dsh-all-usage 1.1.17 → 1.1.18

package/lib/http.js

@@ -328,6 +328,21 @@ export function registerRoutes(host) {
         sendJson(res, 200, snapshot())
       },
     }))
+    ctx.effect(() => webServer.register({
+      kind: 'exact',
+      path: '/api/all-usage/version',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') { res.statusCode = 405; res.end(); return }
+        if (!isTrustedLocalApiRequest(req, false)) { rejectRequest(res); return }
+        let force = false
+        try {
+          force = new URL(req.url ?? '/', 'http://x').searchParams.get('force') === '1'
+        } catch (err) { /* default */ }
+        // The host caches the answer, so a dashboard left open does not hammer the
+        // registry; force=1 only comes from the refresh button.
+        sendJson(res, 200, await host.versionCheck.read(force))
+      },
+    }))
     ctx.effect(() => webServer.register({
       kind: 'exact',
       path: '/api/all-usage/balance',

package/lib/plugin.js

@@ -7,6 +7,7 @@ import { RETIRED_WORKSPACE_ID, createLedger } from './ledger.js'
 import { createPricingRuntime } from './pricing-runtime.js'
 import { createSessionSync } from './session-sync.js'
 import { createCostAccumulator, createEmptyPricingState } from './pricing.js'
+import { createVersionCheck } from './version-check.js'
 
 const name = 'dsh-all-usage'
 // The page is served from this package, so a version mismatch between the
@@ -221,6 +222,9 @@ function apply(ctx) {
   host.pricing = createPricingRuntime(host)
   host.balance = createBalance(host)
   host.sessionSync = createSessionSync(host)
+  // The header asks the host for this, so the page never talks to the registry
+  // itself (the desktop shell would not allow it) and the answer is cached here.
+  host.versionCheck = createVersionCheck({ currentVersion: pluginVersion })
 
   async function loadAliases() {
     const storage = services.storage

package/lib/version-check.js

@@ -0,0 +1,133 @@
+// Version check for the dashboard header. The running version is known locally;
+// this only asks the npm registry for the newest published one, at most once per
+// TTL and only while a dashboard is open (the page asks for it, the host never
+// polls on its own). A plain GET of a small JSON document, no body, no cookies.
+const VERSION_CHECK_URL = 'https://registry.npmjs.org/dsh-all-usage/latest'
+const VERSION_CHECK_TTL_MS = 6 * 60 * 60 * 1000
+const VERSION_CHECK_TIMEOUT_MS = 8000
+// The route is a plain local read (like /api/all-usage/status it needs no
+// capability), so this floor is what keeps one page - or a hostile local page -
+// from turning a burst of requests into a burst of registry requests.
+const VERSION_CHECK_MIN_INTERVAL_MS = 30 * 1000
+const MAX_VERSION_BYTES = 64 * 1024
+
+function parseVersion(text) {
+  const value = String(text === undefined || text === null ? '' : text).trim().replace(/^v/, '')
+  const match = value.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/)
+  if (match === null) return null
+  return {
+    major: Number(match[1]),
+    minor: Number(match[2]),
+    patch: Number(match[3]),
+    prerelease: match[4] === undefined ? null : match[4].split('.'),
+  }
+}
+
+/**
+ * Compare two dotted versions the way semver orders them: numeric parts first,
+ * then a prerelease ranks below its release and numeric identifiers rank below
+ * alphanumeric ones ('1.1.18-rc.1' < '1.1.18' < '1.1.19'). Returns -1, 0 or 1,
+ * and 0 for anything unparseable so a malformed tag never claims an update.
+ */
+export function compareVersions(left, right) {
+  const a = parseVersion(left)
+  const b = parseVersion(right)
+  if (a === null || b === null) return 0
+  for (const key of ['major', 'minor', 'patch']) {
+    if (a[key] !== b[key]) return a[key] < b[key] ? -1 : 1
+  }
+  if (a.prerelease === null && b.prerelease === null) return 0
+  if (a.prerelease === null) return 1
+  if (b.prerelease === null) return -1
+  const length = Math.max(a.prerelease.length, b.prerelease.length)
+  for (let index = 0; index < length; index += 1) {
+    const leftPart = a.prerelease[index]
+    const rightPart = b.prerelease[index]
+    if (leftPart === undefined) return -1
+    if (rightPart === undefined) return 1
+    if (leftPart === rightPart) continue
+    const leftNumber = /^\d+$/.test(leftPart) ? Number(leftPart) : null
+    const rightNumber = /^\d+$/.test(rightPart) ? Number(rightPart) : null
+    if (leftNumber !== null && rightNumber !== null) return leftNumber < rightNumber ? -1 : 1
+    if (leftNumber !== null) return -1
+    if (rightNumber !== null) return 1
+    return leftPart < rightPart ? -1 : 1
+  }
+  return 0
+}
+
+/** 'latest' when the running version is at least the published one, else 'outdated'. */
+export function versionStatus(current, latest) {
+  if (typeof current !== 'string' || current === '') return 'unknown'
+  if (typeof latest !== 'string' || latest === '') return 'unknown'
+  if (parseVersion(current) === null || parseVersion(latest) === null) return 'unknown'
+  return compareVersions(current, latest) < 0 ? 'outdated' : 'latest'
+}
+
+export async function fetchLatestVersion(fetchImpl = globalThis.fetch, options = {}) {
+  if (typeof fetchImpl !== 'function') return { ok: false, error: 'fetch-unavailable' }
+  const url = typeof options.url === 'string' && options.url !== '' ? options.url : VERSION_CHECK_URL
+  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : VERSION_CHECK_TIMEOUT_MS
+  let controller = null
+  let timer = null
+  try {
+    if (typeof AbortController === 'function') {
+      controller = new AbortController()
+      timer = setTimeout(() => controller.abort(), timeoutMs)
+    }
+    const response = await fetchImpl(url, { headers: { accept: 'application/json' }, signal: controller ? controller.signal : undefined })
+    if (!response || response.ok !== true) return { ok: false, error: 'http-' + String((response && response.status) || 0) }
+    const text = await response.text()
+    if (new TextEncoder().encode(text).length > MAX_VERSION_BYTES) return { ok: false, error: 'version-too-large' }
+    let parsed = null
+    try { parsed = JSON.parse(text.replace(/^\uFEFF/, '')) } catch (err) { return { ok: false, error: 'version-invalid-json' } }
+    const version = parsed !== null && typeof parsed === 'object' && typeof parsed.version === 'string' ? parsed.version.trim() : ''
+    if (parseVersion(version) === null) return { ok: false, error: 'version-invalid' }
+    return { ok: true, version, sourceUrl: url, fetchedAt: Date.now() }
+  } catch (err) {
+    return { ok: false, error: 'version-fetch-failed' }
+  } finally {
+    if (timer !== null) clearTimeout(timer)
+  }
+}
+
+export function createVersionCheck(options = {}) {
+  const fetchImpl = options.fetchImpl === undefined ? globalThis.fetch : options.fetchImpl
+  const currentVersion = typeof options.currentVersion === 'string' ? options.currentVersion : ''
+  const ttlMs = Number.isFinite(options.ttlMs) && options.ttlMs > 0 ? options.ttlMs : VERSION_CHECK_TTL_MS
+  const minIntervalMs = Number.isFinite(options.minIntervalMs) && options.minIntervalMs >= 0 ? options.minIntervalMs : VERSION_CHECK_MIN_INTERVAL_MS
+  let entry = null
+  let failure = null
+  let lastAttemptAt = 0
+  function snapshot(cached) {
+    return {
+      current: currentVersion,
+      latest: entry === null ? null : entry.version,
+      status: entry === null ? 'unknown' : versionStatus(currentVersion, entry.version),
+      checkedAt: entry === null ? null : entry.fetchedAt,
+      sourceUrl: entry === null ? VERSION_CHECK_URL : entry.sourceUrl,
+      error: failure === null ? null : failure.error,
+      cached: cached === true,
+    }
+  }
+  /** Read the cached verdict, or ask the registry again when it is stale or forced. */
+  async function read(force) {
+    const now = Date.now()
+    if (!force && entry !== null && now - entry.fetchedAt < ttlMs) return snapshot(true)
+    // A forced read still waits out the floor: force comes from the refresh button,
+    // and no human needs a second registry round trip inside the same half minute.
+    if (lastAttemptAt > 0 && now - lastAttemptAt < minIntervalMs) return snapshot(false)
+    lastAttemptAt = now
+    const result = await fetchLatestVersion(fetchImpl, options)
+    if (result.ok) {
+      entry = { version: result.version, fetchedAt: result.fetchedAt, sourceUrl: result.sourceUrl }
+      failure = null
+    } else {
+      failure = { error: result.error, failedAt: Date.now() }
+    }
+    return snapshot(false)
+  }
+  return { read, snapshot: () => snapshot(true), currentVersion }
+}
+
+export { VERSION_CHECK_MIN_INTERVAL_MS, VERSION_CHECK_TTL_MS, VERSION_CHECK_URL }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-all-usage",
-  "version": "1.1.17",
+  "version": "1.1.18",
   "description": "DeepSeek Harness usage dashboard with model, provider, workspace, cache, balance, and CSV insights",
   "repository": {
     "type": "git",
@@ -58,6 +58,7 @@
     "lib/client.js",
     "lib/pricing.js",
     "lib/usage-core.js",
+    "lib/version-check.js",
     "CHANGELOG.md",
     "cordis.patch.yml",
     "screenshots.json",