dsh-mini-utility-dock 0.1.5 → 0.1.7

package/CHANGELOG.en.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.7 - 2026-09-20
+
+- The two host-side fragments no longer state how many consumers exist: "all three plugins", "the three disagree" and "the three plugins / diverged three times" give way to wording that names no count. A fragment is embedded verbatim into each consumer, where the reader cannot know how many sibling repositories exist — the count is workspace knowledge, not that repository's.
+- The fragments' bytes change, so consumers must re-run `loopback:sync` / `guard:sync` and raise their pin to 0.1.7.
+
+## 0.1.6 - 2026-09-20
+
+- Fix the `allowRemoteHost` note in `dist/guard.js`: it read "stop being admitted", the opposite of what the code does — that mode skips both checks, so it admits them. The JSDoc was already right; only this inline comment was inverted.
+- The fragment's bytes change, so consumers must re-run `guard:sync` and raise their pin to 0.1.6.
+
 ## 0.1.5 - 2026-09-17
 
 - Documentation maintenance: README and CHANGELOG cleanup. Fragments and command behavior are unchanged, so consumer pins need no update.

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.7 - 2026-09-20
+
+- 两个 host 侧片段的注释不再带消费仓数量：「all three plugins」「the three disagree」「the three plugins / diverged three times」改为不指名、不计数的说法。片段会逐字嵌入消费仓，那里的读者无从得知有几个同级仓，计数是工作区知识而非该仓知识。
+- 片段字节因此变化，消费仓需重新运行 `loopback:sync` / `guard:sync` 并把 pin 升到 0.1.7。
+
+## 0.1.6 - 2026-09-20
+
+- 修正 `dist/guard.js` 里 `allowRemoteHost` 的说明文字：原文写作「不再被放行」，与代码相反——开启该模式时这两项检查被跳过，即被放行。JSDoc 一直是对的，只有这处行内注释写反。
+- 该片段的字节因此变化，消费仓需重新运行 `guard:sync` 并把 pin 升到 0.1.6。
+
 ## 0.1.5 - 2026-09-17
 
 - 文档维护：README 与 CHANGELOG 的整理，片段与命令行为不变，故无需改动消费仓的 pin。

package/dist/guard.js

@@ -21,8 +21,8 @@
 // file, so an import of a sibling module would both break the standalone promise
 // and collide with the exports the block above already declares.
 //
-// Why the guard is shared rather than reimplemented per plugin: the three plugins
-// each carried their own `createGuard`, and the copies diverged three times. The
+// Why the guard is shared rather than reimplemented per plugin: each consumer
+// carried its own `createGuard`, and the copies diverged repeatedly. The
 // parts that differed were never the *decisions* — they were the error codes and
 // message strings welded into the same function, which forced every repo to keep
 // its own copy and made drift possible. Here the enforcement order and every
@@ -134,12 +134,13 @@ const bindGuard = ({ currentPort, respond, allowRemoteHost, policy } = {}) => {
       return deny(res, 'unknown_peer')
     }
     // `allowRemoteHost` buys exactly one thing: an off-loopback peer AND an
-    // off-loopback Host stop being admitted by this guard, because the caller has
-    // opted into verifying its own credential per request. Everything else still
-    // applies — the Origin check below rejects cross-site traffic in both modes,
-    // so the exemption never widens the browser-facing boundary. A plugin that
-    // does not pass the predicate never enters this mode, so for it the peer and
-    // Host criteria are absolute.
+    // off-loopback Host stop being *rejected* by this guard — both checks below
+    // are skipped — because the caller has opted into verifying its own
+    // credential per request. Everything else still applies: the Origin check
+    // below rejects cross-site traffic in both modes, so the exemption never
+    // widens the browser-facing boundary. A plugin that does not pass the
+    // predicate never enters this mode, so for it the peer and Host criteria
+    // are absolute.
     const remote = fleetAllowed()
     if (!remote && !isLoopbackAddress(peerAddress)) {
       return deny(res, 'non_loopback_peer')

package/dist/loopback.js

@@ -10,8 +10,8 @@
 // the dock is that a plugin works with no sibling installed.
 //
 // Why it is shared at all: these predicates were copy-pasted per repo and
-// drifted twice. The first drift rejected IPv6 loopback in all three plugins;
-// the second made the three disagree on which Host spellings count as loopback
+// drifted twice. The first drift rejected IPv6 loopback everywhere; the second
+// is that consumers disagreed on which Host spellings count as loopback
 // (see scripts/guard-parity.mjs, which compares this block across repos).
 //
 // "Loopback" is decided in exactly one place — LOOPBACK_HOSTNAMES plus the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mini-utility-dock",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Canonical fragments and a build-time embedding CLI shared by DSH plugins: the Mini Utility Dock bootstrap for client halves, and the loopback predicates plus the host request guard for host halves.",
   "type": "module",
   "bin": {