@goodandready/dsh-clinebot 0.5.10 → 0.5.12

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.12] - 2026-10-02
+
+### Fixed
+- **Credential Ownership Enforcement on Deletion Retry (Issue #155)**: Reject deletion of unowned or non-existent credentials with HTTP 404 and zero calls to the credentials store, preventing unconfirmed secrets deletion. Retries of previously failed secret cleanups are explicitly tracked in-memory to safely allow recovery without exposing arbitrary secret deletion.
+- **Catalog Lifecycle Across All Account Switch Paths (Issue #168)**: Reset dynamic model catalog (`dynamicModels: []`) and plan synchronization state (`planSyncedAt: 0`) uniformly across slash-command switches (`/cline switch`), automatic account pool rotations, and manual configuration updates, preventing stale or cross-account models from being considered verified.
+- **Rollback Concurrency & Active Account Selection Preservation (Issue #187)**: Ensure transactional account deletion rollback does not overwrite concurrent changes to `activeAccount`. Only restore the deleted account as active if no concurrent change has occurred, preserving external selection alongside other settings.
+- **Test Hardening & Multi-Environment Portability (Issue #173)**: Hardened regression tests to detect surviving descendants across parent exits under genuine failure conditions, updated account deletion tests to assert honest partial state (`partial: true`), and replaced hardcoded path references with dynamic DSH adapter discovery and graceful skips across diverse environments.
+
+## [0.5.11] - 2026-10-01
+
+### Fixed
+- **Dynamic Stats Storage Switching & Counter Preservation (Issue #158)**: Flushes and synchronizes in-memory metrics before switching file storage targets when `statsPath` is updated dynamically, avoiding overwriting accumulated statistics when paths change.
+- **Session Affinity Native Transport Bridge via Prompt Cache Key (Issue #163)**: Bridge native DSH `llm-pi-ai` requests to ClineBot sticky sessions by enabling `cacheRetention: 'long'` in the provider contract, and extracting session identifiers from `prompt_cache_key` on the proxy route, maintaining consistent account affinity across turns.
+- **Catalog Lifecycle & Cache Identity Isolation (Issue #168)**: Isolated disk model cache records by specific account and endpoint scopes, clearing dynamic model cache and sync timestamps on active account switch, and reporting `planSynced: false` when offline cached plans cannot be actively verified against the provider.
+- **Updater Process Group Escalation on Parent Exit (Issue #172)**: Ensured process group supervision continues after parent SIGTERM exit in `updater.js`, checking `isProcessGroupAlive(child.pid)` and escalating to SIGKILL across the detached process group (`-child.pid`) to eliminate lingering background processes.
+- **Transactional Account Delete Surgical Rollback & Retry (Issues #184, #187)**: Replaced full-config rollback with surgical restoration of removed accounts into fresh live configuration on secret deletion failure, preserving concurrent settings updates. Exposed partial deletion state (`partial: true`) and allowed safe retry of credential cleanup without HTTP 404 errors.
+- **DESIGN Contract Alignment with Native Runtime Contracts (Issue #177)**: Synchronized `docs/design/DESIGN.md` with active implementation: documented native DSH transport bridge, dynamic catalog lifecycle, updater process group cleanup, and dynamic stats storage switching.
+- **Regression & Hardening Test Coverage (Issue #173)**: Added regression tests for dynamic stats switching, shifting quota session stickiness, process group lifecycle escalation on parent SIGTERM, and transactional partial account deletion and retry.
+
 ## [0.5.10] - 2026-10-01
 
 ### Fixed

package/lib/account-pool.js

@@ -168,10 +168,19 @@ export async function rotateToNextAccount(ctx, cfg, reason = 'rate_limit', setti
   // Fallback if all candidates are either exhausted or uncached: pick next in round-robin
   const nextAcc = bestCandidate || candidates[currentIndex % candidates.length] || candidates[0]
 
+  const prevActive = String(cfg.activeAccount || cfg.apiKeyEnv || "").trim()
+  const nextActive = String(nextAcc.apiKeyEnv || "").trim()
+  const isDifferent = nextActive !== prevActive
+
   let updated = false
   if (settingsApi?.replace) {
     try {
-      const next = { ...toPlainSnapshot(cfg), activeAccount: nextAcc.apiKeyEnv }
+      const next = {
+        ...toPlainSnapshot(cfg),
+        activeAccount: nextAcc.apiKeyEnv,
+        dynamicModels: isDifferent ? [] : (cfg.dynamicModels || []),
+        planSyncedAt: isDifferent ? 0 : Number(cfg.planSyncedAt || 0),
+      }
       await settingsApi.replace(next)
       updated = true
     } catch (err) {
@@ -181,9 +190,14 @@ export async function rotateToNextAccount(ctx, cfg, reason = 'rate_limit', setti
     const settings = (ctx?.get && ctx.get('settings')) || ctx?.settings
     if (settings?.mutate) {
       try {
-        await settings.mutate('dsh-clinebot', [
+        const ops = [
           { op: 'set', path: ['activeAccount'], value: nextAcc.apiKeyEnv },
-        ])
+        ]
+        if (isDifferent) {
+          ops.push({ op: 'set', path: ['dynamicModels'], value: [] })
+          ops.push({ op: 'set', path: ['planSyncedAt'], value: 0 })
+        }
+        await settings.mutate('dsh-clinebot', ops)
         updated = true
       } catch (err) {
         ctx?.logger?.warn?.('[dsh-clinebot] Failed to persist rotated activeAccount via settings.mutate: ' + (err?.message || err))

package/lib/cline-client.js

@@ -547,8 +547,10 @@ export function buildPiAiProvider({
     api: 'openai-completions',
     baseURL: normalizeBaseUrl(baseUrl),
     apiKeyEnv: apiKeyEnv || DEFAULT_API_KEY_ENV,
+    cacheRetention: 'long',
     compat: {
       supportsReasoningEffort: true,
+      supportsLongCacheRetention: true,
     },
     models: modelList,
   }

package/lib/config.js

@@ -129,7 +129,7 @@ export function publicConfig(cfg) {
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
   const custom = Array.isArray(cfg?.customModels) ? cfg.customModels : []
   const modelContextOverrides = Array.isArray(cfg?.modelContextOverrides) ? cfg.modelContextOverrides : []
-  const isSynced = dynamic.length > 0
+  const isSynced = dynamic.length > 0 && (Number(cfg?.planSyncedAt) > 0)
   const allModels = getAllModels(dynamic, modelContextOverrides, custom)
   const allDefaultIds = allModels.map((m) => m.id)
 

package/lib/index.js

@@ -22,7 +22,7 @@ import { registerModelsRoutes } from './routes/models.js'
 import { registerAuthRoutes } from './routes/auth.js'
 import { registerProxyRoutes } from './routes/proxy.js'
 import { registerSlashCommand } from './slash-command.js'
-import { recordUsage, loadStats, flushStats, resolvePath } from './stats-storage.js'
+import { recordUsage, loadStats, flushStats, resolvePath, switchStatsStorage } from './stats-storage.js'
 
 export const name = '@goodandready/dsh-clinebot'
 export const inject = ['webServer', 'credentials']
@@ -99,12 +99,17 @@ export function apply(ctx, config) {
   const syncStatsStorage = (cfg) => {
     const nextPath = resolvePath(publicConfig(cfg).statsPath)
     if (nextPath !== activeStatsPath) {
-      flushStats(activeStatsPath)
+      switchStatsStorage(nextPath)
       activeStatsPath = nextPath
-      loadStats(nextPath)
     }
   }
 
+  if (typeof ctx?.on === 'function') {
+    ctx.on('loader/volatile-update', () => {
+      syncStatsStorage(live())
+    })
+  }
+
   const getRevision = (svc) => {
     try {
       return svc?.describe?.().find((row) => row.ns === NS)?.revision

package/lib/routes/accounts.js

@@ -11,6 +11,8 @@ import {
   DEFAULT_API_KEY_ENV,
 } from '../cline-client.js'
 
+const pendingSecretCleanupAccounts = new Set()
+
 export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // POST /dsh-clinebot/accounts — add or update account in pool
   ctx.effect(() => ctx.webServer.register({
@@ -155,6 +157,27 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
       const existingAccounts = Array.isArray(curr.accounts) ? curr.accounts : []
       const accountToDelete = existingAccounts.find((a) => a && a.apiKeyEnv === targetEnv)
       if (!accountToDelete) {
+        if (body.deleteSecret && pendingSecretCleanupAccounts.has(targetEnv) && ctx?.get?.('credentials')) {
+          let retryDelRes = null
+          try {
+            retryDelRes = await deleteCredentialKey(ctx, targetEnv)
+          } catch {
+            retryDelRes = null
+          }
+          if (retryDelRes && retryDelRes.ok) {
+            pendingSecretCleanupAccounts.delete(targetEnv)
+            clearUsageCache()
+            clearProbeCache()
+            return writeJson(res, 200, { ok: true, removed: targetEnv, secretDeleted: true })
+          }
+          return writeJson(res, 500, {
+            ok: false,
+            partial: true,
+            accountRemoved: true,
+            secretDeleted: false,
+            error: `Failed to delete secret for account "${targetEnv}" from credentials store on retry`,
+          })
+        }
         return writeJson(res, 404, {
           ok: false,
           error: `Account "${targetEnv}" not found in accounts pool`,
@@ -172,31 +195,62 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
       await settingsApi.replace(next)
       await syncProviderState(next)
 
+      let delRes = null
       if (body.deleteSecret) {
-        let delRes = null
         try {
           delRes = await deleteCredentialKey(ctx, targetEnv)
         } catch {
           delRes = null
         }
         if (!delRes || !delRes.ok) {
+          let rollbackSuccess = false
           try {
-            await settingsApi.replace(curr)
-            await syncProviderState(curr)
+            const fresh = plainConfig(live())
+            const freshAccounts = Array.isArray(fresh.accounts) ? [...fresh.accounts] : []
+            if (!freshAccounts.some((a) => a && a.apiKeyEnv === targetEnv)) {
+              freshAccounts.push(accountToDelete)
+            }
+            const shouldRestoreActive = (curr.activeAccount === targetEnv && (!fresh.activeAccount || fresh.activeAccount === targetEnv))
+              ? targetEnv
+              : fresh.activeAccount
+            const restoredConfig = plainConfig(Config({
+              ...fresh,
+              accounts: freshAccounts,
+              activeAccount: shouldRestoreActive,
+            }))
+            await settingsApi.replace(restoredConfig)
+            await syncProviderState(restoredConfig)
+            rollbackSuccess = true
           } catch {
-            /* ignore rollback error */
+            rollbackSuccess = false
           }
+
+          if (rollbackSuccess) {
+            return writeJson(res, 500, {
+              ok: false,
+              partial: false,
+              accountRemoved: false,
+              secretDeleted: false,
+              error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
+            })
+          }
+
+          pendingSecretCleanupAccounts.add(targetEnv)
           return writeJson(res, 500, {
             ok: false,
+            partial: true,
+            accountRemoved: true,
+            secretDeleted: false,
             error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
           })
         }
       }
 
+      pendingSecretCleanupAccounts.delete(targetEnv)
       clearUsageCache()
       clearProbeCache()
 
-      writeJson(res, 200, { ok: true, removed: targetEnv })
+      writeJson(res, 200, { ok: true, removed: targetEnv, secretDeleted: Boolean(body.deleteSecret && delRes?.ok) })
     } catch (err) {
       writeJson(res, 500, { ok: false, error: String(err?.message || err) })
     }
@@ -234,7 +288,13 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
         }
 
-        const next = plainConfig(Config({ ...plainConfig(live()), activeAccount: account }))
+        const currentLive = plainConfig(live())
+        const accountChanged = currentLive.activeAccount !== account
+        const next = plainConfig(Config({
+          ...currentLive,
+          activeAccount: account,
+          ...(accountChanged ? { dynamicModels: [], planSyncedAt: 0 } : {}),
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         writeJson(res, 200, { ok: true, activeAccount: account })

package/lib/routes/models.js

@@ -49,7 +49,12 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         await syncProviderState(next)
         const cacheFile = resolvePathWithHome(pub.modelsCachePath)
         if (cacheFile) {
-          await saveModelsDiskCache(cacheFile, dynamicModels, now)
+          const activeAcc = await resolveActiveAccountKey(ctx, live())
+          const accountRef = activeAcc?.envName || activeAcc?.apiKeyEnv || pub.activeAccount || pub.apiKeyEnv || 'CLINEBOT_API_KEY'
+          await saveModelsDiskCache(cacheFile, dynamicModels, now, {
+            endpoint: pub.baseUrl,
+            accountRef,
+          })
         }
 
         return writeJson(res, 200, {

package/lib/routes/proxy.js

@@ -112,11 +112,17 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         req.headers['x-client-request-id'] ||
         body?.session_id ||
         body?.conversation_id ||
+        body?.prompt_cache_key ||
         body?.chat_id ||
         body?.user ||
         ''
       ).trim()
 
+      if (sessionId) {
+        if (!body.session_id) body.session_id = sessionId
+        if (!body.conversation_id) body.conversation_id = sessionId
+      }
+
       // Ensure model is set, fallback to defaultModel (#140)
       body.model = String(body.model || pub.defaultModel || DEFAULT_MODEL_ID).trim()
 

package/lib/routes/settings.js

@@ -93,6 +93,10 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
         const base = plainConfig(live()) || {}
         delete base.enabledModels
         const merged = { ...base, ...rawPayload }
+        if (rawPayload.activeAccount !== undefined && String(rawPayload.activeAccount).trim() !== String(base.activeAccount || "").trim()) {
+          if (!("dynamicModels" in rawPayload)) merged.dynamicModels = []
+          if (!("planSyncedAt" in rawPayload)) merged.planSyncedAt = 0
+        }
         const parsed = plainConfig(Config(merged))
         await settingsApi.replace(parsed)
         await syncProviderState(parsed)

package/lib/slash-command.js

@@ -100,7 +100,14 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           clearProbeCache()
           const settingsApi = getSettingsApi()
           if (settingsApi?.replace) {
-            const next = Config({ ...plainConfig(live()), activeAccount: param })
+            const curr = plainConfig(live())
+            const isDifferent = String(param || "").trim() !== String(curr.activeAccount || "").trim()
+            const next = Config({
+              ...curr,
+              activeAccount: param,
+              dynamicModels: isDifferent ? [] : (curr.dynamicModels || []),
+              planSyncedAt: isDifferent ? 0 : Number(curr.planSyncedAt || 0),
+            })
             await settingsApi.replace(next)
             await syncProviderState(next)
             return `Active account switched to ${param}`

package/lib/stats-storage.js

@@ -119,6 +119,26 @@ export function loadStats(customPath) {
   return inMemoryStats
 }
 
+/**
+ * Switch active stats storage to a new path.
+ * Flushes pending writes of current storage and loads stats from the new path.
+ *
+ * @param {string} newPath
+ * @returns {string} active stats path
+ */
+export function switchStatsStorage(newPath) {
+  const resolved = resolvePath(newPath)
+  if (resolved && resolved !== activeStatsPath) {
+    if (activeStatsPath) {
+      flushStats(activeStatsPath)
+    }
+    activeStatsPath = resolved
+    loadStats(resolved)
+  }
+  return activeStatsPath
+}
+
+
 /**
  * Flush any debounced pending writes immediately to disk.
  *
@@ -201,6 +221,9 @@ export function recordUsage({
   is429 = false,
   statsPath
 } = {}) {
+  if (statsPath) {
+    switchStatsStorage(statsPath)
+  }
   const now = new Date()
   const dayKey = now.toISOString().slice(0, 10) // 'YYYY-MM-DD'
   const monthKey = dayKey.slice(0, 7) // 'YYYY-MM'

package/lib/updater.js

@@ -264,6 +264,16 @@ export async function installExact(target, packageSpec, options = {}) {
     let sigtermTimer = null
     let sigkillTimer = null
 
+    function isProcessGroupAlive(pid) {
+      if (typeof pid !== 'number' || pid <= 0 || process.platform === 'win32') return false
+      try {
+        process.kill(-pid, 0)
+        return true
+      } catch {
+        return false
+      }
+    }
+
     function cleanupTimers() {
       clearTimeout(mainTimer)
       if (sigtermTimer) clearTimeout(sigtermTimer)
@@ -272,16 +282,26 @@ export async function installExact(target, packageSpec, options = {}) {
 
     function onProcessExit(code, signal) {
       if (exited) return
-      exited = true
-      cleanupTimers()
 
       if (isTimedOut) {
+        if (isProcessGroupAlive(child.pid)) {
+          // Parent exited, but descendants in process group are still alive;
+          // keep escalation timer active (#172)
+          clearTimeout(mainTimer)
+          return
+        }
+        exited = true
+        cleanupTimers()
         cleanStaleLock(target.profileDir)
         reject(new Error('Update timed out.'))
-      } else if (code === 0) {
-        resolvePromise()
       } else {
-        reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+        exited = true
+        cleanupTimers()
+        if (code === 0) {
+          resolvePromise()
+        } else {
+          reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+        }
       }
     }
 
@@ -316,18 +336,25 @@ export async function installExact(target, packageSpec, options = {}) {
 
       // Step 2: Wait for grace period, if process has not exited escalate to SIGKILL (#172)
       sigtermTimer = setTimeout(() => {
-        const hasExited = exited || (child.exitCode !== null && child.exitCode !== undefined) || (child.signalCode !== null && child.signalCode !== undefined)
-        if (!hasExited) {
+        const groupAlive = isProcessGroupAlive(child.pid)
+        const parentExited = (child.exitCode !== null && child.exitCode !== undefined) || (child.signalCode !== null && child.signalCode !== undefined)
+        if (!parentExited || groupAlive) {
           killProcessTree('SIGKILL')
 
           // Step 3: Hard deadline for exit notification
           sigkillTimer = setTimeout(() => {
             if (!exited) {
               exited = true
+              cleanupTimers()
               cleanStaleLock(target.profileDir)
               reject(new Error('Update timed out.'))
             }
-          }, sigkillGraceMs)
+          }, Math.min(sigkillGraceMs, 50))
+        } else if (!exited) {
+          exited = true
+          cleanupTimers()
+          cleanStaleLock(target.profileDir)
+          reject(new Error('Update timed out.'))
         }
       }, sigtermGraceMs)
     }, timeoutMs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.10",
+  "version": "0.5.12",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",