@iasiv5/dsh-skip-browser-auth 0.2.2 → 0.3.2

package/lib/compatibility.js

@@ -14,6 +14,7 @@ export const COMPATIBILITY_PROFILES = [
         hostAdapter: 'legacy-web',
         clientVariant: 'rc12',
         requiresRecoveryGlobal: false,
+        browserAuthSemantics: 'root',
         status: 'active',
     },
     {
@@ -29,10 +30,38 @@ export const COMPATIBILITY_PROFILES = [
         hostAdapter: 'carrier-neutral',
         clientVariant: 'rc15',
         requiresRecoveryGlobal: true,
+        browserAuthSemantics: 'root',
         // Promoted after the carrier-neutral host/client adapter and fixture path
         // are implemented; real deployment validation remains documented separately.
         status: 'active',
     },
+    {
+        // 0.1.7 is a real contract change from 0.1.5, not a republish: the shared /api
+        // route admits through the new OperatorPeer (`admit()`) and wraps the
+        // bridge in the `connection/request` waterfall; BrowserAuth consumption
+        // becomes mount-preserving; the browser client bundle is rewritten. Audited
+        // package-by-package in docs/COMPATIBILITY.md §5.4.
+        //
+        // 0.1.7-rc.1 joined this generation after a byte-level audit (§5.5): every
+        // package the replacement touches (dsh-client-connection lib/+client/,
+        // dsh-host-webserver, dsh-scope, dsh-host-frontend-static) ships rc.2-identical
+        // code, the web-app patch's connection row is field-identical, and the runtime
+        // diff is chunk-hash renames plus diagnostics-only boot changes. The rc17
+        // client variant therefore serves both pairs, selected by this one profile id.
+        id: 'carrier-neutral-v3',
+        pairs: [
+            { runtime: '0.1.7-rc.1', connection: '0.1.7-rc.1' },
+            { runtime: '0.1.7-rc.2', connection: '0.1.7-rc.2' },
+        ],
+        hostAdapter: 'carrier-neutral-017',
+        clientVariant: 'rc17',
+        requiresRecoveryGlobal: true,
+        browserAuthSemantics: 'mount-preserving',
+        // Promoted together with the adapter/client implementation; the fixture
+        // composition suite and the real 0.1.7-rc.2 deployment checklist are the
+        // promotion evidence (docs/COMPATIBILITY.md §5.4, docs/DESIGN.md).
+        status: 'active',
+    },
 ];
 /** All exact versions represented by profiles, for diagnostics and fixtures. */
 export const GATE_VERSIONS = [...new Set(COMPATIBILITY_PROFILES.flatMap((profile) => profile.pairs.flatMap((pair) => [pair.runtime, pair.connection])))];

package/lib/connection-runtime.js

@@ -1,5 +1,4 @@
 /** Runtime connection module loader used by compatibility adapters. */
-import { API_PATH as PINNED_API_PATH, HostConnectionService as PinnedHostConnectionService } from '@deepseek-ai/dsh-client-connection';
 import { CONNECTION_PACKAGE } from './gate.js';
 function isRuntimeConnectionModule(value) {
     if (typeof value !== 'object' || value === null)
@@ -45,8 +44,20 @@ export async function loadRuntimeConnectionModule(ctx) {
         }
         return loaded;
     }
-    return {
-        HostConnectionService: PinnedHostConnectionService,
-        API_PATH: PINNED_API_PATH,
-    };
+    return importPinnedConnectionModule();
+}
+/**
+ * Pinned dev 副本惰性加载（审计修复 2026-09-28）：只允许在完全没有 loader
+ * 服务的直接单元测试上下文执行。禁止顶层静态 import——那会让 0.1.2 旧模块
+ * 图在产品环境随插件加载被求值，且 bare specifier 绑定随安装布局漂移（dev
+ * 树内嵌时遮蔽命中 pinned 副本，净装则经 pnpm hoist 命中宿主副本）。动态
+ * import() 把模块解析推迟到实际调用点，产品路径（loader 恒在）永不触碰该
+ * 副本。不变量由 tests/manifest.test.mjs 的 lazy-load 断言锁定。
+ */
+async function importPinnedConnectionModule() {
+    const pinned = (await import('@deepseek-ai/dsh-client-connection'));
+    if (typeof pinned?.HostConnectionService !== 'function' || typeof pinned?.API_PATH !== 'string') {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: pinned dev module ${CONNECTION_PACKAGE} has an incompatible export shape`);
+    }
+    return pinned;
 }

package/lib/host.js

@@ -2,8 +2,9 @@
  * @iasiv5/dsh-skip-browser-auth host half：trusted-network Connection Replacement。
  *
  * 兼容性按 profile 分代：0.1.2 使用 legacy-web adapter，0.1.5 使用
- * carrier-neutral adapter。公共 apply 只负责 profile/backstop、信任配置、
- * 生命周期和固定 warning；版本差异藏在 adapter 与 runtime connection loader。
+ * carrier-neutral adapter，0.1.7 使用 carrier-neutral-017 adapter。公共 apply
+ * 只负责 profile/backstop、信任配置、生命周期和固定 warning；版本差异藏在
+ * adapter 与 runtime connection loader。
  */
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -13,6 +14,7 @@ import { COMPATIBILITY_PROFILES } from './compatibility.js';
 import { loadRuntimeConnectionModule } from './connection-runtime.js';
 import { createLegacyWebRuntime } from './adapters/legacy-web.js';
 import { createCarrierNeutralRuntime } from './adapters/carrier-neutral.js';
+import { createCarrierNeutral017Runtime } from './adapters/carrier-neutral-017.js';
 import { assertTrustedAuthority } from './trust-fence.js';
 import { createTrustedAuth } from './trusted-auth.js';
 import { DEFAULT_MAX_REQUEST_BODY_BYTES } from './bridge.js';
@@ -137,6 +139,8 @@ function createHostRuntime(profile, input) {
             return createLegacyWebRuntime(input);
         case 'carrier-neutral':
             return createCarrierNeutralRuntime(input);
+        case 'carrier-neutral-017':
+            return createCarrierNeutral017Runtime(input);
         default:
             throw new Error('@iasiv5/dsh-skip-browser-auth: unsupported host adapter');
     }
@@ -154,7 +158,7 @@ export async function apply(ctx, config) {
     assertImageBodyCapacity(ctx, maxRequestBodyBytes);
     const profile = assertGateBackstop(ctx, config?.compatibilityProfile) ?? directProfile(config?.compatibilityProfile);
     const module = await loadRuntimeConnectionModule(ctx);
-    const auth = createTrustedAuth(trustedHosts);
+    const auth = createTrustedAuth(trustedHosts, profile.browserAuthSemantics);
     const runtime = createHostRuntime(profile, {
         ctx,
         module,

package/lib/trusted-auth.js

@@ -12,11 +12,17 @@ const TOKEN_QUERY = 'token';
 /**
  * Create the three-method stub consumed by the official HostConnectionService.
  * @param trustedHosts - non-loopback authorities this deployment serves: exact `host:port`, or port-less `host` matching any port.
+ * @param semantics - the host generation's BrowserAuth URL contract: `root`
+ * (0.1.2/0.1.5, app at `/`) or `mount-preserving` (0.1.7, app may mount at a
+ * sub-path). Selected by the compatibility profile, never guessed.
  * @returns authentication owner with trusted-network semantics for all three methods.
  */
-export function createTrustedAuth(trustedHosts) {
+export function createTrustedAuth(trustedHosts, semantics = 'root') {
+    // mount-preserving：官方 0.1.7 的清理重定向目标是目录相对 `./`，
+    // 应用可以挂在子路径上；root：官方 0.1.2/0.1.5 一律回到 `/`。
+    const cleanLocation = semantics === 'mount-preserving' ? './' : '/';
     return {
-        // 请求已通过 /api 侧的 requestRejection 信任栅栏；此处恒真，
+        // 请求已通过 /api 侧的 requestRejection/admit 信任栅栏；此处恒真，
         // 使官方 service 不再叠加 401 身份层。
         isAuthenticated(_request) {
             return true;
@@ -37,7 +43,7 @@ export function createTrustedAuth(trustedHosts) {
             if (url.searchParams.has(TOKEN_QUERY) && req.method === 'GET' && url.pathname === '/') {
                 res.writeHead(303, {
                     'cache-control': 'no-store',
-                    'location': '/',
+                    'location': cleanLocation,
                     'referrer-policy': 'no-referrer',
                 });
                 res.end();
@@ -45,10 +51,13 @@ export function createTrustedAuth(trustedHosts) {
             }
             return true;
         },
-        // 无身份层：返回干净的应用根 URL，不附加任何 token。
+        // 无身份层：返回干净的应用 URL，不附加任何 token。
+        // root：官方 0.1.2/0.1.5 语义，重写到应用根 `/`；
+        // mount-preserving：官方 0.1.7 语义，保留调用方的 mount，仅去掉 query/hash。
         authenticatedUrl(baseUrl) {
             const url = new URL(baseUrl);
-            url.pathname = '/';
+            if (semantics !== 'mount-preserving')
+                url.pathname = '/';
             url.search = '';
             url.hash = '';
             return url.href;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iasiv5/dsh-skip-browser-auth",
-  "version": "0.2.2",
-  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1 与 0.1.5-rc.1/rc.2，详见仓库。",
+  "version": "0.3.2",
+  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1、0.1.5-rc.1/rc.2 与 0.1.7-rc.1/rc.2，详见仓库。",
   "keywords": [
     "dsh",
     "deepseek-harness",
@@ -41,7 +41,8 @@
     "test": "node --test tests/*.test.mjs tests/composition/*.test.mjs",
     "test:rc2-fixture": "node scripts/install-rc2-fixture.mjs",
     "test:rc15-fixture": "node scripts/install-rc15-fixture.mjs",
-    "test:all": "npm run test:rc2-fixture && npm run test:rc15-fixture && npm run build && npm run typecheck && npm test",
+    "test:rc17-fixture": "node scripts/install-rc17-fixture.mjs",
+    "test:all": "npm run test:rc2-fixture && npm run test:rc15-fixture && npm run test:rc17-fixture && npm run build && npm run typecheck && npm test",
     "prepare": "npm run build"
   },
   "dsh": {
@@ -59,13 +60,17 @@
     "@deepseek-ai/schemastery": "*"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/cordis-plugin-include": "1.0.7",
     "@deepseek-ai/cordis-plugin-loader": "1.0.3",
+    "@deepseek-ai/dsh-atomic-write": "0.1.2-rc.1",
     "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
     "dsh-client-connection-rc15": "npm:@deepseek-ai/dsh-client-connection@0.1.5-rc.1",
+    "dsh-client-connection-rc17": "npm:@deepseek-ai/dsh-client-connection@0.1.7-rc.2",
     "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
     "@deepseek-ai/dsh-credentials-local": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-home-paths": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1",
     "@deepseek-ai/dsh-host-frontend-static": "0.1.2-rc.1",
     "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",