@goodandready/dsh-cost-meter 0.7.7 → 0.7.8

package/docs/design/DESIGN.md

@@ -82,7 +82,7 @@
   - Не допускать утечек локальных путей и инфраструктурных данных в коде или документации.
 
 ## History & Decisions
-- 2026-09-05 (v0.7.7):
+- 2026-09-05 (v0.7.8):
   - Hotfix: исправлен ReferenceError (t is not defined) в объекте словаря ru (lib/client.js) (#15).
   - Добавлен автоматический тест на чистое исполнение фабрики client loader (`test/public-route.test.mjs`).
 - 2026-09-05 (v0.7.4):

package/docs/plans/findings.md

@@ -1,16 +1,10 @@
-# Technical Findings & Architecture Decisions (v0.7.7)
+# Findings & Architecture Decisions (v0.7.8)
 
-## 1. Zod Usage Rationale
-- `zod` is used in `lib/index.js` for `usageByModelProjection`:
-  DeepSeek Harness core projection machinery requires `.parse(view)` method on projection schemas for runtime boundary contract validation. Schemastery does not provide `.parse()`, so `zod` is strictly required here and is not overengineering.
+## 1. Browser Request Race Conditions
+In `CostMeter`, rapid model switches or toggling the popover calls `load(usedKeys)`. Since network latency varies, an older request might resolve after a newer one. By tracking an active request counter or cancellation token per effect invocation, we ensure only the most up-to-date state response mutates the component state.
 
-## 2. Browser Reactivity & Settings
-- Reactivity in browser UI (`lib/client.js`):
-  Using `React.useSyncExternalStore` connected to `ctx.settingsScope` allows instant updates of `currency` and `usdRate` in the header chip and popover without needing a page refresh or roundtrip state reload.
+## 2. IANA TimeZone Validation
+`Intl.DateTimeFormat(undefined, { timeZone })` throws a `RangeError` if the timezone string is invalid. We can safely leverage this in `CostMeterCard` to reject typos (e.g. `Europe/Moskow` instead of `Europe/Moscow`) on the client before writing to `settingsScope`.
 
-## 3. Slot Hygiene
-- Cleaned up slot injection in `lib/client.js`:
-  Removed `setTimeout(..., 500)` fallback registering `settings.section`. The standard `settings.plugin.item` slot cleanly renders the settings card inside the Harness Settings view.
-
-## 4. Style Isolation & Deduplication
-- Added `data-dsh-plugin="dsh-cost-meter"` attribute to injected `<style>` tags to adhere to DSH UI design guidelines and prevent duplicate stylesheets.
+## 3. Query Parameter Sanitization
+The endpoint `GET /dsh-cost-meter/state?models=...` accepts comma-separated model keys. Adding a length bound (e.g. <= 128 chars) and trimming ensures no malformed payloads cause unexpected overhead.

package/docs/plans/progress.md

@@ -1,15 +1,17 @@
-# Implementation Progress (v0.7.7)
+# Implementation Progress (v0.7.8)
 
-- [x] Create Gitea Issue #17
-- [x] Create isolated worktree `refactor/stability-and-quality`
-- [x] Bump version to 0.7.7 in `package.json`
-- [x] Refactor `lib/client.js` for reactive settings, clean slot registration, and style tagging
-- [x] Verify syntax and run test suite (`npm test`, 9 passed)
-- [ ] Document design contract in `docs/design/DESIGN.md`
+- [x] Create Gitea Issue #19
+- [x] Create isolated worktree `stability-v078`
+- [x] Bump version to 0.7.8 in `package.json`
+- [x] Add monotonic request sequence guard in `lib/client.js` `CostMeter`
+- [x] Add IANA time zone validation in `lib/client.js` `CostMeterCard`
+- [x] Sanitize query parameters in `lib/index.js`
+- [x] Add automated unit tests (`test/timezone-sanitization.test.mjs`, 11/11 passing)
+- [x] Update design documentation in `docs/design/DESIGN.md`
 - [ ] Commit changes with conventional commits (`git-antigravity`)
 - [ ] Create Pull Request and merge into `main`
 - [ ] Test package on MiniPC isolated test server (`192.168.1.123:3082`)
 - [ ] Smoke-test package on production candidate (`192.168.1.111:3080`)
-- [ ] Publish v0.7.7 to npm and GitHub Release
-- [ ] Install v0.7.7 from npm on MiniAI and verify live health
-- [ ] Close Gitea Issue #17 and clean up worktree
+- [ ] Publish v0.7.8 to npm and GitHub Release
+- [ ] Install v0.7.8 from npm on MiniAI and verify live health
+- [ ] Close Gitea Issue #19 and clean up worktree

package/docs/plans/task_plan.md

@@ -1,25 +1,24 @@
-# Task Plan: Refactor dsh-cost-meter for stability, simplification & performance
+# Task Plan: Stability, Race Condition Prevention & TimeZone Validation (v0.7.8)
 
-- **Issue**: Gitea #17
-- **Worktree**: `.worktrees/refactor-stability`
-- **Branch**: `refactor/stability-and-quality`
+## 1. Goal
+Strengthen `@goodandready/dsh-cost-meter` runtime resilience:
+- Prevent race condition response overwrites in browser `CostMeter` component.
+- Validate IANA TimeZone inputs in `CostMeterCard` settings before saving.
+- Sanitize `models` query parameter keys in `lib/index.js` route handler.
+- Maintain strict backward compatibility, zero regression in automated tests.
 
-## Phases
-
-- [ ] **Phase 1: Architecture & Overengineering Cleanup**
-  - Remove `zod` dependency from `lib/index.js`, standardize on `@deepseek-ai/schemastery`.
-  - Remove dynamic fragile `require('@deepseek-ai/dsh-client-ui-primitives')` from `lib/client.js`, standardize on clean native inline SVG chevron.
-  - Remove race-prone `setTimeout(..., 500)` fallback slot registration in `lib/client.js`.
-- [ ] **Phase 2: Fault Tolerance & Safe Caching**
-  - Wrap catalog filesystem operations (`mkdirSync`, `writeFileSync`, `readFileSync`) in safe `try/catch`.
-  - Add safe error catching in `lib/client.js` for `/dsh-cost-meter/state` fetch to prevent console error spam on DSH reload.
-- [ ] **Phase 3: Performance & Settings Reactivity**
-  - Implement in-memory catalog index Map in `lib/index.js` for O(1) model rate lookups.
-  - Subscribe to `settingsScope` updates in `lib/client.js` to dynamically refresh currency and USD rate without reload.
-- [ ] **Phase 4: Verification, Tests & Documentation**
-  - Run regression test suite `npm test` and add tests for schema validation and safe catalog failure.
-  - Update `docs/design/DESIGN.md` and release notes for v0.7.7.
-- [ ] **Phase 5: Release Gate & Production Rollout**
-  - Test on MiniPC test server (`192.168.1.123:3082`).
-  - Merge PR, tag v0.7.7, publish to npm & GitHub release.
-  - Deploy to production web profile on MiniAI (`192.168.1.111:3080`).
+## 2. Checklist
+- [ ] Bump version to `0.7.8` in `package.json`
+- [ ] Implement cancellation flag / abort protection in `lib/client.js` `CostMeter`
+- [ ] Implement `isValidTimeZone` helper and validation check in `CostMeterCard`
+- [ ] Implement key sanitization (length <= 128 chars, alphanumeric/dash/slash) in `lib/index.js`
+- [ ] Add unit tests for timezone check and query sanitization
+- [ ] Run test suite (`npm test`)
+- [ ] Update `docs/design/DESIGN.md`
+- [ ] Conventional Commit & Push
+- [ ] Gitea PR & Merge to `main`
+- [ ] Test on MiniPC test server (`192.168.1.123`)
+- [ ] Production Smoke Verification on MiniAI (`192.168.1.111`)
+- [ ] Publish Tag `v0.7.8`, GitHub Release & npm
+- [ ] Update production profile from npm
+- [ ] Close Gitea Issue #19 and clean up worktree

package/lib/client.js

@@ -209,9 +209,14 @@ window.__ModuleLoader__.load({
           } catch (e) { broken.push('usdRate: ' + (e && e.message || String(e))) }
         }
 
-        try {
-          await scope.set('displayTimeZone', String(draft.displayTimeZone || 'Europe/Moscow').trim())
-        } catch (e) { broken.push('displayTimeZone: ' + (e && e.message || String(e))) }
+        const tzVal = String(draft.displayTimeZone || 'Europe/Moscow').trim()
+        if (!isValidTimeZone(tzVal)) {
+          broken.push('displayTimeZone: invalid IANA time zone')
+        } else {
+          try {
+            await scope.set('displayTimeZone', tzVal)
+          } catch (e) { broken.push('displayTimeZone: ' + (e && e.message || String(e))) }
+        }
 
         setSaving(false)
         if (broken.length) {
@@ -385,6 +390,16 @@ window.__ModuleLoader__.load({
       return String(Math.floor(minute / 60)).padStart(2, '0') + ':' + String(minute % 60).padStart(2, '0')
     }
 
+    function isValidTimeZone(tz) {
+      if (!tz || typeof tz !== 'string') return false
+      try {
+        new Intl.DateTimeFormat(undefined, { timeZone: tz })
+        return true
+      } catch {
+        return false
+      }
+    }
+
     /**
      * Render a UTC minute-of-day in the display zone. Built from a real Date so
      * the zone's current offset (and any DST) comes from Intl, not arithmetic.
@@ -491,14 +506,18 @@ window.__ModuleLoader__.load({
           m.usage.cacheReadTokens || m.usage.cacheWriteTokens)
       const usedKeys = used.map((m) => m.provider + '/' + m.model).sort().join(',')
 
+      const reqSeq = React.useRef(0)
+
       const load = React.useCallback((keys) => {
+        const seq = ++reqSeq.current
         const query = keys ? '?models=' + encodeURIComponent(keys) : ''
         fetch(STATE_PATH + query, { headers: { accept: 'application/json' } })
           .then((r) => (r.ok ? r.json() : null))
-          .then((data) => { if (data) setState(data) })
+          .then((data) => {
+            if (data && seq === reqSeq.current) setState(data)
+          })
           .catch(() => {})
       }, [])
-
       // Refetch when the set of billed models changes — a new model needs its
       // own tariff before its tokens can be priced.
       React.useEffect(() => { load(usedKeys) }, [load, usedKeys])

package/lib/index.js

@@ -507,16 +507,18 @@ export function apply(ctx, config) {
           // session that switched models can price each part on its own tariff.
           const schedules = {}
           const asked = new URL(req.url, 'http://localhost').searchParams.get('models')
-          for (const key of (asked ? asked.split(',') : []).slice(0, 24)) {
-            const parsed = splitRoute(key.trim())
-            if (!parsed) continue
-            const resolved = resolveTariff(cfg, catalog.index, parsed)
-            schedules[key.trim()] = {
-              schedule: resolved.schedule,
-              source: resolved.source,
-              matchedId: resolved.matchedId,
-            }
-          }
+          for (const key of (asked ? asked.split(',') : []).slice(0, 24)) {
+            const trimmed = String(key || '').trim()
+            if (!trimmed || trimmed.length > 128) continue
+            const parsed = splitRoute(trimmed)
+            if (!parsed) continue
+            const resolved = resolveTariff(cfg, catalog.index, parsed)
+            schedules[trimmed] = {
+              schedule: resolved.schedule,
+              source: resolved.source,
+              matchedId: resolved.matchedId,
+            }
+          }
 
           res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
           res.end(JSON.stringify({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.7.7",
+  "version": "0.7.8",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",