my-provider-dash-manager 0.2.8

package/LICENSE

@@ -0,0 +1,63 @@
+# My Provider Dash Manager — Licence
+
+Copyright © 2026 Eduard Secureanu (GitHub: [FiredMosquito831](https://github.com/FiredMosquito831)).
+All rights reserved.
+
+Source-available. You may **use** this software, personally and commercially. You may **not** modify
+it, redistribute changed versions, or present it as your own work.
+
+## 1. Permitted
+
+1. **Use, without charge, for any purpose — personal or commercial.** You may run the application on
+   any number of machines, including inside a company, and use it in the course of paid work.
+2. **Reading and studying the source**, including for security review.
+3. **Redistributing the software verbatim and unmodified**, keeping this licence and the attribution
+   below intact, provided you charge nothing for the software itself.
+4. **Private, local changes solely to make the software run in your own environment** (for example a
+   build fix). Such changes may not be published or distributed.
+
+## 2. Not permitted
+
+1. **Modifying the software** for distribution, or publishing modified or derivative versions, forks
+   with changes, ports, or rebrands.
+2. **Presenting the work, in whole or in part, as your own**, or removing or obscuring authorship,
+   copyright notices, or this licence.
+3. **Sublicensing, selling, or renting the software**, or including it in a paid product or service
+   offering where the software itself is what is being paid for.
+4. Using the author's name to endorse anything without written permission.
+
+## 3. Attribution
+
+If you mention, describe, review, demonstrate, publish about, or otherwise refer to this software
+anywhere — an article, video, README, documentation, presentation, social post, or product page —
+you must credit the author and link the project repository:
+
+> My Provider Dash Manager by FiredMosquito831 —
+> https://github.com/FiredMosquito831/my-provider-dash-manager
+
+## 4. Contributions
+
+Contributions are welcome only as issues, or as pull requests that the author may accept at their
+sole discretion. By submitting a contribution you assign to the author the rights necessary to
+license it under these terms.
+
+## 5. No warranty; no liability
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+The software manages sessions and credentials for third-party services. You are responsible for
+complying with those services' terms, and for the security of the machine it runs on.
+
+## 6. Termination
+
+Any breach of sections 1–3 terminates the rights granted here automatically. Rights are reinstated if
+the breach is corrected promptly after notice.
+
+---
+
+*This is a bespoke source-available licence, not an OSI-approved open-source licence: it deliberately
+withholds the right to modify and redistribute. Third-party dependencies keep their own licences.*

package/README.md

@@ -0,0 +1,228 @@
+# My Provider Dash Manager
+
+**One desktop app for every cloud account you own.** Keep several Vercel, Netlify, Supabase,
+Cloudflare, Railway, Render and GitHub accounts signed in at the same time, each in a fully isolated
+session, and switch between them instantly — the way a browser handles tabs, but built around
+*accounts* instead of pages.
+
+<sub>Windows desktop app · Electron 43 · local-first · no telemetry, no account, no server ·
+source-available licence: free for personal and commercial use</sub>
+
+---
+
+## Install
+
+Download the latest installer from
+[Releases](https://github.com/FiredMosquito831/my-provider-dash-manager/releases) and run it.
+
+The installer is not code-signed yet, so SmartScreen shows a warning: choose **More info → Run
+anyway**.
+
+### Updates
+
+The Home screen has an **Updates** panel: it shows your installed version, the latest release, the
+release notes, and gives you *Check for updates*, *Download*, and *Restart & install* buttons with
+download progress. Nothing is downloaded or installed without you pressing the button, and the app
+checks quietly on startup and once an hour after that.
+
+The repository is public, so updates need no setup. (If you ever fork this into a private repo, the
+panel lets you store a GitHub token, encrypted with Windows DPAPI, so the feed stays readable.)
+
+### Install from the command line
+
+```bash
+npx my-provider-dash-manager                    # fetch the newest release and run its installer
+npx my-provider-dash-manager -- --silent        # install without the wizard
+npx my-provider-dash-manager -- --download-only # just fetch the .exe
+```
+
+From a checkout of this repository, the same thing is `npm run install:latest`.
+
+It prints the latest version and its release notes and verifies the download really is a Windows
+executable before running it. No authentication is needed; a `GH_TOKEN` is used only if present.
+
+### Run from source
+
+```bash
+npm install
+npm start
+```
+
+---
+
+## What it looks like
+
+**Home — every service and account in one grid, with the account rail on the left.**
+Each provider lists its accounts; hovering one reveals open / sleep / close / fill-login / connect-token / manage.
+
+![Home screen](docs/screenshots/home.png)
+
+**A real dashboard, signed in, inside the app.** The rail and tab strip stay put, so Home is always one click away.
+
+![A dashboard open in the app](docs/screenshots/dashboard.png)
+
+**The top bar is only your open tabs** — filter them, or group them by provider with collapsible sections.
+Slept tabs stay in the strip (dimmed) and resume on click.
+
+![Tabs grouped by provider](docs/screenshots/tabs-grouped.png)
+
+**Updates and saved logins live on Home**: installed vs latest version with release notes and an update
+button, plus login remembering, auto-fill and password import.
+
+![Updates and saved logins](docs/screenshots/settings.png)
+
+<sub>Screenshots use a demo profile with placeholder account names.</sub>
+
+---
+
+## Why it exists
+
+Every cloud provider assumes you have exactly one identity. The moment you have a personal account
+and a client account on the same service, the browser fights you:
+
+| The usual pain | What this app does |
+|---|---|
+| Signing out of one account to reach another | Every account stays signed in, in its own storage partition |
+| Juggling browser profiles, one window each | One window: providers on the left, open accounts as tabs on top |
+| "Which account am I actually in right now?" | Every tab and rail row is colour-coded and labelled by account |
+| Losing your workspace on restart | The open-tab set is remembered and restored |
+| Re-typing passwords for the fifth account | Logins are captured per account and refilled automatically |
+| Ads and blinding white dashboards | Built-in ad-blocking and dark mode, no extensions required |
+
+It is not a browser and not a scraper. It is a **container for identities**: real dashboards, real
+sessions, one place.
+
+---
+
+## Features
+
+### Accounts and sessions
+- **Unlimited accounts per service.** Each account gets its own Chromium storage partition — separate
+  cookies, localStorage, IndexedDB and cache. Accounts can never see each other's session.
+- **Sessions persist across restarts.** Sign in once; you stay signed in (verified by an automated
+  restart test that counts real cookies after relaunch).
+- **Instant switching.** Active tabs stay warm, so switching is a visibility toggle, not a reload.
+- **Warm-tab limit with sleeping.** Each live dashboard costs roughly 125 MB, so the app keeps a
+  configurable number warm (default 5) and sleeps the rest. Slept tabs stay in the strip and resume on
+  click, and sleeping returns the app to about 350 MB. Measured: 5 tabs ≈ 1.0 GB, 10 ≈ 1.6 GB, all
+  slept ≈ 0.35 GB (private memory, the figure Task Manager reports).
+- **Tab session memory.** The set of open tabs is saved and restored on the next launch: recent ones
+  come back warm, the rest asleep, and you land on the Home grid.
+- **Per-account proxy** (optional) with proper connection flushing.
+
+### Layout
+- **Left rail — your identities.** Providers listed vertically, accounts nested underneath, each with
+  hover actions: open, sleep, close, fill login, connect an API token, manage. Collapse any provider.
+- **Top bar — open tabs only.** A filter box and a group-by-provider toggle with collapsible groups.
+- **Home** is always one click (or `Esc`) away: a grid of every service and account with live status.
+- Keyboard: `Ctrl+W` sleep, `Ctrl+Shift+W` sleep all, `Ctrl+Tab` cycle, `Ctrl+1…9` jump.
+
+### Saved logins
+- **Remembers logins you type** inside an account tab, bound to *that* account, so two accounts on the
+  same service refill with different credentials.
+- **Auto-fills sign-in pages** when it recognises one (toggleable), plus a manual fill action.
+- **Imports existing passwords** from installed Chromium browsers (Chrome, Edge, Brave, Vivaldi,
+  Opera) or from a CSV exported by any browser, including Firefox.
+- Everything is encrypted at rest with Windows DPAPI. Passwords never reach the app's own UI process.
+- **Origin-bound**: a login is tied to the account *and* the service's own domains. A password typed on
+  another site reached from that tab (an OAuth hand-off, a look-alike page) is never captured as that
+  account's login, and a saved password is never filled into a page outside the service's domains.
+
+### API status
+Paste a read-only API token into an account and its Home card shows live status — project counts and
+names for every built-in service, plus latest deploy state on Vercel. Tokens are validated before
+being stored, encrypted with DPAPI, revocable in one click, and never leave the main process.
+
+### Content
+- **Ad-blocking** driven by EasyList (~52,000 blocked hosts plus generic cosmetic rules, refreshed
+  weekly) applied per account partition. Main-frame navigation is never blocked.
+- **Dark mode**: sites that support `prefers-color-scheme` go dark natively, and an optional
+  force-dark inversion covers the ones that don't.
+
+### Extensibility
+- **Add any service by URL** — it gets its own rail row and isolated per-account sessions.
+- **Service plugins**: drop a small JSON manifest into `plugins/` (or install it from the UI) to
+  define a service and, optionally, how to read its API for status cards.
+
+---
+
+---
+
+## Using it
+
+1. **Add an account** — click `+` next to a provider in the left rail, name it, then choose *Log in*
+   or *Create a new account*. The service's real page opens inside that account's isolated session.
+2. **Sign in normally.** Use email/password or GitHub. Avoid "Continue with Google": Google blocks
+   sign-in inside embedded browsers, so use the **Browser** button to finish that flow in your system
+   browser instead.
+3. **Switch accounts** by clicking a tab or a rail row. Everything stays signed in.
+4. **Connect a token** (optional) via the link icon on any account to light up its status card.
+5. **Import passwords** (optional) from Home → *Import from browser* or *Import CSV*.
+
+### Multiple accounts and provider terms
+
+The app surfaces each provider's stance instead of hiding it. GitHub and Railway allow one account
+per person and the rail says so — use their organisations and workspaces instead. Vercel, Netlify,
+Supabase and Cloudflare tolerate separate accounts but watch for abuse. Account creation is always
+manual and guided; nothing is ever automated, because automated signup violates several providers'
+acceptable-use policies.
+
+---
+
+## How it works
+
+Each account is a `persist:<service>__<account>` Chromium partition rendered in its own
+`WebContentsView`. The app window composes those views beside a native rail and tab strip, so the
+chrome is always reachable. Account pages run sandboxed with context isolation, deny-by-default
+permissions, and an isolated-world preload that handles login capture and filling without exposing
+anything to the page.
+
+State lives in your user-data folder: `accounts.json` (the registry), `session.json` (open tabs),
+`settings.json`, `services.json` (custom services), `plugins/`, plus DPAPI-encrypted `tokens.json`
+and `credentials.json`.
+
+### Security posture, honestly
+
+Cookies, tokens and saved passwords are encrypted at rest with Windows DPAPI, which protects against
+another user on the machine, a stolen disk, and casual copying. It does **not** protect against
+malware running as you — no desktop app can, which is why the app never masks device identity and
+keeps API tokens scoped and revocable. Saved logins are additionally bound to the service's own origins,
+so they cannot be captured from — or filled into — an unrelated site. Nothing syncs anywhere: there is
+no server, no account and no telemetry.
+
+---
+
+## Development
+
+```bash
+npm start            # run the app
+npm run smoke        # sessions, registry, partitions
+npm run smoke:restore# sessions survive a restart (real cookies)
+npm run smoke:tokens # DPAPI round-trip + live token rejection
+npm run smoke:creds  # import, per-account recall, encryption at rest
+npm run smoke:autofill # real page: form detection, fill, capture
+npm run smoke:updates  # version comparison + real release-feed check
+npm run capture      # screenshot the running shell
+npm run spike        # memory benchmark
+npm run dist         # build the Windows installer
+npm run install:latest # fetch and run the latest released installer
+npm start -- --print-paths   # show the app name, version and data folder
+npm start -- --open vercel::personal  # open an account on launch
+```
+
+The suite is 35 checks across five modes.
+
+`MAM_USER_DATA=<dir>` points any command at an isolated profile.
+
+Releases are cut by pushing a `v*` tag: GitHub Actions builds the NSIS installer, uploads it with the
+update feed, and publishes the release.
+
+## Licence
+
+Source-available, © 2026 FiredMosquito831 — see [LICENSE](LICENSE).
+
+**Free to use, personally and commercially.** You may not modify or redistribute changed versions, or
+present the work as your own. If you mention the app anywhere, credit the author and link this repo:
+
+> My Provider Dash Manager by FiredMosquito831 —
+> https://github.com/FiredMosquito831/my-provider-dash-manager

package/package.json

@@ -0,0 +1,93 @@
+{
+  "name": "my-provider-dash-manager",
+  "version": "0.2.8",
+  "description": "Manage many accounts per cloud service (Vercel, Netlify, Supabase, Cloudflare, Railway, Render, GitHub) in one desktop app \u2014 isolated persistent sessions, one tab per account.",
+  "main": "src/main.js",
+  "scripts": {
+    "start": "electron .",
+    "spike": "electron . --spike",
+    "smoke": "electron . --smoke",
+    "smoke:restore": "electron . --smoke-restore",
+    "smoke:tokens": "electron . --smoke-tokens",
+    "capture": "electron . --capture",
+    "dist": "electron-builder --win",
+    "smoke:creds": "electron . --smoke-creds",
+    "smoke:autofill": "electron . --smoke-autofill",
+    "internal:save": "git --git-dir=.internal-git --work-tree=. add -f CLAUDE.md docs/WORKING-NOTES.md && git --git-dir=.internal-git --work-tree=. commit -m \"internal notes snapshot\"",
+    "internal:log": "git --git-dir=.internal-git --work-tree=. log --oneline",
+    "smoke:updates": "electron . --smoke-updates",
+    "install:latest": "node scripts/install-latest.js"
+  },
+  "devDependencies": {
+    "electron": "^43.0.0",
+    "electron-builder": "^26.0.0"
+  },
+  "dependencies": {
+    "electron-updater": "^6.6.0"
+  },
+  "build": {
+    "appId": "com.firedmosquito.my-provider-dash-manager",
+    "productName": "My Provider Dash Manager",
+    "files": [
+      "src/**/*",
+      "package.json"
+    ],
+    "win": {
+      "target": [
+        "nsis"
+      ]
+    },
+    "nsis": {
+      "oneClick": false,
+      "allowToChangeInstallationDirectory": true
+    },
+    "publish": {
+      "provider": "github",
+      "owner": "FiredMosquito831",
+      "repo": "my-provider-dash-manager"
+    },
+    "artifactName": "My-Provider-Dash-Manager-Setup-${version}.${ext}"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "bin": {
+    "my-provider-dash-manager": "scripts/install-latest.js"
+  },
+  "files": [
+    "scripts/install-latest.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/FiredMosquito831/my-provider-dash-manager.git"
+  },
+  "homepage": "https://github.com/FiredMosquito831/my-provider-dash-manager",
+  "bugs": {
+    "url": "https://github.com/FiredMosquito831/my-provider-dash-manager/issues"
+  },
+  "author": "FiredMosquito831",
+  "keywords": [
+    "multi-account",
+    "account-manager",
+    "vercel",
+    "netlify",
+    "supabase",
+    "cloudflare",
+    "railway",
+    "render",
+    "github",
+    "electron",
+    "dashboard",
+    "sessions",
+    "windows"
+  ],
+  "os": [
+    "win32"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}

package/scripts/install-latest.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+// Fetch the latest published release and run its installer.
+//
+//   npm run install:latest              download + launch the installer
+//   npm run install:latest -- --silent  install without the wizard UI
+//   npm run install:latest -- --download-only
+//
+// Auth: the repository is private, so a token is required — GH_TOKEN/GITHUB_TOKEN from the
+// environment, or whatever `gh auth token` returns. Making the repo public removes that need.
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const https = require('https');
+const { execFileSync, spawn } = require('child_process');
+
+const REPO = 'FiredMosquito831/my-provider-dash-manager';
+const args = process.argv.slice(2);
+const silent = args.includes('--silent');
+const downloadOnly = args.includes('--download-only');
+
+function token() {
+  if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
+  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
+  try { return execFileSync('gh', ['auth', 'token'], { encoding: 'utf8' }).trim(); } catch { return null; }
+}
+
+// accept: 'application/vnd.github+json' for API calls, 'application/octet-stream' for asset bytes.
+// Without the octet-stream Accept, the asset endpoint returns JSON metadata instead of the file.
+function get(url, tok, accept = 'application/vnd.github+json', redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const headers = { 'User-Agent': 'my-provider-dash-manager-installer', Accept: accept };
+    if (tok) headers.Authorization = `Bearer ${tok}`;
+    https.get(url, { headers }, res => {
+      if ([301, 302, 307, 308].includes(res.statusCode) && res.headers.location) {
+        if (redirects > 5) return reject(new Error('too many redirects'));
+        res.resume();
+        // S3 asset redirects reject an Authorization header, so drop it after the first hop
+        return resolve(get(res.headers.location, null, accept, redirects + 1));
+      }
+      resolve(res);
+    }).on('error', reject);
+  });
+}
+
+async function json(url, tok) {
+  const res = await get(url, tok);
+  const body = await new Promise((resolve, reject) => {
+    let d = ''; res.setEncoding('utf8');
+    res.on('data', c => { d += c; }); res.on('end', () => resolve(d)); res.on('error', reject);
+  });
+  if (res.statusCode === 404) throw new Error('Release not found. The repo is private — set GH_TOKEN or run `gh auth login`.');
+  if (res.statusCode === 401 || res.statusCode === 403) throw new Error('GitHub rejected the token (needs read access to this repo).');
+  if (res.statusCode >= 400) throw new Error(`GitHub API returned HTTP ${res.statusCode}`);
+  return JSON.parse(body);
+}
+
+function download(url, tok, dest, size) {
+  return new Promise(async (resolve, reject) => {
+    const res = await get(url, tok, 'application/octet-stream');
+    if (res.statusCode >= 400) return reject(new Error(`download failed: HTTP ${res.statusCode}`));
+    const out = fs.createWriteStream(dest);
+    let done = 0; let lastPct = -1;
+    res.on('data', c => {
+      done += c.length;
+      if (size) {
+        const pct = Math.floor((done / size) * 100);
+        if (pct !== lastPct && pct % 5 === 0) { lastPct = pct; process.stdout.write(`\r  downloading… ${pct}%`); }
+      }
+    });
+    res.pipe(out);
+    out.on('finish', () => { process.stdout.write('\r  downloading… 100%\n'); out.close(() => resolve(dest)); });
+    out.on('error', reject);
+    res.on('error', reject);
+  });
+}
+
+(async () => {
+  const tok = token();
+  if (!tok) console.warn('! No GitHub token found (GH_TOKEN or `gh auth login`) — this will fail while the repo is private.\n');
+
+  console.log(`Looking up the latest release of ${REPO}…`);
+  const rel = await json(`https://api.github.com/repos/${REPO}/releases/latest`, tok);
+  const version = String(rel.tag_name || '').replace(/^v/, '');
+  const asset = (rel.assets || []).find(a => a.name.endsWith('.exe'));
+  if (!asset) throw new Error(`Release ${rel.tag_name} has no .exe asset.`);
+
+  let installed = null;
+  try { installed = require('../package.json').version; } catch {}
+  console.log(`  latest: ${version}${installed ? `   (this checkout: ${installed})` : ''}`);
+  if (rel.body) console.log(`\n${String(rel.body).trim().split('\n').slice(0, 12).join('\n')}\n`);
+
+  const dest = path.join(os.tmpdir(), asset.name);
+  console.log(`Downloading ${asset.name} (${(asset.size / 1048576).toFixed(1)} MB)…`);
+  await download(asset.url, tok, dest, asset.size); // .url (not browser_download_url) works for private repos
+
+  // Never hand a non-executable to spawn(): the asset endpoint returns JSON metadata unless the
+  // request asks for octet-stream, and that failure is otherwise silent.
+  const stat = fs.statSync(dest);
+  const head = Buffer.alloc(2);
+  const fd = fs.openSync(dest, 'r'); fs.readSync(fd, head, 0, 2, 0); fs.closeSync(fd);
+  if (head.toString('latin1') !== 'MZ') throw new Error(`downloaded file is not a Windows executable (${stat.size} bytes)`);
+  if (asset.size && stat.size !== asset.size) throw new Error(`size mismatch: expected ${asset.size} bytes, got ${stat.size}`);
+  console.log(`  verified: ${(stat.size / 1048576).toFixed(1)} MB Windows executable`);
+
+  if (downloadOnly) { console.log(`\nSaved to ${dest}`); return; }
+
+  console.log(`\nLaunching the installer${silent ? ' (silent)' : ''}…`);
+  const child = spawn(dest, silent ? ['/S'] : [], { detached: true, stdio: 'ignore', shell: false });
+  child.unref();
+  console.log('The installer is running. It is unsigned, so SmartScreen may ask you to confirm.');
+})().catch(err => {
+  console.error(`\nFailed: ${err.message}`);
+  process.exit(1);
+});