@goodandready/dsh-usage-guard 0.1.17 → 0.1.18

package/lib/telemetry.js

@@ -124,12 +124,17 @@ export function isTrustedSettingsRequest(request, options = {}) {
   if (referer) {
     try {
       const url = new URL(referer);
-      if (host && url.host.toLowerCase() === host.toLowerCase()) {
-        return true;
+      // Apply strict host matching only to standard web referers (http/https).
+      // Non-http schemes (e.g. dsh-app:// in DSH Desktop Electron forwarder)
+      // fall through to loopback and token verification (#55).
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) {
+          return true;
+        }
+        return false;
       }
-      return false;
     } catch {
-      return false;
+      // Non-standard or unparseable referers fall through to auth/loopback checks
     }
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-usage-guard",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Keeps a malformed token-usage sample from taking a whole session history down with it: a missing or non-numeric counter becomes zero before the harness adds it up, so the fold never yields NaN and already-broken sessions open again.",
   "keywords": [
     "deepseek-harness",