dsh-agy 0.2.3 → 0.2.4

package/README.md

@@ -81,6 +81,24 @@ dsh-agy logout         # remove account
 | `dsh-agy health` | `--index <n...>` — check only these accounts (default: all enabled)<br>`--interval <ms>` — repeat on an interval instead of once | Batch health check (refresh + userinfo), re-enables accounts whose credentials are live again |
 | `dsh-agy logout` | `--index <n>` — account index (default: active)<br>`--email <email>` — account email | Remove an account |
 
+### Per-account proxy
+
+Each account can have its own proxy; credentials are encrypted at rest and displayed masked as `protocol//host:port`.
+
+```sh
+dsh-agy login --proxy socks5://user:pass@host:1080
+dsh-agy import --proxy <url> file.json
+dsh-agy proxy set --index 0 --proxy <url>   # set / update
+dsh-agy proxy clear --index 0               # clear (fall back to env)
+dsh-agy proxy test --index 0                # TCP 2s fast-fail probe
+dsh-agy proxy list                          # masked list
+dsh-agy status                              # shows proxy column (masked host:port)
+```
+
+Fallback: with no per-account proxy, requests use `EnvHttpProxyAgent` (`HTTP_PROXY`/`HTTPS_PROXY` with `NO_PROXY` honored). Per-account proxies ignore `NO_PROXY`, are fail-closed (unreachable proxy skips the account without cooldown and clears affinity), and loopback targets (`localhost`/`127.0.0.1`/`::1`) are always forced direct.
+
+Web dashboard (`/agy`): each account card shows an inline Proxy row `[input] [Save][Clear][Test]` with masked `host:port`; writes via `POST /agy/api/proxy`, probes via `POST /agy/api/proxy/test`.
+
 ### Path C: Local Development & Link
 
 ```sh

package/lib/{accounts-BvX5zmPa.mjs → accounts-DbTTxX_z.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { i as proxiedFetch, n as isProxyUnreachableError } from "./proxy-DQPIwUov.mjs";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
-import { EnvHttpProxyAgent } from "undici";
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import lockfile from "proper-lockfile";
@@ -32,21 +32,6 @@ var AgyPoolBlockedError = class extends Error {
 	}
 };
 //#endregion
-//#region src/proxy.ts
-/**
-* Proxy-aware fetch: respects the standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY
-* environment variables (lowercase variants included) via undici's
-* EnvHttpProxyAgent. Applied per-request through the `dispatcher` option so the
-* plugin never mutates the host process's global dispatcher — DSH's own fetch
-* calls stay untouched.
-*/
-const agent = new EnvHttpProxyAgent();
-/** fetch() that routes through the env-configured proxy when one is set. */
-const proxiedFetch = (input, init) => fetch(input, {
-	...init,
-	dispatcher: agent
-});
-//#endregion
 //#region src/oauth/constants.ts
 /**
 * Antigravity (agy) OAuth and API constants.
@@ -144,7 +129,10 @@ async function fetchAgyFirstOk(urlPath, init, fetchImpl = proxiedFetch) {
 		const response = await fetchImpl(`${baseEndpoint}${urlPath}`, init);
 		if (!AGY_ENDPOINT_SKIP_STATUSES.has(response.status)) return response;
 		lastSkipped = response;
-	} catch {}
+	} catch (error) {
+		const { isProxyUnreachableError } = await import("./proxy-DQPIwUov.mjs").then((n) => n.o);
+		if (isProxyUnreachableError(error)) throw error;
+	}
 	if (lastSkipped) return lastSkipped;
 	throw new Error("all agy endpoints failed");
 }
@@ -410,7 +398,7 @@ async function refreshAccessToken(auth, options) {
 				client_id: clientId,
 				client_secret: clientSecret
 			})
-		});
+		}, options?.proxyUrl ? { proxyUrl: options.proxyUrl } : void 0);
 		if (!response.ok) {
 			const errorText = await response.text().catch(() => void 0);
 			const { code, description } = parseOAuthErrorPayload(errorText);
@@ -449,13 +437,22 @@ async function refreshAccessToken(auth, options) {
 			clientId
 		};
 	} catch (error) {
+		const raw = error instanceof Error ? error : new Error(String(error));
+		const code = error?.code;
+		const errorCode = error?.errorCode;
+		const wrapped = new AgyTokenRefreshError({
+			message: raw.message,
+			status: 0,
+			statusText: "Network Error",
+			code: code ?? errorCode,
+			description: raw.message
+		});
+		wrapped.cause = error;
+		if (code) wrapped.code = code;
+		if (errorCode) wrapped.errorCode = errorCode;
 		transientFailure = {
 			type: "failed",
-			error: new AgyTokenRefreshError({
-				message: error instanceof Error ? error.message : "Unknown refresh error",
-				status: 0,
-				statusText: "Network Error"
-			})
+			error: wrapped
 		};
 	}
 	if (transientFailure) return transientFailure;
@@ -584,6 +581,10 @@ function decideRotation(kind, account, consecutiveFailures, retryAfterMs, catego
 			action: "retry",
 			backoffMs
 		};
+		case "proxy-unreachable": return {
+			action: "rotate",
+			backoffMs: Math.min(backoffMs, 1e3)
+		};
 	}
 }
 /**
@@ -991,7 +992,10 @@ var AgySessionManager = class AgySessionManager {
 				access: cached?.access ?? "",
 				expires: cached?.expires ?? 0,
 				refresh: account.refresh
-			}, { clientId: account.clientId });
+			}, {
+				clientId: account.clientId,
+				proxyUrl: account.proxy
+			});
 			if (result.type === "success") {
 				if (!account.clientId && result.clientId) {
 					await this.store.mutate((s) => {
@@ -1017,6 +1021,7 @@ var AgySessionManager = class AgySessionManager {
 					expires: cached.expires,
 					refresh: account.refresh
 				};
+				if (isProxyUnreachableError(result.error)) throw new AgyAuthError("transport", "proxy_unreachable", { cause: result.error });
 				throw new AgyAuthError(result.error.status === 429 ? "rate-limit" : result.error.status === 0 || result.error.status === 408 || result.error.status >= 500 ? "transport" : "invalid-credential", result.error.message, { cause: result.error });
 			}
 			if (result.type === "revoked") {
@@ -1076,16 +1081,19 @@ var AgySessionManager = class AgySessionManager {
 				try {
 					const auth = await this.accessTokenFor(account);
 					if (!auth) return null;
-					const { fetchAvailableModels } = await import("./models-I1UAEk9x.mjs").then((n) => n.r);
-					const boundedFetch = (input, init) => {
+					const { fetchAvailableModels } = await import("./models-DRWVi33p.mjs").then((n) => n.r);
+					const quotas = ingestFamilyQuotas(await fetchAvailableModels(auth.access, account.projectId, (input, init) => {
 						const timeout = AbortSignal.timeout(AgySessionManager.QUOTA_FETCH_TIMEOUT_MS);
 						const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+						if (account.proxy) return proxiedFetch(input, {
+							...init,
+							signal
+						}, { proxyUrl: account.proxy });
 						return fetch(input, {
 							...init,
 							signal
 						});
-					};
-					const quotas = ingestFamilyQuotas(await fetchAvailableModels(auth.access, account.projectId, boundedFetch));
+					}));
 					return {
 						key,
 						quotas,
@@ -1184,11 +1192,39 @@ var AgySessionManager = class AgySessionManager {
 	async getSession(model) {
 		let storage = await this.store.load();
 		const maxAttempts = storage.accounts.filter((account) => account.enabled !== false).length;
+		let proxyUnreachableCount = 0;
 		for (let attempt = 0; attempt < maxAttempts; attempt++) {
 			if (storage.accounts.filter((account) => account.enabled !== false).length > 1) await this.refreshQuotaCache(storage);
 			const picked = await this.pickAccount(storage, model);
 			if (!picked) return void 0;
-			const auth = await this.accessTokenFor(picked.account);
+			let auth;
+			try {
+				auth = await this.accessTokenFor(picked.account);
+			} catch (error) {
+				if (error instanceof AgyAuthError && error.kind === "transport" && isProxyUnreachableError(error)) {
+					proxyUnreachableCount++;
+					this.lastUsed = null;
+					const deadIndex = storage.accounts.findIndex((a) => this.accountKey(a) === this.accountKey(picked.account));
+					if (deadIndex !== -1) {
+						const next = pickNextAccountIndex(storage.accounts, deadIndex, Date.now());
+						if (next !== storage.activeIndex) {
+							storage.activeIndex = next;
+							await this.store.mutate((s) => {
+								s.activeIndex = next;
+							}).catch(() => {});
+						}
+					}
+					storage = await this.store.load();
+					continue;
+				}
+				if (isProxyUnreachableError(error)) {
+					proxyUnreachableCount++;
+					this.lastUsed = null;
+					storage = await this.store.load();
+					continue;
+				}
+				throw error;
+			}
 			if (!auth) {
 				this.lastUsed = null;
 				storage = await this.store.load();
@@ -1196,7 +1232,7 @@ var AgySessionManager = class AgySessionManager {
 			}
 			const key = this.accountKey(picked.account);
 			if (!picked.account.projectId && !this.projectRetryFailed.has(key)) try {
-				const { loadCodeAssist } = await import("./exchange-CteHnRzO.mjs").then((n) => n.n);
+				const { loadCodeAssist } = await import("./exchange-BvrLu2E4.mjs").then((n) => n.n);
 				const { projectId } = await loadCodeAssist(auth.access);
 				if (projectId) {
 					await this.store.mutate((s) => {
@@ -1227,6 +1263,7 @@ var AgySessionManager = class AgySessionManager {
 				impersonation: impersonationHeadersFor(picked.account)
 			};
 		}
+		if (proxyUnreachableCount === maxAttempts && maxAttempts > 0) throw new AgyAuthError("transport", "proxy_unreachable");
 	}
 	/** Adapter hook: apply rotation decisions and fingerprint regeneration. */
 	async reportFailure(kind, session, info) {
@@ -1290,7 +1327,7 @@ var AgySessionManager = class AgySessionManager {
 				ok: false,
 				error: "No agy account configured — run `dsh-agy login` first."
 			};
-			const { toAgyRequestBody } = await import("./translate-C1SMdm5J.mjs").then((n) => n.n);
+			const { toAgyRequestBody } = await import("./translate-COjBTH4-.mjs").then((n) => n.n);
 			const { fetchAgyFirstOk } = await Promise.resolve().then(() => constants_exports);
 			const { parseAgySse } = await import("./parse-D8bV2yqa.mjs").then((n) => n.n);
 			const body = toAgyRequestBody({
@@ -1370,7 +1407,7 @@ var AgySessionManager = class AgySessionManager {
 				ok: false,
 				error: "refresh failed (revoked?)"
 			};
-			const response = await proxiedFetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${auth.access}` } });
+			const response = await proxiedFetch("https://www.googleapis.com/oauth2/v1/userinfo?alt=json", { headers: { Authorization: `Bearer ${auth.access}` } }, account.proxy ? { proxyUrl: account.proxy } : void 0);
 			if (!response.ok) return {
 				ok: false,
 				error: `userinfo ${response.status}`
@@ -1589,21 +1626,42 @@ const properFileLock = { async withLock(file, fn) {
 function isEncrypted(value) {
 	return value.startsWith(ENC_PREFIX);
 }
-/** Decrypt one account's refresh field when encrypted; plaintext passes through (legacy). */
+/** Decrypt one account's refresh/proxy fields when encrypted; plaintext passes through (legacy). */
 function decryptAccount(account, codec) {
-	if (isEncrypted(account.refresh)) return {
-		...account,
-		refresh: codec.decrypt(account.refresh)
+	let out = account;
+	if (isEncrypted(out.refresh)) out = {
+		...out,
+		refresh: codec.decrypt(out.refresh)
+	};
+	if (out.proxy && isEncrypted(out.proxy)) out = {
+		...out,
+		proxy: codec.decrypt(out.proxy)
 	};
-	return account;
+	return out;
 }
-/** Encrypt one account's refresh field (plaintext stays plaintext if no codec change). */
+/** Encrypt one account's refresh/proxy fields (plaintext stays plaintext if no codec change). */
 function encryptAccount(account, codec) {
-	if (!isEncrypted(account.refresh)) return {
-		...account,
-		refresh: codec.encrypt(account.refresh)
+	let out = account;
+	if (!isEncrypted(out.refresh)) out = {
+		...out,
+		refresh: codec.encrypt(out.refresh)
 	};
-	return account;
+	if (out.proxy && !isEncrypted(out.proxy)) out = {
+		...out,
+		proxy: codec.encrypt(out.proxy)
+	};
+	return out;
+}
+/** Mask a proxy URL for display/logs: protocol//host:port (no credentials, no query). */
+function maskProxyUrl(proxyUrl) {
+	if (!proxyUrl) return null;
+	try {
+		const u = new URL(proxyUrl);
+		const port = u.port || (u.protocol === "https:" ? "443" : u.protocol === "socks5:" || u.protocol === "socks5h:" ? "1080" : "8080");
+		return `${u.protocol}//${u.hostname}:${port}`;
+	} catch {
+		return null;
+	}
 }
 function ensureAccountIds(storage) {
 	let mutated = false;
@@ -1761,6 +1819,6 @@ var JsonAccountStore = class {
 	}
 };
 //#endregion
-export { AgyPoolBlockedError as A, OAUTH_USERINFO_URL as C, resolveAgyClientCredentials as D, getAgyBootstrapUserAgent as E, proxiedFetch as O, OAUTH_TOKEN_URL as S, getAgyBootstrapClientMetadata as T, generateAntigravityRequestId as _, loadMasterKey as a, AGY_SCOPES as b, resolveMasterKeyCodec as c, generateFingerprint as d, recordFingerprintVersion as f, deriveAntigravitySessionId as g, resolveAntigravityVersionBounded as h, deriveKey as i, AgyAuthError as k, AgySessionManager as l, resolveAntigravityVersion as m, MASTER_KEY_REF as n, persistMasterKey as o, calculateTokenExpiry as p, createAesGcmCodec as r, resolveDshHome as s, JsonAccountStore as t, isAgyDisabled as u, AGY_DEFAULT_REDIRECT_URI as v, fetchAgyFirstOk as w, OAUTH_AUTHORIZE_URL as x, AGY_ENDPOINT_FALLBACKS as y };
+export { AgyPoolBlockedError as A, OAUTH_TOKEN_URL as C, getAgyBootstrapUserAgent as D, getAgyBootstrapClientMetadata as E, resolveAgyClientCredentials as O, OAUTH_AUTHORIZE_URL as S, fetchAgyFirstOk as T, deriveAntigravitySessionId as _, deriveKey as a, AGY_ENDPOINT_FALLBACKS as b, resolveDshHome as c, isAgyDisabled as d, generateFingerprint as f, resolveAntigravityVersionBounded as g, resolveAntigravityVersion as h, createAesGcmCodec as i, AgyAuthError as k, resolveMasterKeyCodec as l, calculateTokenExpiry as m, maskProxyUrl as n, loadMasterKey as o, recordFingerprintVersion as p, MASTER_KEY_REF as r, persistMasterKey as s, JsonAccountStore as t, AgySessionManager as u, generateAntigravityRequestId as v, OAUTH_USERINFO_URL as w, AGY_SCOPES as x, AGY_DEFAULT_REDIRECT_URI as y };
 
-//# sourceMappingURL=accounts-BvX5zmPa.mjs.map
+//# sourceMappingURL=accounts-DbTTxX_z.mjs.map