my-provider-dash-manager 0.6.0 → 0.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +130 -136
  2. package/package.json +1 -1
package/README.md CHANGED
@@ -1,41 +1,60 @@
1
1
  # My Provider Dash Manager
2
2
 
3
- **One desktop app for every account you own.** Keep several Google, Microsoft, AWS, Vercel,
4
- Netlify, Cloudflare, Supabase, GitHub, npm, Stripe, Gmail, Outlook, Proton Mail (and 25 more) accounts
5
- signed in at the same time, each in a fully isolated session, and switch between them instantly — the
6
- way a browser handles tabs, but built around *accounts* instead of pages.
3
+ **One desktop app for every account you own.** Keep several Google, Microsoft, AWS, Vercel, Netlify,
4
+ Cloudflare, Supabase, GitHub, npm, Stripe, Gmail, Outlook and Proton Mail accounts (37 services built
5
+ in, any site by URL) signed in at the same time, each in a fully isolated session, and switch between
6
+ them instantly — the way a browser handles tabs, but built around *accounts* instead of pages.
7
7
 
8
8
  <sub>Windows desktop app · Electron 43 · local-first · no telemetry, no account, no server ·
9
9
  source-available licence: free for personal and commercial use</sub>
10
10
 
11
+ ![Home — the account rail on the left, every account as a card, the installed version bottom-left](docs/screenshots/home.png)
12
+
13
+ ![A Gmail account open in the app, with back / forward / reload / dashboard and the address bar in the strip](docs/screenshots/navigation.png)
14
+
15
+ <sub>Screenshots use a demo profile with placeholder account names.</sub>
16
+
11
17
  ---
12
18
 
13
19
  ## Install
14
20
 
15
- Download the latest installer from
21
+ **Fastest — from the command line** (needs Node.js 18+):
22
+
23
+ ```bash
24
+ npx my-provider-dash-manager
25
+ ```
26
+
27
+ That downloads the newest installer from GitHub, verifies it is a real Windows executable, runs it,
28
+ and launches the app. Run the same command again later to update.
29
+
30
+ **Or download the installer** from
16
31
  [Releases](https://github.com/FiredMosquito831/my-provider-dash-manager/releases) and run it.
17
32
 
18
- The installer is not code-signed yet, so SmartScreen shows a warning: choose **More info → Run
19
- anyway**.
33
+ The installer is not code-signed yet, so SmartScreen shows a warning the first time: choose
34
+ **More info → Run anyway**. The app installs per user under `%LOCALAPPDATA%\Programs` and creates
35
+ Start Menu and Desktop shortcuts. Your accounts, sessions and saved logins live in
36
+ `%APPDATA%\multi-acc-manager` and survive updates and reinstalls.
20
37
 
21
- ### Updates
38
+ ### Updating
22
39
 
23
- The Home screen has an **Updates** panel: it shows your installed version, the latest release, the
24
- release notes, and gives you *Check for updates*, *Download*, and *Restart & install* buttons with
25
- download progress. Nothing is downloaded or installed without you pressing the button, and the app
26
- checks quietly on startup and once an hour after that.
40
+ Three ways, all ending in the same place:
27
41
 
28
- The repository is public, so updates need no setup. (If you ever fork this into a private repo, the
29
- panel lets you store a GitHub token, encrypted with Windows DPAPI, so the feed stays readable.)
42
+ - **Inside the app.** The version is always shown bottom-left in the rail. When a newer release
43
+ exists it turns into an **Update x.y.z** button; click it to open the Updates panel on Home, which
44
+ shows the release notes and offers **Download** and **Restart & install** with progress. The app
45
+ checks quietly on startup and once an hour after that. Nothing is downloaded or installed until you
46
+ press the button.
47
+ - **From the command line.** `npx my-provider-dash-manager` (or `mpdm update` if installed globally)
48
+ installs the newest release over the current one. Close the app first, or the running copy keeps
49
+ showing the old version until you restart it.
50
+ - **From the release page.** Run the newest installer; it upgrades in place.
30
51
 
31
- ### Install from the command line
52
+ The repository is public, so updates need no token or account.
32
53
 
33
- ```bash
34
- npx my-provider-dash-manager # install (or update) and launch
35
- ```
54
+ ### The CLI
36
55
 
37
- The same CLI manages the whole lifecycle — install it globally with
38
- `npm i -g my-provider-dash-manager` and the commands are also available as `mpdm`:
56
+ The npm package is a small lifecycle CLI. Install it globally with `npm i -g my-provider-dash-manager`
57
+ and it is also available as `mpdm`:
39
58
 
40
59
  | Command | What it does |
41
60
  |---|---|
@@ -44,14 +63,11 @@ The same CLI manages the whole lifecycle — install it globally with
44
63
  | `… start` | Launch the installed app |
45
64
  | `… status` | Installed version vs latest, plus where the app and your data live |
46
65
  | `… where` | Print the install and data paths |
47
- | `… uninstall` | Run the uninstaller (your accounts and sessions are kept) |
66
+ | `… uninstall` | Run the uninstaller (accounts and sessions are kept) |
48
67
 
49
68
  Flags: `--silent` (no wizard), `--download-only`, `--force`, `--version`, `--help`.
50
69
  From a checkout of this repository the equivalent is `npm run install:latest`.
51
70
 
52
- It prints the latest version and its release notes and verifies the download really is a Windows
53
- executable before running it. No authentication is needed; a `GH_TOKEN` is used only if present.
54
-
55
71
  ### Run from source
56
72
 
57
73
  ```bash
@@ -61,40 +77,10 @@ npm start
61
77
 
62
78
  ---
63
79
 
64
- ## What it looks like
65
-
66
- **Home — every service and account in one grid, with the account rail on the left.**
67
- Each provider lists its accounts; hovering one reveals open / sleep / close / fill-login / connect-token / manage.
68
-
69
- ![Home screen](docs/screenshots/home.png)
70
-
71
- **A real dashboard, signed in, inside the app.** The rail and tab strip stay put, so Home is always one click away.
72
-
73
- ![A dashboard open in the app](docs/screenshots/dashboard.png)
74
-
75
- Browser controls appear in the strip while a tab is open: back, forward, reload, dashboard, and an
76
- address bar that navigates inside that account's own session.
77
-
78
- ![Navigation bar with a Gmail sign-in open](docs/screenshots/navigation.png)
79
-
80
- **The top bar is only your open tabs** — filter them, or group them by provider with collapsible sections.
81
- Slept tabs stay in the strip (dimmed) and resume on click.
82
-
83
- ![Tabs grouped by provider](docs/screenshots/tabs-grouped.png)
84
-
85
- **Updates and saved logins live on Home**: installed vs latest version with release notes and an update
86
- button, plus login remembering, auto-fill and password import.
87
-
88
- ![Updates and saved logins](docs/screenshots/settings.png)
89
-
90
- <sub>Screenshots use a demo profile with placeholder account names.</sub>
91
-
92
- ---
93
-
94
80
  ## Why it exists
95
81
 
96
- Every cloud provider assumes you have exactly one identity. The moment you have a personal account
97
- and a client account on the same service, the browser fights you:
82
+ Every provider assumes you have exactly one identity. The moment you have a personal account and a
83
+ client account on the same service, the browser fights you:
98
84
 
99
85
  | The usual pain | What this app does |
100
86
  |---|---|
@@ -110,6 +96,27 @@ sessions, one place.
110
96
 
111
97
  ---
112
98
 
99
+ ## Using it
100
+
101
+ 1. **Add an account.** Click **Add account** at the bottom of the rail (or the `+` next to a provider
102
+ you already use), pick the service from the searchable picker, name the account, then choose
103
+ *Log in* or *Create a new account*. The service's real sign-in page opens inside that account's own
104
+ isolated session.
105
+ 2. **Sign in normally.** Google services sign in directly. On other sites use email/password or
106
+ GitHub rather than "Continue with Google", which Google blocks inside embedded browsers; the
107
+ **Browser** button finishes any stubborn flow in your system browser.
108
+ 3. **Switch accounts** by clicking a tab or a rail row. Everything stays signed in.
109
+ 4. **Browse.** While a tab is open the strip shows back, forward, reload, a back-to-dashboard button
110
+ and an address bar. Type any address and press Enter to open it inside that account's session.
111
+ 5. **Connect a token** (optional) via the link icon on an account to light up its status card.
112
+ 6. **Import passwords** (optional) from Home → *Import from browser* or *Import CSV*.
113
+
114
+ Keyboard: `Ctrl+W` sleep tab · `Ctrl+Shift+W` sleep all · `Ctrl+Tab` cycle · `Ctrl+1…9` jump ·
115
+ `Esc` Home · `Alt+Left` / `Alt+Right` back / forward · `Ctrl+R` or `F5` reload · `Alt+Home` dashboard
116
+ · `Ctrl+L` address bar.
117
+
118
+ ---
119
+
113
120
  ## Features
114
121
 
115
122
  ### Accounts and sessions
@@ -120,36 +127,25 @@ sessions, one place.
120
127
  - **Instant switching.** Active tabs stay warm, so switching is a visibility toggle, not a reload.
121
128
  - **Warm-tab limit with sleeping.** Each live dashboard costs roughly 125 MB, so the app keeps a
122
129
  configurable number warm (default 5) and sleeps the rest. Slept tabs stay in the strip and resume on
123
- click, and sleeping returns the app to about 350 MB. Measured: 5 tabs ≈ 1.0 GB, 10 ≈ 1.6 GB, all
124
- slept ≈ 0.35 GB (private memory, the figure Task Manager reports).
130
+ click. Measured: 5 tabs ≈ 1.0 GB, 10 ≈ 1.6 GB, all slept ≈ 0.35 GB (private memory, the figure Task
131
+ Manager reports).
125
132
  - **Tab session memory.** The set of open tabs is saved and restored on the next launch: recent ones
126
- come back warm, the rest asleep, and you land on the Home grid.
133
+ come back warm, the rest asleep, and you land on Home.
127
134
  - **Per-account proxy** (optional) with proper connection flushing.
128
135
 
129
- ### Layout
130
- - **Left rail — your identities.** Providers listed vertically, accounts nested underneath, each with
131
- hover actions: open, sleep, close, fill login, connect an API token, manage. Collapse any provider.
132
- - **Top bar — open tabs only.** A filter box and a group-by-provider toggle with collapsible groups.
133
- - **Home** is always one click (or `Esc`) away: a grid of every service and account with live status.
134
- - **Browser controls** while a tab is open: back, forward, reload/stop, back-to-dashboard, and an
135
- editable address bar that navigates inside that account's own session (http/https only).
136
- - Keyboard: `Ctrl+W` sleep, `Ctrl+Shift+W` sleep all, `Ctrl+Tab` cycle, `Ctrl+1…9` jump,
137
- `Alt+Left`/`Alt+Right` back/forward, `Ctrl+R`/`F5` reload, `Alt+Home` dashboard, `Ctrl+L` address.
138
-
139
- ### Saved logins
140
- - **Remembers logins you type** inside an account tab, bound to *that* account, so two accounts on the
141
- same service refill with different credentials.
142
- - **Auto-fills sign-in pages** when it recognises one (toggleable), plus a manual fill action.
143
- - **Imports existing passwords** from installed Chromium browsers (Chrome, Edge, Brave, Vivaldi,
144
- Opera) or from a CSV exported by any browser, including Firefox.
145
- - Everything is encrypted at rest with Windows DPAPI. Passwords never reach the app's own UI process.
146
- - **Origin-bound**: a login is tied to the account *and* the service's own domains. A password typed on
147
- another site reached from that tab (an OAuth hand-off, a look-alike page) is never captured as that
148
- account's login, and a saved password is never filled into a page outside the service's domains.
136
+ ### Layout and browsing
137
+ - **Left rail — your identities.** Providers you use, accounts nested underneath, each with hover
138
+ actions: open, sleep, close, fill login, connect a token, manage. Collapse any provider. The
139
+ installed version (or an update button) sits at the bottom.
140
+ - **Top bar — open tabs only,** with a filter box and group-by-provider with collapsible groups.
141
+ - **Home** is always one click (or `Esc`) away: every account as a card with live status, the service
142
+ picker, the Updates panel and saved-login settings.
143
+ - **Browser controls** while a tab is open: back, forward, reload/stop, back-to-dashboard and an
144
+ editable address bar. Navigation stays inside that account's session and accepts http/https only.
149
145
 
150
146
  ### Built-in services
151
147
  Thirty-seven services ship ready to use, grouped by category. The rail and Home show only the ones
152
- you have accounts on; everything else sits one click away behind **Add account**, a searchable picker.
148
+ you have accounts on; everything else is one click away in the **Add account** picker.
153
149
 
154
150
  | Category | Services |
155
151
  |---|---|
@@ -164,22 +160,37 @@ you have accounts on; everything else sits one click away behind **Add account**
164
160
  | AI | OpenAI Platform, Claude Platform (Anthropic) |
165
161
 
166
162
  Every login page is verified to load inside an isolated partition, landing on a host the credential
167
- guard trusts, by `npm run smoke:services`. Google sign-in works directly in the app (verified against
168
- Google's own sign-in flow); "Continue with Google" buttons on *other* sites remain blocked by Google
169
- in embedded browsers, so use email/password or GitHub there. Anything else can be added by URL or as
170
- a plugin (below).
163
+ guard trusts (`npm run smoke:services`). Google sign-in was verified against Google's own flow and
164
+ works in the app. Anything else can be added by URL or as a plugin.
165
+
166
+ ### Saved logins
167
+ - **Remembers logins you type** inside an account tab, bound to *that* account, so two accounts on the
168
+ same service refill with different credentials.
169
+ - **Auto-fills sign-in pages** when it recognises one (toggleable), plus a manual fill action.
170
+ - **Imports existing passwords** from installed Chromium browsers (Chrome, Edge, Brave, Vivaldi,
171
+ Opera) or from a CSV exported by any browser, including Firefox.
172
+ - Encrypted at rest with Windows DPAPI. Passwords never reach the app's own UI process.
173
+ - **Origin-bound**: a login is tied to the account *and* the service's own domains. A password typed on
174
+ another site reached from that tab (an OAuth hand-off, a look-alike page) is never captured as that
175
+ account's login, and a saved password is never filled into a page outside the service's domains.
171
176
 
172
177
  ### API status
173
- Paste a read-only API token into an account and its Home card shows live status — project, app,
174
- repository or package counts and names for every built-in service except PyPI (whose tokens are
175
- upload-only), latest deploy state on Vercel, and account name plus charges/payouts state on Stripe.
176
- The token field tells you which kind of credential each service expects (Docker Hub needs
177
- `username:token`). Tokens are validated before being stored, encrypted with DPAPI, revocable in one
178
- click, and never leave the main process.
178
+ Paste a read-only API token into an account and its Home card shows live status: project, app,
179
+ repository or package counts and names for every built-in developer service except PyPI (whose tokens
180
+ are upload-only), latest deploy state on Vercel, account name plus charges/payouts state on Stripe.
181
+ The token field says which credential each service expects. Tokens are validated before being stored,
182
+ encrypted with DPAPI, revocable in one click, and never leave the main process.
183
+
184
+ ### Updates
185
+ - Version always visible in the rail; an **Update** button appears when a newer release exists.
186
+ - Updates panel on Home: installed vs latest, release notes, Check / Download / Restart & install with
187
+ progress. Nothing installs itself.
188
+ - Startup and hourly checks against the public release feed.
179
189
 
180
190
  ### Content
181
191
  - **Ad-blocking** driven by EasyList (~52,000 blocked hosts plus generic cosmetic rules, refreshed
182
- weekly) applied per account partition. Main-frame navigation is never blocked.
192
+ weekly), applied per account partition. Main-frame navigation and sign-in infrastructure are never
193
+ blocked.
183
194
  - **Dark mode**: sites that support `prefers-color-scheme` go dark natively, and an optional
184
195
  force-dark inversion covers the ones that don't.
185
196
 
@@ -188,30 +199,13 @@ click, and never leave the main process.
188
199
  - **Service plugins**: drop a small JSON manifest into `plugins/` (or install it from the UI) to
189
200
  define a service and, optionally, how to read its API for status cards.
190
201
 
191
- ---
192
-
193
- ---
194
-
195
- ## Using it
196
-
197
- 1. **Add an account** — click `+` next to a provider in the left rail, name it, then choose *Log in*
198
- or *Create a new account*. The service's real page opens inside that account's isolated session.
199
- 2. **Sign in normally.** Use email/password or GitHub. Avoid "Continue with Google": Google blocks
200
- sign-in inside embedded browsers, so use the **Browser** button to finish that flow in your system
201
- browser instead.
202
- 3. **Switch accounts** by clicking a tab or a rail row. Everything stays signed in.
203
- 4. **Connect a token** (optional) via the link icon on any account to light up its status card.
204
- 5. **Import passwords** (optional) from Home → *Import from browser* or *Import CSV*.
205
-
206
202
  ### Multiple accounts and provider terms
207
-
208
- The app surfaces each provider's stance instead of hiding it. GitHub and Railway allow one account
209
- per person and the rail says so — use their organisations and workspaces instead. Vercel, Netlify,
203
+ The app surfaces each provider's stance instead of hiding it. GitHub and Railway allow one account per
204
+ person and the rail says so — use their organisations and workspaces instead. Vercel, Netlify,
210
205
  Supabase, Cloudflare, Heroku and DigitalOcean tolerate separate accounts but watch for abuse; the
211
- registries (npm, PyPI, Docker Hub, Hugging Face), GitLab, Fly.io, Neon and Stripe treat extra accounts
212
- as ordinary (Stripe expects one per business). Account creation is always
213
- manual and guided; nothing is ever automated, because automated signup violates several providers'
214
- acceptable-use policies.
206
+ registries, GitLab, Fly.io, Neon, Google, Microsoft and the mail providers treat extra accounts as
207
+ ordinary; Stripe expects one per business. Account creation is always manual and guided; nothing is
208
+ ever automated, because automated signup violates several providers' acceptable-use policies.
215
209
 
216
210
  ---
217
211
 
@@ -223,46 +217,46 @@ chrome is always reachable. Account pages run sandboxed with context isolation,
223
217
  permissions, and an isolated-world preload that handles login capture and filling without exposing
224
218
  anything to the page.
225
219
 
226
- State lives in your user-data folder: `accounts.json` (the registry), `session.json` (open tabs),
227
- `settings.json`, `services.json` (custom services), `plugins/`, plus DPAPI-encrypted `tokens.json`
228
- and `credentials.json`.
220
+ State lives in `%APPDATA%\multi-acc-manager`: `accounts.json` (the registry), `session.json` (open
221
+ tabs), `settings.json`, `services.json` (custom services), `plugins/`, plus DPAPI-encrypted
222
+ `tokens.json` and `credentials.json`.
229
223
 
230
224
  ### Security posture, honestly
231
225
 
232
226
  Cookies, tokens and saved passwords are encrypted at rest with Windows DPAPI, which protects against
233
227
  another user on the machine, a stolen disk, and casual copying. It does **not** protect against
234
228
  malware running as you — no desktop app can, which is why the app never masks device identity and
235
- keeps API tokens scoped and revocable. Saved logins are additionally bound to the service's own origins,
236
- so they cannot be captured from — or filled into — an unrelated site. Nothing syncs anywhere: there is
237
- no server, no account and no telemetry.
229
+ keeps API tokens scoped and revocable. Saved logins are additionally bound to the service's own
230
+ origins, so they cannot be captured from, or filled into, an unrelated site. The address bar accepts
231
+ http/https only. Nothing syncs anywhere: there is no server, no account and no telemetry.
238
232
 
239
233
  ---
240
234
 
241
235
  ## Development
242
236
 
243
237
  ```bash
244
- npm start # run the app
245
- npm run smoke # sessions, registry, partitions
246
- npm run smoke:restore# sessions survive a restart (real cookies)
247
- npm run smoke:tokens # DPAPI round-trip + live token rejection
248
- npm run smoke:creds # import, per-account recall, encryption at rest
249
- npm run smoke:autofill # real page: form detection, fill, capture
250
- npm run smoke:updates # version comparison + real release-feed check
251
- npm run smoke:services # every built-in login page loads inside an isolated partition
252
- npm run capture # screenshot the running shell
253
- npm run spike # memory benchmark
254
- npm run dist # build the Windows installer
238
+ npm start # run the app
239
+ npm run smoke # sessions, registry, partitions, tab navigation (12 checks)
240
+ npm run smoke:restore # sessions survive a restart (real cookies)
241
+ npm run smoke:tokens # DPAPI round-trip + live fake-token rejection per provider (15)
242
+ npm run smoke:creds # import, per-account recall, encryption at rest (7)
243
+ npm run smoke:autofill # real page: form detection, fill, capture, origin guard (10)
244
+ npm run smoke:updates # version comparison + real release-feed check (8)
245
+ npm run smoke:services # every built-in login page loads inside an isolated partition (42)
246
+ npm run capture # screenshot the running shell (--capture-out, --capture-open svc::id, --capture-js)
247
+ npm run spike # memory benchmark
248
+ npm run dist # build the Windows installer locally
255
249
  npm run install:latest # fetch and run the latest released installer
256
- npm start -- --print-paths # show the app name, version and data folder
250
+ npm start -- --print-paths # show the app name, version and data folder
257
251
  npm start -- --open vercel::personal # open an account on launch
258
252
  ```
259
253
 
260
- The suite is 35 checks across five modes.
261
-
262
- `MAM_USER_DATA=<dir>` points any command at an isolated profile.
254
+ The suite is 108 checks across seven modes. `MAM_USER_DATA=<dir>` points any command at an isolated
255
+ profile.
263
256
 
264
- Releases are cut by pushing a `v*` tag: GitHub Actions builds the NSIS installer, uploads it with the
265
- update feed, and publishes the release.
257
+ Releases are cut by pushing a `v*` tag: GitHub Actions checks the tag against `package.json`, builds
258
+ the NSIS installer, publishes the GitHub release with the update feed, and publishes the npm package
259
+ through npm trusted publishing (OIDC, with a provenance attestation — no tokens involved).
266
260
 
267
261
  ## Licence
268
262
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "my-provider-dash-manager",
3
- "version": "0.6.0",
3
+ "version": "0.6.2",
4
4
  "description": "Manage many accounts per cloud service (Vercel, Netlify, Supabase, Cloudflare, Railway, Render, GitHub) in one desktop app \u2014 isolated persistent sessions, one tab per account.",
5
5
  "main": "src/main.js",
6
6
  "scripts": {