dsh-unlag 1.9.19 → 1.9.21

package/client.js

@@ -634,7 +634,25 @@ window.__ModuleLoader__.load({
           // A replacement that did not finish stops the press here: rebuilding the page anyway would
           // start a document against a plugin set the app has not finished applying.
           if (replace) {
-            const status = await withTimeout(replacePlugins()).catch(() => 'failed');
+            /**
+             * The answer to a replacement can be lost while the set is being recomposed, which reads
+             * as a failure even though the plugins did change. The startup list says which set is
+             * serving now, so a lost answer is checked against it before the press claims to fail.
+             */
+            const before = await hostBootGraph();
+            const revBefore = typeof before?.rev === 'string' ? before.rev : null;
+            let status = await withTimeout(replacePlugins()).catch(() => 'failed');
+            if (status === 'failed' && revBefore !== null) {
+              for (const wait of [400, 900, 1800]) { // ui-copy-ignore
+                await new Promise((resolve) => setTimeout(resolve, wait));
+                const after = await hostBootGraph();
+                const revNow = typeof after?.rev === 'string' ? after.rev : null;
+                if (revNow !== null && revNow !== revBefore) {
+                  status = 'done';
+                  break;
+                }
+              }
+            }
             if (status !== 'done' && status !== 'off') {
               const key =
                 status === 'queued'

package/index.js

@@ -1521,6 +1521,12 @@ function serveButton(ctx, controller, config) {
         try {
           const method = String(req?.method ?? 'GET').toUpperCase()
           if (method !== 'POST') return sendJson(res, 405, { status: 'method' })
+          /**
+           * A page on any site can post to a local address without asking first, and a log is
+           * evidence: a made-up outcome must not get in. The header the page's own script sends
+           * makes the request one a browser has to ask about first, and this app never agrees.
+           */
+          if (typeof req?.headers?.[BUTTON_HEADER] !== 'string') return sendJson(res, 403, { status: 'forbidden' })
           let query = ''
           try {
             query = new URL(String(req?.url ?? ''), 'http://x').searchParams.toString()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.9.19",
+  "version": "1.9.21",
   "type": "module",
   "description": "A press applies plugin edits right away and brings a laggy interface back; automatic reloading stays off unless you turn it on, so the press is the only trigger, and nothing restarts.",
   "license": "MIT",