@goodandready/dsh-clinebot 0.6.23 → 0.6.24

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.24] - 2026-10-28
+
+### Security
+- **Fail-closed source gate** (#250): without `connection.requestRejection`, remote requests are rejected regardless of spoofable `Origin`/`Referer`/`Sec-Fetch-Site`/`X-Forwarded-Host`; loopback remains allowed.
+- **Allowlisted updater env** (#267): the child install process receives only safe OS/npm/DSH variables, not API keys, auth tokens, proxy credentials or other secrets.
+- **Symlink-safe data paths** (#269): realpath/ancestor resolution rejects symlink escapes and profile/config targets.
+- **Prototype-safe telemetry** (#281): stats and session dictionaries use null-prototype maps; `__proto__` session/model keys no longer mutate `Object.prototype`.
+
 ## [0.6.23] - 2026-10-28
 
 ### Fixed

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.23</b> closes residual path/rollback/settings-merge races: profile files cannot be targeted through data paths, orphan credentials are reported explicitly, and account additions merge with concurrent settings. It keeps automatic model/free/dated catalog backfill, DSH <code>0.2.1-rc.4</code>, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.24</b> hardens the source gate, updater environment, symlink-safe data paths and prototype-safe telemetry. It keeps automatic model/free/dated catalog backfill, DSH <code>0.2.1-rc.4</code>, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.23</b> закрывает остаточные гонки путей, rollback и настроек: файлы профиля нельзя выбрать через data paths, orphan-credential явно репортится, а добавление аккаунта мержится с параллельными настройками. Сохраняются автодобор каталога моделей/FREE/dated, DSH <code>0.2.1-rc.4</code>, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.24</b> ужесточает source gate, окружение updater, symlink-безопасность data paths и защиту телеметрии от prototype pollution. Сохраняются автодобор каталога моделей/FREE/dated, DSH <code>0.2.1-rc.4</code>, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.23</b> 修复剩余的路径、回滚和设置合并竞态：数据路径不能指向配置文件，回滚失败会明确报告孤立凭据，添加账户会与并发设置合并。保留模型/免费/日期变体自动补齐、DSH <code>0.2.1-rc.4</code>、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.24</b> 加固 source gate、更新器环境、符号链接安全的数据路径和原型污染安全的遥测。保留模型/免费/日期变体自动补齐、DSH <code>0.2.1-rc.4</code>、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/lib/http.js

@@ -87,6 +87,11 @@ export function isTrustedSettingsRequest(request, ctx = null) {
   }
 
   const remoteLoopback = isLoopbackAddress(request?.socket?.remoteAddress)
+  const hasConnectionAuth = Boolean(conn && typeof conn.requestRejection === 'function')
+  // Without the host auth service, a remote request cannot prove it is a
+  // same-origin browser request: Origin/Referer/Sec-Fetch are caller-controlled.
+  if (!hasConnectionAuth && !remoteLoopback) return false
+
   // A forwarding header is only trusted when the actual peer is the local
   // reverse proxy; never trust it from a LAN/remote client.
   const forwardedHost = header(request, 'x-forwarded-host')

package/lib/path-safety.js

@@ -1,3 +1,4 @@
+import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 
@@ -5,6 +6,22 @@ export function dshHome() {
   return path.resolve(process.env.DSH_HOME || path.join(process.env.HOME || os.homedir(), '.dsh'))
 }
 
+function realPath(target) {
+  let current = target
+  const missing = []
+  while (!fs.existsSync(current)) {
+    const parent = path.dirname(current)
+    if (parent === current) break
+    missing.unshift(path.basename(current))
+    current = parent
+  }
+  try {
+    return path.join(fs.realpathSync(current), ...missing)
+  } catch {
+    return target
+  }
+}
+
 export function isSafeDataPath(value) {
   const raw = String(value ?? '').trim()
   if (!raw) return true
@@ -12,11 +29,12 @@ export function isSafeDataPath(value) {
   const resolved = raw === '~' || raw.startsWith('~/')
     ? path.resolve(process.env.HOME || os.homedir(), raw.slice(1))
     : path.resolve(raw)
-  const home = dshHome()
-  if (resolved === home || !resolved.startsWith(`${home}${path.sep}`)) return false
-  const relative = path.relative(home, resolved).toLowerCase()
+  const home = realPath(dshHome())
+  const realResolved = realPath(resolved)
+  if (realResolved === home || !realResolved.startsWith(`${home}${path.sep}`)) return false
+  const relative = path.relative(home, realResolved).toLowerCase()
   const segments = relative.split(/[\\/]+/)
-  const base = path.basename(resolved).toLowerCase()
+  const base = path.basename(realResolved).toLowerCase()
   if (segments[0] === 'profiles' && !base.startsWith('clinebot-')) return false
   if (path.extname(base) !== '.json') return false
   return !['package.json', 'package-lock.json', 'tsconfig.json', 'settings.json', '.credentials.json'].includes(base)

package/lib/safe-dict.js

@@ -0,0 +1,15 @@
+export function safeDict(source) {
+  const out = Object.create(null)
+  if (source && typeof source === 'object') {
+    for (const key of Object.keys(source)) out[key] = source[key]
+  }
+  return out
+}
+
+export function safeNestedDict(source) {
+  const out = Object.create(null)
+  if (source && typeof source === 'object') {
+    for (const key of Object.keys(source)) out[key] = safeDict(source[key])
+  }
+  return out
+}

package/lib/stats-storage.js

@@ -15,6 +15,7 @@ import {
   pruneRetentionOnStats,
 } from './stats-metrics.js'
 import { csvCell } from './csv.js'
+import { safeDict, safeNestedDict } from './safe-dict.js'
 
 const MAX_SESSIONS = 500
 const SESSION_TTL_MS = 90 * 24 * 60 * 60 * 1000
@@ -69,13 +70,13 @@ export function createEmptyStats() {
     createdAt: Date.now(),
     updatedAt: Date.now(),
     totals: emptyBucket(),
-    byDay: {},
-    byMonth: {},
-    byModel: {},
-    byAccount: {},
-    bySession: {},
-    byHour: {},
-    byHourModel: {},
+    byDay: safeDict(),
+    byMonth: safeDict(),
+    byModel: safeDict(),
+    byAccount: safeDict(),
+    bySession: safeDict(),
+    byHour: safeDict(),
+    byHourModel: safeNestedDict(),
   }
 }
 
@@ -131,13 +132,13 @@ export function loadStats(customPath) {
           ...parsed,
           version: 2,
           totals: { ...empty.totals, ...parsed.totals },
-          byDay: parsed.byDay || {},
-          byMonth: parsed.byMonth || {},
-          byModel: parsed.byModel || {},
-          byAccount: parsed.byAccount || {},
-          bySession: parsed.bySession || {},
-          byHour: parsed.byHour || {},
-          byHourModel: parsed.byHourModel || {},
+          byDay: safeDict(parsed.byDay),
+          byMonth: safeDict(parsed.byMonth),
+          byModel: safeDict(parsed.byModel),
+          byAccount: safeDict(parsed.byAccount),
+          bySession: safeDict(parsed.bySession),
+          byHour: safeDict(parsed.byHour),
+          byHourModel: safeNestedDict(parsed.byHourModel),
         }
         backfillHourlyFromSessions()
         pruneRetentionOnStats(inMemoryStats, statsRetentionDays)
@@ -237,7 +238,7 @@ function addToBucket(bucket, entry) {
 }
 
 function incrementBucket(container, key, entry) {
-  if (!container[key]) container[key] = emptyBucket()
+  if (!Object.hasOwn(container, key)) container[key] = emptyBucket()
   addToBucket(container[key], entry)
 }
 
@@ -298,7 +299,7 @@ function backfillHourlyFromSessions() {
     if (bucket.model) hour.model = bucket.model
     if (bucket.accountId) hour.accountId = bucket.accountId
     const model = bucket.model || 'unknown'
-    if (!inMemoryStats.byHourModel[key]) inMemoryStats.byHourModel[key] = {}
+    if (!Object.hasOwn(inMemoryStats.byHourModel, key)) inMemoryStats.byHourModel[key] = safeDict()
     inMemoryStats.byHourModel[key][model] = Number(inMemoryStats.byHourModel[key][model] || 0) + requests
   }
 }
@@ -359,7 +360,7 @@ export function recordUsage({
   const localNow = new Date(now)
   const hourKey = `${localDateKey(localNow)}T${String(localNow.getHours()).padStart(2, '0')}`
   incrementBucket(inMemoryStats.byHour, hourKey, entry)
-  if (!inMemoryStats.byHourModel[hourKey]) inMemoryStats.byHourModel[hourKey] = {}
+  if (!Object.hasOwn(inMemoryStats.byHourModel, hourKey)) inMemoryStats.byHourModel[hourKey] = safeDict()
   inMemoryStats.byHourModel[hourKey][model] = Number(inMemoryStats.byHourModel[hourKey][model] || 0) + 1
   pruneHours(now)
   pruneRetentionOnStats(inMemoryStats, statsRetentionDays, now)

package/lib/telemetry.js

@@ -2,6 +2,8 @@
  * In-memory runtime session metrics for ClinePass requests in DeepSeek Harness.
  */
 
+import { safeDict } from './safe-dict.js'
+
 export const sessionStats = {
   totalRequests: 0,
   successfulRequests: 0,
@@ -15,7 +17,7 @@ export const sessionStats = {
   lastLatencyMs: null,
   lastRequestAt: null,
   lastError: null,
-  byModel: {},
+  byModel: safeDict(),
   lastSmoke: null,
 }
 
@@ -49,8 +51,10 @@ export function recordSessionRequest({
   sessionStats.totalTokensEst += (Number(promptTokens) || 0) + (Number(completionTokens) || 0)
 
   if (model) {
-    if (!sessionStats.byModel) sessionStats.byModel = {}
-    const m = sessionStats.byModel[model] || { requests: 0, promptTokens: 0, completionTokens: 0, reasoningTokens: 0 }
+    if (!sessionStats.byModel) sessionStats.byModel = safeDict()
+    const m = Object.hasOwn(sessionStats.byModel, model)
+      ? sessionStats.byModel[model]
+      : { requests: 0, promptTokens: 0, completionTokens: 0, reasoningTokens: 0 }
     m.requests += 1
     m.promptTokens += Number(promptTokens) || 0
     m.completionTokens += Number(completionTokens) || 0
@@ -82,6 +86,6 @@ export function resetSessionStats() {
   sessionStats.lastLatencyMs = null
   sessionStats.lastRequestAt = null
   sessionStats.lastError = null
-  sessionStats.byModel = {}
+  sessionStats.byModel = safeDict()
   sessionStats.lastSmoke = null
 }

package/lib/transport/cline-transport.js

@@ -9,7 +9,7 @@
 import { createRequire } from 'node:module'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.23'
+let packageVersion = '0.6.24'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {

package/lib/updater.js

@@ -14,16 +14,23 @@ import { fileURLToPath } from 'node:url'
 const UPDATE_HEADER = 'x-dsh-plugin-update'
 const UPDATE_TIMEOUT_MS = 10 * 60_000
 const VERSION_CACHE_MS = 5 * 60_000
-const SECRET_ENV_RE = /(?:^|_)(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|CREDENTIALS?)(?:_|$)/i
+const SAFE_ENV_KEYS = new Set([
+  'PATH', 'HOME', 'USERPROFILE', 'SystemRoot', 'windir', 'ComSpec', 'PATHEXT',
+  'TEMP', 'TMP', 'TMPDIR', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TERM', 'SHELL', 'PWD',
+  'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'PROGRAMFILES', 'PROGRAMFILES(X86)',
+  'PROGRAMW6432', 'SYSTEMDRIVE', 'NUMBER_OF_PROCESSORS', 'OS',
+  'PROCESSOR_ARCHITECTURE', 'PROCESSOR_IDENTIFIER', 'USER', 'USERNAME',
+  'LOGNAME', 'HOSTNAME', 'DSH_HOME', 'DSH_PROFILE_DIR', 'NODE_EXTRA_CA_CERTS',
+])
+const SAFE_NPM_ENV_RE = /^npm_config_(?:registry|proxy|https_proxy|strict_ssl|userconfig|globalconfig|cache|prefix)$/i
 let latestCache = undefined
 
 export function sanitizeChildEnv(env = process.env) {
-  const out = { ...env, NO_COLOR: '1' }
-  for (const key of Object.keys(out)) {
-    if (/^CLINEBOT_/i.test(key) || /^COMMANDCODE_/i.test(key) || SECRET_ENV_RE.test(key) || /AUTH[_-]?TOKEN/i.test(key)) {
-      delete out[key]
-    }
+  const out = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (SAFE_ENV_KEYS.has(key) || SAFE_NPM_ENV_RE.test(key)) out[key] = value
   }
+  out.NO_COLOR = '1'
   return out
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.23",
+  "version": "0.6.24",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",