@goodandready/dsh-dsml-artifact-guard 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -7,7 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
-## 0.2.4
+## [0.2.6] - 2026-09-25
+
+### Fixed
+- **SettingsForms Migration (DSH 0.1.7)**: marked Config schema as volatile and configured settings policy (`auto: false`) to suppress generic auto-generated form duplicates, while resolving row ID `dsh-dsml-artifact-guard` via client `configForms` with live subscription support (#17).
+- **Client Locale Lifecycle**: wrapped client locale registration in `ctx.effect` to ensure clean namespace disposal on HMR and avoid collision on module reload (#44).
+
+## [0.2.5] - 2026-09-24
+
+### Fixed
+- **Preflight & Locale Contract**: eliminated nonexistent `locale.get()` call in `lib/client.js`, using injected `props.t` with canonical `ctx.locale.bind(NS)` fallback (#36).
+- **Streaming Buffer & Tag Balancing**: replaced fixed 64-character buffer slicing with delimiter-based tag boundary scanning (`<` and `>`), ensuring DSML parameter tags of arbitrary length preserve open/close tag balance without premature truncation (#37).
+- **One-Click Updater LAN Support**: updated `isTrustedUpdateRequest` to allow same-origin requests matching Host/Origin, enabling one-click updates from LAN and reverse-proxy Web UIs while retaining strict loopback verification for local endpoints (#38).
+- **Dead Code Elimination**: connected `checkRequestMethod` helper to updater POST handler (#39).
+
+## [0.2.4] - 2026-09-22
 
 ### Fixed
 - The settings card no longer waits for the removed `settingsScope` service. It uses `configForms` on current DeepSeek Harness (#41).

package/lib/client.js

@@ -102,16 +102,20 @@ window.__ModuleLoader__.load({
       });
 
       const scopeRef = React.useRef(null);
-      if (!scopeRef.current && _ctx && _ctx.configForms) {
+      if (!scopeRef.current && _ctx) {
         try {
-          scopeRef.current = _ctx.configForms.get(NS);
+          if (_ctx.configForms && typeof _ctx.configForms.get === 'function') {
+            scopeRef.current = _ctx.configForms.get(ROW_ID) || _ctx.configForms.get(NS);
+          } else if (_ctx.settingsScope && typeof _ctx.settingsScope.bind === 'function') {
+            scopeRef.current = _ctx.settingsScope.bind({ namespace: NS });
+          }
         } catch (e) {
           scopeRef.current = null;
         }
       }
       const scope = scopeRef.current;
 
-      const currentLang = (_ctx?.locale?.get?.() || navigator.language || 'en').startsWith('zh') ? 'zh' : 'en';
+      const currentLang = ((typeof _ctx?.locale?.getLocale === 'function' ? _ctx.locale.getLocale() : null) || (typeof navigator !== 'undefined' && navigator.language) || 'en').startsWith('zh') ? 'zh' : 'en';
       const dict = currentLang === 'zh' ? zh : en;
       const tt = (k, params) => {
         let str = (typeof t === 'function' ? t(k) : null) || dict[k] || en[k] || k;
@@ -123,43 +127,67 @@ window.__ModuleLoader__.load({
         return str;
       };
 
-      // Load settings from snapshot
+      // Load settings from snapshot and subscribe to live changes
       React.useEffect(() => {
         if (!scope) {
           setStatus('unavailable');
           return;
         }
         let cancelled = false;
-        (async () => {
-          try {
-            const snap = await scope.get();
-            if (cancelled) return;
-            if (snap && typeof snap === 'object' && 'status' in snap) {
-              if (snap.status === 'ready' && snap.value) {
-                setDraft({
-                  mode: snap.value.mode || DEFAULTS.mode,
-                  providerId: snap.value.providerId || DEFAULTS.providerId,
-                  modelId: snap.value.modelId || DEFAULTS.modelId,
-                });
-                setStatus('ready');
-              } else {
-                setStatus(snap.status);
-              }
-            } else if (snap && typeof snap === 'object') {
+        const syncSnapshot = (snap) => {
+          if (!snap || cancelled) return;
+          const view = snap.view || snap.value || snap;
+          if (typeof snap === 'object' && 'status' in snap) {
+            if (snap.status === 'ready' && view) {
               setDraft({
-                mode: snap.mode || DEFAULTS.mode,
-                providerId: snap.providerId || DEFAULTS.providerId,
-                modelId: snap.modelId || DEFAULTS.modelId,
+                mode: view.mode || DEFAULTS.mode,
+                providerId: view.providerId || DEFAULTS.providerId,
+                modelId: view.modelId || DEFAULTS.modelId,
               });
               setStatus('ready');
             } else {
-              setStatus('ready');
+              setStatus(snap.status);
             }
-          } catch {
+          } else if (typeof view === 'object') {
+            setDraft({
+              mode: view.mode || DEFAULTS.mode,
+              providerId: view.providerId || DEFAULTS.providerId,
+              modelId: view.modelId || DEFAULTS.modelId,
+            });
+            setStatus('ready');
+          } else {
+            setStatus('ready');
+          }
+        };
+
+        (async () => {
+          try {
+            const snap = typeof scope.getSnapshot === 'function' ? scope.getSnapshot() : (typeof scope.get === 'function' ? await scope.get() : null);
+            syncSnapshot(snap);
+          } catch (err) {
             if (!cancelled) setStatus('unavailable');
           }
         })();
-        return () => { cancelled = true; };
+
+        let unsubscribe;
+        if (typeof scope.subscribe === 'function') {
+          try {
+            unsubscribe = scope.subscribe(() => {
+              try {
+                syncSnapshot(typeof scope.getSnapshot === 'function' ? scope.getSnapshot() : null);
+              } catch (err) {
+                /* Snapshot update read failed */
+              }
+            });
+          } catch (err) {
+            /* Subscription to scope updates unavailable */
+          }
+        }
+
+        return () => {
+          cancelled = true;
+          if (typeof unsubscribe === 'function') unsubscribe();
+        };
       }, [scope]);
 
       // Check updater status on mount
@@ -179,7 +207,7 @@ window.__ModuleLoader__.load({
               latestVersion: data.latestVersion || '',
               updateAvailable: !!data.updateAvailable,
             }));
-          } catch {
+          } catch (err) {
             if (!cancelled) {
               setUpdateState(s => ({ ...s, checking: false, error: tt('checkUpdateFailed') }));
             }
@@ -528,10 +556,10 @@ window.__ModuleLoader__.load({
     // title) and view:'page' (the form, bare). The older seat keeps the card.
     function PluginItem(props) {
       if (props && props.view === 'summary') {
-        const ctx = props && props.ctx;
-        const lang = (ctx && ctx.locale && typeof ctx.locale.get === 'function' ? ctx.locale.get() : null) || 'en';
-        const dict = String(lang).startsWith('zh') ? zh : en;
-        const tt = typeof props.t === 'function' ? props.t : (k) => dict[k] || en[k] || k;
+        const tBind = (props && props.ctx && typeof props.ctx.locale?.bind === 'function')
+          ? props.ctx.locale.bind(NS)
+          : null;
+        const tt = typeof props.t === 'function' ? props.t : (typeof tBind === 'function' ? tBind : (k) => en[k] || k);
         return React.createElement('div', {
           'data-dsh-plugin': NS,
           className: 'dsh-dsml-artifact-guard-sub',
@@ -544,10 +572,17 @@ window.__ModuleLoader__.load({
     exports.inject = ['slots', 'configForms', 'locale'];
     exports.apply = function apply(ctx) {
       if (typeof ctx.locale?.register === 'function') {
-        try {
-          ctx.locale.register(NS, { en, zh });
-        } catch (err) {
-          /* Locale namespace already registered or unavailable */
+        const registerLocale = () => {
+          try {
+            return ctx.locale.register(NS, { en, zh });
+          } catch (err) {
+            /* Locale namespace already registered or unavailable */
+          }
+        };
+        if (typeof ctx.effect === 'function') {
+          ctx.effect(registerLocale, 'dsh-dsml-artifact-guard: locale');
+        } else {
+          registerLocale();
         }
       }
 

package/lib/index.js

@@ -5,17 +5,20 @@ const TAIL = /(?:<\/｜DSML｜parameter>\s*)?(?:<\/｜DSML｜invoke>\s*)?<\/｜D
 const OPEN_TAG = /<｜DSML｜(?:tool_calls|invoke|parameter)[^>]*>/gu;
 const CLOSE_TAG = /<\/｜DSML｜(?:tool_calls|invoke|parameter)>/gu;
 const KEEP = 96;
-const SCAN_BUFFER_SAFE = 64;
 
 export const name = '@goodandready/dsh-dsml-artifact-guard';
 export const inject = ['llm', 'settings', 'webServer'];
 
-export const Config = Schema.object({
+const rawConfig = Schema.object({
   mode: Schema.string().default('sanitize'),
   providerId: Schema.string().default('opencode-go'),
   modelId: Schema.string().default('deepseek-v4-flash'),
 });
 
+export const Config = typeof rawConfig.volatile === 'function'
+  ? rawConfig.volatile()
+  : rawConfig.extra('volatile', true);
+
 export function matchesScope(o, c) {
   const provider = o?.providerId ?? o?.provider?.id ?? o?.provider;
   const model = o?.modelId ?? o?.model?.id ?? o?.model?.name ?? o?.model;
@@ -68,10 +71,22 @@ export async function* sanitizeDsmlArtifacts(s, { mode = 'sanitize', onArtifact
       p += c.text;
 
       scanBuffer += c.text;
-      if (scanBuffer.length > SCAN_BUFFER_SAFE) {
-        const safe = scanBuffer.slice(0, scanBuffer.length - SCAN_BUFFER_SAFE);
-        scanBuffer = scanBuffer.slice(scanBuffer.length - SCAN_BUFFER_SAFE);
-        countTags(safe);
+      const lastOpen = scanBuffer.lastIndexOf('<');
+      const lastClose = scanBuffer.lastIndexOf('>');
+      if (lastOpen > lastClose) {
+        if (lastOpen > 0) {
+          const safe = scanBuffer.slice(0, lastOpen);
+          scanBuffer = scanBuffer.slice(lastOpen);
+          countTags(safe);
+        }
+        if (scanBuffer.length > 2048) {
+          const cut = scanBuffer.length - 1024;
+          countTags(scanBuffer.slice(0, cut));
+          scanBuffer = scanBuffer.slice(cut);
+        }
+      } else if (scanBuffer.length > 0) {
+        countTags(scanBuffer);
+        scanBuffer = '';
       }
 
       if (p.length > KEEP) {
@@ -98,19 +113,31 @@ export function apply(ctx, initialConfig = {}) {
 
   let getConfig = () => activeConfig;
 
-  // Register settings scope inside ctx.effect
-  if (typeof ctx.inject === 'function') {
+  // Live config subscription from the plugin fiber
+  if (typeof ctx.on === 'function') {
+    ctx.effect(() => ctx.on('config', (nextConfig) => {
+      activeConfig = Config(nextConfig) ?? {};
+    }), 'dsh-dsml-artifact-guard: live config');
+  }
+
+  // DSH 0.1.7 SettingsForms: suppress generic duplicate form, custom card mounts in plugins seat
+  if (ctx.settings && typeof ctx.settings.configure === 'function') {
+    ctx.effect(() => ctx.settings.configure({ auto: false }), 'dsh-dsml-artifact-guard: settings policy');
+  } else if (typeof ctx.inject === 'function') {
+    // Legacy settings service fallback
     ctx.inject(['settings'], (sctx) => {
-      try {
-        const scope = sctx.settings.register(NS, Config, { base: initialConfig });
-        getConfig = () => Config(scope?.get() ?? initialConfig) ?? {};
-        if (typeof scope?.watch === 'function') {
-          sctx.effect(() => scope.watch(() => {
-            activeConfig = getConfig();
-          }));
+      if (typeof sctx.settings?.register === 'function') {
+        try {
+          const scope = sctx.settings.register(NS, Config, { base: initialConfig });
+          getConfig = () => Config(scope?.get() ?? initialConfig) ?? {};
+          if (typeof scope?.watch === 'function') {
+            sctx.effect(() => scope.watch(() => {
+              activeConfig = getConfig();
+            }));
+          }
+        } catch (err) {
+          /* Legacy settings service registration unavailable */
         }
-      } catch (err) {
-        ctx.logger?.warn?.(`[dsh-dsml-artifact-guard] settings registration skipped: ${String(err)}`);
       }
     });
   }

package/lib/updater.js

@@ -4,6 +4,7 @@ import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, dirname, isAbsolute, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { checkRequestMethod } from './index.js';
 
 const UPDATE_HEADER = 'x-dsh-plugin-update';
 const UPDATE_TIMEOUT_MS = 10 * 60000;
@@ -24,7 +25,6 @@ export function isLoopback(value) {
 
 export function isTrustedUpdateRequest(request) {
   if (header(request, UPDATE_HEADER) !== '1') return false;
-  if (!isLoopback(request.socket?.remoteAddress)) return false;
   const site = header(request, 'sec-fetch-site');
   if (site !== undefined && site !== 'same-origin') return false;
   const origin = header(request, 'origin');
@@ -32,8 +32,12 @@ export function isTrustedUpdateRequest(request) {
   if (origin === undefined || host === undefined) return false;
   try {
     const url = new URL(origin);
-    return (url.protocol === 'http:' || url.protocol === 'https:')
-      && isLoopback(url.hostname) && url.host === host;
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+    if (url.host.toLowerCase() !== host.toLowerCase()) return false;
+    if (isLoopback(url.hostname)) {
+      return isLoopback(request.socket?.remoteAddress);
+    }
+    return site === 'same-origin';
   } catch {
     return false;
   }
@@ -218,7 +222,7 @@ export function registerPluginUpdater(ctx, options) {
           res.end(req.method === 'HEAD' ? undefined : JSON.stringify(payload));
           return;
         }
-        if (req.method !== 'POST') {
+        if (!checkRequestMethod(req, 'POST')) {
           res.writeHead(405, { allow: 'GET, HEAD, POST' });
           res.end();
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-dsml-artifact-guard",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Sanitizes leaked DeepSeek DSML closing tags from model text streams",
   "type": "module",
   "main": "lib/index.js",