@goodandready/dsh-ollama-cloud-provider 0.1.3 → 0.1.5

package/CHANGELOG.md

@@ -1,57 +1,79 @@
-# Changelog
-
-## 0.1.3 — 2026-10-21
-
-- Aligned README documentation trio with dsh-documentation-standard: added standardized Hero headers, goodandready.app hub badges, support tables, and Mermaid architecture diagrams across English, Russian, and Chinese documentations.
-- Updated installation instructions and package version parity.
-
-## 0.1.2 — 2026-10-21
-
-- Test connection falls back to the reasoning text when a thinking model returns
-  no content, and uses a 64-token budget (#17).
-- Production acceptance of 0.1.1 confirmed chat, catalog and balance; the probe
-  is the only follow-up defect.
-
-## 0.1.1 — 2026-10-21
-
-Audit fixes (Gitea #1–#15):
-
-- A transient transport/timeout/server failure no longer cools down the only
-  configured account; the harness retry policy can recover. Credential and quota
-  rejections still cool the key (#1).
-- Removed the unimplemented `toolUpdate: 'addition-only'` declaration so the
-  model always receives the full tool list (#2).
-- `/dsh-ollama/key` and `/key/clear` only accept this plugin's credential
-  references (`apiKeyEnv`, configured account refs and `OLLAMA_*`) (#3).
-- The sidebar quota card honors `showSidebarQuota`, stays unmounted while the
-  setting is off and stops polling `/state` (#4).
-- The injected stylesheet carries `data-dsh-plugin` so neighbouring plugin
-  cleanup cannot strip it (#5).
-- Analytics uses the shared `estimateCost` implementation and applies
-  `priceOverrides` (#7).
-- Empty catch blocks report through `bestEffortFailed` at debug level (#8).
-- Removed unused modules and exports (`quota-runway`, `requireImages`,
-  `clearAnalyticsCache`, `PLUGIN_PROVIDERS`, `showUrlFor`) (#9).
-- Heatmap and theme values no longer hardcode colors (#10).
-- Test-connection requests disable thinking and use a 32-token budget (#11).
-- The request log is flushed on shutdown (#12).
-- Architecture documentation moved to `docs/design/ARCHITECTURE.md`; the
-  design contract lives in `docs/design/DESIGN.md` (#13).
-- Added wiring, analytics, route-guard and adapter regression tests (#14).
-- Account rows show the 7-day spend without a meaningless percentage (#15).
-
-## 0.1.0
-
-Initial release.
-
-- Registers the `ollama-cloud` provider route for DeepSeek Harness.
-- Native `/api/chat` transport (NDJSON) with thinking, tool calls, images and usage counters.
-- OpenAI-compatible `/v1/chat/completions` transport selectable per model.
-- Live model catalog from `/v1/models` enriched with `/api/tags` capabilities, plus an offline snapshot.
-- Balance from `/api/balance` (credits and legacy percentage windows) and spend from `/api/usage`
-  with 24-hour, 7-day and 30-day windows and per-model groups.
-- Multi-account rotation before the first streamed token, persistent cooldowns, sticky sessions and
-  model → account glob rules.
-- Price estimates including off-peak rates and per-model overrides.
-- Settings page, sidebar quota card, quota/analytics panel with a request heatmap, `/ollama` command,
-  TUI settings section and one-click plugin update.
+# Changelog
+
+## 0.1.5 — 2026-10-22
+
+- Write routes now require an `Origin` or `Referer` whose host matches `Host`;
+  a request with neither is rejected with 403. This closes the LAN-bridge path
+  that rewrites both Host and socket to loopback (#28).
+- Added route-guard tests for 405, non-loopback Host/socket, cross-origin and
+  missing sources, plus native stream parser tests for text, thinking, tool
+  calls, in-band quota errors, aborts, idle timeouts, abrupt closes and empty
+  streams (#26).
+- `prepare` now sends tsdown output to stderr, so `npm pack --json` stays
+  parseable and preflight can inspect the package (#25).
+- DESIGN.md now records the 64-token Test connection budget and its reason (#27).
+
+## 0.1.4 — 2026-10-21
+
+- Model list rows now use the reference three-column grid: badges live inside
+  the name cell, so rows no longer stretch, wrap into empty gaps or truncate the
+  model id to a single character (#20).
+- The sidebar quota card uses the reference 16px ring and no longer appends the
+  internal `default` account label. An optional `planLabel` (for example `PRO`)
+  can be shown next to the provider name instead (#21).
+
+## 0.1.3 — 2026-10-21
+
+- Aligned README documentation trio with dsh-documentation-standard: added standardized Hero headers, goodandready.app hub badges, support tables, and Mermaid architecture diagrams across English, Russian, and Chinese documentations.
+- Updated installation instructions and package version parity.
+
+## 0.1.2 — 2026-10-21
+
+- Test connection falls back to the reasoning text when a thinking model returns
+  no content, and uses a 64-token budget (#17).
+- Production acceptance of 0.1.1 confirmed chat, catalog and balance; the probe
+  is the only follow-up defect.
+
+## 0.1.1 — 2026-10-21
+
+Audit fixes (Gitea #1–#15):
+
+- A transient transport/timeout/server failure no longer cools down the only
+  configured account; the harness retry policy can recover. Credential and quota
+  rejections still cool the key (#1).
+- Removed the unimplemented `toolUpdate: 'addition-only'` declaration so the
+  model always receives the full tool list (#2).
+- `/dsh-ollama/key` and `/key/clear` only accept this plugin's credential
+  references (`apiKeyEnv`, configured account refs and `OLLAMA_*`) (#3).
+- The sidebar quota card honors `showSidebarQuota`, stays unmounted while the
+  setting is off and stops polling `/state` (#4).
+- The injected stylesheet carries `data-dsh-plugin` so neighbouring plugin
+  cleanup cannot strip it (#5).
+- Analytics uses the shared `estimateCost` implementation and applies
+  `priceOverrides` (#7).
+- Empty catch blocks report through `bestEffortFailed` at debug level (#8).
+- Removed unused modules and exports (`quota-runway`, `requireImages`,
+  `clearAnalyticsCache`, `PLUGIN_PROVIDERS`, `showUrlFor`) (#9).
+- Heatmap and theme values no longer hardcode colors (#10).
+- Test-connection requests disable thinking and use a 32-token budget (#11).
+- The request log is flushed on shutdown (#12).
+- Architecture documentation moved to `docs/design/ARCHITECTURE.md`; the
+  design contract lives in `docs/design/DESIGN.md` (#13).
+- Added wiring, analytics, route-guard and adapter regression tests (#14).
+- Account rows show the 7-day spend without a meaningless percentage (#15).
+
+## 0.1.0
+
+Initial release.
+
+- Registers the `ollama-cloud` provider route for DeepSeek Harness.
+- Native `/api/chat` transport (NDJSON) with thinking, tool calls, images and usage counters.
+- OpenAI-compatible `/v1/chat/completions` transport selectable per model.
+- Live model catalog from `/v1/models` enriched with `/api/tags` capabilities, plus an offline snapshot.
+- Balance from `/api/balance` (credits and legacy percentage windows) and spend from `/api/usage`
+  with 24-hour, 7-day and 30-day windows and per-model groups.
+- Multi-account rotation before the first streamed token, persistent cooldowns, sticky sessions and
+  model → account glob rules.
+- Price estimates including off-peak rates and per-model overrides.
+- Settings page, sidebar quota card, quota/analytics panel with a request heatmap, `/ollama` command,
+  TUI settings section and one-click plugin update.

package/NOTICE

@@ -1,15 +1,15 @@
-dsh-ollama-cloud-provider
-Copyright (c) 2026 GooDAnDReaDY
-
-This product is MIT-licensed (see LICENSE).
-
-Third-party references and attribution:
-
-- The plugin structure, cordis lifecycle wiring, HTTP route guards, request log, analytics reader,
-  quota runway and generic client widgets were adapted from the author's own
-  `@goodandready/dsh-opencode-provider` (MIT).
-- The feature set was informed by `@goodandready/dsh-clinebot` (MIT) and
-  `@mars-sea/dsh-commandcode-provider` (MIT). No vendor code from those packages is bundled.
-- DeepSeek Harness packages (`@deepseek-ai/*`) are host-owned peer dependencies and are not bundled.
-- Ollama Cloud API facts were verified against the public documentation and live endpoints on
-  2026-10-21. Ollama is a trademark of its respective owner; this plugin is unofficial.
+dsh-ollama-cloud-provider
+Copyright (c) 2026 GooDAnDReaDY
+
+This product is MIT-licensed (see LICENSE).
+
+Third-party references and attribution:
+
+- The plugin structure, cordis lifecycle wiring, HTTP route guards, request log, analytics reader,
+  quota runway and generic client widgets were adapted from the author's own
+  `@goodandready/dsh-opencode-provider` (MIT).
+- The feature set was informed by `@goodandready/dsh-clinebot` (MIT) and
+  `@mars-sea/dsh-commandcode-provider` (MIT). No vendor code from those packages is bundled.
+- DeepSeek Harness packages (`@deepseek-ai/*`) are host-owned peer dependencies and are not bundled.
+- Ollama Cloud API facts were verified against the public documentation and live endpoints on
+  2026-10-21. Ollama is a trademark of its respective owner; this plugin is unofficial.

package/README.md

@@ -84,7 +84,7 @@ graph LR
 - **Price estimates** from the published Ollama pricing table, including off-peak rates, with per-model overrides.
 - **Browser UI**:
   - **Settings → Ollama Cloud**: key, balance, accounts, rules, model allowlist, per-model transport, connection settings.
-  - **Sidebar quota card** (off by default, and it does not poll `/state` while disabled): a ring with the highest used window and rows with remaining credits or legacy windows.
+  - **Sidebar quota card** (off by default, and it does not poll `/state` while disabled): a ring with the highest used window and rows with remaining credits or legacy windows; an optional `planLabel` is shown next to the provider name.
   - **Center quota panel**: spend windows, spend by model, accounts, routing trace, usage analytics and a request heatmap.
 - **`/ollama` command** for status, usage, balance, accounts, models, rules and `test [model]`.
 - **TUI settings section** for terminal profiles.
@@ -103,17 +103,17 @@ npm pack
 Install the published package:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
 ```
 
 Or install the packed tarball into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 ```
 
 Restart dsh (or DSH Desktop), then pick **Ollama Cloud** in the model picker.
@@ -142,6 +142,7 @@ Restart dsh (or DSH Desktop), then pick **Ollama Cloud** in the model picker.
     activeAccount: ''              # label or credential name to pin
     stickySession: true
     showSidebarQuota: false
+    planLabel: ''                  # optional, e.g. PRO
 ```
 
 Every field except `apiKey` is volatile and appears in dsh settings.
@@ -190,10 +191,10 @@ Open **Settings → Ollama Cloud**:
 - **Routing** — sticky session per conversation.
 - **Models** — search, refresh the live catalog, hide models, override the wire transport per model, see price, context and capabilities.
 - **Connection** — native and OpenAI bases, usage and balance endpoints, transport, timeouts, output cap and context override.
-- **Sidebar** — show or hide the quota card.
+- **Sidebar** — show or hide the quota card, and an optional plan label (for example `PRO`) shown next to the provider name.
 - **Plugin update** — current/latest version and **Update now**.
 
-The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, are refused for cross-origin requests, and are restricted to loopback (`127.0.0.1` / `::1`).
+The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host`, and are restricted to loopback (`127.0.0.1` / `::1`); a write without either source header is rejected with 403.
 
 ## Command
 

package/README.ru.md

@@ -84,7 +84,7 @@ graph LR
 - **Оценка стоимости**: тарификация по официальному прайс-листу Ollama Cloud, включая ночные скидки (off-peak rates) и возможность ручного переопределения цен на модель.
 - **Интерфейс в браузере (Web UI)**:
   - **Настройки → Ollama Cloud**: управление ключами, отображение баланса, пул аккаунтов, правила маршрутизации, allowlist моделей, выбор транспорта.
-  - **Карточка квоты в сайдбаре**: кольцевой индикатор с наиболее загруженным окном и детализацией остатка кредитов (по умолчанию выключена и не нагружает сеть фоновыми опросами).
+  - **Карточка квоты в сайдбаре**: кольцевой индикатор с наиболее загруженным окном и детализацией остатка кредитов (по умолчанию выключена и не нагружает сеть фоновыми опросами; рядом с названием можно показать `planLabel`, например `PRO`).
   - **Центральная панель квот**: окна расходов, разбивка по моделям, трейс маршрутизации, аналитика токенов и интерактивный heatmap запросов.
 - **Команда `/ollama`**: статус провайдера, квоты, баланс, список аккаунтов, моделей, правил и запуск тестового запроса `test [model]`.
 - **Интеграция с терминалом (TUI)**: специальная секция настроек в терминальном режиме.
@@ -103,17 +103,17 @@ npm pack
 Установка опубликованного пакета из npm:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
 ```
 
 Либо установка из упакованного tarball:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **Ollama Cloud** в списке моделей.
@@ -137,6 +137,7 @@ dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud
     activeAccount: ''              # метка для принудительного закрепления
     stickySession: true
     showSidebarQuota: false
+    planLabel: ''                  # необязательно, например PRO
 ```
 
 Все поля, кроме `apiKey`, доступны для изменения в интерфейсе настроек DSH.

package/README.zh.md

@@ -84,7 +84,7 @@ graph LR
 - **成本透明估算**：依据官方发布的价目表（包含闲时优惠折扣）进行费用估算，支持按模型覆盖价格。
 - **Web UI 与交互卡片**：
   - **设置 → Ollama Cloud**：密钥配置、余额显示、账号池管理、模型白名单与协议切换。
-  - **侧边栏配额指示卡片**：环形展示最高额度窗口（默认关闭且不产生后台轮询）。
+  - **侧边栏配额指示卡片**：环形展示最高额度窗口（默认关闭且不产生后台轮询；可在名称旁显示 `planLabel`，例如 `PRO`）。
   - **中央用量分析面板**：支出窗口、请求热力图与用量走势。
 - **`/ollama` 快捷指令**：快速查询状态、额度、余额、账号列表与执行联通性测试。
 - **一键热更新**：在 DSH 设置页直接检测 npm 最新版本并快速安装更新。
@@ -102,17 +102,17 @@ npm pack
 从 npm 安装已发布版本：
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
 # DSH 桌面端：
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.3
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
 ```
 
 或通过打包文件安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.3.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型列表中选择 **Ollama Cloud** 即可。
@@ -136,6 +136,7 @@ dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud
     activeAccount: ''              # 固定指定活跃账号
     stickySession: true
     showSidebarQuota: false
+    planLabel: ''                  # 可选，例如 PRO
 ```
 
 除 `apiKey` 外的所有配置项均可在 DSH 设置页直接修改。

package/cordis.patch.yml

@@ -1,11 +1,11 @@
-# dsh-ollama-cloud-provider bundle layer.
-# Registers the `ollama-cloud` provider route. All fields are optional —
-# schema defaults apply.
-#
-# `name` must be the FULL package specifier as installed in the profile's
-# node_modules. Quote it: an unquoted YAML scalar starting with `@` fails.
-- insert:
-    - id: llm-ollama-cloud
-      name: "@goodandready/dsh-ollama-cloud-provider"
-      config:
-        apiKeyEnv: OLLAMA_API_KEY
+# dsh-ollama-cloud-provider bundle layer.
+# Registers the `ollama-cloud` provider route. All fields are optional —
+# schema defaults apply.
+#
+# `name` must be the FULL package specifier as installed in the profile's
+# node_modules. Quote it: an unquoted YAML scalar starting with `@` fails.
+- insert:
+    - id: llm-ollama-cloud
+      name: "@goodandready/dsh-ollama-cloud-provider"
+      config:
+        apiKeyEnv: OLLAMA_API_KEY

package/lib/client.js

@@ -120,6 +120,8 @@ window.__ModuleLoader__.load({
 				sidebar: "Sidebar",
 				showSidebarQuota: "Show the quota card in the sidebar",
 				showSidebarQuotaHint: "The card appears above Settings and opens this panel.",
+				planLabel: "Plan label",
+				planLabelHint: "Optional label shown on the sidebar card, for example PRO. Ollama does not expose the plan name via API.",
 				usageAnalytics: "Usage analytics",
 				analyticsEmpty: "No Ollama Cloud sessions in this window.",
 				analyticsHint: "Aggregated from the local session projection cache: numeric metadata only, no prompt text.",
@@ -277,6 +279,8 @@ window.__ModuleLoader__.load({
 				sidebar: "侧边栏",
 				showSidebarQuota: "在侧边栏显示配额卡片",
 				showSidebarQuotaHint: "卡片显示在设置上方，点击可打开此面板。",
+				planLabel: "套餐标签",
+				planLabelHint: "侧边栏卡片上显示的可选标签，例如 PRO。Ollama API 不提供套餐名称。",
 				usageAnalytics: "用量分析",
 				analyticsEmpty: "此窗口内没有 Ollama Cloud 会话。",
 				analyticsHint: "来自本地会话投影缓存，仅包含数值元数据，不读取提示词。",
@@ -1005,8 +1009,8 @@ window.__ModuleLoader__.load({
 			};
 		}
 		function MiniRing(props) {
-			const size = props.size ?? 34;
-			const radius = 14;
+			const size = props.size ?? 16;
+			const radius = 7;
 			const circumference = 2 * Math.PI * radius;
 			const filled = Math.max(0, Math.min(100, props.percent)) / 100;
 			const stroke = props.percent >= 90 ? "var(--ocl-danger)" : props.percent >= 75 ? "var(--ocl-warning)" : "var(--ocl-accent)";
@@ -1014,24 +1018,24 @@ window.__ModuleLoader__.load({
 				className: "ocl-ring",
 				width: size,
 				height: size,
-				viewBox: "0 0 34 34",
+				viewBox: "0 0 20 20",
 				fill: "none",
 				"aria-hidden": "true",
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
-					cx: "17",
-					cy: "17",
+					cx: "10",
+					cy: "10",
 					r: radius,
 					stroke: "var(--ocl-border-strong)",
-					strokeWidth: "3"
+					strokeWidth: "2.5"
 				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
-					cx: "17",
-					cy: "17",
+					cx: "10",
+					cy: "10",
 					r: radius,
 					stroke,
-					strokeWidth: "3",
+					strokeWidth: "2.5",
 					strokeLinecap: "round",
 					strokeDasharray: `${circumference * filled} ${circumference}`,
-					transform: "rotate(-90 17 17)"
+					transform: "rotate(-90 10 10)"
 				})]
 			});
 		}
@@ -1076,8 +1080,8 @@ window.__ModuleLoader__.load({
 			const report = state?.usage?.report;
 			const bars = quotaBars(report);
 			const worst = worstUsedPercent(report);
-			const active = state?.accounts.find((account) => account.active);
-			const name = active === void 0 ? t("quotaCardName") : `${t("quotaCardName")} · ${active.label}`;
+			const plan = state?.config.planLabel?.trim() ?? "";
+			const name = plan === "" ? t("quotaCardName") : `${t("quotaCardName")} · ${plan}`;
 			const detail = bars.map((entry) => `${entry.label}: ${entry.remainingPercent.toFixed(0)}% ${t("remaining")}`).join(" · ");
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
 				type: "button",
@@ -1441,6 +1445,7 @@ window.__ModuleLoader__.load({
 				maxOutputTokens: state.config.maxOutputTokens === null ? "" : String(state.config.maxOutputTokens),
 				contextWindow: state.config.contextWindow === null ? "" : String(state.config.contextWindow),
 				showSidebarQuota: state.config.showSidebarQuota,
+				planLabel: state.config.planLabel,
 				activeAccount: state.config.activeAccount,
 				accounts: state.config.accounts.map((account) => ({ ...account })),
 				modelAccountRules: state.config.modelAccountRules.map((rule) => ({ ...rule })),
@@ -1471,6 +1476,7 @@ window.__ModuleLoader__.load({
 				maxOutputTokens: numberOrNull(draft.maxOutputTokens),
 				contextWindow: numberOrNull(draft.contextWindow),
 				showSidebarQuota: draft.showSidebarQuota,
+				planLabel: draft.planLabel.trim(),
 				activeAccount: draft.activeAccount.trim(),
 				accounts: draft.accounts.map((account) => ({
 					label: account.label.trim(),
@@ -1587,63 +1593,67 @@ window.__ModuleLoader__.load({
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "ocl-model",
 				children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-						className: "ocl-row",
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-							type: "checkbox",
-							checked: visible,
-							onChange: (event) => onVisible(event.target.checked)
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "ocl-model-name",
-							title: `${model.name} · ${model.description}`,
-							children: model.id
-						})]
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						type: "checkbox",
+						checked: visible,
+						onChange: (event) => onVisible(event.target.checked)
 					}),
-					model.free ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge",
-						title: t("legendFree"),
-						children: t("free")
-					}) : null,
-					!model.free && model.cost.priced ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-						className: "ocl-badge",
-						title: t("legendPrice"),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+						className: "ocl-model-name",
+						title: `${model.name} · ${model.description}`,
 						children: [
-							"$",
-							model.cost.input,
-							"/$",
-							model.cost.output
+							model.id,
+							model.free ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: t("legendFree"),
+								children: [" ", t("free")]
+							}) : null,
+							!model.free && model.cost.priced ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: t("legendPrice"),
+								children: [
+									" $",
+									model.cost.input,
+									"/$",
+									model.cost.output
+								]
+							}) : null,
+							!model.free && !model.cost.priced ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: t("legendUnknownPrice"),
+								children: [" ", t("priceUnknown")]
+							}) : null,
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: t("legendContext"),
+								children: [
+									" ",
+									Math.round(model.contextWindow / 1024),
+									"K"
+								]
+							}),
+							model.tools ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: t("legendTools"),
+								children: [" ", t("tools")]
+							}) : null,
+							model.input.includes("image") ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								children: [" ", t("vision")]
+							}) : null,
+							model.reasoning.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge",
+								title: model.reasoning.join(", "),
+								children: [" ", t("reasoning")]
+							}) : null,
+							model.available ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "ocl-badge ocl-badge-warn",
+								children: [" ", t("unavailable")]
+							})
 						]
-					}) : null,
-					!model.free && !model.cost.priced ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge",
-						title: t("legendUnknownPrice"),
-						children: t("priceUnknown")
-					}) : null,
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-						className: "ocl-badge",
-						title: t("legendContext"),
-						children: [Math.round(model.contextWindow / 1024), "K"]
-					}),
-					model.tools ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge",
-						title: t("legendTools"),
-						children: t("tools")
-					}) : null,
-					model.input.includes("image") ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge",
-						children: t("vision")
-					}) : null,
-					model.reasoning.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge",
-						title: model.reasoning.join(", "),
-						children: t("reasoning")
-					}) : null,
-					model.available ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						className: "ocl-badge ocl-badge-warn",
-						children: t("unavailable")
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("select", {
-						className: "ocl-select ocl-model-transport",
+						className: "ocl-select",
 						value: transport === "" ? model.transport : transport,
 						"aria-label": t("transport"),
 						onChange: (event) => onTransport(event.target.value),
@@ -2415,6 +2425,12 @@ window.__ModuleLoader__.load({
 									type: "number",
 									value: draft.contextWindow,
 									onChange: (value) => update({ contextWindow: value })
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Field, {
+									label: t("planLabel"),
+									hint: t("planLabelHint"),
+									value: draft.planLabel,
+									onChange: (value) => update({ planLabel: value })
 								})
 							]
 						})]

package/lib/index.d.ts

@@ -66,6 +66,8 @@ interface Config {
   activeAccount?: string;
   /** Show the quota card in the sidebar. */
   showSidebarQuota?: boolean;
+  /** Optional plan label shown on the sidebar card, for example PRO. */
+  planLabel?: string;
   /** Per-model price overrides in USD per 1M tokens. */
   priceOverrides?: Record<string, ModelPriceOverride>;
   /** Product user agent sent to Ollama Cloud. */
@@ -94,6 +96,7 @@ interface ResolvedConfig {
   stickySession: boolean;
   activeAccount: string;
   showSidebarQuota: boolean;
+  planLabel: string;
   priceOverrides: Readonly<Record<string, ModelPriceOverride>>;
   userAgent: string;
 }

package/lib/index.js

@@ -51,7 +51,7 @@ const DEFAULT_API_BASE = "https://ollama.com";
 const DEFAULT_OPENAI_BASE = "https://ollama.com/v1";
 const DEFAULT_USAGE_URL = "https://ollama.com/api/usage";
 const DEFAULT_BALANCE_URL = "https://ollama.com/api/balance";
-const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.2";
+const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.5";
 const DEFAULT_CONTEXT_WINDOW = 131072;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 131072;
@@ -88,6 +88,7 @@ const Config = z.object({
 	stickySession: markVolatile(z.boolean().default(true)),
 	activeAccount: markVolatile(z.string().default("")),
 	showSidebarQuota: markVolatile(z.boolean().default(false)),
+	planLabel: markVolatile(z.string().default("")),
 	priceOverrides: markVolatile(z.dict(z.object({
 		input: z.number().min(0),
 		output: z.number().min(0),
@@ -178,6 +179,7 @@ function resolveConfig(config) {
 		stickySession: config.stickySession !== false,
 		activeAccount: typeof config.activeAccount === "string" ? config.activeAccount : "",
 		showSidebarQuota: config.showSidebarQuota === true,
+		planLabel: typeof config.planLabel === "string" ? config.planLabel.trim() : "",
 		priceOverrides: priceRecord(config.priceOverrides),
 		userAgent: typeof config.userAgent === "string" && config.userAgent !== "" ? config.userAgent : DEFAULT_USER_AGENT
 	};
@@ -3573,6 +3575,7 @@ function publicConfig(config) {
 		stickySession: config.stickySession,
 		activeAccount: config.activeAccount,
 		showSidebarQuota: config.showSidebarQuota,
+		planLabel: config.planLabel,
 		priceOverrides: config.priceOverrides,
 		userAgent: config.userAgent
 	};
@@ -3656,6 +3659,29 @@ function json(res, status, value) {
 	res.setHeader("cache-control", "no-store");
 	res.end(JSON.stringify(value));
 }
+function sourceHost(value) {
+	if (value === void 0 || value === "") return void 0;
+	try {
+		return new URL(value).host;
+	} catch {
+		return;
+	}
+}
+/**
+* Write routes must prove a same-origin browser context. A LAN bridge that
+* rewrites Host and socket to loopback would otherwise let any non-browser
+* client write keys and settings without an Origin. Fail closed when neither
+* Origin nor Referer is present.
+*/
+function writeSourceError(req) {
+	const host = req.headers.host;
+	if (host === void 0 || host === "") return "request host required";
+	const origin = req.headers.origin;
+	if (origin !== void 0 && origin !== "") return sourceHost(origin) === host ? void 0 : "cross-origin request refused";
+	const referer = req.headers.referer;
+	if (referer === void 0 || referer === "") return "request origin required";
+	return sourceHost(referer) === host ? void 0 : "cross-origin request refused";
+}
 function allowedOrigin(req) {
 	const origin = req.headers.origin;
 	if (origin === void 0 || origin === "") return true;
@@ -3706,8 +3732,9 @@ function requirePost(req, res) {
 		json(res, 403, { error: "non-loopback Host refused" });
 		return false;
 	}
-	if (!allowedOrigin(req)) {
-		json(res, 403, { error: "cross-origin request refused" });
+	const sourceError = writeSourceError(req);
+	if (sourceError !== void 0) {
+		json(res, 403, { error: sourceError });
 		return false;
 	}
 	const remote = req.socket.remoteAddress ?? "";
@@ -3777,6 +3804,7 @@ function configOps(patch) {
 	if ("stickySession" in patch) set("stickySession", patch.stickySession === true);
 	if ("activeAccount" in patch) set("activeAccount", patch.activeAccount);
 	if ("showSidebarQuota" in patch) set("showSidebarQuota", patch.showSidebarQuota === true);
+	if ("planLabel" in patch) set("planLabel", patch.planLabel);
 	if ("priceOverrides" in patch) set("priceOverrides", cleanPrices(patch.priceOverrides));
 	if ("userAgent" in patch) set("userAgent", patch.userAgent);
 	return ops;
@@ -4258,6 +4286,18 @@ function buildOllamaTuiSection(deps) {
 					value: text.trim() === "true"
 				})
 			},
+			{
+				path: ["planLabel"],
+				group: "sidebar",
+				kind: "text",
+				label: "Plan label",
+				hint: "Optional label shown on the sidebar card, for example PRO.",
+				format: (value) => String(value === void 0 ? deps.planLabel() : value),
+				parse: (text) => text.trim() === "" ? { kind: "clear" } : {
+					kind: "set",
+					value: text.trim()
+				}
+			},
 			{
 				path: ["activeAccount"],
 				group: "advanced",
@@ -4328,7 +4368,8 @@ function applyOllamaTuiSettings(ctx, deps) {
 		visibleModels: deps.visibleModels(),
 		activeAccount: deps.activeAccount(),
 		stickySession: deps.stickySession(),
-		showSidebarQuota: deps.showSidebarQuota()
+		showSidebarQuota: deps.showSidebarQuota(),
+		planLabel: deps.planLabel()
 	});
 	let lastSignature = signature();
 	const refresh = () => {
@@ -4626,7 +4667,8 @@ function apply(ctx, config) {
 			visibleModels: () => current().visibleModels,
 			activeAccount: () => current().activeAccount,
 			stickySession: () => current().stickySession,
-			showSidebarQuota: () => current().showSidebarQuota
+			showSidebarQuota: () => current().showSidebarQuota,
+			planLabel: () => current().planLabel
 		});
 	});
 	ctx.inject(["webServer"], (webCtx) => {

package/package.json

@@ -1,121 +1,121 @@
-{
-  "name": "@goodandready/dsh-ollama-cloud-provider",
-  "version": "0.1.3",
-  "description": "Ollama Cloud LLM provider plugin for DeepSeek Harness (dsh).",
-  "license": "MIT",
-  "type": "module",
-  "main": "./lib/index.js",
-  "types": "./lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./client": {
-      "default": "./lib/client.js"
-    },
-    "./package.json": "./package.json",
-    "./cordis.patch.yml": "./cordis.patch.yml"
-  },
-  "files": [
-    "lib",
-    "!lib/**/*.map",
-    "cordis.patch.yml",
-    "README.md",
-    "README.zh.md",
-    "README.ru.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    "NOTICE",
-    "media/visual-verification.png"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider.git"
-  },
-  "bugs": {
-    "url": "https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider/issues"
-  },
-  "homepage": "https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider#readme",
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-ui-renderer",
-        "@deepseek-ai/dsh-client-ui-settings"
-      ]
-    },
-    "compatibility": {
-      "dshReleases": {
-        "0.2.0-rc.2": "compatible",
-        "0.2.1-rc.2": "compatible"
-      },
-      "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
-    }
-  },
-  "engines": {
-    "node": ">=22",
-    "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
-  },
-  "scripts": {
-    "build": "tsdown",
-    "prepare": "tsdown",
-    "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test tests/core.test.ts tests/usage.test.ts tests/adapter.test.ts tests/routes.test.ts tests/commands.test.ts tests/tui-settings.test.ts tests/analytics.test.ts tests/apply.test.ts tests/account-rules.test.ts tests/request-log.test.ts tests/image-budget.test.ts tests/tool-schema.test.ts tests/tools.test.ts tests/plugin-updater.test.ts",
-    "check": "npm run typecheck && npm test && npm run build",
-    "release": "npm run check && npm pack",
-    "sync:models": "node scripts/sync-models.mjs"
-  },
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "ollama",
-    "ollama-cloud",
-    "llm-provider"
-  ],
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4 || ~4.0.5",
-    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-commands": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.0-rc.2 || 0.2.1-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4 || ~3.18.5",
-    "react": "^18.2.0"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-locale": "^0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-rc.2",
-    "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "^0.2.1-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.5",
-    "@types/node": "^22.0.0",
-    "@types/react": "^18.3.1",
-    "react": "^18.3.1",
-    "tsdown": "^0.22.2",
-    "tsx": "^4.23.12",
-    "typescript": "^5.7.2"
-  }
-}
+{
+  "name": "@goodandready/dsh-ollama-cloud-provider",
+  "version": "0.1.5",
+  "description": "Ollama Cloud LLM provider plugin for DeepSeek Harness (dsh).",
+  "license": "MIT",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "lib",
+    "!lib/**/*.map",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "README.ru.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "NOTICE",
+    "media/visual-verification.png"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider.git"
+  },
+  "bugs": {
+    "url": "https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider/issues"
+  },
+  "homepage": "https://github.com/GooDAnDReaDY/dsh-ollama-cloud-provider#readme",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    },
+    "compatibility": {
+      "dshReleases": {
+        "0.2.0-rc.2": "compatible",
+        "0.2.1-rc.2": "compatible"
+      },
+      "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
+    }
+  },
+  "engines": {
+    "node": ">=22",
+    "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "prepare": "tsdown 1>&2",
+    "typecheck": "tsc --noEmit",
+    "test": "node --import tsx --test tests/core.test.ts tests/usage.test.ts tests/adapter.test.ts tests/routes.test.ts tests/native.test.ts tests/commands.test.ts tests/tui-settings.test.ts tests/analytics.test.ts tests/apply.test.ts tests/account-rules.test.ts tests/request-log.test.ts tests/image-budget.test.ts tests/tool-schema.test.ts tests/tools.test.ts tests/plugin-updater.test.ts",
+    "check": "npm run typecheck && npm test && npm run build",
+    "release": "npm run check && npm pack",
+    "sync:models": "node scripts/sync-models.mjs"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "ollama",
+    "ollama-cloud",
+    "llm-provider"
+  ],
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.4 || ~4.0.5",
+    "@deepseek-ai/dsh-attachment": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.0-rc.2 || 0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.4 || ~3.18.5",
+    "react": "^18.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.2.1-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "~3.18.5",
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.1",
+    "react": "^18.3.1",
+    "tsdown": "^0.22.2",
+    "tsx": "^4.23.12",
+    "typescript": "^5.7.2"
+  }
+}