Skip to content

feat: web dashboard + Chrome extension for runtime account management#5

Open
danscMax wants to merge 2 commits into
ForgetMeAI:mainfrom
danscMax:foundation-v2
Open

feat: web dashboard + Chrome extension for runtime account management#5
danscMax wants to merge 2 commits into
ForgetMeAI:mainfrom
danscMax:foundation-v2

Conversation

@danscMax

@danscMax danscMax commented Jun 9, 2026

Copy link
Copy Markdown

Summary

Adds a localhost-only web dashboard and a Chrome extension for managing the DeepSeek account pool at runtime, built on top of the existing file-based pool (reuses accounts[] / loadDeepSeekConfig — no second pool). Rebased onto current main, so it includes and builds on the recent account-pooling work.

What's included

  • Web dashboard (/dashboard): view accounts + statuses, import, check, delete.
  • Chrome extension (chrome-extension/): one-click capture of DeepSeek auth → import.
  • Account API (localhost-only, CSRF-guarded): GET /api/accounts, POST /api/accounts/import (cURL/HAR), POST /api/accounts/:id/check, DELETE /api/accounts/:id, GET /api/auth-status.
  • Import helpers: scripts/auth_from_curl.js, scripts/auth_from_har.js, lib/parseAuth.js.

How it integrates with the pool

Runtime-added accounts are stored as individual JSON files under a managed data/accounts/ dir; discoverAuthPaths() also scans that dir, so they load alongside DEEPSEEK_AUTH_DIR / deepseek-auth.json. Add/delete write/remove a file and call loadDeepSeekConfig() to reload. No separate account store.

Security

  • All /api/accounts* routes are localhost-only and CSRF-guarded.
  • Account files written 0600; data/accounts/*.json is gitignored.
  • File deletion is path-constrained to the managed dir — env-provided auth files are never touched.

Notes / limitations

  • /api/accounts/:id/check does a real GET /api/v0/users/current request (no PoW, 15s timeout).
  • Tested: server start, all GET routes, import dedup, delete, CSRF rejection, live /check round-trip. Flows needing a valid live account (successful import + OK check + email) were validated by code review only.

Supersedes #2 (which mixed this with a parallel pool implementation; this is rebased clean on top of the current pool).

Add a localhost-only web dashboard and a Chrome extension to manage the
DeepSeek account pool at runtime, layered on top of the existing file-based
pool (no duplicate pool):

- routes: GET /dashboard, GET /api/accounts, POST /api/accounts/import
  (cURL/HAR), POST /api/accounts/:id/check, DELETE /api/accounts/:id,
  GET /api/auth-status — localhost-only and CSRF-guarded
- runtime add/delete writes/removes managed files in data/accounts/ then
  reloads the pool; secrets written 0600 and gitignored
- live account check via GET /api/v0/users/current (no PoW), 15s timeout
- scripts/auth_from_curl.js + auth_from_har.js import helpers
- lib/parseAuth.js parses cURL/HAR auth captures
- dashboard: model picker, inline delete, copy, retry, auto-grow, and a
  per-account label with inline edit
- chrome extension: icons, server-status indicator, dashboard button, label
- parseAuth: handle Chrome "Copy as cURL (bash)" ANSI-C headers
- server: GET /api/accounts exposes label; POST /api/accounts/:id/label sets
  it (localhost + CSRF guarded, persisted to the managed account file)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant