@deepseek-ai/dsh-web-app 0.2.1-alpha.1 → 0.2.1-alpha.3

package/lib/index.js

@@ -2,11 +2,10 @@ import { t as parsePublicUrl } from "./public-url-D_dMK-yI.js";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { dirname, join } from "node:path";
-import { networkInterfaces } from "node:os";
-import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";
-import { addHarnessSourceSection, auditStartupEntries } from "@deepseek-ai/dsh-app-boot";
+import { auditStartupEntries } from "@deepseek-ai/dsh-app-boot";
 import * as FrontendStatic from "@deepseek-ai/dsh-host-frontend-static";
+import { bindUrlHost, isLoopbackHost } from "@deepseek-ai/dsh-host-webserver";
 import { launchEnvironmentOf, launchedThroughSsh } from "@deepseek-ai/dsh-launch-environment";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 //#region lib/types/index.js
@@ -16,34 +15,26 @@ import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 * manifest field). The plugin owns the browser-surface glue: it resolves
 * the built frontend dist (workspace knowledge of this bundle, never user
 * config), mounts the `frontend-static` fallback owner over it, registers the
-* harness-source and web-surface prompt sections, the bash-visible web runtime
-* variable, the process-token URL line, and the default-browser handoff. An
-* advertised `publicUrl` replaces the published root — the loopback URL
-* otherwise. App command-line values arrive through the `webStartup` service
-* expressions in the bundle patch.
+* bash-visible web runtime variable, the process-token URL line, and the
+* default-browser handoff, and provides the `webApp` service. An advertised
+* `publicUrl` replaces the published bind-address URL. Non-loopback
+* HTTP binds trigger an exposure warning. App command-line values arrive
+* through the `webStartup` service expressions in the bundle patch.
 * @module @deepseek-ai/dsh-web-app
 */
 /** Stable Cordis plugin name. */
 const name = "web-app";
-/** This dsh installation's root, from either this package's source or built entry. */
-const SOURCE_ROOT = fileURLToPath(new URL("../../../..", import.meta.url));
 const ANNOUNCED_ROOTS = /* @__PURE__ */ new WeakSet();
-/** Runtime service that releases Web rows after bind-dependent values resolve. */
-const WEB_RUNTIME_SERVICE = "webRuntime";
 /** Services required before the web runtime can mount. */
 const inject = ["webServer"];
 const Config = z.object({
 	openBrowser: z.boolean().default(true),
 	printUrl: z.boolean().default(true),
 	surfaceContext: z.boolean().default(true),
-	publicUrl: z.transform(z.string(), (value) => parsePublicUrl(value).href),
-	trustedHosts: z.array(String).default([])
+	publicUrl: z.transform(z.string(), (value) => parsePublicUrl(value).href)
 });
 /** Environment variable naming the advertised URL of this Web GUI. */
 const DSH_WEB_URL = "DSH_WEB_URL";
-const LOOPBACK_HOST = "127.0.0.1";
-/** The webserver schema's all-interfaces bind literal. */
-const ALL_INTERFACES_HOST = "0.0.0.0";
 const BROWSER_OPENER_MODULE = import.meta.resolve("open");
 const BROWSER_OPENER_PROGRAM = `
 try {
@@ -74,37 +65,6 @@ try {
 }
 `;
 /**
-* Resolve one LAN-trust snapshot from the active server bind.
-*
-* Derived entries are port-less IP literals: DNS rebinding needs an
-* attacker-controlled name, while an IP-literal Host is safe on any port and
-* an OS-assigned port is unknowable before bind.
-* @param bindHost - the active webserver bind host.
-* @param extra - explicit `--trusted-host` values, in argument order.
-* @returns the LAN display addresses and invocation-derived fence authorities.
-*/
-function resolveLanTrust(bindHost, extra) {
-	const lanAddresses = bindHost === ALL_INTERFACES_HOST ? Object.values(networkInterfaces()).flat().filter((iface) => iface !== void 0 && iface.family === "IPv4" && !iface.internal).map((iface) => iface.address) : [];
-	return {
-		lanAddresses,
-		trustedHosts: [...lanAddresses, ...extra]
-	};
-}
-/** Model-visible orientation and acceptance boundary for sessions created through `dsh web`. */
-function webSurfacePrompt(webUrl) {
-	return `You are interacting with the user through the DeepSeek Harness Web GUI at ${webUrl}. When the user refers to "this page", "this GUI", or "this app" without naming another target, they mean this GUI. The browser provides no implicit DOM, route, or screenshot context. The client-plugin HMR receiver is active, but client-plugin changes reload without a refresh only while \`pnpm run dev:web\` is also running from this same checkout to rebuild their bundles; verify that watcher before promising automatic updates. Every other change — the apps/web shell and plain packages — requires rebuilding the affected Web artifacts and verifying this existing URL after a page refresh. Starting another server does not update this GUI. The apps/web Vite entry builds the shell but is not a standalone application because only dsh web injects window.__DSH_BOOT__. Do not start a replacement server unless the user asks; if one is needed, use a managed background job and verify its exact URL.`;
-}
-/** Resolve the canonical loopback URL from the active Web server. */
-function localWebUrl(ctx) {
-	const port = ctx.get("webServer")?.port;
-	if (port === void 0) throw new Error("web-app: webServer service missing while resolving Web runtime");
-	return `http://${LOOPBACK_HOST}:${String(port)}`;
-}
-function appRootUrl(ctx, publicUrl) {
-	if (publicUrl !== void 0) return publicUrl;
-	return localWebUrl(ctx);
-}
-/**
 * Dist location is workspace knowledge of this bundle: anchored on the
 * frontend package manifest, not configured. Existence is a request-time
 * concern — the fallback owner reads files per request, so a composition
@@ -171,44 +131,35 @@ const internals = {
 	openBrowser
 };
 /**
-* Mount the Web runtime: dist serving, surface prompt, the bash runtime
-* variable, the URL line, and the default-browser handoff.
+* Mount the Web runtime: dist serving, the bash runtime variable, the URL
+* line, and the default-browser handoff.
 * @param ctx - plugin context carrying the webServer service.
 * @param config - validated {@link Config}.
 */
 function apply(ctx, config) {
-	const runtime = resolveLanTrust(ctx.webServer.host, config.trustedHosts);
 	const publicUrl = config.publicUrl ?? void 0;
+	const boundHost = ctx.webServer.host;
+	if (publicUrl === void 0 && bindUrlHost(boundHost) === void 0) throw new Error(`web-app: bind address ${JSON.stringify(boundHost)} carries an interface zone id, which no URL can express; pass --public-url with the root browsers actually reach it through`);
+	if (ctx.webServer.protocol === "http:" && !isLoopbackHost(boundHost)) console.warn(`dsh web: listening on ${boundHost} over plain HTTP; restrict this port to a trusted proxy or network`);
 	const handoffBrowser = config.openBrowser && !launchedThroughSsh(launchEnvironmentOf(ctx));
-	ctx.provide(WEB_RUNTIME_SERVICE, runtime);
+	/** The advertised root: the canonical `publicUrl`, or the listener's own origin. */
+	const appRootUrl = () => publicUrl ?? ctx.webServer.getOrigin();
+	ctx.provide("webApp", { getAdvertisedUrl: appRootUrl });
 	ctx.plugin(FrontendStatic, { distIndex: internals.resolveDistIndex() });
-	if (config.surfaceContext) {
-		ctx.inject(["systemPrompt"], (promptCtx) => {
-			addHarnessSourceSection(promptCtx, SOURCE_ROOT);
-			promptCtx.systemPrompt.section({
-				name: "app:web-surface",
-				order: promptCtx.systemPrompt.getSectionOrder("WEB_SURFACE"),
-				text: () => webSurfacePrompt(appRootUrl(promptCtx, publicUrl))
-			});
-		});
-		ctx.inject(["shellEnv"], (runtimeCtx) => {
-			runtimeCtx.shellEnv.register({
-				name: "web-runtime",
-				variables: { [DSH_WEB_URL]: { description: "Advertised URL of the DeepSeek Harness Web GUI serving this session." } },
-				resolve: () => ({ [DSH_WEB_URL]: appRootUrl(runtimeCtx, publicUrl) })
-			});
+	if (config.surfaceContext) ctx.inject(["shellEnv"], (runtimeCtx) => {
+		runtimeCtx.shellEnv.register({
+			name: "web-runtime",
+			variables: { [DSH_WEB_URL]: { description: "Advertised URL of the DeepSeek Harness Web GUI serving this session." } },
+			resolve: () => ({ [DSH_WEB_URL]: appRootUrl() })
 		});
-	}
+	});
 	if (config.printUrl || handoffBrowser) ctx.inject(["connection"], (connectionCtx) => {
 		const announceReady = () => {
 			if (ANNOUNCED_ROOTS.has(connectionCtx.root)) return;
-			const webUrl = appRootUrl(connectionCtx, publicUrl);
+			const webUrl = appRootUrl();
 			const authenticatedUrl = connectionCtx.connection.authenticatedUrl(webUrl);
-			const lanCandidate = runtime.lanAddresses[0];
-			const port = connectionCtx.webServer.port;
-			const lanUrl = lanCandidate === void 0 ? void 0 : connectionCtx.connection.authenticatedUrl(`http://${lanCandidate}:${String(port)}`);
 			ANNOUNCED_ROOTS.add(connectionCtx.root);
-			if (config.printUrl) console.log(`dsh web: ${authenticatedUrl}${lanUrl === void 0 ? "" : ` (LAN: ${lanUrl})`}`);
+			if (config.printUrl) console.log(`dsh web: ${authenticatedUrl}`);
 			if (handoffBrowser) {
 				console.log("dsh web: opening the default browser; pass --no-open to disable");
 				internals.openBrowser(authenticatedUrl).catch((error) => {
@@ -226,4 +177,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { Config, apply, inject, internals, name, resolveLanTrust };
+export { Config, apply, inject, internals, name };

package/lib/startup.js

@@ -1,10 +1,11 @@
 import { t as parsePublicUrl } from "./public-url-D_dMK-yI.js";
+import { isWildcardHost } from "@deepseek-ai/dsh-host-webserver";
 import { Command } from "commander";
 import { parseCmdline } from "@deepseek-ai/dsh-cmdline";
 //#region lib/types/startup.js
 /**
 * The web app's command-line provider: it parses the `dsh --profile web` flag
-* family (`--host`, `--port`, `--public-url`, `--trusted-host`, `--no-open`)
+* family (`--host`, `--port`, `--public-url`, `--trusted-host`, `--no-open`, TLS)
 * and its `--help` text, then provides the immutable values as
 * {@link WEB_STARTUP_SERVICE}. Ordinary rows inject that service before
 * reading it from lazy config.
@@ -21,28 +22,37 @@ const WEB_STARTUP_SERVICE = "webStartup";
 * @returns a fresh program, so one process can parse more than once (tests).
 */
 function webCommand() {
-	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind host").option("--no-open", "do not open the Web UI in the default browser").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--public-url <url>", "advertise this HTTP(S) root in the printed, opened, web-surface, and DSH_WEB_URL forms; grants no trust").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").addHelpText("after", `
+	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind address: one concrete IPv4 or IPv6 literal of a local interface; wildcard addresses are rejected").option("--no-open", "do not open the Web UI in the default browser").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--public-url <url>", "advertise this HTTP(S) root in the printed, opened, runtime-context, and DSH_WEB_URL forms; grants no trust").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").option("--tls-cert <file>", "PEM server certificate chain; requires --tls-key").option("--tls-key <file>", "unencrypted PEM private key; requires --tls-cert").addHelpText("after", `
 Examples:
   dsh --profile web                          serve on the composed host and port
   dsh --profile web --no-open                serve without opening a browser
   dsh --profile web --port 8080              serve on another port
+  dsh --profile web --host 10.0.0.7          bind one local interface address
   dsh --profile web --public-url https://app.example/ui/ --trusted-host app.example
                                              advertise a prefix-stripping HTTPS proxy entry and admit its authority
+  dsh --profile web --tls-cert ./server-chain.pem --tls-key ./server-key.pem
+                                             serve HTTPS with an existing certificate and key
 `);
 }
 /**
 * Parse and provide the Web invocation as an ordinary Cordis service. The
-* command's action publishes the flags this invocation named; `--host 0.0.0.0`,
-* a non-numeric `--port`, or a malformed `--public-url` is a usage error, so on
-* rejection (and on `--help`) nothing is provided.
+* command's action publishes the flags this invocation named. Invalid flags,
+* including an unpaired TLS certificate or key, are usage errors; rejection
+* and `--help` provide no service.
 * @param ctx - plugin context carrying the command line.
 */
 function apply(ctx) {
 	const program = webCommand();
 	program.action(() => {
 		const options = program.opts();
-		if (options.host === "0.0.0.0") program.error("error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead");
+		if (options.host !== void 0 && isWildcardHost(options.host)) program.error(`error: --host ${options.host} is an unspecified (wildcard) address, which is not supported: binding every interface would expose remote code execution to the network; bind one concrete IPv4 or IPv6 address instead`);
 		if (options.port !== void 0 && !/^\d+$/.test(options.port)) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`);
+		let tls;
+		if (options.tlsCert !== void 0 && options.tlsKey !== void 0) tls = {
+			certFile: options.tlsCert,
+			keyFile: options.tlsKey
+		};
+		else if (options.tlsCert !== void 0 || options.tlsKey !== void 0) program.error("error: --tls-cert and --tls-key must be supplied together");
 		if (options.publicUrl !== void 0) try {
 			parsePublicUrl(options.publicUrl, "--public-url");
 		} catch (error) {
@@ -53,6 +63,7 @@ function apply(ctx) {
 			...options.host !== void 0 && { host: options.host },
 			...options.port !== void 0 && { port: Number(options.port) },
 			...options.publicUrl !== void 0 && { publicUrl: options.publicUrl },
+			...tls !== void 0 && { tls },
 			trustedHosts: options.trustedHost ?? []
 		});
 	});

package/lib/types/index.d.ts

@@ -4,15 +4,29 @@
  * manifest field). The plugin owns the browser-surface glue: it resolves
  * the built frontend dist (workspace knowledge of this bundle, never user
  * config), mounts the `frontend-static` fallback owner over it, registers the
- * harness-source and web-surface prompt sections, the bash-visible web runtime
- * variable, the process-token URL line, and the default-browser handoff. An
- * advertised `publicUrl` replaces the published root — the loopback URL
- * otherwise. App command-line values arrive through the `webStartup` service
- * expressions in the bundle patch.
+ * bash-visible web runtime variable, the process-token URL line, and the
+ * default-browser handoff, and provides the `webApp` service. An advertised
+ * `publicUrl` replaces the published bind-address URL. Non-loopback
+ * HTTP binds trigger an exposure warning. App command-line values arrive
+ * through the `webStartup` service expressions in the bundle patch.
  * @module @deepseek-ai/dsh-web-app
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
+/** The Web GUI this process serves, provided by the `web-runtime` row. */
+export interface WebApp {
+    /**
+     * The URL this GUI advertises, also used for `DSH_WEB_URL` and the startup URL line.
+     * @returns the configured `publicUrl`, otherwise the listener origin.
+     */
+    getAdvertisedUrl(): string;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        /** The Web GUI this process serves; absent when no Web runtime is mounted. */
+        webApp: WebApp;
+    }
+}
 /** Stable Cordis plugin name. */
 export declare const name = "web-app";
 /** Services required before the web runtime can mount. */
@@ -24,50 +38,28 @@ export interface Config {
     /** Print the URL line on activation; a non-interactive layer can turn it off. */
     printUrl: boolean;
     /**
-     * Register the model-visible surface context (the `app:web-surface` prompt
-     * section and the `DSH_WEB_URL` bash variable). A one-shot non-interactive
-     * layer can turn it off when its user is not in the GUI, so the
-     * orientation text would be false.
+     * Register the `DSH_WEB_URL` bash variable naming this GUI. A one-shot
+     * non-interactive layer can turn it off when its user is not in the GUI.
      */
     surfaceContext: boolean;
     /**
      * Canonical HTTP(S) root to advertise in the printed and opened URL,
-     * `DSH_WEB_URL`, and the web-surface orientation, e.g.
-     * `https://app.example/ui/`, normalized to end in `/`. Advertisement only;
-     * see [public deployments](../README.md#public-deployments). Absent or YAML
-     * `null` advertises the loopback URL.
+     * `DSH_WEB_URL`, and `webApp.getAdvertisedUrl()`, which supplies the Web GUI
+     * URL in agent runtime context, e.g. `https://app.example/ui/`, normalized to end in `/`. Configures no routing
+     * or authentication; see [public deployments](../README.md#public-deployments).
+     * Absent or YAML `null` advertises the bind-address URL.
      */
     publicUrl?: string;
-    /** Explicit `--trusted-host` authorities from this invocation. */
-    trustedHosts: string[];
 }
 export declare const Config: z<Config>;
-/** Bind-dependent Web values shared by the trust fence and URL display. */
-export interface WebRuntimeValues {
-    /** LAN IPv4 literals sampled once when the server binds all interfaces. */
-    lanAddresses: string[];
-    /** LAN literals followed by explicit invocation authorities. */
-    trustedHosts: string[];
-}
-/**
- * Resolve one LAN-trust snapshot from the active server bind.
- *
- * Derived entries are port-less IP literals: DNS rebinding needs an
- * attacker-controlled name, while an IP-literal Host is safe on any port and
- * an OS-assigned port is unknowable before bind.
- * @param bindHost - the active webserver bind host.
- * @param extra - explicit `--trusted-host` values, in argument order.
- * @returns the LAN display addresses and invocation-derived fence authorities.
- */
-export declare function resolveLanTrust(bindHost: string, extra: readonly string[]): WebRuntimeValues;
 /** Test hooks for the built dist and native browser handoff; production never mutates them. */
 export declare const internals: {
     resolveDistIndex: () => string;
     openBrowser: (url: string) => Promise<void>;
 };
 /**
- * Mount the Web runtime: dist serving, surface prompt, the bash runtime
- * variable, the URL line, and the default-browser handoff.
+ * Mount the Web runtime: dist serving, the bash runtime variable, the URL
+ * line, and the default-browser handoff.
  * @param ctx - plugin context carrying the webServer service.
  * @param config - validated {@link Config}.
  */

package/lib/types/startup.d.ts

@@ -1,12 +1,13 @@
 /**
  * The web app's command-line provider: it parses the `dsh --profile web` flag
- * family (`--host`, `--port`, `--public-url`, `--trusted-host`, `--no-open`)
+ * family (`--host`, `--port`, `--public-url`, `--trusted-host`, `--no-open`, TLS)
  * and its `--help` text, then provides the immutable values as
  * {@link WEB_STARTUP_SERVICE}. Ordinary rows inject that service before
  * reading it from lazy config.
  * @module @deepseek-ai/dsh-web-app/startup
  */
 import type { Context } from '@deepseek-ai/cordis';
+import { type TlsConfig } from '@deepseek-ai/dsh-host-webserver';
 /** Stable Cordis plugin name. */
 export declare const name = "web-startup";
 /** Services required before the flags can be resolved. */
@@ -28,12 +29,14 @@ export interface WebStartupValues {
     publicUrl?: string;
     /** Explicit `--trusted-host` authorities, in argument order. */
     trustedHosts: string[];
+    /** Server certificate chain and unencrypted private key supplied together. */
+    tls?: TlsConfig;
 }
 /**
  * Parse and provide the Web invocation as an ordinary Cordis service. The
- * command's action publishes the flags this invocation named; `--host 0.0.0.0`,
- * a non-numeric `--port`, or a malformed `--public-url` is a usage error, so on
- * rejection (and on `--help`) nothing is provided.
+ * command's action publishes the flags this invocation named. Invalid flags,
+ * including an unpaired TLS certificate or key, are usage errors; rejection
+ * and `--help` provide no service.
  * @param ctx - plugin context carrying the command line.
  */
 export declare function apply(ctx: Context): void;

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "web-app"
+  }
+}

package/locale/startup/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "web-app/startup"
+  }
+}

package/locale/startup/zh.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "Web 启动配置"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Web 应用运行支持",
+    "description": "提供前端页面资源，并连接 Web 应用所需的运行配置。"
+  }
+}