@goodandready/dsh-model-sync 0.3.8 → 0.3.9

package/README.md

@@ -142,6 +142,19 @@ dsh plugin --profile web add @goodandready/dsh-model-sync
 
 ---
 
+## 🚀 Enhancements in v0.3.9
+
+* 🔒 **Serialized Settings Mutations (`saveConfig`)**:
+  * Chained internal settings persistence via an async promise mutex (`saveQueue`).
+  * Eliminates race conditions between simultaneous sync runs and user UI interactions, ensuring clean atomic writes to `settings.yaml`.
+* 🛡️ **Hardened Cross-Origin & CSRF Protections**:
+  * Enhanced `trusted(req)` checking to evaluate `sec-fetch-site`, `origin`, and `referer` against the HTTP `Host`.
+  * Blocks unauthorized cross-origin mutations while preserving legitimate local and reverse-proxy requests.
+* 🎨 **Standardized Plugin Style Discovery**:
+  * Added `data-dsh-plugin="dsh-model-sync"` attribute to injected UI style tags in compliance with the DeepSeek Harness plugin authoring standard.
+
+---
+
 ## 🚀 Enhancements in v0.3.5
 
 * ⏱️ **Adaptive Rate Limit & Retry-After Handling**:

package/README.ru.md

@@ -119,6 +119,19 @@ dsh plugin --profile web add @goodandready/dsh-model-sync
 
 ---
 
+## 🚀 Новые возможности в v0.3.9
+
+* 🔒 **Атомарная очередь сохранения настроек (`saveConfig`)**:
+  * Сериализация внутренних мутаций конфигурации через цепочку промисов (`saveQueue`).
+  * Предотвращает состояние гонки между фоновой синхронизацией и действиями пользователя в интерфейсе, гарантируя целостность `settings.yaml`.
+* 🛡️ **Усиленная защита от CSRF и cross-origin атак**:
+  * Расширенная валидация запросов `trusted(req)` с проверкой заголовков `sec-fetch-site`, `origin` и `referer` против `Host`.
+  * Блокировка межсайтовых вызовов мутаций без нарушения локальных обращений и проксирования.
+* 🎨 **Стандартизация инжекции стилей интерфейса**:
+  * Добавлен атрибут `data-dsh-plugin="dsh-model-sync"` для тега стилей в полном соответствии со стандартом разработки плагинов DeepSeek Harness.
+
+---
+
 ## 🚀 Новые возможности в v0.3.5
 
 * ⏱️ **Адаптивная обработка Rate Limit и Retry-After**:

package/lib/client.js

@@ -33,10 +33,11 @@ window.__ModuleLoader__.load({
     function ensureStyles() {
       if (typeof document === 'undefined' || !document.head) return
       const cssId = 'dsh-model-sync/settings.module.css'
-      if (document.querySelector('style[data-plugin-css="' + cssId + '"]')) return
+      if (document.querySelector('style[data-plugin-css="' + cssId + '"]') || document.querySelector('style[data-dsh-plugin="dsh-model-sync"]')) return
       const tag = document.createElement('style')
       tag.textContent = CSS
       tag.setAttribute('data-plugin', 'dsh-model-sync')
+      tag.setAttribute('data-dsh-plugin', 'dsh-model-sync')
       tag.setAttribute('data-plugin-css', cssId)
       document.head.appendChild(tag)
     }

package/lib/http.js

@@ -8,12 +8,24 @@ function json(res, status, body) {
 }
 
 function trusted(req) {
-  if (req.headers?.['sec-fetch-site'] === 'cross-site') return false
-  const origin = req.headers?.origin
-  if (!origin) return true
+  const fetchSite = req.headers?.['sec-fetch-site']
+  if (fetchSite === 'cross-site') return false
   const host = req.headers?.host
-  if (!host) return false
-  try { return new URL(origin).host === host } catch { return false }
+  const origin = req.headers?.origin
+  if (origin) {
+    if (!host) return false
+    try { return new URL(origin).host === host } catch { return false }
+  }
+  const referer = req.headers?.referer
+  if (referer) {
+    if (!host) return false
+    try { return new URL(referer).host === host } catch { return false }
+  }
+  // If sec-fetch-site is same-origin or same-site, allow
+  if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
+  // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
+  if (req.headers?.['sec-fetch-mode'] && !host) return false
+  return true
 }
 
 function readJson(req) {

package/lib/index.js

@@ -115,10 +115,15 @@ export function apply(ctx, config) {
       liveConfig = resolveConfig(next || baseConfig)
       reconfigure()
     })
-    saveConfigImpl = async (patch) => {
-      const result = await scope.update(patch)
-      liveConfig = resolveConfig(scope.get() || baseConfig)
-      return result
+    let saveQueue = Promise.resolve()
+    saveConfigImpl = (patch) => {
+      const nextTask = saveQueue.then(async () => {
+        const result = await scope.update(patch)
+        liveConfig = resolveConfig(scope.get() || baseConfig)
+        return result
+      })
+      saveQueue = nextTask.catch(() => {})
+      return nextTask
     }
     ownerCtx.effect(() => () => {
       settingsScope = undefined

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",