@goodandready/dsh-clinebot 0.5.22 → 0.5.24

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.24] - 2026-10-13
+
+### Security
+- **Settings & Updater Authentication Boundary (Issue #222)**: Integrated `getConnection(ctx)` and delegated request verification to DSH core service `connection.requestRejection(request)`. When accessed across LAN bridges or reverse-proxies, unauthenticated requests lacking DSH session authentication are rejected with HTTP 401/403 fail-closed, preventing unauthorized credential modification (`/save-key`), account pool manipulation, model toggling, or telemetry resets from LAN clients.
+
+## [0.5.23] - 2026-10-13
+
+### Removed
+- **Dead Exports & Helper Hygiene (Issue #220)**: Removed unused `getOrStartProxyPort` export from `lib/proxy-server.js` and unused cursor helper exports `getRoundRobinCursor` and `resetRoundRobinCursor` from `lib/session-router.js`. Internal round-robin cursor rotation and lifecycle resets remain fully operational.
+
 ## [0.5.22] - 2026-10-13
 
 ### Added

package/lib/access.js

@@ -1,9 +1,26 @@
-import { isTrustedSettingsRequest, writeJson } from './http.js'
+import { isTrustedSettingsRequest, getConnection, writeJson } from './http.js'
 
-export { isTrustedSettingsRequest }
+export { isTrustedSettingsRequest, getConnection }
 
-export function assertTrustedSettingsRequest(req, res) {
-  if (!isTrustedSettingsRequest(req)) {
+export function assertTrustedSettingsRequest(req, res, ctx = null) {
+  const conn = getConnection(ctx) || req?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(req)
+    } catch {
+      rejection = 403
+    }
+    if (rejection !== undefined) {
+      writeJson(res, rejection, {
+        ok: false,
+        error: rejection === 401 ? 'Authentication required' : 'Forbidden',
+      })
+      return false
+    }
+  }
+
+  if (!isTrustedSettingsRequest(req, ctx)) {
     writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }

package/lib/http.js

@@ -53,8 +53,34 @@ export function isLoopbackAddress(value) {
     || address.startsWith('::ffff:127.')
 }
 
-/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
-export function isTrustedSettingsRequest(request) {
+export function getConnection(ctx) {
+  try {
+    const fromCtx = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx || {}, 'connection'))
+    if (fromCtx) return fromCtx
+    if (ctx?.root) {
+      return getConnection(ctx.root)
+    }
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Reject unauthenticated LAN/remote writes while allowing admitted DSH and local requests (#222). */
+export function isTrustedSettingsRequest(request, ctx = null) {
+  // 1. Core DSH connection auth gate (#222)
+  const conn = getConnection(ctx) || request?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(request)
+    } catch {
+      return false
+    }
+    if (rejection !== undefined) return false
+  }
   const secFetchSite = header(request, 'sec-fetch-site')
   if (secFetchSite === 'cross-site') {
     return false

package/lib/proxy-server.js

@@ -136,10 +136,3 @@ export async function stopLoopbackProxyServer() {
   })
 }
 
-export async function getOrStartProxyPort(ctx, routeEnv) {
-  if (activeProxyPort) return activeProxyPort
-  if (routeEnv) {
-    return await startLoopbackProxyServer(ctx, routeEnv)
-  }
-  return null
-}

package/lib/proxy-token.js

@@ -14,9 +14,9 @@ export const LOCAL_PROXY_KEY_ENV = 'CLINEBOT_LOCAL_PROXY_TOKEN'
 let cachedToken = null
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.22'
+let packageVersion = '0.5.24'
 try {
-  packageVersion = require('../package.json').version || '0.5.22'
+  packageVersion = require('../package.json').version || '0.5.24'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }

package/lib/routes/accounts.js

@@ -23,7 +23,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
         return handleDeleteAccount(req, res)
       }
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       const settingsApi = getSettingsApi()
       if (!settingsApi || typeof settingsApi.replace !== 'function') {
         return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
@@ -114,7 +114,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
   }), 'dsh-clinebot: /accounts')
 
   async function handleDeleteAccount(req, res, targetEnvFromUrl = '') {
-    if (!assertTrustedSettingsRequest(req, res)) return
+    if (!assertTrustedSettingsRequest(req, res, ctx)) return
     const settingsApi = getSettingsApi()
     if (!settingsApi || typeof settingsApi.replace !== 'function') {
       return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
@@ -271,7 +271,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/accounts/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -307,7 +307,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/register',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -327,7 +327,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/unregister',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         await removePiAiProvider(ctx)
         writeJson(res, 200, { ok: true })

package/lib/routes/auth.js

@@ -16,7 +16,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     kind: 'exact',
     path: '/dsh-clinebot/key/verify',
     handler: async (req, res) => {
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
       try {
         const bodyBuf = await readBody(req)
@@ -96,7 +96,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/models.js

@@ -12,7 +12,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     kind: 'exact',
     path: '/dsh-clinebot/models/sync',
     handler: async (req, res) => {
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       if (req.method !== 'POST') {
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
@@ -76,7 +76,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -113,7 +113,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/context',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -223,7 +223,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/usage',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
         const activeKey = await resolveActiveAccountKey(ctx, live())
@@ -247,7 +247,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/probe',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/settings.js

@@ -12,7 +12,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const st = await buildStatus(ctx, live())
         writeJson(res, 200, st)
@@ -28,13 +28,13 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/config',
     handler: async (req, res) => {
       if (req.method === 'GET') {
-        if (!assertTrustedSettingsRequest(req, res)) return
+        if (!assertTrustedSettingsRequest(req, res, ctx)) return
         return writeJson(res, 200, { ok: true, config: publicConfig(live()) })
       }
       if (req.method !== 'PUT') {
         return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
       }
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       const settingsApi = getSettingsApi()
       if (!settingsApi) {
         return writeJson(res, 503, { ok: false, error: 'settings not ready' })
@@ -116,7 +116,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/save-key',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -186,7 +186,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const stats = getStatsSummary()
         writeJson(res, 200, { ok: true, stats })
@@ -202,7 +202,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats/reset',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
         const stats = resetStats(pub.statsPath)
@@ -219,7 +219,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats/export',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const csv = exportStatsAsCsv()
         res.statusCode = 200

package/lib/session-router.js

@@ -132,14 +132,6 @@ export function getAccountUsageMetric(acc) {
 
 let roundRobinCursor = 0
 
-export function getRoundRobinCursor() {
-  return roundRobinCursor
-}
-
-export function resetRoundRobinCursor() {
-  roundRobinCursor = 0
-}
-
 export function getNextRoundRobinAccount(accounts = []) {
   if (!Array.isArray(accounts) || accounts.length === 0) {
     return null

package/lib/updater.js

@@ -1,3 +1,4 @@
+import { getConnection } from './http.js'
 /**
  * Host-side one-click updater for @goodandready/dsh-clinebot.
  * Conforms to the DSH authoring reference implementation.
@@ -27,8 +28,18 @@ function isLoopback(value) {
     || address?.startsWith('::ffff:127.') === true
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
+  const conn = getConnection(targetCtx) || request?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(request)
+    } catch {
+      return false
+    }
+    if (rejection !== undefined) return false
+  }
   if (!isLoopback(request?.socket?.remoteAddress)) return false
   const site = header(request, 'sec-fetch-site')
   if (site !== undefined && site !== 'same-origin') return false
@@ -388,7 +399,7 @@ export function registerPluginUpdater(ctx, options) {
           response.end()
           return
         }
-        if (!isTrustedUpdateRequest(request)) {
+        if (!isTrustedUpdateRequest(request, ctx)) {
           writeResponseJson(response, 403, { ok: false, error: 'Rejected non-local or cross-origin update request.' })
           return
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.22",
+  "version": "0.5.24",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",