@goodandready/dsh-subscriptions 0.5.24 → 0.5.26

package/lib/client.js

@@ -1365,20 +1365,26 @@ const cssId = 'dsh-subscriptions/settings.module.css'
         ))
       } catch { moved = false }
       if (moved) return
-      // Запасной путь для сборок без settings.plugin.item: прежний раздел,
-      // чтобы настройки не пропали.
-      ctx.slots.inject('settings.section', () => ctx.slots.register(
-        {
-          name: 'settings.section',
-          id: '@goodandready/dsh-subscriptions',
-          order: 28,
-          // locale в записи слота — то, из-за чего компонент получает props.t.
-          locale: NS,
-          label: () => t('title'),
-          inject: () => ({ ctx: ctx }),
-        },
-        SubsSection,
-      ))
+      // #244: Fallback for harness cores before settings.plugin.item slot was
+      // introduced (< 0.1.2-rc.1). Once all production profiles run a core
+      // that has settings.plugin.item, this block can be safely removed.
+      // Tracked in Gitea #244 — do not remove without verifying minimum core.
+      try {
+        ctx.slots.inject('settings.section', () => ctx.slots.register(
+          {
+            name: 'settings.section',
+            id: '@goodandready/dsh-subscriptions',
+            order: 28,
+            locale: NS,
+            label: () => t('title'),
+            inject: () => ({ ctx: ctx }),
+          },
+          SubsSection,
+        ))
+      } catch (e) {
+        // Neither slot system available — settings panel will not render.
+        // This is expected on headless / non-web profiles.
+      }
     }
 
     // Горячий переключатель провайдера в строке композера: клик циклично

package/lib/index.js

@@ -29,7 +29,7 @@ import {
   antigravityIdentityHeaders,
 } from './code-assist.js'
 
-export const name = 'dsh-subscriptions'
+export const name = '@goodandready/dsh-subscriptions'
 export const inject = ['llm', 'credentials', 'webServer', 'settings']
 
 const NS = 'dsh-subscriptions'
@@ -110,6 +110,11 @@ export const Config = z.object({
 
 function publicConfig(cfg) {
   const clone = structuredClone(cfg)
+  // #242: redact all *ClientSecret fields before exposing config via GET /config.
+  // Secrets must never leave the server; the UI does not need them.
+  for (const key of Object.keys(clone)) {
+    if (key.endsWith('ClientSecret')) clone[key] = clone[key] ? '••••••' : ''
+  }
   return clone
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-subscriptions",
-  "version": "0.5.24",
+  "version": "0.5.26",
   "description": "Use ChatGPT Codex, Claude, Grok, and Antigravity subscriptions as DeepSeek Harness LLM providers via OAuth.",
   "license": "MIT",
   "type": "module",