@goodandready/dsh-cost-meter 0.8.9 → 0.8.11

package/lib/index.js

@@ -38,21 +38,50 @@ export function isLoopback(value) {
 }
 
 export function isTrustedCaller(request) {
-  const remote = request?.socket?.remoteAddress || request?.connection?.remoteAddress
-  if (isLoopback(remote)) return true
-  const site = request?.headers?.['sec-fetch-site']
-  if (site === 'same-origin' || site === 'same-site') return true
+  if (!request) return false
+  const remote = request.socket?.remoteAddress || request.connection?.remoteAddress
+  const site = request.headers?.['sec-fetch-site']
   if (site === 'cross-site') return false
-  const origin = request?.headers?.['origin']
-  const host = request?.headers?.['host']
-  if (origin && host) {
+
+  const host = request.headers?.['x-forwarded-host'] || request.headers?.['host']
+  const origin = request.headers?.['origin']
+  if (origin) {
     try {
       const url = new URL(origin)
-      if (url.host === host) return true
-    } catch (e) {
-      /* invalid url */
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        return false
+      }
+      // Non-http/https origin (e.g. dsh-app://app in DSH Desktop)
+      if (isLoopback(remote)) return true
+      return false
+    } catch {
+      return false
     }
   }
+
+  const referer = request.headers?.['referer']
+  if (referer) {
+    try {
+      const url = new URL(referer)
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) return true
+        if (isLoopback(url.hostname) && isLoopback(remote)) return true
+        return false
+      }
+      // Non-http/https referer (e.g. dsh-app://app/ in DSH Desktop)
+      if (isLoopback(remote)) return true
+      return false
+    } catch {
+      return false
+    }
+  }
+
+  if (site === 'same-site') return false
+  if (site === 'same-origin') return true
+  if (isLoopback(remote)) return true
+
   return false
 }
 
@@ -167,15 +196,35 @@ export function slotOf(timeMs) {
   return Math.floor((d.getUTCHours() * 60 + d.getUTCMinutes()) / 30)
 }
 
-const usageByModelProjection = {
+const modelSlotsSchema = zod.record(zod.string(), bucketSchema)
+
+const costByModelViewSchema = zod.object({
+  models: zod.array(zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+    slots: modelSlotsSchema,
+  }).strict()),
+}).strict()
+
+const costByModelStateSchema = zod.object({
+  route: zod.object({
+    provider: zod.string(),
+    model: zod.string(),
+  }).nullable(),
+  byKey: zod.record(zod.string(), modelSlotsSchema),
+  last: zod.object({
+    turn: zod.number().int().nonnegative(),
+    step: zod.number().int().nonnegative(),
+    key: zod.string(),
+    slot: zod.string(),
+    buckets: bucketSchema,
+  }).nullable(),
+}).strict()
+
+export const usageByModelProjection = {
   key: 'costByModel',
-  schema: zod.object({
-    models: zod.array(zod.object({
-      provider: zod.string(),
-      model: zod.string(),
-      slots: zod.record(zod.string(), bucketSchema),
-    })),
-  }).strict(),
+  stateVersion: 2,
+  stateSchema: costByModelStateSchema,
   init: () => ({ route: null, byKey: {}, last: null }),
   apply: (state, event) => {
     if (event.type === 'request/header') {
@@ -211,17 +260,19 @@ const usageByModelProjection = {
       last: { turn: sample.turn, step: sample.step, key, slot, buckets },
     }
   },
-  view: (state) => ({
-    models: Object.keys(state.byKey).map((key) => {
-      const slash = key.indexOf('/')
-      return {
-        provider: key.slice(0, slash),
-        model: key.slice(slash + 1),
-        slots: state.byKey[key],
-      }
+  wire: {
+    viewSchema: costByModelViewSchema,
+    view: (state) => ({
+      models: Object.keys(state.byKey).map((key) => {
+        const slash = key.indexOf('/')
+        return {
+          provider: key.slice(0, slash),
+          model: key.slice(slash + 1),
+          slots: state.byKey[key],
+        }
+      }),
     }),
-  }),
-  stateVersion: 2,
+  },
 }
 
 /** The agent's default route, read off settings descriptors when available. */
@@ -309,19 +360,37 @@ export function apply(ctx, config) {
     }
   }
 
-  // Live config from the GUI, with the composition entry as the base layer.
-  ctx.inject(['settings'], (sctx) => {
-    const scope = sctx.settings.register(NS, Config, { base: config })
-    current = scope.get() ?? config
-    scope.watch((next) => {
-      current = next
+  // Live config reaction from GUI / settings service
+  ctx.on('settings/updated', (ns, next) => {
+    if (ns === NS && next) {
+      current = { ...config, ...next }
+      clearResolveCache()
+    }
+  })
+
+  ctx.on('settings/document-updated', (ns) => {
+    if (!ns || ns === NS) {
       clearResolveCache()
-    })
+    }
+  })
+
+  ctx.inject(['settings'], (sctx) => {
+    if (typeof sctx.settings?.describe === 'function') {
+      try {
+        const desc = sctx.settings.describe(NS)
+        if (desc?.value && typeof desc.value === 'object') {
+          current = { ...config, ...desc.value }
+          clearResolveCache()
+        }
+      } catch {
+        /* namespace might not have descriptor yet */
+      }
+    }
   })
 
   // Hook the session projection so the widget can show spend breakdown.
-  ctx.inject(['chatSessionProjections'], (pctx) => {
-    pctx.chatSessionProjections.register(usageByModelProjection)
+  ctx.inject(['sessionProjections'], (pctx) => {
+    pctx.sessionProjections.register(usageByModelProjection)
   })
 
   // Route 1: POST /dsh-cost-meter/refresh (manual catalog reload)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-cost-meter",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "DeepSeek Harness plugin: a session cost chip in the conversation header - live token usage by bucket, peak/off-peak tariff, and a countdown to the next tariff switch.",
   "type": "module",
   "main": "lib/index.js",