@goodandready/dsh-github-ops 0.6.1 → 0.6.2

package/lib/status.js

@@ -35,6 +35,21 @@ function isTrustedHost(host) {
   return false
 }
 
+/** Whether an address or host string represents local loopback. */
+function isLoopback(val) {
+  if (!val || typeof val !== 'string') return false
+  let h = val.trim().toLowerCase()
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']')
+    if (end > 0) h = h.slice(1, end)
+  } else if (h.includes(':')) {
+    const colons = h.split(':').length - 1
+    if (colons === 1) h = h.split(':')[0]
+  }
+  const clean = h.replace(/^::ffff:/, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.') || clean === 'localhost' || clean === 'localhost.'
+}
+
 /** Whether a request may read the status payload. Fail-closed. */
 export function isTrustedRequest(req) {
   if (!req) return false
@@ -51,15 +66,13 @@ export function isTrustedRequest(req) {
   if (cleanIp && !isTrustedHost(cleanIp)) return false
 
   const host = header(req, 'host')
-  const origin = header(req, 'origin') || header(req, 'referer')
-
   // If host is provided, it MUST be a trusted local/private host (DNS rebinding guard)
   if (host && !isTrustedHost(host)) return false
 
-  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
-  if (!origin && !secFetchSite && loopback) return true
+  const origin = header(req, 'origin')
+  const referer = header(req, 'referer')
 
-  // If origin/referer is present, verify it matches host or is a trusted local host
+  // Check origin header first
   if (origin) {
     try {
       const originUrl = new URL(origin)
@@ -71,6 +84,31 @@ export function isTrustedRequest(req) {
     }
   }
 
+  // Check referer header
+  if (referer) {
+    try {
+      const refUrl = new URL(referer)
+      if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
+        if (!isTrustedHost(refUrl.hostname)) return false
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
+        return true
+      }
+      // Non-http referer (e.g. dsh-app://app/ in DSH Desktop Electron):
+      // Desktop removes origin/sec-fetch-site and sets custom scheme referer.
+      // Accept only if caller is loopback (socket or loopback host).
+      const hostIsLoopback = host ? isLoopback(host) : false
+      if (loopback || (!address && hostIsLoopback)) {
+        return true
+      }
+      return false
+    } catch {
+      return false
+    }
+  }
+
+  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
+  if (!secFetchSite && loopback) return true
+
   // Non-loopback caller without origin/referer is refused
   if (!loopback) return false
 
@@ -94,7 +132,9 @@ export function isTrustedWriteRequest(req) {
   if (cleanIp && !isTrustedHost(cleanIp)) return false
 
   const host = header(req, 'host')
-  const origin = header(req, 'origin') || header(req, 'referer')
+  const origin = header(req, 'origin')
+  const referer = header(req, 'referer')
+
   if (origin) {
     try {
       const originUrl = new URL(origin)
@@ -102,8 +142,21 @@ export function isTrustedWriteRequest(req) {
     } catch {
       return false
     }
+  } else if (referer) {
+    try {
+      const refUrl = new URL(referer)
+      if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
+      } else {
+        // Non-http custom scheme referer from loopback: permitted as local loopback writer
+        const hostIsLoopback = host ? isLoopback(host) : false
+        if (!loopback && (address || !hostIsLoopback)) return false
+      }
+    } catch {
+      return false
+    }
   } else {
-    // Write request without origin: only permit local loopback
+    // Write request without origin/referer: only permit local loopback
     if (!loopback) return false
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",