dsh-archived 0.3.0 → 0.3.1

package/lib/client.js

@@ -165,7 +165,7 @@ window.__ModuleLoader__.load({
         : [];
 
       var [snapshot, setSnapshot] = useState(null);
-      var [failed, setFailed] = useState(false);
+      var [failed, setFailed] = useState(null);
       var [query, setQuery] = useState("");
       var [selected, setSelected] = useState({});
       var [expanded, setExpanded] = useState({});
@@ -179,13 +179,17 @@ window.__ModuleLoader__.load({
       function reload() {
         return request(STATE_PATH)
           .then(function (payload) {
-            if (!payload || payload.ok !== true) throw new Error("state");
+            if (!payload || payload.ok !== true) {
+              throw new Error(payload && payload.error ? String(payload.error) : "state");
+            }
             setSnapshot(payload);
-            setFailed(false);
+            setFailed(null);
             return payload;
           })
-          .catch(function () {
-            setFailed(true);
+          .catch(function (error) {
+            // Say why: a bare "cannot read host state" is undebuggable from the
+            // outside, which is exactly how the Desktop-app failure hid.
+            setFailed(String(error && error.message ? error.message : error));
             setSnapshot(null);
           });
       }
@@ -366,10 +370,10 @@ window.__ModuleLoader__.load({
         });
       }
 
-      if (failed) {
+      if (failed !== null) {
         return h("div", { className: "dasm_section" }, [
           h("h2", { className: "dasm_title", key: "title" }, t("nav")),
-          h("p", { className: "dasm_status", key: "failed" }, t("hostUnavailable")),
+          h("p", { className: "dasm_status", key: "failed" }, t("hostUnavailable", { reason: failed })),
         ]);
       }
 
@@ -751,7 +755,7 @@ window.__ModuleLoader__.load({
       nav: "已归档",
       search: "搜索已归档会话",
       loading: "正在读取会话…",
-      hostUnavailable: "读不到宿主状态：请确认插件已随宿主加载，然后刷新页面。",
+      hostUnavailable: "读不到宿主状态（{reason}）：请确认插件已随宿主加载，然后刷新页面。",
       apiMismatch: "插件的前后端版本不一致：请重启 DSH 后再试。",
       empty: "暂无已归档会话。",
       emptySearch: "没有匹配的会话。",
@@ -820,7 +824,7 @@ window.__ModuleLoader__.load({
       nav: "Archived",
       search: "Search archived sessions",
       loading: "Reading sessions…",
-      hostUnavailable: "Cannot read host state — check that the plugin loaded, then refresh.",
+      hostUnavailable: "Cannot read host state ({reason}) — check that the plugin loaded, then refresh.",
       apiMismatch: "The plugin's two halves disagree on the API version — restart DSH and try again.",
       empty: "No archived sessions.",
       emptySearch: "No matching sessions.",

package/lib/host/trust.js

@@ -1,14 +1,29 @@
 // Request trust for the destructive routes.
 //
-// Loopback, marker-header, same-origin. The routes are destructive, so they
+// Loopback, and provably not cross-site. The routes are destructive, so they
 // refuse anything that is not this browser talking to this server.
 //
-// `Origin` is authoritative when present, but browsers omit it on same-origin
-// GETs — so that case falls back to Fetch Metadata's `sec-fetch-site`, which a
-// cross-site caller cannot forge. A request with neither signal is refused.
+// The shipped web client is not the only client: the Desktop app talks to the
+// same host, and a request that reaches us through the app's own pipeline can
+// arrive without the Fetch Metadata headers a page-initiated fetch carries.
+// Requiring `sec-fetch-site: same-origin` outright therefore rejected the
+// Desktop app's perfectly legitimate same-origin call. What actually has to
+// hold is: loopback, not cross-site, and either the marker header or a proven
+// same-origin signal.
+//
+//   * cross-site is always refused — that is the CSRF case, and every browser
+//     that matters sends `sec-fetch-site` for it;
+//   * `Origin`, when present, must match `Host` (browsers omit it on
+//     same-origin GETs, which is why it cannot be required);
+//   * a request with no signals at all needs the marker header, which a
+//     cross-origin page cannot set without a preflight this server never
+//     approves.
 
 export const HEADER = "x-dsh-archived";
 
+/** The pre-rename marker, still accepted so an open tab survives the rename. */
+export const LEGACY_HEADER = "x-dsh-archived-sessions";
+
 export function header(request, key) {
   const value = request.headers?.[key];
   return Array.isArray(value) ? value[0] : value;
@@ -25,15 +40,8 @@ export function isLoopbackAddress(value) {
   );
 }
 
-export function isTrustedRequest(request) {
-  if (header(request, HEADER) !== "1") return false;
-  if (!isLoopbackAddress(request.socket?.remoteAddress)) return false;
-  const site = header(request, "sec-fetch-site");
-  if (site !== undefined && site !== "same-origin") return false;
-  const host = header(request, "host");
-  if (!host) return false;
-  const origin = header(request, "origin");
-  if (origin === undefined) return site === "same-origin";
+/** Whether the request's `Origin` names this very host. */
+function originMatchesHost(origin, host) {
   try {
     const url = new URL(origin);
     return (
@@ -46,6 +54,46 @@ export function isTrustedRequest(request) {
   }
 }
 
+/**
+ * The full trust decision, with the evidence that produced it.
+ *
+ * @returns `{ trusted, ... }` — the reasons are kept so a refused request can
+ * be reported instead of vanishing, which is what made the Desktop-app failure
+ * invisible for a whole round of debugging.
+ */
+export function trustReport(request) {
+  const marker = header(request, HEADER) ?? header(request, LEGACY_HEADER);
+  const site = header(request, "sec-fetch-site");
+  const host = header(request, "host");
+  const origin = header(request, "origin");
+  const loopback = isLoopbackAddress(request.socket?.remoteAddress);
+  // A present Origin or Fetch Metadata signal is authoritative and cannot be
+  // overridden by the marker: a mismatch is fatal on its own.
+  const originOk = origin === undefined || originMatchesHost(origin, host);
+  const siteOk = site === undefined || site === "same-origin";
+  // A same-origin signal is something a cross-origin page cannot produce, so it
+  // proves the caller on its own. The marker covers the case where no Fetch
+  // Metadata header arrives at all (a non-browser client, or the Desktop app's
+  // own request pipeline).
+  const provenSameOrigin = (origin !== undefined && originOk) || site === "same-origin";
+  const trusted = loopback && Boolean(host) && originOk && siteOk && (marker === "1" || provenSameOrigin);
+  return {
+    trusted,
+    marker: marker ?? null,
+    loopback,
+    host: host ?? null,
+    site: site ?? null,
+    origin: origin ?? null,
+    originOk,
+    siteOk,
+    provenSameOrigin,
+  };
+}
+
+export function isTrustedRequest(request) {
+  return trustReport(request).trusted;
+}
+
 export function json(response, statusCode, value) {
   response.writeHead(statusCode, {
     "content-type": "application/json; charset=utf-8",

package/lib/index.js

@@ -54,18 +54,29 @@ import {
   quarantineSession,
   restoreSession,
 } from "./host/quarantine.js";
-import { failureDetail, isTrustedRequest, json, readJsonBody } from "./host/trust.js";
+import { failureDetail, json, readJsonBody, trustReport } from "./host/trust.js";
 
 export const name = "dsh-archived";
 export const inject = ["webServer", "workspaceRegistry", "agents", "sessions"];
 
 const BASE = "/api/dsh-archived";
-const STATE_PATH = BASE + "/state";
-const DELETE_PATH = BASE + "/delete";
-const DELETE_ALL_PATH = BASE + "/delete-all";
-const RESTORE_PATH = BASE + "/restore";
-const EMPTY_PATH = BASE + "/empty-quarantine";
-const REVEAL_PATH = BASE + "/reveal";
+
+/**
+ * The pre-rename prefix, still served so a tab that loaded the 0.2.0 client
+ * keeps working across the rename instead of stranding the user on an error
+ * page until they reload. The 0.2.0 client used the same six verbs, so the
+ * alias is a prefix swap and nothing more.
+ */
+const LEGACY_BASE = "/api/dsh-archived-sessions";
+/** Route suffixes, registered under both the current and the legacy prefix. */
+const SUFFIX = {
+  state: "/state",
+  delete: "/delete",
+  deleteAll: "/delete-all",
+  restore: "/restore",
+  empty: "/empty-quarantine",
+  reveal: "/reveal",
+};
 
 /** Wire version of the route contract, so the panel can detect a half-upgraded host. */
 export const API_VERSION = 2;
@@ -82,6 +93,26 @@ const sweeps = new Set();
 /** Session ids with a delete in flight, so two tabs cannot interleave on one row. */
 const inFlight = new Set();
 
+/**
+ * The last few refused requests, with the evidence that refused them. A 403
+ * that leaves no trace is undebuggable from the outside — which is exactly how
+ * the Desktop app ended up looking broken while every probe said it worked.
+ */
+const refusals = [];
+const MAX_REFUSALS = 20;
+
+function recordRefusal(path, request, report) {
+  refusals.push({
+    at: new Date().toISOString(),
+    path,
+    method: request.method,
+    remote: request.socket?.remoteAddress ?? null,
+    userAgent: String(request.headers?.["user-agent"] ?? "").slice(0, 80),
+    ...report,
+  });
+  if (refusals.length > MAX_REFUSALS) refusals.splice(0, refusals.length - MAX_REFUSALS);
+}
+
 /** The archive set's owner. `ctx.get` is the documented safe read; the property stays as a fallback. */
 function registryOf(ctx) {
   try {
@@ -155,6 +186,7 @@ async function stateOf(ctx) {
     home: dshHome(),
     items,
     quarantine: { count: parked.length, bytes: sumBytes(parked), items: parked },
+    refusals: refusals.slice().reverse(),
     legacy: {
       present: existsSync(legacyAggregateFile()),
       rows: legacyRows === null ? null : legacyRows.size,
@@ -331,8 +363,11 @@ function route(ctx, { path, method, handle }) {
             json(response, 405, { error: "method-not-allowed" });
             return;
           }
-          if (!isTrustedRequest(request)) {
-            json(response, 403, { error: "forbidden" });
+          const report = trustReport(request);
+          if (!report.trusted) {
+            recordRefusal(path, request, report);
+            ctx.logger?.warn?.(`[dsh-archived] refused ${request.method} ${path}: ${JSON.stringify(report)}`);
+            json(response, 403, { error: "forbidden", detail: report });
             return;
           }
           try {
@@ -350,37 +385,39 @@ function route(ctx, { path, method, handle }) {
 }
 
 export function apply(ctx) {
-  route(ctx, { path: STATE_PATH, method: "GET", handle: () => stateOf(ctx) });
-
-  route(ctx, {
-    path: DELETE_PATH,
-    method: "POST",
-    handle: (body) => deleteOne(ctx, body?.sessionId, body?.mode === "forever" ? "forever" : "quarantine"),
-  });
-
-  route(ctx, {
-    path: DELETE_ALL_PATH,
-    method: "POST",
-    handle: (body) => {
-      const mode = body?.mode === "forever" ? "forever" : "quarantine";
-      const ids = Array.isArray(body?.ids) ? body.ids : archivedIds(ctx);
-      return deleteMany(ctx, ids, mode);
+  const specs = [
+    { suffix: SUFFIX.state, method: "GET", handle: () => stateOf(ctx) },
+    {
+      suffix: SUFFIX.delete,
+      method: "POST",
+      handle: (body) => deleteOne(ctx, body?.sessionId, body?.mode === "forever" ? "forever" : "quarantine"),
     },
-  });
-
-  route(ctx, { path: RESTORE_PATH, method: "POST", handle: (body) => restoreOne(ctx, body?.sessionId) });
-
-  route(ctx, {
-    path: EMPTY_PATH,
-    method: "POST",
-    handle: async () => {
-      const parked = await listQuarantine();
-      for (const entry of parked) await purgeQuarantineEntry(entry.id);
-      return { ok: true, purged: parked.length, bytes: sumBytes(parked) };
+    {
+      suffix: SUFFIX.deleteAll,
+      method: "POST",
+      handle: (body) => {
+        const mode = body?.mode === "forever" ? "forever" : "quarantine";
+        const ids = Array.isArray(body?.ids) ? body.ids : archivedIds(ctx);
+        return deleteMany(ctx, ids, mode);
+      },
     },
-  });
-
-  route(ctx, { path: REVEAL_PATH, method: "POST", handle: (body) => revealOne(ctx, body?.sessionId) });
+    { suffix: SUFFIX.restore, method: "POST", handle: (body) => restoreOne(ctx, body?.sessionId) },
+    {
+      suffix: SUFFIX.empty,
+      method: "POST",
+      handle: async () => {
+        const parked = await listQuarantine();
+        for (const entry of parked) await purgeQuarantineEntry(entry.id);
+        return { ok: true, purged: parked.length, bytes: sumBytes(parked) };
+      },
+    },
+    { suffix: SUFFIX.reveal, method: "POST", handle: (body) => revealOne(ctx, body?.sessionId) },
+  ];
+  for (const spec of specs) {
+    for (const base of [BASE, LEGACY_BASE]) {
+      route(ctx, { path: base + spec.suffix, method: spec.method, handle: spec.handle });
+    }
+  }
 
   // A parked session is recoverable for a bounded window, then it expires on
   // its own so the quarantine can never become a second archive nobody drains.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-archived",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Archived-sessions page for DeepSeek Harness: per-row and batch deletion that clears the session log, the projection cache and the archive index together, with a 30-day recycle bin, subagent-aware refusals and a per-row disk footprint.",
   "type": "module",
   "main": "lib/index.js",