@michengai/dsh-skills-manager 0.1.28 → 0.1.30

package/CHANGELOG.md

@@ -4,6 +4,20 @@
 
 The five most recent published versions are listed below.
 
+## 0.1.30 — 2026-08-28
+
+- Fixed reverse-proxy domains and LAN IPs already trusted by DSH Web through `--trusted-host` still being rejected by Skills Manager's own loopback-only Host fence.
+- Reused `webRuntime.trustedHosts` with DSH-compatible authority semantics: port-less entries match any port, explicit ports match exactly, and unknown Hosts, non-canonical authorities, foreign Origins, and explicit cross-site requests remain blocked.
+- Added isolated real-DSH startup verification and regression coverage for domains, LAN IPs, ports, Origins, cross-site requests, and mutation markers.
+
+Published package: [`@michengai/dsh-skills-manager@0.1.30`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.30).
+
+## 0.1.29 — 2026-08-28
+
+- Restored the standard DSH README header navigation: the Changelog link now sits between the language switch and the Apache-2.0 license link.
+
+Published package: [`@michengai/dsh-skills-manager@0.1.29`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.29).
+
 ## 0.1.28 — 2026-08-28
 
 - Moved the release-history entry point to the top of the README so package updates are immediately discoverable.
@@ -25,19 +39,3 @@ Published package: [`@michengai/dsh-skills-manager@0.1.27`](https://www.npmjs.co
 - Replaced the large-string Base64 validation regex with stack-safe validation to prevent multi-MiB files from exhausting the JavaScript call stack.
 
 Published package: [`@michengai/dsh-skills-manager@0.1.26`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.26).
-
-## 0.1.25 — 2026-08-27
-
-- Added provider-backed loading for public Agents, Codex, Claude, Gemini, and OpenCode while keeping external source files read-only and persisting toggles in manager state.
-- Added Markdown details, diagnostics, conversational creation, recoverable Trash, and second-stage permanent deletion.
-- Replaced chained importing with one upload dialog for `.zip`, skill folders, and a single `SKILL.md`, with path, size, count, and archive safety limits.
-- Fixed corrupted-state overwrite, trash rollback data loss, Windows `EPERM` publication failures, and the missing Repair-and-enable payload field.
-
-Published package: [`@michengai/dsh-skills-manager@0.1.25`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.25).
-
-## 0.1.24 — 2026-08-23
-
-- Added bilingual changelogs covering the five most recent releases.
-- Linked the release history from both README editions and included it in the npm package.
-
-Published package: [`@michengai/dsh-skills-manager@0.1.24`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.24).

package/CHANGELOG.zh-CN.md

@@ -4,6 +4,20 @@
 
 以下记录最近发布的五个版本。
 
+## 0.1.30 — 2026-08-28
+
+- 修复 DSH Web 已通过 `--trusted-host` 信任的反向代理域名或局域网 IP，仍被 Skills Manager 自身 loopback-only Host 校验拒绝的问题。
+- 复用 `webRuntime.trustedHosts`，按 DSH 的 authority 语义支持无端口任意端口匹配和带端口精确匹配，同时继续拒绝未知 Host、非规范 authority、异源 Origin 与显式 cross-site 请求。
+- 补充真实 DSH 隔离启动验证以及域名、LAN IP、端口、Origin、跨站请求和写接口标记的回归测试。
+
+发布包：[`@michengai/dsh-skills-manager@0.1.30`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.30)。
+
+## 0.1.29 — 2026-08-28
+
+- 恢复 DSH 系列 README 的标准头部导航：更新日志入口位于语言切换与 Apache-2.0 许可证链接之间。
+
+发布包：[`@michengai/dsh-skills-manager@0.1.29`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.29)。
+
 ## 0.1.28 — 2026-08-28
 
 - 将 README 中的更新日志入口前移到页面顶部，打开项目即可看到发布历史。
@@ -25,19 +39,3 @@
 - 将大字符串 Base64 正则校验改为栈安全校验，避免数 MiB 文件耗尽 JavaScript 调用栈。
 
 发布包：[`@michengai/dsh-skills-manager@0.1.26`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.26)。
-
-## 0.1.25 — 2026-08-27
-
-- 新增公共 Agent、Codex、Claude、Gemini 与 OpenCode 技能源加载；启停策略仅写入管理器状态，不修改外部源文件。
-- 新增正文详情、格式诊断、对话创建、可恢复回收站及二次永久删除。
-- 导入改为单弹窗流程，统一支持 `.zip`、技能文件夹和单个 `SKILL.md`，并补充路径、大小、数量与归档安全边界。
-- 修复损坏状态文件覆盖、回收站回滚丢失、Windows `EPERM` 发布失败和「修复并启用」字段缺失等问题。
-
-发布包：[`@michengai/dsh-skills-manager@0.1.25`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.25)。
-
-## 0.1.24 — 2026-08-23
-
-- 新增中英文更新日志，展示最近五个发布版本。
-- 在中英文 README 中加入更新日志入口，并将日志纳入 npm 包。
-
-发布包：[`@michengai/dsh-skills-manager@0.1.24`](https://www.npmjs.com/package/@michengai/dsh-skills-manager/v/0.1.24)。

package/README.md

@@ -8,7 +8,7 @@
 
   **Load and safely manage skills from DSH and common local Agents**
 
-  [简体中文](README.zh-CN.md) · [Apache-2.0](LICENSE)
+  [简体中文](README.zh-CN.md) · [Changelog](CHANGELOG.md) · [Apache-2.0](LICENSE)
 
   [![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
   [![npm package](https://img.shields.io/npm/v/%40michengai%2Fdsh-skills-manager.svg?label=npm%20package)](https://www.npmjs.com/package/@michengai/dsh-skills-manager)
@@ -19,9 +19,6 @@
 
 > DSH Skills Manager is a community-maintained DeepSeek Harness (DSH) plugin, not an official DeepSeek AI product.
 
-## Changelog
-
-See [CHANGELOG.md](CHANGELOG.md) for the five most recent releases.
 
 ## Features
 
@@ -159,9 +156,9 @@ Escape closes only the frontmost upload or confirmation dialog and leaves Settin
 
 - Enable, disable, and delete accept only one ordinary skill-name path segment.
 - Replacements copy to a temporary sibling path first and keep the original until that succeeds.
-- All endpoints, including GET `/state`, accept only loopback `Host` values (`localhost`, `127.0.0.1`, `[::1]`).
-- Write endpoints also require JSON and the DSH client request marker, so cross-site browser requests cannot trigger local file operations.
-- Import accepts the local path the user selected. The HTTP API trusts loopback callers only; do not expose the host web server beyond this machine.
+- Every endpoint, including GET `/state`, accepts only a loopback `Host` or a canonical `host[:port]` that the DSH Web runtime already trusts through its LAN bind and `--trusted-host`; unknown hosts still receive 403.
+- Browser requests must also carry a same-origin `Origin` when present and must not be marked cross-site; write endpoints continue to require JSON and the DSH client request marker.
+- Import accepts the local path selected by the user. The Host trust fence prevents DNS rebinding but is not authentication; reverse-proxy and LAN deployments still need authentication, a VPN, or network access controls.
 
 ## Secondary development
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
   **在 DeepSeek Harness 中统一加载并安全管理本机 Agent Skills**
 
-  [English](README.md) · [Apache-2.0](LICENSE)
+  [English](README.md) · [更新日志](CHANGELOG.zh-CN.md) · [Apache-2.0](LICENSE)
 
   [![许可证：Apache-2.0](https://img.shields.io/badge/许可证-Apache--2.0-blue.svg)](LICENSE)
   [![npm package](https://img.shields.io/npm/v/%40michengai%2Fdsh-skills-manager.svg?label=npm%20package)](https://www.npmjs.com/package/@michengai/dsh-skills-manager)
@@ -19,9 +19,6 @@
 
 > DSH Skills Manager 是社区维护的 DeepSeek Harness（DSH）插件，并非 DeepSeek AI 官方产品。
 
-## 更新日志
-
-最近五个发布版本见 [CHANGELOG.zh-CN.md](CHANGELOG.zh-CN.md)。
 
 ## 功能概览
 
@@ -159,9 +156,9 @@ dsh --profile web --dump-config
 
 - 启用、停用和删除只接受单个普通技能名称，目录穿越名称会被拒绝。
 - 覆盖前先复制到同目录临时路径；复制成功前不会改动现有技能。
-- 全部接口（含 GET `/state`）只接受 loopback `Host`（`localhost`、`127.0.0.1`、`[::1]`）。
-- 写入接口还要求 JSON 与 DSH 客户端请求标记，跨站浏览器请求不能触发本地文件操作。
-- 导入接受用户选定的本机路径。HTTP 接口只信任 loopback 来源，不要把宿主 webServer 暴露到非本机地址。
+- 全部接口（含 GET `/state`）只接受 loopback `Host`，或 DSH Web runtime 已通过 LAN 绑定和 `--trusted-host` 明确信任的 `host[:port]`；未知 Host 继续返回 403。
+- 浏览器请求还必须满足同源 `Origin` 且不能标记为 cross-site；写入接口继续要求 JSON 与 DSH 客户端请求标记。
+- 导入接受用户选定的本机路径。Host 信任栅栏用于防 DNS rebinding，不是身份认证；通过反向代理或局域网提供服务时，仍应配置认证、VPN 或网络访问控制。
 
 ## 二次开发
 

package/lib/index.js

@@ -1,7 +1,7 @@
 // dsh-skills-manager host half：设置面板的 HTTP 后端（webServer prefix 路由）
 // - host 路由仅依赖 node: 内置与本地 core.js；ZIP 解压封装在 core
 // - 路由：状态、启停、详情、创建、导入、回收站
-// - 全部接口先校验 loopback Host；写接口再校验请求标记与 JSON
+// - 全部接口先校验 DSH Web 信任的 Host；写接口再校验请求标记与 JSON
 // - $DSH_HOME\skills 可创建、导入、回收、启停；外部 Agent 根只读，由 manager 状态控制加载
 
 import { appendFile, rename, rm, stat } from "node:fs/promises";
@@ -24,7 +24,7 @@ import {
 } from "./core.js";
 
 const name = "skills-manager";
-const inject = ["webServer", "skills", "tools"];
+const inject = ["webServer", "webRuntime", "skills", "tools"];
 const CLIENT_MARKER_HEADER = "x-dsh-skills-manager";
 const MAX_LOG_BYTES = 1 << 20;
 // 文件夹上传允许 64 MiB 原始内容；Base64 会膨胀约 1/3，再为最多 1000 条路径预留余量。
@@ -91,16 +91,80 @@ function readBody(req, limit = 1 << 20) {
   });
 }
 
-/** 只允许 loopback Host，避免 DNS rebinding 读取 /state 或改写本地技能。 */
-function validateLoopbackHost(req) {
-  const host = String(req.headers.host || "").toLowerCase();
-  if (!/^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host)) return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+/** 将裸 `host[:port]` authority 解析为 URL；非法形态返回 undefined。 */
+function parseAuthority(authority) {
+  try {
+    return new URL(`http://${authority}`);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * 返回 authority 的规范形态。用 http/https 双重解析保留显式的 :80 / :443，
+ * 避免默认端口被 WHATWG URL 自动剥离后意外扩大为任意端口授权。
+ */
+function canonicalAuthority(authority, parsed) {
+  const port = parsed.port !== "" ? parsed.port : new URL(`https://${authority}`).port;
+  return port === "" ? parsed.hostname : `${parsed.hostname}:${port}`;
+}
+
+/** 只接受纯净、规范的 host[:port]，拒绝路径、userinfo、空白和非规范端口。 */
+function isCanonicalAuthority(authority, parsed) {
+  return canonicalAuthority(authority, parsed) === authority.toLowerCase();
+}
+
+/** 与 DSH `/api` 信任栅栏一致：localhost、IPv6 loopback 或 IPv4 127/8。 */
+function isLoopbackHostname(hostname) {
+  if (hostname === "localhost" || hostname === "[::1]") return true;
+  const parts = hostname.split(".");
+  return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+
+/** 带端口的 trustedHosts 条目精确匹配；不带端口的条目匹配同主机的任意端口。 */
+function isTrustedAuthority(hostUrl, trustedHosts) {
+  return trustedHosts.some((entry) => {
+    if (typeof entry !== "string") return false;
+    const entryUrl = parseAuthority(entry);
+    if (!entryUrl || !isCanonicalAuthority(entry, entryUrl)) return false;
+    return canonicalAuthority(entry, entryUrl) === entryUrl.hostname
+      ? entryUrl.hostname === hostUrl.hostname
+      : entryUrl.host === hostUrl.host;
+  });
+}
+
+/**
+ * 复用 DSH Web runtime 的 trustedHosts（LAN IP + `--trusted-host`），同时
+ * 保留 loopback 默认值；未知 Host、跨站 Fetch 或异源 Origin 继续拒绝。
+ */
+function validateRequestOrigin(req, trustedHosts = []) {
+  const host = typeof req.headers.host === "string" ? req.headers.host : "";
+  const hostUrl = parseAuthority(host);
+  if (!hostUrl || !isCanonicalAuthority(host, hostUrl)) {
+    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+  }
+  if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) {
+    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+  }
+  if (req.headers["sec-fetch-site"] === "cross-site") {
+    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+  }
+  const origin = req.headers.origin;
+  if (typeof origin === "string") {
+    try {
+      if (new URL(origin).host !== hostUrl.host) {
+        return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+      }
+    } catch {
+      return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+    }
+  }
   return null;
 }
 
 /** 写接口额外要求自定义头与 JSON；自定义头迫使跨站 fetch 预检，且本接口不回 CORS。 */
-function validateMutationRequest(req) {
-  const hostError = validateLoopbackHost(req);
+function validateMutationRequest(req, trustedHosts) {
+  const hostError = validateRequestOrigin(req, trustedHosts);
   if (hostError) return hostError;
   if (req.headers[CLIENT_MARKER_HEADER] !== "1") return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden mutation request" };
   const contentType = String(req.headers["content-type"] || "").split(";", 1)[0].trim().toLowerCase();
@@ -239,6 +303,7 @@ function registerAgentSkillProviders(ctx, invalidators) {
 
 function apply(ctx) {
   const log = makeLog();
+  const trustedHosts = Array.isArray(ctx.webRuntime.trustedHosts) ? ctx.webRuntime.trustedHosts : [];
   const roots = userRoots();
   const rootByKey = Object.fromEntries(roots.map((r) => [r.key, r]));
   const providerInvalidators = new Set();
@@ -297,7 +362,7 @@ function apply(ctx) {
       const u = new URL(req.url, "http://localhost");
       const path = u.pathname.replace(/\/+$/, "");
       try {
-        const hostError = validateLoopbackHost(req);
+        const hostError = validateRequestOrigin(req, trustedHosts);
         if (hostError) {
           json(res, hostError.statusCode, { ok: false, code: hostError.code, error: hostError.error });
           return;
@@ -315,7 +380,7 @@ function apply(ctx) {
           json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` });
           return;
         }
-        const requestError = validateMutationRequest(req);
+        const requestError = validateMutationRequest(req, trustedHosts);
         if (requestError) {
           json(res, requestError.statusCode, { ok: false, code: requestError.code, error: requestError.error });
           return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "description": "NPM-installable DSH Web plugin for safely loading and managing skills across DSH and common local Agents.",
   "license": "Apache-2.0",
   "repository": {