@riceawa/dsh-lan-gateway 0.5.0 → 0.5.1

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/DeepSeek%20Harness-4d6bfe?logo=deepseek&logoColor=fff&style=flat-square" alt="DeepSeek Harness" />
-  <img src="https://img.shields.io/badge/version-0.5.0-2b7fff?style=flat-square" alt="version 0.5.0" />
+  <img src="https://img.shields.io/badge/version-0.5.1-2b7fff?style=flat-square" alt="version 0.5.1" />
   <img src="https://img.shields.io/badge/TLS-8b5cf6?logo=lock&logoColor=fff&style=flat-square" alt="TLS" />
   <img src="https://img.shields.io/github/license/rice-awa/dsh-lan-gateway?style=flat-square" alt="MIT license" />
 </p>
@@ -229,6 +229,24 @@ IPv6 的 `fe80::/10`（link-local）与 `127.0.0.0/8` / `::1` 归类为 LAN/loop
 - **WebSocket**：`/api` 升级请求同样过登录校验、同源 Origin 校验，再拼接转发给 dsh，
   并纳入会话撤销（epoch 变化即断开）。
 
+## 版本兼容（0.5.0 的加载失败与修复）
+
+0.5.0 及更早版本装在 **dsh ≥ 0.1.2-rc.1** 上会让整个 plugin tree 起不来：
+
+```
+Error: dsh: plugin tree failed to load: ...
+SyntaxError: The requested module '@deepseek-ai/dsh-settings' does not provide an export named 'settingsNamespace'
+```
+
+`@deepseek-ai/dsh-settings` 自 `0.1.2-rc.1` 起删掉了 `settingsNamespace()` 这个品牌化辅助
+函数（命名空间改为 `register()` 内部校验的普通字符串字面量），旧版插件在 ESM 链接期就失败；
+cordis 的 include 一旦失败会连坐整棵树，所以表现是**所有插件都起不来**，而报错点看着像隔壁
+插件的名字。0.5.1 移除了该导入——运行时行为不变（新旧版本的 `register()` 都按同一个
+`NAMESPACE_PATTERN` 校验并原样接受这个字面量），因此 0.5.1 在 `0.1.0-rc.6` 到 `0.1.5-rc.2`
+的底座上都能加载。
+
+升级：`pnpm add @riceawa/dsh-lan-gateway@0.5.1`（或重新 `pnpm install` 走 link/github 安装）。
+
 ## 从 v0.4（及更早）升级
 
 1. **把底座升级到 dsh ≥ 0.1.2-rc.1**（含 QVD-2026-57410 上游修复）。低于该版本时本插件

package/lib/index.js

@@ -1,6 +1,5 @@
 import { X509Certificate, createHmac, createSign, generateKeyPairSync, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import z from "@deepseek-ai/schemastery";
-import { settingsNamespace } from "@deepseek-ai/dsh-settings";
 import http from "node:http";
 import https from "node:https";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -1264,8 +1263,13 @@ var UpstreamSessionRelay = class {
 const name = "dsh-lan-gateway";
 /** Requires the web server service (binds before this row's apply runs) and the tool registry. */
 const inject = ["webServer", "tools"];
-/** The `lan-gateway` user-settings namespace, mirroring the composition schema. */
-const NS = settingsNamespace("lan-gateway");
+/**
+* The `lan-gateway` user-settings namespace, mirroring the composition schema.
+* A plain string literal: dsh-settings dropped the `settingsNamespace()` brand
+* helper in 0.1.2-rc.1 and `register` validates the literal itself, so this
+* shape works against both that release line and the older branded one.
+*/
+const NS = "lan-gateway";
 /** Optional config keys: an empty submitted value clears them back to the composition layer. */
 const OPTIONAL_CONFIG_KEYS = /* @__PURE__ */ new Set([
 	"dshTargetPort",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@riceawa/dsh-lan-gateway",
   "description": "LAN/internet reverse-proxy gateway for the DeepSeek Harness web GUI: binds 0.0.0.0 and forwards to the loopback dsh web server. Default-deny: every source (loopback, LAN, internet) must sign in with an HMAC session cookie unless lanPasswordless is explicitly enabled; against dsh >= 0.1.2-rc.1 the gateway relays one shared upstream browser session, so the harness's own authorization still gates every request. Fail-closed start guard (password required, plaintext needs an explicit opt-in), session revocation by epoch (password changes and secret rotation kill cookies and live WebSockets), same-site/Origin fence on HTTP and WebSocket upgrades, optional TLS (auto self-signed or user-supplied certs), and a Settings → Plugins card for live adjustment of port, CIDRs, auth, and TLS. Includes an insecure-origin UUID shim client bundle: on gateway-served plain-HTTP origins browsers lack crypto.randomUUID, so the client half patches a getRandomValues-backed randomUUID onto the Crypto prototype, fixing workspace open over LAN without touching DSH source.",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -22,13 +22,6 @@
     "skills",
     "cordis.patch.yml"
   ],
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "test": "vitest run",
-    "build:client": "tsdown",
-    "prepack": "tsdown"
-  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -42,18 +35,22 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-settings": "^0.1.0-rc.6 || ^0.1.0",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ^0.1.0",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-settings": "^0.1.2-rc.1 || ^0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1 || ^0.1.5-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-settings": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "3.18.1",
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-brand": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.1.5-rc.2",
+    "@deepseek-ai/schemastery": "3.18.2",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.1",
     "react": "^18.2.0",
@@ -82,5 +79,11 @@
   "bugs": {
     "url": "https://github.com/rice-awa/dsh-lan-gateway/issues"
   },
-  "homepage": "https://github.com/rice-awa/dsh-lan-gateway#readme"
-}
+  "homepage": "https://github.com/rice-awa/dsh-lan-gateway#readme",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "test": "vitest run",
+    "build:client": "tsdown"
+  }
+}

package/src/index.ts

@@ -42,7 +42,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import { randomBytes } from 'node:crypto'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import z from '@deepseek-ai/schemastery'
-import { settingsNamespace, type SettingsScope } from '@deepseek-ai/dsh-settings'
+import type { SettingsScope } from '@deepseek-ai/dsh-settings'
 import { DEFAULT_LAN_CIDR_STRINGS, originMatchesHost } from './auth.ts'
 import { LanGateway } from './gateway.ts'
 import { readBody } from './login.ts'
@@ -160,8 +160,13 @@ export interface Config {
   trustedTerminator?: string
 }
 
-/** The `lan-gateway` user-settings namespace, mirroring the composition schema. */
-const NS = settingsNamespace('lan-gateway')
+/**
+ * The `lan-gateway` user-settings namespace, mirroring the composition schema.
+ * A plain string literal: dsh-settings dropped the `settingsNamespace()` brand
+ * helper in 0.1.2-rc.1 and `register` validates the literal itself, so this
+ * shape works against both that release line and the older branded one.
+ */
+const NS = 'lan-gateway'
 
 /** Optional config keys: an empty submitted value clears them back to the composition layer. */
 const OPTIONAL_CONFIG_KEYS = new Set(['dshTargetPort', 'tlsCertPath', 'tlsKeyPath', 'trustedTerminator'])