@goodandready/dsh-clinebot 0.3.9 → 0.3.10

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.10] - 2026-09-16
+
+### Changed
+- **UI Color Contrast & Adaptive Theme Compliance** (Gitea Issue #27): Replaced all hardcoded `rgba(...)` background tints and borders with CSS `color-mix(in srgb, var(--dsw-alias-state-...) X%, transparent)` for full legibility across Light and Dark DSH themes.
+- **Kernel Chevron Icon Probe & Fallback** (Gitea Issue #28): Added dynamic safe probe for kernel `IconChevronDownOutline14` from `@deepseek-ai/dsh-client-ui-primitives` with pixel-perfect FallbackChevron and `.cb-chevron` / `.cb-chevron-open` rotation classes.
+- **Single-Bundle Runtime Contract Documentation** (Gitea Issue #29): Formalized client single-bundle architecture and decoupled backend design in `docs/design/DESIGN.md`.
+- **Packaging Sanitization & Denylist Enforcement** (Gitea Issues #25, #26, #30): Purged internal workflow files (`AGENTS.md`, `index.md`, `deploy.sh`, `release-notes.md`) from git tracking and added them to `.gitignore`. Removed redundant duplicate READMEs in `docs/` and outdated root `.tgz` artifacts, reducing unpacked package size to 200 KiB.
+- **Client Module Injection Contract Clarification** (Gitea Issue #32): Documented that `dsh.client.inject: []` in `package.json` is architectural canon for plugins consuming core services (`slots`, `locale`, `settingsScope`) via `exports.inject` rather than require-table imports.
+- **Immediate Quota & Probe Invalidation on Account Switch** (Gitea Issue #31): Connected `clearUsageCache()` and `clearProbeCache()` to account switching routes (`/accounts/active`, `/cline switch`) and `rotateToNextAccount()`, preventing quota telemetry from lagging or sticking to former accounts.
+- **Model Validation in Slash Command** (Gitea Issue #31): Integrated `isSupportedModel()` in `/cline test [model]` to validate target models upfront before issuing upstream requests.
+
+
+### Fixed
+- **LLM Provider Schema Alignment (`reasoningEfforts`)** (GitHub Issue #1, Gitea Issue #35): Fixed Cordis loader validation failure (`$.providers.clinebot.models[0].reasoningEfforts expected false | { [key]: string } but got ["low","medium","high"]`). Properly map array reasoning efforts into a validated object record `{ [effort]: effort }` or `false`, resolving startup provider crash.
+- **Client Localization Fallback Crash** (Gitea Issue #34): Fixed `ReferenceError: ru is not defined` in `lib/client.js` fallback registration path when `ctx.effect` is absent. Removed direct reference to deleted `ru` dictionary.
+- **Settings Persistence Error Visibility** (Gitea Issue #33): Replaced empty/silent `catch {}` blocks around settings persistence in `lib/client.js` and `lib/cline-client.js` with structured warning logs (`ctx.logger.warn`) and user-facing error banners (`setErr`).
+- **Semantic Version Prerelease Comparison in Host Updater** (Gitea Issue #23): Enhanced `isNewerVersion()` in `lib/updater.js` to strictly follow SemVer 2.0.0 rules for pre-release tags, ensuring pre-releases and release candidates update seamlessly.
+- **Hardened Write-Route Security Validation** (Gitea Issue #22): Strengthened `isTrustedSettingsRequest()` in `lib/http.js` to rigorously validate `Origin`, `Host`, `X-Forwarded-Host`, `Referer`, and loopback remote addresses against CSRF, while maintaining full support for reverse proxies and local LAN environments.
+
 ## [0.3.9] - 2026-09-15
 
 ### Added

package/lib/client.js

@@ -208,7 +208,14 @@ const en = {
         })
       )
     }
-    const Chevron = FallbackChevron
+    let ChevronIcon = null
+    try {
+      const primitives = require('@deepseek-ai/dsh-client-ui-primitives')
+      ChevronIcon = primitives && (primitives.IconChevronDownOutline14 || primitives.IconChevronDownOutline)
+    } catch (_) {
+      ChevronIcon = null
+    }
+    const Chevron = ChevronIcon || FallbackChevron
 
     function ensureCss() {
       if (typeof document === 'undefined') return
@@ -218,6 +225,8 @@ const en = {
       style.dataset.dshPlugin = NS
       style.textContent = `
 .cb-page{display:flex;flex-direction:column;gap:20px;padding:8px 0 32px;max-width:960px}
+.cb-chevron{display:inline-flex;align-items:center;justify-content:center;transition:transform .16s ease;color:var(--dsw-alias-label-tertiary)}
+.cb-chevron-open{transform:rotate(180deg)}
 .cb-header{display:flex;flex-direction:column;gap:8px;padding-bottom:16px;border-bottom:1px solid var(--dsw-alias-border-l2)}
 .cb-page-title{font-size:22px;font-weight:700;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:10px}
 .cb-page-sub{font-size:14px;color:var(--dsw-alias-label-secondary);line-height:1.5}
@@ -230,9 +239,9 @@ const en = {
 .cb-grid-2{display:grid;grid-template-columns:repeat(auto-fit, minmax(280px, 1fr));gap:14px}
 
 .cb-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500}
-.cb-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:rgba(16,185,129,0.08)}
-.cb-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:rgba(245,158,11,0.08)}
-.cb-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:rgba(239,68,68,0.08)}
+.cb-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}
+.cb-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}
+.cb-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}
 
 .cb-input{height:36px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;width:100%;box-sizing:border-box}
 .cb-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}
@@ -242,8 +251,8 @@ const en = {
 .cb-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}
 .cb-btn-primary{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent}
 .cb-btn-primary:hover:not(:disabled){background:var(--dsw-alias-label-primary) !important;color:var(--dsw-alias-bg-layer-3) !important;opacity:0.88;visibility:visible !important}
-.cb-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:rgba(239,68,68,0.3)}
-.cb-btn-danger:hover:not(:disabled){background:rgba(239,68,68,0.12) !important;border-color:rgba(239,68,68,0.5)}
+.cb-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}
+.cb-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent) !important;border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}
 .cb-btn-disabled{opacity:0.5;cursor:not-allowed}
 
 .cb-bar-container{display:flex;flex-direction:column;gap:6px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2)}
@@ -257,11 +266,11 @@ const en = {
 .cb-table td{padding:10px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:13px;color:var(--dsw-alias-label-primary)}
 .cb-table tr:hover{background:var(--dsw-alias-bg-layer-2)}
 
-.cb-alert-ok{padding:10px 14px;border-radius:8px;background:rgba(16,185,129,0.1);color:var(--dsw-alias-state-success-primary);font-size:13px}
-.cb-alert-bad{padding:10px 14px;border-radius:8px;background:rgba(239,68,68,0.1);color:var(--dsw-alias-state-error-primary);font-size:13px}
-.cb-alert-err{padding:10px 14px;border-radius:8px;background:rgba(239,68,68,0.1);color:var(--dsw-alias-state-error-primary);font-size:13px}
-.cb-banner-warning{padding:12px 16px;border-radius:8px;background:rgba(245,158,11,0.12);border:1px solid var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:500}
-.cb-banner-exhausted{padding:12px 16px;border-radius:8px;background:rgba(239,68,68,0.12);border:1px solid var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:600}
+.cb-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px}
+.cb-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px}
+.cb-alert-err{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px}
+.cb-banner-warning{padding:12px 16px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 12%, transparent);border:1px solid var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:500}
+.cb-banner-exhausted{padding:12px 16px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);border:1px solid var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:600}
 .cb-stat-box{padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);display:flex;flex-direction:column;gap:4px}
 .cb-stat-val{font-size:18px;font-weight:700;color:var(--dsw-alias-label-primary)}
 .cb-stat-lbl{font-size:12px;color:var(--dsw-alias-label-secondary)}
@@ -587,7 +596,11 @@ const en = {
       // Pin active account
       async function handlePinAccount(accountEnv) {
         if (scope && snapshotStatus === "ready") {
-          try { await scope.set("activeAccount", accountEnv) } catch (_) {}
+          try {
+            await scope.set("activeAccount", accountEnv)
+          } catch (e) {
+            console.warn('[dsh-clinebot] Failed to set activeAccount on scope:', e)
+          }
         }
         setBusy(`pin-${accountEnv}`)
         setErr('')
@@ -620,15 +633,26 @@ const en = {
         if (debounceTimerRef.current) clearTimeout(debounceTimerRef.current)
         debounceTimerRef.current = setTimeout(async () => {
           if (scope && snapshotStatus === 'ready') {
-            try { await scope.set('disabledModels', nextDisabled) } catch (_) {}
+            try {
+              await scope.set('disabledModels', nextDisabled)
+            } catch (e) {
+              console.warn('[dsh-clinebot] Failed to set disabledModels on scope:', e)
+            }
           }
           try {
-            await fetch(`${ROUTE_PREFIX}/models/toggle`, {
+            const res = await fetch(`${ROUTE_PREFIX}/models/toggle`, {
               method: 'POST',
               headers: { 'Content-Type': 'application/json' },
               body: JSON.stringify({ disabledModels: nextDisabled }),
             })
-          } catch {}
+            const data = await res.json().catch(() => ({}))
+            if (!data.ok) {
+              setErr(data.error || 'Failed to persist disabled models')
+            }
+          } catch (e) {
+            console.warn('[dsh-clinebot] Failed to persist disabled models:', e)
+            setErr(String(e.message || e))
+          }
         }, 280)
       }
 
@@ -1219,7 +1243,7 @@ const en = {
             React.createElement('div', { style: { fontWeight: 600, fontSize: '15px' } }, t('title')),
             React.createElement('div', { style: { fontSize: '13px', color: 'var(--dsw-alias-label-secondary)' } }, t('subtitle'))
           ),
-          React.createElement('span', { style: { transform: open ? 'rotate(180deg)' : 'none', transition: 'transform .16s' } },
+          React.createElement('span', { className: 'cb-chevron' + (open ? ' cb-chevron-open' : '') },
             React.createElement(Chevron)
           )
         ),
@@ -1255,7 +1279,9 @@ const en = {
         try {
           const s = (ctx?.get && ctx.get('lanSettings')) || ctx?.settingsScope
           s?.describe?.()?.load?.()
-        } catch (_) {}
+        } catch (e) {
+          console.debug?.('[dsh-clinebot] Polling settings mirror:', e)
+        }
       }, 1000)
       return () => clearInterval(timer)
     }
@@ -1276,7 +1302,7 @@ const en = {
           }, 'dsh-clinebot: dictionaries')
         } else {
           addLocale('en', en)
-          addLocale('ru', ru)
+          addLocale('zh', zh)
         }
       }
 

package/lib/cline-client.js

@@ -493,8 +493,27 @@ export function buildPiAiProvider({
       input: hasImage ? ['text', 'image'] : ['text'],
       provider: PROVIDER_ID,
     }
+    const validEfforts = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']
     if (Array.isArray(item.reasoningEfforts) && item.reasoningEfforts.length) {
-      res.reasoningEfforts = [...item.reasoningEfforts]
+      const efforts = {}
+      for (const effort of item.reasoningEfforts) {
+        const key = String(effort).trim().toLowerCase()
+        if (validEfforts.includes(key)) {
+          efforts[key] = key
+        }
+      }
+      res.reasoningEfforts = Object.keys(efforts).length ? efforts : false
+    } else if (item.reasoningEfforts && typeof item.reasoningEfforts === 'object' && !Array.isArray(item.reasoningEfforts)) {
+      const efforts = {}
+      for (const [k, v] of Object.entries(item.reasoningEfforts)) {
+        const key = String(k).trim().toLowerCase()
+        if (validEfforts.includes(key)) {
+          efforts[key] = typeof v === 'string' && v.trim() ? v.trim() : key
+        }
+      }
+      res.reasoningEfforts = Object.keys(efforts).length ? efforts : false
+    } else {
+      res.reasoningEfforts = false
     }
     return res
   })
@@ -634,7 +653,9 @@ export async function rotateToNextAccount(ctx, cfg, reason = 'rate_limit', setti
       const next = { ...cfg, activeAccount: nextAcc.apiKeyEnv }
       await settingsApi.replace(next)
       updated = true
-    } catch {}
+    } catch (err) {
+      ctx?.logger?.warn?.('[dsh-clinebot] Failed to persist rotated activeAccount via settingsApi: ' + (err?.message || err))
+    }
   } else {
     const settings = (ctx?.get && ctx.get('settings')) || ctx?.settings
     if (settings?.mutate) {
@@ -643,10 +664,16 @@ export async function rotateToNextAccount(ctx, cfg, reason = 'rate_limit', setti
           { op: 'set', path: ['activeAccount'], value: nextAcc.apiKeyEnv },
         ])
         updated = true
-      } catch {}
+      } catch (err) {
+        ctx?.logger?.warn?.('[dsh-clinebot] Failed to persist rotated activeAccount via settings.mutate: ' + (err?.message || err))
+      }
     }
   }
 
+  // Reset cached quota and host probes so new account immediately revalidates
+  clearUsageCache()
+  clearProbeCache()
+
   return {
     rotated: true,
     previousAccount: active,

package/lib/http.js

@@ -28,7 +28,67 @@ export function readBody(req, maxBytes = 256 * 1024) {
   })
 }
 
-/** Reject cross-site writes. LAN / reverse-proxy UIs are allowed. */
+function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()]
+  return Array.isArray(value) ? value[0] : value
+}
+
+function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '')
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.')
+}
+
+/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
 export function isTrustedSettingsRequest(request) {
-  return request.headers['sec-fetch-site'] !== 'cross-site'
+  const secFetchSite = header(request, 'sec-fetch-site')
+  if (secFetchSite === 'cross-site') {
+    return false
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host')
+  const origin = header(request, 'origin')
+  if (origin) {
+    try {
+      const url = new URL(origin)
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true
+      }
+      return false
+    } catch {
+      return false
+    }
+  }
+
+  const referer = header(request, 'referer')
+  if (referer) {
+    try {
+      const url = new URL(referer)
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true
+      }
+      return false
+    } catch {
+      return false
+    }
+  }
+
+  // Requests without origin/referer (e.g. curl or internal requests): allow if loopback
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    return true
+  }
+
+  // If sec-fetch-site is explicitly same-origin or same-site, allow
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+    return true
+  }
+
+  return false
 }

package/lib/index.js

@@ -10,6 +10,7 @@ import {
   getAllModels,
   getDefaultModelIds,
   getActiveModelIds,
+  isSupportedModel,
   parsePlanIncludedModels,
   saveModelsDiskCache,
   loadModelsDiskCache,
@@ -33,6 +34,8 @@ import {
   sessionStats,
   recordSessionRequest,
   resetSessionStats,
+  clearUsageCache,
+  clearProbeCache,
   usageCache,
 } from './cline-client.js'
 
@@ -705,6 +708,8 @@ export function apply(ctx, config) {
           try { body = JSON.parse(bodyBuf.toString('utf8')) } catch {}
           const account = String(body.account || '').trim()
 
+          clearUsageCache()
+          clearProbeCache()
           if (settingsApi?.replace) {
             const next = Config({ ...live(), activeAccount: account })
             await settingsApi.replace(next)
@@ -818,6 +823,8 @@ export function apply(ctx, config) {
           if (!param) {
             return '⚠️ Please specify account: `/cline switch <CLINEBOT_API_KEY_2>`'
           }
+          clearUsageCache()
+          clearProbeCache()
           if (settingsApi?.replace) {
             const next = Config({ ...live(), activeAccount: param })
             await settingsApi.replace(next)
@@ -848,6 +855,9 @@ export function apply(ctx, config) {
 
         // 6. Subcommand /cline test [model] / smoke
         if (subcmd === 'test' || subcmd === 'smoke') {
+          if (param && !isSupportedModel(param, pub.dynamicModels)) {
+            return `⚠️ **ClineBot**: Model \`${param}\` is not recognized. Use \`/cline models\` to see available models.`
+          }
           const activeKey = await resolveActiveAccountKey(ctx, live())
           if (!activeKey.value) {
             return '⚠️ **ClineBot**: API key is not configured. Open **Settings → Plugins → ClineBot**.'

package/lib/updater.js

@@ -104,6 +104,37 @@ function parseSemver(value) {
   }
 }
 
+function comparePrerelease(candidateParts, currentParts) {
+  // A normal version with no pre-release tag is newer than a pre-release version
+  if (candidateParts.length === 0 && currentParts.length > 0) return 1
+  if (candidateParts.length > 0 && currentParts.length === 0) return -1
+  if (candidateParts.length === 0 && currentParts.length === 0) return 0
+
+  const len = Math.max(candidateParts.length, currentParts.length)
+  for (let i = 0; i < len; i += 1) {
+    const a = candidateParts[i]
+    const b = currentParts[i]
+    if (a === undefined) return -1
+    if (b === undefined) return 1
+    if (a === b) continue
+
+    const aNum = /^\d+$/.test(a) ? Number(a) : undefined
+    const bNum = /^\d+$/.test(b) ? Number(b) : undefined
+
+    if (aNum !== undefined && bNum !== undefined) {
+      return aNum > bNum ? 1 : -1
+    }
+    if (aNum !== undefined && bNum === undefined) {
+      return -1
+    }
+    if (aNum === undefined && bNum !== undefined) {
+      return 1
+    }
+    return a.localeCompare(b) > 0 ? 1 : -1
+  }
+  return 0
+}
+
 export function isNewerVersion(currentValue, candidateValue) {
   const current = parseSemver(currentValue)
   const candidate = parseSemver(candidateValue)
@@ -111,7 +142,7 @@ export function isNewerVersion(currentValue, candidateValue) {
   for (let index = 0; index < 3; index += 1) {
     if (candidate.core[index] !== current.core[index]) return candidate.core[index] > current.core[index]
   }
-  return false
+  return comparePrerelease(candidate.prerelease, current.prerelease) > 0
 }
 
 async function fetchLatestVersion(packageName, registry) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",
@@ -15,7 +15,8 @@
     "lib/",
     "cordis.patch.yml",
     "README.md",
-    "docs/",
+    "README.ru.md",
+    "README.zh.md",
     "CHANGELOG.md",
     "LICENSE"
   ],

package/docs/README.ru.md

@@ -1,199 +0,0 @@
-# 📦 @goodandready/dsh-clinebot
-
-<div align="center">
-
-<h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
-  <a href="../LICENSE"><img src="https://img.shields.io/github/license/GooDAnDReaDY/dsh-clinebot.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
-  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
-  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
-</p>
-
-<!-- Обязательная кнопка перехода на витрину всех проектов -->
-<p align="center">
-  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/Все_проекты_автора-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="Все проекты автора"></a>
-</p>
-
-<p align="center">
-  <a href="README.md"><b>🇬🇧 English</b></a> •
-  <a href="README.ru.md"><b>🇷🇺 Русский</b></a> •
-  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a>
-</p>
-
-<table align="center">
-  <tr>
-    <td align="center">
-      ⭐ <strong>Если вам нравится этот плагин, поставьте ему звезду на GitHub</strong> — это покажет мне, что плагин вам полезен, и будет мотивировать меня развивать его дальше.
-      <br><br>
-      🐛 <strong>Если вы нашли баг или хотите предложить новый функционал</strong>, создайте issue на GitHub на любом языке — я рассмотрю ваше предложение и реализую полезные идеи в одной из следующих версий плагина.
-    </td>
-  </tr>
-</table>
-
-</div>
-
----
-
-## ⚡ Обзор и решаемая проблема
-
-**ClinePass** (`https://cline.bot`) — сервис единой фиксированной подписки (\$9.99/мес), предоставляющий разработчикам повышенные лимиты (в 2–5 раз выше стандартных) на передовые open-weights модели программирования и рассуждений через единый OpenAI-совместимый интерфейс (`https://api.cline.bot/api/v1`).
-
-Интеграция ClinePass в DeepSeek Harness (DSH) напрямую сопряжена со следующими сложностями:
-1. **Отсутствие эндпоинта `/v1/models`**: запрос `GET /v1/models` к `api.cline.bot` возвращает `404 Not Found`, из-за чего динамический поиск моделей в DSH падает или оставляет список пустым.
-2. **Специфический формат идентификаторов**: моделям требуется обязательный префикс `cline-pass/` (например, `cline-pass/deepseek-v4-flash`, `cline-pass/kimi-k3`).
-3. **Отслеживание лимитов**: 5-часовые и недельные скользящие окна расхода токенов требуют прозрачной визуализации в интерфейсе.
-4. **Безопасность ключей**: хранение API-токенов в открытых конфигурациях небезопасно.
-
-Плагин **`@goodandready/dsh-clinebot`** решает эти задачи «из коробки»:
-* 🚀 **Обновление в один клик**: Обновление плагина прямо из интерфейса DSH или через защищённый loopback-эндпоинт `/dsh-clinebot/update`.
-* ⚡ **SWR-кэширование квот и здоровья**: Мгновенный ответ (<2 мс) на запросы статуса с фоновым обновлением данных без блокировки UI.
-* 🔀 **Smart Quota-Aware Failover**: Интеллектуальная ротация аккаунтов с обходом исчерпанных лимитов и авто-восстановлением при наступлении `resetsAt`.
-* 🖥️ **Отдельная страница в Настройках**: собственная полноэкранная страница в меню Настроек DSH (`Настройки → ClineBot`).
-* 🔄 **Динамическая синхронизация моделей подписки**: автоматическое получение реального списка моделей из `GET /api/v1/users/me/plan` и мгновенное обновление провайдера DSH в один клик.
-* ⚠️ **Предупреждения об исчерпании квоты**: баннеры предупреждения при достижении 80% (внимание) и 95% (исчерпано) 5-часового лимита с таймером сброса.
-* 📈 **Метрики сессии**: учет количества запросов, расчетных токенов (Prompt / Completion), задержки и времени последнего вызова.
-* 📊 **Дашборд лимитов подписки (Usage)**: наглядные прогресс-бары расхода 5-часового и недельного скользящего окна из официального API `GET /users/me/plan/usage-limits`.
-* 🔑 **Сохранение ключа прямо из UI**: поле ввода ключа с маскировкой; сохранение напрямую в системный сервис `credentials` (`~/.dsh/.credentials.yaml`) без ручной правки файлов на сервере.
-* 🎯 **Управление моделями в пикере**: включение/выключение отображения конкретных моделей в диалогах чата.
-* 💬 **Слэш-команда `/cline` в чате**: просмотр остатка квот, предупреждений, статистики сессии, задержки и активной модели прямо из чата.
-
----
-
-## 🏛️ Архитектура
-
-```mermaid
-graph LR
-    subgraph UI [Интерфейс DSH]
-        Page["Отдельная страница (Настройки -> ClineBot)"]
-        QuotaBar["Прогресс-бары 5h и недельного лимита + Баннер предупреждений"]
-        KeyInput["Ввод и сохранение API-ключа"]
-        ModelPick["Динамическая синхронизация моделей и пикер"]
-        StatsCard["Метрики и статистика текущей сессии"]
-    end
-
-    subgraph PluginHost [Хост-часть dsh-clinebot]
-        HttpEndpoints["API: /api/plugins/dsh-clinebot/*"]
-        ClientCore["lib/cline-client.js"]
-        ModelCatalog["lib/models.js (Встроенные + Динамические из плана)"]
-        SlashCmd["Слэш-команда: /cline"]
-    end
-
-    subgraph DSHCore [Сервисы DSH]
-        Credentials["Сервис credentials (~/.dsh/.credentials.yaml)"]
-        PiAi["Настройки: llm-pi-ai.providers.clinebot"]
-    end
-
-    subgraph Upstream [Сервер Cline]
-        ClinePass["api.cline.bot/api/v1/chat/completions"]
-        ClineQuota["api.cline.bot/api/v1/users/me/plan/usage-limits"]
-        ClinePlan["api.cline.bot/api/v1/users/me/plan"]
-    end
-
-    Page -->|GET /status & /usage| HttpEndpoints
-    KeyInput -->|POST /save-key| HttpEndpoints
-    ModelPick -->|POST /models/sync| HttpEndpoints
-    HttpEndpoints --> Credentials
-    HttpEndpoints --> ClientCore
-    ClientCore --> ModelCatalog
-    HttpEndpoints -->|Атомарная мутация| PiAi
-    ClientCore -->|Чат| ClinePass
-    ClientCore -->|Квоты| ClineQuota
-    ClientCore -->|Тарифный план| ClinePlan
-```
-
----
-
-## ✨ Структура модулей и возможности
-
-* **`lib/models.js`**: каталог встроенных моделей ClinePass (11 моделей) и парсер моделей подписки (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
-* **`lib/cline-client.js`**:
-  * `fetchUsageLimits`: параллельный опрос `GET /users/me/plan/usage-limits`, `GET /users/me/plan` и `GET /users/me` с кэшированием в памяти.
-  * `sessionStats` / `recordSessionRequest`: счетчики сессии (запросы, токены, задержка, время).
-  * `saveCredentialKey`: атомарная запись ключей в `~/.dsh/.credentials.yaml`.
-  * `smokeChat`: замер задержки и тестовый пинг с фиксацией статистики.
-  * `buildPiAiProvider`: генерация конфигурации провайдера для `llm-pi-ai` (`api: 'openai-completions'`).
-* **`lib/index.js`**: сервис Cordis, регистрация системных маршрутов (включая `/dsh-clinebot/models/sync`), расчет порогов предупреждения квоты и слэш-команды `/cline`.
-* **`lib/client.js`**: полнофункциональный раздел настроек (`settings.section`, order 28) с баннерами предупреждений, карточкой статистики сессии, кнопкой синхронизации моделей плана и аккордеоном плагина (`settings.plugin.item`).
-
----
-
-## 📦 Установка
-
-```bash
-dsh plugin --profile web add @goodandready/dsh-clinebot
-```
-
-Перезапустите экземпляр DeepSeek Harness и обновите вкладку в браузере.
-
----
-
-## 💬 Слэш-команда `/cline` в чате
-
-В любой сессии чата введите команду `/cline` для проверки остатка лимитов, предупреждений и статистики:
-
-```text
-### 🤖 ClinePass Status (ClinePass ($9.99/mo))
-* Пинг хоста: ✅ 210 мс
-* Активный ключ: CLINEBOT_API_KEY (credentials)
-* Модель по умолчанию: `cline-pass/deepseek-v4-flash`
-
-⏱ 5-часовое окно: [████░░░░░░] 42% (сброс: 18:00)
-📅 Недельное окно: [██████░░░░] 60% (сброс: 08.09)
-* Аккаунт: `developer@example.com`
-
-📈 Статистика текущей сессии:
-* Запросов: 14 вызовов
-* Токены: ~8,450 (Промпт: 6,100 | Ответ: 2,350)
-* Задержка последнего ответа: 210 мс
-```
-
----
-
-## ⚙️ Таблица конфигурации (`settings.yaml`)
-
-```yaml
-dsh-clinebot:
-  enabled: true
-  baseUrl: https://api.cline.bot/api/v1
-  apiKeyEnv: CLINEBOT_API_KEY
-  defaultModel: cline-pass/deepseek-v4-flash
-  timeoutMs: 15000
-  smokeTimeoutMs: 25000
-  enabledModels:
-    - cline-pass/deepseek-v4-flash
-    - cline-pass/deepseek-v4-pro
-    - cline-pass/kimi-k3
-    - cline-pass/qwen3.7-max
-  dynamicModels: []
-```
-
-### Параметры конфигурации
-
-| Параметр | Тип | По умолчанию | Описание |
-|:---|:---|:---|:---|
-| `enabled` | `boolean` | `true` | Включение моста провайдера ClineBot |
-| `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | Базовый URL OpenAI-совместимого API ClinePass |
-| `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | Имя переменной / ключа в хранилище credentials |
-| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | Модель, выбираемая по умолчанию |
-| `timeoutMs` | `number` | `15000` | Таймаут HTTP-запросов (мс) |
-| `smokeTimeoutMs` | `number` | `25000` | Таймаут тестового пинга (мс) |
-| `enabledModels` | `array` | `[...]` | Список моделей, активных в селекторе чата |
-| `dynamicModels` | `array` | `[]` | Динамические модели, автоматически синхронизированные из тарифа |
-
----
-
-## 🧪 Тестирование
-
-Запуск автоматического набора тестов:
-
-```bash
-npm test
-```
-
----
-
-## 📄 Лицензия
-
-MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/docs/README.zh.md

@@ -1,201 +0,0 @@
-# 📦 @goodandready/dsh-clinebot
-
-<div align="center">
-
-<h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
-
-<p align="center">
-  <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
-  <a href="../LICENSE"><img src="https://img.shields.io/github/license/GooDAnDReaDY/dsh-clinebot.svg?style=for-the-badge&color=10b981&labelColor=064e3b" alt="license"></a>
-  <a href="https://github.com/topics/dsh-plugin"><img src="https://img.shields.io/badge/DSH-Plugin-8b5cf6.svg?style=for-the-badge&labelColor=2e1065" alt="DSH Plugin"></a>
-  <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node-20%2B-f59e0b.svg?style=for-the-badge&labelColor=451a03" alt="Node version"></a>
-</p>
-
-<!-- 作者所有项目展示页面链接 -->
-<p align="center">
-  <a href="https://goodandready.app/"><img src="https://img.shields.io/badge/作者所有开源项目-goodandready.app-ff4500.svg?style=for-the-badge&logo=rocket&logoColor=white&labelColor=1a1a2e" alt="所有项目"></a>
-</p>
-
-<p align="center">
-  <a href="README.md"><b>🇬🇧 English</b></a> •
-  <a href="README.ru.md"><b>🇷🇺 Русский</b></a> •
-  <a href="README.zh.md"><b>🇨🇳 中文说明</b></a>
-</p>
-
-<table align="center">
-  <tr>
-    <td align="center">
-      ⭐ <strong>如果您喜欢这个插件，请在 GitHub 上为它点亮 Star</strong> — 这能让我知道插件对您有用，并鼓励我继续开发和维护它。
-      <br><br>
-      🐛 <strong>如果您发现 Bug 或希望增加功能</strong>，请使用任意语言在 GitHub 上提交 Issue — 我会评估您的建议，并在后续版本中实现有价值的改进。
-    </td>
-  </tr>
-</table>
-
-</div>
-
----
-
-## ⚡ 概述与解决的核心痛点
-
-**ClinePass** (`https://cline.bot`) 是一项固定月费（\$9.99/月）的高性价比订阅服务，为开发者提供主流开源代码模型与推理模型 2–5 倍的高并发调用限额，统一通过 OpenAI 兼容接口 (`https://api.cline.bot/api/v1`) 提供服务。
-
-在将 ClinePass 接入 DeepSeek Harness (DSH) 时存在以下挑战：
-1. **缺失 `/v1/models` 接口**：`api.cline.bot` 的 `GET /v1/models` 会直接返回 `404 Not Found`，导致动态模型同步失败或模型列表为空。
-2. **专属模型前缀**：所有模型 ID 均需前缀 `cline-pass/`（如 `cline-pass/deepseek-v4-flash`, `cline-pass/kimi-k3`）。
-3. **用量额度监控**：5 小时滑动窗口与每周限额需要清晰直观的可视化进度监控。
-4. **安全凭据隔离**：禁止在明文配置中直接填写密钥。
-
-**`@goodandready/dsh-clinebot`** 完美解决以上痛点：
-* 🚀 **应用内一键更新**：直接在 DSH 界面检查并升级插件，或通过受保护的 `/dsh-clinebot/update` 进行本地安全更新。
-* ⚡ **SWR 配额与健康状态缓存**：状态查询毫秒级响应（<2ms），并在后台静默更新，不阻塞前端渲染。
-* 🔀 **智能配额故障转移 (Smart Failover)**：多账号池自动轮询，避开耗尽账号并在 `resetsAt` 到达后自动恢复。
-* 🖥️ **专属设置大页**：在 DSH 设置中提供全宽独立页面（`设置 → ClineBot`）。
-* 🔄 **订阅模型动态同步**：从官方 `GET /api/v1/users/me/plan` 自动提取真实包含模型，一键原子级同步至 DSH 提供商配置，无需等待插件更新。
-* ⚠️ **额度耗尽实时预警**：当 5 小时滑动窗口达到 80%（警告黄色）和 95%（即将耗尽红色）时展示醒目预警横幅与重置倒计时。
-* 📈 **会话统计与指标看板**：实时追踪请求调用次数、预估 Token（Prompt / Completion）、最近延迟及最后调用时间。
-* 📊 **实时用量仪表盘**：调用官方 `GET /users/me/plan/usage-limits` API，实时渲染 5 小时与每周额度进度条及重置倒计时。
-* 🔑 **界面直存密钥**：在 UI 中直接粘贴 API 密钥，通过 `ctx.credentials.set()` 自动安全保存至 `~/.dsh/.credentials.yaml`。
-* 🎯 **模型选择器管理**：支持勾选开启/关闭特定模型在聊天选择器中的显示。
-* 💬 **聊天斜杠指令 `/cline`**：在任意聊天框快速查询当前配额、预警横幅、会话指标统计、网络延迟与活跃模型。
-
----
-
-## 🏛️ 架构设计
-
-```mermaid
-graph LR
-    subgraph UI [DSH Web 前端界面]
-        Page["独立配置页 (设置 -> ClineBot)"]
-        QuotaBar["5小时与每周额度进度条 + 额度预警横幅"]
-        KeyInput["API 密钥直填与安全保存"]
-        ModelPick["模型动态同步与选择器管控"]
-        StatsCard["会话指标监控看板"]
-    end
-
-    subgraph PluginHost [dsh-clinebot 宿主运行环境]
-        HttpEndpoints["API 路由: /api/plugins/dsh-clinebot/*"]
-        ClientCore["lib/cline-client.js"]
-        ModelCatalog["lib/models.js (内置精选 + 动态订阅解析)"]
-        SlashCmd["斜杠指令: /cline"]
-    end
-
-    subgraph DSHCore [DSH 核心系统服务]
-        Credentials["凭据存储服务 (~/.dsh/.credentials.yaml)"]
-        PiAi["模型注册: llm-pi-ai.providers.clinebot"]
-    end
-
-    subgraph Upstream [Cline 官方云端]
-        ClinePass["api.cline.bot/api/v1/chat/completions"]
-        ClineQuota["api.cline.bot/api/v1/users/me/plan/usage-limits"]
-        ClinePlan["api.cline.bot/api/v1/users/me/plan"]
-    end
-
-    Page -->|GET /status & /usage| HttpEndpoints
-    KeyInput -->|POST /save-key| HttpEndpoints
-    ModelPick -->|POST /models/sync| HttpEndpoints
-    HttpEndpoints --> Credentials
-    HttpEndpoints --> ClientCore
-    ClientCore --> ModelCatalog
-    HttpEndpoints -->|原子级写入| PiAi
-    ClientCore -->|模型对话| ClinePass
-    ClientCore -->|额度查询| ClineQuota
-    ClientCore -->|套餐信息| ClinePlan
-```
-
----
-
-## ✨ 核心模块与功能
-
-* **`lib/models.js`**：管理 11 款官方精选内置模型以及套餐模型动态解析器（`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`）。
-* **`lib/cline-client.js`**：
-  * `fetchUsageLimits`：高效并发轮询 `GET /users/me/plan/usage-limits`、`GET /users/me/plan` 与 `GET /users/me` 并进行内存缓存。
-  * `sessionStats` / `recordSessionRequest`：内存级会话度量记录器（请求次数、Token 估算、延迟、时间戳）。
-  * `saveCredentialKey`：将密钥安全写入 `~/.dsh/.credentials.yaml`。
-  * `smokeChat`：毫秒级网络探活与非流式延迟测试，并记录会话指标。
-  * `buildPiAiProvider`：构建 DSH `llm-pi-ai` 兼容的服务商定义 (`api: 'openai-completions'`)。
-* **`lib/index.js`**：Cordis 插件主生命周期服务，注册后端 REST API 路由（含 `/dsh-clinebot/models/sync`）、额度预警计算与 `/cline` 聊天斜杠指令。
-* **`lib/client.js`**：前端设置面板（`settings.section` 序号 28），内含预警横幅、会话指标卡片、一键模型同步按钮及插件折叠卡片。
-
----
-
-## 📦 快速安装
-
-在 DeepSeek Harness Web 配置中安装：
-
-```bash
-dsh plugin --profile web add @goodandready/dsh-clinebot
-```
-
-重启 DeepSeek Harness 实例并刷新浏览器页面。
-
----
-
-## 💬 聊天斜杠指令 `/cline`
-
-在任何聊天会话中输入 `/cline` 即可即时检查配额、预警状态与会话指标：
-
-```text
-### 🤖 ClinePass Status (ClinePass ($9.99/mo))
-* 响应延迟: ✅ 210 ms
-* 活跃密钥: CLINEBOT_API_KEY (credentials)
-* 默认模型: `cline-pass/deepseek-v4-flash`
-
-⏱ 5 小时窗口: [████░░░░░░] 42% (重置时间: 18:00)
-📅 每周窗口:   [██████░░░░] 60% (重置时间: 09月08日)
-* 绑定账号: `developer@example.com`
-
-📈 当前会话统计:
-* 请求次数: 14 次
-* Token 估算: ~8,450 (Prompt: 6,100 | Completion: 2,350)
-* 最近延迟: 210 ms
-```
-
----
-
-## ⚙️ 配置项参考 (`settings.yaml`)
-
-```yaml
-dsh-clinebot:
-  enabled: true
-  baseUrl: https://api.cline.bot/api/v1
-  apiKeyEnv: CLINEBOT_API_KEY
-  defaultModel: cline-pass/deepseek-v4-flash
-  timeoutMs: 15000
-  smokeTimeoutMs: 25000
-  enabledModels:
-    - cline-pass/deepseek-v4-flash
-    - cline-pass/deepseek-v4-pro
-    - cline-pass/kimi-k3
-    - cline-pass/qwen3.7-max
-  dynamicModels: []
-```
-
-### 配置参数说明
-
-| 参数项 | 类型 | 默认值 | 说明 |
-|:---|:---|:---|:---|
-| `enabled` | `boolean` | `true` | 是否启用 ClineBot 桥接插件 |
-| `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | ClinePass OpenAI 兼容接口地址 |
-| `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | 凭据管理系统中的密钥名称 |
-| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | 默认选中的模型 ID |
-| `timeoutMs` | `number` | `15000` | HTTP 请求超时时间（毫秒） |
-| `smokeTimeoutMs` | `number` | `25000` | 探活测试超时时间（毫秒） |
-| `enabledModels` | `array` | `[...]` | 允许在聊天下拉框中显示的可用模型列表 |
-| `dynamicModels` | `array` | `[]` | 从官方套餐中自动同步的动态模型列表 |
-
----
-
-## 🧪 测试
-
-运行自动化测试套件：
-
-```bash
-npm test
-```
-
----
-
-## 📄 许可证
-
-MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY)

package/docs/design/DESIGN.md

@@ -1,88 +0,0 @@
-# Design Contract: `@goodandready/dsh-clinebot`
-
-## 1. Executive Summary
-`@goodandready/dsh-clinebot` is a companion plugin for DeepSeek Harness (DSH) enabling native integration of the **ClineBot / ClinePass** subscription provider. Because ClinePass is an OpenAI-compatible endpoint whose `GET /v1/models` returns `404 Not Found`, dynamic discovery is impossible. This plugin acts as the bridge: delivering a curated catalog of open-weights models, securely resolving credentials, exposing health and smoke tests, and mutating the DSH `llm-pi-ai` provider registry.
-
-## 2. Architecture & Cordis Lifecycles
-The plugin consists of two runtime boundaries conforming to DSH authoring standards:
-
-### 2.1 Host Runtime (`lib/index.js`, `lib/cline-client.js`, `lib/models.js`, `lib/http.js`)
-* **Cordis Service Registration**: Declares `inject = ['settings', 'webServer', 'credentials']` and registers the settings namespace dynamically via `ctx.inject(['settings'], (sctx) => { sctx.settings.register(NS, Config, { base: config }) })`. This guarantees that the configuration schema, default values, and reactive watchers are declared and available to the host and client settingsScope without timing issues.
-* **Safe Service Resolution**: Service lookups utilize defensive proxy resolution `(ctx?.get && ctx.get('credentials')) || ctx?.credentials` to prevent `undefined` properties on Cordis proxies.
-* **Credential Isolation**: The plugin NEVER stores plain API keys in its configuration. The setting `apiKeyEnv` holds the credential identifier (default: `CLINEBOT_API_KEY`), resolved via `ctx.get('credentials').resolve()` or `process.env`.
-* **State Synchronization & Auto-Registration**: Mutates the core `llm-pi-ai` settings space (`op: 'set', path: ['providers', 'clinebot']`) declaratively and automatically when enabled or key is saved.
-* **Auto-Discovery & `disabledModels`**: Features automatic background polling of subscription plan models (`GET /api/v1/users/me/plan`). User preferences are tracked via `disabledModels: []`, ensuring newly added plan models appear enabled by default in the DSH chat picker without manual re-synchronization.
-
-### 2.2 Client Runtime (`lib/client.js`)
-* Self-registering module via `window.__ModuleLoader__.load({ id: '@goodandready/dsh-clinebot', factory })`.
-* Injects `['slots', 'locale', 'settingsScope']`.
-* Slots strictly and exclusively into `settings.plugin.item` (`key: NS`, `locale: NS`). Standalone top-level `settings.section` registration is omitted to maintain clean primary navigation in DSH and prevent side-list pollution.
-* Uses `refreshMirrorUntilVisible(ctx)` to invalidate and re-read the client settings mirror until the namespace is reported ready by the host.
-* Registers localized `en` and `zh` dictionaries with duplicate-safe guards (`ctx.locale.register()`), while Russian translation is modularly supplied by `dsh-russian-lang`.
-* Reactive binding via `((ctx?.get && ctx.get('lanSettings')) || ctx?.settingsScope).bind({ namespace: NS })` with `useSyncExternalStore` guarding against `unavailable` / `loading` snapshot states. Form mutations write directly to `scope.set()`.
-* Uses native design tokens (`--dsw-alias-...`) with full dark/light theme support.
-* Injects isolated style tag tagged with `data-dsh-plugin="dsh-clinebot"`.
-
-```mermaid
-graph LR
-    subgraph Client [DSH Web Interface]
-        UI[Settings Card: ClineBot]
-        SmokeBtn[Smoke Test Button]
-        RegBtn[Register in DSH Models]
-    end
-
-    subgraph Host [DSH Node.js Runtime]
-        API["HTTP API: /api/plugins/dsh-clinebot/*"]
-        ClientHelper["lib/cline-client.js"]
-        Catalog["lib/models.js (Static 11 Models)"]
-        CredService[DSH Credentials Service]
-        PiAiSettings["DSH Settings: llm-pi-ai"]
-    end
-
-    subgraph Remote [Cline Service]
-        ClineAPI["api.cline.bot/api/v1"]
-    end
-
-    UI -->|GET /status| API
-    SmokeBtn -->|POST /smoke| API
-    RegBtn -->|POST /register| API
-    API --> CredService
-    API --> ClientHelper
-    ClientHelper --> Catalog
-    API -->|Mutate| PiAiSettings
-    ClientHelper -->|POST /chat/completions| ClineAPI
-```
-
-## 3. UI/UX Contract
-* **Badges**:
-  * Host connectivity: `Host online (<ms>)` (green) / `Host unreachable` (red).
-  * Credential presence: `Key ✓ (credentials|env)` (green) / `Key missing` (amber).
-  * Registration status: `DSH Registered` (green) / `Not Registered` (amber).
-* **Model Picker**: Interactive checklist of all 11 official models with multi-select and vision capability indicators.
-* **Non-destructive actions**: Unregister cleanly removes the provider entry from DSH without touching other providers or configurations.
-
-## 4. Security & Isolation
-* CSRF / Cross-site protection: All mutating routes (`/register`, `/unregister`, `/smoke`, `/models`, `/accounts/active`, `/auth/begin`) validate `isTrustedSettingsRequest(req)` (`Sec-Fetch-Site !== 'cross-site'`).
-* Body size limits: Request payloads are strictly capped at 256 KB.
-* Sensitive credential data is never returned across the HTTP API (only `{ present: boolean, source: string, envName: string }`).
-
-## 5. Multi-Account Pool & Resilient Execution (v0.3.3)
-* **Account Pool**: The plugin supports multiple accounts (`accounts: [{ label, apiKeyEnv }]`, `activeAccount`). `resolveActiveAccountKey()` automatically selects the configured active account or falls back to primary `apiKeyEnv`. Account switching (`POST /dsh-clinebot/accounts/active` and `/cline switch <label>`) triggers instant re-registration in `llm-pi-ai` without service restart.
-* **Resilient Retry Policy**: HTTP calls to ClinePass utilize `retryWithBackoff()` with exponential delays and jitter to automatically absorb transient 429 rate-limiting events and upstream 5xx errors.
-* **Reasoning Effort Support**: Models declaring `reasoningEfforts: ['low', 'medium', 'high', 'max']` expose native thinking controls within the DSH model picker, accompanied by UI badges (`🧠 Reasoning`).
-* **Offline Cold-Start Cache**: Discovered plan models are serialized locally to `modelsCachePath` (`~/.dsh/clinebot-models-cache.json`), ensuring models remain immediately available on cold boot even if the upstream network or Cline API is temporarily unavailable.
-
-
-## 6. Performance, Resilience & Telemetry (v0.3.8)
-* **Stale-While-Revalidate (SWR) Network Probing**: `probeHealth()` utilizes an in-memory SWR cache (`probeCache`) with 25s TTL. Repeated `/status` queries return instantaneously (<1ms latency) with fresh host availability, asynchronously refreshing network latency in the background without blocking the client UI thread.
-* **HTTP Keep-Alive Connection Reuse**: Outbound fetch calls to `api.cline.bot` enforce persistent connection keepalive (`keepalive: true`), eliminating recurrent TLS handshake and TCP connection establishment latency.
-* **Auto-Failover Account Rotation**: When an active account encounters HTTP 429 (Rate Limit) or 100% quota depletion, `rotateToNextAccount()` automatically selects the next configured account in the pool, applies the update to DSH settings, and re-synchronizes credentials in `llm-pi-ai` in real time.
-* **Accurate Token Telemetry**: Real usage metadata (`prompt_tokens`, `completion_tokens`, `total_tokens`) is parsed directly from chat completion responses and tracked in session telemetry (`sessionStats`).
-* **Expanded Slash Commands**: Slash command `/cline` supports `/cline test [model]` (smoke test with latency, response and token metrics), `/cline ping` (real-time host connectivity test), and `/cline rotate` (round-robin active account rotation).
-* **Debounced Model Selection**: Model exclusion checkboxes in `lib/client.js` utilize immediate optimistic UI rendering paired with a 280ms debounced persistence layer, ensuring smooth interaction without request thrashing.
-
-## 7. Stability, SWR Quotas, Smart Failover & One-Click In-App Updater (v0.3.9)
-* **SWR Quota Caching (`fetchUsageLimits`)**: In-memory Stale-While-Revalidate caching for Cline usage limits (20s TTL). Returns quota statistics (<2ms) immediately on `/status` requests while refreshing quota windows in the background.
-* **Smart Quota-Aware Failover**: Account failover evaluates cached rolling limits (5-hour window), automatically prioritizing accounts with the lowest `percentUsed` and respecting `resetsAt` timestamps for automatic account recovery.
-* **One-Click In-App Updater (`/dsh-clinebot/update`)**: Integrates host-side one-click updater (`lib/updater.js`) with security verification (`isTrustedUpdateRequest`: loopback validation, same-origin checks, `x-dsh-plugin-update: 1` header). Allows seamless in-place updates from DSH UI.
-* **Canonical DSH Localization Standard**: Source code complies with canonical DSH standards (English base canon, complete Chinese `zh` locale registration in client, external Russian translation provided by `dsh-russian-lang`). All slash command responses and system logs are localized to English.