my-provider-dash-manager 0.4.1 → 0.5.0

package/README.md

@@ -1,10 +1,9 @@
 # My Provider Dash Manager
 
-**One desktop app for every cloud account you own.** Keep several Vercel, Netlify, Cloudflare,
-Railway, Render, Fly.io, Heroku, DigitalOcean, Supabase, Neon, GitHub, GitLab, npm, PyPI, Docker Hub,
-Hugging Face and Stripe accounts signed in at the same time, each in a fully isolated session, and
-switch between them instantly — the way a browser handles tabs, but built around *accounts* instead
-of pages.
+**One desktop app for every account you own.** Keep several Google, Microsoft, AWS, Vercel,
+Netlify, Cloudflare, Supabase, GitHub, npm, Stripe, Gmail, Outlook, Proton Mail (and 25 more) accounts
+signed in at the same time, each in a fully isolated session, and switch between them instantly — the
+way a browser handles tabs, but built around *accounts* instead of pages.
 
 <sub>Windows desktop app · Electron 43 · local-first · no telemetry, no account, no server ·
 source-available licence: free for personal and commercial use</sub>
@@ -141,11 +140,26 @@ sessions, one place.
   account's login, and a saved password is never filled into a page outside the service's domains.
 
 ### Built-in services
-Seventeen services ship ready to use, grouped in the rail: **hosting** (Vercel, Netlify, Cloudflare,
-Railway, Render, Fly.io, Heroku, DigitalOcean), **data** (Supabase, Neon), **code and packages**
-(GitHub, GitLab, npm, PyPI, Docker Hub, Hugging Face) and **payments** (Stripe). Every login page is
-verified to load inside an isolated partition by `npm run smoke:services`. Anything else can be added
-by URL or as a plugin (below).
+Thirty-seven services ship ready to use, grouped by category. The rail and Home show only the ones
+you have accounts on; everything else sits one click away behind **Add account**, a searchable picker.
+
+| Category | Services |
+|---|---|
+| Hosting & deploy | Vercel, Netlify, Cloudflare, Railway, Render, Fly.io, Heroku, DigitalOcean |
+| Databases | Supabase, Neon |
+| Code & packages | GitHub, GitLab, npm, PyPI, Docker Hub, Hugging Face |
+| Payments | Stripe |
+| Google | Google Account, Gmail, Google Cloud, Firebase, Google Workspace Admin, Google Play Console, Google AI Studio |
+| Microsoft | Microsoft Account, Outlook, Azure, Microsoft 365 Admin |
+| Mail | Proton Mail, Zoho Mail, Fastmail, Yahoo Mail, Tuta Mail, iCloud Mail |
+| Cloud | AWS |
+| AI | OpenAI Platform, Claude Platform (Anthropic) |
+
+Every login page is verified to load inside an isolated partition, landing on a host the credential
+guard trusts, by `npm run smoke:services`. Google sign-in works directly in the app (verified against
+Google's own sign-in flow); "Continue with Google" buttons on *other* sites remain blocked by Google
+in embedded browsers, so use email/password or GitHub there. Anything else can be added by URL or as
+a plugin (below).
 
 ### API status
 Paste a read-only API token into an account and its Home card shows live status — project, app,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-provider-dash-manager",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Manage many accounts per cloud service (Vercel, Netlify, Supabase, Cloudflare, Railway, Render, GitHub) in one desktop app \u2014 isolated persistent sessions, one tab per account.",
   "main": "src/main.js",
   "scripts": {

package/src/main.js

@@ -58,8 +58,12 @@ function userData(name) { return userDataPath(name); }
 // Built-in curated services + user-added generic ones (Phase 2) + plugin manifests (Phase 3).
 let pluginServices = [];
 let pluginErrors = [];
+// Sign-in infrastructure the managed services depend on but that is not a credential host: the
+// ad-blocker must leave these alone (EasyList rules hit e.g. accounts.youtube.com/CheckConnection,
+// which Google sign-in loads in an iframe). This list grants NO password trust — see serviceHosts.
+const AUTH_INFRA_HOSTS = ['accounts.youtube.com', 'accounts.google.com', 'gstatic.com', 'login.microsoftonline.com', 'login.live.com', 'msftauth.net', 'msauth.net', 'appleid.cdn-apple.com'];
 function refreshManagedHosts() {
-  const hosts = new Set();
+  const hosts = new Set(AUTH_INFRA_HOSTS);
   for (const s of allServices()) for (const h of serviceHosts(s.key)) hosts.add(h);
   content.setManagedHosts([...hosts]);
 }
@@ -266,8 +270,12 @@ class ViewManager {
     });
     const onNav = (_e, url2) => {
       tab.url = url2;
-      // conservative sign-in heuristic: sitting on the service's login page means not signed in
-      tab.lastState = url2.startsWith(service.loginUrl) ? 'signin' : 'ok';
+      // conservative sign-in heuristic: sitting on the service's login page means not signed in.
+      // When the service authenticates on a separate host (accounts.google.com, login.live.com,
+      // id.heroku.com…) any URL on that host counts as "signing in".
+      const loginHost = creds.hostOf(service.loginUrl);
+      const onAuthHost = loginHost && loginHost !== creds.hostOf(service.dashboardUrl) && creds.hostOf(url2) === loginHost;
+      tab.lastState = (url2.startsWith(service.loginUrl) || onAuthHost) ? 'signin' : 'ok';
       const a = findAccount(svc, id);
       if (a) { a.lastState = tab.lastState; store.save(); }
       this.emitState();
@@ -609,8 +617,9 @@ async function runSmokeServices() {
   const check = (name, ok, detail = '') => { results.checks.push({ name, ok, detail }); console.log(`[smoke:services] ${ok ? 'PASS' : 'FAIL'} ${name} ${detail}`); };
   const keys = SERVICES.map(s => s.key);
   check('unique-keys', new Set(keys).size === keys.length, `${keys.length} services`);
-  check('definitions-complete', SERVICES.every(s => s.name && /^https:\/\//.test(s.dashboardUrl) && /^https:\/\//.test(s.loginUrl) && /^https:\/\//.test(s.signupUrl) && /^#[0-9a-f]{6}$/i.test(s.color) && ['ok', 'warn', 'one-per-person'].includes(s.multiAccountPolicy)));
+  check('definitions-complete', SERVICES.every(s => s.name && /^https:\/\//.test(s.dashboardUrl) && /^https:\/\//.test(s.loginUrl) && /^https:\/\//.test(s.signupUrl) && /^#[0-9a-f]{6}$/i.test(s.color) && ['ok', 'warn', 'one-per-person'].includes(s.multiAccountPolicy) && typeof s.category === 'string' && s.category));
   check('partition-ids-safe', SERVICES.every(s => /^[a-z0-9_-]+$/.test(s.key)), keys.join(','));
+  check('extra-hosts-are-specific', SERVICES.every(s => (s.extraHosts || []).every(h => /^[a-z0-9.-]+\.[a-z]+$/.test(h) && h.split('.').length >= 3)));
   check('extra-hosts-in-guard', serviceHosts('dockerhub').includes('login.docker.com') && originAllowed('dockerhub', 'https://login.docker.com/u/login?x=1') && !originAllowed('dockerhub', 'https://evil.example/'));
 
   const win = new BaseWindow({ width: 1280, height: 800, show: false });