@sparkelf/dsh-patch-browser-auth-mode 0.1.0-rc.12

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write patches/npm/browser-auth-mode/README.md
+README.md: 6e514a93ca25599c0daa2f5607bd5eb4db098575
+README.zh.md: 861ecc1f3695f77852919da5fc4b984e98b77db8

package/README.md

@@ -0,0 +1,9 @@
+# @sparkelf/dsh-patch-browser-auth-mode
+
+English | [中文](README.zh.md)
+
+This data-only package adds one explicit `browserAuthentication: required | disabled` policy to official Connection. `required` remains the official default and preserves the process-token exchange, signed cookie, and 401 response. `disabled` creates no launch token or signing record, prints the clean Web URL, admits index requests, and treats Host API requests as authenticated after the independent Host/Origin trust fence succeeds.
+
+Plus selects `disabled` because its accepted local Web workflow prioritizes direct access over browser identity. This exposes the complete Host API, including Shell, files, and Sessions, to every process that can reach an accepted authority; it does not only affect DataOps. The shipped CLI still binds loopback and rejects `--host 0.0.0.0`, while custom trusted authorities remain a deployment responsibility.
+
+The target is exact official source base `0a53fb55bea101816fa226bb964ae2bed71c343b`. The package has no JavaScript entry, lifecycle script, credential material, or fallback variant. Retire it when official DSH exposes an equivalent profile-selected browser-authentication policy.

package/README.zh.md

@@ -0,0 +1,9 @@
+# @sparkelf/dsh-patch-browser-auth-mode
+
+[English](README.md) | 中文
+
+该data-only package为official Connection增加唯一显式`browserAuthentication: required | disabled`策略。`required`保持official default，保留process-token exchange、signed cookie与401 response。`disabled`不创建launch token或signing record，打印clean Web URL，接受index requests，并在独立Host/Origin trust fence通过后把Host API requests视为authenticated。
+
+Plus选择`disabled`，因为其accepted local Web workflow优先保证直接访问，不保留browser identity。该选择会把包含Shell、files与Sessions在内的完整Host API开放给所有能访问accepted authority的进程，并非只影响DataOps。shipped CLI仍绑定loopback并拒绝`--host 0.0.0.0`，custom trusted authorities仍由deployment负责。
+
+target是exact official source base `0a53fb55bea101816fa226bb964ae2bed71c343b`。本package没有JavaScript entry、lifecycle script、credential material或fallback variant。official DSH暴露等价profile-selected browser-authentication policy后retire本package。

package/package.json

@@ -0,0 +1,35 @@
+{
+  "description": "Data-only exact official-source patch adding profile-selected browser authentication policy",
+  "dshPatch": {
+    "formatVersion": 1,
+    "variants": [
+      {
+        "dsh": ">=0.1.2-alpha.2",
+        "file": "./patches/browser-auth-mode.patch",
+        "id": "browser-authentication-policy-mode",
+        "target": {
+          "baseRevision": "0a53fb55bea101816fa226bb964ae2bed71c343b",
+          "kind": "dsh-source",
+          "paths": [
+            "packages/client/connection/"
+          ]
+        }
+      }
+    ]
+  },
+  "files": [
+    "patches/*.patch"
+  ],
+  "license": "MIT",
+  "name": "@sparkelf/dsh-patch-browser-auth-mode",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "directory": "patches/npm/browser-auth-mode",
+    "type": "git",
+    "url": "git+https://github.com/SparkElf/deepseek-harness-plus.git"
+  },
+  "type": "module",
+  "version": "0.1.0-rc.12"
+}

package/patches/browser-auth-mode.patch

@@ -0,0 +1,182 @@
+diff --git a/packages/client/connection/README.i18n.yaml b/packages/client/connection/README.i18n.yaml
+index 528a378161..8baa29134d 100644
+--- a/packages/client/connection/README.i18n.yaml
++++ b/packages/client/connection/README.i18n.yaml
+@@ -2,5 +2,5 @@
+ # side as of the last confirmed-consistent state. Both languages carry equal authority;
+ # after editing either side, bring the other along and re-record with:
+ #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
+-README.md: ee0566bf811a0bad32f7d59b4c8849e26efea613
+-README.zh.md: 48425a428247b7749bf0dd75f592b5f7e4088ef2
++README.md: 6454dfa7d8d69a10480f9bd310325300f7c9cec0
++README.zh.md: 9fd600d1fcf3d9ade970436e544a7d9c3b67fac4
+diff --git a/packages/client/connection/README.md b/packages/client/connection/README.md
+index ee0566bf81..6454dfa7d8 100644
+--- a/packages/client/connection/README.md
++++ b/packages/client/connection/README.md
+@@ -25,18 +25,18 @@ The package carries browser-to-Host Remote calls, exact Fetch responses, and con
+ <a id="use-this-package"></a>
+ ## Use this package
+ 
+-The browser uses HTTP POST for Remote unary calls. API Gateway owns the `/api/remote.mux` WebSocket and its logical streams; in-process compositions provide equivalent Remote streams through `connection.rpc.open` without opening a WebSocket. The Host half owns the sole `/api` route, Fetch bridge, browser authentication, Host/Origin checks, and exact `GET`/`HEAD` route registry. Typert Gateway claims generated Remote endpoints, feature packages register non-JSON responses such as Session-log downloads, and unclaimed requests return 404. Loopback hostname classification remains package-internal to the browser-facing Client state.
++The browser uses HTTP POST for Remote unary calls. API Gateway owns the `/api/remote.mux` WebSocket and its logical streams; in-process compositions provide equivalent Remote streams through `connection.rpc.open` without opening a WebSocket. The Host half owns the sole `/api` route, Fetch bridge, browser-authentication policy, Host/Origin checks, and exact `GET`/`HEAD` route registry. Typert Gateway claims generated Remote endpoints, feature packages register non-JSON responses such as Session-log downloads, and unclaimed requests return 404. Loopback hostname classification remains package-internal to the browser-facing Client state.
+ 
+ -----
+ 
+ <a id="browser-authentication-and-request-trust"></a>
+ ## Browser authentication and request trust
+ 
+-Every Host RPC method and WebSocket stream requires one browser session; there is no method-specific loopback tier. Each process mints a random launch token. `dsh-web-app` prints and opens the ordinary root URL with `?token=...`; `frontend-static` delegates root and index requests to `ctx.connection.authorizeIndex`, which accepts that token only on `GET /`, writes an authority-bound signed cookie, and redirects to clean `/`. A missing, expired, malformed, or wrong-authority cookie returns 401 before RPC dispatch. Static assets remain public. The HTTP carrier accepts no query token outside the root exchange and no Authorization-header token.
++`browserAuthentication` defaults to `required`. In that mode every Host RPC method and WebSocket stream requires one browser session; there is no method-specific loopback tier. Each process mints a random launch token. `dsh-web-app` prints and opens the ordinary root URL with `?token=...`; `frontend-static` delegates root and index requests to `ctx.connection.authorizeIndex`, which accepts that token only on `GET /`, writes an authority-bound signed cookie, and redirects to clean `/`. A missing, expired, malformed, or wrong-authority cookie returns 401 before RPC dispatch. Static assets remain public. The HTTP carrier accepts no query token outside the root exchange and no Authorization-header token.
+ 
+-The cookie signing secret is the owner-scoped `client-connection/browser-session` grant record in `ctx.credentials`. The local provider persists it in `$DSH_HOME/.credentials.yaml`; `BrowserAuth` loads or creates the record during Connection activation and retains the secret in memory, so request authentication is synchronous. Deleting or replacing the record takes effect on the next Connection activation. Cookies carry an absolute issue/expiry interval, defaulting to 30 days through `cookieMaxAgeDays`, and bind the normalized hostname plus port in both their deterministic name and signed payload. They are host-only, `Path=/`, `HttpOnly`, and `SameSite=Strict`; they deliberately omit `Secure` because the shipped server uses loopback HTTP.
++The cookie signing secret is the owner-scoped `client-connection/browser-session` grant record in `ctx.credentials`. The local provider persists it in `$DSH_HOME/.credentials.yaml`; `BrowserAuth` loads or creates the record during Connection activation and retains the secret in memory, so request authentication is synchronous. Deleting or replacing the record takes effect on the next Connection activation. Cookies carry an absolute issue/expiry interval, defaulting to 30 days through `cookieMaxAgeDays`, and bind the normalized hostname plus port in both their deterministic name and signed payload. They are host-only, `Path=/`, `HttpOnly`, and `SameSite=Strict`; they deliberately omit `Secure` because the shipped server uses loopback HTTP. A profile that explicitly selects `browserAuthentication: disabled` creates no launch token or signing record, prints the clean application URL, admits index requests, and treats Host API requests as authenticated after the independent Host/Origin fence succeeds.
+ 
+-Before authentication, every request still passes `src/api-request-trust.ts`. Its `Host` must be loopback or match a `trustedHosts` entry: exact on `host:port`, any port on port-less entries, both sides WHATWG-normalized. An attached `Origin` must equal that Host and `sec-fetch-site: cross-site` is refused. Malformed configured authorities fail plugin load. These checks defend DNS rebinding and cross-site browser requests; they never establish identity. A failed Host/Origin check returns 403, while a trusted but unauthenticated request returns 401. `dsh web --host 0.0.0.0` remains unsupported. Decision records: [browser request trust](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md) and [browser token authentication](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.md).
++Every request first passes `src/api-request-trust.ts`. Its `Host` must be loopback or match a `trustedHosts` entry: exact on `host:port`, any port on port-less entries, both sides WHATWG-normalized. An attached `Origin` must equal that Host and `sec-fetch-site: cross-site` is refused. Malformed configured authorities fail plugin load. These checks defend DNS rebinding and cross-site browser requests; they never establish identity. A failed Host/Origin check returns 403. Under the default required policy, a trusted but unauthenticated request returns 401; the disabled policy proceeds after trust succeeds. `dsh web --host 0.0.0.0` remains unsupported. Decision records: [browser request trust](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md) and [browser token authentication](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.md).
+ 
+ <a id="connection-generation"></a>
+ ## Connection generation
+diff --git a/packages/client/connection/README.zh.md b/packages/client/connection/README.zh.md
+index 48425a4282..9fd600d1fc 100644
+--- a/packages/client/connection/README.zh.md
++++ b/packages/client/connection/README.zh.md
+@@ -25,18 +25,18 @@ kind: "package-reference"
+ <a id="use-this-package"></a>
+ ## 使用本包
+ 
+-浏览器通过 HTTP POST 执行 Remote 一元调用；API Gateway 自己拥有 `/api/remote.mux` WebSocket 及其逻辑流。进程内组合通过 `connection.rpc.open` 提供等价的 Remote 流，不打开 WebSocket。Host half 拥有唯一 `/api` route、Fetch bridge、浏览器认证、Host/Origin 校验与精确 `GET`/`HEAD` 路由注册表。Typert Gateway 认领生成的 Remote endpoint，功能包注册 Session 日志下载等非 JSON 响应，未认领的请求返回 404。Loopback hostname 判定只供浏览器侧当前页面状态使用，留在包内。
++浏览器通过 HTTP POST 执行 Remote 一元调用；API Gateway 自己拥有 `/api/remote.mux` WebSocket 及其逻辑流。进程内组合通过 `connection.rpc.open` 提供等价的 Remote 流，不打开 WebSocket。Host half 拥有唯一 `/api` route、Fetch bridge、浏览器认证策略、Host/Origin 校验与精确 `GET`/`HEAD` 路由注册表。Typert Gateway 认领生成的 Remote endpoint，功能包注册 Session 日志下载等非 JSON 响应，未认领的请求返回 404。Loopback hostname 判定只供浏览器侧当前页面状态使用，留在包内。
+ 
+ -----
+ 
+ <a id="browser-authentication-and-request-trust"></a>
+ ## 浏览器认证与请求信任
+ 
+-每个 Host RPC 方法和 WebSocket stream 都要求同一个浏览器会话，不存在按方法区分的 loopback 层。每个进程生成一个随机启动令牌。`dsh-web-app` 打印并打开带 `?token=...` 的普通根 URL；`frontend-static` 把根路径和 index 请求交给 `ctx.connection.authorizeIndex`，后者只在 `GET /` 接受该令牌，写入绑定 authority 的签名 cookie，再重定向到干净的 `/`。缺失、过期、畸形或 authority 不匹配的 cookie 会在 RPC 分发前得到 401。静态资源保持公开。HTTP 载体不在根路径交换之外接受 query token，也不接受 Authorization header token。
++`browserAuthentication`默认为`required`。在该模式下，每个 Host RPC 方法和 WebSocket stream 都要求同一个浏览器会话，不存在按方法区分的 loopback 层。每个进程生成一个随机启动令牌。`dsh-web-app` 打印并打开带 `?token=...` 的普通根 URL；`frontend-static` 把根路径和 index 请求交给 `ctx.connection.authorizeIndex`，后者只在 `GET /` 接受该令牌，写入绑定 authority 的签名 cookie，再重定向到干净的 `/`。缺失、过期、畸形或 authority 不匹配的 cookie 会在 RPC 分发前得到 401。静态资源保持公开。HTTP 载体不在根路径交换之外接受 query token，也不接受 Authorization header token。
+ 
+-cookie 签名密钥是 `ctx.credentials` 中由 `client-connection/browser-session` 拥有的 grant 记录。本地提供方把它持久化到 `$DSH_HOME/.credentials.yaml`；`BrowserAuth` 在 Connection 激活期间加载或创建该记录，并把密钥留在内存中，因此请求认证同步执行。删除或替换该记录会在下一次 Connection 激活时生效。cookie 携带绝对签发与过期区间，`cookieMaxAgeDays` 默认设为 30 天，并在确定性名称与签名 payload 中同时绑定规范化 hostname 和 port。它是 host-only、`Path=/`、`HttpOnly`、`SameSite=Strict`；随附服务器使用 loopback HTTP，因此刻意不设置 `Secure`。
++cookie 签名密钥是 `ctx.credentials` 中由 `client-connection/browser-session` 拥有的 grant 记录。本地提供方把它持久化到 `$DSH_HOME/.credentials.yaml`；`BrowserAuth` 在 Connection 激活期间加载或创建该记录，并把密钥留在内存中，因此请求认证同步执行。删除或替换该记录会在下一次 Connection 激活时生效。cookie 携带绝对签发与过期区间，`cookieMaxAgeDays` 默认设为 30 天，并在确定性名称与签名 payload 中同时绑定规范化 hostname 和 port。它是 host-only、`Path=/`、`HttpOnly`、`SameSite=Strict`；随附服务器使用 loopback HTTP，因此刻意不设置 `Secure`。显式选择`browserAuthentication: disabled`的profile不创建启动令牌或签名记录，打印clean application URL，接受index requests，并在独立Host/Origin fence通过后把Host API requests视为authenticated。
+ 
+-认证之前，每个请求仍经过 `src/api-request-trust.ts`。其 `Host` 必须是 loopback，或与 `trustedHosts` 条目匹配：带端口的 `host:port` 精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化。若附带 `Origin`，它必须等于该 Host；`sec-fetch-site: cross-site` 一律拒绝。畸形配置 authority 会让插件加载失败。这些检查防御 DNS rebinding 与跨站浏览器请求，绝不建立身份。Host/Origin 校验失败返回 403；Host 可信但未认证的请求返回 401。`dsh web --host 0.0.0.0` 仍不受支持。决策记录：[浏览器请求信任](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md)与[浏览器令牌认证](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.zh.md)。
++每个请求首先经过 `src/api-request-trust.ts`。其 `Host` 必须是 loopback，或与 `trustedHosts` 条目匹配：带端口的 `host:port` 精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化。若附带 `Origin`，它必须等于该 Host；`sec-fetch-site: cross-site` 一律拒绝。畸形配置 authority 会让插件加载失败。这些检查防御 DNS rebinding 与跨站浏览器请求，绝不建立身份。Host/Origin 校验失败返回403；默认required策略下，Host可信但未认证的请求返回401，disabled策略则在trust通过后继续。`dsh web --host 0.0.0.0` 仍不受支持。决策记录：[浏览器请求信任](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.zh.md)与[浏览器令牌认证](../../../.agents/notes/implemented/architecture/2026-08-24-browser-token-authentication.zh.md)。
+ 
+ <a id="connection-generation"></a>
+ ## Connection generation
+diff --git a/packages/client/connection/src/browser-auth.ts b/packages/client/connection/src/browser-auth.ts
+index 10353d9a06..dbeb256022 100644
+--- a/packages/client/connection/src/browser-auth.ts
++++ b/packages/client/connection/src/browser-auth.ts
+@@ -177,12 +177,29 @@ async function initializeSecret(credentials: CredentialProvider): Promise<Buffer
+   return secret
+ }
+ 
++/** Browser-session policy selected once while Connection activates. */
++export interface BrowserAuthentication {
++  /** Add any authentication input to the clean application URL. */
++  authenticatedUrl(baseUrl: string): string
++  /** Authorize one frontend index request, owning the response when denied or redirected. */
++  authorizeIndex(req: ConnectionIndexRequest, res: ConnectionIndexResponse): boolean
++  /** Decide whether a trusted Host request has the required browser identity. */
++  isAuthenticated(request: ConnectionTrustRequest): boolean
++}
++
++/** Profile-selected policy that admits every request after the independent Host/Origin fence. */
++export const DISABLED_BROWSER_AUTHENTICATION: BrowserAuthentication = {
++  authenticatedUrl: baseUrl => new URL(baseUrl).href,
++  authorizeIndex: () => true,
++  isAuthenticated: () => true,
++}
++
+ /**
+  * Process launch-token exchange and persistent signed-cookie verification.
+  * Connection loads the credential provider's signing secret during activation
+  * and retains it for synchronous request authentication.
+  */
+-export class BrowserAuth {
++export class BrowserAuth implements BrowserAuthentication {
+   private readonly launchToken: string
+   private readonly maxAgeMilliseconds: number
+ 
+diff --git a/packages/client/connection/src/index.ts b/packages/client/connection/src/index.ts
+index 34cf79bd65..6bed1e1c9a 100644
+--- a/packages/client/connection/src/index.ts
++++ b/packages/client/connection/src/index.ts
+@@ -8,7 +8,7 @@ import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
+ import { API_PATH } from './api-path.ts'
+ import { bridge, DEFAULT_MAX_REQUEST_BODY_BYTES } from './http-bridge.ts'
+ import { assertTrustedAuthority } from './api-request-trust.ts'
+-import { BrowserAuth } from './browser-auth.ts'
++import { BrowserAuth, DISABLED_BROWSER_AUTHENTICATION } from './browser-auth.ts'
+ import { HostConnectionService } from './rpc-host.ts'
+ 
+ export type {
+@@ -77,6 +77,8 @@ export interface ConnectionConfig {
+    * bind. An entry that is not a bare, canonical authority fails plugin load.
+    */
+   trustedHosts?: string[]
++  /** Host API browser identity policy; Host/Origin trust remains independent. Default: `required`. */
++  browserAuthentication?: 'required' | 'disabled'
+   /** Absolute browser-session lifetime in days. Default: 30. */
+   cookieMaxAgeDays?: number
+   /** Maximum buffered JSON body for every `/api` request. Default: 300 MiB. */
+@@ -85,6 +87,7 @@ export interface ConnectionConfig {
+ 
+ export const Config: z<ConnectionConfig> = z.object({
+   trustedHosts: z.array(String).default([]),
++  browserAuthentication: z.union(['required', 'disabled']).default('required'),
+   cookieMaxAgeDays: z.natural().min(1).default(30),
+   maxRequestBodyBytes: z.natural().min(1).default(DEFAULT_MAX_REQUEST_BODY_BYTES),
+ })
+@@ -99,16 +102,21 @@ export const Config: z<ConnectionConfig> = z.object({
+ export async function apply(ctx: Context, config?: ConnectionConfig): Promise<void> {
+   // The Loader resolves schema defaults; hand-built test contexts may pass none.
+   const trustedHosts = config?.trustedHosts ?? []
++  const browserAuthentication = config?.browserAuthentication ?? 'required'
+   const cookieMaxAgeDays = config?.cookieMaxAgeDays ?? 30
+   const maxRequestBodyBytes = config?.maxRequestBodyBytes ?? DEFAULT_MAX_REQUEST_BODY_BYTES
+   // Config boundary: a malformed entry fails the load loudly here rather than
+   // silently authorizing its hostname prefix at request time.
+   for (const entry of trustedHosts) assertTrustedAuthority(entry)
+   assertImageBodyCapacity(ctx, maxRequestBodyBytes)
++  // 配置在激活时只选择一次策略；disabled不会创建token或credential record。
++  const browserAuth = browserAuthentication === 'required'
++    ? await BrowserAuth.create(ctx.root, ctx.credentials, cookieMaxAgeDays)
++    : DISABLED_BROWSER_AUTHENTICATION
+   const connection = new HostConnectionService(
+     ctx,
+     trustedHosts,
+-    await BrowserAuth.create(ctx.root, ctx.credentials, cookieMaxAgeDays),
++    browserAuth,
+   )
+   const fetchHandler = connection.createSharedFetchHandler(API_PATH)
+   const route: WebRoute = {
+diff --git a/packages/client/connection/src/rpc-host.ts b/packages/client/connection/src/rpc-host.ts
+index a9bbc72954..486c669ea2 100644
+--- a/packages/client/connection/src/rpc-host.ts
++++ b/packages/client/connection/src/rpc-host.ts
+@@ -11,7 +11,7 @@ import { clientRequestSchema } from './rpc-schema.ts'
+ import { bridge, type FetchHandler } from './http-bridge.ts'
+ import { isTrustedApiRequest } from './api-request-trust.ts'
+ import { API_PATH } from './api-path.ts'
+-import type { BrowserAuth } from './browser-auth.ts'
++import type { BrowserAuthentication } from './browser-auth.ts'
+ import type {
+   ConnectionIndexRequest,
+   ConnectionIndexResponse,
+@@ -64,12 +64,12 @@ export class HostConnectionService extends Service implements HostConnectionHand
+    * Provide the Host half over the active HTTP server.
+    * @param ctx - owning Connection plugin context.
+    * @param trustedHosts - deployment authorities accepted by the Host/Origin fence.
+-   * @param browserAuth - process token and persistent browser-session owner.
++   * @param browserAuth - profile-selected browser-session policy.
+    */
+   constructor(
+     ctx: Context,
+     private readonly trustedHosts: readonly string[],
+-    private readonly browserAuth: BrowserAuth,
++    private readonly browserAuth: BrowserAuthentication,
+   ) {
+     super(ctx, 'connection')
+   }