@goodandready/dsh-model-sync 0.5.5 → 0.5.6

package/lib/adapter-registry.js

@@ -137,6 +137,24 @@ export function normalizeAdapterConfig(config, profile = {}) {
   if (endpoint.protocol === 'http:' && !privateHttpHost(endpoint.hostname)) {
     throw Object.assign(new Error('adapter endpoint must use https outside loopback'), { code: 'ADAPTER_CONFIG_INVALID' })
   }
+  if (profile?.provider && PROVIDER_ADAPTERS[profile.provider]) {
+    const defaultEndpoint = PROVIDER_ADAPTERS[profile.provider].endpoint
+    let defaultUrl
+    try { defaultUrl = new URL(defaultEndpoint) } catch (_err) { defaultUrl = null }
+    if (defaultUrl) {
+      const knownHost = defaultUrl.hostname.toLowerCase()
+      const targetHost = endpoint.hostname.toLowerCase()
+      const isDomainMatch = targetHost === knownHost || targetHost.endsWith('.' + knownHost.replace(/^api\./, ''))
+      const isLoopback = privateHttpHost(targetHost)
+      const isExplicitlyAllowed = source.allowCustomHost === true || source.allowCustomEndpoint === true
+      if (!isDomainMatch && !isLoopback && !isExplicitlyAllowed) {
+        throw Object.assign(
+          new Error(`adapter endpoint host "${endpoint.hostname}" does not match known provider domain for "${profile.provider}"`),
+          { code: 'ADAPTER_HOST_MISMATCH' }
+        )
+      }
+    }
+  }
   const auth = source.auth === undefined ? 'bearer' : String(source.auth)
   if (!SAFE_AUTH.has(auth)) throw Object.assign(new Error('adapter auth mode is unsupported'), { code: 'ADAPTER_CONFIG_INVALID' })
   const parse = source.parser === undefined ? 'openai' : String(source.parser)

package/lib/diff-notifier.js

@@ -114,6 +114,20 @@ export async function sendWebhookNotification(url, secret, payload, { fetchImpl
     if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
       return { ok: false, error: "URL must use http or https protocol" }
     }
+    const hostname = parsedUrl.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+    if (
+      hostname === '169.254.169.254' ||
+      hostname.startsWith('169.254.') ||
+      hostname === 'metadata.google.internal' ||
+      hostname === '0.0.0.0' ||
+      hostname === '255.255.255.255'
+    ) {
+      return { ok: false, error: "webhook url targets a forbidden metadata or link-local address" }
+    }
+    const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+    if (parsedUrl.protocol === "http:" && !isLoopback) {
+      return { ok: false, error: "insecure http webhook url is only permitted on loopback" }
+    }
   } catch (err) {
     return { ok: false, error: "Invalid URL: " + (err?.message || String(err)) }
   }
@@ -181,9 +195,21 @@ export async function dispatchDiffNotifications(ctx, config, results, { fetchImp
 
   let webhookResult = null
   if (config?.diffWebhookUrl && typeof config.diffWebhookUrl === "string" && config.diffWebhookUrl.trim()) {
+    let secret = config.diffWebhookSecret || ''
+    const secretRef = config.diffWebhookSecretRef || (typeof config.diffWebhookSecret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(config.diffWebhookSecret) ? config.diffWebhookSecret : '')
+    if (secretRef) {
+      try {
+        const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secretRef) : ctx?.get?.('credentials')?.resolve?.(secretRef))
+        if (res) secret = typeof res === 'string' ? res : res?.value || secret
+      } catch (err) {
+        if (typeof ctx?.logger?.debug === 'function') {
+          ctx.logger.debug('[dsh-model-sync] webhook secret resolution fallback:', err)
+        }
+      }
+    }
     webhookResult = await sendWebhookNotification(
       config.diffWebhookUrl,
-      config.diffWebhookSecret,
+      secret,
       {
         event: "model-sync.diff",
         ...events,

package/lib/http.js

@@ -2,8 +2,31 @@ import { validateAliasName } from './alias-resolver.js'
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
+  let parsed
+  try {
+    parsed = new URL(body.url.trim())
+  } catch (err) {
+    throw Object.assign(new Error("Invalid URL: " + (err?.message || String(err))), { code: "INVALID_REQUEST" })
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw Object.assign(new Error("URL must use http or https protocol"), { code: "INVALID_REQUEST" })
+  }
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  const isLoopback = hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1' || hostname.startsWith('127.') || hostname.startsWith('::ffff:127.')
+  if (parsed.protocol === "http:" && !isLoopback) {
+    throw Object.assign(new Error("insecure http webhook url is only permitted on loopback"), { code: "INVALID_REQUEST" })
+  }
+  if (
+    hostname === '169.254.169.254' ||
+    hostname.startsWith('169.254.') ||
+    hostname === 'metadata.google.internal' ||
+    hostname === '0.0.0.0' ||
+    hostname === '255.255.255.255'
+  ) {
+    throw Object.assign(new Error("webhook url targets a forbidden metadata or link-local address"), { code: "INVALID_REQUEST" })
+  }
   return {
-    url: body.url.trim(),
+    url: parsed.toString(),
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
@@ -28,7 +51,9 @@ export function isLoopbackAddress(ip) {
 export function trusted(req, { requireLoopback = false } = {}) {
   const remoteAddress = req?.socket?.remoteAddress
   if (requireLoopback || req?.method === 'POST') {
-    if (!isLoopbackAddress(remoteAddress)) return false
+    if (remoteAddress && !isLoopbackAddress(remoteAddress)) return false
+    if (!remoteAddress && req?.socket) return false
+    if (!remoteAddress && !isLoopbackAddress(req?.headers?.host?.split(':')[0])) return false
   }
   const fetchSite = req.headers?.['sec-fetch-site']
   if (fetchSite === 'cross-site') return false
@@ -59,8 +84,10 @@ export function trusted(req, { requireLoopback = false } = {}) {
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
   // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
   if (req.headers?.['sec-fetch-mode'] && !host) return false
-  // For POST write requests without any browser origin/referer headers, require explicit loopback remoteAddress
-  if (req?.method === 'POST' && !origin && !referer && !isLoopbackAddress(remoteAddress)) return false
+  // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
+  if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
+    if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false
+  }
   return true
 }
 
@@ -247,7 +274,8 @@ export function registerHttpApi(ctx, synchronizer, { getSchedulerStatus = () =>
     return []
   }
   const makeHandler = (route) => async (req, res) => {
-    if (!trusted(req, { requireLoopback: req.method === 'POST' })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
+    const isPublicStatus = route === 'status' && req.method === 'GET'
+    if (!trusted(req, { requireLoopback: !isPublicStatus })) return json(res, 403, { error: { code: 'forbidden', message: 'dsh-model-sync: cross-origin or non-loopback request rejected' } })
     if (route === 'status') {
       if (req.method !== 'GET') return json(res, 405, { error: { code: 'method', message: 'GET only' } })
       const payload = { ...synchronizer.status(), scheduler: getSchedulerStatus(), providers: synchronizer.listProviders() }

package/lib/index.js

@@ -27,7 +27,8 @@ export const Config = Schema.object({
   historyLimit: Schema.number().default(50).volatile(),
   notificationLimit: Schema.number().default(50).volatile(),
   diffWebhookUrl: Schema.string().default().volatile(),
-  diffWebhookSecret: Schema.string().default().volatile(),
+  diffWebhookSecretRef: Schema.string().role('credential-ref').default('').volatile(),
+  diffWebhookSecret: Schema.string().role('credential-ref').default('').volatile(),
   notifyOnModelAdded: Schema.boolean().default(true).volatile(),
   notifyOnModelDeprecated: Schema.boolean().default(true).volatile(),
   notifyOnPriceChanged: Schema.boolean().default(true).volatile(),

package/lib/synchronizer.js

@@ -554,7 +554,18 @@ export function createModelSynchronizer(ctx, { getConfig = () => ({}), saveConfi
     notifications: notificationLedger,
     updateNotification: updateNotificationState,
     rollbackHistory,
-    testWebhook: async ({ url, secret }) => sendWebhookNotification(url, secret, { event: 'model-sync.test', timestamp: Date.now(), test: true }),
+    testWebhook: async ({ url, secret }) => {
+      let resolvedSecret = secret || ''
+      if (typeof secret === 'string' && /^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
+        try {
+          const res = await (ctx?.credentials?.resolve ? ctx.credentials.resolve(secret) : ctx?.get?.('credentials')?.resolve?.(secret))
+          if (res) resolvedSecret = typeof res === 'string' ? res : res?.value || resolvedSecret
+        } catch (err) {
+          ctx?.logger?.debug?.('[dsh-model-sync] secret ref resolution fallback:', err)
+        }
+      }
+      return sendWebhookNotification(url, resolvedSecret, { event: 'model-sync.test', timestamp: Date.now(), test: true })
+    },
     status: () => ({ running: Boolean(running), lastRun, lastHealth, lastReport: structuredClone(lastReport), notifications: notificationLedger(), history: history(), policies: listPolicies(), lifecycle: structuredClone(getConfig()?.modelLifecycle ?? {}), aliases: structuredClone(getConfig()?.aliases ?? {}) }),
   })
 }

package/lib/updater.js

@@ -237,7 +237,6 @@ export async function installExact(target, packageSpec, options = {}) {
         '--profile',
         target.profileName,
         'add',
-        '--config.minimumReleaseAge=0',
         packageSpec,
         `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",