@goodandready/dsh-subscriptions 0.7.31 → 0.7.32

package/lib/account-reliability.js

@@ -0,0 +1,68 @@
+function text(value) {
+  return value == null ? '' : String(value).trim()
+}
+
+/**
+ * #827: decide whether a stored credential is usable without exposing it.
+ * Empty access/refresh tokens and non-finite expiry are treated as corrupt.
+ */
+export function credentialState(blob) {
+  if (!blob || typeof blob !== 'object') return { usable: false, reason: 'invalid_blob' }
+  const accessToken = text(blob.accessToken)
+  const refreshToken = text(blob.refreshToken)
+  if (!accessToken && !refreshToken && !text(blob.apiKey)) {
+    return { usable: false, reason: 'empty_credentials' }
+  }
+  if (blob.expiresAt != null && blob.expiresAt !== '' && !Number.isFinite(Number(blob.expiresAt))) {
+    return { usable: false, reason: 'invalid_expiry' }
+  }
+  return { usable: true, reason: null }
+}
+
+/**
+ * #831: stable provider identity used for duplicate detection. Unknown
+ * identities return null and must never be merged automatically.
+ */
+export function accountIdentityKey(provider, blob) {
+  if (!blob || typeof blob !== 'object') return null
+  const id = text(blob.email || blob.login || blob.accountId || blob.userId)
+  if (!id) return null
+  return `${text(provider).toLowerCase()}:${id.toLowerCase()}`
+}
+
+/**
+ * #818: aliases are display-only. Resolve either a stable ref or a legacy
+ * label within one provider back to the stable credential ref.
+ */
+export function resolveAccountRef(slots, provider, value) {
+  const wanted = text(value)
+  if (!wanted) return null
+  const list = (Array.isArray(slots) ? slots : []).filter((slot) => slot && slot.provider === provider)
+  const byIndex = Number(wanted)
+  if (Number.isInteger(byIndex) && byIndex > 0) {
+    return list.find((slot) => Number(slot.index) === byIndex)?.ref || null
+  }
+  return list.find((slot) => slot.ref === wanted || text(slot.label) === wanted)?.ref || null
+}
+
+/**
+ * #806: a delayed refresh may only write when its credential lineage is
+ * still current. A newer save/revoke bumps the version.
+ */
+export function refreshIsCurrent(currentVersion, expectedVersion) {
+  return Number(currentVersion) === Number(expectedVersion)
+}
+
+/**
+ * #833: deterministic host-env vs plugin-proxy precedence.
+ * @param {{ hostProxy?: string, pluginProxy?: string, prefer?: 'host' | 'plugin' }} [options]
+ */
+export function proxyPrecedence(options = {}) {
+  const prefer = options.prefer || 'host'
+  const host = text(options.hostProxy)
+  const plugin = text(options.pluginProxy)
+  if (host && plugin && prefer === 'plugin') return { proxy: plugin, source: 'plugin', conflict: true }
+  if (host) return { proxy: host, source: 'host', conflict: Boolean(plugin) }
+  if (plugin) return { proxy: plugin, source: 'plugin', conflict: false }
+  return { proxy: '', source: 'none', conflict: false }
+}

package/lib/accounts-view.js

@@ -169,6 +169,8 @@ export async function createAccountsView({ live, store, fetch, pmL, pmE, concurr
       poolEnabled: slot.poolEnabled !== false,
       isDefault: !!slot.isDefault,
       ...(Array.isArray(slot.poolModels) ? { poolModels: slot.poolModels } : {}),
+      credentialError: info.credentialError || null,
+      duplicateOf: info.duplicateOf || null,
       capabilities,
       billing,
       renewsAt: billing.renewsAt,

package/lib/accounts.js

@@ -46,6 +46,7 @@ import { credentialRef } from '@deepseek-ai/dsh-credentials'
 import { oauthRef, isProvider } from './refs.js'
 import { parseBlob, serializeBlob } from './blob.js'
 import { encryptWithPassphrase, decryptWithPassphrase } from './crypto.js'
+import { accountIdentityKey, credentialState } from './account-reliability.js'
 import { recordSwitch, recordExhaust, recordBroken, computeHealthScore, healthBadge } from './health.js'
 import { executeWithRetry } from './backoff.js'
 import { getVendor } from './vendors/index.js'
@@ -308,6 +309,26 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
     if (base.configured) {
       try {
         const blob = parseBlob(await resolveRaw(ref))
+        const state = credentialState(blob)
+        if (!state.usable) {
+          base.configured = false
+          base.credentialError = state.reason
+          base.label = blob.label || blob.email || ''
+          return {
+            ...base,
+            cooldownUntil: 0,
+            quarantineUntil: 0,
+            cooldownFamilies: null,
+            cooldownModels: null,
+            quota: null,
+            isRevoked: false,
+            authWarning: '',
+            validationUrl: '',
+            validationMessage: '',
+            accountNotice: '',
+            paidTierName: '',
+          }
+        }
         base.label = blob.label || blob.email || ''
         base.email = blob.email || ''
         base.plan = blob.plan || blob.paidTierName || ''
@@ -367,6 +388,7 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
       latencyGrade: pings.get(ref)?.latencyGrade ?? null,
       lastDoctorVerdict: doctorVerdicts.get(ref) || null,
       availableModels: dynamicModels.get(ref)?.models || null,
+      credentialError: base.credentialError || null,
     }
   }
 
@@ -374,8 +396,12 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
     const curConfig = getConfig()
     const slots = normalizeSlots(curConfig.slots).filter((s) => s.provider === provider)
     const out = []
+    const identities = new Map()
     for (const slot of slots) {
       const info = await describeRef(slot.ref, curConfig)
+      const identity = accountIdentityKey(provider, { email: info.email, accountId: info.accountId })
+      const duplicateOf = identity ? (identities.get(identity) || null) : null
+      if (identity && !duplicateOf) identities.set(identity, slot.ref)
       const q = quarantines.get(slot.ref)
       out.push({
         ref: slot.ref,
@@ -400,6 +426,8 @@ export function createAccountStore({ credentials, getConfig, fetchImpl, fetchFor
         poolEnabled: slot.poolEnabled !== false,
         isDefault: !!slot.isDefault,
         ...(Array.isArray(slot.poolModels) ? { poolModels: slot.poolModels } : {}),
+        credentialError: info.credentialError || null,
+        duplicateOf,
       })
     }
     return out

package/lib/index.js

@@ -18,6 +18,7 @@ import { createSubscriptionsService } from './subscriptions.js'
 import { registerSubscriptionTools } from './native-tools.js'
 import { detectConflicts, readProfilePluginNames, setActiveConflicts } from './coexistence.js'
 import { createAccountStore, defaultAccountRef, normalizeSlots, vendorConfig } from './accounts.js'
+import { resolveAccountRef } from './account-reliability.js'
 import { OllamaAdapter, ollamaAlive, ollamaModels, ollamaBase } from './ollama.js'
 import { createResetCreditService } from './reset-credits.js'
 import { maskEmail, maskLabel } from './mask.js'
@@ -276,9 +277,8 @@ export function apply(ctx, rawConfig) {
 
   // #85: host-only reset credit service for Codex accounts.
   const resetCredits = createResetCreditService({ loadBlob: (ref) => store.loadBlob(ref) })
-  function refForSlot(provider, index) {
-    const slot = normalizeSlots(live().slots).find((s) => s.provider === provider && s.index === index)
-    return slot ? slot.ref : null
+  function refForSlot(provider, indexOrAlias) {
+    return resolveAccountRef(normalizeSlots(live().slots), provider, indexOrAlias)
   }
 
   function stripLegacySlots(slots) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.31",
+  "version": "0.7.32",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",