@goodandready/dsh-clinebot 0.6.13 → 0.6.15

package/lib/config.js

@@ -62,6 +62,8 @@ export const Config = z.object({
     .description('Public model price catalog URL used by the optional price sync.').volatile(),
   priceCatalogPath: z.string().default('~/.dsh/clinebot-prices.json')
     .description('Local cache for the public price catalog.').volatile(),
+  priceAutoSync: z.boolean().default(true)
+    .description('Automatically fetch the public price catalog when a newly discovered model has no price.').volatile(),
   eventLogPath: z.string().default('~/.dsh/clinebot-events.json')
     .description('Local ring buffer for account cooldown, recovery and routing events.').volatile(),
   enabledModels: z.array(z.string()).default([])
@@ -252,6 +254,7 @@ export function publicConfig(cfg) {
     statsPath: String(cfg?.statsPath || '~/.dsh/clinebot-stats.json'),
     priceCatalogUrl: String(cfg?.priceCatalogUrl || 'https://models.dev/api.json'),
     priceCatalogPath: String(cfg?.priceCatalogPath || '~/.dsh/clinebot-prices.json'),
+    priceAutoSync: cfg?.priceAutoSync !== false,
     eventLogPath: String(cfg?.eventLogPath || '~/.dsh/clinebot-events.json'),
     statsRetentionDays: Number.isFinite(Number(cfg?.statsRetentionDays))
       ? Math.max(0, Math.min(3650, Number(cfg.statsRetentionDays)))

package/lib/http.js

@@ -86,7 +86,11 @@ export function isTrustedSettingsRequest(request, ctx = null) {
     return false
   }
 
-  const host = header(request, 'x-forwarded-host') || header(request, 'host')
+  const remoteLoopback = isLoopbackAddress(request?.socket?.remoteAddress)
+  // A forwarding header is only trusted when the actual peer is the local
+  // reverse proxy; never trust it from a LAN/remote client.
+  const forwardedHost = header(request, 'x-forwarded-host')
+  const host = remoteLoopback ? (forwardedHost || header(request, 'host')) : header(request, 'host')
   const origin = header(request, 'origin')
   if (origin) {
     try {
@@ -94,7 +98,7 @@ export function isTrustedSettingsRequest(request, ctx = null) {
       if (host && url.host.toLowerCase() === host.toLowerCase()) {
         return true
       }
-      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+      if (isLoopbackAddress(url.hostname) && remoteLoopback) {
         return true
       }
       return false
@@ -110,7 +114,7 @@ export function isTrustedSettingsRequest(request, ctx = null) {
       if (host && url.host.toLowerCase() === host.toLowerCase()) {
         return true
       }
-      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+      if (isLoopbackAddress(url.hostname) && remoteLoopback) {
         return true
       }
       return false
@@ -119,17 +123,9 @@ export function isTrustedSettingsRequest(request, ctx = null) {
     }
   }
 
-  // Requests without origin/referer (e.g. curl or internal requests): allow if loopback
-  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
-    return true
-  }
-
-  // If sec-fetch-site is explicitly same-origin or same-site, allow
-  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
-    return true
-  }
-
-  return false
+  // Requests without origin/referer (e.g. curl or internal requests): allow if loopback.
+  // Sec-Fetch-Site alone is spoofable by non-browser clients and is not an auth signal.
+  return remoteLoopback
 }
 
 export function publicUsage(usage) {

package/lib/index.js

@@ -38,7 +38,7 @@ export function configReader(config) {
 export { NS, Config, sessionStats, recordSessionRequest, resetSessionStats, rotateToNextAccount }
 
 export function apply(ctx, config) {
-  let currentConfig = config || {}
+  let currentConfig = configReader(config)() || {}
   const overrides = {}
   const getConfig = () => {
     if (!currentConfig) return currentConfig
@@ -300,8 +300,8 @@ export function apply(ctx, config) {
           }])
         }
         ctx.effect(() => () => {
-          try { adapterDirectory?.() } catch {}
-          try { adapterRegistration?.() } catch {}
+          try { adapterDirectory?.() } catch { /* explicit best-effort fallback: non-fatal by design */ }
+          try { adapterRegistration?.() } catch { /* explicit best-effort fallback: non-fatal by design */ }
           adapterDirectory = null
           adapterRegistration = null
         }, 'dsh-clinebot: llm adapter')
@@ -383,7 +383,7 @@ export function apply(ctx, config) {
           const unreg = web.registerSearchProvider(CLINEBOT_SEARCH_PROVIDER_ID, searchProvider)
           if (typeof ctx.effect === 'function') {
             ctx.effect(() => () => {
-              try { if (typeof unreg === 'function') unreg() } catch {}
+              try { if (typeof unreg === 'function') unreg() } catch { /* explicit best-effort fallback: non-fatal by design */ }
             }, 'dsh-clinebot: web search provider')
           }
         } catch (e) {

package/lib/key-discovery.js

@@ -18,13 +18,6 @@ function cleanupExpired() {
   }
 }
 
-export function getDiscoveredKey(id) {
-  if (!id || typeof id !== 'string') return null
-  cleanupExpired()
-  const item = discoveredKeysCache.get(id)
-  return item?.key || null
-}
-
 export function consumeDiscoveredKey(id) {
   if (!id || typeof id !== 'string') return null
   cleanupExpired()
@@ -34,10 +27,6 @@ export function consumeDiscoveredKey(id) {
   return item.key
 }
 
-export function clearDiscoveredKeysCache() {
-  discoveredKeysCache.clear()
-}
-
 export function maskApiKey(key) {
   if (!key || typeof key !== 'string') return ''
   if (key.length <= 12) return '••••••••'
@@ -162,10 +151,10 @@ export function discoverLocalClineKeys() {
             const hits = scanFileForKeys(full, 'Cline CLI (~/.cline)')
             for (const h of hits) addKey(h)
           }
-        } catch {}
+        } catch { /* explicit best-effort fallback: non-fatal by design */ }
       }
     }
-  } catch {}
+  } catch { /* explicit best-effort fallback: non-fatal by design */ }
 
   return discovered
 }

package/lib/models.js

@@ -414,10 +414,6 @@ export function isSupportedModel(id, dynamicModels = [], modelContextOverrides =
   return findModel(id, dynamicModels, modelContextOverrides, customModels) !== null
 }
 
-export function getDefaultModelIds(dynamicModels = [], modelContextOverrides = [], customModels = []) {
-  return getAllModels(dynamicModels, modelContextOverrides, customModels).map((m) => m.id)
-}
-
 /**
  * Filter out models explicitly disabled by user.
  * Any newly introduced model (not in disabledModelIds) is active by default.

package/lib/price-sync.js

@@ -82,11 +82,6 @@ export function loadPublicPriceCache(cachePath) {
 let lastMissingSignature = ''
 let lastAttemptAt = 0
 
-export function resetPriceSyncState() {
-  lastMissingSignature = ''
-  lastAttemptAt = 0
-}
-
 /**
  * Refresh the public catalog only when one of the active models is missing.
  * A repeated missing set is retried at most once per interval, so an unknown
@@ -96,6 +91,7 @@ export async function ensurePublicPricesForModels(modelIds, {
   url = DEFAULT_URL,
   cachePath = '~/.dsh/clinebot-prices.json',
   fetchImpl,
+  enabled = true,
   timeoutMs = 8000,
   minIntervalMs = 6 * 60 * 60 * 1000,
   now = Date.now(),
@@ -103,6 +99,7 @@ export async function ensurePublicPricesForModels(modelIds, {
   const ids = [...new Set((Array.isArray(modelIds) ? modelIds : []).map((id) => String(id || '').trim()).filter(Boolean))]
   const missing = ids.filter((id) => !getPublicPriceCatalog()[normalizeModelKey(id)])
   if (missing.length === 0) return { synced: false, missing: [], count: 0 }
+  if (enabled === false) return { synced: false, skipped: true, missing, count: 0 }
   if (!fetchImpl && process.env.CLINEBOT_DISABLE_PRICE_AUTOSYNC === '1') {
     return { synced: false, skipped: true, missing, count: 0 }
   }

package/lib/provider-sync.js

@@ -248,6 +248,7 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
         await ensurePublicPricesForModels(usageData.dynamicModels.map((model) => model.id), {
           url: pub.priceCatalogUrl,
           cachePath: pub.priceCatalogPath,
+          enabled: pub.priceAutoSync !== false,
         }).catch(() => {})
       }
       return

package/lib/routes/models.js

@@ -66,6 +66,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
             priceSync = await ensurePublicPricesForModels(addedModels.map((model) => model.id), {
               url: pub.priceCatalogUrl,
               cachePath: pub.priceCatalogPath,
+              enabled: pub.priceAutoSync !== false,
             })
           } catch {
             /* price catalog refresh is best-effort */

package/lib/routes/settings.js

@@ -280,7 +280,7 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
         let query = {}
         try {
           query = Object.fromEntries(new URL(req.url, 'http://127.0.0.1').searchParams.entries())
-        } catch {}
+        } catch { /* explicit best-effort fallback: non-fatal by design */ }
         const parseTime = (value) => {
           if (value === undefined || value === '') return undefined
           const numeric = Number(value)

package/lib/session-router.js

@@ -112,18 +112,6 @@ export function markAccountCooldown(accountId, durationMs = 60000, resetsAt = nu
   emitAccountEvent({ type: 'cooldown', accountId, reason, until })
 }
 
-/**
- * Clear cooldown for an account manually.
- *
- * @param {string} accountId
- */
-export function clearAccountCooldown(accountId) {
-  if (accountId && cooldowns.has(accountId)) {
-    cooldowns.delete(accountId)
-    emitAccountEvent({ type: 'recover', accountId, reason: 'manual' })
-  }
-}
-
 export function matchesAccount(acc, identifier) {
   if (!acc || !identifier) return false
   return acc.id === identifier || acc.apiKeyEnv === identifier || acc.label === identifier
@@ -362,17 +350,6 @@ export function resolveSessionAccount(sessionId, accounts = [], defaultActiveId
   }
 }
 
-/**
- * Explicitly release a session.
- *
- * @param {string} sessionId
- */
-export function releaseSession(sessionId) {
-  if (sessionId) {
-    sessions.delete(sessionId)
-  }
-}
-
 /**
  * Clear all sessions and cooldowns (for test environments).
  */

package/lib/stats-storage.js

@@ -154,10 +154,10 @@ export function loadStats(customPath) {
         const existing = readdirSync(dir).filter((name) => name.startsWith(prefix)).sort()
         while (existing.length > 3) {
           const oldest = existing.shift()
-          try { unlinkSync(path.join(dir, oldest)) } catch {}
+          try { unlinkSync(path.join(dir, oldest)) } catch { /* explicit best-effort fallback: non-fatal by design */ }
         }
       }
-    } catch {}
+    } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
   inMemoryStats = createEmptyStats()
   pruneRetentionOnStats(inMemoryStats, statsRetentionDays)
@@ -202,7 +202,7 @@ function queueSaveStats(customPath, debounceMs = 500) {
   if (saveTimer) clearTimeout(saveTimer)
   saveTimer = setTimeout(() => {
     saveTimer = null
-    try { saveStatsSync(customPath) } catch {}
+    try { saveStatsSync(customPath) } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }, debounceMs)
 }
 

package/lib/telemetry.js

@@ -10,6 +10,7 @@ export const sessionStats = {
   promptTokensEst: 0,
   completionTokensEst: 0,
   reasoningTokensEst: 0,
+  offloadedImages: 0,
   totalTokensEst: 0,
   lastLatencyMs: null,
   lastRequestAt: null,
@@ -26,6 +27,7 @@ export function recordSessionRequest({
   promptTokens = 0,
   completionTokens = 0,
   reasoningTokens = 0,
+  offloadedImages = 0,
   model,
 }) {
   sessionStats.totalRequests += 1
@@ -43,6 +45,7 @@ export function recordSessionRequest({
   sessionStats.promptTokensEst += Number(promptTokens) || 0
   sessionStats.completionTokensEst += Number(completionTokens) || 0
   sessionStats.reasoningTokensEst = (sessionStats.reasoningTokensEst || 0) + (Number(reasoningTokens) || 0)
+  sessionStats.offloadedImages = (sessionStats.offloadedImages || 0) + (Number(offloadedImages) || 0)
   sessionStats.totalTokensEst += (Number(promptTokens) || 0) + (Number(completionTokens) || 0)
 
   if (model) {
@@ -74,6 +77,7 @@ export function resetSessionStats() {
   sessionStats.promptTokensEst = 0
   sessionStats.completionTokensEst = 0
   sessionStats.reasoningTokensEst = 0
+  sessionStats.offloadedImages = 0
   sessionStats.totalTokensEst = 0
   sessionStats.lastLatencyMs = null
   sessionStats.lastRequestAt = null

package/lib/transport/cline-transport.js

@@ -9,7 +9,7 @@
 import { createRequire } from 'node:module'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.13'
+let packageVersion = '0.6.15'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {
@@ -144,7 +144,7 @@ export async function readResponseText(response, { maxBytes = DEFAULT_MAX_BODY_B
     out += decoder.decode()
     return out
   } finally {
-    try { reader.releaseLock() } catch {}
+    try { reader.releaseLock() } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
 }
 
@@ -285,7 +285,7 @@ export async function* readSseEvents(response, {
   try {
     while (true) {
       if (signal?.aborted) {
-        try { await reader.cancel('aborted') } catch {}
+        try { await reader.cancel('aborted') } catch { /* explicit best-effort fallback: non-fatal by design */ }
         throw abortError()
       }
       const { done, value } = await readWithIdle()
@@ -305,10 +305,10 @@ export async function* readSseEvents(response, {
     const tail = parseSseBlock(buffer)
     if (tail !== undefined) yield tail
   } catch (error) {
-    try { await reader.cancel(error?.message || 'stream error') } catch {}
+    try { await reader.cancel(error?.message || 'stream error') } catch { /* explicit best-effort fallback: non-fatal by design */ }
     if (signal?.aborted) throw abortError()
     throw error
   } finally {
-    try { reader.releaseLock() } catch {}
+    try { reader.releaseLock() } catch { /* explicit best-effort fallback: non-fatal by design */ }
   }
 }

package/lib/tui-settings.js

@@ -184,7 +184,7 @@ export function applyTuiSettings(ctx, { live }) {
       const dispose = service.register(buildTuiSection({ live }))
       if (typeof ctx.effect === 'function') {
         ctx.effect(() => () => {
-          try { dispose() } catch {}
+          try { dispose() } catch { /* explicit best-effort fallback: non-fatal by design */ }
         }, 'dsh-clinebot: tui settings')
       }
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.13",
+  "version": "0.6.15",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",