dsh-plugin-subscriptions 0.5.0 → 0.5.2

package/lib/auth/store.js

@@ -10,7 +10,7 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 /** Every provider route, in display order. */
-export const PROVIDER_IDS = ['codex', 'claude', 'grok'];
+export const PROVIDER_IDS = ['codex', 'claude', 'grok', 'copilot'];
 /**
  * Absolute path of the auth store file.
  * @returns `dshHomePath('plugins', 'subscriptions', 'auth.json')`.
@@ -103,6 +103,38 @@ async function writeStore(store, path) {
         throw error;
     }
 }
+/**
+ * One write chain per store path. Every mutation is a read-modify-write of a
+ * single JSON file, and the plugin has several independent writers — a login,
+ * a logout, and one token refresh per provider adapter, each on its own
+ * schedule. Overlapping them unserialized costs whichever provider read the
+ * store first its entry.
+ *
+ * A chain is dropped once nothing is queued behind it, so the map holds an
+ * entry only while writes are in flight.
+ */
+const writeChains = new Map();
+/**
+ * Run one read-modify-write of a store path after every write already queued
+ * for it. Callers join the chain synchronously, so call order is write order.
+ * @param path - the store file being mutated.
+ * @param action - the read-modify-write to run.
+ * @returns whatever `action` returns.
+ */
+async function serialize(path, action) {
+    const previous = writeChains.get(path) ?? Promise.resolve();
+    // Both handlers: a failed write must not strand everything queued behind it.
+    const next = previous.then(action, action);
+    const tail = next.then(() => undefined, () => undefined);
+    writeChains.set(path, tail);
+    try {
+        return await next;
+    }
+    finally {
+        if (writeChains.get(path) === tail)
+            writeChains.delete(path);
+    }
+}
 /**
  * Read one provider's session.
  * @param provider - the provider route.
@@ -119,9 +151,11 @@ export async function getSession(provider, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function saveSession(provider, session, path = authFilePath()) {
-    const store = await loadStore(path);
-    store[provider] = session;
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        store[provider] = session;
+        await writeStore(store, path);
+    });
 }
 /**
  * Delete one provider's session (logout).
@@ -129,9 +163,11 @@ export async function saveSession(provider, session, path = authFilePath()) {
  * @param path - store file path; defaults to {@link authFilePath}.
  */
 export async function deleteSession(provider, path = authFilePath()) {
-    const store = await loadStore(path);
-    if (store[provider] === undefined)
-        return;
-    delete store[provider];
-    await writeStore(store, path);
+    return serialize(path, async () => {
+        const store = await loadStore(path);
+        if (store[provider] === undefined)
+            return;
+        delete store[provider];
+        await writeStore(store, path);
+    });
 }

package/lib/client/SubscriptionsSection.d.ts

@@ -1,7 +1,7 @@
 import type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client';
 import type { SubscriptionsKey } from './locales.js';
 /** Subscription provider ids, fixed by the node half's OAuth adapters. */
-export type SubscriptionProvider = 'codex' | 'claude' | 'grok';
+export type SubscriptionProvider = 'codex' | 'claude' | 'grok' | 'copilot';
 /** One provider's login state as answered by the `status` endpoint. */
 export interface ProviderStatus {
     loggedIn: boolean;
@@ -23,6 +23,23 @@ export interface ProviderUsage {
     windows?: UsageWindow[];
     plan?: string;
 }
+/** `proxyGet` endpoint value: the node half owns this shape (no secrets). */
+export interface ProxyConfigView {
+    enabled: boolean;
+    url: string;
+    username?: string;
+    passwordSet: boolean;
+    bypass: string[];
+    error?: string;
+}
+/** `proxyTest` endpoint value. */
+export interface ProxyTestResult {
+    ok: boolean;
+    viaProxy: boolean;
+    status?: number;
+    latencyMs?: number;
+    error?: string;
+}
 /** Injected dependencies of {@link SubscriptionsSection} (slot `inject`). */
 export interface SubscriptionsSectionInjected {
     /** Generic logical-RPC caller over the Connection transport. */

package/lib/client/SubscriptionsSection.js

@@ -24,6 +24,7 @@ const PROVIDERS = [
     { id: 'codex', name: 'Codex (ChatGPT)' },
     { id: 'claude', name: 'Claude' },
     { id: 'grok', name: 'Grok (X Premium)' },
+    { id: 'copilot', name: 'GitHub Copilot' },
 ];
 /** Business error returned by the `/subscriptions-auth` channel (error branch message). */
 class SubscriptionsAuthError extends Error {
@@ -77,6 +78,10 @@ const styles = {
         border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 12,
         padding: '12px 14px', display: 'flex', flexDirection: 'column', gap: 6,
     },
+    proxyCard: {
+        padding: '12px 14px', display: 'flex', flexDirection: 'column', gap: 6,
+    },
+    separator: { borderTop: '1px solid var(--dsw-alias-border-l2)' },
     cardHeader: { display: 'flex', alignItems: 'center', gap: 8 },
     dot: { width: 8, height: 8, borderRadius: '50%', flexShrink: 0 },
     name: { fontWeight: 500, fontSize: 14, lineHeight: '22px', color: 'var(--dsw-alias-label-primary)' },
@@ -122,6 +127,45 @@ const styles = {
         padding: '0 10px', font: 'inherit', fontSize: 14, lineHeight: '22px',
         background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)',
     },
+    deviceCode: {
+        marginTop: 4, display: 'flex', flexDirection: 'column', gap: 6,
+        border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8,
+        padding: '10px 12px', background: 'var(--dsw-alias-bg-layer-1)',
+    },
+    deviceCodeText: {
+        fontFamily: 'monospace', fontSize: 18, lineHeight: '24px', letterSpacing: 2,
+        color: 'var(--dsw-alias-label-primary)', userSelect: 'all',
+    },
+    proxyField: { display: 'flex', flexDirection: 'column', gap: 4 },
+    proxyLabel: { fontSize: 12, lineHeight: '18px', color: 'var(--dsw-alias-label-secondary)' },
+    proxyInput: {
+        height: 32, width: '100%', boxSizing: 'border-box',
+        border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 8,
+        padding: '0 10px', font: 'inherit', fontSize: 14, lineHeight: '22px',
+        background: 'var(--dsw-alias-bg-layer-1)', color: 'var(--dsw-alias-label-primary)',
+    },
+    proxyHint: {
+        margin: 0, fontSize: 12, lineHeight: '18px', color: 'var(--dsw-alias-label-tertiary)',
+    },
+    proxyCheck: {
+        display: 'flex', alignItems: 'center', gap: 8,
+        fontSize: 13, lineHeight: '20px', color: 'var(--dsw-alias-label-primary)', cursor: 'pointer',
+    },
+    proxyMessage: { margin: 0, fontSize: 12, lineHeight: '18px' },
+    proxyActions: { display: 'flex', gap: 8, alignItems: 'center', justifyContent: 'flex-end', marginTop: 2 },
+    modalOverlay: {
+        position: 'fixed', inset: 0, zIndex: 1000,
+        display: 'flex', alignItems: 'center', justifyContent: 'center', padding: 16,
+        background: 'rgba(0, 0, 0, 0.45)',
+    },
+    modal: {
+        width: 460, maxWidth: '100%', maxHeight: '90vh', overflowY: 'auto',
+        boxSizing: 'border-box', display: 'flex', flexDirection: 'column', gap: 12,
+        padding: '16px 18px', borderRadius: 12,
+        background: 'var(--dsw-alias-bg-layer-1)', border: '1px solid var(--dsw-alias-border-l2)',
+    },
+    modalHeader: { display: 'flex', alignItems: 'center', gap: 8 },
+    modalTitle: { fontWeight: 600, fontSize: 15, lineHeight: '22px', color: 'var(--dsw-alias-label-primary)' },
 };
 /** Status dot color for one provider state. */
 function dotColor(status) {
@@ -178,6 +222,24 @@ function usageBarColor(usedPercent) {
         return 'var(--dsw-alias-state-warn-label)';
     return 'var(--dsw-alias-state-success-primary)';
 }
+/** One-line status text of the proxy config card. */
+function proxyStatusText(t, proxy, loadError) {
+    if (loadError !== undefined)
+        return t('proxyLoadFailed', { message: loadError });
+    if (proxy === undefined)
+        return t('proxyLoading');
+    if (proxy.error !== undefined)
+        return t('proxyStatusError', { message: proxy.error });
+    if (proxy.enabled)
+        return t('proxyStatusEnabled', { url: proxy.url });
+    return t('proxyStatusNone');
+}
+/** Feedback-line color of the proxy dialog. */
+function messageColor(tone) {
+    return tone === 'error'
+        ? 'var(--dsw-alias-state-error-primary)'
+        : 'var(--dsw-alias-state-success-primary)';
+}
 /**
  * The Subscriptions settings page component.
  * @param props - the slot inject face ({@link SubscriptionsSectionInjected}).
@@ -189,8 +251,11 @@ export function SubscriptionsSection(props) {
     const [statuses, setStatuses] = useState({});
     const [errors, setErrors] = useState({});
     const [manualDrafts, setManualDrafts] = useState({
-        codex: '', claude: '', grok: '',
+        codex: '', claude: '', grok: '', copilot: '',
     });
+    /** Pending device-flow codes (copilot), shown while the attempt polls. */
+    const [deviceCodes, setDeviceCodes] = useState({});
+    const [copiedCode, setCopiedCode] = useState(undefined);
     const [usages, setUsages] = useState({});
     const [usageErrors, setUsageErrors] = useState({});
     const [usageLoading, setUsageLoading] = useState({});
@@ -198,6 +263,21 @@ export function SubscriptionsSection(props) {
     const pollersRef = useRef(new Map());
     /** Providers with a `usage` call in flight; guards the auto-fetch effect against re-entry. */
     const usageInflightRef = useRef(new Set());
+    /** Proxy config as last answered by `proxyGet`/`proxySet`. */
+    const [proxy, setProxy] = useState(undefined);
+    const [proxyLoadError, setProxyLoadError] = useState(undefined);
+    /** Proxy dialog state (draft fields; the password never pre-fills). */
+    const [proxyOpen, setProxyOpen] = useState(false);
+    const [proxyEnabled, setProxyEnabled] = useState(false);
+    const [proxyUrl, setProxyUrl] = useState('');
+    const [proxyUsername, setProxyUsername] = useState('');
+    const [proxyPassword, setProxyPassword] = useState('');
+    const [proxyClearPassword, setProxyClearPassword] = useState(false);
+    const [proxyBypass, setProxyBypass] = useState('');
+    const [proxySaving, setProxySaving] = useState(false);
+    const [proxyTesting, setProxyTesting] = useState(false);
+    const [proxyMessage, setProxyMessage] = useState(undefined);
+    const [proxyTestResult, setProxyTestResult] = useState(undefined);
     const setProviderError = useCallback((provider, message) => {
         if (!mountedRef.current)
             return;
@@ -235,8 +315,17 @@ export function SubscriptionsSection(props) {
         setStatuses(response.providers);
         for (const { id } of PROVIDERS) {
             const status = response.providers[id];
-            if (status.loggedIn || !status.busy)
+            if (status.loggedIn || !status.busy) {
                 stopPolling(id);
+                // The attempt settled (success, timeout, or cancel): drop the code card.
+                setDeviceCodes((prev) => {
+                    if (prev[id] === undefined)
+                        return prev;
+                    const next = { ...prev };
+                    delete next[id];
+                    return next;
+                });
+            }
         }
     }, [rpc, stopPolling]);
     const startPolling = useCallback((provider) => {
@@ -332,11 +421,18 @@ export function SubscriptionsSection(props) {
             if (typeof response.authorizeUrl !== 'string') {
                 throw new SubscriptionsAuthError(t('loginMissingUrl'));
             }
-            window.open(response.authorizeUrl, '_blank', 'noopener');
             if (!mountedRef.current)
                 return;
             // Optimistic busy so Cancel and the manual fallback appear before the first poll tick.
             setStatuses(prev => ({ ...prev, [provider]: { ...prev[provider], busy: true, loggedIn: false } }));
+            if (typeof response.userCode === 'string' && response.userCode.length > 0) {
+                // Device flow: show the code card instead of opening the page blind —
+                // the user copies the code first, then opens the verification page.
+                setDeviceCodes(prev => ({ ...prev, [provider]: { userCode: response.userCode, verificationUrl: response.authorizeUrl } }));
+            }
+            else {
+                window.open(response.authorizeUrl, '_blank', 'noopener');
+            }
             startPolling(provider);
         }
         catch (error) {
@@ -386,12 +482,117 @@ export function SubscriptionsSection(props) {
         }
         await refresh();
     }, [rpc, t, setProviderError, refresh]);
+    const copyDeviceCode = useCallback((provider, userCode) => {
+        void navigator.clipboard?.writeText(userCode).then(() => {
+            if (!mountedRef.current)
+                return;
+            setCopiedCode(provider);
+            setTimeout(() => {
+                if (mountedRef.current) {
+                    setCopiedCode(current => current === provider ? undefined : current);
+                }
+            }, 1500);
+        }).catch(() => undefined);
+    }, []);
+    // Proxy configuration: load once on mount; the dialog drives proxySet/proxyTest.
+    useEffect(() => {
+        if (rpc === undefined)
+            return;
+        let alive = true;
+        void callSubscriptionsAuth(rpc, 'proxyGet', {}).then((view) => {
+            if (!alive)
+                return;
+            setProxy(view);
+            setProxyLoadError(undefined);
+        }).catch((error) => {
+            if (alive)
+                setProxyLoadError(messageOf(error));
+        });
+        return () => { alive = false; };
+    }, [rpc]);
+    useEffect(() => {
+        if (!proxyOpen)
+            return;
+        const onKey = (event) => {
+            if (event.key === 'Escape')
+                setProxyOpen(false);
+        };
+        window.addEventListener('keydown', onKey);
+        return () => window.removeEventListener('keydown', onKey);
+    }, [proxyOpen]);
+    const openProxyDialog = useCallback(() => {
+        if (proxy === undefined)
+            return;
+        setProxyEnabled(proxy.enabled);
+        setProxyUrl(proxy.url);
+        setProxyUsername(proxy.username ?? '');
+        setProxyPassword('');
+        setProxyClearPassword(false);
+        setProxyBypass(proxy.bypass.join(', '));
+        setProxyMessage(undefined);
+        setProxyTestResult(undefined);
+        setProxyOpen(true);
+    }, [proxy]);
+    const saveProxy = useCallback(async () => {
+        if (rpc === undefined)
+            return;
+        setProxySaving(true);
+        setProxyMessage(undefined);
+        try {
+            const view = await callSubscriptionsAuth(rpc, 'proxySet', {
+                enabled: proxyEnabled,
+                url: proxyUrl.trim(),
+                username: proxyUsername,
+                ...proxyClearPassword ? { password: null } : proxyPassword !== '' ? { password: proxyPassword } : {},
+                bypass: proxyBypass.split(/[,\n]/).map(entry => entry.trim()).filter(entry => entry !== ''),
+            });
+            setProxy(view);
+            setProxyLoadError(undefined);
+            setProxyMessage({ tone: 'success', text: t('proxySaved') });
+            setProxyOpen(false);
+        }
+        catch (error) {
+            setProxyMessage({ tone: 'error', text: t('proxySaveFailed', { message: messageOf(error) }) });
+        }
+        finally {
+            setProxySaving(false);
+        }
+    }, [rpc, proxyEnabled, proxyUrl, proxyUsername, proxyPassword, proxyClearPassword, proxyBypass, t]);
+    const testProxy = useCallback(async () => {
+        if (rpc === undefined || proxyTesting)
+            return;
+        setProxyTesting(true);
+        setProxyTestResult(undefined);
+        try {
+            // Test the dialog's current inputs (they do not need to be saved first);
+            // the host builds a throwaway agent for the probe.
+            setProxyTestResult(await callSubscriptionsAuth(rpc, 'proxyTest', {
+                proxy: {
+                    url: proxyUrl.trim(),
+                    ...proxyUsername.trim() !== '' ? { username: proxyUsername.trim() } : {},
+                    ...proxyPassword !== '' ? { password: proxyPassword } : {},
+                },
+            }));
+        }
+        catch (error) {
+            setProxyTestResult({ ok: false, viaProxy: false, error: messageOf(error) });
+        }
+        finally {
+            setProxyTesting(false);
+        }
+    }, [rpc, proxyTesting, proxyUrl, proxyUsername, proxyPassword]);
     if (rpc === undefined) {
         return _jsx("p", { style: styles.intro, children: t('unavailable') });
     }
-    return (_jsxs("div", { style: styles.section, children: [_jsx("p", { style: styles.intro, children: t('intro') }), PROVIDERS.map(({ id, name }) => {
+    return (_jsxs("div", { style: styles.section, children: [_jsx("p", { style: styles.intro, children: t('intro') }), _jsxs("div", { style: styles.proxyCard, children: [_jsxs("div", { style: styles.cardHeader, children: [_jsx("span", { style: {
+                                    ...styles.dot,
+                                    background: proxy?.enabled === true
+                                        ? 'var(--dsw-alias-state-success-primary)'
+                                        : 'var(--dsw-alias-label-dimmed)',
+                                } }), _jsx("span", { style: styles.name, children: t('proxyTitle') }), _jsx("button", { type: "button", style: { ...styles.button, marginLeft: 'auto', flexShrink: 0 }, onClick: openProxyDialog, children: t('proxyConfigure') })] }), _jsx("p", { style: styles.statusLine, children: proxyStatusText(t, proxy, proxyLoadError) })] }), _jsx("div", { style: styles.separator }), PROVIDERS.map(({ id, name }) => {
                 const status = statuses[id];
                 const busy = status?.busy === true;
+                const deviceCode = deviceCodes[id];
                 const usage = usages[id];
                 const usageError = usageErrors[id];
                 // Providers without a usage endpoint answer supported:false — no block.
@@ -401,6 +602,15 @@ export function SubscriptionsSection(props) {
                                     const percent = Math.min(100, Math.max(0, window.usedPercent));
                                     return (_jsxs("div", { style: styles.usageRow, children: [_jsxs("div", { style: styles.usageMeta, children: [_jsx("span", { children: usageWindowLabel(t, window) }), _jsxs("span", { children: [`${String(Math.round(percent))}%`, window.resetsAt !== undefined
                                                                 && ` · ${t('usageResets', { date: new Date(window.resetsAt).toLocaleString() })}`] })] }), _jsx("div", { style: styles.usageTrack, children: _jsx("div", { style: { ...styles.usageFill, width: `${String(percent)}%`, background: usageBarColor(percent) } }) })] }, index));
-                                })] })), busy && (_jsxs("details", { style: styles.manual, children: [_jsx("summary", { children: t('manualSummary') }), _jsxs("div", { style: styles.manualRow, children: [_jsx("input", { style: styles.manualInput, value: manualDrafts[id], placeholder: t('manualPlaceholder'), onChange: event => setManualDrafts(prev => ({ ...prev, [id]: event.target.value })) }), _jsx("button", { type: "button", style: styles.button, onClick: () => { void submitManual(id); }, children: t('submit') })] })] }))] }, id));
-            })] }));
+                                })] })), busy && deviceCode !== undefined && (_jsxs("div", { style: styles.deviceCode, children: [_jsx("span", { style: styles.statusLine, children: t('deviceCodePrompt') }), _jsx("span", { style: styles.deviceCodeText, children: deviceCode.userCode }), _jsxs("div", { style: styles.actions, children: [_jsx("button", { type: "button", style: styles.button, onClick: () => { copyDeviceCode(id, deviceCode.userCode); }, children: copiedCode === id ? t('deviceCodeCopied') : t('deviceCodeCopy') }), _jsx("button", { type: "button", style: styles.button, onClick: () => { window.open(deviceCode.verificationUrl, '_blank', 'noopener'); }, children: t('deviceCodeOpenPage') })] })] })), busy && deviceCode === undefined && (_jsxs("details", { style: styles.manual, children: [_jsx("summary", { children: t('manualSummary') }), _jsxs("div", { style: styles.manualRow, children: [_jsx("input", { style: styles.manualInput, value: manualDrafts[id], placeholder: t('manualPlaceholder'), onChange: event => setManualDrafts(prev => ({ ...prev, [id]: event.target.value })) }), _jsx("button", { type: "button", style: styles.button, onClick: () => { void submitManual(id); }, children: t('submit') })] })] }))] }, id));
+            }), proxyOpen && (_jsx("div", { style: styles.modalOverlay, onClick: () => setProxyOpen(false), children: _jsxs("div", { style: styles.modal, onClick: event => event.stopPropagation(), children: [_jsxs("div", { style: styles.modalHeader, children: [_jsx("span", { style: styles.modalTitle, children: t('proxyDialogTitle') }), _jsx("button", { type: "button", style: { ...styles.button, marginLeft: 'auto' }, onClick: () => setProxyOpen(false), children: t('proxyDialogClose') })] }), _jsxs("label", { style: styles.proxyCheck, children: [_jsx("input", { type: "checkbox", checked: proxyEnabled, onChange: event => setProxyEnabled(event.target.checked) }), _jsx("span", { children: t('proxyEnabled') })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyUrl') }), _jsx("input", { style: styles.proxyInput, value: proxyUrl, placeholder: t('proxyUrlPlaceholder'), onChange: event => setProxyUrl(event.target.value) }), _jsx("p", { style: styles.proxyHint, children: t('proxyUrlHint') })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyUsername') }), _jsx("input", { style: styles.proxyInput, value: proxyUsername, placeholder: t('proxyUsernamePlaceholder'), onChange: event => setProxyUsername(event.target.value) })] }), _jsxs("div", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyPassword') }), _jsx("input", { type: "password", style: styles.proxyInput, value: proxyPassword, placeholder: t('proxyPasswordPlaceholder'), onChange: event => setProxyPassword(event.target.value) }), _jsxs("label", { style: styles.proxyCheck, children: [_jsx("input", { type: "checkbox", checked: proxyClearPassword, onChange: event => setProxyClearPassword(event.target.checked) }), _jsx("span", { children: t('proxyClearPassword') })] })] }), _jsxs("label", { style: styles.proxyField, children: [_jsx("span", { style: styles.proxyLabel, children: t('proxyBypass') }), _jsx("input", { style: styles.proxyInput, value: proxyBypass, placeholder: t('proxyBypassPlaceholder'), onChange: event => setProxyBypass(event.target.value) }), _jsx("p", { style: styles.proxyHint, children: t('proxyBypassHint') })] }), _jsx("p", { style: styles.proxyHint, children: t('proxyNote') }), proxyMessage !== undefined && (_jsx("p", { style: { ...styles.proxyMessage, color: messageColor(proxyMessage.tone) }, children: proxyMessage.text })), proxyTestResult !== undefined && (_jsx("p", { style: {
+                                ...styles.proxyMessage,
+                                color: proxyTestResult.ok
+                                    ? 'var(--dsw-alias-state-success-primary)'
+                                    : 'var(--dsw-alias-state-error-primary)',
+                            }, children: proxyTestResult.ok
+                                ? (proxyTestResult.viaProxy
+                                    ? t('proxyTestOk', { status: String(proxyTestResult.status), ms: String(proxyTestResult.latencyMs) })
+                                    : t('proxyTestOkDirect', { status: String(proxyTestResult.status), ms: String(proxyTestResult.latencyMs) }))
+                                : t('proxyTestFail', { message: proxyTestResult.error ?? '' }) })), _jsxs("div", { style: styles.proxyActions, children: [_jsx("button", { type: "button", style: { ...styles.button, ...proxyTesting ? { opacity: 0.5, cursor: 'default' } : {} }, disabled: proxyTesting, onClick: () => { void testProxy(); }, children: proxyTesting ? t('proxyTesting') : t('proxyTest') }), _jsx("button", { type: "button", style: { ...styles.button, ...proxySaving ? { opacity: 0.5, cursor: 'default' } : {} }, disabled: proxySaving, onClick: () => { void saveProxy(); }, children: proxySaving ? t('proxySaving') : t('proxySave') }), _jsx("button", { type: "button", style: styles.button, onClick: () => setProxyOpen(false), children: t('proxyCancel') })] })] }) }))] }));
 }

package/lib/client/index.js

@@ -22,6 +22,17 @@ export const inject = ['slots', 'connection', 'locale'];
  */
 export function apply(ctx) {
     ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-plugin-subscriptions: copy dictionaries');
+    // Settings-shell nudge: the panel (nav title + header row + section body)
+    // sits flush against the panel's top edge; push it down a little to leave
+    // breathing room. Scoped by the settings panel's own dialog role + nav child
+    // so other aria-modal dialogs (e.g. the attachment lightbox) are untouched.
+    ctx.effect(() => {
+        const style = document.createElement('style');
+        style.setAttribute('data-plugin', 'dsh-plugin-subscriptions');
+        style.textContent = 'div[role="dialog"][aria-modal="true"]:has(> nav) { padding-top: 14px; }';
+        document.head.appendChild(style);
+        return () => style.remove();
+    }, 'dsh-plugin-subscriptions: settings panel breathing room');
     // The client-runtime Context merge types `connection` as the host handle;
     // in the browser shell the same key holds the full client ConnectionHandle.
     const connection = ctx.get('connection');

package/lib/client/locales.d.ts

@@ -19,6 +19,10 @@ export declare const en: {
     manualPlaceholder: string;
     submit: string;
     loginMissingUrl: string;
+    deviceCodePrompt: string;
+    deviceCodeCopy: string;
+    deviceCodeCopied: string;
+    deviceCodeOpenPage: string;
     usageTitle: string;
     usageRefresh: string;
     usageLoading: string;
@@ -47,6 +51,38 @@ export declare const en: {
     speedFastDescription: string;
     commandFast: string;
     commandFastUnavailable: string;
+    proxyTitle: string;
+    proxyStatusNone: string;
+    proxyStatusEnabled: string;
+    proxyStatusError: string;
+    proxyConfigure: string;
+    proxyDialogTitle: string;
+    proxyDialogClose: string;
+    proxyEnabled: string;
+    proxyUrl: string;
+    proxyUrlPlaceholder: string;
+    proxyUrlHint: string;
+    proxyUsername: string;
+    proxyUsernamePlaceholder: string;
+    proxyPassword: string;
+    proxyPasswordPlaceholder: string;
+    proxyClearPassword: string;
+    proxyBypass: string;
+    proxyBypassPlaceholder: string;
+    proxyBypassHint: string;
+    proxyTest: string;
+    proxyTesting: string;
+    proxyTestOk: string;
+    proxyTestOkDirect: string;
+    proxyTestFail: string;
+    proxySave: string;
+    proxyCancel: string;
+    proxySaving: string;
+    proxyLoading: string;
+    proxyLoadFailed: string;
+    proxySaved: string;
+    proxySaveFailed: string;
+    proxyNote: string;
 };
 /** zh strings, one per {@link en} key. */
 export declare const zh: {
@@ -68,6 +104,10 @@ export declare const zh: {
     manualPlaceholder: string;
     submit: string;
     loginMissingUrl: string;
+    deviceCodePrompt: string;
+    deviceCodeCopy: string;
+    deviceCodeCopied: string;
+    deviceCodeOpenPage: string;
     usageTitle: string;
     usageRefresh: string;
     usageLoading: string;
@@ -96,6 +136,38 @@ export declare const zh: {
     speedFastDescription: string;
     commandFast: string;
     commandFastUnavailable: string;
+    proxyTitle: string;
+    proxyStatusNone: string;
+    proxyStatusEnabled: string;
+    proxyStatusError: string;
+    proxyConfigure: string;
+    proxyDialogTitle: string;
+    proxyDialogClose: string;
+    proxyEnabled: string;
+    proxyUrl: string;
+    proxyUrlPlaceholder: string;
+    proxyUrlHint: string;
+    proxyUsername: string;
+    proxyUsernamePlaceholder: string;
+    proxyPassword: string;
+    proxyPasswordPlaceholder: string;
+    proxyClearPassword: string;
+    proxyBypass: string;
+    proxyBypassPlaceholder: string;
+    proxyBypassHint: string;
+    proxyTest: string;
+    proxyTesting: string;
+    proxyTestOk: string;
+    proxyTestOkDirect: string;
+    proxyTestFail: string;
+    proxySave: string;
+    proxyCancel: string;
+    proxySaving: string;
+    proxyLoading: string;
+    proxyLoadFailed: string;
+    proxySaved: string;
+    proxySaveFailed: string;
+    proxyNote: string;
 };
 /** The Subscriptions namespace key union (en is the key-set source of truth). */
 export type SubscriptionsKey = keyof typeof en;

package/lib/client/locales.js

@@ -19,6 +19,10 @@ export const en = {
     manualPlaceholder: 'Paste the callback URL or code',
     submit: 'Submit',
     loginMissingUrl: 'login answered without an authorizeUrl',
+    deviceCodePrompt: 'Enter this code on the GitHub verification page:',
+    deviceCodeCopy: 'Copy code',
+    deviceCodeCopied: 'Copied',
+    deviceCodeOpenPage: 'Open GitHub verification page',
     usageTitle: 'Usage',
     usageRefresh: 'Refresh',
     usageLoading: 'Loading usage…',
@@ -47,6 +51,38 @@ export const en = {
     speedFastDescription: '1.5x speed, more usage',
     commandFast: 'Switch the Codex speed tier (Standard/Fast)',
     commandFastUnavailable: 'The current model has no fast tier; /fast only works on Codex models whose catalog advertises one',
+    proxyTitle: 'Proxy',
+    proxyStatusNone: 'Not configured — subscription requests go direct.',
+    proxyStatusEnabled: 'Enabled · {url}',
+    proxyStatusError: 'Config error: {message}',
+    proxyConfigure: 'Configure…',
+    proxyDialogTitle: 'Proxy settings',
+    proxyDialogClose: 'Close',
+    proxyEnabled: 'Route subscription requests through a proxy',
+    proxyUrl: 'Proxy URL',
+    proxyUrlPlaceholder: 'http://localhost:7890',
+    proxyUrlHint: 'HTTP or HTTPS proxy only (Clash/mihomo, v2rayN…); socks is not supported.',
+    proxyUsername: 'Username (optional)',
+    proxyUsernamePlaceholder: 'Proxy username',
+    proxyPassword: 'Password',
+    proxyPasswordPlaceholder: 'Leave blank to keep the saved password',
+    proxyClearPassword: 'Clear the saved password',
+    proxyBypass: 'Bypass hosts',
+    proxyBypassPlaceholder: '127.0.0.1, localhost, *.example.com',
+    proxyBypassHint: 'Comma-separated hostnames that keep going direct.',
+    proxyTest: 'Test',
+    proxyTesting: 'Testing…',
+    proxyTestOk: 'OK · HTTP {status} · {ms} ms',
+    proxyTestOkDirect: 'OK (direct, bypassed) · HTTP {status} · {ms} ms',
+    proxyTestFail: 'Failed: {message}',
+    proxySave: 'Save',
+    proxyCancel: 'Cancel',
+    proxySaving: 'Saving…',
+    proxyLoading: 'Loading proxy settings…',
+    proxyLoadFailed: 'Failed to load proxy settings: {message}',
+    proxySaved: 'Saved — new requests use the proxy.',
+    proxySaveFailed: 'Save failed: {message}',
+    proxyNote: 'Applies to token exchange, model APIs, usage lookups, image/video generation and x_search. The OAuth authorization page opens in your browser and follows the browser/system proxy, not this setting.',
 };
 /** zh strings, one per {@link en} key. */
 export const zh = {
@@ -68,6 +104,10 @@ export const zh = {
     manualPlaceholder: '粘贴回调 URL 或授权码',
     submit: '提交',
     loginMissingUrl: 'login 响应缺少 authorizeUrl',
+    deviceCodePrompt: '在 GitHub 验证页面输入此验证码：',
+    deviceCodeCopy: '复制验证码',
+    deviceCodeCopied: '已复制',
+    deviceCodeOpenPage: '打开 GitHub 验证页面',
     usageTitle: '用量',
     usageRefresh: '刷新',
     usageLoading: '用量加载中…',
@@ -96,4 +136,36 @@ export const zh = {
     speedFastDescription: '约 1.5 倍速度，消耗更多用量',
     commandFast: '切换 Codex 速度档（标准/快速）',
     commandFastUnavailable: '当前模型不支持快速档；/fast 仅对目录声明了 fast tier 的 Codex 模型可用',
+    proxyTitle: '代理',
+    proxyStatusNone: '未配置 —— 订阅请求直连。',
+    proxyStatusEnabled: '已启用 · {url}',
+    proxyStatusError: '配置错误：{message}',
+    proxyConfigure: '配置…',
+    proxyDialogTitle: '代理设置',
+    proxyDialogClose: '关闭',
+    proxyEnabled: '让订阅相关请求走代理',
+    proxyUrl: '代理地址',
+    proxyUrlPlaceholder: 'http://localhost:7890',
+    proxyUrlHint: '仅支持 HTTP/HTTPS 代理（Clash/mihomo、v2rayN 等）；不支持 socks。',
+    proxyUsername: '用户名（可选）',
+    proxyUsernamePlaceholder: '代理用户名',
+    proxyPassword: '密码',
+    proxyPasswordPlaceholder: '留空则保留已保存的密码',
+    proxyClearPassword: '清除已保存的密码',
+    proxyBypass: '绕过主机',
+    proxyBypassPlaceholder: '127.0.0.1, localhost, *.example.com',
+    proxyBypassHint: '逗号分隔的主机名，这些主机保持直连。',
+    proxyTest: '测试',
+    proxyTesting: '测试中…',
+    proxyTestOk: '成功 · HTTP {status} · {ms} ms',
+    proxyTestOkDirect: '成功（直连，已绕过）· HTTP {status} · {ms} ms',
+    proxyTestFail: '失败：{message}',
+    proxySave: '保存',
+    proxyCancel: '取消',
+    proxySaving: '保存中…',
+    proxyLoading: '代理设置加载中…',
+    proxyLoadFailed: '代理设置加载失败：{message}',
+    proxySaved: '已保存 —— 后续请求将走代理。',
+    proxySaveFailed: '保存失败：{message}',
+    proxyNote: '作用于 token 交换、模型 API、用量查询、图片/视频生成与 x_search。OAuth 授权页在浏览器中打开，走的是浏览器/系统代理，不受此设置影响。',
 };