dsh-msg9-kit 0.2.1 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +8 -1
- package/README.zh-CN.md +4 -1
- package/lib/client.js +63 -61
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -73,6 +73,7 @@ themes alike.
|
|
|
73
73
|
| `msg9_peers` | List the sibling workspaces' inboxes (address book for cross-workspace sync) |
|
|
74
74
|
| `msg9_rotate` | Rotate the current workspace's key (recover from a lost/leaked key) |
|
|
75
75
|
| `msg9_status` | Owner + current workspace + cursor + state file; `verify=true` checks the key |
|
|
76
|
+
| `msg9_notify` | Pause/resume new-mail wake-ups for this instance (`on` / `off` / `status`) — the same mute switch as the panel bell |
|
|
76
77
|
|
|
77
78
|
Plus `/msg9` to print the owner and the registered workspace inboxes.
|
|
78
79
|
|
|
@@ -234,7 +235,13 @@ what it sent, and the address book it messages most.
|
|
|
234
235
|
The panel talks to these same-origin routes (never a key in the response).
|
|
235
236
|
Requests are accepted only when the connection itself comes from loopback
|
|
236
237
|
(`remoteAddress`), plus a same-origin `Origin` check for browsers — a forged
|
|
237
|
-
`Host` header from another local process does not pass
|
|
238
|
+
`Host` header from another local process does not pass.
|
|
239
|
+
|
|
240
|
+
Threat-model boundary (per audit): a local process connecting via loopback is
|
|
241
|
+
still trusted — deliberately, since it could read `~/.dsh/msg9-kit/state.json`
|
|
242
|
+
directly anyway; HTTP-layer defence cannot and need not keep out the machine's
|
|
243
|
+
owner. What this check actually closes is remote clients forging `Host` when
|
|
244
|
+
dsh web binds a non-loopback address, and cross-origin browser pages:
|
|
238
245
|
|
|
239
246
|
| Route | Purpose |
|
|
240
247
|
|---|---|
|
package/README.zh-CN.md
CHANGED
|
@@ -61,6 +61,7 @@
|
|
|
61
61
|
| `msg9_peers` | 列出**兄弟 workspace** 的收件箱（跨 workspace 同步的地址簿） |
|
|
62
62
|
| `msg9_rotate` | 轮换当前 workspace 的 key（本地 key 丢失/泄漏时恢复） |
|
|
63
63
|
| `msg9_status` | owner + 当前 workspace + 游标 + 状态文件；`verify=true` 校验 key |
|
|
64
|
+
| `msg9_notify` | 暂停/恢复本实例的新邮件唤醒（`on` / `off` / `status`）——和面板铃铛是同一个静音开关 |
|
|
64
65
|
|
|
65
66
|
另有 `/msg9` 命令，打印 owner 与已登记的 workspace 收件箱。
|
|
66
67
|
|
|
@@ -181,7 +182,9 @@ msg9_send({ to: "dsh-alpha-a1b2@msg9.io", text: "schema 已更新", correlation_
|
|
|
181
182
|
|
|
182
183
|
## HTTP 桥
|
|
183
184
|
|
|
184
|
-
面板调用的同源接口（响应里永不含 key）。只接受连接来源本身是本机 loopback（`remoteAddress`）的请求，浏览器另有 `Origin` 同源校验——本机其他进程伪造 `Host`
|
|
185
|
+
面板调用的同源接口（响应里永不含 key）。只接受连接来源本身是本机 loopback（`remoteAddress`）的请求，浏览器另有 `Origin` 同源校验——本机其他进程伪造 `Host` 头不再放行。
|
|
186
|
+
|
|
187
|
+
威胁模型边界（审计澄清）：本机进程经 loopback 连接仍会被信任——这是有意的，因为这类进程本就可以直读 `~/.dsh/msg9-kit/state.json`，HTTP 层防不住也不必防「机器主人」。这层校验真正关掉的是：dsh web 绑定非 loopback 地址时远程伪造 `Host` 的客户端，以及跨源浏览器页面。
|
|
185
188
|
|
|
186
189
|
| 路由 | 用途 |
|
|
187
190
|
|---|---|
|