@goodandready/dsh-clinebot 0.5.2 → 0.5.4

package/CHANGELOG.md

@@ -1,10 +1,20 @@
 # Changelog
 
+## 0.5.4
+
+### Fixed
+- **Peer gate on DSH 0.2.0-rc.1** (#58): DSH skips a profile bundle whose `peerDependencies` exclude the running version, so this plugin was absent from the profile with no error in the UI. Every `@deepseek-ai/dsh-*` peer now names both the 0.1.7-rc.2 and 0.2.0-rc.1 lines, because semver does not admit a prerelease of the next minor into a range that does not name it.
+
 All notable changes to `@goodandready/dsh-clinebot` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-09-28
+
+### Fixed
+- **Proxy Token Routing via DSH llm-pi-ai & Dual Bearer Auth (Issue #150, GitHub #11)**: In `@deepseek-ai/dsh-llm-pi-ai@0.1.7-rc.2`, the streaming runner (`streamWithSnapshot`) resolves request authorization strictly from `profile.apiKeyEnv` and completely ignores the literal `apiKey` field in the provider descriptor. When `proxyMode` is active, `upsertPiAiProvider` now correctly registers `apiKeyEnv: LOCAL_PROXY_KEY_ENV` (`CLINEBOT_LOCAL_PROXY_TOKEN`), while `lib/proxy-token.js` populates the credential store with the generated token value. In addition, `isAuthorizedProxyRequest` now accepts requests authenticated with either `CLINEBOT_LOCAL_PROXY_TOKEN` or any valid account key configured in the active account pool, ensuring uninterrupted communication across streaming, non-streaming, and diagnostic invocations without HTTP 401 Unauthorized rejections.
+
 ## [0.5.2] - 2026-09-28
 
 ### Security

package/lib/provider-sync.js

@@ -215,7 +215,7 @@ export async function upsertPiAiProvider(ctx, cfg, activeModelIds) {
 
   const providerObj = buildPiAiProvider({
     baseUrl: effectiveBaseUrl,
-    apiKeyEnv: activeAcc?.apiKeyEnv || pub.apiKeyEnv,
+    apiKeyEnv: isProxy ? LOCAL_PROXY_KEY_ENV : (activeAcc?.apiKeyEnv || pub.apiKeyEnv),
     apiKey: localToken,
     models: modelsToRegister.length ? modelsToRegister : allModels,
     customModels: [...(pub.dynamicModels || []), ...(pub.customModels || [])],

package/lib/routes/proxy.js

@@ -24,9 +24,9 @@ import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 import { getLocalProxyToken } from '../proxy-token.js'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.2'
+let packageVersion = '0.5.3'
 try {
-  packageVersion = require('../../package.json').version || '0.5.2'
+  packageVersion = require('../../package.json').version || '0.5.3'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }
@@ -44,12 +44,22 @@ export function hasDisallowedBrowserOrigin(req) {
   return false
 }
 
-export function isAuthorizedProxyRequest(req) {
+export function isAuthorizedProxyRequest(req, accountPool = []) {
   const auth = req.headers?.['authorization'] || ''
   const match = auth.match(/^Bearer\s+(.+)$/i)
   if (!match) return false
   const token = match[1].trim()
-  return Boolean(token && token === getLocalProxyToken())
+  if (!token) return false
+  const localToken = getLocalProxyToken()
+  if (localToken && token === localToken) {
+    return true
+  }
+  if (Array.isArray(accountPool) && accountPool.length > 0) {
+    if (accountPool.some((acc) => acc.value && acc.value === token)) {
+      return true
+    }
+  }
+  return false
 }
 
 export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
@@ -70,7 +80,8 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
       }
 
-      if (!isAuthorizedProxyRequest(req)) {
+      const pool = await resolveAccountPool(ctx, live())
+      if (!isAuthorizedProxyRequest(req, pool)) {
         return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
       }
 
@@ -114,7 +125,6 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
       }
 
       const isStreaming = Boolean(body.stream)
-      const pool = await resolveAccountPool(ctx, cfg)
       const configuredAccounts = pool.filter(a => a.present && a.value)
 
       const maxRetries = Math.max(1, configuredAccounts.length)
@@ -345,7 +355,8 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
       }
 
-      if (!isAuthorizedProxyRequest(req)) {
+      const pool = await resolveAccountPool(ctx, live())
+      if (!isAuthorizedProxyRequest(req, pool)) {
         return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",
@@ -59,8 +59,8 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-credentials": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {