@goodandready/dsh-clinebot 0.6.13 → 0.6.15

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.15] - 2026-10-21
+
+### Added
+- **Multimodal budgeting** (#257): the adapter now runs `optimizePromptCacheAndBudget`, honors `offloadSeenImages` and `maxPayloadMb`, and records `offloadedImages` in session telemetry.
+- **Model controls** (#258): per-model **Ping** calls `POST /models/probe` and shows TTFT; **Apply visibility** calls `POST /models/visible`.
+- **Price auto-sync switch** (#259): `priceAutoSync` is available in settings and the price card, and is documented in all three READMEs.
+
+### Fixed
+- **Write-route source gate** (#261): POST/PUT without `Origin`/`Referer` are rejected fail-closed, closing the dsh-lanmode loopback-bridge write bypass.
+- Removed test-only exports (`getDefaultModelIds`, `resetPriceSyncState`, `clearAccountCooldown`, `releaseSession`) and wired `configReader` into the host path.
+- Added `.gitattributes` (`* text=auto eol=lf`) and normalized tracked files.
+
+## [0.6.14] - 2026-10-21
+
+### Fixed
+- **Settings source gate**: remote clients can no longer pass by spoofing `Sec-Fetch-Site`; `X-Forwarded-Host` is trusted only from a loopback reverse proxy. Added regression cases for both bypasses.
+- **Theme regression**: replaced 58 hardcoded colors in the client stylesheet with DSH theme tokens and `color-mix`, restoring light/dark compatibility and matching `DESIGN.md`.
+
+### Changed
+- Extracted attempt telemetry into `lib/adapter-telemetry.js`; `lib/adapter.js` is back under the 600-line budget.
+- The decomposition test now scans every server module instead of a hand-maintained allowlist.
+
+### Removed
+- Dead/test-only exports `clearAccountEvents`, `getDiscoveredKey` and `clearDiscoveredKeysCache` (with tests adjusted to the production API).
+- Annotated intentional best-effort catches and removed stale `.tgz` artifacts from the workspace.
+
 ## [0.6.13] - 2026-10-21
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.13</b> automatically refreshes public prices when new models appear. Chat runs on the native <code>ctx.llm</code> adapter and requires DSH <code>0.2.1-rc.2</code>; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.15</b> connects multimodal budgeting, exposes model probe/visibility controls, adds the price auto-sync switch and closes the remaining audit hygiene/security findings. Chat runs on the native <code>ctx.llm</code> adapter and requires DSH <code>0.2.1-rc.2</code>; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
@@ -122,7 +122,11 @@ graph LR
 * **`lib/models.js`**:
   Dynamic subscription catalogue, curated fallback properties, reasoning efforts, custom models and plan parsing (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
 * **`lib/model-prices.js`**:
-  Explicit local cost estimates with per-model overrides. Unknown models stay `unpriced` instead of being reported as $0.
+  Explicit local cost estimates with per-model overrides. Unknown models stay `unpriced` instead of being reported as $0. When a newly discovered model has no price, the optional `priceAutoSync` setting fetches the public models.dev catalog (at most once per missing set every 6 hours); turn it off in the price card or set `priceAutoSync: false` while keeping the manual Sync button.
+* **`lib/multimodal-budget.js`**:
+  Offloads images from earlier turns into stable text placeholders and enforces `maxPayloadMb`, reducing prompt-cache churn and oversized ClinePass requests. `offloadedImages` is included in session telemetry.
+* **Model tools in Settings → ClineBot → Models**:
+  The per-model **Ping** button calls `POST /models/probe` and shows TTFT; **Apply visibility** calls `POST /models/visible` after choosing the visible models and plan-only filter.
 * **`lib/stats-storage.js`**:
   Persistent JSON telemetry v2: cache buckets, estimated cost, TTFT/latency, sessions and day/month/model/account aggregates. v1 files upgrade on read.
 * **`lib/account-pool.js` / `lib/session-router.js`**:
@@ -199,6 +203,7 @@ dsh-clinebot:
   statsPath: ~/.dsh/clinebot-stats.json
   priceCatalogUrl: https://models.dev/api.json
   priceCatalogPath: ~/.dsh/clinebot-prices.json
+  priceAutoSync: true
   eventLogPath: ~/.dsh/clinebot-events.json
   statsRetentionDays: 95
   dailyBudgetUsd: 0
@@ -226,6 +231,7 @@ dsh-clinebot:
 | `statsPath` | `string` | `"~/.dsh/clinebot-stats.json"` | Persistent on-disk path for token usage analytics |
 | `priceCatalogUrl` | `string` | `"https://models.dev/api.json"` | Public price catalog used by the optional sync |
 | `priceCatalogPath` | `string` | `"~/.dsh/clinebot-prices.json"` | Local cache for the public price catalog |
+| `priceAutoSync` | `boolean` | `true` | Fetch models.dev for newly discovered models without a price; the manual Sync button remains available when off |
 | `eventLogPath` | `string` | `"~/.dsh/clinebot-events.json"` | Ring buffer for account cooldown/recovery/routing history |
 | `statsRetentionDays` | `number` | `95` | Retention for day/hour/session telemetry; 0 keeps everything |
 | `dailyBudgetUsd` | `number` | `0` | Optional estimated daily spend guard; 0 disables it |

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.13</b> автоматически догружает публичные цены при появлении новых моделей. Чат работает через нативный адаптер <code>ctx.llm</code>, требуется DSH <code>0.2.1-rc.2</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.15</b> подключает бюджетирование мультимодальных запросов, добавляет замер моделей и управление видимостью, переключатель автосинхронизации цен и закрывает оставшиеся находки аудита. Чат работает через нативный адаптер <code>ctx.llm</code>, требуется DSH <code>0.2.1-rc.2</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
@@ -108,6 +108,7 @@ graph LR
 ## ✨ Структура модулей и возможности
 
 * **`lib/models.js`**: динамический каталог моделей подписки и встроенных шаблонов с поддержкой уровней рассуждения (`Off` / `Low` / `Medium` / `High` / `Max`), контекстных лимитов, пользовательских моделей (`customModels`) и парсинга тарифа (`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`).
+* **Цены и модели**: кнопка **Ping** у модели вызывает `POST /models/probe` и показывает TTFT; кнопка **Применить видимость** сохраняет выбор видимых моделей и фильтр тарифа через `POST /models/visible`. Публичные цены могут автоматически подгружаться из models.dev для новых моделей; это отключается переключателем `priceAutoSync` (или `priceAutoSync: false`), ручная синхронизация остаётся доступной.
 * **`lib/cline-client.js`**:
   * `fetchUsageLimits`: параллельный опрос `GET /users/me/plan/usage-limits`, `GET /users/me/plan` и `GET /users/me` с кэшированием в памяти.
   * `sessionStats` / `recordSessionRequest`: счетчики сессии (запросы, токены, задержка, время).

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.13</b> 在出现新模型时自动刷新公开价格。聊天使用原生 <code>ctx.llm</code> 适配器，需要 DSH <code>0.2.1-rc.2</code>；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.15</b> 接入多模态预算、模型延迟/可见性控制、价格自动同步开关，并修复其余审计问题。聊天使用原生 <code>ctx.llm</code> 适配器，需要 DSH <code>0.2.1-rc.2</code>；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>
@@ -108,6 +108,7 @@ graph LR
 ## ✨ 核心模块与功能
 
 * **`lib/models.js`**：管理动态订阅模型目录与内置精选模板（提供完整的 `Off` / `Low` / `Medium` / `High` / `Max` 思考强度映射、上游 200k 上下文容量标注、自定义模型支持）以及套餐模型动态解析器（`parsePlanIncludedModels`, `getAllModels`, `getDynamicModels`）。
+* **价格与模型**：模型行中的 **Ping** 调用 `POST /models/probe` 并显示 TTFT；**应用可见模型** 通过 `POST /models/visible` 保存可见模型和套餐过滤。新模型缺少价格时可通过 `priceAutoSync` 开关自动从 models.dev 获取公开价格；关闭后仍可使用手动同步。
 * **`lib/cline-client.js`**：
   * `fetchUsageLimits`：高效并发轮询 `GET /users/me/plan/usage-limits`、`GET /users/me/plan` 与 `GET /users/me` 并进行内存缓存。
   * `sessionStats` / `recordSessionRequest`：内存级会话度量记录器（请求次数、Token 估算、延迟、时间戳）。

package/lib/access.js

@@ -24,5 +24,17 @@ export function assertTrustedSettingsRequest(req, res, ctx = null) {
     writeJson(res, 403, { ok: false, error: 'Forbidden' })
     return false
   }
+
+  // A loopback-only caller is not enough for state changes: dsh-lanmode can
+  // proxy LAN/Tailscale clients into the host over loopback. Browsers attach
+  // Origin/Referer; non-browser writes without one are rejected fail-closed.
+  const method = String(req?.method || 'GET').toUpperCase()
+  if (method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS') {
+    const origin = req?.headers?.origin || req?.headers?.referer
+    if (typeof origin !== 'string' || origin.length === 0) {
+      writeJson(res, 403, { ok: false, error: 'Forbidden' })
+      return false
+    }
+  }
   return true
 }

package/lib/account-events.js

@@ -79,7 +79,3 @@ export function flushAccountEvents() {
   }
 }
 
-export function clearAccountEvents() {
-  events = []
-  flushAccountEvents()
-}

package/lib/adapter-telemetry.js

@@ -0,0 +1,76 @@
+import { estimateCost } from './model-prices.js'
+import { recordSessionRequest } from './telemetry.js'
+import { recordUsage } from './stats-storage.js'
+
+/**
+ * Record one attempt's session and persistent telemetry.
+ * Kept out of adapter.js so the adapter stays within the decomposition budget.
+ */
+export function recordAttemptTelemetry({
+  pub,
+  accountId,
+  model,
+  usage,
+  isError,
+  is429 = false,
+  ttftMs,
+  latencyMs,
+  aborted = false,
+  options,
+  offloadedImages = 0,
+}) {
+  const promptTokens = Number(usage?.promptTokens || 0)
+  const completionTokens = Number(usage?.completionTokens || 0)
+  const reasoningTokens = Number(usage?.reasoningTokens || 0)
+  const totalTokens = Number(usage?.totalTokens || (promptTokens + completionTokens))
+  const cost = estimateCost({
+    model,
+    promptTokens,
+    completionTokens,
+    reasoningTokens,
+    cacheReadTokens: usage?.cacheReadTokens,
+    cacheWriteTokens: usage?.cacheWriteTokens,
+    overrides: pub.priceOverrides || {},
+  })
+
+  try {
+    recordSessionRequest({
+      latencyMs,
+      ok: !isError,
+      aborted,
+      promptTokens,
+      completionTokens,
+      reasoningTokens,
+      model,
+      offloadedImages,
+      ...(isError ? { error: is429 ? 'rate limit' : 'stream error' } : {}),
+    })
+  } catch {
+    /* telemetry must never break inference */
+  }
+
+  try {
+    recordUsage({
+      model,
+      accountId,
+      promptTokens,
+      completionTokens,
+      reasoningTokens,
+      totalTokens,
+      isError,
+      is429,
+      statsPath: pub.statsPath,
+      sessionId: options.sessionId ? String(options.sessionId) : undefined,
+      purpose: options.purpose,
+      ttftMs: ttftMs ?? undefined,
+      latencyMs,
+      cacheReadTokens: usage?.cacheReadTokens,
+      cacheWriteTokens: usage?.cacheWriteTokens,
+      cacheSavingsUsd: cost.cacheSavingsUsd,
+      costUsd: cost.usd,
+      priced: cost.priced,
+    })
+  } catch {
+    /* persistent telemetry is best-effort */
+  }
+}

package/lib/adapter.js

@@ -11,11 +11,11 @@ import { publicConfig } from './config.js'
 import { getAllModels, findModel, formatModelDescription } from './models.js'
 import { resolveAccountPool } from './account-pool.js'
 import { resolveSessionAccount, markAccountCooldown } from './session-router.js'
-import { recordSessionRequest } from './telemetry.js'
-import { recordUsage, getBudgetSpend } from './stats-storage.js'
+import { recordAttemptTelemetry } from './adapter-telemetry.js'
+import { getBudgetSpend } from './stats-storage.js'
 import { budgetStatus, budgetErrorMessage } from './budget.js'
-import { estimateCost } from './model-prices.js'
 import { buildOpenAiPayload } from './adapter-messages.js'
+import { optimizePromptCacheAndBudget } from './multimodal-budget.js'
 import { streamJsonCompletion, streamOpenAiChunks } from './adapter-stream.js'
 import {
   abortError,
@@ -264,8 +264,14 @@ export class ClineBotAdapter extends LlmAdapter {
     const attachments = this.resolveAttachments
       ? this.resolveAttachments()
       : attachmentStore(this.ctx)
+    const optimized = optimizePromptCacheAndBudget(options.messages, {
+      offloadSeenImages: pub.offloadSeenImages,
+      maxPayloadBytes: Number(pub.maxPayloadMb || 40) * 1024 * 1024,
+    })
+    const requestOptions = { ...options, offloadedImages: optimized.offloadedCount }
     const payload = await buildOpenAiPayload({
       ...options,
+      messages: optimized.messages,
       model,
       signal,
     }, { attachments })
@@ -445,7 +451,7 @@ export class ClineBotAdapter extends LlmAdapter {
             isError: false,
             ttftMs,
             latencyMs: Date.now() - startedAt,
-            options,
+            options: requestOptions,
           })
           return
         }
@@ -474,7 +480,7 @@ export class ClineBotAdapter extends LlmAdapter {
           isError: false,
           ttftMs,
           latencyMs: Date.now() - startedAt,
-          options,
+          options: requestOptions,
         })
         return
       } catch (error) {
@@ -487,7 +493,7 @@ export class ClineBotAdapter extends LlmAdapter {
             isError: true,
             ttftMs,
             latencyMs: Date.now() - startedAt,
-            options,
+            options: requestOptions,
             aborted: true,
           })
           throw abortError()
@@ -513,7 +519,7 @@ export class ClineBotAdapter extends LlmAdapter {
           is429: normalized.code === 'RATE_LIMIT',
           ttftMs,
           latencyMs: Date.now() - startedAt,
-          options,
+          options: requestOptions,
         })
         throw normalized
       }
@@ -549,72 +555,11 @@ export class ClineBotAdapter extends LlmAdapter {
    *   options: Record<string, unknown>,
    * }} entry
    */
-  recordAttempt({
-    pub,
-    accountId,
-    model,
-    usage,
-    isError,
-    is429 = false,
-    ttftMs,
-    latencyMs,
-    aborted = false,
-    options,
-  }) {
-    const promptTokens = Number(usage?.promptTokens || 0)
-    const completionTokens = Number(usage?.completionTokens || 0)
-    const reasoningTokens = Number(usage?.reasoningTokens || 0)
-    const totalTokens = Number(usage?.totalTokens || (promptTokens + completionTokens))
-    const cost = estimateCost({
-      model,
-      promptTokens,
-      completionTokens,
-      reasoningTokens,
-      cacheReadTokens: usage?.cacheReadTokens,
-      cacheWriteTokens: usage?.cacheWriteTokens,
-      overrides: pub.priceOverrides || {},
+  recordAttempt(entry) {
+    recordAttemptTelemetry({
+      ...entry,
+      offloadedImages: entry?.options?.offloadedImages || 0,
     })
-
-    try {
-      recordSessionRequest({
-        latencyMs,
-        ok: !isError,
-        aborted,
-        promptTokens,
-        completionTokens,
-        reasoningTokens,
-        model,
-        ...(isError ? { error: is429 ? 'rate limit' : 'stream error' } : {}),
-      })
-    } catch {
-      /* telemetry must never break inference */
-    }
-
-    try {
-      recordUsage({
-        model,
-        accountId,
-        promptTokens,
-        completionTokens,
-        reasoningTokens,
-        totalTokens,
-        isError,
-        is429,
-        statsPath: pub.statsPath,
-        // Extended fields consumed by stats v2 once available.
-        sessionId: options.sessionId ? String(options.sessionId) : undefined,
-        purpose: options.purpose,
-        ttftMs: ttftMs ?? undefined,
-        latencyMs,
-        cacheReadTokens: usage?.cacheReadTokens,
-        cacheWriteTokens: usage?.cacheWriteTokens,
-        cacheSavingsUsd: cost.cacheSavingsUsd,
-        costUsd: cost.usd,
-        priced: cost.priced,
-      })
-    } catch {
-      /* persistent telemetry is best-effort */
-    }
   }
 }