@goodandready/dsh-clinebot 0.3.25 → 0.4.1

package/lib/provider-sync.js

@@ -1,6 +1,6 @@
 import os from 'node:os'
 import path from 'node:path'
-import { publicConfig, Config, LLM_PI_AI_NS } from './config.js'
+import { publicConfig, plainConfig, Config, LLM_PI_AI_NS } from './config.js'
 import { publicUsage } from './http.js'
 import {
   PROVIDER_ID,
@@ -16,6 +16,8 @@ import {
   fetchUsageLimits,
   buildPiAiProvider,
   sessionStats,
+  getLastRotation,
+  usageCache,
 } from './cline-client.js'
 
 export function resolvePathWithHome(p) {
@@ -29,13 +31,27 @@ export function resolvePathWithHome(p) {
 
 export async function checkRegisteredInPiAi(ctx) {
   const settings = ctx?.get?.('settings')
-  if (!settings?.get) return false
   try {
-    const piAi = settings.get(LLM_PI_AI_NS)
-    return !!piAi?.providers?.[PROVIDER_ID]
+    if (typeof settings?.describe === 'function') {
+      const descriptors = settings.describe()
+      const piAiDesc = Array.isArray(descriptors) ? descriptors.find((d) => d?.ns === LLM_PI_AI_NS) : null
+      if (piAiDesc?.value?.providers?.[PROVIDER_ID]) return true
+    }
+    if (typeof settings?.get === 'function') {
+      const piAi = settings.get(LLM_PI_AI_NS)
+      if (piAi?.providers?.[PROVIDER_ID]) return true
+    }
+    const llm = ctx?.get?.('llm')
+    if (typeof llm?.listProviders === 'function') {
+      const list = await llm.listProviders()
+      if (Array.isArray(list) && list.some((p) => (p?.id || p) === PROVIDER_ID)) {
+        return true
+      }
+    }
   } catch {
     return false
   }
+  return false
 }
 
 export async function resolveActiveAccountKey(ctx, cfg, pool = null) {
@@ -100,19 +116,26 @@ export async function buildStatus(ctx, cfg) {
       present: !!(activeAcc.value || key.value),
       source: activeAcc.source || key.source,
     },
-    accounts: pool.map((acc) => ({
-      id: acc.id,
-      label: acc.label,
-      apiKeyEnv: acc.apiKeyEnv,
-      present: acc.present,
-      source: acc.source,
-      isPinned: acc.isPinned,
-    })),
+    accounts: pool.map((acc) => {
+      const cacheKey = `cline:usage:${(acc.value || '').slice(-8)}`
+      const cached = usageCache.get(cacheKey)?.data
+      const pct = cached?.windows?.fiveHour?.percentUsed
+      return {
+        id: acc.id,
+        label: acc.label,
+        apiKeyEnv: acc.apiKeyEnv,
+        present: acc.present,
+        source: acc.source,
+        isPinned: acc.isPinned,
+        percentUsed: typeof pct === 'number' ? pct : null,
+      }
+    }),
     activeAccount: activeAcc.apiKeyEnv,
     health,
     usage: publicUsage(usage),
     quotaWarning,
     sessionStats: { ...sessionStats },
+    lastRotation: getLastRotation(),
     isRegistered,
     availableModels: allModels,
   }
@@ -129,9 +152,11 @@ export async function upsertPiAiProvider(ctx, cfg, activeModelIds) {
   const allowedSet = new Set(activeModelIds || pub.enabledModels)
   const modelsToRegister = allModels.filter((m) => allowedSet.has(m.id))
 
+  const activeAcc = await resolveActiveAccountKey(ctx, cfg)
+
   const providerObj = buildPiAiProvider({
     baseUrl: pub.baseUrl,
-    apiKeyEnv: pub.apiKeyEnv,
+    apiKeyEnv: activeAcc?.apiKeyEnv || pub.apiKeyEnv,
     models: modelsToRegister.length ? modelsToRegister : allModels,
     customModels: pub.dynamicModels,
     displayName: PROVIDER_DISPLAY_NAME,
@@ -154,12 +179,19 @@ export async function removePiAiProvider(ctx) {
     throw new Error('DSH settings service unavailable')
   }
 
-  await settings.mutate(LLM_PI_AI_NS, [
-    {
-      op: 'remove',
-      path: ['providers', PROVIDER_ID],
-    },
-  ])
+  try {
+    await settings.mutate(LLM_PI_AI_NS, [
+      {
+        op: 'remove',
+        path: ['providers', PROVIDER_ID],
+      },
+    ])
+  } catch (err) {
+    const msg = String(err?.message || err).toLowerCase()
+    if (!msg.includes('not found') && !msg.includes('absent') && !msg.includes('enoent') && !msg.includes('does not exist')) {
+      throw err
+    }
+  }
   return { ok: true }
 }
 
@@ -180,7 +212,11 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
     if ((!pub.dynamicModels || !pub.dynamicModels.length) && cacheFile) {
       const fromDisk = await loadModelsDiskCache(cacheFile)
       if (Array.isArray(fromDisk) && fromDisk.length && settingsApi?.replace) {
-        const next = Config({ ...live(), dynamicModels: fromDisk })
+        const next = Config({
+          ...plainConfig(live()),
+          dynamicModels: fromDisk,
+          planSyncedAt: fromDisk.planSyncedAt || Date.now(),
+        })
         await settingsApi.replace(next)
         await syncProviderState(next)
       }
@@ -200,14 +236,16 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
       const hasNew = usageData.dynamicModels.some((m) => !existingIds.has(m.id))
 
       if (hasNew && settingsApi?.replace) {
+        const now = Date.now()
         const next = Config({
-          ...live(),
+          ...plainConfig(live()),
           dynamicModels: usageData.dynamicModels,
+          planSyncedAt: now,
         })
         await settingsApi.replace(next)
         await syncProviderState(next)
         if (cacheFile) {
-          await saveModelsDiskCache(cacheFile, usageData.dynamicModels)
+          await saveModelsDiskCache(cacheFile, usageData.dynamicModels, now)
         }
       }
     }

package/lib/routes/accounts.js

@@ -1,10 +1,178 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
-import { publicConfig, Config } from '../config.js'
+import { assertTrustedSettingsRequest } from '../access.js'
+import { publicConfig, plainConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
-import { clearUsageCache, clearProbeCache } from '../cline-client.js'
+import {
+  clearUsageCache,
+  clearProbeCache,
+  saveCredentialKey,
+  deleteCredentialKey,
+  smokeChat,
+  DEFAULT_API_KEY_ENV,
+} from '../cline-client.js'
 
 export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
+  // POST /dsh-clinebot/accounts — add or update account in pool
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/accounts',
+    handler: async (req, res) => {
+      if (req.method === 'DELETE') {
+        return handleDeleteAccount(req, res)
+      }
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
+      if (!assertTrustedSettingsRequest(req, res)) return
+      const settingsApi = getSettingsApi()
+      if (!settingsApi || typeof settingsApi.replace !== 'function') {
+        return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+      }
+      try {
+        const bodyBuf = await readBody(req)
+        let body = {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
+
+        const apiKey = String(body.apiKey || '').trim()
+        if (!apiKey) {
+          return writeJson(res, 400, { ok: false, error: 'API key is required' })
+        }
+
+        const curr = plainConfig(live())
+        const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
+
+        let targetEnv = String(body.apiKeyEnv || '').trim()
+        if (!targetEnv) {
+          let maxN = 1
+          for (const acc of existingAccounts) {
+            const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
+            if (m) {
+              const num = parseInt(m[1], 10)
+              if (num >= maxN) maxN = num + 1
+            }
+          }
+          if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
+            const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
+            if (m) {
+              const num = parseInt(m[1], 10)
+              if (num >= maxN) maxN = num + 1
+            }
+          }
+          targetEnv = `CLINEBOT_API_KEY_${maxN}`
+        }
+
+        if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
+          return writeJson(res, 400, {
+            ok: false,
+            error: `Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`,
+          })
+        }
+
+        const label = String(body.label || '').trim() || targetEnv
+
+        await saveCredentialKey(ctx, targetEnv, apiKey)
+
+        const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
+        const accountEntry = { label, apiKeyEnv: targetEnv }
+        if (idx >= 0) {
+          existingAccounts[idx] = accountEntry
+        } else {
+          existingAccounts.push(accountEntry)
+        }
+
+        const next = Config({ ...curr, accounts: existingAccounts })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+
+        let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
+        try {
+          const parsed = new URL(curr.baseUrl)
+          if (parsed.protocol === 'https:') {
+            validation = await smokeChat(curr.baseUrl, apiKey, {
+              model: curr.defaultModel,
+              timeoutMs: 15000,
+            })
+          }
+        } catch {
+          validation = { ok: false, error: 'Invalid baseUrl' }
+        }
+
+        clearUsageCache()
+        clearProbeCache()
+
+        writeJson(res, 200, {
+          ok: true,
+          account: accountEntry,
+          validated: validation.ok,
+          latencyMs: validation.latencyMs,
+          validationError: validation.ok ? null : validation.error,
+        })
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /accounts')
+
+  async function handleDeleteAccount(req, res, targetEnvFromUrl = '') {
+    if (!assertTrustedSettingsRequest(req, res)) return
+    const settingsApi = getSettingsApi()
+    if (!settingsApi || typeof settingsApi.replace !== 'function') {
+      return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+    }
+    try {
+      let body = {}
+      if (req.method === 'POST' || req.method === 'DELETE') {
+        try {
+          const bodyBuf = await readBody(req)
+          body = JSON.parse(bodyBuf.toString('utf8'))
+        } catch {
+          body = {}
+        }
+      }
+      const targetEnv = String(targetEnvFromUrl || body.apiKeyEnv || '').trim()
+      if (!targetEnv) {
+        return writeJson(res, 400, { ok: false, error: 'apiKeyEnv is required' })
+      }
+
+      const curr = plainConfig(live())
+      if (targetEnv === curr.apiKeyEnv || targetEnv === DEFAULT_API_KEY_ENV) {
+        return writeJson(res, 400, { ok: false, error: 'Cannot delete the primary account' })
+      }
+
+      const existingAccounts = Array.isArray(curr.accounts) ? curr.accounts : []
+      const nextAccounts = existingAccounts.filter((a) => a && a.apiKeyEnv !== targetEnv)
+      let activeAccount = curr.activeAccount
+      if (activeAccount === targetEnv) {
+        activeAccount = ''
+      }
+
+      const next = Config({ ...curr, accounts: nextAccounts, activeAccount })
+      await settingsApi.replace(next)
+      await syncProviderState(next)
+
+      if (body.deleteSecret) {
+        await deleteCredentialKey(ctx, targetEnv)
+      }
+
+      clearUsageCache()
+      clearProbeCache()
+
+      writeJson(res, 200, { ok: true, removed: targetEnv })
+    } catch (err) {
+      writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+    }
+  }
+
+  // POST /dsh-clinebot/accounts/delete — delete account endpoint
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/accounts/delete',
+    handler: async (req, res) => {
+      if (req.method !== 'POST' && req.method !== 'DELETE') {
+        return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
+      }
+      return handleDeleteAccount(req, res)
+    },
+  }), 'dsh-clinebot: /accounts/delete')
+
   // POST /dsh-clinebot/accounts/active — switch or pin active account
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
@@ -21,14 +189,14 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
         clearUsageCache()
         clearProbeCache()
         const settingsApi = getSettingsApi()
-        if (settingsApi?.replace) {
-          const next = Config({ ...live(), activeAccount: account })
-          await settingsApi.replace(next)
-          await syncProviderState(next)
-          writeJson(res, 200, { ok: true, activeAccount: next.activeAccount })
-        } else {
-          writeJson(res, 200, { ok: true, activeAccount: account })
+        if (!settingsApi || typeof settingsApi.replace !== 'function') {
+          return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
         }
+
+        const next = Config({ ...plainConfig(live()), activeAccount: account })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+        writeJson(res, 200, { ok: true, activeAccount: account })
       } catch (err) {
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }

package/lib/routes/auth.js

@@ -1,51 +1,94 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
+import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig } from '../config.js'
 import { resolveActiveAccountKey } from '../provider-sync.js'
-import { smokeChat, recordSessionRequest, rotateToNextAccount, DEFAULT_MODEL_ID } from '../cline-client.js'
+import {
+  smokeChat,
+  recordSmokeTest,
+  rotateToNextAccount,
+  DEFAULT_MODEL_ID,
+  normalizeBaseUrl,
+} from '../cline-client.js'
 
 export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
-  let authSession = null
-
-  // POST /dsh-clinebot/auth/begin — start loopback auth listener
+  // POST /dsh-clinebot/key/verify — on-the-fly verification of Cline API key
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
-    path: '/dsh-clinebot/auth/begin',
+    path: '/dsh-clinebot/key/verify',
     handler: async (req, res) => {
-      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
       if (!assertTrustedSettingsRequest(req, res)) return
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
       try {
-        const authUrl = 'https://app.cline.bot'
-        authSession = {
-          state: 'waiting',
-          startedAt: Date.now(),
-          authUrl,
+        const bodyBuf = await readBody(req)
+        let body = {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
+        const key = String(body.key || '').trim()
+        if (!key) {
+          return writeJson(res, 400, { ok: false, valid: false, error: 'Key is empty' })
+        }
+        const pub = publicConfig(live())
+        const base = normalizeBaseUrl(pub.baseUrl)
+
+        let parsedBase
+        try {
+          parsedBase = new URL(base)
+        } catch {
+          return writeJson(res, 400, { ok: false, valid: false, error: 'Invalid baseUrl' })
+        }
+        if (parsedBase.protocol !== 'https:' && parsedBase.hostname !== 'localhost' && parsedBase.hostname !== '127.0.0.1') {
+          return writeJson(res, 400, {
+            ok: false,
+            valid: false,
+            error: 'Insecure baseUrl: key verification requires https://',
+          })
+        }
+
+        const ac = new AbortController()
+        const timer = setTimeout(() => ac.abort(), 6000)
+        try {
+          const [meRes, planRes] = await Promise.all([
+            fetch(`${base}/users/me`, {
+              headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' },
+              signal: ac.signal,
+            }).catch((err) => ({ ok: false, status: 500, error: err })),
+            fetch(`${base}/users/me/plan`, {
+              headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' },
+              signal: ac.signal,
+            }).catch(() => null),
+          ])
+
+          if (!meRes.ok) {
+            return writeJson(res, 200, {
+              ok: false,
+              valid: false,
+              error: meRes.status === 401 ? 'Invalid API key (HTTP 401 Unauthorized)' : `Upstream returned HTTP ${meRes.status}`,
+            })
+          }
+
+          const meData = await meRes.json().catch(() => ({}))
+          const email = meData?.data?.email || meData?.email || 'authenticated user'
+
+          let planName = 'ClinePass'
+          if (planRes && planRes.ok) {
+            const planData = await planRes.json().catch(() => ({}))
+            const plan = planData?.data?.plan || planData?.data || planData?.plan || planData
+            planName = plan?.displayName || plan?.title || plan?.name || 'ClinePass'
+          }
+
+          return writeJson(res, 200, {
+            ok: true,
+            valid: true,
+            email,
+            plan: planName,
+          })
+        } finally {
+          clearTimeout(timer)
         }
-        writeJson(res, 200, {
-          ok: true,
-          status: authSession.state,
-          authUrl,
-        })
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+        return writeJson(res, 500, { ok: false, valid: false, error: String(err?.message || err) })
       }
     },
-  }), 'dsh-clinebot: /auth/begin')
-
-  // GET /dsh-clinebot/auth/status — query current fast auth state
-  ctx.effect(() => ctx.webServer.register({
-    kind: 'exact',
-    path: '/dsh-clinebot/auth/status',
-    handler: async (req, res) => {
-      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
-      writeJson(res, 200, {
-        ok: true,
-        status: authSession?.state || 'idle',
-        authUrl: authSession?.authUrl || 'https://app.cline.bot',
-      })
-    },
-  }), 'dsh-clinebot: /auth/status')
+  }), 'dsh-clinebot: /key/verify')
 
   // POST /dsh-clinebot/smoke — live ping test
   ctx.effect(() => ctx.webServer.register({
@@ -73,12 +116,11 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
           model: modelToTest,
           timeoutMs: pub.smokeTimeoutMs,
         })
-        recordSessionRequest({
+        recordSmokeTest({
           latencyMs: outcome.latencyMs,
           ok: outcome.ok,
           error: outcome.error,
-          promptTokens: outcome.promptTokens || 5,
-          completionTokens: outcome.completionTokens || 10,
+          model: modelToTest,
         })
 
         let failover = null
@@ -91,7 +133,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
 
         writeJson(res, outcome.ok ? 200 : 502, { ...outcome, failover })
       } catch (err) {
-        recordSessionRequest({ ok: false, error: String(err?.message || err) })
+        recordSmokeTest({ ok: false, error: String(err?.message || err) })
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }
     },

package/lib/routes/models.js

@@ -1,6 +1,6 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
-import { publicConfig, Config } from '../config.js'
+import { assertTrustedSettingsRequest } from '../access.js'
+import { publicConfig, plainConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'
 import { fetchUsageLimits } from '../cline-client.js'
@@ -35,18 +35,21 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         const dynamicModels = Array.isArray(usageData.dynamicModels) ? usageData.dynamicModels : []
         const allModels = getAllModels(dynamicModels)
         const settingsApi = getSettingsApi()
+        if (!settingsApi || typeof settingsApi.replace !== 'function') {
+          return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+        }
 
-        if (settingsApi?.replace) {
-          const next = Config({
-            ...live(),
-            dynamicModels,
-          })
-          await settingsApi.replace(next)
-          await syncProviderState(next)
-          const cacheFile = resolvePathWithHome(pub.modelsCachePath)
-          if (cacheFile) {
-            await saveModelsDiskCache(cacheFile, dynamicModels)
-          }
+        const now = Date.now()
+        const next = Config({
+          ...plainConfig(live()),
+          dynamicModels,
+          planSyncedAt: now,
+        })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+        const cacheFile = resolvePathWithHome(pub.modelsCachePath)
+        if (cacheFile) {
+          await saveModelsDiskCache(cacheFile, dynamicModels, now)
         }
 
         return writeJson(res, 200, {
@@ -75,23 +78,23 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
 
         const settingsApi = getSettingsApi()
-        if (settingsApi?.replace) {
-          const patch = {}
-          if (Array.isArray(body.disabledModels)) {
-            patch.disabledModels = body.disabledModels
-          } else if (Array.isArray(body.enabledModels)) {
-            const allModels = getAllModels(live().dynamicModels)
-            const enabledSet = new Set(body.enabledModels)
-            patch.disabledModels = allModels.map((m) => m.id).filter((id) => !enabledSet.has(id))
-          }
-          if (body.defaultModel) patch.defaultModel = body.defaultModel
-          const next = Config({ ...live(), ...patch })
-          await settingsApi.replace(next)
-          await syncProviderState(next)
-          writeJson(res, 200, { ok: true, disabledModels: next.disabledModels, enabledModels: publicConfig(next).enabledModels })
-        } else {
-          writeJson(res, 200, { ok: true })
+        if (!settingsApi || typeof settingsApi.replace !== 'function') {
+          return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+        }
+
+        const patch = {}
+        if (Array.isArray(body.disabledModels)) {
+          patch.disabledModels = body.disabledModels
+        } else if (Array.isArray(body.enabledModels)) {
+          const allModels = getAllModels(publicConfig(live()).dynamicModels)
+          const enabledSet = new Set(body.enabledModels)
+          patch.disabledModels = allModels.map((m) => m.id).filter((id) => !enabledSet.has(id))
         }
+        if (body.defaultModel) patch.defaultModel = body.defaultModel
+        const next = Config({ ...plainConfig(live()), ...patch })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+        writeJson(res, 200, { ok: true, disabledModels: next.disabledModels, enabledModels: publicConfig(next).enabledModels })
       } catch (err) {
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }