@goodandready/dsh-subscriptions 0.7.8 → 0.7.10

package/bin/dsh-subscriptions.mjs

@@ -105,6 +105,8 @@ export function formatDoctor(payload) {
   lines.push('doctor: ' + (doctorFailed(payload) ? 'degraded' : 'ok'))
   lines.push('errors: ' + errors + ' conflicts: ' + conflicts)
   lines.push('key-rotation: ' + (kr.available ? (kr.healthyKeys + '/' + kr.totalKeys + ' healthy keys') : ('unavailable' + (kr.reason ? ' (' + kr.reason + ')' : ''))))
+  const snapshots = diag.vaultSnapshots || {}
+  lines.push('snapshots: ' + (snapshots.count || 0) + ' (' + (snapshots.bytes || 0) + ' bytes)')
   for (const row of (sources.providers || [])) lines.push(row.provider + ': ' + (row.selected || 'none'))
   return lines.join('\n')
 }
@@ -123,6 +125,11 @@ export function formatPacks(packs) {
   return JSON.stringify((Array.isArray(packs) ? packs : []).map(sanitizePack), null, 2) + '\\n'
 }
 
+export function formatSnapshotStatus(payload) {
+  const stats = (payload && payload.stats) || {}
+  return 'snapshots: ' + (stats.count || 0) + '  bytes: ' + (stats.bytes || 0) + '  path: ' + (stats.path || '-')
+}
+
 export function formatSnapshots(payload) {
   const rows = (payload && payload.snapshots) || []
   if (!rows.length) return 'no vault snapshots'
@@ -217,6 +224,7 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
   if (options.command === 'vault' && !options.json) {
     try {
       const payload = JSON.parse(text || '{}')
+      if (options.vaultAction === 'status') return { text: formatSnapshotStatus(payload), contentType: 'text/plain' }
       if (options.vaultAction === 'snapshots' || !options.vaultAction) return { text: formatSnapshots(payload), contentType: 'text/plain' }
       if (options.vaultAction === 'snapshot') return { text: 'created ' + (payload.snapshot && payload.snapshot.id), contentType: 'text/plain' }
       if (options.vaultAction === 'restore') return { text: 'restored ' + (payload.slotCount || 0) + ' slots', contentType: 'text/plain' }
@@ -237,7 +245,7 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
 async function main() {
   const result = await run()
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id>\n  doctor [--json]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  doctor [--json]\n')
     return
   }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')

package/lib/client.js

@@ -3713,11 +3713,11 @@ window.__ModuleLoader__.load({
 
     // #736: vault snapshot list with create/restore. Payload stays server-side.
     function VaultSnapshotsPanel() {
-      const [state, setState] = React.useState({ snapshots: [], message: '', error: null, busy: false })
+      const [state, setState] = React.useState({ snapshots: [], stats: null, message: '', error: null, busy: false })
       const pull = () => {
         fetch('/dsh-subscriptions/vault/snapshots', { cache: 'no-store' })
           .then((res) => res.json())
-          .then((data) => setState((st) => Object.assign({}, st, { snapshots: data.snapshots || [], error: null })))
+          .then((data) => setState((st) => Object.assign({}, st, { snapshots: data.snapshots || [], stats: data.stats || null, error: null })))
           .catch((err) => setState((st) => Object.assign({}, st, { error: String(err && err.message || err) })))
       }
       React.useEffect(() => { pull() }, [])
@@ -3745,6 +3745,7 @@ window.__ModuleLoader__.load({
       return h('div', { className: 'dsub-section-card' },
         h('div', { className: 'dsub-section-title' }, 'Vault snapshots', h('button', { type: 'button', className: 'dsub-mini', onClick: create, disabled: state.busy }, state.busy ? '…' : 'Create snapshot')),
         h('div', { className: 'dsub-section-desc' }, 'Encrypted slots snapshots. A pre-pull snapshot is created automatically. Payload stays on the host.'),
+        state.stats ? h('div', { className: 'dsub-dim' }, state.stats.count + ' snapshots · ' + state.stats.bytes + ' bytes · ' + state.stats.path) : null,
         state.snapshots.length ? state.snapshots.map((snap) => h('div', { className: 'dsub-row', key: snap.id },
           h('span', { className: 'dsub-h' }, snap.id),
           h('span', { className: 'dsub-dim' }, (snap.label || '-') + ' · ' + snap.slotCount + ' slots · ' + snap.createdAt),

package/lib/health-report.js

@@ -0,0 +1,21 @@
+// #745: health is about having a usable source, not about uptime alone.
+export function assessHealth({ accounts = [], sources = null, snapshots = null, webhookUrl = '', ollama = false } = {}) {
+  const list = Array.isArray(accounts) ? accounts : []
+  const connectedAccounts = list.filter((a) => a && a.configured).length
+  const sourceRows = sources && Array.isArray(sources.providers) ? sources.providers : []
+  const selectedSources = sourceRows.filter((row) => row && row.selected).length
+  const keyRotation = Boolean(sources && sources.keyRotation && sources.keyRotation.available)
+  const ok = connectedAccounts > 0 || keyRotation || Boolean(ollama)
+  return {
+    ok,
+    status: ok ? 'healthy' : 'degraded',
+    checks: {
+      connectedAccounts,
+      keyRotation,
+      ollama: Boolean(ollama),
+      webhook: Boolean(webhookUrl),
+      snapshots: snapshots ? Number(snapshots.count) || 0 : 0,
+      selectedSources,
+    },
+  }
+}

package/lib/metrics.js

@@ -0,0 +1,62 @@
+// #744: Prometheus text exposition. No secrets, labels escaped, deterministic order.
+function label(value) {
+  return String(value == null ? '' : value).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')
+}
+
+function add(lines, name, help, type, samples) {
+  lines.push('# HELP ' + name + ' ' + help)
+  lines.push('# TYPE ' + name + ' ' + type)
+  for (const sample of samples) lines.push(name + (sample.labels ? '{' + sample.labels + '}' : '') + ' ' + sample.value)
+}
+
+export function formatMetrics({ accounts = [], rows = [], alerts = [], sources = null } = {}) {
+  const lines = []
+  const accountRows = Array.isArray(accounts) ? accounts : []
+  add(lines, 'dsh_subscriptions_connected_accounts', 'Accounts with a configured credential.', 'gauge', [
+    { value: accountRows.filter((a) => a && a.configured).length },
+  ])
+  const configured = []
+  const usage = []
+  const cooldown = []
+  for (const account of accountRows) {
+    if (!account || !account.provider) continue
+    const labels = 'provider="' + label(account.provider) + '",index="' + label(account.index || 1) + '"'
+    configured.push({ labels, value: account.configured ? 1 : 0 })
+    if (account.usagePercent != null) usage.push({ labels, value: Number(account.usagePercent) })
+    const until = Number(account.cooldownUntil) || 0
+    cooldown.push({ labels, value: until > Date.now() ? Math.round((until - Date.now()) / 1000) : 0 })
+  }
+  add(lines, 'dsh_subscriptions_account_configured', '1 when the slot has a credential.', 'gauge', configured)
+  add(lines, 'dsh_subscriptions_account_usage_percent', 'Last observed quota usage.', 'gauge', usage)
+  add(lines, 'dsh_subscriptions_account_cooldown_seconds', 'Remaining cooldown.', 'gauge', cooldown)
+
+  const selected = []
+  for (const row of (sources && Array.isArray(sources.providers) ? sources.providers : [])) {
+    if (!row || !row.selected) continue
+    selected.push({ labels: 'provider="' + label(row.provider) + '",source="' + label(row.selected) + '"', value: 1 })
+  }
+  add(lines, 'dsh_subscriptions_source_selected', 'Selected source for a provider.', 'gauge', selected)
+
+  const byRequest = new Map()
+  for (const row of (Array.isArray(rows) ? rows : [])) {
+    const provider = row && row.provider ? row.provider : 'unknown'
+    const status = row && row.status != null ? row.status : 'unknown'
+    const key = provider + '|' + status
+    byRequest.set(key, (byRequest.get(key) || 0) + 1)
+  }
+  add(lines, 'dsh_subscriptions_requests_total', 'Recorded requests by provider and status.', 'counter',
+    [...byRequest.entries()].sort().map(([key, value]) => {
+      const [provider, status] = key.split('|')
+      return { labels: 'provider="' + label(provider) + '",status="' + label(status) + '"', value }
+    }))
+
+  const bySeverity = new Map()
+  for (const alert of (Array.isArray(alerts) ? alerts : [])) {
+    const severity = alert && alert.severity ? alert.severity : 'warn'
+    bySeverity.set(severity, (bySeverity.get(severity) || 0) + 1)
+  }
+  add(lines, 'dsh_subscriptions_alerts_total', 'Recent alerts by severity.', 'counter',
+    [...bySeverity.entries()].sort().map(([severity, value]) => ({ labels: 'severity="' + label(severity) + '"', value })))
+
+  return lines.join('\n') + '\n'
+}

package/lib/routes/metrics.js

@@ -0,0 +1,33 @@
+import { getRecentAlerts } from '../alerts.js'
+import { isLoopback, isTrustedSettingsRequest } from '../http.js'
+import { formatMetrics } from '../metrics.js'
+import { collectSourceChain } from './sources.js'
+
+export function registerMetricsRoutes(ctx, state) {
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/metrics',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('method not allowed\n')
+        return
+      }
+      if (!isLoopback(req) && !isTrustedSettingsRequest(req, ctx)) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('forbidden\n')
+        return
+      }
+      const accounts = await state.accountsView().catch(() => [])
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const text = formatMetrics({
+        accounts,
+        rows: typeof state.history?.all === 'function' ? state.history.all() : [],
+        alerts: getRecentAlerts(1000),
+        sources,
+      })
+      res.writeHead(200, { 'content-type': 'text/plain; version=0.0.4; charset=utf-8' })
+      res.end(text)
+    },
+  }), 'dsh-subscriptions: /metrics')
+}

package/lib/routes/sources.js

@@ -1,8 +1,33 @@
 import { isTrustedSettingsRequest, safeJsonHandler, writeJson } from '../http.js'
 import { buildSourceChain, readKeyRotationStatus, subscriptionCandidate } from '../key-rotation-bridge.js'
 
-export function registerSourcesRoutes(ctx, state) {
+export async function collectSourceChain(state, port) {
   const { accountsView, live } = state
+  let subscriptions = []
+  try {
+    const rows = await accountsView()
+    subscriptions = (rows || []).map(subscriptionCandidate)
+  } catch { /* keep the chain available */ }
+  const keyRotation = port
+    ? await readKeyRotationStatus({ baseUrl: 'http://127.0.0.1:' + port })
+    : { available: false, reason: 'no local port', providers: [], totalKeys: 0, healthyKeys: 0 }
+  const chain = buildSourceChain({
+    subscriptions,
+    keyRotation,
+    ollama: { available: live().ollamaFallback !== false },
+  })
+  return {
+    keyRotation: {
+      available: keyRotation.available,
+      reason: keyRotation.reason || null,
+      totalKeys: keyRotation.totalKeys,
+      healthyKeys: keyRotation.healthyKeys,
+    },
+    ...chain,
+  }
+}
+
+export function registerSourcesRoutes(ctx, state) {
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -16,30 +41,8 @@ export function registerSourcesRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      let subscriptions = []
-      try {
-        const rows = await accountsView()
-        subscriptions = (rows || []).map(subscriptionCandidate)
-      } catch { /* keep the chain available */ }
-      const port = req.socket && req.socket.localPort
-      const keyRotation = port
-        ? await readKeyRotationStatus({ baseUrl: 'http://127.0.0.1:' + port })
-        : { available: false, reason: 'no local port', providers: [], totalKeys: 0, healthyKeys: 0 }
-      const chain = buildSourceChain({
-        subscriptions,
-        keyRotation,
-        ollama: { available: live().ollamaFallback !== false },
-      })
-      writeJson(res, 200, {
-        ok: true,
-        keyRotation: {
-          available: keyRotation.available,
-          reason: keyRotation.reason || null,
-          totalKeys: keyRotation.totalKeys,
-          healthyKeys: keyRotation.healthyKeys,
-        },
-        ...chain,
-      })
+      const payload = await collectSourceChain(state, req.socket && req.socket.localPort)
+      writeJson(res, 200, { ok: true, ...payload })
     }),
   }), 'dsh-subscriptions: /sources')
 }

package/lib/routes/status.js

@@ -26,6 +26,9 @@ import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
 import { defaultErrorBuffer } from '../error-buffer.js'
+import { assessHealth } from '../health-report.js'
+import { defaultSnapshotStore } from '../vault-snapshots.js'
+import { collectSourceChain } from './sources.js'
 
 export function registerStatusRoutes(ctx, state) {
   const {
@@ -82,7 +85,16 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
-      writeJson(res, 200, { ok: true, status: 'healthy', version: pkgVersion || 'unknown' })
+      const accounts = await accountsView().catch(() => [])
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const health = assessHealth({
+        accounts,
+        sources,
+        snapshots: defaultSnapshotStore.stats(),
+        webhookUrl: live().webhookUrl,
+        ollama: live().ollamaFallback !== false,
+      })
+      writeJson(res, 200, { ok: true, status: health.status, version: pkgVersion || 'unknown', checks: health.checks })
     }),
   }), 'dsh-subscriptions: /health')
 
@@ -310,6 +322,8 @@ export function registerStatusRoutes(ctx, state) {
         report: await diagnosticsReport(),
         conflicts: getActiveConflicts(),
         route: buildRouteReport(last, accounts),
+        sources: await collectSourceChain(state, req.socket && req.socket.localPort),
+        vaultSnapshots: defaultSnapshotStore.stats(),
       })
     }),
   }), 'dsh-subscriptions: /diagnostics')

package/lib/routes/vault.js

@@ -15,7 +15,7 @@ export function registerVaultRoutes(ctx, state) {
         return
       }
       if (req.method === 'GET') {
-        writeJson(res, 200, { ok: true, snapshots: defaultSnapshotStore.list() })
+        writeJson(res, 200, { ok: true, snapshots: defaultSnapshotStore.list(), stats: defaultSnapshotStore.stats() })
         return
       }
       if (req.method !== 'POST') {

package/lib/routes.js

@@ -9,6 +9,7 @@ import { registerSourcesRoutes } from './routes/sources.js'
 import { registerPacksRoutes } from './routes/packs.js'
 import { registerWebhookRoutes } from './routes/webhook.js'
 import { registerVaultRoutes } from './routes/vault.js'
+import { registerMetricsRoutes } from './routes/metrics.js'
 import { registerPluginUpdater } from './updater.js'
 
 export function registerRoutes(ctx, state) {
@@ -117,4 +118,5 @@ function esc(x){return String(x==null?'':x).replace(/&/g,'&amp;').replace(/</g,'
   registerPacksRoutes(ctx)
   registerWebhookRoutes(ctx, state)
   registerVaultRoutes(ctx, state)
+  registerMetricsRoutes(ctx, state)
 }

package/lib/vault-snapshots.js

@@ -1,7 +1,25 @@
-// #734: bounded in-memory snapshot ring. Only metadata leaves list(); the
-// encrypted payload is available through get(id) for an explicit restore.
+// #739: durable, bounded snapshot ring. Encrypted payloads are written with
+// 0600 permissions through a temp file + rename; list() only returns metadata.
+import { chmodSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { homedir } from 'node:os'
+
+const FILE_NAME = 'vault-snapshots.json'
+export const DEFAULT_MAX_BYTES = 2 * 1024 * 1024
+
+function bytesOf(items) {
+  return Buffer.byteLength(JSON.stringify(items))
+}
 let seq = 0
 
+export function resolveSnapshotDir(customDir) {
+  if (customDir) return customDir
+  if (process.env.DSH_SNAPSHOT_DIR) return process.env.DSH_SNAPSHOT_DIR
+  if (process.env.DSH_STORAGE_DIR) return process.env.DSH_STORAGE_DIR
+  if (process.env.DSH_HOME) return join(process.env.DSH_HOME, 'storages', 'dsh-subscriptions')
+  return join(homedir(), '.dsh', 'storages', 'dsh-subscriptions')
+}
+
 function meta(snapshot) {
   return {
     id: snapshot.id,
@@ -13,9 +31,36 @@ function meta(snapshot) {
   }
 }
 
-export function createSnapshotStore({ max = 10, now = () => Date.now() } = {}) {
-  let items = []
+function load(file) {
+  try {
+    const rows = JSON.parse(readFileSync(file, 'utf8'))
+    if (!Array.isArray(rows)) return []
+    return rows.filter((row) => row && typeof row === 'object' && typeof row.vault === 'string' && row.id)
+  } catch {
+    return []
+  }
+}
+
+function persist(dir, file, items) {
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    const tmp = file + '.tmp-' + process.pid + '-' + Date.now()
+    writeFileSync(tmp, JSON.stringify(items), { mode: 0o600 })
+    renameSync(tmp, file)
+    try { chmodSync(file, 0o600) } catch { /* best-effort */ }
+    return true
+  } catch {
+    return false
+  }
+}
+
+export function createSnapshotStore({ max = 10, maxBytes = DEFAULT_MAX_BYTES, now = () => Date.now(), dir, persistToDisk = true } = {}) {
+  const snapshotDir = resolveSnapshotDir(dir)
+  const file = join(snapshotDir, FILE_NAME)
+  let items = persistToDisk ? load(file) : []
+  const save = () => { if (persistToDisk) persist(snapshotDir, file, items) }
   return {
+    path: file,
     add(snapshot, label = '') {
       const at = now()
       const entry = {
@@ -26,6 +71,8 @@ export function createSnapshotStore({ max = 10, now = () => Date.now() } = {}) {
       }
       items.unshift(entry)
       if (items.length > Math.max(1, max)) items = items.slice(0, Math.max(1, max))
+      while (items.length > 1 && bytesOf(items) > Math.max(1, maxBytes)) items.pop()
+      save()
       return meta(entry)
     },
     list() {
@@ -36,6 +83,12 @@ export function createSnapshotStore({ max = 10, now = () => Date.now() } = {}) {
     },
     clear() {
       items = []
+      save()
+    },
+    stats() {
+      let bytes = bytesOf(items)
+      try { bytes = Math.max(bytes, statSync(file).size) } catch { /* file may not exist yet */ }
+      return { count: items.length, bytes, path: file, maxBytes }
     },
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",