@goodandready/dsh-clinebot 0.5.16 → 0.5.18

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.18] - 2026-10-06
+
+### Fixed
+- **Canonical Core CSS Theme Tokens Replacement (Issue #204)**: Replaced 6 non-existent legacy theme tokens across `src/client/` (`state-warning-primary`, `state-brand-primary`, `bg-hover`, `border`, `bg-layer-4`, `status-danger`) with canonical DSH 0.2.0-rc.2 core alias tokens (`state-warn-primary`, `brand-primary`, `interactive-bg-hover`, `border-l2`, `state-error-primary`), restoring color accents to warning badges, progress bars, warning banners, input focus states, button hover states, and critical quota warnings. Added automated test verifying all `--dsw-alias-*` tokens against canonical core allowlist.
+- **Client Fetch Abort Timeout Protection (Issue #205)**: Implemented modular client helper `fetchWithTimeout(url, opts, ms = 30000)` using `AbortController` in `src/client/api.js`. Wrapped all 18 client-side `fetch` calls in `src/client/settings-page.js` to prevent infinite loading/busy button lockups on unresponsive networks or stalled endpoints, unlocking UI states after 30 seconds with informative timeout messaging.
+- **Explicit Warning and Local Fallback for Missing ESLint (Issue #206)**: Updated `scripts/build-client.js` to look for local `node_modules/.bin/eslint` before fallback and emit an explicit stdout warning when eslint is not installed rather than silently suppressing ENOENT. Added `AbortController` to global identifier declarations.
+- **Build Drift Verification via --check Flag (Issue #207)**: Added `--check` mode to `scripts/build-client.js` to verify in memory whether `lib/client.js` is in sync with `src/client/` source modules without rewriting the bundle. Integrated `--check` validation into `test/decomposition.test.js` to prevent uncommitted client bundle drift.
+- **Strict Canonical Row Slot Key Registration (Issue #208)**: Removed redundant loop in `src/client/entry.js` registering inert legacy key `dsh-clinebot#dsh-clinebot`. Retained strictly canonical row seat registration under `ROW_CONFIG_KEY` (`@goodandready/dsh-clinebot#dsh-clinebot`).
+- **Locale Dictionary Registration Error Logging (Issue #209)**: In `src/client/entry.js`, added explicit `console.warn` diagnostics reporting namespace and locale details upon `ctx.locale.register` failure instead of silently swallowing dictionary errors.
+
+## [0.5.17] - 2026-10-05
+
+### Fixed
+- **Cosmokit Volatile Getters Unwrapping in Live Config (Issues #194, #200)**: Resolved issue where `live()` returned raw Cosmokit `Volatile` `{ get }` object boxes for volatile schema fields, causing downstream boolean checks (such as `!pub.enabled` in `syncProviderState`) to always evaluate as truthy objects regardless of actual boolean value. Fully unwrapped `live()` return values via `plainConfig(Config(plainConfig(...)))` and guaranteed robust fallback defaults when `apply()` receives null/undefined config.
+- **Proxy Body Read Timeout & Payload Size Bounds (Issues #198, #202)**: Switched non-streaming upstream body read timeouts from `streamIdleTimeoutMs` (30s) to `bodyTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)`. Added strict guard against unbounded payload responses (`MAX_BODY_BYTES = 10 * 1024 * 1024`) returning 502 Bad Gateway if upstream response exceeds 10MB.
+- **Dead Configuration Keys & Timeout Cleanup (Issue #197)**: Removed non-existent configuration keys (`streamTotalTimeoutMs`, `connectTimeoutMs`, `idleTimeoutMs`) from `lib/routes/proxy.js` and eliminated dead timer logic.
+- **DSH Non-Existent Service API Calls Removal (Issue #199)**: Removed dead `settings?.get` and `settingsApi.watch` calls on DSH services that lack those methods.
+- **Corrupted Stats Backup Pruning (Issue #201)**: Added automatic rotation and pruning for `.corrupt.*` backup files in `lib/stats-storage.js`, retaining at most the 3 latest diagnostic copies to prevent unbounded disk usage.
+- **Version Literals & Slash Command Cleanup (Issue #202)**: Synchronized hardcoded fallback version literals to `'0.5.17'`, cleaned up unused `invocation` argument in `slash-command.js`, and updated fallback port detection (`ctx?.webServer?.port || ctx?.get?.('webServer')?.port || process.env.PORT || 3080`).
+
 ## [0.5.16] - 2026-10-04
 
 ### Fixed

package/lib/client.js

@@ -44,6 +44,7 @@ const en = {
       'settings.loading': 'Loading ClineBot settings…',
       'settings.retry': 'Retry',
       'settings.unavailable': 'ClineBot settings unavailable (host namespace is not ready).',
+      'api.timeout': 'Request timed out ({seconds}s)',
       'header.title': 'ClineBot (ClinePass) Provider',
       'header.sub': 'Connect models under your active ClinePass subscription. OpenAI API compatible, automated rolling limit tracking, and instant auto-registration in DSH.',
       'badge.online': 'Host online ({latency} ms)',
@@ -197,6 +198,7 @@ const en = {
       'settings.loading': '正在加载 ClineBot 设置…',
       'settings.retry': '重试',
       'settings.unavailable': 'ClineBot 设置不可用（宿主命名空间尚未就绪）。',
+      'api.timeout': '请求超时（{seconds}秒）',
       'header.title': 'ClineBot (ClinePass) 模型服务商',
       'header.sub': '通过 ClinePass 订阅连接主流推理与编程模型。完全兼容 OpenAI 接口，自动追踪滚动限额并在 DSH 中即时生效。',
       'badge.online': '服务在线 ({latency} ms)',
@@ -406,15 +408,15 @@ function ensureCss() {
 
 .cb-badge{font-size:12px;padding:3px 10px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:5px;font-weight:500}
 .cb-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}
-.cb-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}
+.cb-badge-warn{border-color:var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 8%, transparent)}
 .cb-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}
 
 .cb-input{height:36px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 12px;font-size:13px;width:100%;box-sizing:border-box}
-.cb-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}
+.cb-input:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}
 .cb-input-group{display:flex;gap:8px;align-items:center}
 
 .cb-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:7px 14px;font-size:13px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-weight:500;display:inline-flex;align-items:center;justify-content:center;gap:6px;transition:all .15s ease}
-.cb-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}
+.cb-btn:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}
 .cb-btn-primary{background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);border-color:transparent}
 .cb-btn-primary:hover:not(:disabled){background:var(--dsw-alias-label-primary) !important;color:var(--dsw-alias-bg-layer-3) !important;opacity:0.88;visibility:visible !important}
 .cb-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}
@@ -426,8 +428,8 @@ function ensureCss() {
 .cb-progress-label{font-weight:500;white-space:nowrap}
 .cb-progress-meta, .cb-bar-meta{font-size:12px;color:var(--dsw-alias-label-secondary);white-space:nowrap;margin-left:auto}
 .cb-progress-track, .cb-bar-track{width:100%;height:8px;border-radius:999px;background:var(--dsw-alias-bg-layer-1);overflow:hidden;border:1px solid var(--dsw-alias-border-l2)}
-.cb-progress-bar-fill, .cb-bar-fill{height:100%;border-radius:999px;transition:width .3s;background:var(--dsw-alias-state-brand-primary, var(--dsw-alias-state-success-primary))}
-.cb-progress-bar-warn{height:100%;border-radius:999px;transition:width .3s;background:var(--dsw-alias-state-warning-primary)}
+.cb-progress-bar-fill, .cb-bar-fill{height:100%;border-radius:999px;transition:width .3s;background:var(--dsw-alias-brand-primary, var(--dsw-alias-state-success-primary))}
+.cb-progress-bar-warn{height:100%;border-radius:999px;transition:width .3s;background:var(--dsw-alias-state-warn-primary)}
 .cb-progress-bar-bad{height:100%;border-radius:999px;transition:width .3s;background:var(--dsw-alias-state-error-primary)}
 
 .cb-table{width:100%;border-collapse:collapse;margin-top:8px}
@@ -438,7 +440,7 @@ function ensureCss() {
 .cb-alert-ok{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);font-size:13px}
 .cb-alert-bad{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px}
 .cb-alert-err{padding:10px 14px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);font-size:13px}
-.cb-banner-warning{padding:12px 16px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 12%, transparent);border:1px solid var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:500}
+.cb-banner-warning{padding:12px 16px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-warn-primary) 12%, transparent);border:1px solid var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:500}
 .cb-banner-exhausted{padding:12px 16px;border-radius:8px;background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);border:1px solid var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);font-size:13px;display:flex;align-items:center;gap:10px;font-weight:600}
 .cb-stat-box{padding:12px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2);display:flex;flex-direction:column;gap:4px}
 .cb-stat-val{font-size:18px;font-weight:700;color:var(--dsw-alias-label-primary)}
@@ -448,6 +450,29 @@ function ensureCss() {
       document.head.appendChild(style)
     }
 
+// --- src/client/api.js ---
+async function fetchWithTimeout(url, opts = {}, ms = 30000) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => {
+    controller.abort()
+  }, ms)
+  const signal = opts.signal || controller.signal
+  try {
+    const res = await fetch(url, { ...opts, signal })
+    return res
+  } catch (err) {
+    if (err && (err.name === 'AbortError' || controller.signal.aborted)) {
+      const sec = Math.round(ms / 1000)
+      const tFn = typeof opts.t === 'function' ? opts.t : null
+      const msg = tFn ? tFn('api.timeout', { seconds: sec }) : ('Request timed out (' + sec + 's)')
+      throw new Error(msg)
+    }
+    throw err
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
 // --- src/client/error-boundary.js ---
 function createErrorBoundary() {
   try {
@@ -549,7 +574,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
         gap: '8px',
         padding: '12px 14px',
         borderRadius: '8px',
-        border: isBad ? '1px solid var(--dsw-alias-status-danger)' : '1px solid var(--dsw-alias-border-l2)',
+        border: isBad ? '1px solid var(--dsw-alias-state-error-primary)' : '1px solid var(--dsw-alias-border-l2)',
         background: 'var(--dsw-alias-bg-layer-2)',
       },
     },
@@ -569,7 +594,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
         'span',
         { className: 'cb-progress-label', style: { fontWeight: 500, whiteSpace: 'nowrap' } },
         label,
-        isBad ? React.createElement('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-status-danger)' } }, '⚠️ <10%') : null
+        isBad ? React.createElement('span', { style: { marginLeft: '6px', fontSize: '11px', color: 'var(--dsw-alias-state-error-primary)' } }, '⚠️ <10%') : null
       ),
       React.createElement(
         'span',
@@ -577,7 +602,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
           className: 'cb-progress-meta cb-bar-meta',
           style: {
             fontSize: '12px',
-            color: isBad ? 'var(--dsw-alias-status-danger)' : 'var(--dsw-alias-label-secondary)',
+            color: isBad ? 'var(--dsw-alias-state-error-primary)' : 'var(--dsw-alias-label-secondary)',
             whiteSpace: 'nowrap',
             marginLeft: 'auto',
           },
@@ -764,7 +789,7 @@ function KeySection({ keyPresent, apiKeyInput, setApiKeyInput, showKey, setShowK
           href: 'https://app.cline.bot/settings/api-keys',
           target: '_blank',
           rel: 'noreferrer',
-          style: { color: 'var(--dsw-alias-state-brand-primary)' },
+          style: { color: 'var(--dsw-alias-brand-primary)' },
         },
         t('key.get_key')
       )
@@ -850,8 +875,8 @@ function AccountsSection({ status, busy, handlePinAccount, handleAddAccount, han
           {
             onSubmit: onSubmitAdd,
             style: {
-              background: 'var(--dsw-alias-bg-hover, color-mix(in srgb, currentColor 4%, transparent))',
-              border: '1px solid var(--dsw-alias-border, color-mix(in srgb, currentColor 12%, transparent))',
+              background: 'var(--dsw-alias-interactive-bg-hover, color-mix(in srgb, currentColor 4%, transparent))',
+              border: '1px solid var(--dsw-alias-border-l2, color-mix(in srgb, currentColor 12%, transparent))',
               borderRadius: '8px',
               padding: '12px',
               marginBottom: '14px',
@@ -1522,7 +1547,7 @@ function ModelsSection({
                         display: 'flex',
                         flexDirection: 'column',
                         gap: '6px',
-                        background: 'var(--dsw-alias-bg-hover, color-mix(in srgb, currentColor 4%, transparent))',
+                        background: 'var(--dsw-alias-interactive-bg-hover, color-mix(in srgb, currentColor 4%, transparent))',
                         padding: '6px',
                         borderRadius: '6px',
                         border: '1px solid var(--dsw-alias-border-l2)',
@@ -1985,8 +2010,8 @@ function SettingsPage(props) {
   const load = React.useCallback(async () => {
     setErr('')
     const [res, statsRes] = await Promise.all([
-      fetch(`${ROUTE_PREFIX}/status`, { cache: 'no-store' }),
-      fetch(`${ROUTE_PREFIX}/stats`, { cache: 'no-store' }).catch(() => null),
+      fetchWithTimeout(`${ROUTE_PREFIX}/status`, { cache: 'no-store' }),
+      fetchWithTimeout(`${ROUTE_PREFIX}/stats`, { cache: 'no-store' }).catch(() => null),
     ])
     const data = await res.json().catch(() => ({}))
     if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`)
@@ -2001,7 +2026,7 @@ function SettingsPage(props) {
   const checkUpdate = React.useCallback(async () => {
     setUpdateState((s) => ({ ...s, checking: true, status: 'checking', error: '' }))
     try {
-      const res = await fetch(`${ROUTE_PREFIX}/update`)
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/update`)
       if (!res.ok) throw new Error(`HTTP ${res.status}`)
       const data = await res.json().catch(() => ({}))
       if (data.latestCheckFailed) {
@@ -2045,7 +2070,7 @@ function SettingsPage(props) {
     if (updateState.updating) return
     setUpdateState((s) => ({ ...s, updating: true, error: '', notice: '' }))
     try {
-      const res = await fetch(`${ROUTE_PREFIX}/update`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/update`, {
         method: 'POST',
         headers: { 'x-dsh-plugin-update': '1' },
       })
@@ -2089,7 +2114,7 @@ function SettingsPage(props) {
     const keyVal = String(apiKeyInput || '').trim()
     if (!keyVal) { setErr(t('key.empty_err')); return }
     await performAction('save-key', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/save-key`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/save-key`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ apiKey: keyVal, apiKeyEnv: draft?.apiKeyEnv }),
       })
@@ -2103,7 +2128,7 @@ function SettingsPage(props) {
 
   async function handleRefreshQuota() {
     await performAction('refresh-quota', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/usage`)
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/usage`)
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)
       setStatus((prev) => (prev ? { ...prev, usage: data } : prev))
@@ -2113,7 +2138,7 @@ function SettingsPage(props) {
 
   async function handleUpdateModelContext(payload) {
     await performAction('update-context', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/models/context`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/models/context`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(payload),
       })
@@ -2126,7 +2151,7 @@ function SettingsPage(props) {
 
   async function handleSyncPlanModels() {
     await performAction('sync-models', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/models/sync`, { method: 'POST' })
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/models/sync`, { method: 'POST' })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)
       setMsg(t('models.synced_msg', { total: data.totalModelsCount, discovered: data.discoveredCount }))
@@ -2136,7 +2161,7 @@ function SettingsPage(props) {
 
   async function handleRegister() {
     await performAction('register', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/register`, { method: 'POST' })
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/register`, { method: 'POST' })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)
       const count = status?.availableModels?.filter((m) => !(draft?.disabledModels || []).includes(m.id)).length || 0
@@ -2147,7 +2172,7 @@ function SettingsPage(props) {
 
   async function handleUnregister() {
     await performAction('unregister', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/unregister`, { method: 'POST' })
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/unregister`, { method: 'POST' })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)
       setMsg(t('diag.unregistered_msg'))
@@ -2158,7 +2183,7 @@ function SettingsPage(props) {
   async function handleSmoke() {
     setSmokeResult(null)
     await performAction('smoke', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/smoke`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/smoke`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ model: draft?.defaultModel }),
@@ -2182,7 +2207,7 @@ function SettingsPage(props) {
     verifyTimerRef.current = setTimeout(async () => {
       setVerifyStatus({ state: 'verifying', email: '', plan: '', error: '' })
       try {
-        const res = await fetch(`${ROUTE_PREFIX}/key/verify`, {
+        const res = await fetchWithTimeout(`${ROUTE_PREFIX}/key/verify`, {
           method: 'POST', headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ key: raw }),
         })
@@ -2207,7 +2232,7 @@ function SettingsPage(props) {
 
   async function handlePinAccount(accountEnv) {
     await performAction('pin-account', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/accounts/active`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/accounts/active`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ account: accountEnv }),
       })
@@ -2219,7 +2244,7 @@ function SettingsPage(props) {
 
   async function handleAddAccount({ label, apiKeyEnv, apiKey }) {
     await performAction('add-account', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/accounts`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/accounts`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ label, apiKeyEnv, apiKey }),
       })
@@ -2232,7 +2257,7 @@ function SettingsPage(props) {
 
   async function handleDeleteAccount(accountEnv, deleteSecret = true) {
     await performAction('delete-account', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/accounts/delete`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/accounts/delete`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ apiKeyEnv: accountEnv, deleteSecret }),
       })
@@ -2245,7 +2270,7 @@ function SettingsPage(props) {
   async function handleConfigPatch(patch) {
     setDraft((d) => ({ ...(d || {}), ...(patch || {}) }))
     await performAction('patch-config', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/config`, {
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/config`, {
         method: 'PUT', headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ config: patch }),
       })
@@ -2257,7 +2282,7 @@ function SettingsPage(props) {
 
   async function handleResetStats() {
     await performAction('reset-stats', async () => {
-      const res = await fetch(`${ROUTE_PREFIX}/stats/reset`, { method: 'POST' })
+      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/stats/reset`, { method: 'POST' })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)
       await load()
@@ -2272,7 +2297,7 @@ function SettingsPage(props) {
     if (debounceTimerRef.current) clearTimeout(debounceTimerRef.current)
     debounceTimerRef.current = setTimeout(async () => {
       try {
-        const res = await fetch(`${ROUTE_PREFIX}/models/toggle`, {
+        const res = await fetchWithTimeout(`${ROUTE_PREFIX}/models/toggle`, {
           method: 'POST',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ disabledModels: nextDisabled }),
@@ -2527,7 +2552,8 @@ function apply(ctx) {
   const addLocale = (locale, dictionary) => {
     try {
       return ctx.locale.register(NS, locale, dictionary)
-    } catch (_) {
+    } catch (err) {
+      console.warn(`[dsh-clinebot] Failed to register locale dictionary for ns "${NS}", locale "${locale}":`, err)
       return () => {}
     }
   }
@@ -2597,19 +2623,18 @@ function apply(ctx) {
   // The core keys the seat as `<bundle name>#<row id>`; `bundle.name` may be the
   // package name or the short bundle name depending on the manager's view, so both
   // spellings are registered — the unused one is inert.
-  for (const key of [ROW_CONFIG_KEY, ROW_ID + '#' + ROW_ID]) {
-    registerSlotWhenReady('plugins.row.config', () =>
-      ctx.slots.register(
-        {
-          name: 'plugins.row.config',
-          key,
-          locale: NS,
-          inject: () => ({ ctx }),
-        },
-        (props) => React.createElement(ErrorBoundary, { t: props && props.t }, React.createElement(PluginCard, { ...props, ctx: (props && props.ctx) || ctx }))
-      )
+  // Row seat: key = ROW_CONFIG_KEY ('@goodandready/dsh-clinebot#dsh-clinebot').
+  registerSlotWhenReady('plugins.row.config', () =>
+    ctx.slots.register(
+      {
+        name: 'plugins.row.config',
+        key: ROW_CONFIG_KEY,
+        locale: NS,
+        inject: () => ({ ctx }),
+      },
+      (props) => React.createElement(ErrorBoundary, { t: props && props.t }, React.createElement(PluginCard, { ...props, ctx: (props && props.ctx) || ctx }))
     )
-  }
+  )
 
   registerSlotWhenReady('settings.plugin.item', () =>
     ctx.slots.register(

package/lib/index.js

@@ -37,7 +37,7 @@ export function configReader(config) {
 export { NS, LLM_PI_AI_NS, Config, sessionStats, recordSessionRequest, resetSessionStats, rotateToNextAccount }
 
 export function apply(ctx, config) {
-  let currentConfig = config
+  let currentConfig = config || {}
   const overrides = {}
   const getConfig = () => {
     if (!currentConfig) return currentConfig
@@ -73,7 +73,7 @@ export function apply(ctx, config) {
     }
     return currentConfig
   }
-  const live = () => (getConfig() ? Config(structuredClone(plainConfig(getConfig()))) : config)
+  const live = () => plainConfig(Config(plainConfig(getConfig() || config || {})))
   let settingsApi
 
   const syncProviderState = async (cfg) => {
@@ -219,7 +219,7 @@ export function apply(ctx, config) {
       applyConfigMutations(currentConfig, parsed)
       syncStatsStorage(live())
       await syncProviderState(live())
-      return parsed
+      return plainConfig(parsed)
     },
     update: async (patch) => {
       const svc = ctx?.get?.('settings')
@@ -248,13 +248,9 @@ export function apply(ctx, config) {
       applyConfigMutations(currentConfig, merged)
       syncStatsStorage(live())
       await syncProviderState(live())
-      return merged
-    },
-    watch: (cb) => {
-      const svc = ctx?.get?.('settings')
-      if (typeof svc?.watch === 'function') return svc.watch(cb)
-      return () => {}
+      return plainConfig(merged)
     },
+
   }
 
   if (typeof ctx.effect === 'function') {

package/lib/provider-sync.js

@@ -56,10 +56,7 @@ export async function checkRegisteredInPiAi(ctx) {
       const piAiDesc = Array.isArray(descriptors) ? descriptors.find((d) => d?.ns === LLM_PI_AI_NS) : null
       if (piAiDesc?.value?.providers?.[PROVIDER_ID]) return true
     }
-    if (typeof settings?.get === 'function') {
-      const piAi = settings.get(LLM_PI_AI_NS)
-      if (piAi?.providers?.[PROVIDER_ID]) return true
-    }
+
     const llm = ctx?.get?.('llm')
     if (typeof llm?.listProviders === 'function') {
       const list = await llm.listProviders()
@@ -215,7 +212,7 @@ export async function upsertPiAiProvider(ctx, cfg, activeModelIds) {
 
   if (isProxy) {
     if (!proxyPort) {
-      proxyPort = ctx?.webServer?.port || process.env.PORT || 3080
+      proxyPort = ctx?.webServer?.port || ctx?.get?.('webServer')?.port || process.env.PORT || 3080
       const isFenced = await detectHostWebServerFence(proxyPort)
       if (isFenced) {
         ctx?.logger?.warn?.(

package/lib/routes/proxy.js

@@ -24,9 +24,9 @@ import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 import { getLocalProxyToken } from '../proxy-token.js'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.3'
+let packageVersion = '0.5.18'
 try {
-  packageVersion = require('../../package.json').version || '0.5.6'
+  packageVersion = require('../../package.json').version || '0.5.18'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }
@@ -161,8 +161,8 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           'User-Agent': USER_AGENT
         }
 
-        const connectTimeoutMs = Math.max(50, Number(pub.connectTimeoutMs || pub.timeoutMs) || 15000)
-        const streamIdleTimeoutMs = Math.max(50, Number(pub.streamIdleTimeoutMs || pub.idleTimeoutMs) || 30000)
+        const connectTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)
+        const streamIdleTimeoutMs = Math.max(50, Number(pub.streamIdleTimeoutMs) || 30000)
 
         const connectAbortCtrl = new AbortController()
         const bodyAbortCtrl = new AbortController()
@@ -283,16 +283,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             }
           }
 
-          let totalTimer = null
-          if (pub.streamTotalTimeoutMs && Number(pub.streamTotalTimeoutMs) > 0) {
-            const totalMs = Number(pub.streamTotalTimeoutMs)
-            totalTimer = setTimeout(() => {
-              streamError = new Error(`Stream total timeout after ${totalMs}ms`)
-              try {
-                reader.cancel('stream total timeout').catch(() => {})
-              } catch { /* reader already cancelled or closed */ }
-            }, totalMs)
-          }
+
 
           try {
             resetIdleTimer()
@@ -341,7 +332,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             ctx?.logger?.warn?.('[dsh-clinebot:proxy] Stream read error: ' + (streamErr?.message || streamErr))
           } finally {
             clearIdleTimer()
-            if (totalTimer) clearTimeout(totalTimer)
+            
             clientAbortCtrl.signal.removeEventListener('abort', onStreamAbort)
             cleanupClientListeners()
             try {
@@ -379,17 +370,26 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           return
         }
 
-        // Non-streaming JSON response with deadline and fail-closed error handling (#185)
-        const idleTimeoutMs = streamIdleTimeoutMs
+        // Non-streaming JSON response with deadline and fail-closed error handling (#185, #198, #202)
+        const bodyTimeoutMs = Math.max(50, Number(pub.timeoutMs) || 15000)
         let bodyTimer = null
         const bodyTimeoutPromise = new Promise((_, reject) => {
           bodyTimer = setTimeout(() => {
             bodyTimedOut = true
-            bodyAbortCtrl.abort(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
-            reject(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
-          }, idleTimeoutMs)
+            bodyAbortCtrl.abort(new Error(`Upstream body read timed out after ${bodyTimeoutMs}ms`))
+            reject(new Error(`Upstream body read timed out after ${bodyTimeoutMs}ms`))
+          }, bodyTimeoutMs)
         })
 
+        const MAX_BODY_BYTES = 10 * 1024 * 1024
+        const contentLength = Number(upstreamRes.headers.get('content-length'))
+        if (contentLength > MAX_BODY_BYTES) {
+          clearTimeout(bodyTimer)
+          cleanupClientListeners()
+          writeJson(res, 502, { ok: false, error: 'Upstream response exceeded maximum allowed size' })
+          return
+        }
+
         let resText = ''
         let readError = null
         try {
@@ -397,6 +397,9 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
             upstreamRes.text(),
             bodyTimeoutPromise,
           ])
+          if (resText.length > MAX_BODY_BYTES) {
+            throw new Error('Upstream response exceeded maximum allowed size')
+          }
         } catch (err) {
           readError = err
         } finally {
@@ -419,7 +422,7 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
           })
           const statusCode = isTimeout ? 504 : 502
           const errMessage = isTimeout
-            ? `Gateway Timeout: upstream body read timed out after ${idleTimeoutMs}ms`
+            ? `Gateway Timeout: upstream body read timed out after ${bodyTimeoutMs}ms`
             : `Bad Gateway: upstream response body read error: ${readError?.message || readError}`
           return writeJson(res, statusCode, {
             error: {

package/lib/slash-command.js

@@ -26,7 +26,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
     const commands = cmdCtx.commands
     if (typeof commands?.register !== 'function') return
 
-    const executeCommand = async (rawArgs, invocation = null) => {
+    const executeCommand = async (rawArgs) => {
       try {
         const pub = publicConfig(live())
         const subcmd = String(rawArgs || '').trim().toLowerCase().split(/\s+/)[0] || 'quota'
@@ -102,12 +102,12 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
           if (settingsApi?.replace) {
             const curr = plainConfig(live())
             const isDifferent = String(param || "").trim() !== String(curr.activeAccount || "").trim()
-            const next = Config({
+            const next = plainConfig(Config({
               ...curr,
               activeAccount: param,
               dynamicModels: isDifferent ? [] : (curr.dynamicModels || []),
               planSyncedAt: isDifferent ? 0 : Number(curr.planSyncedAt || 0),
-            })
+            }))
             await settingsApi.replace(next)
             await syncProviderState(next)
             return `Active account switched to ${param}`
@@ -276,7 +276,7 @@ export function registerSlashCommand(ctx, { live, getSettingsApi, syncProviderSt
         ? invocation
         : (invocation?.rawInput || invocation?.input || invocation?.text || invocation?.args || '')
       try {
-        const output = await executeCommand(rawArgs, invocation)
+        const output = await executeCommand(rawArgs)
         return {
           kind: 'success',
           text: output,

package/lib/stats-storage.js

@@ -5,7 +5,7 @@
  * Survives dsh-web service restarts and tracks historical consumption by day, month, model, and account.
  */
 
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync } from 'node:fs'
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync, readdirSync, unlinkSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
 
@@ -104,11 +104,25 @@ export function loadStats(customPath) {
       }
     }
   } catch (err) {
-    // If reading fails or file is corrupted, preserve corrupted file for diagnostics
+    // If reading fails or file is corrupted, preserve corrupted file for diagnostics (#158, #201)
     try {
       if (existsSync(filePath)) {
         const corruptBackup = `${filePath}.corrupt.${Date.now()}`
         copyFileSync(filePath, corruptBackup)
+        const dir = path.dirname(filePath)
+        const base = path.basename(filePath)
+        const prefix = `${base}.corrupt.`
+        const existing = readdirSync(dir)
+          .filter((name) => name.startsWith(prefix))
+          .sort()
+        while (existing.length > 3) {
+          const oldest = existing.shift()
+          try {
+            unlinkSync(path.join(dir, oldest))
+          } catch {
+            /* ignore deletion failure */
+          }
+        }
       }
     } catch {
       /* ignore backup failure */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.16",
+  "version": "0.5.18",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",