dsh-subscriptions 0.1.5 → 0.2.2

package/lib/auth/oauth-flow.js

@@ -9,9 +9,9 @@ import { createServer } from 'node:http';
 import { createPkce, randomHex, randomToken } from './pkce.js';
 /** Default attempt lifetime: three minutes for the user to complete login. */
 export const DEFAULT_FLOW_TIMEOUT_MS = 180_000;
-const SUCCESS_PAGE = '<!doctype html><html><head><meta charset="utf-8"><title>Login successful</title></head>'
-    + '<body style="font-family:sans-serif"><h1>Login successful</h1>'
-    + '<p>You can close this tab and return to DeepSeek Harness.</p></body></html>';
+const SUCCESS_PAGE = '<!doctype html><html><head><meta charset="utf-8"><title>Login successful</title></head>' +
+    '<body style="font-family:sans-serif"><h1>Login successful</h1>' +
+    '<p>You can close this tab and return to DeepSeek Harness.</p></body></html>';
 function authorizationFailure(error) {
     // Safe means this failure path carries no provider-controlled free text,
     // not that no secret can exist elsewhere in the system.
@@ -40,13 +40,13 @@ function authorizationFailure(error) {
             category = 'temporarily_unavailable';
             break;
     }
-    return 'authorization failed'
-        + (category === undefined ? '' : ` (${category})`)
-        + ': [provider message omitted]';
+    return ('authorization failed' +
+        (category === undefined ? '' : ` (${category})`) +
+        ': [provider message omitted]');
 }
 function failurePage(detail) {
-    return '<!doctype html><html><head><meta charset="utf-8"><title>Login failed</title></head>'
-        + `<body style="font-family:sans-serif"><h1>Login failed</h1><p>${detail.replace(/[<>&]/g, '')}</p></body></html>`;
+    return ('<!doctype html><html><head><meta charset="utf-8"><title>Login failed</title></head>' +
+        `<body style="font-family:sans-serif"><h1>Login failed</h1><p>${detail.replace(/[<>&]/g, '')}</p></body></html>`);
 }
 /**
  * Loopback addresses one listen host covers. `localhost` resolves to ::1 or
@@ -69,7 +69,7 @@ function familyUnavailable(error) {
  */
 async function listen(handler, spec) {
     const hosts = listenHosts(spec.host);
-    const candidates = spec.ports.flatMap(port => (port === 0 ? [0, 0, 0] : [port]));
+    const candidates = spec.ports.flatMap((port) => port === 0 ? [0, 0, 0] : [port]);
     let lastError;
     for (const candidate of candidates) {
         const servers = [];
@@ -161,6 +161,8 @@ export class OAuthFlowManager {
             rejectCode = reject;
         });
         let settled = false;
+        // Assigned after listen(); a callback that arrives first must see it absent.
+        // eslint-disable-next-line prefer-const -- the single write is after the listener exists
         let timer;
         let servers = [];
         const handler = (request, response) => {
@@ -177,7 +179,8 @@ export class OAuthFlowManager {
                 response.end('state mismatch');
                 return;
             }
-            if (url.searchParams.has('error_description') || url.searchParams.has('error')) {
+            if (url.searchParams.has('error_description') ||
+                url.searchParams.has('error')) {
                 const detail = authorizationFailure(url.searchParams.get('error'));
                 response.writeHead(200, { 'content-type': 'text/html' });
                 response.end(failurePage(detail));

package/lib/auth/rpc.d.ts

@@ -23,7 +23,7 @@ export declare const SUBSCRIPTIONS_AUTH_PREFIX = "subscriptions-auth.";
  * Every endpoint {@link dispatch} answers; each gets one exact Fetch route.
  * Kept in one place so the route table and the switch cannot drift apart.
  */
-export declare const SUBSCRIPTIONS_AUTH_ENDPOINTS: readonly ["providerSettings", "setProviderSettings", "status", "login", "manual", "cancel", "logout", "setDefault", "usage", "externalStatus", "externalUsage", "cursorStatus", "cursorLogin", "cursorCancel", "cursorLogout", "cursorUsage", "cursorModels", "cursorSettings", "cursorSetSettings", "image", "video", "prepareReset", "consumeReset", "speed", "setSpeed", "modelDefaults", "setModelDefault"];
+export declare const SUBSCRIPTIONS_AUTH_ENDPOINTS: readonly ["providerSettings", "setProviderSettings", "status", "login", "manual", "cancel", "logout", "setDefault", "usage", "externalStatus", "externalUsage", "cursorStatus", "cursorLogin", "cursorCancel", "cursorLogout", "cursorUsage", "cursorModels", "cursorSettings", "cursorSetSettings", "ollamaSettings", "ollamaSetSettings", "ollamaModels", "image", "video", "prepareReset", "consumeReset", "speed", "setSpeed", "modelDefaults", "setModelDefault"];
 /** Decoded image bytes returned by the `image` endpoint. */
 export interface ImageBytesResult {
     mediaType: string;
@@ -201,11 +201,82 @@ export interface CursorRpcController {
     settings(force: boolean, signal: AbortSignal): Promise<unknown>;
     setSettings(input: unknown): Promise<void>;
 }
+/** One model in the Ollama Cloud picker catalog, with its capability flags. */
+export interface OllamaModelView {
+    id: string;
+    name: string;
+    /** The endpoint advertised the `vision` capability. */
+    vision: boolean;
+    /** The endpoint advertised the `thinking` capability. */
+    thinking: boolean;
+    contextWindow?: number;
+    /** Advertised reasoning levels, when the model reasons. */
+    efforts?: {
+        id: string;
+        name: string;
+    }[];
+    /** The level preselected for the model, when one is known. */
+    defaultEffort?: string;
+}
+/** One candidate returned by the cloud listing; adopting it stores `id`. */
+export interface OllamaCloudCandidate {
+    /** Normalized wire id, e.g. `glm-5.3:cloud`. */
+    id: string;
+    /** The id exactly as the listing published it, e.g. `glm-5.3`. */
+    rawId: string;
+    /** Display basename for the checkbox row. */
+    name: string;
+    vision: boolean;
+    thinking: boolean;
+    contextWindow?: number;
+    efforts: string[];
+    defaultEffort?: string;
+}
+/**
+ * What the Ollama card renders: the stored overrides, the effective values
+ * after config/default fallback, and the catalog the picker serves.
+ */
+export interface OllamaSettingsView {
+    provider: 'ollama-cloud';
+    /** The stored document; absent fields mean "no override". */
+    settings: unknown;
+    effective: {
+        baseURL: string;
+        apiKeyRef: string;
+        web: boolean;
+    };
+    /** The effective catalog, in picker order (empty hides the picker entry). */
+    models: OllamaModelView[];
+    /** A non-empty `config.ollama.models` wins over the store, so card edits are inert. */
+    configOverridesModels: boolean;
+}
+/** Ollama Cloud catalog and connection settings; the API key stays in DSH credentials. */
+export interface OllamaRpcController {
+    settings(): Promise<OllamaSettingsView>;
+    /** Validate and persist the store document, then re-announce the route. */
+    setSettings(input: unknown): Promise<void>;
+    /**
+     * List the endpoint's Cloud models for the adoption checklist.
+     * @param input - an optional one-time API key and base URL override; the
+     *   key is used for this listing only and never persisted.
+     * @param signal - caller cancellation from the RPC transport.
+     */
+    models(input: {
+        apiKey?: string;
+        baseURL?: string;
+    }, signal: AbortSignal): Promise<{
+        models: OllamaCloudCandidate[];
+    }>;
+}
 /**
  * Register the `/subscriptions-auth` RPC channel when a host connection exists.
  * @param ctx - the plugin context (headless profiles have no `connection`).
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
  * @param modelDefaults - optional per-model default-effort state backing `modelDefaults`/`setModelDefault`.
+ * @param providerSettings - optional OAuth provider/account preferences.
+ * @param externalUsage - optional credential-backed quota readers.
+ * @param cursor - optional Cursor account and model-visibility actions.
+ * @param ollama - optional Ollama Cloud catalog and connection settings.
  */
-export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController, modelDefaults?: ModelDefaultsController | undefined, providerSettings?: ProviderSettingsController | undefined, externalUsage?: ExternalUsageRpcController | undefined, cursor?: CursorRpcController | undefined): void;
+export declare function registerAuthRpc(ctx: Context, controller: AuthController, speed: SpeedController, modelDefaults?: ModelDefaultsController | undefined, providerSettings?: ProviderSettingsController | undefined, externalUsage?: ExternalUsageRpcController | undefined, cursor?: CursorRpcController | undefined, ollama?: OllamaRpcController | undefined): void;

package/lib/auth/rpc.js

@@ -9,6 +9,7 @@
 import { AttachmentId } from '@deepseek-ai/dsh-attachment';
 import { PROVIDER_IDS } from './store.js';
 import { EXTERNAL_USAGE_SOURCES } from '../providers/external-usage-controller.js';
+import { validateOllamaBaseURL } from '../providers/ollama-settings.js';
 /**
  * Endpoint-name prefix under the shared `/api` channel: endpoint `status`
  * is served at `/api/subscriptions-auth.status`. The browser half calls
@@ -20,17 +21,44 @@ export const SUBSCRIPTIONS_AUTH_PREFIX = 'subscriptions-auth.';
  * Kept in one place so the route table and the switch cannot drift apart.
  */
 export const SUBSCRIPTIONS_AUTH_ENDPOINTS = [
-    'providerSettings', 'setProviderSettings',
-    'status', 'login', 'manual', 'cancel', 'logout', 'setDefault', 'usage',
-    'externalStatus', 'externalUsage',
-    'cursorStatus', 'cursorLogin', 'cursorCancel', 'cursorLogout', 'cursorUsage', 'cursorModels',
-    'cursorSettings', 'cursorSetSettings',
-    'image', 'video', 'prepareReset', 'consumeReset',
-    'speed', 'setSpeed',
-    'modelDefaults', 'setModelDefault',
+    'providerSettings',
+    'setProviderSettings',
+    'status',
+    'login',
+    'manual',
+    'cancel',
+    'logout',
+    'setDefault',
+    'usage',
+    'externalStatus',
+    'externalUsage',
+    'cursorStatus',
+    'cursorLogin',
+    'cursorCancel',
+    'cursorLogout',
+    'cursorUsage',
+    'cursorModels',
+    'cursorSettings',
+    'cursorSetSettings',
+    'ollamaSettings',
+    'ollamaSetSettings',
+    'ollamaModels',
+    'image',
+    'video',
+    'prepareReset',
+    'consumeReset',
+    'speed',
+    'setSpeed',
+    'modelDefaults',
+    'setModelDefault',
 ];
 /** Media types the attachment store accepts (ImageMediaType). */
-const IMAGE_MEDIA_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];
+const IMAGE_MEDIA_TYPES = [
+    'image/png',
+    'image/jpeg',
+    'image/webp',
+    'image/gif',
+];
 /** Bare MP4 file names the `video` endpoint accepts (no path separators). */
 const VIDEO_NAME_PATTERN = /^[\w.-]+\.mp4$/;
 /** Payload carried no usable provider id — an RPC client bug, not a server failure. */
@@ -40,9 +68,16 @@ function readEnvelope(body) {
     if (typeof body !== 'object' || body === null)
         return undefined;
     const record = body;
-    if (record.type !== 'client-request' || typeof record.rpcId !== 'string' || typeof record.method !== 'string')
+    if (record.type !== 'client-request' ||
+        typeof record.rpcId !== 'string' ||
+        typeof record.method !== 'string')
         return undefined;
-    return { type: 'client-request', rpcId: record.rpcId, method: record.method, payload: record.payload };
+    return {
+        type: 'client-request',
+        rpcId: record.rpcId,
+        method: record.method,
+        payload: record.payload,
+    };
 }
 function serverResponse(rpcId, result) {
     return Response.json({ type: 'server-response', rpcId, result });
@@ -62,8 +97,14 @@ function fetchRouteFor(endpoint, handler) {
         methods: ['POST'],
         requestBody: 'buffered',
         fetch: async (request) => {
-            if (request.headers.get('content-type')?.split(';', 1)[0]?.trim().toLowerCase() !== 'application/json') {
-                return new Response('content type must be application/json', { status: 415 });
+            if (request.headers
+                .get('content-type')
+                ?.split(';', 1)[0]
+                ?.trim()
+                .toLowerCase() !== 'application/json') {
+                return new Response('content type must be application/json', {
+                    status: 415,
+                });
             }
             let body;
             try {
@@ -77,7 +118,11 @@ function fetchRouteFor(endpoint, handler) {
                 const rawId = body?.rpcId;
                 return serverResponse(typeof rawId === 'string' ? rawId : 'invalid-request', {
                     ok: false,
-                    error: { code: 'gateway/bad-request', message: 'invalid client-request message', details: { issues: [] } },
+                    error: {
+                        code: 'gateway/bad-request',
+                        message: 'invalid client-request message',
+                        details: { issues: [] },
+                    },
                 });
             }
             if (envelope.method !== method) {
@@ -101,7 +146,10 @@ function failure(error) {
     const message = error instanceof Error ? error.message : String(error);
     if (error instanceof BadRequest) {
         // The issues array is zod-shaped upstream; this channel validates by hand.
-        return { ok: false, error: { code: 'bad-request', message, details: { issues: [] } } };
+        return {
+            ok: false,
+            error: { code: 'bad-request', message, details: { issues: [] } },
+        };
     }
     return { ok: false, error: { code: 'internal', message, details: {} } };
 }
@@ -109,7 +157,8 @@ function readProvider(payload) {
     if (typeof payload !== 'object' || payload === null)
         throw new BadRequest('payload must be an object');
     const provider = payload.provider;
-    if (typeof provider !== 'string' || !PROVIDER_IDS.includes(provider)) {
+    if (typeof provider !== 'string' ||
+        !PROVIDER_IDS.includes(provider)) {
         throw new BadRequest(`payload.provider must be one of ${PROVIDER_IDS.join(', ')}`);
     }
     return provider;
@@ -121,6 +170,18 @@ function readString(payload, field) {
     }
     return value;
 }
+/** Read a field that may be omitted, rejecting an empty or non-string value. */
+function readOptionalString(payload, field) {
+    if (typeof payload !== 'object' || payload === null)
+        throw new BadRequest('payload must be an object');
+    const value = payload[field];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new BadRequest(`payload.${field} must be a non-empty string when present`);
+    }
+    return value;
+}
 /** Validate the `setModelDefault` endpoint's payload. */
 function readModelDefaultInput(payload) {
     const provider = readProvider(payload);
@@ -169,7 +230,8 @@ function readImageRef(payload) {
         throw new BadRequest('payload.attachmentId must be a non-empty string');
     }
     const mediaType = record.mediaType;
-    if (typeof mediaType !== 'string' || !IMAGE_MEDIA_TYPES.includes(mediaType)) {
+    if (typeof mediaType !== 'string' ||
+        !IMAGE_MEDIA_TYPES.includes(mediaType)) {
         throw new BadRequest(`payload.mediaType must be one of ${IMAGE_MEDIA_TYPES.join(', ')}`);
     }
     for (const field of ['bytes', 'width', 'height']) {
@@ -188,7 +250,7 @@ function readImageRef(payload) {
         bytes: record.bytes,
         width: record.width,
         height: record.height,
-        ...name === undefined ? {} : { name: name },
+        ...(name === undefined ? {} : { name: name }),
     };
 }
 /**
@@ -222,7 +284,7 @@ function readSessionId(payload) {
         throw new BadRequest('payload must be an object');
     return readString(payload, 'sessionId');
 }
-async function dispatch(controller, speed, modelDefaults, endpoint, payload, signal, providerSettings, externalUsage, cursor) {
+async function dispatch(controller, speed, modelDefaults, endpoint, payload, signal, providerSettings, externalUsage, cursor, ollama) {
     switch (endpoint) {
         case 'providerSettings':
             if (!providerSettings)
@@ -239,11 +301,14 @@ async function dispatch(controller, speed, modelDefaults, endpoint, payload, sig
             // One provider's failure (a corrupt store entry, a broken flow) must not
             // blind the whole page: it degrades to an error detail on that provider
             // while the others still report their real status.
-            const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [provider, await controller.status(provider).catch((error) => ({
+            const entries = await Promise.all(PROVIDER_IDS.map(async (provider) => [
+                provider,
+                await controller.status(provider).catch((error) => ({
                     busy: false,
                     accounts: [],
                     detail: error instanceof Error ? error.message : String(error),
-                }))]));
+                })),
+            ]));
             return ok({ providers: Object.fromEntries(entries) });
         }
         case 'login': {
@@ -322,6 +387,38 @@ async function dispatch(controller, speed, modelDefaults, endpoint, payload, sig
                 throw new BadRequest('payload must be an object');
             await cursor.setSettings(payload.settings);
             return ok({ ok: true });
+        case 'ollamaSettings':
+            if (!ollama)
+                throw new BadRequest('Ollama settings are unavailable');
+            return ok(await ollama.settings());
+        case 'ollamaSetSettings':
+            if (!ollama)
+                throw new BadRequest('Ollama settings are unavailable');
+            if (payload === null || typeof payload !== 'object')
+                throw new BadRequest('payload must be an object');
+            await ollama.setSettings(payload.settings);
+            return ok({ ok: true });
+        case 'ollamaModels': {
+            if (!ollama)
+                throw new BadRequest('Ollama settings are unavailable');
+            const apiKey = readOptionalString(payload, 'apiKey');
+            const rawBaseURL = readOptionalString(payload, 'baseURL');
+            let baseURL;
+            if (rawBaseURL !== undefined) {
+                // The listing may run against a not-yet-saved draft address, so it
+                // passes the same URL check the store applies.
+                try {
+                    baseURL = validateOllamaBaseURL(rawBaseURL);
+                }
+                catch (error) {
+                    throw new BadRequest(error instanceof Error ? error.message : String(error));
+                }
+            }
+            return ok(await ollama.models({
+                ...(apiKey === undefined ? {} : { apiKey }),
+                ...(baseURL === undefined ? {} : { baseURL }),
+            }, signal));
+        }
         case 'prepareReset':
             if (!controller.prepareReset)
                 throw new BadRequest('Reset redemption unavailable');
@@ -363,8 +460,12 @@ async function dispatch(controller, speed, modelDefaults, endpoint, payload, sig
  * @param controller - the auth operations backing the endpoints.
  * @param speed - the per-session speed-tier state backing the Speed toggle.
  * @param modelDefaults - optional per-model default-effort state backing `modelDefaults`/`setModelDefault`.
+ * @param providerSettings - optional OAuth provider/account preferences.
+ * @param externalUsage - optional credential-backed quota readers.
+ * @param cursor - optional Cursor account and model-visibility actions.
+ * @param ollama - optional Ollama Cloud catalog and connection settings.
  */
-export function registerAuthRpc(ctx, controller, speed, modelDefaults = undefined, providerSettings = undefined, externalUsage = undefined, cursor = undefined) {
+export function registerAuthRpc(ctx, controller, speed, modelDefaults = undefined, providerSettings = undefined, externalUsage = undefined, cursor = undefined, ollama = undefined) {
     // `connection` is not in this plugin's inject list (headless compositions
     // lack it), so its startup order is unconstrained: defer registration until
     // the service exists instead of probing once at apply time.
@@ -381,7 +482,7 @@ export function registerAuthRpc(ctx, controller, speed, modelDefaults = undefine
         const connection = ctx.get('connection');
         const handler = async (endpoint, payload, signal) => {
             try {
-                return await dispatch(controller, speed, modelDefaults, endpoint, payload, signal, providerSettings, externalUsage, cursor);
+                return await dispatch(controller, speed, modelDefaults, endpoint, payload, signal, providerSettings, externalUsage, cursor, ollama);
             }
             catch (error) {
                 return failure(error);

package/lib/auth/store.js

@@ -18,7 +18,13 @@ import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'
 import { dirname } from 'node:path';
 import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 /** Every provider route, in display order. */
-export const PROVIDER_IDS = ['codex', 'claude', 'grok', 'copilot', 'antigravity'];
+export const PROVIDER_IDS = [
+    'codex',
+    'claude',
+    'grok',
+    'copilot',
+    'antigravity',
+];
 /**
  * The stable identity of one session's account: Codex keys on workspace AND
  * user (email fallback, workspace-only for unidentified legacy sessions),
@@ -37,40 +43,53 @@ export function accountKeyOf(provider, session) {
     switch (provider) {
         case 'codex': {
             const codex = session;
-            const payload = typeof codex.idToken === 'string' ? decodeJwtPayload(codex.idToken) : undefined;
+            const payload = typeof codex.idToken === 'string'
+                ? decodeJwtPayload(codex.idToken)
+                : undefined;
             const auth = claimObject(payload?.['https://api.openai.com/auth']);
             const user = nonEmpty(auth?.chatgpt_user_id) ?? nonEmpty(auth?.user_id);
             const profile = claimObject(payload?.['https://api.openai.com/profile']);
-            const email = nonEmpty(codex.emailAddress) ?? nonEmpty(payload?.email) ?? nonEmpty(profile?.email);
+            const email = nonEmpty(codex.emailAddress) ??
+                nonEmpty(payload?.email) ??
+                nonEmpty(profile?.email);
             if (user === undefined && email === undefined)
                 return codex.accountId;
             // JSON tuple encoding avoids separator collisions and distinguishes IDs from emails.
-            return JSON.stringify([codex.accountId, user === undefined ? 'email' : 'user', user ?? email.toLowerCase()]);
+            return JSON.stringify([
+                codex.accountId,
+                user === undefined ? 'email' : 'user',
+                user ?? email.toLowerCase(),
+            ]);
         }
         case 'claude':
-            return session.emailAddress ?? tokenHash(session.refreshToken);
+            return (session.emailAddress ??
+                tokenHash(session.refreshToken));
         case 'grok':
             return session.account ?? tokenHash(session.refreshToken);
         case 'antigravity':
-            return session.account ?? tokenHash(session.refreshToken);
+            return (session.account ??
+                tokenHash(session.refreshToken));
         case 'copilot':
-            return session.account ?? tokenHash(session.refreshToken);
+            return (session.account ?? tokenHash(session.refreshToken));
     }
 }
 function nonEmpty(value) {
-    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
+    return typeof value === 'string' && value.trim().length > 0
+        ? value.trim()
+        : undefined;
 }
 function claimObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value)
-        ? value : undefined;
+        ? value
+        : undefined;
 }
 /** Resolve only recorded aliases, not an ambiguous workspace-wide match. */
 function resolveAccount(entry, key) {
     const seen = new Set();
-    while (!Object.hasOwn(entry.accounts, key)
-        && entry.aliases !== undefined
-        && Object.hasOwn(entry.aliases, key)
-        && !seen.has(key)) {
+    while (!Object.hasOwn(entry.accounts, key) &&
+        entry.aliases !== undefined &&
+        Object.hasOwn(entry.aliases, key) &&
+        !seen.has(key)) {
         seen.add(key);
         key = entry.aliases[key];
     }
@@ -107,9 +126,13 @@ export async function resolveAccountKey(provider, account, path = authFilePath()
 }
 /** Migrate workspace-only keys once; retain collisions rather than discard credentials. */
 function codexEmail(session) {
-    const payload = typeof session.idToken === 'string' ? decodeJwtPayload(session.idToken) : undefined;
+    const payload = typeof session.idToken === 'string'
+        ? decodeJwtPayload(session.idToken)
+        : undefined;
     const profile = claimObject(payload?.['https://api.openai.com/profile']);
-    return (nonEmpty(session.emailAddress) ?? nonEmpty(payload?.email) ?? nonEmpty(profile?.email))?.toLowerCase();
+    return (nonEmpty(session.emailAddress) ??
+        nonEmpty(payload?.email) ??
+        nonEmpty(profile?.email))?.toLowerCase();
 }
 function codexUserKey(session) {
     const key = accountKeyOf('codex', session);
@@ -179,13 +202,16 @@ function assertSessionShape(provider, account, value) {
         throw new Error(`subscriptions auth store: entry "${provider}/${account}" is not an object; fix or delete the store file`);
     }
     const entry = value;
-    if (typeof entry.accessToken !== 'string' || entry.accessToken.length === 0
-        || typeof entry.refreshToken !== 'string' || entry.refreshToken.length === 0
-        || typeof entry.expiresAt !== 'number' || !Number.isFinite(entry.expiresAt)) {
+    if (typeof entry.accessToken !== 'string' ||
+        entry.accessToken.length === 0 ||
+        typeof entry.refreshToken !== 'string' ||
+        entry.refreshToken.length === 0 ||
+        typeof entry.expiresAt !== 'number' ||
+        !Number.isFinite(entry.expiresAt)) {
         throw new Error(`subscriptions auth store: entry "${provider}/${account}" is missing accessToken/refreshToken/expiresAt; fix or delete the store file`);
     }
-    if (provider === 'antigravity'
-        && (typeof entry.projectId !== 'string' || entry.projectId.length === 0)) {
+    if (provider === 'antigravity' &&
+        (typeof entry.projectId !== 'string' || entry.projectId.length === 0)) {
         throw new Error('subscriptions auth store: entry "antigravity" is missing projectId; log out and complete Antigravity login again');
     }
 }
@@ -261,12 +287,19 @@ function parseStore(text, path) {
                 continue;
             }
             const session = record;
-            const key = provider === 'codex' ? session.accountId : accountKeyOf(provider, session);
-            store[provider] = { default: key, accounts: { [key]: session } };
+            const key = provider === 'codex'
+                ? session.accountId
+                : accountKeyOf(provider, session);
+            store[provider] = {
+                default: key,
+                accounts: { [key]: session },
+            };
             continue;
         }
         const accounts = record.accounts;
-        if (typeof accounts !== 'object' || accounts === null || Array.isArray(accounts)) {
+        if (typeof accounts !== 'object' ||
+            accounts === null ||
+            Array.isArray(accounts)) {
             console.warn(`subscriptions auth store: entry "${provider}" has no accounts map; skipped`);
             continue;
         }
@@ -288,7 +321,11 @@ function parseStore(text, path) {
         const validDefault = record.default === undefined || record.default in kept
             ? record.default
             : Object.keys(kept)[0];
-        store[provider] = { ...record, default: validDefault, accounts: kept };
+        store[provider] = {
+            ...record,
+            default: validDefault,
+            accounts: kept,
+        };
     }
     if (store.codex !== undefined)
         migrateCodex(store.codex);
@@ -299,9 +336,12 @@ function isValidSessionShape(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const entry = value;
-    return typeof entry.accessToken === 'string' && entry.accessToken.length > 0
-        && typeof entry.refreshToken === 'string' && entry.refreshToken.length > 0
-        && typeof entry.expiresAt === 'number' && Number.isFinite(entry.expiresAt);
+    return (typeof entry.accessToken === 'string' &&
+        entry.accessToken.length > 0 &&
+        typeof entry.refreshToken === 'string' &&
+        entry.refreshToken.length > 0 &&
+        typeof entry.expiresAt === 'number' &&
+        Number.isFinite(entry.expiresAt));
 }
 /** Persist the whole store atomically with owner-only permissions. */
 async function writeStore(store, path) {
@@ -361,7 +401,10 @@ export async function listAccounts(provider, path = authFilePath()) {
     const entry = (await loadStore(path))[provider];
     if (entry === undefined)
         return [];
-    const accounts = Object.entries(entry.accounts).map(([key, session]) => ({ key, session }));
+    const accounts = Object.entries(entry.accounts).map(([key, session]) => ({
+        key,
+        session,
+    }));
     accounts.sort((a, b) => Number(b.key === entry.default) - Number(a.key === entry.default));
     return accounts;
 }
@@ -402,7 +445,8 @@ export async function saveAccountSession(provider, account, session, path = auth
         if (entry !== undefined) {
             account = resolveAccount(entry, account);
             if (provider === 'codex') {
-                account = reconcileCodexIdentity(entry, session) ?? accountKeyOf('codex', session);
+                account =
+                    reconcileCodexIdentity(entry, session) ?? accountKeyOf('codex', session);
             }
         }
         ;
@@ -439,7 +483,9 @@ export async function deleteAccountSession(provider, account, path = authFilePat
             ;
             store[provider] = {
                 ...entry,
-                ...entry.default === account ? { default: Object.keys(accounts)[0] } : { default: entry.default },
+                ...(entry.default === account
+                    ? { default: Object.keys(accounts)[0] }
+                    : { default: entry.default }),
                 accounts,
             };
         }
@@ -462,7 +508,10 @@ export async function setDefaultAccount(provider, account, path = authFilePath()
             throw new Error(`no ${provider} account "${account}" is logged in`);
         }
         ;
-        store[provider] = { ...entry, default: account };
+        store[provider] = {
+            ...entry,
+            default: account,
+        };
         await writeStore(store, path);
     });
 }

package/lib/client/CursorCard.d.ts

@@ -2,7 +2,7 @@ import type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client';
 import type { SubscriptionsSectionInjected } from './SubscriptionsSection.js';
 type Translate = SubscriptionsSectionInjected['t'];
 /** Cursor's single connected account, rendered with the same card and Manage dialog as the other providers. */
-export declare function CursorCard({ rpc, t }: {
+export declare function CursorCard({ rpc, t, }: {
     rpc: ConnectionHandle['rpc'];
     t: Translate;
 }): import("react").JSX.Element;