@goodandready/dsh-tts 0.4.20 → 0.4.22

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Notable changes to `@goodandready/dsh-tts`.
 
+## 0.4.22
+
+### Fixed
+- Enforce fail-closed `isTrustedSettingsRequest(req)` validation on `/stream`, `/pending`, and `/speak` HTTP handlers to reject untrusted cross-site requests with 403 Forbidden (#136).
+
+## 0.4.21
+
+### Fixed
+- Settings no longer wait on the removed settingsScope service. The client uses configForms (#137).
+
 ## 0.4.19
 
 ### Fixed

package/lib/client-src/50-settings.js

@@ -15,10 +15,10 @@
 
       const ctx = props && props.ctx
       const scope = React.useMemo(() => {
-        const s = (ctx && ctx.get && ctx.get('lanSettings')) || (ctx && ctx.settingsScope)
-        if (!s || !s.bind) return null
+        const s = (ctx && ctx.get && ctx.get('lanSettings')) || (ctx && ctx.configForms)
+        if (!s || !s.get) return null
         try {
-          return s.bind({ namespace: NS })
+          return s.get(NS)
         } catch (_) { /* settings scope binding failed */ 
           return null
         }

package/lib/client-src/60-card-dock.js

@@ -206,7 +206,7 @@
       ))
     }
 
-    exports.inject = ['slots', 'settingsScope', 'locale']
+    exports.inject = ['slots', 'configForms', 'locale']
     exports.apply = function apply(ctx) {
       registerSettings(ctx)
       registerSpeaker(ctx)

package/lib/client.js

@@ -1379,10 +1379,10 @@ async function pollPending() {
 
       const ctx = props && props.ctx
       const scope = React.useMemo(() => {
-        const s = (ctx && ctx.get && ctx.get('lanSettings')) || (ctx && ctx.settingsScope)
-        if (!s || !s.bind) return null
+        const s = (ctx && ctx.get && ctx.get('lanSettings')) || (ctx && ctx.configForms)
+        if (!s || !s.get) return null
         try {
-          return s.bind({ namespace: NS })
+          return s.get(NS)
         } catch (_) { /* settings scope binding failed */ 
           return null
         }
@@ -1969,7 +1969,7 @@ async function pollPending() {
       ))
     }
 
-    exports.inject = ['slots', 'settingsScope', 'locale']
+    exports.inject = ['slots', 'configForms', 'locale']
     exports.apply = function apply(ctx) {
       registerSettings(ctx)
       registerSpeaker(ctx)

package/lib/routes.js

@@ -58,6 +58,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
+      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
       try {
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
@@ -376,6 +377,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/pending',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
+      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
       const url = new URL(req.url || '/', 'http://127.0.0.1')
       const after = url.searchParams.get('after') || ''
       let items = pending.slice()
@@ -392,6 +394,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/speak',
     handler: async (req, res) => {
       if (req.method !== 'POST') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'POST only' } }); return }
+      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
       let raw
       try { raw = await readBody(req, 256 * 1024) } catch (e) {
         writeJson(res, 400, { ok: false, error: { code: 'body', message: e.message } }); return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.20",
+  "version": "0.4.22",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",
@@ -54,7 +54,9 @@
       "platform": "web",
       "inject": [
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-connection"
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings"
       ]
     }
   },