@iasiv5/dsh-skip-browser-auth 0.3.12 → 0.4.0

package/lib/compatibility.js

@@ -67,6 +67,15 @@ export const COMPATIBILITY_PROFILES = [
         // a ModuleLoader chunk-hash rename whose 34 changed lines all sit in that CLI
         // area with resolveSync usage line-identical. rc17 keeps anchoring at
         // 0.1.7-rc.2; no second 0.2.x-line build input is introduced.
+        //
+        // 0.2.1-rc.1 does NOT join this generation (§5.8): unlike every rc.2-style
+        // republish it is a real contract change on the replacement face —
+        // OperatorPeer reworked into per-request Peer instances with principals,
+        // the shared-route bridge threading admission.peer into fetch, a new
+        // /connect exact channel (authorizeConnect), the client bundle split into
+        // browser/node entries, and the official patch's connection row moving
+        // from the webRuntime to the webStartup service. It therefore starts the
+        // carrier-neutral-v4 generation below (docs/COMPATIBILITY.md §5.2/§5.9).
         id: 'carrier-neutral-v3',
         pairs: [
             { runtime: '0.1.7-rc.1', connection: '0.1.7-rc.1' },
@@ -84,7 +93,37 @@ export const COMPATIBILITY_PROFILES = [
         // promotion evidence (docs/COMPATIBILITY.md §5.4, docs/DESIGN.md).
         status: 'active',
     },
+    {
+        // 0.2.1-rc.1 starts its own generation (§5.8 audit → §5.2 new generation):
+        // the official apply wiring it must replicate is admit() → waterfall →
+        // bridge(req, res, fetchHandler, admission.peer, maxRequestBodyBytes) plus
+        // the new exact /connect route (connection.authorizeConnect). The
+        // HostConnectionService constructor (ctx, trustedHosts, browserAuth) is
+        // unchanged, but the patch row serving this generation reads trustedHosts
+        // from the webStartup service (webRuntime is gone upstream; the official
+        // 0.2.1 patch row made the same move and narrows trustedHosts to the
+        // explicit invocation authorities). The rc21 client variant anchors at the
+        // official browser entry lib/client.browser.js of 0.2.1-rc.1 — no other
+        // generation shares this build input.
+        id: 'carrier-neutral-v4',
+        pairs: [
+            { runtime: '0.2.1-rc.1', connection: '0.2.1-rc.1' },
+        ],
+        hostAdapter: 'carrier-neutral-021',
+        clientVariant: 'rc21',
+        requiresRecoveryGlobal: true,
+        browserAuthSemantics: 'mount-preserving',
+        hostProfiles: ['web'],
+        status: 'active',
+    },
 ];
+/**
+ * The §5.9 generation id: the only profile whose bundle patch row injects the
+ * `webStartup` service (upstream renamed webRuntime → webStartup in 0.2.1).
+ * The row-binding expressions in gate.ts partition the active profile ids by
+ * this constant so exactly one inserted row can activate per host generation.
+ */
+export const CARRIER_NEUTRAL_V4_PROFILE_ID = 'carrier-neutral-v4';
 /** All exact versions represented by profiles, for diagnostics and fixtures. */
 export const GATE_VERSIONS = [...new Set(COMPATIBILITY_PROFILES.flatMap((profile) => profile.pairs.flatMap((pair) => [pair.runtime, pair.connection])))];
 /** Backward-compatible internal alias for the original 0.1.2 build/test pin. */

package/lib/gate.js

@@ -66,7 +66,7 @@
  * docs/COMPATIBILITY.md §7.4/§7.6）。Node 侧镜像见 detectHostProfile；
  * 语义、事故记录与解冻条件见 docs/COMPATIBILITY.md §7。
  */
-import { ACTIVE_COMPATIBILITY_PROFILE_IDS, GATE_PROFILE_TABLE, } from './compatibility.js';
+import { ACTIVE_COMPATIBILITY_PROFILE_IDS, CARRIER_NEUTRAL_V4_PROFILE_ID, GATE_PROFILE_TABLE, } from './compatibility.js';
 export { ACTIVE_COMPATIBILITY_PROFILE_IDS, COMPATIBILITY_PROFILES, GATE_VERSION, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, resolveCompatibilityProfile, } from './compatibility.js';
 export const CONNECTION_PACKAGE = '@deepseek-ai/dsh-client-connection';
 /** 宿主 runtime 本体包：探针的第一锚点，版本即宿主 dsh 版本。 */
@@ -99,10 +99,22 @@ export const GATE_PROFILE_EXPRESSION = `(() => { try { const internal = ctx.load
 // A known candidate profile remains dormant until its host/client adapter is
 // promoted, while the profile expression still exposes its exact pair id.
 export const GATE_PROBE_EXPRESSION = `(() => { try { const profile = (${GATE_PROFILE_EXPRESSION}); return profile !== null && ${JSON.stringify(ACTIVE_COMPATIBILITY_PROFILE_IDS)}.includes(profile); } catch (gateError) { return false; } })()`;
-// 行绑定放行：自身探针为真 + 同组 sibling 存在且名字匹配且其 effective disabled 为真。
+// 行绑定放行表达式源（0.4.0 起按代际拆分）：自身探针解析出的 profile 落在
+// allowedProfileIds 内 + 同组 sibling 存在且名字匹配且其 effective disabled 为真。
 // sibling 必须从当前 entry（Symbol.for('cordis.entry')）所属子树解析，
 // 根 Loader 的 resolve 看不到 Include 子树内的行。
-export const GATE_ROW_ALLOWED_EXPRESSION = `(() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '${CONNECTION_PACKAGE}') return false; const probeAllowed = (${GATE_PROBE_EXPRESSION}); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })()`;
+//
+// 为什么按代际拆分（§5.9）：bundle patch 现在插入两行（webRuntime 行服务
+// ≤0.2.0 代际、webStartup 行服务 0.2.1+ 代际），两个 id 集合必须互斥——否则
+// 新代际宿主上旧行也会放行（其 inject 的 webRuntime 服务在上游已不存在）。
+// 两个集合由 compatibility.ts 单表派生，不会漂移。
+function rowAllowedExpressionSource(allowedProfileIds) {
+    return `(() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '${CONNECTION_PACKAGE}') return false; const profile = (${GATE_PROFILE_EXPRESSION}); if (profile === null || !${JSON.stringify(allowedProfileIds)}.includes(profile)) return false; return official.disabled === true; } catch (gateError) { return false; } })()`;
+}
+/** ≤0.2.0 代际的行绑定（webRuntime 行）：active 集合排除 v4。 */
+export const GATE_ROW_ALLOWED_EXPRESSION = rowAllowedExpressionSource(ACTIVE_COMPATIBILITY_PROFILE_IDS.filter((id) => id !== CARRIER_NEUTRAL_V4_PROFILE_ID));
+/** 0.2.1+ 代际（carrier-neutral-v4）的行绑定（webStartup 行）：仅 v4。 */
+export const GATE_ROW_ALLOWED_EXPRESSION_V4 = rowAllowedExpressionSource([CARRIER_NEUTRAL_V4_PROFILE_ID]);
 /**
  * Evaluate the activation probe against a loader context scope.
  * @param ctx - the `!!js` evaluation scope (same object the Loader passes).

package/lib/host.js

@@ -2,7 +2,8 @@
  * @iasiv5/dsh-skip-browser-auth host half：trusted-network Connection Replacement。
  *
  * 兼容性按 profile 分代：0.1.2 使用 legacy-web adapter，0.1.5 使用
- * carrier-neutral adapter，0.1.7 使用 carrier-neutral-017 adapter。公共 apply
+ * carrier-neutral adapter，0.1.7–0.2.0 使用 carrier-neutral-017 adapter，
+ * 0.2.1 起使用 carrier-neutral-021 adapter。公共 apply
  * 只负责 profile/backstop、信任配置、生命周期和固定 warning；版本差异藏在
  * adapter 与 runtime connection loader。
  */
@@ -15,6 +16,7 @@ import { loadRuntimeConnectionModule } from './connection-runtime.js';
 import { createLegacyWebRuntime } from './adapters/legacy-web.js';
 import { createCarrierNeutralRuntime } from './adapters/carrier-neutral.js';
 import { createCarrierNeutral017Runtime } from './adapters/carrier-neutral-017.js';
+import { createCarrierNeutral021Runtime } from './adapters/carrier-neutral-021.js';
 import { assertTrustedAuthority } from './trust-fence.js';
 import { createTrustedAuth } from './trusted-auth.js';
 import { DEFAULT_MAX_REQUEST_BODY_BYTES } from './bridge.js';
@@ -162,6 +164,8 @@ function createHostRuntime(profile, input) {
             return createCarrierNeutralRuntime(input);
         case 'carrier-neutral-017':
             return createCarrierNeutral017Runtime(input);
+        case 'carrier-neutral-021':
+            return createCarrierNeutral021Runtime(input);
         default:
             throw new Error('@iasiv5/dsh-skip-browser-auth: unsupported host adapter');
     }
@@ -202,6 +206,10 @@ export async function apply(ctx, config) {
         profileId: profile.id,
     });
     ctx.effect(() => ctx.webServer.register(runtime.route), `@iasiv5/dsh-skip-browser-auth: ${runtime.adapterId} ${runtime.route.path} route`);
+    // 代际附加路由（官方 apply 注册顺序照抄）：0.2.1 的 /connect exact 通道。
+    for (const additionalRoute of runtime.additionalRoutes ?? []) {
+        ctx.effect(() => ctx.webServer.register(additionalRoute), `@iasiv5/dsh-skip-browser-auth: ${runtime.adapterId} ${additionalRoute.path} route`);
+    }
     installBrowserGlobals(ctx, profile);
     ctx.inject(['attachments'], (attachmentCtx) => {
         assertImageBodyCapacity(attachmentCtx, maxRequestBodyBytes);

package/lib/trusted-auth.js

@@ -1,9 +1,9 @@
 /**
  * Trusted-network replacement for the official BrowserAuth stub.
  *
- * 官方 HostConnectionService 对认证的全部依赖只有三个方法：
- * isAuthenticated / authorizeIndex / authenticatedUrl。本模块以
- * trusted-network 语义提供三方法 stub：请求信任栅栏（Host/Origin/
+ * 官方 HostConnectionService 对认证的全部依赖（0.2.1 起）只有四个方法：
+ * isAuthenticated / authorizeIndex / authenticatedUrl / authorizeConnect。
+ * 本模块以 trusted-network 语义提供四方法 stub：请求信任栅栏（Host/Origin/
  * Fetch Metadata/trustedHosts）承担全部访问判定，身份层不存在。
  * 首页 fence 与 /api fence 消费同一个 trustedHosts 列表。
  */
@@ -62,5 +62,34 @@ export function createTrustedAuth(trustedHosts, semantics = 'root') {
             url.hash = '';
             return url.href;
         },
+        // 0.2.1 /connect 交换（trusted-network 语义）：
+        // - interactions 声明校验逐字对齐官方（客户端协议契约，400 兜底）；
+        // - 官方成功路径 = mint operator cookie + 302 ./api/remote.mux；本 stub
+        //   省略 cookie 与 operator 记录（无身份可铸造；publish 不调用，避免
+        //   生成无 cookie 引用的孤儿 operator 台账），其余响应形态逐字对齐。
+        //   后续 /api 请求由 admit() 恒准为 owner-principal browserPeer，mux
+        //   连接不依赖该 cookie。
+        // - 服务层已在 authorizeConnect 入口做过 isTrusted（evil host ⇒ 403，
+        //   不达本 stub）；身份/token 校验路径在本模式恒通过（isAuthenticated
+        //   恒真），token 缺失不再 401。
+        authorizeConnect(req, res, _secure, _publish) {
+            const url = new URL(req.url ?? '/', 'http://dsh.invalid');
+            const declarations = url.searchParams.getAll('interactions');
+            const interactions = declarations[0] ?? 'none';
+            if (declarations.length > 1 || (interactions !== 'answer' && interactions !== 'none')) {
+                res.writeHead(400, {
+                    'cache-control': 'no-store',
+                    'content-type': 'text/plain; charset=utf-8',
+                });
+                res.end('interactions must be declared once as answer or none\n');
+                return;
+            }
+            res.writeHead(302, {
+                'cache-control': 'no-store',
+                'location': './api/remote.mux',
+                'referrer-policy': 'no-referrer',
+            });
+            res.end();
+        },
     };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iasiv5/dsh-skip-browser-auth",
-  "version": "0.3.12",
-  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1、0.1.5-rc.1/rc.2、0.1.7-rc.1/rc.2 与 0.2.0-rc.1/rc.2，详见仓库。仅支持 web（宿主二进制须为 node）；desktop 宿主一律自动休眠（多进程树判别：安装槽位/启动器 argv/宿主二进制），属设计行为。",
+  "version": "0.4.0",
+  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1、0.1.5-rc.1/rc.2、0.1.7-rc.1/rc.2、0.2.0-rc.1/rc.2 与 0.2.1-rc.1，详见仓库。仅支持 web（宿主二进制须为 node）；desktop 宿主一律自动休眠（多进程树判别：安装槽位/启动器 argv/宿主二进制），属设计行为。",
   "keywords": [
     "dsh",
     "deepseek-harness",
@@ -68,6 +68,7 @@
     "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
     "dsh-client-connection-rc15": "npm:@deepseek-ai/dsh-client-connection@0.1.5-rc.1",
     "dsh-client-connection-rc17": "npm:@deepseek-ai/dsh-client-connection@0.1.7-rc.2",
+    "dsh-client-connection-rc21": "npm:@deepseek-ai/dsh-client-connection@0.2.1-rc.1",
     "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
     "@deepseek-ai/dsh-credentials-local": "0.1.2-rc.1",
     "@deepseek-ai/dsh-home-paths": "0.1.2-rc.1",