@goodandready/dsh-clinebot 0.5.9 → 0.5.11

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.11] - 2026-10-01
+
+### Fixed
+- **Dynamic Stats Storage Switching & Counter Preservation (Issue #158)**: Flushes and synchronizes in-memory metrics before switching file storage targets when `statsPath` is updated dynamically, avoiding overwriting accumulated statistics when paths change.
+- **Session Affinity Native Transport Bridge via Prompt Cache Key (Issue #163)**: Bridge native DSH `llm-pi-ai` requests to ClineBot sticky sessions by enabling `cacheRetention: 'long'` in the provider contract, and extracting session identifiers from `prompt_cache_key` on the proxy route, maintaining consistent account affinity across turns.
+- **Catalog Lifecycle & Cache Identity Isolation (Issue #168)**: Isolated disk model cache records by specific account and endpoint scopes, clearing dynamic model cache and sync timestamps on active account switch, and reporting `planSynced: false` when offline cached plans cannot be actively verified against the provider.
+- **Updater Process Group Escalation on Parent Exit (Issue #172)**: Ensured process group supervision continues after parent SIGTERM exit in `updater.js`, checking `isProcessGroupAlive(child.pid)` and escalating to SIGKILL across the detached process group (`-child.pid`) to eliminate lingering background processes.
+- **Transactional Account Delete Surgical Rollback & Retry (Issues #184, #187)**: Replaced full-config rollback with surgical restoration of removed accounts into fresh live configuration on secret deletion failure, preserving concurrent settings updates. Exposed partial deletion state (`partial: true`) and allowed safe retry of credential cleanup without HTTP 404 errors.
+- **DESIGN Contract Alignment with Native Runtime Contracts (Issue #177)**: Synchronized `docs/design/DESIGN.md` with active implementation: documented native DSH transport bridge, dynamic catalog lifecycle, updater process group cleanup, and dynamic stats storage switching.
+- **Regression & Hardening Test Coverage (Issue #173)**: Added regression tests for dynamic stats switching, shifting quota session stickiness, process group lifecycle escalation on parent SIGTERM, and transactional partial account deletion and retry.
+
+## [0.5.10] - 2026-10-01
+
+### Fixed
+- **Native Cosmokit Volatile Box & Proxy Target Preservation (Issues #157, #173)**: Preserved native Cosmokit `{ get }` volatile references without scalar overwrites during config mutations, and ensured extensible proxy targets for frozen configurations to prevent `TypeError: 'ownKeys' on proxy` invariants.
+- **In-Memory Stats Retention Across Config Updates (Issue #158)**: Retained unwritten in-memory metrics across unrelated configuration saves (`PUT /config`) without reloading from disk or dropping unpersisted counters. Flushes pending metrics before switching storage paths when `statsPath` changes.
+- **Account Pool Least-Used Routing on Empty Active Account (Issue #162)**: Allowed automatic least-used quota routing when `activeAccount` is set to an empty string or `"auto"`, preventing unintended pinning of the primary default account.
+- **Native DSH Provider Compatibility Flag Normalization (Issue #163)**: Removed obsolete session affinity compatibility flags (`sendSessionAffinityHeaders`, `sessionAffinityFormat`) rejected by native DSH `llm-pi-ai`, restoring clean catalog registration and model resolution.
+- **Disk Models Cache Isolation by Account & Endpoint (Issue #168)**: Keyed on-disk models cache (`saveModelsDiskCache`/`loadModelsDiskCache`) to specific account and endpoint identities, preventing cross-account model pollution and false `planSynced: true` indications in offline mode.
+- **Process Group Termination & Zombie Prevention in Updater (Issue #172)**: Spanned updater processes with `detached: true` on POSIX, transmitting `SIGTERM` and `SIGKILL` across the entire process group (`-child.pid`) on timeout to guarantee complete termination of spawned child/grandchild processes and prompt lock release.
+- **Session Router Bounded Memory Capacity on Manual Pin (Issue #183)**: Enforced strict capacity bounds (`MAX_SESSIONS = 1000`) on manual pin branches in `resolveSessionAccount`, ensuring LRU eviction and preventing unbounded memory growth.
+- **Transactional Account Deletion & Secret Preservation (Issue #184)**: Persisted configuration updates prior to unsetting credentials in `handleDeleteAccount`, preventing irrevocable API key loss if settings persistence fails, and rolling back settings on credential deletion failures.
+- **Non-Stream Proxy Response Body Deadline & Fail-Closed Error Handling (Issue #185)**: Wrapped non-streaming proxy response body reading in a `Promise.race` deadline bounded by `streamIdleTimeoutMs`, aborting upstream requests and returning HTTP 504 Gateway Timeout or 502 Bad Gateway with error metrics on stalls or socket drops instead of false HTTP 200 `{}`.
+- **Localized Quota Countdown & Duplicate Chinese Reset Label Elimination (Issue #175)**: Added localized `quota.resetting` keys in `zh` ("正在重置") and `en` ("Resetting…") and handled resetting countdown states cleanly in `makeT` and `ProgressBar`, eliminating awkward "resetting后重置" strings.
+- **Documentation & DESIGN Contract Alignment (Issue #177)**: Removed obsolete `settings.yaml` references across all documentation, updated runtime defaults (`cline-pass/deepseek-v4-flash`, timeouts 15s/25s/30s), documented 256 KiB control vs 64 MiB proxy body limits, and documented auto-routing policies.
+- **Native DSH Adapter Integration Test Coverage (Issue #173)**: Added regression and integration tests verifying native DSH `llm-pi-ai` provider registration without `catalogError` and validating reactive volatile schema behavior.
+
 ## [0.5.9] - 2026-10-01
 
 ### Fixed

package/README.md

@@ -154,9 +154,9 @@ From any DSH chat session, type `/cline` to inspect quota, warning alerts, and s
 
 ---
 
-## ⚙️ Configuration Reference (`settings.yaml`)
+## ⚙️ Configuration Reference (DSH Settings & Web UI)
 
-Configure options in `settings.yaml` or directly inside the Web UI:
+In modern DeepSeek Harness (0.1.7+), settings are managed natively via the DSH Web UI Settings card or `PUT /dsh-clinebot/config`, with API keys persisted securely in DSH Credentials storage (`~/.dsh/.credentials.yaml`).
 
 ```yaml
 dsh-clinebot:
@@ -186,7 +186,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | Enable or disable the ClineBot provider bridge in DSH |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | ClinePass OpenAI-compatible base URL |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | Environment variable / credentials key name |
-| `defaultModel` | `string` | `"claude-3-7-sonnet"` | Default selected model ID for chat and smoke tests |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | Default selected model ID for chat and smoke tests |
 | `disabledModels` | `array` | `[]` | List of model IDs hidden from the DSH chat picker (new subscription models are auto-enabled) |
 | `customModels` | `array` | `[]` | User-defined gateway models (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | Configured default reasoning effort per model (`low`, `medium`, `high`, `max`) |
@@ -195,9 +195,9 @@ dsh-clinebot:
 | `statsPath` | `string` | `"~/.dsh/clinebot-stats.json"` | Persistent on-disk path for token usage analytics |
 | `accounts` | `array` | `[]` | Additional accounts for multi-account failover and quota rotation (`[{ label, apiKeyEnv }]`) |
 | `activeAccount` | `string` | `""` | Manually pinned active account env name (empty for least-used auto routing) |
-| `timeoutMs` | `number` | `30000` | HTTP probe timeout in milliseconds |
-| `smokeTimeoutMs` | `number` | `60000` | Timeout for smoke test chat completions in milliseconds |
-| `streamIdleTimeoutMs` | `number` | `60000` | Idle timeout between SSE stream chunks in milliseconds |
+| `timeoutMs` | `number` | `15000` | HTTP probe timeout in milliseconds |
+| `smokeTimeoutMs` | `number` | `25000` | Timeout for smoke test chat completions in milliseconds |
+| `streamIdleTimeoutMs` | `number` | `30000` | Idle timeout between SSE stream chunks in milliseconds |
 | `enabledModels` | `array` | *(deprecated)* | Read-only in public config; rejected on `PUT /config` in favor of `disabledModels` |
 | `dynamicModels` | `array` | `[]` | Dynamic models automatically synced from the official plan |
 
@@ -205,17 +205,29 @@ dsh-clinebot:
 
 ## 🌐 HTTP API Endpoints
 
-All endpoints are registered under `/dsh-clinebot/*` and protected against untrusted cross-site origins (same-origin and loopback allowed):
+All endpoints are registered under `/dsh-clinebot/*` and protected against untrusted cross-site origins (same-origin and loopback allowed). Control endpoints enforce a 256 KiB request payload limit; the loopback proxy endpoint supports up to 64 MiB payloads (`MAX_PROXY_BODY_BYTES`):
 
+### Management & Control Endpoints (Max 256 KiB)
 * `GET /dsh-clinebot/status` — Live status report including provider health, active credential, quota, and session metrics.
 * `GET /dsh-clinebot/config` — Diagnostic endpoint returning public configuration without secret keys.
 * `PUT /dsh-clinebot/config` — Update configuration fields. Accepts only known schema properties (unknown fields or deprecated `enabledModels` return `400 Bad Request`).
 * `POST /dsh-clinebot/key/verify` — Validates a candidate API key against `api.cline.bot` and returns account email and plan name.
 * `POST /dsh-clinebot/save-key` — Saves a key into DSH credentials service under a valid `CLINEBOT_API_KEY*` name.
 * `POST /dsh-clinebot/models/sync` — Synchronizes models with your active subscription plan.
-* `POST /dsh-clinebot/models/toggle` — Toggles models via `disabledModels`.
-* `POST /dsh-clinebot/accounts/active` — Pins an active account from the account pool.
+* `POST /dsh-clinebot/models/toggle` — Toggles models via `disabledModels` (atomic Volatile preservation).
+* `POST /dsh-clinebot/models/custom` / `DELETE /dsh-clinebot/models/custom` — Manage custom user-defined models.
+* `POST /dsh-clinebot/models/context` / `DELETE /dsh-clinebot/models/context` — Manage model context length overrides.
+* `POST /dsh-clinebot/accounts` — Add account to the multi-account pool.
+* `POST /dsh-clinebot/accounts/delete` — Delete account from the pool with atomic credential preservation.
+* `POST /dsh-clinebot/accounts/active` — Switch or pin active account (or empty for auto least-used routing).
+* `POST /dsh-clinebot/stats/reset` — Reset session request and token statistics.
 * `POST /dsh-clinebot/smoke` — Runs a live latency test ping.
+* `GET /dsh-clinebot/update/status` — Query available GitHub releases and plugin updates.
+* `POST /dsh-clinebot/update/apply` — Apply version upgrade with process-group cleanup and lockfile sync.
+
+### OpenAI-Compatible Loopback Proxy (Max 64 MiB)
+* `POST /dsh-clinebot/v1/chat/completions` — Transparent local proxy supporting streaming SSE and non-streaming responses, Bearer token authentication, sticky session affinity with least-used quota allocation, body read watchdog (`streamIdleTimeoutMs`), and automatic 429 failover.
+* `GET /dsh-clinebot/v1/models` — OpenAI-compatible catalog listing all active plan and custom models.
 
 ---
 

package/README.ru.md

@@ -151,7 +151,9 @@ dsh plugin --profile web add @goodandready/dsh-clinebot
 
 ---
 
-## ⚙️ Таблица конфигурации (`settings.yaml`)
+## ⚙️ Конфигурация (Настройки DSH и Web UI)
+
+В современном DeepSeek Harness (0.1.7+) настройки управляются через карточку в Web UI или `PUT /dsh-clinebot/config`, а секретные ключи безопасно хранятся в DSH Credentials (`~/.dsh/.credentials.yaml`).
 
 ```yaml
 dsh-clinebot:
@@ -181,7 +183,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | Включение моста провайдера ClineBot в DSH |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | Базовый URL OpenAI-совместимого API ClinePass |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | Имя переменной / ключа в хранилище credentials |
-| `defaultModel` | `string` | `"claude-3-7-sonnet"` | Модель, выбираемая по умолчанию для чата и smoke-тестов |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | Модель, выбираемая по умолчанию для чата и smoke-тестов |
 | `disabledModels` | `array` | `[]` | Список отключённых моделей (новые модели подписки включаются автоматически) |
 | `customModels` | `array` | `[]` | Пользовательские модели шлюза (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | Значения thinking effort по умолчанию для моделей (`low`, `medium`, `high`, `max`) |
@@ -190,9 +192,9 @@ dsh-clinebot:
 | `statsPath` | `string` | `"~/.dsh/clinebot-stats.json"` | Путь к файлу персистентной аналитики использования токенов |
 | `accounts` | `array` | `[]` | Дополнительные аккаунты для ротации квоты и failover (`[{ label, apiKeyEnv }]`) |
 | `activeAccount` | `string` | `""` | Принудительно закреплённый аккаунт (пусто для автоматического выбора least-used) |
-| `timeoutMs` | `number` | `30000` | Таймаут HTTP-запросов (мс) |
-| `smokeTimeoutMs` | `number` | `60000` | Таймаут тестового пинга инференса (мс) |
-| `streamIdleTimeoutMs` | `number` | `60000` | Таймаут ожидания между чанками SSE-потока (мс) |
+| `timeoutMs` | `number` | `15000` | Таймаут HTTP-запросов (мс) |
+| `smokeTimeoutMs` | `number` | `25000` | Таймаут тестового пинга инференса (мс) |
+| `streamIdleTimeoutMs` | `number` | `30000` | Таймаут ожидания между чанками SSE-потока (мс) |
 | `enabledModels` | `array` | *(устарело)* | Только для чтения в public config; отклоняется при `PUT /config` в пользу `disabledModels` |
 | `dynamicModels` | `array` | `[]` | Динамические модели, автоматически синхронизированные из тарифа |
 
@@ -200,17 +202,29 @@ dsh-clinebot:
 
 ## 🌐 Маршруты HTTP API
 
-Все маршруты регистрируются с префиксом `/dsh-clinebot/*` и защищены от несанкционированных межсайтовых запросов (разрешены same-origin и loopback):
+Все маршруты регистрируются с префиксом `/dsh-clinebot/*` и защищены от межсайтовых запросов (разрешены same-origin и loopback). Управляющие эндпоинты ограничены лимитом 256 КиБ; прокси-эндпоинт поддерживает до 64 МиБ полезной нагрузки (`MAX_PROXY_BODY_BYTES`):
 
+### Управляющие эндпоинты (макс. 256 КиБ)
 * `GET /dsh-clinebot/status` — Текущее состояние провайдера, активный аккаунт, квоты и статистика сессий.
 * `GET /dsh-clinebot/config` — Диагностический маршрут, возвращающий открытую конфигурацию (без секретов).
-* `PUT /dsh-clinebot/config` — Обновление параметров конфигурации. Принимает только известные поля схемы (неизвестные поля и устаревшее `enabledModels` возвращают `400 Bad Request`).
-* `POST /dsh-clinebot/key/verify` — Проверка API-ключа на сервере `api.cline.bot` с возвратом email и названия тарифа.
-* `POST /dsh-clinebot/save-key` — Сохранение ключа в сервис credentials DSH под именем шаблона `CLINEBOT_API_KEY*`.
+* `PUT /dsh-clinebot/config` — Обновление параметров конфигурации (устаревший `enabledModels` блокируется).
+* `POST /dsh-clinebot/key/verify` — Проверка API-ключа на сервере `api.cline.bot` с возвратом email и тарифа.
+* `POST /dsh-clinebot/save-key` — Сохранение ключа в сервис credentials DSH под именем `CLINEBOT_API_KEY*`.
 * `POST /dsh-clinebot/models/sync` — Синхронизация списка моделей с официальным тарифом ClinePass.
-* `POST /dsh-clinebot/models/toggle` — Включение и отключение моделей через `disabledModels`.
-* `POST /dsh-clinebot/accounts/active` — Назначение активного аккаунта из пула.
+* `POST /dsh-clinebot/models/toggle` — Включение и отключение моделей через `disabledModels` с сохранением Volatile-ссылок.
+* `POST /dsh-clinebot/models/custom` / `DELETE /dsh-clinebot/models/custom` — Управление пользовательскими моделями.
+* `POST /dsh-clinebot/models/context` / `DELETE /dsh-clinebot/models/context` — Переопределение контекстного окна моделей.
+* `POST /dsh-clinebot/accounts` — Добавление аккаунта в пул ротации.
+* `POST /dsh-clinebot/accounts/delete` — Удаление аккаунта с атомарной защитой секретного ключа.
+* `POST /dsh-clinebot/accounts/active` — Назначение активного аккаунта из пула (или пусто для auto least-used).
+* `POST /dsh-clinebot/stats/reset` — Сброс счётчиков запросов и токенов.
 * `POST /dsh-clinebot/smoke` — Выполнение тестового пинга задержки.
+* `GET /dsh-clinebot/update/status` — Проверка наличия обновлений плагина.
+* `POST /dsh-clinebot/update/apply` — Обновление плагина с корректным завершением групп процессов и блокировками профиля.
+
+### OpenAI-совместимый loopback-прокси (макс. 64 МиБ)
+* `POST /dsh-clinebot/v1/chat/completions` — Прозрачный локальный прокси с поддержкой SSE и нестриминговых ответов, Bearer-аутентификацией, сессионной липкостью и least-used распределением квот, контролем дедлайнов (`streamIdleTimeoutMs`) и автоматическим 429 failover.
+* `GET /dsh-clinebot/v1/models` — Каталог моделей в стандарте OpenAI API.
 
 ---
 

package/README.zh.md

@@ -153,7 +153,9 @@ dsh plugin --profile web add @goodandready/dsh-clinebot
 
 ---
 
-## ⚙️ 配置项参考 (`settings.yaml`)
+## ⚙️ 配置项参考 (DSH 设置与 Web UI)
+
+在现代 DeepSeek Harness (0.1.7+) 中，各项配置通过 Web UI 或 `PUT /dsh-clinebot/config` 原生管理，密钥安全存储于 DSH Credentials 凭据中心 (`~/.dsh/.credentials.yaml`)。
 
 ```yaml
 dsh-clinebot:
@@ -183,7 +185,7 @@ dsh-clinebot:
 | `enabled` | `boolean` | `true` | 是否在 DSH 中启用 ClineBot 桥接插件 |
 | `baseUrl` | `string` | `"https://api.cline.bot/api/v1"` | ClinePass OpenAI 兼容接口地址 |
 | `apiKeyEnv` | `string` | `"CLINEBOT_API_KEY"` | 凭据管理系统中的密钥名称 |
-| `defaultModel` | `string` | `"claude-3-7-sonnet"` | 默认选中的模型 ID（用于对话及探活） |
+| `defaultModel` | `string` | `"cline-pass/deepseek-v4-flash"` | 默认选中的模型 ID（用于对话及探活） |
 | `disabledModels` | `array` | `[]` | 在选择器中隐藏的模型 ID 列表（新订阅模型默认自动启用） |
 | `customModels` | `array` | `[]` | 用户自定义网关模型 (`[{ id, name, contextLength, maxTokens, category, isReasoning }]`) |
 | `modelReasoningDefaults` | `object` | `{}` | 各模型默认思考强度配置 (`low`, `medium`, `high`, `max`) |
@@ -192,9 +194,9 @@ dsh-clinebot:
 | `statsPath` | `string` | `"~/.dsh/clinebot-stats.json"` | 本地持久化 Token 用量统计文件路径 |
 | `accounts` | `array` | `[]` | 额外轮转账号池 (`[{ label, apiKeyEnv }]`) |
 | `activeAccount` | `string` | `""` | 手动指定的主账号（为空时自动按最低配额消耗优先路由） |
-| `timeoutMs` | `number` | `30000` | HTTP 请求探测超时时间（毫秒） |
-| `smokeTimeoutMs` | `number` | `60000` | 探活测试超时时间（毫秒） |
-| `streamIdleTimeoutMs` | `number` | `60000` | SSE 流式输出块间空闲超时时间（毫秒） |
+| `timeoutMs` | `number` | `15000` | HTTP 请求探测超时时间（毫秒） |
+| `smokeTimeoutMs` | `number` | `25000` | 探活测试超时时间（毫秒） |
+| `streamIdleTimeoutMs` | `number` | `30000` | SSE 流式输出块间空闲超时时间（毫秒） |
 | `enabledModels` | `array` | *(已废弃)* | 仅在 public config 中只读提供，`PUT /config` 时禁止写入并请使用 `disabledModels` |
 | `dynamicModels` | `array` | `[]` | 从官方套餐中自动同步的动态模型列表 |
 
@@ -202,17 +204,29 @@ dsh-clinebot:
 
 ## 🌐 HTTP API 接口说明
 
-所有接口注册于 `/dsh-clinebot/*` 路径，并受到严格的跨站防护保护（仅允许同源或环回请求）：
+所有接口挂载于 `/dsh-clinebot/*` 路径，并受到跨站请求防护（仅放行同源或环回请求）。管理接口限制请求体上限 256 KiB；环回推理代理接口支持最高 64 MiB 有效载荷 (`MAX_PROXY_BODY_BYTES`)：
 
+### 管理与控制接口（上限 256 KiB）
 * `GET /dsh-clinebot/status` — 服务运行状态，包括健康探活、当前凭据名称、配额限制及会话统计。
-* `GET /dsh-clinebot/config` — 诊断接口，安全获取脱敏后的公共配置。
-* `PUT /dsh-clinebot/config` — 更新配置项。仅接受模式中的已知字段（未知字段或已废弃的 `enabledModels` 返回 `400 Bad Request`）。
-* `POST /dsh-clinebot/key/verify` — 向 `api.cline.bot` 发送探活请求实时验证密钥，返回绑定邮箱及套餐名称。
-* `POST /dsh-clinebot/save-key` — 将 API 密钥安全存储到 DSH credentials 服务。
-* `POST /dsh-clinebot/models/sync` — 同步 ClinePass 官方套餐内包含的全部动态模型。
-* `POST /dsh-clinebot/models/toggle` — 通过 `disabledModels` 批量切换模型可用性。
-* `POST /dsh-clinebot/accounts/active` — 从多账号池中指定当前主账号。
+* `GET /dsh-clinebot/config` — 诊断接口，安全获取脱敏后的公共配置（不含敏感密钥）。
+* `PUT /dsh-clinebot/config` — 更新配置项（严格校验模式，已废弃的 `enabledModels` 被拦截）。
+* `POST /dsh-clinebot/key/verify` — 实时验证 API 密钥有效性，返回绑定邮箱及套餐名称。
+* `POST /dsh-clinebot/save-key` — 将 API 密钥安全写入 DSH 凭据服务。
+* `POST /dsh-clinebot/models/sync` — 手动同步官方套餐动态模型列表。
+* `POST /dsh-clinebot/models/toggle` — 批量切换模型可用性（更新 `disabledModels` 并保留 Volatile 引用）。
+* `POST /dsh-clinebot/models/custom` / `DELETE /dsh-clinebot/models/custom` — 自定义模型增删。
+* `POST /dsh-clinebot/models/context` / `DELETE /dsh-clinebot/models/context` — 上下文窗口与最大 Token 覆盖。
+* `POST /dsh-clinebot/accounts` — 添加多账号备用凭据。
+* `POST /dsh-clinebot/accounts/delete` — 删除账号（具备原子化凭据保护）。
+* `POST /dsh-clinebot/accounts/active` — 指定活动账号（为空时自动启用最低用量优先路由）。
+* `POST /dsh-clinebot/stats/reset` — 重置会话与 Token 消耗统计。
 * `POST /dsh-clinebot/smoke` — 发起快速探测并返回实时延迟。
+* `GET /dsh-clinebot/update/status` — 查询插件版本更新状态。
+* `POST /dsh-clinebot/update/apply` — 应用版本更新（支持进程树完全清理与锁文件保护）。
+
+### OpenAI 兼容环回代理接口（上限 64 MiB）
+* `POST /dsh-clinebot/v1/chat/completions` — 本地透明代理，支持 SSE 流式与完整响应、会话粘性路由、最低用量负载均衡、响应体超时防护 (`streamIdleTimeoutMs`) 以及 429 自动故障转移。
+* `GET /dsh-clinebot/v1/models` — 符合 OpenAI API 规范的模型列表。
 
 ---
 

package/lib/account-pool.js

@@ -84,9 +84,11 @@ export async function resolveAccountPool(ctx, cfg) {
     const envName = textSetting(slot.apiKeyEnv) || (i === 0 ? apiKeyEnv : `CLINEBOT_API_KEY_${i + 1}`)
     const keyInfo = await resolveKeyValue(ctx, envName)
     const slotId = slot.id || (i === 0 ? 'default' : `account-${i + 1}`)
-    const isPinned = activeAccount === 'auto'
-      ? false
-      : (activeAccount ? (activeAccount === envName || activeAccount === slotId) : i === 0)
+    const isPinned = Boolean(
+      activeAccount &&
+      activeAccount !== 'auto' &&
+      (activeAccount === envName || activeAccount === slotId)
+    )
     const quota = keyInfo.value ? getAccountQuotaSnapshot(keyInfo.value, baseUrl) : null
     resolved.push({
       id: slotId,

package/lib/client.js

@@ -94,6 +94,7 @@ const en = {
       'quota.reset_at': 'Reset: {time}',
       'quota.window_monthly': '📅 Monthly Window',
       'quota.countdown': 'Resets in {time}',
+      'quota.resetting': 'Resetting…',
       'quota.warning_low': 'Quota is below 10%. Requests may be throttled soon.',
       'quota.exhausted_5h': '5-hour rolling limit is almost exhausted ({percentUsed}%). New requests may be rejected until quota reset.',
       'quota.warning_5h': 'Low quota warning: {percentUsed}% of 5-hour limit consumed (<10% remaining).',
@@ -242,6 +243,7 @@ const en = {
       'quota.reset_at': '重置时间：{time}',
       'quota.window_monthly': '📅 每月滚动窗口',
       'quota.countdown': '{time}后重置',
+      'quota.resetting': '正在重置',
       'quota.warning_low': '额度低于 10%，请求可能很快会受到限制。',
       'quota.exhausted_5h': '5 小时滚动限额已接近耗尽（已用 {percentUsed}%）。在额度重置前新请求可能会被拒绝。',
       'quota.warning_5h': '低额度警告：5 小时限额已消耗 {percentUsed}%（剩余不足 10%）。',
@@ -336,6 +338,9 @@ const en = {
 
     function makeT(dict, fallback) {
       return function t(key, vars) {
+        if (key === 'quota.countdown' && vars?.time === 'resetting') {
+          return (dict && dict['quota.resetting']) || (fallback && fallback['quota.resetting']) || '正在重置'
+        }
         let val = (dict && dict[key]) || (fallback && fallback[key]) || key
         if (vars && typeof val === 'string') {
           for (const k of Object.keys(vars)) {
@@ -570,7 +575,7 @@ function ProgressBar({ label, percentUsed, remainingPercent, resetsAt, t }) {
           },
         },
         t('quota.used', { pct }),
-        resetCountdown ? ` · ${t('quota.countdown', { time: resetCountdown })}` : (resetClock ? ` · ${t('quota.reset_at', { time: resetClock })}` : '')
+        resetCountdown ? ` · ${resetCountdown === 'resetting' ? (t('quota.resetting') || '正在重置') : t('quota.countdown', { time: resetCountdown })}` : (resetClock ? ` · ${t('quota.reset_at', { time: resetClock })}` : '')
       )
     ),
     React.createElement(

package/lib/cline-client.js

@@ -528,10 +528,7 @@ export function buildPiAiProvider({
         if (validEfforts.includes(key)) efforts[key] = key === 'off' ? (v === undefined ? null : v) : (typeof v === 'string' && v.trim() ? v.trim() : key)
       }
     }
-    const modelCompat = {
-      sendSessionAffinityHeaders: true,
-      sessionAffinityFormat: 'openrouter',
-    }
+    const modelCompat = {}
     if (efforts && Object.keys(efforts).length) {
       if (!('off' in efforts)) efforts.off = null
       res.reasoningEfforts = efforts
@@ -539,7 +536,9 @@ export function buildPiAiProvider({
     } else {
       res.reasoningEfforts = false
     }
-    res.compat = modelCompat
+    if (Object.keys(modelCompat).length > 0) {
+      res.compat = modelCompat
+    }
     return res
   })
 
@@ -548,10 +547,10 @@ export function buildPiAiProvider({
     api: 'openai-completions',
     baseURL: normalizeBaseUrl(baseUrl),
     apiKeyEnv: apiKeyEnv || DEFAULT_API_KEY_ENV,
+    cacheRetention: 'long',
     compat: {
       supportsReasoningEffort: true,
-      sendSessionAffinityHeaders: true,
-      sessionAffinityFormat: 'openrouter',
+      supportsLongCacheRetention: true,
     },
     models: modelList,
   }

package/lib/config.js

@@ -129,7 +129,7 @@ export function publicConfig(cfg) {
   const dynamic = Array.isArray(cfg?.dynamicModels) ? cfg.dynamicModels : []
   const custom = Array.isArray(cfg?.customModels) ? cfg.customModels : []
   const modelContextOverrides = Array.isArray(cfg?.modelContextOverrides) ? cfg.modelContextOverrides : []
-  const isSynced = dynamic.length > 0
+  const isSynced = dynamic.length > 0 && (Number(cfg?.planSyncedAt) > 0)
   const allModels = getAllModels(dynamic, modelContextOverrides, custom)
   const allDefaultIds = allModels.map((m) => m.id)
 

package/lib/index.js

@@ -22,7 +22,7 @@ import { registerModelsRoutes } from './routes/models.js'
 import { registerAuthRoutes } from './routes/auth.js'
 import { registerProxyRoutes } from './routes/proxy.js'
 import { registerSlashCommand } from './slash-command.js'
-import { recordUsage, loadStats, flushStats } from './stats-storage.js'
+import { recordUsage, loadStats, flushStats, resolvePath, switchStatsStorage } from './stats-storage.js'
 
 export const name = '@goodandready/dsh-clinebot'
 export const inject = ['webServer', 'credentials']
@@ -35,7 +35,41 @@ export { NS, LLM_PI_AI_NS, Config, sessionStats, recordSessionRequest, resetSess
 
 export function apply(ctx, config) {
   let currentConfig = config
-  let getConfig = () => currentConfig
+  const overrides = {}
+  const getConfig = () => {
+    if (!currentConfig) return currentConfig
+    if (Object.isFrozen(currentConfig)) {
+      return new Proxy({}, {
+        get(_target, prop) {
+          const orig = Reflect.get(currentConfig, prop)
+          if (isVolatileRef(orig) || Object.getOwnPropertyDescriptor(currentConfig, prop)?.get) {
+            return orig
+          }
+          if (prop in overrides) {
+            return overrides[prop]
+          }
+          return orig
+        },
+        has(_target, prop) {
+          return prop in overrides || Reflect.has(currentConfig, prop)
+        },
+        ownKeys() {
+          return Array.from(new Set([...Reflect.ownKeys(currentConfig), ...Object.keys(overrides)]))
+        },
+        getOwnPropertyDescriptor(_target, prop) {
+          if (prop in overrides) {
+            return { configurable: true, enumerable: true, value: overrides[prop], writable: true }
+          }
+          const desc = Object.getOwnPropertyDescriptor(currentConfig, prop)
+          if (desc) {
+            return { configurable: true, enumerable: desc.enumerable ?? true, value: Reflect.get(currentConfig, prop) }
+          }
+          return undefined
+        }
+      })
+    }
+    return currentConfig
+  }
   const live = () => (getConfig() ? Config(structuredClone(plainConfig(getConfig()))) : config)
   let settingsApi
 
@@ -59,6 +93,23 @@ export function apply(ctx, config) {
     autoDiscoverPlanModels(ctx, { live, getSettingsApi: () => settingsApi, syncProviderState })
   }
 
+  let activeStatsPath = resolvePath(publicConfig(live()).statsPath)
+  loadStats(activeStatsPath)
+
+  const syncStatsStorage = (cfg) => {
+    const nextPath = resolvePath(publicConfig(cfg).statsPath)
+    if (nextPath !== activeStatsPath) {
+      switchStatsStorage(nextPath)
+      activeStatsPath = nextPath
+    }
+  }
+
+  if (typeof ctx?.on === 'function') {
+    ctx.on('loader/volatile-update', () => {
+      syncStatsStorage(live())
+    })
+  }
+
   const getRevision = (svc) => {
     try {
       return svc?.describe?.().find((row) => row.ns === NS)?.revision
@@ -69,22 +120,37 @@ export function apply(ctx, config) {
 
   const applyConfigMutations = (target, source) => {
     const targetConfig = typeof target === 'function' ? target() : target
-    if (targetConfig && typeof targetConfig === 'object' && !Object.isFrozen(targetConfig)) {
+    if (targetConfig && typeof targetConfig === 'object') {
+      if (Object.isFrozen(targetConfig)) {
+        for (const [key, value] of Object.entries(source)) {
+          const orig = targetConfig[key]
+          if (isVolatileRef(orig) || Object.getOwnPropertyDescriptor(targetConfig, key)?.get) {
+            continue
+          }
+          overrides[key] = value
+        }
+        return
+      }
       for (const [key, value] of Object.entries(source)) {
         try {
-          if (isVolatileRef(targetConfig[key]) && typeof targetConfig[key].set === 'function') {
-            targetConfig[key].set(value)
-          } else if (Object.getOwnPropertyDescriptor(targetConfig, key)?.set) {
+          if (isVolatileRef(targetConfig[key])) {
+            // Cosmokit native Volatile references are reactive and authoritative;
+            // preserve the reference without overwriting with plain value.
+            continue
+          }
+          const desc = Object.getOwnPropertyDescriptor(targetConfig, key)
+          if (desc?.get && !desc.set) {
+            continue
+          }
+          if (desc?.set) {
             targetConfig[key] = value
-          } else if (!Object.getOwnPropertyDescriptor(targetConfig, key)?.get) {
+          } else {
             targetConfig[key] = value
           }
         } catch {
           /* ignore read-only */
         }
       }
-    } else {
-      currentConfig = source
     }
   }
 
@@ -104,7 +170,7 @@ export function apply(ctx, config) {
         await svc.update(NS, payload, rev)
       }
       applyConfigMutations(currentConfig, parsed)
-      loadStats(publicConfig(live()).statsPath)
+      syncStatsStorage(live())
       await syncProviderState(live())
       return parsed
     },
@@ -122,7 +188,7 @@ export function apply(ctx, config) {
         await svc.replace(NS, payload, rev)
       }
       applyConfigMutations(currentConfig, merged)
-      loadStats(publicConfig(live()).statsPath)
+      syncStatsStorage(live())
       await syncProviderState(live())
       return merged
     },
@@ -133,11 +199,10 @@ export function apply(ctx, config) {
     },
   }
 
-  loadStats(publicConfig(live()).statsPath)
   if (typeof ctx.effect === 'function') {
     ctx.effect(() => {
       return () => {
-        flushStats(publicConfig(live()).statsPath)
+        flushStats(activeStatsPath)
       }
     }, 'dsh-clinebot: stats-storage')
   }

package/lib/models.js

@@ -510,14 +510,20 @@ export function isVisionModel(id, dynamicModels = [], modelContextOverrides = []
 /**
  * Disk caching for discovered models.
  */
-export async function saveModelsDiskCache(cachePath, models = [], planSyncedAt = Date.now()) {
-  if (!cachePath || !Array.isArray(models) || !models.length) return false
+export async function saveModelsDiskCache(cachePath, models = [], planSyncedAt = Date.now(), options = {}) {
+  if (!cachePath || !Array.isArray(models)) return false
   try {
     const fs = await import('node:fs/promises')
     const path = await import('node:path')
     const dir = path.dirname(cachePath)
     await fs.mkdir(dir, { recursive: true })
-    const payload = JSON.stringify({ savedAt: Date.now(), planSyncedAt, models }, null, 2)
+    const payload = JSON.stringify({
+      savedAt: Date.now(),
+      planSyncedAt,
+      endpoint: options.endpoint || options.baseUrl || '',
+      accountRef: options.accountRef || options.accountId || options.apiKeyEnv || '',
+      models,
+    }, null, 2)
     await fs.writeFile(cachePath, payload, 'utf8')
     return true
   } catch {
@@ -525,7 +531,7 @@ export async function saveModelsDiskCache(cachePath, models = [], planSyncedAt =
   }
 }
 
-export async function loadModelsDiskCache(cachePath) {
+export async function loadModelsDiskCache(cachePath, options = {}) {
   if (!cachePath) return null
   try {
     const fs = await import('node:fs/promises')
@@ -533,6 +539,19 @@ export async function loadModelsDiskCache(cachePath) {
     const parsed = JSON.parse(raw)
     const rawList = Array.isArray(parsed?.models) ? parsed.models : (Array.isArray(parsed) ? parsed : null)
     if (!rawList) return null
+
+    const expectedEndpoint = options.endpoint || options.baseUrl
+    const expectedAccount = options.accountRef || options.accountId || options.apiKeyEnv
+    if (expectedEndpoint && parsed?.endpoint && parsed.endpoint !== expectedEndpoint) {
+      return null
+    }
+    if (expectedAccount && parsed?.accountRef && parsed.accountRef !== expectedAccount) {
+      return null
+    }
+    if ((expectedEndpoint || expectedAccount) && (!parsed?.endpoint || !parsed?.accountRef)) {
+      return null
+    }
+
     let hasObsolete = false
     const list = rawList.map((m) => {
       const migrated = migrateModelEntry(m)
@@ -540,8 +559,10 @@ export async function loadModelsDiskCache(cachePath) {
       return migrated
     })
     list.planSyncedAt = typeof parsed?.planSyncedAt === 'number' ? parsed.planSyncedAt : (typeof parsed?.savedAt === 'number' ? parsed.savedAt : 0)
+    list.endpoint = parsed?.endpoint
+    list.accountRef = parsed?.accountRef
     if (hasObsolete) {
-      saveModelsDiskCache(cachePath, list, list.planSyncedAt).catch(() => {})
+      saveModelsDiskCache(cachePath, list, list.planSyncedAt, options).catch(() => {})
     }
     return list
   } catch {

package/lib/provider-sync.js

@@ -293,34 +293,30 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
       await syncProviderState(next)
     }
 
-    if ((!pub.dynamicModels || !pub.dynamicModels.length) && cacheFile) {
-      const fromDisk = await loadModelsDiskCache(cacheFile)
-      if (Array.isArray(fromDisk) && fromDisk.length && settingsApi?.replace) {
-        const migratedDisk = fromDisk.map(migrateModelEntry)
-        const next = plainConfig(Config({
-          ...plainConfig(live()),
-          dynamicModels: migratedDisk,
-          planSyncedAt: fromDisk.planSyncedAt || Date.now(),
-        }))
-        await settingsApi.replace(next)
-        await syncProviderState(next)
-      }
-    }
-
     const activeAcc = await resolveActiveAccountKey(ctx, cfg)
     if (!activeAcc.value) return
 
-    const usageData = await fetchUsageLimits(pub.baseUrl, activeAcc.value, {
-      timeoutMs: Math.min(pub.timeoutMs, 5000),
-      bypassCache: true,
-    })
+    const cacheIdentity = {
+      endpoint: pub.baseUrl,
+      accountRef: activeAcc.envName || activeAcc.id || pub.apiKeyEnv,
+    }
+
+    let usageData = null
+    try {
+      usageData = await fetchUsageLimits(pub.baseUrl, activeAcc.value, {
+        timeoutMs: Math.min(pub.timeoutMs, 5000),
+        bypassCache: true,
+      })
+    } catch {
+      usageData = null
+    }
 
     if (usageData?.ok && Array.isArray(usageData.dynamicModels)) {
       const existingDynamic = pub.dynamicModels || []
       const isDifferent = isCatalogDifferent(existingDynamic, usageData.dynamicModels)
+      const now = Date.now()
 
       if (isDifferent && settingsApi?.replace) {
-        const now = Date.now()
         const next = plainConfig(Config({
           ...plainConfig(live()),
           dynamicModels: usageData.dynamicModels,
@@ -328,9 +324,24 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
         }))
         await settingsApi.replace(next)
         await syncProviderState(next)
-        if (cacheFile) {
-          await saveModelsDiskCache(cacheFile, usageData.dynamicModels, now)
-        }
+      }
+      if (cacheFile) {
+        await saveModelsDiskCache(cacheFile, usageData.dynamicModels, now, cacheIdentity)
+      }
+      return
+    }
+
+    if ((!pub.dynamicModels || !pub.dynamicModels.length) && cacheFile) {
+      const fromDisk = await loadModelsDiskCache(cacheFile, cacheIdentity)
+      if (Array.isArray(fromDisk) && fromDisk.length && settingsApi?.replace) {
+        const migratedDisk = fromDisk.map(migrateModelEntry)
+        const next = plainConfig(Config({
+          ...plainConfig(live()),
+          dynamicModels: migratedDisk,
+          planSyncedAt: 0,
+        }))
+        await settingsApi.replace(next)
+        await syncProviderState(next)
       }
     }
   } catch {

package/lib/routes/accounts.js

@@ -155,20 +155,30 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
       const existingAccounts = Array.isArray(curr.accounts) ? curr.accounts : []
       const accountToDelete = existingAccounts.find((a) => a && a.apiKeyEnv === targetEnv)
       if (!accountToDelete) {
-        return writeJson(res, 404, {
-          ok: false,
-          error: `Account "${targetEnv}" not found in accounts pool`,
-        })
-      }
-
-      if (body.deleteSecret) {
-        const delRes = await deleteCredentialKey(ctx, targetEnv)
-        if (!delRes || !delRes.ok) {
+        if (body.deleteSecret && ctx?.get?.('credentials')) {
+          let retryDelRes = null
+          try {
+            retryDelRes = await deleteCredentialKey(ctx, targetEnv)
+          } catch {
+            retryDelRes = null
+          }
+          if (retryDelRes && retryDelRes.ok) {
+            clearUsageCache()
+            clearProbeCache()
+            return writeJson(res, 200, { ok: true, removed: targetEnv, secretDeleted: true })
+          }
           return writeJson(res, 500, {
             ok: false,
-            error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
+            partial: true,
+            accountRemoved: true,
+            secretDeleted: false,
+            error: `Failed to delete secret for account "${targetEnv}" from credentials store on retry`,
           })
         }
+        return writeJson(res, 404, {
+          ok: false,
+          error: `Account "${targetEnv}" not found in accounts pool`,
+        })
       }
 
       const nextAccounts = existingAccounts.filter((a) => a && a.apiKeyEnv !== targetEnv)
@@ -177,10 +187,58 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
         activeAccount = ''
       }
 
+      // Persist settings changes first before unsetting credentials (#184)
       const next = plainConfig(Config({ ...curr, accounts: nextAccounts, activeAccount }))
       await settingsApi.replace(next)
       await syncProviderState(next)
 
+      if (body.deleteSecret) {
+        let delRes = null
+        try {
+          delRes = await deleteCredentialKey(ctx, targetEnv)
+        } catch {
+          delRes = null
+        }
+        if (!delRes || !delRes.ok) {
+          let rollbackSuccess = false
+          try {
+            const fresh = plainConfig(live())
+            const freshAccounts = Array.isArray(fresh.accounts) ? [...fresh.accounts] : []
+            if (!freshAccounts.some((a) => a && a.apiKeyEnv === targetEnv)) {
+              freshAccounts.push(accountToDelete)
+            }
+            const restoredConfig = plainConfig(Config({
+              ...fresh,
+              accounts: freshAccounts,
+              activeAccount: curr.activeAccount === targetEnv ? targetEnv : fresh.activeAccount,
+            }))
+            await settingsApi.replace(restoredConfig)
+            await syncProviderState(restoredConfig)
+            rollbackSuccess = true
+          } catch {
+            rollbackSuccess = false
+          }
+
+          if (rollbackSuccess) {
+            return writeJson(res, 500, {
+              ok: false,
+              partial: false,
+              accountRemoved: false,
+              secretDeleted: false,
+              error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
+            })
+          }
+
+          return writeJson(res, 500, {
+            ok: false,
+            partial: true,
+            accountRemoved: true,
+            secretDeleted: false,
+            error: `Failed to delete secret for account "${targetEnv}" from credentials store`,
+          })
+        }
+      }
+
       clearUsageCache()
       clearProbeCache()
 
@@ -222,7 +280,13 @@ export function registerAccountsRoutes(ctx, { live, getSettingsApi, syncProvider
           return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
         }
 
-        const next = plainConfig(Config({ ...plainConfig(live()), activeAccount: account }))
+        const currentLive = plainConfig(live())
+        const accountChanged = currentLive.activeAccount !== account
+        const next = plainConfig(Config({
+          ...currentLive,
+          activeAccount: account,
+          ...(accountChanged ? { dynamicModels: [], planSyncedAt: 0 } : {}),
+        }))
         await settingsApi.replace(next)
         await syncProviderState(next)
         writeJson(res, 200, { ok: true, activeAccount: account })

package/lib/routes/models.js

@@ -49,7 +49,12 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         await syncProviderState(next)
         const cacheFile = resolvePathWithHome(pub.modelsCachePath)
         if (cacheFile) {
-          await saveModelsDiskCache(cacheFile, dynamicModels, now)
+          const activeAcc = await resolveActiveAccountKey(ctx, live())
+          const accountRef = activeAcc?.envName || activeAcc?.apiKeyEnv || pub.activeAccount || pub.apiKeyEnv || 'CLINEBOT_API_KEY'
+          await saveModelsDiskCache(cacheFile, dynamicModels, now, {
+            endpoint: pub.baseUrl,
+            accountRef,
+          })
         }
 
         return writeJson(res, 200, {

package/lib/routes/proxy.js

@@ -112,11 +112,17 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         req.headers['x-client-request-id'] ||
         body?.session_id ||
         body?.conversation_id ||
+        body?.prompt_cache_key ||
         body?.chat_id ||
         body?.user ||
         ''
       ).trim()
 
+      if (sessionId) {
+        if (!body.session_id) body.session_id = sessionId
+        if (!body.conversation_id) body.conversation_id = sessionId
+      }
+
       // Ensure model is set, fallback to defaultModel (#140)
       body.model = String(body.model || pub.defaultModel || DEFAULT_MODEL_ID).trim()
 
@@ -192,13 +198,15 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
         const streamIdleTimeoutMs = Math.max(50, Number(pub.streamIdleTimeoutMs || pub.idleTimeoutMs) || 30000)
 
         const connectAbortCtrl = new AbortController()
+        const bodyAbortCtrl = new AbortController()
         let connectTimedOut = false
+        let bodyTimedOut = false
         const connectTimer = setTimeout(() => {
           connectTimedOut = true
           connectAbortCtrl.abort(new Error(`Upstream connect timeout after ${connectTimeoutMs}ms`))
         }, connectTimeoutMs)
 
-        const fetchSignal = AbortSignal.any([clientAbortCtrl.signal, connectAbortCtrl.signal])
+        const fetchSignal = AbortSignal.any([clientAbortCtrl.signal, connectAbortCtrl.signal, bodyAbortCtrl.signal])
 
         let upstreamRes
         try {
@@ -404,8 +412,57 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
           return
         }
 
-        // Non-streaming JSON response
-        const resText = await upstreamRes.text().catch(() => '{}')
+        // Non-streaming JSON response with deadline and fail-closed error handling (#185)
+        const idleTimeoutMs = streamIdleTimeoutMs
+        let bodyTimer = null
+        const bodyTimeoutPromise = new Promise((_, reject) => {
+          bodyTimer = setTimeout(() => {
+            bodyTimedOut = true
+            bodyAbortCtrl.abort(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
+            reject(new Error(`Upstream body read timed out after ${idleTimeoutMs}ms`))
+          }, idleTimeoutMs)
+        })
+
+        let resText = ''
+        let readError = null
+        try {
+          resText = await Promise.race([
+            upstreamRes.text(),
+            bodyTimeoutPromise,
+          ])
+        } catch (err) {
+          readError = err
+        } finally {
+          clearTimeout(bodyTimer)
+        }
+
+        cleanupClientListeners()
+
+        if (clientAbortCtrl.signal.aborted || clientClosed) {
+          return
+        }
+
+        if (bodyTimedOut || readError) {
+          const isTimeout = bodyTimedOut || bodyAbortCtrl.signal.aborted
+          recordUsage({
+            model: body.model,
+            accountId: targetAccount.id || targetAccount.label,
+            isError: true,
+            statsPath: pub.statsPath
+          })
+          const statusCode = isTimeout ? 504 : 502
+          const errMessage = isTimeout
+            ? `Gateway Timeout: upstream body read timed out after ${idleTimeoutMs}ms`
+            : `Bad Gateway: upstream response body read error: ${readError?.message || readError}`
+          return writeJson(res, statusCode, {
+            error: {
+              message: errMessage,
+              type: isTimeout ? 'gateway_timeout' : 'bad_gateway',
+              code: isTimeout ? 'body_read_timeout' : 'body_read_error'
+            }
+          })
+        }
+
         let resJson = null
         try {
           resJson = JSON.parse(resText)
@@ -413,7 +470,6 @@ export function registerProxyRoutes(ctx, { live, getSettingsApi, syncProviderSta
           resJson = null
         }
 
-        cleanupClientListeners()
         recordUsage({
           model: body.model,
           accountId: targetAccount.id || targetAccount.label,

package/lib/session-router.js

@@ -205,6 +205,11 @@ export function resolveSessionAccount(sessionId, accounts = [], defaultActiveId
     }
   }
 
+  // Prune if needed before allocating a new session entry (#183)
+  if (!existing && sessions.size >= MAX_SESSIONS) {
+    pruneSessions(now, MAX_SESSIONS - 1, SESSION_TTL_MS)
+  }
+
   // If manual pin is configured and available:
   if (pinnedAvailable) {
     const reassigned = Boolean(existing && !matchesAccount(pinnedAvailable, existing.accountId))
@@ -230,11 +235,6 @@ export function resolveSessionAccount(sessionId, accounts = [], defaultActiveId
     // Otherwise, failover is needed
   }
 
-  // Prune if needed
-  if (!existing && sessions.size >= MAX_SESSIONS) {
-    pruneSessions(now, MAX_SESSIONS - 1, SESSION_TTL_MS)
-  }
-
   // Pick least-used available account
   const chosen = selectLeastUsedAccount(safeAccounts) || safeAccounts[0]
   if (chosen) {

package/lib/stats-storage.js

@@ -119,6 +119,26 @@ export function loadStats(customPath) {
   return inMemoryStats
 }
 
+/**
+ * Switch active stats storage to a new path.
+ * Flushes pending writes of current storage and loads stats from the new path.
+ *
+ * @param {string} newPath
+ * @returns {string} active stats path
+ */
+export function switchStatsStorage(newPath) {
+  const resolved = resolvePath(newPath)
+  if (resolved && resolved !== activeStatsPath) {
+    if (activeStatsPath) {
+      flushStats(activeStatsPath)
+    }
+    activeStatsPath = resolved
+    loadStats(resolved)
+  }
+  return activeStatsPath
+}
+
+
 /**
  * Flush any debounced pending writes immediately to disk.
  *
@@ -201,6 +221,9 @@ export function recordUsage({
   is429 = false,
   statsPath
 } = {}) {
+  if (statsPath) {
+    switchStatsStorage(statsPath)
+  }
   const now = new Date()
   const dayKey = now.toISOString().slice(0, 10) // 'YYYY-MM-DD'
   const monthKey = dayKey.slice(0, 7) // 'YYYY-MM'

package/lib/updater.js

@@ -253,6 +253,7 @@ export async function installExact(target, packageSpec, options = {}) {
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],
       env: { ...process.env, NO_COLOR: '1' },
+      detached: options.detached !== undefined ? options.detached : process.platform !== 'win32',
     })
     let detail = ''
     child.stdout?.on('data', (chunk) => { detail = (detail + String(chunk)).slice(-4000) })
@@ -263,6 +264,16 @@ export async function installExact(target, packageSpec, options = {}) {
     let sigtermTimer = null
     let sigkillTimer = null
 
+    function isProcessGroupAlive(pid) {
+      if (typeof pid !== 'number' || pid <= 0 || process.platform === 'win32') return false
+      try {
+        process.kill(-pid, 0)
+        return true
+      } catch {
+        return false
+      }
+    }
+
     function cleanupTimers() {
       clearTimeout(mainTimer)
       if (sigtermTimer) clearTimeout(sigtermTimer)
@@ -271,16 +282,26 @@ export async function installExact(target, packageSpec, options = {}) {
 
     function onProcessExit(code, signal) {
       if (exited) return
-      exited = true
-      cleanupTimers()
 
       if (isTimedOut) {
+        if (isProcessGroupAlive(child.pid)) {
+          // Parent exited, but descendants in process group are still alive;
+          // keep escalation timer active (#172)
+          clearTimeout(mainTimer)
+          return
+        }
+        exited = true
+        cleanupTimers()
         cleanStaleLock(target.profileDir)
         reject(new Error('Update timed out.'))
-      } else if (code === 0) {
-        resolvePromise()
       } else {
-        reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+        exited = true
+        cleanupTimers()
+        if (code === 0) {
+          resolvePromise()
+        } else {
+          reject(new Error(detail.trim() || `Update exited with code ${String(code)}.`))
+        }
       }
     }
 
@@ -292,33 +313,48 @@ export async function installExact(target, packageSpec, options = {}) {
     child.once('exit', onProcessExit)
     child.once('close', onProcessExit)
 
+    function killProcessTree(sig) {
+      if (!child) return
+      if (typeof child.pid === 'number' && child.pid > 0 && process.platform !== 'win32') {
+        try {
+          process.kill(-child.pid, sig)
+        } catch {
+          /* process group might not exist or already terminated */
+        }
+      }
+      try {
+        child.kill(sig)
+      } catch {
+        /* ignore if already dead */
+      }
+    }
+
     const mainTimer = setTimeout(() => {
       isTimedOut = true
       // Step 1: Send SIGTERM
-      try {
-        child.kill('SIGTERM')
-      } catch (err) {
-        /* ignore if process already terminated */
-      }
+      killProcessTree('SIGTERM')
 
       // Step 2: Wait for grace period, if process has not exited escalate to SIGKILL (#172)
       sigtermTimer = setTimeout(() => {
-        const hasExited = exited || (child.exitCode !== null && child.exitCode !== undefined) || (child.signalCode !== null && child.signalCode !== undefined)
-        if (!hasExited) {
-          try {
-            child.kill('SIGKILL')
-          } catch (err) {
-            /* ignore if process already terminated */
-          }
+        const groupAlive = isProcessGroupAlive(child.pid)
+        const parentExited = (child.exitCode !== null && child.exitCode !== undefined) || (child.signalCode !== null && child.signalCode !== undefined)
+        if (!parentExited || groupAlive) {
+          killProcessTree('SIGKILL')
 
           // Step 3: Hard deadline for exit notification
           sigkillTimer = setTimeout(() => {
             if (!exited) {
               exited = true
+              cleanupTimers()
               cleanStaleLock(target.profileDir)
               reject(new Error('Update timed out.'))
             }
-          }, sigkillGraceMs)
+          }, Math.min(sigkillGraceMs, 50))
+        } else if (!exited) {
+          exited = true
+          cleanupTimers()
+          cleanStaleLock(target.profileDir)
+          reject(new Error('Update timed out.'))
         }
       }, sigtermGraceMs)
     }, timeoutMs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.5.9",
+  "version": "0.5.11",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",