dsh-scnet 0.6.9 → 0.6.10

package/README.md

@@ -4,17 +4,15 @@
 
 DSH-SCNet (`dsh-scnet` on npm) is a community-maintained DSH bundle for operating Supercomputing Network (SCNet). It packages the source [`scnet-hpc`](https://github.com/lql341/scnet-hpc) Skill, profile-aware utilities, and bounded tools for SSH, Slurm, OpenAPI files, regional resources, and Notebook discovery.
 
-Current release: **0.6.9**
+Current release: **0.6.10**
 
 <!-- scnet-release:start -->
-## 0.6.9 highlights
-
-- Default CLI output is compact across OpenAPI and SSH, with `--details` and `--raw` for
-  progressively richer responses and bounded internal job waiting to reduce repeated output.
-- OpenAPI completion is confirmed against accounting before it becomes terminal, and SSH job
-  lookup falls back to accounting after a job leaves the live queue.
-- First-use setup defaults to OpenAPI, retains existing backend preferences, and preserves
-  unrelated configuration fields when settings are updated.
+## 0.6.10 highlights
+
+- Coordinate the synchronized downstream DSH release with a protocol-neutral one-shot loopback
+  OAuth callback listener, fixed-path validation, timeout cleanup, and generic browser responses.
+- Keep the canonical Skill endpoint-neutral; no SCNet issuer, endpoint, client ID, scope, or
+  credential is embedded in this release.
 <!-- scnet-release:end -->
 
 > This is an independent community project. It is compatible with DeepSeek Harness but is not an official DeepSeek product and does not imply endorsement, partnership, or authorization by DeepSeek.

package/README_CN.md

@@ -4,15 +4,15 @@
 
 <p align="center">在 DeepSeek Harness 里操作超算互联网（SCNet）：配置 SSH、管理 Slurm 作业、查询 OpenAPI 区域和文件、检查 Notebook 资源与实例，并保留海光 DCU/DTK 诊断能力。</p>
 
-当前版本：**0.6.9**
+当前版本：**0.6.10**
 
 <!-- scnet-release:start -->
-## 0.6.9 更新
+## 0.6.10 更新
 
-- OpenAPI 与 SSH 的 CLI 默认使用精简输出；需要更多信息时使用 `--details` 或 `--raw`，
-  作业等待改为程序内部有界轮询，减少重复输出。
-- OpenAPI 在作业状态终结前通过账本确认，SSH 作业离开实时队列后自动回退到账本查询。
-- 首次配置默认选择 OpenAPI，已有用户保留原 backend 偏好，更新设置时保留无关配置字段。
+- 协调下游 DSH 发布协议无关的一次性 loopback OAuth 回调监听器，包含固定路径校验、
+  超时清理和不暴露回调细节的通用浏览器响应。
+- canonical Skill 继续保持 endpoint 无关；本版本不嵌入 SCNet issuer、endpoint、client ID、
+  scope 或任何凭证。
 <!-- scnet-release:end -->
 
 > 本项目是独立维护的社区项目，与 DeepSeek Harness 兼容，但不是 DeepSeek 官方产品，也不表示 DeepSeek 对本项目提供背书、合作或授权。

package/connector/callback.mjs

@@ -0,0 +1,155 @@
+import { createServer } from 'node:http'
+
+import { ConnectorError } from './errors.mjs'
+
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', '::1', '[::1]', 'localhost'])
+const CALLBACK_TIMEOUT_MS = 120000
+
+function requiredString(value, label) {
+  const normalized = String(value ?? '').trim()
+  if (!normalized) throw new TypeError(`${label} must be a non-empty string`)
+  return normalized
+}
+
+function parseLoopbackRedirect(value) {
+  let redirect
+  try {
+    redirect = new URL(requiredString(value, 'redirectUri'))
+  } catch {
+    throw new TypeError('redirectUri must be a valid URL')
+  }
+  if (redirect.protocol !== 'http:' || !LOOPBACK_HOSTS.has(redirect.hostname)) {
+    throw new TypeError('redirectUri must use an http loopback address')
+  }
+  if (!redirect.pathname || redirect.pathname === '/') {
+    throw new TypeError('redirectUri must include a callback path')
+  }
+  if (redirect.username || redirect.password || redirect.hash) {
+    throw new TypeError('redirectUri must not include credentials or a fragment')
+  }
+  return redirect
+}
+
+function responseBody(res, statusCode, body) {
+  const content = Buffer.from(body, 'utf8')
+  res.writeHead(statusCode, {
+    'content-type': 'text/html; charset=utf-8',
+    'content-length': content.byteLength,
+    connection: 'close',
+  })
+  res.end(content)
+}
+
+/**
+ * Start a one-shot local OAuth callback listener.
+ *
+ * The listener is protocol-neutral: the caller owns the authorization session
+ * and provides its callback consumer. Browser responses never contain callback
+ * parameters or private error details.
+ */
+export async function listenLoopbackCallback({
+  redirectUri,
+  consumeCallback,
+  timeoutMs = CALLBACK_TIMEOUT_MS,
+} = {}) {
+  const requested = parseLoopbackRedirect(redirectUri)
+  if (typeof consumeCallback !== 'function') {
+    throw new TypeError('consumeCallback must be a function')
+  }
+  const timeout = Number(timeoutMs)
+  if (!Number.isFinite(timeout) || timeout <= 0) {
+    throw new TypeError('timeoutMs must be a positive number')
+  }
+
+  let settled = false
+  let timer
+  let actualRedirect
+  let resolveResult
+  let rejectResult
+  const result = new Promise((resolve, reject) => {
+    resolveResult = resolve
+    rejectResult = reject
+  })
+
+  const server = createServer((req, res) => {
+    if (settled) {
+      responseBody(res, 410, '<!doctype html><title>Callback closed</title>')
+      return
+    }
+    const callbackUrl = actualRedirect && new URL(req.url || '/', actualRedirect.origin)
+    if (req.method !== 'GET' || !callbackUrl || callbackUrl.pathname !== requested.pathname) {
+      responseBody(res, 404, '<!doctype html><title>Not found</title>')
+      return
+    }
+    settle(callbackUrl.href, res)
+  })
+
+  function closeServer() {
+    if (timer) clearTimeout(timer)
+    if (server.listening) server.close()
+  }
+
+  function settle(callbackUrl, res) {
+    if (settled) return
+    settled = true
+    try {
+      const value = consumeCallback(callbackUrl)
+      responseBody(res, 200, '<!doctype html><title>Authorization complete</title>')
+      resolveResult(value)
+    } catch (error) {
+      responseBody(res, 400, '<!doctype html><title>Authorization failed</title>')
+      rejectResult(
+        error instanceof ConnectorError
+          ? error
+          : new ConnectorError('CALLBACK_MISMATCH', error?.message || 'OAuth callback rejected', {
+              operation: 'login',
+            }),
+      )
+    } finally {
+      closeServer()
+    }
+  }
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject)
+    server.listen({
+      host: requested.hostname,
+      port: requested.port,
+      exclusive: true,
+    }, resolve)
+  }).catch((error) => {
+    closeServer()
+    throw new ConnectorError('CALLBACK_MISMATCH', 'Unable to open the local OAuth callback listener', {
+      operation: 'login',
+    })
+  })
+
+  const address = server.address()
+  if (!address || typeof address === 'string') {
+    closeServer()
+    throw new ConnectorError('CALLBACK_MISMATCH', 'Local OAuth callback listener returned no address', {
+      operation: 'login',
+    })
+  }
+  actualRedirect = new URL(requested.href)
+  actualRedirect.port = String(address.port)
+
+  timer = setTimeout(() => {
+    if (settled) return
+    settled = true
+    rejectResult(new ConnectorError('CALLBACK_MISMATCH', 'OAuth callback timed out', { operation: 'login' }))
+    closeServer()
+  }, timeout)
+  timer.unref?.()
+
+  return Object.freeze({
+    redirectUri: actualRedirect.href,
+    waitForCallback: () => result,
+    close() {
+      if (settled) return
+      settled = true
+      rejectResult(new ConnectorError('CALLBACK_MISMATCH', 'OAuth callback listener closed', { operation: 'login' }))
+      closeServer()
+    },
+  })
+}

package/connector/index.mjs

@@ -19,6 +19,10 @@ export {
   createCredentialStoreAdapter,
 } from './credentials.mjs'
 
+export {
+  listenLoopbackCallback,
+} from './callback.mjs'
+
 export {
   MemoryCredentialStore,
   TokenLifecycle,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-scnet",
-  "version": "0.6.9",
+  "version": "0.6.10",
   "description": "Community DeepSeek Harness bundle for SCNet SSH and OpenAPI jobs, files, Notebook resources, Slurm diagnostics, and Hygon DCU/DTK guidance.",
   "type": "module",
   "main": "./index.mjs",

package/skills/scnet-hpc/VERSION

@@ -1 +1 @@
-0.6.9
+0.6.10