dsh-plugin-tether 0.1.8 → 0.1.9

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 本文件记录面向用户的变化。每个版本的这一节会原样作为该版本 Release 的说明。
 
+## 0.1.9
+
+### 新增
+
+- **适配 dsh 0.1.2-alpha 的浏览器认证**([#4](https://github.com/zexadev/dsh-tether/issues/4))。dsh 0.1.2-alpha 起,网页界面与 Host API 要求持有经启动 token 兑换的签名 cookie,无凭据一律 401——手机端表现为连上后一片 401 提示。
+
+  适配完全在电脑侧完成:插件启动时自动完成 token→cookie 兑换,sidecar 在代理出口把认证注入每个转发请求。**手机 App 无需更新**;dsh 的跨站请求防护经隧道原样保留(伪造来源仍被 403 拒绝)。
+
+  cookie 是 `SameSite=Strict` 且绑定地址端口,手机 WebView 的内嵌页面属跨站上下文、cookie 根本不会随请求发出,所以「把登录链接发给手机打开」这条路在浏览器规则下走不通,注入只能发生在电脑侧。
+
+- 继续兼容 dsh 0.1.0-rc.7 / rc.8:旧版没有浏览器认证,代理保持原样透传,行为不变。
+
 ## 0.1.8
 
 ### 修复

package/README.md

@@ -17,9 +17,11 @@
   <a href="../../releases"><img src="https://img.shields.io/github/downloads/zexadev/dsh-tether/total?style=flat&label=downloads&color=4D6BFE" alt="Downloads"></a>
   <a href="../../stargazers"><img src="https://img.shields.io/github/stars/zexadev/dsh-tether?style=flat&label=%E2%98%85&color=08C" alt="Stars"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat" alt="MIT"></a>
-  <img src="https://img.shields.io/badge/dsh-0.1.0--rc.7%20%7C%20rc.8-4D6BFE?style=flat" alt="dsh 0.1.0-rc.7 | rc.8">
+  <img src="https://img.shields.io/badge/dsh-0.1.0--rc.7%20%7C%20rc.8%20%7C%200.1.2--alpha-4D6BFE?style=flat" alt="dsh 0.1.0-rc.7 | rc.8 | 0.1.2-alpha">
   <img src="https://img.shields.io/badge/Android-4493F8?style=flat" alt="Android">
   <img src="https://img.shields.io/badge/iOS-beta-8E8E93?style=flat" alt="iOS beta">
+  <a href="https://www.dsh.so/artifact/dsh-tether"><img src="https://www.dsh.so/badge/dsh-tether.svg" alt="dsh.so security scan"></a>
+  <a href="https://www.dsh.so/artifact/dsh-tether"><img src="https://www.dsh.so/badge/install/dsh-tether.svg" alt="dsh.so install check"></a>
 </p>
 
 <p align="center">
@@ -106,7 +108,7 @@ From then on the app connects by itself when you open it.
 - The iOS build is beta: built only in CI, never run on a real device, and you sign it yourself. Android is the one verified on real hardware.
 - The app connects when you open it and holds no background connection — Android's doze would not let it anyway.
 - The interface on the phone is DSH's own; the narrow-screen fit comes from minimal injected styles, so a dsh layout change may need a follow-up here.
-- Verified against dsh **`0.1.0-rc.7`** and **`0.1.0-rc.8`**. dsh is in developer preview — check this line before assuming a newer dsh works.
+- Verified against dsh **`0.1.0-rc.7`**, **`0.1.0-rc.8`** and **`0.1.2-alpha`**. dsh is in developer preview — check this line before assuming a newer dsh works. The browser authentication dsh introduced in 0.1.2-alpha is handled entirely on the machine side; the phone app needs no update for it.
 
 ## What has been verified
 

package/README.zh.md

@@ -17,9 +17,11 @@
   <a href="../../releases"><img src="https://img.shields.io/github/downloads/zexadev/dsh-tether/total?style=flat&label=downloads&color=4D6BFE" alt="下载量"></a>
   <a href="../../stargazers"><img src="https://img.shields.io/github/stars/zexadev/dsh-tether?style=flat&label=%E2%98%85&color=08C" alt="Stars"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-2EA44F?style=flat" alt="MIT"></a>
-  <img src="https://img.shields.io/badge/dsh-0.1.0--rc.7%20%7C%20rc.8-4D6BFE?style=flat" alt="dsh 0.1.0-rc.7 | rc.8">
+  <img src="https://img.shields.io/badge/dsh-0.1.0--rc.7%20%7C%20rc.8%20%7C%200.1.2--alpha-4D6BFE?style=flat" alt="dsh 0.1.0-rc.7 | rc.8 | 0.1.2-alpha">
   <img src="https://img.shields.io/badge/Android-4493F8?style=flat" alt="Android">
   <img src="https://img.shields.io/badge/iOS-%E6%B5%8B%E8%AF%95%E7%89%88-8E8E93?style=flat" alt="iOS 测试版">
+  <a href="https://www.dsh.so/artifact/dsh-tether"><img src="https://www.dsh.so/badge/dsh-tether.svg" alt="dsh.so 安全扫描"></a>
+  <a href="https://www.dsh.so/artifact/dsh-tether"><img src="https://www.dsh.so/badge/install/dsh-tether.svg" alt="dsh.so 安装实测"></a>
 </p>
 
 <p align="center">
@@ -106,7 +108,7 @@ dsh plugin --profile web add .
 - iOS 版是测试版:只在 CI 上构建,从未在真机运行过,且需要自行签名。安卓版是经过真机验证的那一个。
 - App 打开时才连接,不在后台常驻——Android 的 doze 也留不住它。
 - 手机上的界面是 DSH 自己的,窄屏适配靠注入的最小样式完成;dsh 改版式时可能需要跟进。
-- 已针对 dsh **`0.1.0-rc.7`** 与 **`0.1.0-rc.8`** 验证。dsh 处于 developer preview,换更新的 dsh 之前先看这一行。
+- 已针对 dsh **`0.1.0-rc.7`**、**`0.1.0-rc.8`** 与 **`0.1.2-alpha`** 验证。dsh 处于 developer preview,换更新的 dsh 之前先看这一行。dsh 0.1.2-alpha 引入的浏览器认证完全在电脑侧处理,手机 App 无需更新。
 
 ## 验证过什么
 

package/index.js

@@ -175,6 +175,44 @@ function apply(ctx, config = {}) {
 
   ctx.effect(() => ctx.webServer.tapIndex(injectNarrowScreenCss))
 
+  // dsh 0.1.2-alpha 起浏览器界面要求认证:进程启动 token 经 GET /?token= 换成
+  // HMAC 签名 cookie,index 与 /api 无 cookie 一律 401。cookie 是 SameSite=Strict
+  // 且绑定 Host authority——手机 WebView 的 iframe 属跨站上下文,cookie 根本不会
+  // 随请求发出,把 token 交给手机没有用;唯一可行位置在电脑侧:这里自己完成兑换,
+  // 把 cookie 交给 sidecar 在代理流上逐请求注入。
+  ctx.inject(['connection'], (connCtx) => {
+    // rc.7/rc.8 也有 connection 服务,只是没有浏览器认证;判据必须是能力
+    // 本身而不是服务存在性(实测 rc.8 走到这里,靠服务存在性判会误报错)
+    if (typeof connCtx.connection.authenticatedUrl !== 'function') return
+    const authority = new URL(`http://${proxyTarget}`).host
+    const exchange = async () => {
+      const url = connCtx.connection.authenticatedUrl(`http://${proxyTarget}/`)
+      const res = await fetch(url, { redirect: 'manual' })
+      const setCookie = res.headers.getSetCookie()
+      if (res.status !== 303 || setCookie.length !== 1) {
+        throw new Error(`token 兑换应答异常: HTTP ${res.status}, set-cookie ×${setCookie.length}`)
+      }
+      send({ type: 'proxy-auth', cookie: setCookie[0].split(';', 1)[0], authority })
+    }
+    const exchangeWithRetry = async () => {
+      for (let attempt = 1; ; attempt++) {
+        try {
+          return await exchange()
+        } catch (error) {
+          if (attempt >= 3) {
+            console.error('[tether] 浏览器认证 cookie 获取失败,手机端将收到 401:', error)
+            return
+          }
+          await new Promise((resolve) => setTimeout(resolve, 1000 * attempt))
+        }
+      }
+    }
+    void exchangeWithRetry()
+    // cookie 绝对有效期默认 30 天,dsh 进程可能活得更久;定期重兑换续上
+    const timer = setInterval(() => { void exchangeWithRetry() }, 12 * 60 * 60 * 1000)
+    connCtx.effect(() => () => clearInterval(timer))
+  })
+
   // 「打开配置文件」在宿主机桌面开编辑器,手机上按了毫无反应。这条路由把同一份
   // 文件的内容原样交给手机自己渲染。路径由 Host 侧的 settings.documentPath 决定,
   // 不接受客户端传路径——否则就成了任意文件读取。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-tether",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Mobile client for the DeepSeek Harness — use the dsh on your dev machine from your Android or iOS phone, remotely across networks, peer-to-peer with no server in between (iroh)",
   "keywords": [
     "dsh",
@@ -42,18 +42,18 @@
     }
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.7",
-    "@deepseek-ai/dsh-user-approval": ">=0.1.0-rc.7"
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.0-rc.7 <0.1.1-0 || >=0.1.2-alpha.0 <0.1.3-0",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.0-rc.7 <0.1.1-0 || >=0.1.2-alpha.0 <0.1.3-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-host-webserver": { "optional": true },
     "@deepseek-ai/dsh-user-approval": { "optional": true }
   },
   "optionalDependencies": {
-    "dsh-tether-host-darwin-arm64": "0.1.8",
-    "dsh-tether-host-darwin-x64": "0.1.8",
-    "dsh-tether-host-linux-arm64": "0.1.8",
-    "dsh-tether-host-linux-x64": "0.1.8",
-    "dsh-tether-host-win32-x64": "0.1.8"
+    "dsh-tether-host-darwin-arm64": "0.1.9",
+    "dsh-tether-host-darwin-x64": "0.1.9",
+    "dsh-tether-host-linux-arm64": "0.1.9",
+    "dsh-tether-host-linux-x64": "0.1.9",
+    "dsh-tether-host-win32-x64": "0.1.9"
   }
 }