@goodandready/dsh-clinebot 0.6.30 → 0.6.31

package/lib/stats-storage.js

@@ -6,7 +6,7 @@
  */
 
 import { readFileSync, writeFileSync, renameSync, mkdirSync, existsSync, copyFileSync, readdirSync, unlinkSync } from 'node:fs'
-import { homedir } from 'node:os'
+import { resolveDataPath, isSafeDataPath } from './path-safety.js'
 import path from 'node:path'
 import {
   latencyBucketIndex,
@@ -85,33 +85,8 @@ function localDateKey(date) {
   return `${date.getFullYear()}-${String(date.getMonth() + 1).padStart(2, '0')}-${String(date.getDate()).padStart(2, '0')}`
 }
 
-/** Get active .dsh directory, respecting DSH_HOME and HOME. */
-function getDshHome() {
-  if (process.env.DSH_HOME) return process.env.DSH_HOME
-  const home = process.env.HOME || homedir()
-  return path.join(home, '.dsh')
-}
-
 export function resolvePath(targetPath) {
-  let unwrapGuard = 0
-  while (unwrapGuard < 5 && targetPath) {
-    if (typeof targetPath === 'function') {
-      try { targetPath = targetPath() } catch { targetPath = ''; break }
-      unwrapGuard += 1
-    } else if (typeof targetPath === 'object' && typeof targetPath.get === 'function') {
-      try { targetPath = targetPath.get() } catch { targetPath = ''; break }
-      unwrapGuard += 1
-    } else {
-      break
-    }
-  }
-  if (typeof targetPath !== 'string') targetPath = ''
-  if (!targetPath) return path.join(getDshHome(), 'clinebot-stats.json')
-  if (targetPath.startsWith('~/') || targetPath === '~') {
-    const home = process.env.HOME || homedir()
-    return path.join(home, targetPath.slice(1))
-  }
-  return path.resolve(targetPath)
+  return resolveDataPath(targetPath, 'clinebot-stats.json')
 }
 
 /**

package/lib/transport/cline-transport.js

@@ -10,7 +10,7 @@ import { createRequire } from 'node:module'
 import { isSecureRemoteBaseUrl } from '../http.js'
 
 const require = createRequire(import.meta.url)
-let packageVersion = '0.6.30'
+let packageVersion = '0.6.31'
 try {
   packageVersion = require('../../package.json').version || packageVersion
 } catch {

package/lib/updater.js

@@ -1,4 +1,4 @@
-import { getConnection } from './http.js'
+import { getConnection, isLoopbackAddress, isLoopbackHostname } from './http.js'
 /**
  * Host-side one-click updater for @goodandready/dsh-clinebot.
  * Conforms to the DSH authoring reference implementation.
@@ -58,12 +58,7 @@ function header(request, name) {
   return Array.isArray(value) ? value[0] : value
 }
 
-function isLoopback(value) {
-  const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
-  return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address?.startsWith('127.') === true
-    || address?.startsWith('::ffff:127.') === true
-}
+
 
 export function isTrustedUpdateRequest(request, targetCtx = null) {
   if (header(request, UPDATE_HEADER) !== '1') return false
@@ -77,7 +72,7 @@ export function isTrustedUpdateRequest(request, targetCtx = null) {
     }
     if (rejection !== undefined) return false
   }
-  if (!isLoopback(request?.socket?.remoteAddress)) return false
+  if (!isLoopbackAddress(request?.socket?.remoteAddress)) return false
   const site = header(request, 'sec-fetch-site')
   if (site !== undefined && site !== 'same-origin') return false
   const origin = header(request, 'origin')
@@ -86,7 +81,7 @@ export function isTrustedUpdateRequest(request, targetCtx = null) {
   try {
     const url = new URL(origin)
     return (url.protocol === 'http:' || url.protocol === 'https:')
-      && isLoopback(url.hostname) && url.host === host
+      && isLoopbackHostname(url.hostname) && url.host === host
   } catch {
     return false
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-clinebot",
-  "version": "0.6.30",
+  "version": "0.6.31",
   "description": "DeepSeek Harness companion for ClineBot / ClinePass: dynamic subscription models sync, quota exhaustion warnings, session metrics, dedicated settings page, live usage limits, and /cline slash-command.",
   "license": "MIT",
   "type": "module",