@riceawa/dsh-lan-gateway 0.5.1 → 0.5.2

package/README.md

@@ -229,6 +229,26 @@ IPv6 的 `fe80::/10`（link-local）与 `127.0.0.0/8` / `::1` 归类为 LAN/loop
 - **WebSocket**：`/api` 升级请求同样过登录校验、同源 Origin 校验，再拼接转发给 dsh，
   并纳入会话撤销（epoch 变化即断开）。
 
+## 0.5.2：共享会话中继修复
+
+0.5.0 / 0.5.1 在 **dsh ≥ 0.1.2-rc.1** 上时，网关自己的登录能过，但每一个转发请求都被上游
+401 拒绝，浏览器只看到：
+
+```
+dsh web authentication required; reopen the URL printed by dsh web.
+```
+
+问题出在共享上游会话中继的 cookie 匹配：插件用 `dsh-auth-=` 这个前缀去找上游签发的会话
+cookie，而 dsh 实际签发的名字是 `dsh-auth-<base64url(sha256(authority))>` —— 前缀后面永远
+跟哈希而不是 `=`，匹配必然为空。令牌换取本身是好的（`GET /?token=…` 确实发出、也拿到了
+`Set-Cookie`），但那条 cookie 在这一步被丢弃，转发请求全部以匿名身份发出。0.5.2 改为
+「名字以 `dsh-auth-` 开头且后面还有内容」，并新增 `tests/upstream-session.test.ts`：用真实
+回环 HTTP 服务端跑完整换取链路（集成测试注入的是假会话对象，正好绕过了这段）。
+
+同一失效域还顺带修掉一个启动竞态：`listenerKey` 现在把「中继是否可用」计入重启判据。
+监听器若早于 `connection` 服务启动（因此没有中继），会在服务挂载后自动重启，而不是一直
+匿名转发、状态里却写着 relay active。
+
 ## 版本兼容（0.5.0 的加载失败与修复）
 
 0.5.0 及更早版本装在 **dsh ≥ 0.1.2-rc.1** 上会让整个 plugin tree 起不来：
@@ -311,6 +331,8 @@ pnpm test
 # ✓ tests/uuid-shim.test.ts             ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
 # ✓ tests/x509.test.ts                  ( 6) 自签名证书 DER/SAN/签名/TLS 握手
 # ✓ tests/tls.test.ts                   ( 7) 证书持久化 / 重生成 / 自定义证书加载
+# ✓ tests/upstream-session.test.ts      ( 4) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
+#                                            invalidate 重获取
 ```
 
 ## 安全评估与修复记录

package/lib/index.js

@@ -1155,6 +1155,22 @@ function nameValueOnly(setCookie) {
 	const semi = setCookie.indexOf(";");
 	return (semi === -1 ? setCookie : setCookie.slice(0, semi)).trim();
 }
+/** The cookie name of a `Set-Cookie` string (`''` when it is malformed). */
+function cookieNameOf(setCookie) {
+	const eq = setCookie.indexOf("=");
+	return eq === -1 ? "" : setCookie.slice(0, eq).trim();
+}
+/**
+* Whether a `Set-Cookie` string is the upstream browser-session cookie. The
+* name upstream mints is `dsh-auth-<base64url(sha256(authority))>`: the prefix
+* is followed by the authority hash, never by `=` itself, so the test is a
+* prefix plus at least one character — matching on `dsh-auth-=` finds nothing
+* and silently relays every request anonymously.
+*/
+function isUpstreamSessionCookie(setCookie) {
+	const name = cookieNameOf(setCookie);
+	return name.startsWith(UPSTREAM_COOKIE_PREFIX) && name.length > 9;
+}
 /** Pull the Max-Age attribute (seconds) out of a Set-Cookie string, if any. */
 function maxAgeSeconds(setCookie) {
 	const match = /\bMax-Age=(\d+)\b/i.exec(setCookie);
@@ -1192,7 +1208,7 @@ function exchange(url, authority, port) {
 				resolve(void 0);
 				return;
 			}
-			const raw = (Array.isArray(setCookies) ? setCookies : [setCookies]).find((value) => value.startsWith(`${UPSTREAM_COOKIE_PREFIX}=`));
+			const raw = (Array.isArray(setCookies) ? setCookies : [setCookies]).find(isUpstreamSessionCookie);
 			if (raw === void 0) {
 				resolve(void 0);
 				return;
@@ -1320,8 +1336,15 @@ function resolveTls(cfg) {
 	});
 	return material;
 }
-/** Config fields that require a listener restart when they change. */
-function listenerKey(cfg) {
+/**
+* Config fields that require a listener restart when they change, plus whether
+* a shared upstream session relay is available at all. The relay flag belongs
+* in the key: a listener that started before the `connection` service appeared
+* was built without a relay and must restart once the service attaches,
+* otherwise it silently forwards every request anonymously (the upstream 401s)
+* while the status line still claims the relay is active.
+*/
+function listenerKey(cfg, relayAvailable) {
 	return JSON.stringify([
 		cfg.gatewayPort,
 		cfg.dshTargetPort,
@@ -1336,7 +1359,8 @@ function listenerKey(cfg) {
 		cfg.tlsSelfSignedHosts,
 		cfg.tlsCertMaxAgeDays,
 		cfg.allowInsecurePlaintext,
-		cfg.trustedTerminator
+		cfg.trustedTerminator,
+		relayAvailable
 	]);
 }
 /** One-line TLS description for status output. */
@@ -1426,7 +1450,7 @@ function apply(ctx, config) {
 		}, state);
 		await next.listen();
 		gateway = next;
-		startedWith = listenerKey(cfg);
+		startedWith = listenerKey(cfg, makeRelay !== void 0);
 		ctx.logger.info(`dsh-lan-gateway: listening on 0.0.0.0:${cfg.gatewayPort}${tls !== void 0 ? " (TLS)" : ""} -> 127.0.0.1:${dshPort}${encryptedIngress ? "" : " (plaintext, explicit allowInsecurePlaintext)"}${makeRelay !== void 0 ? " [shared upstream session relay]" : " [no upstream session relay: base has no browser-session auth]"}`);
 	};
 	const stopGateway = async () => {
@@ -1448,7 +1472,7 @@ function apply(ctx, config) {
 				if (gateway === void 0) {
 					if (shouldRun) await startGateway(cfg);
 				} else if (!shouldRun) await stopGateway();
-				else if (startedWith !== listenerKey(cfg)) {
+				else if (startedWith !== listenerKey(cfg, makeRelay !== void 0)) {
 					await stopGateway();
 					await startGateway(cfg);
 				}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@riceawa/dsh-lan-gateway",
   "description": "LAN/internet reverse-proxy gateway for the DeepSeek Harness web GUI: binds 0.0.0.0 and forwards to the loopback dsh web server. Default-deny: every source (loopback, LAN, internet) must sign in with an HMAC session cookie unless lanPasswordless is explicitly enabled; against dsh >= 0.1.2-rc.1 the gateway relays one shared upstream browser session, so the harness's own authorization still gates every request. Fail-closed start guard (password required, plaintext needs an explicit opt-in), session revocation by epoch (password changes and secret rotation kill cookies and live WebSockets), same-site/Origin fence on HTTP and WebSocket upgrades, optional TLS (auto self-signed or user-supplied certs), and a Settings → Plugins card for live adjustment of port, CIDRs, auth, and TLS. Includes an insecure-origin UUID shim client bundle: on gateway-served plain-HTTP origins browsers lack crypto.randomUUID, so the client half patches a getRandomValues-backed randomUUID onto the Crypto prototype, fixing workspace open over LAN without touching DSH source.",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -22,6 +22,13 @@
     "skills",
     "cordis.patch.yml"
   ],
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "test": "vitest run",
+    "build:client": "tsdown",
+    "prepack": "tsdown"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -79,11 +86,5 @@
   "bugs": {
     "url": "https://github.com/rice-awa/dsh-lan-gateway/issues"
   },
-  "homepage": "https://github.com/rice-awa/dsh-lan-gateway#readme",
-  "scripts": {
-    "build": "tsdown",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "test": "vitest run",
-    "build:client": "tsdown"
-  }
-}
+  "homepage": "https://github.com/rice-awa/dsh-lan-gateway#readme"
+}

package/src/index.ts

@@ -241,8 +241,15 @@ function resolveTls(cfg: Config): TlsMaterial | undefined {
   return material
 }
 
-/** Config fields that require a listener restart when they change. */
-function listenerKey(cfg: Config): string {
+/**
+ * Config fields that require a listener restart when they change, plus whether
+ * a shared upstream session relay is available at all. The relay flag belongs
+ * in the key: a listener that started before the `connection` service appeared
+ * was built without a relay and must restart once the service attaches,
+ * otherwise it silently forwards every request anonymously (the upstream 401s)
+ * while the status line still claims the relay is active.
+ */
+function listenerKey(cfg: Config, relayAvailable: boolean): string {
   return JSON.stringify([
     cfg.gatewayPort,
     cfg.dshTargetPort,
@@ -258,6 +265,7 @@ function listenerKey(cfg: Config): string {
     cfg.tlsCertMaxAgeDays,
     cfg.allowInsecurePlaintext,
     cfg.trustedTerminator,
+    relayAvailable,
   ])
 }
 
@@ -358,7 +366,7 @@ export function apply(ctx: Context, config: Config): void {
     }, state)
     await next.listen()
     gateway = next
-    startedWith = listenerKey(cfg)
+    startedWith = listenerKey(cfg, makeRelay !== undefined)
     ctx.logger.info(
       `dsh-lan-gateway: listening on 0.0.0.0:${cfg.gatewayPort}${tls !== undefined ? ' (TLS)' : ''}`
       + ` -> 127.0.0.1:${dshPort}${encryptedIngress ? '' : ' (plaintext, explicit allowInsecurePlaintext)'}`
@@ -387,7 +395,7 @@ export function apply(ctx: Context, config: Config): void {
           if (shouldRun) await startGateway(cfg)
         } else if (!shouldRun) {
           await stopGateway()
-        } else if (startedWith !== listenerKey(cfg)) {
+        } else if (startedWith !== listenerKey(cfg, makeRelay !== undefined)) {
           await stopGateway()
           await startGateway(cfg)
         }

package/src/upstream-session.ts

@@ -65,6 +65,24 @@ function nameValueOnly(setCookie: string): string {
   return (semi === -1 ? setCookie : setCookie.slice(0, semi)).trim()
 }
 
+/** The cookie name of a `Set-Cookie` string (`''` when it is malformed). */
+function cookieNameOf(setCookie: string): string {
+  const eq = setCookie.indexOf('=')
+  return eq === -1 ? '' : setCookie.slice(0, eq).trim()
+}
+
+/**
+ * Whether a `Set-Cookie` string is the upstream browser-session cookie. The
+ * name upstream mints is `dsh-auth-<base64url(sha256(authority))>`: the prefix
+ * is followed by the authority hash, never by `=` itself, so the test is a
+ * prefix plus at least one character — matching on `dsh-auth-=` finds nothing
+ * and silently relays every request anonymously.
+ */
+function isUpstreamSessionCookie(setCookie: string): boolean {
+  const name = cookieNameOf(setCookie)
+  return name.startsWith(UPSTREAM_COOKIE_PREFIX) && name.length > UPSTREAM_COOKIE_PREFIX.length
+}
+
 /** Pull the Max-Age attribute (seconds) out of a Set-Cookie string, if any. */
 function maxAgeSeconds(setCookie: string): number | undefined {
   const match = /\bMax-Age=(\d+)\b/i.exec(setCookie)
@@ -111,7 +129,7 @@ function exchange(
         return
       }
       const raw = (Array.isArray(setCookies) ? setCookies : [setCookies])
-        .find((value) => value.startsWith(`${UPSTREAM_COOKIE_PREFIX}=`))
+        .find(isUpstreamSessionCookie)
       if (raw === undefined) {
         resolve(undefined)
         return