@goodandready/dsh-plugin-notify 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.2] - 2026-10-10
+
+### Fixed
+- **Request trust enforcement on HTTP/SSE routes** (#46): Route SSE and Push subscriptions through `isTrustedRequest` / `getRequestRejection`, ensuring origin and session checks with loopback fallback.
+- **Webhook error logging diagnostic** (#49): Log human-readable channel name instead of truncated webhook URL on POST failure, preventing credential token leakage.
+- **Multi-instance SSE client isolation** (#50): Isolate SSE client sets per plugin lifecycle context on dispose, avoiding cross-instance connection drops on reload.
+- **Deterministic memory bound on turnStarts map** (#51): Enforce deterministic FIFO eviction bound (`maxSize = 100`) on `turnStarts` map under session bursts.
+
+## [0.4.1] - 2026-10-10
+
+### Fixed
+- **Settings registration namespace & Desktop crash protection** (#55): Use canonical `ENTRY_ID = 'plugin-notify'` instead of scoped package name in `settings.register`; wrap call with `try / catch` logging warning instead of throwing `TypeError` in DSH Desktop.
+- **Settings form slot binding** (#54): Bind UI `settings.plugin.item` slot `key` to `ROW_ID` (`'plugin-notify'`), and prioritize `ROW_ID` in `configForms` candidates over legacy `NS`.
+- **Dynamic settings observation** (#48): Make describe settings fallback reactive: observe `loader/volatile-update`, `settings/document-updated`, and `settings/updated` to dynamically refresh settings when edited in UI or external config.
+- **Config unboxing guarantee** (#47): Guarantee `getConfig()` always unwraps volatile boxes via `unwrapConfig(config ?? {})`, preventing `TypeError` during `session/event` event unboxing.
+- **DSH 0.2.0-rc.1 clean activation & volatile schema** (#42): Guarantee clean activation on DSH 0.2.0-rc.1 when `settings.register` is absent; confirm all user-facing fields in `Config` have `.volatile()` markers.
+
 ## [0.4.0] - 2026-10-05
 
 ### Added

package/lib/client.js

@@ -675,11 +675,10 @@ window.__ModuleLoader__.load({
         }
       }
 
-      // dsh 0.1 keys the settings scope by package name; 0.2 keys it by the
-      // composition row id. get() always returns a controller, so hold BOTH and
-      // use whichever reports ready (the other stays permanently unavailable).
-      const [scopeNS, scopeRow] = React.useMemo(
-        () => (ctx && ctx.configForms ? [ctx.configForms.get(NS), ctx.configForms.get(ROW_ID)] : [undefined, undefined]),
+      // In DSH 0.2.x configForms is keyed strictly by entry id (ROW_ID = 'plugin-notify').
+      // Hold both candidates and prefer ROW_ID whenever it is ready or NS is unavailable.
+      const [scopeRow, scopeNS] = React.useMemo(
+        () => (ctx && ctx.configForms ? [ctx.configForms.get(ROW_ID), ctx.configForms.get(NS)] : [undefined, undefined]),
         [ctx],
       )
       const useSnap = (scope) => React.useSyncExternalStore(
@@ -687,11 +686,11 @@ window.__ModuleLoader__.load({
         React.useCallback(() => (scope ? scope.getSnapshot() : { status: 'loading' }), [scope]),
         React.useCallback(() => ({ status: 'loading' }), []),
       )
-      const snapNS = useSnap(scopeNS)
       const snapRow = useSnap(scopeRow)
-      const rowWins = scopeRow && snapNS.status !== 'ready' && snapRow.status === 'ready'
-      const scope = rowWins ? scopeRow : scopeNS
-      const snapshot = rowWins ? snapRow : snapNS
+      const snapNS = useSnap(scopeNS)
+      const useRow = scopeRow && (snapRow.status === 'ready' || snapNS.status !== 'ready')
+      const scope = useRow ? scopeRow : (scopeNS || scopeRow)
+      const snapshot = useRow ? snapRow : (scopeNS ? snapNS : snapRow)
 
       React.useEffect(() => { ensureStyles() }, [])
 
@@ -905,7 +904,7 @@ window.__ModuleLoader__.load({
         })
         ctx.slots.inject('settings.plugin.item', () => {
           ctx.slots.register(
-            { name: 'settings.plugin.item', key: NS, locale: NS, order: 40, inject: () => ({ ctx }) },
+            { name: 'settings.plugin.item', key: ROW_ID, locale: NS, order: 40, inject: () => ({ ctx }) },
             (props) => React.createElement(NotifyCard, { ...props, ctx }),
           )
         })
@@ -916,7 +915,7 @@ window.__ModuleLoader__.load({
       let currentSettings = {}
       if (ctx.configForms) {
         try {
-          const candidates = [ctx.configForms.get(NS), ctx.configForms.get(ROW_ID)]
+          const candidates = [ctx.configForms.get(ROW_ID), ctx.configForms.get(NS)]
           const ready = candidates.find((s) => s && s.getSnapshot && s.getSnapshot().status === 'ready')
           const scope = ready || candidates[0]
           if (scope && typeof scope.subscribe === 'function') {

package/lib/index.js

@@ -10,6 +10,8 @@ import { credentialRef } from '@deepseek-ai/dsh-credentials';
 export const name = '@goodandready/dsh-plugin-notify';
 /** Settings namespace shared with the Web settings card. */
 export const NS = '@goodandready/dsh-plugin-notify';
+/** Canonical entry id matching cordis.patch.yml */
+export const ENTRY_ID = 'plugin-notify';
 
 // Session firehose + credentials (webhook URL refs) + settings scope for the card + webServer for SSE events + connection for authentication.
 export const inject = ['sessions', 'credentials', 'settings', 'webServer', 'connection'];
@@ -92,7 +94,7 @@ const warnedLegacyUrls = new Set();
  * Purge turnStarts entries older than maxAgeMs (default 2 hours) to prevent
  * memory leaks from abandoned or cancelled sessions.
  */
-export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now()) {
+export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now(), maxSize = 100) {
     let deleted = 0;
     for (const [sid, start] of turnStarts.entries()) {
         if (now - start > maxAgeMs) {
@@ -100,6 +102,13 @@ export function cleanupTurnStarts(maxAgeMs = 7200000, now = Date.now()) {
             deleted++;
         }
     }
+    if (typeof maxSize === 'number' && maxSize > 0 && turnStarts.size >= maxSize) {
+        for (const [sid] of turnStarts.entries()) {
+            if (turnStarts.size < maxSize) break;
+            turnStarts.delete(sid);
+            deleted++;
+        }
+    }
     return deleted;
 }
 
@@ -166,17 +175,23 @@ function connectionOf(ctx) {
  * Delegates to DSH connection service (Host/Origin fence + browser authentication session),
  * with loopback-only fallback when connection service is absent (e.g. standalone tests).
  */
-export function isTrustedRequest(request, targetCtx) {
-    if (!request || !request.headers) return false;
+export function getRequestRejection(request, targetCtx) {
+    if (!request || !request.headers) return 403;
 
     const conn = connectionOf(targetCtx);
     if (conn && typeof conn.requestRejection === 'function') {
         const rejection = conn.requestRejection(request);
-        return rejection === void 0;
+        if (rejection !== void 0) return rejection;
+        return void 0;
     }
 
     const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress;
-    return Boolean(remoteAddr && isLoopback(remoteAddr));
+    if (!remoteAddr || !isLoopback(remoteAddr)) return 403;
+    return void 0;
+}
+
+export function isTrustedRequest(request, targetCtx) {
+    return getRequestRejection(request, targetCtx) === void 0;
 }
 
 export function broadcastSse(eventData) {
@@ -194,7 +209,7 @@ export function broadcastSse(eventData) {
     return sent;
 }
 
-export function handleSseConnection(req, res, targetCtx) {
+export function handleSseConnection(req, res, targetCtx, instanceClients = null) {
     if (req.method !== 'GET') {
         res.statusCode = 405;
         if (typeof res.setHeader === 'function') res.setHeader('allow', 'GET');
@@ -203,31 +218,16 @@ export function handleSseConnection(req, res, targetCtx) {
         return;
     }
 
-    const conn = connectionOf(targetCtx);
-    if (conn && typeof conn.requestRejection === 'function') {
-        const rejection = conn.requestRejection(req);
-        if (rejection !== void 0) {
-            res.statusCode = rejection;
-            if (typeof res.writeHead === 'function') {
-                res.writeHead(rejection, { 'Content-Type': 'text/plain; charset=utf-8' });
-            }
-            if (typeof res.end === 'function') {
-                res.end(rejection === 401 ? 'Unauthorized' : 'Forbidden');
-            }
-            return;
+    const rejection = getRequestRejection(req, targetCtx);
+    if (rejection !== void 0) {
+        res.statusCode = rejection;
+        if (typeof res.writeHead === 'function') {
+            res.writeHead(rejection, { 'Content-Type': 'text/plain; charset=utf-8' });
         }
-    } else {
-        const remoteAddr = req.socket?.remoteAddress || req.connection?.remoteAddress;
-        if (!remoteAddr || !isLoopback(remoteAddr)) {
-            res.statusCode = 403;
-            if (typeof res.writeHead === 'function') {
-                res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
-            }
-            if (typeof res.end === 'function') {
-                res.end('Forbidden');
-            }
-            return;
+        if (typeof res.end === 'function') {
+            res.end(rejection === 401 ? 'Unauthorized' : 'Forbidden');
         }
+        return;
     }
 
     if (typeof res.writeHead === 'function') {
@@ -241,9 +241,15 @@ export function handleSseConnection(req, res, targetCtx) {
         res.write(': connected\n\n');
     }
     sseClients.add(res);
+    if (instanceClients) {
+        instanceClients.add(res);
+    }
 
     const onEnd = () => {
         sseClients.delete(res);
+        if (instanceClients) {
+            instanceClients.delete(res);
+        }
     };
     if (typeof req.on === 'function') req.on('close', onEnd);
     if (typeof res.on === 'function') {
@@ -252,8 +258,9 @@ export function handleSseConnection(req, res, targetCtx) {
     }
 }
 
-export function closeAllSseClients() {
-    for (const res of Array.from(sseClients)) {
+export function closeAllSseClients(clientsToClose = sseClients) {
+    const list = Array.from(clientsToClose);
+    for (const res of list) {
         try {
             if (!res.writableEnded) {
                 if (typeof res.write === 'function' && res.headersSent) {
@@ -271,9 +278,16 @@ export function closeAllSseClients() {
             // ignore close error
         } finally {
             sseClients.delete(res);
+            if (clientsToClose !== sseClients) {
+                clientsToClose.delete(res);
+            }
         }
     }
-    sseClients.clear();
+    if (clientsToClose !== sseClients) {
+        clientsToClose.clear();
+    } else {
+        sseClients.clear();
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -545,18 +559,9 @@ function writeText(res, status, text, headers = {}) {
 
 /** Shared auth for push routes: same fence as the SSE stream. Returns true when accepted. */
 export function authorizePushRequest(req, res, targetCtx) {
-    const conn = connectionOf(targetCtx);
-    if (conn && typeof conn.requestRejection === 'function') {
-        const rejection = conn.requestRejection(req);
-        if (rejection !== void 0) {
-            writeText(res, rejection, rejection === 401 ? 'Unauthorized' : 'Forbidden');
-            return false;
-        }
-        return true;
-    }
-    const remoteAddr = req.socket?.remoteAddress || req.connection?.remoteAddress;
-    if (!remoteAddr || !isLoopback(remoteAddr)) {
-        writeText(res, 403, 'Forbidden');
+    const rejection = getRequestRejection(req, targetCtx);
+    if (rejection !== void 0) {
+        writeText(res, rejection, rejection === 401 ? 'Unauthorized' : 'Forbidden');
         return false;
     }
     return true;
@@ -647,6 +652,7 @@ export async function handlePushTest(req, res, targetCtx, getConfig) {
 
 function mountWebServer(targetCtx, hostCtx, getConfig) {
     if (!targetCtx?.webServer?.register) return () => {};
+    const instanceClients = new Set();
     // Async route wrapper: an unexpected rejection becomes a 500 instead of an
     // unhandled rejection; authorized handlers have already written their response.
     const asyncRoute = (handler) => (req, res) => {
@@ -658,7 +664,7 @@ function mountWebServer(targetCtx, hostCtx, getConfig) {
         {
             kind: 'exact',
             path: '/dsh-plugin-notify/events',
-            handler: (req, res) => handleSseConnection(req, res, targetCtx),
+            handler: (req, res) => handleSseConnection(req, res, targetCtx, instanceClients),
         },
         {
             kind: 'exact',
@@ -714,7 +720,7 @@ function mountWebServer(targetCtx, hostCtx, getConfig) {
             }
             unregister = null;
         }
-        closeAllSseClients();
+        closeAllSseClients(instanceClients);
     };
 
     if (typeof targetCtx.effect === 'function') {
@@ -734,7 +740,7 @@ function mountWebServer(targetCtx, hostCtx, getConfig) {
 }
 
 export function apply(ctx, config = {}) {
-    let getConfig = () => config ?? {};
+    let getConfig = () => unwrapConfig(config ?? {});
 
     let webServerMounted = false;
     let unmountWebServer = null;
@@ -753,7 +759,6 @@ export function apply(ctx, config = {}) {
             try { unmountWebServer(); } catch { /* ignore */ }
             unmountWebServer = null;
         }
-        closeAllSseClients();
         turnStarts.clear();
         webServerMounted = false;
     };
@@ -768,22 +773,48 @@ export function apply(ctx, config = {}) {
     if (typeof ctx.inject === 'function') {
         ctx.inject(['settings'], (sctx) => {
             if (typeof sctx.settings?.register === 'function') {
-                const scope = sctx.settings.register(NS, Config, { base: config ?? {} });
-                getConfig = () => scope.get() ?? config ?? {};
-                return;
+                try {
+                    const scope = sctx.settings.register(ENTRY_ID, Config, { base: config ?? {} });
+                    getConfig = () => (scope ? unwrapConfig(scope.get() ?? config ?? {}) : unwrapConfig(config ?? {}));
+                    return;
+                } catch (err) {
+                    ctx?.logger?.warn?.(`[plugin-notify] settings.register('${ENTRY_ID}') failed, falling back to describe: ${String(err)}`);
+                }
+            }
+            let currentRow = (() => { try { return sctx.settings?.describe?.().find((r) => r && (r.ns === ENTRY_ID || r.ns === NS)); } catch { return null; } })();
+            const refreshSettings = () => {
+                try {
+                    const next = sctx.settings?.describe?.().find((r) => r && (r.ns === ENTRY_ID || r.ns === NS));
+                    if (next) currentRow = next;
+                } catch {
+                    // best effort
+                }
+            };
+            if (typeof ctx.on === 'function') {
+                ctx.on('settings/document-updated', refreshSettings);
+                ctx.on('loader/volatile-update', refreshSettings);
+                ctx.on('settings/updated', refreshSettings);
+            }
+            if (typeof sctx.settings?.on === 'function') {
+                try { sctx.settings.on('update', refreshSettings); } catch { /* ignore */ }
             }
-            const row = (() => { try { return sctx.settings?.describe?.().find((r) => r && r.ns === NS); } catch { return null; } })();
             const scope = {
-              get: () => row?.value ?? config ?? {},
+              get: () => {
+                refreshSettings();
+                return currentRow?.value ?? config ?? {};
+              },
               replace: async (next) => {
                 try {
-                  return await sctx.settings?.replace?.(NS, next, row?.revision);
+                  const targetNs = sctx.settings?.describe?.().some((r) => r && r.ns === ENTRY_ID) ? ENTRY_ID : NS;
+                  const res = await sctx.settings?.replace?.(targetNs, next, currentRow?.revision);
+                  refreshSettings();
+                  return res;
                 } catch (err) {
                   ctx?.logger?.warn?.(`[plugin-notify] settings replace failed: ${String(err)}`);
                 }
               },
             };
-            getConfig = () => scope.get() ?? config ?? {};
+            getConfig = () => (scope ? unwrapConfig(scope.get() ?? config ?? {}) : unwrapConfig(config ?? {}));
         });
         ctx.inject(['webServer'], (wctx) => tryMountWebServer(wctx))
     }
@@ -842,8 +873,8 @@ export function apply(ctx, config = {}) {
         const excludeSessionPrefixes = cfg.excludeSessionPrefixes ?? [];
 
         if (event.type === 'turn/start') {
-            if (turnStarts.size > 100) {
-                cleanupTurnStarts();
+            if (turnStarts.size >= 100) {
+                cleanupTurnStarts(7200000, Date.now(), 100);
             }
             turnStarts.set(String(session.id), Date.now());
             return;
@@ -895,28 +926,28 @@ function send(ctx, n, webhooks, timeoutMs, local, includeSession, includeDuratio
     const signal = AbortSignal.timeout(timeoutMs);
     const channels = Object.keys(webhooks);
     (ctx?.logger?.debug ?? ctx?.logger?.info)?.(`[plugin-notify] ${n.kind} · ${n.title} · session ${n.sessionId} · channels ${channels.join(',') || 'none'} · local ${local}`);
-    const post = (url, body) => {
+    const post = (channel, url, body) => {
         fetch(url, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify(body),
             signal,
         }).catch(error => {
-            ctx?.logger?.warn?.(`[plugin-notify] webhook POST failed (${String(url).slice(0, 64)}…): ${String(error)}`);
+            ctx?.logger?.warn?.(`[plugin-notify] ${channel} webhook POST failed: ${String(error)}`);
         });
     };
     if (webhooks.feishu)
-        post(webhooks.feishu, { msg_type: 'text', content: { text } });
+        post('feishu', webhooks.feishu, { msg_type: 'text', content: { text } });
     if (webhooks.wecom)
-        post(webhooks.wecom, { msgtype: 'text', text: { content: text } });
+        post('wecom', webhooks.wecom, { msgtype: 'text', text: { content: text } });
     if (webhooks.dingtalk)
-        post(webhooks.dingtalk, { msgtype: 'text', text: { content: text } });
+        post('dingtalk', webhooks.dingtalk, { msgtype: 'text', text: { content: text } });
     if (webhooks.slack)
-        post(webhooks.slack, { text });
+        post('slack', webhooks.slack, { text });
     if (webhooks.discord)
-        post(webhooks.discord, { content: text });
+        post('discord', webhooks.discord, { content: text });
     if (webhooks.custom) {
-        post(webhooks.custom, {
+        post('custom', webhooks.custom, {
             text,
             kind: n.kind,
             title: n.title,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-plugin-notify",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "DSH plugin: audio chimes, cross-session toasts, desktop push, IM webhooks, and web push (PWA) for turn completion, errors, and approvals.",
   "license": "MIT",
   "type": "module",