@goodandready/dsh-context-lens 0.1.16 → 0.1.18

package/lib/client.js

@@ -5,7 +5,14 @@ window.__ModuleLoader__.load({
     const React = require('react');
     const NS = '@goodandready/dsh-context-lens';
 
-    const en = {
+        const en = {
+      'update.available': 'Update available: v{latestVersion} (current: v{currentVersion})',
+      'update.btn': 'Update Now',
+      'update.updating': 'Updating…',
+      'update.done': 'Successfully updated to v{version}! Please restart DSH.',
+      'update.failed': 'Update failed: {error}',
+      'update.checking': 'Checking for updates…',
+      'update.up_to_date': 'Up to date',
       title: 'Context Lens & Token Guard',
       sub: 'AST compression, log filtering, token budget',
       mode: 'Compression mode',
@@ -23,39 +30,55 @@ window.__ModuleLoader__.load({
       lowBudget: 'Budget nearly exhausted',
       threshold: 'Auto-compress threshold (chars)',
       autoCollapse: 'Warn when budget is nearly exhausted',
+      budgetAlertPercent: 'Budget alert threshold (%)',
       previewApprox: 'Server preview',
       noData: 'No data yet',
       refresh: 'Refresh',
       ops: 'ops',
       active: 'Active',
       readyState: 'Ready',
-      lowBudgetBadge: 'Low Budget ⚠'
+      lowBudgetBadge: 'Low Budget ⚠',
+      focusPaths: 'Active focus',
+      noFocus: 'No focus paths set',
+      clearFocus: 'Clear focus'
     };
-    const ru = {
-      title: 'Context Lens & Token Guard',
-      sub: 'Сжатие AST, фильтрация логов, контроль токенов',
-      mode: 'Режим сжатия',
-      depth: 'Глубина AST',
-      tracking: 'Считать экономию',
-      preview: 'Предпросмотр лога',
-      compress: 'Сжать',
-      saved: 'Сэкономлено',
-      tokens: 'токенов',
-      placeholder: 'Вставьте лог Jest/Pytest…',
-      saving: 'Сохранение…',
-      ready: 'Готово',
-      budget: 'Бюджет',
-      history: 'Последние операции',
-      lowBudget: 'Бюджет почти исчерпан',
-      threshold: 'Порог авто-сжатия (символы)',
-      autoCollapse: 'Предупреждать при почти исчерпанном бюджете',
-      previewApprox: 'Серверный предпросмотр',
-      noData: 'Пока нет данных',
-      refresh: 'Обновить',
-      ops: 'оп.',
-      active: 'Активен',
-      readyState: 'Готов',
-      lowBudgetBadge: 'Мало бюджета ⚠'
+
+    const zh = {
+      'update.available': '发现新版本 v{latestVersion}（当前版本 v{currentVersion}）',
+      'update.btn': '立即更新',
+      'update.updating': '正在更新…',
+      'update.done': '更新成功至 v{version}！请重启 DSH 服务生效。',
+      'update.failed': '更新失败：{error}',
+      'update.checking': '正在检查更新…',
+      'update.up_to_date': '已是最新版本',
+      title: 'Context Lens 上下文镜头与 Token 守卫',
+      sub: 'AST 代码精简、日志过滤与 Token 预算监控',
+      mode: '压缩模式',
+      depth: 'AST 最大深度',
+      tracking: '追踪 Token 节省',
+      preview: '日志预览',
+      compress: '压缩',
+      saved: '已节省',
+      tokens: 'Token',
+      placeholder: '在此粘贴 Jest/Pytest 等测试日志…',
+      saving: '保存中…',
+      ready: '已就绪',
+      budget: '预算',
+      history: '近期操作',
+      lowBudget: 'Token 预算即将耗尽',
+      threshold: '自动压缩阈值 (字符数)',
+      autoCollapse: '预算偏低时在界面提示警告',
+      budgetAlertPercent: '预算警告阈值 (%)',
+      previewApprox: '服务端压缩预览',
+      noData: '暂无数据',
+      refresh: '刷新',
+      ops: '次操作',
+      active: '运行中',
+      readyState: '已就绪',
+      lowBudgetBadge: '预算紧张 ⚠',
+      focusPaths: '当前聚焦路径',
+      noFocus: '未设置聚焦路径',
+      clearFocus: '清除聚焦'
     };
 
     function ensureCss() {
@@ -99,12 +122,12 @@ window.__ModuleLoader__.load({
 .cl-badge-ok {
   border-color: var(--dsw-alias-state-success-primary, #10b981);
   color: var(--dsw-alias-state-success-primary, #10b981);
-  background: rgba(16, 185, 129, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent);
 }
 .cl-badge-warn {
   border-color: var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
 }
 .cl-stat-grid {
   display: grid;
@@ -202,7 +225,7 @@ window.__ModuleLoader__.load({
 .cl-banner-warn {
   padding: 10px 14px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.1);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 10%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -220,10 +243,22 @@ window.__ModuleLoader__.load({
 .cl-hist-item:last-child {
   border-bottom: none;
 }
+.cl-tag {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  padding: 2px 6px;
+  background: var(--dsw-alias-bg-layer-1);
+  border: 1px solid var(--dsw-alias-border-l2);
+  border-radius: 4px;
+  font-size: 11px;
+  font-family: monospace;
+  color: var(--dsw-alias-label-secondary);
+}
 .cl-error-box {
   padding: 12px;
   border-radius: 8px;
-  background: rgba(239, 68, 68, 0.08);
+  background: color-mix(in srgb, var(--dsw-alias-state-error-primary, #ef4444) 8%, transparent);
   border: 1px solid var(--dsw-alias-state-error-primary, #ef4444);
   color: var(--dsw-alias-state-error-primary, #ef4444);
   font-size: 12px;
@@ -232,6 +267,18 @@ window.__ModuleLoader__.load({
       document.head.appendChild(style);
     }
 
+    function makeT(dict, fallback) {
+      return function t(key, vars) {
+        let val = (dict && dict[key]) || (fallback && fallback[key]) || key;
+        if (vars && typeof val === 'string') {
+          for (const k of Object.keys(vars)) {
+            val = val.replace(new RegExp('\\{' + k + '\\}', 'g'), String(vars[k]));
+          }
+        }
+        return val;
+      };
+    }
+
     function createErrorBoundary() {
       if (!React || typeof React.Component !== 'function') {
         return function NoopBoundary(props) { return (props && props.children) || null; };
@@ -270,13 +317,13 @@ window.__ModuleLoader__.load({
       try {
         if (ctx && ctx.locale && typeof ctx.locale.getSnapshot === 'function') {
           const snap = ctx.locale.getSnapshot();
-          if (snap && snap.active && snap.active.startsWith('ru')) return ru;
+          if (snap && snap.active && snap.active.startsWith('zh')) return zh;
         }
-      } catch {}
+      } catch (err) { void err; }
       return en;
     }
 
-    function StatusPanel({ stats, history, labels, onRefresh, title, showBadge, compact }) {
+    function StatusPanel({ stats, history, focus, sessionId, labels, onRefresh, onClearFocus, title, showBadge, compact }) {
       ensureCss();
       const L = labels || en;
       const warn = !!(stats && stats.lowBudget);
@@ -351,6 +398,33 @@ window.__ModuleLoader__.load({
         ));
       }
 
+            // Active focus paths section
+      const focusPaths = (focus && focus.paths) || [];
+      if (focusPaths.length > 0 || onClearFocus) {
+        children.push(React.createElement('div', {
+          key: 'focus',
+          style: { marginTop: 10, paddingTop: 8, borderTop: '1px solid var(--dsw-alias-border-l2)' }
+        },
+          React.createElement('div', {
+            style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: 4 }
+          },
+            React.createElement('span', { style: { fontSize: 11, fontWeight: 600, color: 'var(--dsw-alias-label-secondary)' } }, L.focusPaths),
+            focusPaths.length > 0 && onClearFocus
+              ? React.createElement('button', {
+                  type: 'button',
+                  onClick: onClearFocus,
+                  style: { background: 'none', border: 'none', padding: 0, fontSize: 10, color: 'var(--dsw-alias-label-tertiary)', cursor: 'pointer', textDecoration: 'underline' }
+                }, L.clearFocus)
+              : null
+          ),
+          focusPaths.length > 0
+            ? React.createElement('div', { style: { display: 'flex', flexWrap: 'wrap', gap: 4, marginTop: 4 } },
+                ...focusPaths.slice(0, 4).map((p, i) => React.createElement('span', { key: i, className: 'cl-tag' }, p))
+              )
+            : React.createElement('div', { style: { fontSize: 11, color: 'var(--dsw-alias-label-tertiary)', fontStyle: 'italic' } }, L.noFocus)
+        ));
+      }
+
       if (history && history.length) {
         children.push(React.createElement('div', {
           key: 'hist',
@@ -386,20 +460,31 @@ window.__ModuleLoader__.load({
         .then((r) => r.ok ? r.json() : null);
     }
 
+    function clearLensFocus(sessionId) {
+      const q = sessionId ? '?sessionId=' + encodeURIComponent(sessionId) : '';
+      return fetch('/dsh-context-lens/clear-focus' + q, { method: 'POST', headers: { accept: 'application/json' } })
+        .then((r) => r.ok ? r.json() : null);
+    }
+
     function LensTabInner({ ctx: _ctx, scope }) {
       ensureCss();
       const [stats, setStats] = React.useState(null);
       const [history, setHistory] = React.useState([]);
+      const [focus, setFocus] = React.useState(null);
+      const [sessionId, setSessionId] = React.useState(null);
       const L = React.useMemo(() => getActiveLocale(_ctx), [_ctx]);
       const apply = (j) => {
         if (j && j.stats) setStats(j.stats);
         if (j && j.history) setHistory(j.history || []);
+        if (j && j.focus) setFocus(j.focus);
+        if (j && j.sessionId) setSessionId(j.sessionId);
       };
       const refresh = () => fetchLensStatus().then(apply).catch(() => {});
+      const handleClearFocus = () => clearLensFocus(sessionId).then(() => refresh()).catch(() => {});
       React.useEffect(() => { refresh(); }, []);
       return React.createElement('div', { style: { padding: 12 } },
         React.createElement(StatusPanel, {
-          stats, history, labels: L, onRefresh: refresh, title: 'Context Lens', showBadge: false, compact: false
+          stats, history, focus, sessionId, labels: L, onRefresh: refresh, onClearFocus: handleClearFocus, title: 'Context Lens', showBadge: false, compact: false
         })
       );
     }
@@ -414,6 +499,8 @@ window.__ModuleLoader__.load({
       ensureCss();
       const [stats, setStats] = React.useState(null);
       const [history, setHistory] = React.useState([]);
+      const [focus, setFocus] = React.useState(null);
+      const [sessionId, setSessionId] = React.useState(null);
       const [open, setOpen] = React.useState(false);
       const ref = React.useRef(null);
       const L = React.useMemo(() => getActiveLocale(_ctx), [_ctx]);
@@ -421,8 +508,12 @@ window.__ModuleLoader__.load({
       const fetchStatus = () => fetchLensStatus().then((j) => {
         if (j && j.stats) setStats(j.stats);
         if (j && j.history) setHistory(j.history || []);
+        if (j && j.focus) setFocus(j.focus);
+        if (j && j.sessionId) setSessionId(j.sessionId);
       }).catch(() => {});
 
+      const handleClearFocus = () => clearLensFocus(sessionId).then(() => fetchStatus()).catch(() => {});
+
       React.useEffect(() => {
         let alive = true;
         fetchStatus();
@@ -469,13 +560,13 @@ window.__ModuleLoader__.load({
         style: {
           position: 'absolute', top: 'calc(100% + 6px)', right: 0, width: 280,
           background: 'var(--dsw-alias-bg-layer-3)', border: '1px solid var(--dsw-alias-border-l2)',
-          borderRadius: 10, boxShadow: '0 8px 24px rgba(0, 0, 0, 0.28)', padding: '12px 14px',
+          borderRadius: 10, boxShadow: 'var(--dsw-alias-modal-shadow, var(--dsw-alias-shadow-large, 0 4px 16px var(--dsw-alias-border-l1)))', padding: '12px 14px',
           zIndex: 1000, fontSize: 12, color: 'var(--dsw-alias-label-primary)', cursor: 'default', textAlign: 'left'
         },
         onClick: (e) => e.stopPropagation()
       },
         React.createElement(StatusPanel, {
-          stats, history, labels: L, onRefresh: fetchStatus, title: 'Context Lens', showBadge: true, compact: true
+          stats, history, focus, sessionId, labels: L, onRefresh: fetchStatus, onClearFocus: handleClearFocus, title: 'Context Lens', showBadge: true, compact: true
         })
       ) : null;
 
@@ -507,6 +598,7 @@ window.__ModuleLoader__.load({
         astSkeletonMaxDepth: 3,
         tokenSavingsTracking: true,
         budgetLimit: 100000,
+        budgetAlertPercent: 90,
         autoCollapse: true,
         autoCompressThreshold: 4000
       });
@@ -521,7 +613,7 @@ window.__ModuleLoader__.load({
       const scopeRef = React.useRef(null);
       if (!scopeRef.current && _ctx) {
         try {
-          const s = (_ctx.get && _ctx.get('lanSettings')) || _ctx.settingsScope;
+          const s = _ctx.settingsScope || (_ctx.get && _ctx.get('settingsScope'));
           if (s && typeof s.bind === 'function') {
             scopeRef.current = s.bind({ namespace: NS });
           }
@@ -561,7 +653,7 @@ window.__ModuleLoader__.load({
             unsub = scope.subscribe(() => {
               if (!cancelled) loadSnap();
             });
-          } catch (_) {}
+          } catch (_err) { void _err; }
         }
 
         return () => {
@@ -570,6 +662,69 @@ window.__ModuleLoader__.load({
         };
       }, [scope]);
 
+      const [updateState, setUpdateState] = React.useState({
+        checking: false,
+        updating: false,
+        currentVersion: '0.1.18',
+        latestVersion: '',
+        updateAvailable: false,
+        canAutoUpdate: true,
+        notice: '',
+        error: ''
+      });
+
+      const checkUpdate = React.useCallback(async () => {
+        setUpdateState((s) => ({ ...s, checking: true, error: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update');
+          if (!res.ok) throw new Error('HTTP ' + res.status);
+          const data = await res.json().catch(() => ({}));
+          setUpdateState((s) => ({
+            ...s,
+            checking: false,
+            currentVersion: data.currentVersion || s.currentVersion,
+            latestVersion: data.latestVersion || '',
+            updateAvailable: !!data.updateAvailable,
+            canAutoUpdate: data.canAutoUpdate !== false,
+          }));
+        } catch (_) {
+          setUpdateState((s) => ({ ...s, checking: false }));
+        }
+      }, []);
+
+      React.useEffect(() => {
+        if (expanded) checkUpdate();
+      }, [expanded, checkUpdate]);
+
+      async function handleTriggerUpdate() {
+        if (updateState.updating) return;
+        setUpdateState((s) => ({ ...s, updating: true, error: '', notice: '' }));
+        try {
+          const res = await fetch('/api/dsh-context-lens/update', {
+            method: 'POST',
+            headers: { 'x-dsh-plugin-update': '1', 'x-dsh-context-lens-update': '1' }
+          });
+          const data = await res.json().catch(() => ({}));
+          if (!res.ok || data.ok === false || data.error) {
+            throw new Error(data.error || ('HTTP ' + res.status));
+          }
+          const newVer = data.updatedVersion || updateState.latestVersion || updateState.currentVersion;
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            updateAvailable: false,
+            currentVersion: newVer,
+            notice: tt('update.done', { version: newVer }),
+          }));
+        } catch (e) {
+          setUpdateState((s) => ({
+            ...s,
+            updating: false,
+            error: tt('update.failed', { error: e && e.message || String(e) }),
+          }));
+        }
+      }
+
       React.useEffect(() => {
         if (!expanded) return;
         fetch('/dsh-context-lens/status').then((r) => r.ok ? r.json() : null).then((j) => {
@@ -580,7 +735,8 @@ window.__ModuleLoader__.load({
         }).catch(() => {});
       }, [expanded, draft.autoCollapse]);
 
-      const tt = t || ((k) => (en[k] || k));
+      const L = React.useMemo(() => getActiveLocale(_ctx), [_ctx]);
+      const tt = React.useMemo(() => (t ? t : makeT(L, en)), [t, L]);
 
       let ChevronIcon = null;
       try {
@@ -589,9 +745,29 @@ window.__ModuleLoader__.load({
       } catch (e) { ChevronIcon = null; }
 
       const Chevron = ChevronIcon ? function ChevronNode(p) {
-        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s', transform: p.open ? 'rotate(180deg)' : 'none' } });
+        return React.createElement(ChevronIcon, { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)', transition: 'transform .16s ease', transform: p.open ? 'rotate(180deg)' : 'none' } });
       } : function Fallback(p) {
-        return React.createElement('span', { className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''), style: { marginLeft: 'auto', color: 'var(--dsw-alias-label-tertiary)' } }, '▼');
+        return React.createElement('svg', {
+          className: 'cl-chev' + (p.open ? ' cl-chev-open' : ''),
+          viewBox: '0 0 14 14',
+          width: 14,
+          height: 14,
+          style: {
+            marginLeft: 'auto',
+            color: 'var(--dsw-alias-label-tertiary)',
+            transform: p.open ? 'rotate(180deg)' : 'none',
+            transition: 'transform .16s ease',
+            display: 'inline-block',
+            flexShrink: 0
+          }
+        }, React.createElement('path', {
+          d: 'M3.5 5.25L7 8.75L10.5 5.25',
+          fill: 'none',
+          stroke: 'currentColor',
+          strokeWidth: '1.5',
+          strokeLinecap: 'round',
+          strokeLinejoin: 'round'
+        }));
       };
 
       async function onSave() {
@@ -645,6 +821,39 @@ window.__ModuleLoader__.load({
           React.createElement(Chevron, { open: expanded })
         ),
         expanded ? React.createElement('div', { className: 'cl-body', style: { borderTop: '1px solid var(--dsw-alias-border-l2)', paddingTop: 12 } },
+          React.createElement('div', {
+            style: {
+              display: 'flex', alignItems: 'center', justifyContent: 'space-between',
+              padding: '6px 10px', marginBottom: 10, borderRadius: 8,
+              background: 'var(--dsw-alias-bg-layer-2)', border: '1px solid var(--dsw-alias-border-l2)', fontSize: 12
+            }
+          },
+            React.createElement('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
+              React.createElement('span', { style: { fontWeight: 500, color: 'var(--dsw-alias-label-primary)' } },
+                'v' + (updateState.currentVersion || '0.1.18')
+              ),
+              updateState.checking
+                ? React.createElement('span', { style: { color: 'var(--dsw-alias-label-tertiary)', fontSize: 11 } }, tt('update.checking'))
+                : updateState.updateAvailable
+                  ? React.createElement('span', { className: 'cl-badge cl-badge-warn' },
+                      tt('update.available', { latestVersion: updateState.latestVersion, currentVersion: updateState.currentVersion })
+                    )
+                  : React.createElement('span', { className: 'cl-badge cl-badge-ok' },
+                      '✓ ' + tt('update.up_to_date')
+                    )
+            ),
+            updateState.updateAvailable
+              ? React.createElement('button', {
+                  type: 'button',
+                  className: 'cl-btn cl-btn-primary',
+                  disabled: updateState.updating,
+                  onClick: handleTriggerUpdate,
+                  style: { padding: '3px 8px', fontSize: 11 }
+                }, updateState.updating ? tt('update.updating') : tt('update.btn'))
+              : null
+          ),
+          updateState.notice ? React.createElement('div', { className: 'cl-banner-ok', style: { marginBottom: 10, padding: '8px 12px', borderRadius: 8, background: 'color-mix(in srgb, var(--dsw-alias-state-success-primary, #10b981) 8%, transparent)', border: '1px solid var(--dsw-alias-state-success-primary, #10b981)', color: 'var(--dsw-alias-state-success-primary, #10b981)', fontSize: 12 } }, '✓ ' + updateState.notice) : null,
+          updateState.error ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 10 } }, updateState.error) : null,
           budgetWarn ? React.createElement('div', { className: 'cl-banner-warn', style: { marginBottom: 12 } }, '⚠ ' + tt('lowBudget')) : null,
           status === 'loading' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Loading…') :
           status === 'unavailable' ? React.createElement('div', { style: { padding: 12, color: 'var(--dsw-alias-label-secondary)' } }, 'Settings unavailable — plugin not registered on host yet') :
@@ -696,6 +905,14 @@ window.__ModuleLoader__.load({
                 onChange: (e) => setDraft((d) => ({ ...d, budgetLimit: parseInt(e.target.value, 10) || 100000 }))
               })
             ),
+            React.createElement('div', { className: 'cl-field', style: { display: 'flex', flexDirection: 'column', gap: 6, padding: '8px 0' } },
+              React.createElement('label', { style: { fontSize: 13, color: 'var(--dsw-alias-label-secondary)' } }, tt('budgetAlertPercent')),
+              React.createElement('input', {
+                className: 'cl-input', type: 'number', min: 50, max: 99, step: 1,
+                value: draft.budgetAlertPercent,
+                onChange: (e) => setDraft((d) => ({ ...d, budgetAlertPercent: parseInt(e.target.value, 10) || 90 }))
+              })
+            ),
             React.createElement('div', { className: 'cl-field', style: { display: 'flex', flexDirection: 'column', gap: 6, padding: '8px 0' } },
               React.createElement('label', { style: { fontSize: 13, color: 'var(--dsw-alias-label-secondary)' } }, tt('threshold')),
               React.createElement('input', {
@@ -741,9 +958,28 @@ window.__ModuleLoader__.load({
       );
     }
 
-    module.exports.inject = ['slots', 'locale'];
+    module.exports.inject = ['slots', 'locale', 'settingsScope'];
     module.exports.apply = function apply(ctx) {
-      try { ctx.locale.register(NS, { en, ru }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      let hasEffect = false;
+      try {
+        hasEffect = typeof ctx.effect === 'function';
+      } catch (_) {
+        hasEffect = false;
+      }
+      if (hasEffect) {
+        ctx.effect(() => {
+          try {
+            const dispose = ctx.locale?.register ? ctx.locale.register(NS, { en, zh }) : undefined;
+            return () => {
+              if (typeof dispose === 'function') dispose();
+            };
+          } catch (e) {
+            console.warn('[dsh-context-lens] locale register failed', e && e.message || e);
+          }
+        }, 'dsh-context-lens: locale');
+      } else {
+        try { ctx.locale.register(NS, { en, zh }); } catch (e) { console.warn('[dsh-context-lens] locale register failed', e && e.message || e); }
+      }
       if (!ctx.slots) return;
       let registered = false;
       const doRegister = () => {
@@ -819,14 +1055,14 @@ window.__ModuleLoader__.load({
                     try { registerPaneTab(); } catch (e2) {}
                   }
                 } else {
-                  try { registerPaneTab(); } catch (e) {}
+                  try { registerPaneTab(); } catch (err) { void err; }
                 }
               }
             } catch (e) {
               console.warn("[dsh-context-lens] native sidebar registration failed", e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) { void err; }
       }
 
       if (typeof ctx.inject === 'function') {
@@ -851,7 +1087,7 @@ window.__ModuleLoader__.load({
               console.warn('[dsh-context-lens] betterSidebar registerTab failed', e && e.message || e);
             }
           });
-        } catch (e) {}
+        } catch (err) { void err; }
       }
 
       if (ctx.slots) {
@@ -875,7 +1111,7 @@ window.__ModuleLoader__.load({
             try { headerChipRegister(); } catch (e2) {}
           }
         } else {
-          try { headerChipRegister(); } catch (e) {}
+          try { headerChipRegister(); } catch (err) { void err; }
         }
       }
     };

package/lib/http.js

@@ -0,0 +1,114 @@
+export function writeJson(res, code, body) {
+  try {
+    res.writeHead(code, {
+      'Content-Type': 'application/json; charset=utf-8',
+      'Cache-Control': 'no-store',
+    });
+    res.end(JSON.stringify(body));
+  } catch {
+    /* socket already closed */
+  }
+}
+
+export function readBody(req, maxBytes = 256 * 1024) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    req.on('data', (c) => {
+      size += c.length;
+      if (size > maxBytes) {
+        req.destroy();
+        reject(new Error('body too large'));
+        return;
+      }
+      chunks.push(c);
+    });
+    req.on('end', () => resolve(Buffer.concat(chunks)));
+    req.on('error', reject);
+  });
+}
+
+export function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+export function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^\[|\]$/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.');
+}
+
+/** Reject cross-site writes while allowing local, LAN, and reverse-proxy UIs. */
+export function isTrustedRequest(request) {
+  const secFetchSite = header(request, 'sec-fetch-site');
+  if (secFetchSite === 'cross-site') {
+    return false;
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host');
+  const origin = header(request, 'origin');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  const referer = header(request, 'referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  // Requests without origin/referer (e.g. curl, loopback tests, or internal calls)
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    return true;
+  }
+
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+    return true;
+  }
+
+  return false;
+}
+
+export const UPDATE_HEADER = 'x-dsh-plugin-update';
+export const ALT_UPDATE_HEADER = 'x-dsh-context-lens-update';
+
+export function isTrustedUpdateRequest(request) {
+  const updHdr = header(request, UPDATE_HEADER) || header(request, ALT_UPDATE_HEADER);
+  if (updHdr !== '1') return false;
+  if (!isLoopbackAddress(request?.socket?.remoteAddress)) return false;
+  const site = header(request, 'sec-fetch-site');
+  if (site !== undefined && site !== 'same-origin') return false;
+  const origin = header(request, 'origin');
+  const host = header(request, 'host');
+  if (origin === undefined || host === undefined) return false;
+  try {
+    const url = new URL(origin);
+    return (url.protocol === 'http:' || url.protocol === 'https:')
+      && isLoopbackAddress(url.hostname) && url.host === host;
+  } catch {
+    return false;
+  }
+}