dsh-all-usage 1.1.15 → 1.1.17

package/lib/http.js

@@ -57,6 +57,26 @@ if (value === 'localhost') return true
 return isLoopbackAddress(value)
 }
 
+// The DSH desktop shell serves the UI from its own scheme and forwards every
+// request through Electron, which strips Origin (along with Cookie and
+// Sec-Fetch-*) before the host sees it. A write therefore cannot present an
+// Origin at all, and requiring one made every save from the desktop client fail
+// with 403. What actually authorizes a write is the per-apply capability: it is
+// unguessable and unreadable cross-origin (the read endpoints send no CORS
+// headers), and a browser cannot attach it to a form POST. An Origin that is
+// present must still be a trusted one, and the Host must still be loopback so a
+// rebound DNS name cannot reach the API.
+function isTrustedLocalOrigin(origin, hostUrl) {
+  if (origin === 'dsh-app://app' || origin.startsWith('dsh-app://')) return true
+  let originUrl
+  try {
+    originUrl = new URL(origin)
+  } catch (err) {
+    return false
+  }
+  return originUrl.protocol === 'http:' && originUrl.host === hostUrl.host
+}
+
 function isTrustedLocalApiRequest(req, requireOrigin) {
 const remoteAddress = req && req.socket && req.socket.remoteAddress
 if (!isLoopbackAddress(remoteAddress)) return false
@@ -71,13 +91,8 @@ try {
 if (!isLoopbackHostname(hostUrl.hostname)) return false
 if (requestHeader(req, 'sec-fetch-site') === 'cross-site') return false
 const origin = requestHeader(req, 'origin')
-if (origin === undefined) return requireOrigin !== true
-try {
-  const originUrl = new URL(origin)
-  return originUrl.protocol === 'http:' && originUrl.host === hostUrl.host
-} catch (err) {
-  return false
-}
+if (origin === undefined || origin === '') return requireOrigin !== true
+return isTrustedLocalOrigin(origin, hostUrl)
 }
 
 function hasWriteToken(req, expected) {
@@ -211,7 +226,7 @@ export function registerRoutes(host) {
           return
         }
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 256 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null
@@ -232,7 +247,7 @@ export function registerRoutes(host) {
       path: '/api/all-usage/pricing/sync',
       handler: async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         // Backfill iterates the loaded ledger, so wait for it like the pricing
         // POST does; otherwise an early sync answers with an empty backfill.
         await Promise.all([state.pricingReady, state.ledgerReady])
@@ -245,7 +260,7 @@ export function registerRoutes(host) {
       path: '/api/all-usage/pricing/holidays',
       handler: async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 8 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null
@@ -337,7 +352,7 @@ export function registerRoutes(host) {
           res.end()
           return
         }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 16 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null

package/lib/plugin.js

@@ -1,4 +1,5 @@
-import { randomBytes } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
+import { readFileSync } from 'node:fs'
 import { createAggregation } from './aggregation.js'
 import { createBalance } from './balance.js'
 import { registerRoutes } from './http.js'
@@ -8,6 +9,18 @@ import { createSessionSync } from './session-sync.js'
 import { createCostAccumulator, createEmptyPricingState } from './pricing.js'
 
 const name = 'dsh-all-usage'
+// The page is served from this package, so a version mismatch between the
+// running host and the page means DSH is still executing an older plugin (it
+// only imports at startup). Publishing it lets the panel say so instead of
+// leaving the user to guess why a new panel talks to an old payload.
+const pluginVersion = (() => {
+  try {
+    const meta = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+    return typeof meta.version === 'string' ? meta.version : ''
+  } catch (error) {
+    return ''
+  }
+})()
 const inject = ['sessionQuery', 'workspaceRegistry', 'timer', 'sessionPersistence', 'storage', 'webServer']
 
 function apply(ctx) {
@@ -18,6 +31,7 @@ function apply(ctx) {
     webServer: ctx.get('webServer'),
     sessionPersistence: ctx.get('sessionPersistence'),
   }
+  const requestToken = randomBytes(32).toString('base64url')
   const state = {
     wsMeta: new Map(),
     // True once recorded usage from a vanished workspace was moved into the
@@ -52,8 +66,13 @@ function apply(ctx) {
     aliasWriteChain: Promise.resolve(),
     aliasesReady: Promise.resolve(),
     balanceCache: { fetchedAt: 0, payload: null },
-    requestToken: randomBytes(32).toString('base64url'),
+    requestToken,
+    // The status poll must be able to notice that the capability rotated without
+    // being handed the capability itself: this id is derived from the token, so it
+    // changes exactly when the token does and reveals nothing about it.
+    capabilityId: createHash('sha256').update(requestToken).digest('base64url').slice(0, 16),
     instanceId: randomBytes(12).toString('base64url'),
+    pluginVersion,
     statsRevision: 0,
     dataRevision: 0,
     metadataRevision: 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-all-usage",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "description": "DeepSeek Harness usage dashboard with model, provider, workspace, cache, balance, and CSV insights",
   "repository": {
     "type": "git",
@@ -31,8 +31,8 @@
   },
   "dsh": {
     "compatibility": {
-      "runtime": ">=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0 || >=0.1.7-rc.2 <0.1.8-0",
-      "verified": ["0.1.7-rc.2", "0.1.5-rc.2", "0.1.5-rc.1", "0.1.1-rc.2", "0.1.1-rc.1"]
+      "runtime": ">=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0 || >=0.1.7-rc.2 <0.1.8-0 || >=0.2.0-rc.2 <0.2.1-0",
+      "verified": ["0.2.0-rc.2", "0.1.7-rc.2", "0.1.5-rc.2", "0.1.5-rc.1", "0.1.1-rc.2", "0.1.1-rc.1"]
     },
     "bundle": {
       "patch": "./cordis.patch.yml"