@goodandready/dsh-ollama-cloud-provider 0.1.5 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.7 — 2026-10-22
+
+- Identify the Desktop renderer by the signed host auth cookie plus the desktop
+  user agent when Origin and Referer are absent (the dsh-app protocol strips
+  both). Plain LAN clients without either still receive 403 (#28).
+
+## 0.1.6 — 2026-10-22
+
+- Accept the DSH Desktop renderer origin `dsh-app://app` on write routes after
+  the loopback Host and socket checks. Without this explicit exception the
+  same-origin guard in 0.1.5 rejected every Desktop settings write (#28).
+
 ## 0.1.5 — 2026-10-22
 
 - Write routes now require an `Origin` or `Referer` whose host matches `Host`;

package/README.md

@@ -103,17 +103,17 @@ npm pack
 Install the published package:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 Or install the packed tarball into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 Restart dsh (or DSH Desktop), then pick **Ollama Cloud** in the model picker.
@@ -194,7 +194,7 @@ Open **Settings → Ollama Cloud**:
 - **Sidebar** — show or hide the quota card, and an optional plan label (for example `PRO`) shown next to the provider name.
 - **Plugin update** — current/latest version and **Update now**.
 
-The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host`, and are restricted to loopback (`127.0.0.1` / `::1`); a write without either source header is rejected with 403.
+The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host` (the Desktop renderer is identified by its `dsh-auth-*` cookie and desktop user agent when both headers are absent), and are restricted to loopback (`127.0.0.1` / `::1`); a write without any source identity is rejected with 403.
 
 ## Command
 

package/README.ru.md

@@ -103,17 +103,17 @@ npm pack
 Установка опубликованного пакета из npm:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 Либо установка из упакованного tarball:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **Ollama Cloud** в списке моделей.

package/README.zh.md

@@ -102,17 +102,17 @@ npm pack
 从 npm 安装已发布版本：
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH 桌面端：
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.5
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 或通过打包文件安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.5.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型列表中选择 **Ollama Cloud** 即可。

package/lib/index.js

@@ -51,7 +51,7 @@ const DEFAULT_API_BASE = "https://ollama.com";
 const DEFAULT_OPENAI_BASE = "https://ollama.com/v1";
 const DEFAULT_USAGE_URL = "https://ollama.com/api/usage";
 const DEFAULT_BALANCE_URL = "https://ollama.com/api/balance";
-const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.5";
+const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.7";
 const DEFAULT_CONTEXT_WINDOW = 131072;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 131072;
@@ -3668,6 +3668,16 @@ function sourceHost(value) {
 	}
 }
 /**
+* The Desktop renderer runs on `dsh-app://app`. Its host fetch has no Origin
+* or Referer, but it carries the signed host auth cookie and the desktop user
+* agent. Require both so a plain LAN client without either stays fail-closed.
+*/
+function desktopShellRequest(req) {
+	const agent = req.headers["user-agent"] ?? "";
+	const cookie = req.headers.cookie ?? "";
+	return agent.includes("@deepseek-ai/dsh-desktop/") && cookie.includes("dsh-auth-");
+}
+/**
 * Write routes must prove a same-origin browser context. A LAN bridge that
 * rewrites Host and socket to loopback would otherwise let any non-browser
 * client write keys and settings without an Origin. Fail closed when neither
@@ -3678,6 +3688,7 @@ function writeSourceError(req) {
 	if (host === void 0 || host === "") return "request host required";
 	const origin = req.headers.origin;
 	if (origin !== void 0 && origin !== "") return sourceHost(origin) === host ? void 0 : "cross-origin request refused";
+	if (desktopShellRequest(req)) return void 0;
 	const referer = req.headers.referer;
 	if (referer === void 0 || referer === "") return "request origin required";
 	return sourceHost(referer) === host ? void 0 : "cross-origin request refused";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-ollama-cloud-provider",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Ollama Cloud LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",