@goodandready/dsh-clinebot 0.5.30 → 0.5.32

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.32] - 2026-10-19
+
+### Security
+- **API Key Sanitization in Key Auto-Discovery & Import Flow (Issue #246)**:
+  - Eliminated raw secret key exposure from `GET /dsh-clinebot/keys/discovered`. Discovered keys are now cached exclusively on the server with a 15-minute TTL under an opaque UUID `id`.
+  - Added dedicated server-side import route `POST /dsh-clinebot/keys/discovered/import` that consumes the discovered secret by `id` directly on the server and persists it into DSH Credentials (`saveCredentialKey`) without ever passing secret tokens through client memory, devtools, or network logs.
+  - Updated client settings UI to import discovered keys strictly by opaque identifier.
+
+## [0.5.31] - 2026-10-18
+
+### Fixed
+- **CI / Host Native Adapter Test (#241)**: Mocked `process.env.CLINEBOT_API_KEY` in `test/settings-service.test.js:638` with guaranteed cleanup, ensuring compatibility with newer `@deepseek-ai/dsh-llm-pi-ai` adapter authentication requirements.
+- **DSH Design Token Compliance (#242)**: Replaced hardcoded `#888` fallback with `var(--dsw-alias-label-secondary)` and `rgba(0,0,0,0.15)` with `var(--dsw-elevation-prominent)` in composer cost dock and accounts section.
+- **Design Contract Synchronization (#243)**: Updated `docs/design/DESIGN.md` with specifications for `DashboardDialog` modal, `settings.section`, native web search `ClineBotSearchProvider`, and multimodal KV-cache prompt budgeting.
+- **Repository Hygiene (#244)**: Pruned obsolete `.tgz` release archives from repository root.
+
 ## [0.5.30] - 2026-10-18
 
 ### Added

package/lib/client.js

@@ -1019,9 +1019,9 @@ function AccountsSection({
       await handleAddAccount({
         label: item.source || targetEnv,
         apiKeyEnv: targetEnv,
-        apiKey: item.key,
+        id: item.id,
       })
-      setDiscoveredKeys((prev) => prev.filter((k) => k.key !== item.key))
+      setDiscoveredKeys((prev) => prev.filter((k) => k.id !== item.id))
     }
   }
 
@@ -1119,7 +1119,7 @@ function AccountsSection({
           gap: '8px',
           margin: '8px 0 12px 0',
           fontSize: '12px',
-          color: 'var(--dsw-alias-label-secondary, #888)',
+          color: 'var(--dsw-alias-label-secondary)',
         },
       },
       React.createElement('span', { style: { fontWeight: 500 } }, t('accounts.mode_label') + ':'),
@@ -3208,7 +3208,7 @@ function ComposerCostDock(props) {
               background: 'var(--dsw-alias-bg-layer-3)',
               border: '1px solid var(--dsw-alias-border-l2)',
               borderRadius: '8px',
-              boxShadow: '0 4px 12px rgba(0,0,0,0.15)',
+              boxShadow: 'var(--dsw-elevation-prominent)',
               zIndex: 100,
               fontSize: '12px',
               color: 'var(--dsw-alias-label-primary)',
@@ -3510,11 +3510,13 @@ function SettingsPage(props) {
     })
   }
 
-  async function handleAddAccount({ label, apiKeyEnv, apiKey }) {
+  async function handleAddAccount({ label, apiKeyEnv, apiKey, id }) {
     await performAction('add-account', async () => {
-      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/accounts`, {
+      const endpoint = id ? `${ROUTE_PREFIX}/keys/discovered/import` : `${ROUTE_PREFIX}/accounts`
+      const payload = id ? { id, label, apiKeyEnv } : { label, apiKeyEnv, apiKey }
+      const res = await fetchWithTimeout(endpoint, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ label, apiKeyEnv, apiKey }),
+        body: JSON.stringify(payload),
       })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)

package/lib/key-discovery.js

@@ -1,10 +1,44 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
+import crypto from 'node:crypto'
 
 const CLINE_KEY_REGEX = /cline_[A-Za-z0-9_\-]{16,}/g
+const DISCOVERY_CACHE_TTL_MS = 15 * 60 * 1000 // 15 minutes TTL
 
-function maskApiKey(key) {
+// Server-side cache for discovered keys: id -> { id, key, source, maskedKey, path, expiresAt }
+const discoveredKeysCache = new Map()
+
+function cleanupExpired() {
+  const now = Date.now()
+  for (const [id, item] of discoveredKeysCache.entries()) {
+    if (item.expiresAt && item.expiresAt <= now) {
+      discoveredKeysCache.delete(id)
+    }
+  }
+}
+
+export function getDiscoveredKey(id) {
+  if (!id || typeof id !== 'string') return null
+  cleanupExpired()
+  const item = discoveredKeysCache.get(id)
+  return item?.key || null
+}
+
+export function consumeDiscoveredKey(id) {
+  if (!id || typeof id !== 'string') return null
+  cleanupExpired()
+  const item = discoveredKeysCache.get(id)
+  if (!item) return null
+  discoveredKeysCache.delete(id)
+  return item.key
+}
+
+export function clearDiscoveredKeysCache() {
+  discoveredKeysCache.clear()
+}
+
+export function maskApiKey(key) {
   if (!key || typeof key !== 'string') return ''
   if (key.length <= 12) return '••••••••'
   return key.slice(0, 8) + '••••' + key.slice(-4)
@@ -35,13 +69,41 @@ function scanFileForKeys(filePath, sourceName) {
 }
 
 export function discoverLocalClineKeys() {
+  cleanupExpired()
   const discovered = []
   const seenKeys = new Set()
 
   const addKey = (item) => {
     if (!item?.key || seenKeys.has(item.key)) return
     seenKeys.add(item.key)
-    discovered.push(item)
+
+    // Reuse existing ID if already cached
+    let existingId = null
+    for (const [id, cached] of discoveredKeysCache.entries()) {
+      if (cached.key === item.key) {
+        existingId = id
+        cached.expiresAt = Date.now() + DISCOVERY_CACHE_TTL_MS
+        break
+      }
+    }
+
+    const id = existingId || crypto.randomUUID()
+    discoveredKeysCache.set(id, {
+      id,
+      key: item.key,
+      source: item.source,
+      maskedKey: item.maskedKey,
+      path: item.path,
+      expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS,
+    })
+
+    // Public view: NEVER expose the raw secret key (#246)
+    discovered.push({
+      id,
+      source: item.source,
+      maskedKey: item.maskedKey,
+      path: item.path,
+    })
   }
 
   // 1. Check environment variables
@@ -106,4 +168,4 @@ export function discoverLocalClineKeys() {
   } catch {}
 
   return discovered
-}
+}

package/lib/proxy-token.js

@@ -14,9 +14,9 @@ export const LOCAL_PROXY_KEY_ENV = 'CLINEBOT_LOCAL_PROXY_TOKEN'
 let cachedToken = null
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.30'
+let packageVersion = '0.5.32'
 try {
-  packageVersion = require('../package.json').version || '0.5.30'
+  packageVersion = require('../package.json').version || '0.5.32'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }

package/lib/routes/accounts.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { discoverLocalClineKeys } from '../key-discovery.js'
+import { discoverLocalClineKeys, consumeDiscoveredKey } from '../key-discovery.js'
 import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, plainConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
@@ -12,10 +12,81 @@ import {
   DEFAULT_API_KEY_ENV,
 } from '../cline-client.js'
 
-const pendingSecretCleanupAccounts = new Set()
+export function registerAccountsRoutes(ctx, { live, syncProviderState, getSettingsApi }) {
+  const pendingSecretCleanupAccounts = new Set()
 
-export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
-  // POST /dsh-clinebot/accounts — add or update account in pool
+  async function addAccountInternal({ apiKey, label, apiKeyEnv }) {
+    const curr = plainConfig(live())
+    const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
+
+    let targetEnv = String(apiKeyEnv || '').trim()
+    if (!targetEnv) {
+      let maxN = 1
+      for (const acc of existingAccounts) {
+        const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
+        if (m) {
+          const num = parseInt(m[1], 10)
+          if (num >= maxN) maxN = num + 1
+        }
+      }
+      if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
+        const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
+        if (m) {
+          const num = parseInt(m[1], 10)
+          if (num >= maxN) maxN = num + 1
+        }
+      }
+      targetEnv = `CLINEBOT_API_KEY_${maxN}`
+    }
+
+    if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
+      const err = new Error(`Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`)
+      err.status = 400
+      throw err
+    }
+
+    const accountLabel = String(label || '').trim() || targetEnv
+
+    await saveCredentialKey(ctx, targetEnv, apiKey)
+
+    const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
+    const accountEntry = { label: accountLabel, apiKeyEnv: targetEnv }
+    if (idx >= 0) {
+      existingAccounts[idx] = accountEntry
+    } else {
+      existingAccounts.push(accountEntry)
+    }
+
+    const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
+    const settingsApi = getSettingsApi()
+    await settingsApi.replace(next)
+    await syncProviderState(next)
+
+    let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
+    try {
+      const parsed = new URL(curr.baseUrl)
+      if (parsed.protocol === 'https:') {
+        validation = await smokeChat(curr.baseUrl, apiKey, {
+          model: curr.defaultModel,
+          timeoutMs: 15000,
+        })
+      }
+    } catch {
+      validation = { ok: false, error: 'Invalid baseUrl' }
+    }
+
+    clearUsageCache()
+    clearProbeCache()
+
+    return {
+      account: accountEntry,
+      validated: validation.ok,
+      latencyMs: validation.latencyMs,
+      validationError: validation.ok ? null : validation.error,
+    }
+  }
+
+  // POST /dsh-clinebot/accounts — add account endpoint (supports DELETE for backward compat)
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-clinebot/accounts',
@@ -39,77 +110,15 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 400, { ok: false, error: 'API key is required' })
         }
 
-        const curr = plainConfig(live())
-        const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
-
-        let targetEnv = String(body.apiKeyEnv || '').trim()
-        if (!targetEnv) {
-          let maxN = 1
-          for (const acc of existingAccounts) {
-            const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
-            if (m) {
-              const num = parseInt(m[1], 10)
-              if (num >= maxN) maxN = num + 1
-            }
-          }
-          if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
-            const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
-            if (m) {
-              const num = parseInt(m[1], 10)
-              if (num >= maxN) maxN = num + 1
-            }
-          }
-          targetEnv = `CLINEBOT_API_KEY_${maxN}`
-        }
-
-        if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
-          return writeJson(res, 400, {
-            ok: false,
-            error: `Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`,
-          })
-        }
-
-        const label = String(body.label || '').trim() || targetEnv
-
-        await saveCredentialKey(ctx, targetEnv, apiKey)
-
-        const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
-        const accountEntry = { label, apiKeyEnv: targetEnv }
-        if (idx >= 0) {
-          existingAccounts[idx] = accountEntry
-        } else {
-          existingAccounts.push(accountEntry)
-        }
-
-        const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
-        await settingsApi.replace(next)
-        await syncProviderState(next)
-
-        let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
-        try {
-          const parsed = new URL(curr.baseUrl)
-          if (parsed.protocol === 'https:') {
-            validation = await smokeChat(curr.baseUrl, apiKey, {
-              model: curr.defaultModel,
-              timeoutMs: 15000,
-            })
-          }
-        } catch {
-          validation = { ok: false, error: 'Invalid baseUrl' }
-        }
-
-        clearUsageCache()
-        clearProbeCache()
-
-        writeJson(res, 200, {
-          ok: true,
-          account: accountEntry,
-          validated: validation.ok,
-          latencyMs: validation.latencyMs,
-          validationError: validation.ok ? null : validation.error,
+        const result = await addAccountInternal({
+          apiKey,
+          label: body.label,
+          apiKeyEnv: body.apiKeyEnv,
         })
+        writeJson(res, 200, { ok: true, ...result })
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+        const status = typeof err?.status === 'number' ? err.status : 500
+        writeJson(res, status, { ok: false, error: String(err?.message || err) })
       }
     },
   }), 'dsh-clinebot: /accounts')
@@ -338,7 +347,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     },
   }), 'dsh-clinebot: /unregister')
 
-  // GET /dsh-clinebot/keys/discovered — scan local Cline CLI and VS Code extension keys (#232)
+  // GET /dsh-clinebot/keys/discovered — scan local Cline CLI and VS Code extension keys (#232, #246)
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-clinebot/keys/discovered',
@@ -353,4 +362,43 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
       }
     },
   }), 'dsh-clinebot: /keys/discovered')
-}
+
+  // POST /dsh-clinebot/keys/discovered/import — safely import discovered key without exposing secret (#246)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/keys/discovered/import',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
+      const settingsApi = getSettingsApi()
+      if (!settingsApi || typeof settingsApi.replace !== 'function') {
+        return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+      }
+      try {
+        const bodyBuf = await readBody(req)
+        let body = {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
+
+        const id = String(body.id || '').trim()
+        if (!id) {
+          return writeJson(res, 400, { ok: false, error: 'Discovered key id is required' })
+        }
+
+        const apiKey = consumeDiscoveredKey(id)
+        if (!apiKey) {
+          return writeJson(res, 404, { ok: false, error: 'Discovered key not found or expired' })
+        }
+
+        const result = await addAccountInternal({
+          apiKey,
+          label: body.label,
+          apiKeyEnv: body.apiKeyEnv,
+        })
+        writeJson(res, 200, { ok: true, ...result })
+      } catch (err) {
+        const status = typeof err?.status === 'number' ? err.status : 500
+        writeJson(res, status, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /keys/discovered/import')
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.30",
+  "version": "0.5.32",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",