@goodandready/dsh-cost-meter 0.8.23 → 0.8.24
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/index.js +9 -8
- package/package.json +1 -1
package/lib/index.js
CHANGED
|
@@ -68,8 +68,11 @@ export function isTrustedCaller(request, ctx = null) {
|
|
|
68
68
|
}
|
|
69
69
|
}
|
|
70
70
|
const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
|
|
71
|
+
const loopback = isLoopback(remote)
|
|
72
|
+
if (ctx && !conn && !loopback) return false
|
|
73
|
+
|
|
71
74
|
const site = request.headers?.['sec-fetch-site']
|
|
72
|
-
if (site === 'cross-site') return false
|
|
75
|
+
if (site === 'cross-site' || site === 'same-site') return false
|
|
73
76
|
|
|
74
77
|
const host = request.headers?.['host']
|
|
75
78
|
const origin = request.headers?.['origin']
|
|
@@ -78,11 +81,11 @@ export function isTrustedCaller(request, ctx = null) {
|
|
|
78
81
|
const url = new URL(origin)
|
|
79
82
|
if (url.protocol === 'http:' || url.protocol === 'https:') {
|
|
80
83
|
if (host && url.host.toLowerCase() === host.toLowerCase()) return true
|
|
81
|
-
if (isLoopback(url.hostname) &&
|
|
84
|
+
if (isLoopback(url.hostname) && loopback) return true
|
|
82
85
|
return false
|
|
83
86
|
}
|
|
84
87
|
// Non-http/https origin (e.g. dsh-app://app in DSH Desktop)
|
|
85
|
-
if (
|
|
88
|
+
if (loopback) return true
|
|
86
89
|
return false
|
|
87
90
|
} catch {
|
|
88
91
|
return false
|
|
@@ -95,20 +98,18 @@ export function isTrustedCaller(request, ctx = null) {
|
|
|
95
98
|
const url = new URL(referer)
|
|
96
99
|
if (url.protocol === 'http:' || url.protocol === 'https:') {
|
|
97
100
|
if (host && url.host.toLowerCase() === host.toLowerCase()) return true
|
|
98
|
-
if (isLoopback(url.hostname) &&
|
|
101
|
+
if (isLoopback(url.hostname) && loopback) return true
|
|
99
102
|
return false
|
|
100
103
|
}
|
|
101
104
|
// Non-http/https referer (e.g. dsh-app://app/ in DSH Desktop)
|
|
102
|
-
if (
|
|
105
|
+
if (loopback) return true
|
|
103
106
|
return false
|
|
104
107
|
} catch {
|
|
105
108
|
return false
|
|
106
109
|
}
|
|
107
110
|
}
|
|
108
111
|
|
|
109
|
-
if (
|
|
110
|
-
if (site === 'same-origin') return true
|
|
111
|
-
if (isLoopback(remote)) return true
|
|
112
|
+
if (loopback) return true
|
|
112
113
|
|
|
113
114
|
return false
|
|
114
115
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@goodandready/dsh-cost-meter",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.24",
|
|
4
4
|
"description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "lib/index.js",
|