dsh-ide-git 0.21.0 → 0.21.1

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-ide-git",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "main": "./src/index.js",
   "description": "IDE 级 Git 操作面板:分支树 + 提交图谱 + 变更/暂存/提交 + 提交详情。装了 dsh-better-sidebar 时挂成它的原生 tab(右侧栏 + 底部工作台);没装时直接挂 DSH 原生右侧栏,单独安装即可用。JetBrains 风格 Git 工具窗口 for DeepSeek Harness.",
   "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ide-git",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "DSH plugin: an IDE-grade Git tool window as a native dsh-better-sidebar tab — branch tree, commit graph, changes, commit details, JetBrains-style actions, in the right sidebar and the bottom panel. | DSH 插件:IDE 级 Git 工具窗口,以 dsh-better-sidebar 原生 Tab 挂载——分支树 / 提交图谱 / 变更与提交详情 / JetBrains 风格操作,右侧栏与底部面板双布局自适应。",
   "type": "module",
   "repository": {

package/src/client.js

@@ -7425,6 +7425,19 @@ window.__ModuleLoader__.load({
     function isAuthRejection(status) {
       return status === 401 || status === 403
     }
+
+    /* Whether a proxy answer looks like OUR route (a JSON object). With no
+       remote-web-ui installed the SPA static fallback serves /remote/<path> as
+       '405 Method Not Allowed' with an EMPTY body (issue #20: on a plain-HTTP
+       LAN page the panel surfaced a bare 'HTTP 405' instead of the real
+       403 refusal). A non-JSON retry therefore proves there is no proxy, and
+       the original answer must be what the caller sees. Cloning leaves the
+       caller's own body untouched. */
+    async function answersJson(response) {
+      let body = null
+      try { body = await response.clone().json() } catch (error) { return false }
+      return body !== null && typeof body === 'object'
+    }
     /* ---- end remote channel fallback core ---- */
 
     /* Sticky remote-channel mode: once the proxy has answered, later calls go
@@ -7446,13 +7459,15 @@ window.__ModuleLoader__.load({
       } else {
         response = await fetch(direct, init)
         if (isAuthRejection(response.status) === true) {
-          /* Off the origin's trust path: try the pairing proxy once. With no
-             remote-web-ui installed the proxy path 404s — the retry then also
-             fails, and the ORIGINAL rejection is what the caller sees (a
-             proxy answer that is itself an auth rejection is discarded the
-             same way, so a genuine cross-site refusal can never be masked). */
+          /* Off the origin's trust path: try the pairing proxy once. It has to
+             answer like our route (a JSON body) to take over: with no
+             remote-web-ui installed the SPA fallback serves the retry as 405
+             with an empty body, and that non-answer must not outrank the
+             ORIGINAL rejection (issue #20). A proxy answer that is itself an
+             auth rejection is discarded the same way, so a genuine refusal can
+             never be masked. */
           const retried = await fetch(remoteFallbackUrl(direct), init)
-          if (isAuthRejection(retried.status) !== true) {
+          if (isAuthRejection(retried.status) !== true && (await answersJson(retried)) === true) {
             viaRemoteChannel = true
             response = retried
           }

package/src/index.js

@@ -2086,6 +2086,61 @@ function headerOf(req, name) {
   return value
 }
 
+/* Normalize an authority ("host[:port]" or an absolute URL) to
+   "hostname:port", filling the scheme default port when it is implicit.
+   Returns '' for anything unparseable (including the "null" opaque origin). */
+function authorityKey(value, protocol) {
+  const text = String(value === undefined || value === null ? '' : value).trim()
+  if (text === '') return ''
+  let hostname = text
+  let port = ''
+  let scheme = protocol
+  if (text.includes('://') === true) {
+    let parsed = null
+    try { parsed = new URL(text) } catch (error) { parsed = null }
+    if (parsed === null) return ''
+    hostname = parsed.hostname
+    port = parsed.port
+    scheme = parsed.protocol
+  } else {
+    const bracketed = /^\[([^\]]+)\](?::(\d+))?$/.exec(text)
+    if (bracketed !== null) {
+      hostname = bracketed[1]
+      port = bracketed[2] === undefined ? '' : bracketed[2]
+    } else {
+      const plain = /^([^:]+)(?::(\d+))?$/.exec(text)
+      if (plain === null) return ''
+      hostname = plain[1]
+      port = plain[2] === undefined ? '' : plain[2]
+    }
+  }
+  if (hostname === '') return ''
+  if (port === '') port = scheme === 'https:' ? '443' : '80'
+  return hostname.toLowerCase() + ':' + port
+}
+
+/* Same-origin fallback for browsers that send no Sec-Fetch-* headers. A page
+   served over plain HTTP from a non-loopback address is not a secure context,
+   and the fetch-metadata headers are omitted there (issue #20: the git panel
+   answered 403 on a LAN address). Origin and Referer are forbidden headers a
+   page cannot forge — a cross-site request always carries the caller's own
+   origin — so comparing either against the Host header restores the
+   same-origin fence without trusting anything the request body claims. */
+function sameOriginOf(req, host) {
+  const hostKey = authorityKey(host, 'http:')
+  if (hostKey === '') return false
+  /* A Host header without a port says nothing about the scheme, so either
+     scheme default may be the one the browser used in Origin. */
+  const candidates = new Set([hostKey])
+  if (/:\d+$/.test(String(host).trim()) !== true) candidates.add(authorityKey(host, 'https:'))
+  const matches = (value) => {
+    const key = authorityKey(value, 'http:')
+    return key !== '' && candidates.has(key)
+  }
+  if (matches(headerOf(req, 'origin')) === true) return true
+  return matches(headerOf(req, 'referer'))
+}
+
 /** Loopback authority, or a same-origin browser request (desktop shell / remote UI). */
 function isTrusted(req) {
   const host = headerOf(req, 'host')
@@ -2094,7 +2149,8 @@ function isTrusted(req) {
   if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1' || hostname === '0.0.0.0') return true
   if (/^127\./.test(hostname)) return true
   const site = headerOf(req, 'sec-fetch-site')
-  return site === 'same-origin' || site === 'same-site'
+  if (site === 'same-origin' || site === 'same-site') return true
+  return sameOriginOf(req, host)
 }
 
 function sendJson(res, status, body) {
@@ -2136,7 +2192,13 @@ function readJsonBody(req, limit = 1 << 20) {
 
 async function handle(req, res) {
   if (!isTrusted(req)) {
-    sendJson(res, 403, { ok: false, error: { code: 'forbidden', message: 'forbidden' } })
+    sendJson(res, 403, {
+      ok: false,
+      error: {
+        code: 'forbidden',
+        message: 'forbidden: a non-loopback request must be same-origin (open this host from its own page) or come through the remote pairing proxy',
+      },
+    })
     return
   }
   if (req.method !== 'POST') {