@goodandready/dsh-opencode-provider 0.5.11 → 0.5.13

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.5.13
+
+- Removed the unused `LEGACY_CONSOLE_PROVIDER` constant and the dead `settings.models.provider-card` slot declaration left by the custom provider-card removal.
+- Removed a stray zero-byte `$null` file from the repository root.
+- No runtime behavior change; 100 tests, typecheck and build pass.
+
+## 0.5.12
+
+- **Security**: read routes now require a literal loopback Host; `/state` is GET-only, `/health` and `/analytics` reject DNS-rebinding hosts, and updater status GET uses a loopback read guard. Added regression tests.
+- **Routing correctness**: sticky selection and the success trace are recorded only after the stream completes; a mid-stream failure now records a failed trace, not a false success.
+- **Onboarding**: auth-entry credential refs use injective hex encoding, so entries differing only by punctuation cannot overwrite each other. Added a collision test.
+- **Client tests**: added React server-render smoke tests for analytics, heatmap, settings and quota panel; 100 tests.
+- Read routes now work only from the local machine; a LAN-exposed web profile can no longer read plugin state (write routes were already loopback-only).
+
 ## 0.5.11
 
 - **Usage fetch retry**: the quota reader retries one transient Node/undici network failure before caching `fetch failed`, so a brief connect timeout no longer leaves the quota panel without usage data.

package/README.md

@@ -130,12 +130,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.11
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.13
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.

package/README.ru.md

@@ -129,12 +129,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.11
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.13
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.

package/README.zh.md

@@ -124,12 +124,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.11.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.13.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.11
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.13
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。

package/lib/client.js

@@ -1806,6 +1806,18 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/auth-ref.ts
+		/**
+		* Collision-free credential ref for an OpenCode auth entry. Hex encoding is
+		* injective (unlike replacing punctuation with underscores) and uses only
+		* characters accepted by credential references.
+		*/
+		function authRefForEntry(entry) {
+			let hex = "";
+			for (const byte of new TextEncoder().encode(entry)) hex += byte.toString(16).padStart(2, "0");
+			return `OPENCODE_AUTH_${hex}`;
+		}
+		//#endregion
 		//#region src/client/settings-page.tsx
 		function OpenCodeSettingsPage(props) {
 			const { t } = props;
@@ -1875,8 +1887,7 @@ window.__ModuleLoader__.load({
 			};
 			const importAllAuth = async () => {
 				if (state === null || draft === null) return;
-				const refFor = (entry) => `OPENCODE_AUTH_${entry.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}`;
-				const missing = state.auth.entries.filter((entry) => !draft.accounts.some((account) => account.label === entry || account.apiKeyEnv === refFor(entry)));
+				const missing = state.auth.entries.filter((entry) => !draft.accounts.some((account) => account.label === entry || account.apiKeyEnv === authRefForEntry(entry)));
 				if (missing.length === 0) {
 					setNotice(t("importedAll"));
 					return;
@@ -1884,10 +1895,10 @@ window.__ModuleLoader__.load({
 				setImporting(true);
 				setError(null);
 				try {
-					for (const entry of missing) await importAuth(entry, refFor(entry));
+					for (const entry of missing) await importAuth(entry, authRefForEntry(entry));
 					update({ accounts: [...draft.accounts, ...missing.map((entry) => ({
 						label: entry,
-						apiKeyEnv: refFor(entry)
+						apiKeyEnv: authRefForEntry(entry)
 					}))] });
 					setNotice(t("importedAll"));
 				} catch (caught) {

package/lib/index.js

@@ -17,7 +17,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.11";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.13";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 32768;
@@ -3261,6 +3261,12 @@ var OpenCodeAdapter = class extends LlmAdapter {
 					}
 					throw error;
 				}
+				for await (const chunk of this.parse(response, model.transport, config, options.signal)) {
+					if (firstChunkAt === void 0) firstChunkAt = Date.now();
+					started = true;
+					yield chunk;
+				}
+				logAttempt(true);
 				this.rememberSticky(sessionId, options, entry);
 				this.pushTrace({
 					at: Date.now(),
@@ -3271,17 +3277,23 @@ var OpenCodeAdapter = class extends LlmAdapter {
 					fallback,
 					ok: true
 				});
-				for await (const chunk of this.parse(response, model.transport, config, options.signal)) {
-					if (firstChunkAt === void 0) firstChunkAt = Date.now();
-					started = true;
-					yield chunk;
-				}
-				logAttempt(true);
 				return;
 			} catch (error) {
 				const classified = error instanceof LlmError ? error : new LlmError(error instanceof Error ? error.message : "OpenCode request failed", "TRANSPORT", { cause: error });
 				logAttempt(false, classified.code);
-				if (started || options.signal?.aborted === true) throw error;
+				if (started || options.signal?.aborted === true) {
+					this.pushTrace({
+						at: Date.now(),
+						provider: options.provider,
+						model: options.model,
+						account: entry.label ?? "default",
+						reason: attemptReason,
+						fallback,
+						ok: false,
+						error: classified.code
+					});
+					throw error;
+				}
 				lastError = classified;
 				const transient = this.isTransient(classified);
 				if (transient && !responseFailure && !fallback) this.markCooldown(entry.key, 0);
@@ -3870,6 +3882,27 @@ function isTrustedUpdateRequest(request) {
 		return false;
 	}
 }
+/** Local, loopback-only reads for the update card; blocks DNS-rebinding hosts. */
+function isTrustedReadRequest(request) {
+	if (!isLoopback(request.socket?.remoteAddress)) return false;
+	const host = header(request, "host");
+	if (host === void 0) return false;
+	try {
+		if (!isLoopback(new URL(`http://${host}`).hostname)) return false;
+	} catch {
+		return false;
+	}
+	const site = header(request, "sec-fetch-site");
+	if (site !== void 0 && site !== "same-origin") return false;
+	const origin = header(request, "origin");
+	if (origin === void 0) return true;
+	try {
+		const url = new URL(origin);
+		return (url.protocol === "http:" || url.protocol === "https:") && isLoopback(url.hostname) && url.host === host;
+	} catch {
+		return false;
+	}
+}
 function validProfileName(value) {
 	return typeof value === "string" && value !== "" && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !/[\0-\x1f\x7f]/.test(value);
 }
@@ -4075,6 +4108,10 @@ function registerPluginUpdater(ctx, options) {
 			try {
 				const target = runtime();
 				if (request.method === "GET" || request.method === "HEAD") {
+					if (!isTrustedReadRequest(request)) {
+						json$1(response, 403, { error: "Rejected non-local update status request." });
+						return;
+					}
 					const payload = await status(options, target);
 					response.writeHead(200, {
 						"content-type": "application/json; charset=utf-8",
@@ -4732,10 +4769,14 @@ function applyRoutes(ctx, web, deps) {
 		}));
 	};
 	route("/dsh-opencode/state", async (req, res) => {
-		if (req.method !== "GET" && req.method !== "POST") {
+		if (req.method !== "GET") {
 			json(res, 405, { error: "GET required" });
 			return;
 		}
+		if (!loopbackHost(req)) {
+			json(res, 403, { error: "non-loopback Host refused" });
+			return;
+		}
 		if (!allowedOrigin(req)) {
 			json(res, 403, { error: "cross-origin request refused" });
 			return;
@@ -4751,6 +4792,10 @@ function applyRoutes(ctx, web, deps) {
 			json(res, 405, { error: "GET required" });
 			return;
 		}
+		if (!loopbackHost(req)) {
+			json(res, 403, { error: "non-loopback Host refused" });
+			return;
+		}
 		if (!allowedOrigin(req)) {
 			json(res, 403, { error: "cross-origin request refused" });
 			return;
@@ -4773,6 +4818,10 @@ function applyRoutes(ctx, web, deps) {
 			json(res, 405, { error: "GET required" });
 			return;
 		}
+		if (!loopbackHost(req)) {
+			json(res, 403, { error: "non-loopback Host refused" });
+			return;
+		}
 		if (!allowedOrigin(req)) {
 			json(res, 403, { error: "cross-origin request refused" });
 			return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",
@@ -68,7 +68,7 @@
     "build": "tsdown",
     "prepare": "tsdown",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test tests/core.test.ts tests/routes.test.ts tests/limits.test.ts tests/analytics.test.ts tests/adapter.test.ts tests/usage.test.ts tests/request-log.test.ts tests/account-rules.test.ts tests/commands.test.ts tests/tool-schema.test.ts tests/tui-settings.test.ts tests/plan-filter.test.ts tests/image-budget.test.ts tests/tools.test.ts tests/plugin-updater.test.ts",
+    "test": "node --import tsx --test tests/core.test.ts tests/routes.test.ts tests/limits.test.ts tests/analytics.test.ts tests/adapter.test.ts tests/usage.test.ts tests/request-log.test.ts tests/account-rules.test.ts tests/commands.test.ts tests/tool-schema.test.ts tests/tui-settings.test.ts tests/plan-filter.test.ts tests/image-budget.test.ts tests/tools.test.ts tests/plugin-updater.test.ts tests/client-render.test.tsx",
     "check": "npm run typecheck && npm test && npm run build",
     "release": "npm run check && npm pack",
     "sync:models": "node scripts/sync-models.mjs"
@@ -114,7 +114,9 @@
     "@deepseek-ai/schemastery": "~3.18.5",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.1",
+    "@types/react-dom": "^18.3.0",
     "react": "^18.3.1",
+    "react-dom": "^18.3.1",
     "tsdown": "^0.22.2",
     "tsx": "^4.23.12",
     "typescript": "^5.7.2"