@goodandready/dsh-usage-guard 0.1.15 → 0.1.16

package/lib/index.js

@@ -156,8 +156,6 @@ export function apply(ctx, config) {
         badFields: bad,
         fixedTokenCount: fixedTokensCount,
         clamped: clampedAny,
-        provider: event?.provider ?? event?.data?.provider ?? 'unknown',
-        sample: found.usage,
       })
 
       if (live && live.report !== false) {

package/lib/telemetry.js

@@ -11,7 +11,7 @@ class UsageGuardTelemetry {
     this.recentIncidents = [];
   }
 
-  recordIncident({ turn = 0, step = 0, badFields = [], fixedTokenCount = 0, clamped = false, provider = 'unknown', sample = null, kind = 'malformed-usage', target = '' } = {}) {
+  recordIncident({ turn = 0, step = 0, badFields = [], fixedTokenCount = 0, clamped = false, kind = 'malformed-usage', target = '' } = {}) {
     this.rescuedEvents += 1;
     this.fixedTokens += Number(fixedTokenCount) || 0;
     if (clamped) {
@@ -26,8 +26,6 @@ class UsageGuardTelemetry {
       target: String(target || (Array.isArray(badFields) ? badFields.join(',') : '')),
       fields: Array.isArray(badFields) ? badFields : [],
       clamped: Boolean(clamped),
-      provider: typeof provider === 'string' ? provider : 'unknown',
-      sample: sample && typeof sample === 'object' ? JSON.stringify(sample).slice(0, 300) : null,
     };
 
     this.lastIncident = incident;
@@ -89,6 +87,100 @@ export function resetTelemetry() {
   telemetry.reset();
 }
 
+function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^[[\]]/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.');
+}
+
+/** Reject cross-site and unauthenticated requests while allowing same-origin and local callers. */
+export function isTrustedSettingsRequest(request, options = {}) {
+  if (!request || typeof request !== 'object' || !request.headers) return false;
+
+  const secFetchSite = header(request, 'sec-fetch-site');
+  // Unconditionally reject cross-site requests
+  if (secFetchSite === 'cross-site') {
+    return false;
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host');
+  const origin = header(request, 'origin');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  const referer = header(request, 'referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      if (isLoopbackAddress(url.hostname) && isLoopbackAddress(request?.socket?.remoteAddress)) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  // Check Bearer token or custom auth header
+  const expectedToken = options.expectedToken
+    || (typeof process !== 'undefined' ? (process.env?.DSH_AUTH_TOKEN || process.env?.DSH_TOKEN) : null);
+
+  const auth = header(request, 'authorization');
+  if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+    const bearer = auth.slice(7).trim();
+    if (expectedToken && bearer && bearer === expectedToken) {
+      return true;
+    }
+  }
+
+  const customAuth = header(request, 'x-dsh-auth');
+  if (expectedToken && customAuth && customAuth === expectedToken) {
+    return true;
+  }
+
+  // Check cookie authentication
+  const cookie = header(request, 'cookie');
+  if (typeof cookie === 'string' && expectedToken) {
+    const match = cookie.match(/(?:^|;\s*)(?:token|dsh-auth|dsh_token)=([^;]+)/);
+    if (match && match[1] === expectedToken) {
+      return true;
+    }
+  }
+
+  // Same-origin or same-site fetch
+  if (secFetchSite === 'same-origin' || secFetchSite === 'same-site') {
+    return true;
+  }
+
+  // Loopback connection (curl, local process)
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    return true;
+  }
+
+  return false;
+}
+
 export function registerTelemetryRoute(ctx, options = {}) {
   const endpoint = options.endpoint || '/api/dsh-usage-guard/telemetry';
   return ctx.webServer.register({
@@ -100,6 +192,14 @@ export function registerTelemetryRoute(ctx, options = {}) {
         response.end();
         return;
       }
+      if (!isTrustedSettingsRequest(request, options)) {
+        response.writeHead(403, {
+          'content-type': 'application/json; charset=utf-8',
+          'cache-control': 'no-store',
+        });
+        response.end(request.method === 'HEAD' ? undefined : JSON.stringify({ error: 'Forbidden: untrusted or cross-site request' }));
+        return;
+      }
       const snapshot = telemetry.getSnapshot();
       response.writeHead(200, {
         'content-type': 'application/json; charset=utf-8',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-usage-guard",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Keeps a malformed token-usage sample from taking a whole session history down with it: a missing or non-numeric counter becomes zero before the harness adds it up, so the fold never yields NaN and already-broken sessions open again.",
   "keywords": [
     "deepseek-harness",