dsh-mini-utility-dock 0.1.5 → 0.1.6

package/CHANGELOG.en.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.6 - 2026-09-20
+
+- Fix the `allowRemoteHost` note in `dist/guard.js`: it read "stop being admitted", the opposite of what the code does — that mode skips both checks, so it admits them. The JSDoc was already right; only this inline comment was inverted.
+- The fragment's bytes change, so consumers must re-run `guard:sync` and raise their pin to 0.1.6.
+
 ## 0.1.5 - 2026-09-17
 
 - Documentation maintenance: README and CHANGELOG cleanup. Fragments and command behavior are unchanged, so consumer pins need no update.

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.6 - 2026-09-20
+
+- 修正 `dist/guard.js` 里 `allowRemoteHost` 的说明文字：原文写作「不再被放行」，与代码相反——开启该模式时这两项检查被跳过，即被放行。JSDoc 一直是对的，只有这处行内注释写反。
+- 该片段的字节因此变化，消费仓需重新运行 `guard:sync` 并把 pin 升到 0.1.6。
+
 ## 0.1.5 - 2026-09-17
 
 - 文档维护：README 与 CHANGELOG 的整理，片段与命令行为不变，故无需改动消费仓的 pin。

package/dist/guard.js

@@ -134,12 +134,13 @@ const bindGuard = ({ currentPort, respond, allowRemoteHost, policy } = {}) => {
       return deny(res, 'unknown_peer')
     }
     // `allowRemoteHost` buys exactly one thing: an off-loopback peer AND an
-    // off-loopback Host stop being admitted by this guard, because the caller has
-    // opted into verifying its own credential per request. Everything else still
-    // applies — the Origin check below rejects cross-site traffic in both modes,
-    // so the exemption never widens the browser-facing boundary. A plugin that
-    // does not pass the predicate never enters this mode, so for it the peer and
-    // Host criteria are absolute.
+    // off-loopback Host stop being *rejected* by this guard — both checks below
+    // are skipped — because the caller has opted into verifying its own
+    // credential per request. Everything else still applies: the Origin check
+    // below rejects cross-site traffic in both modes, so the exemption never
+    // widens the browser-facing boundary. A plugin that does not pass the
+    // predicate never enters this mode, so for it the peer and Host criteria
+    // are absolute.
     const remote = fleetAllowed()
     if (!remote && !isLoopbackAddress(peerAddress)) {
       return deny(res, 'non_loopback_peer')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mini-utility-dock",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Canonical fragments and a build-time embedding CLI shared by DSH plugins: the Mini Utility Dock bootstrap for client halves, and the loopback predicates plus the host request guard for host halves.",
   "type": "module",
   "bin": {