@goodandready/dsh-subscriptions 0.7.7 → 0.7.9

package/bin/dsh-subscriptions.mjs

@@ -6,7 +6,7 @@ import { readFile } from 'node:fs/promises'
 export function parseArgs(argv) {
   const args = Array.isArray(argv) ? argv.slice() : []
   const command = args.shift() || 'status'
-  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '' }
+  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i]
     if (arg === '--csv') options.csv = true
@@ -18,6 +18,8 @@ export function parseArgs(argv) {
     else if (command === 'set') options.setValue = arg
     else if (command === 'packs' && arg === 'add') options.packAction = 'add'
     else if (command === 'packs' && options.packAction === 'add' && !options.packFile) options.packFile = arg
+    else if (command === 'vault' && !options.vaultAction) options.vaultAction = arg
+    else if (command === 'vault' && !options.vaultArg) options.vaultArg = arg
     else if (command === 'fast' && !options.sessionId) options.sessionId = arg
     else if (command === 'fast') options.mode = arg === 'standard' || arg === 'off' ? 'standard' : 'fast'
   }
@@ -72,6 +74,15 @@ export function buildRequest(options, env = process.env) {
   if (options.command === 'sources') return { url: base + '/sources', init: { method: 'GET', headers } }
   if (options.command === 'packs') return { url: base + '/config', init: { method: 'GET', headers } }
   if (options.command === 'diagnostics') return { url: base + '/diagnostics', init: { method: 'GET', headers } }
+  if (options.command === 'vault') {
+    if (options.vaultAction === 'restore') {
+      return { url: base + '/vault/snapshots/restore', init: { method: 'POST', headers: { ...headers, 'Content-Type': 'application/json' }, body: JSON.stringify({ id: options.vaultArg }) } }
+    }
+    if (options.vaultAction === 'snapshot') {
+      return { url: base + '/vault/snapshots', init: { method: 'POST', headers: { ...headers, 'Content-Type': 'application/json' }, body: JSON.stringify({ label: options.vaultArg || 'manual' }) } }
+    }
+    return { url: base + '/vault/snapshots', init: { method: 'GET', headers } }
+  }
   throw new Error('unknown command: ' + options.command)
 }
 
@@ -112,6 +123,17 @@ export function formatPacks(packs) {
   return JSON.stringify((Array.isArray(packs) ? packs : []).map(sanitizePack), null, 2) + '\\n'
 }
 
+export function formatSnapshotStatus(payload) {
+  const stats = (payload && payload.stats) || {}
+  return 'snapshots: ' + (stats.count || 0) + '  bytes: ' + (stats.bytes || 0) + '  path: ' + (stats.path || '-')
+}
+
+export function formatSnapshots(payload) {
+  const rows = (payload && payload.snapshots) || []
+  if (!rows.length) return 'no vault snapshots'
+  return rows.map((s) => s.id + '  ' + s.createdAt + '  ' + (s.label || '-') + '  ' + s.slotCount + ' slots').join('\n')
+}
+
 export function mergeProviderPack(packs, pack) {
   const list = (Array.isArray(packs) ? packs : []).filter((p) => p && p.id !== pack.id)
   return [...list, pack]
@@ -197,6 +219,15 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
   const res = await fetchImpl(request.url, request.init)
   const text = await res.text()
   if (!res.ok) throw new Error('HTTP ' + res.status + ': ' + text.slice(0, 500))
+  if (options.command === 'vault' && !options.json) {
+    try {
+      const payload = JSON.parse(text || '{}')
+      if (options.vaultAction === 'status') return { text: formatSnapshotStatus(payload), contentType: 'text/plain' }
+      if (options.vaultAction === 'snapshots' || !options.vaultAction) return { text: formatSnapshots(payload), contentType: 'text/plain' }
+      if (options.vaultAction === 'snapshot') return { text: 'created ' + (payload.snapshot && payload.snapshot.id), contentType: 'text/plain' }
+      if (options.vaultAction === 'restore') return { text: 'restored ' + (payload.slotCount || 0) + ' slots', contentType: 'text/plain' }
+    } catch { /* fall back to raw */ }
+  }
   if (options.command === 'packs' && options.packAction !== 'add') {
     try {
       const payload = JSON.parse(text || '{}')
@@ -212,7 +243,7 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
 async function main() {
   const result = await run()
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  doctor [--json]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  doctor [--json]\n')
     return
   }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')

package/lib/client.js

@@ -1843,6 +1843,7 @@ window.__ModuleLoader__.load({
           h('div', { className: 'dsub-sub' }, 'Floating capsule can be dragged; docked stays bottom-right.'),
           h(SourcesPanel, { t }),
           h(ProviderPacksPanel),
+          h(VaultSnapshotsPanel),
 
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, t('composerQuota')),
@@ -3710,6 +3711,51 @@ window.__ModuleLoader__.load({
       )
     }
 
+    // #736: vault snapshot list with create/restore. Payload stays server-side.
+    function VaultSnapshotsPanel() {
+      const [state, setState] = React.useState({ snapshots: [], stats: null, message: '', error: null, busy: false })
+      const pull = () => {
+        fetch('/dsh-subscriptions/vault/snapshots', { cache: 'no-store' })
+          .then((res) => res.json())
+          .then((data) => setState((st) => Object.assign({}, st, { snapshots: data.snapshots || [], stats: data.stats || null, error: null })))
+          .catch((err) => setState((st) => Object.assign({}, st, { error: String(err && err.message || err) })))
+      }
+      React.useEffect(() => { pull() }, [])
+      const call = (url, body) => fetch(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(body || {}),
+      }).then(async (res) => {
+        const data = await res.json().catch(() => ({}))
+        if (!res.ok || !data.ok) throw new Error((data.error && data.error.message) || ('HTTP ' + res.status))
+        return data
+      })
+      const create = () => {
+        setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
+        call('/dsh-subscriptions/vault/snapshots', { label: 'manual' })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'created ' + data.snapshot.id })); pull() })
+          .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
+      }
+      const restore = (id) => {
+        setState((st) => Object.assign({}, st, { busy: true, message: '', error: null }))
+        call('/dsh-subscriptions/vault/snapshots/restore', { id })
+          .then((data) => { setState((st) => Object.assign({}, st, { busy: false, message: 'restored ' + data.slotCount + ' slots' })); pull() })
+          .catch((err) => setState((st) => Object.assign({}, st, { busy: false, error: String(err && err.message || err) })))
+      }
+      return h('div', { className: 'dsub-section-card' },
+        h('div', { className: 'dsub-section-title' }, 'Vault snapshots', h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : 'Create snapshot')),
+        h('div', { className: 'dsub-section-desc' }, 'Encrypted slots snapshots. A pre-pull snapshot is created automatically. Payload stays on the host.'),
+        state.stats ? h('div', { className: 'dsub-dim' }, state.stats.count + ' snapshots · ' + state.stats.bytes + ' bytes · ' + state.stats.path) : null,
+        state.snapshots.length ? state.snapshots.map((snap) => h('div', { className: 'dsub-row', key: snap.id },
+          h('span', { className: 'dsub-h' }, snap.id),
+          h('span', { className: 'dsub-dim' }, (snap.label || '-') + ' · ' + snap.slotCount + ' slots · ' + snap.createdAt),
+          h('button', { type: 'button', className: 'dsub-mini', disabled: state.busy, onClick: () => restore(snap.id) }, 'Restore'),
+        )) : h('div', { className: 'dsub-dim' }, 'No snapshots yet.'),
+        state.message ? h('div', { className: 'dsub-ok' }, state.message) : null,
+        state.error ? h('div', { className: 'dsub-bad' }, state.error) : null,
+      )
+    }
+
     // #724: provider pack manager. Displays ids/models only; headers are masked.
     function ProviderPacksPanel() {
       const [state, setState] = React.useState({ packs: [], text: '', message: '', error: null, busy: false })

package/lib/routes/vault.js

@@ -0,0 +1,88 @@
+import { Config, plainConfig, revisionOf } from '../config-schema.js'
+import { isTrustedSettingsRequest, readBody, safeJsonHandler, writeJson } from '../http.js'
+import { capturePrePullSnapshot, restoreVaultSnapshot } from '../vault-sync.js'
+import { defaultSnapshotStore } from '../vault-snapshots.js'
+
+export function registerVaultRoutes(ctx, state) {
+  const { live, getSettingsApi, syncAdapter, stripLegacySlots } = state
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/snapshots',
+    handler: safeJsonHandler(async (req, res) => {
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      if (req.method === 'GET') {
+        writeJson(res, 200, { ok: true, snapshots: defaultSnapshotStore.list(), stats: defaultSnapshotStore.stats() })
+        return
+      }
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET or POST' } })
+        return
+      }
+      let body = {}
+      try { body = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const passphrase = String(live().vaultSyncPassphrase || '').trim()
+      if (!passphrase) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault', message: 'vaultSyncPassphrase is required' } })
+        return
+      }
+      try {
+        const snapshot = capturePrePullSnapshot(live().slots || [], passphrase, String(body.label || 'manual'))
+        writeJson(res, 200, { ok: true, snapshot })
+      } catch (err) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault', message: String(err && err.message || err) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/snapshots')
+
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/vault/snapshots/restore',
+    handler: safeJsonHandler(async (req, res) => {
+      if (req.method !== 'POST') {
+        writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } })
+        return
+      }
+      if (!isTrustedSettingsRequest(req, ctx)) {
+        writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
+        return
+      }
+      let body = {}
+      try { body = JSON.parse((await readBody(req, 4096)).toString('utf8') || '{}') } catch {
+        writeJson(res, 400, { ok: false, error: { code: 'json', message: 'invalid json' } })
+        return
+      }
+      const snapshot = defaultSnapshotStore.get(String(body.id || ''))
+      if (!snapshot) {
+        writeJson(res, 404, { ok: false, error: { code: 'snapshot', message: 'snapshot not found' } })
+        return
+      }
+      const passphrase = String(live().vaultSyncPassphrase || '').trim()
+      if (!passphrase) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault', message: 'vaultSyncPassphrase is required' } })
+        return
+      }
+      const api = getSettingsApi()
+      if (!api) {
+        writeJson(res, 503, { ok: false, error: { code: 'settings', message: 'settings not ready' } })
+        return
+      }
+      try {
+        const restored = restoreVaultSnapshot(snapshot, passphrase)
+        const cfg = live()
+        const slots = stripLegacySlots(restored.slots || [])
+        await api.replace(plainConfig(Config({ ...cfg, slots })), revisionOf(api))
+        if (typeof syncAdapter === 'function') await syncAdapter()
+        writeJson(res, 200, { ok: true, id: snapshot.id, slotCount: slots.length })
+      } catch (err) {
+        writeJson(res, 400, { ok: false, error: { code: 'vault', message: String(err && err.message || err) } })
+      }
+    }),
+  }), 'dsh-subscriptions: /vault/snapshots/restore')
+}

package/lib/routes.js

@@ -8,6 +8,7 @@ import { registerProxyRoutes } from './routes/proxy.js'
 import { registerSourcesRoutes } from './routes/sources.js'
 import { registerPacksRoutes } from './routes/packs.js'
 import { registerWebhookRoutes } from './routes/webhook.js'
+import { registerVaultRoutes } from './routes/vault.js'
 import { registerPluginUpdater } from './updater.js'
 
 export function registerRoutes(ctx, state) {
@@ -115,4 +116,5 @@ function esc(x){return String(x==null?'':x).replace(/&/g,'&amp;').replace(/</g,'
   registerSourcesRoutes(ctx, state)
   registerPacksRoutes(ctx)
   registerWebhookRoutes(ctx, state)
+  registerVaultRoutes(ctx, state)
 }

package/lib/vault-snapshots.js

@@ -0,0 +1,96 @@
+// #739: durable, bounded snapshot ring. Encrypted payloads are written with
+// 0600 permissions through a temp file + rename; list() only returns metadata.
+import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+
+const FILE_NAME = 'vault-snapshots.json'
+export const DEFAULT_MAX_BYTES = 2 * 1024 * 1024
+
+function bytesOf(items) {
+  return Buffer.byteLength(JSON.stringify(items))
+}
+let seq = 0
+
+export function resolveSnapshotDir(customDir) {
+  if (customDir) return customDir
+  if (process.env.DSH_SNAPSHOT_DIR) return process.env.DSH_SNAPSHOT_DIR
+  if (process.env.DSH_STORAGE_DIR) return process.env.DSH_STORAGE_DIR
+  if (process.env.DSH_HOME) return join(process.env.DSH_HOME, 'storages', 'dsh-subscriptions')
+  return join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+}
+
+function meta(snapshot) {
+  return {
+    id: snapshot.id,
+    label: snapshot.label || '',
+    createdAt: snapshot.createdAt,
+    version: snapshot.version || 2,
+    slotCount: Number(snapshot.slotCount) || 0,
+    blobCount: Number(snapshot.blobCount) || 0,
+  }
+}
+
+function load(file) {
+  try {
+    const rows = JSON.parse(readFileSync(file, 'utf8'))
+    if (!Array.isArray(rows)) return []
+    return rows.filter((row) => row && typeof row === 'object' && typeof row.vault === 'string' && row.id)
+  } catch {
+    return []
+  }
+}
+
+function persist(dir, file, items) {
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    const tmp = file + '.tmp-' + process.pid + '-' + Date.now()
+    writeFileSync(tmp, JSON.stringify(items), { mode: 0o600 })
+    renameSync(tmp, file)
+    try { chmodSync(file, 0o600) } catch { /* best-effort */ }
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function createSnapshotStore({ max = 10, maxBytes = DEFAULT_MAX_BYTES, now = () => Date.now(), dir, persistToDisk = true } = {}) {
+  const snapshotDir = resolveSnapshotDir(dir)
+  const file = join(snapshotDir, FILE_NAME)
+  let items = persistToDisk ? load(file) : []
+  const save = () => { if (persistToDisk) persist(snapshotDir, file, items) }
+  return {
+    path: file,
+    add(snapshot, label = '') {
+      const at = now()
+      const entry = {
+        ...snapshot,
+        id: 'vs_' + at.toString(36) + '_' + (++seq).toString(36),
+        label: String(label || snapshot.label || ''),
+        createdAt: snapshot.createdAt || new Date(at).toISOString(),
+      }
+      items.unshift(entry)
+      if (items.length > Math.max(1, max)) items = items.slice(0, Math.max(1, max))
+      while (items.length > 1 && bytesOf(items) > Math.max(1, maxBytes)) items.pop()
+      save()
+      return meta(entry)
+    },
+    list() {
+      return items.map(meta)
+    },
+    get(id) {
+      return items.find((item) => item.id === id) || null
+    },
+    clear() {
+      items = []
+      save()
+    },
+    stats() {
+      let bytes = bytesOf(items)
+      try { bytes = Math.max(bytes, statSync(file).size) } catch { /* file may not exist yet */ }
+      return { count: items.length, bytes, path: file, maxBytes }
+    },
+  }
+}
+
+export const defaultSnapshotStore = createSnapshotStore({ max: 10 })

package/lib/vault-sync.js

@@ -6,6 +6,7 @@ import { exportVault, importVault } from './vault.js'
 import { normalizeSlots } from './accounts.js'
 import { Config, plainConfig, revisionOf } from './config-schema.js'
 import { validateCredentialBlob } from './blob.js'
+import { defaultSnapshotStore } from './vault-snapshots.js'
 
 let syncStatus = {
   enabled: false,
@@ -273,6 +274,10 @@ export function createVaultSnapshot({ slots, blobs = {} }, passphrase, label = '
   return { version: 2, label: String(label || ''), createdAt: new Date().toISOString(), vault, slotCount, blobCount }
 }
 
+export function capturePrePullSnapshot(slots, passphrase, label = 'pre-pull') {
+  return defaultSnapshotStore.add(createVaultSnapshot({ slots: slots || [], blobs: {} }, passphrase, label))
+}
+
 export function restoreVaultSnapshot(snapshot, passphrase) {
   if (!snapshot || typeof snapshot.vault !== 'string' || !snapshot.vault) throw new Error('snapshot is missing its encrypted vault')
   return importVault(snapshot.vault, passphrase)
@@ -401,6 +406,7 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
       throw new Error(`unsupported vault sync backend: ${backend}`)
     }
 
+    try { capturePrePullSnapshot(cfg.slots || [], passphrase) } catch { /* snapshot is best-effort */ }
     const result = importVault(encryptedData, passphrase)
     const providerFilter = new Set((cfg.vaultSyncProviders || []).map((p) => String(p)))
     const remoteSlots = providerFilter.size

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",