@goodandready/dsh-clinebot 0.4.0 → 0.4.2

package/lib/cline-client.js

@@ -6,7 +6,6 @@
  */
 
 import {
-  CLINE_MODELS,
   DEFAULT_MODEL_ID,
   PROVIDER_ID,
   PROVIDER_DISPLAY_NAME,
@@ -90,6 +89,26 @@ export async function saveCredentialKey(ctx, apiKeyEnv, apiKey) {
   return { ok: true, envName: name }
 }
 
+/**
+ * Delete API key from DSH credentials service.
+ */
+export async function deleteCredentialKey(ctx, apiKeyEnv) {
+  const name = String(apiKeyEnv || '').trim()
+  if (!name) return { ok: false }
+  const credentials = ctx?.credentials || ctx?.get?.('credentials')
+  if (!credentials) return { ok: false }
+  try {
+    const ref = await toCredentialRef(name)
+    if (typeof credentials.unset === 'function') {
+      await credentials.unset(ref)
+      return { ok: true, envName: name }
+    }
+  } catch (err) {
+    console.warn('[dsh-clinebot] Failed unsetting credential:', err)
+  }
+  return { ok: false }
+}
+
 function abortAfter(ms) {
   const ac = new AbortController()
   const timer = setTimeout(() => ac.abort(), Math.max(1, Number(ms) || DEFAULT_TIMEOUT_MS))

package/lib/index.js

@@ -40,9 +40,7 @@ export function apply(ctx, config) {
     try {
       const pub = publicConfig(cfg)
       if (!pub.enabled) {
-        if (await checkRegisteredInPiAi(ctx)) {
-          await removePiAiProvider(ctx)
-        }
+        await removePiAiProvider(ctx)
         return
       }
       const activeKey = await resolveActiveAccountKey(ctx, cfg)

package/lib/models.js

@@ -168,12 +168,12 @@ export function parsePlanIncludedModels(includedInput) {
   const clean = includedText
     .replace(/^includes\s+/i, '')
     .replace(/\band\b/gi, ',')
-    .replace(/\./g, '')
+    .replace(/[.;]+$/g, '')
     .trim()
 
   const parts = clean
     .split(',')
-    .map((p) => p.trim())
+    .map((p) => p.trim().replace(/[.;]+$/g, '').trim())
     .filter(Boolean)
 
   const normalize = (s) =>
@@ -193,7 +193,14 @@ export function parsePlanIncludedModels(includedInput) {
       matched.push(found)
     } else {
       // Dynamic fallback for newly introduced models mentioned in plan
-      const idPart = name.toLowerCase().replace(/[\s_]+/g, '-')
+      const idPart = name
+        .toLowerCase()
+        .trim()
+        .replace(/^cline-pass\//, '')
+        .replace(/qwen\s+([0-9])/i, 'qwen$1')
+        .replace(/glm\s+([0-9])/i, 'glm-$1')
+        .replace(/[\s_]+/g, '-')
+        .replace(/-+/g, '-')
       const isVision = /(vision|vl|multimodal|omni|image)/i.test(name)
       const hasReasoning = /(reason|think|r1|pro|flash|max|plus|k3|m3|glm|qwen|mimo)/i.test(name)
       matched.push({

package/lib/provider-sync.js

@@ -17,6 +17,8 @@ import {
   buildPiAiProvider,
   sessionStats,
   getLastRotation,
+  usageCache,
+  DEFAULT_API_KEY_ENV,
 } from './cline-client.js'
 
 export function resolvePathWithHome(p) {
@@ -30,27 +32,48 @@ export function resolvePathWithHome(p) {
 
 export async function checkRegisteredInPiAi(ctx) {
   const settings = ctx?.get?.('settings')
-  if (!settings?.get) return false
   try {
-    const piAi = settings.get(LLM_PI_AI_NS)
-    return !!piAi?.providers?.[PROVIDER_ID]
+    if (typeof settings?.describe === 'function') {
+      const descriptors = settings.describe()
+      const piAiDesc = Array.isArray(descriptors) ? descriptors.find((d) => d?.ns === LLM_PI_AI_NS) : null
+      if (piAiDesc?.value?.providers?.[PROVIDER_ID]) return true
+    }
+    if (typeof settings?.get === 'function') {
+      const piAi = settings.get(LLM_PI_AI_NS)
+      if (piAi?.providers?.[PROVIDER_ID]) return true
+    }
+    const llm = ctx?.get?.('llm')
+    if (typeof llm?.listProviders === 'function') {
+      const list = await llm.listProviders()
+      if (Array.isArray(list) && list.some((p) => (p?.id || p) === PROVIDER_ID)) {
+        return true
+      }
+    }
   } catch {
     return false
   }
+  return false
 }
 
 export async function resolveActiveAccountKey(ctx, cfg, pool = null) {
   const accountPool = pool || await resolveAccountPool(ctx, cfg)
   const configured = accountPool.filter((acc) => acc.present && acc.value)
   if (!configured.length) {
-    return { envName: publicConfig(cfg).apiKeyEnv, value: '', source: 'none', id: 'default' }
+    const fallbackEnv = publicConfig(cfg).apiKeyEnv || DEFAULT_API_KEY_ENV
+    return { envName: fallbackEnv, apiKeyEnv: fallbackEnv, value: '', source: 'none', id: 'default' }
   }
   const pub = publicConfig(cfg)
+  let chosen = configured[0]
   if (pub.activeAccount) {
     const pinned = configured.find((acc) => acc.apiKeyEnv === pub.activeAccount || acc.id === pub.activeAccount)
-    if (pinned) return pinned
+    if (pinned) chosen = pinned
+  }
+  const keyEnv = chosen.apiKeyEnv || chosen.envName || DEFAULT_API_KEY_ENV
+  return {
+    ...chosen,
+    envName: keyEnv,
+    apiKeyEnv: keyEnv,
   }
-  return configured[0]
 }
 
 export async function buildStatus(ctx, cfg) {
@@ -101,14 +124,20 @@ export async function buildStatus(ctx, cfg) {
       present: !!(activeAcc.value || key.value),
       source: activeAcc.source || key.source,
     },
-    accounts: pool.map((acc) => ({
-      id: acc.id,
-      label: acc.label,
-      apiKeyEnv: acc.apiKeyEnv,
-      present: acc.present,
-      source: acc.source,
-      isPinned: acc.isPinned,
-    })),
+    accounts: pool.map((acc) => {
+      const cacheKey = `cline:usage:${(acc.value || '').slice(-8)}`
+      const cached = usageCache.get(cacheKey)?.data
+      const pct = cached?.windows?.fiveHour?.percentUsed
+      return {
+        id: acc.id,
+        label: acc.label,
+        apiKeyEnv: acc.apiKeyEnv,
+        present: acc.present,
+        source: acc.source,
+        isPinned: acc.isPinned,
+        percentUsed: typeof pct === 'number' ? pct : null,
+      }
+    }),
     activeAccount: activeAcc.apiKeyEnv,
     health,
     usage: publicUsage(usage),
@@ -158,12 +187,19 @@ export async function removePiAiProvider(ctx) {
     throw new Error('DSH settings service unavailable')
   }
 
-  await settings.mutate(LLM_PI_AI_NS, [
-    {
-      op: 'remove',
-      path: ['providers', PROVIDER_ID],
-    },
-  ])
+  try {
+    await settings.mutate(LLM_PI_AI_NS, [
+      {
+        op: 'remove',
+        path: ['providers', PROVIDER_ID],
+      },
+    ])
+  } catch (err) {
+    const msg = String(err?.message || err).toLowerCase()
+    if (!msg.includes('not found') && !msg.includes('absent') && !msg.includes('enoent') && !msg.includes('does not exist')) {
+      throw err
+    }
+  }
   return { ok: true }
 }
 

package/lib/routes/accounts.js

@@ -1,10 +1,178 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
+import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, plainConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
-import { clearUsageCache, clearProbeCache } from '../cline-client.js'
+import {
+  clearUsageCache,
+  clearProbeCache,
+  saveCredentialKey,
+  deleteCredentialKey,
+  smokeChat,
+  DEFAULT_API_KEY_ENV,
+} from '../cline-client.js'
 
 export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
+  // POST /dsh-clinebot/accounts — add or update account in pool
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/accounts',
+    handler: async (req, res) => {
+      if (req.method === 'DELETE') {
+        return handleDeleteAccount(req, res)
+      }
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
+      if (!assertTrustedSettingsRequest(req, res)) return
+      const settingsApi = getSettingsApi()
+      if (!settingsApi || typeof settingsApi.replace !== 'function') {
+        return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+      }
+      try {
+        const bodyBuf = await readBody(req)
+        let body = {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
+
+        const apiKey = String(body.apiKey || '').trim()
+        if (!apiKey) {
+          return writeJson(res, 400, { ok: false, error: 'API key is required' })
+        }
+
+        const curr = plainConfig(live())
+        const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
+
+        let targetEnv = String(body.apiKeyEnv || '').trim()
+        if (!targetEnv) {
+          let maxN = 1
+          for (const acc of existingAccounts) {
+            const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
+            if (m) {
+              const num = parseInt(m[1], 10)
+              if (num >= maxN) maxN = num + 1
+            }
+          }
+          if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
+            const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
+            if (m) {
+              const num = parseInt(m[1], 10)
+              if (num >= maxN) maxN = num + 1
+            }
+          }
+          targetEnv = `CLINEBOT_API_KEY_${maxN}`
+        }
+
+        if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
+          return writeJson(res, 400, {
+            ok: false,
+            error: `Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`,
+          })
+        }
+
+        const label = String(body.label || '').trim() || targetEnv
+
+        await saveCredentialKey(ctx, targetEnv, apiKey)
+
+        const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
+        const accountEntry = { label, apiKeyEnv: targetEnv }
+        if (idx >= 0) {
+          existingAccounts[idx] = accountEntry
+        } else {
+          existingAccounts.push(accountEntry)
+        }
+
+        const next = Config({ ...curr, accounts: existingAccounts })
+        await settingsApi.replace(next)
+        await syncProviderState(next)
+
+        let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
+        try {
+          const parsed = new URL(curr.baseUrl)
+          if (parsed.protocol === 'https:') {
+            validation = await smokeChat(curr.baseUrl, apiKey, {
+              model: curr.defaultModel,
+              timeoutMs: 15000,
+            })
+          }
+        } catch {
+          validation = { ok: false, error: 'Invalid baseUrl' }
+        }
+
+        clearUsageCache()
+        clearProbeCache()
+
+        writeJson(res, 200, {
+          ok: true,
+          account: accountEntry,
+          validated: validation.ok,
+          latencyMs: validation.latencyMs,
+          validationError: validation.ok ? null : validation.error,
+        })
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /accounts')
+
+  async function handleDeleteAccount(req, res, targetEnvFromUrl = '') {
+    if (!assertTrustedSettingsRequest(req, res)) return
+    const settingsApi = getSettingsApi()
+    if (!settingsApi || typeof settingsApi.replace !== 'function') {
+      return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+    }
+    try {
+      let body = {}
+      if (req.method === 'POST' || req.method === 'DELETE') {
+        try {
+          const bodyBuf = await readBody(req)
+          body = JSON.parse(bodyBuf.toString('utf8'))
+        } catch {
+          body = {}
+        }
+      }
+      const targetEnv = String(targetEnvFromUrl || body.apiKeyEnv || '').trim()
+      if (!targetEnv) {
+        return writeJson(res, 400, { ok: false, error: 'apiKeyEnv is required' })
+      }
+
+      const curr = plainConfig(live())
+      if (targetEnv === curr.apiKeyEnv || targetEnv === DEFAULT_API_KEY_ENV) {
+        return writeJson(res, 400, { ok: false, error: 'Cannot delete the primary account' })
+      }
+
+      const existingAccounts = Array.isArray(curr.accounts) ? curr.accounts : []
+      const nextAccounts = existingAccounts.filter((a) => a && a.apiKeyEnv !== targetEnv)
+      let activeAccount = curr.activeAccount
+      if (activeAccount === targetEnv) {
+        activeAccount = ''
+      }
+
+      const next = Config({ ...curr, accounts: nextAccounts, activeAccount })
+      await settingsApi.replace(next)
+      await syncProviderState(next)
+
+      if (body.deleteSecret) {
+        await deleteCredentialKey(ctx, targetEnv)
+      }
+
+      clearUsageCache()
+      clearProbeCache()
+
+      writeJson(res, 200, { ok: true, removed: targetEnv })
+    } catch (err) {
+      writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+    }
+  }
+
+  // POST /dsh-clinebot/accounts/delete — delete account endpoint
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/accounts/delete',
+    handler: async (req, res) => {
+      if (req.method !== 'POST' && req.method !== 'DELETE') {
+        return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
+      }
+      return handleDeleteAccount(req, res)
+    },
+  }), 'dsh-clinebot: /accounts/delete')
+
   // POST /dsh-clinebot/accounts/active — switch or pin active account
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',

package/lib/routes/auth.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
+import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig } from '../config.js'
 import { resolveActiveAccountKey } from '../provider-sync.js'
 import {
@@ -29,6 +29,20 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
         const pub = publicConfig(live())
         const base = normalizeBaseUrl(pub.baseUrl)
 
+        let parsedBase
+        try {
+          parsedBase = new URL(base)
+        } catch {
+          return writeJson(res, 400, { ok: false, valid: false, error: 'Invalid baseUrl' })
+        }
+        if (parsedBase.protocol !== 'https:' && parsedBase.hostname !== 'localhost' && parsedBase.hostname !== '127.0.0.1') {
+          return writeJson(res, 400, {
+            ok: false,
+            valid: false,
+            error: 'Insecure baseUrl: key verification requires https://',
+          })
+        }
+
         const ac = new AbortController()
         const timer = setTimeout(() => ac.abort(), 6000)
         try {

package/lib/routes/models.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { isTrustedSettingsRequest, assertTrustedSettingsRequest } from '../access.js'
+import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, plainConfig, Config } from '../config.js'
 import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.js'
 import { getAllModels, saveModelsDiskCache } from '../models.js'

package/lib/routes/settings.js

@@ -64,6 +64,30 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 400, { ok: false, error: `unknown config field: ${k}` })
         }
       }
+      if (rawPayload.apiKeyEnv && !/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(String(rawPayload.apiKeyEnv))) {
+        return writeJson(res, 400, { ok: false, error: `Disallowed apiKeyEnv: "${rawPayload.apiKeyEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$` })
+      }
+      if (Array.isArray(rawPayload.accounts)) {
+        for (const acc of rawPayload.accounts) {
+          if (!acc || typeof acc !== 'object') {
+            return writeJson(res, 400, { ok: false, error: 'Each account must be an object' })
+          }
+          const env = String(acc.apiKeyEnv || '').trim()
+          if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(env)) {
+            return writeJson(res, 400, { ok: false, error: `Disallowed account apiKeyEnv: "${env}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$` })
+          }
+        }
+      }
+      if (rawPayload.baseUrl) {
+        try {
+          const parsed = new URL(rawPayload.baseUrl)
+          if (parsed.protocol !== 'https:' && parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
+            return writeJson(res, 400, { ok: false, error: 'Insecure baseUrl: remote endpoint must use https://' })
+          }
+        } catch {
+          return writeJson(res, 400, { ok: false, error: 'Invalid baseUrl' })
+        }
+      }
       try {
         const base = plainConfig(live()) || {}
         delete base.enabledModels
@@ -99,13 +123,21 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
         const targetEnvName = String(body.apiKeyEnv || pub.apiKeyEnv || DEFAULT_API_KEY_ENV).trim()
 
         const isDefaultPattern = /^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnvName)
-        const isConfiguredEnv = targetEnvName === pub.apiKeyEnv ||
+        if (!isDefaultPattern) {
+          return writeJson(res, 400, {
+            ok: false,
+            error: `Disallowed apiKeyEnv: "${targetEnvName}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$.`,
+          })
+        }
+
+        const isConfiguredEnv = targetEnvName === DEFAULT_API_KEY_ENV ||
+          targetEnvName === pub.apiKeyEnv ||
           (Array.isArray(pub.accounts) && pub.accounts.some(acc => acc && acc.apiKeyEnv === targetEnvName))
 
-        if (!isDefaultPattern && !isConfiguredEnv) {
+        if (!isConfiguredEnv) {
           return writeJson(res, 400, {
             ok: false,
-            error: `Disallowed apiKeyEnv: "${targetEnvName}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$ or be configured in settings.`,
+            error: `Disallowed apiKeyEnv: "${targetEnvName}". Must be configured in settings accounts pool.`,
           })
         }