@goodandready/dsh-clinebot 0.5.23 → 0.5.25

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.25] - 2026-10-16
+
+### Fixed
+- **Subscription Plan Model Synchronization & Default Model Migration (Issue #224, GH #14)**: Updated canonical default model identifier and baseline catalog entry to `cline-pass/deepseek-v4.1-flash` (`DeepSeek V4.1 Flash`), matching upstream ClinePass plan changes. Added automatic silent migration for legacy `cline-pass/deepseek-v4-flash` in `OBSOLETE_MODEL_ID_MAP` and `publicConfig` (`defaultModel`, `disabledModels`, `enabledModels`), eliminating false-positive `Configured default model ... is not available in your active plan` warning banners. Updated `parsePlanIncludedModels` to resolve both legacy and modern plan model feature strings with model deduplication.
+
+## [0.5.24] - 2026-10-13
+
+### Security
+- **Settings & Updater Authentication Boundary (Issue #222)**: Integrated `getConnection(ctx)` and delegated request verification to DSH core service `connection.requestRejection(request)`. When accessed across LAN bridges or reverse-proxies, unauthenticated requests lacking DSH session authentication are rejected with HTTP 401/403 fail-closed, preventing unauthorized credential modification (`/save-key`), account pool manipulation, model toggling, or telemetry resets from LAN clients.
+
 ## [0.5.23] - 2026-10-13
 
 ### Removed

package/README.md

@@ -42,7 +42,7 @@
 
 Integrating ClinePass into DeepSeek Harness (DSH) natively poses key challenges:
 1. **No `/v1/models` Discovery**: `GET /v1/models` on `api.cline.bot` returns `404 Not Found`. Dynamic discovery fails silently or leaves the provider with 0 models.
-2. **Model Identifier Formats**: Models require the specific prefix `cline-pass/` (e.g. `cline-pass/deepseek-v4-flash`, `cline-pass/kimi-k3`).
+2. **Model Identifier Formats**: Models require the specific prefix `cline-pass/` (e.g. `cline-pass/deepseek-v4.1-flash`, `cline-pass/kimi-k3`).
 3. **Quota Tracking**: Rolling 5-hour and weekly limits need clear in-browser visualization.
 4. **Credential Security**: Storing API keys directly in plain settings is insecure.
 
@@ -140,7 +140,7 @@ From any DSH chat session, type `/cline` to inspect quota, warning alerts, and s
 ### 🤖 ClinePass Status (ClinePass)
 * Latency: ✅ 210 ms
 * Active Key: CLINEBOT_API_KEY (credentials)
-* Default Model: `cline-pass/deepseek-v4-flash`
+* Default Model: `cline-pass/deepseek-v4.1-flash`
 
 ⏱ 5-Hour Window: [████░░░░░░] 42% (resets: 18:00)
 📅 Weekly Window: [██████░░░░] 60% (resets: Sep 8)
@@ -186,7 +186,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | Enable or disable the ClineBot provider bridge in DSH |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | ClinePass OpenAI-compatible base URL |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | Environment variable / credentials key name |
-| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | Default selected model ID for chat and smoke tests |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4.1-flash"` | Default selected model ID for chat and smoke tests |
 | `disabledModels` | `array` | `[]` | List of model IDs hidden from the DSH chat picker (new subscription models are auto-enabled) |
 | `customModels` | `array` | `[]` | User-defined gateway models (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | Configured default reasoning effort per model (`low`, `medium`, `high`, `max`) |

package/README.ru.md

@@ -42,7 +42,7 @@
 
 Интеграция ClinePass в DeepSeek Harness (DSH) напрямую сопряжена со следующими сложностями:
 1. **Отсутствие эндпоинта `/v1/models`**: запрос `GET /v1/models` к `api.cline.bot` возвращает `404 Not Found`, из-за чего динамический поиск моделей в DSH падает или оставляет список пустым.
-2. **Специфический формат идентификаторов**: моделям требуется обязательный префикс `cline-pass/` (например, `cline-pass/deepseek-v4-flash`, `cline-pass/kimi-k3`).
+2. **Специфический формат идентификаторов**: моделям требуется обязательный префикс `cline-pass/` (например, `cline-pass/deepseek-v4.1-flash`, `cline-pass/kimi-k3`).
 3. **Отслеживание лимитов**: 5-часовые и недельные скользящие окна расхода токенов требуют прозрачной визуализации в интерфейсе.
 4. **Безопасность ключей**: хранение API-токенов в открытых конфигурациях небезопасно.
 
@@ -137,7 +137,7 @@ dsh plugin --profile web add @goodandready/dsh-clinebot
 ### 🤖 ClinePass Status (ClinePass)
 * Пинг хоста: ✅ 210 мс
 * Активный ключ: CLINEBOT_API_KEY (credentials)
-* Модель по умолчанию: `cline-pass/deepseek-v4-flash`
+* Модель по умолчанию: `cline-pass/deepseek-v4.1-flash`
 
 ⏱ 5-часовое окно: [████░░░░░░] 42% (сброс: 18:00)
 📅 Недельное окно: [██████░░░░] 60% (сброс: 08.09)
@@ -183,7 +183,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | Включение моста провайдера ClineBot в DSH |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | Базовый URL OpenAI-совместимого API ClinePass |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | Имя переменной / ключа в хранилище credentials |
-| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | Модель, выбираемая по умолчанию для чата и smoke-тестов |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4.1-flash"` | Модель, выбираемая по умолчанию для чата и smoke-тестов |
 | `disabledModels` | `array` | `[]` | Список отключённых моделей (новые модели подписки включаются автоматически) |
 | `customModels` | `array` | `[]` | Пользовательские модели шлюза (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | Значения thinking effort по умолчанию для моделей (`low`, `medium`, `high`, `max`) |

package/README.zh.md

@@ -42,7 +42,7 @@
 
 在将 ClinePass 接入 DeepSeek Harness (DSH) 时存在以下挑战：
 1. **缺失 `/v1/models` 接口**：`api.cline.bot` 的 `GET /v1/models` 会直接返回 `404 Not Found`，导致动态模型同步失败或模型列表为空。
-2. **专属模型前缀**：所有模型 ID 均需前缀 `cline-pass/`（如 `cline-pass/deepseek-v4-flash`, `cline-pass/kimi-k3`）。
+2. **专属模型前缀**：所有模型 ID 均需前缀 `cline-pass/`（如 `cline-pass/deepseek-v4.1-flash`, `cline-pass/kimi-k3`）。
 3. **用量额度监控**：5 小时滑动窗口与每周限额需要清晰直观的可视化进度监控。
 4. **安全凭据隔离**：禁止在明文配置中直接填写密钥。
 
@@ -139,7 +139,7 @@ dsh plugin --profile web add @goodandready/dsh-clinebot
 ### 🤖 ClinePass Status (ClinePass)
 * 响应延迟: ✅ 210 ms
 * 活跃密钥: CLINEBOT_API_KEY (credentials)
-* 默认模型: `cline-pass/deepseek-v4-flash`
+* 默认模型: `cline-pass/deepseek-v4.1-flash`
 
 ⏱ 5 小时窗口: [████░░░░░░] 42% (重置时间: 18:00)
 📅 每周窗口:   [██████░░░░] 60% (重置时间: 09月08日)
@@ -185,7 +185,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | 是否在 DSH 中启用 ClineBot 桥接插件 |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | ClinePass OpenAI 兼容接口地址 |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | 凭据管理系统中的密钥名称 |
-| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | 默认选中的模型 ID（用于对话及探活） |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4.1-flash"` | 默认选中的模型 ID（用于对话及探活） |
 | `disabledModels` | `array` | `[]` | 在选择器中隐藏的模型 ID 列表（新订阅模型默认自动启用） |
 | `customModels` | `array` | `[]` | 用户自定义网关模型 (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | 各模型默认思考强度配置 (`low`, `medium`, `high`, `max`) |

package/lib/access.js

@@ -1,9 +1,26 @@
-import { isTrustedSettingsRequest, writeJson } from './http.js'
+import { isTrustedSettingsRequest, getConnection, writeJson } from './http.js'
 
-export { isTrustedSettingsRequest }
+export { isTrustedSettingsRequest, getConnection }
 
-export function assertTrustedSettingsRequest(req, res) {
-  if (!isTrustedSettingsRequest(req)) {
+export function assertTrustedSettingsRequest(req, res, ctx = null) {
+  const conn = getConnection(ctx) || req?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(req)
+    } catch {
+      rejection = 403
+    }
+    if (rejection !== undefined) {
+      writeJson(res, rejection, {
+        ok: false,
+        error: rejection === 401 ? 'Authentication required' : 'Forbidden',
+      })
+      return false
+    }
+  }
+
+  if (!isTrustedSettingsRequest(req, ctx)) {
     writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }

package/lib/config.js

@@ -11,6 +11,7 @@ import {
   DEFAULT_MODEL_ID,
   getAllModels,
   getActiveModelIds,
+  migrateModelId,
 } from './models.js'
 
 // DSH settings.describe only publishes fields marked volatile. Without them the
@@ -137,9 +138,9 @@ export function publicConfig(cfg) {
   const allModels = getAllModels(dynamic, modelContextOverrides, custom)
   const allDefaultIds = allModels.map((m) => m.id)
 
-  let disabledList = Array.isArray(cfg?.disabledModels) ? cfg.disabledModels : []
+  let disabledList = Array.isArray(cfg?.disabledModels) ? cfg.disabledModels.map(migrateModelId) : []
   if (cfg?.disabledModels === undefined && Array.isArray(cfg?.enabledModels) && cfg.enabledModels.length > 0) {
-    const enabledSet = new Set(cfg.enabledModels)
+    const enabledSet = new Set(cfg.enabledModels.map(migrateModelId))
     disabledList = allDefaultIds.filter((id) => !enabledSet.has(id))
   }
 
@@ -148,7 +149,7 @@ export function publicConfig(cfg) {
     activeIds = [allDefaultIds[0]]
   }
 
-  let defaultModel = cfg?.defaultModel || DEFAULT_MODEL_ID
+  let defaultModel = migrateModelId(cfg?.defaultModel || DEFAULT_MODEL_ID)
   let defaultModelWarning = null
 
   if (allDefaultIds.length > 0 && !allDefaultIds.includes(defaultModel)) {

package/lib/http.js

@@ -53,8 +53,34 @@ export function isLoopbackAddress(value) {
     || address.startsWith('::ffff:127.')
 }
 
-/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
-export function isTrustedSettingsRequest(request) {
+export function getConnection(ctx) {
+  try {
+    const fromCtx = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx || {}, 'connection'))
+    if (fromCtx) return fromCtx
+    if (ctx?.root) {
+      return getConnection(ctx.root)
+    }
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** Reject unauthenticated LAN/remote writes while allowing admitted DSH and local requests (#222). */
+export function isTrustedSettingsRequest(request, ctx = null) {
+  // 1. Core DSH connection auth gate (#222)
+  const conn = getConnection(ctx) || request?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(request)
+    } catch {
+      return false
+    }
+    if (rejection !== undefined) return false
+  }
   const secFetchSite = header(request, 'sec-fetch-site')
   if (secFetchSite === 'cross-site') {
     return false

package/lib/models.js

@@ -13,6 +13,7 @@
 export const PROVIDER_ID = 'clinebot'
 
 export const OBSOLETE_MODEL_ID_MAP = Object.freeze({
+  'cline-pass/deepseek-v4-flash': 'cline-pass/deepseek-v4.1-flash',
   'cline-pass/deepseek-v41-flash': 'cline-pass/deepseek-v4.1-flash',
   'cline-pass/qwen38-max': 'cline-pass/qwen3.8-max',
   'cline-pass/glm-53': 'cline-pass/glm-5.3',
@@ -20,7 +21,7 @@ export const OBSOLETE_MODEL_ID_MAP = Object.freeze({
   'cline-pass/muse-spark-13-contributor': 'cline-pass/muse-spark-1.3-contributor',
 })
 
-function migrateModelId(id) {
+export function migrateModelId(id) {
   if (typeof id !== 'string') return id
   return OBSOLETE_MODEL_ID_MAP[id] || id
 }
@@ -35,7 +36,7 @@ export function migrateModelEntry(model) {
   }
 }
 export const PROVIDER_DISPLAY_NAME = 'ClineBot (ClinePass)'
-export const DEFAULT_MODEL_ID = 'cline-pass/deepseek-v4-flash'
+export const DEFAULT_MODEL_ID = 'cline-pass/deepseek-v4.1-flash'
 
 /**
  * Authentic original model specifications from original creators:
@@ -104,8 +105,8 @@ function createCuratedModel({
 
 export const CLINE_MODELS = Object.freeze([
   createCuratedModel({
-    id: 'cline-pass/deepseek-v4-flash',
-    name: 'DeepSeek V4 Flash',
+    id: 'cline-pass/deepseek-v4.1-flash',
+    name: 'DeepSeek V4.1 Flash',
     description: 'High-speed reasoning & code completion model optimized for agentic loops.',
     ctx: 128000, maxTokens: 8192, input: ['text', 'image'], category: 'coding', recommended: true,
     reasoningEfforts: ['low', 'medium', 'high'],
@@ -216,32 +217,38 @@ export function parsePlanIncludedModels(includedInput) {
       .replace(/[\s._-]+/g, '')
 
   const matched = []
+  const seenIds = new Set()
   for (const name of parts) {
     const targetNorm = normalize(name)
+    const idPart = name
+      .toLowerCase()
+      .trim()
+      .replace(/^cline-pass\//, '')
+      .replace(/qwen\s+([0-9])/i, 'qwen$1')
+      .replace(/glm\s+([0-9])/i, 'glm-$1')
+      .replace(/[\s_]+/g, '-')
+      .replace(/-+/g, '-')
+    const candidateId = migrateModelId(`cline-pass/${idPart}`)
     const found = CLINE_MODELS.find(
       (m) =>
+        m.id === candidateId ||
         normalize(m.name) === targetNorm ||
         normalize(m.id.replace(/^cline-pass\//, '')) === targetNorm
     )
     if (found) {
-      matched.push(found)
+      if (!seenIds.has(found.id)) {
+        seenIds.add(found.id)
+        matched.push(found)
+      }
     } else {
       // Dynamic fallback for newly introduced models mentioned in plan
-      const idPart = name
-        .toLowerCase()
-        .trim()
-        .replace(/^cline-pass\//, '')
-        .replace(/qwen\s+([0-9])/i, 'qwen$1')
-        .replace(/glm\s+([0-9])/i, 'glm-$1')
-        .replace(/[\s_]+/g, '-')
-        .replace(/-+/g, '-')
       const isVision = /(vision|vl|multimodal|omni|image)/i.test(name)
       const hasReasoning = /(reason|think|r1|pro|flash|max|plus|k3|m3|glm|qwen|mimo)/i.test(name)
       const origCtx = getOriginalModelContext(name)
       const origMax = getOriginalModelMaxTokens(name)
       const origProv = getOriginalModelProvider(name)
-      matched.push({
-        id: `cline-pass/${idPart}`,
+      const dynamicModel = migrateModelEntry({
+        id: candidateId,
         name,
         description: `Official ClinePass subscription model: ${name}`,
         clineContextLength: 200000,
@@ -258,6 +265,10 @@ export function parsePlanIncludedModels(includedInput) {
         isCustom: false,
         ...(hasReasoning ? { reasoningEfforts: ['low', 'medium', 'high', 'max'] } : {}),
       })
+      if (!seenIds.has(dynamicModel.id)) {
+        seenIds.add(dynamicModel.id)
+        matched.push(dynamicModel)
+      }
     }
   }
 

package/lib/proxy-token.js

@@ -14,9 +14,9 @@ export const LOCAL_PROXY_KEY_ENV = 'CLINEBOT_LOCAL_PROXY_TOKEN'
 let cachedToken = null
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.23'
+let packageVersion = '0.5.25'
 try {
-  packageVersion = require('../package.json').version || '0.5.23'
+  packageVersion = require('../package.json').version || '0.5.25'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }

package/lib/routes/accounts.js

@@ -23,7 +23,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
         return handleDeleteAccount(req, res)
       }
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST or DELETE only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       const settingsApi = getSettingsApi()
       if (!settingsApi || typeof settingsApi.replace !== 'function') {
         return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
@@ -114,7 +114,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
   }), 'dsh-clinebot: /accounts')
 
   async function handleDeleteAccount(req, res, targetEnvFromUrl = '') {
-    if (!assertTrustedSettingsRequest(req, res)) return
+    if (!assertTrustedSettingsRequest(req, res, ctx)) return
     const settingsApi = getSettingsApi()
     if (!settingsApi || typeof settingsApi.replace !== 'function') {
       return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
@@ -271,7 +271,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/accounts/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -307,7 +307,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/register',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -327,7 +327,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/unregister',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         await removePiAiProvider(ctx)
         writeJson(res, 200, { ok: true })

package/lib/routes/auth.js

@@ -16,7 +16,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     kind: 'exact',
     path: '/dsh-clinebot/key/verify',
     handler: async (req, res) => {
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
       try {
         const bodyBuf = await readBody(req)
@@ -96,7 +96,7 @@ export function registerAuthRoutes(ctx, { live, getSettingsApi, syncProviderStat
     path: '/dsh-clinebot/smoke',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/models.js

@@ -12,7 +12,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     kind: 'exact',
     path: '/dsh-clinebot/models/sync',
     handler: async (req, res) => {
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       if (req.method !== 'POST') {
         return writeJson(res, 405, { ok: false, error: 'POST only' })
       }
@@ -76,7 +76,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -113,7 +113,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/context',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -223,7 +223,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/usage',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
         const activeKey = await resolveActiveAccountKey(ctx, live())
@@ -247,7 +247,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
     path: '/dsh-clinebot/models/probe',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}

package/lib/routes/settings.js

@@ -12,7 +12,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const st = await buildStatus(ctx, live())
         writeJson(res, 200, st)
@@ -28,13 +28,13 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/config',
     handler: async (req, res) => {
       if (req.method === 'GET') {
-        if (!assertTrustedSettingsRequest(req, res)) return
+        if (!assertTrustedSettingsRequest(req, res, ctx)) return
         return writeJson(res, 200, { ok: true, config: publicConfig(live()) })
       }
       if (req.method !== 'PUT') {
         return writeJson(res, 405, { ok: false, error: 'GET or PUT' })
       }
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       const settingsApi = getSettingsApi()
       if (!settingsApi) {
         return writeJson(res, 503, { ok: false, error: 'settings not ready' })
@@ -116,7 +116,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/save-key',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const bodyBuf = await readBody(req)
         let body = {}
@@ -186,7 +186,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const stats = getStatsSummary()
         writeJson(res, 200, { ok: true, stats })
@@ -202,7 +202,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats/reset',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
         const stats = resetStats(pub.statsPath)
@@ -219,7 +219,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
     path: '/dsh-clinebot/stats/export',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
-      if (!assertTrustedSettingsRequest(req, res)) return
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const csv = exportStatsAsCsv()
         res.statusCode = 200

package/lib/updater.js

@@ -1,3 +1,4 @@
+import { getConnection } from './http.js'
 /**
  * Host-side one-click updater for @goodandready/dsh-clinebot.
  * Conforms to the DSH authoring reference implementation.
@@ -27,8 +28,18 @@ function isLoopback(value) {
     || address?.startsWith('::ffff:127.') === true
 }
 
-export function isTrustedUpdateRequest(request) {
+export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
+  const conn = getConnection(targetCtx) || request?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(request)
+    } catch {
+      return false
+    }
+    if (rejection !== undefined) return false
+  }
   if (!isLoopback(request?.socket?.remoteAddress)) return false
   const site = header(request, 'sec-fetch-site')
   if (site !== undefined && site !== 'same-origin') return false
@@ -388,7 +399,7 @@ export function registerPluginUpdater(ctx, options) {
           response.end()
           return
         }
-        if (!isTrustedUpdateRequest(request)) {
+        if (!isTrustedUpdateRequest(request, ctx)) {
           writeResponseJson(response, 403, { ok: false, error: 'Rejected non-local or cross-origin update request.' })
           return
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.23",
+  "version": "0.5.25",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",