@goodandready/dsh-tts 0.4.29 → 0.4.30

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.4.30
+
+### Fixed
+- **Supply Chain Security & Updater** (#196, #199):
+  - Removed `--config.minimumReleaseAge=0` bypass in `lib/updater.js:installExact`, respecting pnpm supply-chain quarantine during updates.
+  - Consolidated updater endpoint to canonical `/api/dsh-tts/update`, removing legacy `/dsh-tts/updater` route alias.
+  - Implemented shared `updaterMutex` returning HTTP 409 `Install already in progress` across concurrent requests.
+- **Theme Tokens & Design System** (#197):
+  - Replaced legacy CSS custom properties with canonical DSH core theme tokens (`--dsw-state-warn-primary`, `--dsw-brand-primary`, `--dsw-bg-layer-3`).
+- **Client Networking & Timeout Safety** (#198):
+  - Wrapped all client `fetch` calls in `clientFetch(url, options)` utility with configurable 15-second `AbortController` timeout.
+  - Added error rejection handlers on fire-and-forget telemetry, settings, and player requests.
+
 ## 0.4.29
 
 ### Fixed

package/lib/client.js

@@ -51,7 +51,24 @@ window.__ModuleLoader__.load({
     }
 
 
-        function getModelHint(provider, t) {
+        function clientFetch(url, options) {
+      const opts = options || {}
+      const timeoutMs = Number(opts.timeoutMs) > 0 ? Number(opts.timeoutMs) : 15000
+      const controller = new AbortController()
+      const timer = setTimeout(() => controller.abort(), timeoutMs)
+
+      if (opts.signal) {
+        if (opts.signal.aborted) controller.abort()
+        else opts.signal.addEventListener('abort', () => controller.abort(), { once: true })
+      }
+
+      const fetchOpts = Object.assign({}, opts, { signal: controller.signal })
+      delete fetchOpts.timeoutMs
+
+      return fetch(url, fetchOpts).finally(() => clearTimeout(timer))
+    }
+
+    function getModelHint(provider, t) {
       if (typeof t === 'function') {
         const loc = t('modelHint_' + provider)
         if (loc && !loc.startsWith('modelHint_')) return loc
@@ -122,12 +139,12 @@ window.__ModuleLoader__.load({
       '.dts-body{border-top:1px solid var(--dsw-alias-border-l2);margin:0 16px;padding:12px 0}' +
       '.dts-field{display:flex;flex-direction:column;gap:6px;padding:6px 0;font-size:13px;color:var(--dsw-alias-label-primary)}' +
       '.dts-input{height:34px;border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:8px;padding:0 10px;font-size:13px;box-sizing:border-box}' +
-      '.dts-input:focus{outline:none;border-color:var(--dsw-alias-state-brand-primary)}' +
+      '.dts-input:focus{outline:none;border-color:var(--dsw-alias-brand-primary, #6366f1)}' +
       '.dts-foot{border-top:1px solid var(--dsw-alias-border-l2);display:flex;justify-content:flex-end;align-items:center;gap:10px;padding:14px 0 4px}' +
       '.dts-save{appearance:none;font:inherit;cursor:pointer;border:1px solid transparent;border-radius:8px;padding:6px 16px;font-size:13px;font-weight:500;background:var(--dsw-alias-label-primary);color:var(--dsw-alias-bg-layer-3);transition:all .15s ease}' +
       '.dts-save:hover:not(:disabled){opacity:0.88}' +
       '.dts-btn{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;padding:6px 12px;font-size:13px;background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);font-weight:500;display:inline-flex;align-items:center;justify-content:center;gap:6px;transition:all .15s ease}' +
-      '.dts-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}' +
+      '.dts-btn:hover:not(:disabled){background:var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-layer-2));border-color:var(--dsw-alias-label-dimmed, var(--dsw-alias-border-l2))}' +
       '.dts-btn-danger{color:var(--dsw-alias-state-error-primary);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 30%, transparent)}' +
       '.dts-btn-danger:hover:not(:disabled){background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 12%, transparent);border-color:color-mix(in srgb, var(--dsw-alias-state-error-primary) 50%, transparent)}' +
       '.dts-entry{display:flex;flex-direction:column;gap:8px;padding:12px;border:1px solid var(--dsw-alias-border-l2);border-radius:8px;background:var(--dsw-alias-bg-layer-2)}' +
@@ -135,18 +152,18 @@ window.__ModuleLoader__.load({
       '.dts-row .dts-model{flex:1;min-width:120px}' +
       '.dts-row .dts-key{flex:1;min-width:180px}' +
       '.dts-mini{border:1px solid var(--dsw-alias-border-l2);background:var(--dsw-alias-bg-layer-2);color:var(--dsw-alias-label-primary);border-radius:6px;width:28px;height:28px;cursor:pointer;flex:none;display:inline-flex;align-items:center;justify-content:center;font-size:13px;transition:all .15s ease}' +
-      '.dts-mini:hover:not(:disabled){background:var(--dsw-alias-bg-layer-4, var(--dsw-alias-bg-layer-2))}' +
+      '.dts-mini:hover:not(:disabled){background:var(--dsw-alias-bg-layer-3, var(--dsw-alias-bg-layer-2))}' +
       '.dts-ok{font-size:12px;color:var(--dsw-alias-state-success-primary);font-weight:500}' +
       '.dts-bad{font-size:12px;color:var(--dsw-alias-state-error-primary);font-weight:500}' +
       '.dts-badge{font-size:11px;padding:3px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary);white-space:nowrap;display:inline-flex;align-items:center;gap:4px;font-weight:500}' +
       '.dts-badge-on{color:var(--dsw-alias-state-success-primary);border-color:var(--dsw-alias-state-success-primary);background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 8%, transparent)}' +
-      '.dts-badge-warn{color:var(--dsw-alias-state-warning-primary);border-color:var(--dsw-alias-state-warning-primary);background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 8%, transparent)}' +
+      '.dts-badge-warn{color:var(--dsw-alias-state-warn-primary, #f59e0b);border-color:var(--dsw-alias-state-warn-primary, #f59e0b);background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #f59e0b) 8%, transparent)}' +
       '.dts-badge-bad{color:var(--dsw-alias-state-error-primary);border-color:var(--dsw-alias-state-error-primary);background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 8%, transparent)}' +
       '.dts-link{background:none;border:none;color:var(--dsw-alias-label-secondary);cursor:pointer;font-size:12px;padding:0;text-decoration:underline}' +
       '.dts-link:hover:not(:disabled){color:var(--dsw-alias-label-primary)}' +
       '.dts-alert{padding:10px 14px;border-radius:8px;font-size:13px}' +
       '.dts-alert-err{background:color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, transparent);color:var(--dsw-alias-state-error-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-error-primary) 20%, transparent)}' +
-      '.dts-alert-warn{background:color-mix(in srgb, var(--dsw-alias-state-warning-primary) 10%, transparent);color:var(--dsw-alias-state-warning-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-warning-primary) 20%, transparent)}' +
+      '.dts-alert-warn{background:color-mix(in srgb, var(--dsw-alias-state-warn-primary, #f59e0b) 10%, transparent);color:var(--dsw-alias-state-warn-primary, #f59e0b);border:1px solid color-mix(in srgb, var(--dsw-alias-state-warn-primary, #f59e0b) 20%, transparent)}' +
       '.dts-alert-ok{background:color-mix(in srgb, var(--dsw-alias-state-success-primary) 10%, transparent);color:var(--dsw-alias-state-success-primary);border:1px solid color-mix(in srgb, var(--dsw-alias-state-success-primary) 20%, transparent)}' +
       '.dts-grow{flex:1;min-width:100px}'
 
@@ -543,7 +560,7 @@ window.__ModuleLoader__.load({
 
     async function pollPending() {
       try {
-        const st = await fetch('/dsh-tts/status', { cache: 'no-store' })
+        const st = await clientFetch('/dsh-tts/status', { cache: 'no-store', timeoutMs: 8000 })
         if (!st.ok) return
         const meta = await st.json()
         player.enabled = !!(meta && meta.speakReplies)
@@ -552,7 +569,7 @@ window.__ModuleLoader__.load({
         if (meta && meta.roles) player.roles = meta.roles
         if (meta && typeof meta.bargeIn === 'boolean') player.bargeIn = meta.bargeIn
         if (!player.enabled) return
-        const res = await fetch('/dsh-tts/pending?after=' + encodeURIComponent(player.after || ''), { cache: 'no-store' })
+        const res = await clientFetch('/dsh-tts/pending?after=' + encodeURIComponent(player.after || ''), { cache: 'no-store', timeoutMs: 8000 })
         if (!res.ok) return
         const data = await res.json()
         const items = data && Array.isArray(data.items) ? data.items : []
@@ -608,10 +625,11 @@ window.__ModuleLoader__.load({
     function playStandalone(text) {
       if (!text) return
       stopPlayback()
-      fetch('/dsh-tts/speak', {
+      clientFetch('/dsh-tts/speak', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ text }),
+        timeoutMs: 15000,
       })
         .then((r) => r.json())
         .then((d) => {
@@ -623,15 +641,18 @@ window.__ModuleLoader__.load({
             audioBase64: d.audioBase64,
           })
         })
-        .catch(() => {})
+        .catch((err) => {
+          console.warn('[dsh-tts] playStandalone fetch failed:', err)
+        })
     }
 
     function previewSpeech(provider, model, voice, text) {
       stopPlayback()
-      return fetch('/dsh-tts/preview', {
+      return clientFetch('/dsh-tts/preview', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ provider, model, voice, text }),
+        timeoutMs: 15000,
       })
         .then((r) => r.json())
         .then((d) => {
@@ -657,10 +678,11 @@ window.__ModuleLoader__.load({
         if (list && list.items && list.items.length) phrase = list.items[0]
       }
       if (!phrase) return
-      fetch('/dsh-tts/speak', {
+      clientFetch('/dsh-tts/speak', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ text: phrase }),
+        timeoutMs: 15000,
       })
         .then((r) => r.json())
         .then((d) => {
@@ -1219,8 +1241,8 @@ window.__ModuleLoader__.load({
       const [models, setModels] = React.useState({})
 
       const loadStatus = React.useCallback(() => {
-        if (typeof fetch === 'undefined') return
-        fetch('/dsh-tts/models/status')
+        if (typeof clientFetch === 'undefined' && typeof fetch === 'undefined') return
+        clientFetch('/dsh-tts/models/status', { timeoutMs: 8000 })
           .then((r) => r.json())
           .then((d) => { if (d && d.ok && d.models) setModels(d.models) })
           .catch(() => {}) // status poll best-effort
@@ -1236,11 +1258,14 @@ window.__ModuleLoader__.load({
         if (typeof window !== 'undefined' && window.confirm) {
           if (!window.confirm(t('confirmDeleteModel'))) return
         }
-        fetch('/dsh-tts/models/delete', {
+        clientFetch('/dsh-tts/models/delete', {
           method: 'DELETE',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ engine }),
-        }).then(() => loadStatus()).catch(() => {})
+          timeoutMs: 10000,
+        }).then(() => loadStatus()).catch((err) => {
+          console.warn('[dsh-tts] model delete failed:', err)
+        })
       }
 
       const kokoro = models.kokoro || { installed: false, downloading: false, progress: 0 }
@@ -1480,7 +1505,7 @@ window.__ModuleLoader__.load({
           style: {
             padding: '10px 14px',
             borderRadius: '8px',
-            border: '1px solid var(--dsw-alias-state-warning-primary)',
+            border: '1px solid var(--dsw-alias-state-warn-primary, #f59e0b)',
             background: 'var(--dsw-alias-bg-layer-2)',
             display: 'flex',
             flexDirection: 'column',
@@ -1488,7 +1513,7 @@ window.__ModuleLoader__.load({
             fontSize: '13px',
           },
         },
-          React.createElement('span', { style: { fontWeight: 600, color: 'var(--dsw-alias-state-warning-primary)' } },
+          React.createElement('span', { style: { fontWeight: 600, color: 'var(--dsw-alias-state-warn-primary, #f59e0b)' } },
             '⚠️ ' + t('voiceNotInstalledTitle')
           ),
           React.createElement('span', { className: 'dts-sub' },
@@ -1522,7 +1547,7 @@ window.__ModuleLoader__.load({
           style: {
             padding: '10px 14px',
             borderRadius: '8px',
-            border: '1px solid var(--dsw-alias-state-warning-primary)',
+            border: '1px solid var(--dsw-alias-state-warn-primary, #f59e0b)',
             background: 'var(--dsw-alias-bg-layer-2)',
             display: 'flex',
             flexDirection: 'column',
@@ -1530,7 +1555,7 @@ window.__ModuleLoader__.load({
             fontSize: '13px',
           },
         },
-          React.createElement('span', { style: { fontWeight: 600, color: 'var(--dsw-alias-state-warning-primary)' } },
+          React.createElement('span', { style: { fontWeight: 600, color: 'var(--dsw-alias-state-warn-primary, #f59e0b)' } },
             '⚠️ ' + t('messengerNotInstalledTitle')
           ),
           React.createElement('span', { className: 'dts-sub' },
@@ -1565,8 +1590,9 @@ window.__ModuleLoader__.load({
         setLoading(true)
         setMsg(null)
         try {
-          const res = await fetch('/api/dsh-tts/update', {
+          const res = await clientFetch('/api/dsh-tts/update', {
             headers: { 'x-dsh-plugin-update': '1' },
+            timeoutMs: 10000,
           })
           if (!res.ok) throw new Error('HTTP ' + res.status)
           const data = await res.json()
@@ -1582,12 +1608,13 @@ window.__ModuleLoader__.load({
         setUpdating(true)
         setMsg(null)
         try {
-          const res = await fetch('/api/dsh-tts/update', {
+          const res = await clientFetch('/api/dsh-tts/update', {
             method: 'POST',
             headers: {
               'x-dsh-plugin-update': '1',
               'content-type': 'application/json',
             },
+            timeoutMs: 60000,
           })
           const data = await res.json()
           if (!res.ok) throw new Error((data && (data.error || data.message)) || 'HTTP ' + res.status)
@@ -1631,7 +1658,7 @@ window.__ModuleLoader__.load({
                   {
                     type: 'button',
                     className: 'dts-btn',
-                    style: { borderColor: 'var(--dsw-alias-state-warning-primary)', color: 'var(--dsw-alias-state-warning-primary)' },
+                    style: { borderColor: 'var(--dsw-alias-state-warn-primary, #f59e0b)', color: 'var(--dsw-alias-state-warn-primary, #f59e0b)' },
                     onClick: onUpdateNow,
                     disabled: updating || loading,
                   },
@@ -1661,11 +1688,11 @@ window.__ModuleLoader__.load({
       const t = props.t || ((key) => key)
       const [data, setData] = React.useState(null)
       const loadStats = () => {
-        fetch('/dsh-tts/stats', { cache: 'no-store' }).then((r) => r.json()).then(setData).catch(() => {})
+        clientFetch('/dsh-tts/stats', { cache: 'no-store', timeoutMs: 8000 }).then((r) => r.json()).then(setData).catch((err) => console.warn('[dsh-tts] loadStats failed:', err))
       }
       React.useEffect(() => { loadStats() }, [])
       const reset = () => {
-        fetch('/dsh-tts/stats', { method: 'DELETE' }).then(loadStats).catch(() => {})
+        clientFetch('/dsh-tts/stats', { method: 'DELETE', timeoutMs: 8000 }).then(loadStats).catch((err) => console.warn('[dsh-tts] resetStats failed:', err))
       }
       return React.createElement('div', { className: 'dts-block' },
         React.createElement('span', { className: 'dts-sub' }, data
@@ -1751,18 +1778,18 @@ window.__ModuleLoader__.load({
 
       React.useEffect(() => {
         let alive = true
-        fetch('/dsh-tts/config', { cache: 'no-store' }).then((res) => res.json()).then((data) => {
+        clientFetch('/dsh-tts/config', { cache: 'no-store', timeoutMs: 8000 }).then((res) => res.json()).then((data) => {
           if (!alive) return
           applyPayload(data)
         }).catch((e) => { if (alive) setErr(String(e && e.message ? e.message : e)) })
 
-        fetch('/dsh-tts/integrations', { cache: 'no-store' }).then((res) => res.json()).then((data) => {
+        clientFetch('/dsh-tts/integrations', { cache: 'no-store', timeoutMs: 8000 }).then((res) => res.json()).then((data) => {
           if (!alive) return
           if (data && data.ok) setIntegrations(data.integrations || data)
         }).catch(() => {})
 
         const loadTelemetry = () => {
-          fetch('/dsh-tts/stats', { cache: 'no-store' }).then((res) => res.json()).then((st) => {
+          clientFetch('/dsh-tts/stats', { cache: 'no-store', timeoutMs: 8000 }).then((res) => res.json()).then((st) => {
             if (!alive || !st) return
             setTelemetry((prev) => Object.assign({}, prev, {
               cacheHits: st.cacheHits || 0,
@@ -1773,7 +1800,7 @@ window.__ModuleLoader__.load({
           }).catch(() => {
             if (alive) setTelemetry((prev) => Object.assign({}, prev, { online: false }))
           })
-          fetch('/dsh-tts/status', { cache: 'no-store' }).then((res) => res.json()).then((st) => {
+          clientFetch('/dsh-tts/status', { cache: 'no-store', timeoutMs: 8000 }).then((res) => res.json()).then((st) => {
             if (!alive || !st) return
             setTelemetry((prev) => Object.assign({}, prev, {
               sseClients: st.sseClients || 0,
@@ -1804,10 +1831,11 @@ window.__ModuleLoader__.load({
         const value = String(raw != null ? raw : ((keyDrafts && keyDrafts[provider]) || '')).trim()
         if (!value) return
         setErr('')
-        const res = await fetch('/dsh-tts/credential', {
+        const res = await clientFetch('/dsh-tts/credential', {
           method: 'PUT',
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ provider: provider, value: value }),
+          timeoutMs: 10000,
         })
         const data = await res.json().catch(() => ({ /* parse error */ }))
         if (!res.ok) throw new Error((data && data.error && data.error.message) || ('HTTP ' + res.status))
@@ -1818,10 +1846,11 @@ window.__ModuleLoader__.load({
       const clearKey = async (provider) => {
         setErr('')
         try {
-          const res = await fetch('/dsh-tts/credential', {
+          const res = await clientFetch('/dsh-tts/credential', {
             method: 'DELETE',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ provider: provider }),
+            timeoutMs: 10000,
           })
           const data = await res.json().catch(() => ({ /* parse error */ }))
           if (!res.ok) throw new Error((data && data.error && data.error.message) || ('HTTP ' + res.status))
@@ -1843,10 +1872,11 @@ window.__ModuleLoader__.load({
           if (revision !== null && revision !== undefined) {
             bodyPayload.revision = revision
           }
-          const res = await fetch('/dsh-tts/config', {
+          const res = await clientFetch('/dsh-tts/config', {
             method: 'PUT',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(bodyPayload),
+            timeoutMs: 10000,
           })
           const data = await res.json().catch(() => ({ /* parse error */ }))
           if (!res.ok) throw new Error((data && data.error && data.error.message) || ('HTTP ' + res.status))
@@ -1862,7 +1892,7 @@ window.__ModuleLoader__.load({
 
       const clearCacheNow = async () => {
         setErr('')
-        const res = await fetch('/dsh-tts/cache', { method: 'DELETE' })
+        const res = await clientFetch('/dsh-tts/cache', { method: 'DELETE', timeoutMs: 10000 })
         if (!res.ok) throw new Error('HTTP ' + res.status)
         setSaved(true); setTimeout(() => setSaved(false), 2000)
       }

package/lib/routes.js

@@ -495,15 +495,11 @@ export function registerHttpRoutes(ctx, api) {
     },
   }), 'dsh-tts: /speak route')
 
-  ctx.effect(() => registerPluginUpdater(ctx, {
-    endpoint: '/dsh-tts/updater',
-    packageName: '@goodandready/dsh-tts',
-    manifestUrl: new URL('../package.json', import.meta.url),
-  }), 'dsh-tts: updater route /dsh-tts/updater')
-
+  const updaterMutex = { installing: false }
   ctx.effect(() => registerPluginUpdater(ctx, {
     endpoint: '/api/dsh-tts/update',
     packageName: '@goodandready/dsh-tts',
     manifestUrl: new URL('../package.json', import.meta.url),
+    mutex: updaterMutex,
   }), 'dsh-tts: updater route /api/dsh-tts/update')
 }

package/lib/updater.js

@@ -225,7 +225,6 @@ async function installExact(target, packageSpec, options) {
         '--profile',
         target.profileName,
         'add',
-        '--config.minimumReleaseAge=0',
         packageSpec,
         `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
       ],
@@ -268,7 +267,7 @@ function json(response, statusCode, value) {
 }
 
 export function registerPluginUpdater(ctx, options) {
-  let installing = false
+  const mutex = options?.mutex || { installing: false }
   if (typeof ctx?.webServer?.register !== 'function') {
     ctx?.logger?.warn?.('[dsh-tts] webServer service unavailable, updater skipped')
     return () => {}
@@ -298,11 +297,11 @@ export function registerPluginUpdater(ctx, options) {
           json(response, 403, { error: 'Rejected non-local or cross-origin update request.' })
           return
         }
-        if (installing) {
+        if (mutex.installing) {
           json(response, 409, { error: 'This plugin is already updating.' })
           return
         }
-        installing = true
+        mutex.installing = true
         try {
           const before = await status(options, target)
           if (before.latestVersion === undefined) {
@@ -322,7 +321,7 @@ export function registerPluginUpdater(ctx, options) {
         } catch (err) {
           json(response, 503, { error: `Plugin update failed: ${String(err?.message || err)}` })
         } finally {
-          installing = false
+          mutex.installing = false
         }
       } catch (error) {
         ctx?.logger?.warn?.(`[dsh-tts] plugin updater failed: ${String(error)}`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-tts",
-  "version": "0.4.29",
+  "version": "0.4.30",
   "description": "Text-to-speech for DeepSeek Harness: speak agent replies in the Web UI with a provider fallback chain (OpenAI, ElevenLabs, Google, Azure, Groq, Deepgram, OpenRouter, Edge, Piper, eSpeak).",
   "license": "MIT",
   "type": "module",