@goodandready/dsh-clinebot 0.5.31 → 0.5.33

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.33] - 2026-10-19
+
+### Security
+- **Proxy Token Isolation from Environment & Child Processes (Issue #247)**:
+  - Local proxy bearer authentication token (`CLINEBOT_LOCAL_PROXY_TOKEN`) is now retained strictly in module-private memory and never exported to `process.env`.
+  - Added startup and mutation scrubbing to ensure `process.env[CLINEBOT_LOCAL_PROXY_TOKEN]` is deleted immediately.
+  - Sanitized child process spawn environment in `lib/updater.js` to ensure the token cannot be inherited by sub-processes.
+  - Enforced unified DSH connection authorization gate (`connection.requestRejection`) across `/dsh-clinebot/v1/chat/completions` and `/dsh-clinebot/v1/models` endpoints.
+
+## [0.5.32] - 2026-10-19
+
+### Security
+- **API Key Sanitization in Key Auto-Discovery & Import Flow (Issue #246)**:
+  - Eliminated raw secret key exposure from `GET /dsh-clinebot/keys/discovered`. Discovered keys are now cached exclusively on the server with a 15-minute TTL under an opaque UUID `id`.
+  - Added dedicated server-side import route `POST /dsh-clinebot/keys/discovered/import` that consumes the discovered secret by `id` directly on the server and persists it into DSH Credentials (`saveCredentialKey`) without ever passing secret tokens through client memory, devtools, or network logs.
+  - Updated client settings UI to import discovered keys strictly by opaque identifier.
+
 ## [0.5.31] - 2026-10-18
 
 ### Fixed

package/lib/client.js

@@ -1019,9 +1019,9 @@ function AccountsSection({
       await handleAddAccount({
         label: item.source || targetEnv,
         apiKeyEnv: targetEnv,
-        apiKey: item.key,
+        id: item.id,
       })
-      setDiscoveredKeys((prev) => prev.filter((k) => k.key !== item.key))
+      setDiscoveredKeys((prev) => prev.filter((k) => k.id !== item.id))
     }
   }
 
@@ -3510,11 +3510,13 @@ function SettingsPage(props) {
     })
   }
 
-  async function handleAddAccount({ label, apiKeyEnv, apiKey }) {
+  async function handleAddAccount({ label, apiKeyEnv, apiKey, id }) {
     await performAction('add-account', async () => {
-      const res = await fetchWithTimeout(`${ROUTE_PREFIX}/accounts`, {
+      const endpoint = id ? `${ROUTE_PREFIX}/keys/discovered/import` : `${ROUTE_PREFIX}/accounts`
+      const payload = id ? { id, label, apiKeyEnv } : { label, apiKeyEnv, apiKey }
+      const res = await fetchWithTimeout(endpoint, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ label, apiKeyEnv, apiKey }),
+        body: JSON.stringify(payload),
       })
       const data = await res.json().catch(() => ({}))
       if (!res.ok || !data.ok) throw new Error(data.error || `HTTP ${res.status}`)

package/lib/key-discovery.js

@@ -1,10 +1,44 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import os from 'node:os'
+import crypto from 'node:crypto'
 
 const CLINE_KEY_REGEX = /cline_[A-Za-z0-9_\-]{16,}/g
+const DISCOVERY_CACHE_TTL_MS = 15 * 60 * 1000 // 15 minutes TTL
 
-function maskApiKey(key) {
+// Server-side cache for discovered keys: id -> { id, key, source, maskedKey, path, expiresAt }
+const discoveredKeysCache = new Map()
+
+function cleanupExpired() {
+  const now = Date.now()
+  for (const [id, item] of discoveredKeysCache.entries()) {
+    if (item.expiresAt && item.expiresAt <= now) {
+      discoveredKeysCache.delete(id)
+    }
+  }
+}
+
+export function getDiscoveredKey(id) {
+  if (!id || typeof id !== 'string') return null
+  cleanupExpired()
+  const item = discoveredKeysCache.get(id)
+  return item?.key || null
+}
+
+export function consumeDiscoveredKey(id) {
+  if (!id || typeof id !== 'string') return null
+  cleanupExpired()
+  const item = discoveredKeysCache.get(id)
+  if (!item) return null
+  discoveredKeysCache.delete(id)
+  return item.key
+}
+
+export function clearDiscoveredKeysCache() {
+  discoveredKeysCache.clear()
+}
+
+export function maskApiKey(key) {
   if (!key || typeof key !== 'string') return ''
   if (key.length <= 12) return '••••••••'
   return key.slice(0, 8) + '••••' + key.slice(-4)
@@ -35,13 +69,41 @@ function scanFileForKeys(filePath, sourceName) {
 }
 
 export function discoverLocalClineKeys() {
+  cleanupExpired()
   const discovered = []
   const seenKeys = new Set()
 
   const addKey = (item) => {
     if (!item?.key || seenKeys.has(item.key)) return
     seenKeys.add(item.key)
-    discovered.push(item)
+
+    // Reuse existing ID if already cached
+    let existingId = null
+    for (const [id, cached] of discoveredKeysCache.entries()) {
+      if (cached.key === item.key) {
+        existingId = id
+        cached.expiresAt = Date.now() + DISCOVERY_CACHE_TTL_MS
+        break
+      }
+    }
+
+    const id = existingId || crypto.randomUUID()
+    discoveredKeysCache.set(id, {
+      id,
+      key: item.key,
+      source: item.source,
+      maskedKey: item.maskedKey,
+      path: item.path,
+      expiresAt: Date.now() + DISCOVERY_CACHE_TTL_MS,
+    })
+
+    // Public view: NEVER expose the raw secret key (#246)
+    discovered.push({
+      id,
+      source: item.source,
+      maskedKey: item.maskedKey,
+      path: item.path,
+    })
   }
 
   // 1. Check environment variables
@@ -106,4 +168,4 @@ export function discoverLocalClineKeys() {
   } catch {}
 
   return discovered
-}
+}

package/lib/proxy-token.js

@@ -1,22 +1,30 @@
 /**
- * Local Proxy Authentication Token (Issue #145)
+ * Local Proxy Authentication Token (Issues #145, #247)
  *
  * Secures transparent proxy endpoints (/dsh-clinebot/v1/*) from unauthorized
  * LAN clients or cross-site browser requests (CSRF).
+ * Token is stored strictly in-memory and isolated from process.env and child processes (#247).
  */
 
 import crypto from 'node:crypto'
 import { createRequire } from 'node:module'
-import { writeJson } from './http.js'
+import { writeJson, isLoopbackAddress, getConnection } from './http.js'
+import { resolveAccountPool } from './account-pool.js'
 
 export const LOCAL_PROXY_KEY_ENV = 'CLINEBOT_LOCAL_PROXY_TOKEN'
 
 let cachedToken = null
 
+// At module startup, scrub any token from process.env if present (#247)
+if (process.env[LOCAL_PROXY_KEY_ENV]) {
+  cachedToken = process.env[LOCAL_PROXY_KEY_ENV]
+  delete process.env[LOCAL_PROXY_KEY_ENV]
+}
+
 const require = createRequire(import.meta.url)
-let packageVersion = '0.5.31'
+let packageVersion = '0.5.33'
 try {
-  packageVersion = require('../package.json').version || '0.5.31'
+  packageVersion = require('../package.json').version || '0.5.33'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }
@@ -25,6 +33,7 @@ export const USER_AGENT = `@goodandready/dsh-clinebot/${packageVersion}`
 
 /**
  * Get or generate the local proxy bearer token.
+ * Token is stored strictly in module-private memory and never exported to process.env (#247).
  *
  * @returns {string}
  */
@@ -32,25 +41,22 @@ export function getLocalProxyToken() {
   if (cachedToken) return cachedToken
   if (process.env[LOCAL_PROXY_KEY_ENV]) {
     cachedToken = process.env[LOCAL_PROXY_KEY_ENV]
+    delete process.env[LOCAL_PROXY_KEY_ENV]
     return cachedToken
   }
   cachedToken = crypto.randomBytes(24).toString('hex')
-  process.env[LOCAL_PROXY_KEY_ENV] = cachedToken
   return cachedToken
 }
 
 /**
  * Manually set local proxy token (for testing).
+ * Never leaks token to process.env (#247).
  *
  * @param {string|null} token
  */
 export function setLocalProxyToken(token) {
   cachedToken = token
-  if (token) {
-    process.env[LOCAL_PROXY_KEY_ENV] = token
-  } else {
-    delete process.env[LOCAL_PROXY_KEY_ENV]
-  }
+  delete process.env[LOCAL_PROXY_KEY_ENV]
 }
 
 /**
@@ -75,6 +81,48 @@ export function isAuthorizedProxyRequest(req, accountPool = []) {
   return Array.isArray(accountPool) && accountPool.some((acc) => acc.value && acc.value === token)
 }
 
+/**
+ * Unified gate for proxy endpoints (/v1/chat/completions, /v1/models) (#247).
+ * Verifies loopback address, browser origin, DSH connection rejection, and bearer token.
+ */
+export async function assertAuthorizedProxyRequest(ctx, req, res, live) {
+  if (!isLoopbackAddress(req.socket?.remoteAddress)) {
+    writeJson(res, 403, { ok: false, error: 'Loopback access only' })
+    return { ok: false }
+  }
+
+  if (hasDisallowedBrowserOrigin(req)) {
+    writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
+    return { ok: false }
+  }
+
+  const conn = getConnection(ctx) || req?.connectionService
+  if (conn && typeof conn.requestRejection === 'function') {
+    let rejection
+    try {
+      rejection = conn.requestRejection(req)
+    } catch {
+      rejection = 403
+    }
+    if (rejection !== undefined) {
+      const status = typeof rejection === 'number' ? rejection : 403
+      writeJson(res, status, {
+        ok: false,
+        error: status === 401 ? 'Authentication required' : 'Forbidden',
+      })
+      return { ok: false }
+    }
+  }
+
+  const pool = await resolveAccountPool(ctx, typeof live === 'function' ? live() : live)
+  if (!isAuthorizedProxyRequest(req, pool)) {
+    writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
+    return { ok: false }
+  }
+
+  return { ok: true, pool }
+}
+
 /**
  * Write appropriate terminal JSON error response when retries are exhausted.
  */
@@ -119,7 +167,6 @@ export function sendProxyTerminalError(res, { hadTimeout, is429Exhausted, lastEr
   })
 }
 
-
 /**
  * Safely extract standard and reasoning token counts from usage object.
  */
@@ -137,4 +184,4 @@ export function extractUsageMetrics(usage) {
   )
   const totalTokens = Number(usage.total_tokens) || (promptTokens + completionTokens)
   return { promptTokens, completionTokens, reasoningTokens, totalTokens }
-}
+}

package/lib/routes/accounts.js

@@ -1,5 +1,5 @@
 import { writeJson, readBody } from '../http.js'
-import { discoverLocalClineKeys } from '../key-discovery.js'
+import { discoverLocalClineKeys, consumeDiscoveredKey } from '../key-discovery.js'
 import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, plainConfig, Config } from '../config.js'
 import { upsertPiAiProvider, removePiAiProvider } from '../provider-sync.js'
@@ -12,10 +12,81 @@ import {
   DEFAULT_API_KEY_ENV,
 } from '../cline-client.js'
 
-const pendingSecretCleanupAccounts = new Set()
+export function registerAccountsRoutes(ctx, { live, syncProviderState, getSettingsApi }) {
+  const pendingSecretCleanupAccounts = new Set()
 
-export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
-  // POST /dsh-clinebot/accounts — add or update account in pool
+  async function addAccountInternal({ apiKey, label, apiKeyEnv }) {
+    const curr = plainConfig(live())
+    const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
+
+    let targetEnv = String(apiKeyEnv || '').trim()
+    if (!targetEnv) {
+      let maxN = 1
+      for (const acc of existingAccounts) {
+        const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
+        if (m) {
+          const num = parseInt(m[1], 10)
+          if (num >= maxN) maxN = num + 1
+        }
+      }
+      if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
+        const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
+        if (m) {
+          const num = parseInt(m[1], 10)
+          if (num >= maxN) maxN = num + 1
+        }
+      }
+      targetEnv = `CLINEBOT_API_KEY_${maxN}`
+    }
+
+    if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
+      const err = new Error(`Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`)
+      err.status = 400
+      throw err
+    }
+
+    const accountLabel = String(label || '').trim() || targetEnv
+
+    await saveCredentialKey(ctx, targetEnv, apiKey)
+
+    const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
+    const accountEntry = { label: accountLabel, apiKeyEnv: targetEnv }
+    if (idx >= 0) {
+      existingAccounts[idx] = accountEntry
+    } else {
+      existingAccounts.push(accountEntry)
+    }
+
+    const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
+    const settingsApi = getSettingsApi()
+    await settingsApi.replace(next)
+    await syncProviderState(next)
+
+    let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
+    try {
+      const parsed = new URL(curr.baseUrl)
+      if (parsed.protocol === 'https:') {
+        validation = await smokeChat(curr.baseUrl, apiKey, {
+          model: curr.defaultModel,
+          timeoutMs: 15000,
+        })
+      }
+    } catch {
+      validation = { ok: false, error: 'Invalid baseUrl' }
+    }
+
+    clearUsageCache()
+    clearProbeCache()
+
+    return {
+      account: accountEntry,
+      validated: validation.ok,
+      latencyMs: validation.latencyMs,
+      validationError: validation.ok ? null : validation.error,
+    }
+  }
+
+  // POST /dsh-clinebot/accounts — add account endpoint (supports DELETE for backward compat)
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-clinebot/accounts',
@@ -39,77 +110,15 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 400, { ok: false, error: 'API key is required' })
         }
 
-        const curr = plainConfig(live())
-        const existingAccounts = Array.isArray(curr.accounts) ? [...curr.accounts] : []
-
-        let targetEnv = String(body.apiKeyEnv || '').trim()
-        if (!targetEnv) {
-          let maxN = 1
-          for (const acc of existingAccounts) {
-            const m = String(acc?.apiKeyEnv || '').match(/^CLINEBOT_API_KEY_(\d+)$/)
-            if (m) {
-              const num = parseInt(m[1], 10)
-              if (num >= maxN) maxN = num + 1
-            }
-          }
-          if (curr.apiKeyEnv && curr.apiKeyEnv.startsWith('CLINEBOT_API_KEY_')) {
-            const m = curr.apiKeyEnv.match(/^CLINEBOT_API_KEY_(\d+)$/)
-            if (m) {
-              const num = parseInt(m[1], 10)
-              if (num >= maxN) maxN = num + 1
-            }
-          }
-          targetEnv = `CLINEBOT_API_KEY_${maxN}`
-        }
-
-        if (!/^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)) {
-          return writeJson(res, 400, {
-            ok: false,
-            error: `Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`,
-          })
-        }
-
-        const label = String(body.label || '').trim() || targetEnv
-
-        await saveCredentialKey(ctx, targetEnv, apiKey)
-
-        const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
-        const accountEntry = { label, apiKeyEnv: targetEnv }
-        if (idx >= 0) {
-          existingAccounts[idx] = accountEntry
-        } else {
-          existingAccounts.push(accountEntry)
-        }
-
-        const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
-        await settingsApi.replace(next)
-        await syncProviderState(next)
-
-        let validation = { ok: false, error: 'Skipped validation: baseUrl is not https' }
-        try {
-          const parsed = new URL(curr.baseUrl)
-          if (parsed.protocol === 'https:') {
-            validation = await smokeChat(curr.baseUrl, apiKey, {
-              model: curr.defaultModel,
-              timeoutMs: 15000,
-            })
-          }
-        } catch {
-          validation = { ok: false, error: 'Invalid baseUrl' }
-        }
-
-        clearUsageCache()
-        clearProbeCache()
-
-        writeJson(res, 200, {
-          ok: true,
-          account: accountEntry,
-          validated: validation.ok,
-          latencyMs: validation.latencyMs,
-          validationError: validation.ok ? null : validation.error,
+        const result = await addAccountInternal({
+          apiKey,
+          label: body.label,
+          apiKeyEnv: body.apiKeyEnv,
         })
+        writeJson(res, 200, { ok: true, ...result })
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+        const status = typeof err?.status === 'number' ? err.status : 500
+        writeJson(res, status, { ok: false, error: String(err?.message || err) })
       }
     },
   }), 'dsh-clinebot: /accounts')
@@ -338,7 +347,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
     },
   }), 'dsh-clinebot: /unregister')
 
-  // GET /dsh-clinebot/keys/discovered — scan local Cline CLI and VS Code extension keys (#232)
+  // GET /dsh-clinebot/keys/discovered — scan local Cline CLI and VS Code extension keys (#232, #246)
   ctx.effect(() => ctx.webServer.register({
     kind: 'exact',
     path: '/dsh-clinebot/keys/discovered',
@@ -353,4 +362,43 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
       }
     },
   }), 'dsh-clinebot: /keys/discovered')
-}
+
+  // POST /dsh-clinebot/keys/discovered/import — safely import discovered key without exposing secret (#246)
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/keys/discovered/import',
+    handler: async (req, res) => {
+      if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' })
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
+      const settingsApi = getSettingsApi()
+      if (!settingsApi || typeof settingsApi.replace !== 'function') {
+        return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
+      }
+      try {
+        const bodyBuf = await readBody(req)
+        let body = {}
+        try { body = JSON.parse(bodyBuf.toString('utf8')) } catch { body = {} }
+
+        const id = String(body.id || '').trim()
+        if (!id) {
+          return writeJson(res, 400, { ok: false, error: 'Discovered key id is required' })
+        }
+
+        const apiKey = consumeDiscoveredKey(id)
+        if (!apiKey) {
+          return writeJson(res, 404, { ok: false, error: 'Discovered key not found or expired' })
+        }
+
+        const result = await addAccountInternal({
+          apiKey,
+          label: body.label,
+          apiKeyEnv: body.apiKeyEnv,
+        })
+        writeJson(res, 200, { ok: true, ...result })
+      } catch (err) {
+        const status = typeof err?.status === 'number' ? err.status : 500
+        writeJson(res, status, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /keys/discovered/import')
+}

package/lib/routes/proxy.js

@@ -15,19 +15,19 @@
  * 7. Streaming SSE token usage interception & persistent telemetry recording.
  */
 
-import { writeJson, readBody, isLoopbackAddress } from '../http.js'
+import { writeJson, readBody } from '../http.js'
 import { publicConfig, plainConfig } from '../config.js'
-import { resolveAccountPool } from '../account-pool.js'
 import { resolveSessionAccount, markAccountCooldown } from '../session-router.js'
 import { recordUsage } from '../stats-storage.js'
 import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 import { optimizePromptCacheAndBudget } from '../multimodal-budget.js'
 import {
   getLocalProxyToken, hasDisallowedBrowserOrigin, isAuthorizedProxyRequest,
+  assertAuthorizedProxyRequest,
   USER_AGENT, sendProxyTerminalError, extractUsageMetrics
 } from '../proxy-token.js'
 
-export { hasDisallowedBrowserOrigin, isAuthorizedProxyRequest, USER_AGENT }
+export { hasDisallowedBrowserOrigin, isAuthorizedProxyRequest, assertAuthorizedProxyRequest, USER_AGENT }
 
 export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncProviderState }) {
   return async (req, res) => {
@@ -35,18 +35,9 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
       return writeJson(res, 405, { ok: false, error: 'POST only' })
     }
 
-    if (!isLoopbackAddress(req.socket?.remoteAddress)) {
-      return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
-    }
-
-    if (hasDisallowedBrowserOrigin(req)) {
-      return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
-    }
-
-    const pool = await resolveAccountPool(ctx, live())
-    if (!isAuthorizedProxyRequest(req, pool)) {
-      return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
-    }
+    const auth = await assertAuthorizedProxyRequest(ctx, req, res, live)
+    if (!auth.ok) return
+    const pool = auth.pool
 
     let bodyBuf
     try {
@@ -543,18 +534,8 @@ export function createModelsHandler(ctx, { live }) {
       return writeJson(res, 405, { ok: false, error: 'GET only' })
     }
 
-    if (!isLoopbackAddress(req.socket?.remoteAddress)) {
-      return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
-    }
-
-    if (hasDisallowedBrowserOrigin(req)) {
-      return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
-    }
-
-    const pool = await resolveAccountPool(ctx, live())
-    if (!isAuthorizedProxyRequest(req, pool)) {
-      return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
-    }
+    const auth = await assertAuthorizedProxyRequest(ctx, req, res, live)
+    if (!auth.ok) return
 
     const pub = publicConfig(live())
     const dynamic = Array.isArray(pub.dynamicModels) ? pub.dynamicModels : []

package/lib/updater.js

@@ -263,7 +263,11 @@ export async function installExact(target, packageSpec, options = {}) {
       cwd: target.profileDir,
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],
-      env: { ...process.env, NO_COLOR: '1' },
+      env: (() => {
+        const childEnv = { ...process.env, NO_COLOR: '1' }
+        delete childEnv.CLINEBOT_LOCAL_PROXY_TOKEN
+        return childEnv
+      })(),
       detached: options.detached !== undefined ? options.detached : process.platform !== 'win32',
     })
     let detail = ''

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",