@goodandready/dsh-clinebot 0.5.16 → 0.5.17

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.17] - 2026-10-05
+
+### Fixed
+- **Cosmokit Volatile Getters Unwrapping in Live Config (Issues #194, #200)**: Resolved issue where `live()` returned raw Cosmokit `Volatile` `{ get }` object boxes for volatile schema fields, causing downstream boolean checks (such as `!pub.enabled` in `syncProviderState`) to always evaluate as truthy objects regardless of actual boolean value. Fully unwrapped `live()` return values via `plainConfig(Config(plainConfig(...)))` and guaranteed robust fallback defaults when `apply()` receives null/undefined config.
+- **Proxy Body Read Timeout & Payload Size Bounds (Issues #198, #202)**: Switched non-streaming upstream body read timeouts from `streamIdleTimeoutMs` (30s) to `bodyTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)`. Added strict guard against unbounded payload responses (`MAX_BODY_BYTES = 10 * 1024 * 1024`) returning 502 Bad Gateway if upstream response exceeds 10MB.
+- **Dead Configuration Keys & Timeout Cleanup (Issue #197)**: Removed non-existent configuration keys (`streamTotalTimeoutMs`, `connectTimeoutMs`, `idleTimeoutMs`) from `lib/routes/proxy.js` and eliminated dead timer logic.
+- **DSH Non-Existent Service API Calls Removal (Issue #199)**: Removed dead `settings?.get` and `settingsApi.watch` calls on DSH services that lack those methods.
+- **Corrupted Stats Backup Pruning (Issue #201)**: Added automatic rotation and pruning for `.corrupt.*` backup files in `lib/stats-storage.js`, retaining at most the 3 latest diagnostic copies to prevent unbounded disk usage.
+- **Version Literals & Slash Command Cleanup (Issue #202)**: Synchronized hardcoded fallback version literals to `'0.5.17'`, cleaned up unused `invocation` argument in `slash-command.js`, and updated fallback port detection (`ctx?.webServer?.port || ctx?.get?.('webServer')?.port || process.env.PORT || 3080`).
+
 ## [0.5.16] - 2026-10-04
 
 ### Fixed

package/lib/index.js

@@ -37,7 +37,7 @@ export function configReader(config) {
 export { NS, LLM_PI_AI_NS, Config, sessionStats, recordSessionRequest, resetSessionStats, rotateToNextAccount }
 
 export function apply(ctx, config) {
-  let currentConfig = config
+  let currentConfig = config || {}
   const overrides = {}
   const getConfig = () => {
     if (!currentConfig) return currentConfig
@@ -73,7 +73,7 @@ export function apply(ctx, config) {
     }
     return currentConfig
   }
-  const live = () => (getConfig() ? Config(structuredClone(plainConfig(getConfig()))) : config)
+  const live = () => plainConfig(Config(plainConfig(getConfig() || config || {})))
   let settingsApi
 
   const syncProviderState = async (cfg) => {
@@ -219,7 +219,7 @@ export function apply(ctx, config) {
       applyConfigMutations(currentConfig, parsed)
       syncStatsStorage(live())
       await syncProviderState(live())
-      return parsed
+      return plainConfig(parsed)
     },
     update: async (patch) => {
       const svc = ctx?.get?.('settings')
@@ -248,13 +248,9 @@ export function apply(ctx, config) {
       applyConfigMutations(currentConfig, merged)
       syncStatsStorage(live())
       await syncProviderState(live())
-      return merged
-    },
-    watch: (cb) => {
-      const svc = ctx?.get?.('settings')
-      if (typeof svc?.watch === 'function') return svc.watch(cb)
-      return () => {}
+      return plainConfig(merged)
     },
+
   }
 
   if (typeof ctx.effect === 'function') {

package/lib/provider-sync.js

@@ -56,10 +56,7 @@ export async function checkRegisteredInPiAi(ctx) {
       const piAiDesc = Array.isArray(descriptors) ? descriptors.find((d) => d?.ns === LLM_PI_AI_NS) : null
       if (piAiDesc?.value?.providers?.[PROVIDER_ID]) return true
     }
-    if (typeof settings?.get === 'function') {
-      const piAi = settings.get(LLM_PI_AI_NS)
-      if (piAi?.providers?.[PROVIDER_ID]) return true
-    }
+
     const llm = ctx?.get?.('llm')
     if (typeof llm?.listProviders === 'function') {
       const list = await llm.listProviders()
@@ -215,7 +212,7 @@ export async function upsertPiAiProvider(ctx, cfg, activeModelIds) {
 
   if (isProxy) {
     if (!proxyPort) {
-      proxyPort = ctx?.webServer?.port || process.env.PORT || 3080
+      proxyPort = ctx?.webServer?.port || ctx?.get?.('webServer')?.port || process.env.PORT || 3080
       const isFenced = await detectHostWebServerFence(proxyPort)
       if (isFenced) {
         ctx?.logger?.warn?.(

package/lib/routes/proxy.js

@@ -24,9 +24,9 @@ import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 import { getLocalProxyToken } from '../proxy-token.js'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.3'
+let packageVersion = '0.5.17'
 try {
-  packageVersion = require('../../package.json').version || '0.5.6'
+  packageVersion = require('../../package.json').version || '0.5.17'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }
@@ -161,8 +161,8 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           'User-Agent': USER_AGENT
         }
 
-        const connectTimeoutMs = Math.max(50, Number(pub.connectTimeoutMs || pub.timeoutMs) || 15000)
-        const streamIdleTimeoutMs = Math.max(50, Number(pub.streamIdleTimeoutMs || pub.idleTimeoutMs) || 30000)
+        const connectTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)
+        const streamIdleTimeoutMs = Math.max(50, Number(pub.streamIdleTimeoutMs) || 30000)
 
         const connectAbortCtrl = new AbortController()
         const bodyAbortCtrl = new AbortController()
@@ -283,16 +283,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             }
           }
 
-          let totalTimer = null
-          if (pub.streamTotalTimeoutMs && Number(pub.streamTotalTimeoutMs) > 0) {
-            const totalMs = Number(pub.streamTotalTimeoutMs)
-            totalTimer = setTimeout(() => {
-              streamError = new Error(`Stream total timeout after ${totalMs}ms`)
-              try {
-                reader.cancel('stream total timeout').catch(() => {})
-              } catch { /* reader already cancelled or closed */ }
-            }, totalMs)
-          }
+
 
           try {
             resetIdleTimer()
@@ -341,7 +332,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             ctx?.logger?.warn?.('[dsh-clinebot:proxy] Stream read error: ' + (streamErr?.message || streamErr))
           } finally {
             clearIdleTimer()
-            if (totalTimer) clearTimeout(totalTimer)
+            
             clientAbortCtrl.signal.removeEventListener('abort', onStreamAbort)
             cleanupClientListeners()
             try {
@@ -379,17 +370,26 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           return
         }
 
-        // Non-streaming JSON response with deadline and fail-closed error handling (#185)
-        const idleTimeoutMs = streamIdleTimeoutMs
+        // Non-streaming JSON response with deadline and fail-closed error handling (#185, #198, #202)
+        const bodyTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)
         let bodyTimer = null
         const bodyTimeoutPromise = new Promise((_, reject) => {
           bodyTimer = setTimeout(() => {
             bodyTimedOut = true
-            bodyAbortCtrl.abort(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
-            reject(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
-          }, idleTimeoutMs)
+            bodyAbortCtrl.abort(new Error(`Upstream body read timed out after ${bodyTimeoutMs}ms`))
+            reject(new Error(`Upstream body read timed out after ${bodyTimeoutMs}ms`))
+          }, bodyTimeoutMs)
         })
 
+        const MAX_BODY_BYTES = 10 * 1024 * 1024
+        const contentLength = Number(upstreamRes.headers.get('content-length'))
+        if (contentLength > MAX_BODY_BYTES) {
+          clearTimeout(bodyTimer)
+          cleanupClientListeners()
+          writeJson(res, 502, { ok: false, error: 'Upstream response exceeded maximum allowed size' })
+          return
+        }
+
         let resText = ''
         let readError = null
         try {
@@ -397,6 +397,9 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             upstreamRes.text(),
             bodyTimeoutPromise,
           ])
+          if (resText.length > MAX_BODY_BYTES) {
+            throw new Error('Upstream response exceeded maximum allowed size')
+          }
         } catch (err) {
           readError = err
         } finally {
@@ -419,7 +422,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           })
           const statusCode = isTimeout ? 504 : 502
           const errMessage = isTimeout
-            ? `Gateway Timeout: upstream body read timed out after ${idleTimeoutMs}ms`
+            ? `Gateway Timeout: upstream body read timed out after ${bodyTimeoutMs}ms`
             : `Bad Gateway: upstream response body read error: ${readError?.message || readError}`
           return writeJson(res, statusCode, {
             error: {

package/lib/slash-command.js

@@ -26,7 +26,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
     const commands = cmdCtx.commands
     if (typeof commands?.register !== 'function') return
 
-    const executeCommand = async (rawArgs, invocation = null) => {
+    const executeCommand = async (rawArgs) => {
       try {
         const pub = publicConfig(live())
         const subcmd = String(rawArgs || '').trim().toLowerCase().split(/\s+/)[0] || 'quota'
@@ -102,12 +102,12 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           if (settingsApi?.replace) {
             const curr = plainConfig(live())
             const isDifferent = String(param || "").trim() !== String(curr.activeAccount || "").trim()
-            const next = Config({
+            const next = plainConfig(Config({
               ...curr,
               activeAccount: param,
               dynamicModels: isDifferent ? [] : (curr.dynamicModels || []),
               planSyncedAt: isDifferent ? 0 : Number(curr.planSyncedAt || 0),
-            })
+            }))
             await settingsApi.replace(next)
             await syncProviderState(next)
             return `Active account switched to ${param}`
@@ -276,7 +276,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
         ? invocation
         : (invocation?.rawInput || invocation?.input || invocation?.text || invocation?.args || '')
       try {
-        const output = await executeCommand(rawArgs, invocation)
+        const output = await executeCommand(rawArgs)
         return {
           kind: 'success',
           text: output,

package/lib/stats-storage.js

@@ -5,7 +5,7 @@
  * Survives dsh-web service restarts and tracks historical consumption by day, month, model, and account.
  */
 
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync } from 'node:fs'
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync, readdirSync, unlinkSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
 
@@ -104,11 +104,25 @@ export function loadStats(customPath) {
       }
     }
   } catch (err) {
-    // If reading fails or file is corrupted, preserve corrupted file for diagnostics
+    // If reading fails or file is corrupted, preserve corrupted file for diagnostics (#158, #201)
     try {
       if (existsSync(filePath)) {
         const corruptBackup = `${filePath}.corrupt.${Date.now()}`
         copyFileSync(filePath, corruptBackup)
+        const dir = path.dirname(filePath)
+        const base = path.basename(filePath)
+        const prefix = `${base}.corrupt.`
+        const existing = readdirSync(dir)
+          .filter((name) => name.startsWith(prefix))
+          .sort()
+        while (existing.length > 3) {
+          const oldest = existing.shift()
+          try {
+            unlinkSync(path.join(dir, oldest))
+          } catch {
+            /* ignore deletion failure */
+          }
+        }
       }
     } catch {
       /* ignore backup failure */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",