@fonlan/dsh-web-auth 0.1.10 → 0.2.2

package/README.md

@@ -6,11 +6,11 @@
 
 - **登录页 + HttpOnly 签名 Cookie**（HMAC-SHA256，7 天滑动续期），浏览器自动携带，HTTP / WebSocket / SSE / 静态资源全覆盖
 - **首次设置**：未配置密码时，登录页显示「设置访问密码」表单（引导流程，见下文安全说明）
-- **GUI 改密**：设置 → 插件 →「访问认证」卡片（插件配置 tab），需旧密码；改密后**轮换签名密钥，所有已登录会话立即下线**
+- **GUI 改密**：设置 → 侧栏「访问认证」页面，需旧密码；改密后**轮换签名密钥，所有已登录会话立即下线**
 - **退出登录**：设置卡片按钮，或访问 `/logout`
 - **防爆破**：登录与改密接口按客户端 IP 限速（连续 5 次失败锁 1 分钟起，指数退避至 30 分钟；15 分钟内累计）
-- **反代友好**：Cookie `Secure` 自动跟随 `x-forwarded-proto`；限速信任回环对端的 `X-Forwarded-For`
-- **监听地址切换**：设置卡片可一键把 dsh 的监听地址在 `127.0.0.1`（仅本机）与 `0.0.0.0`（所有网卡 / 局域网可访问）之间切换，热生效、无需重启进程（写入 `web-auth` settings 命名空间 → host 半区应用 patch → HMR 重绑 webserver）
+- **反代友好**：Cookie `Secure` 自动跟随 `x-forwarded-proto`；限速信任本机对端的 `X-Forwarded-For`
+- **监听地址切换**：设置卡片可在**本机网卡的具体地址**之间切换（含 `127.0.0.1` 仅本机、以及每张网卡的 IP），热生效、无需重启进程（REST → host 半区应用 patch → HMR 重绑 webserver）。**不再提供 `0.0.0.0`**：dsh `0.2.1-alpha.2` 起通配符地址会在解析配置阶段直接让启动失败，写进去即硬砖（见下文「通配符与启动失败」）
 - **远程设置解锁（可选）**：`unlockRemoteSettings` 组合配置在启动页注入 `__DSH_TRANSPORT__.ownsHost` 标志，让反代域名下的设置面（模型页、插件配置、常规设置等）完整可用，默认关闭（见下文安全权衡）
 - **启动令牌收口**：未登录浏览器带旧 `?token=` 链接访问一律重定向回登录页，只有插件自身的服务端 mint 走回环放行通道——既不需要手工引导，也不会再撞上 DSH 的 `401` 死页面（`0.1.7` 起）
 - 密码以 **scrypt 加盐哈希**存储（`$DSH_HOME/web-auth/password.hash`，0600），永不回显、不落明文配置
@@ -29,6 +29,8 @@ dsh plugin --profile web update @fonlan/dsh-web-auth
 
 > 安装后**需要重启 dsh web 进程**才生效（当前会话会短暂断连重连）。
 
+**宿主兼容性**：`0.2.1` 面向 dsh `^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2`，含两处按宿主演进做的适配：取值域去掉通配符（宿主 `0.2.1-alpha.2` 起拒绝），设置页不再依赖已被移除的客户端 `settingsScope` 服务（改走本插件 REST）。在更早的 `0.1.x` 宿主上本插件同样可用，但请勿把监听地址设成 `0.0.0.0`——宿主一旦升级到 `0.2.1-alpha.2`，该值会让 dsh 无法启动（见下文「通配符与启动失败」）。
+
 ## 激活（首次设置密码）
 
 重启后打开 dsh web，会被重定向到登录页：
@@ -36,7 +38,7 @@ dsh plugin --profile web update @fonlan/dsh-web-auth
 1. 未设置过密码时，登录页显示「设置访问密码」——输入 **≥8 位**的新密码并确认
 2. 设置成功后立即签发会话并跳回原页面；此后每次访问都要输密码
 
-改密入口在 **设置 → 插件 → 插件配置 → 访问认证**（需先登录）。
+改密入口在 **设置 → 侧栏「访问认证」**（需先登录）。
 
 ## 行为细节
 
@@ -55,22 +57,58 @@ dsh plugin --profile web update @fonlan/dsh-web-auth
 | 连续失败 | 按 IP 限速，提示「尝试过于频繁」 |
 | 会话过期 | 跳回登录页；滑动续期：剩余不足 24h 自动刷新 |
 | 修改密码 | 校验旧密码 → 轮换签名密钥 → **全员下线**，跳转登录页 |
-| 切换监听地址（设置卡片） | 校验取值（仅 `127.0.0.1` / `0.0.0.0`）→ 写入 `web-auth` settings 命名空间（revision 设栅）→ host 半区应用 patch（profile 优先，home 兜底）→ HMR 热重载 webserver 重新绑定；**WebSocket 短暂断连后自动重连** |
+| 切换监听地址（设置卡片） | 校验取值（必须是具体 IPv4/IPv6 字面量，**通配符被拒绝**）→ `POST /api/web-auth/listen` → host 半区应用 patch（profile 优先，home 兜底）→ HMR 热重载 webserver 重新绑定；**WebSocket 短暂断连后自动重连** |
 | `/logout` | 清除 Cookie，跳转登录页 |
 
 > **无需再处理 DSH 自己的启动令牌**：DSH 的浏览器会话认证（`dsh web` 启动时打印的 `http://127.0.0.1:3080/?token=…`）用 cookie 绑定 Host。插件会把所有已认证请求的 Host 改写为回环地址，而 DSH 的 cookie 必须与「DSH 看到的 Host」一致——`0.1.5` 起插件会在登录/会话期间**自动在服务端完成 DSH 令牌交换**并把 `dsh-auth` cookie 转交给浏览器（含持续续期），所以外部设备、新浏览器都不需要再手工访问带 token 的 URL。`0.1.7` 起这条路径进一步收紧：未登录浏览器带 `token` 访问会被重定向到 `/login` 并丢弃该参数（旧令牌在 dsh 重启后即失效，放行只会展示 DSH 自己的 `401` 页面），登录本身就已经完成 mint，不再需要任何手工引导步骤。
 
 ### 切换监听地址
 
-dsh 默认只监听 `127.0.0.1`。在 **设置 → 插件 → 插件配置 → 访问认证** 卡片底部可以把它切换为 `0.0.0.0`（所有网卡，局域网可访问），或切回仅本机——无需重启 dsh 进程：
+dsh 默认只监听 `127.0.0.1`。在 **设置 → 侧栏「访问认证」** 页面底部可以把它切换为本机任意网卡上的**具体地址**（列表由 host 半区枚举 `os.networkInterfaces()` 生成），或切回 `127.0.0.1` 仅本机——无需重启 dsh 进程：
 
-- 切换写入 `web-auth` settings 命名空间（`$DSH_HOME/settings.yaml`，revision 设栅）；host 半区监听到提交后应用到当前部署的 patch 层：profile 的 `cordis.patch.yml`；若 home 层（`$DSH_HOME/cordis.patch.yml`）已声明 webserver 行则写 home 层（home 优先级更高，改在低层会被覆盖）。文件里其余内容（注释、`!!js` 端口表达式）原样保留。
-- dsh 的 HMR 会监听到 patch 文件变化并热重载 webserver 行：**关闭旧监听、按新地址重新绑定**，全程无需重启进程。重启进程后该设置依然生效（settings 命名空间 + patch 文件都在）。
+- 页面先 `GET /api/web-auth/status` 取当前地址与候选列表（`allowed`），提交时 `POST /api/web-auth/listen`；host 半区把取值写进当前部署的 patch 层：profile 的 `cordis.patch.yml`；若 home 层（`$DSH_HOME/cordis.patch.yml`）已声明 webserver 行则写 home 层（home 优先级更高，改在低层会被覆盖）。文件里其余内容（注释、`!!js` 端口表达式）原样保留。
+- 写入前统一过 `isLocalListenHost`：必须是 IPv4/IPv6 **字面量**、不是通配符、并且**确实是本机网卡拥有的地址**，否则直接拒绝（`400 invalid-host`，响应里附上合法候选列表），不会写坏文件。下拉列表即由同一枚举生成，页面不可能提供一个写不进去的值。
+- dsh 的 HMR 会监听到 patch 文件变化并热重载 webserver 行：**关闭旧监听、按新地址重新绑定**，全程无需重启进程。重启进程后该设置依然生效（patch 文件在）。
 - 切换瞬间所有连接（包括当前页面与 WebSocket）会断开重连，属正常现象；卡片会轮询状态确认新地址生效。
-- 注意：若你正通过**局域网 IP**（`0.0.0.0` 模式）访问并切回 `127.0.0.1`，切回后只能在本机访问，请改用 `127.0.0.1` 重新打开页面。
+- **绑定具体网卡地址后 `127.0.0.1` 不再监听**：本机也必须改用该地址访问（`http://<网卡地址>:3080`）。想同时保留本机与局域网入口，请让 dsh 继续监听 `127.0.0.1`，另在本机放一层反代监听局域网/公网并指向它——这也是 dsh 现在推荐的暴露方式。
+- 注意：若你正通过**局域网 IP** 访问并切回 `127.0.0.1`，切回后只能在本机访问，请改用 `127.0.0.1` 重新打开页面。
 
 > 该能力依赖 webserver 行位于 profile/home patch 层（默认安装即如此）。若你的 webserver 配置来自自定义 `--patch` overlay，请直接编辑 overlay 文件。
 
+### 写入值导致启动失败（三类，及恢复方式）
+
+监听地址是**组合配置**，写在 patch 文件里、由 loader 在启动时读取。因此一个写坏的取值不是「绑定失败」而已——它会让**下一次启动整体失败**，而本插件自己也在 waiting、无法自救。`0.2.0` 把所有已知的三类都堵在写入之前：
+
+| 类别 | 写坏后会看到 | 插件现在如何拦截 |
+|---|---|---|
+| 通配符 `0.0.0.0` / `::` | 解析配置阶段报 `host "0.0.0.0" is an unspecified (wildcard) address, which is not supported …` | 通配符一律拒绝（`400 invalid-host` / 写盘前抛错） |
+| 本机没有的地址（如 macOS 上的 `127.0.0.2`、过期 DHCP 地址） | `listen EADDRNOTAVAIL: address not available …` | 只接受**本机网卡实际拥有**的地址（`os.networkInterfaces()` 枚举，`127.0.0.1` 恒定可用） |
+| 把行追加到模板的空序列 `[]` 之后 | `failed to parse overlay …: end of the stream or a document separator is expected` | 识别模板 `[]` 并**替换**它（非空 flow 文档直接拒绝编辑） |
+
+三类症状长这样（`webserver` 未激活，所有依赖它的插件排队等 `webServer`）：
+
+```
+dsh: startup failed: 2 required plugins did not activate
+  webserver (required)  @deepseek-ai/dsh-host-webserver  → 上面某一类报错
+Plugins waiting for services:
+  web-runtime / web-auth / better-sidebar / task-kanban / … (missing webServer)
+```
+
+恢复方式都是手工改 patch 文件（插件此时不会加载）：
+
+```bash
+# 1) 看当前写死的 host
+grep -n -A3 '^- id: webserver' ~/.dsh/profiles/web/cordis.patch.yml
+# 2) 改成 127.0.0.1（或本机某张网卡的实际地址）后保存
+```
+
+若第一行是 `[]` 之类的空序列而下面又跟了 `- id:` 行，把那个 `[]` 行整行删掉即为合法文档。
+
+> **DHCP 提醒**：绑定具体网卡地址后，地址由 DHCP 变化（或网卡消失）时，下一次启动同样会 `EADDRNOTAVAIL`。长期部署建议让 dsh 监听 `127.0.0.1`，把对外暴露交给本机反代（反代再指向回环），这样地址变化不影响 dsh 启动。
+
+`0.2.0` 起插件的所有写路径都会在改动任何字节之前校验，因此这三类砖不会再被本插件写出来。（若你仍在用 `0.1.10` 及更早版本并已中招，同样按上面方式手工修复，再升级到 `0.2.0`。）
+
+
 ### 远程设置解锁（`unlockRemoteSettings`，默认关闭）
 
 **现象**：通过域名反代访问 dsh 时，设置 → 模型页报「加载提供方目录失败: settings are unavailable in this browser」，常规设置、插件配置等设置面同样不可用。这不是故障，是 dsh 的有意设计：设置文档（含 provider 凭据引用等敏感配置）只对"本机浏览器"开放——客户端在页面加载时按 `location.hostname` 判定是否回环（`localhost` / `127.x`），反代域名永远不算，设置镜像因此保持进程本地、根本不发起读取。注意这与服务端无关：本插件已把已认证请求改写为回环来源，`/api` 通道完全正常，只有客户端这道门在拦。
@@ -109,11 +147,11 @@ npm run test       # 单元 + 集成测试（node:test，真实 HTTP/WS 全流
 - `src/auth-core.ts` — 纯逻辑：scrypt 哈希、Cookie 签名/校验、限速器、`next` 校验
 - `src/gate.ts` — 把认证闸门包到 node:http 服务器的 request/upgrade 监听器外层
 - `src/handlers.ts` — 登录页/登录/登出/改密/状态/监听切换 路由处理
-- `src/profile-patch.ts` — 监听地址切换：webserver 行的 patch 层文本改写（保留注释与 `!!js` 表达式）
+- `src/profile-patch.ts` — 监听地址切换：webserver 行的 patch 层文本改写（保留注释与 `!!js` 表达式），并在写入前拒绝通配符
+- `src/listen-addresses.ts` — 监听地址取值域：字面量/通配符判定、本机网卡枚举（候选列表）、本机对端判定（mint 重入与 XFF 信任）
 - `src/remote-unlock.ts` — 远程设置解锁：`unlockRemoteSettings` 开启时经 `webServer.tapIndex` 注入 `ownsHost` 启动页脚本
-- `src/settings.ts` — `web-auth` settings 命名空间注册 + listenHost 变更应用（卡片的分发键与数据源）
 - `src/index.ts` — cordis 插件装配（host 半区）
-- `src/client/index.tsx` — 设置卡片（浏览器半区，`settings.plugin.item` 插槽，keyed by `web-auth` 命名空间）
+- `src/client/index.tsx` — 设置卡片（浏览器半区，`settings.section` 插槽，id `web-auth`；读写走本插件 REST）
 - `cordis.patch.yml` — bundle 补丁层（insert 插件行）
 
 ## License

package/lib/client/index.d.ts

@@ -1,16 +1,17 @@
 import type { Context } from '@deepseek-ai/cordis';
-/** Services provided by other browser plugins before this one mounts.
- *
- * `connection` and `remote` are required by `settingsScope.bind` (it resolves
- * the settings transport and the forwarded-invalidation subscription through
- * `ctx.get`), so the fiber must wait for them — exactly like
- * the settings shell does for its own sections. dsh >= 0.1.7 dropped
- * `settingsScope` itself, so it is resolved optionally below.
- */
+/** Services provided by other browser plugins before this one mounts. */
 export declare const inject: string[];
 /**
- * Client plugin body: register the settings page. The shell's declaration
- * may not be on the ledger yet, so the registration waits via slots.inject.
+ * Client plugin body: register the settings page.
+ *
+ * The page needs only the slot ledger — it reads and writes the password and
+ * the listen address through the plugin's own REST routes
+ * (/api/web-auth/{status,password,listen}). It deliberately does NOT bind the
+ * browser settings transport: dsh >= 0.2.1-alpha.2 removed the
+ * `settingsScope` client service (its settings plane is now the schema-driven
+ * SettingsForms on the host), so a page that waited for it would never
+ * register — the 访问认证 entry would silently vanish from Settings.
+ *
  * @param ctx - the client cordis context.
  */
 export declare function apply(ctx: Context): void;

package/lib/client.js

@@ -102,37 +102,49 @@ var dshWebAuthModule = (() => {
       return { ok: false, message: "\u7F51\u7EDC\u9519\u8BEF\uFF0C\u8BF7\u91CD\u8BD5\u3002" };
     }
   }
-  var LISTEN_OPTIONS = [
-    { value: "127.0.0.1", label: "127.0.0.1\uFF08\u4EC5\u672C\u673A\uFF09" },
-    { value: "0.0.0.0", label: "0.0.0.0\uFF08\u6240\u6709\u7F51\u5361\uFF0C\u5C40\u57DF\u7F51\u53EF\u8BBF\u95EE\uFF09" }
-  ];
   function isListenHost(value) {
-    return value === "127.0.0.1" || value === "0.0.0.0";
+    return typeof value === "string" && value.length > 0;
   }
   async function fetchStatus() {
     try {
       const response = await fetch("/api/web-auth/status");
       if (!response.ok) return null;
       const data = await response.json();
-      return { configured: data.configured === true, host: isListenHost(data.host) ? data.host : void 0 };
+      return {
+        configured: data.configured === true,
+        host: isListenHost(data.host) ? data.host : void 0,
+        allowed: Array.isArray(data.allowed) ? data.allowed : [],
+        needsMigration: data.needsMigration === true
+      };
     } catch {
       return null;
     }
   }
-  function WebAuthSettingsSection(props) {
-    const { scope } = props;
-    const snapshot = (0, import_react.useSyncExternalStore)(
-      (listener) => scope.subscribe(listener),
-      () => scope.getSnapshot()
-    );
+  async function postListenHost(host) {
+    try {
+      const response = await fetch("/api/web-auth/listen", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ host })
+      });
+      const data = await response.json();
+      if (response.ok && data.ok === true) return { ok: true };
+      return { ok: false, message: data.message ?? data.error ?? String(response.status) };
+    } catch {
+      return { ok: false, message: "\u7F51\u7EDC\u9519\u8BEF" };
+    }
+  }
+  function WebAuthSettingsSection() {
     const [configured, setConfigured] = (0, import_react.useState)(null);
     const [host, setHost] = (0, import_react.useState)(null);
+    const [options, setOptions] = (0, import_react.useState)([]);
+    const [needsMigration, setNeedsMigration] = (0, import_react.useState)(false);
     const [oldPassword, setOldPassword] = (0, import_react.useState)("");
     const [newPassword, setNewPassword] = (0, import_react.useState)("");
     const [confirm, setConfirm] = (0, import_react.useState)("");
     const [busy, setBusy] = (0, import_react.useState)(false);
     const [message, setMessage] = (0, import_react.useState)(null);
-    const [listenPick, setListenPick] = (0, import_react.useState)("127.0.0.1");
+    const [listenPick, setListenPick] = (0, import_react.useState)("");
     const [listenBusy, setListenBusy] = (0, import_react.useState)(false);
     const [listenMsg, setListenMsg] = (0, import_react.useState)(null);
     (0, import_react.useEffect)(() => {
@@ -140,16 +152,17 @@ var dshWebAuthModule = (() => {
       void fetchStatus().then((status) => {
         if (!alive || status === null) return;
         setConfigured(status.configured);
-        if (status.host !== void 0) {
-          setHost(status.host);
-          setListenPick(status.host);
-        }
+        setOptions(status.allowed);
+        setNeedsMigration(status.needsMigration);
+        const selectable = status.host !== void 0 && status.allowed.some((o) => o.value === status.host);
+        const pick = selectable ? status.host : status.allowed[0]?.value ?? "";
+        setHost(status.host ?? null);
+        setListenPick(pick);
       });
       return () => {
         alive = false;
       };
     }, []);
-    if (snapshot.status === "unavailable") return null;
     const submit = async () => {
       if (newPassword.length < 8) {
         setMessage({ kind: "err", text: "\u65B0\u5BC6\u7801\u81F3\u5C11 8 \u4F4D\u3002" });
@@ -175,27 +188,30 @@ var dshWebAuthModule = (() => {
       }
     };
     const applyListen = async () => {
-      if (host === listenPick) return;
+      if (listenPick.length === 0 || host === listenPick) return;
       setListenBusy(true);
       setListenMsg(null);
-      try {
-        await scope.set("listenHost", listenPick);
-        setListenMsg({ kind: "ok", text: "\u5DF2\u5207\u6362\uFF0C\u6B63\u5728\u91CD\u65B0\u7ED1\u5B9A\u76D1\u542C\u7AEF\u53E3\uFF0C\u9875\u9762\u5C06\u77ED\u6682\u65AD\u8FDE\u2026" });
-        for (let i = 0; i < 15; i++) {
-          await new Promise((resolve) => setTimeout(resolve, 600));
-          const status = await fetchStatus();
-          if (status?.host === listenPick) {
-            setHost(listenPick);
-            setListenMsg({ kind: "ok", text: "\u5DF2\u751F\u6548\uFF1A\u76D1\u542C\u5730\u5740\u4E3A " + listenPick + "\u3002" });
-            return;
-          }
-        }
-        setListenMsg({ kind: "ok", text: "\u5DF2\u5E94\u7528\uFF0C\u82E5\u9875\u9762\u8FDE\u63A5\u4E2D\u65AD\u8BF7\u7A0D\u5019\u5237\u65B0\uFF08\u76D1\u542C\u5730\u5740\uFF1A" + listenPick + "\uFF09\u3002" });
-      } catch {
-        setListenMsg({ kind: "err", text: "\u5199\u5165\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5\u3002" });
-      } finally {
+      const result = await postListenHost(listenPick);
+      if (!result.ok) {
         setListenBusy(false);
+        setListenMsg({ kind: "err", text: "\u5199\u5165\u5931\u8D25\uFF1A" + String(result.message) });
+        return;
+      }
+      setListenMsg({ kind: "ok", text: "\u5DF2\u5207\u6362\uFF0C\u6B63\u5728\u91CD\u65B0\u7ED1\u5B9A\u76D1\u542C\u7AEF\u53E3\uFF0C\u9875\u9762\u5C06\u77ED\u6682\u65AD\u8FDE\u2026" });
+      for (let i = 0; i < 15; i++) {
+        await new Promise((resolve) => setTimeout(resolve, 600));
+        const status = await fetchStatus();
+        if (status?.host === listenPick) {
+          setHost(listenPick);
+          setNeedsMigration(status.needsMigration);
+          setOptions(status.allowed);
+          setListenMsg({ kind: "ok", text: "\u5DF2\u751F\u6548\uFF1A\u76D1\u542C\u5730\u5740\u4E3A " + listenPick + "\u3002" });
+          setListenBusy(false);
+          return;
+        }
       }
+      setListenMsg({ kind: "ok", text: "\u5DF2\u5E94\u7528\uFF0C\u82E5\u9875\u9762\u8FDE\u63A5\u4E2D\u65AD\u8BF7\u7A0D\u5019\u5237\u65B0\uFF08\u76D1\u542C\u5730\u5740\uFF1A" + listenPick + "\uFF09\u3002" });
+      setListenBusy(false);
     };
     return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "dwa-page", children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("header", { className: "dwa-page-head", children: [
@@ -264,9 +280,9 @@ var dshWebAuthModule = (() => {
               id: "dwa-listen",
               className: "dwa-input",
               value: listenPick,
-              disabled: listenBusy || host === null || !snapshot.writable,
+              disabled: listenBusy || options.length === 0,
               onChange: (e) => setListenPick(e.target.value),
-              children: LISTEN_OPTIONS.map((option) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: option.value, children: option.label }, option.value))
+              children: options.map((option) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("option", { value: option.value, children: option.label }, option.value))
             }
           )
         ] }),
@@ -274,31 +290,30 @@ var dshWebAuthModule = (() => {
           "button",
           {
             className: "dwa-btn",
-            disabled: listenBusy || host === null || host === listenPick || !snapshot.writable,
+            disabled: listenBusy || listenPick.length === 0 || host === listenPick,
             onClick: () => void applyListen(),
             children: "\u5E94\u7528\u76D1\u542C\u5730\u5740"
           }
         ) }),
-        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-hint", children: "\u5207\u6362\u540E dsh \u4F1A\u7ACB\u5373\u91CD\u65B0\u7ED1\u5B9A\u76D1\u542C\u7AEF\u53E3\uFF08WebSocket \u77ED\u6682\u65AD\u8FDE\u540E\u81EA\u52A8\u91CD\u8FDE\uFF09\u3002\u6CE8\u610F\uFF1A\u82E5\u5F53\u524D\u901A\u8FC7\u5C40\u57DF\u7F51 IP \u8BBF\u95EE\uFF0C\u5207\u56DE 127.0.0.1 \u540E\u53EA\u80FD\u5728\u672C\u673A\u8BBF\u95EE\u3002" }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-hint", children: "\u5217\u8868\u662F\u672C\u673A\u7F51\u5361\u4E0A\u7684\u5177\u4F53\u5730\u5740\u3002dsh 0.2.1-alpha.2 \u8D77\u4E0D\u518D\u63A5\u53D7 0.0.0.0 / ::\uFF08\u901A\u914D\u7B26\u4F1A\u5728\u89E3\u6790\u914D\u7F6E\u9636\u6BB5\u76F4\u63A5\u8BA9 dsh \u542F\u52A8\u5931\u8D25\uFF09\uFF0C\u9700\u8981\u5C40\u57DF\u7F51\u6216\u53CD\u4EE3\u8BBF\u95EE\u8BF7\u9009\u62E9\u5BF9\u5E94\u7F51\u5361\u5730\u5740\uFF0C\u5E76\u4F18\u5148\u5728\u672C\u673A\u653E\u4E00\u5C42\u53CD\u4EE3\u6307\u5411 127.0.0.1\u3002 \u6CE8\u610F\uFF1A\u7ED1\u5B9A\u5177\u4F53\u7F51\u5361\u5730\u5740\u540E 127.0.0.1 \u4E0D\u518D\u76D1\u542C\uFF0C\u672C\u673A\u4E5F\u9700\u6539\u7528\u8BE5\u5730\u5740\u8BBF\u95EE\uFF1B\u82E5\u901A\u8FC7\u5C40\u57DF\u7F51 IP \u8BBF\u95EE\uFF0C\u5207\u56DE 127.0.0.1 \u540E\u53EA\u80FD\u5728\u672C\u673A\u8BBF\u95EE\u3002" }),
+        needsMigration && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-msg", "data-kind": "err", role: "alert", children: "\u5F53\u524D\u914D\u7F6E\u7684\u76D1\u542C\u5730\u5740\u4E0D\u662F\u672C\u63D2\u4EF6\u53EF\u5199\u5165\u7684\u5177\u4F53\u5730\u5740\uFF08\u4F8B\u5982\u5386\u53F2\u9057\u7559\u7684 0.0.0.0\uFF09\u3002\u8BF7\u6539\u9009\u4E00\u4E2A\u7F51\u5361\u5730\u5740\u540E\u5E94\u7528\u3002" }),
         listenMsg !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { className: "dwa-msg", "data-kind": listenMsg.kind, role: "alert", children: listenMsg.text })
       ] })
     ] });
   }
   function apply(ctx) {
-    ctx.inject(["settingsScope"], (raw) => {
+    ctx.inject(["slots"], (raw) => {
       const c = raw;
-      if (c.settingsScope === void 0) return;
       injectStyle();
-      const scope = c.settingsScope.bind({ namespace: WEB_AUTH_NS });
       c.slots.inject(
         "settings.section",
         () => c.slots.register(
           {
             name: "settings.section",
-            id: "web-auth",
+            id: WEB_AUTH_NS,
             order: 120,
             label: "\u8BBF\u95EE\u8BA4\u8BC1",
-            inject: () => ({ scope })
+            inject: () => ({})
           },
           WebAuthSettingsSection
         )

package/lib/handlers.d.ts

@@ -80,8 +80,12 @@ export declare function pathnameOf(req: IncomingMessage): string;
 export declare function cookieValue(header: string | undefined, name: string): string | undefined;
 /**
  * The client address for rate limiting. X-Forwarded-For is honored ONLY when
- * the direct peer is loopback (the reverse proxy sits on the same host), so
- * a remote attacker hitting dsh directly cannot forge a fresh identity.
+ * the direct peer is local (a reverse proxy on this host), so a remote
+ * attacker hitting dsh directly cannot forge a fresh identity.
+ *
+ * "Local" is the machine's own address set, not just loopback: a concrete LAN
+ * bind stops listening on `127.0.0.1` entirely, so a same-host proxy arrives
+ * FROM the bound address. See isLocalPeerAddress.
  */
 export declare function clientIp(req: IncomingMessage): string;
 /** Whether the browser's connection is HTTPS (reverse-proxied or direct). */
@@ -128,6 +132,19 @@ export declare function createGate(env: HandlerEnv): Gate;
 export declare function handleLoginPage(req: IncomingMessage, res: ServerResponse, env: HandlerEnv): void;
 export declare function handleLoginPost(req: IncomingMessage, res: ServerResponse, env: HandlerEnv): Promise<void>;
 export declare function handleLogout(req: IncomingMessage, res: ServerResponse, env: HandlerEnv): void;
+/**
+ * The settings page's state: whether a password is configured, the current
+ * bind host, the writable concrete addresses of this machine, and whether the
+ * configured host needs migrating.
+ *
+ * `allowed` holds only addresses this plugin may write (loopback plus the
+ * machine's interfaces), so the page can never offer a value the write path
+ * would refuse. `needsMigration` is true when the resolved host is outside
+ * that domain — the wildcard (only reachable on hosts older than
+ * 0.2.1-alpha.2, since a newer boot would have failed already), a hostname,
+ * or an address this machine does not have; the page warns and preselects a
+ * concrete address instead of echoing a value that would be refused.
+ */
 export declare function handleStatus(req: IncomingMessage, res: ServerResponse, env: HandlerEnv): void;
 export interface ChangePasswordBody {
     oldPassword?: string;
@@ -138,7 +155,7 @@ export interface ListenChangeBody {
     host?: unknown;
 }
 /**
- * Switch the web server's bind host between '127.0.0.1' and '0.0.0.0'.
+ * Switch the web server's bind host to a concrete local interface address.
  *
  * The change is applied to the owning patch layer (profile or home
  * cordis.patch.yml); HMR then reloads the webserver row, which closes and
@@ -146,5 +163,10 @@ export interface ListenChangeBody {
  * committed — the reload tears down every connection, including this one —
  * so the client gets its confirmation first and the write lands a beat
  * later (see {@link ListenController}).
+ *
+ * The wildcard is refused with 400: it is not a bind this plugin may store,
+ * because dsh >= 0.2.1-alpha.2 fails the whole startup on it while resolving
+ * config. The response lists the selectable addresses so a stale client can
+ * correct itself.
  */
 export declare function handleListenChange(req: IncomingMessage, res: ServerResponse, env: HandlerEnv): Promise<void>;

package/lib/handlers.js

@@ -1,7 +1,8 @@
 import { createHash } from 'node:crypto';
 import { COOKIE_NAME, MIN_PASSWORD_LENGTH, SESSION_TTL_SECONDS, hashPassword, needsSessionRefresh, sanitizeNext, signSession, verifyPassword, verifySession } from "./auth-core.js";
 import { renderLoginPage } from "./login-page.js";
-import { ALLOWED_LISTEN_HOSTS, isAllowedListenHost } from "./profile-patch.js";
+import { isAllowedListenHost } from "./profile-patch.js";
+import { isLocalPeerAddress, listListenHosts } from "./listen-addresses.js";
 /** Maximum accepted request body for the login form / API. */
 export const MAX_BODY_BYTES = 16 * 1024;
 // ── small request helpers ───────────────────────────────────────────────────
@@ -23,13 +24,16 @@ export function cookieValue(header, name) {
 }
 /**
  * The client address for rate limiting. X-Forwarded-For is honored ONLY when
- * the direct peer is loopback (the reverse proxy sits on the same host), so
- * a remote attacker hitting dsh directly cannot forge a fresh identity.
+ * the direct peer is local (a reverse proxy on this host), so a remote
+ * attacker hitting dsh directly cannot forge a fresh identity.
+ *
+ * "Local" is the machine's own address set, not just loopback: a concrete LAN
+ * bind stops listening on `127.0.0.1` entirely, so a same-host proxy arrives
+ * FROM the bound address. See isLocalPeerAddress.
  */
 export function clientIp(req) {
     const direct = req.socket.remoteAddress ?? 'unknown';
-    const loopback = direct === '127.0.0.1' || direct === '::1' || direct === '::ffff:127.0.0.1';
-    if (loopback) {
+    if (isLocalPeerAddress(direct)) {
         const xff = req.headers['x-forwarded-for'];
         if (typeof xff === 'string') {
             const first = xff.split(',')[0]?.trim();
@@ -155,16 +159,17 @@ export function tokenQueryCount(req) {
  */
 export const MINT_REENTRY_HEADER = 'x-dsh-web-auth-mint';
 /**
- * Whether this tokened request is the server-side mint's own loopback
- * re-entry: the marker header AND a direct loopback TCP peer (not
- * clientIp's XFF-aware view — a proxied remote client must not pass even
- * if it forges the header, and the mint never traverses the proxy).
+ * Whether this tokened request is the server-side mint's own local re-entry:
+ * the marker header AND a direct local TCP peer (not clientIp's XFF-aware
+ * view — a proxied remote client must not pass even if it forges the header,
+ * and the mint never traverses the proxy). "Local" covers the bound address
+ * as well as loopback, because a concrete LAN bind has no loopback listener
+ * for the mint to come back through.
  */
 function isMintReentry(req) {
     if (req.headers[MINT_REENTRY_HEADER] !== '1')
         return false;
-    const direct = req.socket.remoteAddress ?? '';
-    return direct === '127.0.0.1' || direct === '::1' || direct === '::ffff:127.0.0.1';
+    return isLocalPeerAddress(req.socket.remoteAddress ?? undefined);
 }
 /**
  * Build the gate used to wrap the HTTP server listeners. Whitelisted paths
@@ -470,9 +475,27 @@ export function handleLogout(req, res, env) {
     redirect(res, '/login?loggedOut=1');
 }
 // ── GET /api/web-auth/status — settings page state ─────────────────────────
+/**
+ * The settings page's state: whether a password is configured, the current
+ * bind host, the writable concrete addresses of this machine, and whether the
+ * configured host needs migrating.
+ *
+ * `allowed` holds only addresses this plugin may write (loopback plus the
+ * machine's interfaces), so the page can never offer a value the write path
+ * would refuse. `needsMigration` is true when the resolved host is outside
+ * that domain — the wildcard (only reachable on hosts older than
+ * 0.2.1-alpha.2, since a newer boot would have failed already), a hostname,
+ * or an address this machine does not have; the page warns and preselects a
+ * concrete address instead of echoing a value that would be refused.
+ */
 export function handleStatus(req, res, env) {
-    const body = { configured: env.state.readHash() !== undefined };
     const current = env.listen?.current();
+    const options = listListenHosts();
+    const body = {
+        configured: env.state.readHash() !== undefined,
+        allowed: options,
+        needsMigration: current !== undefined && !isAllowedListenHost(current)
+    };
     if (current !== undefined)
         body.host = current;
     writeJson(res, 200, body);
@@ -521,7 +544,7 @@ export async function handleChangePassword(req, res, env) {
     writeJson(res, 200, { ok: true, sessionsInvalidated: true });
 }
 /**
- * Switch the web server's bind host between '127.0.0.1' and '0.0.0.0'.
+ * Switch the web server's bind host to a concrete local interface address.
  *
  * The change is applied to the owning patch layer (profile or home
  * cordis.patch.yml); HMR then reloads the webserver row, which closes and
@@ -529,6 +552,11 @@ export async function handleChangePassword(req, res, env) {
  * committed — the reload tears down every connection, including this one —
  * so the client gets its confirmation first and the write lands a beat
  * later (see {@link ListenController}).
+ *
+ * The wildcard is refused with 400: it is not a bind this plugin may store,
+ * because dsh >= 0.2.1-alpha.2 fails the whole startup on it while resolving
+ * config. The response lists the selectable addresses so a stale client can
+ * correct itself.
  */
 export async function handleListenChange(req, res, env) {
     const body = await readBody(req);
@@ -545,7 +573,11 @@ export async function handleListenChange(req, res, env) {
         return;
     }
     if (!isAllowedListenHost(parsed.host)) {
-        writeJson(res, 400, { error: 'invalid-host', allowed: [...ALLOWED_LISTEN_HOSTS] });
+        writeJson(res, 400, {
+            error: 'invalid-host',
+            message: 'bind a concrete IPv4/IPv6 address this machine has (the wildcard and unowned addresses are refused)',
+            allowed: listListenHosts()
+        });
         return;
     }
     const listen = env.listen;

package/lib/index.js

@@ -22,8 +22,8 @@ import { RateLimiter } from "./auth-core.js";
 import { readSecret, readPasswordHash, resolveDshHome, rotateSecret, writePasswordHash } from "./state.js";
 import { MINT_REENTRY_HEADER, createGate, handleChangePassword, handleListenChange, handleLoginPage, handleLoginPost, handleLogout, handleStatus } from "./handlers.js";
 import { LISTEN_APPLY_DELAY_MS, prepareWebserverHostPatch, resolveListenPatchPath, writeWebserverHostPatch } from "./profile-patch.js";
-import { installWebAuthSettings } from "./settings.js";
 import { injectOwnsHost } from "./remote-unlock.js";
+import { resetLocalAddressCache } from "./listen-addresses.js";
 import { fileURLToPath } from 'node:url';
 import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
@@ -106,11 +106,20 @@ export function apply(ctx, config) {
         // away; failures are logged, never thrown — the client was confirmed.
         listen: buildListenController(ctx)
     };
-    // The plugin's own settings page (设置 → 侧栏「访问认证」) rides the
-    // `web-auth` settings namespace: binding the namespace is how the page reads
-    // and writes it, and committed listenHost changes are applied here. Attaches
-    // only when a settings service exists (CLI/headless profiles skip it).
-    installWebAuthSettings(ctx, env.listen);
+    // The listen host is changed through the plugin's own REST surface
+    // (/api/web-auth/listen) and applied to the patch layer by `env.listen`:
+    // the webserver's bind host is composition config, and the patch is the
+    // only place the loader reads it from. The value domain is a concrete
+    // local interface address — never the wildcard, which fails the whole
+    // startup on dsh >= 0.2.1-alpha.2 (see listen-addresses.ts).
+    //
+    // Earlier releases mirrored the value into a `web-auth` settings namespace
+    // (settings.register + scope.watch). That API no longer exists: dsh
+    // >= 0.2.1-alpha.2 replaced it with schema-driven SettingsForms
+    // (describe/update keyed by profile entry id), and the browser-side
+    // `settingsScope` service is gone with it. The namespace registration is
+    // therefore removed rather than left calling a method that is no longer
+    // there; the settings page talks to the REST endpoints below.
     if (state.readHash() === undefined) {
         // console.error, not ctx.logger.warn: the cordis default logger level
         // suppresses warn (level 2) unless the deployment raises it, and this
@@ -212,7 +221,12 @@ function buildDshCookieMinter(ctx) {
     return async () => {
         if (connection === undefined)
             return undefined;
-        const host = ctx.webServer.host === '0.0.0.0' || ctx.webServer.host === '::' ? '127.0.0.1' : ctx.webServer.host;
+        // The bind host is a concrete literal (dsh rejects the wildcard outright),
+        // so the mint re-enters through the very address the server listens on.
+        // The legacy wildcard mapping stays as belt-and-braces: on a host old
+        // enough to accept it, loopback is the reachable spelling of "any".
+        const bound = ctx.webServer.host;
+        const host = bound === '0.0.0.0' || bound === '::' ? '127.0.0.1' : bound;
         try {
             const url = connection.authenticatedUrl(`http://${host}:${String(ctx.webServer.port)}`);
             // The marker header is what the gate's token branch keys on to forward
@@ -263,6 +277,10 @@ function buildListenController(ctx) {
             setTimeout(() => {
                 try {
                     writeWebserverHostPatch(patchPath, content);
+                    // The listener is about to move to another interface: drop the
+                    // cached local-address set so peer trust follows the new bind
+                    // immediately instead of after the TTL.
+                    resetLocalAddressCache();
                 }
                 catch (error) {
                     console.error('[dsh-web-auth] failed to apply listen address:', error);

package/lib/listen-addresses.d.ts

@@ -0,0 +1,85 @@
+/** The always-offered loopback bind (this plugin's default and the safe choice). */
+export declare const LOOPBACK_LISTEN_HOST = "127.0.0.1";
+/** Strip an IPv6 zone id (`fe80::1%en0` → `fe80::1`). */
+export declare function stripZoneId(value: string): string;
+/**
+ * Whether a value is an IPv4/IPv6 literal (hostnames are rejected by the
+ * webserver's own `parseIpLiteral`, so they are rejected here too).
+ */
+export declare function isIpLiteral(value: unknown): value is string;
+/**
+ * Whether a literal is the unspecified (wildcard) address: `0.0.0.0`, any
+ * spelling of IPv6 `::`, and their IPv4-mapped forms (`::ffff:0.0.0.0`).
+ * Non-literals are not wildcards — {@link isConcreteListenHost} rejects them.
+ *
+ * IPv6 is normalized through the WHATWG URL parser, which collapses every
+ * all-zero spelling to `[::]` and renders IPv4-mapped forms as hex groups, so
+ * `0:0:0:0:0:0:0:0`, `::0` and `::ffff:0.0.0.0` are all recognized.
+ */
+export declare function isWildcardListenHost(value: unknown): boolean;
+/**
+ * Whether a value is a bind host the webserver's config schema accepts: a
+ * concrete IPv4/IPv6 literal that is not the wildcard.
+ *
+ * This is the SCHEMA's domain, not this plugin's write domain — see
+ * {@link isLocalListenHost}, which every write path actually runs (the schema
+ * also accepts literals the machine does not own, and writing one of those
+ * breaks the next boot at bind time).
+ */
+export declare function isConcreteListenHost(value: unknown): value is string;
+/** One selectable bind host for the settings page. */
+export interface ListenHostOption {
+    /** The literal written into the patch layer. */
+    value: string;
+    /** Human-facing label (address + interface name). */
+    label: string;
+    /** Whether this option keeps the service unreachable from the network. */
+    loopback: boolean;
+}
+/** Whether a literal is in the loopback range (127/8 or `::1`, mapped forms included). */
+export declare function isLoopbackListenHost(value: unknown): boolean;
+/**
+ * The bind hosts offered by the settings page: loopback first, then every
+ * concrete address of a local interface (labelled with the interface name).
+ * Every entry is writable — see {@link isLocalListenHost}, which is the write
+ * domain this list is drawn from.
+ *
+ * @returns The ordered options; always at least the loopback default.
+ */
+export declare function listListenHosts(): ListenHostOption[];
+/**
+ * Whether a value is a bind host this plugin may WRITE: a concrete literal
+ * naming an address this machine actually has.
+ *
+ * Stricter than {@link isConcreteListenHost}, and deliberately so. A literal
+ * the machine does not own (`127.0.0.2` on macOS, `10.99.99.99`, a stale DHCP
+ * lease) passes the webserver's schema and is written happily — then fails at
+ * bind time with EADDRNOTAVAIL, so the NEXT boot dies the same way the
+ * wildcard does, with this plugin unable to help. Restricting writes to
+ * addresses the machine has turns that into an immediate 400.
+ *
+ * @param value - the requested bind host.
+ * @param now - clock injection for the interface-cache TTL (tests).
+ * @returns Whether the value may be written to the patch layer.
+ */
+export declare function isLocalListenHost(value: unknown, now?: number): boolean;
+/**
+ * Whether a TCP peer address belongs to this machine (loopback or any local
+ * interface address).
+ *
+ * This replaced a hard loopback test: with a concrete LAN address bound,
+ * `127.0.0.1` is not listening at all, so the server's own re-entry (the DSH
+ * cookie mint) and a same-host reverse proxy both arrive FROM the bound
+ * address. An off-host client cannot present a local address as its source
+ * (that needs L2 spoofing on the same segment), so treating the machine's own
+ * addresses as trusted keeps the X-Forwarded-For fence and the mint marker as
+ * tight as the loopback-only version on a loopback bind. Any 127/8 spelling
+ * counts — a peer claiming that range is by definition on this host.
+ *
+ * @param address - `socket.remoteAddress` (undefined before a socket exists).
+ * @param now - clock injection for the cache TTL (tests).
+ * @returns Whether the peer is this machine.
+ */
+export declare function isLocalPeerAddress(address: string | undefined, now?: number): boolean;
+/** Drop the cached interface sets (tests, and after a listen-address change). */
+export declare function resetLocalAddressCache(): void;

package/lib/listen-addresses.js

@@ -0,0 +1,223 @@
+/**
+ * dsh-web-auth — the bind-address domain: which `host` values the webserver
+ * accepts, which local interfaces can be offered to the user, and whether a
+ * TCP peer is local.
+ *
+ * dsh >= 0.2.1-alpha.2 validates the webserver's `host` as a CONCRETE
+ * IPv4/IPv6 literal and rejects the unspecified (wildcard) address outright:
+ *
+ *   webserver: host "0.0.0.0" is an unspecified (wildcard) address, which is
+ *   not supported: binding every interface would expose remote code execution
+ *   to the network; bind one concrete IPv4 or IPv6 address of a local
+ *   interface instead
+ *
+ * The rejection happens while the loader RESOLVES CONFIG — before any plugin
+ * fiber activates. A wildcard written into the profile patch therefore bricks
+ * the whole boot (webserver never activates, every dependent plugin waits
+ * forever) and NOTHING can self-repair it: this plugin does not load either.
+ * That is why every write path in this plugin runs {@link isConcreteListenHost}
+ * and refuses a wildcard instead of writing it.
+ *
+ * `dsh web --host` is validated by the same rule (`isWildcardHost`), and
+ * `parseIpLiteral` rejects hostnames, so only IP literals are ever written.
+ */
+import { isIP } from 'node:net';
+import { networkInterfaces } from 'node:os';
+/** The always-offered loopback bind (this plugin's default and the safe choice). */
+export const LOOPBACK_LISTEN_HOST = '127.0.0.1';
+/** Normalized IPv6 forms whose bits are all zero (the IPv4-any-mapped form included). */
+const WILDCARD_IPV6_FORMS = new Set(['[::]', '[::ffff:0:0]']);
+/** Direct peers always considered local, whichever spelling the socket reports. */
+const LOOPBACK_PEERS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+/** Strip an IPv6 zone id (`fe80::1%en0` → `fe80::1`). */
+export function stripZoneId(value) {
+    const at = value.indexOf('%');
+    return at === -1 ? value : value.slice(0, at);
+}
+/**
+ * Whether a value is an IPv4/IPv6 literal (hostnames are rejected by the
+ * webserver's own `parseIpLiteral`, so they are rejected here too).
+ */
+export function isIpLiteral(value) {
+    return typeof value === 'string' && isIP(stripZoneId(value)) !== 0;
+}
+/**
+ * Whether a literal is the unspecified (wildcard) address: `0.0.0.0`, any
+ * spelling of IPv6 `::`, and their IPv4-mapped forms (`::ffff:0.0.0.0`).
+ * Non-literals are not wildcards — {@link isConcreteListenHost} rejects them.
+ *
+ * IPv6 is normalized through the WHATWG URL parser, which collapses every
+ * all-zero spelling to `[::]` and renders IPv4-mapped forms as hex groups, so
+ * `0:0:0:0:0:0:0:0`, `::0` and `::ffff:0.0.0.0` are all recognized.
+ */
+export function isWildcardListenHost(value) {
+    if (typeof value !== 'string')
+        return false;
+    const bare = stripZoneId(value);
+    const family = isIP(bare);
+    if (family === 4)
+        return bare.split('.').every((octet) => octet === '0');
+    if (family !== 6)
+        return false;
+    try {
+        return WILDCARD_IPV6_FORMS.has(new URL('http://[' + bare + ']').hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether a value is a bind host the webserver's config schema accepts: a
+ * concrete IPv4/IPv6 literal that is not the wildcard.
+ *
+ * This is the SCHEMA's domain, not this plugin's write domain — see
+ * {@link isLocalListenHost}, which every write path actually runs (the schema
+ * also accepts literals the machine does not own, and writing one of those
+ * breaks the next boot at bind time).
+ */
+export function isConcreteListenHost(value) {
+    return isIpLiteral(value) && !isWildcardListenHost(value);
+}
+/** Whether a literal is in the loopback range (127/8 or `::1`, mapped forms included). */
+export function isLoopbackListenHost(value) {
+    if (typeof value !== 'string')
+        return false;
+    const bare = stripZoneId(value);
+    if (isIP(bare) === 4 && bare.startsWith('127.'))
+        return true;
+    if (isIP(bare) !== 6)
+        return false;
+    try {
+        const hostname = new URL('http://[' + bare + ']').hostname;
+        // `[::1]` and the `::ffff:127.0.0.0/104` mapped range (`[::ffff:7f00:1]`).
+        return hostname === '[::1]' || hostname.startsWith('[::ffff:7f');
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Link-local addresses need a zone id to bind and are never the intended
+ * choice (`169.254.0.0/16`, `fe80::/10`), so they are not offered.
+ */
+function isLinkLocal(value) {
+    if (isIP(value) === 4)
+        return value.startsWith('169.254.');
+    return /^fe[89ab]/i.test(value);
+}
+/**
+ * The bind hosts offered by the settings page: loopback first, then every
+ * concrete address of a local interface (labelled with the interface name).
+ * Every entry is writable — see {@link isLocalListenHost}, which is the write
+ * domain this list is drawn from.
+ *
+ * @returns The ordered options; always at least the loopback default.
+ */
+export function listListenHosts() {
+    const options = [
+        { value: LOOPBACK_LISTEN_HOST, label: '127.0.0.1（仅本机）', loopback: true }
+    ];
+    const seen = new Set([LOOPBACK_LISTEN_HOST]);
+    for (const [name, addresses] of Object.entries(networkInterfaces())) {
+        for (const entry of addresses ?? []) {
+            const value = stripZoneId(entry.address);
+            if (entry.internal || isLinkLocal(value))
+                continue;
+            if (!isConcreteListenHost(value) || seen.has(value))
+                continue;
+            seen.add(value);
+            const family = isIP(value) === 6 ? 'IPv6' : 'IPv4';
+            options.push({
+                value,
+                label: `${value}（${name}，${family}，局域网可访问）`,
+                loopback: false
+            });
+        }
+    }
+    return options;
+}
+/** Cached interface-address sets (interfaces change rarely; a TTL bounds staleness). */
+let interfaceCache;
+const INTERFACE_CACHE_TTL_MS = 10_000;
+/**
+ * The addresses this machine actually has, from `os.networkInterfaces()`.
+ *
+ * `owned` is the set a bind may use: exactly the assigned addresses, plus
+ * `127.0.0.1`, which every platform assigns to its loopback interface (the
+ * explicit seed keeps the write domain usable even if enumeration reports an
+ * empty loopback entry). Note the set is NOT "any 127/8": on macOS only
+ * `127.0.0.1` is assigned, so `127.0.0.2` fails to bind with EADDRNOTAVAIL.
+ *
+ * `peers` additionally carries the IPv4-mapped IPv6 spelling of every IPv4
+ * address, because a dual-stack socket reports the mapped form as
+ * `remoteAddress`.
+ */
+function interfaceAddresses(now) {
+    if (interfaceCache !== undefined && interfaceCache.expires > now)
+        return interfaceCache;
+    const owned = new Set([LOOPBACK_LISTEN_HOST]);
+    const peers = new Set(LOOPBACK_PEERS);
+    for (const entry of Object.values(networkInterfaces())) {
+        for (const address of entry ?? []) {
+            const value = stripZoneId(address.address);
+            owned.add(value);
+            peers.add(value);
+            // The mapped spelling is the same socket peer on a dual-stack listener.
+            if (isIP(value) === 4)
+                peers.add('::ffff:' + value);
+        }
+    }
+    interfaceCache = { expires: now + INTERFACE_CACHE_TTL_MS, owned, peers };
+    return interfaceCache;
+}
+/**
+ * Whether a value is a bind host this plugin may WRITE: a concrete literal
+ * naming an address this machine actually has.
+ *
+ * Stricter than {@link isConcreteListenHost}, and deliberately so. A literal
+ * the machine does not own (`127.0.0.2` on macOS, `10.99.99.99`, a stale DHCP
+ * lease) passes the webserver's schema and is written happily — then fails at
+ * bind time with EADDRNOTAVAIL, so the NEXT boot dies the same way the
+ * wildcard does, with this plugin unable to help. Restricting writes to
+ * addresses the machine has turns that into an immediate 400.
+ *
+ * @param value - the requested bind host.
+ * @param now - clock injection for the interface-cache TTL (tests).
+ * @returns Whether the value may be written to the patch layer.
+ */
+export function isLocalListenHost(value, now = Date.now()) {
+    if (!isConcreteListenHost(value))
+        return false;
+    return interfaceAddresses(now).owned.has(stripZoneId(value));
+}
+/**
+ * Whether a TCP peer address belongs to this machine (loopback or any local
+ * interface address).
+ *
+ * This replaced a hard loopback test: with a concrete LAN address bound,
+ * `127.0.0.1` is not listening at all, so the server's own re-entry (the DSH
+ * cookie mint) and a same-host reverse proxy both arrive FROM the bound
+ * address. An off-host client cannot present a local address as its source
+ * (that needs L2 spoofing on the same segment), so treating the machine's own
+ * addresses as trusted keeps the X-Forwarded-For fence and the mint marker as
+ * tight as the loopback-only version on a loopback bind. Any 127/8 spelling
+ * counts — a peer claiming that range is by definition on this host.
+ *
+ * @param address - `socket.remoteAddress` (undefined before a socket exists).
+ * @param now - clock injection for the cache TTL (tests).
+ * @returns Whether the peer is this machine.
+ */
+export function isLocalPeerAddress(address, now = Date.now()) {
+    if (address === undefined || address.length === 0)
+        return false;
+    const bare = stripZoneId(address);
+    if (LOOPBACK_PEERS.has(bare))
+        return true;
+    if (isLoopbackListenHost(bare))
+        return true;
+    return interfaceAddresses(now).peers.has(bare);
+}
+/** Drop the cached interface sets (tests, and after a listen-address change). */
+export function resetLocalAddressCache() {
+    interfaceCache = undefined;
+}

package/lib/profile-patch.d.ts

@@ -1,6 +1,10 @@
-/** The two bind hosts the webserver config schema accepts. */
-export declare const ALLOWED_LISTEN_HOSTS: readonly ["127.0.0.1", "0.0.0.0"];
-export type ListenHost = (typeof ALLOWED_LISTEN_HOSTS)[number];
+/**
+ * A writable bind host: a concrete literal naming an address this machine
+ * has. A plain alias rather than a closed union — the domain is machine
+ * dependent, enforced at runtime by {@link isAllowedListenHost} and offered to
+ * the UI by listen-addresses.ts.
+ */
+export type ListenHost = string;
 /**
  * Delay between confirming the change to the browser and writing the patch
  * file. The HMR watcher fires within milliseconds of the write and the
@@ -8,7 +12,11 @@ export type ListenHost = (typeof ALLOWED_LISTEN_HOSTS)[number];
  * the confirmation — so the write lands a beat AFTER the response flushed.
  */
 export declare const LISTEN_APPLY_DELAY_MS = 300;
-/** Whether a value is one of the two allowed bind-host literals. */
+/**
+ * Whether a value is a bind host that is safe (and accepted) to write: a
+ * concrete literal naming an address of this machine. See isLocalListenHost
+ * for why the wildcard AND non-local literals are both refused.
+ */
 export declare function isAllowedListenHost(value: unknown): value is ListenHost;
 /** Whether a patch document already spells the webserver row. */
 export declare function patchHasWebserverEntry(content: string): boolean;
@@ -18,11 +26,15 @@ export declare function patchHasWebserverEntry(content: string): boolean;
  * - entry present with a `host:` under `config:` → the value is replaced;
  * - entry present without `host:` → the line is inserted under `config:`;
  * - entry present without `config:` → a config block is appended;
- * - no entry at all → a complete row is appended (name/inject/port restated).
+ * - no entry at all → a complete row is written (name/inject/port restated):
+ *   replacing the generated template's `[]` marker when present, otherwise
+ *   appended as a new block item.
  *
  * @param content - the patch file's current text.
- * @param host - the target bind host literal.
+ * @param host - the target bind host (an address this machine owns).
  * @returns the next file text; every other byte is untouched.
+ * @throws When `host` is not an address this machine owns, or the document is
+ *   flow-style and cannot be extended as valid YAML — see refuseListenHost.
  */
 export declare function setWebserverHost(content: string, host: ListenHost): string;
 /** Read a patch file as text; a missing file reads as the empty document. */
@@ -36,7 +48,8 @@ export declare function readPatchOrEmpty(patchPath: string): string;
 export declare function resolveListenPatchPath(profilePatch: string, homePatch: string): string;
 /**
  * Read + transform the owning patch layer for `host`, returning the next
- * file content. Throws when the file cannot be read.
+ * file content. Throws when the file cannot be read, or when `host` is not a
+ * concrete address (the wildcard refusal runs before any read).
  */
 export declare function prepareWebserverHostPatch(patchPath: string, host: ListenHost): string;
 /** Atomic write of prepared patch content (tmp + rename, like the state files). */

package/lib/profile-patch.js

@@ -8,6 +8,19 @@
  * override entry in place hot-applies the change: the webserver row reloads,
  * closes its listener, and rebinds on the new host — no process restart.
  *
+ * The value domain is defined by listen-addresses.ts: a concrete IPv4/IPv6
+ * literal that is an address of THIS MACHINE. Two classes of value are refused
+ * because both leave a profile that cannot boot, and in both cases this plugin
+ * is not running afterwards to repair it:
+ *
+ *  - the wildcard (`0.0.0.0`/`::`), which dsh >= 0.2.1-alpha.2 rejects while
+ *    resolving the loader config — before any plugin fiber activates;
+ *  - a literal the machine does not own (a stale DHCP address, `127.0.0.2` on
+ *    macOS), which fails at bind time with EADDRNOTAVAIL on the next start.
+ *
+ * {@link setWebserverHost} therefore validates and throws, so no caller can
+ * write either even if a stale client asks.
+ *
  * This module only ever touches the `host` value inside the `webserver`
  * entry. Everything else — comments, other entries, and especially the
  * `!!js` port expression — is preserved byte-for-byte, which a YAML
@@ -17,8 +30,7 @@
  */
 import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { randomBytes } from 'node:crypto';
-/** The two bind hosts the webserver config schema accepts. */
-export const ALLOWED_LISTEN_HOSTS = ['127.0.0.1', '0.0.0.0'];
+import { isLocalListenHost, isWildcardListenHost } from "./listen-addresses.js";
 /**
  * Delay between confirming the change to the browser and writing the patch
  * file. The HMR watcher fires within milliseconds of the write and the
@@ -26,9 +38,30 @@ export const ALLOWED_LISTEN_HOSTS = ['127.0.0.1', '0.0.0.0'];
  * the confirmation — so the write lands a beat AFTER the response flushed.
  */
 export const LISTEN_APPLY_DELAY_MS = 300;
-/** Whether a value is one of the two allowed bind-host literals. */
+/**
+ * Whether a value is a bind host that is safe (and accepted) to write: a
+ * concrete literal naming an address of this machine. See isLocalListenHost
+ * for why the wildcard AND non-local literals are both refused.
+ */
 export function isAllowedListenHost(value) {
-    return value === '127.0.0.1' || value === '0.0.0.0';
+    return isLocalListenHost(value);
+}
+/**
+ * Throw the refusal for a host that must never reach the patch layer. Each
+ * case gets its own message: the wildcard and a non-local literal both leave
+ * a profile that cannot boot, but for different reasons and with different
+ * fixes.
+ */
+function refuseListenHost(value) {
+    const shown = JSON.stringify(value);
+    if (isWildcardListenHost(value)) {
+        throw new Error(`refusing to write ${shown}: the unspecified (wildcard) bind address is rejected by ` +
+            'dsh >= 0.2.1-alpha.2 while resolving config, which fails the entire startup ' +
+            '(the webserver never activates). Bind one concrete local interface address instead.');
+    }
+    throw new Error(`refusing to write ${shown}: not an address of this machine. Bind one concrete IPv4/IPv6 ` +
+        'address that a local interface actually has (or 127.0.0.1) — an address the machine ' +
+        'does not own fails to bind with EADDRNOTAVAIL and leaves the next startup broken.');
 }
 /** The patch row id owning the web transport. */
 const WEBSERVER_ROW_ID = 'webserver';
@@ -53,13 +86,19 @@ export function patchHasWebserverEntry(content) {
  * - entry present with a `host:` under `config:` → the value is replaced;
  * - entry present without `host:` → the line is inserted under `config:`;
  * - entry present without `config:` → a config block is appended;
- * - no entry at all → a complete row is appended (name/inject/port restated).
+ * - no entry at all → a complete row is written (name/inject/port restated):
+ *   replacing the generated template's `[]` marker when present, otherwise
+ *   appended as a new block item.
  *
  * @param content - the patch file's current text.
- * @param host - the target bind host literal.
+ * @param host - the target bind host (an address this machine owns).
  * @returns the next file text; every other byte is untouched.
+ * @throws When `host` is not an address this machine owns, or the document is
+ *   flow-style and cannot be extended as valid YAML — see refuseListenHost.
  */
 export function setWebserverHost(content, host) {
+    if (!isAllowedListenHost(host))
+        refuseListenHost(host);
     const lines = content.split('\n');
     let entryStart = -1;
     for (let i = 0; i < lines.length; i++) {
@@ -76,8 +115,32 @@ export function setWebserverHost(content, host) {
             '  config:',
             '    host: ' + host,
             '    port: !!js ' + WEBSERVER_PORT_EXPRESSION
-        ].join('\n');
-        return content.length === 0 || content.endsWith('\n') ? content + block + '\n' : content + '\n' + block + '\n';
+        ];
+        // The dsh-generated template for a fresh profile is a comment header
+        // followed by `[]` (the valid empty-sequence document). Appending a block
+        // item after `[]` yields `[]\n- id: …`, which is NOT valid YAML — the boot
+        // then dies with "failed to parse overlay …: end of the stream or a
+        // document separator is expected", i.e. the same class of unbootable
+        // state as the wildcard. Replace the empty marker instead of appending.
+        const marker = lines.findIndex((line) => line.trim() === '[]');
+        if (marker !== -1) {
+            lines.splice(marker, 1, ...block);
+            return lines.join('\n');
+        }
+        // Any other flow-style document (e.g. `[{ id: webserver }]`) cannot be
+        // extended textually without producing invalid YAML; refuse loudly rather
+        // than write a file the next boot cannot parse.
+        const firstContent = lines.find((line) => {
+            const trimmed = line.trim();
+            return trimmed.length > 0 && !trimmed.startsWith('#');
+        });
+        if (firstContent !== undefined && firstContent.trimStart().startsWith('[')) {
+            throw new Error('refusing to edit a flow-style patch document (' + firstContent.trim() + '): ' +
+                'convert it to block style (a `- id:` list) first — appending a block item ' +
+                'after a flow sequence produces YAML the next boot cannot parse.');
+        }
+        const text = content.length === 0 || content.endsWith('\n') ? content + block.join('\n') + '\n' : content + '\n' + block.join('\n') + '\n';
+        return text;
     }
     // The entry block ends at the next top-level list item or EOF.
     let entryEnd = lines.length;
@@ -137,7 +200,8 @@ export function resolveListenPatchPath(profilePatch, homePatch) {
 }
 /**
  * Read + transform the owning patch layer for `host`, returning the next
- * file content. Throws when the file cannot be read.
+ * file content. Throws when the file cannot be read, or when `host` is not a
+ * concrete address (the wildcard refusal runs before any read).
  */
 export function prepareWebserverHostPatch(patchPath, host) {
     return setWebserverHost(readPatchOrEmpty(patchPath), host);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fonlan/dsh-web-auth",
-  "version": "0.1.10",
+  "version": "0.2.2",
   "description": "DSH web plugin: password-gate authentication (login page + HttpOnly signed cookie) for exposing dsh web behind a reverse proxy",
   "type": "module",
   "license": "MIT",
@@ -50,33 +50,32 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-ui-slots",
-        "@deepseek-ai/dsh-client-ui-settings",
-        "@deepseek-ai/dsh-client-connection",
-        "@deepseek-ai/dsh-api-remotes"
+        "@deepseek-ai/dsh-client-ui-settings"
       ],
       "platform": "web"
     }
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1",
+    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.2 || ^0.2.0-rc.1 || ^0.2.1-alpha.1 || ^0.2.1-alpha.2 || ^0.2.1-rc.2 || ^0.2.1-rc.3",
     "@deepseek-ai/schemastery": "^3.18.4",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "3.18.5-alpha.1"
+    "@deepseek-ai/schemastery": "3.18.5"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5-alpha.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-settings": "0.2.1-alpha.1",
-    "@deepseek-ai/schemastery": "3.18.5-alpha.1",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "3.18.5",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.0",
     "esbuild": "^0.24.0",
     "react": "^18.2.0",
-    "typescript": "^5.6.0"
+    "typescript": "^5.6.0",
+    "yaml": "2.9.1"
   }
 }

package/lib/settings.d.ts

@@ -1,62 +0,0 @@
-/**
- * dsh-web-auth — the `web-auth` settings namespace.
- *
- * The namespace exists so the plugin's browser half can read and write its
- * own settings page: the page registers on the `settings.section` slot (the
- * 「访问认证」 entry in the settings sidebar) and binds this namespace through
- * the client settings scope, which is the only write path to `listenHost`.
- * The namespace carries the one genuine configuration value the plugin owns:
- * the web server's bind host (`listenHost`). The password is deliberately
- * NOT here — it is a secret stored hashed under `$DSH_HOME/web-auth/` and
- * changed through a dedicated API, never through the settings document.
- *
- * Applying `listenHost` still goes through the profile patch layer (the
- * webserver's bind host is composition config; the patch is how it is
- * changed, and HMR hot-applies it). The settings document is the user-facing
- * source of intent; this module translates a committed change into the same
- * prepare → deferred-commit path the REST API used before.
- */
-import z from '@deepseek-ai/schemastery';
-import { type ListenHost } from './profile-patch.ts';
-import type { ListenController } from './handlers.ts';
-/** The settings namespace string (the card's dispatch key, spelled the same client-side). */
-export declare const WEB_AUTH_NS = "web-auth";
-/** Branded namespace for the settings provider. */
-export declare const NS = "web-auth";
-/** The namespace's resolved shape. */
-export interface WebAuthSettings {
-    /** The web server's bind host. */
-    listenHost: ListenHost;
-}
-/** Schema resolving the namespace (schemastery, matching the webserver's own).
- *
- * Deliberately NO `.default(...)`: an invalid user-layer value (e.g. `null`
- * written by an out-of-band client) must REJECT the write — keeping the last
- * good resolved value — rather than silently resolving to the default. A
- * default would look like a genuine user change to the watch below and could
- * rebind the webserver off a value nobody actually chose.
- */
-export declare const WebAuthSettingsSchema: z<WebAuthSettings>;
-/**
- * Register the `web-auth` settings namespace and translate committed
- * `listenHost` changes into the live bind-host switch.
- *
- * The registration rides the plugin fiber and attaches only when a settings
- * service exists (`ctx.inject(['settings'])`), so CLI/headless profiles —
- * which have no web surface and no card — keep working without one. The
- * composition `base` is the webserver's host at boot: the patch layer IS the
- * deployment's composition, and seeding it this way makes the resolved value
- * match reality with no user layer and no settings-document write.
- *
- * The watch callback applies a changed host through the same
- * prepare → deferred-commit controller the REST API uses; a change that is a
- * no-op against the current runtime host is skipped, and a commit that did
- * not actually change the resolved value (invalid writes keep the last good
- * value; document reloads re-resolve) never touches the webserver. This also
- * makes the initial attach harmless — the resolved value equals the runtime
- * host.
- *
- * @param ctx - the plugin context (must expose `settings` when available).
- * @param listen - the live listen-host controller (prepare/commit).
- */
-export declare function installWebAuthSettings(ctx: import('./context-types.ts').PluginContext, listen: ListenController): void;

package/lib/settings.js

@@ -1,87 +0,0 @@
-/**
- * dsh-web-auth — the `web-auth` settings namespace.
- *
- * The namespace exists so the plugin's browser half can read and write its
- * own settings page: the page registers on the `settings.section` slot (the
- * 「访问认证」 entry in the settings sidebar) and binds this namespace through
- * the client settings scope, which is the only write path to `listenHost`.
- * The namespace carries the one genuine configuration value the plugin owns:
- * the web server's bind host (`listenHost`). The password is deliberately
- * NOT here — it is a secret stored hashed under `$DSH_HOME/web-auth/` and
- * changed through a dedicated API, never through the settings document.
- *
- * Applying `listenHost` still goes through the profile patch layer (the
- * webserver's bind host is composition config; the patch is how it is
- * changed, and HMR hot-applies it). The settings document is the user-facing
- * source of intent; this module translates a committed change into the same
- * prepare → deferred-commit path the REST API used before.
- */
-import z from '@deepseek-ai/schemastery';
-import { isAllowedListenHost } from "./profile-patch.js";
-/** The settings namespace string (the card's dispatch key, spelled the same client-side). */
-export const WEB_AUTH_NS = 'web-auth';
-/** Branded namespace for the settings provider. */
-export const NS = WEB_AUTH_NS;
-/** Schema resolving the namespace (schemastery, matching the webserver's own).
- *
- * Deliberately NO `.default(...)`: an invalid user-layer value (e.g. `null`
- * written by an out-of-band client) must REJECT the write — keeping the last
- * good resolved value — rather than silently resolving to the default. A
- * default would look like a genuine user change to the watch below and could
- * rebind the webserver off a value nobody actually chose.
- */
-export const WebAuthSettingsSchema = z.object({
-    listenHost: z.union([z.const('127.0.0.1'), z.const('0.0.0.0')])
-});
-/**
- * Register the `web-auth` settings namespace and translate committed
- * `listenHost` changes into the live bind-host switch.
- *
- * The registration rides the plugin fiber and attaches only when a settings
- * service exists (`ctx.inject(['settings'])`), so CLI/headless profiles —
- * which have no web surface and no card — keep working without one. The
- * composition `base` is the webserver's host at boot: the patch layer IS the
- * deployment's composition, and seeding it this way makes the resolved value
- * match reality with no user layer and no settings-document write.
- *
- * The watch callback applies a changed host through the same
- * prepare → deferred-commit controller the REST API uses; a change that is a
- * no-op against the current runtime host is skipped, and a commit that did
- * not actually change the resolved value (invalid writes keep the last good
- * value; document reloads re-resolve) never touches the webserver. This also
- * makes the initial attach harmless — the resolved value equals the runtime
- * host.
- *
- * @param ctx - the plugin context (must expose `settings` when available).
- * @param listen - the live listen-host controller (prepare/commit).
- */
-export function installWebAuthSettings(ctx, listen) {
-    ctx.inject(['settings'], (sctx) => {
-        const current = listen.current();
-        const base = {
-            listenHost: isAllowedListenHost(current) ? current : '127.0.0.1'
-        };
-        const scope = sctx.settings.register(NS, WebAuthSettingsSchema, { base });
-        const dispose = scope.watch((next, prev) => {
-            const desired = next.listenHost;
-            // Only a real resolved-value change is a user gesture worth applying:
-            // a commit that re-resolves to the same value (document reloads, a
-            // rejected patch keeping the last good value) must not touch the
-            // webserver. Combined with the no-default schema, an invalid write
-            // cannot masquerade as a change.
-            if (desired === prev.listenHost)
-                return;
-            if (desired === listen.current())
-                return;
-            try {
-                listen.commit(listen.prepare(desired));
-            }
-            catch (error) {
-                // The settings document already committed; the apply is best-effort
-                // (failures logged, never thrown — the client was already confirmed).
-                console.error('[dsh-web-auth] failed to apply listenHost from settings:', error);
-            }
-        });
-        sctx.effect(() => dispose, 'web-auth: listen host settings watcher');
-    });
-}