@goodandready/dsh-voice 0.9.42 → 0.9.43

package/lib/http-util.js

@@ -102,11 +102,117 @@ export function readBody(req, maxBytes) {
 export function isLoopback(addr) {
   if (!addr) return false
   const clean = String(addr).replace(/^::ffff:/, '')
-  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost'
+  return clean === '127.0.0.1' || clean === '::1' || clean === 'localhost' || clean === '[::1]'
 }
 
 /**
- * Check whether a request originates from the same origin as the Host header (#292).
+ * Check whether an incoming HTTP request is from the DeepSeek desktop shell (#12, #295).
+ * Matches patterns from @deepseek-ai/dsh-desktop and official DSH shell wrappers.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isDesktopShellRequest(req) {
+  if (!req || !req.headers) return false
+  const ua = String(req.headers['user-agent'] || '')
+  const cookie = String(req.headers.cookie || '')
+  if (ua.includes('@deepseek-ai/dsh-desktop/') && cookie.includes('dsh-auth-')) return true
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (ua.includes('dsh-desktop') && isLoopback(remote)) return true
+  return false
+}
+
+/**
+ * Check whether an incoming HTTP request carries a DeepSeek Harness session cookie (#295).
+ * DSH core sets 'dsh-auth-<hash>=v1...' as a SameSite=Strict HttpOnly cookie.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function hasDshAuthCookie(req) {
+  if (!req || !req.headers) return false
+  const cookie = String(req.headers.cookie || '')
+  return cookie.includes('dsh-auth-')
+}
+
+/**
+ * Split host header or URL host into lowercase hostname and port string.
+ * @param {string} rawHost
+ * @returns {{ hostname: string, port: string }}
+ */
+function parseHost(rawHost) {
+  if (!rawHost) return { hostname: '', port: '' }
+  const clean = String(rawHost).trim().toLowerCase()
+  const ipv6Match = clean.match(/^\[([^\]]+)\](?::(\d+))?$/)
+  let hostname = ''
+  let port = ''
+  if (ipv6Match) {
+    hostname = ipv6Match[1]
+    port = ipv6Match[2] || ''
+  } else {
+    const parts = clean.split(':')
+    hostname = parts[0]
+    port = parts[1] || ''
+  }
+  if (port === '80' || port === '443') {
+    port = ''
+  }
+  return { hostname, port }
+}
+
+/**
+ * Verify whether an Origin or Referer URL is allowed for the given Host header (#12, #292, #295).
+ * @param {string} urlStr
+ * @param {string} hostHeader
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {boolean}
+ */
+export function isOriginOrRefererAllowed(urlStr, hostHeader, req) {
+  if (!urlStr || typeof urlStr !== 'string') return false
+  const trimmed = urlStr.trim()
+  if (!trimmed) return false
+
+  const remote = req?.socket?.remoteAddress || req?.connection?.remoteAddress || ''
+  const remoteIsLoopback = isLoopback(remote)
+
+  // 1. Literal 'null' origin (sent by Chromium/Electron for local files or sandboxed views)
+  if (trimmed === 'null') {
+    return remoteIsLoopback && (isDesktopShellRequest(req) || hasDshAuthCookie(req))
+  }
+
+  try {
+    const u = new URL(trimmed)
+
+    // 2. Official DeepSeek desktop custom app scheme (e.g. dsh-app://app or dsh-app://localhost)
+    if (u.protocol === 'dsh-app:') {
+      const appHost = u.host.toLowerCase()
+      const allowedAppHost = !appHost || appHost === 'app' || appHost === 'localhost'
+      return allowedAppHost && remoteIsLoopback
+    }
+
+    // 3. Web schemes: HTTP and HTTPS
+    if (u.protocol === 'http:' || u.protocol === 'https:') {
+      if (!hostHeader) return false
+      const target = parseHost(hostHeader)
+      const origin = parseHost(u.host)
+
+      // Exact match
+      if (origin.hostname === target.hostname && origin.port === target.port) {
+        return true
+      }
+
+      // Loopback equivalence (e.g. localhost:3080 vs 127.0.0.1:3080 or ::1:3080)
+      if (isLoopback(origin.hostname) && isLoopback(target.hostname) && origin.port === target.port) {
+        return true
+      }
+    }
+
+    return false
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Check whether a request originates from the same origin as the Host header or trusted desktop shell (#12, #292, #295).
  * @param {import('node:http').IncomingMessage} req
  * @returns {boolean}
  */
@@ -118,38 +224,33 @@ export function hasSameOrigin(req) {
   const host = String(req.headers.host || '').trim().toLowerCase()
   if (!host) return false
 
-  const origin = String(req.headers.origin || '').trim().toLowerCase()
+  const origin = String(req.headers.origin || '').trim()
   if (origin) {
-    try {
-      const u = new URL(origin)
-      return u.host.toLowerCase() === host
-    } catch {
-      return false
-    }
+    return isOriginOrRefererAllowed(origin, host, req)
   }
 
-  const referer = String(req.headers.referer || '').trim().toLowerCase()
+  const referer = String(req.headers.referer || '').trim()
   if (referer) {
-    try {
-      const u = new URL(referer)
-      return u.host.toLowerCase() === host
-    } catch {
-      return false
-    }
+    return isOriginOrRefererAllowed(referer, host, req)
   }
 
+  // Same-origin metadata from browser Fetch API
   if (secSite === 'same-origin') return true
 
+  // DeepSeek Desktop shell or authenticated DSH session on loopback/same-host
+  const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
+  if (isDesktopShellRequest(req)) return true
+  if (hasDshAuthCookie(req) && (isLoopback(remote) || host)) return true
+
   return false
 }
 
 /**
  * Verify that the HTTP request originates from a trusted caller.
- * Fail-closed security guard for state-changing or quota-consuming routes (#117, #173, #277, #292).
+ * Fail-closed security guard for state-changing or quota-consuming routes (#117, #173, #277, #292, #295).
  * - Routes marked loopbackOnly strictly reject non-loopback callers.
- * - Mutating requests (POST, PUT, PATCH) or WS upgrades require validated same-origin or valid session token (#292).
- *   Loopback callers without Origin/Referer through dsh-lanmode bridge are rejected without token.
- * - Non-loopback LAN requests require valid session token for mutating operations (#277).
+ * - Mutating requests (POST, PUT, PATCH) or WS upgrades require validated same-origin or valid session token (#12, #292, #295).
+ *   Raw LAN callers or reverse bridges without Origin/Referer/Cookie and without token are fail-closed rejected.
  * - Non-mutating GET requests require loopback or same-origin.
  * @param {import('node:http').IncomingMessage} req
  * @param {{ loopbackOnly?: boolean }} [options]
@@ -162,27 +263,18 @@ export function isTrustedCaller(req, options = {}) {
   const secSite = String(req.headers?.['sec-fetch-site'] || '').toLowerCase()
   if (secSite === 'cross-site' || secSite === 'same-site') return false
 
-  // 2. If Origin header is present, it must strictly match the Host header
   const host = String(req.headers?.host || '').toLowerCase()
-  const origin = String(req.headers?.origin || '').trim().toLowerCase()
+
+  // 2. If Origin header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const origin = String(req.headers?.origin || '').trim()
   if (origin) {
-    try {
-      const u = new URL(origin)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(origin, host, req)) return false
   }
 
-  // 3. If Referer header is present, it must strictly match the Host header
-  const referer = String(req.headers?.referer || '').trim().toLowerCase()
+  // 3. If Referer header is present, verify against host or trusted desktop scheme (#12, #292, #295)
+  const referer = String(req.headers?.referer || '').trim()
   if (referer) {
-    try {
-      const u = new URL(referer)
-      if (u.host !== host) return false
-    } catch {
-      return false
-    }
+    if (!isOriginOrRefererAllowed(referer, host, req)) return false
   }
 
   // 4. For state-changing or data-carrying requests (POST/PUT/PATCH), require application/json or octet-stream
@@ -200,7 +292,7 @@ export function isTrustedCaller(req, options = {}) {
   const remote = req.socket?.remoteAddress || req.connection?.remoteAddress || ''
   const remoteIsLoopback = isLoopback(remote)
   const hostName = host.replace(/:\d+$/, '')
-  const hostIsLoopback = hostName === '127.0.0.1' || hostName === 'localhost' || hostName === '::1' || hostName === '[::1]'
+  const hostIsLoopback = isLoopback(hostName)
   const isPureLocal = remoteIsLoopback && hostIsLoopback
 
   // 5. If route strictly requires loopback (e.g. host model installer or hardware benchmark)
@@ -212,6 +304,7 @@ export function isTrustedCaller(req, options = {}) {
   // 6. Mutating requests (POST/PUT/PATCH):
   // Even from loopback (which may be proxied via dsh-lanmode bridge), requests without Origin/Referer
   // must present a valid x-dsh-voice-token (#292).
+  // Non-loopback LAN callers strictly require a valid session token to prevent forged LAN mutations (#277).
   if (isMutating) {
     const incomingToken = String(req.headers?.['x-dsh-voice-token'] || req.headers?.['x-voice-token'] || '')
     const hasValidToken = Boolean(incomingToken && verifyVoiceSessionToken(incomingToken))
@@ -221,8 +314,8 @@ export function isTrustedCaller(req, options = {}) {
       return hasValidToken
     }
 
-    // Loopback callers (or reverse bridge dsh-lanmode):
-    // If request has verified same-origin (browser UI), allow it.
+    // Loopback callers (local browser, desktop shell, or reverse bridge dsh-lanmode):
+    // If request has verified same-origin or desktop shell, allow it (#12, #295).
     if (hasSameOrigin(req)) return true
     // If request has valid session token, allow it.
     if (hasValidToken) return true
@@ -233,7 +326,7 @@ export function isTrustedCaller(req, options = {}) {
   // 7. Loopback remote address for non-mutating GET requests
   if (remoteIsLoopback) return true
 
-  // 8. Non-loopback LAN GET requests: require same-origin
+  // 8. Non-loopback LAN GET requests: require same-origin or authenticated session
   if (secSite === 'same-origin') return true
   if (hasSameOrigin(req)) return true
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-voice",
-  "version": "0.9.42",
+  "version": "0.9.43",
   "description": "Voice input for DeepSeek Harness: dictation chunked by pauses and voice messages, each with its own provider fallback chain (Deepgram, Groq, HuggingFace, local whisper.cpp, plus any OpenAI-compatible API of your own).",
   "license": "MIT",
   "type": "module",