@goodandready/dsh-ollama-cloud-provider 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.7 — 2026-10-22
+
+- Identify the Desktop renderer by the signed host auth cookie plus the desktop
+  user agent when Origin and Referer are absent (the dsh-app protocol strips
+  both). Plain LAN clients without either still receive 403 (#28).
+
 ## 0.1.6 — 2026-10-22
 
 - Accept the DSH Desktop renderer origin `dsh-app://app` on write routes after

package/README.md

@@ -103,17 +103,17 @@ npm pack
 Install the published package:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 Or install the packed tarball into a profile:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 Restart dsh (or DSH Desktop), then pick **Ollama Cloud** in the model picker.
@@ -194,7 +194,7 @@ Open **Settings → Ollama Cloud**:
 - **Sidebar** — show or hide the quota card, and an optional plan label (for example `PRO`) shown next to the provider name.
 - **Plugin update** — current/latest version and **Update now**.
 
-The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host` (the Desktop renderer's `dsh-app://app` origin is accepted after loopback checks), and are restricted to loopback (`127.0.0.1` / `::1`); a write without either source header is rejected with 403.
+The Host serves `/dsh-ollama/state`, `/health`, `/analytics`, `/usage`, `/balance`, `/config`, `/key`, `/key/clear`, `/refresh`, `/models/refresh`, `/test` and `/update`. Writes require JSON, an `Origin` or `Referer` matching `Host` (the Desktop renderer is identified by its `dsh-auth-*` cookie and desktop user agent when both headers are absent), and are restricted to loopback (`127.0.0.1` / `::1`); a write without any source identity is rejected with 403.
 
 ## Command
 

package/README.ru.md

@@ -103,17 +103,17 @@ npm pack
 Установка опубликованного пакета из npm:
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH Desktop:
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 Либо установка из упакованного tarball:
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH Desktop:
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 После установки перезапустите dsh (или DSH Desktop) и выберите **Ollama Cloud** в списке моделей.

package/README.zh.md

@@ -102,17 +102,17 @@ npm pack
 从 npm 安装已发布版本：
 
 ```bash
-dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile web add @goodandready/dsh-ollama-cloud-provider@0.1.7
 # DSH 桌面端：
-dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.6
+dsh plugin --profile desktop add @goodandready/dsh-ollama-cloud-provider@0.1.7
 ```
 
 或通过打包文件安装：
 
 ```bash
-dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile web add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 # DSH 桌面端：
-dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.6.tgz
+dsh plugin --profile desktop add /absolute/path/to/goodandready-dsh-ollama-cloud-provider-0.1.7.tgz
 ```
 
 安装完成后重启 dsh 或 DSH 桌面端，在模型列表中选择 **Ollama Cloud** 即可。

package/lib/index.js

@@ -51,7 +51,7 @@ const DEFAULT_API_BASE = "https://ollama.com";
 const DEFAULT_OPENAI_BASE = "https://ollama.com/v1";
 const DEFAULT_USAGE_URL = "https://ollama.com/api/usage";
 const DEFAULT_BALANCE_URL = "https://ollama.com/api/balance";
-const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.6";
+const DEFAULT_USER_AGENT = "dsh-ollama-cloud-provider/0.1.7";
 const DEFAULT_CONTEXT_WINDOW = 131072;
 const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_GENERATE_MAX_TOKENS = 131072;
@@ -3668,11 +3668,15 @@ function sourceHost(value) {
 	}
 }
 /**
-* The Desktop renderer runs on `dsh-app://app`; its relative fetch reaches the
-* loopback host with that Origin. The request must still pass the loopback
-* Host check below and the loopback socket check in `requirePost`.
+* The Desktop renderer runs on `dsh-app://app`. Its host fetch has no Origin
+* or Referer, but it carries the signed host auth cookie and the desktop user
+* agent. Require both so a plain LAN client without either stays fail-closed.
 */
-const DESKTOP_ORIGIN = "dsh-app://app";
+function desktopShellRequest(req) {
+	const agent = req.headers["user-agent"] ?? "";
+	const cookie = req.headers.cookie ?? "";
+	return agent.includes("@deepseek-ai/dsh-desktop/") && cookie.includes("dsh-auth-");
+}
 /**
 * Write routes must prove a same-origin browser context. A LAN bridge that
 * rewrites Host and socket to loopback would otherwise let any non-browser
@@ -3683,10 +3687,8 @@ function writeSourceError(req) {
 	const host = req.headers.host;
 	if (host === void 0 || host === "") return "request host required";
 	const origin = req.headers.origin;
-	if (origin !== void 0 && origin !== "") {
-		if (origin === DESKTOP_ORIGIN) return void 0;
-		return sourceHost(origin) === host ? void 0 : "cross-origin request refused";
-	}
+	if (origin !== void 0 && origin !== "") return sourceHost(origin) === host ? void 0 : "cross-origin request refused";
+	if (desktopShellRequest(req)) return void 0;
 	const referer = req.headers.referer;
 	if (referer === void 0 || referer === "") return "request origin required";
 	return sourceHost(referer) === host ? void 0 : "cross-origin request refused";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-ollama-cloud-provider",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Ollama Cloud LLM provider plugin for DeepSeek Harness (dsh).",
   "license": "MIT",
   "type": "module",