@goodandready/dsh-usage-guard 0.1.17 → 0.1.19

package/lib/telemetry.js

@@ -124,12 +124,17 @@ export function isTrustedSettingsRequest(request, options = {}) {
   if (referer) {
     try {
       const url = new URL(referer);
-      if (host && url.host.toLowerCase() === host.toLowerCase()) {
-        return true;
+      // Apply strict host matching only to standard web referers (http/https).
+      // Non-http schemes (e.g. dsh-app:// in DSH Desktop Electron forwarder)
+      // fall through to loopback and token verification (#55).
+      if (url.protocol === 'http:' || url.protocol === 'https:') {
+        if (host && url.host.toLowerCase() === host.toLowerCase()) {
+          return true;
+        }
+        return false;
       }
-      return false;
     } catch {
-      return false;
+      // Non-standard or unparseable referers fall through to auth/loopback checks
     }
   }
 

package/lib/updater.js

@@ -174,14 +174,23 @@ export async function getUpdateStatus(options, target = runtime()) {
   };
 }
 
+export function buildInstallArgs(cliEntry, profileName, packageSpec, options = {}) {
+  return [
+    cliEntry, 'plugin', '--profile', profileName, 'add',
+    packageSpec,
+    `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
+  ];
+}
+
 async function installExact(target, packageSpec, options) {
   if (target.cliEntry === undefined) throw new Error('Automatic update is unavailable in this runtime.');
   await new Promise((resolvePromise, reject) => {
-    const child = spawn(process.execPath, [
-      target.cliEntry, 'plugin', '--profile', target.profileName, 'add',
-      '--config.minimumReleaseAge=0', packageSpec,
-      `--registry=${options.registry ?? 'https://registry.npmjs.org/'}`,
-    ], {
+    const child = spawn(process.execPath, buildInstallArgs(
+      target.cliEntry,
+      target.profileName,
+      packageSpec,
+      options,
+    ), {
       cwd: target.profileDir,
       windowsHide: true,
       stdio: ['ignore', 'pipe', 'pipe'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-usage-guard",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Keeps a malformed token-usage sample from taking a whole session history down with it: a missing or non-numeric counter becomes zero before the harness adds it up, so the fold never yields NaN and already-broken sessions open again.",
   "keywords": [
     "deepseek-harness",