@goodandready/dsh-model-sync 0.3.13 → 0.4.0

package/lib/http.js

@@ -8,24 +8,50 @@ function json(res, status, body) {
   res.end(JSON.stringify(body))
 }
 
-function trusted(req) {
+export function isLoopbackAddress(ip) {
+  if (!ip || typeof ip !== 'string') return false
+  const clean = ip.toLowerCase().replace(/^\[|\]$/g, '')
+  if (clean === '127.0.0.1' || clean === '::1' || clean === '::ffff:127.0.0.1' || clean === 'localhost') return true
+  if (clean.startsWith('127.') || clean.startsWith('::ffff:127.')) return true
+  return false
+}
+
+export function trusted(req, { requireLoopback = false } = {}) {
+  const remoteAddress = req?.socket?.remoteAddress
+  if (requireLoopback || req?.method === 'POST') {
+    if (!isLoopbackAddress(remoteAddress)) return false
+  }
   const fetchSite = req.headers?.['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
   const host = req.headers?.host
   const origin = req.headers?.origin
   if (origin) {
     if (!host) return false
-    try { return new URL(origin).host === host } catch { return false }
+    try {
+      const url = new URL(origin)
+      if (url.host !== host) return false
+      if (requireLoopback || req?.method === 'POST') {
+        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+      }
+    } catch { return false }
   }
   const referer = req.headers?.referer
   if (referer) {
     if (!host) return false
-    try { return new URL(referer).host === host } catch { return false }
+    try {
+      const url = new URL(referer)
+      if (url.host !== host) return false
+      if (requireLoopback || req?.method === 'POST') {
+        if (!isLoopbackAddress(url.hostname) && url.hostname !== 'localhost') return false
+      }
+    } catch { return false }
   }
   // If sec-fetch-site is same-origin or same-site, allow
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
   // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
   if (req.headers?.['sec-fetch-mode'] && !host) return false
+  // For POST write requests without any browser origin/referer headers, require explicit loopback remoteAddress
+  if (req?.method === 'POST' && !origin && !referer && !isLoopbackAddress(remoteAddress)) return false
   return true
 }
 
@@ -97,6 +123,27 @@ export function normalizeTryRequest(body) {
   return { provider: body.provider, model: body.model }
 }
 
+
+export function normalizeBatchTryRequest(body) {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) throw new Error('request body must be an object')
+  if (typeof body.provider !== 'string' || !body.provider) throw new Error('provider is required')
+  if (!Array.isArray(body.models)) throw new Error('models must be an array')
+  return {
+    provider: body.provider.trim(),
+    models: body.models.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()),
+  }
+}
+
+export function normalizeAliasRequest(body) {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) throw new Error('request body must be an object')
+  if (typeof body.alias !== 'string' || !body.alias.trim()) throw new Error('alias is required')
+  if (!/^[a-zA-Z0-9_\-.]{1,64}$/.test(body.alias.trim())) throw new Error('alias must be 1-64 alphanumeric characters or _-.')
+  if (body.action === 'delete') return { action: 'delete', alias: body.alias.trim() }
+  if (typeof body.provider !== 'string' || !body.provider.trim() || body.provider.length > 128) throw new Error('provider must be a short string')
+  if (typeof body.model !== 'string' || !body.model.trim() || body.model.length > 256) throw new Error('model must be a short string')
+  return { action: 'set', alias: body.alias.trim(), provider: body.provider.trim(), model: body.model.trim() }
+}
+
 export function normalizeHealthRequest(body) {
   if (body === null || typeof body !== 'object' || Array.isArray(body)) throw new Error('request body must be an object')
   if (body.provider !== undefined && (typeof body.provider !== 'string' || body.provider.length > 128)) throw new Error('provider must be a short string')
@@ -122,6 +169,10 @@ export function normalizePolicyRequest(body) {
       exclude: body.exclude,
       requireCapabilities: body.requireCapabilities,
       denyCapabilities: body.denyCapabilities,
+      enableCostFilter: body.enableCostFilter,
+      maxPricePerMillion: body.maxPricePerMillion,
+      enableContextFilter: body.enableContextFilter,
+      minContextTokens: body.minContextTokens,
     }),
   }
 }
@@ -163,7 +214,7 @@ export function normalizeSelectionRequest(body) {
 
 export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () => null } = {}) {
   const makeHandler = (route) => async (req, res) => {
-    if (!trusted(req)) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin request rejected' } })
+    if (!trusted(req, { requireLoopback: req.method === 'POST' })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }
@@ -187,6 +238,24 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
       try { return json(res, 200, await synchronizer.credentialDiagnostics(normalizeCredentialRequest(req.url))) }
       catch (error) { return json(res, 400, { error: { code: 'bad-request', message: error instanceof Error ? error.message : String(error) } }) }
     }
+    if (route === 'export') {
+      if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
+      return json(res, 200, synchronizer.exportConfig())
+    }
+    if (route === 'aliases' && req.method === 'GET') {
+      return json(res, 200, { aliases: synchronizer.getAliases() })
+    }
+    if (route === 'import') {
+      if (req.method !== 'POST') return json(res, 405, { error: { code: 'method', message: 'POST only' } })
+      try {
+        const body = await readJson(req)
+        const result = await synchronizer.importConfig(body)
+        return json(res, 200, result)
+      } catch (error) {
+        const code = error?.code === 'INVALID_CONFIG' || error?.code === 'INVALID_POLICY' ? 400 : 500
+        return json(res, code, { error: { code: error?.code ?? 'import-failed', message: error instanceof Error ? error.message : String(error) } })
+      }
+    }
     if (route === 'report') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       return json(res, 200, { report: synchronizer.report() })
@@ -203,6 +272,8 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
         ? normalizeSelectionRequest(body)
         : route === 'policy' ? normalizePolicyRequest(body)
         : route === 'try' ? normalizeTryRequest(body)
+        : route === 'batch-try' ? normalizeBatchTryRequest(body)
+        : route === 'aliases' ? normalizeAliasRequest(body)
         : route === 'health' ? normalizeHealthRequest(body)
         : route === 'credentials-check' ? normalizeCredentialCheckRequest(body)
         : route === 'notification-read' || route === 'notification-acknowledge' ? normalizeNotificationAction(body)
@@ -215,6 +286,8 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
         ? await synchronizer.setModelSelection(options.provider, options.models)
         : route === 'policy' ? await synchronizer.setModelPolicy(options.provider, options.policy)
         : route === 'try' ? await synchronizer.tryModel(options)
+        : route === 'batch-try' ? await synchronizer.batchTryModels(options)
+        : route === 'aliases' ? (options.action === 'delete' ? await synchronizer.deleteAlias(options) : await synchronizer.setAlias(options))
         : route === 'health' ? await synchronizer.health(options)
         : route === 'credentials-check' ? { health: await synchronizer.health(options), credentials: await synchronizer.credentialDiagnostics(options) }
         : route === 'notification-read' ? await synchronizer.updateNotification(options.id, 'read')
@@ -224,7 +297,7 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
       return json(res, 200, { ...result, providers: synchronizer.listProviders() })
     }
     catch (error) {
-      const code = error?.code === 'SETTINGS_CONFLICT' ? 409 : error?.code === 'SETTINGS_UNAVAILABLE' || error?.code === 'CONFIG_UNAVAILABLE' ? 503 : error?.code === 'PROVIDER_NOT_CONFIGURED' || error?.code === 'UNKNOWN_MODEL' || error?.code === 'INVALID_POLICY' || error?.code === 'INVALID_HISTORY' || error?.code === 'HISTORY_NOT_FOUND' || error?.code === 'INVALID_NOTIFICATION' || error?.code === 'NOTIFICATION_NOT_FOUND' ? 400 : 500
+      const code = error?.code === 'SETTINGS_CONFLICT' ? 409 : error?.code === 'SETTINGS_UNAVAILABLE' || error?.code === 'CONFIG_UNAVAILABLE' ? 503 : error?.code === 'PROVIDER_NOT_CONFIGURED' || error?.code === 'UNKNOWN_MODEL' || error?.code === 'INVALID_POLICY' || error?.code === 'INVALID_HISTORY' || error?.code === 'HISTORY_NOT_FOUND' || error?.code === 'INVALID_NOTIFICATION' || error?.code === 'NOTIFICATION_NOT_FOUND' || error?.code === 'INVALID_ALIAS' || error?.code === 'INVALID_CONFIG' ? 400 : 500
       return json(res, code, { error: { code: error?.code ?? 'run-failed', message: error instanceof Error ? error.message : String(error) } })
     }
   }
@@ -232,6 +305,10 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/status`, handler: makeHandler('status') }),
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/run`, handler: makeHandler('run') }),
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/try`, handler: makeHandler('try') }),
+    ctx.webServer.register({ kind: 'exact', path: `${BASE}/batch-try`, handler: makeHandler('batch-try') }),
+    ctx.webServer.register({ kind: 'exact', path: `${BASE}/export`, handler: makeHandler('export') }),
+    ctx.webServer.register({ kind: 'exact', path: `${BASE}/import`, handler: makeHandler('import') }),
+    ctx.webServer.register({ kind: 'exact', path: `${BASE}/aliases`, handler: makeHandler('aliases') }),
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/health`, handler: makeHandler('health') }),
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/selection`, handler: makeHandler('selection') }),
     ctx.webServer.register({ kind: 'exact', path: `${BASE}/policy`, handler: makeHandler('policy') }),

package/lib/index.js

@@ -1,163 +1,180 @@
-import Schema from '@deepseek-ai/schemastery'
-import { createProviderService } from './provider-service.js'
-import { createModelSynchronizer } from './synchronizer.js'
-import { createSyncScheduler } from './scheduler.js'
-import { registerHttpApi } from './http.js'
-
-export const name = '@goodandready/dsh-model-sync'
-export const inject = ['llm', 'settings', 'webServer', 'credentials']
-
-const NS = 'dsh-model-sync'
-
-export const Config = Schema.object({
-  enabled: Schema.boolean().default(true),
-  intervalMinutes: Schema.number().default(60),
-  scheduleEnabled: Schema.boolean().default(false),
-  jitterMinutes: Schema.number().default(0),
-  ttlMinutes: Schema.number().default(0),
-  autoApply: Schema.boolean().default(false),
-  requestTimeoutMs: Schema.number().default(15000),
-  retryAttempts: Schema.number().default(3),
-  retryBaseDelayMs: Schema.number().default(250),
-  retryMaxDelayMs: Schema.number().default(4000),
-  concurrency: Schema.number().default(4),
-  circuitBreakerFailures: Schema.number().default(3),
-  circuitBreakerCooldownMinutes: Schema.number().default(5),
-  historyLimit: Schema.number().default(50),
-  notificationLimit: Schema.number().default(50),
-  notifications: Schema.array(Schema.object({
-    id: Schema.string().required(),
-    fingerprint: Schema.string().required(),
-    createdAt: Schema.number().required(),
-    updatedAt: Schema.number().required(),
-    occurrences: Schema.number().default(1),
-    readAt: Schema.any().default(null),
-    acknowledgedAt: Schema.any().default(null),
-    severity: Schema.string().required(),
-    title: Schema.string().required(),
-    message: Schema.string().required(),
-    providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
-  staleGraceRuns: Schema.number().default(2),
-  lifecycleRetentionRuns: Schema.number().default(20),
-  lifecycleRevision: Schema.number().default(0),
-  modelLifecycle: Schema.dict(Schema.dict(Schema.object({
-    status: Schema.string().required(),
-    consecutiveMissing: Schema.number().default(0),
-    firstMissingAt: Schema.number().default(0),
-    lastSeenAt: Schema.number().default(0),
-    lastObservedRun: Schema.number().default(0),
-  }).loose())).default({}),
-  history: Schema.array(Schema.object({
-    id: Schema.string().required(),
-    version: Schema.number().required(),
-    startedAt: Schema.number().required(),
-    finishedAt: Schema.number().required(),
-    providers: Schema.array(Schema.object({}).loose()).default([]),
-  }).loose()).default([]),
-  providers: Schema.array(Schema.object({
-    provider: Schema.string().required(),
-    enabled: Schema.boolean().default(true),
-    intervalMinutes: Schema.number().default(0),
-    jitterMinutes: Schema.number().default(0),
-    ttlMinutes: Schema.number().default(0),
-    autoApply: Schema.boolean().default(false),
-  })).default([]),
-  modelSelections: Schema.dict(Schema.array(Schema.string())).default({}),
-  adapterRegistry: Schema.dict(Schema.object({
-    enabled: Schema.boolean().default(true),
-    endpoint: Schema.string().default(''),
-    auth: Schema.string().default('bearer'),
-    parser: Schema.string().default('openai'),
-    modelsPath: Schema.string().default('data'),
-    fields: Schema.any().default({}),
-    capabilityMap: Schema.any().default({}),
-    headers: Schema.dict(Schema.string()).default({}),
-  }).loose()).default({}),
-  modelPolicies: Schema.dict(Schema.object({
-    include: Schema.array(Schema.string()).default([]),
-    exclude: Schema.array(Schema.string()).default([]),
-    requireCapabilities: Schema.dict(Schema.boolean()).default({}),
-    denyCapabilities: Schema.dict(Schema.boolean()).default({}),
-  }).loose()).default({}),
-  // Full catalogs are cached separately from the allowlist applied to DSH.
-  // This keeps the model picker useful after a restart without widening the
-  // active llm-pi-ai catalog.
-  modelCatalogs: Schema.dict(Schema.array(Schema.object({
-    provider: Schema.string().required(),
-    id: Schema.string().required(),
-    name: Schema.string().required(),
-  }).loose())).default({}),
-})
-
-export function apply(ctx, config) {
-  const baseConfig = structuredClone(config || {})
-  const resolveConfig = (value) => Config(structuredClone(value || {}))
-  let liveConfig = resolveConfig(baseConfig)
-  let reconfigure = () => {}
-  let saveConfigImpl
-  // ctx.inject starts a child fiber; keep a stable function reference for the
-  // synchronizer while that fiber connects to the Settings service.
-  const saveConfig = async (patch) => {
-    if (!saveConfigImpl) {
-      throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
-    }
-    return saveConfigImpl(patch)
-  }
-
-  let settingsScope
-  const bindSettings = (settings, ownerCtx) => {
-    if (settingsScope || !settings?.register) return false
-    const scope = settings.register(NS, Config, { base: baseConfig })
-    settingsScope = scope
-    liveConfig = resolveConfig(scope.get() || baseConfig)
-    const stop = scope.watch((next) => {
-      liveConfig = resolveConfig(next || baseConfig)
-      reconfigure()
-    })
-    let saveQueue = Promise.resolve()
-    saveConfigImpl = (patch) => {
-      const nextTask = saveQueue.then(async () => {
-        const result = await scope.update(patch)
-        liveConfig = resolveConfig(scope.get() || baseConfig)
-        return result
-      })
-      saveQueue = nextTask.catch(() => {})
-      return nextTask
-    }
-    ownerCtx.effect(() => () => {
-      settingsScope = undefined
-      saveConfigImpl = undefined
-      stop()
-    }, 'dsh-model-sync: settings')
-    return true
-  }
-
-  let settings
-  try { settings = ctx.get('settings') } catch {}
-  if (!bindSettings(settings, ctx)) {
-    ctx.inject(['settings'], (sctx) => {
-      bindSettings((typeof sctx.get === 'function' ? sctx.get('settings') : null) ?? sctx.settings, sctx)
-    })
-  }
-
-
-  const service = createProviderService(ctx)
-  const synchronizer = createModelSynchronizer(ctx, { getConfig: () => liveConfig, saveConfig })
-  const scheduler = createSyncScheduler(synchronizer, { getConfig: () => liveConfig })
-  reconfigure = () => scheduler.reconfigure()
-  scheduler.start()
-  ctx.effect(() => () => scheduler.stop(), 'dsh-model-sync: scheduler cleanup')
-  ctx.effect(() => {
-    const registrations = registerHttpApi(ctx, synchronizer, { getSchedulerStatus: () => scheduler.status() })
-    return () => {
-      for (const dispose of registrations) if (typeof dispose === 'function') dispose()
-    }
-  }, 'dsh-model-sync: http api')
-  ctx.effect(() => {
-    if (!liveConfig.enabled) return () => {}
-    ctx.provide('modelSync', service)
-    ctx.provide('modelSyncRunner', synchronizer)
-    return () => {}
-  }, 'dsh-model-sync: service')
-}
+import Schema from '@deepseek-ai/schemastery'
+import { createProviderService } from './provider-service.js'
+import { createModelSynchronizer } from './synchronizer.js'
+import { createSyncScheduler } from './scheduler.js'
+import { registerHttpApi } from './http.js'
+import { registerPluginUpdater } from './updater.js'
+
+export const name = '@goodandready/dsh-model-sync'
+export const inject = ['llm', 'settings', 'webServer', 'credentials']
+
+const NS = 'dsh-model-sync'
+
+export const Config = Schema.object({
+  enabled: Schema.boolean().default(true),
+  intervalMinutes: Schema.number().default(60),
+  scheduleEnabled: Schema.boolean().default(false),
+  jitterMinutes: Schema.number().default(0),
+  ttlMinutes: Schema.number().default(0),
+  autoApply: Schema.boolean().default(false),
+  requestTimeoutMs: Schema.number().default(15000),
+  retryAttempts: Schema.number().default(3),
+  retryBaseDelayMs: Schema.number().default(250),
+  retryMaxDelayMs: Schema.number().default(4000),
+  concurrency: Schema.number().default(4),
+  circuitBreakerFailures: Schema.number().default(3),
+  circuitBreakerCooldownMinutes: Schema.number().default(5),
+  historyLimit: Schema.number().default(50),
+  notificationLimit: Schema.number().default(50),
+  notifications: Schema.array(Schema.object({
+    id: Schema.string().required(),
+    fingerprint: Schema.string().required(),
+    createdAt: Schema.number().required(),
+    updatedAt: Schema.number().required(),
+    occurrences: Schema.number().default(1),
+    readAt: Schema.any().default(null),
+    acknowledgedAt: Schema.any().default(null),
+    severity: Schema.string().required(),
+    title: Schema.string().required(),
+    message: Schema.string().required(),
+    providers: Schema.array(Schema.object({}).loose()).default([]),
+  }).loose()).default([]),
+  staleGraceRuns: Schema.number().default(2),
+  lifecycleRetentionRuns: Schema.number().default(20),
+  lifecycleRevision: Schema.number().default(0),
+  modelLifecycle: Schema.dict(Schema.dict(Schema.object({
+    status: Schema.string().required(),
+    consecutiveMissing: Schema.number().default(0),
+    firstMissingAt: Schema.number().default(0),
+    lastSeenAt: Schema.number().default(0),
+    lastObservedRun: Schema.number().default(0),
+  }).loose())).default({}),
+  history: Schema.array(Schema.object({
+    id: Schema.string().required(),
+    version: Schema.number().required(),
+    startedAt: Schema.number().required(),
+    finishedAt: Schema.number().required(),
+    providers: Schema.array(Schema.object({}).loose()).default([]),
+  }).loose()).default([]),
+  providers: Schema.array(Schema.object({
+    provider: Schema.string().required(),
+    enabled: Schema.boolean().default(true),
+    intervalMinutes: Schema.number().default(0),
+    jitterMinutes: Schema.number().default(0),
+    ttlMinutes: Schema.number().default(0),
+    autoApply: Schema.boolean().default(false),
+  })).default([]),
+  aliases: Schema.dict(Schema.object({
+    provider: Schema.string().required(),
+    model: Schema.string().required(),
+    updatedAt: Schema.number().default(0),
+  }).loose()).default({}),
+  modelSelections: Schema.dict(Schema.array(Schema.string())).default({}),
+  adapterRegistry: Schema.dict(Schema.object({
+    enabled: Schema.boolean().default(true),
+    endpoint: Schema.string().default(''),
+    auth: Schema.string().default('bearer'),
+    parser: Schema.string().default('openai'),
+    modelsPath: Schema.string().default('data'),
+    fields: Schema.any().default({}),
+    capabilityMap: Schema.any().default({}),
+    headers: Schema.dict(Schema.string()).default({}),
+  }).loose()).default({}),
+  modelPolicies: Schema.dict(Schema.object({
+    include: Schema.array(Schema.string()).default([]),
+    exclude: Schema.array(Schema.string()).default([]),
+    requireCapabilities: Schema.dict(Schema.boolean()).default({}),
+    denyCapabilities: Schema.dict(Schema.boolean()).default({}),
+    enableCostFilter: Schema.boolean().default(false),
+    maxPricePerMillion: Schema.number(),
+    enableContextFilter: Schema.boolean().default(false),
+    minContextTokens: Schema.number(),
+  }).loose()).default({}),
+  // Full catalogs are cached separately from the allowlist applied to DSH.
+  // This keeps the model picker useful after a restart without widening the
+  // active llm-pi-ai catalog.
+  modelCatalogs: Schema.dict(Schema.array(Schema.object({
+    provider: Schema.string().required(),
+    id: Schema.string().required(),
+    name: Schema.string().required(),
+  }).loose())).default({}),
+})
+
+export function apply(ctx, config) {
+  const baseConfig = structuredClone(config || {})
+  const resolveConfig = (value) => Config(structuredClone(value || {}))
+  let liveConfig = resolveConfig(baseConfig)
+  let reconfigure = () => {}
+  let saveConfigImpl
+  // ctx.inject starts a child fiber; keep a stable function reference for the
+  // synchronizer while that fiber connects to the Settings service.
+  const saveConfig = async (patch) => {
+    if (!saveConfigImpl) {
+      throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
+    }
+    return saveConfigImpl(patch)
+  }
+
+  let settingsScope
+  const bindSettings = (settings, ownerCtx) => {
+    if (settingsScope || !settings?.register) return false
+    const scope = settings.register(NS, Config, { base: baseConfig })
+    settingsScope = scope
+    liveConfig = resolveConfig(scope.get() || baseConfig)
+    const stop = scope.watch((next) => {
+      liveConfig = resolveConfig(next || baseConfig)
+      reconfigure()
+    })
+    let saveQueue = Promise.resolve()
+    saveConfigImpl = (patch) => {
+      const nextTask = saveQueue.then(async () => {
+        const result = await scope.update(patch)
+        liveConfig = resolveConfig(scope.get() || baseConfig)
+        return result
+      })
+      saveQueue = nextTask.catch(() => {})
+      return nextTask
+    }
+    ownerCtx.effect(() => () => {
+      settingsScope = undefined
+      saveConfigImpl = undefined
+      stop()
+    }, 'dsh-model-sync: settings')
+    return true
+  }
+
+  let settings
+  try { settings = ctx.get('settings') } catch (e) {
+    if (typeof ctx.logger?.debug === 'function') ctx.logger.debug('[dsh-model-sync] settings service not immediately available:', e)
+  }
+  if (!bindSettings(settings, ctx)) {
+    ctx.inject(['settings'], (sctx) => {
+      bindSettings((typeof sctx.get === 'function' ? sctx.get('settings') : null) ?? sctx.settings, sctx)
+    })
+  }
+
+
+  const service = createProviderService(ctx)
+  const synchronizer = createModelSynchronizer(ctx, { getConfig: () => liveConfig, saveConfig })
+  const scheduler = createSyncScheduler(synchronizer, { getConfig: () => liveConfig })
+  reconfigure = () => scheduler.reconfigure()
+  scheduler.start()
+  ctx.effect(() => () => scheduler.stop(), 'dsh-model-sync: scheduler cleanup')
+  ctx.effect(() => {
+    const registrations = registerHttpApi(ctx, synchronizer, { getSchedulerStatus: () => scheduler.status() })
+    return () => {
+      for (const dispose of registrations) if (typeof dispose === 'function') dispose()
+    }
+  }, 'dsh-model-sync: http api')
+  ctx.effect(() => registerPluginUpdater(ctx, {
+    packageName: name,
+    endpoint: '/api/dsh-model-sync/update',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  }), 'dsh-model-sync: plugin updater')
+  ctx.effect(() => {
+    if (!liveConfig.enabled) return () => {}
+    ctx.provide('modelSync', service)
+    ctx.provide('modelSyncRunner', synchronizer)
+    return () => {}
+  }, 'dsh-model-sync: service')
+}

package/lib/policy.js

@@ -16,12 +16,21 @@ function capabilities(value) {
 
 export function normalizePolicy(policy) {
   const value = policy && typeof policy === 'object' && !Array.isArray(policy) ? policy : {}
-  return {
+  const res = {
     include: list(value.include),
     exclude: list(value.exclude),
     requireCapabilities: capabilities(value.requireCapabilities),
     denyCapabilities: capabilities(value.denyCapabilities),
   }
+  if (value.enableCostFilter) res.enableCostFilter = true
+  if (typeof value.maxPricePerMillion === 'number' && Number.isFinite(value.maxPricePerMillion) && value.maxPricePerMillion >= 0) {
+    res.maxPricePerMillion = value.maxPricePerMillion
+  }
+  if (value.enableContextFilter) res.enableContextFilter = true
+  if (typeof value.minContextTokens === 'number' && Number.isFinite(value.minContextTokens) && value.minContextTokens >= 0) {
+    res.minContextTokens = Math.floor(value.minContextTokens)
+  }
+  return res
 }
 
 function compilePatterns(patterns, field) {
@@ -48,6 +57,8 @@ export function hasPolicy(policy) {
     || normalized.exclude.length > 0
     || Object.keys(normalized.requireCapabilities).length > 0
     || Object.keys(normalized.denyCapabilities).length > 0
+    || (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined)
+    || (normalized.enableContextFilter && normalized.minContextTokens !== undefined)
 }
 
 export function filterModels(models, policy) {
@@ -66,6 +77,18 @@ export function filterModels(models, policy) {
     for (const [key, denied] of Object.entries(normalized.denyCapabilities)) {
       if (modelCapabilities[key] === denied) return false
     }
+    if (normalized.enableCostFilter && normalized.maxPricePerMillion !== undefined) {
+      const inputPrice = model?.pricing?.inputPerToken
+      if (typeof inputPrice === 'number' && Number.isFinite(inputPrice)) {
+        if (inputPrice * 1000000 > normalized.maxPricePerMillion) return false
+      }
+    }
+    if (normalized.enableContextFilter && normalized.minContextTokens !== undefined) {
+      const context = model?.contextWindow
+      if (typeof context === 'number' && Number.isFinite(context)) {
+        if (context < normalized.minContextTokens) return false
+      }
+    }
     return true
   })
 }