@goodandready/dsh-usage-guard 0.1.15 → 0.1.17

package/lib/client.js

@@ -52,6 +52,7 @@ window.__ModuleLoader__.load({
       updater_up_to_date: 'Plugin is up to date',
       updater_failed: 'Update check failed',
       updater_success: 'Update successful. Please reload page.',
+      request_timeout: 'Request timed out (15s)',
     };
 
     const zh = {
@@ -97,6 +98,7 @@ window.__ModuleLoader__.load({
       updater_up_to_date: '已是最新版本',
       updater_failed: '检查更新失败',
       updater_success: '更新成功，请刷新页面。',
+      request_timeout: '请求超时（15秒）',
     };
 
     function getActiveLocale(c) {
@@ -248,16 +250,18 @@ window.__ModuleLoader__.load({
           const res = await fetch('/api/dsh-usage-guard/telemetry', {
             headers: { accept: 'application/json' },
             cache: 'no-store',
+            signal: AbortSignal.timeout(15000),
           });
           if (!res.ok) throw new Error(`HTTP ${res.status}`);
           const data = await res.json();
           setTelemetry(data);
         } catch (e) {
-          setErr(e?.message || String(e));
+          const isTimeout = e?.name === 'TimeoutError' || e?.name === 'AbortError';
+          setErr(isTimeout ? t('request_timeout') : (e?.message || String(e)));
         } finally {
           setLoading(false);
         }
-      }, []);
+      }, [t]);
 
       React.useEffect(() => {
         fetchTelemetry();
@@ -341,12 +345,15 @@ window.__ModuleLoader__.load({
           const res = await fetch('/api/dsh-usage-guard/update', {
             headers: { accept: 'application/json' },
             cache: 'no-store',
+            signal: AbortSignal.timeout(15000),
           });
           if (!res.ok) throw new Error(`HTTP ${res.status}`);
           const data = await res.json();
           setStatus(data);
         } catch (e) {
-          setFeedback({ text: `${t('updater_failed')}: ${e?.message || String(e)}`, ok: false });
+          const isTimeout = e?.name === 'TimeoutError' || e?.name === 'AbortError';
+          const msg = isTimeout ? t('request_timeout') : (e?.message || String(e));
+          setFeedback({ text: `${t('updater_failed')}: ${msg}`, ok: false });
         } finally {
           setLoading(false);
         }
@@ -362,13 +369,16 @@ window.__ModuleLoader__.load({
               'x-dsh-plugin-update': '1',
               'content-type': 'application/json',
             },
+            signal: AbortSignal.timeout(15000),
           });
           const data = await res.json();
           if (!res.ok) throw new Error(data?.error || `HTTP ${res.status}`);
           setStatus(data);
           setFeedback({ text: t('updater_success'), ok: true });
         } catch (e) {
-          setFeedback({ text: e?.message || String(e), ok: false });
+          const isTimeout = e?.name === 'TimeoutError' || e?.name === 'AbortError';
+          const msg = isTimeout ? t('request_timeout') : (e?.message || String(e));
+          setFeedback({ text: msg, ok: false });
         } finally {
           setUpdating(false);
         }

package/lib/index.js

@@ -25,69 +25,83 @@ export const Config = z.object({
   repair: z
     .boolean()
     .default(true)
+    .volatile()
     .description('Replace a missing or non-numeric token counter with zero before the harness adds it up. '
       + 'Off means reporting only: the counters reach the fold as they came, and a broken sample keeps the '
       + 'session history unreadable.'),
   report: z
     .boolean()
     .default(true)
+    .volatile()
     .description('Log a line naming the turn, the step and the raw sample whenever a damaged one arrives. '
       + 'Each turn, step and field set is reported once, not once per replay.'),
   maxStepTokens: z
     .natural()
     .default(0)
+    .volatile()
     .description('Maximum allowed token count for a single turn step. Spikes exceeding this ceiling are clamped to prevent integer overflow and runaway stats. Set to 0 to disable.'),
 })
 
+export function plainConfig(val) {
+  if (!val || typeof val !== 'object') return val
+  if (typeof val.get === 'function') return plainConfig(val.get())
+  const out = Array.isArray(val) ? [] : {}
+  for (const [k, v] of Object.entries(val)) out[k] = plainConfig(v)
+  return out
+}
+
 export function apply(ctx, config) {
   let live
   try {
-    live = Config(structuredClone(config ?? {})) ?? config
+    const plain = plainConfig(config ?? {})
+    live = plainConfig(Config(plain)) ?? plain
   } catch (_) {
     live = Config({}) ?? { repair: true, report: true, maxStepTokens: 0 }
   }
 
-  ctx.inject(['settings'], (sctx) => {
+  let settingsSvc = null
+  const readLive = () => {
     try {
-      const scope = sctx.settings?.register?.(NS, Config, { base: config })
-      if (!scope) {
-        const msg = `[dsh-usage-guard] settings service register() unavailable; running with default config`
-        if (typeof sctx.logger?.warn === 'function') sctx.logger.warn(msg)
-        else if (typeof ctx.logger?.warn === 'function') ctx.logger.warn(msg)
-        return
+      const row = settingsSvc?.describe?.()?.find?.((r) => r?.ns === NS)
+      if (row?.value) {
+        return plainConfig(Config(plainConfig(row.value)))
       }
-
-      if (typeof scope.get === 'function') {
-        try {
-          const fresh = scope.get()
-          if (fresh && typeof fresh === 'object') live = fresh
-        } catch (readErr) {
-          const msg = `[dsh-usage-guard] failed to read current settings: ${readErr?.message || readErr}; running with initial config`
-          if (typeof sctx.logger?.warn === 'function') sctx.logger.warn(msg)
-          else if (typeof ctx.logger?.warn === 'function') ctx.logger.warn(msg)
-        }
-      } else {
-        const msg = `[dsh-usage-guard] settings scope has no get() method; running with default config`
-        if (typeof sctx.logger?.warn === 'function') sctx.logger.warn(msg)
-        else if (typeof ctx.logger?.warn === 'function') ctx.logger.warn(msg)
+    } catch (describeErr) {
+      if (typeof ctx.logger?.debug === 'function') {
+        ctx.logger.debug('[dsh-usage-guard] failed to read settings via describe():', describeErr)
       }
-
-      if (typeof scope.watch === 'function') {
-        sctx.effect(() => scope.watch((next) => {
-          if (next && typeof next === 'object') live = next
-        }))
-      } else {
-        const msg = `[dsh-usage-guard] settings scope has no watch() method; running with default config without live update subscription`
-        if (typeof sctx.logger?.warn === 'function') sctx.logger.warn(msg)
-        else if (typeof ctx.logger?.warn === 'function') ctx.logger.warn(msg)
+    }
+    try {
+      return plainConfig(Config(plainConfig(config)))
+    } catch (configErr) {
+      if (typeof ctx.logger?.debug === 'function') {
+        ctx.logger.debug('[dsh-usage-guard] failed to derive config from base:', configErr)
       }
-    } catch (err) {
-      const msg = `[dsh-usage-guard] failed to register settings subscription: ${err?.message || err}; running with default config`
-      if (typeof sctx.logger?.warn === 'function') sctx.logger.warn(msg)
-      else if (typeof ctx.logger?.warn === 'function') ctx.logger.warn(msg)
+      return live
     }
+  }
+
+  ctx.inject(['settings'], (sctx) => {
+    settingsSvc = sctx.settings ?? (typeof sctx.get === 'function' ? sctx.get('settings') : null) ?? null
+    const fresh = readLive()
+    if (fresh) live = fresh
   })
 
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => {
+      const onVolatileUpdate = () => {
+        const fresh = readLive()
+        if (fresh) live = fresh
+      }
+      ctx.on?.('loader/volatile-update', onVolatileUpdate)
+      ctx.on?.('settings/document-updated', onVolatileUpdate)
+      return () => {
+        ctx.off?.('loader/volatile-update', onVolatileUpdate)
+        ctx.off?.('settings/document-updated', onVolatileUpdate)
+      }
+    }, 'dsh-usage-guard: volatile-update')
+  }
+
   // Register one-click updater and telemetry endpoints if webServer is available
   ctx.inject(['webServer'], (wctx) => {
     try {
@@ -156,8 +170,6 @@ export function apply(ctx, config) {
         badFields: bad,
         fixedTokenCount: fixedTokensCount,
         clamped: clampedAny,
-        provider: event?.provider ?? event?.data?.provider ?? 'unknown',
-        sample: found.usage,
       })
 
       if (live && live.report !== false) {

package/lib/telemetry.js

@@ -11,7 +11,7 @@ class UsageGuardTelemetry {
     this.recentIncidents = [];
   }
 
-  recordIncident({ turn = 0, step = 0, badFields = [], fixedTokenCount = 0, clamped = false, provider = 'unknown', sample = null, kind = 'malformed-usage', target = '' } = {}) {
+  recordIncident({ turn = 0, step = 0, badFields = [], fixedTokenCount = 0, clamped = false, kind = 'malformed-usage', target = '' } = {}) {
     this.rescuedEvents += 1;
     this.fixedTokens += Number(fixedTokenCount) || 0;
     if (clamped) {
@@ -26,8 +26,6 @@ class UsageGuardTelemetry {
       target: String(target || (Array.isArray(badFields) ? badFields.join(',') : '')),
       fields: Array.isArray(badFields) ? badFields : [],
       clamped: Boolean(clamped),
-      provider: typeof provider === 'string' ? provider : 'unknown',
-      sample: sample && typeof sample === 'object' ? JSON.stringify(sample).slice(0, 300) : null,
     };
 
     this.lastIncident = incident;
@@ -85,8 +83,91 @@ export function getSnapshot() {
   return telemetry.getSnapshot();
 }
 
-export function resetTelemetry() {
-  telemetry.reset();
+
+function header(request, name) {
+  const value = request?.headers?.[name.toLowerCase()];
+  return Array.isArray(value) ? value[0] : value;
+}
+
+function isLoopbackAddress(value) {
+  const address = String(value || '').toLowerCase().replace(/^[[\]]/g, '');
+  return address === 'localhost' || address === 'localhost.' || address === '::1'
+    || address.startsWith('127.')
+    || address.startsWith('::ffff:127.');
+}
+
+/** Reject cross-site and unauthenticated requests while allowing same-origin and local callers. */
+export function isTrustedSettingsRequest(request, options = {}) {
+  if (!request || typeof request !== 'object' || !request.headers) return false;
+
+  const secFetchSite = header(request, 'sec-fetch-site');
+  // Unconditionally reject cross-site and same-site requests (#51)
+  if (secFetchSite === 'cross-site' || secFetchSite === 'same-site') {
+    return false;
+  }
+
+  const host = header(request, 'x-forwarded-host') || header(request, 'host');
+  const origin = header(request, 'origin');
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  const referer = header(request, 'referer');
+  if (referer) {
+    try {
+      const url = new URL(referer);
+      if (host && url.host.toLowerCase() === host.toLowerCase()) {
+        return true;
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  // Check Bearer token or custom auth header
+  const expectedToken = options.expectedToken
+    || (typeof process !== 'undefined' ? (process.env?.DSH_AUTH_TOKEN || process.env?.DSH_TOKEN) : null);
+
+  const auth = header(request, 'authorization');
+  if (typeof auth === 'string' && auth.startsWith('Bearer ')) {
+    const bearer = auth.slice(7).trim();
+    if (expectedToken && bearer && bearer === expectedToken) {
+      return true;
+    }
+  }
+
+  const customAuth = header(request, 'x-dsh-auth');
+  if (expectedToken && customAuth && customAuth === expectedToken) {
+    return true;
+  }
+
+  // Check cookie authentication
+  const cookie = header(request, 'cookie');
+  if (typeof cookie === 'string' && expectedToken) {
+    const match = cookie.match(/(?:^|;\s*)(?:token|dsh-auth|dsh_token)=([^;]+)/);
+    if (match && match[1] === expectedToken) {
+      return true;
+    }
+  }
+
+  // Loopback connection (curl, local process)
+  if (isLoopbackAddress(request?.socket?.remoteAddress)) {
+    if (secFetchSite && secFetchSite !== 'same-origin') {
+      return false;
+    }
+    return true;
+  }
+
+  return false;
 }
 
 export function registerTelemetryRoute(ctx, options = {}) {
@@ -100,6 +181,14 @@ export function registerTelemetryRoute(ctx, options = {}) {
         response.end();
         return;
       }
+      if (!isTrustedSettingsRequest(request, options)) {
+        response.writeHead(403, {
+          'content-type': 'application/json; charset=utf-8',
+          'cache-control': 'no-store',
+        });
+        response.end(request.method === 'HEAD' ? undefined : JSON.stringify({ error: 'Forbidden: untrusted or cross-site request' }));
+        return;
+      }
       const snapshot = telemetry.getSnapshot();
       response.writeHead(200, {
         'content-type': 'application/json; charset=utf-8',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-usage-guard",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Keeps a malformed token-usage sample from taking a whole session history down with it: a missing or non-numeric counter becomes zero before the harness adds it up, so the fold never yields NaN and already-broken sessions open again.",
   "keywords": [
     "deepseek-harness",