@goodandready/dsh-clinebot 0.3.16 → 0.3.18

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.18] - 2026-09-22
+
+### Added
+- **Reasoning Effort (思考强度) Selection (#59)**: Enabled reasoning effort selection (`Off` / `Low` / `Medium` / `High` / `Max`) across DSH composer model picker and `dsh-effort-slider` for all supported reasoning models (Qwen 3.7 Max/Plus, MiMo 2.5/Pro, GLM 5.2, Kimi K3, DeepSeek V4 Pro/Flash, MiniMax M3).
+- **Protocol Compliance**: Injected `off: null` into wire dictionary and declared `compat: { supportsReasoningEffort: true }` at provider and model levels in accordance with `@earendil-works/pi-ai` protocol specifications.
+- **Dynamic Plan Model Reasoning Heuristics**: Added automatic detection of reasoning capabilities for dynamically discovered models matching `/qwen3\.7|mimo|glm-5|kimi-k3|deepseek-v4|minimax-m3/i`.
+- **Reasoning Tooltip Localization**: Added localized explanatory tooltips (`models.reasoning_tooltip`) across English, Russian, and Chinese in the Settings UI.
+
+### Fixed
+- **Settings UI Reasoning Badge**: Fixed reasoning badge check in `models-section.js` to correctly detect object dictionary configurations instead of relying solely on array length.
+- **Context Window Capacity Clarification**: Updated catalog documentation and descriptions to clarify that the uniform 200k tokens context parameter reflects the official ClinePass upstream completion proxy gateway limit.
+
+## [0.3.17] - 2026-09-21
+
+### Fixed
+- **Cache Resilience (#50)**: Fixed permanent `isRevalidating` flag lock in `usageCache` and `probeCache` upon background SWR revalidation failures. The flag is now guaranteed to reset in `finally` and `catch` blocks.
+- **Immediate Abort Handling (#52)**: Eliminated artificial 250ms delay and futile retry upon `AbortError` or `signal.aborted` in `fetchUsageLimits`.
+- **Lifecycle Timer Cleanup (#53)**: Wrapped `autoDiscover` timer in `ctx.effect` with cleanup handler to avoid orphaned background callbacks upon plugin context unload.
+- **UI Version Hardcode Removal (#56)**: Replaced hardcoded legacy `'0.3.12'` string in initial React state with dynamic retrieval from `/update` endpoint and conditional badge rendering.
+
+### Performance
+- **Single Account Pool Resolution (#51)**: Eliminated duplicate sequential IPC queries to DSH Credentials by passing the pre-resolved account pool into `resolveActiveAccountKey` within `buildStatus`.
+- **Bounded Cache with Auto-Eviction (#57)**: Enforced `MAX_CACHE_ENTRIES = 50` and automatic eviction of expired entries in `usageCache` and `probeCache` to prevent long-term memory leaks.
+
+### Refactored
+- **Active Route Guard (#54)**: Converted `assertTrustedSettingsRequest` into an active route guard writing `403 Forbidden` and applied it across all write endpoints in `lib/routes/`.
+- **Dead Export Wiring (#55)**: Wired `getDefaultModelIds` helper in `lib/config.js` to compute `allDefaultIds`, clearing preflight dead-export warnings.
+
 ## [0.3.16] - 2026-09-20
 
 ### Fixed

package/README.md

@@ -108,13 +108,13 @@ graph LR
 ## ✨ Features & Module Breakdown
 
 * **`lib/models.js`**:
-  Manages the curated catalog (11 built-in models) and dynamically parses subscription plan models (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
+  Manages the curated catalog (11 built-in models) with full reasoning effort mappings (`off: null`, `low`, `medium`, `high`, `max`), upstream 200k context limit declarations, and dynamic subscription plan model parsing (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
 * **`lib/cline-client.js`**:
   * `fetchUsageLimits`: queries `GET /users/me/plan/usage-limits`, `GET /users/me/plan`, and `GET /users/me` with in-memory caching.
   * `sessionStats` / `recordSessionRequest`: in-memory telemetry recording requests count, tokens, latency, and timestamps.
   * `saveCredentialKey`: writes credentials directly into `~/.dsh/.credentials.yaml`.
   * `smokeChat`: tests latency via non-streaming ping and updates session metrics.
-  * `buildPiAiProvider`: builds the DSH `llm-pi-ai` structure (`api: 'openai-completions'`).
+  * `buildPiAiProvider`: builds the DSH `llm-pi-ai` structure (`api: 'openai-completions'`) with full reasoning effort protocol compliance (`compat.supportsReasoningEffort: true`).
 * **`lib/index.js`**:
   Cordis service module managing routes (including `POST /dsh-clinebot/models/sync`), quota warnings threshold evaluation, credentials, and registering the `/cline` slash command.
 * **`lib/client.js`**:

package/README.ru.md

@@ -107,7 +107,7 @@ graph LR
 
 ## ✨ Структура модулей и возможности
 
-* **`lib/models.js`**: каталог встроенных моделей ClinePass (11 моделей) и парсер моделей подписки (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
+* **`lib/models.js`**: каталог встроенных моделей ClinePass (11 моделей с полной поддержкой уровней размышлений `Off` / `Low` / `Medium` / `High` / `Max` и фиксацией лимита шлюза в 200k токенов) и парсер моделей подписки (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
 * **`lib/cline-client.js`**:
   * `fetchUsageLimits`: параллельный опрос `GET /users/me/plan/usage-limits`, `GET /users/me/plan` и `GET /users/me` с кэшированием в памяти.
   * `sessionStats` / `recordSessionRequest`: счетчики сессии (запросы, токены, задержка, время).

package/README.zh.md

@@ -107,7 +107,7 @@ graph LR
 
 ## ✨ 核心模块与功能
 
-* **`lib/models.js`**：管理 11 款官方精选内置模型以及套餐模型动态解析器（`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`）。
+* **`lib/models.js`**：管理 11 款官方精选内置模型（提供完整的 `Off` / `Low` / `Medium` / `High` / `Max` 思考强度映射、上游 200k 上下文容量标注）以及套餐模型动态解析器（`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`）。
 * **`lib/cline-client.js`**：
   * `fetchUsageLimits`：高效并发轮询 `GET /users/me/plan/usage-limits`、`GET /users/me/plan` 与 `GET /users/me` 并进行内存缓存。
   * `sessionStats` / `recordSessionRequest`：内存级会话度量记录器（请求次数、Token 估算、延迟、时间戳）。

package/lib/access.js

@@ -1,9 +1,10 @@
-import { isTrustedSettingsRequest } from './http.js'
+import { isTrustedSettingsRequest, writeJson } from './http.js'
 
 export { isTrustedSettingsRequest }
 
 export function assertTrustedSettingsRequest(req, res) {
   if (!isTrustedSettingsRequest(req)) {
+    writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }
   return true

package/lib/client.js

@@ -65,7 +65,8 @@ const en = {
       'quota.remaining': 'Remaining: {pct}%',
       'quota.reset_at': 'Reset: {time}',
       'models.title': '🎯 Model Picker in DSH ({enabled} of {total} active)',
-      'models.desc': 'Catalog synchronizes directly from ClinePass subscription. New plan models are enabled automatically. Uncheck models to hide them from DSH chat picker.',
+      'models.desc': 'Catalog synchronizes directly from ClinePass subscription. New plan models are enabled automatically. Uncheck models to hide them from DSH chat picker. Thinking effort is selectable in the composer model menu.',
+      'models.reasoning_tooltip': 'Supports thinking effort selection in composer model menu (Off / Low / Medium / High / Max)',
       'models.sync': '🔄 Check Plan Models',
       'models.syncing': 'Checking…',
       'models.synced_msg': 'Synchronized subscription models: {total} ({discovered} discovered from ClinePass)',
@@ -154,7 +155,8 @@ const en = {
       'quota.remaining': '剩余可用：{pct}%',
       'quota.reset_at': '重置时间：{time}',
       'models.title': '🎯 DSH 模型选择列表（已启用 {enabled}/{total}）',
-      'models.desc': '模型目录与 ClinePass 官方订阅实时同步。新订阅模型默认自动启用。取消勾选可在 DSH 对话模型列表中隐藏不需要的模型。',
+      'models.desc': '模型目录与 ClinePass 官方订阅实时同步。新订阅模型默认自动启用。取消勾选可在 DSH 对话模型列表中隐藏不需要的模型。支持在对话输入框上方切换推理思考强度（Effort）。',
+      'models.reasoning_tooltip': '支持在对话框上方模型菜单中选择思考强度（Off / Low / Medium / High / Max）',
       'models.sync': '🔄 同步订阅模型',
       'models.syncing': '正在同步…',
       'models.synced_msg': '已成功同步订阅模型：共 {total} 个（发现 {discovered} 个新模型）',
@@ -402,9 +404,11 @@ function UpdateBanner({ updateState, handleTriggerUpdate, t }) {
       React.createElement(
         'div',
         { style: { display: 'flex', alignItems: 'center', gap: '8px', fontSize: '13px' } },
-        React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
-          `v${updateState.currentVersion}`
-        ),
+        updateState.currentVersion
+          ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-secondary)', fontWeight: 500 } },
+              `v${updateState.currentVersion}`
+            )
+          : null,
         updateState.checking
           ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: '12px' } },
               t('update.checking')
@@ -725,8 +729,8 @@ function ModelsSection({ modelsList, disabledSet, enabledCount, keyPresent, busy
               m.input?.includes('image') || m.input?.includes('vision')
                 ? React.createElement('span', { className: 'cb-badge', style: { marginLeft: '4px' } }, 'Vision')
                 : null,
-              m.reasoningEfforts?.length || m.reasoning
-                ? React.createElement('span', { className: 'cb-badge', style: { marginLeft: '4px' } }, '🧠 Reasoning')
+              (Array.isArray(m.reasoningEfforts) ? m.reasoningEfforts.length > 0 : (m.reasoningEfforts && typeof m.reasoningEfforts === 'object' ? Object.keys(m.reasoningEfforts).length > 0 : Boolean(m.reasoning)))
+                ? React.createElement('span', { className: 'cb-badge cb-badge-ok', style: { marginLeft: '4px' }, title: t('models.reasoning_tooltip') }, '🧠 Reasoning')
                 : null
             )
           )
@@ -882,7 +886,7 @@ function SettingsPage(props) {
   const [updateState, setUpdateState] = React.useState({
     checking: false,
     updating: false,
-    currentVersion: '0.3.12',
+    currentVersion: '',
     latestVersion: '',
     updateAvailable: false,
     canAutoUpdate: true,

package/lib/cline-client.js

@@ -132,9 +132,26 @@ function abortAfter(ms) {
 }
 
 // In-memory caches for quota queries and host health probes
+export const MAX_CACHE_ENTRIES = 50
 export const usageCache = new Map()
 export const probeCache = new Map()
 
+export function setBoundedCache(map, key, value, maxEntries = MAX_CACHE_ENTRIES) {
+  if (map.size >= maxEntries) {
+    const now = Date.now()
+    for (const [k, v] of map.entries()) {
+      if (v.expiresAt && v.expiresAt < now) {
+        map.delete(k)
+      }
+    }
+    if (map.size >= maxEntries) {
+      const oldestKey = map.keys().next().value
+      if (oldestKey) map.delete(oldestKey)
+    }
+  }
+  map.set(key, value)
+}
+
 export function clearProbeCache() {
   probeCache.clear()
 }
@@ -212,8 +229,10 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
           keepalive: true,
         })
       } catch (netErr) {
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         // Quick 1-retry fallback on transient network drop
         await new Promise((r) => setTimeout(r, 250))
+        if (signal?.aborted || netErr?.name === 'AbortError') throw netErr
         limitsRes = await fetchImpl(`${base}/users/me/plan/usage-limits`, {
           method: 'GET',
           headers,
@@ -299,7 +318,7 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
 
-      usageCache.set(cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(usageCache, cacheKey, { data: result, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return result
     } catch (err) {
       const outcome = {
@@ -308,10 +327,15 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
         checkedAt: Date.now(),
       }
       if (!usageCache.has(cacheKey)) {
-        usageCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+        setBoundedCache(usageCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = usageCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
       }
       return outcome
     } finally {
+      const existing = usageCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }
@@ -362,7 +386,7 @@ export async function probeHealth(baseUrl, {
         error: reachable ? null : `HTTP status ${res.status}`,
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
+      setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + ttlMs, isRevalidating: false })
       return outcome
     } catch (err) {
       const latencyMs = Date.now() - start
@@ -372,9 +396,16 @@ export async function probeHealth(baseUrl, {
         error: String(err?.message || err),
         checkedAt: Date.now(),
       }
-      probeCache.set(cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      if (!probeCache.has(cacheKey)) {
+        setBoundedCache(probeCache, cacheKey, { data: outcome, expiresAt: Date.now() + 5000, isRevalidating: false })
+      } else {
+        const existing = probeCache.get(cacheKey)
+        if (existing) existing.isRevalidating = false
+      }
       return outcome
     } finally {
+      const existing = probeCache.get(cacheKey)
+      if (existing) existing.isRevalidating = false
       cancel()
     }
   }
@@ -495,24 +526,24 @@ export function buildPiAiProvider({
       provider: PROVIDER_ID,
     }
     const validEfforts = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']
+    let efforts = null
     if (Array.isArray(item.reasoningEfforts) && item.reasoningEfforts.length) {
-      const efforts = {}
+      efforts = {}
       for (const effort of item.reasoningEfforts) {
         const key = String(effort).trim().toLowerCase()
-        if (validEfforts.includes(key)) {
-          efforts[key] = key
-        }
+        if (validEfforts.includes(key)) efforts[key] = key === 'off' ? null : key
       }
-      res.reasoningEfforts = Object.keys(efforts).length ? efforts : false
     } else if (item.reasoningEfforts && typeof item.reasoningEfforts === 'object' && !Array.isArray(item.reasoningEfforts)) {
-      const efforts = {}
+      efforts = {}
       for (const [k, v] of Object.entries(item.reasoningEfforts)) {
         const key = String(k).trim().toLowerCase()
-        if (validEfforts.includes(key)) {
-          efforts[key] = typeof v === 'string' && v.trim() ? v.trim() : key
-        }
+        if (validEfforts.includes(key)) efforts[key] = key === 'off' ? (v === undefined ? null : v) : (typeof v === 'string' && v.trim() ? v.trim() : key)
       }
-      res.reasoningEfforts = Object.keys(efforts).length ? efforts : false
+    }
+    if (efforts && Object.keys(efforts).length) {
+      if (!('off' in efforts)) efforts.off = null
+      res.reasoningEfforts = efforts
+      res.compat = { supportsReasoningEffort: true }
     } else {
       res.reasoningEfforts = false
     }
@@ -524,6 +555,7 @@ export function buildPiAiProvider({
     api: 'openai-completions',
     baseURL: normalizeBaseUrl(baseUrl),
     apiKeyEnv: apiKeyEnv || DEFAULT_API_KEY_ENV,
+    compat: { supportsReasoningEffort: true },
     models: modelList,
   }
 }

package/lib/config.js

@@ -9,6 +9,7 @@ import {
 import {
   DEFAULT_MODEL_ID,
   getAllModels,
+  getDefaultModelIds,
   getActiveModelIds,
 } from './models.js'
 
@@ -37,6 +38,7 @@ export const Config = z.object({
     input: z.array(z.string()).default(['text']),
     category: z.string().default('general'),
     isCustom: z.boolean().default(false),
+    reasoningEfforts: z.any().default(undefined),
   })).default([])
     .description('Models automatically discovered from the official ClinePass subscription plan.'),
   timeoutMs: z.number().default(DEFAULT_TIMEOUT_MS)
@@ -56,8 +58,7 @@ export const Config = z.object({
 
 export function publicConfig(cfg) {
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
-  const allModels = getAllModels(dynamic)
-  const allDefaultIds = allModels.map((m) => m.id)
+  const allDefaultIds = getDefaultModelIds(dynamic)
 
   let disabledList = Array.isArray(cfg?.disabledModels) ? cfg.disabledModels : []
   if (!Array.isArray(cfg?.disabledModels) || (cfg.disabledModels.length === 0 && Array.isArray(cfg?.enabledModels) && cfg.enabledModels.length > 0)) {

package/lib/index.js

@@ -83,7 +83,14 @@ export function apply(ctx, config) {
   }
 
   syncProviderState(live())
-  setTimeout(triggerAutoDiscover, 500)
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      const timer = setTimeout(triggerAutoDiscover, 500)
+      return () => clearTimeout(timer)
+    }, 'dsh-clinebot: auto-discover')
+  } else {
+    setTimeout(triggerAutoDiscover, 500)
+  }
 
   if (ctx.webServer?.register) {
     const unregisterUpdater = registerPluginUpdater(ctx, {

package/lib/models.js

@@ -2,8 +2,11 @@
  * Curated and extensible models catalog for ClineBot / ClinePass.
  *
  * Notice: GET /v1/models returns 404 on api.cline.bot, so DSH cannot rely on
- * dynamic OpenAI model discovery. This catalogue provides the official ClinePass
- * models plus support for user-defined custom models added via the Settings page.
+ * dynamic OpenAI model discovery. Furthermore, ClinePass upstream proxy enforces
+ * a uniform 200,000 token context window cap across subscription completion routes,
+ * and /users/me/plan returns only feature strings without per-model context specs.
+ * This catalogue provides the official ClinePass models (200k gateway capacity) plus
+ * support for user-defined custom models with arbitrary context length.
  */
 
 export const PROVIDER_ID = 'clinebot'
@@ -45,6 +48,7 @@ export const CLINE_MODELS = Object.freeze([
     category: 'general',
     recommended: false,
     isCustom: false,
+    reasoningEfforts: ['low', 'medium', 'high'],
   },
   {
     id: 'cline-pass/kimi-k3',
@@ -56,7 +60,7 @@ export const CLINE_MODELS = Object.freeze([
     category: 'reasoning',
     recommended: true,
     isCustom: false,
-    reasoningEfforts: ['low', 'high', 'max'],
+    reasoningEfforts: ['low', 'medium', 'high', 'max'],
   },
   {
     id: 'cline-pass/kimi-k2.7-code',
@@ -83,24 +87,26 @@ export const CLINE_MODELS = Object.freeze([
   {
     id: 'cline-pass/qwen3.7-max',
     name: 'Qwen 3.7 Max',
-    description: 'Large-scale multimodal foundation model from Alibaba Cloud.',
+    description: 'Large-scale multimodal foundation model from Alibaba Cloud with reasoning support.',
     contextLength: 200000,
     maxTokens: 8192,
     input: ['text', 'image'],
     category: 'multimodal',
     recommended: true,
     isCustom: false,
+    reasoningEfforts: ['low', 'medium', 'high', 'max'],
   },
   {
     id: 'cline-pass/qwen3.7-plus',
     name: 'Qwen 3.7 Plus',
-    description: 'Fast, capable multimodal model with strong multilingual skills.',
+    description: 'Fast, capable multimodal model with strong multilingual skills and reasoning.',
     contextLength: 200000,
     maxTokens: 8192,
     input: ['text', 'image'],
     category: 'multimodal',
     recommended: false,
     isCustom: false,
+    reasoningEfforts: ['low', 'medium', 'high', 'max'],
   },
   {
     id: 'cline-pass/minimax-m3',
@@ -117,24 +123,26 @@ export const CLINE_MODELS = Object.freeze([
   {
     id: 'cline-pass/mimo-v2.5',
     name: 'MiMo V2.5',
-    description: 'Xiaomi MiMo efficient instruction model.',
+    description: 'Xiaomi MiMo efficient instruction model with reasoning and multimodal support.',
     contextLength: 200000,
     maxTokens: 8192,
-    input: ['text'],
+    input: ['text', 'image'],
     category: 'general',
     recommended: false,
     isCustom: false,
+    reasoningEfforts: ['low', 'medium', 'high', 'max'],
   },
   {
     id: 'cline-pass/mimo-v2.5-pro',
     name: 'MiMo V2.5 Pro',
-    description: 'Xiaomi MiMo advanced agentic reasoning model.',
+    description: 'Xiaomi MiMo advanced agentic reasoning model with multimodal support.',
     contextLength: 200000,
     maxTokens: 8192,
-    input: ['text'],
+    input: ['text', 'image'],
     category: 'coding',
     recommended: false,
     isCustom: false,
+    reasoningEfforts: ['low', 'medium', 'high', 'max'],
   },
 ])
 
@@ -186,16 +194,19 @@ export function parsePlanIncludedModels(includedInput) {
     } else {
       // Dynamic fallback for newly introduced models mentioned in plan
       const idPart = name.toLowerCase().replace(/[\s_]+/g, '-')
+      const isVision = /(vision|vl|multimodal|omni|image)/i.test(name)
+      const hasReasoning = /(reason|think|r1|pro|flash|max|plus|k3|m3|glm|qwen|mimo)/i.test(name)
       matched.push({
         id: `cline-pass/${idPart}`,
         name,
         description: `Official ClinePass subscription model: ${name}`,
         contextLength: 200000,
         maxTokens: 8192,
-        input: ['text'],
-        category: 'general',
+        input: isVision ? ['text', 'image'] : ['text'],
+        category: hasReasoning ? 'reasoning' : (isVision ? 'multimodal' : 'general'),
         recommended: false,
         isCustom: false,
+        ...(hasReasoning ? { reasoningEfforts: ['low', 'medium', 'high', 'max'] } : {}),
       })
     }
   }

package/lib/provider-sync.js

@@ -37,9 +37,9 @@ export async function checkRegisteredInPiAi(ctx) {
   }
 }
 
-export async function resolveActiveAccountKey(ctx, cfg) {
-  const pool = await resolveAccountPool(ctx, cfg)
-  const configured = pool.filter((acc) => acc.present && acc.value)
+export async function resolveActiveAccountKey(ctx, cfg, pool = null) {
+  const accountPool = pool || await resolveAccountPool(ctx, cfg)
+  const configured = accountPool.filter((acc) => acc.present && acc.value)
   if (!configured.length) {
     return { envName: publicConfig(cfg).apiKeyEnv, value: '', source: 'none', id: 'default' }
   }
@@ -62,7 +62,7 @@ export async function buildStatus(ctx, cfg) {
     probeHealth(pub.baseUrl, { timeoutMs: probeTimeout }),
   ])
 
-  const activeAcc = await resolveActiveAccountKey(ctx, cfg)
+  const activeAcc = await resolveActiveAccountKey(ctx, cfg, pool)
   const allModels = getAllModels(pub.dynamicModels)
 
   let usage = null

package/lib/routes/accounts.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
 import { clearUsageCache, clearProbeCache } from '../cline-client.js'
@@ -11,9 +11,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/accounts/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -43,9 +41,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/register',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -65,9 +61,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/unregister',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         await removePiAiProvider(ctx)
         writeJson(res, 200, { ok: true })

package/lib/routes/auth.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig } from '../config.js'
 import { resolveActiveAccountKey } from '../provider-sync.js'
 import { smokeChat, recordSessionRequest, rotateToNextAccount, DEFAULT_MODEL_ID } from '../cline-client.js'
@@ -13,9 +13,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/auth/begin',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const authUrl = 'https://app.cline.bot'
         authSession = {
@@ -54,9 +52,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/models.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
@@ -11,9 +11,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     kind: 'exact',
     path: '/dsh-clinebot/models/sync',
     handler: async (req, res) => {
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       if (req.method !== 'POST') {
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
@@ -69,9 +67,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/settings.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest } from '../access.js'
+import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, Config } from '../config.js'
 import { buildStatus } from '../provider-sync.js'
 import { saveCredentialKey, smokeChat, DEFAULT_API_KEY_ENV } from '../cline-client.js'
@@ -62,9 +62,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/save-key',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'Forbidden' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",