@goodandready/dsh-key-rotation 0.8.52 → 0.8.53

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.8.53 - 2026-10-09
+
+### Fixed
+- **Official DSH Desktop Build Compatibility (#465, GitHub #22)**:
+  - Fixed issue where all mutating routes (POST, PUT, DELETE) answered `403 "forbidden"` inside the official DSH Desktop application (reported by @onech1cken in GitHub #22).
+  - The Desktop shell (`dsh-app://app/`) uses `forwardWebRequest` proxying which strips the `Origin` header before forwarding requests to the in-process server.
+  - `isTrustedBridgeRequest` now permits absent `Origin` headers (`origin === undefined`) for mutating requests when the remote peer address is verified loopback (`127.0.0.1`, `::1`, `::ffff:127.0.0.1`) and the `Host` header is verified loopback/localhost with no cross-site fetch metadata (`sec-fetch-site !== cross-site`). Real web browsers unconditionally attach `Origin` to cross-origin writes, preventing CSRF.
+  - Explicitly allowed `dsh-app://app` origin when forwarded by Desktop shell.
+  - Preserved strict fail-closed security for non-loopback clients, DNS rebinding, malformed origins, and cross-site requests.
+
 ## 0.8.52 - 2026-10-07
 
 ### Added

package/lib/pool.js

@@ -42,12 +42,19 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
-  if (!origin) {
-    const method = String(req?.method ?? 'GET').toUpperCase();
-    return method === 'GET' || method === 'HEAD' || method === 'OPTIONS';
+  if (origin === undefined) {
+    // Official Desktop build forwards requests via forwardWebRequest which strips Origin (#465 / GitHub #22).
+    // Real browsers unconditionally send Origin on cross-origin mutations, so an absent Origin cannot originate
+    // from a malicious website. Peer address and Host header are already verified loopback above.
+    return true;
   }
+  if (!origin) return false; // Explicit empty string or null-like falsy
   try {
     const originUrl = new URL(origin);
+    // Official Desktop build shell origin
+    if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app')) {
+      return true;
+    }
     if (originUrl.host !== hostHeader) return false;
     const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
     return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.52",
+  "version": "0.8.53",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [