@dsh-cove/dsh-web-all 0.0.0-stage → 0.4.3

package/lib/types/core/worktree/workspace-model.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Workspace-scoped model presets: domain types shared between the host
+ * half and the browser half. Everything crossing the HTTP boundary lands
+ * here first so the JSON contract is one source of truth.
+ *
+ * The granularity is **workspace**: a preset is keyed by the canonical
+ * workspace directory path (the same value the DSH session header records
+ * as `cwd` at session creation). Each workspace — a plain directory or a
+ * worktree — carries one `{ provider, model, reasoningEffort? }` selection
+ * that overrides the session's otherwise-resolved model from its very first
+ * request.
+ * @module @dsh-cove/dsh-client-ui-worktree/core/workspace-model
+ */
+/** One workspace's model preset. `reasoningEffort` is adapter-owned and
+ *  optional — absent means the selected model's provider default applies. */
+export interface WorkspaceModelPreset {
+    /** Registered provider route id. */
+    provider: string;
+    /** Provider-owned model id. */
+    model: string;
+    /** Adapter-owned reasoning effort id, or provider default when absent. */
+    reasoningEffort?: string;
+}
+/** The stored document: a map from canonical workspace path to preset. */
+export type WorkspacePresetMap = Record<string, WorkspaceModelPreset>;
+/** The effective display form a preset may take. */
+export interface EffectiveWorkspaceModel {
+    /** Whether the workspace has an explicit preset. */
+    preset?: WorkspaceModelPreset;
+}
+/** A read of one workspace's effective model selection. */
+export interface WorkspaceModelView {
+    /** Canonical workspace path the preset is keyed by. */
+    path: string;
+    /** Explicit preset when registered; undefined when none. */
+    preset?: WorkspaceModelPreset;
+}
+/** Mutation input: set/clear a preset for one canonical workspace path. */
+export interface SetWorkspaceModelInput {
+    /** Canonical workspace path (the preset key). */
+    path: string;
+    /** The preset to store. */
+    preset: WorkspaceModelPreset;
+}
+/** Domain error shape returned over HTTP (status >= 400). */
+export interface WorkspaceModelErrorView {
+    ok: false;
+    code: 'bad-request' | 'forbidden';
+    message: string;
+}
+/** Discriminated union for HTTP responses. */
+export type WorkspaceModelResponse<T = void> = {
+    ok: true;
+    value: T;
+} | WorkspaceModelErrorView;
+//# sourceMappingURL=workspace-model.d.ts.map

package/lib/types/core/worktree/workspace-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-model.d.ts","sourceRoot":"","sources":["../../../../src/core/worktree/workspace-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;6EAC6E;AAC7E,MAAM,WAAW,oBAAoB;IACnC,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;AAErE,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC,oDAAoD;IACpD,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B;AAED,2DAA2D;AAC3D,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAA;IACZ,2BAA2B;IAC3B,MAAM,EAAE,oBAAoB,CAAA;CAC7B;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,aAAa,GAAG,WAAW,CAAA;IACjC,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,8CAA8C;AAC9C,MAAM,MAAM,sBAAsB,CAAC,CAAC,GAAG,IAAI,IACvC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB,uBAAuB,CAAA"}

package/lib/types/core/worktree/workspace-model.js

@@ -0,0 +1,14 @@
+/**
+ * Workspace-scoped model presets: domain types shared between the host
+ * half and the browser half. Everything crossing the HTTP boundary lands
+ * here first so the JSON contract is one source of truth.
+ *
+ * The granularity is **workspace**: a preset is keyed by the canonical
+ * workspace directory path (the same value the DSH session header records
+ * as `cwd` at session creation). Each workspace — a plain directory or a
+ * worktree — carries one `{ provider, model, reasoningEffort? }` selection
+ * that overrides the session's otherwise-resolved model from its very first
+ * request.
+ * @module @dsh-cove/dsh-client-ui-worktree/core/workspace-model
+ */
+export {};

package/lib/types/host/services/access-trust/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Host access-trust service domain: the single admission decision every
+ * privileged web-all host route family consults (see `./trust.ts` for the
+ * rule itself).
+ *
+ * The deployment's browser authorities come from `ctx.webRuntime`, the service
+ * `dsh-web-app` provides for the active bind (`trustedHosts` = invocation-
+ * derived LAN literals plus `--trusted-host`). Browser-session admission comes
+ * from the connection service's private `BrowserAuth`, the same object DSH
+ * uses for `/api`; `remote-web-ui` composes the web-all account session into it
+ * and `no-browser-auth` may replace it when a deployment explicitly opts out.
+ * Both are read per request so a late mount (or a settings-driven repatch) is
+ * picked up without remounting.
+ *
+ * Fail-closed: a missing `webRuntime`, a missing/reshaped `BrowserAuth`, an
+ * undeclared Host, or a request without a session predicate falls back to the
+ * strict loopback rule.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { IncomingMessage } from 'node:http';
+import { type HostTrustOptions } from './trust.ts';
+/** Cordis service name carrying the admission decision. */
+export declare const ACCESS_TRUST_SERVICE = "webAllAccessTrust";
+/** The admission decision one request is asked for. */
+export interface AccessTrust {
+    /** Whether this request may reach a privileged host surface. */
+    isTrusted(request: IncomingMessage): boolean;
+}
+/** Authorities this deployment declares as its browser entries (never trusted as a wildcard). */
+export declare function trustedAuthoritiesOf(ctx: Context): readonly string[];
+/**
+ * Browser-session admission, read fresh per request because both the
+ * integrated-auth adapter and the legacy bypass patch the same method.
+ * @returns the predicate, or undefined when the connection shape is unavailable.
+ */
+export declare function browserSessionPredicateOf(ctx: Context): ((request: IncomingMessage) => boolean) | undefined;
+/** Live admission options for one request. */
+export declare function hostTrustOptionsOf(ctx: Context): HostTrustOptions;
+/**
+ * Mount the service domain.
+ * @param ctx - host plugin context.
+ * @returns the disposer releasing the provided service.
+ */
+export declare function register(ctx: Context): () => void;
+/**
+ * Resolve the admission decision for one route family. Families resolve this
+ * through their own `register(ctx)` and keep serving the strict loopback rule
+ * whenever the service is not (or not yet) provided, so a partially mounted
+ * plugin can never widen access.
+ * @param ctx - the context the family was mounted on.
+ * @returns the per-request admission decision.
+ */
+export declare function accessTrustOf(ctx: Context): AccessTrust;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/host/services/access-trust/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/access-trust/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAA2C,KAAK,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAE3F,2DAA2D;AAC3D,eAAO,MAAM,oBAAoB,sBAAsB,CAAA;AAEvD,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAA;CAC7C;AA8BD,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,SAAS,CAU3G;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAKjE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,IAAI,CAMjD;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,CAcvD"}

package/lib/types/host/services/access-trust/index.js

@@ -0,0 +1,82 @@
+import { isLoopbackRequest, isTrustedHostRequest } from "./trust.js";
+/** Cordis service name carrying the admission decision. */
+export const ACCESS_TRUST_SERVICE = 'webAllAccessTrust';
+/** Optional service lookup that never throws on a missing or reshaped service. */
+function optionalService(ctx, name) {
+    const get = ctx.get;
+    if (typeof get !== 'function')
+        return undefined;
+    try {
+        return get.call(ctx, name, false);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Authorities this deployment declares as its browser entries (never trusted as a wildcard). */
+export function trustedAuthoritiesOf(ctx) {
+    const runtime = optionalService(ctx, 'webRuntime');
+    const hosts = runtime?.trustedHosts;
+    return Array.isArray(hosts) ? hosts.filter((entry) => typeof entry === 'string') : [];
+}
+/**
+ * Browser-session admission, read fresh per request because both the
+ * integrated-auth adapter and the legacy bypass patch the same method.
+ * @returns the predicate, or undefined when the connection shape is unavailable.
+ */
+export function browserSessionPredicateOf(ctx) {
+    return (request) => {
+        const auth = optionalService(ctx, 'connection')?.browserAuth;
+        if (auth === undefined || typeof auth.isAuthenticated !== 'function')
+            return false;
+        try {
+            return auth.isAuthenticated(request) === true;
+        }
+        catch {
+            return false;
+        }
+    };
+}
+/** Live admission options for one request. */
+export function hostTrustOptionsOf(ctx) {
+    return {
+        trustedAuthorities: trustedAuthoritiesOf(ctx),
+        isAuthenticated: browserSessionPredicateOf(ctx),
+    };
+}
+/**
+ * Mount the service domain.
+ * @param ctx - host plugin context.
+ * @returns the disposer releasing the provided service.
+ */
+export function register(ctx) {
+    const trust = {
+        isTrusted: (request) => isTrustedHostRequest(request, hostTrustOptionsOf(ctx)),
+    };
+    const dispose = ctx.provide(ACCESS_TRUST_SERVICE, trust);
+    return () => { void dispose(); };
+}
+/**
+ * Resolve the admission decision for one route family. Families resolve this
+ * through their own `register(ctx)` and keep serving the strict loopback rule
+ * whenever the service is not (or not yet) provided, so a partially mounted
+ * plugin can never widen access.
+ * @param ctx - the context the family was mounted on.
+ * @returns the per-request admission decision.
+ */
+export function accessTrustOf(ctx) {
+    return {
+        isTrusted: (request) => {
+            const provided = optionalService(ctx, ACCESS_TRUST_SERVICE);
+            if (provided !== undefined && typeof provided.isTrusted === 'function') {
+                try {
+                    return provided.isTrusted(request) === true;
+                }
+                catch {
+                    return false;
+                }
+            }
+            return isLoopbackRequest(request);
+        },
+    };
+}

package/lib/types/host/services/access-trust/trust.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Unified host request-trust fence for the web-all plugin route families.
+ *
+ * Every privileged host surface of this plugin (Git workbench, Agent Browser
+ * control plane, worktree mutations, SSH, memoir, schedule mode, workbench
+ * reads) previously carried its own ad-hoc loopback check. Those checks were
+ * inconsistent: some demanded a loopback socket AND a loopback Host, others
+ * only the socket — and behind a same-host reverse proxy (the documented
+ * NetBird topology: browser -> nginx:80 -> 127.0.0.1:3080 with Host preserved)
+ * every request arrives on a loopback socket, so the socket-only variants let
+ * unauthenticated remote browsers through while the Host-checking variants
+ * refused the deployment's own canonical entry.
+ *
+ * This module is the single rule:
+ *
+ * 1. the socket must be loopback (the plugin never serves a public listener);
+ * 2. the Host authority must be loopback, OR a deployment-declared trusted
+ *    authority (`ctx.webRuntime.trustedHosts`: the invocation-derived LAN
+ *    literals plus `--trusted-host`) carrying an authenticated browser
+ *    session — the same admission decision DSH itself applies to `/api`;
+ * 3. `sec-fetch-site: cross-site` is refused;
+ * 4. when an `Origin` is attached it must be same-origin with the Host.
+ *
+ * The socket address is authoritative and `X-Forwarded-For` is never trusted:
+ * a proxy that shapes requests as loopback (this plugin's own server-mode
+ * gateway) is indistinguishable from a local browser by design, which is why
+ * the trusted-authority branch additionally demands the browser session.
+ * @module dsh-web-all/host-access-trust
+ */
+import type { IncomingMessage } from 'node:http';
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export declare function isIPv4Loopback(v4: string): boolean;
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export declare function isLoopbackAddress(address: string | undefined): boolean;
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether a request Host matches one declared trusted authority. An entry with
+ * an explicit port matches that exact authority; a port-less entry matches the
+ * hostname on any port (the shape the CLI derives for IP-literal serving,
+ * where the bound port may be OS-assigned). Both sides compare through WHATWG
+ * normalization, so case and a redundant `:80` never decide trust.
+ */
+export declare function matchesTrustedAuthority(hostUrl: URL, authorities: readonly string[]): boolean;
+/** Admission inputs for one request. */
+export interface HostTrustOptions {
+    /** Non-loopback authorities this deployment serves (`host` or `host:port`). */
+    trustedAuthorities?: readonly string[];
+    /** Browser-session admission for a trusted non-loopback authority; absent denies. */
+    isAuthenticated?: (request: IncomingMessage) => boolean;
+}
+/** Parse the request Host header; undefined when absent or unparsable. */
+export declare function hostUrlOf(request: IncomingMessage): URL | undefined;
+/**
+ * Whether a request may reach a loopback privilege surface (the strict
+ * loopback-only rule: loopback socket AND loopback Host AND same-origin
+ * markers). Use this for surfaces that must never accept a remote browser.
+ */
+export declare function isLoopbackRequest(request: IncomingMessage): boolean;
+/**
+ * Whether a request may reach a privileged plugin host surface: loopback, or a
+ * deployment-declared trusted authority carrying an authenticated browser
+ * session. Fails closed whenever the Host is unparsable, the authority is not
+ * declared, or no session predicate is available.
+ * @param request - the incoming HTTP request (or upgrade request).
+ * @param options - deployment authorities and the browser-session predicate.
+ * @returns true when the request is trusted.
+ */
+export declare function isTrustedHostRequest(request: IncomingMessage, options?: HostTrustOptions): boolean;
+//# sourceMappingURL=trust.d.ts.map

package/lib/types/host/services/access-trust/trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/access-trust/trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAEhD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAKlD;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAMtE;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5D;AA+CD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAQ7F;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,qFAAqF;IACrF,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAA;CACxD;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,GAAG,GAAG,SAAS,CAWnE;AAeD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAKnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAetG"}

package/lib/types/host/services/access-trust/trust.js

@@ -0,0 +1,187 @@
+/**
+ * Unified host request-trust fence for the web-all plugin route families.
+ *
+ * Every privileged host surface of this plugin (Git workbench, Agent Browser
+ * control plane, worktree mutations, SSH, memoir, schedule mode, workbench
+ * reads) previously carried its own ad-hoc loopback check. Those checks were
+ * inconsistent: some demanded a loopback socket AND a loopback Host, others
+ * only the socket — and behind a same-host reverse proxy (the documented
+ * NetBird topology: browser -> nginx:80 -> 127.0.0.1:3080 with Host preserved)
+ * every request arrives on a loopback socket, so the socket-only variants let
+ * unauthenticated remote browsers through while the Host-checking variants
+ * refused the deployment's own canonical entry.
+ *
+ * This module is the single rule:
+ *
+ * 1. the socket must be loopback (the plugin never serves a public listener);
+ * 2. the Host authority must be loopback, OR a deployment-declared trusted
+ *    authority (`ctx.webRuntime.trustedHosts`: the invocation-derived LAN
+ *    literals plus `--trusted-host`) carrying an authenticated browser
+ *    session — the same admission decision DSH itself applies to `/api`;
+ * 3. `sec-fetch-site: cross-site` is refused;
+ * 4. when an `Origin` is attached it must be same-origin with the Host.
+ *
+ * The socket address is authoritative and `X-Forwarded-For` is never trusted:
+ * a proxy that shapes requests as loopback (this plugin's own server-mode
+ * gateway) is indistinguishable from a local browser by design, which is why
+ * the trusted-authority branch additionally demands the browser session.
+ * @module dsh-web-all/host-access-trust
+ */
+/** IPv4 127/8 predicate (four decimal octets, first == 127). */
+export function isIPv4Loopback(v4) {
+    const parts = v4.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/** Whether a socket remote address names the loopback range (127/8, ::1, IPv4-mapped). */
+export function isLoopbackAddress(address) {
+    if (address === undefined)
+        return false;
+    const normalized = address.toLowerCase();
+    if (normalized === '::1')
+        return true;
+    if (normalized.startsWith('::ffff:'))
+        return isIPv4Loopback(normalized.slice('::ffff:'.length));
+    return isIPv4Loopback(normalized);
+}
+/** Whether a normalized URL hostname names the loopback authority (localhost, [::1], 127/8). */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    return isIPv4Loopback(hostname);
+}
+/**
+ * Parse one declared authority, rejecting anything that is not a bare
+ * `host[:port]` that survives WHATWG parsing unchanged. This mirrors the SDK's
+ * own `trustedHosts` assertion: a path, userinfo, query, fragment, surrounding
+ * whitespace or a non-canonical spelling (`0x7f.0.0.1`, zero-padded port) would
+ * silently widen or move the grant, so it fails closed here just as at config
+ * load. Any explicit port counts (including `:80` / `:443`), because the
+ * deployment wrote the authority it serves.
+ */
+function canonicalAuthority(entry) {
+    if (entry === '')
+        return undefined;
+    let url;
+    try {
+        url = new URL(`http://${entry}`);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '')
+        return undefined;
+    if (!(url.pathname === '' || url.pathname === '/'))
+        return undefined;
+    if (url.hostname === '')
+        return undefined;
+    // `new URL('http://host:80')` drops the default port, so read the written
+    // port from an https parse, whose default port differs.
+    let explicitPort = url.port;
+    if (explicitPort === '') {
+        try {
+            explicitPort = new URL(`https://${entry}`).port;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const canonical = explicitPort === '' ? url.hostname : `${url.hostname}:${explicitPort}`;
+    if (canonical !== entry.toLowerCase())
+        return undefined;
+    return explicitPort === ''
+        ? { hostname: url.hostname }
+        : { hostname: url.hostname, hostWithPort: canonical };
+}
+/**
+ * Whether a request Host matches one declared trusted authority. An entry with
+ * an explicit port matches that exact authority; a port-less entry matches the
+ * hostname on any port (the shape the CLI derives for IP-literal serving,
+ * where the bound port may be OS-assigned). Both sides compare through WHATWG
+ * normalization, so case and a redundant `:80` never decide trust.
+ */
+export function matchesTrustedAuthority(hostUrl, authorities) {
+    return authorities.some((entry) => {
+        const parsed = canonicalAuthority(entry);
+        if (parsed === undefined)
+            return false;
+        return parsed.hostWithPort === undefined
+            ? parsed.hostname === hostUrl.hostname
+            : parsed.hostWithPort === hostUrl.host;
+    });
+}
+/** Parse the request Host header; undefined when absent or unparsable. */
+export function hostUrlOf(request) {
+    const host = request.headers?.host;
+    if (typeof host !== 'string' || host === '')
+        return undefined;
+    // Host is an authority, not a URL. WHATWG parsing otherwise silently drops
+    // userinfo, paths, fragments and control whitespace before the trust check.
+    if (/[\s\\/?#@]/.test(host))
+        return undefined;
+    try {
+        return new URL(`http://${host}`);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Browser same-origin markers: cross-site is refused, an Origin must match the Host. */
+function sameOriginMarkers(request, hostUrl) {
+    const headers = request.headers ?? {};
+    if (headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    const origin = headers.origin;
+    if (origin === undefined)
+        return true;
+    try {
+        return new URL(origin).host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a request may reach a loopback privilege surface (the strict
+ * loopback-only rule: loopback socket AND loopback Host AND same-origin
+ * markers). Use this for surfaces that must never accept a remote browser.
+ */
+export function isLoopbackRequest(request) {
+    if (!isLoopbackAddress(request.socket?.remoteAddress))
+        return false;
+    const hostUrl = hostUrlOf(request);
+    if (hostUrl === undefined || !isLoopbackHostname(hostUrl.hostname))
+        return false;
+    return sameOriginMarkers(request, hostUrl);
+}
+/**
+ * Whether a request may reach a privileged plugin host surface: loopback, or a
+ * deployment-declared trusted authority carrying an authenticated browser
+ * session. Fails closed whenever the Host is unparsable, the authority is not
+ * declared, or no session predicate is available.
+ * @param request - the incoming HTTP request (or upgrade request).
+ * @param options - deployment authorities and the browser-session predicate.
+ * @returns true when the request is trusted.
+ */
+export function isTrustedHostRequest(request, options = {}) {
+    if (!isLoopbackAddress(request.socket?.remoteAddress))
+        return false;
+    const hostUrl = hostUrlOf(request);
+    if (hostUrl === undefined)
+        return false;
+    if (!isLoopbackHostname(hostUrl.hostname)) {
+        if (!matchesTrustedAuthority(hostUrl, options.trustedAuthorities ?? []))
+            return false;
+        let authenticated = false;
+        try {
+            authenticated = options.isAuthenticated?.(request) === true;
+        }
+        catch {
+            authenticated = false;
+        }
+        if (!authenticated)
+            return false;
+    }
+    return sameOriginMarkers(request, hostUrl);
+}

package/lib/types/host/services/codex-bridge/bridge.d.ts

@@ -0,0 +1,106 @@
+/**
+ * dsh-api-proxy process management for the codex-bridge service domain.
+ *
+ * Spawns (or adopts) the standalone dsh-api-proxy node service, keeps its
+ * generated config.yaml in the proxy directory, and exposes health / models /
+ * accounts / verification probes. The client api key is minted once and
+ * persisted next to the config (0600), so it stays stable across restarts.
+ * All HTTP calls target 127.0.0.1 only.
+ *
+ * Ported verbatim from the pre-merge @dsh-cove/dsh-codex-bridge package
+ * (src/bridge.ts) into the dsh-web-all host services.
+ */
+import { type CodexAuthStatus, type DeviceCodeGrant } from './codex-auth.ts';
+/** Phase of an in-flight device-code login. */
+export type DeviceLoginPhase = 'idle' | 'waiting' | 'success' | 'failed' | 'timeout' | 'cancelled';
+export interface DeviceLoginState {
+    phase: DeviceLoginPhase;
+    grant?: DeviceCodeGrant;
+    email?: string;
+    error?: string;
+}
+export interface BridgeOptions {
+    proxyDir: string;
+    host?: string;
+    port?: number;
+    authFile?: string;
+    apiKey?: string;
+}
+export interface BridgeStatus {
+    proxy: 'stopped' | 'starting' | 'running' | 'failed';
+    port: number;
+    baseURL: string;
+    apiKeyConfigured: boolean;
+    auth: CodexAuthStatus;
+    models: string[];
+    accountEmail?: string;
+    accountPlan?: string;
+    lastError?: string;
+    adopted: boolean;
+}
+export declare class ApiProxyBridge {
+    readonly port: number;
+    readonly host: string;
+    readonly authFile: string;
+    readonly baseURL: string;
+    private readonly proxyDir;
+    private readonly configuredKey;
+    private child;
+    private adopted;
+    private lastError;
+    private loginState;
+    private loginAbort;
+    constructor(options: BridgeOptions);
+    private keyFilePath;
+    /**
+     * Stable client api key, resolved in order: configured value, the key an
+     * existing (adopted) service's config.yaml carries, the persisted key file,
+     * or a fresh mint.
+     */
+    apiKey(): string;
+    /** Extract the first api key from an existing dsh-api-proxy config.yaml. */
+    private readKeyFromProxyConfig;
+    private proxyConfigPath;
+    /** Ensure the proxy config.yaml exists with our endpoint, the codex auth
+     *  file, and the stable api key. */
+    ensureConfig(): {
+        key: string;
+        configPath: string;
+    };
+    /** True when a service already answers on our endpoint (adopt mode). */
+    detectExisting(signal?: AbortSignal): Promise<boolean>;
+    /** Spawn the proxy service and wait for /health; adopt an existing one. */
+    start(): Promise<void>;
+    private waitForHealth;
+    /** Stop a child we spawned (adopted services are left alone). */
+    stop(): void;
+    restart(): Promise<void>;
+    /** Current device-login state. */
+    deviceLoginState(): DeviceLoginState;
+    /**
+     * Start a device-code login: request the one-time code, surface it, then
+     * poll in the background, exchange and persist tokens on success. The
+     * returned grant is what the UI shows the user.
+     */
+    startDeviceLogin(fetchImpl?: typeof fetch): Promise<DeviceCodeGrant>;
+    private runDevicePoll;
+    cancelDeviceLogin(): void;
+    private authedFetch;
+    listModels(): Promise<string[]>;
+    accounts(): Promise<{
+        email?: string;
+        planType?: string;
+    } | undefined>;
+    /**
+     * Verify the whole chain end to end: models endpoint plus one minimal
+     * chat completion through the codex backend.
+     */
+    verify(model?: string): Promise<{
+        ok: boolean;
+        model?: string;
+        reply?: string;
+        error?: string;
+    }>;
+    status(auth: CodexAuthStatus): Promise<BridgeStatus>;
+}
+//# sourceMappingURL=bridge.d.ts.map

package/lib/types/host/services/codex-bridge/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../../../src/host/services/codex-bridge/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,EAOL,KAAK,eAAe,EACpB,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAA;AAExB,+CAA+C;AAC/C,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAA;AAElG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,gBAAgB,CAAA;IACvB,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,eAAe,CAAA;IACrB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;CACjB;AAOD,qBAAa,cAAc;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoB;IAClD,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,UAAU,CAA6B;gBAEnC,OAAO,EAAE,aAAa;IASlC,OAAO,CAAC,WAAW;IAInB;;;;OAIG;IACH,MAAM,IAAI,MAAM;IAmBhB,4EAA4E;IAC5E,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,eAAe;IAIvB;wCACoC;IACpC,YAAY,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAsBnD,wEAAwE;IAClE,cAAc,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAS5D,2EAA2E;IACrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YA+Bd,aAAa;IAW3B,iEAAiE;IACjE,IAAI,IAAI,IAAI;IAON,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,kCAAkC;IAClC,gBAAgB,IAAI,gBAAgB;IAIpC;;;;OAIG;IACG,gBAAgB,CACpB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC;YAWb,aAAa;IAsC3B,iBAAiB,IAAI,IAAI;YAKX,WAAW;IAOnB,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAW/B,QAAQ,IAAI,OAAO,CAAC;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAc5E;;;OAGG;IACG,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBhG,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;CAiB3D"}