@goodandready/dsh-clinebot 0.3.16 → 0.3.17

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.17] - 2026-09-21
+
+### Fixed
+- **Cache Resilience (#50)**: Fixed permanent `isRevalidating` flag lock in `usageCache` and `probeCache` upon background SWR revalidation failures. The flag is now guaranteed to reset in `finally` and `catch` blocks.
+- **Immediate Abort Handling (#52)**: Eliminated artificial 250ms delay and futile retry upon `AbortError` or `signal.aborted` in `fetchUsageLimits`.
+- **Lifecycle Timer Cleanup (#53)**: Wrapped `autoDiscover` timer in `ctx.effect` with cleanup handler to avoid orphaned background callbacks upon plugin context unload.
+- **UI Version Hardcode Removal (#56)**: Replaced hardcoded legacy `'0.3.12'` string in initial React state with dynamic retrieval from `/update` endpoint and conditional badge rendering.
+
+### Performance
+- **Single Account Pool Resolution (#51)**: Eliminated duplicate sequential IPC queries to DSH Credentials by passing the pre-resolved account pool into `resolveActiveAccountKey` within `buildStatus`.
+- **Bounded Cache with Auto-Eviction (#57)**: Enforced `MAX_CACHE_ENTRIES = 50` and automatic eviction of expired entries in `usageCache` and `probeCache` to prevent long-term memory leaks.
+
+### Refactored
+- **Active Route Guard (#54)**: Converted `assertTrustedSettingsRequest` into an active route guard writing `403 Forbidden` and applied it across all write endpoints in `lib/routes/`.
+- **Dead Export Wiring (#55)**: Wired `getDefaultModelIds` helper in `lib/config.js` to compute `allDefaultIds`, clearing preflight dead-export warnings.
+
 ## [0.3.16] - 2026-09-20
 
 ### Fixed

package/lib/access.js

@@ -1,9 +1,10 @@
-import { isTrustedSettingsRequest } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 export { isTrustedSettingsRequest }
 
 export function assertTrustedSettingsRequest(req, res) {
   if (!isTrustedSettingsRequest(req)) {
+    writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }
   return true

package/lib/client.js

@@ -402,9 +402,11 @@ function UpdateBanner({ updateState, handleTriggerUpdate, t }) {
       React.createElement(
         'div',
         { style: { display: 'flex', alignItems: 'center', gap: '8px', fontSize: '13px' } },
-        React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
-          `v${updateState.currentVersion}`
-        ),
+        updateState.currentVersion
+          ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
+              `v${updateState.currentVersion}`
+            )
+          : null,
         updateState.checking
           ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: '12px' } },
               t('update.checking')
@@ -882,7 +884,7 @@ function SettingsPage(props) {
   const [updateState, setUpdateState] = React.useState({
     checking: false,
     updating: false,
-    currentVersion: '0.3.12',
+    currentVersion: '',
     latestVersion: '',
     updateAvailable: false,
     canAutoUpdate: true,

package/lib/cline-client.js

@@ -132,9 +132,26 @@ function abortAfter(ms) {
 }
 
 // In-memory caches for quota queries and host health probes
+export const MAX_CACHE_ENTRIES = 50
 export const usageCache = new Map()
 export const probeCache = new Map()
 
+export function setBoundedCache(map, key, value, maxEntries = MAX_CACHE_ENTRIES) {
+  if (map.size >= maxEntries) {
+    const now = Date.now()
+    for (const [k, v] of map.entries()) {
+      if (v.expiresAt && v.expiresAt < now) {
+        map.delete(k)
+      }
+    }
+    if (map.size >= maxEntries) {
+      const oldestKey = map.keys().next().value
+      if (oldestKey) map.delete(oldestKey)
+    }
+  }
+  map.set(key, value)
+}
+
 export function clearProbeCache() {
   probeCache.clear()
 }
@@ -212,8 +229,10 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
           keepalive: true,
         })
       } catch (netErr) {
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         // Quick 1-retry fallback on transient network drop
         await new Promise((r) => setTimeout(r, 250))
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         limitsRes = await fetchImpl(`${base}/users/me/plan/usage-limits`, {
           method: 'GET',
           headers,
@@ -299,7 +318,7 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
 
-      usageCache.set(cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(usageCache, cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return result
     } catch (err) {
       const outcome = {
@@ -308,10 +327,15 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
       if (!usageCache.has(cacheKey)) {
-        usageCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+        setBoundedCache(usageCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = usageCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
       }
       return outcome
     } finally {
+      const existing = usageCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }
@@ -362,7 +386,7 @@ export async function probeHealth(baseUrl, {
         error: reachable ? null : `HTTP status ${res.status}`,
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return outcome
     } catch (err) {
       const latencyMs = Date.now() - start
@@ -372,9 +396,16 @@ export async function probeHealth(baseUrl, {
         error: String(err?.message || err),
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      if (!probeCache.has(cacheKey)) {
+        setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = probeCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
+      }
       return outcome
     } finally {
+      const existing = probeCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }

package/lib/config.js

@@ -9,6 +9,7 @@ import {
 import {
   DEFAULT_MODEL_ID,
   getAllModels,
+  getDefaultModelIds,
   getActiveModelIds,
 } from './models.js'
 
@@ -56,8 +57,7 @@ export const Config = z.object({
 
 export function publicConfig(cfg) {
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
-  const allModels = getAllModels(dynamic)
-  const allDefaultIds = allModels.map((m) => m.id)
+  const allDefaultIds = getDefaultModelIds(dynamic)
 
   let disabledList = Array.isArray(cfg?.disabledModels) ? cfg.disabledModels : []
   if (!Array.isArray(cfg?.disabledModels) || (cfg.disabledModels.length === 0 && Array.isArray(cfg?.enabledModels) && cfg.enabledModels.length > 0)) {

package/lib/index.js

@@ -83,7 +83,14 @@ export function apply(ctx, config) {
   }
 
   syncProviderState(live())
-  setTimeout(triggerAutoDiscover, 500)
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      const timer = setTimeout(triggerAutoDiscover, 500)
+      return () => clearTimeout(timer)
+    }, 'dsh-clinebot: auto-discover')
+  } else {
+    setTimeout(triggerAutoDiscover, 500)
+  }
 
   if (ctx.webServer?.register) {
     const unregisterUpdater = registerPluginUpdater(ctx, {

package/lib/provider-sync.js

@@ -37,9 +37,9 @@ export async function checkRegisteredInPiAi(ctx) {
   }
 }
 
-export async function resolveActiveAccountKey(ctx, cfg) {
-  const pool = await resolveAccountPool(ctx, cfg)
-  const configured = pool.filter((acc) => acc.present && acc.value)
+export async function resolveActiveAccountKey(ctx, cfg, pool = null) {
+  const accountPool = pool || await resolveAccountPool(ctx, cfg)
+  const configured = accountPool.filter((acc) => acc.present && acc.value)
   if (!configured.length) {
     return { envName: publicConfig(cfg).apiKeyEnv, value: '', source: 'none', id: 'default' }
   }
@@ -62,7 +62,7 @@ export async function buildStatus(ctx, cfg) {
     probeHealth(pub.baseUrl, { timeoutMs: probeTimeout }),
   ])
 
-  const activeAcc = await resolveActiveAccountKey(ctx, cfg)
+  const activeAcc = await resolveActiveAccountKey(ctx, cfg, pool)
   const allModels = getAllModels(pub.dynamicModels)
 
   let usage = null

package/lib/routes/accounts.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
 import { clearUsageCache, clearProbeCache } from '../cline-client.js'
@@ -11,9 +11,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/accounts/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -43,9 +41,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/register',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -65,9 +61,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/unregister',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         await removePiAiProvider(ctx)
         writeJson(res, 200, { ok: true })

package/lib/routes/auth.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig } from '../config.js'
 import { resolveActiveAccountKey } from '../provider-sync.js'
 import { smokeChat, recordSessionRequest, rotateToNextAccount, DEFAULT_MODEL_ID } from '../cline-client.js'
@@ -13,9 +13,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/auth/begin',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const authUrl = 'https://app.cline.bot'
         authSession = {
@@ -54,9 +52,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/models.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
@@ -11,9 +11,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     kind: 'exact',
     path: '/dsh-clinebot/models/sync',
     handler: async (req, res) => {
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       if (req.method !== 'POST') {
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
@@ -69,9 +67,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/settings.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { buildStatus } from '../provider-sync.js'
 import { saveCredentialKey, smokeChat, DEFAULT_API_KEY_ENV } from '../cline-client.js'
@@ -62,9 +62,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/save-key',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",