@goodandready/dsh-subscriptions 0.7.3 → 0.7.4

package/bin/dsh-subscriptions.mjs

@@ -5,19 +5,49 @@ import { pathToFileURL } from 'node:url'
 export function parseArgs(argv) {
   const args = Array.isArray(argv) ? argv.slice() : []
   const command = args.shift() || 'status'
-  const options = { command, csv: false, type: 'accounts', sessionId: '', mode: 'fast', help: false }
+  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '' }
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i]
     if (arg === '--csv') options.csv = true
+    else if (arg === '--json') options.json = true
     else if (arg === '--help' || arg === '-h') options.help = true
     else if (arg === '--type') options.type = args[++i] || 'accounts'
     else if (arg === '--session') options.sessionId = args[++i] || ''
+    else if (command === 'set' && !options.setKey) options.setKey = arg
+    else if (command === 'set') options.setValue = arg
     else if (command === 'fast' && !options.sessionId) options.sessionId = arg
     else if (command === 'fast') options.mode = arg === 'standard' || arg === 'off' ? 'standard' : 'fast'
   }
   return options
 }
 
+export function parseConfigValue(raw) {
+  if (raw === 'true') return true
+  if (raw === 'false') return false
+  if (raw === 'null') return null
+  if (/^-?\d+(?:\.\d+)?$/.test(raw)) return Number(raw)
+  if (raw.startsWith('{') || raw.startsWith('[')) {
+    try { return JSON.parse(raw) } catch { throw new Error('value is not valid JSON: ' + raw) }
+  }
+  return raw
+}
+
+export function setNested(target, path, value) {
+  const parts = String(path || '').split('.').filter(Boolean)
+  if (!parts.length) throw new Error('set requires a dot path, for example rotationStrategy')
+  for (const part of parts) {
+    if (part === '__proto__' || part === 'constructor' || part === 'prototype') throw new Error('unsafe path: ' + path)
+  }
+  let cursor = target
+  for (let i = 0; i < parts.length - 1; i += 1) {
+    const key = parts[i]
+    if (!cursor[key] || typeof cursor[key] !== 'object' || Array.isArray(cursor[key])) cursor[key] = {}
+    cursor = cursor[key]
+  }
+  cursor[parts[parts.length - 1]] = value
+  return target
+}
+
 export function buildRequest(options, env = process.env) {
   const base = String(env.DSH_SUBS_URL || 'http://127.0.0.1:3080/dsh-subscriptions').replace(/\/$/, '')
   const headers = { Accept: 'application/json' }
@@ -35,23 +65,59 @@ export function buildRequest(options, env = process.env) {
       init: { method: 'POST', headers, body: JSON.stringify({ sessionId: options.sessionId, mode: options.mode || 'fast' }) },
     }
   }
+  if (options.command === 'config') return { url: base + '/config', init: { method: 'GET', headers } }
+  if (options.command === 'sources') return { url: base + '/sources', init: { method: 'GET', headers } }
   throw new Error('unknown command: ' + options.command)
 }
 
+export function formatSources(payload) {
+  const lines = []
+  const kr = payload && payload.keyRotation
+  lines.push('key-rotation: ' + (kr && kr.available ? (kr.healthyKeys + '/' + kr.totalKeys + ' healthy keys') : ('unavailable' + (kr && kr.reason ? ' (' + kr.reason + ')' : ''))))
+  for (const row of ((payload && payload.providers) || [])) {
+    const availability = (row.candidates || []).map((c) => c.source + '=' + (c.available ? 'yes' : 'no')).join(' ')
+    lines.push(row.provider + ': selected=' + (row.selected || 'none') + (availability ? ' ' + availability : ''))
+  }
+  return lines.join('\n')
+}
+
+export function buildSetRequest(options, configPayload, env = process.env) {
+  const base = String(env.DSH_SUBS_URL || 'http://127.0.0.1:3080/dsh-subscriptions').replace(/\/$/, '')
+  const headers = { Accept: 'application/json', 'Content-Type': 'application/json' }
+  if (env.DSH_AUTH_TOKEN) headers.Authorization = 'Bearer ' + env.DSH_AUTH_TOKEN
+  const config = configPayload && configPayload.config && typeof configPayload.config === 'object'
+    ? JSON.parse(JSON.stringify(configPayload.config))
+    : {}
+  setNested(config, options.setKey, parseConfigValue(options.setValue))
+  return {
+    url: base + '/config',
+    init: { method: 'PUT', headers, body: JSON.stringify({ config, revision: configPayload && configPayload.revision }) },
+  }
+}
+
 export async function run(argv = process.argv.slice(2), env = process.env, fetchImpl = fetch) {
   const options = parseArgs(argv)
   if (options.help) return { help: true }
-  const request = buildRequest(options, env)
+  let request = buildRequest(options.command === 'set' ? { ...options, command: 'config' } : options, env)
+  if (options.command === 'set') {
+    const current = await fetchImpl(request.url, request.init)
+    const text = await current.text()
+    if (!current.ok) throw new Error('HTTP ' + current.status + ': ' + text.slice(0, 500))
+    request = buildSetRequest(options, JSON.parse(text || '{}'), env)
+  }
   const res = await fetchImpl(request.url, request.init)
   const text = await res.text()
   if (!res.ok) throw new Error('HTTP ' + res.status + ': ' + text.slice(0, 500))
+  if (options.command === 'sources' && !options.json) {
+    try { return { text: formatSources(JSON.parse(text || '{}')), contentType: 'text/plain' } } catch { /* fall back to raw */ }
+  }
   return { text, contentType: res.headers.get('content-type') || '' }
 }
 
 async function main() {
   const result = await run()
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n')
     return
   }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')

package/lib/client.js

@@ -1841,6 +1841,7 @@ window.__ModuleLoader__.load({
             ),
           ),
           h('div', { className: 'dsub-sub' }, 'Floating capsule can be dragged; docked stays bottom-right.'),
+          h(SourcesPanel, { t }),
 
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, t('composerQuota')),
@@ -3239,6 +3240,7 @@ window.__ModuleLoader__.load({
           composerQuota: (data && data.composerQuota) || 'off',
           composerQuotaDisplay: (data && data.composerQuotaDisplay) || 'current',
           quotaWidget: (data && data.quotaWidget) || 'docked',
+          quotaWidgetPosition: (data && data.quotaWidgetPosition) || { right: 16, bottom: 16 },
           active: (data && data.active) || null,
           error: null,
         }
@@ -3653,20 +3655,74 @@ window.__ModuleLoader__.load({
       )
     }
 
+    // #713: read-only source chain panel. Never renders key values.
+    function SourcesPanel() {
+      const [state, setState] = React.useState({ loading: true, data: null, error: null })
+      const pull = () => {
+        fetch('/dsh-subscriptions/sources', { cache: 'no-store' })
+          .then((res) => res.json())
+          .then((data) => setState({ loading: false, data, error: null }))
+          .catch((err) => setState({ loading: false, data: null, error: String(err && err.message || err) }))
+      }
+      React.useEffect(() => {
+        pull()
+        const id = setInterval(pull, 30 * 1000)
+        return () => clearInterval(id)
+      }, [])
+      const sourceLabel = (source) => source === 'api-key' ? 'API key' : (source === 'oauth' ? 'OAuth' : (source === 'ollama' ? 'Ollama' : 'none'))
+      return h('div', { className: 'dsub-section-card' },
+        h('div', { className: 'dsub-section-title' }, 'Sources', h('button', { type: 'button', className: 'dsub-mini', onClick: pull }, state.loading ? '…' : '↻')),
+        h('div', { className: 'dsub-section-desc' }, 'Subscription → API key → Ollama. Read-only: key rotation owns its cooldowns.'),
+        state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
+        state.data && state.data.keyRotation && !state.data.keyRotation.available
+          ? h('div', { className: 'dsub-dim' }, 'key-rotation not installed/offline' + (state.data.keyRotation.reason ? ': ' + state.data.keyRotation.reason : ''))
+          : null,
+        state.data && state.data.keyRotation && state.data.keyRotation.available
+          ? h('div', { className: 'dsub-dim' }, 'key-rotation: ' + state.data.keyRotation.healthyKeys + '/' + state.data.keyRotation.totalKeys + ' healthy keys')
+          : null,
+        (state.data && state.data.providers ? state.data.providers : []).map((row) => h('div', { className: 'dsub-row', key: row.provider },
+          h('span', { className: 'dsub-h' }, row.provider),
+          h('span', { className: 'dsub-pillTag' }, sourceLabel(row.selected)),
+          row.candidates.map((c, i) => h('span', { key: i, className: 'dsub-dim' },
+            sourceLabel(c.source) + (c.available ? ' ✓' : ' ✕'))),
+        )),
+      )
+    }
+
     // #688: floating/docked quota capsule. Draggable unless docked; opens settings.
     function QuotaCapsule(props) {
       const t = (props && props.t) || ((k) => k)
-      const [state, setState] = React.useState({ mode: 'off', active: null, remaining: null })
+      const [state, setState] = React.useState({ mode: 'off', active: null, remaining: null, source: null })
       const [pos, setPos] = React.useState({ right: 16, bottom: 16 })
+      const posRef = React.useRef({ right: 16, bottom: 16 })
       const drag = React.useRef(null)
       const suppressClick = React.useRef(false)
+      const savePosition = (next) => {
+        fetch('/dsh-subscriptions/config', { cache: 'no-store' })
+          .then((res) => res.json())
+          .then((cfg) => {
+            if (!cfg || !cfg.config) return null
+            return fetch('/dsh-subscriptions/config', {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({
+                config: Object.assign({}, cfg.config, {
+                  quotaWidgetPosition: { right: Math.round(next.right), bottom: Math.round(next.bottom) },
+                }),
+                revision: cfg.revision,
+              }),
+            })
+          })
+          .catch(() => {})
+      }
       React.useEffect(() => {
         let alive = true
         const pull = () => {
           refreshLoggedIn().then(async (r) => {
             if (!alive) return
             const mode = r.quotaWidget || 'docked'
-            if (mode === 'off') { setState({ mode, active: null, remaining: null }); return }
+            if (mode === 'off') { setState({ mode, active: null, remaining: null, source: null }); return }
+            const sources = await fetch('/dsh-subscriptions/sources', { cache: 'no-store' }).then((res) => res.json()).catch(() => null)
             let a = r.active
             const current = currentModelProvider(props)
             if (current && (!a || a.provider !== current)) {
@@ -3674,8 +3730,19 @@ window.__ModuleLoader__.load({
               const rows = (cfg && cfg.accounts) || []
               a = rows.find((row) => row && row.provider === current && row.usagePercent != null) || null
             }
-            if (!a || a.provider === 'ollama' || a.usagePercent == null) { setState({ mode, active: null, remaining: null }); return }
-            setState({ mode, active: a, remaining: Math.max(0, 100 - a.usagePercent) })
+            if (!a || a.provider === 'ollama' || a.usagePercent == null) { setState({ mode, active: null, remaining: null, source: null }); return }
+            const sourceRow = (sources && Array.isArray(sources.providers) ? sources.providers : []).find((row) => row && row.provider === a.provider)
+            const source = sourceRow ? sourceRow.selected : null
+            if (r.quotaWidgetPosition && typeof window !== 'undefined') {
+              const clamp = (v, max) => Math.max(4, Math.min(max, Number(v) || 0))
+              const next = {
+                right: clamp(r.quotaWidgetPosition.right, window.innerWidth - 40),
+                bottom: clamp(r.quotaWidgetPosition.bottom, window.innerHeight - 40),
+              }
+              posRef.current = next
+              setPos(next)
+            }
+            setState({ mode, active: a, remaining: Math.max(0, 100 - a.usagePercent), source })
           }).catch(() => {})
         }
         pull()
@@ -3707,12 +3774,18 @@ window.__ModuleLoader__.load({
         const dx = e.clientX - d.x
         const dy = e.clientY - d.y
         if (Math.abs(dx) + Math.abs(dy) > 3) { d.moved = true; suppressClick.current = true }
-        setPos({
+        const next = {
           right: Math.max(4, Math.min(window.innerWidth - 40, d.right - dx)),
           bottom: Math.max(4, Math.min(window.innerHeight - 40, d.bottom - dy)),
-        })
+        }
+        posRef.current = next
+        setPos(next)
+      }
+      const onPointerUp = () => {
+        const wasDrag = drag.current
+        drag.current = null
+        if (!docked && wasDrag && wasDrag.moved) savePosition(posRef.current)
       }
-      const onPointerUp = () => { drag.current = null }
       return h('div', {
         className: 'dsub-qw' + (docked ? ' dsub-qwDocked' : '') + tone,
         style: { right: pos.right + 'px', bottom: pos.bottom + 'px' },
@@ -3723,12 +3796,13 @@ window.__ModuleLoader__.load({
         onPointerDown,
         onPointerMove,
         onPointerUp,
-        onPointerCancel: onPointerUp,
+        onPointerCancel: () => { drag.current = null },
         onClick: () => { if (suppressClick.current) { suppressClick.current = false; return } openSettings() },
         onKeyDown: (e) => { if (e.key === 'Enter' || e.key === ' ') openSettings() },
       },
         h('span', { className: 'dsub-led ' + ledClass(state.active.usagePercent) }),
         h('span', { className: 'dsub-qwBrand' }, brandBadge(state.active.provider).icon + ' ' + String(state.active.provider || '').toUpperCase()),
+        state.source ? h('span', { className: 'dsub-pillTag' }, state.source === 'api-key' ? 'KEY' : (state.source === 'oauth' ? 'OAuth' : 'OLLAMA')) : null,
         h('span', { className: 'dsub-qwBar' }, h('span', { className: 'dsub-qwBarFill', style: { width: state.remaining + '%', display: 'block' } })),
         h('span', { className: 'dsub-qwPct' }, Math.round(state.remaining) + '%'),
       )

package/lib/config-schema.js

@@ -99,6 +99,9 @@ export const Config = z.object({
     .description('#682 Status-bar quota scope: current (model provider) or hidden.'),
   quotaWidget: z.string().volatile().default('docked')
     .description('#688 Quota widget placement: off, floating (draggable) or docked.'),
+  quotaWidgetPosition: z.object({ right: z.number(), bottom: z.number() }).volatile()
+    .default({ right: 16, bottom: 16 })
+    .description('#711 Last floating quota widget position in CSS pixels.'),
   rateLimitWait: z.boolean().volatile().default(true)
     .description('#684 Report the disclosed reset to dsh-llm-retry instead of parking the account on a guess.'),
   rateLimitMaxWaitMs: z.number().volatile().default(21600000)

package/lib/key-rotation-bridge.js

@@ -0,0 +1,102 @@
+// #709: read-only bridge to @goodandready/dsh-key-rotation.
+// This module never writes cooldown, never rotates a key and never exposes a
+// key value. It only summarises the sanitized status route so the source chain
+// can show which pool would be used next.
+export const KEY_ROTATION_STATUS_PATH = '/dsh-key-rotation/status'
+
+export function summarizeKeyRotationStatus(raw) {
+  if (!raw || !Array.isArray(raw.providers)) return { available: false, reason: 'invalid status', providers: [], totalKeys: 0, healthyKeys: 0 }
+  let totalKeys = 0
+  let healthyKeys = 0
+  const providers = raw.providers.map((p) => {
+    const keys = (Array.isArray(p && p.keys) ? p.keys : [])
+      .filter((k) => k && k.present)
+      .map((k) => {
+        const cooldownMsLeft = Math.max(0, Number(k.cooldownMsLeft) || 0)
+        const paused = Boolean(k.paused)
+        const revoked = Boolean(k.revoked)
+        const broken = Boolean(k.broken)
+        const healthy = !paused && !revoked && !broken && cooldownMsLeft === 0
+        return {
+          ref: String(k.ref || ''),
+          active: Boolean(k.active),
+          cooldownMsLeft,
+          paused,
+          revoked,
+          broken,
+          healthy,
+          expiresAt: k.expiresAt == null ? null : Number(k.expiresAt),
+        }
+      })
+    totalKeys += keys.length
+    healthyKeys += keys.filter((k) => k.healthy).length
+    return {
+      provider: String((p && (p.providerName || p.provider)) || ''),
+      base: String((p && p.provider) || ''),
+      healthyKeys: keys.filter((k) => k.healthy).length,
+      totalKeys: keys.length,
+      keys,
+    }
+  }).filter((p) => p.provider)
+  return { available: true, providers, totalKeys, healthyKeys }
+}
+
+export async function readKeyRotationStatus({ baseUrl, path = KEY_ROTATION_STATUS_PATH, fetchImpl = fetch, timeoutMs = 2000 } = {}) {
+  if (!baseUrl) return { available: false, reason: 'missing base url', providers: [], totalKeys: 0, healthyKeys: 0 }
+  try {
+    const init = { method: 'GET', headers: { accept: 'application/json' } }
+    if (timeoutMs > 0 && typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') {
+      init.signal = AbortSignal.timeout(timeoutMs)
+    }
+    const res = await fetchImpl(String(baseUrl).replace(/\/$/, '') + path, init)
+    if (!res || !res.ok) return { available: false, reason: 'HTTP ' + (res && res.status), providers: [], totalKeys: 0, healthyKeys: 0 }
+    const raw = await res.json()
+    return summarizeKeyRotationStatus(raw)
+  } catch (err) {
+    return { available: false, reason: String(err && err.message || err), providers: [], totalKeys: 0, healthyKeys: 0 }
+  }
+}
+
+const SOURCE_ORDER = ['oauth', 'api-key', 'ollama']
+
+export function buildSourceChain({ subscriptions = [], keyRotation = null, ollama = { available: false } } = {}) {
+  const providers = new Map()
+  const entry = (provider) => {
+    const key = String(provider || '')
+    if (!providers.has(key)) providers.set(key, { provider: key, candidates: [] })
+    return providers.get(key)
+  }
+  for (const sub of (Array.isArray(subscriptions) ? subscriptions : [])) {
+    if (!sub || !sub.provider) continue
+    entry(sub.provider).candidates.push({
+      source: 'oauth',
+      available: Boolean(sub.loggedIn) && !(Number(sub.cooldownUntil) > Date.now()),
+      detail: {
+        index: sub.index == null ? null : Number(sub.index),
+        label: sub.label || null,
+        usagePercent: sub.usagePercent == null ? null : Number(sub.usagePercent),
+        cooldownUntil: sub.cooldownUntil == null ? null : Number(sub.cooldownUntil),
+      },
+    })
+  }
+  if (keyRotation && keyRotation.available) {
+    for (const pool of (keyRotation.providers || [])) {
+      if (!pool || !pool.provider) continue
+      entry(pool.provider).candidates.push({
+        source: 'api-key',
+        available: Number(pool.healthyKeys) > 0,
+        detail: { healthyKeys: Number(pool.healthyKeys) || 0, totalKeys: Number(pool.totalKeys) || 0, keys: pool.keys || [] },
+      })
+    }
+  }
+  if (ollama && ollama.available) {
+    const target = entry('ollama')
+    target.candidates.push({ source: 'ollama', available: true, detail: { model: ollama.model || null } })
+  }
+  const rows = [...providers.values()].map((row) => {
+    row.candidates.sort((a, b) => SOURCE_ORDER.indexOf(a.source) - SOURCE_ORDER.indexOf(b.source))
+    const selected = row.candidates.find((c) => c.available) || null
+    return { ...row, selected: selected ? selected.source : null }
+  })
+  return { order: SOURCE_ORDER.slice(), noDoubleRotation: true, providers: rows }
+}

package/lib/routes/sources.js

@@ -0,0 +1,52 @@
+import { isTrustedSettingsRequest, safeJsonHandler, writeJson } from '../http.js'
+import { buildSourceChain, readKeyRotationStatus } from '../key-rotation-bridge.js'
+
+export function registerSourcesRoutes(ctx, state) {
+  const { accountsView, live } = state
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/sources',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'GET') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let subscriptions = []
+      try {
+        const rows = await accountsView()
+        subscriptions = (rows || []).map((row) => ({
+          provider: row.provider,
+          index: row.index,
+          label: row.label,
+          loggedIn: Boolean(row.hasToken),
+          usagePercent: row.usagePercent,
+          cooldownUntil: row.cooldownUntil,
+        }))
+      } catch { /* keep the chain available */ }
+      const port = req.socket && req.socket.localPort
+      const keyRotation = port
+        ? await readKeyRotationStatus({ baseUrl: 'http://127.0.0.1:' + port })
+        : { available: false, reason: 'no local port', providers: [], totalKeys: 0, healthyKeys: 0 }
+      const chain = buildSourceChain({
+        subscriptions,
+        keyRotation,
+        ollama: { available: live().ollamaFallback !== false },
+      })
+      writeJson(res, 200, {
+        ok: true,
+        keyRotation: {
+          available: keyRotation.available,
+          reason: keyRotation.reason || null,
+          totalKeys: keyRotation.totalKeys,
+          healthyKeys: keyRotation.healthyKeys,
+        },
+        ...chain,
+      })
+    }),
+  }), 'dsh-subscriptions: /sources')
+}

package/lib/routes/status.js

@@ -260,6 +260,7 @@ export function registerStatusRoutes(ctx, state) {
         fastMode: !!live().codexFastMode,
         composerQuota: String(live().composerQuota || 'off'),        composerQuotaDisplay: String(live().composerQuotaDisplay || 'current'),
         quotaWidget: String(live().quotaWidget || 'docked'),
+        quotaWidgetPosition: live().quotaWidgetPosition || { right: 16, bottom: 16 },
         active,
       })
     }),

package/lib/routes.js

@@ -5,6 +5,7 @@ import { registerStatusRoutes } from './routes/status.js'
 import { registerOauthRoutes } from './routes/oauth.js'
 import { registerAccountsRoutes } from './routes/accounts.js'
 import { registerProxyRoutes } from './routes/proxy.js'
+import { registerSourcesRoutes } from './routes/sources.js'
 import { registerPluginUpdater } from './updater.js'
 
 export function registerRoutes(ctx, state) {
@@ -109,4 +110,5 @@ function esc(x){return String(x==null?'':x).replace(/&/g,'&amp;').replace(/</g,'
   registerOauthRoutes(ctx, state)
   registerAccountsRoutes(ctx, state)
   registerProxyRoutes(ctx, state)
+  registerSourcesRoutes(ctx, state)
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",