@goodandready/dsh-clinebot 0.6.12 → 0.6.14

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.14] - 2026-10-21
+
+### Fixed
+- **Settings source gate**: remote clients can no longer pass by spoofing `Sec-Fetch-Site`; `X-Forwarded-Host` is trusted only from a loopback reverse proxy. Added regression cases for both bypasses.
+- **Theme regression**: replaced 58 hardcoded colors in the client stylesheet with DSH theme tokens and `color-mix`, restoring light/dark compatibility and matching `DESIGN.md`.
+
+### Changed
+- Extracted attempt telemetry into `lib/adapter-telemetry.js`; `lib/adapter.js` is back under the 600-line budget.
+- The decomposition test now scans every server module instead of a hand-maintained allowlist.
+
+### Removed
+- Dead/test-only exports `clearAccountEvents`, `getDiscoveredKey` and `clearDiscoveredKeysCache` (with tests adjusted to the production API).
+- Annotated intentional best-effort catches and removed stale `.tgz` artifacts from the workspace.
+
+## [0.6.13] - 2026-10-21
+
+### Added
+- **Automatic price refresh for new models**: model sync and auto-discovery compare the newly added IDs with the public catalog and fetch models.dev only when coverage is missing. Repeated misses are throttled, and the model-sync response includes a `priceSync` summary.
+
 ## [0.6.12] - 2026-10-21
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.12</b> adds model/account/error filters and a custom date range to analytics. Chat runs on the native <code>ctx.llm</code> adapter and requires DSH <code>0.2.1-rc.2</code>; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.14</b> hardens the settings source gate, restores token-only theming and cleans up the audit findings. Chat runs on the native <code>ctx.llm</code> adapter and requires DSH <code>0.2.1-rc.2</code>; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.12</b> добавляет фильтры аналитики по модели, аккаунту и ошибкам, а также произвольный диапазон дат. Чат работает через нативный адаптер <code>ctx.llm</code>, требуется DSH <code>0.2.1-rc.2</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.14</b> закрывает находки аудита: усилен source gate настроек, тема снова использует только токены DSH, мёртвый код и артефакты убраны. Чат работает через нативный адаптер <code>ctx.llm</code>, требуется DSH <code>0.2.1-rc.2</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.12</b> 为分析添加模型/账户/错误筛选和自定义日期范围。聊天使用原生 <code>ctx.llm</code> 适配器，需要 DSH <code>0.2.1-rc.2</code>；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.14</b> 修复审计发现：加固设置 source gate，恢复仅使用 DSH 主题令牌的样式，并清理死代码和残留文件。聊天使用原生 <code>ctx.llm</code> 适配器，需要 DSH <code>0.2.1-rc.2</code>；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/lib/account-events.js

@@ -79,7 +79,3 @@ export function flushAccountEvents() {
   }
 }
 
-export function clearAccountEvents() {
-  events = []
-  flushAccountEvents()
-}

package/lib/adapter-telemetry.js

@@ -0,0 +1,74 @@
+import { estimateCost } from './model-prices.js'
+import { recordSessionRequest } from './telemetry.js'
+import { recordUsage } from './stats-storage.js'
+
+/**
+ * Record one attempt's session and persistent telemetry.
+ * Kept out of adapter.js so the adapter stays within the decomposition budget.
+ */
+export function recordAttemptTelemetry({
+  pub,
+  accountId,
+  model,
+  usage,
+  isError,
+  is429 = false,
+  ttftMs,
+  latencyMs,
+  aborted = false,
+  options,
+}) {
+  const promptTokens = Number(usage?.promptTokens || 0)
+  const completionTokens = Number(usage?.completionTokens || 0)
+  const reasoningTokens = Number(usage?.reasoningTokens || 0)
+  const totalTokens = Number(usage?.totalTokens || (promptTokens + completionTokens))
+  const cost = estimateCost({
+    model,
+    promptTokens,
+    completionTokens,
+    reasoningTokens,
+    cacheReadTokens: usage?.cacheReadTokens,
+    cacheWriteTokens: usage?.cacheWriteTokens,
+    overrides: pub.priceOverrides || {},
+  })
+
+  try {
+    recordSessionRequest({
+      latencyMs,
+      ok: !isError,
+      aborted,
+      promptTokens,
+      completionTokens,
+      reasoningTokens,
+      model,
+      ...(isError ? { error: is429 ? 'rate limit' : 'stream error' } : {}),
+    })
+  } catch {
+    /* telemetry must never break inference */
+  }
+
+  try {
+    recordUsage({
+      model,
+      accountId,
+      promptTokens,
+      completionTokens,
+      reasoningTokens,
+      totalTokens,
+      isError,
+      is429,
+      statsPath: pub.statsPath,
+      sessionId: options.sessionId ? String(options.sessionId) : undefined,
+      purpose: options.purpose,
+      ttftMs: ttftMs ?? undefined,
+      latencyMs,
+      cacheReadTokens: usage?.cacheReadTokens,
+      cacheWriteTokens: usage?.cacheWriteTokens,
+      cacheSavingsUsd: cost.cacheSavingsUsd,
+      costUsd: cost.usd,
+      priced: cost.priced,
+    })
+  } catch {
+    /* persistent telemetry is best-effort */
+  }
+}

package/lib/adapter.js

@@ -11,10 +11,9 @@ import { publicConfig } from './config.js'
 import { getAllModels, findModel, formatModelDescription } from './models.js'
 import { resolveAccountPool } from './account-pool.js'
 import { resolveSessionAccount, markAccountCooldown } from './session-router.js'
-import { recordSessionRequest } from './telemetry.js'
-import { recordUsage, getBudgetSpend } from './stats-storage.js'
+import { recordAttemptTelemetry } from './adapter-telemetry.js'
+import { getBudgetSpend } from './stats-storage.js'
 import { budgetStatus, budgetErrorMessage } from './budget.js'
-import { estimateCost } from './model-prices.js'
 import { buildOpenAiPayload } from './adapter-messages.js'
 import { streamJsonCompletion, streamOpenAiChunks } from './adapter-stream.js'
 import {
@@ -549,72 +548,8 @@ export class ClineBotAdapter extends LlmAdapter {
    *   options: Record<string, unknown>,
    * }} entry
    */
-  recordAttempt({
-    pub,
-    accountId,
-    model,
-    usage,
-    isError,
-    is429 = false,
-    ttftMs,
-    latencyMs,
-    aborted = false,
-    options,
-  }) {
-    const promptTokens = Number(usage?.promptTokens || 0)
-    const completionTokens = Number(usage?.completionTokens || 0)
-    const reasoningTokens = Number(usage?.reasoningTokens || 0)
-    const totalTokens = Number(usage?.totalTokens || (promptTokens + completionTokens))
-    const cost = estimateCost({
-      model,
-      promptTokens,
-      completionTokens,
-      reasoningTokens,
-      cacheReadTokens: usage?.cacheReadTokens,
-      cacheWriteTokens: usage?.cacheWriteTokens,
-      overrides: pub.priceOverrides || {},
-    })
-
-    try {
-      recordSessionRequest({
-        latencyMs,
-        ok: !isError,
-        aborted,
-        promptTokens,
-        completionTokens,
-        reasoningTokens,
-        model,
-        ...(isError ? { error: is429 ? 'rate limit' : 'stream error' } : {}),
-      })
-    } catch {
-      /* telemetry must never break inference */
-    }
-
-    try {
-      recordUsage({
-        model,
-        accountId,
-        promptTokens,
-        completionTokens,
-        reasoningTokens,
-        totalTokens,
-        isError,
-        is429,
-        statsPath: pub.statsPath,
-        // Extended fields consumed by stats v2 once available.
-        sessionId: options.sessionId ? String(options.sessionId) : undefined,
-        purpose: options.purpose,
-        ttftMs: ttftMs ?? undefined,
-        latencyMs,
-        cacheReadTokens: usage?.cacheReadTokens,
-        cacheWriteTokens: usage?.cacheWriteTokens,
-        cacheSavingsUsd: cost.cacheSavingsUsd,
-        costUsd: cost.usd,
-        priced: cost.priced,
-      })
-    } catch {
-      /* persistent telemetry is best-effort */
-    }
+  recordAttempt(entry) {
+    recordAttemptTelemetry(entry)
   }
 }
 

package/lib/client.js

@@ -325,59 +325,58 @@ function ensureCss(){if(typeof document==="undefined")return;if(document.getElem
   .cb-analytics-head span:nth-child(4),.cb-analytics-head span:nth-child(5),.cb-analytics-row span:nth-child(4),.cb-analytics-row span:nth-child(5){display:none}
 }
 
-/* Opencode-inspired visual language: neutral rgba surfaces, 7-10px radii and
-   the same green/amber/red accents. Text still follows the harness theme. */
+/* OpenCode-inspired proportions, rendered exclusively with DSH theme tokens. */
 .cb-page{gap:14px;padding:4px 2px 24px}
 .cb-page-title{font-size:18px;font-weight:650;line-height:1.4}
 .cb-panel{max-width:760px;padding:18px}
-.cb-section-card,.cb-dialogCard,.cb-provider-card,.cb-progress-card,.cb-stat-box,.cb-account-add,.cb-discovered,.cb-update-banner,.cb-notice,.cb-savebar-inner,.cb-account-menu{border:1px solid rgba(127,127,127,.25);border-radius:10px;background:rgba(127,127,127,.06)}
+.cb-section-card,.cb-dialogCard,.cb-provider-card,.cb-progress-card,.cb-stat-box,.cb-account-add,.cb-discovered,.cb-update-banner,.cb-notice,.cb-savebar-inner,.cb-account-menu{border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1)}
 .cb-section-card,.cb-dialogCard{padding:12px 14px;gap:10px}
 .cb-section-title,.cb-settings-group-title{font-size:13px;font-weight:650;line-height:1.5}
 .cb-section-desc,.cb-settings-group-desc,.cb-settings-row-desc,.cb-hint{opacity:.72;line-height:1.5}
-.cb-input,.cb-select{height:auto;min-height:32px;padding:6px 8px;border:1px solid rgba(127,127,127,.35);border-radius:7px;background:rgba(127,127,127,.08);font-size:13px;line-height:1.4}
-.cb-input:focus,.cb-select:focus{border-color:rgba(80,140,255,.6);outline:2px solid rgba(80,140,255,.25);outline-offset:1px}
-.cb-btn{height:auto;min-height:30px;padding:6px 11px;border:1px solid rgba(127,127,127,.35);border-radius:7px;background:rgba(127,127,127,.1);font-size:13px;line-height:1.4}
-.cb-btn:hover:not(:disabled){background:rgba(127,127,127,.18)}
-.cb-btn-primary{border-color:rgba(80,140,255,.6);background:rgba(80,140,255,.18);color:inherit}
-.cb-btn-primary:hover:not(:disabled){background:rgba(80,140,255,.26)}
-.cb-btn-danger{border-color:rgba(220,80,80,.5);color:#e07a7a}
-.cb-badge{padding:2px 7px;border:1px solid rgba(127,127,127,.3);border-radius:999px;background:rgba(127,127,127,.1);font-size:11px;line-height:1.4}
-.cb-badge-ok{color:#4fbf86;border-color:rgba(60,180,110,.5);background:rgba(60,180,110,.10)}
-.cb-badge-warn{color:#d9a24a;border-color:rgba(220,160,60,.5);background:rgba(220,160,60,.10)}
-.cb-badge-bad{color:#e07a7a;border-color:rgba(220,80,80,.5);background:rgba(220,80,80,.10)}
+.cb-input,.cb-select{height:auto;min-height:32px;padding:6px 8px;border:1px solid var(--dsw-alias-border-l3);border-radius:7px;background:var(--dsw-alias-bg-layer-1);font-size:13px;line-height:1.4}
+.cb-input:focus,.cb-select:focus{border-color:var(--dsw-alias-brand-primary);outline:2px solid color-mix(in srgb,var(--dsw-alias-brand-primary) 25%,transparent);outline-offset:1px}
+.cb-btn{height:auto;min-height:30px;padding:6px 11px;border:1px solid var(--dsw-alias-border-l3);border-radius:7px;background:var(--dsw-alias-bg-layer-2);font-size:13px;line-height:1.4}
+.cb-btn:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-active)}
+.cb-btn-primary{border-color:var(--dsw-alias-brand-primary);background:color-mix(in srgb,var(--dsw-alias-brand-primary) 18%,transparent);color:inherit}
+.cb-btn-primary:hover:not(:disabled){background:color-mix(in srgb,var(--dsw-alias-brand-primary) 26%,transparent)}
+.cb-btn-danger{border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 50%,transparent);color:var(--dsw-alias-state-error-primary)}
+.cb-badge{padding:2px 7px;border:1px solid var(--dsw-alias-border-l3);border-radius:999px;background:var(--dsw-alias-bg-layer-2);font-size:11px;line-height:1.4}
+.cb-badge-ok{color:var(--dsw-alias-state-success-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-success-primary) 50%,transparent);background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent)}
+.cb-badge-warn{color:var(--dsw-alias-state-warn-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 50%,transparent);background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 10%,transparent)}
+.cb-badge-bad{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 50%,transparent);background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent)}
 .cb-stat-box{padding:8px 10px;border-radius:8px}
 .cb-stat-val{font-size:15px;font-weight:600;line-height:1.4}
 .cb-stat-lbl{font-size:11px;line-height:1.5}
 .cb-table{font-size:12px}
-.cb-table th{padding:5px 8px;border-bottom:1px solid rgba(127,127,127,.18);font-size:11px;font-weight:600;opacity:.8}
-.cb-table td{padding:5px 8px;border-bottom:1px solid rgba(127,127,127,.18);font-size:12px}
-.cb-model-group td{padding:8px 8px 4px;color:var(--dsw-alias-label-secondary);font-size:11px;font-weight:650;background:rgba(127,127,127,.08)}
-.cb-progress-track,.cb-bar-track{height:8px;border-radius:999px;background:rgba(127,127,127,.2)}
-.cb-progress-bar-fill,.cb-bar-fill,.cb-footFill,.cb-meter-fill{background:#4fbf86}
-.cb-progress-bar-warn{background:#d9a24a}
-.cb-progress-bar-bad,.cb-footFillWarn,.cb-meter-fill-warn{background:#e07a7a}
-.cb-progress-meta-bad,.cb-progress-low,.cb-footPctWarn{color:#e07a7a}
-.cb-footBar,.cb-meter{background:rgba(127,127,127,.2)}
-.cb-account-tab,.cb-seg{border:1px solid rgba(127,127,127,.3);border-radius:999px;background:rgba(127,127,127,.1)}
+.cb-table th{padding:5px 8px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:11px;font-weight:600;opacity:.8}
+.cb-table td{padding:5px 8px;border-bottom:1px solid var(--dsw-alias-border-l2);font-size:12px}
+.cb-model-group td{padding:8px 8px 4px;color:var(--dsw-alias-label-secondary);font-size:11px;font-weight:650;background:var(--dsw-alias-bg-layer-2)}
+.cb-progress-track,.cb-bar-track{height:8px;border-radius:999px;background:var(--dsw-alias-bg-layer-2)}
+.cb-progress-bar-fill,.cb-bar-fill,.cb-footFill,.cb-meter-fill{background:var(--dsw-alias-state-success-primary)}
+.cb-progress-bar-warn{background:var(--dsw-alias-state-warn-primary)}
+.cb-progress-bar-bad,.cb-footFillWarn,.cb-meter-fill-warn{background:var(--dsw-alias-state-error-primary)}
+.cb-progress-meta-bad,.cb-progress-low,.cb-footPctWarn{color:var(--dsw-alias-state-error-primary)}
+.cb-footBar,.cb-meter{background:var(--dsw-alias-bg-layer-2)}
+.cb-account-tab,.cb-seg{border:1px solid var(--dsw-alias-border-l3);border-radius:999px;background:var(--dsw-alias-bg-layer-1)}
 .cb-seg{border-radius:7px;overflow:hidden}
-.cb-seg-item{border:0;border-left:1px solid rgba(127,127,127,.2);border-radius:0;background:transparent}
+.cb-seg-item{border:0;border-left:1px solid var(--dsw-alias-border-l2);border-radius:0;background:transparent}
 .cb-seg-item:first-child{border-left:0}
-.cb-seg-item-active,.cb-account-tab-active{border-color:rgba(80,140,255,.6);background:rgba(80,140,255,.18);color:inherit}
+.cb-seg-item-active,.cb-account-tab-active{border-color:var(--dsw-alias-brand-primary);background:color-mix(in srgb,var(--dsw-alias-brand-primary) 18%,transparent);color:inherit}
 .cb-tab{border:0;border-radius:0;background:transparent;border-bottom:1.5px solid transparent}
-.cb-tab-active{border-bottom-color:#4fbf86;background:transparent}
-.cb-heat-l0{background:rgba(127,127,127,.10)}
-.cb-heat-l1{background:rgba(79,191,134,.234)}
-.cb-heat-l2{background:rgba(79,191,134,.382)}
-.cb-heat-l3{background:rgba(79,191,134,.530)}
-.cb-heat-l4{background:rgba(79,191,134,.826)}
+.cb-tab-active{border-bottom-color:var(--dsw-alias-state-success-primary);background:transparent}
+.cb-heat-l0{background:var(--dsw-alias-bg-layer-2)}
+.cb-heat-l1{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 18%,var(--dsw-alias-bg-layer-2))}
+.cb-heat-l2{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 36%,var(--dsw-alias-bg-layer-2))}
+.cb-heat-l3{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 54%,var(--dsw-alias-bg-layer-2))}
+.cb-heat-l4{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 82%,var(--dsw-alias-bg-layer-2))}
 .cb-heat-cell,.cb-heat-swatch{border-radius:3px}
-.cb-analytics-head,.cb-analytics-row{padding:5px 0;border-bottom:1px solid rgba(127,127,127,.18)}
-.cb-settings-row,.cb-price-section{border-color:rgba(127,127,127,.18)}
-.cb-alert-ok{background:rgba(60,180,110,.10);color:#4fbf86}
-.cb-alert-bad,.cb-alert-err{background:rgba(220,80,80,.10);color:#e07a7a}
-.cb-banner-warning{background:rgba(220,160,60,.10);border-color:rgba(220,160,60,.5);color:#d9a24a}
-.cb-banner-exhausted{background:rgba(220,80,80,.10);border-color:rgba(220,80,80,.5);color:#e07a7a}
-.cb-account-route-row,.cb-model-row,.cb-preview,.cb-account-add{background:rgba(127,127,127,.06)}
+.cb-analytics-head,.cb-analytics-row{padding:5px 0;border-bottom:1px solid var(--dsw-alias-border-l2)}
+.cb-settings-row,.cb-price-section{border-color:var(--dsw-alias-border-l2)}
+.cb-alert-ok{background:color-mix(in srgb,var(--dsw-alias-state-success-primary) 10%,transparent);color:var(--dsw-alias-state-success-primary)}
+.cb-alert-bad,.cb-alert-err{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent);color:var(--dsw-alias-state-error-primary)}
+.cb-banner-warning{background:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 10%,transparent);border-color:color-mix(in srgb,var(--dsw-alias-state-warn-primary) 50%,transparent);color:var(--dsw-alias-state-warn-primary)}
+.cb-banner-exhausted{background:color-mix(in srgb,var(--dsw-alias-state-error-primary) 10%,transparent);border-color:color-mix(in srgb,var(--dsw-alias-state-error-primary) 50%,transparent);color:var(--dsw-alias-state-error-primary)}
+.cb-account-route-row,.cb-model-row,.cb-preview,.cb-account-add{background:var(--dsw-alias-bg-layer-1)}
 
 `;document.head.appendChild(style)}
 

package/lib/http.js

@@ -86,7 +86,11 @@ export function isTrustedSettingsRequest(request, ctx = null) {
     return false
   }
 
-  const host = header(request, 'x-forwarded-host') || header(request, 'host')
+  const remoteLoopback = isLoopbackAddress(request?.socket?.remoteAddress)
+  // A forwarding header is only trusted when the actual peer is the local
+  // reverse proxy; never trust it from a LAN/remote client.
+  const forwardedHost = header(request, 'x-forwarded-host')
+  const host = remoteLoopback ? (forwardedHost || header(request, 'host')) : header(request, 'host')
   const origin = header(request, 'origin')
   if (origin) {
     try {
@@ -94,7 +98,7 @@ export function isTrustedSettingsRequest(request, ctx = null) {
       if (host && url.host.toLowerCase() === host.toLowerCase()) {
         return true
       }
-      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+      if (isLoopbackAddress(url.hostname) && remoteLoopback) {
         return true
       }
       return false
@@ -110,7 +114,7 @@ export function isTrustedSettingsRequest(request, ctx = null) {
       if (host && url.host.toLowerCase() === host.toLowerCase()) {
         return true
       }
-      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+      if (isLoopbackAddress(url.hostname) && remoteLoopback) {
         return true
       }
       return false
@@ -119,17 +123,9 @@ export function isTrustedSettingsRequest(request, ctx = null) {
     }
   }
 
-  // Requests without origin/referer (e.g. curl or internal requests): allow if loopback
-  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
-    return true
-  }
-
-  // If sec-fetch-site is explicitly same-origin or same-site, allow
-  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
-    return true
-  }
-
-  return false
+  // Requests without origin/referer (e.g. curl or internal requests): allow if loopback.
+  // Sec-Fetch-Site alone is spoofable by non-browser clients and is not an auth signal.
+  return remoteLoopback
 }
 
 export function publicUsage(usage) {

package/lib/index.js

@@ -300,8 +300,8 @@ export function apply(ctx, config) {
           }])
         }
         ctx.effect(() => () => {
-          try { adapterDirectory?.() } catch {}
-          try { adapterRegistration?.() } catch {}
+          try { adapterDirectory?.() } catch { /* explicit best-effort fallback: non-fatal by design */ }
+          try { adapterRegistration?.() } catch { /* explicit best-effort fallback: non-fatal by design */ }
           adapterDirectory = null
           adapterRegistration = null
         }, 'dsh-clinebot: llm adapter')
@@ -383,7 +383,7 @@ export function apply(ctx, config) {
           const unreg = web.registerSearchProvider(CLINEBOT_SEARCH_PROVIDER_ID, searchProvider)
           if (typeof ctx.effect === 'function') {
             ctx.effect(() => () => {
-              try { if (typeof unreg === 'function') unreg() } catch {}
+              try { if (typeof unreg === 'function') unreg() } catch { /* explicit best-effort fallback: non-fatal by design */ }
             }, 'dsh-clinebot: web search provider')
           }
         } catch (e) {

package/lib/key-discovery.js

@@ -18,13 +18,6 @@ function cleanupExpired() {
   }
 }
 
-export function getDiscoveredKey(id) {
-  if (!id || typeof id !== 'string') return null
-  cleanupExpired()
-  const item = discoveredKeysCache.get(id)
-  return item?.key || null
-}
-
 export function consumeDiscoveredKey(id) {
   if (!id || typeof id !== 'string') return null
   cleanupExpired()
@@ -34,10 +27,6 @@ export function consumeDiscoveredKey(id) {
   return item.key
 }
 
-export function clearDiscoveredKeysCache() {
-  discoveredKeysCache.clear()
-}
-
 export function maskApiKey(key) {
   if (!key || typeof key !== 'string') return ''
   if (key.length <= 12) return '••••••••'
@@ -162,10 +151,10 @@ export function discoverLocalClineKeys() {
             const hits = scanFileForKeys(full, 'Cline CLI (~/.cline)')
             for (const h of hits) addKey(h)
           }
-        } catch {}
+        } catch { /* explicit best-effort fallback: non-fatal by design */ }
       }
     }
-  } catch {}
+  } catch { /* explicit best-effort fallback: non-fatal by design */ }
 
   return discovered
 }

package/lib/price-sync.js

@@ -1,7 +1,7 @@
 import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
-import { normalizeModelKey } from './model-prices.js'
+import { normalizeModelKey, getPublicPriceCatalog, setPublicPriceCatalog } from './model-prices.js'
 
 const DEFAULT_URL = 'https://models.dev/api.json'
 const PROVIDER_PRIORITY = {
@@ -79,6 +79,51 @@ export function loadPublicPriceCache(cachePath) {
   }
 }
 
+let lastMissingSignature = ''
+let lastAttemptAt = 0
+
+export function resetPriceSyncState() {
+  lastMissingSignature = ''
+  lastAttemptAt = 0
+}
+
+/**
+ * Refresh the public catalog only when one of the active models is missing.
+ * A repeated missing set is retried at most once per interval, so an unknown
+ * custom model cannot hammer models.dev on every sync.
+ */
+export async function ensurePublicPricesForModels(modelIds, {
+  url = DEFAULT_URL,
+  cachePath = '~/.dsh/clinebot-prices.json',
+  fetchImpl,
+  timeoutMs = 8000,
+  minIntervalMs = 6 * 60 * 60 * 1000,
+  now = Date.now(),
+} = {}) {
+  const ids = [...new Set((Array.isArray(modelIds) ? modelIds : []).map((id) => String(id || '').trim()).filter(Boolean))]
+  const missing = ids.filter((id) => !getPublicPriceCatalog()[normalizeModelKey(id)])
+  if (missing.length === 0) return { synced: false, missing: [], count: 0 }
+  if (!fetchImpl && process.env.CLINEBOT_DISABLE_PRICE_AUTOSYNC === '1') {
+    return { synced: false, skipped: true, missing, count: 0 }
+  }
+  const signature = missing.slice().sort().join('|')
+  if (signature === lastMissingSignature && now - lastAttemptAt < minIntervalMs) {
+    return { synced: false, skipped: true, missing, count: 0 }
+  }
+  lastMissingSignature = signature
+  lastAttemptAt = now
+  const result = await syncPublicPrices({ url, cachePath, fetchImpl, timeoutMs })
+  setPublicPriceCatalog(result.catalog)
+  const stillMissing = ids.filter((id) => !result.catalog[normalizeModelKey(id)])
+  return {
+    synced: true,
+    count: result.count,
+    syncedAt: result.syncedAt,
+    source: result.source,
+    missing: stillMissing,
+  }
+}
+
 /**
  * Fetch and cache the public catalog. The caller owns applying it to
  * model-prices; keeping that side effect out of this helper makes it testable.

package/lib/provider-sync.js

@@ -11,6 +11,7 @@ import {
   migrateModelEntry,
   isCatalogDifferent,
 } from './models.js'
+import { ensurePublicPricesForModels } from './price-sync.js'
 import {
   probeHealth,
   fetchUsageLimits,
@@ -243,6 +244,12 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
       if (cacheFile) {
         await saveModelsDiskCache(cacheFile, usageData.dynamicModels, now, cacheIdentity)
       }
+      if (isDifferent) {
+        await ensurePublicPricesForModels(usageData.dynamicModels.map((model) => model.id), {
+          url: pub.priceCatalogUrl,
+          cachePath: pub.priceCatalogPath,
+        }).catch(() => {})
+      }
       return
     }
 

package/lib/routes/models.js

@@ -5,6 +5,7 @@ import { resolveActiveAccountKey, resolvePathWithHome } from '../provider-sync.j
 import { getAllModels, saveModelsDiskCache, getOriginalModelContext, getOriginalModelMaxTokens } from '../models.js'
 import { fetchUsageLimits, smokeChat } from '../cline-client.js'
 import { publicUsage } from '../http.js'
+import { ensurePublicPricesForModels } from '../price-sync.js'
 
 export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // POST /dsh-clinebot/models/sync — dynamically load models from plan
@@ -39,6 +40,8 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           return writeJson(res, 503, { ok: false, error: 'Settings service unavailable or read-only' })
         }
 
+        const previousIds = new Set((pub.dynamicModels || []).map((model) => model?.id).filter(Boolean))
+        const addedModels = dynamicModels.filter((model) => model?.id && !previousIds.has(model.id))
         const now = Date.now()
         const next = plainConfig(Config({
           ...plainConfig(live()),
@@ -57,12 +60,25 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           })
         }
 
+        let priceSync = null
+        if (addedModels.length > 0) {
+          try {
+            priceSync = await ensurePublicPricesForModels(addedModels.map((model) => model.id), {
+              url: pub.priceCatalogUrl,
+              cachePath: pub.priceCatalogPath,
+            })
+          } catch {
+            /* price catalog refresh is best-effort */
+          }
+        }
+
         return writeJson(res, 200, {
           ok: true,
           plan: usageData.plan,
           discoveredCount: dynamicModels.length,
           totalModelsCount: allModels.length,
           models: allModels,
+          priceSync,
         })
       } catch (err) {
         return writeJson(res, 500, { ok: false, error: String(err?.message || err) })

package/lib/routes/settings.js

@@ -280,7 +280,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
         let query = {}
         try {
           query = Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries())
-        } catch {}
+        } catch { /* explicit best-effort fallback: non-fatal by design */ }
         const parseTime = (value) => {
           if (value === undefined || value === '') return undefined
           const numeric = Number(value)

package/lib/stats-storage.js

@@ -154,10 +154,10 @@ export function loadStats(customPath) {
         const existing = readdirSync(dir).filter((name) => name.startsWith(prefix)).sort()
         while (existing.length > 3) {
           const oldest = existing.shift()
-          try { unlinkSync(path.join(dir, oldest)) } catch {}
+          try { unlinkSync(path.join(dir, oldest)) } catch { /* explicit best-effort fallback: non-fatal by design */ }
         }
       }
-    } catch {}
+    } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
   inMemoryStats = createEmptyStats()
   pruneRetentionOnStats(inMemoryStats, statsRetentionDays)
@@ -202,7 +202,7 @@ function queueSaveStats(customPath, debounceMs = 500) {
   if (saveTimer) clearTimeout(saveTimer)
   saveTimer = setTimeout(() => {
     saveTimer = null
-    try { saveStatsSync(customPath) } catch {}
+    try { saveStatsSync(customPath) } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }, debounceMs)
 }
 

package/lib/transport/cline-transport.js

@@ -9,7 +9,7 @@
 import { createRequire } from 'node:module'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.12'
+let packageVersion = '0.6.14'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {
@@ -144,7 +144,7 @@ export async function readResponseText(response, { maxBytes = DEFAULT_MAX_BODY_B
     out += decoder.decode()
     return out
   } finally {
-    try { reader.releaseLock() } catch {}
+    try { reader.releaseLock() } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
 }
 
@@ -285,7 +285,7 @@ export async function* readSseEvents(response, {
   try {
     while (true) {
       if (signal?.aborted) {
-        try { await reader.cancel('aborted') } catch {}
+        try { await reader.cancel('aborted') } catch { /* explicit best-effort fallback: non-fatal by design */ }
         throw abortError()
       }
       const { done, value } = await readWithIdle()
@@ -305,10 +305,10 @@ export async function* readSseEvents(response, {
     const tail = parseSseBlock(buffer)
     if (tail !== undefined) yield tail
   } catch (error) {
-    try { await reader.cancel(error?.message || 'stream error') } catch {}
+    try { await reader.cancel(error?.message || 'stream error') } catch { /* explicit best-effort fallback: non-fatal by design */ }
     if (signal?.aborted) throw abortError()
     throw error
   } finally {
-    try { reader.releaseLock() } catch {}
+    try { reader.releaseLock() } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
 }

package/lib/tui-settings.js

@@ -184,7 +184,7 @@ export function applyTuiSettings(ctx, { live }) {
       const dispose = service.register(buildTuiSection({ live }))
       if (typeof ctx.effect === 'function') {
         ctx.effect(() => () => {
-          try { dispose() } catch {}
+          try { dispose() } catch { /* explicit best-effort fallback: non-fatal by design */ }
         }, 'dsh-clinebot: tui settings')
       }
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.12",
+  "version": "0.6.14",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",