setModelLimit(40) },
+              }),
+              h('select', {
+                className: 'dsub-select',
+                value: modelSort,
+                title: t('modelSortLabel'),
+                'aria-label': t('modelSortLabel'),
+                onChange: (e) => { setModelSort(e.target.value); setModelLimit(40) },
+              },
+                h('option', { value: 'name' }, t('modelSortName')),
+                h('option', { value: 'provider' }, t('modelSortProvider')),
+                h('option', { value: 'context' }, t('modelSortContext')),
+                h('option', { value: 'availability' }, t('modelSortAvailability')),
+              ),
+            ),
+            h('div', { className: 'dsub-sub', style: { marginTop: 4 } },
+              t('modelListCounts')
+                .replace('{shown}', String(catalogCounts.shown))
+                .replace('{matched}', String(catalogSorted.length))
+                .replace('{hidden}', String(catalogCounts.hidden))
+                .replace('{total}', String(catalogCounts.total))
+            ),
             h('div', { className: 'dsub-model-grid' },
-              (Array.isArray(modelsCatalog) && modelsCatalog.length ? modelsCatalog : [
-                { id: 'gpt-4o', contextLabel: '128k', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
-                { id: 'o1 / o3-mini', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
-                { id: 'claude-3-7-sonnet', contextLabel: '200k', capabilities: ['reasoning'], pool: { status: t('sourceAvailable') } },
-                { id: 'claude-3-5-sonnet', contextLabel: '200k', capabilities: ['coding'], pool: { status: t('sourceAvailable') } },
-                { id: 'grok-beta', contextLabel: '128k', capabilities: ['fast'], pool: { status: t('sourceAvailable') } },
-                { id: 'gemini-2.5-pro', contextLabel: '1M', capabilities: ['vision'], pool: { status: t('sourceAvailable') } },
-                { id: 'kimi-k1.5', contextLabel: '128k', capabilities: ['math'], pool: { status: t('sourceAvailable') } },
-                { id: 'glm-4-plus', contextLabel: '128k', capabilities: ['chinese'], pool: { status: t('sourceAvailable') } },
-              ]).map((m, idx) => {
+              catalogShown.map((m, idx) => {
                 const poolStatus = m.pool ? m.pool.status : 'unconfigured'
                 const statusClass = 'dsub-model-status-' + poolStatus
                 let poolLabel = ''
@@ -2244,6 +2345,17 @@ h('div', { className: 'dsub-row' },
                 )
               })
             ),
+            catalogSorted.length === 0 ? h('div', { className: 'dsub-sub', style: { marginTop: 6 } }, t('modelNoMatches')) : null,
+            catalogCounts.shown < catalogSorted.length ? h('div', { className: 'dsub-row', style: { marginTop: 6, gap: 6 } },
+              h('button', {
+                type: 'button', className: 'dsub-mini',
+                onClick: () => setModelLimit((n) => n + 40),
+              }, t('modelShowMore')),
+              h('button', {
+                type: 'button', className: 'dsub-mini',
+                onClick: () => setModelLimit(catalogSorted.length),
+              }, t('modelShowAll')),
+            ) : null,
           ),
           h('details', { className: 'dsub-group', 'data-pane': 'models' },
             h('summary', { className: 'dsub-groupHead' }, '🧠 ' + t('reasoningEffortTitle')),

package/lib/http.js

@@ -103,6 +103,8 @@ function configuredTrustedHosts(targetCtx) {
   return out
 }
 
+const SHELL_SESSION_COOKIE = /(?:^|;\s*)dsh-auth-[^=;\s]*=/
+
 /**
  * Reject cross-site and untrusted writes and sensitive reads.
  * Fail-closed: must be loopback, same-origin/same-site, or authentic host credentials (#374).
@@ -117,7 +119,14 @@ export function isTrustedSettingsRequest(request, targetCtx) {
   // not enough because the LAN bridge rewrites Host and connects over loopback.
   const method = String(request?.method || '').toUpperCase()
   const mutating = method !== '' && method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS'
-  if (mutating && !headers.origin && !headers.referer) return false
+  if (mutating && !headers.origin && !headers.referer) {
+    // #26: DSH Desktop validates dsh-app://app, then strips Origin/Referer
+    // before forwarding. The shell's session cookie is the only positive
+    // signal left. Presence is not a signature check: DSH still owns cookie
+    // validation, and this only relaxes the mutation gate for loopback.
+    const shellForwarded = SHELL_SESSION_COOKIE.test(String(headers.cookie || '')) && isLoopback(request)
+    if (!shellForwarded) return false
+  }
 
   // 1. Explicit cross-site fetch is always rejected
   const secFetchSite = String(headers['sec-fetch-site'] || '').toLowerCase()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.23",
+  "version": "0.7.25",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",