@goodandready/dsh-key-rotation 0.8.70 → 0.8.72

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.8.72] — 2026-10-23
+
+### Security
+- **Fail-closed write-origin guard (#516):** Mutating HTTP methods (`POST`, `PUT`, `PATCH`, `DELETE`) without `Origin` header are now rejected with `403 Forbidden` unless positively identified as the Desktop shell (UA contains `@deepseek-ai/dsh-desktop/` AND Cookie contains `dsh-auth-`). Previously, any LAN/Tailscale client whose requests were forwarded via `dsh-lanmode` (loopback socket) could bypass source validation on all write routes.
+- **`/auto-import` fail-closed body validation (#516):** Invalid JSON body now returns `400 Bad Request` instead of silently importing all discovered keys. Auto-import requires explicit `refs` array or `all: true`.
+
+### Added
+- `isDesktopShellRequest(req)` predicate in `lib/pool.js` for positive Desktop shell identification.
+- `test/issue-516-write-origin-guard.test.mjs` — dedicated regression test suite (3 tests).
+
+### Changed
+- `isTrustedBridgeRequest` in `lib/pool.js`: absent Origin on write requests now checks Desktop shell credentials or same-origin Referer before passing.
+- Client card `runAutoImport` sends `{ all: true }` instead of `{}`.
+- Updated 7 existing test files to match new fail-closed semantics.
+- Updated `README.md`, `README.zh.md`, `docs/design/DESIGN.md`.
+
+## 0.8.71 - 2026-10-22
+
+### Bug Fixes
+- **Complete Chinese (zh) Localization for Interactive Routing Simulator (#514, PR #515)**:
+  - Added 13 missing Chinese translations to `zh` dictionary in `lib/client-src/10-locales.js` for the Interactive Routing Simulator dialog (`simulatorTitle`, `simulatorDesc`, `simulatorRun`, `simulatorRunning`, `simulatorSelectProvider`, `simulatorSelectModel`, `simulatorMaxAttempts`, `simulatorEvent`, `simulatorEventSuccess`, `simulatorEventRateLimit`, `simulatorEventServer500`, `simulatorResults`, `simulatorNoResults`).
+  - Recompiled `lib/client.js` bundle (194,681 bytes) meeting strict size and line constraints.
+  - Added automated test `test/issue-514-i18n-zh-simulator.test.mjs` verifying 100% key parity between English and Chinese dictionaries (248 keys each).
+
 ## 0.8.70 - 2026-10-20
 
 ### Bug Fixes

package/README.md

@@ -303,7 +303,7 @@ Access full visual management under **Settings → Key Rotation** or via the Hea
 * **Zero Plaintext Secrets in Plugin Config**: Configuration files store only environment variable reference names (e.g. `MY_PROVIDER_API_KEY`).
 * **Secure Vault Storage**: Actual secret values reside securely in `$DSH_HOME/.credentials.yaml` managed by the DSH `Credentials` service.
 * **5-Character Masking (`keyTail`)**: Full secret values are never sent to the client browser; only the trailing 5 characters are exposed for visual identification. Short keys (<= 5 characters) return a fixed masked placeholder (`***`) to prevent credential disclosure.
-* **Fail-Closed Loopback & Same-Origin Fencing**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on `POST`/`PUT`/`PATCH`/`DELETE` but optional on `GET`/`HEAD`/`OPTIONS`, because browsers omit it on same-origin reads — requiring it there would reject the Settings card's own requests.
+* **Fail-Closed Loopback, Same-Origin & Write-Origin Guard**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on mutating methods (`POST`/`PUT`/`PATCH`/`DELETE`) — requests without `Origin` pass only if they carry positive Desktop shell identification (`@deepseek-ai/dsh-desktop/` in `User-Agent` AND `dsh-auth-` session cookie) or a same-origin `Referer`. `GET`/`HEAD`/`OPTIONS` remain unrestricted as browsers omit `Origin` on same-origin reads.
 * **Fail-Closed Resolver on Pool Exhaustion**: When all credentials in a managed pool are exhausted, paused, expired, or blocked by RPM/TPM limits, the resolver fails closed with `LOCAL_POOL_EXHAUSTED` error rather than falling back to leaking unmanaged credentials.
 * **SSRF Protection & Rebinding Guard**: Remote provider pool import strictly enforces HTTPS-only URLs, validates all resolved IP addresses including IPv4-mapped and IPv4-compatible IPv6 addresses (`::ffff:127.0.0.1`, `::ffff:7f00:1`, `64:ff9b::/96`), and enforces connect-time DNS validation via undici agent dispatchers to prevent TOCTOU DNS rebinding.
 * **Cross-Pool Revocation & Inheritance**: Model pools automatically inherit pause, revoke, and expiry states from their base provider; runtime 401 permanent authentication failures revoke the credential across all shared pools immediately.

package/README.zh.md

@@ -265,7 +265,7 @@ claude-sonnet 请求
 * **配置零明文**：插件配置仅保存环境变量引用名（如 `MY_PROVIDER_API_KEY`）。
 * **宿主安全存储**：真实密钥持久化保存在 `$DSH_HOME/.credentials.yaml`。
 * **前台 5 字符脱敏**：前端仅展示密钥后 5 位字符进行视觉区分。对于长度 <= 5 的短密钥，返回统一脱敏占位符 (`***`)，防止凭证完整泄露。
-* **Fail-Closed 环回同源安全隔离**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。`POST`/`PUT`/`PATCH`/`DELETE` 必须携带 `Origin`，而 `GET`/`HEAD`/`OPTIONS` 允许省略——因为浏览器在同源读取请求中不会发送该头，强制要求会连带拒绝设置面板自身的请求。
+* **Fail-Closed 环回同源安全隔离及写操作 Origin 守卫**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。变更方法（`POST`/`PUT`/`PATCH`/`DELETE`）无 `Origin` 时，仅允许通过明确 Desktop 外壳身份识别（`User-Agent` 含 `@deepseek-ai/dsh-desktop/` 且 Cookie 含 `dsh-auth-`）或同源 `Referer` 的请求。`GET`/`HEAD`/`OPTIONS` 保持不限制，因为浏览器同源读取时不发送 `Origin`。
 * **凭证池耗尽 Fail-Closed 熔断**：当受管凭证池中所有密钥均被耗尽、暂停、过期或触发 RPM/TPM 限制时，解析器立即返回 `LOCAL_POOL_EXHAUSTED` 错误熔断，杜绝静默回退泄漏未受控原始密钥。
 * **SSRF 与 DNS 重绑定防护**：远程配置导入严格仅支持 HTTPS，全面校验解析 IP 并拦截 IPv4-mapped/IPv4-compatible 等各类 IPv6 环回变体（如 `::ffff:127.0.0.1`、`::ffff:7f00:1`、`64:ff9b::/96`），并通过 undici 调度器执行连接时（connect-time）DNS 校验，从根本上防御 TOCTOU DNS 重绑定。
 * **跨池吊销与状态继承**：模型子池自动继承基础提供商的暂停、吊销与过期时间；运行时 401 永久认证失败将即时在所有关联共享池中统一标记吊销。

package/lib/client.js

@@ -300,6 +300,19 @@ window.__ModuleLoader__.load({
       'header.sub': '自动化多密钥轮换、429/5xx指数退避冷却、断路器保护及凭证安全 (~/.dsh/.credentials.yaml)。',
       'header.pools_badge': '个活跃密钥池',
       'header.keys_badge': '个已配置密钥',
+      simulatorTitle: '交互式路由模拟器',
+      simulatorDesc: '测试路由策略并在不向上游发送实际请求的情况下可视化密钥池的故障转移链路。',
+      simulatorRun: '运行模拟',
+      simulatorRunning: '模拟中…',
+      simulatorSelectProvider: '提供商',
+      simulatorSelectModel: '模型（可选）',
+      simulatorMaxAttempts: '最大尝试次数',
+      simulatorEvent: '模拟场景',
+      simulatorEventSuccess: '所有密钥均成功',
+      simulatorEventRateLimit: '密钥 1 触发速率限制 (429)',
+      simulatorEventServer500: '密钥 1 内部服务错误 (500)',
+      simulatorResults: '模拟追踪结果',
+      simulatorNoResults: '运行模拟以查看候选密钥执行链路。',
       sectionStats: '密钥池健康与遥测',
       sectionStatsDesc: '活跃密钥池、健康凭证和故障转移状态的实时遥测。',
       sectionFailover: '故障转移触发器与错误代码',
@@ -1397,7 +1410,7 @@ window.__ModuleLoader__.load({
           const res = await fetch('/dsh-key-rotation/auto-import', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({}),
+            body: JSON.stringify({ all: true }),
             signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined,
           });
           const data = await res.json();

package/lib/http-bridge.js

@@ -1,7 +1,7 @@
 // lib/http-bridge.js — shared HTTP helpers for dsh-key-rotation routes.
 import { findSecrets } from './keycheck.js';
-import { isTrustedBridgeRequest } from './pool.js';
-export { isTrustedBridgeRequest };
+import { isTrustedBridgeRequest, isDesktopShellRequest } from './pool.js';
+export { isTrustedBridgeRequest, isDesktopShellRequest };
 import { mutateSettings, plainObject, requireRevision, sectionOps, validateOps } from './settings-write.js';
 
 export const NS = 'dsh-key-rotation';

package/lib/index.js

@@ -10,7 +10,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import Schema from '@deepseek-ai/schemastery';
 import { createConfigReader, createProviderProfilesReader } from './config-compat.js';
 import {
-  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, SWITCHABLE_MESSAGE_PATTERN,
+  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, SWITCHABLE_MESSAGE_PATTERN,
   DEFAULT_SWITCH_CODES, isValidRef, pickNext, applyCooldown, recordFailure,
   recordSuccess, computeBackoff, envValue, sweepExpired, parseRetryAfter,
   computeHealthScore, extractRateLimit, isRateLimited, selectPool, isSwitchableError,
@@ -52,7 +52,7 @@ import { setupIdleHealEffect, setupAutoUnbreakEffect, setupPersistence, setupPro
 
 export const name = '@goodandready/dsh-key-rotation';
 export const inject = ['llm', 'webServer', 'settings', 'credentials'];
-export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
+export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
 export { notifySwitch, notifyExhaustion, notifyEarlyWarning };
 
 const NS = 'dsh-key-rotation';

package/lib/ops-keys.js

@@ -464,19 +464,24 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: auto-import is local-only' } });
       return;
     }
-    let body = {};
-    try { body = await readJson(req); } catch (_) { body = {}; }
+    let body;
+    try {
+      body = await readJson(req);
+    } catch (e) {
+      json(res, 400, { error: { code: 'bad-request', message: e.message || 'invalid request body' } });
+      return;
+    }
+    const hasRefs = Array.isArray(body?.refs) && body.refs.length > 0;
+    if (!hasRefs && body?.all !== true) {
+      json(res, 400, { error: { code: 'bad-request', message: 'auto-import requires explicit "refs" array or "all: true"' } });
+      return;
+    }
 
     try {
       const runtime = deps.buildRuntime?.() ?? {};
       const discovered = await discoverUnconfiguredKeys(ctx, runtime.pools || []);
-      const targetRefs = Array.isArray(body?.refs) && body.refs.length > 0
-        ? new Set(body.refs)
-        : null;
-
-      const toImport = targetRefs
-        ? discovered.filter((d) => targetRefs.has(d.ref))
-        : discovered;
+      const targetRefs = hasRefs ? new Set(body.refs) : null;
+      const toImport = targetRefs ? discovered.filter((d) => targetRefs.has(d.ref)) : discovered;
 
       if (toImport.length === 0) {
         json(res, 200, { ok: true, importedCount: 0, message: 'No unassigned keys to import' });

package/lib/pool.js

@@ -39,12 +39,20 @@ export function isLoopbackAddress(ip) {
   return false;
 }
 
+/** Check if an incoming HTTP request is from the Desktop shell (#516). */
+export function isDesktopShellRequest(req) {
+  const agent = req?.headers?.['user-agent'] || '';
+  const cookie = req?.headers?.cookie || '';
+  return typeof agent === 'string' && agent.includes('@deepseek-ai/dsh-desktop/') &&
+         typeof cookie === 'string' && cookie.includes('dsh-auth-');
+}
+
 /** Strip an optional :port and IPv6 brackets from a Host header value. */
 function hostNameOf(hostHeader) {
   return String(hostHeader).replace(/:\d+$/, '').replace(/^\[|\]$/g, '').toLowerCase();
 }
 
-/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware). */
+/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware, #516 write-origin-guard). */
 export function isTrustedBridgeRequest(req) {
   const remoteAddress = req?.socket?.remoteAddress;
   if (!isLoopbackAddress(remoteAddress)) return false;
@@ -55,25 +63,51 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
-  if (origin === undefined) {
-    // Official Desktop build forwards requests via forwardWebRequest which strips Origin (#465 / GitHub #22).
-    // Real browsers unconditionally send Origin on cross-origin mutations, so an absent Origin cannot originate
-    // from a malicious website. Peer address and Host header are already verified loopback above.
+  if (origin !== undefined) {
+    if (!origin) return false; // Explicit empty string or null-like falsy
+    try {
+      const originUrl = new URL(origin);
+      // Official Desktop build shell origin
+      if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
+        return true;
+      }
+      if (originUrl.host !== hostHeader) return false;
+      const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
+    }
+  }
+
+  // Absent Origin:
+  const method = String(req?.method || 'GET').toUpperCase();
+  const mutating = method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+  if (!mutating) {
+    // Browsers omit Origin on same-origin read navigations (GET/HEAD/OPTIONS).
     return true;
   }
-  if (!origin) return false; // Explicit empty string or null-like falsy
-  try {
-    const originUrl = new URL(origin);
-    // Official Desktop build shell origin
-    if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app')) {
-      return true;
+
+  // Mutating requests without Origin: allow only authenticated Desktop shell or valid Referer (#516).
+  if (isDesktopShellRequest(req)) {
+    return true;
+  }
+
+  const referer = req?.headers?.referer;
+  if (referer) {
+    try {
+      const refUrl = new URL(referer);
+      if (refUrl.protocol === 'dsh-app:' && (refUrl.host === 'app' || refUrl.hostname === 'app' || refUrl.host === 'localhost')) {
+        return true;
+      }
+      if (refUrl.host !== hostHeader) return false;
+      const hostname = refUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(refUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
     }
-    if (originUrl.host !== hostHeader) return false;
-    const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
-    return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
-  } catch (_) {
-    return false;
   }
+
+  return false;
 }
 
 /** Regex matching error phrases that warrant switching to the next key. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.70",
+  "version": "0.8.72",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [