@michengai/dsh-skills-manager 1.2.21 → 1.2.22

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.2.22 - 2026-10-29
+
+- Fix 403 Forbidden Host on DSH 0.2.x with LAN IP and remote access (Issue #71):
+  - Completely remove legacy DSH 0.1.x `webRuntime` access, preventing Cordis Context Proxy errors from short-circuiting service fallback;
+  - Fully align with DSH 0.2.x `webStartup` service to properly inherit `--trusted-host` entries;
+  - Admit `--host` listener bind address authorities across arbitrary ports matching host fence semantics, resolving 403 errors when accessing via LAN IP;
+  - Extract authority host from `--public-url` when specified;
+  - Add `DSH_SKILLS_MANAGER_TRUSTED_HOSTS` environment variable fallback (comma-separated list of accepted authorities) for reverse proxy and custom domain deployments.
+
 ## 1.2.21 - 2026-10-28
 
 - Fix Windows transient directory rename locks: Reuse `renameWithRetry` across atomic skill copy, upload staging, skill creation, and repository updates to automatically retry on transient `EPERM`/`EBUSY` locks caused by background filesystem indexers or antivirus scanners, preventing spurious "Import failed" errors.

package/CHANGELOG.zh-CN.md

@@ -2,6 +2,15 @@
 
 [English](CHANGELOG.md)
 
+## 1.2.22 - 2026-10-29
+
+- 修复 DSH 0.2.x 远程访问与局域网 IP 报 403 错误（Issue #71）：
+  - 彻底清理已废弃的 0.1.x `webRuntime` 残留服务访问，消除 Cordis Context Proxy 在属性未声明 inject 时抛错中断回退链的问题；
+  - 全面适配 DSH 0.2.x 的 `webStartup` 启动服务，支持正常读取 `--trusted-host` 声明的 Host 名单；
+  - 适配 `--host` 绑定网卡地址（直连 IP 放行，任意端口匹配，对齐宿主行为），解决局域网直连形态下插件 API 报「禁止的请求来源（非法 Host）」的缺陷；
+  - 支持提取 `--public-url` 声明的 host authority；
+  - 新增 `DSH_SKILLS_MANAGER_TRUSTED_HOSTS` 环境变量，支持逗号分隔的 authority 白名单，为反向代理等复杂部署场景提供免发版放行通道。
+
 ## 1.2.21 - 2026-10-28
 
 - 修复 Windows 下技能导入与更新的瞬时文件锁冲突：在原子复制替换、解压暂存包装、新建技能及仓库更新回滚等路径中全面复用 `renameWithRetry` 重试机制，有效规避 Windows Defender 与系统索引器在瞬时扫描时导致的 `EPERM`/`EBUSY` 抛错，彻底消除界面偶发或高发的「导入失败」报错。

package/README.md

@@ -19,7 +19,7 @@
 
 > DSH Skills Manager is a community-maintained DeepSeek Harness (DSH) plugin, not an official DeepSeek AI product.
 
-This README describes **1.2.21**. Released changes are in the [changelog](CHANGELOG.md).
+This README describes **1.2.22**. Released changes are in the [changelog](CHANGELOG.md).
 
 ## Features
 
@@ -74,7 +74,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 
 Restart DSH, refresh the page, and open **Settings → Skills**. To update, select **Check for updates** or run the installation command again.
 
-- Plugin `1.2.21` is tested with DeepSeek Harness `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, `0.2.1-rc.2`, `0.2.1-rc.3`.
+- Plugin `1.2.22` is tested with DeepSeek Harness `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-rc.1`, `0.2.1-rc.2`, `0.2.1-rc.3`.
 - Host compatibility: Full DeepSeek Harness `0.2.x` line (`>=0.2.0-rc.1 <0.3.0-0`), forwards-compatible with subsequent `0.2.x` releases, alphas, and RCs without requiring routine plugin version bumps. Legacy versions and breaking changes in the `0.3.0` generation are rejected by the version gate. If you still use a `0.1.x` host, install plugin `1.1.23` instead of `@latest`.
 - **Reverse proxy deployment**: Supports hosting DSH behind prefix-stripping reverse proxies (e.g. `/app/dsh/`). API and update endpoints resolve against the page base URI (`document.baseURI`).
 

package/README.zh-CN.md

@@ -19,7 +19,7 @@
 
 > DSH Skills Manager 是社区维护的 DeepSeek Harness（DSH）插件，并非 DeepSeek AI 官方产品。
 
-本文描述 **1.2.21**。已发布变更见[更新日志](CHANGELOG.zh-CN.md)。
+本文描述 **1.2.22**。已发布变更见[更新日志](CHANGELOG.zh-CN.md)。
 
 ## 功能概览
 
@@ -74,7 +74,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 
 安装后重启 DSH 并刷新页面，打开「设置 → 技能」即可使用。更新时可点击「检查更新」，或重新执行安装命令。
 
-- `1.2.21` 已验证兼容 DeepSeek Harness `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2`、`0.2.1-rc.3`。
+- `1.2.22` 已验证兼容 DeepSeek Harness `0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-rc.1`、`0.2.1-rc.2`、`0.2.1-rc.3`。
 - 宿主支持范围：DeepSeek Harness `0.2.x` 全系列（`>=0.2.0-rc.1 <0.3.0-0`），自动支持后续日常小版本、alpha 与 RC，同代宿主升级无需重复等待发版。早期版本与 `0.3.0` 代际破坏性更新由版本门拦截。仍在使用 `0.1.x` 的，请安装插件 `1.1.23`，不要装 `@latest`。
 - **反向代理部署**：支持将 DSH 部署在带路径前缀的反向代理后面（如 `/app/dsh/`），插件 API 统一自动按页面基址（`document.baseURI`）相对解析。
 

package/lib/index.js

@@ -300,16 +300,45 @@ function apply(ctx, config) {
   const log = makeLog();
   const repositories = createRepositoryManager({ log, registeredWorkspaces: () => registeredWorkspacePaths(ctx) });
   const getTrustedHosts = () => {
+    const hosts = [];
     try {
       const rawCtx = ctx;
       const root = rawCtx.root || rawCtx;
-      const candidate = root.webRuntime || root.webStartup;
-      if (candidate && typeof candidate === "object" && Array.isArray(candidate.trustedHosts)) {
-        return candidate.trustedHosts;
+      let startup;
+      try {
+        startup = root.webStartup;
+      } catch {
+      }
+      if (startup && typeof startup === "object") {
+        if (Array.isArray(startup.trustedHosts)) {
+          for (const item of startup.trustedHosts) {
+            if (typeof item === "string" && item.trim()) hosts.push(item.trim());
+          }
+        }
+        if (typeof startup.host === "string" && startup.host.trim()) {
+          const rawHost = startup.host.trim();
+          const zoneAt = rawHost.indexOf("%");
+          const address = zoneAt === -1 ? rawHost : rawHost.slice(0, zoneAt);
+          const normalizedHost = address.includes(":") && !address.startsWith("[") ? `[${address}]` : address;
+          hosts.push(normalizedHost);
+        }
+        if (typeof startup.publicUrl === "string" && startup.publicUrl.trim()) {
+          try {
+            hosts.push(new URL(startup.publicUrl.trim()).host);
+          } catch {
+          }
+        }
       }
     } catch {
     }
-    return [];
+    const envHosts = process.env.DSH_SKILLS_MANAGER_TRUSTED_HOSTS;
+    if (typeof envHosts === "string" && envHosts.trim()) {
+      for (const item of envHosts.split(",")) {
+        const trimmed = item.trim();
+        if (trimmed) hosts.push(trimmed);
+      }
+    }
+    return hosts;
   };
   const findUserRoot = (key) => userRoots().find((root) => root.key === key);
   const providerInvalidators = /* @__PURE__ */ new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "1.2.21",
+  "version": "1.2.22",
   "description": "DSH Skills Manager — 在 DeepSeek Harness 中统一加载并安全管理本机 Agent Skills · Load and safely manage local Agent Skills in DSH",
   "license": "Apache-2.0",
   "repository": {
@@ -43,7 +43,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "test": "node scripts/check-committed-lib.mjs && npm run typecheck && npm run build && node test/build-test.mjs && node test/api-base.test.mjs && node test/route-lifecycle.test.mjs && node test/repositories.test.mjs && node test/repository-install-targets.test.mjs && node test/workspace-target.test.mjs && node test/workspace-routes.test.mjs && node test/workspace-list.test.mjs && node test/destination-picker.test.mjs && node test/workspace-project-page.test.mjs && node test/repository-ui.test.mjs && node test/catalog-skill.test.mjs && node test/skills-sh-catalog.test.mjs && node test/clawhub-catalog.test.mjs && node --test test/catalog-state.test.mjs test/catalog-lifecycle.test.mjs && node test/theme-select.test.mjs && node --test test/antd-theme.browser.test.mjs && node test/host-fallback.test.mjs && node test/repository-routes.test.mjs && node test/core-test.mjs && node test/root-path.test.mjs && node test/custom-sources.test.mjs && node test/disabled-external-native.test.mjs && node test/categories.test.mjs && node test/categories-ui.test.mjs && node --experimental-strip-types --test test/settings-nav-icon.test.mjs && node test/readonly-discovery.test.mjs && node test/project-root-skills.test.mjs && node test/project-sources.test.mjs && node test/locale-test.mjs && node --test test/plugin-updater.test.mjs && node test/plugin-update-locale.test.mjs && node test/client-scope.test.mjs && node test/compatibility-options-test.mjs && node test/sidebar-entry.test.mjs && node --test test/sidebar-entry-lifecycle.test.mjs test/plugin-update-visibility.test.mjs && node test/online-update.test.mjs",
+    "test": "node scripts/check-committed-lib.mjs && npm run typecheck && npm run build && node test/build-test.mjs && node test/api-base.test.mjs && node test/route-lifecycle.test.mjs && node test/repositories.test.mjs && node test/repository-install-targets.test.mjs && node test/workspace-target.test.mjs && node test/workspace-routes.test.mjs && node test/workspace-list.test.mjs && node test/destination-picker.test.mjs && node test/workspace-project-page.test.mjs && node test/repository-ui.test.mjs && node test/catalog-skill.test.mjs && node test/skills-sh-catalog.test.mjs && node test/clawhub-catalog.test.mjs && node --test test/catalog-state.test.mjs test/catalog-lifecycle.test.mjs && node test/theme-select.test.mjs && node --test test/antd-theme.browser.test.mjs && node test/host-fallback.test.mjs && node test/host-fence.test.mjs && node test/repository-routes.test.mjs && node test/core-test.mjs && node test/root-path.test.mjs && node test/custom-sources.test.mjs && node test/disabled-external-native.test.mjs && node test/categories.test.mjs && node test/categories-ui.test.mjs && node --experimental-strip-types --test test/settings-nav-icon.test.mjs && node test/readonly-discovery.test.mjs && node test/project-root-skills.test.mjs && node test/project-sources.test.mjs && node test/locale-test.mjs && node --test test/plugin-updater.test.mjs && node test/plugin-update-locale.test.mjs && node test/client-scope.test.mjs && node test/compatibility-options-test.mjs && node test/sidebar-entry.test.mjs && node --test test/sidebar-entry-lifecycle.test.mjs test/plugin-update-visibility.test.mjs && node test/online-update.test.mjs",
     "verify": "node scripts/sync-hosts.mjs && npm test && npm run pack:check && node test/pack-test.mjs",
     "pack:check": "npm pack --dry-run --json",
     "prepack": "npm run typecheck && npm run build",