@iasiv5/dsh-skip-browser-auth 0.1.0

package/lib/gate.js

@@ -0,0 +1,25 @@
+/**
+ * 版本探针与行绑定表达式的单一事实源（组合期激活判据）。
+ *
+ * 两个表达式都跑在 Loader 的 `!!js` 求值环境里（`with (ctx) + eval`，
+ * 见 vendor/loader/src/config/utils.ts），失败一律落入 dormant（fail-closed）。
+ * sibling 解析走 Symbol.for('cordis.entry') 当前 entry 所属子树，
+ * 不依赖根 Loader 的 resolve——业务行位于 Include 子树，根上看不到。
+ */
+export const CONNECTION_PACKAGE = '@deepseek-ai/dsh-client-connection';
+export const GATE_VERSION = '0.1.2-rc.1';
+// 版本探针：单行；生成 cordis.patch.yml 官方行 disabled（scripts/write-patch.mjs）。
+export const GATE_PROBE_EXPRESSION = `(() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return false; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier: '${CONNECTION_PACKAGE}/package.json', attributes: {} }).url : internal.resolveSync('${CONNECTION_PACKAGE}/package.json', ctx.baseUrl, {}).url; } catch (gateError) { return false; } if (typeof url !== 'string') return false; const match = decodeURIComponent(url).match(/[+]dsh-client-connection@([^/_]+)[_/]/); return match !== null && match[1] === '${GATE_VERSION}'; } catch (gateError) { return false; } })()`;
+// 行绑定放行：自身探针为真 + 同组 sibling 存在且名字匹配且其 effective disabled 为真。
+// sibling 必须从当前 entry（Symbol.for('cordis.entry')）所属子树解析，
+// 根 Loader 的 resolve 看不到 Include 子树内的行。
+export const GATE_ROW_ALLOWED_EXPRESSION = `(() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '${CONNECTION_PACKAGE}') return false; const probeAllowed = (${GATE_PROBE_EXPRESSION}); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })()`;
+/**
+ * Evaluate the activation probe against a loader context scope.
+ * @param ctx - the `!!js` evaluation scope (same object the Loader passes).
+ * @returns true only when the resolved connection package is exactly the whitelisted version.
+ */
+export function evaluateGate(ctx) {
+    // 与 vendor/loader/src/config/utils.ts 的 evaluate 同语义：with(ctx) + eval。
+    return new Function('ctx', 'expr', 'with (ctx) { return eval(expr) }')(ctx, GATE_PROBE_EXPRESSION);
+}

package/lib/host.js

@@ -0,0 +1,129 @@
+/**
+ * @iasiv5/dsh-skip-browser-auth host half：trusted-network Connection Replacement。
+ *
+ * 复用官方导出的 HostConnectionService（对认证的全部依赖只有
+ * isAuthenticated / authorizeIndex / authenticatedUrl 三个方法，由
+ * trusted-auth 的 stub 提供），复刻官方 apply 的 /api 前缀路由、
+ * 请求体上限与 image capacity 断言语义，并在启动时输出固定警告。
+ * apply 内 backstop 是最后防线：版本白名单（读官方 manifest）与
+ * 门控绑定状态（同组官方行确被禁用且无活跃 fiber）任一不满足即
+ * fail loud 拒绝运行。
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import z from '@deepseek-ai/schemastery';
+import { HostConnectionService, API_PATH } from '@deepseek-ai/dsh-client-connection';
+import { assertTrustedAuthority } from './trust-fence.js';
+import { createTrustedAuth } from './trusted-auth.js';
+import { bridge, DEFAULT_MAX_REQUEST_BODY_BYTES } from './bridge.js';
+import { CONNECTION_PACKAGE, GATE_VERSION } from './gate.js';
+/** Stable Cordis plugin name. */
+export const name = '@iasiv5/dsh-skip-browser-auth';
+/** Services required before providing the replacement Connection. */
+export const inject = ['webServer'];
+/** 启动警告固定文案（全局约束：Replacement 激活时逐字输出）。 */
+const SKIP_WARNING = '@iasiv5/dsh-skip-browser-auth: BrowserAuth has been skipped. DSH Web is using the trusted-network behavior; this plugin does not verify any upstream proxy.';
+/** Headroom for RPC JSON fields around aggregate base64 image payloads. */
+const REQUEST_ENVELOPE_HEADROOM_BYTES = 1024 * 1024;
+function assertImageBodyCapacity(ctx, maxRequestBodyBytes) {
+    const attachments = ctx.get('attachments');
+    if (attachments === undefined)
+        return;
+    const requiredImageBodyBytes = Math.ceil(attachments.imageLimits.maxMessageImageBytes * 4 / 3) + REQUEST_ENVELOPE_HEADROOM_BYTES;
+    if (maxRequestBodyBytes < requiredImageBodyBytes) {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth maxRequestBodyBytes (${String(maxRequestBodyBytes)}) must be at least `
+            + `${String(requiredImageBodyBytes)} for the configured aggregate image limit`);
+    }
+}
+/**
+ * apply 内 backstop（最后防线，fail loud）：版本白名单断言读取官方 manifest
+ * 本体（组合期探针只读 pnpm 路径段，会被「路径真、manifest 假」的漂移骗过）；
+ * 绑定断言确认当前 entry 子树内的官方 connection 行确实被本插件禁用、
+ * 同组同名且无活跃 fiber。
+ *
+ * 跳过 seam 仅限「完全没有 Loader、也没有 Loader entry」的直接单元测试调用；
+ * 产品组合中 loader / internal / current 任一缺失都意味着最后防线无法执行，
+ * 必须在创建 Connection 服务与注册 /api 之前 fail loud——否则后续 patch 层
+ * 强制启用或组合回归把 Replacement 误送进 apply 时将无人拦截。
+ */
+function assertGateBackstop(ctx) {
+    const loader = ctx.get('loader');
+    const current = ctx.fiber?.entry;
+    if (loader === undefined && current === undefined)
+        return;
+    if (loader === undefined) {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: gate backstop unavailable: loader service is missing');
+    }
+    if (loader.internal === undefined) {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: gate backstop unavailable: loader internal resolver is missing');
+    }
+    if (current === undefined) {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: gate backstop unavailable: current loader entry is missing');
+    }
+    // (a) 版本断言：与官方 row 同一解析锚点（loader.internal），读 manifest 比对白名单。
+    const baseUrl = ctx.baseUrl ?? '';
+    const specifier = `${CONNECTION_PACKAGE}/package.json`;
+    const internal = loader.internal;
+    const resolved = internal.version === 'v2'
+        ? internal.resolveSync(baseUrl, { specifier, attributes: {} })
+        : internal.resolveSync(specifier, baseUrl, {});
+    const manifest = JSON.parse(readFileSync(fileURLToPath(resolved?.url), 'utf8'));
+    if (manifest.version !== GATE_VERSION) {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: official connection manifest is ${String(manifest.version)}, whitelist is ['0.1.2-rc.1']; disable or uninstall the plugin`);
+    }
+    // (b) 绑定断言：官方行被禁用是 Replacement 放行的前提，且不得有活跃 fiber。
+    const official = current.parent.tree.resolve('connection');
+    if (official.parent !== current.parent
+        || official.options?.id !== 'connection'
+        || official.options?.name !== CONNECTION_PACKAGE
+        || official.disabled !== true
+        || official.fiber !== undefined) {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: gate binding violated; refusing to run');
+    }
+}
+export const Config = z.object({
+    trustedHosts: z.array(String).default([]),
+    maxRequestBodyBytes: z.natural().min(1).default(DEFAULT_MAX_REQUEST_BODY_BYTES),
+});
+/**
+ * Mounts the trusted-network Connection replacement under the browser
+ * transport prefix. Every request on the prefix passes the Host/Origin
+ * browser-trust fence; no identity layer exists beyond it.
+ * @param ctx - Host plugin context.
+ * @param config - resolved plugin config (schema defaults applied).
+ */
+export async function apply(ctx, config) {
+    // The Loader resolves schema defaults; hand-built test contexts may pass none.
+    const trustedHosts = config?.trustedHosts ?? [];
+    const maxRequestBodyBytes = config?.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES;
+    // Config boundary: a malformed entry fails the load loudly here rather than
+    // silently authorizing its hostname prefix at request time.
+    for (const entry of trustedHosts)
+        assertTrustedAuthority(entry);
+    assertImageBodyCapacity(ctx, maxRequestBodyBytes);
+    assertGateBackstop(ctx);
+    // 官方未导出 BrowserAuth 类型，用构造器参数位取回；stub 只需满足
+    // HostConnectionService 实际消费的三个方法。
+    const auth = createTrustedAuth(trustedHosts);
+    const connection = new HostConnectionService(ctx, trustedHosts, auth);
+    const fetchHandler = connection.createSharedFetchHandler(API_PATH);
+    const route = {
+        kind: 'prefix',
+        path: API_PATH,
+        handler: async (req, res) => {
+            const rejection = connection.requestRejection(req);
+            if (rejection !== undefined) {
+                res.writeHead(rejection);
+                res.end(rejection === 401 ? 'unauthorized' : 'forbidden');
+                return;
+            }
+            await bridge(req, res, fetchHandler, maxRequestBodyBytes);
+        },
+    };
+    ctx.effect(() => ctx.webServer.register(route), '@iasiv5/dsh-skip-browser-auth: /api route');
+    ctx.inject(['attachments'], (attachmentCtx) => {
+        assertImageBodyCapacity(attachmentCtx, maxRequestBodyBytes);
+    });
+    // 固定文案启动警告（全局约束）：Replacement 已激活、无上游代理校验。
+    console.warn(SKIP_WARNING);
+}

package/lib/trust-fence.js

@@ -0,0 +1,135 @@
+/**
+ * Browser-trust fence for every /api request. Defends the two confused-deputy
+ * paths a browser opens against a local HTTP API — DNS rebinding (Host names
+ * the attacker's domain while the socket reaches this server) and cross-site
+ * requests fired from a malicious page. The Host fence binds every request,
+ * browser-looking or not: over plain HTTP a browser attaches neither Origin
+ * nor Fetch-Metadata to reads (images and navigations — those
+ * headers go only to trustworthy destinations), so an unmarked request may
+ * still be a rebound browser read and Host is the one header rebinding cannot
+ * forge. Non-browser and remote clients pass the same fence via loopback,
+ * deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
+ * Network reachability and authentication stay out of scope: binding policy
+ * belongs to the webserver config, and this fence is not an auth layer.
+ *
+ * 移植自官方 packages/client/connection/src/api-request-trust.ts（rc.1），
+ * 语义照抄；isLoopbackHostname 与 ConnectionTrustRequest 类型就地局部化。
+ */
+/**
+ * Whether a normalized URL hostname names the local loopback authority.
+ * @param hostname - WHATWG URL hostname (IPv6 literals retain brackets).
+ * @returns true for localhost, IPv6 loopback, or any IPv4 address in 127/8.
+ */
+function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '[::1]')
+        return true;
+    const parts = hostname.split('.');
+    return parts.length === 4
+        && parts[0] === '127'
+        && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+function header(headers, name) {
+    if (headers instanceof Headers)
+        return headers.get(name) ?? undefined;
+    const value = headers[name];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Normalized URL of a Host-header authority (hostname lowercased, default port stripped, IPv6 bracketed), or undefined when unparsable. */
+function parseAuthority(authority) {
+    try {
+        // http: is a WHATWG "special scheme": parsing yields a non-empty hostname or throws.
+        return new URL(`http://${authority}`);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Assert one configured `trustedHosts` entry is a bare authority (`host` or
+ * `host:port`) in canonical form: it must survive WHATWG parsing unchanged
+ * (case aside). Anything parsing would silently rewrite is refused as a typo
+ * that must fail the load loudly instead of being ignored until requests 403
+ * or quietly changing the grant: URL parts beyond the authority
+ * (`harness.internal/path`, `user@harness.internal` — which would authorize
+ * the embedded hostname), stripped whitespace, a dangling colon or
+ * zero-padded port (which would broaden an intended exact-port grant to every
+ * port), and non-canonical host spellings (`0x7f.0.0.1`, percent-encoding,
+ * unbracketed IPv6; IDN hosts are declared in punycode, the form the wire
+ * carries).
+ * @param entry - the configured value, verbatim.
+ */
+export function assertTrustedAuthority(entry) {
+    const entryUrl = parseAuthority(entry);
+    if (entryUrl !== undefined && canonicalAuthority(entry, entryUrl) === entry.toLowerCase())
+        return;
+    throw new Error(`@iasiv5/dsh-skip-browser-auth: trustedHosts entry ${JSON.stringify(entry)} is not a bare host[:port] authority`);
+}
+/**
+ * Canonical form of a parsed authority: `hostname` when no port was written,
+ * else `hostname:port`. The port is judged from URL parses under both special
+ * schemes (their default ports differ, so `:80` and `:443` still count as
+ * explicit), never from the raw string, where WHATWG trimming would misread
+ * shapes like `host:port ` as port-less.
+ */
+function canonicalAuthority(entry, entryUrl) {
+    // An authority that parsed under http cannot fail under https.
+    const port = entryUrl.port !== '' ? entryUrl.port : new URL(`https://${entry}`).port;
+    return port === '' ? entryUrl.hostname : `${entryUrl.hostname}:${port}`;
+}
+/**
+ * Whether the request authority matches a `trustedHosts` entry. An entry with
+ * an explicit port matches that exact authority; a port-less entry matches the
+ * hostname on any port (the shape the CLI derives for IP-literal LAN serving,
+ * where the bound port may be OS-assigned). Both sides compare through WHATWG
+ * normalization, so case and a redundant `:80` never decide trust.
+ */
+function isTrustedAuthority(hostUrl, trustedHosts) {
+    return trustedHosts.some((entry) => {
+        const entryUrl = parseAuthority(entry);
+        if (entryUrl === undefined)
+            return false;
+        return canonicalAuthority(entry, entryUrl) === entryUrl.hostname
+            ? entryUrl.hostname === hostUrl.hostname
+            : entryUrl.host === hostUrl.host;
+    });
+}
+/**
+ * Decide whether one /api request may reach the RPC bridge.
+ * @param request - Node HTTP or Fetch request facts (headers).
+ * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
+ * @returns true when the Host is ours (loopback or trusted) and any attached browser markers are same-origin.
+ */
+export function isTrustedApiRequest(request, trustedHosts) {
+    // Host fence (DNS-rebinding defense), applied to every request: the browser
+    // fills Host from the URL it believes it is talking to, so a rebound page
+    // carries the attacker's domain here even though the socket lands on this
+    // server. There is no marker shortcut — a browser read over plain HTTP
+    // (images and navigations) arrives with neither Origin nor
+    // Fetch-Metadata, indistinguishable from curl, and its response is readable
+    // by the rebound page.
+    const host = header(request.headers, 'host');
+    if (host === undefined)
+        return false;
+    const hostUrl = parseAuthority(host);
+    if (hostUrl === undefined)
+        return false;
+    if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts))
+        return false;
+    // Cross-site fence: modern browsers label the initiator relationship on
+    // every fetch; an explicit cross-site marker is refused regardless of Origin.
+    if (header(request.headers, 'sec-fetch-site') === 'cross-site')
+        return false;
+    // Origin fence: when a browser attaches an Origin it must be exactly this
+    // authority (compared through the same normalization as the Host). Absent
+    // Origin is fine — the Host fence above already bound the request. The
+    // literal "null" (sandboxed iframes, file: pages) is an opaque origin, refused.
+    const origin = header(request.headers, 'origin');
+    if (origin === undefined)
+        return true;
+    try {
+        return new URL(origin).host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}

package/lib/trusted-auth.js

@@ -0,0 +1,57 @@
+/**
+ * Trusted-network replacement for the official BrowserAuth stub.
+ *
+ * 官方 HostConnectionService 对认证的全部依赖只有三个方法：
+ * isAuthenticated / authorizeIndex / authenticatedUrl。本模块以
+ * trusted-network 语义提供三方法 stub：请求信任栅栏（Host/Origin/
+ * Fetch Metadata/trustedHosts）承担全部访问判定，身份层不存在。
+ * 首页 fence 与 /api fence 消费同一个 trustedHosts 列表。
+ */
+import { isTrustedApiRequest } from './trust-fence.js';
+const TOKEN_QUERY = 'token';
+/**
+ * Create the three-method stub consumed by the official HostConnectionService.
+ * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
+ * @returns authentication owner with trusted-network semantics for all three methods.
+ */
+export function createTrustedAuth(trustedHosts) {
+    return {
+        // 请求已通过 /api 侧的 requestRejection 信任栅栏；此处恒真，
+        // 使官方 service 不再叠加 401 身份层。
+        isAuthenticated(_request) {
+            return true;
+        },
+        // 首页请求先过与 /api 相同的信任栅栏（不可信 → 403）；
+        // 可信的 GET / 带 token 时以 303 清理 URL（无身份层，无需交换 cookie），
+        // 其余可信请求直接放行交付 index.html。
+        authorizeIndex(req, res) {
+            if (!isTrustedApiRequest(req, trustedHosts)) {
+                res.writeHead(403, {
+                    'cache-control': 'no-store',
+                    'content-type': 'text/plain; charset=utf-8',
+                });
+                res.end(req.method === 'HEAD' ? undefined : 'forbidden\n');
+                return false;
+            }
+            const url = new URL(req.url ?? '/', 'http://dsh.invalid');
+            if (url.searchParams.has(TOKEN_QUERY) && req.method === 'GET' && url.pathname === '/') {
+                res.writeHead(303, {
+                    'cache-control': 'no-store',
+                    'location': '/',
+                    'referrer-policy': 'no-referrer',
+                });
+                res.end();
+                return false;
+            }
+            return true;
+        },
+        // 无身份层：返回干净的应用根 URL，不附加任何 token。
+        authenticatedUrl(baseUrl) {
+            const url = new URL(baseUrl);
+            url.pathname = '/';
+            url.search = '';
+            url.hash = '';
+            return url.href;
+        },
+    };
+}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@iasiv5/dsh-skip-browser-auth",
+  "version": "0.1.0",
+  "description": "个人自用：在 DSH 0.1.2-rc.1 上跳过 BrowserAuth 的 trusted-network Connection 替换插件",
+  "license": "MIT",
+  "type": "module",
+  "main": "lib/host.js",
+  "exports": {
+    ".": "./lib/host.js",
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node --test tests/*.test.mjs tests/composition/*.test.mjs",
+    "test:rc2-fixture": "node scripts/install-rc2-fixture.mjs",
+    "test:all": "npm run test:rc2-fixture && npm run build && npm run typecheck && npm test",
+    "prepare": "npm run build"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [],
+      "immediately": true
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "*",
+    "@deepseek-ai/schemastery": "*"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis-plugin-include": "1.0.7",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.3",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-frontend-static": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@types/node": "^24.0.0",
+    "js-yaml": "^4.2.0",
+    "typescript": "^5.6.0"
+  }
+}