@iasiv5/dsh-skip-browser-auth 0.3.5 → 0.3.6

package/README.md

@@ -38,6 +38,7 @@ sudo systemctl restart deepseek-harness.service   # 按你的部署方式重启
 - DSH 0.1.5-rc.1 / 0.1.5-rc.2：carrier-neutral-v2
 - DSH 0.1.7-rc.1 / 0.1.7-rc.2 / 0.2.0-rc.1 / 0.2.0-rc.2：carrier-neutral-v3
 其它版本或 runtime/connection 混合版本会自动休眠，不要强行处理。
+desktop profile（存在 dsh-desktop-host 的环境）会自动休眠，这是设计行为，不要强行处理或改代码绕过。
 
 1. 先执行 dsh --version 告诉我当前 DSH 版本，然后照常安装：
    dsh plugin --profile web add @iasiv5/dsh-skip-browser-auth
@@ -71,6 +72,7 @@ sudo systemctl restart deepseek-harness.service
 | `0.1.7-rc.2` + `0.1.7-rc.2` | `carrier-neutral-v3` | 同上 | ✅ active（真实 npm fixture 组合测试 + 2026-09-26 实机 checklist 与回滚演练，见 docs/DESIGN.md） |
 | `0.2.0-rc.1` + `0.2.0-rc.1` | `carrier-neutral-v3` | 同上（0.2.0-rc.1 为依赖对齐重发布：插件契约面代码逐字节一致） | ✅ active（npm diff 审计 + 真实 0.2.0-rc.1 npm fixture 组合测试，见 docs/COMPATIBILITY.md §5.6；2026-09-29 实机 checklist 已确认） |
 | `0.2.0-rc.2` + `0.2.0-rc.2` | `carrier-neutral-v3` | 同上（0.2.0-rc.2 为依赖对齐重发布 + 无关 Desktop CLI 演进：插件契约面代码逐字节一致） | ✅ active（npm diff 审计 + 真实 0.2.0-rc.2 npm fixture 组合测试，见 docs/COMPATIBILITY.md §5.7；实机 checklist 见当日升级记录） |
+| desktop profile（存在 dsh-desktop-host 的环境，任意版本对） | — | 😴 dormant-by-design：desktop 一律休眠 | dormant |
 | 其它版本或混合版本对 | — | 😴 自动休眠：官方行为分毫不变 | dormant |
 
 白名单匹配的是**完整版本对**，不是两个独立的 `includes()`：
@@ -99,6 +101,7 @@ runtime=0.1.7-rc.2 + connection=0.1.5-rc.2 → dormant（跨代际混合）
 
 - 组合期版本探针使用 runtime 本体与官方 connection 包双锚点，并返回 profile id；路径段和 npm flat manifest 两种布局均支持。任何异常都 fail-closed 到 dormant。
 - `apply()` backstop 再读取两个 manifest，验证 active profile、patch 传入的 profile id、官方 connection sibling 行的 id/name/disabled/fiber 状态；不满足时在创建服务、注册 route、输出 warning 前 fail loud。
+- 宿主 profile 门控：探针先解析 @deepseek-ai/dsh-desktop-host——命中即 desktop 环境，整体安静休眠（设计行为，desktop 上 Electron 自带 token，插件无收益）；解析异常按 web 继续走版本对判定，任何异常兜底休眠。
 - `legacy-web-v1` 保留 0.1.2 的 `/api` prefix 与 buffered bridge。
 - `carrier-neutral-v2` 使用 runtime loader 取得当前 0.1.5 connection module，支持 `requestBodyMode`、exact Fetch route 和 streaming body，并将 generic `connection.rpc.handle()` 绑定到拥有 Web carrier 的 replacement context，避免 0.1.5 的 405 回归。
 - `carrier-neutral-v3` 在 v2 契约之上复刻 0.1.7 的三处新语义：`/api` 准入改走 `admit()`（OperatorPeer 作为 RPC handler 第 4 参传入）、共享通道请求经 `connection/request` waterfall（监听插件继续可见）、BrowserAuth stub 使用 mount-preserving URL 语义（token 清理 303 `./`、启动 URL 保留 mount）。
@@ -138,6 +141,7 @@ git diff --exit-code cordis.patch.yml
 - 真实 0.2.0-rc.2 `admit()`/OperatorPeer、waterfall、mount-preserving token 清理、同代际跨 patch 混合 dormant（0.2.0-rc.1 ↔ 0.2.0-rc.2 双向）与 npm flat 布局
 - 三个官方 client factory 的 materialization、profile dispatcher 和未知 profile fail-closed
 - rc.2 dormant 基线、dispose/unload、Host/Origin/Fetch Metadata trust fence
+- desktop 宿主 fixture：@deepseek-ai/dsh-desktop-host 桩包在场 + 白名单版本对仍整体休眠（官方行活跃、无插件路由、无横幅）
 
 完整的 GitHub API 审计、profile 数据模型、adapter seam、client 变体和未来新增代际 checklist 见 [docs/COMPATIBILITY.md](./docs/COMPATIBILITY.md)；机制详版见 [docs/DESIGN.md](./docs/DESIGN.md)。
 

package/cordis.patch.yml

@@ -7,12 +7,16 @@
 # 任何门控条件不成立（锚点解析失败、版本漂移、行不存在、名字漂移、
 # 官方行未禁用），Replacement 一律保持 dormant（fail-closed）。探针为假时，
 # 即使后续 patch 层把官方行强制 disabled，行绑定内嵌探针仍保持 dormant。
+# 宿主 profile 门控（web-only）：表达式先解析 @deepseek-ai/dsh-desktop-host/package.json，
+# 解析出合法 URL 即 desktop ⇒ 探针为 null（desktop 一律休眠，设计行为）；解析异常
+# 按包不存在处理（web 继续），兜底仍是完整版本对白名单（fail-closed）。
 - id: connection
   name: '@deepseek-ai/dsh-client-connection'
   disabled: !!js >-
-    (() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof
-    manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles =
-    [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch (gateError) { return false; } })()
+    (() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const desktopSpecifier = "@deepseek-ai/dsh-desktop-host" + '/package.json'; let hostProfile; try { const desktopResolved = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier: desktopSpecifier, attributes: {} }) : internal.resolveSync(desktopSpecifier, ctx.baseUrl, {}); const desktopUrl = desktopResolved === null || typeof desktopResolved !== 'object' ? undefined : desktopResolved.url; hostProfile = typeof desktopUrl === 'string' ? 'desktop' : 'web'; } catch (hostError) { hostProfile = 'web'; } const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef =
+    globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier,
+    attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}],"hostProfiles":["web"]}]; for (const profile of profiles) { if (profile.hostProfiles.includes(hostProfile) && profile.pairs.some((pair) => pair.runtime === versions[0]
+    && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch (gateError) { return false; } })()
 - insert:
     - id: trusted-connection
       name: '@iasiv5/dsh-skip-browser-auth'
@@ -21,11 +25,13 @@
       config:
         trustedHosts: !!js ctx.webRuntime.trustedHosts
         compatibilityProfile: !!js >-
-          (() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof
-          manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles =
-          [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()
+          (() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const desktopSpecifier = "@deepseek-ai/dsh-desktop-host" + '/package.json'; let hostProfile; try { const desktopResolved = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier: desktopSpecifier, attributes: {} }) : internal.resolveSync(desktopSpecifier, ctx.baseUrl, {}); const desktopUrl = desktopResolved === null || typeof desktopResolved !== 'object' ? undefined : desktopResolved.url; hostProfile = typeof desktopUrl === 'string' ? 'desktop' : 'web'; } catch (hostError) { hostProfile = 'web'; } const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef
+          === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url :
+          internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}],"hostProfiles":["web"]}]; for (const profile of profiles) { if (profile.hostProfiles.includes(hostProfile) && profile.pairs.some((pair) => pair.runtime === versions[0] &&
+          pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()
       disabled: !!js >-
-        !((() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '@deepseek-ai/dsh-client-connection') return false; const probeAllowed = ((() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function')
-        return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let
-        anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}]}]; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch
-        (gateError) { return false; } })()); if (probeAllowed !== true) return false; return official.disabled === true; } catch (gateError) { return false; } })())
+        !((() => { try { const self = ctx[Symbol.for('cordis.entry')]; if (!self || !self.parent || !self.parent.tree) return false; const official = self.parent.tree.resolve('connection'); if (!official || official.parent !== self.parent) return false; if (official.options.id !== 'connection' || official.options.name !== '@deepseek-ai/dsh-client-connection') return false; const probeAllowed = ((() => { try { const profile = ((() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const desktopSpecifier = "@deepseek-ai/dsh-desktop-host" + '/package.json'; let hostProfile; try { const desktopResolved = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier: desktopSpecifier, attributes: {} }) : internal.resolveSync(desktopSpecifier, ctx.baseUrl, {}); const desktopUrl = desktopResolved === null || typeof desktopResolved !== 'object' ? undefined : desktopResolved.url; hostProfile =
+        typeof desktopUrl === 'string' ? 'desktop' : 'web'; } catch (hostError) { hostProfile = 'web'; } const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ?
+        manifest.version : null; } return null; }; const anchors = [["@deepseek-ai/dsh","[+]dsh@([^/_]+)[_/]"],["@deepseek-ai/dsh-client-connection","[+]dsh-client-connection@([^/_]+)[_/]"]]; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles =
+        [{"id":"legacy-web-v1","pairs":[{"runtime":"0.1.2-rc.1","connection":"0.1.2-rc.1"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v2","pairs":[{"runtime":"0.1.5-rc.1","connection":"0.1.5-rc.1"},{"runtime":"0.1.5-rc.2","connection":"0.1.5-rc.2"}],"hostProfiles":["web"]},{"id":"carrier-neutral-v3","pairs":[{"runtime":"0.1.7-rc.1","connection":"0.1.7-rc.1"},{"runtime":"0.1.7-rc.2","connection":"0.1.7-rc.2"},{"runtime":"0.2.0-rc.1","connection":"0.2.0-rc.1"},{"runtime":"0.2.0-rc.2","connection":"0.2.0-rc.2"}],"hostProfiles":["web"]}]; for (const profile of profiles) { if (profile.hostProfiles.includes(hostProfile) && profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()); return profile !== null && ["legacy-web-v1","carrier-neutral-v2","carrier-neutral-v3"].includes(profile); } catch (gateError) { return false; } })()); if (probeAllowed !== true) return false;
+        return official.disabled === true; } catch (gateError) { return false; } })())

package/lib/compatibility.js

@@ -15,6 +15,7 @@ export const COMPATIBILITY_PROFILES = [
         clientVariant: 'rc12',
         requiresRecoveryGlobal: false,
         browserAuthSemantics: 'root',
+        hostProfiles: ['web'],
         status: 'active',
     },
     {
@@ -31,6 +32,7 @@ export const COMPATIBILITY_PROFILES = [
         clientVariant: 'rc15',
         requiresRecoveryGlobal: true,
         browserAuthSemantics: 'root',
+        hostProfiles: ['web'],
         // Promoted after the carrier-neutral host/client adapter and fixture path
         // are implemented; real deployment validation remains documented separately.
         status: 'active',
@@ -76,6 +78,7 @@ export const COMPATIBILITY_PROFILES = [
         clientVariant: 'rc17',
         requiresRecoveryGlobal: true,
         browserAuthSemantics: 'mount-preserving',
+        hostProfiles: ['web'],
         // Promoted together with the adapter/client implementation; the fixture
         // composition suite and the real 0.1.7-rc.2 deployment checklist are the
         // promotion evidence (docs/COMPATIBILITY.md §5.4, docs/DESIGN.md).
@@ -96,13 +99,16 @@ export function resolveCompatibilityProfile(runtimeVersion, connectionVersion) {
         return undefined;
     return COMPATIBILITY_PROFILES.find((profile) => profile.pairs.some((pair) => pair.runtime === runtimeVersion && pair.connection === connectionVersion));
 }
-/** Resolve only a profile whose implementation is promoted to active. */
-export function resolveActiveCompatibilityProfile(runtimeVersion, connectionVersion) {
+/** Resolve only a profile whose implementation is promoted to active AND whose
+ *  hostProfiles admit the given host profile（未知宿主形态一律无匹配，fail-closed）。 */
+export function resolveActiveCompatibilityProfile(runtimeVersion, connectionVersion, hostProfile) {
     const profile = resolveCompatibilityProfile(runtimeVersion, connectionVersion);
-    return profile?.status === 'active' ? profile : undefined;
+    return profile?.status === 'active' && profile.hostProfiles.includes(hostProfile)
+        ? profile
+        : undefined;
 }
 export function isActiveCompatibilityProfileId(value) {
     return typeof value === 'string' && ACTIVE_COMPATIBILITY_PROFILE_IDS.includes(value);
 }
 /** Small JSON-safe table embedded into the Loader `!!js` expression. */
-export const GATE_PROFILE_TABLE = COMPATIBILITY_PROFILES.map(({ id, pairs }) => ({ id, pairs }));
+export const GATE_PROFILE_TABLE = COMPATIBILITY_PROFILES.map(({ id, pairs, hostProfiles }) => ({ id, pairs, hostProfiles }));

package/lib/gate.js

@@ -32,6 +32,15 @@
  *     环境无 require/模块导入，这是唯一受支持的同步内建模块获取方式）。
  * 两分支都拿不到精确版本 → dormant。任何异常一律 dormant（组合期绝不
  * fail loud；最后防线在 apply 内 backstop）。
+ *
+ * 宿主 profile 门控（2026-10-07，web-only / desktop 休眠）：表达式在版本对判定
+ * 之前先解析 desktop 信号包（DESKTOP_HOST_PACKAGE）——解析出合法 {url: string}
+ * ⇒ desktop，由白名单表条目的 hostProfiles: ['web'] 条件统一拒绝（休眠，
+ * 策略单一来源 src/compatibility.ts）；抛错/返回空值/url 非字符串 ⇒ 视为包
+ * 不存在（web 继续，组合测试 fake 与真实 v1 loader 契约即如此）；resolver
+ * 缺失仍走原有 null 分支。检测异常的 fail-closed 兜底是版本对判定本身
+ * （真异常时双锚点同样解析失败 ⇒ null）。Node 侧镜像见 detectHostProfile；
+ * 语义与解冻条件记录于 docs/COMPATIBILITY.md §7。
  */
 import { ACTIVE_COMPATIBILITY_PROFILE_IDS, GATE_PROFILE_TABLE, } from './compatibility.js';
 export { ACTIVE_COMPATIBILITY_PROFILE_IDS, COMPATIBILITY_PROFILES, GATE_VERSION, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, resolveCompatibilityProfile, } from './compatibility.js';
@@ -40,6 +49,8 @@ export const CONNECTION_PACKAGE = '@deepseek-ai/dsh-client-connection';
 export const GATE_RUNTIME_PACKAGE = '@deepseek-ai/dsh';
 /** 探针锚点（顺序即求值顺序）：宿主 runtime 本体在前，被替换对象在后。 */
 export const GATE_ANCHOR_PACKAGES = [GATE_RUNTIME_PACKAGE, CONNECTION_PACKAGE];
+/** desktop 宿主信号包：仅 desktop runtime 携带；解析出合法 URL 即判定 desktop（web-only 门控）。 */
+export const DESKTOP_HOST_PACKAGE = '@deepseek-ai/dsh-desktop-host';
 /**
  * 从已解析 URL 提取 pnpm store 版本段的正则源（`+name@VER_` / `+name@VER/`）。
  * 探针表达式内嵌的正则由此单一实现生成；仅匹配 pnpm 布局，非 pnpm 布局
@@ -55,7 +66,7 @@ const GATE_ANCHOR_TABLE = GATE_ANCHOR_PACKAGES.map((pkg) => [pkg, versionSegment
 // 逐锚点解析 `锚点包/package.json`，返回完整 runtime/connection pair 对应的
 // profile id；candidate profile 也可被识别，是否允许激活由下方 boolean probe
 // 根据 profile status 决定。解析失败、未知 pair 或混合 pair 一律返回 null。
-export const GATE_PROFILE_EXPRESSION = `(() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = ${JSON.stringify(GATE_ANCHOR_TABLE)}; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = ${JSON.stringify(GATE_PROFILE_TABLE)}; for (const profile of profiles) { if (profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()`;
+export const GATE_PROFILE_EXPRESSION = `(() => { try { const internal = ctx.loader && ctx.loader.internal; if (!internal || typeof internal.resolveSync !== 'function') return null; const desktopSpecifier = ${JSON.stringify(DESKTOP_HOST_PACKAGE)} + '/package.json'; let hostProfile; try { const desktopResolved = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier: desktopSpecifier, attributes: {} }) : internal.resolveSync(desktopSpecifier, ctx.baseUrl, {}); const desktopUrl = desktopResolved === null || typeof desktopResolved !== 'object' ? undefined : desktopResolved.url; hostProfile = typeof desktopUrl === 'string' ? 'desktop' : 'web'; } catch (hostError) { hostProfile = 'web'; } const versionOfUrl = (url, patternSource) => { if (typeof url !== 'string') return null; const decoded = decodeURIComponent(url); const segmented = decoded.match(new RegExp(patternSource)); if (segmented !== null) return segmented[1]; if (decoded.slice(0, 5) === 'file:') { const processRef = globalThis.process; if (processRef === null || typeof processRef !== 'object' || typeof processRef.getBuiltinModule !== 'function') return null; const fsModule = processRef.getBuiltinModule('node:fs'); const urlModule = processRef.getBuiltinModule('node:url'); if (!fsModule || typeof fsModule.readFileSync !== 'function' || !urlModule || typeof urlModule.fileURLToPath !== 'function') return null; const manifest = JSON.parse(fsModule.readFileSync(urlModule.fileURLToPath(url), 'utf8')); return manifest !== null && typeof manifest === 'object' && typeof manifest.version === 'string' ? manifest.version : null; } return null; }; const anchors = ${JSON.stringify(GATE_ANCHOR_TABLE)}; const versions = []; for (const [anchorPackage, patternSource] of anchors) { const specifier = anchorPackage + '/package.json'; let url; try { url = internal.version === 'v2' ? internal.resolveSync(ctx.baseUrl, { specifier, attributes: {} }).url : internal.resolveSync(specifier, ctx.baseUrl, {}).url; } catch (gateError) { return null; } let anchorVersion; try { anchorVersion = versionOfUrl(url, patternSource); } catch (gateError) { return null; } if (anchorVersion === null) return null; versions.push(anchorVersion); } const profiles = ${JSON.stringify(GATE_PROFILE_TABLE)}; for (const profile of profiles) { if (profile.hostProfiles.includes(hostProfile) && profile.pairs.some((pair) => pair.runtime === versions[0] && pair.connection === versions[1])) return profile.id; } return null; } catch (gateError) { return null; } })()`;
 // Boolean activation probe: only active profiles disable the official row.
 // A known candidate profile remains dormant until its host/client adapter is
 // promoted, while the profile expression still exposes its exact pair id.
@@ -73,3 +84,22 @@ export function evaluateGate(ctx) {
     // 与 vendor/loader/src/config/utils.ts 的 evaluate 同语义：with(ctx) + eval。
     return new Function('ctx', 'expr', 'with (ctx) { return eval(expr) }')(ctx, GATE_PROBE_EXPRESSION);
 }
+/**
+ * Node 侧宿主形态检测（apply backstop 镜像）：与 GATE_PROFILE_EXPRESSION 内联检测
+ * 同语义——解析 desktop 信号包得到合法 {url: string} ⇒ 'desktop'；抛错/空值/url
+ * 非字符串 ⇒ 视为包不存在 ⇒ 'web'（fail-closed 兜底是后续版本对判定）。
+ * 调用方需已确认 resolver 存在（assertGateBackstop 的 presence 检查先于此执行）。
+ */
+export function detectHostProfile(internal, baseUrl) {
+    const specifier = `${DESKTOP_HOST_PACKAGE}/package.json`;
+    try {
+        const resolved = internal.version === 'v2'
+            ? internal.resolveSync(baseUrl, { specifier, attributes: {} })
+            : internal.resolveSync(specifier, baseUrl, {});
+        const url = resolved?.url;
+        return typeof url === 'string' ? 'desktop' : 'web';
+    }
+    catch {
+        return 'web';
+    }
+}

package/lib/host.js

@@ -9,7 +9,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import z from '@deepseek-ai/schemastery';
-import { CONNECTION_PACKAGE, GATE_ANCHOR_PACKAGES, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, } from './gate.js';
+import { CONNECTION_PACKAGE, DESKTOP_HOST_PACKAGE, detectHostProfile, GATE_ANCHOR_PACKAGES, GATE_VERSIONS, isActiveCompatibilityProfileId, resolveActiveCompatibilityProfile, } from './gate.js';
 import { COMPATIBILITY_PROFILES } from './compatibility.js';
 import { loadRuntimeConnectionModule } from './connection-runtime.js';
 import { createLegacyWebRuntime } from './adapters/legacy-web.js';
@@ -44,6 +44,11 @@ function profileById(value) {
         return undefined;
     return COMPATIBILITY_PROFILES.find((profile) => profile.id === value && profile.status === 'active');
 }
+/**
+ * direct（无 loader/fiber entry）上下文的 profile 兜底：仅纯单测/dev 树可达。
+ * 宿主形态按 'web' 处理（dev 树即 web）——desktop 判定需要 resolver，真 desktop
+ * 上必然先经过 assertGateBackstop 的镜像检测 fail loud，不会走到这里。
+ */
 function directProfile(requestedProfile) {
     if (requestedProfile !== undefined) {
         const requested = profileById(requestedProfile);
@@ -82,6 +87,13 @@ function assertGateBackstop(ctx, requestedProfile) {
     }
     const baseUrl = ctx.baseUrl ?? '';
     const internal = loader.internal;
+    // 宿主 profile 镜像检测（2026-10-07 web-only 门控，纵深防御层）：desktop 信号在
+    // 场 ⇒ fail loud。正常流程第①道探针已休眠、apply 不会被调；此层只防「patch 激活
+    // 但不应激活」。语义与 detectHostProfile/表达式层一致（docs/COMPATIBILITY.md §7）。
+    const hostProfile = detectHostProfile(internal, baseUrl);
+    if (hostProfile === 'desktop') {
+        throw new Error(`@iasiv5/dsh-skip-browser-auth: desktop profile not supported; disable or uninstall the plugin (${DESKTOP_HOST_PACKAGE} present)`);
+    }
     const versions = [];
     for (const anchorPackage of GATE_ANCHOR_PACKAGES) {
         const specifier = `${anchorPackage}/package.json`;
@@ -98,7 +110,7 @@ function assertGateBackstop(ctx, requestedProfile) {
         }
         versions.push(manifest.version);
     }
-    const profile = resolveActiveCompatibilityProfile(versions[0], versions[1]);
+    const profile = resolveActiveCompatibilityProfile(versions[0], versions[1], hostProfile);
     if (profile === undefined) {
         throw new Error(`@iasiv5/dsh-skip-browser-auth: gate anchors ${GATE_ANCHOR_PACKAGES[0]}=${String(versions[0])}, ${GATE_ANCHOR_PACKAGES[1]}=${String(versions[1])} do not resolve to one active compatibility profile; whitelist is ${WHITELIST_TEXT}; disable or uninstall the plugin`);
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@iasiv5/dsh-skip-browser-auth",
-  "version": "0.3.5",
-  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1、0.1.5-rc.1/rc.2、0.1.7-rc.1/rc.2 与 0.2.0-rc.1/rc.2，详见仓库。",
+  "version": "0.3.6",
+  "description": "替换官方 Connection 提供方跳过 BrowserAuth，免输 Token；已适配 0.1.2-rc.1、0.1.5-rc.1/rc.2、0.1.7-rc.1/rc.2 与 0.2.0-rc.1/rc.2，详见仓库。仅支持 web profile；desktop profile（存在 dsh-desktop-host 的环境）自动休眠，属设计行为。",
   "keywords": [
     "dsh",
     "deepseek-harness",
@@ -43,6 +43,7 @@
     "test:rc15-fixture": "node scripts/install-rc15-fixture.mjs",
     "test:rc17-fixture": "node scripts/install-rc17-fixture.mjs",
     "test:all": "npm run test:rc2-fixture && npm run test:rc15-fixture && npm run test:rc17-fixture && npm run build && npm run typecheck && npm test",
+    "audit-candidate": "node scripts/audit-candidate.mjs",
     "prepare": "npm run build"
   },
   "dsh": {