@goodandready/dsh-model-sync 0.5.4 → 0.5.6

package/lib/adapter-registry.js

@@ -12,7 +12,7 @@ const PROVIDER_ADAPTERS = Object.freeze({
   clinebot: {
     endpoint: 'https://api.cline.bot/api/v1/users/me/plan',
     auth: 'bearer',
-    parser: 'clinebot-plan',
+    parse: 'clinebot-plan',
     defaultModels: [
       'cline-pass/deepseek-v4-flash',
       'cline-pass/deepseek-v4-pro',
@@ -99,12 +99,13 @@ function mappedRows(provider, rows, descriptor) {
 }
 
 function parseRows(provider, payload, descriptor) {
-  if (descriptor.parse === 'clinebot-plan') {
+  const parserKind = descriptor.parse || descriptor.parser
+  if (parserKind === 'clinebot-plan') {
     const plan = payload?.data?.plan || payload?.data || payload?.plan || payload
     const included = plan?.features?.included || plan?.includedModels || []
     return parseClinePassModels(included)
   }
-  if (descriptor.parse === 'google') {
+  if (parserKind === 'google') {
     const rows = Array.isArray(payload?.models) ? payload.models : []
     return normalizeModels(provider, rows.map((row) => ({
       ...row,
@@ -136,6 +137,24 @@ export function normalizeAdapterConfig(config, profile = {}) {
   if (endpoint.protocol === 'http:' && !privateHttpHost(endpoint.hostname)) {
     throw Object.assign(new Error('adapter endpoint must use https outside loopback'), { code: 'ADAPTER_CONFIG_INVALID' })
   }
+  if (profile?.provider && PROVIDER_ADAPTERS[profile.provider]) {
+    const defaultEndpoint = PROVIDER_ADAPTERS[profile.provider].endpoint
+    let defaultUrl
+    try { defaultUrl = new URL(defaultEndpoint) } catch (_err) { defaultUrl = null }
+    if (defaultUrl) {
+      const knownHost = defaultUrl.hostname.toLowerCase()
+      const targetHost = endpoint.hostname.toLowerCase()
+      const isDomainMatch = targetHost === knownHost || targetHost.endsWith('.' + knownHost.replace(/^api\./, ''))
+      const isLoopback = privateHttpHost(targetHost)
+      const isExplicitlyAllowed = source.allowCustomHost === true || source.allowCustomEndpoint === true
+      if (!isDomainMatch && !isLoopback && !isExplicitlyAllowed) {
+        throw Object.assign(
+          new Error(`adapter endpoint host "${endpoint.hostname}" does not match known provider domain for "${profile.provider}"`),
+          { code: 'ADAPTER_HOST_MISMATCH' }
+        )
+      }
+    }
+  }
   const auth = source.auth === undefined ? 'bearer' : String(source.auth)
   if (!SAFE_AUTH.has(auth)) throw Object.assign(new Error('adapter auth mode is unsupported'), { code: 'ADAPTER_CONFIG_INVALID' })
   const parse = source.parser === undefined ? 'openai' : String(source.parser)
@@ -224,9 +243,6 @@ async function fetchSpecific(profile, descriptor, options) {
       return rows
     }
   } catch (error) {
-    if (descriptor.defaultModels && Array.isArray(descriptor.defaultModels) && descriptor.defaultModels.length > 0) {
-      return normalizeModels(profile.provider, descriptor.defaultModels.map((id) => ({ id })))
-    }
     throw error
   }
   if (descriptor.defaultModels && Array.isArray(descriptor.defaultModels) && descriptor.defaultModels.length > 0) {

package/lib/client.js

@@ -785,6 +785,20 @@ window.__ModuleLoader__.load({
           .finally(() => setBusy(false))
       }
 
+      const resolveSmartAlias = (aliasName) => {
+        setResolvingKey(aliasName)
+        fetch(`${API}/aliases/resolve?alias=${encodeURIComponent(aliasName)}`)
+          .then(async (r) => {
+            const res = await r.json()
+            if (!r.ok) throw new Error(res.error?.message ?? `HTTP ${r.status}`)
+            setResolvedAliases((prev) => ({ ...prev, [aliasName]: res }))
+          })
+          .catch((e) => {
+            setResolvedAliases((prev) => ({ ...prev, [aliasName]: { error: String(e?.message ?? e) } }))
+          })
+          .finally(() => setResolvingKey(''))
+      }
+
       const load = () => {
         if (typeof document !== 'undefined' && document.hidden) return
         setError('')

package/lib/diff-notifier.js

@@ -114,6 +114,20 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
     if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
       return { ok: false, error: "URL must use http or https protocol" }
     }
+    const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+    if (
+      hostname === '169.254.169.254' ||
+      hostname.startsWith('169.254.') ||
+      hostname === 'metadata.google.internal' ||
+      hostname === '0.0.0.0' ||
+      hostname === '255.255.255.255'
+    ) {
+      return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
+    }
+    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    if (parsedUrl.protocol === "http:" && !isLoopback) {
+      return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
+    }
   } catch (err) {
     return { ok: false, error: "Invalid URL: " + (err?.message || String(err)) }
   }
@@ -181,9 +195,21 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
+    let secret = config.diffWebhookSecret || ''
+    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    if (secretRef) {
+      try {
+        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
+        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+      } catch (err) {
+        if (typeof ctx?.logger?.debug === 'function') {
+          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        }
+      }
+    }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,
-      config.diffWebhookSecret,
+      secret,
       {
         event: "model-sync.diff",
         ...events,

package/lib/http.js

@@ -2,8 +2,31 @@ import { validateAliasName } from './alias-resolver.js'
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
+  let parsed
+  try {
+    parsed = new URL(body.url.trim())
+  } catch (err) {
+    throw Object.assign(new Error("Invalid URL: " + (err?.message || String(err))), { code: "INVALID_REQUEST" })
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
+  }
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (parsed.protocol === "http:" && !isLoopback) {
+    throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
+  }
+  if (
+    hostname === '169.254.169.254' ||
+    hostname.startsWith('169.254.') ||
+    hostname === 'metadata.google.internal' ||
+    hostname === '0.0.0.0' ||
+    hostname === '255.255.255.255'
+  ) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
   return {
-    url: body.url.trim(),
+    url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
@@ -28,7 +51,9 @@ export function isLoopbackAddress(ip) {
 export function trusted(req, { requireLoopback = false } = {}) {
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
-    if (!isLoopbackAddress(remoteAddress)) return false
+    if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
+    if (!remoteAddress && req?.socket) return false
+    if (!remoteAddress && !isLoopbackAddress(req?.headers?.host?.split(':')[0])) return false
   }
   const fetchSite = req.headers?.['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
@@ -59,8 +84,10 @@ export function trusted(req, { requireLoopback = false } = {}) {
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
   // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
   if (req.headers?.['sec-fetch-mode'] && !host) return false
-  // For POST write requests without any browser origin/referer headers, require explicit loopback remoteAddress
-  if (req?.method === 'POST' && !origin && !referer && !isLoopbackAddress(remoteAddress)) return false
+  // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
+  if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
+    if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false
+  }
   return true
 }
 
@@ -247,7 +274,8 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
-    if (!trusted(req, { requireLoopback: req.method === 'POST' })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    const isPublicStatus = route === 'status' && req.method === 'GET'
+    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/index.js

@@ -27,7 +27,8 @@ export const Config = Schema.object({
   historyLimit: Schema.number().default(50).volatile(),
   notificationLimit: Schema.number().default(50).volatile(),
   diffWebhookUrl: Schema.string().default().volatile(),
-  diffWebhookSecret: Schema.string().default().volatile(),
+  diffWebhookSecretRef: Schema.string().role('credential-ref').default('').volatile(),
+  diffWebhookSecret: Schema.string().role('credential-ref').default('').volatile(),
   notifyOnModelAdded: Schema.boolean().default(true).volatile(),
   notifyOnModelDeprecated: Schema.boolean().default(true).volatile(),
   notifyOnPriceChanged: Schema.boolean().default(true).volatile(),
@@ -123,7 +124,16 @@ export function plainConfig(value) {
 
 export function apply(ctx, config) {
   const baseConfig = structuredClone(plainConfig(config || {}))
-  const resolveConfig = (value) => plainConfig(Config(plainConfig(value) || {}))
+  const resolveConfig = (value) => {
+    try {
+      return plainConfig(Config(plainConfig(value) || {}))
+    } catch (err) {
+      if (typeof ctx?.logger?.warn === "function") {
+        ctx.logger.warn("[dsh-model-sync] invalid config payload, fallback to current config:", err?.message || err)
+      }
+      return liveConfig ?? baseConfig
+    }
+  }
   let liveConfig = resolveConfig(baseConfig)
   let reconfigure = () => {}
   let saveConfigImpl = async (patch) => {
@@ -165,12 +175,16 @@ export function apply(ctx, config) {
   reconfigure = () => scheduler.reconfigure()
   scheduler.start()
 
-  if (typeof ctx.on === 'function') {
-    ctx.on('loader/volatile-update', () => {
+  ctx.effect(() => {
+    if (typeof ctx.on !== 'function') return () => {}
+    const dispose = ctx.on('loader/volatile-update', () => {
       liveConfig = resolveConfig(config)
       reconfigure()
     })
-  }
+    return () => {
+      if (typeof dispose === 'function') dispose()
+    }
+  }, 'dsh-model-sync: volatile-update listener')
 
   // settings.register was removed before 0.1.7-rc.2. The host hands the profile entry
   // config to apply() directly, and liveConfig above is derived from it; the
@@ -189,7 +203,6 @@ export function apply(ctx, config) {
     manifestUrl: new URL('../package.json', import.meta.url),
   }), 'dsh-model-sync: plugin updater')
   ctx.effect(() => {
-    if (!liveConfig.enabled) return () => {}
     ctx.provide('modelSync', service)
     ctx.provide('modelSyncRunner', synchronizer)
     return () => {}

package/lib/inventory.js

@@ -1,4 +1,5 @@
 import { normalizeModels } from './models.js'
+import { sectionOf } from './synchronizer-helpers.js'
 
 export const API_KEY_PROVIDER_IDS = Object.freeze([
   'anthropic',
@@ -42,7 +43,7 @@ const API_KEY_PROVIDER_SET = new Set(API_KEY_PROVIDER_IDS)
 
 function settingsProfiles(settings) {
   try {
-    return settings?.get('llm-pi-ai')?.providers ?? {}
+    return sectionOf(settings, 'llm-pi-ai')?.providers ?? {}
   } catch {
     return {}
   }
@@ -66,7 +67,7 @@ export function listApiKeyProviders(llm, settings) {
   for (const entry of directory) {
     let profile = profiles[entry.provider]
     if (!profile && (entry.provider === 'commandcode' || entry.settingsNs === 'llm-commandcode')) {
-      const cc = settings?.get?.('llm-commandcode')
+      const cc = sectionOf(settings, 'llm-commandcode')
       profile = {
         apiKeyEnv: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',
         credentialRef: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',

package/lib/synchronizer-helpers.js

@@ -55,12 +55,23 @@ export function descriptorOf(settings, ns) {
   catch { return undefined }
 }
 
+export function sectionOf(settings, ns) {
+  try {
+    const desc = descriptorOf(settings, ns)
+    if (desc && desc.value !== undefined) return desc.value
+    if (typeof settings?.get === 'function') return settings.get(ns)
+    return undefined
+  } catch {
+    return undefined
+  }
+}
+
 export function profileOf(settings, provider) {
   try {
-    const piai = settings?.get(PIAI_NS)?.providers?.[provider]
+    const piai = sectionOf(settings, PIAI_NS)?.providers?.[provider]
     if (piai) return piai
     if (provider === 'commandcode') {
-      const cc = settings?.get?.('llm-commandcode')
+      const cc = sectionOf(settings, 'llm-commandcode')
       return {
         apiKeyEnv: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',
         credentialRef: cc?.apiKeyEnv ?? 'COMMANDCODE_API_KEY',
@@ -97,7 +108,7 @@ export function adapterErrorType(error) {
 export async function replaceWithRetry(settings, ns, patchFn, attempts = 3) {
   let lastError
   for (let i = 0; i < attempts; i++) {
-    const section = settings?.get?.(ns)
+    const section = sectionOf(settings, ns)
     const descriptor = descriptorOf(settings, ns)
     if (!section || !descriptor || typeof settings.replace !== 'function') {
       throw Object.assign(new Error(`${ns} settings are not writable`), { code: 'SETTINGS_UNAVAILABLE' })
@@ -120,7 +131,7 @@ export async function replaceWithRetry(settings, ns, patchFn, attempts = 3) {
 
 export function rotationRefs(settings, provider) {
   try {
-    const rows = settings?.get?.('dsh-key-rotation')?.providers
+    const rows = sectionOf(settings, 'dsh-key-rotation')?.providers
     if (!Array.isArray(rows)) return []
     return rows.filter((row) => row?.provider === provider).flatMap((row) => Array.isArray(row.keys) ? row.keys : [])
   } catch {
@@ -149,7 +160,7 @@ export async function performHistoryRollback({ ctx, config, providers = [], hist
   if (!snapshot || !Array.isArray(snapshot.before)) throw Object.assign(new Error(`history snapshot not found: ${provider}`), { code: 'HISTORY_NOT_FOUND' })
   if (!providers.some((row) => row.provider === provider && row.configured)) throw Object.assign(new Error(`provider is not configured: ${provider}`), { code: 'PROVIDER_NOT_CONFIGURED' })
   const settings = settingsOf(ctx)
-  const section = settings?.get?.(PIAI_NS)
+  const section = sectionOf(settings, PIAI_NS)
   const descriptor = descriptorOf(settings, PIAI_NS)
   if (!section || !descriptor || typeof settings.replace !== 'function') {
     throw Object.assign(new Error('llm-pi-ai settings are not writable'), { code: 'SETTINGS_UNAVAILABLE' })

package/lib/synchronizer.js

@@ -18,6 +18,7 @@ import {
   settingsOf,
   llmOf,
   descriptorOf,
+  sectionOf,
   profileOf,
   errorMessage,
   diagnosticMessage,
@@ -488,7 +489,7 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     if (typeof saveConfig !== 'function') throw Object.assign(new Error('dsh-model-sync settings are not writable'), { code: 'CONFIG_UNAVAILABLE' })
 
     const settings = settingsOf(ctx)
-    const section = settings?.get?.(PIAI_NS)
+    const section = sectionOf(settings, PIAI_NS)
     const descriptor = descriptorOf(settings, PIAI_NS)
     const current = normalizeModels(provider, profileOf(settings, provider).models ?? row.models)
     const nextModels = selectedModels.length
@@ -553,7 +554,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => sendWebhookNotification(url, secret, { event: 'model-sync.test', timestamp: Date.now(), test: true }),
+    testWebhook: async ({ url, secret }) => {
+      let resolvedSecret = secret || ''
+      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+        try {
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+        } catch (err) {
+          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+        }
+      }
+      return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })
+    },
     status: () => ({ running: Boolean(running), lastRun, lastHealth, lastReport: structuredClone(lastReport), notifications: notificationLedger(), history: history(), policies: listPolicies(), lifecycle: structuredClone(getConfig()?.modelLifecycle ?? {}), aliases: structuredClone(getConfig()?.aliases ?? {}) }),
   })
 }

package/lib/updater.js

@@ -237,7 +237,6 @@ export async function installExact(target, packageSpec, options = {}) {
         '--profile',
         target.profileName,
         'add',
-        '--config.minimumReleaseAge=0',
         packageSpec,
         `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",