@goodandready/dsh-clinebot 0.4.8 → 0.5.1

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.1] - 2026-09-28
+
+### Fixed
+- **Host Process Crash on Stats Save (Issue #141, GitHub #9)**: Safely unwrap volatile Schemastery `{ get }` references, getter functions, and non-string inputs in `resolvePath`. Wrapped `saveStatsSync` in `try/catch` inside `queueSaveStats` timer callback to guarantee disk persistence failures never become uncaught exceptions terminating the DSH host process. Updated `lib/index.js` to pass `publicConfig(live()).statsPath`.
+- **Large Context / Multimodal Proxy Rejection (Issue #142, GitHub #10)**: Increased request body reading limit on `/dsh-clinebot/v1/chat/completions` from 256 KB to 64 MB, preventing HTTP 400 `"body too large"` errors on long conversational sessions and multimodal requests.
+- **Model Cache Path Resolution (Issue #143)**: Added safe volatile reference and getter unwrapping to `resolvePathWithHome` in `lib/provider-sync.js`, preventing `TypeError [ERR_INVALID_ARG_TYPE]` on disk cache operations.
+
+## [0.5.0] - 2026-09-27
+
+### Security
+- **Loopback Proxy Access Protection (#133)**: Strictly restricted OpenAI-compatible proxy endpoints (`POST /dsh-clinebot/v1/chat/completions` and `GET /dsh-clinebot/v1/models`) to loopback callers (`127.0.0.1`, `::1`, `localhost`). External network requests are rejected immediately with HTTP 403 Forbidden (`Loopback access only`).
+
+### Added & Improved
+- **Session Router Bounded Memory & LRU Eviction (#134)**: Introduced hard session limit `MAX_SESSIONS = 1000` and session expiration TTL `SESSION_TTL_MS = 24h` in `lib/session-router.js`. Prevents unbounded Map growth under high concurrency by pruning expired sessions and evicting least-recently-used sessions.
+
+### Fixed & Cleaned
+- **Dead & Test-Only Exports Elimination (#135)**: Pruned dead and internal-only exports across server modules (`USAGE_CACHE_TTL_MS` in `lib/cline-client.js`, `queueSaveStats` in `lib/stats-storage.js`, and `migrateModelId`, `getOriginalModelProvider`, `findModel`, `getDefaultModelIds` in `lib/models.js`), aligning module boundaries with public contract.
+- **Design Token Purity in Progress Bar (#136)**: Replaced hardcoded fallback hex `#f87171` in `src/client/progress-bar.js` with semantic design system token `var(--dsw-alias-status-danger)`, eliminating color hardcodes across all client components.
+- **Proxy Client Abort Stream Cancellation (#138)**: Connected `req.on('close')` in streaming SSE completions (`POST /dsh-clinebot/v1/chat/completions`) to immediately cancel upstream response reader via `reader.cancel()`, preventing orphaned background inference and quota drain when clients disconnect.
+- **Circular Module Dependency Removal (#139)**: Eradicated artificial circular import cycle between `lib/cline-client.js` and `lib/account-pool.js` by removing legacy re-exports from `cline-client.js` and routing consumers directly to `lib/account-pool.js`.
+- **Proxy Model Fallback (#140)**: Implemented seamless fallback to `pub.defaultModel` in `/dsh-clinebot/v1/chat/completions` when `model` parameter is omitted, preventing upstream HTTP 400 Bad Request.
+
 ## [0.4.8] - 2026-09-27
 
 ### Added

package/lib/client.js

@@ -478,7 +478,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
         gap: '8px',
         padding: '12px 14px',
         borderRadius: '8px',
-        border: isBad ? '1px solid var(--dsw-alias-error, #f87171)' : '1px solid var(--dsw-alias-border-l2)',
+        border: isBad ? '1px solid var(--dsw-alias-status-danger)' : '1px solid var(--dsw-alias-border-l2)',
         background: 'var(--dsw-alias-bg-layer-2)',
       },
     },
@@ -498,7 +498,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
         'span',
         { className: 'cb-progress-label', style: { fontWeight: 500, whiteSpace: 'nowrap' } },
         label,
-        isBad ? React.createElement('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-error, #f87171)' } }, '⚠️ <10%') : null
+        isBad ? React.createElement('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-status-danger)' } }, '⚠️ <10%') : null
       ),
       React.createElement(
         'span',
@@ -506,7 +506,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
           className: 'cb-progress-meta cb-bar-meta',
           style: {
             fontSize: '12px',
-            color: isBad ? 'var(--dsw-alias-error, #f87171)' : 'var(--dsw-alias-label-secondary)',
+            color: isBad ? 'var(--dsw-alias-status-danger)' : 'var(--dsw-alias-label-secondary)',
             whiteSpace: 'nowrap',
             marginLeft: 'auto',
           },

package/lib/cline-client.js

@@ -26,7 +26,7 @@ export const DEFAULT_BASE_URL = 'https://api.cline.bot/api/v1'
 export const DEFAULT_API_KEY_ENV = 'CLINEBOT_API_KEY'
 export const DEFAULT_TIMEOUT_MS = 15000
 export const DEFAULT_SMOKE_TIMEOUT_MS = 25000
-export const USAGE_CACHE_TTL_MS = 60000
+const USAGE_CACHE_TTL_MS = 60000
 
 export { PROVIDER_ID, PROVIDER_DISPLAY_NAME, DEFAULT_MODEL_ID }
 
@@ -508,4 +508,3 @@ export function buildPiAiProvider({
 
 
 
-export { resolveAccountPool, isAccountQuotaExhausted, rotateToNextAccount, getLastRotation, setLastRotation, isQuotaExceededError } from './account-pool.js'

package/lib/http.js

@@ -46,7 +46,7 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
-function isLoopbackAddress(value) {
+export function isLoopbackAddress(value) {
   const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '')
   return address === 'localhost' || address === 'localhost.' || address === '::1'
     || address.startsWith('127.')

package/lib/index.js

@@ -4,9 +4,11 @@ import {
   sessionStats,
   recordSessionRequest,
   resetSessionStats,
+} from './cline-client.js'
+import {
   rotateToNextAccount,
   isQuotaExceededError,
-} from './cline-client.js'
+} from './account-pool.js'
 import { PROVIDER_ID } from './models.js'
 import {
   upsertPiAiProvider,
@@ -208,7 +210,7 @@ export function apply(ctx, config) {
                   totalTokens: promptTokens + completionTokens,
                   isError: true,
                   is429,
-                  statsPath: live().statsPath,
+                  statsPath: publicConfig(live()).statsPath,
                 })
                 if (is429 || isExceeded) {
                   handleStream429()
@@ -235,7 +237,7 @@ export function apply(ctx, config) {
                   promptTokens,
                   completionTokens,
                   totalTokens: promptTokens + completionTokens,
-                  statsPath: live().statsPath,
+                  statsPath: publicConfig(live()).statsPath,
                 })
               }
             }
@@ -254,7 +256,7 @@ export function apply(ctx, config) {
               promptTokens,
               completionTokens,
               totalTokens: promptTokens + completionTokens,
-              statsPath: live().statsPath,
+              statsPath: publicConfig(live()).statsPath,
             })
           }
         } catch (err) {
@@ -277,7 +279,7 @@ export function apply(ctx, config) {
               totalTokens: promptTokens + completionTokens,
               isError: true,
               is429: status === 429,
-              statsPath: live().statsPath,
+              statsPath: publicConfig(live()).statsPath,
             })
             if (status === 429 || isQuotaExceededError(msg)) {
               handleStream429()

package/lib/models.js

@@ -20,7 +20,7 @@ export const OBSOLETE_MODEL_ID_MAP = Object.freeze({
   'cline-pass/muse-spark-13-contributor': 'cline-pass/muse-spark-1.3-contributor',
 })
 
-export function migrateModelId(id) {
+function migrateModelId(id) {
   if (typeof id !== 'string') return id
   return OBSOLETE_MODEL_ID_MAP[id] || id
 }
@@ -57,7 +57,7 @@ export function getOriginalModelContext(nameOrId) {
   return 200000
 }
 
-export function getOriginalModelProvider(nameOrId) {
+function getOriginalModelProvider(nameOrId) {
   const norm = String(nameOrId || '').toLowerCase()
   if (norm.includes('kimi')) return 'Moonshot AI'
   if (norm.includes('qwen')) return 'Alibaba Cloud'
@@ -437,7 +437,7 @@ export function getAllModels(dynamicModels = [], modelContextOverrides = [], cus
   return baseModels
 }
 
-export function findModel(id, dynamicModels = [], modelContextOverrides = [], customModels = []) {
+function findModel(id, dynamicModels = [], modelContextOverrides = [], customModels = []) {
   const all = getAllModels(dynamicModels, modelContextOverrides)
   const found = all.find((m) => m.id === id)
   if (found) return found
@@ -448,7 +448,7 @@ export function isSupportedModel(id, dynamicModels = [], modelContextOverrides =
   return findModel(id, dynamicModels, modelContextOverrides) !== null
 }
 
-export function getDefaultModelIds(dynamicModels = [], modelContextOverrides = [], customModels = []) {
+function getDefaultModelIds(dynamicModels = [], modelContextOverrides = [], customModels = []) {
   return getAllModels(dynamicModels, modelContextOverrides).map((m) => m.id)
 }
 

package/lib/provider-sync.js

@@ -23,8 +23,21 @@ import { resolveKeyValue } from './credential-refs.js'
 import { resolveAccountPool, getLastRotation } from './account-pool.js'
 
 export function resolvePathWithHome(p) {
-  if (typeof p === 'string' && p.startsWith('~/')) {
-    return path.join(os.homedir(), p.slice(2))
+  let guard = 0
+  while (guard < 5 && p) {
+    if (typeof p === 'function') {
+      try { p = p() } catch { p = ''; break }
+      guard += 1
+    } else if (typeof p === 'object' && typeof p.get === 'function') {
+      try { p = p.get() } catch { p = ''; break }
+      guard += 1
+    } else {
+      break
+    }
+  }
+  if (typeof p !== 'string') return ''
+  if (p.startsWith('~/') || p === '~') {
+    return path.join(os.homedir(), p.slice(1))
   }
   return p
 }

package/lib/routes/auth.js

@@ -5,10 +5,10 @@ import { resolveActiveAccountKey } from '../provider-sync.js'
 import {
   smokeChat,
   recordSmokeTest,
-  rotateToNextAccount,
   DEFAULT_MODEL_ID,
   normalizeBaseUrl,
 } from '../cline-client.js'
+import { rotateToNextAccount } from '../account-pool.js'
 
 export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // POST /dsh-clinebot/key/verify — on-the-fly verification of Cline API key

package/lib/routes/proxy.js

@@ -12,12 +12,12 @@
  * 4. Model reasoning_effort default injection from config.
  */
 
-import { writeJson, readBody } from '../http.js'
+import { writeJson, readBody, isLoopbackAddress } from '../http.js'
 import { publicConfig, plainConfig } from '../config.js'
 import { resolveAccountPool } from '../account-pool.js'
 import { resolveSessionAccount, markAccountCooldown } from '../session-router.js'
 import { recordUsage } from '../stats-storage.js'
-import { getAllModels } from '../models.js'
+import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 
 export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // 1. POST /dsh-clinebot/v1/chat/completions
@@ -29,9 +29,13 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
 
+      if (!isLoopbackAddress(req.socket?.remoteAddress)) {
+        return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
+      }
+
       let bodyBuf
       try {
-        bodyBuf = await readBody(req)
+        bodyBuf = await readBody(req, 64 * 1024 * 1024)
       } catch (err) {
         return writeJson(res, 400, { ok: false, error: String(err?.message || err) })
       }
@@ -56,10 +60,12 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         ''
       ).trim()
 
+      // Ensure model is set, fallback to defaultModel (#140)
+      body.model = String(body.model || pub.defaultModel || DEFAULT_MODEL_ID).trim()
+
       // Inject model reasoning effort if model has default configured and payload omitted it
       if (
         pub.modelReasoningDefaults &&
-        body.model &&
         pub.modelReasoningDefaults[body.model] &&
         !body.reasoning_effort
       ) {
@@ -95,7 +101,7 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
           'Content-Type': 'application/json',
           'Authorization': `Bearer ${targetAccount.value}`,
           'Accept': isStreaming ? 'text/event-stream' : 'application/json',
-          'User-Agent': '@goodandready/dsh-clinebot/0.4.8'
+          'User-Agent': '@goodandready/dsh-clinebot/0.5.0'
         }
 
         let upstreamRes
@@ -145,10 +151,23 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
           const reader = upstreamRes.body.getReader()
           const decoder = new TextDecoder('utf8')
 
+          let streamAborted = false
+          const onClientAbort = () => {
+            streamAborted = true
+            try {
+              reader.cancel().catch(() => {})
+            } catch {
+              /* ignore */
+            }
+          }
+          if (typeof req.on === 'function') {
+            req.on('close', onClientAbort)
+          }
+
           try {
             while (true) {
               const { done, value } = await reader.read()
-              if (done) break
+              if (done || streamAborted) break
 
               const chunkStr = decoder.decode(value, { stream: true })
               res.write(value)
@@ -175,8 +194,13 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
               }
             }
           } catch (streamErr) {
-            ctx?.logger?.warn?.(`[dsh-clinebot:proxy] Error streaming SSE chunk: ${streamErr?.message || streamErr}`)
+            if (!streamAborted) {
+              ctx?.logger?.warn?.(`[dsh-clinebot:proxy] Error streaming SSE chunk: ${streamErr?.message || streamErr}`)
+            }
           } finally {
+            if (typeof req.off === 'function') {
+              req.off('close', onClientAbort)
+            }
             res.end()
             recordUsage({
               model: body.model,
@@ -237,6 +261,10 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
       if (req.method !== 'GET') {
         return writeJson(res, 405, { ok: false, error: 'GET only' })
       }
+
+      if (!isLoopbackAddress(req.socket?.remoteAddress)) {
+        return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
+      }
       const pub = publicConfig(live())
       const dynamic = Array.isArray(pub.dynamicModels) ? pub.dynamicModels : []
       const custom = Array.isArray(pub.customModels) ? pub.customModels : []

package/lib/session-router.js

@@ -14,6 +14,40 @@ const sessions = new Map()
 // In-memory cooldowns: accountId -> { until: timestamp, reason: string }
 const cooldowns = new Map()
 
+export const MAX_SESSIONS = 1000
+export const SESSION_TTL_MS = 24 * 60 * 60 * 1000 // 24 hours
+
+/**
+ * Evict expired sessions and trim capacity to maxLimit via LRU.
+ *
+ * @param {number} [now=Date.now()] Current timestamp
+ * @param {number} [maxLimit=MAX_SESSIONS] Capacity threshold
+ * @param {number} [ttlMs=SESSION_TTL_MS] Expiration TTL
+ */
+export function pruneSessions(now = Date.now(), maxLimit = MAX_SESSIONS, ttlMs = SESSION_TTL_MS) {
+  for (const [id, s] of sessions.entries()) {
+    if (now - s.lastUsedAt > ttlMs) {
+      sessions.delete(id)
+    }
+  }
+
+  while (sessions.size > maxLimit) {
+    let oldestId = null
+    let oldestTime = Infinity
+    for (const [id, s] of sessions.entries()) {
+      if (s.lastUsedAt < oldestTime) {
+        oldestTime = s.lastUsedAt
+        oldestId = id
+      }
+    }
+    if (oldestId) {
+      sessions.delete(oldestId)
+    } else {
+      break
+    }
+  }
+}
+
 /**
  * Check if an account is currently in cooldown or rate-limited.
  * Performs automatic recovery if the cooldown duration has passed.
@@ -120,15 +154,27 @@ export function resolveSessionAccount(sessionId, accounts = [], defaultActiveId
     return { account: best, isReassigned: false, reason: 'no_session_id' }
   }
 
-  const existing = sessions.get(sessionId)
+  let existing = sessions.get(sessionId)
+  const now = Date.now()
   if (existing) {
-    const assigned = safeAccounts.find(a => (a.id || a.label) === existing.accountId)
-    // If assigned account is still valid and NOT in cooldown, keep sticky pin
-    if (assigned && !isAccountInCooldown(assigned.id || assigned.label)) {
-      existing.lastUsedAt = Date.now()
-      return { account: assigned, isReassigned: false, reason: 'sticky_pinned' }
+    // TTL eviction check
+    if (now - existing.lastUsedAt > SESSION_TTL_MS) {
+      sessions.delete(sessionId)
+      existing = null
+    } else {
+      const assigned = safeAccounts.find(a => (a.id || a.label) === existing.accountId)
+      // If assigned account is still valid and NOT in cooldown, keep sticky pin
+      if (assigned && !isAccountInCooldown(assigned.id || assigned.label)) {
+        existing.lastUsedAt = now
+        return { account: assigned, isReassigned: false, reason: 'sticky_pinned' }
+      }
+      // Failover: account was deleted or entered cooldown mid-session
     }
-    // Failover: account was deleted or entered cooldown mid-session
+  }
+
+  // Prune before adding a brand new session if capacity reached
+  if (!existing && sessions.size >= MAX_SESSIONS) {
+    pruneSessions(now, MAX_SESSIONS - 1, SESSION_TTL_MS)
   }
 
   // New session or mid-session failover: pick least-used account
@@ -137,8 +183,8 @@ export function resolveSessionAccount(sessionId, accounts = [], defaultActiveId
     const chosenId = chosen.id || chosen.label
     sessions.set(sessionId, {
       accountId: chosenId,
-      assignedAt: existing ? existing.assignedAt : Date.now(),
-      lastUsedAt: Date.now()
+      assignedAt: existing ? existing.assignedAt : now,
+      lastUsedAt: now
     })
   }
 
@@ -174,6 +220,8 @@ export function resetSessionRouter() {
 export function getSessionRouterStatus() {
   return {
     activeSessionsCount: sessions.size,
+    maxSessions: MAX_SESSIONS,
+    sessionTtlMs: SESSION_TTL_MS,
     cooldownsCount: cooldowns.size,
     cooldowns: Object.fromEntries(
       Array.from(cooldowns.entries()).map(([k, v]) => [

package/lib/slash-command.js

@@ -1,5 +1,6 @@
 import { publicConfig, plainConfig, Config } from './config.js'
 import { resolveActiveAccountKey, formatProgressBar } from './provider-sync.js'
+import { resolveAccountPool, rotateToNextAccount, getLastRotation } from './account-pool.js'
 import {
   getAllModels,
   isVisionModel,
@@ -8,8 +9,6 @@ import {
   DEFAULT_MODEL_ID,
 } from './models.js'
 import {
-  resolveAccountPool,
-  rotateToNextAccount,
   probeHealth,
   smokeChat,
   fetchUsageLimits,
@@ -18,7 +17,6 @@ import {
   clearProbeCache,
   usageCache,
   sessionStats,
-  getLastRotation,
 } from './cline-client.js'
 
 export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderState }) {

package/lib/stats-storage.js

@@ -41,6 +41,21 @@ export function createEmptyStats() {
  * Resolve '~' in paths to user's home directory.
  */
 export function resolvePath(targetPath) {
+  let unwrapGuard = 0
+  while (unwrapGuard < 5 && targetPath) {
+    if (typeof targetPath === 'function') {
+      try { targetPath = targetPath() } catch { targetPath = ''; break }
+      unwrapGuard += 1
+    } else if (typeof targetPath === 'object' && typeof targetPath.get === 'function') {
+      try { targetPath = targetPath.get() } catch { targetPath = ''; break }
+      unwrapGuard += 1
+    } else {
+      break
+    }
+  }
+  if (typeof targetPath !== 'string') {
+    targetPath = ''
+  }
   if (!targetPath) {
     return path.join(homedir(), '.dsh', 'clinebot-stats.json')
   }
@@ -57,10 +72,9 @@ export function resolvePath(targetPath) {
  * @returns {Object} Loaded stats
  */
 export function loadStats(customPath) {
-  const filePath = resolvePath(customPath)
-  activeStatsPath = filePath
-
   try {
+    const filePath = resolvePath(customPath)
+    activeStatsPath = filePath
     if (existsSync(filePath)) {
       const raw = readFileSync(filePath, 'utf8')
       const parsed = JSON.parse(raw)
@@ -91,10 +105,10 @@ export function loadStats(customPath) {
  * @param {string} [customPath]
  */
 export function saveStatsSync(customPath) {
-  const filePath = resolvePath(customPath || activeStatsPath)
-  activeStatsPath = filePath
-
   try {
+    const filePath = resolvePath(customPath || activeStatsPath)
+    activeStatsPath = filePath
+
     const dir = path.dirname(filePath)
     if (!existsSync(dir)) {
       mkdirSync(dir, { recursive: true })
@@ -117,13 +131,17 @@ export function saveStatsSync(customPath) {
  * @param {string} [customPath]
  * @param {number} [debounceMs=500]
  */
-export function queueSaveStats(customPath, debounceMs = 500) {
+function queueSaveStats(customPath, debounceMs = 500) {
   if (saveTimer) {
     clearTimeout(saveTimer)
   }
   saveTimer = setTimeout(() => {
     saveTimer = null
-    saveStatsSync(customPath)
+    try {
+      saveStatsSync(customPath)
+    } catch {
+      // Best-effort disk persistence, never crash host process
+    }
   }, debounceMs)
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.4.8",
+  "version": "0.5.1",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",