@goodandready/dsh-cost-meter 0.8.16 → 0.8.17

package/lib/index.js

@@ -21,19 +21,16 @@ import z from '@deepseek-ai/schemastery'
 
 // Ensure .volatile() helper exists on Schemastery schema prototype for DSH 0.2
 try {
-  const schemaProto = Object.getPrototypeOf(z.boolean())
-  if (schemaProto && typeof schemaProto.volatile !== 'function') {
-    schemaProto.volatile = function () {
-      return typeof this.extra === 'function' ? this.extra('volatile', true) : this
-    }
+  const p = Object.getPrototypeOf(z.boolean())
+  if (p && typeof p.volatile !== 'function') {
+    p.volatile = function () { return typeof this.extra === 'function' ? this.extra('volatile', true) : this }
   }
-} catch {
-  // safe fallback
-}
+} catch {}
+
 export * from './tariff.js'
 export * from './projection.js'
 export { STATE_PATH, REFRESH_PATH } from './routes.js'
-import { indexCatalog, resolveTariff, matchModel } from './tariff.js'
+import { indexCatalog, resolveTariff, matchModel, unwrapVolatile } from './tariff.js'
 import { usageByModelProjection } from './projection.js'
 
 export const name = '@goodandready/dsh-cost-meter'
@@ -43,12 +40,30 @@ const NS = 'dsh-cost-meter'
 export function isLoopback(value) {
   const address = value?.toLowerCase().replace(/^\[|\]$/g, '')
   return address === 'localhost' || address === 'localhost.' || address === '::1'
-    || address?.startsWith('127.') === true
-    || address?.startsWith('::ffff:127.') === true
+    || address?.startsWith('127.') === true || address?.startsWith('::ffff:127.') === true
+}
+
+export function getConnection(ctx) {
+  try {
+    const f = ctx?.reflect?.get
+      ? (ctx.reflect.get('connection') || ctx?.connection)
+      : (ctx?.get ? (ctx.get('connection') || ctx?.connection) : Reflect.get(ctx || {}, 'connection'))
+    return f || (ctx?.root ? getConnection(ctx.root) : undefined)
+  } catch {
+    return undefined
+  }
 }
 
-export function isTrustedCaller(request) {
+export function isTrustedCaller(request, ctx = null) {
   if (!request) return false
+  const conn = getConnection(ctx) || request?.connectionService || request?.connection
+  if (conn && typeof conn.requestRejection === 'function') {
+    try {
+      if (conn.requestRejection(request) !== undefined) return false
+    } catch {
+      return false
+    }
+  }
   const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
   const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
@@ -95,6 +110,24 @@ export function isTrustedCaller(request) {
   return false
 }
 
+export function normalizeConfig(raw) {
+  const u = unwrapVolatile(raw) || {}
+  return {
+    ...u,
+    currency: typeof u.currency === 'string' && u.currency ? u.currency : '$',
+    usdRate: Number(u.usdRate) > 0 ? Number(u.usdRate) : 1,
+    displayTimeZone: typeof u.displayTimeZone === 'string' && u.displayTimeZone ? u.displayTimeZone : 'Europe/Moscow',
+    budgetThreshold: Number(u.budgetThreshold) || 0,
+    useOpenRouter: u.useOpenRouter !== false,
+    refreshHours: Number(u.refreshHours) || 24,
+    deepseekPeakPrices: u.deepseekPeakPrices || {},
+    modelMap: u.modelMap || {},
+    prices: u.prices || {},
+    manualPeakWindowsUtc: Array.isArray(u.manualPeakWindowsUtc) ? u.manualPeakWindowsUtc : [],
+    manualOffPeakMultiplier: Number(u.manualOffPeakMultiplier) || 1,
+  }
+}
+
 const CATALOG_URL = 'https://openrouter.ai/api/v1/models'
 const CACHE_FILE = join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'storages', 'dsh-cost-meter-catalog.json')
 
@@ -109,47 +142,15 @@ const PriceRow = z.object({
 export const Config = z.object({
   currency: z.string().description('Currency symbol shown in the widget.').default('$').volatile(),
   usdRate: z.number().description('Units of `currency` per USD. 1 keeps everything in USD.').default(1).volatile(),
-  displayTimeZone: z
-    .string()
-    .description('IANA zone the widget shows tariff hours in.')
-    .default('Europe/Moscow')
-    .volatile(),
-  budgetThreshold: z
-    .number()
-    .description('Optional session budget threshold in USD. 0 disables threshold warnings.')
-    .default(0)
-    .volatile(),
-  deepseekPeakPrices: z
-    .dict(PriceRow)
-    .description('Override the built-in DeepSeek peak rates, by model id.')
-    .default({})
-    .volatile(),
-  useOpenRouter: z
-    .boolean()
-    .description('Pull rates and discount windows from the public OpenRouter catalog.')
-    .default(true)
-    .volatile(),
+  displayTimeZone: z.string().description('IANA zone the widget shows tariff hours in.').default('Europe/Moscow').volatile(),
+  budgetThreshold: z.number().description('Optional session budget threshold in USD. 0 disables threshold warnings.').default(0).volatile(),
+  deepseekPeakPrices: z.dict(PriceRow).description('Override the built-in DeepSeek peak rates, by model id.').default({}).volatile(),
+  useOpenRouter: z.boolean().description('Pull rates and discount windows from the public OpenRouter catalog.').default(true).volatile(),
   refreshHours: z.number().description('How often to refetch the catalog.').default(24).volatile(),
-  modelMap: z
-    .dict(z.string())
-    .description('Route override: "provider/model" -> OpenRouter model id.')
-    .default({})
-    .volatile(),
-  prices: z
-    .dict(PriceRow)
-    .description('Manual rates by "provider/model" (or "*"). Win over the catalog.')
-    .default({})
-    .volatile(),
-  manualPeakWindowsUtc: z
-    .array(z.string())
-    .description('Peak windows HH:MM-HH:MM UTC, used only with manual prices.')
-    .default([])
-    .volatile(),
-  manualOffPeakMultiplier: z
-    .number()
-    .description('Multiplier outside the manual peak windows.')
-    .default(1)
-    .volatile(),
+  modelMap: z.dict(z.string()).description('Route override: "provider/model" -> OpenRouter model id.').default({}).volatile(),
+  prices: z.dict(PriceRow).description('Manual rates by "provider/model" (or "*"). Win over the catalog.').default({}).volatile(),
+  manualPeakWindowsUtc: z.array(z.string()).description('Peak windows HH:MM-HH:MM UTC, used only with manual prices.').default([]).volatile(),
+  manualOffPeakMultiplier: z.number().description('Multiplier outside the manual peak windows.').default(1).volatile(),
 })
 
 // Per-model usage projection is defined in and exported from ./projection.js
@@ -180,9 +181,8 @@ export function splitRoute(key) {
 }
 
 export function apply(ctx, config) {
-  let current = config
+  let current = normalizeConfig(config)
   let catalog = { index: { byId: {}, byLowerId: {}, bySuffix: {} }, fetchedAt: 0, error: null }
-  let lastManualRefreshAt = 0
 
   // Server-side cache for resolved tariffs: key -> { schedule, source, matchedId }
   const resolveCache = new Map()
@@ -255,14 +255,14 @@ export function apply(ctx, config) {
     }
     const row = readRow()
     if (row?.value && typeof row.value === 'object') {
-      current = { ...config, ...row.value }
+      current = normalizeConfig({ ...config, ...row.value })
       clearResolveCache()
     }
     ctx.on('settings/document-updated', (ns) => {
       if (ns && ns !== NS) return
       const fresh = readRow()
       if (fresh?.value && typeof fresh.value === 'object') {
-        current = { ...config, ...fresh.value }
+        current = normalizeConfig({ ...config, ...fresh.value })
       }
       clearResolveCache()
     })
@@ -282,7 +282,8 @@ export function apply(ctx, config) {
     refresh,
     splitRoute,
     defaultRoute,
-    getCurrentConfig: () => current ?? config,
+    getCurrentConfig: () => (current ? normalizeConfig(current) : normalizeConfig(config)),
     getCatalog: () => catalog,
   })
 }
+

package/lib/routes.js

@@ -26,7 +26,7 @@ export function registerRoutes(ctx, options) {
         path: REFRESH_PATH,
         method: 'POST',
         handler: async (req, res) => {
-          if (!isTrustedCaller(req)) {
+          if (!isTrustedCaller(req, ctx)) {
             res.writeHead(403, { 'Content-Type': 'application/json' })
             res.end(JSON.stringify({ error: 'forbidden' }))
             return
@@ -61,7 +61,7 @@ export function registerRoutes(ctx, options) {
         path: STATE_PATH,
         method: 'GET',
         handler: async (req, res) => {
-          if (!isTrustedCaller(req)) {
+          if (!isTrustedCaller(req, ctx)) {
             res.writeHead(403, { 'Content-Type': 'application/json' })
             res.end(JSON.stringify({ error: 'forbidden' }))
             return
@@ -94,10 +94,10 @@ export function registerRoutes(ctx, options) {
           }
 
           const payloadObj = {
-            currency: cfg.currency,
-            usdRate: cfg.usdRate,
-            displayTimeZone: cfg.displayTimeZone || 'Europe/Moscow',
-            budgetThreshold: Number(cfg.budgetThreshold) || 0,
+            currency: typeof cfg?.currency === 'string' && cfg.currency ? cfg.currency : '$',
+            usdRate: Number(cfg?.usdRate) > 0 ? Number(cfg.usdRate) : 1,
+            displayTimeZone: typeof cfg?.displayTimeZone === 'string' && cfg.displayTimeZone ? cfg.displayTimeZone : 'Europe/Moscow',
+            budgetThreshold: Number(cfg?.budgetThreshold) || 0,
             route,
             source: own.source,
             matchedId: own.matchedId,
@@ -140,3 +140,4 @@ export function registerRoutes(ctx, options) {
     }), 'dsh-cost-meter: updater')
   }
 }
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.16",
+  "version": "0.8.17",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",