@genkaku/protocol 0.1.17 → 0.1.18

package/dist/bridge.js

@@ -4,7 +4,7 @@
 // escrow on Base Sepolia. No provider wire code leaks into dsh.
 import { appendFileSync } from 'node:fs';
 import { createServer } from 'node:http';
-import { applyLoopbackCors } from "./cors.js";
+import { applyPanelCors } from "./cors.js";
 import { openEscrow, publicClientFor, readWorker, refundSession, settleSession, signReceiptPayload, walletAddress, walletClientFor, } from "./chain.js";
 import { dialWorkerAny, fetchOffers, requestSettleCosign } from "./dial.js";
 import { dedupeOffers, toWire } from "./offer.js";
@@ -533,7 +533,7 @@ export async function startOpenAiBridge(opts) {
         void (async () => {
             try {
                 const path = (req.url ?? '/').split('?')[0] ?? '/';
-                if (!applyLoopbackCors(req, res)) {
+                if (!applyPanelCors(req, res)) {
                     res.writeHead(403, { 'content-type': 'application/json' });
                     res.end(JSON.stringify({ error: { message: 'origin not allowed' } }));
                     return;

package/dist/cors.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 /**
- * Apply CORS headers when the request comes from a loopback origin.
- * @returns false when a browser origin outside loopback tried to call us.
+ * Apply CORS headers when the request comes from a host allowed to show a panel.
+ * @returns false when a browser origin outside that set tried to call us.
  */
-export declare function applyLoopbackCors(req: IncomingMessage, res: ServerResponse): boolean;
+export declare function applyPanelCors(req: IncomingMessage, res: ServerResponse): boolean;
 //# sourceMappingURL=cors.d.ts.map

package/dist/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAIhE;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAepF"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAOhE;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAejF"}

package/dist/cors.js

@@ -1,21 +1,32 @@
-// GENKAKU: CORS for the loopback control planes.
+// GENKAKU: CORS for the local control planes.
 //
 // The bridge and the worker status server answer on 127.0.0.1 and used to send
 // `access-control-allow-origin: *`. Any website the user visited could then
-// read wallet state and, once wallet endpoints existed, key material. Only a
-// loopback Origin (the DSH web app) may read these responses.
+// read wallet state and, once wallet endpoints existed, key material. Now only
+// the two hosts that actually render a panel may read these responses:
+//
+//   - the DSH web app served from loopback (`dsh web` in a browser), and
+//   - the official DSH desktop app, whose renderer runs on `dsh-app://app`.
+//     Chromium sends that origin on every cross-origin fetch, and the app's own
+//     web route authenticates with the same string.
+//
+// `null` stays rejected. A sandboxed iframe on any website carries that origin,
+// and file:// pages do too, so allowing it would hand every page the key
+// material this gate exists to protect.
 const LOOPBACK = /^https?:\/\/(127\.0\.0\.1|localhost|\[::1\])(:\d+)?$/;
+/** Origin of the official DSH desktop renderer (Electron custom scheme). */
+const DESKTOP_APP = 'dsh-app://app';
 /**
- * Apply CORS headers when the request comes from a loopback origin.
- * @returns false when a browser origin outside loopback tried to call us.
+ * Apply CORS headers when the request comes from a host allowed to show a panel.
+ * @returns false when a browser origin outside that set tried to call us.
  */
-export function applyLoopbackCors(req, res) {
+export function applyPanelCors(req, res) {
     const origin = req.headers.origin;
     // curl, the HTML dashboard (same-origin navigation) and node clients send no
     // Origin; they are not subject to the browser's cross-origin rules.
     if (origin == null)
         return true;
-    if (!LOOPBACK.test(origin))
+    if (!LOOPBACK.test(origin) && origin !== DESKTOP_APP)
         return false;
     res.setHeader('access-control-allow-origin', origin);
     res.setHeader('vary', 'origin');

package/dist/status.js

@@ -2,7 +2,7 @@
 // GET /genkaku/status (JSON). Snapshot is called per request so the page and
 // the JSON always reflect the live sidecar, never a boot-time copy.
 import { createServer } from 'node:http';
-import { applyLoopbackCors } from "./cors.js";
+import { applyPanelCors } from "./cors.js";
 /** Self-contained dashboard; mirrors the user bridge style and polls the JSON. */
 const DASHBOARD_HTML = `<!doctype html>
 <html lang="en">
@@ -171,7 +171,7 @@ export async function startStatusServer(port, snapshot, onCatalog, onMode, ollam
         void (async () => {
             try {
                 const path = (req.url ?? '/').split('?')[0] ?? '/';
-                if (!applyLoopbackCors(req, res)) {
+                if (!applyPanelCors(req, res)) {
                     res.writeHead(403, { 'content-type': 'application/json' });
                     res.end(JSON.stringify({ error: { message: 'origin not allowed' } }));
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genkaku/protocol",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "GenKaKu protocol core: on-chain worker directory, USDC escrow billing, libp2p transport, Ollama lifecycle",
   "license": "MIT",
   "type": "module",