@goodandready/dsh-ollama-cloud-provider 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.1.6 — 2026-10-22
+
+- Accept the DSH Desktop renderer origin `dsh-app://app` on write routes after
+  the loopback Host and socket checks. Without this explicit exception the
+  same-origin guard in 0.1.5 rejected every Desktop settings write (#28).
+
+## 0.1.5 — 2026-10-22
+
+- Write routes now require an `Origin` or `Referer` whose host matches `Host`;
+  a request with neither is rejected with 403. This closes the LAN-bridge path
+  that rewrites both Host and socket to loopback (#28).
+- Added route-guard tests for 405, non-loopback Host/socket, cross-origin and
+  missing sources, plus native stream parser tests for text, thinking, tool
+  calls, in-band quota errors, aborts, idle timeouts, abrupt closes and empty
+  streams (#26).
+- `prepare` now sends tsdown output to stderr, so `npm pack --json` stays
+  parseable and preflight can inspect the package (#25).
+- DESIGN.md now records the 64-token Test connection budget and its reason (#27).
+
 ## 0.1.4 — 2026-10-21
 
 - Model list rows now use the reference three-column grid: badges live inside

package/README.md

@@ -103,17 +103,17 @@ npm pack
 Install the published package:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
 ```
 
 Or install the packed tarball into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 ```
 
 Restart dsh (or DSH Desktop), then pick **Ollama Cloud** in the model picker.
@@ -194,7 +194,7 @@ Open **Settings → Ollama Cloud**:
 - **Sidebar** — show or hide the quota card, and an optional plan label (for example `PRO`) shown next to the provider name.
 - **Plugin update** — current/latest version and **Update now**.
 
-The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, are refused for cross-origin requests, and are restricted to loopback (`127.0.0.1` / `::1`).
+The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host` (the Desktop renderer's `dsh-app://app` origin is accepted after loopback checks), and are restricted to loopback (`127.0.0.1` / `::1`); a write without either source header is rejected with 403.
 
 ## Command
 

package/README.ru.md

@@ -103,17 +103,17 @@ npm pack
 Установка опубликованного пакета из npm:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
 ```
 
 Либо установка из упакованного tarball:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **Ollama Cloud** в списке моделей.

package/README.zh.md

@@ -102,17 +102,17 @@ npm pack
 从 npm 安装已发布版本：
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
 # DSH 桌面端：
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.4
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
 ```
 
 或通过打包文件安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.4.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型列表中选择 **Ollama Cloud** 即可。

package/lib/index.js

@@ -51,7 +51,7 @@ const DEFAULT_API_BASE = "https://ollama.com";
 const DEFAULT_OPENAI_BASE = "https://ollama.com/v1";
 const DEFAULT_USAGE_URL = "https://ollama.com/api/usage";
 const DEFAULT_BALANCE_URL = "https://ollama.com/api/balance";
-const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.4";
+const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.6";
 const DEFAULT_CONTEXT_WINDOW = 131072;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 131072;
@@ -3659,6 +3659,38 @@ function json(res, status, value) {
 	res.setHeader("cache-control", "no-store");
 	res.end(JSON.stringify(value));
 }
+function sourceHost(value) {
+	if (value === void 0 || value === "") return void 0;
+	try {
+		return new URL(value).host;
+	} catch {
+		return;
+	}
+}
+/**
+* The Desktop renderer runs on `dsh-app://app`; its relative fetch reaches the
+* loopback host with that Origin. The request must still pass the loopback
+* Host check below and the loopback socket check in `requirePost`.
+*/
+const DESKTOP_ORIGIN = "dsh-app://app";
+/**
+* Write routes must prove a same-origin browser context. A LAN bridge that
+* rewrites Host and socket to loopback would otherwise let any non-browser
+* client write keys and settings without an Origin. Fail closed when neither
+* Origin nor Referer is present.
+*/
+function writeSourceError(req) {
+	const host = req.headers.host;
+	if (host === void 0 || host === "") return "request host required";
+	const origin = req.headers.origin;
+	if (origin !== void 0 && origin !== "") {
+		if (origin === DESKTOP_ORIGIN) return void 0;
+		return sourceHost(origin) === host ? void 0 : "cross-origin request refused";
+	}
+	const referer = req.headers.referer;
+	if (referer === void 0 || referer === "") return "request origin required";
+	return sourceHost(referer) === host ? void 0 : "cross-origin request refused";
+}
 function allowedOrigin(req) {
 	const origin = req.headers.origin;
 	if (origin === void 0 || origin === "") return true;
@@ -3709,8 +3741,9 @@ function requirePost(req, res) {
 		json(res, 403, { error: "non-loopback Host refused" });
 		return false;
 	}
-	if (!allowedOrigin(req)) {
-		json(res, 403, { error: "cross-origin request refused" });
+	const sourceError = writeSourceError(req);
+	if (sourceError !== void 0) {
+		json(res, 403, { error: sourceError });
 		return false;
 	}
 	const remote = req.socket.remoteAddress ?? "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-ollama-cloud-provider",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Ollama Cloud LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",
@@ -66,9 +66,9 @@
   },
   "scripts": {
     "build": "tsdown",
-    "prepare": "tsdown",
+    "prepare": "tsdown 1>&2",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test tests/core.test.ts tests/usage.test.ts tests/adapter.test.ts tests/routes.test.ts tests/commands.test.ts tests/tui-settings.test.ts tests/analytics.test.ts tests/apply.test.ts tests/account-rules.test.ts tests/request-log.test.ts tests/image-budget.test.ts tests/tool-schema.test.ts tests/tools.test.ts tests/plugin-updater.test.ts",
+    "test": "node --import tsx --test tests/core.test.ts tests/usage.test.ts tests/adapter.test.ts tests/routes.test.ts tests/native.test.ts tests/commands.test.ts tests/tui-settings.test.ts tests/analytics.test.ts tests/apply.test.ts tests/account-rules.test.ts tests/request-log.test.ts tests/image-budget.test.ts tests/tool-schema.test.ts tests/tools.test.ts tests/plugin-updater.test.ts",
     "check": "npm run typecheck && npm test && npm run build",
     "release": "npm run check && npm pack",
     "sync:models": "node scripts/sync-models.mjs"