@goodandready/dsh-cost-meter 0.8.10 → 0.8.12

package/lib/index.js

@@ -43,13 +43,18 @@ export function isTrustedCaller(request) {
   const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
 
-  const host = request.headers?.['x-forwarded-host'] || request.headers?.['host']
+  const host = request.headers?.['host']
   const origin = request.headers?.['origin']
   if (origin) {
     try {
       const url = new URL(origin)
-      if (host && url.host.toLowerCase() === host.toLowerCase()) return true
-      if (isLoopback(url.hostname) && isLoopback(remote)) return true
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        return false
+      }
+      // Non-http/https origin (e.g. dsh-app://app in DSH Desktop)
+      if (isLoopback(remote)) return true
       return false
     } catch {
       return false
@@ -60,8 +65,13 @@ export function isTrustedCaller(request) {
   if (referer) {
     try {
       const url = new URL(referer)
-      if (host && url.host.toLowerCase() === host.toLowerCase()) return true
-      if (isLoopback(url.hostname) && isLoopback(remote)) return true
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        return false
+      }
+      // Non-http/https referer (e.g. dsh-app://app/ in DSH Desktop)
+      if (isLoopback(remote)) return true
       return false
     } catch {
       return false
@@ -424,6 +434,11 @@ export function apply(ctx, config) {
         path: STATE_PATH,
         method: 'GET',
         handler: async (req, res) => {
+          if (!isTrustedCaller(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'forbidden' }))
+            return
+          }
           const cfg = current ?? config
 
           // On the very first request after boot, wait for the fetch if we have

package/lib/updater.js

@@ -224,7 +224,15 @@ export function registerPluginUpdater(ctx, options) {
     handler: async (request, response) => {
       try {
         const target = detectRuntime()
-        if (request.method === 'GET' || request.method === 'HEAD') {
+        if (request.method === 'HEAD') {
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end()
+          return
+        }
+        if (request.method === 'GET') {
           const payload = await checkUpdateStatus(options, target)
           writeResponseJson(response, 200, payload)
           return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",