@goodandready/dsh-tts 0.4.22 → 0.4.24

package/CHANGELOG.md

@@ -1,7 +1,25 @@
 # Changelog
 
+## 0.4.24
+
+### Fixed
+- **Peer gate on DSH 0.2.0-rc.1** (#58): DSH skips a profile bundle whose `peerDependencies` exclude the running version, so this plugin was absent from the profile with no error in the UI. Every `@deepseek-ai/dsh-*` peer now names both the 0.1.7-rc.2 and 0.2.0-rc.1 lines, because semver does not admit a prerelease of the next minor into a range that does not name it.
+
 Notable changes to `@goodandready/dsh-tts`.
 
+## 0.4.23
+
+### Security
+- **Strict Settings Request Trust Policy**: Eliminated `same-site` and arbitrary auth header bypasses in `isTrustedSettingsRequest`. Rejects non-same-origin callers, validates matching origin/host pair with loopback remote address, and requires explicit token verification against `DSH_AUTH_TOKEN`/`DSH_TOKEN` (#119).
+- **Protected Model Status & Path Redaction**: `GET /dsh-tts/models/status` now requires `isTrustedSettingsRequest` authorization (returns 403 for untrusted/cross-site requests) and completely redacts absolute filesystem paths from model state descriptors (#139).
+
+### Added
+- **One-Click Updater in Settings Card**: Integrated a unified live updater block (`PluginUpdaterBlock`) into the settings card, displaying current version, latest npm release badge, update execution button, and DSH restart instructions connected to `/dsh-tts/updater` and `/api/dsh-tts/update` (#120).
+- **Durable Model Download Failure Tracking**: `modelManager` now tracks sanitized download failure states across engines, reports errors through protected status (`failed: true`, `error: sanitizedMessage`), and clears errors on retry or deletion (#141).
+
+### Packaging
+- **Clean Runtime-Only Package Boundary**: Updated `package.json` files allowlist to exclude `scripts/` (build/release tooling) and `lib/client-src/` from published npm archive, preserving strict runtime-only surface (#140).
+
 ## 0.4.22
 
 ### Fixed

package/lib/client.js

@@ -750,6 +750,16 @@ async function pollPending() {
       'messengerInstallHint': 'To enable voice replies in messengers, install the plugin with',
       'messengerTtsEnabled': 'Voice replies in messengers',
       'messengerTtsEnabledHint': 'Allow the messenger gateway to deliver replies as voice notes.',
+      'updaterTitle': 'Plugin Updates',
+      'updaterCheck': 'Check updates',
+      'updaterChecking': 'Checking…',
+      'updaterCurrent': 'Current version',
+      'updaterLatest': 'Latest version',
+      'updaterUpToDate': 'Up to date',
+      'updaterUpdateNow': 'Update to v{version}',
+      'updaterUpdating': 'Updating…',
+      'updaterSuccess': 'Plugin updated successfully! Please restart DSH service.',
+      'updaterFailed': 'Update check failed: ',
     }
 
     const zh = {
@@ -939,6 +949,16 @@ async function pollPending() {
       'messengerInstallHint': '如需向聊天软件发送语音回复，请运行：',
       'messengerTtsEnabled': '群组语音回复',
       'messengerTtsEnabledHint': '允许网关将回复以语音便签 (Voice Note) 形式发送。',
+      'updaterTitle': '插件更新',
+      'updaterCheck': '检查更新',
+      'updaterChecking': '正在检查…',
+      'updaterCurrent': '当前版本',
+      'updaterLatest': '最新版本',
+      'updaterUpToDate': '已是最新',
+      'updaterUpdateNow': '一键更新至 v{version}',
+      'updaterUpdating': '正在更新…',
+      'updaterSuccess': '插件更新成功！请重启 DSH 服务以生效。',
+      'updaterFailed': '更新检查失败：',
     }
     function ChainEditor(props) {
       // Translator comes from the card: the slot passes props.t only to it.
@@ -1339,6 +1359,110 @@ async function pollPending() {
       )
     }
 
+
+    // Plugin updater block: check updates, show badge, and trigger one-click update
+    function PluginUpdaterBlock(props) {
+      const t = props.t || ((key) => key)
+      const [status, setStatus] = React.useState(null)
+      const [loading, setLoading] = React.useState(false)
+      const [updating, setUpdating] = React.useState(false)
+      const [msg, setMsg] = React.useState(null)
+
+      const checkUpdate = React.useCallback(async () => {
+        setLoading(true)
+        setMsg(null)
+        try {
+          const res = await fetch('/api/dsh-tts/update', {
+            headers: { 'x-dsh-plugin-update': '1' },
+          })
+          if (!res.ok) throw new Error('HTTP ' + res.status)
+          const data = await res.json()
+          setStatus(data)
+        } catch (e) {
+          setMsg({ ok: false, text: (t('updaterFailed') || 'Update check failed: ') + (e && e.message || String(e)) })
+        } finally {
+          setLoading(false)
+        }
+      }, [t])
+
+      const onUpdateNow = async () => {
+        setUpdating(true)
+        setMsg(null)
+        try {
+          const res = await fetch('/api/dsh-tts/update', {
+            method: 'POST',
+            headers: {
+              'x-dsh-plugin-update': '1',
+              'content-type': 'application/json',
+            },
+          })
+          const data = await res.json()
+          if (!res.ok) throw new Error((data && (data.error || data.message)) || 'HTTP ' + res.status)
+          setStatus(data)
+          setMsg({ ok: true, text: t('updaterSuccess') || 'Plugin updated successfully! Please restart DSH service.' })
+        } catch (e) {
+          setMsg({ ok: false, text: e && e.message || String(e) })
+        } finally {
+          setUpdating(false)
+        }
+      }
+
+      React.useEffect(() => {
+        checkUpdate()
+      }, [checkUpdate])
+
+      const currentVer = (status && status.currentVersion) || '0.4.23'
+      const latestVer = status && status.latestVersion
+      const updateAvailable = Boolean(status && status.updateAvailable && latestVer && latestVer !== currentVer)
+
+      return React.createElement(
+        'div',
+        { className: 'dts-block', style: { gap: '10px' } },
+        React.createElement(
+          'div',
+          { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', flexWrap: 'wrap', gap: '8px' } },
+          React.createElement(
+            'div',
+            { style: { display: 'flex', alignItems: 'center', gap: '8px' } },
+            React.createElement('span', { className: 'dts-title' }, '🔄 ' + t('updaterTitle')),
+            React.createElement('span', { className: 'dts-badge ' + (updateAvailable ? 'dts-badge-warn' : 'dts-badge-on') },
+              updateAvailable ? 'v' + latestVer + ' available' : 'v' + currentVer + ' (' + t('updaterUpToDate') + ')'
+            )
+          ),
+          React.createElement(
+            'div',
+            { style: { display: 'flex', gap: '8px' } },
+            updateAvailable
+              ? React.createElement(
+                  'button',
+                  {
+                    type: 'button',
+                    className: 'dts-btn',
+                    style: { borderColor: 'var(--dsw-alias-state-warning-primary)', color: 'var(--dsw-alias-state-warning-primary)' },
+                    onClick: onUpdateNow,
+                    disabled: updating || loading,
+                  },
+                  updating ? (t('updaterUpdating') || 'Updating…') : (t('updaterUpdateNow') || 'Update to v{version}').replace('{version}', latestVer)
+                )
+              : null,
+            React.createElement(
+              'button',
+              {
+                type: 'button',
+                className: 'dts-btn',
+                onClick: checkUpdate,
+                disabled: loading || updating,
+              },
+              loading ? (t('updaterChecking') || 'Checking…') : (t('updaterCheck') || 'Check updates')
+            )
+          )
+        ),
+        msg
+          ? React.createElement('div', { className: msg.ok ? 'dts-alert dts-alert-ok' : 'dts-alert dts-alert-err' }, msg.text)
+          : null
+      )
+    }
+
     // Synthesis stats panel: live host counters.
     function StatsPanel(props) {
       const t = props.t || ((key) => key)
@@ -1668,6 +1792,7 @@ async function pollPending() {
           React.createElement('div', { className: 'dts-h' }, t('statsTitle')),
           React.createElement(StatsPanel, { t: t }),
         ),
+        React.createElement(PluginUpdaterBlock, { t: t }),
         React.createElement('div', { className: 'dts-block' },
           React.createElement('div', { className: 'dts-h' }, t('chainTitle')),
           React.createElement('div', { className: 'dts-sub' },

package/lib/engines/manager.js

@@ -36,6 +36,7 @@ export const MODEL_SPECS = {
 export function createModelManager({ root = process.env.DSH_HOME || path.join(os.homedir(), '.dsh'), fetchImpl = fetch } = {}) {
   const baseDir = path.join(String(root), 'data', 'dsh-tts', 'models')
   const activeDownloads = new Map()
+  const lastErrors = new Map()
 
   function getModelPath(engineId) {
     return path.join(baseDir, engineId)
@@ -76,6 +77,8 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
     const dir = getModelPath(engineId)
     const active = activeDownloads.get(engineId)
 
+    const lastErr = lastErrors.get(engineId)
+
     if (active) {
       return {
         id: engineId,
@@ -84,10 +87,11 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
         requiresGpu: spec.requiresGpu,
         installed: false,
         downloading: true,
+        failed: false,
+        error: null,
         progress: active.progress || 0,
         downloadedBytes: active.downloadedBytes || 0,
         totalBytes: active.totalBytes || 0,
-        path: dir,
       }
     }
 
@@ -109,9 +113,10 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
       requiresGpu: spec.requiresGpu,
       installed: allFilesExist,
       downloading: false,
+      failed: !allFilesExist && Boolean(lastErr),
+      error: !allFilesExist && lastErr ? lastErr.message : null,
       progress: allFilesExist ? 100 : 0,
       sizeBytes,
-      path: dir,
     }
   }
 
@@ -130,6 +135,7 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
     if (activeDownloads.has(engineId)) {
       throw new Error(`Download already in progress for ${engineId}`)
     }
+    lastErrors.delete(engineId)
 
     const customFetch = options.fetchImpl || fetchImpl
     const dir = getModelPath(engineId)
@@ -208,6 +214,7 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
 
       downloadState.progress = 100
       activeDownloads.delete(engineId)
+      lastErrors.delete(engineId)
       return await getStatus(engineId)
     } catch (err) {
       // Clean up tmp files
@@ -215,6 +222,9 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
         const tmpFile = path.join(dir, `${f.name}.tmp`)
         await fs.promises.rm(tmpFile, { force: true }).catch(() => {})
       }
+      const rawMsg = String(err?.message || err || 'Installation failed')
+      const sanitized = rawMsg.replace(/https?:\/\/[^\s]+/g, '[url]')
+      lastErrors.set(engineId, { message: sanitized, failedAt: Date.now() })
       throw err
     } finally {
       activeDownloads.delete(engineId)
@@ -226,12 +236,14 @@ export function createModelManager({ root = process.env.DSH_HOME || path.join(os
     if (active && active.controller) {
       active.controller.abort()
       activeDownloads.delete(engineId)
+      lastErrors.delete(engineId)
       return true
     }
     return false
   }
 
   async function deleteModel(engineId) {
+    lastErrors.delete(engineId)
     const spec = MODEL_SPECS[engineId]
     if (!spec) throw new Error(`Unknown engine: ${engineId}`)
     await cancelDownload(engineId)

package/lib/http-util.js

@@ -21,36 +21,91 @@ export function readBody(req, maxBytes) {
   })
 }
 
-function isLoopback(address) {
-  if (!address) return false
-  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address === 'localhost'
+export function isLoopback(address) {
+  if (!address || typeof address !== 'string') return false
+  return (
+    address === '127.0.0.1' ||
+    address === '::1' ||
+    address === '::ffff:127.0.0.1' ||
+    address.startsWith('127.') ||
+    address === 'localhost'
+  )
+}
+
+function parseCookies(cookieHeader) {
+  if (!cookieHeader || typeof cookieHeader !== 'string') return {}
+  const out = {}
+  for (const part of cookieHeader.split(';')) {
+    const idx = part.indexOf('=')
+    if (idx > 0) {
+      const k = part.slice(0, idx).trim()
+      const v = part.slice(idx + 1).trim()
+      out[k] = v
+    }
+  }
+  return out
 }
 
 /**
  * Strict fail-closed check for administrative/settings requests.
- * Accepts loopback, same-origin/same-site sec-fetch-site, matching origin/host, or authorization header.
- * Rejects cross-site or unauthenticated requests missing origin context.
+ * Only accepts loopback with matching origin/host, same-origin context,
+ * or valid DSH auth tokens. Arbitrary headers, unverified tokens, and same-site requests are rejected.
  */
 export function isTrustedSettingsRequest(request) {
   if (!request || !request.headers) return false
 
-  const authHeader = request.headers['authorization'] || request.headers['x-dsh-auth']
-  if (authHeader && authHeader.length > 5) return true
+  // Fail-closed: unconditionally reject cross-site and non-same-origin Sec-Fetch-Site (e.g. same-site, cross-site)
+  const secFetch = request.headers['sec-fetch-site']
+  if (secFetch && secFetch !== 'same-origin') {
+    return false
+  }
 
+  // If origin is present, ensure it matches request host
+  const origin = request.headers['origin']
+  const host = request.headers['host']
+  if (origin && host) {
+    try {
+      const originHost = new URL(origin).host
+      if (originHost !== host) return false
+    } catch {
+      return false
+    }
+  }
+
+  // Verify explicit authorization token against DSH environment tokens if defined
+  const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN
+  const rawAuth = request.headers['authorization'] || request.headers['x-dsh-auth']
+  const cookieHeader = request.headers['cookie']
+
+  if (expectedToken) {
+    if (typeof rawAuth === 'string') {
+      const token = rawAuth.startsWith('Bearer ') ? rawAuth.slice(7).trim() : rawAuth.trim()
+      if (token && token === expectedToken) return true
+    }
+    if (typeof cookieHeader === 'string') {
+      const cookies = parseCookies(cookieHeader)
+      const token = cookies['token'] || cookies['dsh_token']
+      if (token && token === expectedToken) return true
+    }
+  }
+
+  // Remote IP loopback check
   const remoteAddr = request.socket?.remoteAddress || request.connection?.remoteAddress
-  if (remoteAddr && isLoopback(remoteAddr)) return true
+  if (remoteAddr) {
+    return isLoopback(remoteAddr)
+  }
 
-  const secFetchSite = request.headers['sec-fetch-site']
-  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+  // Internal/mock caller without socket: only allow if sec-fetch-site is explicitly same-origin or origin matches host
+  if (secFetch === 'same-origin') {
     return true
   }
-	  const origin = request.headers['origin']
-  const host = request.headers['host']
+
   if (origin && host) {
     try {
-      const originHost = new URL(origin).host
-      if (originHost === host) return true
-    } catch { /* invalid origin URL */ }
+      return new URL(origin).host === host
+    } catch {
+      return false
+    }
   }
 
   return false

package/lib/routes.js

@@ -80,6 +80,7 @@ export function registerHttpRoutes(ctx, api) {
     path: '/dsh-tts/models/status',
     handler: async (req, res) => {
       if (req.method !== 'GET') { writeJson(res, 405, { ok: false, error: { code: 'method', message: 'GET only' } }); return }
+      if (!isTrustedSettingsRequest(req)) { writeJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'same-origin only' } }); return }
       try {
         const list = await modelManager.listStatus()
         writeJson(res, 200, { ok: true, models: list })
@@ -428,4 +429,10 @@ export function registerHttpRoutes(ctx, api) {
     packageName: '@goodandready/dsh-tts',
     manifestUrl: new URL('../package.json', import.meta.url),
   })
+
+  registerPluginUpdater(ctx, {
+    endpoint: '/api/dsh-tts/update',
+    packageName: '@goodandready/dsh-tts',
+    manifestUrl: new URL('../package.json', import.meta.url),
+  })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.22",
+  "version": "0.4.24",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",
@@ -13,7 +13,8 @@
   },
   "files": [
     "lib/",
-    "scripts/",
+    "!lib/client-src/**",
+    "!lib/client-src",
     "cordis.patch.yml",
     "CHANGELOG.md",
     "README.md",
@@ -62,10 +63,10 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "publishConfig": {

package/lib/client-src/00-open.js

@@ -1,89 +0,0 @@
-window.__ModuleLoader__.load({
-  id: '@goodandready/dsh-tts',
-  factory: (require) => {
-    var module = { exports: {} }
-    var exports = module.exports
-    const React = require('react')
-
-    // Chevron comes from core UI primitives; local SVG is a fallback for
-    // builds without the package. Icon always points down; open state rotates.
-    let ChevronIcon = null
-    try {
-      const primitives = require('@deepseek-ai/dsh-client-ui-primitives')
-      ChevronIcon = primitives && primitives.IconChevronDownOutline14
-    } catch (noPrimitives) {
-      ChevronIcon = null
-    }
-    const NS = 'dsh-tts'
-    // Plugins page row seat: key = '<package name>#<row id>', row id as cordis.patch.yml declares it.
-    const PKG = '@goodandready/dsh-tts'
-    const ROW_ID = 'dsh-tts'
-    const ROW_CONFIG_KEY = PKG + '#' + ROW_ID
-    const PROVIDERS = [
-      'openai', 'elevenlabs', 'google', 'azure', 'groq', 'deepgram', 'openrouter',
-      'edge', 'piper', 'espeak',
-    ]
-    const CLOUD = {
-      openai: 1, elevenlabs: 1, google: 1, azure: 1, groq: 1, deepgram: 1, openrouter: 1, custom: 1,
-    }
-    // Hints stay generic: concrete provider model IDs rot quickly.
-    const MODEL_HINT = {
-      openai: 'provider default',
-      elevenlabs: 'provider default',
-      google: 'provider default',
-      azure: 'region voice name',
-      groq: 'provider default',
-      deepgram: 'provider default (English-only voices)',
-      openrouter: 'provider/model id',
-      edge: 'BCP-47 voice, e.g. ru-RU-SvetlanaNeural',
-      piper: 'path to .onnx',
-      espeak: 'language code, e.g. ru',
-      kokoro: 'not bundled — offline neural runtime unavailable',
-      f5: 'not bundled — offline neural runtime unavailable',
-    }
-
-
-    function createErrorBoundary() {
-      if (!React || typeof React.Component !== 'function') {
-        return function NoopBoundary(props) { return (props && props.children) || null }
-      }
-      return class ErrorBoundary extends React.Component {
-        constructor(props) {
-          super(props)
-          this.state = { hasError: false, error: null }
-        }
-        static getDerivedStateFromError(error) {
-          return { hasError: true, error }
-        }
-        componentDidCatch(error, errorInfo) {
-          console.error('[dsh-tts] React Error:', error, errorInfo)
-        }
-        render() {
-          if (this.state.hasError) {
-            return React.createElement(
-              'div',
-              {
-                className: 'dts-alert dts-alert-err',
-                style: { margin: '12px 0', padding: '14px', borderRadius: '8px' },
-              },
-              React.createElement('div', { style: { fontWeight: 600, marginBottom: '6px' } }, '⚠️ TTS UI Error:'),
-              React.createElement('div', { style: { fontSize: '12px', wordBreak: 'break-all' } }, String((this.state.error && this.state.error.message) || this.state.error)),
-              React.createElement(
-                'button',
-                {
-                  type: 'button',
-                  className: 'dts-btn',
-                  style: { marginTop: '10px', fontSize: '12px', padding: '4px 10px' },
-                  onClick: () => this.setState({ hasError: false, error: null }),
-                },
-                'Retry',
-              ),
-            )
-          }
-          return (this.props && this.props.children) || null
-        }
-      }
-    }
-    const ErrorBoundary = createErrorBoundary()
-    const SNAPSHOT_READY = Object.freeze({ status: 'ready', value: {} })
-    const SNAPSHOT_LOADING = Object.freeze({ status: 'loading', value: {} })

package/lib/client-src/10-styles.js

@@ -1,55 +0,0 @@
-
-    const SET_CSS =
-      '.dts-wrap{display:flex;flex-direction:column;gap:18px;padding:4px 0 24px;max-width:900px}' +
-      '.dts-header{display:flex;flex-direction:column;gap:8px;padding-bottom:14px;border-bottom:1px solid var(--dsw-alias-border-l2)}' +
-      '.dts-page{padding:0}' +
-      '.dts-page-title{font-size:20px;font-weight:700;color:var(--dsw-alias-label-primary);display:flex;align-items:center;gap:10px}' +
-      '.dts-page-sub{font-size:13px;color:var(--dsw-alias-label-secondary);line-height:1.5}' +
-      '.dts-block{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;padding:16px 18px;display:flex;flex-direction:column;gap:12px}' +
-      '.dts-h{font-size:15px;font-weight:600;color:var(--dsw-alias-label-primary);display:flex;align-items:center;justify-content:space-between}' +
-      '.dts-sub{font-size:12px;color:var(--dsw-alias-label-secondary);line-height:1.4}' +
-      '.dts-card{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-3);border-radius:12px;list-style:none}' +
-      '.dts-head{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;display:flex;align-items:center;gap:12px;padding:14px 16px}' +
-      '.dts-headText{flex-direction:column;flex:1;gap:4px;min-width:0;display:flex}' +
-      '.dts-title{color:var(--dsw-alias-label-primary);font-size:15px;font-weight:600;line-height:1.4}' +
-      '.dts-chev{margin-left:auto;color:var(--dsw-alias-label-secondary);flex:none;transition:transform .16s}' +
-      '.dts-chevOpen{transform:rotate(180deg)}' +
-      '.dts-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding:12px 0}' +
-      '.dts-field{display:flex;flex-direction:column;gap:6px;padding:6px 0;font-size:13px;color:var(--dsw-alias-label-primary)}' +
-      '.dts-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
-      '.dts-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
-      '.dts-foot{border-top:1px solid var(--dsw-alias-border-l2);display:flex;justify-content:flex-end;align-items:center;gap:10px;padding:14px 0 4px}' +
-      '.dts-save{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:6px 16px;font-size:13px;font-weight:500;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);transition:all .15s ease}' +
-      '.dts-save:hover:not(:disabled){opacity:0.88}' +
-      '.dts-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 12px;font-size:13px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-weight:500;display:inline-flex;align-items:center;justify-content:center;gap:6px;transition:all .15s ease}' +
-      '.dts-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}' +
-      '.dts-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}' +
-      '.dts-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}' +
-      '.dts-entry{display:flex;flex-direction:column;gap:8px;padding:12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2)}' +
-      '.dts-row{display:flex;gap:8px;align-items:center;flex-wrap:wrap}' +
-      '.dts-row .dts-model{flex:1;min-width:120px}' +
-      '.dts-row .dts-key{flex:1;min-width:180px}' +
-      '.dts-mini{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;width:28px;height:28px;cursor:pointer;flex:none;display:inline-flex;align-items:center;justify-content:center;font-size:13px;transition:all .15s ease}' +
-      '.dts-mini:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2))}' +
-      '.dts-ok{font-size:12px;color:var(--dsw-alias-state-success-primary);font-weight:500}' +
-      '.dts-bad{font-size:12px;color:var(--dsw-alias-state-error-primary);font-weight:500}' +
-      '.dts-badge{font-size:11px;padding:3px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);white-space:nowrap;display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
-      '.dts-badge-on{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}' +
-      '.dts-badge-warn{color:var(--dsw-alias-state-warning-primary);border-color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}' +
-      '.dts-badge-bad{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}' +
-      '.dts-link{background:none;border:none;color:var(--dsw-alias-label-secondary);cursor:pointer;font-size:12px;padding:0;text-decoration:underline}' +
-      '.dts-link:hover:not(:disabled){color:var(--dsw-alias-label-primary)}' +
-      '.dts-alert{padding:10px 14px;border-radius:8px;font-size:13px}' +
-      '.dts-alert-err{background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-error-primary) 20%, transparent)}' +
-      '.dts-alert-warn{background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 10%, transparent);color:var(--dsw-alias-state-warning-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-warning-primary) 20%, transparent)}' +
-      '.dts-alert-ok{background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-success-primary) 20%, transparent)}' +
-      '.dts-grow{flex:1;min-width:100px}'
-
-    const setCssId = 'dsh-tts/settings.module.css'
-    if (typeof document !== 'undefined' && !document.querySelector('style[data-dsh-plugin="dsh-tts"]')) {
-      const tag = document.createElement('style')
-      tag.textContent = SET_CSS
-      tag.setAttribute('data-dsh-plugin', 'dsh-tts')
-      tag.dataset.pluginCss = setCssId
-      document.head.appendChild(tag)
-    }