@goodandready/dsh-opencode-provider 0.5.14 → 0.5.15

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.15
+
+- **Write security**: all write endpoints now require a same-origin `Origin` or `Referer` whose host matches `Host`; a request with neither is rejected with 403 instead of being treated as local. Regression tests cover missing headers, Referer fallback and the DSH LAN bridge path.
+- **Release tooling**: `prepare` sends tsdown output to stderr, so `npm pack --json` emits parseable JSON for preflight.
+- 102 tests.
+
 ## 0.5.14
 
 - **DSH WEB compatibility**: same-origin requests from a literal local interface address (for example `192.168.1.111`) are accepted alongside loopback. DNS-rebinding hostnames are still rejected. This restores Settings, sidebar quota, analytics and update status on DSH Web accessed at its trusted LAN URL.

package/README.md

@@ -130,12 +130,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.14
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.15
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.

package/README.ru.md

@@ -129,12 +129,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.14
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.15
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.

package/README.zh.md

@@ -124,12 +124,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.14.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.15.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.14
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.15
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。

package/lib/index.js

@@ -18,7 +18,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.14";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.15";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 32768;
@@ -4585,6 +4585,12 @@ function trustedHost(req) {
 	const hostname = authorityHostname(req.headers.host);
 	return hostname !== void 0 && isLocalHostname(hostname);
 }
+function writeOrigin(req) {
+	const host = req.headers.host;
+	const source = req.headers.origin ?? req.headers.referer;
+	if (host === void 0 || source === void 0 || source === "") return false;
+	return sameOrigin(host, source);
+}
 async function readJson(req) {
 	const chunks = [];
 	let size = 0;
@@ -4608,8 +4614,8 @@ function requirePost(req, res) {
 		json(res, 403, { error: "non-local Host refused" });
 		return false;
 	}
-	if (!allowedOrigin(req)) {
-		json(res, 403, { error: "cross-origin request refused" });
+	if (!writeOrigin(req)) {
+		json(res, 403, { error: "same-origin Origin or Referer required" });
 		return false;
 	}
 	const site = req.headers["sec-fetch-site"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.14",
+  "version": "0.5.15",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",
@@ -66,7 +66,7 @@
   },
   "scripts": {
     "build": "tsdown",
-    "prepare": "tsdown",
+    "prepare": "tsdown 1>&2",
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test tests/core.test.ts tests/routes.test.ts tests/limits.test.ts tests/analytics.test.ts tests/adapter.test.ts tests/usage.test.ts tests/request-log.test.ts tests/account-rules.test.ts tests/commands.test.ts tests/tool-schema.test.ts tests/tui-settings.test.ts tests/plan-filter.test.ts tests/image-budget.test.ts tests/tools.test.ts tests/plugin-updater.test.ts tests/client-render.test.tsx",
     "check": "npm run typecheck && npm test && npm run build",