@goodandready/dsh-cost-meter 0.7.6 → 0.7.8

package/docs/design/DESIGN.md

@@ -82,7 +82,7 @@
   - Не допускать утечек локальных путей и инфраструктурных данных в коде или документации.
 
 ## History & Decisions
-- 2026-09-05 (v0.7.6):
+- 2026-09-05 (v0.7.8):
   - Hotfix: исправлен ReferenceError (t is not defined) в объекте словаря ru (lib/client.js) (#15).
   - Добавлен автоматический тест на чистое исполнение фабрики client loader (`test/public-route.test.mjs`).
 - 2026-09-05 (v0.7.4):

package/docs/plans/findings.md

@@ -0,0 +1,10 @@
+# Findings & Architecture Decisions (v0.7.8)
+
+## 1. Browser Request Race Conditions
+In `CostMeter`, rapid model switches or toggling the popover calls `load(usedKeys)`. Since network latency varies, an older request might resolve after a newer one. By tracking an active request counter or cancellation token per effect invocation, we ensure only the most up-to-date state response mutates the component state.
+
+## 2. IANA TimeZone Validation
+`Intl.DateTimeFormat(undefined, { timeZone })` throws a `RangeError` if the timezone string is invalid. We can safely leverage this in `CostMeterCard` to reject typos (e.g. `Europe/Moskow` instead of `Europe/Moscow`) on the client before writing to `settingsScope`.
+
+## 3. Query Parameter Sanitization
+The endpoint `GET /dsh-cost-meter/state?models=...` accepts comma-separated model keys. Adding a length bound (e.g. <= 128 chars) and trimming ensures no malformed payloads cause unexpected overhead.

package/docs/plans/progress.md

@@ -0,0 +1,17 @@
+# Implementation Progress (v0.7.8)
+
+- [x] Create Gitea Issue #19
+- [x] Create isolated worktree `stability-v078`
+- [x] Bump version to 0.7.8 in `package.json`
+- [x] Add monotonic request sequence guard in `lib/client.js` `CostMeter`
+- [x] Add IANA time zone validation in `lib/client.js` `CostMeterCard`
+- [x] Sanitize query parameters in `lib/index.js`
+- [x] Add automated unit tests (`test/timezone-sanitization.test.mjs`, 11/11 passing)
+- [x] Update design documentation in `docs/design/DESIGN.md`
+- [ ] Commit changes with conventional commits (`git-antigravity`)
+- [ ] Create Pull Request and merge into `main`
+- [ ] Test package on MiniPC isolated test server (`192.168.1.123:3082`)
+- [ ] Smoke-test package on production candidate (`192.168.1.111:3080`)
+- [ ] Publish v0.7.8 to npm and GitHub Release
+- [ ] Install v0.7.8 from npm on MiniAI and verify live health
+- [ ] Close Gitea Issue #19 and clean up worktree

package/docs/plans/task_plan.md

@@ -0,0 +1,24 @@
+# Task Plan: Stability, Race Condition Prevention & TimeZone Validation (v0.7.8)
+
+## 1. Goal
+Strengthen `@goodandready/dsh-cost-meter` runtime resilience:
+- Prevent race condition response overwrites in browser `CostMeter` component.
+- Validate IANA TimeZone inputs in `CostMeterCard` settings before saving.
+- Sanitize `models` query parameter keys in `lib/index.js` route handler.
+- Maintain strict backward compatibility, zero regression in automated tests.
+
+## 2. Checklist
+- [ ] Bump version to `0.7.8` in `package.json`
+- [ ] Implement cancellation flag / abort protection in `lib/client.js` `CostMeter`
+- [ ] Implement `isValidTimeZone` helper and validation check in `CostMeterCard`
+- [ ] Implement key sanitization (length <= 128 chars, alphanumeric/dash/slash) in `lib/index.js`
+- [ ] Add unit tests for timezone check and query sanitization
+- [ ] Run test suite (`npm test`)
+- [ ] Update `docs/design/DESIGN.md`
+- [ ] Conventional Commit & Push
+- [ ] Gitea PR & Merge to `main`
+- [ ] Test on MiniPC test server (`192.168.1.123`)
+- [ ] Production Smoke Verification on MiniAI (`192.168.1.111`)
+- [ ] Publish Tag `v0.7.8`, GitHub Release & npm
+- [ ] Update production profile from npm
+- [ ] Close Gitea Issue #19 and clean up worktree

package/lib/client.js

@@ -131,6 +131,7 @@ window.__ModuleLoader__.load({
       if (document.getElementById('dsh-cost-meter-card-styles')) return
       const el = document.createElement('style')
       el.id = 'dsh-cost-meter-card-styles'
+      el.dataset.dshPlugin = 'dsh-cost-meter'
       el.textContent = cardCss
       document.head.appendChild(el)
     }
@@ -208,9 +209,14 @@ window.__ModuleLoader__.load({
           } catch (e) { broken.push('usdRate: ' + (e && e.message || String(e))) }
         }
 
-        try {
-          await scope.set('displayTimeZone', String(draft.displayTimeZone || 'Europe/Moscow').trim())
-        } catch (e) { broken.push('displayTimeZone: ' + (e && e.message || String(e))) }
+        const tzVal = String(draft.displayTimeZone || 'Europe/Moscow').trim()
+        if (!isValidTimeZone(tzVal)) {
+          broken.push('displayTimeZone: invalid IANA time zone')
+        } else {
+          try {
+            await scope.set('displayTimeZone', tzVal)
+          } catch (e) { broken.push('displayTimeZone: ' + (e && e.message || String(e))) }
+        }
 
         setSaving(false)
         if (broken.length) {
@@ -384,6 +390,16 @@ window.__ModuleLoader__.load({
       return String(Math.floor(minute / 60)).padStart(2, '0') + ':' + String(minute % 60).padStart(2, '0')
     }
 
+    function isValidTimeZone(tz) {
+      if (!tz || typeof tz !== 'string') return false
+      try {
+        new Intl.DateTimeFormat(undefined, { timeZone: tz })
+        return true
+      } catch {
+        return false
+      }
+    }
+
     /**
      * Render a UTC minute-of-day in the display zone. Built from a real Date so
      * the zone's current offset (and any DST) comes from Intl, not arithmetic.
@@ -471,6 +487,14 @@ window.__ModuleLoader__.load({
       const [open, setOpen] = React.useState(false)
       const [now, setNow] = React.useState(() => new Date())
       const box = React.useRef(null)
+      const settingsScope = ctx.settingsScope || (ctx.services && ctx.services.settingsScope)
+      const settingsSnap = React.useSyncExternalStore
+        ? React.useSyncExternalStore(
+            (cb) => (settingsScope && typeof settingsScope.subscribe === 'function' ? settingsScope.subscribe(cb) : () => {}),
+            () => (settingsScope && typeof settingsScope.get === 'function' ? settingsScope.get(NS) : null),
+            () => null,
+          )
+        : null
 
       // Every model this session actually billed, so each part is priced on its
       // own tariff instead of the current model's. Usage arrives split into
@@ -482,14 +506,18 @@ window.__ModuleLoader__.load({
           m.usage.cacheReadTokens || m.usage.cacheWriteTokens)
       const usedKeys = used.map((m) => m.provider + '/' + m.model).sort().join(',')
 
+      const reqSeq = React.useRef(0)
+
       const load = React.useCallback((keys) => {
+        const seq = ++reqSeq.current
         const query = keys ? '?models=' + encodeURIComponent(keys) : ''
         fetch(STATE_PATH + query, { headers: { accept: 'application/json' } })
           .then((r) => (r.ok ? r.json() : null))
-          .then((data) => { if (data) setState(data) })
+          .then((data) => {
+            if (data && seq === reqSeq.current) setState(data)
+          })
           .catch(() => {})
       }, [])
-
       // Refetch when the set of billed models changes — a new model needs its
       // own tariff before its tokens can be priced.
       React.useEffect(() => { load(usedKeys) }, [load, usedKeys])
@@ -507,8 +535,9 @@ window.__ModuleLoader__.load({
 
       if (!state) return null
 
-      const currency = state.currency || '$'
-      const fx = Number(state.usdRate) || 1
+      const stored = (settingsSnap && settingsSnap.value) || {}
+      const currency = stored.currency !== undefined ? String(stored.currency) : (state.currency || '$')
+      const fx = stored.usdRate !== undefined && !isNaN(Number(stored.usdRate)) ? Number(stored.usdRate) : (Number(state.usdRate) || 1)
       const schedule = state.schedule
       const hasUsage = usage !== undefined && usage !== null
       const minute = now.getUTCHours() * 60 + now.getUTCMinutes()
@@ -734,27 +763,12 @@ window.__ModuleLoader__.load({
         ),
       )
 
-      let placed = false
-      ctx.slots.inject('settings.plugin.item', () => {
-        placed = true
-        return ctx.slots.register(
+      ctx.slots.inject('settings.plugin.item', () =>
+        ctx.slots.register(
           { name: 'settings.plugin.item', key: NS, locale: NS, order: 20, inject: () => ({ ctx }) },
           (p) => React.createElement(CostMeterCard, { ...p, ctx }),
-        )
-      })
-
-      // Fallback to settings.section if settings.plugin.item is not declared
-      setTimeout(() => {
-        if (placed) return
-        try {
-          ctx.slots.inject('settings.section', () =>
-            ctx.slots.register(
-              { name: 'settings.section', id: '@goodandready/dsh-cost-meter', order: 25, locale: NS, label: () => makeT(useActiveLocale(ctx) === 'ru' ? ru : en, en)('title'), inject: () => ({ ctx }) },
-              (p) => React.createElement(CostMeterCard, { ...p, ctx }),
-            ),
-          )
-        } catch (_) {}
-      }, 500)
+        ),
+      )
     }
 
     module.exports = { apply, inject: ['slots', 'locale', 'settingsScope'] }

package/lib/index.js

@@ -507,16 +507,18 @@ export function apply(ctx, config) {
           // session that switched models can price each part on its own tariff.
           const schedules = {}
           const asked = new URL(req.url, 'http://localhost').searchParams.get('models')
-          for (const key of (asked ? asked.split(',') : []).slice(0, 24)) {
-            const parsed = splitRoute(key.trim())
-            if (!parsed) continue
-            const resolved = resolveTariff(cfg, catalog.index, parsed)
-            schedules[key.trim()] = {
-              schedule: resolved.schedule,
-              source: resolved.source,
-              matchedId: resolved.matchedId,
-            }
-          }
+          for (const key of (asked ? asked.split(',') : []).slice(0, 24)) {
+            const trimmed = String(key || '').trim()
+            if (!trimmed || trimmed.length > 128) continue
+            const parsed = splitRoute(trimmed)
+            if (!parsed) continue
+            const resolved = resolveTariff(cfg, catalog.index, parsed)
+            schedules[trimmed] = {
+              schedule: resolved.schedule,
+              source: resolved.source,
+              matchedId: resolved.matchedId,
+            }
+          }
 
           res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
           res.end(JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.7.6",
+  "version": "0.7.8",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",