@goodandready/dsh-clinebot 0.6.26 → 0.6.27

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to `@goodandready/dsh-clinebot` will be documented in this f
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.27] - 2026-11-05
+
+### Security
+- **Updater Windows environment (#289)**: the environment allowlist is case-insensitive, so Windows `Path` and `ProgramFiles(x86)` survive into the child installer.
+- **Updater registry credentials (#290)**: npm registry/proxy URL userinfo is stripped before the child installer starts.
+- **Complete write-path guard (#288)**: adapter telemetry and the models sync route no longer write stats or price caches outside `$DSH_HOME`; invalid paths fall back instead of being used.
+- **Dangling symlink guard (#291)**: `isSafeDataPath()` rejects symlinks whose target does not exist, closing the remaining symlink escape from #269.
+- **Native settings HTTPS gate (#292)**: remote chat and usage requests reject plain HTTP `baseUrl` even when the value came from native settings.
+- **Credential name allowlist (#293)**: `apiKeyEnv`, account env names and credential resolution accept only `CLINEBOT_API_KEY` names; invalid names cannot read arbitrary environment credentials.
+
 ## [0.6.26] - 2026-11-05
 
 ### Security

package/README.md

@@ -4,7 +4,7 @@
 
 <h3>Native ClineBot / ClinePass Provider Companion for DeepSeek Harness</h3>
 
-<p><b>0.6.26</b> hardens updater proxy credentials, native settings data paths and prototype-safe price/config dictionaries. It keeps DSH <code>0.2.2-rc.1</code> support, automatic model/free/dated catalog backfill, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
+<p><b>0.6.27</b> completes the native-settings security boundary: HTTPS-only remote endpoints, allowlisted credential names, path-safe telemetry/price writes, dangling-symlink rejection and a Windows-safe updater environment. It keeps DSH <code>0.2.2-rc.1</code> support, automatic model/free/dated catalog backfill, model-scoped credit cooldowns and 402/413 errors. Chat runs on the native <code>ctx.llm</code> adapter; the legacy <code>llm-pi-ai</code>, loopback proxy and <code>llm/stream</code> path are removed.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.ru.md

@@ -4,7 +4,7 @@
 
 <h3>Нативное подключение провайдера ClineBot / ClinePass для DeepSeek Harness</h3>
 
-<p><b>0.6.26</b> закрывает proxy credentials в updater, пути данных из native settings и prototype-safe словари цен/конфигурации. Сохраняются поддержка DSH <code>0.2.2-rc.1</code>, автодобор каталога моделей/FREE/dated, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
+<p><b>0.6.27</b> завершает security-границу native settings: HTTPS-only внешние endpoints, allowlist имён credentials, безопасные пути telemetry/price, отклонение dangling symlink и Windows-safe окружение updater. Сохраняются поддержка DSH <code>0.2.2-rc.1</code>, автодобор каталога моделей/FREE/dated, cooldown недостатка кредитов для конкретной модели и ошибки 402/413. Чат работает через нативный адаптер <code>ctx.llm</code>; старые <code>llm-pi-ai</code>, loopback-прокси и <code>llm/stream</code> удалены.</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/README.zh.md

@@ -4,7 +4,7 @@
 
 <h3>适用于 DeepSeek Harness 的 ClineBot / ClinePass 原生模型提供商伴侣插件</h3>
 
-<p><b>0.6.26</b> 加固 updater 代理凭据、native settings 数据路径和原型安全的价目/配置字典。保留 DSH <code>0.2.2-rc.1</code> 支持、模型/免费/日期变体自动补齐、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
+<p><b>0.6.27</b> 完善 native settings 安全边界：远程端点仅允许 HTTPS、凭据名称白名单、遥测/价格安全路径、拒绝悬空符号链接，以及 Windows 安全的 updater 环境。保留 DSH <code>0.2.2-rc.1</code> 支持、模型/免费/日期变体自动补齐、按模型隔离的余额不足冷却和明确的 402/413 错误。聊天使用原生 <code>ctx.llm</code> 适配器；旧的 <code>llm-pi-ai</code>、回环代理和 <code>llm/stream</code> 已删除。</p>
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@goodandready/dsh-clinebot"><img src="https://img.shields.io/npm/v/@goodandready/dsh-clinebot.svg?style=for-the-badge&color=6366f1&labelColor=1e1b4b" alt="npm version"></a>

package/lib/adapter-telemetry.js

@@ -1,6 +1,7 @@
 import { estimateCost } from './model-prices.js'
 import { recordSessionRequest } from './telemetry.js'
 import { recordUsage } from './stats-storage.js'
+import { isSafeDataPath } from './path-safety.js'
 
 /**
  * Record one attempt's session and persistent telemetry.
@@ -59,7 +60,7 @@ export function recordAttemptTelemetry({
       totalTokens,
       isError,
       is429,
-      statsPath: pub.statsPath,
+      statsPath: isSafeDataPath(pub.statsPath) ? pub.statsPath : undefined,
       sessionId: options.sessionId ? String(options.sessionId) : undefined,
       purpose: options.purpose,
       ttftMs: ttftMs ?? undefined,

package/lib/cline-client.js

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto'
+import { isSecureRemoteBaseUrl } from './http.js'
 export {
   resolveApiKey,
   saveCredentialKey,
@@ -172,6 +173,9 @@ export async function fetchUsageLimits(baseUrl, apiKey, {
   if (!apiKey) {
     return { ok: false, error: 'API key is missing' }
   }
+  if (!isSecureRemoteBaseUrl(base)) {
+    return { ok: false, error: 'Insecure protocol: remote usage requests require https:' }
+  }
 
   const cacheKey = buildUsageCacheKey(base, apiKey)
   const now = Date.now()

package/lib/credential-refs.js

@@ -4,6 +4,16 @@
  */
 
 export const DEFAULT_API_KEY_ENV = 'CLINEBOT_API_KEY'
+const API_KEY_ENV_RE = /^CLINEBOT_API_KEY(_[A-Z0-9]+)?$/
+
+export function isAllowedApiKeyEnv(value) {
+  return API_KEY_ENV_RE.test(String(value || '').trim())
+}
+
+function isAllowedCredentialDeletion(value) {
+  const name = String(value || '').trim()
+  return isAllowedApiKeyEnv(name) || name === 'CLINEBOT_LOCAL_PROXY_TOKEN'
+}
 
 /**
  * Resolve the optional credentials service without tripping Cordis's
@@ -38,10 +48,11 @@ async function toCredentialRef(name) {
 }
 
 export function resolveApiKey(apiKeyEnv, env = process.env) {
-  const name = String(apiKeyEnv || DEFAULT_API_KEY_ENV).trim() || DEFAULT_API_KEY_ENV
+  const requested = String(apiKeyEnv || '').trim()
+  const name = requested || DEFAULT_API_KEY_ENV
   return {
     envName: name,
-    value: String(env[name] || ''),
+    value: isAllowedApiKeyEnv(name) ? String(env[name] || '') : '',
   }
 }
 
@@ -49,6 +60,9 @@ export async function saveCredentialKey(ctx, apiKeyEnv, apiKey) {
   const name = String(apiKeyEnv || DEFAULT_API_KEY_ENV).trim() || DEFAULT_API_KEY_ENV
   const value = String(apiKey || '').trim()
 
+  if (!isAllowedApiKeyEnv(name)) {
+    throw new Error('Disallowed apiKeyEnv: only CLINEBOT_API_KEY names are allowed')
+  }
   if (!value) {
     throw new Error('API key cannot be empty')
   }
@@ -65,7 +79,7 @@ export async function saveCredentialKey(ctx, apiKeyEnv, apiKey) {
 
 export async function deleteCredentialKey(ctx, apiKeyEnv) {
   const name = String(apiKeyEnv || '').trim()
-  if (!name) return { ok: false }
+  if (!name || !isAllowedCredentialDeletion(name)) return { ok: false }
   const credentials = credentialsService(ctx)
   if (!credentials) return { ok: false }
   try {
@@ -81,7 +95,11 @@ export async function deleteCredentialKey(ctx, apiKeyEnv) {
 }
 
 export async function resolveKeyValue(ctx, apiKeyEnv) {
-  const refName = String(apiKeyEnv || DEFAULT_API_KEY_ENV).trim() || DEFAULT_API_KEY_ENV
+  const requested = String(apiKeyEnv || '').trim()
+  const refName = requested || DEFAULT_API_KEY_ENV
+  if (!isAllowedApiKeyEnv(refName)) {
+    return { envName: refName, value: '', source: 'invalid' }
+  }
   const creds = credentialsService(ctx)
   if (creds && typeof creds.resolve === 'function') {
     try {

package/lib/http.js

@@ -53,6 +53,16 @@ function isLoopbackAddress(value) {
     || address.startsWith('::ffff:127.')
 }
 
+export function isSecureRemoteBaseUrl(value) {
+  try {
+    const url = new URL(String(value || ''))
+    return url.protocol === 'https:'
+      || (url.protocol === 'http:' && isLoopbackAddress(url.hostname))
+  } catch {
+    return false
+  }
+}
+
 export function getConnection(ctx) {
   try {
     const fromCtx = ctx?.reflect?.get

package/lib/path-safety.js

@@ -10,6 +10,11 @@ function realPath(target) {
   let current = target
   const missing = []
   while (!fs.existsSync(current)) {
+    try {
+      if (fs.lstatSync(current).isSymbolicLink()) return null
+    } catch {
+      /* path does not exist */
+    }
     const parent = path.dirname(current)
     if (parent === current) break
     missing.unshift(path.basename(current))
@@ -18,7 +23,7 @@ function realPath(target) {
   try {
     return path.join(fs.realpathSync(current), ...missing)
   } catch {
-    return target
+    return null
   }
 }
 
@@ -31,6 +36,7 @@ export function isSafeDataPath(value) {
     : path.resolve(raw)
   const home = realPath(dshHome())
   const realResolved = realPath(resolved)
+  if (!home || !realResolved) return false
   if (realResolved === home || !realResolved.startsWith(`${home}${path.sep}`)) return false
   const relative = path.relative(home, realResolved).toLowerCase()
   const segments = relative.split(/[\\/]+/)

package/lib/routes/models.js

@@ -67,7 +67,7 @@ export function registerModelsRoutes(ctx, { live, getSettingsApi, syncProviderSt
           try {
             priceSync = await ensurePublicPricesForModels(addedModels.map((model) => model.id), {
               url: pub.priceCatalogUrl,
-              cachePath: pub.priceCatalogPath,
+              cachePath: isSafeDataPath(pub.priceCatalogPath) ? pub.priceCatalogPath : undefined,
               enabled: pub.priceAutoSync !== false,
             })
           } catch {

package/lib/transport/cline-transport.js

@@ -7,9 +7,10 @@
  */
 
 import { createRequire } from 'node:module'
+import { isSecureRemoteBaseUrl } from '../http.js'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.26'
+let packageVersion = '0.6.27'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {
@@ -216,6 +217,9 @@ export async function requestChatCompletion({
   connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS,
   extraHeaders = {},
 }) {
+  if (!isSecureRemoteBaseUrl(baseUrl)) {
+    throw new Error('Insecure protocol: remote chat requests require https:')
+  }
   const connectCtrl = new AbortController()
   let timedOut = false
   const timer = setTimeout(() => {

package/lib/updater.js

@@ -22,10 +22,12 @@ const SAFE_ENV_KEYS = new Set([
   'PROCESSOR_ARCHITECTURE', 'PROCESSOR_IDENTIFIER', 'USER', 'USERNAME',
   'LOGNAME', 'HOSTNAME', 'DSH_HOME', 'DSH_PROFILE_DIR', 'NODE_EXTRA_CA_CERTS',
 ])
+const SAFE_ENV_KEYS_LOWER = new Set([...SAFE_ENV_KEYS].map((key) => key.toLowerCase()))
 const SAFE_NPM_ENV_RE = /^npm_config_(?:registry|proxy|https_proxy|strict_ssl|userconfig|globalconfig|cache|prefix)$/i
+const NPM_URL_ENV_RE = /^npm_config_(?:registry|proxy|https_proxy)$/i
 let latestCache = undefined
 
-function sanitizeProxy(value) {
+function sanitizeUrlCredentials(value) {
   try {
     const url = new URL(String(value))
     url.username = ''
@@ -39,9 +41,9 @@ function sanitizeProxy(value) {
 export function sanitizeChildEnv(env = process.env) {
   const out = {}
   for (const [key, value] of Object.entries(env)) {
-    if (!SAFE_ENV_KEYS.has(key) && !SAFE_NPM_ENV_RE.test(key)) continue
-    if (/proxy/i.test(key)) {
-      const clean = sanitizeProxy(value)
+    if (!SAFE_ENV_KEYS_LOWER.has(key.toLowerCase()) && !SAFE_NPM_ENV_RE.test(key)) continue
+    if (NPM_URL_ENV_RE.test(key)) {
+      const clean = sanitizeUrlCredentials(value)
       if (clean) out[key] = clean
     } else {
       out[key] = value

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.26",
+  "version": "0.6.27",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",