dsh-cliproxyapi-pro 1.5.0 → 1.6.0

package/lib/index.js

@@ -1695,18 +1695,33 @@ function admitRequest(ctx, req, res, expectedMethod) {
   return true;
 }
 
-/** Update writes are browser-only: require an explicit, exact same Origin. */
+/** Same authority, using the scheme the Origin itself declares (host comparison only). */
+function sameAuthorityOrigin(origin, host) {
+  let originUrl;
+  try { originUrl = new URL(origin); } catch { return false; }
+  if (originUrl.protocol !== "http:" && originUrl.protocol !== "https:") return false;
+  if (originUrl.username || originUrl.password) return false;
+  try {
+    return originUrl.host === new URL(`${originUrl.protocol}//${host}`).host;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Update writes need an authenticated browser request. The host connection
+ * service already enforces the Host/Origin fence and its session cookie, so
+ * this only narrows it: when a browser sends an Origin it must belong to this
+ * listener. A carrier that omits Origin (the desktop shell proxies API calls
+ * without it) is allowed, because the session cookie is still required and an
+ * unauthenticated caller is rejected before reaching the route.
+ */
 function admitUpdateRequest(ctx, req, res, method) {
   if (!admitRequest(ctx, req, res, method)) return false;
   if (method === "GET") return true;
-  const protocol = req.socket?.encrypted ? "https:" : "http:";
-  try {
-    const origin = new URL(req.headers.origin);
-    const target = new URL(`${protocol}//${req.headers.host}`);
-    if (!req.headers.host || origin.origin !== target.origin || req.headers.origin !== origin.origin || origin.username || origin.password) {
-      throw new Error("Origin mismatch");
-    }
-  } catch {
+  const host = req.headers.host;
+  const origin = req.headers.origin;
+  if (host === undefined || origin !== undefined && !sameAuthorityOrigin(origin, host)) {
     sendJson(res, 403, { ok: false, errorCode: "forbidden-origin", error: "Same-origin browser request required" });
     return false;
   }

package/lib/updater.js

@@ -13,8 +13,9 @@ export const UPDATE_REGISTRIES = Object.freeze({
 export const UPDATE_TAGS = Object.freeze({ stable: "latest", beta: "beta", dev: "dev" });
 export const UPDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
 export const DEFAULT_UPDATE_SETTINGS = Object.freeze({
-  autoCheck: true, autoDownload: false, channel: "stable", region: "auto",
+  autoCheck: true, autoDownload: false, autoInstall: false, channel: "stable", region: "auto",
 });
+const BOOLEAN_SETTINGS = ["autoCheck", "autoDownload", "autoInstall"];
 const MAX_METADATA_BYTES = 512 * 1024;
 const MAX_PACKAGE_BYTES = 8 * 1024 * 1024;
 const MAX_UNPACKED_BYTES = 16 * 1024 * 1024;
@@ -29,6 +30,8 @@ export function normalizeUpdateSettings(raw = {}) {
   return {
     autoCheck: typeof raw?.autoCheck === "boolean" ? raw.autoCheck : true,
     autoDownload: raw?.autoDownload === true,
+    // Consumed by the Web client, which delegates installation to dshmarket.
+    autoInstall: raw?.autoInstall === true,
     channel: Object.hasOwn(UPDATE_TAGS, raw?.channel ?? "") ? raw.channel : "stable",
     region: ["auto", "global", "cn"].includes(raw?.region) ? raw.region : "auto",
   };
@@ -38,7 +41,7 @@ export function loadUpdateSettings(file) {
   try {
     const raw = JSON.parse(readFileSync(file, "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw) || raw.version !== 1 ||
-        ["autoCheck", "autoDownload"].some((key) => raw[key] !== undefined && typeof raw[key] !== "boolean") ||
+        BOOLEAN_SETTINGS.some((key) => raw[key] !== undefined && typeof raw[key] !== "boolean") ||
         raw.channel !== undefined && !Object.hasOwn(UPDATE_TAGS, raw.channel) ||
         raw.region !== undefined && !["auto", "global", "cn"].includes(raw.region)) fail("invalid-settings");
     return normalizeUpdateSettings(raw);
@@ -340,7 +343,7 @@ export function createPluginUpdater(deps) {
       if (!patch || typeof patch !== "object" || Array.isArray(patch)) fail("invalid-settings");
       if (Object.keys(patch).some((key) => !Object.hasOwn(DEFAULT_UPDATE_SETTINGS, key))) fail("invalid-settings");
       if (Object.hasOwn(patch, "channel") && !Object.hasOwn(UPDATE_TAGS, patch.channel) || Object.hasOwn(patch, "region") && !["auto", "global", "cn"].includes(patch.region)) fail("invalid-settings");
-      for (const key of ["autoCheck", "autoDownload"]) if (Object.hasOwn(patch, key) && typeof patch[key] !== "boolean") fail("invalid-settings");
+      for (const key of BOOLEAN_SETTINGS) if (Object.hasOwn(patch, key) && typeof patch[key] !== "boolean") fail("invalid-settings");
       const next = normalizeUpdateSettings({ ...settings, ...patch });
       saving = true;
       try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cliproxyapi-pro",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Auto-discovery CLIProxyAPI provider and management UI for DeepSeek Harness — multiple accounts, dynamic model sync, capability detection, and visual settings.",
   "keywords": [
     "dsh",