@iasiv5/dsh-skip-browser-auth 0.1.3 → 0.2.0

package/lib/compatibility.js

@@ -0,0 +1,53 @@
+/**
+ * Compatibility generations for the DSH BrowserAuth replacement.
+ *
+ * A profile is the unit of compatibility: a complete runtime/connection
+ * version pair plus the host/client implementation generation that knows how
+ * to serve it. Do not replace this table with independent version `includes`
+ * checks: a runtime from one generation and a connection package from another
+ * generation must never activate together.
+ */
+export const COMPATIBILITY_PROFILES = [
+    {
+        id: 'legacy-web-v1',
+        pairs: [{ runtime: '0.1.2-rc.1', connection: '0.1.2-rc.1' }],
+        hostAdapter: 'legacy-web',
+        clientVariant: 'rc12',
+        requiresRecoveryGlobal: false,
+        status: 'active',
+    },
+    {
+        id: 'carrier-neutral-v2',
+        pairs: [{ runtime: '0.1.5-rc.1', connection: '0.1.5-rc.1' }],
+        hostAdapter: 'carrier-neutral',
+        clientVariant: 'rc15',
+        requiresRecoveryGlobal: true,
+        // Promoted after the carrier-neutral host/client adapter and fixture path
+        // are implemented; real deployment validation remains documented separately.
+        status: 'active',
+    },
+];
+/** All exact versions represented by profiles, for diagnostics and fixtures. */
+export const GATE_VERSIONS = [...new Set(COMPATIBILITY_PROFILES.flatMap((profile) => profile.pairs.flatMap((pair) => [pair.runtime, pair.connection])))];
+/** Backward-compatible internal alias for the original 0.1.2 build/test pin. */
+export const GATE_VERSION = GATE_VERSIONS[0];
+/** Profile ids whose host/client implementations are currently safe to activate. */
+export const ACTIVE_COMPATIBILITY_PROFILE_IDS = COMPATIBILITY_PROFILES
+    .filter((profile) => profile.status === 'active')
+    .map((profile) => profile.id);
+/** Resolve a complete runtime/connection pair, including candidate profiles. */
+export function resolveCompatibilityProfile(runtimeVersion, connectionVersion) {
+    if (typeof runtimeVersion !== 'string' || typeof connectionVersion !== 'string')
+        return undefined;
+    return COMPATIBILITY_PROFILES.find((profile) => profile.pairs.some((pair) => pair.runtime === runtimeVersion && pair.connection === connectionVersion));
+}
+/** Resolve only a profile whose implementation is promoted to active. */
+export function resolveActiveCompatibilityProfile(runtimeVersion, connectionVersion) {
+    const profile = resolveCompatibilityProfile(runtimeVersion, connectionVersion);
+    return profile?.status === 'active' ? profile : undefined;
+}
+export function isActiveCompatibilityProfileId(value) {
+    return typeof value === 'string' && ACTIVE_COMPATIBILITY_PROFILE_IDS.includes(value);
+}
+/** Small JSON-safe table embedded into the Loader `!!js` expression. */
+export const GATE_PROFILE_TABLE = COMPATIBILITY_PROFILES.map(({ id, pairs }) => ({ id, pairs }));

package/lib/connection-runtime.js

@@ -0,0 +1,52 @@
+/** Runtime connection module loader used by compatibility adapters. */
+import { API_PATH as PINNED_API_PATH, HostConnectionService as PinnedHostConnectionService } from '@deepseek-ai/dsh-client-connection';
+import { CONNECTION_PACKAGE } from './gate.js';
+function isRuntimeConnectionModule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const candidate = value;
+    return typeof candidate.HostConnectionService === 'function'
+        && typeof candidate.API_PATH === 'string';
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Resolve the connection module from the active product loader.
+ *
+ * 产品组合必须消费宿主自己的 connection module 实例：有 loader 服务时
+ * internal.import 缺失或调用失败都 fail loud——绝不静默回退到插件自带的
+ * pinned dev 副本（那会重演 2026-09-05「探针自我满足」一类代际错配）。
+ * pinned 副本只允许出现在完全没有 loader 服务的直接单元测试上下文。
+ */
+export async function loadRuntimeConnectionModule(ctx) {
+    const loader = ctx.get('loader');
+    if (loader !== undefined) {
+        const importer = loader.internal?.import;
+        if (typeof importer !== 'function') {
+            throw new Error('@iasiv5/dsh-skip-browser-auth: product loader is present but loader.internal.import is unavailable; refusing to fall back to the pinned dev copy');
+        }
+        const baseUrl = ctx.baseUrl;
+        if (typeof baseUrl !== 'string' || baseUrl === '') {
+            throw new Error('@iasiv5/dsh-skip-browser-auth: loader.internal.import requires the plugin context baseUrl (profile directory URL); refusing to import without it');
+        }
+        let loaded;
+        try {
+            // 必须以 loader.internal 为接收者调用（bound call）。把方法摘下来
+            // detached 调用会丢失 this，Node 内部 ESM loader 在 getOrCreateModuleJob
+            // 前即抛 "Cannot read properties of undefined"（2026-09-10 崩溃循环根因）。
+            loaded = await importer.call(loader.internal, CONNECTION_PACKAGE, baseUrl, {});
+        }
+        catch (error) {
+            throw new Error(`@iasiv5/dsh-skip-browser-auth: failed to import runtime module ${CONNECTION_PACKAGE} via loader.internal.import(name, baseUrl, options): ${describeError(error)}`);
+        }
+        if (!isRuntimeConnectionModule(loaded)) {
+            throw new Error(`@iasiv5/dsh-skip-browser-auth: runtime module ${CONNECTION_PACKAGE} has an incompatible export shape`);
+        }
+        return loaded;
+    }
+    return {
+        HostConnectionService: PinnedHostConnectionService,
+        API_PATH: PINNED_API_PATH,
+    };
+}

package/lib/gate.js

@@ -17,7 +17,7 @@
  *     它只可能来自 runtime fallback，不可能被任何 profile 插件的依赖
  *     抬升污染；其版本即宿主 runtime 版本。
  *  2. 第二锚点仍是官方 connection 包（被替换对象本体）；双锚点必须同时
- *     命中白名单版本，任一解析失败或版本漂移一律 dormant。
+ *     命中同一个 active compatibility profile pair，任一解析失败、混合版本或版本漂移一律 dormant。
  * 配套必要条件：本插件的 dependencies 不得声明任何 `@deepseek-ai` 运行时
  * 包（connection 仅作 devDependency 供编译期类型与构建锚点），由
  * tests/manifest.test.mjs 作为不变量看护。
@@ -33,10 +33,11 @@
  * 两分支都拿不到精确版本 → dormant。任何异常一律 dormant（组合期绝不
  * fail loud；最后防线在 apply 内 backstop）。
  */
+import { ACTIVE_COMPATIBILITY_PROFILE_IDS, GATE_PROFILE_TABLE, } from './compatibility.js';
+export { ACTIVE_COMPATIBILITY_PROFILE_IDS, COMPATIBILITY_PROFILES, GATE_VERSION, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, resolveCompatibilityProfile, } from './compatibility.js';
 export const CONNECTION_PACKAGE = '@deepseek-ai/dsh-client-connection';
 /** 宿主 runtime 本体包：探针的第一锚点，版本即宿主 dsh 版本。 */
 export const GATE_RUNTIME_PACKAGE = '@deepseek-ai/dsh';
-export const GATE_VERSION = '0.1.2-rc.1';
 /** 探针锚点（顺序即求值顺序）：宿主 runtime 本体在前，被替换对象在后。 */
 export const GATE_ANCHOR_PACKAGES = [GATE_RUNTIME_PACKAGE, CONNECTION_PACKAGE];
 /**
@@ -50,10 +51,15 @@ export function versionSegmentPatternSource(pkg) {
 }
 /** 探针内嵌的锚点表：`[包名, 版本段正则源]` 对，全部由上方常量派生。 */
 const GATE_ANCHOR_TABLE = GATE_ANCHOR_PACKAGES.map((pkg) => [pkg, versionSegmentPatternSource(pkg)]);
-// 版本探针：单行；生成 cordis.patch.yml 官方行 disabled（scripts/write-patch.mjs）。
-// 逐锚点解析 `锚点包/package.json`，版本（路径段快路径或 manifest 回退）全部
-// 精确等于 GATE_VERSION 才放行。
-export const GATE_PROBE_EXPRESSION = `(() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return false; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = ${JSON.stringify(GATE_ANCHOR_TABLE)}; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return false; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return false; } if (anchorVersion !== '${GATE_VERSION}') return false; } return true; } catch (gateError) { return false; } })()`;
+// Profile probe：单行；生成 cordis.patch.yml 的 profile-aware disabled 表达式。
+// 逐锚点解析 `锚点包/package.json`，返回完整 runtime/connection pair 对应的
+// profile id；candidate profile 也可被识别，是否允许激活由下方 boolean probe
+// 根据 profile status 决定。解析失败、未知 pair 或混合 pair 一律返回 null。
+export const GATE_PROFILE_EXPRESSION = `(() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = ${JSON.stringify(GATE_ANCHOR_TABLE)}; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = ${JSON.stringify(GATE_PROFILE_TABLE)}; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()`;
+// Boolean activation probe: only active profiles disable the official row.
+// A known candidate profile remains dormant until its host/client adapter is
+// promoted, while the profile expression still exposes its exact pair id.
+export const GATE_PROBE_EXPRESSION = `(() => { try { const profile = (${GATE_PROFILE_EXPRESSION}); return profile !== null && ${JSON.stringify(ACTIVE_COMPATIBILITY_PROFILE_IDS)}.includes(profile); } catch (gateError) { return false; } })()`;
 // 行绑定放行：自身探针为真 + 同组 sibling 存在且名字匹配且其 effective disabled 为真。
 // sibling 必须从当前 entry（Symbol.for('cordis.entry')）所属子树解析，
 // 根 Loader 的 resolve 看不到 Include 子树内的行。
@@ -61,7 +67,7 @@ export const GATE_ROW_ALLOWED_EXPRESSION = `(() => { try { const self = ctx[Symb
 /**
  * Evaluate the activation probe against a loader context scope.
  * @param ctx - the `!!js` evaluation scope (same object the Loader passes).
- * @returns true only when every gate anchor resolves to exactly the whitelisted version.
+ * @returns true only when both gate anchors resolve to one active compatibility profile pair.
  */
 export function evaluateGate(ctx) {
     // 与 vendor/loader/src/config/utils.ts 的 evaluate 同语义：with(ctx) + eval。

package/lib/host.js

@@ -1,30 +1,32 @@
 /**
  * @iasiv5/dsh-skip-browser-auth host half：trusted-network Connection Replacement。
  *
- * 复用官方导出的 HostConnectionService（对认证的全部依赖只有
- * isAuthenticated / authorizeIndex / authenticatedUrl 三个方法，由
- * trusted-auth 的 stub 提供），复刻官方 apply 的 /api 前缀路由、
- * 请求体上限与 image capacity 断言语义，并在启动时输出固定警告。
- * apply 内 backstop 是最后防线：版本白名单（读全部门控锚点的 manifest，
- * 与探针同源常量）与门控绑定状态（同组官方行确被禁用且无活跃 fiber）
- * 任一不满足即 fail loud 拒绝运行。
+ * 兼容性按 profile 分代：0.1.2 使用 legacy-web adapter，0.1.5 使用
+ * carrier-neutral adapter。公共 apply 只负责 profile/backstop、信任配置、
+ * 生命周期和固定 warning；版本差异藏在 adapter 与 runtime connection loader。
  */
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import z from '@deepseek-ai/schemastery';
-import { HostConnectionService, API_PATH } from '@deepseek-ai/dsh-client-connection';
+import { CONNECTION_PACKAGE, GATE_ANCHOR_PACKAGES, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, } from './gate.js';
+import { COMPATIBILITY_PROFILES } from './compatibility.js';
+import { loadRuntimeConnectionModule } from './connection-runtime.js';
+import { createLegacyWebRuntime } from './adapters/legacy-web.js';
+import { createCarrierNeutralRuntime } from './adapters/carrier-neutral.js';
 import { assertTrustedAuthority } from './trust-fence.js';
 import { createTrustedAuth } from './trusted-auth.js';
-import { bridge, DEFAULT_MAX_REQUEST_BODY_BYTES } from './bridge.js';
-import { CONNECTION_PACKAGE, GATE_ANCHOR_PACKAGES, GATE_VERSION } from './gate.js';
+import { DEFAULT_MAX_REQUEST_BODY_BYTES } from './bridge.js';
 /** Stable Cordis plugin name. */
 export const name = '@iasiv5/dsh-skip-browser-auth';
-/** Services required before providing the replacement Connection. */
+/** The replacement owns a web carrier so dedicated RPC channels have a route owner. */
 export const inject = ['webServer'];
 /** 启动警告固定文案（全局约束：Replacement 激活时逐字输出）。 */
 const SKIP_WARNING = '@iasiv5/dsh-skip-browser-auth: BrowserAuth has been skipped. DSH Web is using the trusted-network behavior; this plugin does not verify any upstream proxy.';
 /** Headroom for RPC JSON fields around aggregate base64 image payloads. */
 const REQUEST_ENVELOPE_HEADROOM_BYTES = 1024 * 1024;
+const PROFILE_GLOBAL = '__DSH_SKIP_BROWSER_AUTH_PROFILE__';
+const RECOVERY_GLOBAL = '__DSH_CONNECTION_RECOVERY__';
+const WHITELIST_TEXT = `[${GATE_VERSIONS.map((version) => `'${version}'`).join(', ')}]`;
 function assertImageBodyCapacity(ctx, maxRequestBodyBytes) {
     const attachments = ctx.get('attachments');
     if (attachments === undefined)
@@ -35,28 +37,38 @@ function assertImageBodyCapacity(ctx, maxRequestBodyBytes) {
             + `${String(requiredImageBodyBytes)} for the configured aggregate image limit`);
     }
 }
+function profileById(value) {
+    if (!isActiveCompatibilityProfileId(value))
+        return undefined;
+    return COMPATIBILITY_PROFILES.find((profile) => profile.id === value && profile.status === 'active');
+}
+function directProfile(requestedProfile) {
+    if (requestedProfile !== undefined) {
+        const requested = profileById(requestedProfile);
+        if (requested !== undefined)
+            return requested;
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: compatibility profile ${String(requestedProfile)} is not active; refusing to run`);
+    }
+    const legacy = profileById('legacy-web-v1');
+    if (legacy === undefined) {
+        throw new Error('@iasiv5/dsh-skip-browser-auth: no active compatibility profile is available for direct context');
+    }
+    return legacy;
+}
 /**
- * apply 内 backstop（最后防线，fail loud）：版本白名单断言读取全部门控锚点
- * （gate.ts 的 GATE_ANCHOR_PACKAGES：宿主 runtime 本体 + 官方 connection 包）
- * 的 manifest 本体比对白名单（组合期探针只读 pnpm 路径段，会被
- * 「路径真、manifest 假」的漂移骗过）；绑定断言确认当前 entry 子树内的
- * 官方 connection 行确实被本插件禁用、同组同名且无活跃 fiber。
+ * apply 内 backstop（最后防线，fail loud）：版本 pair 读取全部门控锚点的
+ * manifest，并解析到 active compatibility profile；绑定断言确认当前 entry
+ * 子树内的官方 connection 行确实被本插件禁用、同组同名且无活跃 fiber。
  *
- * 锚点解析与探针同基准（ctx.baseUrl，即 profile 根）：发布安装的插件不携带
- * 任何 @deepseek-ai 运行时依赖（见 tests/manifest.test.mjs 不变量），解析只
- * 可能命中 runtime fallback；探针基准污染的历史事故由此不变量 + 双锚点共同
- * 封死。
- *
- * 跳过 seam 仅限「完全没有 Loader、也没有 Loader entry」的直接单元测试调用；
  * 产品组合中 loader / internal / current 任一缺失都意味着最后防线无法执行，
- * 必须在创建 Connection 服务与注册 /api 之前 fail loud——否则后续 patch 层
- * 强制启用或组合回归把 Replacement 误送进 apply 时将无人拦截。
+ * 必须在创建 Connection 服务与注册 /api 之前 fail loud。没有 loader 与 entry
+ * 的直接单元测试上下文才跳过本 backstop。
  */
-function assertGateBackstop(ctx) {
+function assertGateBackstop(ctx, requestedProfile) {
     const loader = ctx.get('loader');
     const current = ctx.fiber?.entry;
     if (loader === undefined && current === undefined)
-        return;
+        return undefined;
     if (loader === undefined) {
         throw new Error('@iasiv5/dsh-skip-browser-auth: gate backstop unavailable: loader service is missing');
     }
@@ -66,10 +78,9 @@ function assertGateBackstop(ctx) {
     if (current === undefined) {
         throw new Error('@iasiv5/dsh-skip-browser-auth: gate backstop unavailable: current loader entry is missing');
     }
-    // (a) 版本断言：与探针同一解析锚点集合（loader.internal + ctx.baseUrl），
-    // 逐锚点读 manifest 比对白名单。
     const baseUrl = ctx.baseUrl ?? '';
     const internal = loader.internal;
+    const versions = [];
     for (const anchorPackage of GATE_ANCHOR_PACKAGES) {
         const specifier = `${anchorPackage}/package.json`;
         const resolved = internal.version === 'v2'
@@ -77,14 +88,21 @@ function assertGateBackstop(ctx) {
             : internal.resolveSync(specifier, baseUrl, {});
         const manifestUrl = resolved?.url;
         if (typeof manifestUrl !== 'string') {
-            throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchor ${anchorPackage} did not resolve; whitelist is ['${GATE_VERSION}']; disable or uninstall the plugin`);
+            throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchor ${anchorPackage} did not resolve; whitelist is ${WHITELIST_TEXT}; disable or uninstall the plugin`);
         }
         const manifest = JSON.parse(readFileSync(fileURLToPath(manifestUrl), 'utf8'));
-        if (manifest.version !== GATE_VERSION) {
-            throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchor ${anchorPackage} manifest is ${String(manifest.version)}, whitelist is ['${GATE_VERSION}']; disable or uninstall the plugin`);
+        if (typeof manifest.version !== 'string') {
+            throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchor ${anchorPackage} manifest has no version, whitelist is ${WHITELIST_TEXT}; disable or uninstall the plugin`);
         }
+        versions.push(manifest.version);
+    }
+    const profile = resolveActiveCompatibilityProfile(versions[0], versions[1]);
+    if (profile === undefined) {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchors ${GATE_ANCHOR_PACKAGES[0]}=${String(versions[0])}, ${GATE_ANCHOR_PACKAGES[1]}=${String(versions[1])} do not resolve to one active compatibility profile; whitelist is ${WHITELIST_TEXT}; disable or uninstall the plugin`);
+    }
+    if (requestedProfile !== undefined && requestedProfile !== profile.id) {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: compatibility profile mismatch: patch selected ${String(requestedProfile)}, anchors selected ${profile.id}; refusing to run`);
     }
-    // (b) 绑定断言：官方行被禁用是 Replacement 放行的前提，且不得有活跃 fiber。
     const official = current.parent.tree.resolve('connection');
     if (official.parent !== current.parent
         || official.options?.id !== 'connection'
@@ -93,50 +111,62 @@ function assertGateBackstop(ctx) {
         || official.fiber !== undefined) {
         throw new Error('@iasiv5/dsh-skip-browser-auth: gate binding violated; refusing to run');
     }
+    return profile;
+}
+function installBrowserGlobals(ctx, profile) {
+    ctx.inject(['webServer'], (webCtx) => {
+        const carrier = webCtx;
+        if (typeof carrier.on !== 'function')
+            return;
+        carrier.on('webserver/index-inject', (table) => {
+            table.push({ kind: 'global', name: PROFILE_GLOBAL, value: profile.id });
+            if (profile.requiresRecoveryGlobal) {
+                table.push({ kind: 'global', name: RECOVERY_GLOBAL, value: {} });
+            }
+        });
+    });
 }
 export const Config = z.object({
     trustedHosts: z.array(String).default([]),
     maxRequestBodyBytes: z.natural().min(1).default(DEFAULT_MAX_REQUEST_BODY_BYTES),
+    compatibilityProfile: z.string().default('legacy-web-v1'),
 });
+function createHostRuntime(profile, input) {
+    switch (profile.hostAdapter) {
+        case 'legacy-web':
+            return createLegacyWebRuntime(input);
+        case 'carrier-neutral':
+            return createCarrierNeutralRuntime(input);
+        default:
+            throw new Error('@iasiv5/dsh-skip-browser-auth: unsupported host adapter');
+    }
+}
 /**
- * Mounts the trusted-network Connection replacement under the browser
- * transport prefix. Every request on the prefix passes the Host/Origin
- * browser-trust fence; no identity layer exists beyond it.
- * @param ctx - Host plugin context.
- * @param config - resolved plugin config (schema defaults applied).
+ * Mounts the trusted-network Connection replacement under the profile's Web
+ * carrier. Every request passes the Host/Origin browser-trust fence; no
+ * identity layer exists beyond it.
  */
 export async function apply(ctx, config) {
-    // The Loader resolves schema defaults; hand-built test contexts may pass none.
     const trustedHosts = config?.trustedHosts ?? [];
     const maxRequestBodyBytes = config?.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES;
-    // Config boundary: a malformed entry fails the load loudly here rather than
-    // silently authorizing its hostname prefix at request time.
     for (const entry of trustedHosts)
         assertTrustedAuthority(entry);
     assertImageBodyCapacity(ctx, maxRequestBodyBytes);
-    assertGateBackstop(ctx);
-    // 官方未导出 BrowserAuth 类型，用构造器参数位取回；stub 只需满足
-    // HostConnectionService 实际消费的三个方法。
+    const profile = assertGateBackstop(ctx, config?.compatibilityProfile) ?? directProfile(config?.compatibilityProfile);
+    const module = await loadRuntimeConnectionModule(ctx);
     const auth = createTrustedAuth(trustedHosts);
-    const connection = new HostConnectionService(ctx, trustedHosts, auth);
-    const fetchHandler = connection.createSharedFetchHandler(API_PATH);
-    const route = {
-        kind: 'prefix',
-        path: API_PATH,
-        handler: async (req, res) => {
-            const rejection = connection.requestRejection(req);
-            if (rejection !== undefined) {
-                res.writeHead(rejection);
-                res.end(rejection === 401 ? 'unauthorized' : 'forbidden');
-                return;
-            }
-            await bridge(req, res, fetchHandler, maxRequestBodyBytes);
-        },
-    };
-    ctx.effect(() => ctx.webServer.register(route), '@iasiv5/dsh-skip-browser-auth: /api route');
+    const runtime = createHostRuntime(profile, {
+        ctx,
+        module,
+        trustedHosts,
+        auth,
+        maxRequestBodyBytes,
+        profileId: profile.id,
+    });
+    ctx.effect(() => ctx.webServer.register(runtime.route), `@iasiv5/dsh-skip-browser-auth: ${runtime.adapterId} ${runtime.route.path} route`);
+    installBrowserGlobals(ctx, profile);
     ctx.inject(['attachments'], (attachmentCtx) => {
         assertImageBodyCapacity(attachmentCtx, maxRequestBodyBytes);
     });
-    // 固定文案启动警告（全局约束）：Replacement 已激活、无上游代理校验。
     console.warn(SKIP_WARNING);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iasiv5/dsh-skip-browser-auth",
-  "version": "0.1.3",
-  "description": "DSH 0.1.2-rc.1 专用：自动跳过 BrowserAuth，免每次在启动 URL 后输入随机 token；其它版本（含 0.1.1-rc.2）自动休眠，不修改任何 DSH 本体与机制",
+  "version": "0.2.0",
+  "description": "DSH 0.1.2-rc.1 与 0.1.5-rc.1 的分代兼容插件：按精确 compatibility profile 自动跳过 BrowserAuth；其它版本自动休眠，不修改任何 DSH 本体与机制",
   "keywords": [
     "dsh",
     "deepseek-harness",
@@ -40,7 +40,8 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node --test tests/*.test.mjs tests/composition/*.test.mjs",
     "test:rc2-fixture": "node scripts/install-rc2-fixture.mjs",
-    "test:all": "npm run test:rc2-fixture && npm run build && npm run typecheck && npm test",
+    "test:rc15-fixture": "node scripts/install-rc15-fixture.mjs",
+    "test:all": "npm run test:rc2-fixture && npm run test:rc15-fixture && npm run build && npm run typecheck && npm test",
     "prepare": "npm run build"
   },
   "dsh": {
@@ -62,6 +63,7 @@
     "@deepseek-ai/cordis-plugin-include": "1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "1.0.3",
     "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "dsh-client-connection-rc15": "npm:@deepseek-ai/dsh-client-connection@0.1.5-rc.1",
     "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
     "@deepseek-ai/dsh-credentials-local": "0.1.2-rc.1",
     "@deepseek-ai/dsh-host-frontend-static": "0.1.2-rc.1",