@goodandready/dsh-clinebot 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.23] - 2026-10-28
+
+### Fixed
+- **Profile-file path guard** (#269): data paths must be `.json`, must stay inside `$DSH_HOME`, and cannot point at `profiles/**/package.json`, settings, credentials or TypeScript configs.
+- **Explicit credential rollback failure** (#272): if settings persistence and credential rollback both fail, the API now reports `partial`/`credentialOrphan` with the env name and keeps the key available for cleanup/retry instead of hiding it.
+- **Settings merge on account add** (#280): account additions use `settingsApi.update({ accounts })` and a fresh config read, preserving concurrent `timeoutMs` and other setting changes.
+
 ## [0.6.22] - 2026-10-28
 
 ### Fixed

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.22</b> hardens updater credentials, provider failover, concurrent account changes, price-catalog/path access, CSV export and stream limits. It keeps automatic model/free/dated catalog backfill, DSH <code>0.2.1-rc.4</code>, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.23</b> closes residual path/rollback/settings-merge races: profile files cannot be targeted through data paths, orphan credentials are reported explicitly, and account additions merge with concurrent settings. It keeps automatic model/free/dated catalog backfill, DSH <code>0.2.1-rc.4</code>, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.22</b> ужесточает работу с credentials в updater, failover провайдера, конкурентные изменения аккаунтов, доступ к URL/путям, CSV-экспорт и лимиты потоков. Сохраняются автодобор каталога моделей/FREE/dated, DSH <code>0.2.1-rc.4</code>, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.23</b> закрывает остаточные гонки путей, rollback и настроек: файлы профиля нельзя выбрать через data paths, orphan-credential явно репортится, а добавление аккаунта мержится с параллельными настройками. Сохраняются автодобор каталога моделей/FREE/dated, DSH <code>0.2.1-rc.4</code>, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.22</b> 加强更新器凭据隔离、提供方故障转移、并发账户变更、目录 URL/路径访问、CSV 导出和流限制。保留模型/免费/日期变体自动补齐、DSH <code>0.2.1-rc.4</code>、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.23</b> 修复剩余的路径、回滚和设置合并竞态：数据路径不能指向配置文件，回滚失败会明确报告孤立凭据，添加账户会与并发设置合并。保留模型/免费/日期变体自动补齐、DSH <code>0.2.1-rc.4</code>、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/lib/path-safety.js

@@ -13,5 +13,11 @@ export function isSafeDataPath(value) {
     ? path.resolve(process.env.HOME || os.homedir(), raw.slice(1))
     : path.resolve(raw)
   const home = dshHome()
-  return resolved === home || resolved.startsWith(`${home}${path.sep}`)
+  if (resolved === home || !resolved.startsWith(`${home}${path.sep}`)) return false
+  const relative = path.relative(home, resolved).toLowerCase()
+  const segments = relative.split(/[\\/]+/)
+  const base = path.basename(resolved).toLowerCase()
+  if (segments[0] === 'profiles' && !base.startsWith('clinebot-')) return false
+  if (path.extname(base) !== '.json') return false
+  return !['package.json', 'package-lock.json', 'tsconfig.json', 'settings.json', '.credentials.json'].includes(base)
 }

package/lib/routes/accounts.js

@@ -66,30 +66,46 @@ export function registerAccountsRoutes(ctx, { live, syncProviderState, getSettin
       try {
         if (previous.source === 'credentials' && previous.value) {
           await saveCredentialKey(ctx, targetEnv, previous.value)
-        } else {
-          await deleteCredentialKey(ctx, targetEnv)
+          return true
         }
+        const result = await deleteCredentialKey(ctx, targetEnv)
+        return Boolean(result?.ok)
       } catch {
-        /* best-effort rollback */
+        return false
       }
     }
 
     await saveCredentialKey(ctx, targetEnv, apiKey)
 
-    const idx = existingAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
+    const fresh = plainConfig(live())
+    const freshAccounts = Array.isArray(fresh.accounts) ? [...fresh.accounts] : []
+    const idx = freshAccounts.findIndex((a) => a && a.apiKeyEnv === targetEnv)
     const accountEntry = { label: accountLabel, apiKeyEnv: targetEnv }
     if (idx >= 0) {
-      existingAccounts[idx] = accountEntry
+      freshAccounts[idx] = accountEntry
     } else {
-      existingAccounts.push(accountEntry)
+      freshAccounts.push(accountEntry)
     }
 
-    const next = plainConfig(Config({ ...curr, accounts: existingAccounts }))
+    const next = plainConfig(Config({ ...fresh, accounts: freshAccounts }))
     const settingsApi = getSettingsApi()
     try {
-      await settingsApi.replace(next)
+      if (typeof settingsApi.update === 'function') {
+        await settingsApi.update({ accounts: freshAccounts })
+      } else {
+        await settingsApi.replace(next)
+      }
     } catch (err) {
-      await restoreCredential()
+      const restored = await restoreCredential()
+      if (!restored) {
+        pendingSecretCleanupAccounts.add(targetEnv)
+        const partial = new Error(`Account settings were not persisted and credential rollback failed for "${targetEnv}". Use account delete with secret cleanup to retry.`)
+        partial.status = 500
+        partial.partial = true
+        partial.credentialOrphan = true
+        partial.apiKeyEnv = targetEnv
+        throw partial
+      }
       throw err
     }
     await syncProviderState(next)
@@ -150,7 +166,13 @@ export function registerAccountsRoutes(ctx, { live, syncProviderState, getSettin
         writeJson(res, 200, { ok: true, ...result })
       } catch (err) {
         const status = typeof err?.status === 'number' ? err.status : 500
-        writeJson(res, status, { ok: false, error: String(err?.message || err) })
+        writeJson(res, status, {
+          ok: false,
+          error: String(err?.message || err),
+          ...(err?.partial ? { partial: true } : {}),
+          ...(err?.credentialOrphan ? { credentialOrphan: true } : {}),
+          ...(err?.apiKeyEnv ? { apiKeyEnv: err.apiKeyEnv } : {}),
+        })
       }
     },
   }), 'dsh-clinebot: /accounts')
@@ -394,7 +416,13 @@ export function registerAccountsRoutes(ctx, { live, syncProviderState, getSettin
         writeJson(res, 200, { ok: true, ...result })
       } catch (err) {
         const status = typeof err?.status === 'number' ? err.status : 500
-        writeJson(res, status, { ok: false, error: String(err?.message || err) })
+        writeJson(res, status, {
+          ok: false,
+          error: String(err?.message || err),
+          ...(err?.partial ? { partial: true } : {}),
+          ...(err?.credentialOrphan ? { credentialOrphan: true } : {}),
+          ...(err?.apiKeyEnv ? { apiKeyEnv: err.apiKeyEnv } : {}),
+        })
       }
     },
   }), 'dsh-clinebot: /keys/discovered/import')

package/lib/transport/cline-transport.js

@@ -9,7 +9,7 @@
 import { createRequire } from 'node:module'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.22'
+let packageVersion = '0.6.23'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",