dsh-cliproxyapi-pro 1.6.0 → 1.7.0

package/lib/updater.js

@@ -19,12 +19,45 @@ const BOOLEAN_SETTINGS = ["autoCheck", "autoDownload", "autoInstall"];
 const MAX_METADATA_BYTES = 512 * 1024;
 const MAX_PACKAGE_BYTES = 8 * 1024 * 1024;
 const MAX_UNPACKED_BYTES = 16 * 1024 * 1024;
-const PACKAGE_FILES = /^(?:package\.json|README(?:\.en)?\.md|CHANGELOG\.md|LICENSE|icon\.svg|cordis\.patch\.yml|lib\/[A-Za-z0-9_-]+\.js|locale\/(?:en|zh)\.json)$/;
+const MAX_PACKAGE_ENTRIES = 1000;
+const MAX_PATH_SEGMENTS = 6;
+// Plain names only: no dotfiles, spaces, shell/glob characters or non-ASCII.
+const SAFE_SEGMENT = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,99}$/;
+// npm packs these root files whether or not `files` lists them.
+const ALWAYS_PACKED = /^(?:package\.json|(?:README|LICEN[CS]E|NOTICE)(?:\.[A-Za-z0-9_-]+)*)$/i;
+const REQUIRED_FILES = ["package.json", "lib/index.js", "lib/client.js", "cordis.patch.yml", "locale/en.json", "locale/zh.json"];
 
 export class UpdateError extends Error {
-  constructor(code) { super(code); this.code = code; }
+  /** `detail` is a short diagnostic for logs only; the UI shows `code`. */
+  constructor(code, detail) { super(code); this.code = code; if (detail) this.detail = detail; }
+}
+const fail = (code, detail) => { throw new UpdateError(code, detail); };
+const printable = (value) => String(value).replace(/[^\x20-\x7e]/g, "?").slice(0, 160);
+
+/**
+ * Compile the package's own `files` field (npm semantics: a matched directory
+ * includes its contents, `*` stays within a segment, `**` spans segments).
+ * Negations only remove files from what npm packs, so they are ignored here;
+ * absolute or traversing patterns never match.
+ */
+export function packageFilePatterns(files) {
+  if (!Array.isArray(files) || files.length === 0 || files.length > 200) fail("invalid-package", "package.json has no usable \"files\" list");
+  const patterns = [];
+  for (const raw of files) {
+    if (typeof raw !== "string") fail("invalid-package", "package.json \"files\" contains a non-string entry");
+    const pattern = raw.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+    if (!pattern || pattern.startsWith("!") || pattern.startsWith("/") || pattern.includes("\\") ||
+        pattern.split("/").some((part) => part === "" || part === "." || part === "..")) continue;
+    const parts = pattern.split("/");
+    const body = parts.map((part, i) => {
+      const last = i === parts.length - 1;
+      if (part === "**") return last ? ".*" : "(?:[^/]+/)*";
+      return part.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*").replace(/\?/g, "[^/]") + (last ? "" : "/");
+    }).join("");
+    patterns.push(new RegExp(`^${body}(?:/.*)?$`));
+  }
+  return patterns;
 }
-const fail = (code) => { throw new UpdateError(code); };
 
 export function normalizeUpdateSettings(raw = {}) {
   return {
@@ -173,53 +206,82 @@ async function fetchBytes(fetcher, url, signal, limit, download = null) {
   }
 }
 
-/** Validate checksum and a restricted npm tar archive without extracting any file. */
+/**
+ * Validate checksum and a restricted npm tar archive without extracting any file.
+ * Which files may appear is not hard-coded: every regular file must be declared
+ * by the package's own `files` field (or be one npm always packs), so a future
+ * release can ship new files without this version rejecting it. Structural
+ * safety rules (paths, entry types, sizes, dependencies, scripts) are fixed.
+ */
 export function verifyUpdatePackage(bytes, expected) {
   const digest = createHash("sha512").update(bytes).digest();
   if (!timingSafeEqual(digest, integrityDigest(expected.integrity))) fail("integrity-error");
   let tar;
   try { tar = gunzipSync(bytes, { maxOutputLength: MAX_UNPACKED_BYTES }); }
-  catch { fail("invalid-package"); }
+  catch { fail("invalid-package", "not a gzip archive within the size limit"); }
   const seen = new Set();
+  const files = [];
+  const directories = [];
   let manifest;
   let ended = false;
   const text = (buffer) => buffer.toString("utf8").replace(/\0.*$/s, "");
   for (let offset = 0; offset + 512 <= tar.length;) {
     const header = tar.subarray(offset, offset + 512);
     if (header.every((b) => b === 0)) {
-      if (tar.subarray(offset).some((b) => b !== 0)) fail("invalid-package");
+      if (tar.subarray(offset).some((b) => b !== 0)) fail("invalid-package", "data after the tar terminator");
       ended = true;
       break;
     }
     const octal = (buffer) => {
       const value = text(buffer).trim();
-      if (!/^[0-7]+$/.test(value)) fail("invalid-package");
+      if (!/^[0-7]+$/.test(value)) fail("invalid-package", "malformed tar header");
       return parseInt(value, 8);
     };
     const size = octal(header.subarray(124, 136));
     const checksum = octal(header.subarray(148, 156));
     let sum = 0;
     for (let i = 0; i < 512; i++) sum += i >= 148 && i < 156 ? 32 : header[i];
-    if (sum !== checksum || size > MAX_UNPACKED_BYTES || offset + 512 + size > tar.length) fail("invalid-package");
+    if (sum !== checksum || size > MAX_UNPACKED_BYTES || offset + 512 + size > tar.length) fail("invalid-package", "corrupt tar entry");
     const prefix = text(header.subarray(345, 500));
     const path = `${prefix ? `${prefix}/` : ""}${text(header.subarray(0, 100))}`;
-    if (!path.startsWith("package/") || path.includes("\\") || path.split("/").some((p) => p === ".." || p === ".") || seen.has(path)) fail("invalid-package");
-    seen.add(path);
     const type = header[156];
-    if (type === 53) {
-      if (size !== 0 || !["package/", "package/lib/", "package/locale/"].includes(path)) fail("invalid-package");
-    } else if ((type === 0 || type === 48) && PACKAGE_FILES.test(path.slice(8))) {
-      if (path === "package/package.json") {
+    const directory = type === 53;
+    let relative = path.startsWith("package/") ? path.slice(8) : null;
+    if (directory && relative?.endsWith("/")) relative = relative.slice(0, -1);
+    const parts = relative?.split("/") ?? [];
+    if (relative === null || (relative !== "" || !directory) && (parts.length > MAX_PATH_SEGMENTS ||
+        parts.some((part) => !SAFE_SEGMENT.test(part) || part === "node_modules")) || seen.has(path)) {
+      fail("invalid-package", `unsafe path ${printable(path)}`);
+    }
+    seen.add(path);
+    if (seen.size > MAX_PACKAGE_ENTRIES) fail("invalid-package", "too many entries");
+    if (directory) {
+      if (size !== 0) fail("invalid-package", `non-empty directory entry ${printable(path)}`);
+      directories.push(relative);
+    } else if (type === 0 || type === 48) {
+      files.push(relative);
+      if (relative === "package.json") {
         try { manifest = JSON.parse(tar.subarray(offset + 512, offset + 512 + size).toString("utf8")); }
-        catch { fail("invalid-package"); }
+        catch { fail("invalid-package", "package.json is not valid JSON"); }
       }
-    } else fail("invalid-package");
+    } else fail("invalid-package", `link or special entry ${printable(path)}`);
     offset += 512 + Math.ceil(size / 512) * 512;
   }
-  const required = ["package.json", "lib/index.js", "lib/client.js", "cordis.patch.yml", "locale/en.json", "locale/zh.json"];
-  if (!ended || required.some((p) => !seen.has(`package/${p}`)) || manifest?.name !== UPDATE_PACKAGE || manifest?.version !== expected.version || manifest?.dsh?.bundle?.patch !== "./cordis.patch.yml") fail("invalid-package");
-  if (["dependencies", "optionalDependencies", "bundledDependencies", "bundleDependencies"].some((key) => manifest[key] && Object.keys(manifest[key]).length)) fail("invalid-package");
-  if (Object.keys(manifest.scripts ?? {}).some((key) => /^(?:preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack)$/.test(key))) fail("invalid-package");
+  if (!ended) fail("invalid-package", "missing tar terminator");
+  const missing = REQUIRED_FILES.find((p) => !files.includes(p));
+  if (missing) fail("invalid-package", `missing ${missing}`);
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest) || manifest.name !== UPDATE_PACKAGE ||
+      manifest.version !== expected.version || manifest.dsh?.bundle?.patch !== "./cordis.patch.yml") {
+    fail("invalid-package", "package.json does not describe this plugin version");
+  }
+  if (["dependencies", "optionalDependencies", "bundledDependencies", "bundleDependencies"].some((key) => manifest[key] && Object.keys(manifest[key]).length)) fail("invalid-package", "declares dependencies");
+  const script = Object.keys(manifest.scripts ?? {}).find((key) => /^(?:preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack)$/.test(key));
+  if (script) fail("invalid-package", `declares lifecycle script ${printable(script)}`);
+  const patterns = packageFilePatterns(manifest.files);
+  const undeclared = files.find((file) => !(!file.includes("/") && ALWAYS_PACKED.test(file)) && !patterns.some((re) => re.test(file)));
+  if (undeclared) fail("invalid-package", `file not declared in package.json "files": ${printable(undeclared)}`);
+  const stray = directories.find((dir) => dir !== "" && !files.some((file) => file.startsWith(`${dir}/`)));
+  if (stray !== undefined) fail("invalid-package", `directory without files ${printable(stray)}`);
   return manifest;
 }
 
@@ -255,6 +317,8 @@ export function createPluginUpdater(deps) {
     const code = error instanceof UpdateError ? error.code : "network-error";
     state.error = code;
     state.errorCode = code;
+    // The page shows only the localized code; the concrete reason goes to the Host log.
+    if (error instanceof UpdateError && error.detail) deps.logger?.warn?.(`[dsh-cliproxyapi] update ${code}: ${error.detail}`);
   };
 
   const lookup = async (region, snapshot, signal) => {

package/locale/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "CLIProxyAPI Provider",
-    "description": "Connect one or more CLIProxyAPI accounts, enable or disable each, synchronize their models and reasoning capabilities into DSH, and manage settings visually."
+    "title": "CLIProxyAPI (CPA) Provider",
+    "description": "Connect one or more CLIProxyAPI (CPA) accounts, enable or disable each, synchronize their models and reasoning capabilities into DSH, and manage settings visually."
   }
 }

package/locale/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "CLIProxyAPI 接入与同步",
-    "description": "接入一个或多个 CLIProxyAPI 账号（可分别启用或停用），实时同步模型与推理能力，并提供可视化配置与模型过滤面板。"
+    "title": "CLIProxyAPI (CPA) 接入与同步",
+    "description": "接入一个或多个 CLIProxyAPI（CPA）账号（可分别启用或停用），实时同步模型与推理能力，并提供可视化配置与模型过滤面板。"
   }
 }

package/package.json

@@ -1,12 +1,14 @@
 {
   "name": "dsh-cliproxyapi-pro",
-  "version": "1.6.0",
-  "description": "Auto-discovery CLIProxyAPI provider and management UI for DeepSeek Harness — multiple accounts, dynamic model sync, capability detection, and visual settings.",
+  "version": "1.7.0",
+  "description": "Auto-discovery CLIProxyAPI (CPA) provider and management UI for DeepSeek Harness — multiple accounts, dynamic model sync, capability detection, and visual settings.",
   "keywords": [
     "dsh",
     "deepseek-harness",
     "dsh-plugin",
     "cliproxyapi",
+    "cli-proxy-api",
+    "cpa",
     "llm-provider"
   ],
   "author": "bowen (https://github.com/TinyBOOOOM)",
@@ -38,6 +40,7 @@
     "lib/index.js",
     "lib/client.js",
     "lib/updater.js",
+    "lib/quota.js",
     "locale/*.json",
     "cordis.patch.yml",
     "icon.svg",
@@ -59,13 +62,15 @@
         "@deepseek-ai/dsh-client-ui-settings-plugins",
         "@deepseek-ai/dsh-client-ui-plugin-manager",
         "@deepseek-ai/dsh-client-ui-theme",
-        "@deepseek-ai/dsh-client-ui-renderer"
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-model-selection",
+        "@deepseek-ai/dsh-client-ui-conversation"
       ]
     }
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
-    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/updater.js && node --test tests/*.test.mjs",
+    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/updater.js && node --check lib/quota.js && node --test tests/*.test.mjs",
     "pack:check": "npm pack --dry-run"
   }
 }