@goodandready/dsh-clinebot 0.3.22 → 0.3.24

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.24] - 2026-09-24
+
+### Fixed
+
+- The settings card opens. Host settings are published as a namespace, copied to plain values before use, and account credential names are read as text, so the form renders instead of a React error.
+
+## [0.3.23] - 2026-09-24
+
+### Fixed
+- **React Error #185 Infinite Loop Fix (#74 / GitHub #6)**: Restored stable reference constant `SNAPSHOT_READY` in `SettingsPage.getSnapshot` for `useSyncExternalStore`. Returning an inline object literal caused `Object.is` mismatch on every render, triggering an infinite update depth loop (`Maximum update depth exceeded`). The snapshot fallback now returns frozen `SNAPSHOT_READY`, guaranteeing reference stability while keeping the page unblocked in standalone mode.
+- The settings schema marks the user-editable fields volatile, so DSH includes the `dsh-clinebot` namespace and the configuration page is no longer stuck on "host namespace is not ready".
+- Nested fields inside an already volatile array stay plain. The plugin copies host volatile references to plain values before `structuredClone`, so startup does not reject the config or fail to clone a getter.
+- The configuration page renders its own status payload when the host form snapshot is still loading. A missing host namespace still shows the unavailable banner until that payload arrives.
+- Account credential names are read as text. A host volatile reference was sent through as an empty object, and React error #31 replaced the settings card.
+- The settings page binds `configForms.get('dsh-clinebot')` on DSH 0.1.7. The removed `settingsScope` and `lanSettings` services are no longer consulted, so the plugin configuration page can render after install.
+- `GET /dsh-clinebot/status`, `/config`, `/usage`, and `/auth/status` use the same trusted-request check as the write routes. Usage responses keep the quota fields the card shows and omit the raw provider payload.
+- `/cline models` prints the model total in English.
+
 ## [0.3.22] - 2026-09-24
 
 ### Fixed
@@ -186,7 +204,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.3.4] - 2026-09-08
 
 ### Fixed
-- **Cache Path Resolution**: Corrected POSIX home directory expansion (`~/`) in `resolvePathWithHome` so `~/.dsh/clinebot-models-cache.json` resolves cleanly to `/home/vadim/.dsh/...` instead of root-level paths.
+- **Cache Path Resolution**: Corrected POSIX home directory expansion (`~/`) in `resolvePathWithHome` so `~/.dsh/clinebot-models-cache.json` resolves under the user home directory instead of a root-level path.
 
 ## [0.3.3] - 2026-09-08
 

package/README.md

@@ -50,7 +50,7 @@ Integrating ClinePass into DeepSeek Harness (DSH) natively poses key challenges:
 * 🚀 **One-Click In-App Updater**: Upgrade `@goodandready/dsh-clinebot` directly from the DSH UI or trigger secure loopback updates via `/dsh-clinebot/update`.
 * ⚡ **SWR Quota & Health Caching**: Instantaneous response time (<2ms) on status queries with background revalidation.
 * 🔀 **Smart Quota-Aware Failover**: Automatic multi-account rotation skipping exhausted accounts and recovering when `resetsAt` is reached.
-* 🖥️ **Dedicated Settings Page**: Full-width page in DSH Settings (`Settings → ClineBot`).
+* 🖥️ **Plugin configuration page**: Open the installed ClineBot plugin and choose configure. The page shows the credential name, models, quota, and accounts. It is not a separate sidebar section.
 * 🔄 **Dynamic Subscription Model Sync**: Automatically pulls real models included in your ClinePass plan directly from `GET /api/v1/users/me/plan` with one-click DSH provider sync.
 * ⚠️ **Quota Exhaustion Alerts**: Real-time visual warning banners when 5-hour rolling limit reaches 80% (warning) and 95% (exhausted), complete with countdown to reset.
 * 📈 **Session Metrics Telemetry**: Live dashboard tracking request counts, token consumption estimates, latency, and last-request timestamp.
@@ -118,7 +118,7 @@ graph LR
 * **`lib/index.js`**:
   Cordis service module managing routes (including `POST /dsh-clinebot/models/sync`), quota warnings threshold evaluation, credentials, and registering the `/cline` slash command.
 * **`lib/client.js`**:
-  Full-featured dedicated Settings section (`settings.section`, order 28) with live quota bars, exhaustion warning banner, session metrics telemetry card, one-click plan sync button, and plugin accordion (`settings.plugin.item`).
+  Configuration page on the plugin row (`plugins.row.config`) with live quota bars, an exhaustion warning, session metrics, one-click plan sync, and a fallback plugins card (`settings.plugin.item`). There is no `settings.section` sidebar entry.
 
 ---
 

package/README.ru.md

@@ -50,7 +50,7 @@
 * 🚀 **Обновление в один клик**: Обновление плагина прямо из интерфейса DSH или через защищённый loopback-эндпоинт `/dsh-clinebot/update`.
 * ⚡ **SWR-кэширование квот и здоровья**: Мгновенный ответ (<2 мс) на запросы статуса с фоновым обновлением данных без блокировки UI.
 * 🔀 **Smart Quota-Aware Failover**: Интеллектуальная ротация аккаунтов с обходом исчерпанных лимитов и авто-восстановлением при наступлении `resetsAt`.
-* 🖥️ **Отдельная страница в Настройках**: собственная полноэкранная страница в меню Настроек DSH (`Настройки → ClineBot`).
+* 🖥️ **Страница конфигурации плагина**: откройте установленный ClineBot и перейдите в настройки плагина. Там имя учётных данных, модели, квота и аккаунты. Отдельного пункта бокового меню нет.
 * 🔄 **Динамическая синхронизация моделей подписки**: автоматическое получение реального списка моделей из `GET /api/v1/users/me/plan` и мгновенное обновление провайдера DSH в один клик.
 * ⚠️ **Предупреждения об исчерпании квоты**: баннеры предупреждения при достижении 80% (внимание) и 95% (исчерпано) 5-часового лимита с таймером сброса.
 * 📈 **Метрики сессии**: учет количества запросов, расчетных токенов (Prompt / Completion), задержки и времени последнего вызова.
@@ -115,7 +115,7 @@ graph LR
   * `smokeChat`: замер задержки и тестовый пинг с фиксацией статистики.
   * `buildPiAiProvider`: генерация конфигурации провайдера для `llm-pi-ai` (`api: 'openai-completions'`).
 * **`lib/index.js`**: сервис Cordis, регистрация системных маршрутов (включая `/dsh-clinebot/models/sync`), расчет порогов предупреждения квоты и слэш-команды `/cline`.
-* **`lib/client.js`**: полнофункциональный раздел настроек (`settings.section`, order 28) с баннерами предупреждений, карточкой статистики сессии, кнопкой синхронизации моделей плана и аккордеоном плагина (`settings.plugin.item`).
+* **`lib/client.js`**: страница конфигурации строки плагина (`plugins.row.config`) с предупреждениями, статистикой сессии, синхронизацией моделей и запасной карточкой (`settings.plugin.item`). Пункта `settings.section` в боковом меню нет.
 
 ---
 

package/README.zh.md

@@ -50,7 +50,7 @@
 * 🚀 **应用内一键更新**：直接在 DSH 界面检查并升级插件，或通过受保护的 `/dsh-clinebot/update` 进行本地安全更新。
 * ⚡ **SWR 配额与健康状态缓存**：状态查询毫秒级响应（<2ms），并在后台静默更新，不阻塞前端渲染。
 * 🔀 **智能配额故障转移 (Smart Failover)**：多账号池自动轮询，避开耗尽账号并在 `resetsAt` 到达后自动恢复。
-* 🖥️ **专属设置大页**：在 DSH 设置中提供全宽独立页面（`设置 → ClineBot`）。
+* 🖥️ **插件配置页**：打开已安装的 ClineBot，进入配置。页面包含凭据名、模型、配额和账号，不单独占用侧边栏。
 * 🔄 **订阅模型动态同步**：从官方 `GET /api/v1/users/me/plan` 自动提取真实包含模型，一键原子级同步至 DSH 提供商配置，无需等待插件更新。
 * ⚠️ **额度耗尽实时预警**：当 5 小时滑动窗口达到 80%（警告黄色）和 95%（即将耗尽红色）时展示醒目预警横幅与重置倒计时。
 * 📈 **会话统计与指标看板**：实时追踪请求调用次数、预估 Token（Prompt / Completion）、最近延迟及最后调用时间。
@@ -115,7 +115,7 @@ graph LR
   * `smokeChat`：毫秒级网络探活与非流式延迟测试，并记录会话指标。
   * `buildPiAiProvider`：构建 DSH `llm-pi-ai` 兼容的服务商定义 (`api: 'openai-completions'`)。
 * **`lib/index.js`**：Cordis 插件主生命周期服务，注册后端 REST API 路由（含 `/dsh-clinebot/models/sync`）、额度预警计算与 `/cline` 聊天斜杠指令。
-* **`lib/client.js`**：前端设置面板（`settings.section` 序号 28），内含预警横幅、会话指标卡片、一键模型同步按钮及插件折叠卡片。
+* **`lib/client.js`**：插件行配置页（`plugins.row.config`），含预警横幅、会话指标、一键模型同步，以及后备插件卡片（`settings.plugin.item`）。没有 `settings.section` 侧边栏项。
 
 ---
 

package/lib/account-pool.js

@@ -3,8 +3,16 @@ import { resolveKeyValue, usageCache, clearUsageCache, clearProbeCache, DEFAULT_
 /**
  * Resolve all accounts in pool with their status and keys.
  */
+function textSetting(value) {
+  let current = value
+  while (current && typeof current === 'object' && !Array.isArray(current) && typeof current.get === 'function') {
+    current = current.get()
+  }
+  return typeof current === 'string' ? current.trim() : ''
+}
+
 export async function resolveAccountPool(ctx, cfg) {
-  const apiKeyEnv = cfg?.apiKeyEnv || DEFAULT_API_KEY_ENV
+  const apiKeyEnv = textSetting(cfg?.apiKeyEnv) || DEFAULT_API_KEY_ENV
   const defaultSlot = {
     id: 'default',
     label: 'Default',
@@ -12,16 +20,16 @@ export async function resolveAccountPool(ctx, cfg) {
   }
   const accounts = Array.isArray(cfg?.accounts) ? cfg.accounts : []
   const allSlots = [defaultSlot, ...accounts]
-  const activeAccount = String(cfg?.activeAccount || '')
+  const activeAccount = textSetting(cfg?.activeAccount)
   const resolved = []
 
   for (let i = 0; i < allSlots.length; i++) {
     const slot = allSlots[i]
-    const envName = slot.apiKeyEnv || (i === 0 ? apiKeyEnv : `CLINEBOT_API_KEY_${i + 1}`)
+    const envName = textSetting(slot.apiKeyEnv) || (i === 0 ? apiKeyEnv : `CLINEBOT_API_KEY_${i + 1}`)
     const keyInfo = await resolveKeyValue(ctx, envName)
     resolved.push({
       id: slot.id || (i === 0 ? 'default' : `account-${i + 1}`),
-      label: slot.label || (i === 0 ? 'Default' : `Account ${i + 1}`),
+      label: textSetting(slot.label) || (i === 0 ? 'Default' : `Account ${i + 1}`),
       apiKeyEnv: envName,
       present: Boolean(keyInfo.value),
       source: keyInfo.source,

package/lib/client.js

@@ -14,7 +14,11 @@ const NS = 'dsh-clinebot'
 const ROW_ID = 'dsh-clinebot'
 const ROW_CONFIG_KEY = '@goodandready/dsh-clinebot#' + ROW_ID
 const ROUTE_PREFIX = '/dsh-clinebot'
-const SNAPSHOT_LOADING = { status: 'loading', view: null }
+const SNAPSHOT_LOADING = Object.freeze({ status: 'loading', view: null })
+// Stable (frozen) fallback reference: useSyncExternalStore compares snapshots by
+// identity (Object.is), so returning a fresh object literal causes an infinite render loop
+// (React error #185 "Maximum update depth exceeded"). Keep this module-level.
+const SNAPSHOT_READY = Object.freeze({ status: 'ready', view: null })
 
 // --- src/client/locales.js ---
 const en = {
@@ -534,12 +538,14 @@ function AccountsSection({ status, busy, handlePinAccount, t }) {
         'tbody',
         null,
         status.accounts.map((acc) => {
-          const isActive = status.activeAccount === acc.apiKeyEnv || (!status.activeAccount && acc.id === 'default')
+          const envName = typeof acc.apiKeyEnv === 'string' ? acc.apiKeyEnv : ''
+          const label = typeof acc.label === 'string' ? acc.label : ''
+          const isActive = status.activeAccount === envName || (!status.activeAccount && acc.id === 'default')
           return React.createElement(
             'tr',
             { key: acc.id },
-            React.createElement('td', null, React.createElement('strong', null, acc.label)),
-            React.createElement('td', null, React.createElement('code', null, acc.apiKeyEnv)),
+            React.createElement('td', null, React.createElement('strong', null, label)),
+            React.createElement('td', null, React.createElement('code', null, envName)),
             React.createElement(
               'td',
               null,
@@ -561,7 +567,7 @@ function AccountsSection({ status, busy, handlePinAccount, t }) {
                       className: 'cb-btn',
                       style: { padding: '4px 8px', fontSize: '11px' },
                       disabled: !!busy,
-                      onClick: () => handlePinAccount(acc.apiKeyEnv),
+                      onClick: () => handlePinAccount(envName),
                     },
                     t('accounts.pin_btn')
                   )
@@ -834,36 +840,29 @@ Response: ${smokeResult.preview || '(empty)'}`
 }
 
 // --- src/client/settings-page.js ---
+function readConfigForms(ctx) {
+  if (!ctx || typeof ctx.get !== 'function') return undefined
+  try {
+    return ctx.get('configForms') || undefined
+  } catch (err) {
+    console.warn('[dsh-clinebot] configForms is not available:', err)
+    return undefined
+  }
+}
+
 function SettingsPage(props) {
   const ctx = props?.ctx
   const t = props?.t || makeT(en, en)
 
   const scope = React.useMemo(() => {
-    let s = null
-    try {
-      if (typeof ctx?.get === 'function') {
-        s = ctx.get('lanSettings') || ctx.get('settingsScope')
-      }
-    } catch (_) {
-      s = null
-    }
-    if (!s) {
-      try {
-        if (ctx && typeof ctx === 'object') {
-          s = ctx.lanSettings || ctx.settingsScope || null
-        }
-      } catch (_) {
-        s = null
-      }
-    }
-    if (!s) return undefined
+    const svc = readConfigForms(ctx)
+    if (!svc || typeof svc.get !== 'function') return undefined
     try {
-      if (typeof s.bind === 'function') return s.bind({ namespace: NS })
-      if (typeof s.get === 'function') return s.get(NS)
-    } catch (_) {
+      return svc.get(NS)
+    } catch (err) {
+      console.warn('[dsh-clinebot] configForms.get failed:', err)
       return undefined
     }
-    return undefined
   }, [ctx])
 
   const subscribe = React.useMemo(() => {
@@ -878,18 +877,19 @@ function SettingsPage(props) {
   }, [scope])
 
   const getSnapshot = React.useCallback(() => {
-    if (!scope?.getSnapshot) return { status: 'ready', view: null }
+    if (!scope?.getSnapshot) return SNAPSHOT_READY
     try {
-      return scope.getSnapshot() || { status: 'ready', view: null }
-    } catch (_) {
-      return { status: 'ready', view: null }
+      return scope.getSnapshot() || SNAPSHOT_READY
+    } catch (err) {
+      console.warn('[dsh-clinebot] settings snapshot failed:', err)
+      return SNAPSHOT_READY
     }
   }, [scope])
 
   const snapshot = React.useSyncExternalStore(
     subscribe,
     getSnapshot,
-    React.useCallback(() => SNAPSHOT_LOADING, [])
+    React.useCallback(() => SNAPSHOT_READY, [])
   )
   const snapshotStatus = snapshot?.status || 'loading'
 
@@ -1198,15 +1198,14 @@ function SettingsPage(props) {
     debounceSaveDisabledModels(nextDisabled)
   }
 
-  if (snapshotStatus === 'unavailable') {
-    return React.createElement(
-      'div',
-      { className: 'cb-page' },
-      React.createElement('div', { className: 'cb-banner-warning' }, t('settings.unavailable'))
-    )
-  }
-
-  if (!status || !draft || snapshotStatus === 'loading') {
+  if (!status || !draft) {
+    if (snapshotStatus === 'unavailable') {
+      return React.createElement(
+        'div',
+        { className: 'cb-page' },
+        React.createElement('div', { className: 'cb-banner-warning' }, t('settings.unavailable'))
+      )
+    }
     if (err) {
       return React.createElement(
         'div',
@@ -1386,49 +1385,14 @@ function PluginCard(props) {
 }
 
 // --- src/client/entry.js ---
-function refreshMirrorUntilVisible(ctx) {
-  const getSettingsService = () => {
-    try {
-      if (typeof ctx?.get === 'function') {
-        const s = ctx.get('lanSettings') || ctx.get('settingsScope')
-        if (s) return s
-      }
-    } catch (_) {}
-    try {
-      if (ctx && typeof ctx === 'object') {
-        return ctx.lanSettings || ctx.settingsScope || null
-      }
-    } catch (_) {}
-    return null
-  }
-
-  const s = getSettingsService()
-  if (!s) return
-
-  const visible = () => {
-    try {
-      const current = getSettingsService()
-      const view = current?.describe?.()?.getSnapshot?.()?.view
-      return !!view && Array.isArray(view.namespaces) && view.namespaces.some((row) => row.ns === NS)
-    } catch (_) {
-      return false
-    }
+function ensureSettingsForm(ctx) {
+  const svc = readConfigForms(ctx)
+  if (!svc || typeof svc.get !== 'function') return
+  try {
+    svc.get(NS)
+  } catch (err) {
+    console.warn('[dsh-clinebot] configForms.get failed:', err)
   }
-  if (visible()) return
-
-  if (typeof setInterval !== 'function') return
-
-  let tries = 0
-  const timer = setInterval(() => {
-    if (visible() || tries >= 15) { clearInterval(timer); return }
-    tries += 1
-    try {
-      const current = getSettingsService()
-      current?.describe?.()?.load?.()
-    } catch (e) {
-      console.debug?.('[dsh-clinebot] Polling settings mirror:', e)
-    }
-  }, 1000)
 }
 
 function apply(ctx) {
@@ -1453,8 +1417,8 @@ function apply(ctx) {
 
   if (typeof ctx.effect === 'function') {
     ctx.effect(
-      () => refreshMirrorUntilVisible(ctx),
-      'dsh-clinebot: re-read the settings mirror until our namespace appears',
+      () => { ensureSettingsForm(ctx) },
+      'dsh-clinebot: open the settings form for this namespace',
     )
   }
 
@@ -1532,7 +1496,7 @@ function apply(ctx) {
   )
 }
 
-module.exports = { apply, inject: ['slots', 'locale'] }
+module.exports = { apply, inject: ['slots', 'locale', 'configForms'] }
 
     return module.exports
   },

package/lib/config.js

@@ -13,22 +13,32 @@ import {
   getActiveModelIds,
 } from './models.js'
 
+
+// DSH settings.describe only publishes fields marked volatile. Without them the
+// namespace is omitted and the configuration page stays unavailable.
+if (typeof z.prototype?.volatile !== 'function') {
+  z.prototype.volatile = function volatile() {
+    if (this.meta && this.meta.volatile) throw new TypeError('volatile schema is already wrapped')
+    return typeof this.extra === 'function' ? this.extra('volatile', true) : this
+  }
+}
+
 export const NS = 'dsh-clinebot'
 export const LLM_PI_AI_NS = 'llm-pi-ai'
 
 export const Config = z.object({
   enabled: z.boolean().default(true)
-    .description('When true, ClineBot is registered as a model provider in DSH.'),
+    .description('When true, ClineBot is registered as a model provider in DSH.').volatile(),
   baseUrl: z.string().default(DEFAULT_BASE_URL)
-    .description('Base API URL (default: https://api.cline.bot/api/v1).'),
+    .description('Base API URL (default: https://api.cline.bot/api/v1).').volatile(),
   apiKeyEnv: z.string().default(DEFAULT_API_KEY_ENV)
-    .description('Credential / env name containing the ClinePass API key (never store key directly here).'),
+    .description('Credential / env name containing the ClinePass API key (never store key directly here).').volatile(),
   defaultModel: z.string().default(DEFAULT_MODEL_ID)
-    .description('Default model ID for chat and smoke tests.'),
+    .description('Default model ID for chat and smoke tests.').volatile(),
   disabledModels: z.array(z.string()).default([])
-    .description('List of model IDs explicitly disabled by the user (new models are enabled automatically).'),
+    .description('List of model IDs explicitly disabled by the user (new models are enabled automatically).').volatile(),
   enabledModels: z.array(z.string()).default([])
-    .description('Deprecated: preserved for backwards compatibility with earlier versions.'),
+    .description('Deprecated: preserved for backwards compatibility with earlier versions.').volatile(),
   dynamicModels: z.array(z.object({
     id: z.string(),
     name: z.string(),
@@ -40,23 +50,42 @@ export const Config = z.object({
     isCustom: z.boolean().default(false),
     reasoningEfforts: z.any().default(undefined),
   })).default([])
-    .description('Models automatically discovered from the official ClinePass subscription plan.'),
+    .description('Models automatically discovered from the official ClinePass subscription plan.').volatile(),
   timeoutMs: z.number().default(DEFAULT_TIMEOUT_MS)
-    .description('HTTP probe timeout in milliseconds.'),
+    .description('HTTP probe timeout in milliseconds.').volatile(),
   smokeTimeoutMs: z.number().default(DEFAULT_SMOKE_TIMEOUT_MS)
-    .description('Timeout for smoke chat completions in milliseconds.'),
+    .description('Timeout for smoke chat completions in milliseconds.').volatile(),
   modelsCachePath: z.string().default('~/.dsh/clinebot-models-cache.json')
-    .description('Local on-disk cache path for models snapshot.'),
+    .description('Local on-disk cache path for models snapshot.').volatile(),
   accounts: z.array(z.object({
     label: z.string().default(''),
     apiKeyEnv: z.string(),
   })).default([])
-    .description('Additional accounts for multi-account failover and rate limit rotation.'),
+    .description('Additional accounts for multi-account failover and rate limit rotation.').volatile(),
   activeAccount: z.string().default('')
-    .description('Manually pinned active account envName or empty for auto/default.'),
+    .description('Manually pinned active account envName or empty for auto/default.').volatile(),
 })
 
+
+function isVolatileRef(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
+}
+
+// DSH stores each volatile field as { get }. structuredClone cannot copy that
+// getter, so callers need a plain snapshot before validation.
+export function plainConfig(cfg) {
+  if (isVolatileRef(cfg)) return plainConfig(cfg.get())
+  if (!cfg || typeof cfg !== 'object') return cfg
+  const out = {}
+  for (const key of Object.keys(cfg)) {
+    const value = cfg[key]
+    out[key] = isVolatileRef(value) ? value.get() : value
+  }
+  return out
+}
+
 export function publicConfig(cfg) {
+  cfg = plainConfig(cfg)
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
   const allDefaultIds = getDefaultModelIds(dynamic)
 

package/lib/http.js

@@ -92,3 +92,34 @@ export function isTrustedSettingsRequest(request) {
 
   return false
 }
+
+export function publicUsage(usage) {
+  if (!usage || typeof usage !== 'object') return null
+  const windowView = (window) => {
+    if (!window || typeof window !== 'object') return null
+    return {
+      percentUsed: window.percentUsed,
+      remainingPercent: window.remainingPercent,
+      resetsAt: window.resetsAt || null,
+    }
+  }
+  if (usage.ok === false) {
+    return {
+      ok: false,
+      error: typeof usage.error === 'string' ? usage.error : 'usage unavailable',
+      checkedAt: usage.checkedAt,
+    }
+  }
+  return {
+    ok: true,
+    plan: usage.plan || null,
+    user: { email: usage.user?.email || null },
+    windows: {
+      fiveHour: windowView(usage.windows?.fiveHour),
+      weekly: windowView(usage.windows?.weekly),
+      monthly: windowView(usage.windows?.monthly),
+    },
+    checkedAt: usage.checkedAt,
+  }
+}
+

package/lib/index.js

@@ -1,4 +1,4 @@
-import { Config, publicConfig, NS, LLM_PI_AI_NS } from './config.js'
+import { Config, publicConfig, plainConfig, NS, LLM_PI_AI_NS } from './config.js'
 import { registerPluginUpdater } from './updater.js'
 import {
   sessionStats,
@@ -30,7 +30,7 @@ export { NS, LLM_PI_AI_NS, Config, sessionStats, recordSessionRequest, resetSess
 
 export function apply(ctx, config) {
   let getConfig = () => config
-  const live = () => (getConfig() ? Config(structuredClone(getConfig())) : config)
+  const live = () => (getConfig() ? Config(structuredClone(plainConfig(getConfig()))) : config)
   let settingsApi
 
   const syncProviderState = async (cfg) => {

package/lib/provider-sync.js

@@ -1,6 +1,7 @@
 import os from 'node:os'
 import path from 'node:path'
 import { publicConfig, Config, LLM_PI_AI_NS } from './config.js'
+import { publicUsage } from './http.js'
 import {
   PROVIDER_ID,
   PROVIDER_DISPLAY_NAME,
@@ -109,7 +110,7 @@ export async function buildStatus(ctx, cfg) {
     })),
     activeAccount: activeAcc.apiKeyEnv,
     health,
-    usage,
+    usage: publicUsage(usage),
     quotaWarning,
     sessionStats: { ...sessionStats },
     isRegistered,

package/lib/routes/auth.js

@@ -38,6 +38,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/auth/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
+      if (!assertTrustedSettingsRequest(req, res)) return
       writeJson(res, 200, {
         ok: true,
         status: authSession?.state || 'idle',

package/lib/routes/models.js

@@ -4,6 +4,7 @@ import { publicConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
 import { fetchUsageLimits } from '../cline-client.js'
+import { publicUsage } from '../http.js'
 
 export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // POST /dsh-clinebot/models/sync — dynamically load models from plan
@@ -103,6 +104,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/usage',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const pub = publicConfig(live())
         const activeKey = await resolveActiveAccountKey(ctx, live())
@@ -113,7 +115,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           timeoutMs: pub.timeoutMs,
           bypassCache: true,
         })
-        writeJson(res, usageData.ok ? 200 : 502, usageData)
+        writeJson(res, usageData.ok ? 200 : 502, publicUsage(usageData))
       } catch (err) {
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }

package/lib/routes/settings.js

@@ -11,6 +11,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
+      if (!assertTrustedSettingsRequest(req, res)) return
       try {
         const st = await buildStatus(ctx, live())
         writeJson(res, 200, st)
@@ -26,6 +27,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/config',
     handler: async (req, res) => {
       if (req.method === 'GET') {
+        if (!assertTrustedSettingsRequest(req, res)) return
         return writeJson(res, 200, { ok: true, config: publicConfig(live()) })
       }
       if (req.method !== 'PUT') {

package/lib/slash-command.js

@@ -39,7 +39,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           const disabledSet = new Set(pub.disabledModels || [])
           const lines = [
             '### 🎯 ClinePass Models Catalog',
-            `* **Всего моделей**: ${allModels.length} (${allModels.filter((m) => !disabledSet.has(m.id)).length} активно)`,
+            `* **Total models**: ${allModels.length} (${allModels.filter((m) => !disabledSet.has(m.id)).length} active)`,
             '',
           ]
           for (const m of allModels) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.22",
+  "version": "0.3.24",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",
@@ -49,7 +49,11 @@
     },
     "client": {
       "platform": "web",
-      "inject": []
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "peerDependencies": {