@goodandready/dsh-subscriptions 0.7.9 → 0.7.11

package/bin/dsh-subscriptions.mjs

@@ -6,11 +6,12 @@ import { readFile } from 'node:fs/promises'
 export function parseArgs(argv) {
   const args = Array.isArray(argv) ? argv.slice() : []
   const command = args.shift() || 'status'
-  const options = { command, csv: false, json: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
+  const options = { command, csv: false, json: false, once: false, type: 'accounts', sessionId: '', mode: 'fast', help: false, setKey: '', setValue: '', packAction: '', packFile: '', vaultAction: '', vaultArg: '' }
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i]
     if (arg === '--csv') options.csv = true
     else if (arg === '--json') options.json = true
+    else if (arg === '--once') options.once = true
     else if (arg === '--help' || arg === '-h') options.help = true
     else if (arg === '--type') options.type = args[++i] || 'accounts'
     else if (arg === '--session') options.sessionId = args[++i] || ''
@@ -105,6 +106,8 @@ export function formatDoctor(payload) {
   lines.push('doctor: ' + (doctorFailed(payload) ? 'degraded' : 'ok'))
   lines.push('errors: ' + errors + ' conflicts: ' + conflicts)
   lines.push('key-rotation: ' + (kr.available ? (kr.healthyKeys + '/' + kr.totalKeys + ' healthy keys') : ('unavailable' + (kr.reason ? ' (' + kr.reason + ')' : ''))))
+  const snapshots = diag.vaultSnapshots || {}
+  lines.push('snapshots: ' + (snapshots.count || 0) + ' (' + (snapshots.bytes || 0) + ' bytes)')
   for (const row of (sources.providers || [])) lines.push(row.provider + ': ' + (row.selected || 'none'))
   return lines.join('\n')
 }
@@ -123,6 +126,36 @@ export function formatPacks(packs) {
   return JSON.stringify((Array.isArray(packs) ? packs : []).map(sanitizePack), null, 2) + '\\n'
 }
 
+export function renderTui(data, { color = false } = {}) {
+  const health = (data && data.health) || {}
+  const checks = health.checks || {}
+  const sources = (data && data.sources) || {}
+  const snapshots = (data && data.snapshots && data.snapshots.stats) || {}
+  const accounts = Array.isArray(data && data.accounts) ? data.accounts : []
+  const dim = (text) => color ? '\x1b[2m' + text + '\x1b[0m' : text
+  const green = (text) => color ? '\x1b[32m' + text + '\x1b[0m' : text
+  const red = (text) => color ? '\x1b[31m' + text + '\x1b[0m' : text
+  const lines = []
+  lines.push('DSH Subscriptions' + (health.version ? ' ' + health.version : '') + '  ' + (health.status === 'healthy' ? green('healthy') : red(health.status || 'unknown')))
+  lines.push(dim('accounts: ' + (checks.connectedAccounts || 0) + ' configured · key-rotation: ' + (checks.keyRotation ? 'yes' : 'no') + ' · ollama: ' + (checks.ollama ? 'yes' : 'no') + ' · webhook: ' + (checks.webhook ? 'yes' : 'no')))
+  lines.push('')
+  lines.push('ACCOUNTS')
+  for (const account of accounts) {
+    if (!account || !account.provider) continue
+    const usage = account.usagePercent == null ? '-' : Math.round(account.usagePercent) + '%'
+    lines.push('  ' + String(account.provider).padEnd(14) + '#' + (account.index || 1) + '  ' + (account.configured ? green('ok') : dim('off')) + '  ' + usage)
+  }
+  lines.push('')
+  lines.push('SOURCES')
+  for (const row of (sources.providers || [])) lines.push('  ' + String(row.provider).padEnd(14) + (row.selected || dim('none')))
+  lines.push('')
+  lines.push('VAULT')
+  lines.push('  snapshots: ' + (snapshots.count || 0) + ' · ' + (snapshots.bytes || 0) + ' bytes')
+  lines.push('')
+  lines.push(dim('r refresh · q quit'))
+  return lines.join('\n')
+}
+
 export function formatSnapshotStatus(payload) {
   const stats = (payload && payload.stats) || {}
   return 'snapshots: ' + (stats.count || 0) + '  bytes: ' + (stats.bytes || 0) + '  path: ' + (stats.path || '-')
@@ -174,6 +207,21 @@ export function buildSetRequest(options, configPayload, env = process.env) {
 export async function run(argv = process.argv.slice(2), env = process.env, fetchImpl = fetch) {
   const options = parseArgs(argv)
   if (options.help) return { help: true }
+  if (options.command === 'tui') {
+    const base = String(env.DSH_SUBS_URL || 'http://127.0.0.1:3080/dsh-subscriptions').replace(/\/$/, '')
+    const headers = { Accept: 'application/json' }
+    if (env.DSH_AUTH_TOKEN) headers.Authorization = 'Bearer ' + env.DSH_AUTH_TOKEN
+    const get = (path) => fetchImpl(base + path, { method: 'GET', headers }).then(async (res) => {
+      const text = await res.text()
+      if (!res.ok) throw new Error('HTTP ' + res.status + ': ' + text.slice(0, 300))
+      return JSON.parse(text || '{}')
+    })
+    const [health, sources, snapshots, config] = await Promise.all([
+      get('/health'), get('/sources'), get('/vault/snapshots'), get('/config'),
+    ])
+    const data = { health, sources, snapshots, accounts: (config && config.accounts) || [] }
+    return { text: renderTui(data, { color: false }), tuiData: data, contentType: 'text/plain' }
+  }
   if (options.command === 'doctor') {
     const diagReq = buildRequest({ command: 'diagnostics' }, env)
     const srcReq = buildRequest({ command: 'sources' }, env)
@@ -240,12 +288,41 @@ export async function run(argv = process.argv.slice(2), env = process.env, fetch
   return { text, contentType: res.headers.get('content-type') || '' }
 }
 
+async function runTui(initial) {
+  let cleanup = () => {}
+  const paint = (data) => process.stdout.write('\x1b[2J\x1b[H' + renderTui(data, { color: true }) + '\n')
+  paint(initial)
+  const onKey = async (buf) => {
+    const key = String(buf)
+    if (key === 'q' || key === '\u0003') { cleanup(); process.exit(0) }
+    if (key === 'r') {
+      try {
+        const next = await run(['tui', '--once'])
+        if (next.tuiData) paint(next.tuiData)
+      } catch (err) { process.stdout.write('\n' + String(err && err.message || err) + '\n') }
+    }
+  }
+  if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {
+    process.stdin.setRawMode(true)
+    process.stdin.resume()
+    process.stdin.on('data', onKey)
+    cleanup = () => {
+      process.stdin.removeListener('data', onKey)
+      process.stdin.setRawMode(false)
+      process.stdin.pause()
+    }
+  }
+}
+
 async function main() {
-  const result = await run()
+  const argv = process.argv.slice(2)
+  const options = parseArgs(argv)
+  const result = await run(argv)
   if (result.help) {
-    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  doctor [--json]\n')
+    process.stdout.write('Usage: dsh-subscriptions <status|usage|fast|config|set|sources|packs|vault|tui|doctor> [options]\n  usage --csv --type accounts|calls\n  fast <session> [fast|standard]\n  config\n  set <dot.path> <value>\n  sources [--json]\n  packs\n  packs add <file.json>\n  vault snapshots | vault snapshot [label] | vault restore <id> | vault status\n  tui [--once]\n  doctor [--json]\n')
     return
   }
+  if (result.tuiData && !options.once) { await runTui(result.tuiData); return }
   process.stdout.write(result.text.endsWith('\n') ? result.text : result.text + '\n')
   if (result.code) process.exitCode = result.code
 }

package/lib/alerts.js

@@ -16,6 +16,7 @@ try {
 const MAX_ALERTS = 100
 let defaultWebhookSecret = ''
 let defaultAllowPrivate = false
+let defaultWebhookFormat = 'native'
 
 export function setWebhookSecret(secret) {
   defaultWebhookSecret = String(secret || '')
@@ -24,6 +25,35 @@ export function setWebhookSecret(secret) {
 export function setWebhookAllowPrivate(allow) {
   defaultAllowPrivate = Boolean(allow)
 }
+
+export function setWebhookFormat(format) {
+  defaultWebhookFormat = format === 'notify' ? 'notify' : 'native'
+}
+
+export function toNotifyPayload(body) {
+  const sentAt = new Date().toISOString()
+  if (body && body.alert) {
+    return {
+      kind: body.alert.severity === 'info' ? 'task_done' : 'error',
+      title: 'DSH Subscriptions',
+      sessionId: 'dsh-subscriptions',
+      summary: body.alert.message || body.alert.type || 'subscription alert',
+      reason: body.alert.type || null,
+      source: 'dsh-subscriptions',
+      sentAt,
+    }
+  }
+  const digest = (body && body.digest) || { total: 0 }
+  return {
+    kind: digest.total > 0 ? 'error' : 'task_done',
+    title: 'DSH Subscriptions digest',
+    sessionId: 'dsh-subscriptions',
+    summary: String(digest.total || 0) + ' alerts in the digest',
+    reason: 'digest',
+    source: 'dsh-subscriptions',
+    sentAt,
+  }
+}
 const DEDUP_WINDOW_MS = 10 * 60 * 1000 // 10 minutes cooldown per (ref + type)
 
 const alertBuffer = []
@@ -106,10 +136,13 @@ async function dispatchNotification(body, webhookUrl, fetchImpl, options) {
   const { retries = 1, timeoutMs = 5000, sleep } = opts
   const secret = opts.secret == null ? defaultWebhookSecret : opts.secret
   const allowPrivate = opts.allowPrivate == null ? defaultAllowPrivate : Boolean(opts.allowPrivate)
+  const format = opts.format == null ? defaultWebhookFormat : opts.format
   const checked = validateWebhookUrl(webhookUrl, { allowPrivate })
   if (!checked.ok) return false
   webhookUrl = checked.url
-  const payload = { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
+  const payload = format === 'notify'
+    ? toNotifyPayload(body)
+    : { ...body, source: 'dsh-subscriptions', sentAt: new Date().toISOString() }
   const raw = JSON.stringify(payload)
   const headers = {
     'content-type': 'application/json',

package/lib/client.js

@@ -1885,6 +1885,17 @@ window.__ModuleLoader__.load({
             }),
           ),
           h('div', { className: 'dsub-sub' }, 'Signed POST target for quota, session and billing alerts.'),
+          h('div', { className: 'dsub-row' },
+            h('span', { className: 'dsub-h' }, 'Webhook format'),
+            h('select', {
+              className: 'dsub-select',
+              value: draft.webhookFormat || 'native',
+              onChange: (e) => setDraft((d) => Object.assign({}, d, { webhookFormat: e.target.value })),
+            },
+              h('option', { value: 'native' }, 'Native'),
+              h('option', { value: 'notify' }, 'dsh-plugin-notify compatible'),
+            ),
+          ),
           h('div', { className: 'dsub-row' },
             h('span', { className: 'dsub-h' }, 'Webhook secret'),
             h('input', {

package/lib/config-schema.js

@@ -161,6 +161,8 @@ export const Config = z.object({
     .description('#720 HMAC-SHA256 secret used to sign webhook payloads.'),
   webhookAllowPrivate: z.boolean().volatile().default(false)
     .description('#729 Allow webhook URLs that resolve to private or loopback hosts.'),
+  webhookFormat: z.string().volatile().default('native')
+    .description('#751 Webhook payload format: native or notify (dsh-plugin-notify compatible).'),
   digestIntervalHours: z.number().volatile().default(0)
     .description('#720 Send an alert digest every N hours (0 disables digests).'),
   alertThresholds: z.array(z.number()).volatile().default([80, 90, 95])
@@ -189,6 +191,12 @@ export const Config = z.object({
     .description('#562 Remote storage backend: webdav, gist, or s3.'),
   vaultSyncPassphrase: z.string().role('secret').default('')
     .description('#562 Passphrase used to encrypt/decrypt the remote vault archive.'),
+  vaultDeviceId: z.string().volatile().default('')
+    .description('#749 Stable per-device vault id. Empty derives one from the host.'),
+  vaultDeviceLabel: z.string().volatile().default('')
+    .description('#749 Human-readable device label for vault metadata.'),
+  vaultPerDeviceKeys: z.boolean().volatile().default(true)
+    .description('#749 Derive a per-device passphrase and remote object; legacy shared vault stays readable.'),
   vaultSyncProviders: z.array(z.string()).volatile().default([])
     .description('#691 Optional provider allowlist for selective vault sync. Empty means all providers.'),
   vaultSyncIntervalHours: z.number().volatile().default(24)

package/lib/device-identity.js

@@ -0,0 +1,41 @@
+// #749: stable per-device identity. The passphrase is derived per device so
+// one device cannot decrypt another device's remote object with only the base
+// passphrase; the legacy shared object remains readable as a fallback.
+import { createHash } from 'node:crypto'
+import { hostname, platform, arch } from 'node:os'
+
+export function resolveDeviceIdentity({ id = '', label = '' } = {}) {
+  const host = hostname()
+  const derived = createHash('sha256').update(host + '|' + platform() + '|' + arch()).digest('hex').slice(0, 12)
+  const clean = String(id || derived).replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 32)
+  return { id: clean || derived, label: String(label || host) }
+}
+
+export function devicePassphrase(passphrase, deviceId) {
+  return deviceId ? String(passphrase) + '#' + String(deviceId) : String(passphrase)
+}
+
+export function withDeviceSuffix(name, deviceId) {
+  if (!deviceId) return name
+  const match = String(name).match(/^(.*?)(.[^./]+)?$/)
+  return (match && match[1] ? match[1] : String(name)) + '.' + deviceId + (match && match[2] ? match[2] : '')
+}
+
+export function deviceWebdavUrl(url, deviceId) {
+  if (!url || !deviceId) return url
+  try {
+    const parsed = new URL(url)
+    parsed.pathname = withDeviceSuffix(parsed.pathname, deviceId)
+    return parsed.toString()
+  } catch {
+    return url
+  }
+}
+
+export function deviceGistName(deviceId) {
+  return withDeviceSuffix('dsh-subscriptions-vault.enc', deviceId)
+}
+
+export function deviceS3Key(key, deviceId) {
+  return withDeviceSuffix(key || 'dsh-subscriptions-vault.enc', deviceId)
+}

package/lib/health-report.js

@@ -0,0 +1,21 @@
+// #745: health is about having a usable source, not about uptime alone.
+export function assessHealth({ accounts = [], sources = null, snapshots = null, webhookUrl = '', ollama = false } = {}) {
+  const list = Array.isArray(accounts) ? accounts : []
+  const connectedAccounts = list.filter((a) => a && a.configured).length
+  const sourceRows = sources && Array.isArray(sources.providers) ? sources.providers : []
+  const selectedSources = sourceRows.filter((row) => row && row.selected).length
+  const keyRotation = Boolean(sources && sources.keyRotation && sources.keyRotation.available)
+  const ok = connectedAccounts > 0 || keyRotation || Boolean(ollama)
+  return {
+    ok,
+    status: ok ? 'healthy' : 'degraded',
+    checks: {
+      connectedAccounts,
+      keyRotation,
+      ollama: Boolean(ollama),
+      webhook: Boolean(webhookUrl),
+      snapshots: snapshots ? Number(snapshots.count) || 0 : 0,
+      selectedSources,
+    },
+  }
+}

package/lib/index.js

@@ -28,7 +28,7 @@ import { createAccountsView } from './accounts-view.js'
 import { inspectScopes } from './scope-inspector.js'
 import { createAdapterManager } from './adapter-manager.js'
 import { pickAccount, isAuthError } from './rotate.js'
-import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate } from './alerts.js'
+import { notifySessionExpired, getRecentAlerts, dispatchNotificationDigest, setWebhookSecret, setWebhookAllowPrivate, setWebhookFormat } from './alerts.js'
 import { isDigestDue } from './notification-scheduler.js'
 
 export { observeForecast, estimateForecast } from './forecast.js'
@@ -95,6 +95,7 @@ export function apply(ctx, rawConfig) {
   const live = () => {
     setWebhookSecret(cachedConfig.webhookSecret)
     setWebhookAllowPrivate(cachedConfig.webhookAllowPrivate)
+    setWebhookFormat(cachedConfig.webhookFormat)
     return cachedConfig
   }
 
@@ -616,7 +617,7 @@ export function apply(ctx, rawConfig) {
       const cfg = live()
       const alerts = getRecentAlerts(100)
       if (!isDigestDue({ lastDigestAt, nowMs: Date.now(), intervalHours: cfg.digestIntervalHours, alertCount: alerts.length })) return
-      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate })
+      dispatchNotificationDigest(alerts, cfg.webhookUrl, fetch, { secret: cfg.webhookSecret, allowPrivate: cfg.webhookAllowPrivate, format: cfg.webhookFormat })
         .then((ok) => { if (ok) lastDigestAt = Date.now() })
         .catch(() => {})
     }

package/lib/metrics.js

@@ -0,0 +1,62 @@
+// #744: Prometheus text exposition. No secrets, labels escaped, deterministic order.
+function label(value) {
+  return String(value == null ? '' : value).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')
+}
+
+function add(lines, name, help, type, samples) {
+  lines.push('# HELP ' + name + ' ' + help)
+  lines.push('# TYPE ' + name + ' ' + type)
+  for (const sample of samples) lines.push(name + (sample.labels ? '{' + sample.labels + '}' : '') + ' ' + sample.value)
+}
+
+export function formatMetrics({ accounts = [], rows = [], alerts = [], sources = null } = {}) {
+  const lines = []
+  const accountRows = Array.isArray(accounts) ? accounts : []
+  add(lines, 'dsh_subscriptions_connected_accounts', 'Accounts with a configured credential.', 'gauge', [
+    { value: accountRows.filter((a) => a && a.configured).length },
+  ])
+  const configured = []
+  const usage = []
+  const cooldown = []
+  for (const account of accountRows) {
+    if (!account || !account.provider) continue
+    const labels = 'provider="' + label(account.provider) + '",index="' + label(account.index || 1) + '"'
+    configured.push({ labels, value: account.configured ? 1 : 0 })
+    if (account.usagePercent != null) usage.push({ labels, value: Number(account.usagePercent) })
+    const until = Number(account.cooldownUntil) || 0
+    cooldown.push({ labels, value: until > Date.now() ? Math.round((until - Date.now()) / 1000) : 0 })
+  }
+  add(lines, 'dsh_subscriptions_account_configured', '1 when the slot has a credential.', 'gauge', configured)
+  add(lines, 'dsh_subscriptions_account_usage_percent', 'Last observed quota usage.', 'gauge', usage)
+  add(lines, 'dsh_subscriptions_account_cooldown_seconds', 'Remaining cooldown.', 'gauge', cooldown)
+
+  const selected = []
+  for (const row of (sources && Array.isArray(sources.providers) ? sources.providers : [])) {
+    if (!row || !row.selected) continue
+    selected.push({ labels: 'provider="' + label(row.provider) + '",source="' + label(row.selected) + '"', value: 1 })
+  }
+  add(lines, 'dsh_subscriptions_source_selected', 'Selected source for a provider.', 'gauge', selected)
+
+  const byRequest = new Map()
+  for (const row of (Array.isArray(rows) ? rows : [])) {
+    const provider = row && row.provider ? row.provider : 'unknown'
+    const status = row && row.status != null ? row.status : 'unknown'
+    const key = provider + '|' + status
+    byRequest.set(key, (byRequest.get(key) || 0) + 1)
+  }
+  add(lines, 'dsh_subscriptions_requests_total', 'Recorded requests by provider and status.', 'counter',
+    [...byRequest.entries()].sort().map(([key, value]) => {
+      const [provider, status] = key.split('|')
+      return { labels: 'provider="' + label(provider) + '",status="' + label(status) + '"', value }
+    }))
+
+  const bySeverity = new Map()
+  for (const alert of (Array.isArray(alerts) ? alerts : [])) {
+    const severity = alert && alert.severity ? alert.severity : 'warn'
+    bySeverity.set(severity, (bySeverity.get(severity) || 0) + 1)
+  }
+  add(lines, 'dsh_subscriptions_alerts_total', 'Recent alerts by severity.', 'counter',
+    [...bySeverity.entries()].sort().map(([severity, value]) => ({ labels: 'severity="' + label(severity) + '"', value })))
+
+  return lines.join('\n') + '\n'
+}

package/lib/routes/metrics.js

@@ -0,0 +1,33 @@
+import { getRecentAlerts } from '../alerts.js'
+import { isLoopback, isTrustedSettingsRequest } from '../http.js'
+import { formatMetrics } from '../metrics.js'
+import { collectSourceChain } from './sources.js'
+
+export function registerMetricsRoutes(ctx, state) {
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-subscriptions/metrics',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('method not allowed\n')
+        return
+      }
+      if (!isLoopback(req) && !isTrustedSettingsRequest(req, ctx)) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('forbidden\n')
+        return
+      }
+      const accounts = await state.accountsView().catch(() => [])
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const text = formatMetrics({
+        accounts,
+        rows: typeof state.history?.all === 'function' ? state.history.all() : [],
+        alerts: getRecentAlerts(1000),
+        sources,
+      })
+      res.writeHead(200, { 'content-type': 'text/plain; version=0.0.4; charset=utf-8' })
+      res.end(text)
+    },
+  }), 'dsh-subscriptions: /metrics')
+}

package/lib/routes/sources.js

@@ -1,8 +1,33 @@
 import { isTrustedSettingsRequest, safeJsonHandler, writeJson } from '../http.js'
 import { buildSourceChain, readKeyRotationStatus, subscriptionCandidate } from '../key-rotation-bridge.js'
 
-export function registerSourcesRoutes(ctx, state) {
+export async function collectSourceChain(state, port) {
   const { accountsView, live } = state
+  let subscriptions = []
+  try {
+    const rows = await accountsView()
+    subscriptions = (rows || []).map(subscriptionCandidate)
+  } catch { /* keep the chain available */ }
+  const keyRotation = port
+    ? await readKeyRotationStatus({ baseUrl: 'http://127.0.0.1:' + port })
+    : { available: false, reason: 'no local port', providers: [], totalKeys: 0, healthyKeys: 0 }
+  const chain = buildSourceChain({
+    subscriptions,
+    keyRotation,
+    ollama: { available: live().ollamaFallback !== false },
+  })
+  return {
+    keyRotation: {
+      available: keyRotation.available,
+      reason: keyRotation.reason || null,
+      totalKeys: keyRotation.totalKeys,
+      healthyKeys: keyRotation.healthyKeys,
+    },
+    ...chain,
+  }
+}
+
+export function registerSourcesRoutes(ctx, state) {
 
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -16,30 +41,8 @@ export function registerSourcesRoutes(ctx, state) {
         writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } })
         return
       }
-      let subscriptions = []
-      try {
-        const rows = await accountsView()
-        subscriptions = (rows || []).map(subscriptionCandidate)
-      } catch { /* keep the chain available */ }
-      const port = req.socket && req.socket.localPort
-      const keyRotation = port
-        ? await readKeyRotationStatus({ baseUrl: 'http://127.0.0.1:' + port })
-        : { available: false, reason: 'no local port', providers: [], totalKeys: 0, healthyKeys: 0 }
-      const chain = buildSourceChain({
-        subscriptions,
-        keyRotation,
-        ollama: { available: live().ollamaFallback !== false },
-      })
-      writeJson(res, 200, {
-        ok: true,
-        keyRotation: {
-          available: keyRotation.available,
-          reason: keyRotation.reason || null,
-          totalKeys: keyRotation.totalKeys,
-          healthyKeys: keyRotation.healthyKeys,
-        },
-        ...chain,
-      })
+      const payload = await collectSourceChain(state, req.socket && req.socket.localPort)
+      writeJson(res, 200, { ok: true, ...payload })
     }),
   }), 'dsh-subscriptions: /sources')
 }

package/lib/routes/status.js

@@ -26,6 +26,9 @@ import { quotaSnapshot } from '../ratelimit.js'
 import { PROVIDERS, displayName, droppedCredentialRefs, isProvider, oauthRef } from '../refs.js'
 import { getVendor } from '../vendors/index.js'
 import { defaultErrorBuffer } from '../error-buffer.js'
+import { assessHealth } from '../health-report.js'
+import { defaultSnapshotStore } from '../vault-snapshots.js'
+import { collectSourceChain } from './sources.js'
 
 export function registerStatusRoutes(ctx, state) {
   const {
@@ -82,7 +85,16 @@ export function registerStatusRoutes(ctx, state) {
         writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } })
         return
       }
-      writeJson(res, 200, { ok: true, status: 'healthy', version: pkgVersion || 'unknown' })
+      const accounts = await accountsView().catch(() => [])
+      const sources = await collectSourceChain(state, req.socket && req.socket.localPort)
+      const health = assessHealth({
+        accounts,
+        sources,
+        snapshots: defaultSnapshotStore.stats(),
+        webhookUrl: live().webhookUrl,
+        ollama: live().ollamaFallback !== false,
+      })
+      writeJson(res, 200, { ok: true, status: health.status, version: pkgVersion || 'unknown', checks: health.checks })
     }),
   }), 'dsh-subscriptions: /health')
 
@@ -310,6 +322,8 @@ export function registerStatusRoutes(ctx, state) {
         report: await diagnosticsReport(),
         conflicts: getActiveConflicts(),
         route: buildRouteReport(last, accounts),
+        sources: await collectSourceChain(state, req.socket && req.socket.localPort),
+        vaultSnapshots: defaultSnapshotStore.stats(),
       })
     }),
   }), 'dsh-subscriptions: /diagnostics')

package/lib/routes.js

@@ -9,6 +9,7 @@ import { registerSourcesRoutes } from './routes/sources.js'
 import { registerPacksRoutes } from './routes/packs.js'
 import { registerWebhookRoutes } from './routes/webhook.js'
 import { registerVaultRoutes } from './routes/vault.js'
+import { registerMetricsRoutes } from './routes/metrics.js'
 import { registerPluginUpdater } from './updater.js'
 
 export function registerRoutes(ctx, state) {
@@ -117,4 +118,5 @@ function esc(x){return String(x==null?'':x).replace(/&/g,'&amp;').replace(/</g,'
   registerPacksRoutes(ctx)
   registerWebhookRoutes(ctx, state)
   registerVaultRoutes(ctx, state)
+  registerMetricsRoutes(ctx, state)
 }

package/lib/vault-sync.js

@@ -7,6 +7,7 @@ import { normalizeSlots } from './accounts.js'
 import { Config, plainConfig, revisionOf } from './config-schema.js'
 import { validateCredentialBlob } from './blob.js'
 import { defaultSnapshotStore } from './vault-snapshots.js'
+import { resolveDeviceIdentity, devicePassphrase, deviceWebdavUrl, deviceGistName, deviceS3Key } from './device-identity.js'
 
 let syncStatus = {
   enabled: false,
@@ -75,7 +76,7 @@ export async function pullFromWebdav({ url, username, password, fetchFn = fetch
 
 // --- Driver: Gist (GitHub / Gitea) ---
 
-export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fetchFn = fetch }) {
+export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, token, encryptedData, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!token) throw new Error('Gist access token is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -86,7 +87,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   }
 
   const files = {
-    'dsh-subscriptions-vault.enc': { content: encryptedData },
+    [fileName]: { content: encryptedData },
   }
 
   if (gistId) {
@@ -118,7 +119,7 @@ export async function pushToGist({ baseUrl = 'https://api.github.com', gistId, t
   return { ok: true, gistId: json.id }
 }
 
-export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fetchFn = fetch }) {
+export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId, token, fileName = 'dsh-subscriptions-vault.enc', fetchFn = fetch }) {
   if (!gistId) throw new Error('Gist ID is required')
   const cleanBase = baseUrl.replace(/\/+$/, '')
   const headers = {
@@ -133,9 +134,9 @@ export async function pullFromGist({ baseUrl = 'https://api.github.com', gistId,
   })
   if (!res.ok) throw new Error(`Gist pull failed: HTTP ${res.status} ${res.statusText}`)
   const json = await res.json()
-  const file = json.files && json.files['dsh-subscriptions-vault.enc']
+  const file = json.files && json.files[fileName]
   if (!file || !file.content) {
-    throw new Error('dsh-subscriptions-vault.enc not found in Gist')
+    throw new Error(fileName + ' not found in Gist')
   }
   return file.content
 }
@@ -308,12 +309,15 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       } catch { /* ignore */ }
     }
 
-    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, passphrase)
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    const activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    const { vault, slotCount, blobCount } = exportVault({ slots, blobs }, activePass)
     const backend = cfg.vaultSyncBackend || 'webdav'
 
     if (backend === 'webdav') {
       await pushToWebdav({
-        url: cfg.vaultSyncWebdavUrl,
+        url: perDevice ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
         username: cfg.vaultSyncWebdavUsername,
         password: cfg.vaultSyncWebdavPassword,
         encryptedData: vault,
@@ -325,6 +329,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
         gistId: cfg.vaultSyncGistId,
         token: cfg.vaultSyncGistToken,
         encryptedData: vault,
+        fileName: perDevice ? deviceGistName(device.id) : undefined,
         fetchFn,
       })
       if (res.gistId && !cfg.vaultSyncGistId) {
@@ -334,7 +339,7 @@ export async function syncVaultPush({ live, store, fetchFn = fetch }) {
       await pushToS3({
         endpoint: cfg.vaultSyncS3Endpoint,
         bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
+        key: perDevice ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
         region: cfg.vaultSyncS3Region || 'us-east-1',
         accessKey: cfg.vaultSyncS3AccessKey,
         secretKey: cfg.vaultSyncS3SecretKey,
@@ -376,38 +381,53 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
 
   try {
     const backend = cfg.vaultSyncBackend || 'webdav'
-    let encryptedData = ''
-
-    if (backend === 'webdav') {
-      encryptedData = await pullFromWebdav({
-        url: cfg.vaultSyncWebdavUrl,
-        username: cfg.vaultSyncWebdavUsername,
-        password: cfg.vaultSyncWebdavPassword,
-        fetchFn,
-      })
-    } else if (backend === 'gist') {
-      encryptedData = await pullFromGist({
-        baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
-        gistId: cfg.vaultSyncGistId,
-        token: cfg.vaultSyncGistToken,
-        fetchFn,
-      })
-    } else if (backend === 's3') {
-      encryptedData = await pullFromS3({
-        endpoint: cfg.vaultSyncS3Endpoint,
-        bucket: cfg.vaultSyncS3Bucket,
-        key: cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc',
-        region: cfg.vaultSyncS3Region || 'us-east-1',
-        accessKey: cfg.vaultSyncS3AccessKey,
-        secretKey: cfg.vaultSyncS3SecretKey,
-        fetchFn,
-      })
-    } else {
+    const device = resolveDeviceIdentity({ id: cfg.vaultDeviceId, label: cfg.vaultDeviceLabel })
+    const perDevice = cfg.vaultPerDeviceKeys !== false
+    let activePass = perDevice ? devicePassphrase(passphrase, device.id) : passphrase
+    let usedLegacy = false
+    const load = async (deviceMode) => {
+      if (backend === 'webdav') {
+        return pullFromWebdav({
+          url: deviceMode ? deviceWebdavUrl(cfg.vaultSyncWebdavUrl, device.id) : cfg.vaultSyncWebdavUrl,
+          username: cfg.vaultSyncWebdavUsername,
+          password: cfg.vaultSyncWebdavPassword,
+          fetchFn,
+        })
+      }
+      if (backend === 'gist') {
+        return pullFromGist({
+          baseUrl: cfg.vaultSyncGistBaseUrl || 'https://api.github.com',
+          gistId: cfg.vaultSyncGistId,
+          token: cfg.vaultSyncGistToken,
+          fileName: deviceMode ? deviceGistName(device.id) : undefined,
+          fetchFn,
+        })
+      }
+      if (backend === 's3') {
+        return pullFromS3({
+          endpoint: cfg.vaultSyncS3Endpoint,
+          bucket: cfg.vaultSyncS3Bucket,
+          key: deviceMode ? deviceS3Key(cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc', device.id) : (cfg.vaultSyncS3Key || 'dsh-subscriptions-vault.enc'),
+          region: cfg.vaultSyncS3Region || 'us-east-1',
+          accessKey: cfg.vaultSyncS3AccessKey,
+          secretKey: cfg.vaultSyncS3SecretKey,
+          fetchFn,
+        })
+      }
       throw new Error(`unsupported vault sync backend: ${backend}`)
     }
+    let encryptedData
+    try {
+      encryptedData = await load(perDevice)
+    } catch (err) {
+      if (!perDevice) throw err
+      encryptedData = await load(false)
+      activePass = passphrase
+      usedLegacy = true
+    }
 
-    try { capturePrePullSnapshot(cfg.slots || [], passphrase) } catch { /* snapshot is best-effort */ }
-    const result = importVault(encryptedData, passphrase)
+    try { capturePrePullSnapshot(cfg.slots || [], activePass) } catch { /* snapshot is best-effort */ }
+    const result = importVault(encryptedData, activePass)
     const providerFilter = new Set((cfg.vaultSyncProviders || []).map((p) => String(p)))
     const remoteSlots = providerFilter.size
       ? result.slots.filter((slot) => providerFilter.has(String(slot && slot.provider)))
@@ -447,6 +467,9 @@ export async function syncVaultPull({ live, store, settingsApi, syncAdapter, ref
       slotCount: result.slots.length,
       blobCount,
       conflicts: conflicts.length,
+      deviceId: device.id,
+      perDevice,
+      legacy: usedLegacy,
       exportedAt: result.exportedAt,
       timestamp: syncStatus.lastPullAt,
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "description": "Use ChatGPT Codex, Claude, Grok, Antigravity, Kimi, GLM, Cursor, Kiro, Copilot, Qwen, ERNIE, Spark, JetBrains, Perplexity, Replit, and Cody subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",