dsh-all-usage 1.1.16 → 1.1.18

package/lib/http.js

@@ -57,6 +57,26 @@ if (value === 'localhost') return true
 return isLoopbackAddress(value)
 }
 
+// The DSH desktop shell serves the UI from its own scheme and forwards every
+// request through Electron, which strips Origin (along with Cookie and
+// Sec-Fetch-*) before the host sees it. A write therefore cannot present an
+// Origin at all, and requiring one made every save from the desktop client fail
+// with 403. What actually authorizes a write is the per-apply capability: it is
+// unguessable and unreadable cross-origin (the read endpoints send no CORS
+// headers), and a browser cannot attach it to a form POST. An Origin that is
+// present must still be a trusted one, and the Host must still be loopback so a
+// rebound DNS name cannot reach the API.
+function isTrustedLocalOrigin(origin, hostUrl) {
+  if (origin === 'dsh-app://app' || origin.startsWith('dsh-app://')) return true
+  let originUrl
+  try {
+    originUrl = new URL(origin)
+  } catch (err) {
+    return false
+  }
+  return originUrl.protocol === 'http:' && originUrl.host === hostUrl.host
+}
+
 function isTrustedLocalApiRequest(req, requireOrigin) {
 const remoteAddress = req && req.socket && req.socket.remoteAddress
 if (!isLoopbackAddress(remoteAddress)) return false
@@ -71,13 +91,8 @@ try {
 if (!isLoopbackHostname(hostUrl.hostname)) return false
 if (requestHeader(req, 'sec-fetch-site') === 'cross-site') return false
 const origin = requestHeader(req, 'origin')
-if (origin === undefined) return requireOrigin !== true
-try {
-  const originUrl = new URL(origin)
-  return originUrl.protocol === 'http:' && originUrl.host === hostUrl.host
-} catch (err) {
-  return false
-}
+if (origin === undefined || origin === '') return requireOrigin !== true
+return isTrustedLocalOrigin(origin, hostUrl)
 }
 
 function hasWriteToken(req, expected) {
@@ -211,7 +226,7 @@ export function registerRoutes(host) {
           return
         }
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 256 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null
@@ -232,7 +247,7 @@ export function registerRoutes(host) {
       path: '/api/all-usage/pricing/sync',
       handler: async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         // Backfill iterates the loaded ledger, so wait for it like the pricing
         // POST does; otherwise an early sync answers with an empty backfill.
         await Promise.all([state.pricingReady, state.ledgerReady])
@@ -245,7 +260,7 @@ export function registerRoutes(host) {
       path: '/api/all-usage/pricing/holidays',
       handler: async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 8 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null
@@ -313,6 +328,21 @@ export function registerRoutes(host) {
         sendJson(res, 200, snapshot())
       },
     }))
+    ctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/api/all-usage/version',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') { res.statusCode = 405; res.end(); return }
+        if (!isTrustedLocalApiRequest(req, false)) { rejectRequest(res); return }
+        let force = false
+        try {
+          force = new URL(req.url ?? '/', 'http://x').searchParams.get('force') === '1'
+        } catch (err) { /* default */ }
+        // The host caches the answer, so a dashboard left open does not hammer the
+        // registry; force=1 only comes from the refresh button.
+        sendJson(res, 200, await host.versionCheck.read(force))
+      },
+    }))
     ctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/api/all-usage/balance',
@@ -337,7 +367,7 @@ export function registerRoutes(host) {
           res.end()
           return
         }
-        if (!isTrustedLocalApiRequest(req, true) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
+        if (!isTrustedLocalApiRequest(req, false) || !hasWriteToken(req, state.requestToken)) { rejectRequest(res); return }
         const body = await readBody(req, 16 * 1024)
         if (body.tooLarge) { sendJson(res, 413, { ok: false, message: 'request-too-large' }); return }
         let args = null

package/lib/plugin.js

@@ -1,4 +1,5 @@
-import { randomBytes } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
+import { readFileSync } from 'node:fs'
 import { createAggregation } from './aggregation.js'
 import { createBalance } from './balance.js'
 import { registerRoutes } from './http.js'
@@ -6,8 +7,21 @@ import { RETIRED_WORKSPACE_ID, createLedger } from './ledger.js'
 import { createPricingRuntime } from './pricing-runtime.js'
 import { createSessionSync } from './session-sync.js'
 import { createCostAccumulator, createEmptyPricingState } from './pricing.js'
+import { createVersionCheck } from './version-check.js'
 
 const name = 'dsh-all-usage'
+// The page is served from this package, so a version mismatch between the
+// running host and the page means DSH is still executing an older plugin (it
+// only imports at startup). Publishing it lets the panel say so instead of
+// leaving the user to guess why a new panel talks to an old payload.
+const pluginVersion = (() => {
+  try {
+    const meta = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'))
+    return typeof meta.version === 'string' ? meta.version : ''
+  } catch (error) {
+    return ''
+  }
+})()
 const inject = ['sessionQuery', 'workspaceRegistry', 'timer', 'sessionPersistence', 'storage', 'webServer']
 
 function apply(ctx) {
@@ -18,6 +32,7 @@ function apply(ctx) {
     webServer: ctx.get('webServer'),
     sessionPersistence: ctx.get('sessionPersistence'),
   }
+  const requestToken = randomBytes(32).toString('base64url')
   const state = {
     wsMeta: new Map(),
     // True once recorded usage from a vanished workspace was moved into the
@@ -52,8 +67,13 @@ function apply(ctx) {
     aliasWriteChain: Promise.resolve(),
     aliasesReady: Promise.resolve(),
     balanceCache: { fetchedAt: 0, payload: null },
-    requestToken: randomBytes(32).toString('base64url'),
+    requestToken,
+    // The status poll must be able to notice that the capability rotated without
+    // being handed the capability itself: this id is derived from the token, so it
+    // changes exactly when the token does and reveals nothing about it.
+    capabilityId: createHash('sha256').update(requestToken).digest('base64url').slice(0, 16),
     instanceId: randomBytes(12).toString('base64url'),
+    pluginVersion,
     statsRevision: 0,
     dataRevision: 0,
     metadataRevision: 0,
@@ -202,6 +222,9 @@ function apply(ctx) {
   host.pricing = createPricingRuntime(host)
   host.balance = createBalance(host)
   host.sessionSync = createSessionSync(host)
+  // The header asks the host for this, so the page never talks to the registry
+  // itself (the desktop shell would not allow it) and the answer is cached here.
+  host.versionCheck = createVersionCheck({ currentVersion: pluginVersion })
 
   async function loadAliases() {
     const storage = services.storage

package/lib/version-check.js

@@ -0,0 +1,133 @@
+// Version check for the dashboard header. The running version is known locally;
+// this only asks the npm registry for the newest published one, at most once per
+// TTL and only while a dashboard is open (the page asks for it, the host never
+// polls on its own). A plain GET of a small JSON document, no body, no cookies.
+const VERSION_CHECK_URL = 'https://registry.npmjs.org/dsh-all-usage/latest'
+const VERSION_CHECK_TTL_MS = 6 * 60 * 60 * 1000
+const VERSION_CHECK_TIMEOUT_MS = 8000
+// The route is a plain local read (like /api/all-usage/status it needs no
+// capability), so this floor is what keeps one page - or a hostile local page -
+// from turning a burst of requests into a burst of registry requests.
+const VERSION_CHECK_MIN_INTERVAL_MS = 30 * 1000
+const MAX_VERSION_BYTES = 64 * 1024
+
+function parseVersion(text) {
+  const value = String(text === undefined || text === null ? '' : text).trim().replace(/^v/, '')
+  const match = value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/)
+  if (match === null) return null
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] === undefined ? null : match[4].split('.'),
+  }
+}
+
+/**
+ * Compare two dotted versions the way semver orders them: numeric parts first,
+ * then a prerelease ranks below its release and numeric identifiers rank below
+ * alphanumeric ones ('1.1.18-rc.1' < '1.1.18' < '1.1.19'). Returns -1, 0 or 1,
+ * and 0 for anything unparseable so a malformed tag never claims an update.
+ */
+export function compareVersions(left, right) {
+  const a = parseVersion(left)
+  const b = parseVersion(right)
+  if (a === null || b === null) return 0
+  for (const key of ['major', 'minor', 'patch']) {
+    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1
+  }
+  if (a.prerelease === null && b.prerelease === null) return 0
+  if (a.prerelease === null) return 1
+  if (b.prerelease === null) return -1
+  const length = Math.max(a.prerelease.length, b.prerelease.length)
+  for (let index = 0; index < length; index += 1) {
+    const leftPart = a.prerelease[index]
+    const rightPart = b.prerelease[index]
+    if (leftPart === undefined) return -1
+    if (rightPart === undefined) return 1
+    if (leftPart === rightPart) continue
+    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null
+    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null
+    if (leftNumber !== null && rightNumber !== null) return leftNumber < rightNumber ? -1 : 1
+    if (leftNumber !== null) return -1
+    if (rightNumber !== null) return 1
+    return leftPart < rightPart ? -1 : 1
+  }
+  return 0
+}
+
+/** 'latest' when the running version is at least the published one, else 'outdated'. */
+export function versionStatus(current, latest) {
+  if (typeof current !== 'string' || current === '') return 'unknown'
+  if (typeof latest !== 'string' || latest === '') return 'unknown'
+  if (parseVersion(current) === null || parseVersion(latest) === null) return 'unknown'
+  return compareVersions(current, latest) < 0 ? 'outdated' : 'latest'
+}
+
+export async function fetchLatestVersion(fetchImpl = globalThis.fetch, options = {}) {
+  if (typeof fetchImpl !== 'function') return { ok: false, error: 'fetch-unavailable' }
+  const url = typeof options.url === 'string' && options.url !== '' ? options.url : VERSION_CHECK_URL
+  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : VERSION_CHECK_TIMEOUT_MS
+  let controller = null
+  let timer = null
+  try {
+    if (typeof AbortController === 'function') {
+      controller = new AbortController()
+      timer = setTimeout(() => controller.abort(), timeoutMs)
+    }
+    const response = await fetchImpl(url, { headers: { accept: 'application/json' }, signal: controller ? controller.signal : undefined })
+    if (!response || response.ok !== true) return { ok: false, error: 'http-' + String((response && response.status) || 0) }
+    const text = await response.text()
+    if (new TextEncoder().encode(text).length > MAX_VERSION_BYTES) return { ok: false, error: 'version-too-large' }
+    let parsed = null
+    try { parsed = JSON.parse(text.replace(/^\uFEFF/, '')) } catch (err) { return { ok: false, error: 'version-invalid-json' } }
+    const version = parsed !== null && typeof parsed === 'object' && typeof parsed.version === 'string' ? parsed.version.trim() : ''
+    if (parseVersion(version) === null) return { ok: false, error: 'version-invalid' }
+    return { ok: true, version, sourceUrl: url, fetchedAt: Date.now() }
+  } catch (err) {
+    return { ok: false, error: 'version-fetch-failed' }
+  } finally {
+    if (timer !== null) clearTimeout(timer)
+  }
+}
+
+export function createVersionCheck(options = {}) {
+  const fetchImpl = options.fetchImpl === undefined ? globalThis.fetch : options.fetchImpl
+  const currentVersion = typeof options.currentVersion === 'string' ? options.currentVersion : ''
+  const ttlMs = Number.isFinite(options.ttlMs) && options.ttlMs > 0 ? options.ttlMs : VERSION_CHECK_TTL_MS
+  const minIntervalMs = Number.isFinite(options.minIntervalMs) && options.minIntervalMs >= 0 ? options.minIntervalMs : VERSION_CHECK_MIN_INTERVAL_MS
+  let entry = null
+  let failure = null
+  let lastAttemptAt = 0
+  function snapshot(cached) {
+    return {
+      current: currentVersion,
+      latest: entry === null ? null : entry.version,
+      status: entry === null ? 'unknown' : versionStatus(currentVersion, entry.version),
+      checkedAt: entry === null ? null : entry.fetchedAt,
+      sourceUrl: entry === null ? VERSION_CHECK_URL : entry.sourceUrl,
+      error: failure === null ? null : failure.error,
+      cached: cached === true,
+    }
+  }
+  /** Read the cached verdict, or ask the registry again when it is stale or forced. */
+  async function read(force) {
+    const now = Date.now()
+    if (!force && entry !== null && now - entry.fetchedAt < ttlMs) return snapshot(true)
+    // A forced read still waits out the floor: force comes from the refresh button,
+    // and no human needs a second registry round trip inside the same half minute.
+    if (lastAttemptAt > 0 && now - lastAttemptAt < minIntervalMs) return snapshot(false)
+    lastAttemptAt = now
+    const result = await fetchLatestVersion(fetchImpl, options)
+    if (result.ok) {
+      entry = { version: result.version, fetchedAt: result.fetchedAt, sourceUrl: result.sourceUrl }
+      failure = null
+    } else {
+      failure = { error: result.error, failedAt: Date.now() }
+    }
+    return snapshot(false)
+  }
+  return { read, snapshot: () => snapshot(true), currentVersion }
+}
+
+export { VERSION_CHECK_MIN_INTERVAL_MS, VERSION_CHECK_TTL_MS, VERSION_CHECK_URL }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-all-usage",
-  "version": "1.1.16",
+  "version": "1.1.18",
   "description": "DeepSeek Harness usage dashboard with model, provider, workspace, cache, balance, and CSV insights",
   "repository": {
     "type": "git",
@@ -58,6 +58,7 @@
     "lib/client.js",
     "lib/pricing.js",
     "lib/usage-core.js",
+    "lib/version-check.js",
     "CHANGELOG.md",
     "cordis.patch.yml",
     "screenshots.json",