@goodandready/dsh-clinebot 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.1] - 2026-09-28
+
+### Fixed
+- **Host Process Crash on Stats Save (Issue #141, GitHub #9)**: Safely unwrap volatile Schemastery `{ get }` references, getter functions, and non-string inputs in `resolvePath`. Wrapped `saveStatsSync` in `try/catch` inside `queueSaveStats` timer callback to guarantee disk persistence failures never become uncaught exceptions terminating the DSH host process. Updated `lib/index.js` to pass `publicConfig(live()).statsPath`.
+- **Large Context / Multimodal Proxy Rejection (Issue #142, GitHub #10)**: Increased request body reading limit on `/dsh-clinebot/v1/chat/completions` from 256 KB to 64 MB, preventing HTTP 400 `"body too large"` errors on long conversational sessions and multimodal requests.
+- **Model Cache Path Resolution (Issue #143)**: Added safe volatile reference and getter unwrapping to `resolvePathWithHome` in `lib/provider-sync.js`, preventing `TypeError [ERR_INVALID_ARG_TYPE]` on disk cache operations.
+
 ## [0.5.0] - 2026-09-27
 
 ### Security

package/lib/index.js

@@ -210,7 +210,7 @@ export function apply(ctx, config) {
                   totalTokens: promptTokens + completionTokens,
                   isError: true,
                   is429,
-                  statsPath: live().statsPath,
+                  statsPath: publicConfig(live()).statsPath,
                 })
                 if (is429 || isExceeded) {
                   handleStream429()
@@ -237,7 +237,7 @@ export function apply(ctx, config) {
                   promptTokens,
                   completionTokens,
                   totalTokens: promptTokens + completionTokens,
-                  statsPath: live().statsPath,
+                  statsPath: publicConfig(live()).statsPath,
                 })
               }
             }
@@ -256,7 +256,7 @@ export function apply(ctx, config) {
               promptTokens,
               completionTokens,
               totalTokens: promptTokens + completionTokens,
-              statsPath: live().statsPath,
+              statsPath: publicConfig(live()).statsPath,
             })
           }
         } catch (err) {
@@ -279,7 +279,7 @@ export function apply(ctx, config) {
               totalTokens: promptTokens + completionTokens,
               isError: true,
               is429: status === 429,
-              statsPath: live().statsPath,
+              statsPath: publicConfig(live()).statsPath,
             })
             if (status === 429 || isQuotaExceededError(msg)) {
               handleStream429()

package/lib/provider-sync.js

@@ -23,8 +23,21 @@ import { resolveKeyValue } from './credential-refs.js'
 import { resolveAccountPool, getLastRotation } from './account-pool.js'
 
 export function resolvePathWithHome(p) {
-  if (typeof p === 'string' && p.startsWith('~/')) {
-    return path.join(os.homedir(), p.slice(2))
+  let guard = 0
+  while (guard < 5 && p) {
+    if (typeof p === 'function') {
+      try { p = p() } catch { p = ''; break }
+      guard += 1
+    } else if (typeof p === 'object' && typeof p.get === 'function') {
+      try { p = p.get() } catch { p = ''; break }
+      guard += 1
+    } else {
+      break
+    }
+  }
+  if (typeof p !== 'string') return ''
+  if (p.startsWith('~/') || p === '~') {
+    return path.join(os.homedir(), p.slice(1))
   }
   return p
 }

package/lib/routes/proxy.js

@@ -35,7 +35,7 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
 
       let bodyBuf
       try {
-        bodyBuf = await readBody(req)
+        bodyBuf = await readBody(req, 64 * 1024 * 1024)
       } catch (err) {
         return writeJson(res, 400, { ok: false, error: String(err?.message || err) })
       }

package/lib/stats-storage.js

@@ -41,6 +41,21 @@ export function createEmptyStats() {
  * Resolve '~' in paths to user's home directory.
  */
 export function resolvePath(targetPath) {
+  let unwrapGuard = 0
+  while (unwrapGuard < 5 && targetPath) {
+    if (typeof targetPath === 'function') {
+      try { targetPath = targetPath() } catch { targetPath = ''; break }
+      unwrapGuard += 1
+    } else if (typeof targetPath === 'object' && typeof targetPath.get === 'function') {
+      try { targetPath = targetPath.get() } catch { targetPath = ''; break }
+      unwrapGuard += 1
+    } else {
+      break
+    }
+  }
+  if (typeof targetPath !== 'string') {
+    targetPath = ''
+  }
   if (!targetPath) {
     return path.join(homedir(), '.dsh', 'clinebot-stats.json')
   }
@@ -57,10 +72,9 @@ export function resolvePath(targetPath) {
  * @returns {Object} Loaded stats
  */
 export function loadStats(customPath) {
-  const filePath = resolvePath(customPath)
-  activeStatsPath = filePath
-
   try {
+    const filePath = resolvePath(customPath)
+    activeStatsPath = filePath
     if (existsSync(filePath)) {
       const raw = readFileSync(filePath, 'utf8')
       const parsed = JSON.parse(raw)
@@ -91,10 +105,10 @@ export function loadStats(customPath) {
  * @param {string} [customPath]
  */
 export function saveStatsSync(customPath) {
-  const filePath = resolvePath(customPath || activeStatsPath)
-  activeStatsPath = filePath
-
   try {
+    const filePath = resolvePath(customPath || activeStatsPath)
+    activeStatsPath = filePath
+
     const dir = path.dirname(filePath)
     if (!existsSync(dir)) {
       mkdirSync(dir, { recursive: true })
@@ -123,7 +137,11 @@ function queueSaveStats(customPath, debounceMs = 500) {
   }
   saveTimer = setTimeout(() => {
     saveTimer = null
-    saveStatsSync(customPath)
+    try {
+      saveStatsSync(customPath)
+    } catch {
+      // Best-effort disk persistence, never crash host process
+    }
   }, debounceMs)
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",