@iasiv5/dsh-skip-browser-auth 0.1.2 → 0.2.0

package/LICENSE

@@ -1,7 +1,6 @@
 MIT License
 
-Copyright (c) 2026 DeepSeek
-Copyright (c) 2026 iasi (@iasiv5/dsh-skip-browser-auth 适配与新增部分)
+Copyright (c) 2026 iasi
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -13,11 +12,6 @@ furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
-本插件包含或移植 DeepSeek Harness（@deepseek-ai/dsh-client-connection 等）的
-MIT 许可代码：lib/client.js 为官方发布产物的不可变 re-ID 副本，src/trust-fence.ts
-与 src/bridge.ts 移植自官方源码，src/index.ts、src/trusted-auth.ts 基于官方
-Connection 实现语义。上游版权与许可声明如上保留。
-
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

package/NOTICE

@@ -0,0 +1,40 @@
+Third-party notices
+===================
+
+This package includes or adapts MIT-licensed code from DeepSeek Harness
+(@deepseek-ai/dsh-client-connection and related packages, the "Upstream
+Code"):
+
+  - lib/client.js is an unmodified copy of the official published client
+    bundle, re-identified only by its registration id;
+  - src/trust-fence.ts and src/bridge.ts are ported from the official
+    source;
+  - src/index.ts and src/trusted-auth.ts follow the semantics of the
+    official Connection implementation.
+
+The Upstream Code is Copyright (c) 2026 DeepSeek. It is distributed in
+this package under the MIT License, whose full text follows and applies
+to the Upstream Code in its entirety.
+
+---
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,14 +1,18 @@
 # @iasiv5/dsh-skip-browser-auth
 
 [![npm](https://img.shields.io/npm/v/@iasiv5/dsh-skip-browser-auth?label=npm&color=cb3837)](https://www.npmjs.com/package/@iasiv5/dsh-skip-browser-auth)
-[![DSH Web](https://img.shields.io/badge/DSH_Web-0.1.2--rc.1_verified-blue)](#兼容版本)
+[![DSH Web](https://img.shields.io/badge/DSH_Web-0.1.2--rc.1_%7C_0.1.5--rc.1_verified-blue)](#兼容版本)
 [![License](https://img.shields.io/github/license/iasiv5/dsh-skip-browser-auth?color=green)](./LICENSE)
 
-个人自用的 DSH Web 插件：在 **DSH 0.1.2-rc.1** 上自动跳过 BrowserAuth——打开 Web 地址即可直接使用，**不必每次把启动 URL 里那串随机 token 抄进浏览器**。
+个人自用的 DSH Web 插件：在已验证的 DSH compatibility profile 上自动跳过 BrowserAuth，打开 Web 地址即可直接使用，**不必每次把启动 URL 里那串随机 token 抄进浏览器**。
 
-- **只在适配版本激活**：当前仅 `0.1.2-rc.1`。在 `0.1.1-rc.2` 及其它所有未测试版本上**自动休眠**，官方行为分毫不变。
+- **精确 profile 门控**：当前支持 `0.1.2-rc.1` 与 `0.1.5-rc.1`，但两者使用不同的 host/client 兼容代际；不是把两个版本塞进同一个实现。
+- **严格成对匹配**：runtime `@deepseek-ai/dsh` 与 `@deepseek-ai/dsh-client-connection` 必须组成已知版本对。混合版本、未知版本、profile 未实现或解析失败都会自动休眠。
+- **分代适配**：`0.1.2-rc.1` 使用 `legacy-web-v1`；`0.1.5-rc.1` 使用 `carrier-neutral-v2`，包含 request body mode、RPC carrier 和对应浏览器 client variant 适配。
 - **不修改 DSH 本体与任何机制**：仅通过 DSH 官方插件 patch 机制替换 Connection 行；卸载或禁用插件并重启，即完全恢复官方行为。
-- **提醒**：跳过认证后，Web 对本机/可信网络内的访问不再有身份层，请勿把 DSH 端口暴露给不可信网络。
+- **安全提醒**：跳过认证后，Web 对本机/可信网络内的访问不再有身份层，请勿把 DSH 端口暴露给不可信网络。
+
+> 0.1.5 的官方 Connection 在 carrier-neutral 重构后出现过 `connection.rpc.handle()` 返回 HTTP 405 的回归。本插件对 0.1.5 使用独立 adapter，并通过真实 npm fixture 覆盖 dedicated RPC 与 exact Fetch route；GitHub 审计与根因见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)。
 
 ## 安装
 
@@ -27,22 +31,23 @@ sudo systemctl restart deepseek-harness.service   # 按你的部署方式重启
 
 ### 复制给 agent 的安装提示词
 
-把下面整段贴给你机器上的 agent，它就能完成安装与验证：
-
 ```text
-请给我的 DSH Web 安装 @iasiv5/dsh-skip-browser-auth 插件（DSH 0.1.2-rc.1 专用：
-自动跳过 BrowserAuth，免每次在启动 URL 后输入随机 token；其它版本会自动休眠，
-不影响任何行为）。
+请给我的 DSH Web 安装 @iasiv5/dsh-skip-browser-auth 插件。
+它支持两个精确 compatibility profile：
+- DSH 0.1.2-rc.1：legacy-web-v1
+- DSH 0.1.5-rc.1：carrier-neutral-v2
+其它版本或 runtime/connection 混合版本会自动休眠，不要强行处理。
+
 1. 先执行 dsh --version 告诉我当前 DSH 版本，然后照常安装：
    dsh plugin --profile web add @iasiv5/dsh-skip-browser-auth
 2. 重启 DSH Web 并轮询 http://127.0.0.1:3080 直到恢复 200
    （systemd 系统级部署：sudo systemctl restart deepseek-harness.service；
    user 级部署：systemctl --user restart dsh-web.service；端口以实际部署为准）。
-3. 若版本是 0.1.2-rc.1：确认 journal/日志中出现固定警告
-   "BrowserAuth has been skipped"，且浏览器直接打开 Web 地址不再要求 token，
-   即激活成功。
-4. 若版本不是 0.1.2-rc.1：插件会自动休眠（官方行为不变），直接告诉我即可，
-   不要做任何强行处理。
+3. 若版本是 0.1.2-rc.1 或 0.1.5-rc.1：
+   确认 journal/日志中出现固定警告
+   "BrowserAuth has been skipped"，并验证浏览器直接打开 Web 地址不再要求 token。
+4. 若版本不是精确白名单版本，或 profile/依赖契约不匹配：插件应自动休眠，
+   保持官方行为，不要修改 DSH 本体或强行覆盖版本检测。
 ```
 
 ## 卸载
@@ -54,21 +59,63 @@ sudo systemctl restart deepseek-harness.service
 
 市场安装的用户在「插件市场 → 已装」里点卸载即可。卸载或禁用并重启后，官方 BrowserAuth 完全恢复。
 
-## 兼容版本
+## 兼容版本与 profile
+
+| DSH runtime / connection 版本对 | Profile | Host/client 适配 | 状态 |
+| --- | --- | --- | --- |
+| `0.1.2-rc.1` + `0.1.2-rc.1` | `legacy-web-v1` | legacy `/api` prefix + 0.1.2 client | ✅ active |
+| `0.1.5-rc.1` + `0.1.5-rc.1` | `carrier-neutral-v2` | carrier-neutral HostConnectionService + 0.1.5 client | ✅ active（代码/真实 npm fixture 已验证；真实部署仍需按清单确认） |
+| 其它版本或混合版本对 | — | 😴 自动休眠：官方行为分毫不变 | dormant |
+
+白名单匹配的是**完整版本对**，不是两个独立的 `includes()`：
+
+```text
+runtime=0.1.2-rc.1 + connection=0.1.5-rc.1 → dormant
+runtime=0.1.5-rc.1 + connection=0.1.5-rc.1 → carrier-neutral-v2
+```
+
+未来的新版本如果保持同一契约，可以加入对应 profile 的精确版本对；如果发生 API、DI、route、body 或 client bundle 契约变化，必须新增 profile、host adapter 和 client variant，不能 fallback 到旧代际。详细流程见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)。
+
+## 机制与安全
 
-| DSH 版本 | 状态 |
-| --- | --- |
-| `0.1.2-rc.1` | ✅ 激活：跳过 BrowserAuth（pnpm 与 npm 扁平安装布局均可识别） |
-| `0.1.1-rc.2` 及其它未测试版本 | 😴 自动休眠：官方行为分毫不变 |
+- 组合期版本探针使用 runtime 本体与官方 connection 包双锚点，并返回 profile id；路径段和 npm flat manifest 两种布局均支持。任何异常都 fail-closed 到 dormant。
+- `apply()` backstop 再读取两个 manifest，验证 active profile、patch 传入的 profile id、官方 connection sibling 行的 id/name/disabled/fiber 状态；不满足时在创建服务、注册 route、输出 warning 前 fail loud。
+- `legacy-web-v1` 保留 0.1.2 的 `/api` prefix 与 buffered bridge。
+- `carrier-neutral-v2` 使用 runtime loader 取得当前 0.1.5 connection module，支持 `requestBodyMode`、exact Fetch route 和 streaming body，并将 generic `connection.rpc.handle()` 绑定到拥有 Web carrier 的 replacement context，避免 0.1.5 的 405 回归。
+- client bundle 是显式 profile dispatcher：host 通过 `webserver/index-inject` 注入 profile id，0.1.2/0.1.5 使用各自官方 factory；profile 缺失或未知时不猜测、不加载错误 variant。
+- 激活时进程逐字输出固定警告：
 
-新版本经实测验证后逐个加入白名单；版本探测失败一律自动休眠（fail-closed）。
+```text
+@iasiv5/dsh-skip-browser-auth: BrowserAuth has been skipped. DSH Web is using the trusted-network behavior; this plugin does not verify any upstream proxy.
+```
+
+trusted-network mode 的判据只有一个：**请求来源是否通过信任栅栏**（Host/Origin/Fetch Metadata/trustedHosts）。能通过栅栏的请求一律被接受，不存在身份层，本插件也不校验任何上游反代。
+
+## 测试与验证
+
+```sh
+# 安装真实 rc.2 + rc.15 fixture，并运行 build/typecheck/全部 Node tests
+npm run test:all
+
+# 单独重建与加载 host
+rm -rf lib
+npm run build
+node --input-type=module -e "await import('./lib/host.js')"
+
+# 确认 patch 生成幂等
+npm run build
+git diff --exit-code cordis.patch.yml
+```
 
-## 机制与安全（简述）
+测试矩阵覆盖：
 
-- 组合期版本探针采用**双锚点**（宿主 runtime 本体 + 官方 connection 包）与**双分支**版本确认（pnpm 路径段 / manifest 读取，兼容两种安装布局），精确匹配白名单才激活；任何解析失败、版本漂移、结构漂移都保持休眠。
-- 激活后复用官方导出的 `HostConnectionService` 提供 trusted-network Connection：Host/Origin/trustedHosts 请求信任栅栏完整保留，仅移除身份层；激活时进程逐字输出固定警告 `@iasiv5/dsh-skip-browser-auth: BrowserAuth has been skipped. ...`。
-- 运行前 backstop 复核 manifest 白名单与行绑定状态，任何不满足即拒绝运行。
+- 两个完整 profile pair、混合版本、未知版本和 manifest/path drift
+- pnpm 路径段与 npm flat manifest fallback
+- legacy buffered bridge 与 carrier-neutral streaming bridge
+- 真实 0.1.5 dedicated `connection.rpc.handle()`、exact Fetch route 和 405 回归
+- 两个官方 client factory 的 materialization、profile dispatcher 和未知 profile fail-closed
+- rc.2 dormant 基线、dispose/unload、Host/Origin/Fetch Metadata trust fence
 
-详细设计、行为矩阵与实机验证记录见 [docs/DESIGN.md](./docs/DESIGN.md)。
+完整的 GitHub API 审计、profile 数据模型、adapter seam、client 变体和未来新增代际 checklist 见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)；机制详版见 [docs/DESIGN.md](./docs/DESIGN.md)。
 
-本插件包含或移植 DeepSeek Harness 的 MIT 许可代码，详见 [LICENSE](./LICENSE)。
+本插件以 [MIT License](./LICENSE) 发布；包含或移植的 DeepSeek Harness（MIT）代码，其版权与许可声明见 [NOTICE](./NOTICE)。

package/cordis.patch.yml

@@ -1,17 +1,18 @@
 # 本文件由 scripts/write-patch.mjs 从 lib/gate.js 常量机械生成，请勿手改。
 # 自门控 bundle patch：第一行把官方 connection 行的 disabled 绑定到版本探针
 # （双锚点：宿主 runtime 本体 @deepseek-ai/dsh 与官方 connection 包的 pnpm
-# 路径段版本必须同为 0.1.2-rc.1；runtime 锚点只可能来自 runtime fallback，
-# 不会被插件自身依赖污染）；第二行插入本插件的 trusted-connection 行，其
-# disabled 为行绑定表达式的否定（行绑定内嵌同一探针）。
+# runtime/connection 必须命中同一个 active compatibility profile；runtime 锚点
+# 只可能来自 runtime fallback，不会被插件自身依赖污染）；第二行插入本插件的
+# trusted-connection 行，其 config 携带 profile id，disabled 为行绑定表达式的否定。
 # 任何门控条件不成立（锚点解析失败、版本漂移、行不存在、名字漂移、
 # 官方行未禁用），Replacement 一律保持 dormant（fail-closed）。探针为假时，
 # 即使后续 patch 层把官方行强制 disabled，行绑定内嵌探针仍保持 dormant。
 - id: connection
   name: '@deepseek-ai/dsh-client-connection'
   disabled: !!js >-
-    (() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return false; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof
-    manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return false; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return false; } if (anchorVersion !== '0.1.2-rc.1') return false; } return true; } catch (gateError) { return false; } })()
+    (() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof
+    manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"}]}]; for (const profile of profiles)
+    { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2"].includes(profile); } catch (gateError) { return false; } })()
 - insert:
     - id: trusted-connection
       name: '@iasiv5/dsh-skip-browser-auth'
@@ -19,7 +20,11 @@
         - webRuntime
       config:
         trustedHosts: !!js ctx.webRuntime.trustedHosts
+        compatibilityProfile: !!js >-
+          (() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof
+          manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"}]}]; for (const profile of profiles) { if
+          (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()
       disabled: !!js >-
-        !((() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '@deepseek-ai/dsh-client-connection') return false; const probeAllowed = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return false; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule =
-        processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return false; } let anchorVersion; try { anchorVersion = versionOfUrl(url,
-        patternSource); } catch (gateError) { return false; } if (anchorVersion !== '0.1.2-rc.1') return false; } return true; } catch (gateError) { return false; } })()); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })())
+        !((() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '@deepseek-ai/dsh-client-connection') return false; const probeAllowed = ((() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function')
+        return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let
+        anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2"].includes(profile); } catch (gateError) { return false; } })()); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })())

package/lib/adapters/carrier-neutral.js

@@ -0,0 +1,23 @@
+import { createHostRuntime } from './types.js';
+/** Host implementation for the 0.1.5 carrier-neutral connection contract. */
+export const HOST_ADAPTER_ID = 'carrier-neutral';
+export function createCarrierNeutralRuntime(input) {
+    const runtime = createHostRuntime(input, HOST_ADAPTER_ID);
+    if (typeof runtime.fetchHandler.requestBodyMode !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral profile requires a requestBodyMode-aware connection handler');
+    }
+    // 0.1.5's carrier-neutral service keeps generic rpc.handle() registrations
+    // on the reading context, which is often a sibling plugin without webServer.
+    // Bind only this replacement instance to the adapter's carrier context. This
+    // is the narrow equivalent of the upstream workaround and leaves fetch
+    // registry ownership untouched.
+    const service = runtime.connection;
+    const originalRegister = service.register;
+    if (typeof originalRegister !== 'function') {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: carrier-neutral connection lacks its RPC register seam');
+    }
+    service.register = function registerWithCarrier(_owner, channel, handler) {
+        return originalRegister.call(this, input.ctx, channel, handler);
+    };
+    return runtime;
+}

package/lib/adapters/legacy-web.js

@@ -0,0 +1,6 @@
+import { createHostRuntime } from './types.js';
+/** Host implementation for the 0.1.2-rc.1 web-carrier contract. */
+export const HOST_ADAPTER_ID = 'legacy-web';
+export function createLegacyWebRuntime(input) {
+    return createHostRuntime(input, HOST_ADAPTER_ID);
+}

package/lib/adapters/types.js

@@ -0,0 +1,20 @@
+import { bridge } from '../bridge.js';
+/** Construct the common trusted /api carrier route for one compatibility adapter. */
+export function createHostRuntime(input, adapterId) {
+    const connection = new input.module.HostConnectionService(input.ctx, input.trustedHosts, input.auth);
+    const fetchHandler = connection.createSharedFetchHandler(input.module.API_PATH);
+    const route = {
+        kind: 'prefix',
+        path: input.module.API_PATH,
+        handler: async (req, res) => {
+            const rejection = connection.requestRejection(req);
+            if (rejection !== undefined) {
+                res.writeHead(rejection);
+                res.end(rejection === 401 ? 'unauthorized' : 'forbidden');
+                return;
+            }
+            await bridge(req, res, fetchHandler, input.maxRequestBodyBytes);
+        },
+    };
+    return { connection, route, fetchHandler, adapterId };
+}

package/lib/bridge.js

@@ -4,6 +4,7 @@
  *
  * 移植自官方 packages/client/connection/src/http-bridge.ts（rc.1），语义照抄。
  */
+import { Readable } from 'node:stream';
 /** Default carrier cap for all HTTP RPC bodies: sized for the default
  * aggregate image limit (200 MiB) after base64 expansion plus envelope
  * headroom (~267.7 MiB required), rounded up for slack. The bridge buffers
@@ -28,38 +29,60 @@ export async function bridge(req, res, apiHandler, maxRequestBodyBytes = DEFAULT
         if (!res.writableEnded)
             abort.abort();
     });
-    const declaredLength = req.headers['content-length'];
-    if (declaredLength !== undefined && Number(declaredLength) > maxRequestBodyBytes) {
-        res.writeHead(413, { connection: 'close' });
-        res.end();
-        req.destroy();
-        return;
-    }
-    const chunks = [];
-    let received = 0;
-    for await (const chunk of req) {
-        const buffer = chunk;
-        received += buffer.byteLength;
-        if (received > maxRequestBodyBytes) {
+    /* v8 ignore next 3 -- `??` arms: node:http always sets url/method on server
+    requests; the fields are only optional on the client-side IncomingMessage type */
+    const url = new URL(req.url ?? '/', 'http://dsh.internal');
+    const method = req.method ?? 'GET';
+    const headers = Object.fromEntries(Object.entries(req.headers).filter(([, value]) => typeof value === 'string'));
+    const bodyMode = apiHandler.requestBodyMode?.({ method, url }) ?? 'buffered';
+    let request;
+    if (bodyMode === 'buffered') {
+        const declaredLength = req.headers['content-length'];
+        if (declaredLength !== undefined && Number(declaredLength) > maxRequestBodyBytes) {
             res.writeHead(413, { connection: 'close' });
             res.end();
             req.destroy();
             return;
         }
-        chunks.push(buffer);
+        const chunks = [];
+        let received = 0;
+        for await (const chunk of req) {
+            const buffer = chunk;
+            received += buffer.byteLength;
+            if (received > maxRequestBodyBytes) {
+                res.writeHead(413, { connection: 'close' });
+                res.end();
+                req.destroy();
+                return;
+            }
+            chunks.push(buffer);
+        }
+        request = new Request(url, {
+            method,
+            headers,
+            ...chunks.length > 0 ? { body: Buffer.concat(chunks) } : {},
+            signal: abort.signal,
+        });
+    }
+    else {
+        request = new Request(url, {
+            method,
+            headers,
+            body: Readable.toWeb(req),
+            signal: abort.signal,
+            duplex: 'half',
+        });
     }
-    /* v8 ignore next 3 -- `??` arms: node:http always sets url/method on server
-    requests; the fields are only optional on the client-side IncomingMessage type */
-    const request = new Request(new URL(req.url ?? '/', 'http://dsh.internal'), {
-        method: req.method ?? 'GET',
-        headers: Object.fromEntries(Object.entries(req.headers).filter(([, v]) => typeof v === 'string')),
-        ...chunks.length > 0 ? { body: Buffer.concat(chunks) } : {},
-        signal: abort.signal,
-    });
     const response = await apiHandler.fetch(request);
-    res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+    const requestUnread = bodyMode === 'streaming' && !req.readableEnded;
+    const responseHeaders = Object.fromEntries(response.headers.entries());
+    res.writeHead(response.status, requestUnread
+        ? { ...responseHeaders, connection: 'close' }
+        : responseHeaders);
     if (response.body === null) {
         res.end();
+        if (requestUnread)
+            req.destroy();
         return;
     }
     for await (const chunk of response.body) {
@@ -80,4 +103,6 @@ export async function bridge(req, res, apiHandler, maxRequestBodyBytes = DEFAULT
         }
     }
     res.end();
+    if (requestUnread)
+        req.destroy();
 }