@goodandready/dsh-opencode-provider 0.5.33 → 0.5.34

package/AUDIT.md

@@ -0,0 +1,51 @@
+# Project and security audit
+
+Read-only review of `main` on 2026-11-05. Findings are recorded separately from
+implementation; no production runtime or other plugin was modified during the
+review.
+
+## Scope
+
+- Architecture: Host routes, adapter/transports, credentials, proxy, catalog,
+  analytics, settings/client bundle.
+- Correctness: routing, account failover, streaming, tool-call normalization,
+  pricing/analytics, image policy.
+- Security: HTTP boundary, secret handling, updater, dependency graph.
+- Tests and prior issues: 149 tests, tracked parity/security backlog.
+
+## Verified findings
+
+| # | Severity | Finding | Status |
+|---|---|---|---|
+| A1 | High (dev-only) | `zod` 4.4.3 is pinned by every `@deepseek-ai/dsh-*` 0.2.2-rc.1 package; GHSA-mrhx-c7xc-m3w5 affects `<4.6.6`. | Residual. `npm audit --omit=dev` reports **0 vulnerabilities**; the plugin does not bundle zod. No DSH 0.2.2 release with 4.6.6 exists and no forced override is applied. Re-audit after upstream. |
+| A2 | Medium (deployment) | Same-origin checks are CSRF protection, not authentication. DSH exposes no host auth for plugin routes. | Mitigated by optional `adminToken`/`OPENCODE_ADMIN_TOKEN` with constant-time comparison on every `/dsh-opencode/*` route and a browser prompt. If no token is configured, the existing loopback/same-origin guard remains; this is documented, not represented as authentication. |
+| A3 | Low (operational) | Production profile `pnpm-lock.yaml` files were not regenerated during manual `node_modules` deployments. | Residual operational note. Packages installed by verified tarballs; regenerate lockfiles separately before any `--frozen-lockfile` install. |
+| A4 | Low (scope) | Engine compatibility cannot run from a worktree or force-kill a runtime under project rules. | `npm run test:engine -- <candidate.tgz>` validates immutable candidates read-only; compatibility execution stays on the approved MiniPC contour. |
+
+No critical findings were verified. No raw API keys, prompt text, image bytes
+or proxy passwords are written to analytics, heatmap, request logs or sticky /
+cooldown state. Credential values are masked in the UI and diagnostics.
+
+## Evidence
+
+```bash
+npm run check                 # 149 tests + typecheck + build
+npm audit --omit=dev --json   # 0 production vulnerabilities
+npm ls zod --all              # zod 4.4.3 through DSH dev packages
+npm run test:engine -- <candidate.tgz>
+```
+
+- Production package contents are limited by `files`; no tests, sources,
+  credentials or worktrees are published.
+- HTTP writes require a JSON body, same-origin `Origin`/`Referer`, a trusted
+  Host, and the admin token when configured.
+- The updater is loopback-only and also sits behind the admin-token guard.
+- MOA and other plugins were not touched.
+
+## Conclusion
+
+The production dependency surface is clean; the only high advisory is a
+dev/peer `zod` pin inherited from DSH and blocked on an upstream release. The
+remaining deployment caveats (optional admin token, profile lockfiles) are
+documented and tracked. No open critical or correctness issue was found in the
+reviewed scope.

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.5.34 — release 11: engine matrix and audit closure
+
+- **#55 — engine matrix**: `npm run test:engine -- <candidate.tgz>` validates one immutable candidate against `engines.dsh` and `dsh.compatibility.dshReleases`, and rejects test/source content. It never installs DSH, starts a runtime, extracts the tarball, uses a worktree path, or performs forced cleanup; compatibility execution remains on the approved MiniPC contour.
+- **#39 — project/security audit**: added `AUDIT.md` with verified findings. Production dependencies audit clean; the dev/peer `zod` advisory and optional-auth/lockfile caveats are recorded as residuals.
+- **#82 — Duskriver parity**: all 18 child issues are closed; the parity parent is closed with the evidence index.
+- 149 tests.
+
 ## 0.5.33 — release 10: admin token and dependency audit
 
 - **#41 — authenticated HTTP routes**: optional owner `adminToken` (profile config or `OPENCODE_ADMIN_TOKEN`). When set, every `/dsh-opencode/*` route requires `x-opencode-token` or a Bearer token with constant-time comparison; forged Host/Origin alone no longer passes. The settings UI prompts for the token and keeps it in this browser.

package/README.md

@@ -133,12 +133,12 @@ npm pack
 Install the **packed tarball** into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 
 # Or install the published package:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.34
 ```
 
 Restart dsh (or DSH Desktop), then pick **OpenCode (plugin)** or **OpenCode Go (plugin)** in the model picker.
@@ -304,6 +304,10 @@ npm run sync:models   # regenerate src/models.generated.ts from models.dev
 
 GitHub Actions runs `npm run check` and `npm pack` on push/PR (`.github/workflows/ci.yml`).
 
+### Engine matrix
+
+`npm run test:engine -- <candidate.tgz>` validates one immutable, already-built package candidate against `engines.dsh` and `dsh.compatibility.dshReleases`, and checks that only production files are packaged. The command is read-only: it does not install DSH, start a runtime, extract the tarball, touch another plugin, or perform cleanup. Compatibility execution runs on the approved MiniPC test contour against the published candidate — never against a worktree path and never with forced processes or recursive deletion.
+
 ## Limitations
 
 - File attachments are forwarded as DSH handle text, not inline bytes; the harness normally supplies the read-only execution path. Tool-result images are inline on Anthropic, OpenAI Responses and Google; OpenAI Chat uses a placeholder.
@@ -318,6 +322,10 @@ GitHub Actions runs `npm run check` and `npm pack` on push/PR (`.github/workflow
 - Same-origin checks are CSRF protection, not authentication. Set an owner admin token in the profile config (`adminToken`) or `OPENCODE_ADMIN_TOKEN`; every `/dsh-opencode/*` route then requires `x-opencode-token` or `Authorization: Bearer`. The settings UI asks for the token once and keeps it in this browser. Without a token, routes retain the loopback/same-origin guard only.
 - `npm audit` still reports `zod < 4.6.6` (GHSA-mrhx-c7xc-m3w5) because every `@deepseek-ai/dsh-*` 0.2.2-rc.1 package pins `zod` 4.4.3. No DSH 0.2.2 release with 4.6.6 exists yet; this plugin does not bundle zod and no forced override is used. Re-audit after the upstream DSH update.
 
+## Audit
+
+The read-only project and security review, including residual dependency and deployment findings, is in [AUDIT.md](./AUDIT.md).
+
 ## License
 
 MIT © [GooDAnDReaDY](https://github.com/GooDAnDReaDY). See [LICENSE](./LICENSE) and [NOTICE](./NOTICE).

package/README.ru.md

@@ -132,12 +132,12 @@ npm pack
 Установка из **упакованного tarball**:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 
 # Либо установка опубликованного пакета из npm:
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.34
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **OpenCode (plugin)** или **OpenCode Go (plugin)** в списке моделей.
@@ -211,6 +211,10 @@ modelAccountRules:
 
 Язык вывода задаётся в **Настройки → OpenCode → `/opencode` command language** (`中文` включает китайский). По умолчанию английский.
 
+### Матрица движков
+
+`npm run test:engine -- <candidate.tgz>` проверяет неизменяемый уже собранный пакет по `engines.dsh` и `dsh.compatibility.dshReleases`, а также состав production-файлов. Команда только читает: не ставит DSH, не запускает runtime, не распаковывает архив, не трогает другие плагины и не требует cleanup. Прогон совместимости выполняется на согласованном тестовом контуре MiniPC с опубликованным кандидатом — не из worktree и без принудительных процессов или рекурсивного удаления.
+
 ## Безопасность и надежность
 
 - Same-origin — это защита от CSRF, а не аутентификация. Задайте admin-токен владельца в конфиге профиля (`adminToken`) или `OPENCODE_ADMIN_TOKEN`; тогда все маршруты `/dsh-opencode/*` требуют `x-opencode-token` или `Authorization: Bearer`. UI спросит токен один раз и сохранит его в браузере. Без токена остаются только loopback и same-origin проверки.

package/README.zh.md

@@ -127,12 +127,12 @@ npm pack
 通过**打包文件 (.tgz)**安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.33.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-opencode-provider-0.5.34.tgz
 
 # 或从 npm 安装已发布版本：
-dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.33
+dsh plugin --profile web add @goodandready/dsh-opencode-provider@0.5.34
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型选择器中选择 **OpenCode (plugin)** 或 **OpenCode Go (plugin)** 即可。
@@ -186,6 +186,10 @@ modelAccountRules:
 
 在 **设置 → OpenCode → `/opencode` 命令语言** 中选择 `中文` 即可切换输出语言，默认英语。
 
+### 引擎矩阵
+
+`npm run test:engine -- <candidate.tgz>` 使用 `engines.dsh` 与 `dsh.compatibility.dshReleases` 校验不可变的已构建包，并检查只打包生产文件。该命令只读：不安装 DSH、不启动运行时、不解压归档、不修改其他插件，也不需要清理。兼容性执行在批准的 MiniPC 测试环境上使用已发布候选包完成，绝不使用 worktree 路径，也不强制结束进程或递归删除。
+
 ## 安全规范
 
 - 同源检查用于防御 CSRF，并非身份认证。在配置文件（`adminToken`）或 `OPENCODE_ADMIN_TOKEN` 中设置管理员令牌后，所有 `/dsh-opencode/*` 路由都要求 `x-opencode-token` 或 `Authorization: Bearer`；设置界面会要求输入一次并保存在当前浏览器。未设置令牌时仍只有 Loopback 与同源检查。

package/lib/index.js

@@ -99,7 +99,7 @@ const DEFAULT_GO_API_BASE = "https://opencode.ai/inference/go";
 const DEFAULT_GO_ZEN_BASE = "https://opencode.ai/zen/go/v1";
 const DEFAULT_USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const DEFAULT_AUTH_ENTRY = "opencode-go";
-const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.33";
+const DEFAULT_USER_AGENT = "dsh-opencode-provider/0.5.34";
 const DEFAULT_CONTEXT_WINDOW = 262144;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 65536;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-opencode-provider",
-  "version": "0.5.33",
+  "version": "0.5.34",
   "description": "OpenCode / OpenCode Go LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",
@@ -27,6 +27,7 @@
     "CHANGELOG.md",
     "LICENSE",
     "NOTICE",
+    "AUDIT.md",
     "media/visual-verification.png"
   ],
   "publishConfig": {
@@ -70,10 +71,11 @@
     "build": "tsdown",
     "prepare": "tsdown 1>&2",
     "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test tests/core.test.ts tests/routes.test.ts tests/limits.test.ts tests/analytics.test.ts tests/adapter.test.ts tests/usage.test.ts tests/request-log.test.ts tests/account-rules.test.ts tests/commands.test.ts tests/tool-schema.test.ts tests/tui-settings.test.ts tests/plan-filter.test.ts tests/image-budget.test.ts tests/tools.test.ts tests/plugin-updater.test.ts tests/client-render.test.tsx tests/sse.test.ts tests/proxy.test.ts tests/tool-call-validation.test.ts tests/pricing.test.ts",
+    "test": "node --import tsx --test tests/core.test.ts tests/routes.test.ts tests/limits.test.ts tests/analytics.test.ts tests/adapter.test.ts tests/usage.test.ts tests/request-log.test.ts tests/account-rules.test.ts tests/commands.test.ts tests/tool-schema.test.ts tests/tui-settings.test.ts tests/plan-filter.test.ts tests/image-budget.test.ts tests/tools.test.ts tests/plugin-updater.test.ts tests/client-render.test.tsx tests/sse.test.ts tests/proxy.test.ts tests/tool-call-validation.test.ts tests/pricing.test.ts tests/engine-matrix.test.ts",
     "check": "npm run typecheck && npm test && npm run build",
     "release": "npm run check && npm pack",
-    "sync:models": "node scripts/sync-models.mjs"
+    "sync:models": "node scripts/sync-models.mjs",
+    "test:engine": "node scripts/test-engines.mjs"
   },
   "keywords": [
     "dsh",