@goodandready/dsh-cost-meter 0.8.11 → 0.8.13

package/lib/index.js

@@ -43,7 +43,7 @@ export function isTrustedCaller(request) {
   const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
 
-  const host = request.headers?.['x-forwarded-host'] || request.headers?.['host']
+  const host = request.headers?.['host']
   const origin = request.headers?.['origin']
   if (origin) {
     try {
@@ -434,6 +434,11 @@ export function apply(ctx, config) {
         path: STATE_PATH,
         method: 'GET',
         handler: async (req, res) => {
+          if (!isTrustedCaller(req)) {
+            res.writeHead(403, { 'Content-Type': 'application/json' })
+            res.end(JSON.stringify({ error: 'forbidden' }))
+            return
+          }
           const cfg = current ?? config
 
           // On the very first request after boot, wait for the fetch if we have

package/lib/tariff.js

@@ -30,9 +30,24 @@ export const VENDOR_ALIASES = {
   'meta': 'meta-llama',
 }
 
+/** Recursively unwrap cosmokit / Schemastery Volatile<T> reference objects into plain values. */
+export function unwrapVolatile(value) {
+  if (value && typeof value.get === 'function') {
+    return unwrapVolatile(value.get())
+  }
+  if (!value || typeof value !== 'object') return value
+  if (Array.isArray(value)) return value.map(unwrapVolatile)
+  const out = {}
+  for (const [k, v] of Object.entries(value)) {
+    out[k] = unwrapVolatile(v)
+  }
+  return out
+}
+
 /** OpenRouter prices are USD per token; the widget speaks per 1M tokens. */
 export function perMillion(value) {
-  const n = Number(value)
+  const unwrapped = value && typeof value.get === 'function' ? value.get() : value
+  const n = Number(unwrapped)
   return Number.isFinite(n) ? n * 1e6 : 0
 }
 
@@ -61,8 +76,9 @@ export function parseWindow(spec) {
 }
 
 export function overrideBucket(overrideVal, baseVal) {
-  if (overrideVal !== undefined && overrideVal !== null && overrideVal !== '') {
-    const n = Number(overrideVal)
+  const val = overrideVal && typeof overrideVal.get === 'function' ? overrideVal.get() : overrideVal
+  if (val !== undefined && val !== null && val !== '') {
+    const n = Number(val)
     if (Number.isFinite(n)) return n * 1e6
   }
   return baseVal
@@ -165,8 +181,9 @@ export function indexCatalog(models) {
  * Resolve one route's tariff: manual config wins, then DeepSeek's own table,
  * then the OpenRouter catalog.
  */
-export function resolveTariff(cfg, index, route) {
+export function resolveTariff(rawCfg, index, route) {
   if (!route) return { schedule: null, source: 'none', matchedId: null }
+  const cfg = unwrapVolatile(rawCfg) || {}
   const key = route.provider ? route.provider + '/' + route.model : route.model
   const prices = cfg.prices || {}
   const manual = prices[key] || prices[route.model] || prices['*']
@@ -180,7 +197,8 @@ export function resolveTariff(cfg, index, route) {
     }
     const factor = Number(cfg.manualOffPeakMultiplier) || 1
     const windows = []
-    for (const spec of cfg.manualPeakWindowsUtc || []) {
+    const peakWindows = Array.isArray(cfg.manualPeakWindowsUtc) ? cfg.manualPeakWindowsUtc : []
+    for (const spec of peakWindows) {
       const parsed = parseWindow(spec)
       if (parsed) windows.push({ start: parsed.start, end: parsed.end, rates: base })
     }

package/lib/updater.js

@@ -224,7 +224,15 @@ export function registerPluginUpdater(ctx, options) {
     handler: async (request, response) => {
       try {
         const target = detectRuntime()
-        if (request.method === 'GET' || request.method === 'HEAD') {
+        if (request.method === 'HEAD') {
+          response.writeHead(200, {
+            'content-type': 'application/json; charset=utf-8',
+            'cache-control': 'no-store',
+          })
+          response.end()
+          return
+        }
+        if (request.method === 'GET') {
           const payload = await checkUpdateStatus(options, target)
           writeResponseJson(response, 200, payload)
           return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.11",
+  "version": "0.8.13",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",