@goodandready/dsh-clinebot 0.5.32 → 0.6.0

package/lib/routes/models.js

@@ -234,7 +234,8 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           timeoutMs: pub.timeoutMs,
           bypassCache: true,
         })
-        writeJson(res, usageData.ok ? 200 : 502, publicUsage(usageData))
+        const accountLabel = activeKey.label || activeKey.apiKeyEnv || activeKey.id || ''
+        writeJson(res, usageData.ok ? 200 : 502, { ...(publicUsage(usageData) || {}), account: accountLabel })
       } catch (err) {
         writeJson(res, 500, { ok: false, error: String(err?.message || err) })
       }

package/lib/routes/proxy.js

@@ -15,19 +15,19 @@
  * 7. Streaming SSE token usage interception & persistent telemetry recording.
  */
 
-import { writeJson, readBody, isLoopbackAddress } from '../http.js'
+import { writeJson, readBody } from '../http.js'
 import { publicConfig, plainConfig } from '../config.js'
-import { resolveAccountPool } from '../account-pool.js'
 import { resolveSessionAccount, markAccountCooldown } from '../session-router.js'
 import { recordUsage } from '../stats-storage.js'
 import { getAllModels, DEFAULT_MODEL_ID } from '../models.js'
 import { optimizePromptCacheAndBudget } from '../multimodal-budget.js'
 import {
   getLocalProxyToken, hasDisallowedBrowserOrigin, isAuthorizedProxyRequest,
+  assertAuthorizedProxyRequest,
   USER_AGENT, sendProxyTerminalError, extractUsageMetrics
 } from '../proxy-token.js'
 
-export { hasDisallowedBrowserOrigin, isAuthorizedProxyRequest, USER_AGENT }
+export { hasDisallowedBrowserOrigin, isAuthorizedProxyRequest, assertAuthorizedProxyRequest, USER_AGENT }
 
 export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncProviderState }) {
   return async (req, res) => {
@@ -35,18 +35,9 @@ export function createChatCompletionsHandler(ctx, { live, getSettingsApi, syncPr
       return writeJson(res, 405, { ok: false, error: 'POST only' })
     }
 
-    if (!isLoopbackAddress(req.socket?.remoteAddress)) {
-      return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
-    }
-
-    if (hasDisallowedBrowserOrigin(req)) {
-      return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
-    }
-
-    const pool = await resolveAccountPool(ctx, live())
-    if (!isAuthorizedProxyRequest(req, pool)) {
-      return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
-    }
+    const auth = await assertAuthorizedProxyRequest(ctx, req, res, live)
+    if (!auth.ok) return
+    const pool = auth.pool
 
     let bodyBuf
     try {
@@ -543,18 +534,8 @@ export function createModelsHandler(ctx, { live }) {
       return writeJson(res, 405, { ok: false, error: 'GET only' })
     }
 
-    if (!isLoopbackAddress(req.socket?.remoteAddress)) {
-      return writeJson(res, 403, { ok: false, error: 'Loopback access only' })
-    }
-
-    if (hasDisallowedBrowserOrigin(req)) {
-      return writeJson(res, 403, { ok: false, error: 'Cross-site or browser requests to proxy are forbidden' })
-    }
-
-    const pool = await resolveAccountPool(ctx, live())
-    if (!isAuthorizedProxyRequest(req, pool)) {
-      return writeJson(res, 401, { ok: false, error: 'Unauthorized: missing or invalid bearer token' })
-    }
+    const auth = await assertAuthorizedProxyRequest(ctx, req, res, live)
+    if (!auth.ok) return
 
     const pub = publicConfig(live())
     const dynamic = Array.isArray(pub.dynamicModels) ? pub.dynamicModels : []

package/lib/routes/settings.js

@@ -3,7 +3,8 @@ import { assertTrustedSettingsRequest } from '../access.js'
 import { publicConfig, plainConfig, Config } from '../config.js'
 import { buildStatus } from '../provider-sync.js'
 import { saveCredentialKey, smokeChat, DEFAULT_API_KEY_ENV } from '../cline-client.js'
-import { getStatsSummary, resetStats, exportStatsAsCsv } from '../stats-storage.js'
+import { getStatsSummary, resetStats, exportStatsAsCsv, getAnalytics } from '../stats-storage.js'
+import { priceTable } from '../model-prices.js'
 
 export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProviderState, triggerAutoDiscover }) {
   // 1. GET /dsh-clinebot/status
@@ -221,7 +222,13 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
       if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
-        const csv = exportStatsAsCsv()
+        let detailed = false
+        try {
+          detailed = new URL(req.url, 'http://127.0.0.1').searchParams.get('detailed') === '1'
+        } catch {
+          detailed = false
+        }
+        const csv = exportStatsAsCsv(detailed)
         res.statusCode = 200
         res.setHeader('Content-Type', 'text/csv; charset=utf-8')
         res.setHeader('Content-Disposition', 'attachment; filename="clinebot-stats.csv"')
@@ -231,4 +238,58 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
       }
     },
   }), 'dsh-clinebot: /stats/export')
+
+  // 7. GET /dsh-clinebot/analytics — aggregated session/day/model/account report
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/analytics',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
+      try {
+        let query = {}
+        try {
+          query = Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries())
+        } catch {}
+        const parseTime = (value) => {
+          if (value === undefined || value === '') return undefined
+          const numeric = Number(value)
+          return Number.isFinite(numeric) ? numeric : Date.parse(value)
+        }
+        const analytics = getAnalytics({
+          from: parseTime(query.from),
+          to: parseTime(query.to),
+          groupBy: query.groupBy,
+          limit: query.limit,
+          model: query.model,
+          account: query.account,
+          heatmapDays: query.heatmapDays,
+          heatmapModel: query.heatmapModel,
+        })
+        writeJson(res, 200, { ok: true, ...analytics })
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /analytics')
+
+  // 8. GET /dsh-clinebot/prices — local cost-estimate table
+  ctx.effect(() => ctx.webServer.register({
+    kind: 'exact',
+    path: '/dsh-clinebot/prices',
+    handler: async (req, res) => {
+      if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' })
+      if (!assertTrustedSettingsRequest(req, res, ctx)) return
+      try {
+        const pub = publicConfig(live())
+        writeJson(res, 200, {
+          ok: true,
+          ...priceTable(pub.priceOverrides || {}, pub.enabledModels || []),
+          updatedAt: new Date().toISOString(),
+        })
+      } catch (err) {
+        writeJson(res, 500, { ok: false, error: String(err?.message || err) })
+      }
+    },
+  }), 'dsh-clinebot: /prices')
 }

package/lib/services.js

@@ -0,0 +1,55 @@
+/**
+ * Optional-service helpers and one-time legacy lifecycle migration.
+ *
+ * The plugin no longer hard-injects `webServer`/`credentials`, so every read
+ * must survive Cordis's strict-proxy guard and a headless profile that mounts
+ * neither service.
+ */
+
+import { LLM_PI_AI_NS } from './config.js'
+import { deleteCredentialKey } from './credential-refs.js'
+
+/**
+ * Read an optional service without tripping Cordis's strict-proxy guard.
+ * @param {object | undefined} ctx
+ * @param {string} name
+ * @returns {unknown}
+ */
+export function service(ctx, name) {
+  try {
+    const viaGet = typeof ctx?.get === 'function' ? ctx.get(name) : undefined
+    if (viaGet) return viaGet
+  } catch {
+    /* strict context refuses get() for a service the fiber does not inject */
+  }
+  try {
+    return ctx ? ctx[name] : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Remove the legacy `llm-pi-ai.providers.clinebot` entry and its local proxy
+ * token once the native adapter owns the route. Idempotent and best-effort:
+ * a failed cleanup is logged, never fatal.
+ * @param {object} ctx
+ */
+export async function migrateLegacyPiAiProvider(ctx) {
+  try {
+    const svc = service(ctx, 'settings')
+    if (!svc || typeof svc.describe !== 'function' || typeof svc.mutate !== 'function') return
+    const descriptor = svc.describe().find((entry) => entry?.ns === LLM_PI_AI_NS)
+    if (descriptor?.value?.providers?.clinebot) {
+      await svc.mutate(LLM_PI_AI_NS, [{ op: 'remove', path: ['providers', 'clinebot'] }])
+      ctx?.logger?.info?.('[dsh-clinebot] Removed legacy llm-pi-ai clinebot provider after adapter migration')
+    }
+  } catch (error) {
+    ctx?.logger?.warn?.('[dsh-clinebot] Legacy llm-pi-ai provider cleanup skipped: ' + (error?.message || error))
+  }
+  try {
+    await deleteCredentialKey(ctx, 'CLINEBOT_LOCAL_PROXY_TOKEN')
+  } catch {
+    /* the credential may never have existed */
+  }
+}