@goodandready/dsh-clinebot 0.3.15 → 0.3.17

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.17] - 2026-09-21
+
+### Fixed
+- **Cache Resilience (#50)**: Fixed permanent `isRevalidating` flag lock in `usageCache` and `probeCache` upon background SWR revalidation failures. The flag is now guaranteed to reset in `finally` and `catch` blocks.
+- **Immediate Abort Handling (#52)**: Eliminated artificial 250ms delay and futile retry upon `AbortError` or `signal.aborted` in `fetchUsageLimits`.
+- **Lifecycle Timer Cleanup (#53)**: Wrapped `autoDiscover` timer in `ctx.effect` with cleanup handler to avoid orphaned background callbacks upon plugin context unload.
+- **UI Version Hardcode Removal (#56)**: Replaced hardcoded legacy `'0.3.12'` string in initial React state with dynamic retrieval from `/update` endpoint and conditional badge rendering.
+
+### Performance
+- **Single Account Pool Resolution (#51)**: Eliminated duplicate sequential IPC queries to DSH Credentials by passing the pre-resolved account pool into `resolveActiveAccountKey` within `buildStatus`.
+- **Bounded Cache with Auto-Eviction (#57)**: Enforced `MAX_CACHE_ENTRIES = 50` and automatic eviction of expired entries in `usageCache` and `probeCache` to prevent long-term memory leaks.
+
+### Refactored
+- **Active Route Guard (#54)**: Converted `assertTrustedSettingsRequest` into an active route guard writing `403 Forbidden` and applied it across all write endpoints in `lib/routes/`.
+- **Dead Export Wiring (#55)**: Wired `getDefaultModelIds` helper in `lib/config.js` to compute `allDefaultIds`, clearing preflight dead-export warnings.
+
+## [0.3.16] - 2026-09-20
+
+### Fixed
+- **Strict Active Subscription Plan Model Filtering (#48)**: Correctly parsed `plan.features.included` array from `GET /users/me/plan` to discover exactly the 11 active ClinePass subscription models. Removed non-subscription models from the default `CLINE_MODELS` list (eliminating out-of-plan failures and preventing 400+ models from cluttering the DSH picker).
+- **Array Parsing in `parsePlanIncludedModels`**: Added support for both string and array inputs (extracting feature entries matching `/includes\s+/i`).
+
 ## [0.3.15] - 2026-09-19
 
 ### Fixed

package/lib/access.js

@@ -1,9 +1,10 @@
-import { isTrustedSettingsRequest } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 export { isTrustedSettingsRequest }
 
 export function assertTrustedSettingsRequest(req, res) {
   if (!isTrustedSettingsRequest(req)) {
+    writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }
   return true

package/lib/client.js

@@ -402,9 +402,11 @@ function UpdateBanner({ updateState, handleTriggerUpdate, t }) {
       React.createElement(
         'div',
         { style: { display: 'flex', alignItems: 'center', gap: '8px', fontSize: '13px' } },
-        React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
-          `v${updateState.currentVersion}`
-        ),
+        updateState.currentVersion
+          ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
+              `v${updateState.currentVersion}`
+            )
+          : null,
         updateState.checking
           ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: '12px' } },
               t('update.checking')
@@ -882,7 +884,7 @@ function SettingsPage(props) {
   const [updateState, setUpdateState] = React.useState({
     checking: false,
     updating: false,
-    currentVersion: '0.3.12',
+    currentVersion: '',
     latestVersion: '',
     updateAvailable: false,
     canAutoUpdate: true,

package/lib/cline-client.js

@@ -132,9 +132,26 @@ function abortAfter(ms) {
 }
 
 // In-memory caches for quota queries and host health probes
+export const MAX_CACHE_ENTRIES = 50
 export const usageCache = new Map()
 export const probeCache = new Map()
 
+export function setBoundedCache(map, key, value, maxEntries = MAX_CACHE_ENTRIES) {
+  if (map.size >= maxEntries) {
+    const now = Date.now()
+    for (const [k, v] of map.entries()) {
+      if (v.expiresAt && v.expiresAt < now) {
+        map.delete(k)
+      }
+    }
+    if (map.size >= maxEntries) {
+      const oldestKey = map.keys().next().value
+      if (oldestKey) map.delete(oldestKey)
+    }
+  }
+  map.set(key, value)
+}
+
 export function clearProbeCache() {
   probeCache.clear()
 }
@@ -212,8 +229,10 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
           keepalive: true,
         })
       } catch (netErr) {
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         // Quick 1-retry fallback on transient network drop
         await new Promise((r) => setTimeout(r, 250))
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         limitsRes = await fetchImpl(`${base}/users/me/plan/usage-limits`, {
           method: 'GET',
           headers,
@@ -277,12 +296,13 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
 
         if (planRes?.ok) {
           const planData = await planRes.json().catch(() => ({}))
-          const plan = planData?.data || planData
-          if (plan?.title || plan?.name) {
-            planDisplayName = `${plan.title || plan.name} ($${((plan.priceInCents || 999) / 100).toFixed(2)}/mo)`
+          const plan = planData?.data?.plan || planData?.data || planData?.plan || planData
+          if (plan?.displayName || plan?.title || plan?.name) {
+            planDisplayName = `${plan.displayName || plan.title || plan.name} ($${((plan.pricePerSeatCents || plan.priceInCents || 999) / 100).toFixed(2)}/mo)`
           }
-          if (Array.isArray(plan?.includedModels)) {
-            dynamicModels = parsePlanIncludedModels(plan.includedModels)
+          const featuresIncluded = plan?.features?.included || plan?.includedModels
+          if (featuresIncluded) {
+            dynamicModels = parsePlanIncludedModels(featuresIncluded)
           }
         }
       } catch {
@@ -298,7 +318,7 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
 
-      usageCache.set(cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(usageCache, cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return result
     } catch (err) {
       const outcome = {
@@ -307,10 +327,15 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
       if (!usageCache.has(cacheKey)) {
-        usageCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+        setBoundedCache(usageCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = usageCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
       }
       return outcome
     } finally {
+      const existing = usageCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }
@@ -361,7 +386,7 @@ export async function probeHealth(baseUrl, {
         error: reachable ? null : `HTTP status ${res.status}`,
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return outcome
     } catch (err) {
       const latencyMs = Date.now() - start
@@ -371,9 +396,16 @@ export async function probeHealth(baseUrl, {
         error: String(err?.message || err),
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      if (!probeCache.has(cacheKey)) {
+        setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = probeCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
+      }
       return outcome
     } finally {
+      const existing = probeCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }

package/lib/config.js

@@ -9,6 +9,7 @@ import {
 import {
   DEFAULT_MODEL_ID,
   getAllModels,
+  getDefaultModelIds,
   getActiveModelIds,
 } from './models.js'
 
@@ -56,8 +57,7 @@ export const Config = z.object({
 
 export function publicConfig(cfg) {
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
-  const allModels = getAllModels(dynamic)
-  const allDefaultIds = allModels.map((m) => m.id)
+  const allDefaultIds = getDefaultModelIds(dynamic)
 
   let disabledList = Array.isArray(cfg?.disabledModels) ? cfg.disabledModels : []
   if (!Array.isArray(cfg?.disabledModels) || (cfg.disabledModels.length === 0 && Array.isArray(cfg?.enabledModels) && cfg.enabledModels.length > 0)) {

package/lib/index.js

@@ -83,7 +83,14 @@ export function apply(ctx, config) {
   }
 
   syncProviderState(live())
-  setTimeout(triggerAutoDiscover, 500)
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      const timer = setTimeout(triggerAutoDiscover, 500)
+      return () => clearTimeout(timer)
+    }, 'dsh-clinebot: auto-discover')
+  } else {
+    setTimeout(triggerAutoDiscover, 500)
+  }
 
   if (ctx.webServer?.register) {
     const unregisterUpdater = registerPluginUpdater(ctx, {

package/lib/models.js

@@ -136,83 +136,27 @@ export const CLINE_MODELS = Object.freeze([
     recommended: false,
     isCustom: false,
   },
-  {
-    id: 'cline-pass/claude-3-7-sonnet',
-    name: 'Claude 3.7 Sonnet',
-    description: 'Hybrid reasoning and standard generation model with high coding proficiency.',
-    contextLength: 200000,
-    maxTokens: 8192,
-    input: ['text', 'image'],
-    category: 'coding',
-    recommended: true,
-    isCustom: false,
-    reasoningEfforts: ['low', 'medium', 'high'],
-  },
-  {
-    id: 'cline-pass/gpt-4.5-preview',
-    name: 'GPT-4.5 Preview',
-    description: 'Advanced flagship frontier model with deep world knowledge and intuition.',
-    contextLength: 128000,
-    maxTokens: 16384,
-    input: ['text', 'image'],
-    category: 'general',
-    recommended: true,
-    isCustom: false,
-  },
-  {
-    id: 'cline-pass/o3-mini',
-    name: 'o3-mini',
-    description: 'Fast, cost-effective reasoning model specialized for STEM and coding.',
-    contextLength: 200000,
-    maxTokens: 65536,
-    input: ['text'],
-    category: 'reasoning',
-    recommended: true,
-    isCustom: false,
-    reasoningEfforts: ['low', 'medium', 'high'],
-  },
-  {
-    id: 'cline-pass/gemini-2.5-pro',
-    name: 'Gemini 2.5 Pro',
-    description: 'State-of-the-art multimodal reasoning model with extended context.',
-    contextLength: 1000000,
-    maxTokens: 8192,
-    input: ['text', 'image'],
-    category: 'multimodal',
-    recommended: true,
-    isCustom: false,
-    reasoningEfforts: ['low', 'medium', 'high'],
-  },
-  {
-    id: 'cline-pass/gemini-2.5-flash',
-    name: 'Gemini 2.5 Flash',
-    description: 'Ultra-fast multimodal model optimized for real-time agent workflows.',
-    contextLength: 1000000,
-    maxTokens: 8192,
-    input: ['text', 'image'],
-    category: 'general',
-    recommended: false,
-    isCustom: false,
-  },
-  {
-    id: 'cline-pass/qwen-2.5-coder-32b',
-    name: 'Qwen 2.5 Coder 32B',
-    description: 'Open-weights powerhouse for code generation, refactoring and bug fixing.',
-    contextLength: 131072,
-    maxTokens: 8192,
-    input: ['text'],
-    category: 'coding',
-    recommended: false,
-    isCustom: false,
-  },
 ])
 
 /**
  * Parse human-readable included models string from ClinePass plan features.
  * Example: "Includes Kimi K3, GLM 5.2, Kimi K2.6, Kimi K2.7 Code, Mimo v2.5, Mimo v2.5 Pro, Minimax M3, Qwen3.7 Plus, Qwen3.7 Max, DeepSeek V4 Pro, and DeepSeek V4 Flash"
  */
-export function parsePlanIncludedModels(includedText) {
-  if (!includedText || typeof includedText !== 'string') return []
+export function parsePlanIncludedModels(includedInput) {
+  if (!includedInput) return []
+  let includedText = ''
+  if (Array.isArray(includedInput)) {
+    const foundStr = includedInput.find((item) => typeof item === 'string' && /includes\s+/i.test(item))
+    if (foundStr) {
+      includedText = foundStr
+    } else {
+      includedText = includedInput.filter((x) => typeof x === 'string').join(', ')
+    }
+  } else if (typeof includedInput === 'string') {
+    includedText = includedInput
+  } else {
+    return []
+  }
   const clean = includedText
     .replace(/^includes\s+/i, '')
     .replace(/\band\b/gi, ',')

package/lib/provider-sync.js

@@ -37,9 +37,9 @@ export async function checkRegisteredInPiAi(ctx) {
   }
 }
 
-export async function resolveActiveAccountKey(ctx, cfg) {
-  const pool = await resolveAccountPool(ctx, cfg)
-  const configured = pool.filter((acc) => acc.present && acc.value)
+export async function resolveActiveAccountKey(ctx, cfg, pool = null) {
+  const accountPool = pool || await resolveAccountPool(ctx, cfg)
+  const configured = accountPool.filter((acc) => acc.present && acc.value)
   if (!configured.length) {
     return { envName: publicConfig(cfg).apiKeyEnv, value: '', source: 'none', id: 'default' }
   }
@@ -62,7 +62,7 @@ export async function buildStatus(ctx, cfg) {
     probeHealth(pub.baseUrl, { timeoutMs: probeTimeout }),
   ])
 
-  const activeAcc = await resolveActiveAccountKey(ctx, cfg)
+  const activeAcc = await resolveActiveAccountKey(ctx, cfg, pool)
   const allModels = getAllModels(pub.dynamicModels)
 
   let usage = null

package/lib/routes/accounts.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
 import { clearUsageCache, clearProbeCache } from '../cline-client.js'
@@ -11,13 +11,11 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/accounts/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
-        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
         const account = String(body.account || '').trim()
 
         clearUsageCache()
@@ -43,13 +41,11 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/register',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
-        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
         const activeModels = body.models || publicConfig(live()).enabledModels
         const result = await upsertPiAiProvider(ctx, live(), activeModels)
         writeJson(res, 200, { ok: true, provider: result })
@@ -65,9 +61,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/unregister',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         await removePiAiProvider(ctx)
         writeJson(res, 200, { ok: true })

package/lib/routes/auth.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig } from '../config.js'
 import { resolveActiveAccountKey } from '../provider-sync.js'
 import { smokeChat, recordSessionRequest, rotateToNextAccount, DEFAULT_MODEL_ID } from '../cline-client.js'
@@ -13,9 +13,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/auth/begin',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const authUrl = 'https://app.cline.bot'
         authSession = {
@@ -54,13 +52,11 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
-        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
 
         const pub = publicConfig(live())
         const activeKey = await resolveActiveAccountKey(ctx, live())

package/lib/routes/models.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
@@ -11,9 +11,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     kind: 'exact',
     path: '/dsh-clinebot/models/sync',
     handler: async (req, res) => {
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       if (req.method !== 'POST') {
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
@@ -69,13 +67,11 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
-        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
 
         const settingsApi = getSettingsApi()
         if (settingsApi?.replace) {

package/lib/routes/settings.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { buildStatus } from '../provider-sync.js'
 import { saveCredentialKey, smokeChat, DEFAULT_API_KEY_ENV } from '../cline-client.js'
@@ -62,13 +62,11 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/save-key',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
-        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
 
         const apiKey = String(body.apiKey || '').trim()
         if (!apiKey) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",