@goodandready/dsh-model-sync 0.5.7 → 0.5.8

package/lib/adapter-registry.js

@@ -1,8 +1,6 @@
 import { catalogRequestError } from './reliability.js'
-import { canUseGenericAdapter, createGenericAdapter } from './generic-adapter.js'
+import { canUseGenericAdapter, createGenericAdapter, readBoundedText, MAX_RESPONSE_BYTES } from './generic-adapter.js'
 import { normalizeModels, parseClinePassModels } from './models.js'
-
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SAFE_AUTH = new Set(['bearer', 'x-api-key', 'query-key', 'none'])
 const SAFE_PARSERS = new Set(['openai', 'google', 'clinebot-plan'])
 const CAPABILITIES = new Set(['vision', 'tools', 'reasoning', 'embeddings', 'code'])
@@ -214,17 +212,14 @@ async function fetchSpecific(profile, descriptor, options) {
     }
     const respEtag = response.headers?.get?.('etag') || undefined
     const respLastMod = response.headers?.get?.('last-modified') || undefined
-    const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-    if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
-    }
-    const text = await response.text()
-    if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-      const error = new Error('model catalog response is too large')
-      error.adapterCode = 'schema'
-      throw error
+    let text
+    try {
+      text = await readBoundedText(response, MAX_RESPONSE_BYTES)
+    } catch (err) {
+      if (err.message === 'model catalog response is too large') {
+        err.adapterCode = 'schema'
+      }
+      throw err
     }
     try { payload = JSON.parse(text) } catch {
       const error = new Error('model catalog response is not valid JSON')

package/lib/alias-resolver.js

@@ -15,7 +15,7 @@ export function validateAliasName(name) {
   return /^@?[a-zA-Z0-9_\-.]{1,64}$/.test(clean)
 }
 
-function modelScoreForCode(provider, model) {
+function modelScoreForCode(model) {
   let score = 0
   const id = String(model?.id ?? '').toLowerCase()
   const name = String(model?.name ?? '').toLowerCase()
@@ -208,7 +208,7 @@ export function resolveAlias(aliasName, {
     if (strategy === 'best-code') {
       const scored = available.map((item) => ({
         ...item,
-        score: modelScoreForCode(item.provider, item.model),
+        score: modelScoreForCode(item.model),
       }))
       scored.sort((a, b) => b.score - a.score)
       const best = scored[0]

package/lib/client.js

@@ -25,23 +25,23 @@ window.__ModuleLoader__.load({
       '.dms-card-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding-bottom:8px;display:flex;flex-direction:column;gap:10px;box-sizing:border-box}' +
       '.dms-wrap{display:flex;flex-direction:column;gap:14px;max-width:760px;box-sizing:border-box;color:var(--dsw-alias-label-primary,inherit)}' +
       '.dms-wrap>p{margin:0;color:var(--dsw-alias-label-secondary);font-size:12px;line-height:1.55}' +
-      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
+      '.dms-toolbar,.dms-section{display:flex;flex-direction:row;align-items:center;flex-wrap:wrap;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box}' +
       '.dms-toolbar>select{flex:1 1 190px;min-width:190px}' +
       '.dms-toolbar>.dms-actions{flex-basis:100%}' +
       '.dms-toolbar>label{display:inline-flex;align-items:flex-start;gap:7px;font-size:12px;line-height:1.35;color:var(--dsw-alias-label-secondary)}' +
       '.dms-toolbar>select,.dms-editor input,.dms-editor textarea,.dms-input{box-sizing:border-box;min-width:0;background:var(--dsw-specific-input-major,var(--dsw-alias-bg-layer-2,transparent));border:1px solid var(--dsw-alias-border-l1,var(--dsw-alias-border-l2));border-radius:6px;color:var(--dsw-alias-label-primary);font:inherit;padding:7px 9px}' +
       '.dms-toolbar>label input{accent-color:var(--dsw-alias-brand-primary,var(--dsw-alias-button-info-fill))}' +
       '.dms-actions{display:flex;align-items:center;flex-wrap:wrap;gap:7px}' +
-      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
-      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
+      '.dms-wrap>.dms-actions{padding:10px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent)}' +
+      '.dms-btn{margin:0!important;border:1px solid var(--dsw-alias-border-l2);border-radius:6px;background:transparent;color:var(--dsw-alias-label-primary);font:inherit;font-size:12px;line-height:1.35;padding:6px 10px;cursor:pointer;white-space:normal}' +
       '.dms-btn:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary);background:var(--dsw-alias-bg-layer-2)}' +
       '.dms-btn:disabled{opacity:.45;cursor:default}' +
       '.dms-section>strong{display:block;font-size:13px;font-weight:650}' +
       '.dms-provider-wrap{margin:0 0 7px}' +
-      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
+      '.dms-provider{display:grid!important;grid-template-columns:minmax(0,1fr) auto auto;align-items:center;gap:10px;padding:10px 11px;margin:0;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2,transparent)}' +
       '.dms-provider>span{min-width:0;overflow-wrap:anywhere;line-height:1.4}' +
       '.dms-section>div[style]{padding:8px 0;border-top:1px solid var(--dsw-alias-border-l2)}' +
-      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2,var(--dsw-alias-border-primary));border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
+      '.dms-editor{display:flex;flex-direction:column;align-items:stretch;gap:10px;padding:13px 14px;border:1px solid var(--dsw-alias-border-l2);border-radius:10px;background:var(--dsw-alias-bg-layer-1,transparent);box-sizing:border-box;border-color:var(--dsw-alias-brand-primary,var(--dsw-alias-border-l2))}' +
       '.dms-editor strong{font-size:13px}' +
       '.dms-editor label{display:block;gap:5px;margin-top:8px;color:var(--dsw-alias-label-secondary);font-size:12px}' +
       '.dms-editor label input,.dms-editor label textarea{width:100%}' +
@@ -53,10 +53,10 @@ window.__ModuleLoader__.load({
       '.dms-grid-2{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:12px}' +
       '.dms-badge{font-size:11px;padding:2px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
       '.dms-badge-ok{border-color:var(--dsw-alias-state-success-primary);color:var(--dsw-alias-state-success-primary);background:var(--dsw-alias-state-success-secondary,var(--dsw-alias-bg-layer-2))}' +
-      '.dms-badge-warn{border-color:var(--dsw-alias-state-warning-primary);color:var(--dsw-alias-state-warning-primary);background:var(--dsw-alias-state-warning-secondary,var(--dsw-alias-bg-layer-2))}' +
+      '.dms-badge-warn{border-color:var(--dsw-alias-state-warn-primary);color:var(--dsw-alias-state-warn-primary);background:var(--dsw-alias-state-warn-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-badge-bad{border-color:var(--dsw-alias-state-error-primary);color:var(--dsw-alias-state-error-primary);background:var(--dsw-alias-state-error-secondary,var(--dsw-alias-bg-layer-2))}' +
       '.dms-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
-      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
+      '.dms-input:focus{outline:none;border-color:var(--dsw-alias-brand-primary)}' +
       '.dms-btn-primary{background:var(--dsw-alias-label-primary)!important;color:var(--dsw-alias-bg-layer-3)!important;border-color:transparent!important;font-weight:600}' +
       '.dms-btn-primary:hover:not(:disabled){opacity:0.88}' +
       '.dms-btn-danger{color:var(--dsw-alias-state-error-primary)!important;border-color:var(--dsw-alias-state-error-primary)!important}' +
@@ -517,7 +517,7 @@ window.__ModuleLoader__.load({
                 }, updaterChecking ? t.checkingUpdates : (updaterStatus ? t.upToDate : t.checkForUpdates))
           )
         ),
-        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
+        updaterNotice ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-success-primary)', marginTop: 8, fontSize: 12 } }, updaterNotice) : null,
         updaterError ? React.createElement('div', { style: { color: 'var(--dsw-alias-state-error-primary)', marginTop: 8, fontSize: 12 } }, updaterError) : null
       )
     }
@@ -1117,7 +1117,7 @@ window.__ModuleLoader__.load({
               return React.createElement('div', { key: p.name, style: { display: 'flex', flexDirection: 'column', gap: 4, padding: '8px 10px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: 6, background: 'var(--dsw-alias-bg-layer-2)' } },
                 React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center' } },
                   React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center' } },
-                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-state-brand-primary)' } }, p.name),
+                    React.createElement('strong', { style: { fontFamily: 'monospace', fontSize: 13, color: 'var(--dsw-alias-brand-primary)' } }, p.name),
                     React.createElement('span', { style: { fontSize: 12, color: 'var(--dsw-alias-label-secondary)' } }, p.label)
                   ),
                   button(isResolving ? t.resolvingAlias : t.resolveAlias, () => resolveSmartAlias(p.name), 'secondary')
@@ -1318,8 +1318,8 @@ window.__ModuleLoader__.load({
                     React.createElement('input', { type: 'checkbox', checked: selectionDraft.includes(model.id), onChange: (e) => setSelectionDraft((current) => e.target.checked ? [...current, model.id] : current.filter((id) => id !== model.id)) }),
                     ` ${model.name ?? model.id} (${model.id})`,
                     isNewModel(model, row) ? React.createElement('span', { style: { marginLeft: 6, fontSize: 11, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-business-primary)', color: 'white' } }, 'NEW') : null,
-                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
-                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warning-primary)', color: 'white' } }, '★') : null,
+                    deprecationDays !== null ? React.createElement('span', { style: { marginLeft: 6, fontSize: 10, padding: '1px 5px', borderRadius: 4, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, deprecationDays > 0 ? t.deprecatesIn.replace('%d', deprecationDays) : t.deprecated) : null,
+                    (model.contextWindow && maxContext > 0 && model.contextWindow >= maxContext) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-warn-primary)', color: 'white' } }, '★') : null,
                     (model.pricing && minPrice !== Infinity && model.pricing.inputPerToken === minPrice) ? React.createElement('span', { style: { marginLeft: 4, fontSize: 10, padding: '1px 4px', borderRadius: 3, background: 'var(--dsw-alias-state-success-primary)', color: 'white' } }, '$') : null,
                     model.tags && model.tags.length ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)' } }, model.tags.join(', ')) : null,
                     model.pricing ? React.createElement('small', { style: { marginLeft: 6, color: 'var(--dsw-alias-label-secondary)', fontSize: 11 } }, `in $${(model.pricing.inputPerToken * 1000000).toFixed(2)}/1M` + (model.pricing.cacheReadPerToken !== undefined ? ` / cache $${(model.pricing.cacheReadPerToken * 1000000).toFixed(2)}` : '') + (model.pricing.outputPerToken !== undefined ? ` / out $${(model.pricing.outputPerToken * 1000000).toFixed(2)}` : '')) : null,

package/lib/generic-adapter.js

@@ -1,7 +1,7 @@
 import { catalogRequestError } from './reliability.js'
 import { normalizeModels } from './models.js'
 
-const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
+export const MAX_RESPONSE_BYTES = 4 * 1024 * 1024
 const SUPPORTED_APIS = new Set(['openai-completions', 'openai-responses'])
 
 function endpointFor(baseURL) {
@@ -10,16 +10,68 @@ function endpointFor(baseURL) {
   return base.endsWith('/models') ? base : `${base}/models`
 }
 
-async function readBody(response) {
+export async function readBoundedText(response, maxBytes = MAX_RESPONSE_BYTES) {
   const declared = Number(response.headers?.get?.('content-length') ?? NaN)
-  if (Number.isFinite(declared) && declared > MAX_RESPONSE_BYTES) {
+  if (Number.isFinite(declared) && declared > maxBytes) {
     throw new Error('model catalog response is too large')
   }
-  const text = await response.text()
-  if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) {
-    throw new Error('model catalog response is too large')
+
+  if (response.body && typeof response.body[Symbol.asyncIterator] === 'function') {
+    const chunks = []
+    let totalBytes = 0
+    for await (const chunk of response.body) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      totalBytes += buf.byteLength
+      if (totalBytes > maxBytes) {
+        if (typeof response.body.cancel === 'function') {
+          try { await response.body.cancel('response too large') } catch (_err) { /* best-effort */ }
+        } else if (typeof response.body.destroy === 'function') {
+          try { response.body.destroy() } catch (_err) { /* best-effort */ }
+        }
+        throw new Error('model catalog response is too large')
+      }
+      chunks.push(buf)
+    }
+    return Buffer.concat(chunks).toString('utf8')
   }
-  return text
+
+  if (response.body && typeof response.body.getReader === 'function') {
+    const reader = response.body.getReader()
+    const chunks = []
+    let totalBytes = 0
+    try {
+      while (true) {
+        const { done, value } = await reader.read()
+        if (done) break
+        if (value) {
+          const buf = Buffer.isBuffer(value) ? value : Buffer.from(value)
+          totalBytes += buf.byteLength
+          if (totalBytes > maxBytes) {
+            try { await reader.cancel('response too large') } catch (_err) { /* best-effort */ }
+            throw new Error('model catalog response is too large')
+          }
+          chunks.push(buf)
+        }
+      }
+    } finally {
+      try { reader.releaseLock?.() } catch (_err) { /* best-effort */ }
+    }
+    return Buffer.concat(chunks).toString('utf8')
+  }
+
+  if (typeof response.text === 'function') {
+    const text = await response.text()
+    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+      throw new Error('model catalog response is too large')
+    }
+    return text
+  }
+
+  return ''
+}
+
+async function readBody(response) {
+  return readBoundedText(response, MAX_RESPONSE_BYTES)
 }
 
 function rowsFrom(payload) {

package/lib/http.js

@@ -1,4 +1,7 @@
+import crypto from 'node:crypto'
 import { validateAliasName } from './alias-resolver.js'
+import { validatePolicy } from './policy.js'
+
 function normalizeWebhookTestRequest(body) {
   if (!body || typeof body !== "object") throw Object.assign(new Error("body is required"), { code: "INVALID_REQUEST" })
   if (typeof body.url !== "string" || !body.url.trim()) throw Object.assign(new Error("url is required"), { code: "INVALID_REQUEST" })
@@ -30,8 +33,6 @@ function normalizeWebhookTestRequest(body) {
     secret: typeof body.secret === "string" ? body.secret.trim() : "",
   }
 }
-import crypto from 'node:crypto'
-import { validatePolicy } from './policy.js'
 
 const BASE = '/dsh-model-sync'
 
@@ -82,8 +83,6 @@ export function trusted(req, { requireLoopback = false } = {}) {
   }
   // If sec-fetch-site is same-origin or same-site, allow
   if (fetchSite === 'same-origin' || fetchSite === 'same-site') return true
-  // If sec-fetch-mode is present but origin/referer missing on a cross-site request, reject
-  if (req.headers?.['sec-fetch-mode'] && !host) return false
   // For requests requiring loopback or POST without any browser origin/referer headers, require explicit loopback
   if ((requireLoopback || req?.method === 'POST') && !origin && !referer) {
     if (!isLoopbackAddress(remoteAddress ?? (req?.headers?.host ? req.headers.host.split(':')[0] : ''))) return false

package/lib/models.js

@@ -146,11 +146,8 @@ function normalizeCapabilities(row) {
   if (!result.code && (/(^|[_-])(coder|code|starcoder|codellama)($|[_-])/i.test(idStr) || idStr.includes('coder') || idStr.includes('code-'))) {
     result.code = true
   }
-  if (!result.vision && (/(^|[_-])(vision|vl|multimodal|4v|4o|flash)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
-    // Only set vision if clearly indicated by vision/vl tags
-    if (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision')) {
-      result.vision = true
-    }
+  if (!result.vision && (/(^|[_-])(vision|vl)($|[_-])/i.test(idStr) || idStr.includes('-vl') || idStr.includes('-vision'))) {
+    result.vision = true
   }
 
   return Object.keys(result).length > 0 ? result : undefined

package/lib/reliability.js

@@ -110,13 +110,11 @@ export async function retryWithBackoff(operation, {
   onRetry,
 } = {}) {
   const total = Math.max(1, Math.floor(Number(attempts) || 1))
-  let lastError
   for (let attempt = 1; attempt <= total; attempt += 1) {
     if (signal?.aborted) throw signal.reason ?? abortError()
     try {
       return await operation({ attempt })
     } catch (error) {
-      lastError = error
       if (attempt >= total || !isRetryableError(error)) throw error
       const exponential = Math.max(0, Number(baseDelayMs) || 0) * (2 ** (attempt - 1))
       // Full jitter: randomized between [0.5, 1.0] of calculated exponential backoff
@@ -130,7 +128,6 @@ export async function retryWithBackoff(operation, {
       await delay(delayMs, signal)
     }
   }
-  throw lastError
 }
 
 export async function mapWithConcurrency(items, worker, concurrency = 4) {

package/lib/synchronizer-transfer.js

@@ -54,7 +54,7 @@ export function createConfigTransfer({
             importedProviders.push(pname)
           }
           if (Array.isArray(pdata.selectedModels)) {
-            currentSelections[pname] = pdata.selectedModels.filter((m) => typeof m === 'string')
+            currentSelections[pname] = [...new Set(pdata.selectedModels.filter((m) => typeof m === 'string' && m.trim()).map((m) => m.trim()))].slice(0, 1000)
             importedProviders.push(pname)
           }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-model-sync",
-  "version": "0.5.7",
+  "version": "0.5.8",
   "description": "Automatic model catalog synchronization for API-key DeepSeek Harness providers.",
   "keywords": [
     "deepseek-harness",
@@ -53,7 +53,10 @@
   "license": "MIT",
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/schemastery": "^3.18.4",
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1"
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.4"
   }
 }