@goodandready/dsh-cost-meter 0.8.22 → 0.8.24

package/lib/client.js

@@ -1184,7 +1184,6 @@ window.__ModuleLoader__.load({
       const useProjection = props.useProjection
       const usage = useProjection ? useProjection('tokenUsage') : undefined
       const byModel = useProjection ? useProjection('costByModel') : undefined
-      const turns = (byModel?.turns && byModel.turns.length > 0) ? byModel.turns : (state?.turns || [])
       const [state, setState] = React.useState(null)
       const [open, setOpen] = React.useState(false)
       const [now, setNow] = React.useState(() => new Date())
@@ -1250,6 +1249,7 @@ window.__ModuleLoader__.load({
 
       if (!state) return null
 
+      const turns = (byModel?.turns && byModel.turns.length > 0) ? byModel.turns : (state.turns || [])
       const stored = (settingsSnap && settingsSnap.value) || {}
       const currency = stored.currency !== undefined ? String(stored.currency) : (state.currency || '$')
       const fx = stored.usdRate !== undefined && !isNaN(Number(stored.usdRate)) ? Number(stored.usdRate) : (Number(state.usdRate) || 1)
@@ -1472,6 +1472,31 @@ window.__ModuleLoader__.load({
           budgetExceeded ? h('div', { key: 'budget-warn', className: 'dcm-alert dcm-alert-err', style: { marginTop: 6, padding: '6px 10px', fontSize: 11 } },
             t('budget.exceeded', { limit: money(budgetThreshold * fx, currency) })) : null,
 
+          renderSparkline(turns, {
+            h,
+            currency,
+            fx,
+            activeRate: active,
+            t,
+          }),
+
+          (() => {
+            const proj = calculateBurnRateAndProjection(turns, total / fx)
+            const burnRate = proj.burnRatePerHourUsd * fx
+            const projectedTotal = proj.projectedCostUsd * fx
+            if (burnRate <= 0) return null
+            return h('div', { key: 'proj-box', className: 'dcm-proj-box' }, [
+              h('span', { key: 'burn', className: 'dcm-proj-item' }, [
+                h('span', null, t('projection.burn_rate') + ' '),
+                h('span', { className: 'dcm-proj-val' }, money(burnRate, currency) + t('projection.per_hour')),
+              ]),
+              h('span', { key: 'proj', className: 'dcm-proj-item' }, [
+                h('span', null, t('projection.projected') + ' '),
+                h('span', { className: 'dcm-proj-val' }, '≈ ' + money(projectedTotal, currency)),
+              ]),
+            ])
+          })(),
+
           h('hr', { key: 'hr1', className: 'dcm-hr' }),
 
           h('div', { key: 'rates', className: flat ? 'dcm-panel-grid-flat' : 'dcm-panel-grid' }, [

package/lib/index.js

@@ -68,8 +68,11 @@ export function isTrustedCaller(request, ctx = null) {
     }
   }
   const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
+  const loopback = isLoopback(remote)
+  if (ctx && !conn && !loopback) return false
+
   const site = request.headers?.['sec-fetch-site']
-  if (site === 'cross-site') return false
+  if (site === 'cross-site' || site === 'same-site') return false
 
   const host = request.headers?.['host']
   const origin = request.headers?.['origin']
@@ -78,11 +81,11 @@ export function isTrustedCaller(request, ctx = null) {
       const url = new URL(origin)
       if (url.protocol === 'http:' || url.protocol === 'https:') {
         if (host && url.host.toLowerCase() === host.toLowerCase()) return true
-        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        if (isLoopback(url.hostname) && loopback) return true
         return false
       }
       // Non-http/https origin (e.g. dsh-app://app in DSH Desktop)
-      if (isLoopback(remote)) return true
+      if (loopback) return true
       return false
     } catch {
       return false
@@ -95,20 +98,18 @@ export function isTrustedCaller(request, ctx = null) {
       const url = new URL(referer)
       if (url.protocol === 'http:' || url.protocol === 'https:') {
         if (host && url.host.toLowerCase() === host.toLowerCase()) return true
-        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        if (isLoopback(url.hostname) && loopback) return true
         return false
       }
       // Non-http/https referer (e.g. dsh-app://app/ in DSH Desktop)
-      if (isLoopback(remote)) return true
+      if (loopback) return true
       return false
     } catch {
       return false
     }
   }
 
-  if (site === 'same-site') return false
-  if (site === 'same-origin') return true
-  if (isLoopback(remote)) return true
+  if (loopback) return true
 
   return false
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.22",
+  "version": "0.8.24",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",