dsh-connect-workbuddy 5.8.4 → 5.9.0

package/lib/{host-heartbeat-CAX0oKQT.js → host-heartbeat-C1tVU2IN.js}

@@ -1467,8 +1467,27 @@ function text(value) {
 *
 * Any other malformed value is left to the caller to drop — a wrong window
 * would hide a live promotion, and guessing is not this parser's job.
+*
+* THE TYPE GUARD IS LOAD-BEARING, NOT DEFENSIVE DECORATION (issue #139). The
+* upstream feeds a string, and `parseDaily`'s own `text()` would already have
+* dropped a number — but the SAVED `lastCatalog` is a second, independent
+* entrance to this function, and nothing on that path type-checks. A promotion
+* object rides through `toPersistedWorkBuddyModel` untouched (the settings
+* schema keeps unknown keys), survives `resolveRoster`, and reaches the
+* renderer's `selectPromoBadge`. A numeric `start` there used to throw
+* `value.trim is not a function` DURING RENDER, which the host's slot error
+* boundary turned into a blank configuration section — the page looked as if
+* the plugin had never installed.
+*
+* Refusing a non-string is the same answer the parser already gives every
+* other unreadable shape: drop the window rather than guess. Interpreting a
+* number as "minutes since midnight" was considered and rejected — `1380`
+* happens to mean 23:00, but no upstream has ever published that shape, and
+* inventing hours for a promotion the upstream never described is exactly the
+* overstatement this module exists to prevent.
 */
 function minutesOfClock(value) {
+	if (typeof value !== "string") return void 0;
 	const match = /^(\d{1,2}):(\d{2})$/.exec(value.trim());
 	if (match === null) return void 0;
 	const hours = Number(match[1]);
@@ -1528,8 +1547,27 @@ function parseHover(value) {
 		...textEn === void 0 ? {} : { textEn }
 	};
 }
-/** The upstream's `schedule.daily` → the windows this plugin can evaluate. */
-function parseDaily(value) {
+/**
+* What an unreadable endpoint actually was, for the one diagnostic line below.
+*
+* Deliberately coarse: a NUMBER is the shape a future upstream format change
+* would plausibly take (minutes since midnight), so it is named separately
+* from "some other non-string". Reporting the typeof is enough to tell the two
+* apart in a log without ever echoing upstream content into the console.
+*/
+function shapeOf(value) {
+	if (typeof value === "number") return "number";
+	if (value === null) return "null";
+	if (Array.isArray(value)) return "array";
+	return typeof value;
+}
+/**
+* The upstream's `schedule.daily` → the windows this plugin can evaluate.
+*
+* `label` names the entry for the diagnostic line and is passed in rather than
+* read from `value`: the entry id lives one level up, in `parsePromo`.
+*/
+function parseDaily(value, label) {
 	if (!Array.isArray(value)) return void 0;
 	const windows = [];
 	for (const entry of value) {
@@ -1537,8 +1575,12 @@ function parseDaily(value) {
 		if (raw === void 0) continue;
 		const start = text(raw["start"]);
 		const end = text(raw["end"]);
-		if (start === void 0 || end === void 0) continue;
-		if (minutesOfClock(start) === void 0 || minutesOfClock(end) === void 0) continue;
+		if (start === void 0 || end === void 0 || minutesOfClock(start) === void 0 || minutesOfClock(end) === void 0) {
+			try {
+				console.warn(`[dsh-connect-workbuddy] promotion "${label}": dropped an unreadable daily window (start: ${shapeOf(raw["start"])}, end: ${shapeOf(raw["end"])}); the upstream may have changed the time format`);
+			} catch {}
+			continue;
+		}
 		windows.push({
 			start,
 			end
@@ -1578,13 +1620,13 @@ function parseDiscount(value) {
 	};
 }
 /** The upstream's `schedule` → this plugin's schedule shape. */
-function parseSchedule(value) {
+function parseSchedule(value, label) {
 	const raw = record(value);
 	if (raw === void 0) return void 0;
 	const timezone = text(raw["timezone"]);
 	const validFrom = parseInstant(raw["validFrom"]);
 	const validUntil = parseInstant(raw["validUntil"]);
-	const daily = parseDaily(raw["daily"]);
+	const daily = parseDaily(raw["daily"], label);
 	const dailyUnusable = daily === void 0 && Array.isArray(raw["daily"]) && raw["daily"].length > 0;
 	if (timezone === void 0 && validFrom === void 0 && validUntil === void 0 && daily === void 0 && !dailyUnusable) return void 0;
 	return {
@@ -1605,11 +1647,12 @@ function parsePromo(value, source) {
 	const badge = parseBadge(raw["badge"]);
 	if (badge === void 0) return void 0;
 	const hover = parseHover(raw["hover"]);
-	const schedule = parseSchedule(raw["schedule"]);
+	const id = text(raw["id"]) ?? `${source}:${modelIds.join(",")}`;
+	const schedule = parseSchedule(raw["schedule"], id);
 	const discount = parseDiscount(raw["discount"]);
 	const priority = typeof raw["priority"] === "number" && Number.isFinite(raw["priority"]) ? raw["priority"] : 0;
 	return {
-		id: text(raw["id"]) ?? `${source}:${modelIds.join(",")}`,
+		id,
 		source,
 		modelIds,
 		badge,
@@ -6940,7 +6983,7 @@ function describeRosterSeenPayload(raw) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "5.8.4";
+const WORKBUDDY_CONNECT_VERSION = "5.9.0";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as parseCreditMultiplier, A as isEncryptedCredentialError, At as isEncryptedFieldWrapper, B as WorkBuddyCredentialRejectedError, Bt as writeFileAtomic, C as WorkBuddyCredentialStore, Ct as WORKBUDDY_APP_EXECUTABLE_ENV, D as defaultDesktopAuthDirs, Dt as fetchAtRestKeyPayload, E as defaultDesktopAuthCandidates, Et as deriveAtRestKeyId, F as workbuddyAccountId, Ft as readAtRestKey, G as forceNeutralHead, H as channelGateMemberOf, I as workbuddyOwnAuthPath, It as workbuddyAppExecutableCandidates, J as isCredentialRejectedError, K as isContextTooLongBody, L as CONTEXT_OVERFLOW_MARKER, M as legacyWorkbuddyOwnAuthPath, Mt as macosBundleExecutable, N as parseWorkBuddyAuth, Nt as macosNestedAppBundles, O as defaultDesktopAuthPath, Ot as findWorkbuddyAppExecutable, P as preferredAccountName, Pt as openEncryptedField, Q as openingEvidenceOfBody, R as CREDENTIAL_REJECTED_CODE, Rt as resolveDshHome, S as WORKBUDDY_AUTH_FILE_ENV, St as nativeModalityOf, T as authFileName, Tt as deriveAtRestKey, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, W as declaredTools, X as knownRegionOf, Y as isFirstMessageGateBody, Z as modelIdOfBody, _ as deriveCatalog, _t as pickImageModel, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as NATIVE_MODALITY_BY_MODEL_ID, c as WORKBUDDY_CONNECT_VERSION, ct as REFUSES_OFF_MODEL_IDS, dt as offDefaultFor, et as parseReasoning, f as piAiRuntimeInfo, ft as offRefused, g as applyContextBudgets, gt as WorkBuddyImageError, h as WorkBuddyCatalog, ht as DEFAULT_IMAGE_SIZE, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as isWorkbuddyBundle, k as hasEncryptedCredentialFields, l as createFileRosterSeenStore, lt as defaultOffModelIds, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as withEffectiveOff, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as rewriteSessionTitleModel, p as FALLBACK_WORKBUDDY_MODELS, pt as recordRefusal, q as isConversationIdGateBody, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as attachBusyLevels, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as lastRefusalFor, v as fallbackModelsFor, vt as parseQueueAnswer, w as WorkBuddyEncryptedCredentialError, wt as clearAtRestKeyCache, x as WORKBUDDY_AUTH_FILENAME, xt as imageDefaultFor, y as withoutRouters, yt as queueNoticeText, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as withFileLock } from "./host-heartbeat-CAX0oKQT.js";
+import { $ as parseCreditMultiplier, A as isEncryptedCredentialError, At as isEncryptedFieldWrapper, B as WorkBuddyCredentialRejectedError, Bt as writeFileAtomic, C as WorkBuddyCredentialStore, Ct as WORKBUDDY_APP_EXECUTABLE_ENV, D as defaultDesktopAuthDirs, Dt as fetchAtRestKeyPayload, E as defaultDesktopAuthCandidates, Et as deriveAtRestKeyId, F as workbuddyAccountId, Ft as readAtRestKey, G as forceNeutralHead, H as channelGateMemberOf, I as workbuddyOwnAuthPath, It as workbuddyAppExecutableCandidates, J as isCredentialRejectedError, K as isContextTooLongBody, L as CONTEXT_OVERFLOW_MARKER, M as legacyWorkbuddyOwnAuthPath, Mt as macosBundleExecutable, N as parseWorkBuddyAuth, Nt as macosNestedAppBundles, O as defaultDesktopAuthPath, Ot as findWorkbuddyAppExecutable, P as preferredAccountName, Pt as openEncryptedField, Q as openingEvidenceOfBody, R as CREDENTIAL_REJECTED_CODE, Rt as resolveDshHome, S as WORKBUDDY_AUTH_FILE_ENV, St as nativeModalityOf, T as authFileName, Tt as deriveAtRestKey, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, W as declaredTools, X as knownRegionOf, Y as isFirstMessageGateBody, Z as modelIdOfBody, _ as deriveCatalog, _t as pickImageModel, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as NATIVE_MODALITY_BY_MODEL_ID, c as WORKBUDDY_CONNECT_VERSION, ct as REFUSES_OFF_MODEL_IDS, dt as offDefaultFor, et as parseReasoning, f as piAiRuntimeInfo, ft as offRefused, g as applyContextBudgets, gt as WorkBuddyImageError, h as WorkBuddyCatalog, ht as DEFAULT_IMAGE_SIZE, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as isWorkbuddyBundle, k as hasEncryptedCredentialFields, l as createFileRosterSeenStore, lt as defaultOffModelIds, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as withEffectiveOff, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as rewriteSessionTitleModel, p as FALLBACK_WORKBUDDY_MODELS, pt as recordRefusal, q as isConversationIdGateBody, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as attachBusyLevels, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as lastRefusalFor, v as fallbackModelsFor, vt as parseQueueAnswer, w as WorkBuddyEncryptedCredentialError, wt as clearAtRestKeyCache, x as WORKBUDDY_AUTH_FILENAME, xt as imageDefaultFor, y as withoutRouters, yt as queueNoticeText, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as withFileLock } from "./host-heartbeat-C1tVU2IN.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -13,6 +13,7 @@ import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { pathToFileURL } from "node:url";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { isIP } from "node:net";
 //#region src/catalog-sync.ts
 /**
 * The saved model directory (`lastCatalog`) and the LIVE upstream roster.
@@ -84,6 +85,10 @@ import { Readable } from "node:stream";
 * `supportsImages` ride along for the same reason: the upstream publishes
 * them, the saved copy is a snapshot of one moment, and a stale multiplier is
 * a wrong PRICE shown to the user.
+*
+* `promos` is NOT in this list — see {@link overlayLiveCapabilities} for why it
+* needs a different rule (it must be able to CLEAR a saved value, which this
+* loop cannot express).
 */
 const LIVE_OWNED_FIELDS = [
 	"reasoning",
@@ -109,6 +114,31 @@ const LIVE_OWNED_FIELDS = [
 * and the user's effective choice is stamped over it by `withEffectiveOff`
 * afterwards. So the overlay restores the declaration, and the user's tick
 * still wins.
+*
+* `promos` IS LIVE-OWNED TOO, AND IS REPLACED UNCONDITIONALLY. It cannot use
+* the loop above, because that loop only writes a field the live entry HAS —
+* which would keep a saved promotion forever once the upstream withdrew it.
+* Both directions were observed to be wrong before this rule existed:
+*
+*   - saved WITHOUT `promos`, live WITH them → the live promotions were
+*     dropped entirely, so a model on a night discount drew no badge at all;
+*   - saved WITH old `promos`, live with new ones → the saved ones won, so a
+*     promotion whose hours the upstream had since changed kept advertising
+*     the OLD hours.
+*
+* The card persists `promos` into `lastCatalog` (the settings schema keeps
+* unknown keys), so a user who saved the directory once had their badges
+* frozen at that moment — the exact opposite of what `src/promo.ts` promises
+* ("a badge is a function of the clock, not of the fetch"). The upstream's
+* current answer therefore REPLACES the saved one, including when that answer
+* is "no promotions at all": a badge the upstream no longer publishes must
+* stop being drawn, and a standing entry with no schedule has no absolute
+* window to expire it on its own.
+*
+* The key is DELETED rather than set to `undefined` when the live entry has
+* no promotions, for the same reason `resolveRoster` deletes `busyLevel`: an
+* explicit `undefined` survives `structuredClone` and the settings write
+* path's strict JSON codec rejects the whole save.
 */
 function overlayLiveCapabilities(saved, live) {
 	if (live === void 0) return saved;
@@ -117,9 +147,20 @@ function overlayLiveCapabilities(saved, live) {
 		const value = live[field];
 		if (value !== void 0) overlay[field] = value;
 	}
-	if (Object.keys(overlay).length === 0) return saved;
+	const livePromos = live.promos;
+	const savedPromos = saved.promos;
+	const promosDiffer = livePromos !== savedPromos && (livePromos !== void 0 || savedPromos !== void 0);
+	if (Object.keys(overlay).length === 0 && !promosDiffer) return saved;
+	if (livePromos !== void 0) {
+		overlay["promos"] = livePromos;
+		return {
+			...saved,
+			...overlay
+		};
+	}
+	const { promos: _stalePromos, ...rest } = saved;
 	return {
-		...saved,
+		...rest,
 		...overlay
 	};
 }
@@ -2320,6 +2361,203 @@ function attachUsage(directory, report, onError) {
 		})();
 	};
 }
+//#endregion
+//#region src/loopback.ts
+/**
+* Who is allowed to talk to the plugin's own HTTP surfaces.
+*
+* There are two distinct questions and they stop two different attacks, so both
+* live here rather than being re-derived per route. A previous version kept the
+* Host check inside `shim.ts` and only the Origin check inside `web-status.ts`,
+* which meant the shim's chat route had both guards while the settings card's
+* thirteen routes (ten POST + three GET) had one — the asymmetry was invisible
+* because each file looked internally consistent.
+*
+* - **Host** answers "is this request addressed to the interface it landed on?".
+*   A DNS-rebinding page sends requests whose `Host` is the *attacker's* domain
+*   (that is the whole trick: the browser resolves the attacker name to
+*   127.0.0.1), so requiring the Host to match the arrival interface drops it.
+*   This is the guard an Origin-only check does **not** provide.
+* - **Origin** answers "did a page on a foreign origin cause this?". A
+*   non-browser client sends no `Origin` at all and must pass, or the plugin's
+*   own `fetch` calls would be refused.
+*
+* Neither is authentication: any local process can forge both headers. They are
+* the minimum for these surfaces, not a substitute for a secret when a route
+* spends credit.
+*
+* ## Two callers, two strictnesses (deliberate)
+*
+* - `src/web-status.ts` serves the settings card over the HOST's webserver, which
+*   the harness may configure to bind a concrete non-loopback address. It uses
+*   `hostMatchesListener` / `originIsLoopback(origin, localAddress)`, i.e. "is
+*   this addressed to / coming from the interface the connection landed on".
+* - `src/shim.ts` binds `listen(0, '127.0.0.1')` itself, so no LAN request can
+*   ever reach it. It uses the stricter `hostIsLoopback`, which is not a
+*   different notion of "local" but the same one narrowed to the only case that
+*   can occur.
+*
+* Keep that in mind before "unifying" the two: the strict form is not a bug in
+* the shim, and the loose form is not laxness in the card.
+*
+* @module dsh-connect-workbuddy/loopback
+*/
+/**
+* Hostnames that count as this machine without comparing against a bind address.
+*
+* `localhost` is here because it names this machine by definition. The IPv4
+* entries cover the loopback /8 rather than the single address 127.0.0.1: the
+* host harness itself treats the whole 127/8 as loopback (its own
+* `isLoopbackHostname` accepts it, and 127.0.0.2 is a usable second loopback
+* address on Linux), so refusing 127.0.0.2 here would reject a request the
+* host considers local.
+*/
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "[::1]"]);
+/**
+* Whether a string is a bare IP literal (IPv4 dotted quad, or IPv6 with or
+* without the brackets a Host header puts around it).
+*
+* Deliberately narrow: this decides whether a value is an ADDRESS that may be
+* compared with a Host header, so it must reject hostnames and host:port forms.
+* A loose "looks like hex" check would label `[deadbeef]` an address, and while
+* that cannot open the gate on its own (both sides must still be equal), a
+* predicate that answers "yes" to a non-address erodes the property the check is
+* supposed to have. `node:net`'s own parser is the authority for IPv6.
+*/
+function isIpLiteral(value) {
+	if (/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(value)) return value.split(".").every((part) => Number(part) <= 255 && !(part.length > 1 && part.startsWith("0")));
+	const inner = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+	return isIP(inner) === 6;
+}
+/** Whether a bare hostname is inside IPv4 loopback space (127.0.0.0/8). */
+function isIpv4Loopback(hostname) {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/u.exec(hostname);
+	if (match === null) return false;
+	const octets = match.slice(1, 5).map((part) => Number(part));
+	if (octets.some((octet) => octet > 255)) return false;
+	if (match.slice(1, 5).some((part) => part.length > 1 && part.startsWith("0"))) return false;
+	return octets[0] === 127;
+}
+/**
+* Strip the optional `:port` from a Host header value, IPv6-bracket aware.
+*
+* The bracketed form is returned WITH brackets, because {@link LOOPBACK_HOSTS}
+* stores it that way and the two must agree.
+*
+* A `]` that is not at the end of the value (or followed only by `:<digits>`)
+* makes the whole thing unparseable, and unparseable returns the input
+* unchanged so no caller can mistake it for a loopback name. That matters: a
+* naive `slice(0, end + 1)` turns `[::1]evil.example` into `[::1]` and reads a
+* foreign host as this machine. Browsers never send such a value, but this
+* function is a security boundary, so "never" is the wrong bet.
+*/
+function hostnameOfHost(host) {
+	let hostname = host.trim().toLowerCase();
+	if (hostname.startsWith("[")) {
+		const end = hostname.indexOf("]");
+		if (end === -1) return hostname;
+		const after = hostname.slice(end + 1);
+		if (after !== "" && !/^:\d+$/.test(after)) return hostname;
+		return hostname.slice(0, end + 1);
+	}
+	const colon = hostname.lastIndexOf(":");
+	if (colon !== -1 && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
+	return hostname;
+}
+/**
+* Whether a Host header names the loopback interface.
+*
+* An absent Host is treated as NOT loopback. HTTP/1.1 requires the header, so
+* its absence is either a malformed request or an attempt to dodge the check —
+* neither deserves the benefit of the doubt on a surface that can spend credit.
+*/
+function hostIsLoopback(host) {
+	if (host === void 0 || host.trim() === "") return false;
+	return isLocalHostname(hostnameOfHost(host));
+}
+/**
+* Whether a parsed hostname names this machine.
+*
+* The single definition both predicates use, so the Host and Origin paths cannot
+* disagree about what "local" means — they did before (`127.0.0.2` and a trailing
+* dot were treated differently by each), which is exactly the kind of split this
+* module exists to prevent.
+*/
+function isLocalHostname(hostname) {
+	const name = hostname.endsWith(".") && !hostname.endsWith("..") ? hostname.slice(0, -1) : hostname;
+	return LOOPBACK_HOSTS.has(name) || name === "::1" || isIpv4Loopback(name);
+}
+/**
+* Whether a Host header names the address this connection actually arrived on.
+*
+* This is the guard the routes use, and "must be loopback" is the wrong question.
+* The host harness does NOT allow wildcard binds in the version this plugin runs
+* against (0.2.x rejects `0.0.0.0` outright: "bind one concrete IPv4 or IPv6
+* address of a local interface instead"), but it DOES allow binding one concrete
+* local address — including a LAN address. A user who binds their LAN IP and
+* opens the GUI at `http://192.168.1.5:3000` sends exactly that in Host, and the
+* harness itself considers such a request trusted (its own trust layer accepts
+* "the listener's bind IP literal on any port"). A loopback-only check would 403
+* that user's read routes while the rest of the harness works, which is a real
+* regression for a supported configuration.
+*
+* So the question is "was this request addressed to the socket it landed on?".
+* `localAddress` answers that: it is the interface the CONNECTION was accepted
+* on, not the bind literal. Comparing the two drops a rebinding request — whose
+* Host is the attacker's domain while the socket landed on 127.0.0.1 or a LAN
+* address — while accepting every genuine one, loopback or LAN.
+*
+* The local branch is not merely an optimisation: a loopback-bound listener
+* reports `127.0.0.1` from `localAddress`, so the comparison alone would accept
+* `Host: 127.0.0.1` anyway. It is stated first so the answer does not depend on
+* how the platform spells its own loopback, and so an undefined `localAddress`
+* (a proxy, a test double) still admits genuine local traffic.
+*/
+function hostMatchesListener(host, localAddress) {
+	if (host === void 0 || host.trim() === "") return false;
+	const hostname = hostnameOfHost(host);
+	if (isLocalHostname(hostname)) return true;
+	if (hostname === "0.0.0.0" || hostname === "[::]") return false;
+	if (localAddress === void 0 || localAddress.trim() === "") return false;
+	const local = localAddress.trim().toLowerCase();
+	if (!isIpLiteral(local) && !isIpLiteral(`[${local}]`)) return false;
+	const bare = (value) => value.startsWith("[") && value.endsWith("]") && isIP(value.slice(1, -1)) === 6 ? value.slice(1, -1) : value;
+	return bare(hostname) === bare(local);
+}
+/**
+* Whether a browser-sent Origin may drive this route.
+*
+* An ABSENT Origin passes: that is the shape of a non-browser client (the
+* plugin's own fetch, a curl, the tests), and refusing it would break the
+* plugin's own calls.
+*
+* A PRESENT Origin must name this machine — judged by the SAME rule as the Host
+* header, which is why this takes `localAddress` too. Leaving it loopback-only
+* while Host accepted any local interface was a real split: a LAN browser's
+* same-origin POST carries `Origin: http://192.168.1.5:3000`, so the Host gate
+* admitted it and this one then refused all ten write routes. The two predicates
+* use one definition now (see `isLocalHostname`), because a browser reaching the
+* server on its LAN address is exactly as legitimate as one reaching it on
+* loopback — the harness trusts the bind literal on any port either way.
+*
+* The comparison is over the HOSTNAME only. `localAddress` carries no port, and
+* the route's own port is what a same-origin page must already be using, so a
+* port comparison here would add nothing: a page on the same host but another
+* port is not a threat this gate is meant to stop (it would need code already
+* running on this machine), and treating it as one would break legitimate
+* setups behind a proxy that terminates on a different port than it forwards to.
+* That intentional limit is recorded rather than silently assumed.
+*/
+function originIsLoopback(origin, localAddress) {
+	if (origin === void 0 || origin.trim() === "") return true;
+	try {
+		const { hostname } = new URL(origin);
+		if (isLocalHostname(hostname)) return true;
+		return hostMatchesListener(hostname, localAddress);
+	} catch {
+		return false;
+	}
+}
 /** One or two full-width bars — the count is a spelling variable. */
 const BARS = `｜｜?`;
 new RegExp(`${BARS}DSML${BARS}`, "g");
@@ -3229,45 +3467,6 @@ const REQUEST_BODY_LIMIT = 67108864;
 * rate-limiting.
 */
 const FAILOVER_ACCOUNT_GAP_MS = 2e3;
-/** Loopback hostnames the shim's own in-process client uses. */
-const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
-	"127.0.0.1",
-	"localhost",
-	"[::1]"
-]);
-/** Strip the optional :port from a Host header value, IPv6-bracket aware. */
-function hostnameOfHost(host) {
-	let hostname = host.trim().toLowerCase();
-	if (hostname.startsWith("[")) {
-		const end = hostname.indexOf("]");
-		return end === -1 ? hostname : hostname.slice(0, end + 1);
-	}
-	const colon = hostname.lastIndexOf(":");
-	if (colon !== -1 && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
-	return hostname;
-}
-/**
-* The request's Host header must name the loopback interface. A DNS-rebinding
-* page (attacker domain re-resolved to 127.0.0.1) sends its own domain in
-* Host, so this check drops those before any routing happens.
-*/
-function hostIsLoopback(host) {
-	if (host === void 0 || host.trim() === "") return false;
-	return LOOPBACK_HOSTS.has(hostnameOfHost(host));
-}
-/**
-* A browser-sent Origin (present header) must be loopback. Non-browser
-* clients (the plugin's own fetch calls) send no Origin at all and pass.
-*/
-function originIsLoopback(origin) {
-	if (origin === void 0 || origin.trim() === "") return true;
-	try {
-		const { hostname } = new URL(origin);
-		return LOOPBACK_HOSTS.has(hostname) || hostname === "::1";
-	} catch {
-		return false;
-	}
-}
 /** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
 function isJsonContentType(req) {
 	const type = req.headers["content-type"];
@@ -7281,21 +7480,10 @@ function tpsProbeRequestBody(modelId) {
 			content: "List the numbers from 1 to 400 in words, separated by single spaces."
 		}],
 		max_tokens: 256,
-		...OFF_REASONING_FIELDS,
 		stream: true
 	});
 }
 /**
-* Ask for the lowest reasoning effort available.
-*
-* A reasoning model asked to count spends its `max_tokens` inside the reasoning
-* channel; the stream then carries thinking deltas and little or no content, and
-* timing it would measure the wrong thing. `none` is the widest supported
-* spelling; gateways that do not know it ignore the field (measured: the CN
-* gateway answers 200 with it).
-*/
-const OFF_REASONING_FIELDS = { reasoning_effort: "none" };
-/**
 * Read one SSE stream INCREMENTALLY, timing each content deltas arrival.
 *
 * The incremental read is the measurement. `response.text()` buffers the whole
@@ -8700,16 +8888,46 @@ function readJsonBody(req) {
 		req.on("error", reject);
 	});
 }
-/** Loopback browser origins only; other devices are refused until trusted origins exist. */
-function loopbackOrigin(req) {
-	const origin = req.headers.origin;
-	if (origin === void 0) return true;
-	try {
-		const { hostname } = new URL(origin);
-		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
-	} catch {
+/**
+* The full gate a state-changing route must clear: Host AND Origin.
+*
+* Origin alone is not enough. It answers "did a foreign page cause this?", but a
+* DNS-rebinding attack arrives with the attacker's domain in `Host` and no
+* useful Origin, so the Host check is what drops it — and until this function
+* existed, all thirteen routes below (ten POST, three GET) had only the Origin
+* half while the shim's chat route had both. The asymmetry was invisible per-file.
+*
+* Both halves are cheap and NEITHER IS AUTHENTICATION. A local process — or any
+* peer that can reach the listener when it is bound to a LAN address — may send
+* whatever Host and Origin it likes. What these two checks buy is narrow and
+* worth stating precisely:
+*
+* - they stop a BROWSER on a foreign page from driving these routes (the browser
+*   chooses Origin for us, and rebinding fails the Host comparison), which is
+*   the CSRF / rebinding family;
+* - they do NOT stop a program that can already open a socket to the port.
+*
+* There is no per-route secret here: `req.headers` is read for `host` and
+* `origin` and nothing else. Every route that spends credit or returns token
+* material is protected by the same two forgeable headers as the read routes, so
+* binding this listener to a non-loopback address exposes those routes to the
+* local network. That is a property of the whole surface, not of this function,
+* and it must not be described as though a stronger guard existed.
+*
+* Absent Host is refused: HTTP/1.1 requires it, and its absence on a
+* credit-spending surface is not worth the benefit of the doubt. Absent Origin
+* passes, because that is the shape of the plugin's own fetch and of curl.
+*/
+function requireLoopback(req, res) {
+	if (!hostMatchesListener(req.headers.host, req.socket?.localAddress)) {
+		json(res, 403, { error: "host-not-trusted" });
 		return false;
 	}
+	if (!originIsLoopback(req.headers.origin, req.socket?.localAddress)) {
+		json(res, 403, { error: "origin-not-trusted" });
+		return false;
+	}
+	return true;
 }
 /** Map the credit answer to the card's compact document. */
 function toCredits(answer) {
@@ -9126,10 +9344,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					json(res, 405, { error: "method not allowed" });
 					return;
 				}
-				if (!loopbackOrigin(req)) {
-					json(res, 403, { error: "origin-not-trusted" });
-					return;
-				}
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const detail = fastDetailOf(req.url ?? "") ? "fast" : "full";
@@ -9145,7 +9360,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_ACCOUNT_CREDITS_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
@@ -9160,7 +9375,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_ACCOUNTS_REFRESH_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
@@ -9182,7 +9397,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_CHECKIN_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				try {
@@ -9208,7 +9423,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_BENEFIT_CLAIM_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const url = new URL(req.url ?? "/", "http://127.0.0.1");
@@ -9246,7 +9461,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_MODELS_REFRESH_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				if (deps.discoverModels === void 0) return json(res, 503, { error: "model refresh unavailable" });
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
@@ -9262,7 +9477,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_PROBE_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				if (deps.probeModels === void 0) return json(res, 503, { error: "model probe unavailable" });
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
@@ -9284,7 +9499,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_TPS_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				if (deps.measureTps === void 0) return json(res, 503, { error: "tps measurement unavailable" });
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
@@ -9306,7 +9521,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_POOL_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const action = poolActionOf(req.url ?? "/");
@@ -9449,7 +9664,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: "/plugins/dsh-connect-workbuddy/__save",
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const settings = ctx.get?.("settings");
 				if (settings === void 0) return json(res, 503, { error: "settings service unavailable to this fiber" });
 				try {
@@ -9536,7 +9751,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_OAUTH_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const action = oauthActionOf(req.url ?? "/");
@@ -9564,7 +9779,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_TRANSFER_PATH,
 			handler: async (req, res) => {
 				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				const region = requestRegion(req, res);
 				if (region === void 0) return;
 				const action = transferActionOf(req.url ?? "/");
@@ -9618,7 +9833,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			path: WORKBUDDY_CLI_LIVE_PATH,
 			handler: (req, res) => {
 				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (!requireLoopback(req, res)) return;
 				try {
 					json(res, 200, deps.cliLive?.() ?? {
 						turns: [],

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "5.8.4",
+  "version": "5.9.0",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",