@goodandready/dsh-clinebot 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -1,15 +1,24 @@
 # Changelog
 
-## 0.5.4
-
-### Fixed
-- **Peer gate on DSH 0.2.0-rc.1** (#58): DSH skips a profile bundle whose `peerDependencies` exclude the running version, so this plugin was absent from the profile with no error in the UI. Every `@deepseek-ai/dsh-*` peer now names both the 0.1.7-rc.2 and 0.2.0-rc.1 lines, because semver does not admit a prerelease of the next minor into a range that does not name it.
-
 All notable changes to `@goodandready/dsh-clinebot` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.6] - 2026-09-30
+
+### Security
+- **Credential Deletion Scope Enforcement (Issue #155)**: Restricted credential deletion on `DELETE /dsh-clinebot/accounts` and `POST /dsh-clinebot/accounts/delete` strictly to configured secondary accounts matching `^CLINEBOT_API_KEY(_[A-Z0-9]+)?$`. Prohibited deletion of the primary account. Unconfigured or invalid keys receive HTTP 400/404 without calling credentials store. Credential deletion errors return HTTP 500.
+
+### Fixed
+- **Atomic Settings Persistence & Volatile Lifecycle (Issue #157)**: Re-architected `settingsApi.replace` and `settingsApi.update` to persist changes via DSH `SettingsForms` *before* mutating live state. If settings service is unavailable or non-writable, explicit errors are thrown. Mutating in-memory configuration now preserves dynamic Volatile references and getters across updates without severance.
+- **Cold Start Persistent Stats Loading & Flush on Dispose (Issue #158)**: Connected `loadStats(statsPath)` to plugin startup lifecycle in `apply()`, preventing cold starts from overwriting historical token metrics with empty counters. Added `flushStats()` effect hook on plugin disposal and automatic corrupted file preservation (`*.corrupt.<timestamp>`) for diagnostics.
+
+## [0.5.5] - 2026-09-30
+
+### Fixed
+- **Volatile Boxes Unwrapping in Config Validation (Issue #153)**: Corrected deep unwrapping of Schemastery Volatile boxes and getters when passing dynamic configuration objects through `Config()` validation, preventing schema validation failures.
+
 ## [0.5.3] - 2026-09-28
 
 ### Fixed

package/lib/config.js

@@ -87,7 +87,7 @@ export const Config = z.object({
     .description('Manually pinned active account envName or empty for auto/default.').volatile(),
 })
 
-function isVolatileRef(value) {
+export function isVolatileRef(value) {
   return !!value && typeof value === 'object' && !Array.isArray(value) && typeof value.get === 'function'
 }
 

package/lib/index.js

@@ -1,4 +1,4 @@
-import { Config, publicConfig, plainConfig, volatileConfig, NS, LLM_PI_AI_NS } from './config.js'
+import { Config, publicConfig, plainConfig, volatileConfig, isVolatileRef, NS, LLM_PI_AI_NS } from './config.js'
 import { registerPluginUpdater } from './updater.js'
 import {
   sessionStats,
@@ -22,7 +22,7 @@ import { registerModelsRoutes } from './routes/models.js'
 import { registerAuthRoutes } from './routes/auth.js'
 import { registerProxyRoutes } from './routes/proxy.js'
 import { registerSlashCommand } from './slash-command.js'
-import { recordUsage } from './stats-storage.js'
+import { recordUsage, loadStats, flushStats } from './stats-storage.js'
 
 export const name = '@goodandready/dsh-clinebot'
 export const inject = ['webServer', 'credentials']
@@ -67,35 +67,62 @@ export function apply(ctx, config) {
     }
   }
 
+  const applyConfigMutations = (target, source) => {
+    const targetConfig = typeof target === 'function' ? target() : target
+    if (targetConfig && typeof targetConfig === 'object' && !Object.isFrozen(targetConfig)) {
+      for (const [key, value] of Object.entries(source)) {
+        try {
+          if (isVolatileRef(targetConfig[key]) && typeof targetConfig[key].set === 'function') {
+            targetConfig[key].set(value)
+          } else if (Object.getOwnPropertyDescriptor(targetConfig, key)?.set) {
+            targetConfig[key] = value
+          } else if (!Object.getOwnPropertyDescriptor(targetConfig, key)?.get) {
+            targetConfig[key] = value
+          }
+        } catch {
+          /* ignore read-only */
+        }
+      }
+    } else {
+      currentConfig = source
+    }
+  }
+
   settingsApi = {
     get: () => live(),
     replace: async (next) => {
-      const parsed = Config(structuredClone(plainConfig(next)))
-      currentConfig = parsed
       const svc = ctx?.get?.('settings')
-      if (svc) {
-        const payload = volatileConfig(parsed)
-        if (typeof svc.replace === 'function') {
-          await svc.replace(NS, payload, getRevision(svc))
-        } else if (typeof svc.update === 'function') {
-          await svc.update(NS, payload, getRevision(svc))
-        }
+      if (!svc || (typeof svc.replace !== 'function' && typeof svc.update !== 'function')) {
+        throw new Error('DSH settings service is unavailable or non-writable')
+      }
+      const parsed = Config(structuredClone(plainConfig(next)))
+      const payload = volatileConfig(parsed)
+      const rev = getRevision(svc)
+      if (typeof svc.replace === 'function') {
+        await svc.replace(NS, payload, rev)
+      } else {
+        await svc.update(NS, payload, rev)
       }
+      applyConfigMutations(currentConfig, parsed)
+      loadStats(publicConfig(live()).statsPath)
       await syncProviderState(live())
       return parsed
     },
     update: async (patch) => {
-      const merged = Config({ ...publicConfig(live()), ...plainConfig(patch) })
-      currentConfig = merged
       const svc = ctx?.get?.('settings')
-      if (svc) {
-        const payload = volatileConfig(merged)
-        if (typeof svc.update === 'function') {
-          await svc.update(NS, payload, getRevision(svc))
-        } else if (typeof svc.replace === 'function') {
-          await svc.replace(NS, payload, getRevision(svc))
-        }
+      if (!svc || (typeof svc.update !== 'function' && typeof svc.replace !== 'function')) {
+        throw new Error('DSH settings service is unavailable or non-writable')
       }
+      const merged = Config({ ...publicConfig(live()), ...plainConfig(patch) })
+      const payload = volatileConfig(merged)
+      const rev = getRevision(svc)
+      if (typeof svc.update === 'function') {
+        await svc.update(NS, payload, rev)
+      } else {
+        await svc.replace(NS, payload, rev)
+      }
+      applyConfigMutations(currentConfig, merged)
+      loadStats(publicConfig(live()).statsPath)
       await syncProviderState(live())
       return merged
     },
@@ -106,6 +133,15 @@ export function apply(ctx, config) {
     },
   }
 
+  loadStats(publicConfig(live()).statsPath)
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      return () => {
+        flushStats(publicConfig(live()).statsPath)
+      }
+    }, 'dsh-clinebot: stats-storage')
+  }
+
   syncProviderState(live())
   if (typeof ctx.effect === 'function') {
     ctx.effect(() => {

package/lib/provider-sync.js

@@ -274,10 +274,10 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
     const hasObsolete = existingDynamic.some((m) => Boolean(OBSOLETE_MODEL_ID_MAP[m?.id]))
     if (hasObsolete && settingsApi?.replace) {
       const migrated = existingDynamic.map(migrateModelEntry)
-      const next = Config({
+      const next = plainConfig(Config({
         ...plainConfig(live()),
         dynamicModels: migrated,
-      })
+      }))
       await settingsApi.replace(next)
       await syncProviderState(next)
     }
@@ -286,11 +286,11 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
       const fromDisk = await loadModelsDiskCache(cacheFile)
       if (Array.isArray(fromDisk) && fromDisk.length && settingsApi?.replace) {
         const migratedDisk = fromDisk.map(migrateModelEntry)
-        const next = Config({
+        const next = plainConfig(Config({
           ...plainConfig(live()),
           dynamicModels: migratedDisk,
           planSyncedAt: fromDisk.planSyncedAt || Date.now(),
-        })
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
       }
@@ -311,11 +311,11 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
 
       if (hasNew && settingsApi?.replace) {
         const now = Date.now()
-        const next = Config({
+        const next = plainConfig(Config({
           ...plainConfig(live()),
           dynamicModels: usageData.dynamicModels,
           planSyncedAt: now,
-        })
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         if (cacheFile) {

package/lib/routes/accounts.js

@@ -78,7 +78,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           existingAccounts.push(accountEntry)
         }
 
-        const next = Config({ ...curr, accounts: existingAccounts })
+        const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
         await settingsApi.replace(next)
         await syncProviderState(next)
 
@@ -127,31 +127,60 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           body = {}
         }
       }
-      const targetEnv = String(targetEnvFromUrl || body.apiKeyEnv || '').trim()
+      let queryApiKeyEnv = ''
+      try {
+        const u = new URL(req.url, 'http://127.0.0.1')
+        queryApiKeyEnv = u.searchParams.get('apiKeyEnv') || ''
+      } catch {
+        queryApiKeyEnv = ''
+      }
+      const targetEnv = String(targetEnvFromUrl || body.apiKeyEnv || queryApiKeyEnv || '').trim()
       if (!targetEnv) {
         return writeJson(res, 400, { ok: false, error: 'apiKeyEnv is required' })
       }
 
+      const isDefaultPattern = /^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/.test(targetEnv)
+      if (!isDefaultPattern) {
+        return writeJson(res, 400, {
+          ok: false,
+          error: `Disallowed apiKeyEnv: "${targetEnv}". Must match ^CLINEBOT_API_KEY(_[A-Z0-9]+)?$.`,
+        })
+      }
+
       const curr = plainConfig(live())
       if (targetEnv === curr.apiKeyEnv || targetEnv === DEFAULT_API_KEY_ENV) {
         return writeJson(res, 400, { ok: false, error: 'Cannot delete the primary account' })
       }
 
       const existingAccounts = Array.isArray(curr.accounts) ? curr.accounts : []
+      const accountToDelete = existingAccounts.find((a) => a && a.apiKeyEnv === targetEnv)
+      if (!accountToDelete) {
+        return writeJson(res, 404, {
+          ok: false,
+          error: `Account "${targetEnv}" not found in accounts pool`,
+        })
+      }
+
+      if (body.deleteSecret) {
+        const delRes = await deleteCredentialKey(ctx, targetEnv)
+        if (!delRes || !delRes.ok) {
+          return writeJson(res, 500, {
+            ok: false,
+            error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
+          })
+        }
+      }
+
       const nextAccounts = existingAccounts.filter((a) => a && a.apiKeyEnv !== targetEnv)
       let activeAccount = curr.activeAccount
       if (activeAccount === targetEnv) {
         activeAccount = ''
       }
 
-      const next = Config({ ...curr, accounts: nextAccounts, activeAccount })
+      const next = plainConfig(Config({ ...curr, accounts: nextAccounts, activeAccount }))
       await settingsApi.replace(next)
       await syncProviderState(next)
 
-      if (body.deleteSecret) {
-        await deleteCredentialKey(ctx, targetEnv)
-      }
-
       clearUsageCache()
       clearProbeCache()
 
@@ -193,7 +222,7 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
         }
 
-        const next = Config({ ...plainConfig(live()), activeAccount: account })
+        const next = plainConfig(Config({ ...plainConfig(live()), activeAccount: account }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         writeJson(res, 200, { ok: true, activeAccount: account })

package/lib/routes/models.js

@@ -40,11 +40,11 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         }
 
         const now = Date.now()
-        const next = Config({
+        const next = plainConfig(Config({
           ...plainConfig(live()),
           dynamicModels,
           planSyncedAt: now,
-        })
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         const cacheFile = resolvePathWithHome(pub.modelsCachePath)
@@ -92,7 +92,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           patch.disabledModels = allModels.map((m) => m.id).filter((id) => !enabledSet.has(id))
         }
         if (body.defaultModel) patch.defaultModel = body.defaultModel
-        const next = Config({ ...plainConfig(live()), ...patch })
+        const next = plainConfig(Config({ ...plainConfig(live()), ...patch }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         writeJson(res, 200, { ok: true, disabledModels: next.disabledModels, enabledModels: publicConfig(next).enabledModels })
@@ -164,10 +164,10 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           return writeJson(res, 400, { ok: false, error: 'Missing modelId, mode, or overrides array' })
         }
 
-        const next = Config({
+        const next = plainConfig(Config({
           ...plainConfig(live()),
           modelContextOverrides: currentOverrides,
-        })
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
 

package/lib/routes/proxy.js

@@ -26,7 +26,7 @@ import { getLocalProxyToken } from '../proxy-token.js'
 const require = createRequire(import.meta.url)
 let packageVersion = '0.5.3'
 try {
-  packageVersion = require('../../package.json').version || '0.5.3'
+  packageVersion = require('../../package.json').version || '0.5.6'
 } catch (err) {
   /* fallback to default version if manifest is unreadable */
 }

package/lib/routes/settings.js

@@ -93,7 +93,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
         const base = plainConfig(live()) || {}
         delete base.enabledModels
         const merged = { ...base, ...rawPayload }
-        const parsed = Config(merged)
+        const parsed = plainConfig(Config(merged))
         await settingsApi.replace(parsed)
         await syncProviderState(parsed)
         writeJson(res, 200, { ok: true, config: publicConfig(live()) })

package/lib/stats-storage.js

@@ -5,7 +5,7 @@
  * Survives dsh-web service restarts and tracks historical consumption by day, month, model, and account.
  */
 
-import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from 'node:fs'
+import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
 
@@ -84,9 +84,9 @@ export function resolvePath(targetPath) {
  * @returns {Object} Loaded stats
  */
 export function loadStats(customPath) {
+  const filePath = resolvePath(customPath)
+  activeStatsPath = filePath
   try {
-    const filePath = resolvePath(customPath)
-    activeStatsPath = filePath
     if (existsSync(filePath)) {
       const raw = readFileSync(filePath, 'utf8')
       const parsed = JSON.parse(raw)
@@ -103,14 +103,35 @@ export function loadStats(customPath) {
         return inMemoryStats
       }
     }
-  } catch {
-    // If reading fails or file is corrupted, fallback to clean stats
+  } catch (err) {
+    // If reading fails or file is corrupted, preserve corrupted file for diagnostics
+    try {
+      if (existsSync(filePath)) {
+        const corruptBackup = `${filePath}.corrupt.${Date.now()}`
+        copyFileSync(filePath, corruptBackup)
+      }
+    } catch {
+      /* ignore backup failure */
+    }
   }
 
   inMemoryStats = createEmptyStats()
   return inMemoryStats
 }
 
+/**
+ * Flush any debounced pending writes immediately to disk.
+ *
+ * @param {string} [customPath]
+ */
+export function flushStats(customPath) {
+  if (saveTimer) {
+    clearTimeout(saveTimer)
+    saveTimer = null
+  }
+  saveStatsSync(customPath)
+}
+
 /**
  * Synchronously write stats to disk using atomic rename.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",