@goodandready/dsh-clinebot 0.6.25 → 0.6.26

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.26] - 2026-11-05
+
+### Security
+- **Updater proxy credentials (#285)**: proxy env values are stripped of URL userinfo before being passed to install scripts.
+- **Native settings path guard (#286)**: unsafe `statsPath`, `eventLogPath`, `modelsCachePath` and `priceCatalogPath` values are ignored by startup/sync and rejected by write routes, not only by the HTTP config handler.
+- **Prototype-safe price/config dictionaries (#287)**: price catalogs, config snapshots and account snapshots keep `__proto__` as own data instead of changing object prototypes.
+
 ## [0.6.25] - 2026-11-04
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.25</b> adds DSH <code>0.2.2-rc.1</code> support and keeps the security hardening from 0.6.24. It also keeps automatic model/free/dated catalog backfill, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.26</b> hardens updater proxy credentials, native settings data paths and prototype-safe price/config dictionaries. It keeps DSH <code>0.2.2-rc.1</code> support, automatic model/free/dated catalog backfill, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.25</b> добавляет поддержку DSH <code>0.2.2-rc.1</code> и сохраняет security-усиления 0.6.24. Также сохраняются автодобор каталога моделей/FREE/dated, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.26</b> закрывает proxy credentials в updater, пути данных из native settings и prototype-safe словари цен/конфигурации. Сохраняются поддержка DSH <code>0.2.2-rc.1</code>, автодобор каталога моделей/FREE/dated, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.25</b> 增加 DSH <code>0.2.2-rc.1</code> 支持并保留 0.6.24 的安全加固。保留模型/免费/日期变体自动补齐、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.26</b> 加固 updater 代理凭据、native settings 数据路径和原型安全的价目/配置字典。保留 DSH <code>0.2.2-rc.1</code> 支持、模型/免费/日期变体自动补齐、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/lib/account-pool.js

@@ -1,4 +1,5 @@
 import { resolveKeyValue, usageCache, clearUsageCache, clearProbeCache, DEFAULT_API_KEY_ENV, DEFAULT_BASE_URL, buildUsageCacheKey } from './cline-client.js'
+import { safeDict } from './safe-dict.js'
 
 /**
  * Resolve all accounts in pool with their status and keys.
@@ -21,7 +22,7 @@ function arraySetting(value) {
 
 function toPlainSnapshot(cfg) {
   if (!cfg || typeof cfg !== 'object') return cfg
-  const out = {}
+  const out = safeDict()
   for (const [k, v] of Object.entries(cfg)) {
     let cur = v
     while (cur && typeof cur === 'object' && !Array.isArray(cur) && typeof cur.get === 'function') {

package/lib/config.js

@@ -13,6 +13,7 @@ import {
   getActiveModelIds,
   migrateModelId,
 } from './models.js'
+import { setOwn } from './safe-dict.js'
 
 // DSH settings.describe only publishes fields marked volatile. Without them the
 // namespace is omitted and the configuration page stays unavailable.
@@ -150,7 +151,7 @@ export function plainConfig(cfg) {
   }
   const out = {}
   for (const key of Object.keys(cfg)) {
-    out[key] = plainConfig(cfg[key])
+    setOwn(out, key, plainConfig(cfg[key]))
   }
   return out
 }
@@ -161,7 +162,7 @@ export function volatileConfig(cfg) {
   const out = {}
   for (const [key, field] of Object.entries(Config.dict || {})) {
     if (field?.meta?.volatile && Object.hasOwn(plain, key)) {
-      out[key] = plain[key]
+      setOwn(out, key, plain[key])
     }
   }
   return out

package/lib/index.js

@@ -27,6 +27,8 @@ import { loadAccountEvents, flushAccountEvents, recordAccountEvent } from './acc
 import { setAccountEventSink } from './session-router.js'
 import { service, migrateLegacyPiAiProvider } from './services.js'
 import { applyTuiSettings } from './tui-settings.js'
+import { isSafeDataPath } from './path-safety.js'
+import { safeDict, setOwn } from './safe-dict.js'
 
 export const name = '@goodandready/dsh-clinebot'
 export const inject = []
@@ -42,7 +44,7 @@ export { NS, Config, sessionStats, recordSessionRequest, resetSessionStats, rota
 
 export function apply(ctx, config) {
   let currentConfig = configReader(config)() || {}
-  const overrides = {}
+  const overrides = safeDict()
   const getConfig = () => {
     if (!currentConfig) return currentConfig
     if (Object.isFrozen(currentConfig)) {
@@ -108,10 +110,11 @@ export function apply(ctx, config) {
       })
   }
 
-  let activeStatsPath = resolvePath(publicConfig(live()).statsPath)
-  setStatsRetentionDays(publicConfig(live()).statsRetentionDays)
-  setPublicPriceCatalog(loadPublicPriceCache(publicConfig(live()).priceCatalogPath))
-  let activeEventPath = resolvePath(publicConfig(live()).eventLogPath)
+  const initial = publicConfig(live())
+  let activeStatsPath = resolvePath(isSafeDataPath(initial.statsPath) ? initial.statsPath : '~/.dsh/clinebot-stats.json')
+  setStatsRetentionDays(initial.statsRetentionDays)
+  setPublicPriceCatalog(loadPublicPriceCache(isSafeDataPath(initial.priceCatalogPath) ? initial.priceCatalogPath : '~/.dsh/clinebot-prices.json'))
+  let activeEventPath = resolvePath(isSafeDataPath(initial.eventLogPath) ? initial.eventLogPath : '~/.dsh/clinebot-events.json')
   loadAccountEvents(activeEventPath)
   setAccountEventSink(recordAccountEvent)
   loadStats(activeStatsPath)
@@ -119,14 +122,15 @@ export function apply(ctx, config) {
   const syncStatsStorage = (cfg) => {
     const pub = publicConfig(cfg)
     setStatsRetentionDays(pub.statsRetentionDays)
-    setPublicPriceCatalog(loadPublicPriceCache(pub.priceCatalogPath))
-    const nextEventPath = resolvePath(pub.eventLogPath)
+    const priceCatalogPath = isSafeDataPath(pub.priceCatalogPath) ? pub.priceCatalogPath : '~/.dsh/clinebot-prices.json'
+    setPublicPriceCatalog(loadPublicPriceCache(priceCatalogPath))
+    const nextEventPath = resolvePath(isSafeDataPath(pub.eventLogPath) ? pub.eventLogPath : '~/.dsh/clinebot-events.json')
     if (nextEventPath !== activeEventPath) {
       flushAccountEvents()
       activeEventPath = nextEventPath
       loadAccountEvents(activeEventPath)
     }
-    const nextPath = resolvePath(pub.statsPath)
+    const nextPath = resolvePath(isSafeDataPath(pub.statsPath) ? pub.statsPath : '~/.dsh/clinebot-stats.json')
     if (nextPath !== activeStatsPath) {
       switchStatsStorage(nextPath)
       activeStatsPath = nextPath
@@ -184,7 +188,7 @@ export function apply(ctx, config) {
           if (isVolatileRef(orig) || Object.getOwnPropertyDescriptor(targetConfig, key)?.get) {
             continue
           }
-          overrides[key] = value
+          setOwn(overrides, key, value)
         }
         return
       }
@@ -202,7 +206,7 @@ export function apply(ctx, config) {
           if (desc?.set) {
             targetConfig[key] = value
           } else {
-            targetConfig[key] = value
+            setOwn(targetConfig, key, value)
           }
         } catch {
           /* ignore read-only */

package/lib/price-sync.js

@@ -2,6 +2,7 @@ import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync } from '
 import { homedir } from 'node:os'
 import path from 'node:path'
 import { normalizeModelKey, getPublicPriceCatalog, setPublicPriceCatalog } from './model-prices.js'
+import { safeDict } from './safe-dict.js'
 
 const DEFAULT_URL = 'https://models.dev/api.json'
 
@@ -63,7 +64,7 @@ function priority(provider) {
  * @param {Record<string, any>} data
  */
 export function buildPublicCatalog(data) {
-  const catalog = {}
+  const catalog = safeDict()
   for (const provider of Object.values(data || {})) {
     if (!provider || typeof provider !== 'object') continue
     const providerId = String(provider.id || '')
@@ -102,7 +103,7 @@ export function loadPublicPriceCache(cachePath) {
     const file = expandHome(cachePath)
     if (!existsSync(file)) return {}
     const parsed = JSON.parse(readFileSync(file, 'utf8'))
-    return parsed?.models && typeof parsed.models === 'object' ? parsed.models : {}
+    return parsed?.models && typeof parsed.models === 'object' ? safeDict(parsed.models) : safeDict()
   } catch {
     return {}
   }

package/lib/provider-sync.js

@@ -22,6 +22,7 @@ import { publicConfig, plainConfig, Config } from './config.js'
 import { publicUsage } from './http.js'
 import { resolveKeyValue } from './credential-refs.js'
 import { resolveAccountPool, getLastRotation } from './account-pool.js'
+import { isSafeDataPath } from './path-safety.js'
 
 export function resolvePathWithHome(p) {
   let guard = 0
@@ -193,7 +194,7 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
   try {
     const cfg = live()
     const pub = publicConfig(cfg)
-    const cacheFile = resolvePathWithHome(pub.modelsCachePath)
+    const cacheFile = isSafeDataPath(pub.modelsCachePath) ? resolvePathWithHome(pub.modelsCachePath) : ''
     const settingsApi = getSettingsApi()
 
     // Auto-migrate obsolete IDs (e.g. deepseek-v41-flash -> deepseek-v4.1-flash)
@@ -248,7 +249,7 @@ export async function autoDiscoverPlanModels(ctx, { live, getSettingsApi, syncPr
       if (isDifferent) {
         await ensurePublicPricesForModels(usageData.dynamicModels.map((model) => model.id), {
           url: pub.priceCatalogUrl,
-          cachePath: pub.priceCatalogPath,
+          cachePath: isSafeDataPath(pub.priceCatalogPath) ? pub.priceCatalogPath : undefined,
           enabled: pub.priceAutoSync !== false,
         }).catch(() => {})
       }

package/lib/routes/models.js

@@ -6,6 +6,7 @@ import { getAllModels, saveModelsDiskCache, getOriginalModelContext, getOriginal
 import { fetchUsageLimits, smokeChat } from '../cline-client.js'
 import { publicUsage } from '../http.js'
 import { ensurePublicPricesForModels } from '../price-sync.js'
+import { isSafeDataPath } from '../path-safety.js'
 
 export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderState }) {
   // POST /dsh-clinebot/models/sync — dynamically load models from plan
@@ -51,7 +52,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
         }))
         await settingsApi.replace(next)
         await syncProviderState(next)
-        const cacheFile = resolvePathWithHome(pub.modelsCachePath)
+        const cacheFile = isSafeDataPath(pub.modelsCachePath) ? resolvePathWithHome(pub.modelsCachePath) : ''
         if (cacheFile) {
           const activeAcc = await resolveActiveAccountKey(ctx, live())
           const accountRef = activeAcc?.envName || activeAcc?.apiKeyEnv || pub.activeAccount || pub.apiKeyEnv || 'CLINEBOT_API_KEY'

package/lib/routes/settings.js

@@ -235,6 +235,9 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
       if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
+        if (!isSafeDataPath(pub.statsPath)) {
+          return writeJson(res, 400, { ok: false, error: 'statsPath must stay inside the DSH home directory' })
+        }
         const stats = resetStats(pub.statsPath)
         writeJson(res, 200, { ok: true, stats })
       } catch (err) {
@@ -341,6 +344,9 @@ export function registerSettingsRoutes(ctx, { live, getSettingsApi, syncProvider
       if (!assertTrustedSettingsRequest(req, res, ctx)) return
       try {
         const pub = publicConfig(live())
+        if (!isSafeDataPath(pub.priceCatalogPath)) {
+          return writeJson(res, 400, { ok: false, error: 'priceCatalogPath must stay inside the DSH home directory' })
+        }
         const result = await syncPublicPrices({
           url: pub.priceCatalogUrl,
           cachePath: pub.priceCatalogPath,

package/lib/safe-dict.js

@@ -13,3 +13,13 @@ export function safeNestedDict(source) {
   }
   return out
 }
+
+export function setOwn(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    writable: true,
+    enumerable: true,
+    configurable: true,
+  })
+  return target
+}

package/lib/transport/cline-transport.js

@@ -9,7 +9,7 @@
 import { createRequire } from 'node:module'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.25'
+let packageVersion = '0.6.26'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {

package/lib/updater.js

@@ -25,10 +25,27 @@ const SAFE_ENV_KEYS = new Set([
 const SAFE_NPM_ENV_RE = /^npm_config_(?:registry|proxy|https_proxy|strict_ssl|userconfig|globalconfig|cache|prefix)$/i
 let latestCache = undefined
 
+function sanitizeProxy(value) {
+  try {
+    const url = new URL(String(value))
+    url.username = ''
+    url.password = ''
+    return url.toString()
+  } catch {
+    return ''
+  }
+}
+
 export function sanitizeChildEnv(env = process.env) {
   const out = {}
   for (const [key, value] of Object.entries(env)) {
-    if (SAFE_ENV_KEYS.has(key) || SAFE_NPM_ENV_RE.test(key)) out[key] = value
+    if (!SAFE_ENV_KEYS.has(key) && !SAFE_NPM_ENV_RE.test(key)) continue
+    if (/proxy/i.test(key)) {
+      const clean = sanitizeProxy(value)
+      if (clean) out[key] = clean
+    } else {
+      out[key] = value
+    }
   }
   out.NO_COLOR = '1'
   return out

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.25",
+  "version": "0.6.26",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",