@goodandready/dsh-key-rotation 0.8.71 → 0.8.72

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.8.72] — 2026-10-23
+
+### Security
+- **Fail-closed write-origin guard (#516):** Mutating HTTP methods (`POST`, `PUT`, `PATCH`, `DELETE`) without `Origin` header are now rejected with `403 Forbidden` unless positively identified as the Desktop shell (UA contains `@deepseek-ai/dsh-desktop/` AND Cookie contains `dsh-auth-`). Previously, any LAN/Tailscale client whose requests were forwarded via `dsh-lanmode` (loopback socket) could bypass source validation on all write routes.
+- **`/auto-import` fail-closed body validation (#516):** Invalid JSON body now returns `400 Bad Request` instead of silently importing all discovered keys. Auto-import requires explicit `refs` array or `all: true`.
+
+### Added
+- `isDesktopShellRequest(req)` predicate in `lib/pool.js` for positive Desktop shell identification.
+- `test/issue-516-write-origin-guard.test.mjs` — dedicated regression test suite (3 tests).
+
+### Changed
+- `isTrustedBridgeRequest` in `lib/pool.js`: absent Origin on write requests now checks Desktop shell credentials or same-origin Referer before passing.
+- Client card `runAutoImport` sends `{ all: true }` instead of `{}`.
+- Updated 7 existing test files to match new fail-closed semantics.
+- Updated `README.md`, `README.zh.md`, `docs/design/DESIGN.md`.
+
 ## 0.8.71 - 2026-10-22
 
 ### Bug Fixes

package/README.md

@@ -303,7 +303,7 @@ Access full visual management under **Settings → Key Rotation** or via the Hea
 * **Zero Plaintext Secrets in Plugin Config**: Configuration files store only environment variable reference names (e.g. `MY_PROVIDER_API_KEY`).
 * **Secure Vault Storage**: Actual secret values reside securely in `$DSH_HOME/.credentials.yaml` managed by the DSH `Credentials` service.
 * **5-Character Masking (`keyTail`)**: Full secret values are never sent to the client browser; only the trailing 5 characters are exposed for visual identification. Short keys (<= 5 characters) return a fixed masked placeholder (`***`) to prevent credential disclosure.
-* **Fail-Closed Loopback & Same-Origin Fencing**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on `POST`/`PUT`/`PATCH`/`DELETE` but optional on `GET`/`HEAD`/`OPTIONS`, because browsers omit it on same-origin reads — requiring it there would reject the Settings card's own requests.
+* **Fail-Closed Loopback, Same-Origin & Write-Origin Guard**: Administrative endpoints strictly enforce loopback checks (`isTrustedBridgeRequest`): the socket peer and the `Host` header must both be loopback (`127.0.0.1`, `::1`, `localhost`), and `sec-fetch-site: cross-site` is always refused. An attached `Origin` must be an http(s) loopback origin matching `Host` exactly. `Origin` is required on mutating methods (`POST`/`PUT`/`PATCH`/`DELETE`) — requests without `Origin` pass only if they carry positive Desktop shell identification (`@deepseek-ai/dsh-desktop/` in `User-Agent` AND `dsh-auth-` session cookie) or a same-origin `Referer`. `GET`/`HEAD`/`OPTIONS` remain unrestricted as browsers omit `Origin` on same-origin reads.
 * **Fail-Closed Resolver on Pool Exhaustion**: When all credentials in a managed pool are exhausted, paused, expired, or blocked by RPM/TPM limits, the resolver fails closed with `LOCAL_POOL_EXHAUSTED` error rather than falling back to leaking unmanaged credentials.
 * **SSRF Protection & Rebinding Guard**: Remote provider pool import strictly enforces HTTPS-only URLs, validates all resolved IP addresses including IPv4-mapped and IPv4-compatible IPv6 addresses (`::ffff:127.0.0.1`, `::ffff:7f00:1`, `64:ff9b::/96`), and enforces connect-time DNS validation via undici agent dispatchers to prevent TOCTOU DNS rebinding.
 * **Cross-Pool Revocation & Inheritance**: Model pools automatically inherit pause, revoke, and expiry states from their base provider; runtime 401 permanent authentication failures revoke the credential across all shared pools immediately.

package/README.zh.md

@@ -265,7 +265,7 @@ claude-sonnet 请求
 * **配置零明文**：插件配置仅保存环境变量引用名（如 `MY_PROVIDER_API_KEY`）。
 * **宿主安全存储**：真实密钥持久化保存在 `$DSH_HOME/.credentials.yaml`。
 * **前台 5 字符脱敏**：前端仅展示密钥后 5 位字符进行视觉区分。对于长度 <= 5 的短密钥，返回统一脱敏占位符 (`***`)，防止凭证完整泄露。
-* **Fail-Closed 环回同源安全隔离**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。`POST`/`PUT`/`PATCH`/`DELETE` 必须携带 `Origin`，而 `GET`/`HEAD`/`OPTIONS` 允许省略——因为浏览器在同源读取请求中不会发送该头，强制要求会连带拒绝设置面板自身的请求。
+* **Fail-Closed 环回同源安全隔离及写操作 Origin 守卫**：管理接口严格通过 `isTrustedBridgeRequest` 校验：套接字对端与 `Host` 头必须均为环回地址（`127.0.0.1`、`::1`、`localhost`），并始终拒绝 `sec-fetch-site: cross-site`。若请求携带 `Origin`，则必须是 http(s) 环回源且与 `Host` 完全一致。变更方法（`POST`/`PUT`/`PATCH`/`DELETE`）无 `Origin` 时，仅允许通过明确 Desktop 外壳身份识别（`User-Agent` 含 `@deepseek-ai/dsh-desktop/` 且 Cookie 含 `dsh-auth-`）或同源 `Referer` 的请求。`GET`/`HEAD`/`OPTIONS` 保持不限制，因为浏览器同源读取时不发送 `Origin`。
 * **凭证池耗尽 Fail-Closed 熔断**：当受管凭证池中所有密钥均被耗尽、暂停、过期或触发 RPM/TPM 限制时，解析器立即返回 `LOCAL_POOL_EXHAUSTED` 错误熔断，杜绝静默回退泄漏未受控原始密钥。
 * **SSRF 与 DNS 重绑定防护**：远程配置导入严格仅支持 HTTPS，全面校验解析 IP 并拦截 IPv4-mapped/IPv4-compatible 等各类 IPv6 环回变体（如 `::ffff:127.0.0.1`、`::ffff:7f00:1`、`64:ff9b::/96`），并通过 undici 调度器执行连接时（connect-time）DNS 校验，从根本上防御 TOCTOU DNS 重绑定。
 * **跨池吊销与状态继承**：模型子池自动继承基础提供商的暂停、吊销与过期时间；运行时 401 永久认证失败将即时在所有关联共享池中统一标记吊销。

package/lib/client.js

@@ -1410,7 +1410,7 @@ window.__ModuleLoader__.load({
           const res = await fetch('/dsh-key-rotation/auto-import', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({}),
+            body: JSON.stringify({ all: true }),
             signal: (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function') ? AbortSignal.timeout(8000) : undefined,
           });
           const data = await res.json();

package/lib/http-bridge.js

@@ -1,7 +1,7 @@
 // lib/http-bridge.js — shared HTTP helpers for dsh-key-rotation routes.
 import { findSecrets } from './keycheck.js';
-import { isTrustedBridgeRequest } from './pool.js';
-export { isTrustedBridgeRequest };
+import { isTrustedBridgeRequest, isDesktopShellRequest } from './pool.js';
+export { isTrustedBridgeRequest, isDesktopShellRequest };
 import { mutateSettings, plainObject, requireRevision, sectionOps, validateOps } from './settings-write.js';
 
 export const NS = 'dsh-key-rotation';

package/lib/index.js

@@ -10,7 +10,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import Schema from '@deepseek-ai/schemastery';
 import { createConfigReader, createProviderProfilesReader } from './config-compat.js';
 import {
-  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, SWITCHABLE_MESSAGE_PATTERN,
+  keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, SWITCHABLE_MESSAGE_PATTERN,
   DEFAULT_SWITCH_CODES, isValidRef, pickNext, applyCooldown, recordFailure,
   recordSuccess, computeBackoff, envValue, sweepExpired, parseRetryAfter,
   computeHealthScore, extractRateLimit, isRateLimited, selectPool, isSwitchableError,
@@ -52,7 +52,7 @@ import { setupIdleHealEffect, setupAutoUnbreakEffect, setupPersistence, setupPro
 
 export const name = '@goodandready/dsh-key-rotation';
 export const inject = ['llm', 'webServer', 'settings', 'credentials'];
-export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
+export { keyTail, KEY_TAIL_CHARS, KEY_TAIL_PLACEHOLDER, isLoopbackAddress, isTrustedBridgeRequest, isDesktopShellRequest, DEFAULT_SWITCH_CODES, isSwitchableError, formatExhaustionMessage, getRuntime };
 export { notifySwitch, notifyExhaustion, notifyEarlyWarning };
 
 const NS = 'dsh-key-rotation';

package/lib/ops-keys.js

@@ -464,19 +464,24 @@ ctx.effect(() => ctx.webServer.register({
       json(res, 403, { error: { code: 'forbidden', message: 'dsh-key-rotation: auto-import is local-only' } });
       return;
     }
-    let body = {};
-    try { body = await readJson(req); } catch (_) { body = {}; }
+    let body;
+    try {
+      body = await readJson(req);
+    } catch (e) {
+      json(res, 400, { error: { code: 'bad-request', message: e.message || 'invalid request body' } });
+      return;
+    }
+    const hasRefs = Array.isArray(body?.refs) && body.refs.length > 0;
+    if (!hasRefs && body?.all !== true) {
+      json(res, 400, { error: { code: 'bad-request', message: 'auto-import requires explicit "refs" array or "all: true"' } });
+      return;
+    }
 
     try {
       const runtime = deps.buildRuntime?.() ?? {};
       const discovered = await discoverUnconfiguredKeys(ctx, runtime.pools || []);
-      const targetRefs = Array.isArray(body?.refs) && body.refs.length > 0
-        ? new Set(body.refs)
-        : null;
-
-      const toImport = targetRefs
-        ? discovered.filter((d) => targetRefs.has(d.ref))
-        : discovered;
+      const targetRefs = hasRefs ? new Set(body.refs) : null;
+      const toImport = targetRefs ? discovered.filter((d) => targetRefs.has(d.ref)) : discovered;
 
       if (toImport.length === 0) {
         json(res, 200, { ok: true, importedCount: 0, message: 'No unassigned keys to import' });

package/lib/pool.js

@@ -39,12 +39,20 @@ export function isLoopbackAddress(ip) {
   return false;
 }
 
+/** Check if an incoming HTTP request is from the Desktop shell (#516). */
+export function isDesktopShellRequest(req) {
+  const agent = req?.headers?.['user-agent'] || '';
+  const cookie = req?.headers?.cookie || '';
+  return typeof agent === 'string' && agent.includes('@deepseek-ai/dsh-desktop/') &&
+         typeof cookie === 'string' && cookie.includes('dsh-auth-');
+}
+
 /** Strip an optional :port and IPv6 brackets from a Host header value. */
 function hostNameOf(hostHeader) {
   return String(hostHeader).replace(/:\d+$/, '').replace(/^\[|\]$/g, '').toLowerCase();
 }
 
-/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware). */
+/** Check if an incoming HTTP request is from a trusted local bridge origin (#353 fail-closed, #378 method-aware, #516 write-origin-guard). */
 export function isTrustedBridgeRequest(req) {
   const remoteAddress = req?.socket?.remoteAddress;
   if (!isLoopbackAddress(remoteAddress)) return false;
@@ -55,25 +63,51 @@ export function isTrustedBridgeRequest(req) {
   if (!(isLoopbackAddress(hostName) || hostName === 'localhost')) return false;
 
   const origin = req?.headers?.origin;
-  if (origin === undefined) {
-    // Official Desktop build forwards requests via forwardWebRequest which strips Origin (#465 / GitHub #22).
-    // Real browsers unconditionally send Origin on cross-origin mutations, so an absent Origin cannot originate
-    // from a malicious website. Peer address and Host header are already verified loopback above.
+  if (origin !== undefined) {
+    if (!origin) return false; // Explicit empty string or null-like falsy
+    try {
+      const originUrl = new URL(origin);
+      // Official Desktop build shell origin
+      if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app' || originUrl.host === 'localhost')) {
+        return true;
+      }
+      if (originUrl.host !== hostHeader) return false;
+      const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
+    }
+  }
+
+  // Absent Origin:
+  const method = String(req?.method || 'GET').toUpperCase();
+  const mutating = method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
+  if (!mutating) {
+    // Browsers omit Origin on same-origin read navigations (GET/HEAD/OPTIONS).
     return true;
   }
-  if (!origin) return false; // Explicit empty string or null-like falsy
-  try {
-    const originUrl = new URL(origin);
-    // Official Desktop build shell origin
-    if (originUrl.protocol === 'dsh-app:' && (originUrl.host === 'app' || originUrl.hostname === 'app')) {
-      return true;
+
+  // Mutating requests without Origin: allow only authenticated Desktop shell or valid Referer (#516).
+  if (isDesktopShellRequest(req)) {
+    return true;
+  }
+
+  const referer = req?.headers?.referer;
+  if (referer) {
+    try {
+      const refUrl = new URL(referer);
+      if (refUrl.protocol === 'dsh-app:' && (refUrl.host === 'app' || refUrl.hostname === 'app' || refUrl.host === 'localhost')) {
+        return true;
+      }
+      if (refUrl.host !== hostHeader) return false;
+      const hostname = refUrl.hostname.replace(/^\[|\]$/g, '');
+      return ['http:', 'https:'].includes(refUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
+    } catch (_) {
+      return false;
     }
-    if (originUrl.host !== hostHeader) return false;
-    const hostname = originUrl.hostname.replace(/^\[|\]$/g, '');
-    return ['http:', 'https:'].includes(originUrl.protocol) && (isLoopbackAddress(hostname) || hostname === 'localhost');
-  } catch (_) {
-    return false;
   }
+
+  return false;
 }
 
 /** Regex matching error phrases that warrant switching to the next key. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-key-rotation",
-  "version": "0.8.71",
+  "version": "0.8.72",
   "packageManager": "pnpm@10.33.2",
   "description": "Per-provider API key rotation for DeepSeek Harness: a key pool per provider, auto-created clone routes, and switching to the next key on quota/rate-limit errors. Includes a Settings section (Key Rotation) to edit the key pools, cooldown and switch codes.",
   "keywords": [