@goodandready/dsh-dsml-artifact-guard 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -7,7 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
-## 0.2.4
+## [0.2.5] - 2026-09-24
+
+### Fixed
+- **Preflight & Locale Contract**: eliminated nonexistent `locale.get()` call in `lib/client.js`, using injected `props.t` with canonical `ctx.locale.bind(NS)` fallback (#36).
+- **Streaming Buffer & Tag Balancing**: replaced fixed 64-character buffer slicing with delimiter-based tag boundary scanning (`<` and `>`), ensuring DSML parameter tags of arbitrary length preserve open/close tag balance without premature truncation (#37).
+- **One-Click Updater LAN Support**: updated `isTrustedUpdateRequest` to allow same-origin requests matching Host/Origin, enabling one-click updates from LAN and reverse-proxy Web UIs while retaining strict loopback verification for local endpoints (#38).
+- **Dead Code Elimination**: connected `checkRequestMethod` helper to updater POST handler (#39).
+
+## [0.2.4] - 2026-09-22
 
 ### Fixed
 - The settings card no longer waits for the removed `settingsScope` service. It uses `configForms` on current DeepSeek Harness (#41).

package/lib/client.js

@@ -528,10 +528,10 @@ window.__ModuleLoader__.load({
     // title) and view:'page' (the form, bare). The older seat keeps the card.
     function PluginItem(props) {
       if (props && props.view === 'summary') {
-        const ctx = props && props.ctx;
-        const lang = (ctx && ctx.locale && typeof ctx.locale.get === 'function' ? ctx.locale.get() : null) || 'en';
-        const dict = String(lang).startsWith('zh') ? zh : en;
-        const tt = typeof props.t === 'function' ? props.t : (k) => dict[k] || en[k] || k;
+        const tBind = (props && props.ctx && typeof props.ctx.locale?.bind === 'function')
+          ? props.ctx.locale.bind(NS)
+          : null;
+        const tt = typeof props.t === 'function' ? props.t : (typeof tBind === 'function' ? tBind : (k) => en[k] || k);
         return React.createElement('div', {
           'data-dsh-plugin': NS,
           className: 'dsh-dsml-artifact-guard-sub',

package/lib/index.js

@@ -5,7 +5,6 @@ const TAIL = /(?:<\/｜DSML｜parameter>\s*)?(?:<\/｜DSML｜invoke>\s*)?<\/｜D
 const OPEN_TAG = /<｜DSML｜(?:tool_calls|invoke|parameter)[^>]*>/gu;
 const CLOSE_TAG = /<\/｜DSML｜(?:tool_calls|invoke|parameter)>/gu;
 const KEEP = 96;
-const SCAN_BUFFER_SAFE = 64;
 
 export const name = '@goodandready/dsh-dsml-artifact-guard';
 export const inject = ['llm', 'settings', 'webServer'];
@@ -68,10 +67,22 @@ export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact
       p += c.text;
 
       scanBuffer += c.text;
-      if (scanBuffer.length > SCAN_BUFFER_SAFE) {
-        const safe = scanBuffer.slice(0, scanBuffer.length - SCAN_BUFFER_SAFE);
-        scanBuffer = scanBuffer.slice(scanBuffer.length - SCAN_BUFFER_SAFE);
-        countTags(safe);
+      const lastOpen = scanBuffer.lastIndexOf('<');
+      const lastClose = scanBuffer.lastIndexOf('>');
+      if (lastOpen > lastClose) {
+        if (lastOpen > 0) {
+          const safe = scanBuffer.slice(0, lastOpen);
+          scanBuffer = scanBuffer.slice(lastOpen);
+          countTags(safe);
+        }
+        if (scanBuffer.length > 2048) {
+          const cut = scanBuffer.length - 1024;
+          countTags(scanBuffer.slice(0, cut));
+          scanBuffer = scanBuffer.slice(cut);
+        }
+      } else if (scanBuffer.length > 0) {
+        countTags(scanBuffer);
+        scanBuffer = '';
       }
 
       if (p.length > KEEP) {

package/lib/updater.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { checkRequestMethod } from './index.js';
 
 const UPDATE_HEADER = 'x-dsh-plugin-update';
 const UPDATE_TIMEOUT_MS = 10 * 60000;
@@ -24,7 +25,6 @@ export function isLoopback(value) {
 
 export function isTrustedUpdateRequest(request) {
   if (header(request, UPDATE_HEADER) !== '1') return false;
-  if (!isLoopback(request.socket?.remoteAddress)) return false;
   const site = header(request, 'sec-fetch-site');
   if (site !== undefined && site !== 'same-origin') return false;
   const origin = header(request, 'origin');
@@ -32,8 +32,12 @@ export function isTrustedUpdateRequest(request) {
   if (origin === undefined || host === undefined) return false;
   try {
     const url = new URL(origin);
-    return (url.protocol === 'http:' || url.protocol === 'https:')
-      && isLoopback(url.hostname) && url.host === host;
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+    if (url.host.toLowerCase() !== host.toLowerCase()) return false;
+    if (isLoopback(url.hostname)) {
+      return isLoopback(request.socket?.remoteAddress);
+    }
+    return site === 'same-origin';
   } catch {
     return false;
   }
@@ -218,7 +222,7 @@ export function registerPluginUpdater(ctx, options) {
           res.end(req.method === 'HEAD' ? undefined : JSON.stringify(payload));
           return;
         }
-        if (req.method !== 'POST') {
+        if (!checkRequestMethod(req, 'POST')) {
           res.writeHead(405, { allow: 'GET, HEAD, POST' });
           res.end();
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
   "type": "module",
   "main": "lib/index.js",