dsh-subscriptions 0.1.4 → 0.2.0

package/lib/tools/video-generate.d.ts

@@ -57,10 +57,6 @@ export declare function buildVideoGenerateBody(args: {
     resolution?: '480p' | '720p' | '1080p';
     image_url?: string;
 }): VideoGenerateRequestBody;
-/**
- * Extract the request id from the submit response. Throws when the payload
- * carries none.
- */
 export declare function parseVideoStartResponse(payload: unknown): string;
 /** One decoded poll response. */
 export type VideoStatus = {
@@ -71,7 +67,6 @@ export type VideoStatus = {
     duration?: number;
 } | {
     status: 'failed' | 'expired';
-    detail?: string;
 };
 /**
  * Decode one poll response. A `done` payload without a video URL and an

package/lib/tools/video-generate.js

@@ -12,7 +12,7 @@ import { mkdir, writeFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { httpLlmError } from '../providers/common.js';
+import { httpLlmError, parseProviderJson } from '../providers/common.js';
 import { AccountTokenManager } from '../providers/accounts.js';
 import { hostFetch } from '../http.js';
 /** Endpoint the generation request is posted to. */
@@ -60,10 +60,20 @@ function isRecord(value) {
  * Extract the request id from the submit response. Throws when the payload
  * carries none.
  */
+/**
+ * A provider-assigned request id, accepted only in a bounded identifier shape.
+ * The value reaches a user-visible failure message, so an unchecked one would
+ * let a provider put arbitrary text there. The shape rules out prose, spaces
+ * and message excerpts; it does NOT prove the value is harmless, because a
+ * credential-shaped string such as `SHORT_SECRET` matches it. Treat this as a
+ * bounded, format-constrained provider value that is displayed for support
+ * correlation — not as the absence of provider-supplied content.
+ */
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
 export function parseVideoStartResponse(payload) {
     const body = isRecord(payload) ? payload : {};
-    if (typeof body.request_id !== 'string' || body.request_id.length === 0) {
-        throw new Error('video_generate: the response carried no request_id');
+    if (typeof body.request_id !== 'string' || !REQUEST_ID_PATTERN.test(body.request_id)) {
+        throw new Error('video_generate: the response carried no usable request_id');
     }
     return body.request_id;
 }
@@ -89,15 +99,13 @@ export function parseVideoStatusResponse(payload) {
             };
         }
         case 'failed':
-        case 'expired': {
-            const error = isRecord(body.error) ? body.error : {};
-            const detail = typeof error.message === 'string' && error.message.length > 0
-                ? error.message
-                : typeof body.error === 'string' && body.error.length > 0 ? body.error : undefined;
-            return { status: body.status, ...detail === undefined ? {} : { detail } };
-        }
+        case 'expired':
+            // Safe means this failure path carries no provider-controlled free text,
+            // not that no secret can exist elsewhere in the system.
+            return { status: body.status };
         default:
-            throw new Error(`video_generate: unexpected status ${JSON.stringify(body.status)}`);
+            // Safe here also excludes provider-controlled free text, not all system secrets.
+            throw new Error('video_generate: unexpected status: [provider response body omitted]');
     }
 }
 /** Directory the downloaded MP4 files are written to. */
@@ -212,7 +220,7 @@ export function createVideoGenerateTool(options) {
             });
             if (!submit.ok)
                 throw await httpLlmError(submit, 'video_generate');
-            const requestId = parseVideoStartResponse(await submit.json());
+            const requestId = parseVideoStartResponse(await parseProviderJson(submit, 'video generate start'));
             const deadline = Date.now() + maxWaitMs;
             let done;
             for (;;) {
@@ -224,14 +232,17 @@ export function createVideoGenerateTool(options) {
                 });
                 if (!poll.ok)
                     throw await httpLlmError(poll, 'video_generate');
-                const status = parseVideoStatusResponse(await poll.json());
+                const status = parseVideoStatusResponse(await parseProviderJson(poll, 'video generate status poll'));
                 if (status.status === 'done') {
                     done = status;
                     break;
                 }
                 if (status.status === 'failed' || status.status === 'expired') {
+                    // No provider response text on this path. The request id is shaped like an
+                    // opaque id before it is stored (see REQUEST_ID_PATTERN), so it is an
+                    // identifier rather than provider prose; anything else was refused at parse.
                     throw new Error(`video_generate: generation ${status.status} (request ${requestId})`
-                        + (status.detail === undefined ? '' : `: ${status.detail}`));
+                        + ': [provider response body omitted]');
                 }
                 if (Date.now() >= deadline) {
                     throw new Error(`video_generate: timed out after ${String(maxWaitMs)}ms waiting for request ${requestId}`);

package/lib/tools/x-search.js

@@ -5,7 +5,7 @@
  * output is `{ answer, citations }`.
  */
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { httpLlmError } from '../providers/common.js';
+import { httpLlmError, parseProviderJson } from '../providers/common.js';
 import { AccountTokenManager } from '../providers/accounts.js';
 import { hostFetch } from '../http.js';
 /** Endpoint the search request is posted to. */
@@ -191,7 +191,7 @@ export function createXSearchTool(options) {
             });
             if (!response.ok)
                 throw await httpLlmError(response, 'x_search');
-            return parseXSearchResponse(await response.json());
+            return parseXSearchResponse(await parseProviderJson(response, 'x search'));
         },
     });
 }

package/lib/translate/resolved.d.ts

@@ -52,8 +52,11 @@ export interface ImageRequestLimit {
 }
 /**
  * Failure code a host's image-offload executor answers by replacing the oldest
- * retained images with text and retrying (`IMAGE_OFFLOAD_REQUIRED_CODE` in
- * dsh-llm 0.2+). Spelled out so the build links against older hosts too.
+ * retained images with text and retrying. Every host in our support window
+ * exports the equivalent as `IMAGE_OFFLOAD_REQUIRED_CODE`, from the window floor
+ * `0.1.7-rc.2` up, so this is not a newer-host path. The value is spelled out
+ * rather than imported so the plugin keeps building if a host stops exporting
+ * it.
  */
 export declare const IMAGE_OFFLOAD_REQUIRED = "IMAGE_OFFLOAD_REQUIRED";
 /**

package/lib/translate/resolved.js

@@ -45,8 +45,11 @@ export function withToolResultImages(messages) {
 }
 /**
  * Failure code a host's image-offload executor answers by replacing the oldest
- * retained images with text and retrying (`IMAGE_OFFLOAD_REQUIRED_CODE` in
- * dsh-llm 0.2+). Spelled out so the build links against older hosts too.
+ * retained images with text and retrying. Every host in our support window
+ * exports the equivalent as `IMAGE_OFFLOAD_REQUIRED_CODE`, from the window floor
+ * `0.1.7-rc.2` up, so this is not a newer-host path. The value is spelled out
+ * rather than imported so the plugin keeps building if a host stops exporting
+ * it.
  */
 export const IMAGE_OFFLOAD_REQUIRED = 'IMAGE_OFFLOAD_REQUIRED';
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-subscriptions",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Unified subscription providers and usage dashboard for DeepSeek Harness",
   "icon": "./icon.svg",
   "license": "MIT",