@goodandready/dsh-clinebot 0.3.24 → 0.4.0

package/lib/routes/models.js

@@ -1,6 +1,6 @@
 import { writeJson, readBody } from '../http.js'
 import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
-import { publicConfig, Config } from '../config.js'
+import { publicConfig, plainConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
 import { fetchUsageLimits } from '../cline-client.js'
@@ -35,18 +35,21 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         const dynamicModels = Array.isArray(usageData.dynamicModels) ? usageData.dynamicModels : []
         const allModels = getAllModels(dynamicModels)
         const settingsApi = getSettingsApi()
+        if (!settingsApi || typeof settingsApi.replace !== 'function') {
+          return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+        }
 
-        if (settingsApi?.replace) {
-          const next = Config({
-            ...live(),
-            dynamicModels,
-          })
-          await settingsApi.replace(next)
-          await syncProviderState(next)
-          const cacheFile = resolvePathWithHome(pub.modelsCachePath)
-          if (cacheFile) {
-            await saveModelsDiskCache(cacheFile, dynamicModels)
-          }
+        const now = Date.now()
+        const next = Config({
+          ...plainConfig(live()),
+          dynamicModels,
+          planSyncedAt: now,
+        })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+        const cacheFile = resolvePathWithHome(pub.modelsCachePath)
+        if (cacheFile) {
+          await saveModelsDiskCache(cacheFile, dynamicModels, now)
         }
 
         return writeJson(res, 200, {
@@ -75,23 +78,23 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
 
         const settingsApi = getSettingsApi()
-        if (settingsApi?.replace) {
-          const patch = {}
-          if (Array.isArray(body.disabledModels)) {
-            patch.disabledModels = body.disabledModels
-          } else if (Array.isArray(body.enabledModels)) {
-            const allModels = getAllModels(live().dynamicModels)
-            const enabledSet = new Set(body.enabledModels)
-            patch.disabledModels = allModels.map((m) => m.id).filter((id) => !enabledSet.has(id))
-          }
-          if (body.defaultModel) patch.defaultModel = body.defaultModel
-          const next = Config({ ...live(), ...patch })
-          await settingsApi.replace(next)
-          await syncProviderState(next)
-          writeJson(res, 200, { ok: true, disabledModels: next.disabledModels, enabledModels: publicConfig(next).enabledModels })
-        } else {
-          writeJson(res, 200, { ok: true })
+        if (!settingsApi || typeof settingsApi.replace !== 'function') {
+          return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+        }
+
+        const patch = {}
+        if (Array.isArray(body.disabledModels)) {
+          patch.disabledModels = body.disabledModels
+        } else if (Array.isArray(body.enabledModels)) {
+          const allModels = getAllModels(publicConfig(live()).dynamicModels)
+          const enabledSet = new Set(body.enabledModels)
+          patch.disabledModels = allModels.map((m) => m.id).filter((id) => !enabledSet.has(id))
         }
+        if (body.defaultModel) patch.defaultModel = body.defaultModel
+        const next = Config({ ...plainConfig(live()), ...patch })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+        writeJson(res, 200, { ok: true, disabledModels: next.disabledModels, enabledModels: publicConfig(next).enabledModels })
       } catch (err) {
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }

package/lib/routes/settings.js

@@ -1,6 +1,6 @@
 import { writeJson, readBody } from '../http.js'
 import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
-import { publicConfig, Config } from '../config.js'
+import { publicConfig, plainConfig, Config } from '../config.js'
 import { buildStatus } from '../provider-sync.js'
 import { saveCredentialKey, smokeChat, DEFAULT_API_KEY_ENV } from '../cline-client.js'
 
@@ -33,22 +33,42 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
       if (req.method !== 'PUT') {
         return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
       }
-      if (!isTrustedSettingsRequest(req)) {
-        return writeJson(res, 403, { ok: false, error: 'same-origin only' })
-      }
+      if (!assertTrustedSettingsRequest(req, res)) return
       const settingsApi = getSettingsApi()
       if (!settingsApi) {
         return writeJson(res, 503, { ok: false, error: 'settings not ready' })
       }
+      let bodyBuf
+      try {
+        bodyBuf = await readBody(req)
+      } catch (err) {
+        return writeJson(res, 400, { ok: false, error: String(err?.message || err) })
+      }
       let payload
       try {
-        payload = JSON.parse((await readBody(req)).toString('utf8') || '{}')
+        payload = JSON.parse(bodyBuf.toString('utf8') || '{}')
       } catch {
         return writeJson(res, 400, { ok: false, error: 'invalid json' })
       }
-      if (payload && typeof payload.config === 'object') payload = payload.config
+      const rawPayload = payload && typeof payload.config === 'object' && payload.config !== null ? payload.config : payload
+      if (!rawPayload || typeof rawPayload !== 'object' || Array.isArray(rawPayload)) {
+        return writeJson(res, 400, { ok: false, error: 'body must be a JSON object' })
+      }
+      if ('enabledModels' in rawPayload) {
+        return writeJson(res, 400, { ok: false, error: 'enabledModels is deprecated and not allowed; configure disabledModels instead' })
+      }
+      const allowedKeys = new Set(Object.keys(Config.dict || {}))
+      allowedKeys.delete('enabledModels')
+      for (const k of Object.keys(rawPayload)) {
+        if (!allowedKeys.has(k)) {
+          return writeJson(res, 400, { ok: false, error: `unknown config field: ${k}` })
+        }
+      }
       try {
-        const parsed = Config({ ...publicConfig(live()), ...payload })
+        const base = plainConfig(live()) || {}
+        delete base.enabledModels
+        const merged = { ...base, ...rawPayload }
+        const parsed = Config(merged)
         await settingsApi.replace(parsed)
         await syncProviderState(parsed)
         writeJson(res, 200, { ok: true, config: publicConfig(live()) })
@@ -77,15 +97,35 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
 
         const pub = publicConfig(live())
         const targetEnvName = String(body.apiKeyEnv || pub.apiKeyEnv || DEFAULT_API_KEY_ENV).trim()
+
+        const isDefaultPattern = /^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnvName)
+        const isConfiguredEnv = targetEnvName === pub.apiKeyEnv ||
+          (Array.isArray(pub.accounts) && pub.accounts.some(acc => acc && acc.apiKeyEnv === targetEnvName))
+
+        if (!isDefaultPattern && !isConfiguredEnv) {
+          return writeJson(res, 400, {
+            ok: false,
+            error: `Disallowed apiKeyEnv: "${targetEnvName}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$ or be configured in settings.`,
+          })
+        }
+
         await saveCredentialKey(ctx, targetEnvName, apiKey)
 
         await syncProviderState(live())
         triggerAutoDiscover()
 
-        const validation = await smokeChat(pub.baseUrl, apiKey, {
-          model: pub.defaultModel,
-          timeoutMs: 15000,
-        })
+        let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
+        try {
+          const parsedUrl = new URL(pub.baseUrl)
+          if (parsedUrl.protocol === 'https:') {
+            validation = await smokeChat(pub.baseUrl, apiKey, {
+              model: pub.defaultModel,
+              timeoutMs: 15000,
+            })
+          }
+        } catch {
+          validation = { ok: false, error: 'Invalid baseUrl' }
+        }
 
         writeJson(res, 200, {
           ok: true,

package/lib/slash-command.js

@@ -1,4 +1,4 @@
-import { publicConfig, Config } from './config.js'
+import { publicConfig, plainConfig, Config } from './config.js'
 import { resolveActiveAccountKey, formatProgressBar } from './provider-sync.js'
 import {
   getAllModels,
@@ -13,11 +13,12 @@ import {
   probeHealth,
   smokeChat,
   fetchUsageLimits,
-  recordSessionRequest,
+  recordSmokeTest,
   clearUsageCache,
   clearProbeCache,
   usageCache,
   sessionStats,
+  getLastRotation,
 } from './cline-client.js'
 
 export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderState }) {
@@ -37,11 +38,18 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
         if (subcmd === 'models') {
           const allModels = getAllModels(pub.dynamicModels)
           const disabledSet = new Set(pub.disabledModels || [])
+          const syncStatus = pub.planSynced
+            ? `✅ Verified with plan (${pub.planSyncedAt ? new Date(pub.planSyncedAt).toLocaleDateString() : 'synced'})`
+            : '⚠️ Not verified with plan (fallback catalog)'
           const lines = [
             '### 🎯 ClinePass Models Catalog',
+            `* **Plan Sync**: ${syncStatus}`,
             `* **Total models**: ${allModels.length} (${allModels.filter((m) => !disabledSet.has(m.id)).length} active)`,
-            '',
           ]
+          if (pub.defaultModelWarning) {
+            lines.push(`* ⚠️ **Warning**: ${pub.defaultModelWarning}`)
+          }
+          lines.push('')
           for (const m of allModels) {
             const active = !disabledSet.has(m.id) ? '✅' : '❌'
             const isVis = isVisionModel(m.id, pub.dynamicModels) ? '📷 Vision' : '📝 Text'
@@ -67,6 +75,10 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
             const usageInfo = cached?.windows?.fiveHour ? ` · ⏱ ${cached.windows.fiveHour.percentUsed}% used` : ''
             lines.push(`* **${acc.label}** (\`${acc.apiKeyEnv}\`): ${statusBadge} ${pinBadge}${usageInfo}`)
           }
+          const lastRot = getLastRotation()
+          if (lastRot) {
+            lines.push('', `* **Last Failover**: \`${lastRot.from}\` → \`${lastRot.to}\` (${lastRot.reason})`)
+          }
           lines.push('', 'Switch active account: `/cline switch <env_variable_name>`')
           return lines.join('\n')
         }
@@ -80,7 +92,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           clearProbeCache()
           const settingsApi = getSettingsApi()
           if (settingsApi?.replace) {
-            const next = Config({ ...live(), activeAccount: param })
+            const next = Config({ ...plainConfig(live()), activeAccount: param })
             await settingsApi.replace(next)
             await syncProviderState(next)
             return `✅ Active account switched to \`${param}\``
@@ -107,7 +119,33 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           return `❌ **Cline API Ping Failed**: ${health.error || 'Host unreachable'}`
         }
 
-        // 6. Subcommand /cline test [model] / smoke
+        // 6. Subcommand /cline stats (real DSH stream metrics)
+        if (subcmd === 'stats' || subcmd === 'telemetry') {
+          const lines = [
+            '### 📈 DSH ClineBot Stream Telemetry',
+            `* **Requests**: ${sessionStats.successfulRequests} successful / ${sessionStats.totalRequests} total${sessionStats.abortedRequests ? ` (${sessionStats.abortedRequests} aborted)` : ''}${sessionStats.failedRequests ? ` (${sessionStats.failedRequests} failed)` : ''}`,
+            `* **Estimated Tokens**: ~${sessionStats.totalTokensEst} total (~${sessionStats.promptTokensEst} prompt, ~${sessionStats.completionTokensEst} completion)`,
+            `* **Last Stream Latency**: ${sessionStats.lastLatencyMs !== null ? `${sessionStats.lastLatencyMs} ms` : '—'}`,
+            `* **Last Request At**: ${sessionStats.lastRequestAt ? new Date(sessionStats.lastRequestAt).toLocaleTimeString() : '—'}`,
+          ]
+          if (sessionStats.lastError) {
+            lines.push(`* **Last Stream Error**: ${sessionStats.lastError}`)
+          }
+          if (sessionStats.byModel && Object.keys(sessionStats.byModel).length) {
+            lines.push('', '**By Model:**')
+            for (const [mId, mStats] of Object.entries(sessionStats.byModel)) {
+              lines.push(`* \`${mId}\`: ${mStats.requests} reqs, ~${mStats.promptTokens + mStats.completionTokens} tokens`)
+            }
+          }
+          if (sessionStats.lastSmoke) {
+            const smoke = sessionStats.lastSmoke
+            const smokeTime = new Date(smoke.at).toLocaleTimeString()
+            lines.push('', `* **Last Smoke Test**: ${smoke.ok ? '✅ Passed' : '❌ Failed'} (${smoke.latencyMs} ms at ${smokeTime}${smoke.model ? `, model: \`${smoke.model}\`` : ''})`)
+          }
+          return lines.join('\n')
+        }
+
+        // 7. Subcommand /cline test [model] / smoke
         if (subcmd === 'test' || subcmd === 'smoke') {
           if (param && !isSupportedModel(param, pub.dynamicModels)) {
             return `⚠️ **ClineBot**: Model \`${param}\` is not recognized. Use \`/cline models\` to see available models.`
@@ -121,12 +159,11 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
             model: modelToTest,
             timeoutMs: pub.smokeTimeoutMs,
           })
-          recordSessionRequest({
+          recordSmokeTest({
             latencyMs: outcome.latencyMs,
             ok: outcome.ok,
             error: outcome.error,
-            promptTokens: outcome.promptTokens || 5,
-            completionTokens: outcome.completionTokens || 10,
+            model: modelToTest,
           })
 
           let failoverNotice = ''
@@ -170,10 +207,15 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           `* **Host Ping**: ${health.ok ? `✅ ${health.latencyMs} ms` : '❌ Unreachable'}`,
           `* **Active Key**: \`${activeKey.envName}\` (${activeKey.source})`,
           `* **Default Model**: \`${pub.defaultModel}\``,
+        ]
+        if (pub.defaultModelWarning) {
+          lines.push(`* ⚠️ **Warning**: ${pub.defaultModelWarning}`)
+        }
+        lines.push(
           '',
           `**⏱ 5-Hour Rolling Limit**: ${formatProgressBar(fiveHour?.percentUsed)} (reset: ${reset5h})`,
           `**📅 Weekly Window**: ${formatProgressBar(weekly?.percentUsed)} (reset: ${resetWk})`,
-        ]
+        )
 
         if (fiveHour?.percentUsed >= 95) {
           lines.push('', '🚨 **CRITICAL LIMIT**: 5-hour quota is 95%+ consumed! New requests may be throttled until reset.')

package/lib/telemetry.js

@@ -0,0 +1,78 @@
+/**
+ * In-memory runtime session metrics for ClinePass requests in DeepSeek Harness.
+ */
+
+export const sessionStats = {
+  totalRequests: 0,
+  successfulRequests: 0,
+  failedRequests: 0,
+  abortedRequests: 0,
+  promptTokensEst: 0,
+  completionTokensEst: 0,
+  totalTokensEst: 0,
+  lastLatencyMs: null,
+  lastRequestAt: null,
+  lastError: null,
+  byModel: {},
+  lastSmoke: null,
+}
+
+export function recordSessionRequest({
+  latencyMs,
+  ok,
+  error,
+  aborted = false,
+  promptTokens = 0,
+  completionTokens = 0,
+  model,
+}) {
+  sessionStats.totalRequests += 1
+  if (aborted) {
+    sessionStats.abortedRequests = (sessionStats.abortedRequests || 0) + 1
+  } else if (ok) {
+    sessionStats.successfulRequests += 1
+    sessionStats.lastLatencyMs = typeof latencyMs === 'number' ? latencyMs : null
+    sessionStats.lastError = null
+  } else {
+    sessionStats.failedRequests += 1
+    sessionStats.lastError = error || 'Request failed'
+  }
+  sessionStats.lastRequestAt = Date.now()
+  sessionStats.promptTokensEst += Number(promptTokens) || 0
+  sessionStats.completionTokensEst += Number(completionTokens) || 0
+  sessionStats.totalTokensEst += (Number(promptTokens) || 0) + (Number(completionTokens) || 0)
+
+  if (model) {
+    if (!sessionStats.byModel) sessionStats.byModel = {}
+    const m = sessionStats.byModel[model] || { requests: 0, promptTokens: 0, completionTokens: 0 }
+    m.requests += 1
+    m.promptTokens += Number(promptTokens) || 0
+    m.completionTokens += Number(completionTokens) || 0
+    sessionStats.byModel[model] = m
+  }
+}
+
+export function recordSmokeTest({ latencyMs, ok, error, model }) {
+  sessionStats.lastSmoke = {
+    at: Date.now(),
+    latencyMs: typeof latencyMs === 'number' ? latencyMs : null,
+    ok: Boolean(ok),
+    error: error || null,
+    model: model || null,
+  }
+}
+
+export function resetSessionStats() {
+  sessionStats.totalRequests = 0
+  sessionStats.successfulRequests = 0
+  sessionStats.failedRequests = 0
+  sessionStats.abortedRequests = 0
+  sessionStats.promptTokensEst = 0
+  sessionStats.completionTokensEst = 0
+  sessionStats.totalTokensEst = 0
+  sessionStats.lastLatencyMs = null
+  sessionStats.lastRequestAt = null
+  sessionStats.lastError = null
+  sessionStats.byModel = {}
+  sessionStats.lastSmoke = null
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.24",
+  "version": "0.4.0",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",
@@ -63,6 +63,9 @@
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
+  "devDependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
   "homepage": "https://github.com/GooDAnDReaDY/dsh-clinebot#readme",
   "bugs": {
     "url": "https://github.com/GooDAnDReaDY/dsh-clinebot/issues"