dsh-skill-hub 0.3.21 → 0.3.22

package/lib/index.js

@@ -2391,6 +2391,15 @@ function isLoopbackRequest(request) {
 		return false;
 	}
 }
+/**
+* Fallback fence for a host that mounts no Connection service (unit tests, and
+* any composition serving the webserver alone): the historical literal-loopback
+* check, so a missing service degrades to the previous behaviour instead of an
+* open or a dead route family.
+*/
+function loopbackOnlyFence(request) {
+	return isLoopbackRequest(request) ? void 0 : 403;
+}
 /** One JSON response. */
 function writeJson(res, status, body) {
 	const payload = JSON.stringify(body);
@@ -2863,17 +2872,24 @@ function toDetail(skill) {
 //#region src/routes/helpers.ts
 /**
 * Wrap one handler in the shared request fences. Order matches the
-* original per-handler prologue: loopback trust → HTTP method → master
+* original per-handler prologue: trust fence → HTTP method → master
 * switch → JSON body. The outer catch maps errors onto the JSON error
 * body (preserving RepoFetchError status codes).
+*
+* The trust fence is the host's `/api` model (`deps.fence`) whenever the
+* composition mounts Connection, so a reverse-proxied deployment is judged by
+* the same authorities dsh already trusts; without that service the historical
+* literal-loopback check stands in.
 */
 function createRoute(deps, spec) {
+	const fence = deps.fence ?? loopbackOnlyFence;
 	return {
 		kind: spec.kind ?? "exact",
 		path: spec.path,
 		handler: async (req, res) => {
-			if (!isLoopbackRequest(req)) {
-				writeError(res, 403, "forbidden: loopback-only");
+			const rejection = fence(req);
+			if (rejection !== void 0) {
+				writeError(res, rejection, rejection === 401 ? "unauthorized: browser session required" : "forbidden: untrusted authority");
 				return;
 			}
 			if (!spec.methods.includes(req.method)) {
@@ -4507,8 +4523,45 @@ async function sweepOrphanTrash(deps, home, failed) {
 //#endregion
 //#region src/routes.ts
 /**
+* Build the family's trust fence from the host's `/api` model.
+*
+* `ctx.connection.requestRejection` is the documented hook for fencing another
+* Web route; with no Connection service (a webserver-only composition, or a
+* unit test) the literal-loopback check stands in, so the fallback is the old
+* behaviour rather than an open route family.
+*
+* The service is read **per request**, not once at mount: plugins start in
+* composition order, so a one-shot read at `apply()` time would latch the
+* fallback whenever this plugin happens to come up before Connection. A
+* persistent absence is almost certainly an upstream composition change rather
+* than a transient startup order, so the first miss fires `onMissing` once —
+* without that signal the fallback would silently reproduce issue #17 after
+* any future upstream rename of the service.
+* @param read - resolves `ctx.connection`, or `undefined` when absent.
+* @param onMissing - called once, the first time the service reads absent.
+* @returns the fence every route in this family runs first.
+*/
+function hostTrustFence(read, onMissing) {
+	let missingReported = false;
+	return (request) => {
+		const connection = read();
+		if (connection === void 0) {
+			if (!missingReported) {
+				missingReported = true;
+				onMissing?.();
+			}
+			return loopbackOnlyFence(request);
+		}
+		try {
+			return connection.requestRejection(request);
+		} catch {
+			return 403;
+		}
+	};
+}
+/**
 * Build every /api/skill-hub route.
-* @param deps - skill registry view + sidecar store.
+* @param deps - skill registry view + sidecar store + trust fence.
 * @returns the exact-path routes plus the family's 404 catch-all.
 */
 function makeRoutes(deps) {
@@ -5014,7 +5067,7 @@ const CONFIG_FIELDS = [
 /** Order of the announcement section within the tool-guidance band. */
 const SECTION_ORDER = 152;
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const SKILL_HUB_GUIDANCE = ["本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由仅回环可访问。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。", "The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → \"Skills\" is the management page; the plugin's configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with \"check all\" and \"update all\" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; routes are loopback-only. When the user mentions \"skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill\", this plugin is what they mean — collaborate accordingly."].join("\n\n");
+const SKILL_HUB_GUIDANCE = ["本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。", "The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → \"Skills\" is the management page; the plugin's configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with \"check all\" and \"update all\" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh's own /api trust fence (loopback, the listener's bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions \"skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill\", this plugin is what they mean — collaborate accordingly."].join("\n\n");
 /**
 * Mount the skill hub routes and announcement.
 * @param ctx - host plugin context carrying webServer/skills/systemPrompt/settings.
@@ -5105,6 +5158,7 @@ function apply(ctx, config) {
 			const disposers = makeRoutes({
 				skills: ctx.skills,
 				store,
+				fence: hostTrustFence(() => ctx.get("connection"), () => ctx.logger.warn("[dsh-skill-hub] Connection service absent: routes fall back to literal-loopback; reverse-proxy deployments will 403 until it mounts")),
 				invalidate: () => {
 					providerControl?.invalidate();
 				},

package/lib/types/client/locales/settings.d.ts

@@ -21,7 +21,7 @@ export declare const zhSettings: {
     readonly 'settings.statsScanMinutes': "自动统计间隔（分钟）";
     readonly 'settings.statsScanMinutesHint': "后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。";
     readonly 'settings.githubToken': "GitHub Token";
-    readonly 'settings.githubTokenHint': "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅回环可读；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。";
+    readonly 'settings.githubTokenHint': "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。";
     readonly 'settings.githubTokenPlaceholder': "ghp_… / github_pat_…（留空为匿名）";
     readonly 'settings.inherit': "继承";
     readonly 'settings.overridden': "已覆盖";

package/lib/types/client/locales.d.ts

@@ -26,7 +26,7 @@ export declare const zh: {
     readonly 'settings.statsScanMinutes': "自动统计间隔（分钟）";
     readonly 'settings.statsScanMinutesHint': "后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。";
     readonly 'settings.githubToken': "GitHub Token";
-    readonly 'settings.githubTokenHint': "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅回环可读；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。";
+    readonly 'settings.githubTokenHint': "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。";
     readonly 'settings.githubTokenPlaceholder': "ghp_… / github_pat_…（留空为匿名）";
     readonly 'settings.inherit': "继承";
     readonly 'settings.overridden': "已覆盖";

package/lib/types/protocol/config.d.ts

@@ -57,7 +57,7 @@ export type HubSettingsValue = {
     statsWindowDays?: number;
     /** 自动统计扫描间隔（分钟）。 */
     statsScanMinutes?: number;
-    /** GitHub token（明文存本地设置文档，仅回环可读；缺省为匿名）。 */
+    /** GitHub token（明文存本地设置文档，仅经 dsh 的 /api 信任栅栏可读；缺省为匿名）。 */
     githubToken?: string;
 };
 /**

package/lib/types/routes/deps.d.ts

@@ -1,11 +1,12 @@
 /**
  * routes 共享层 · 依赖视图：路由依赖接口、配置解析与可写技能解析（HTTP
- * 围栏在 ./http.ts）。从 helpers.ts 原样搬出，行为不变。
+ * 围栏在 ./http.ts）。
  */
 import type { ServerResponse } from 'node:http';
 import type { SkillDefinition, SkillSummary } from '@deepseek-ai/dsh-skill';
 import { type HubConfig, type WritableRoot } from '../protocol.ts';
 import { type SkillHubStore } from '../store.ts';
+import { type RouteFence } from './http.ts';
 /** Sources the hub may toggle (the user-level filesystem roots). */
 export declare function isWritableSource(source: string): source is WritableRoot;
 /** Lookup options the hub forwards to the registry (cwd selects project roots). */
@@ -22,6 +23,12 @@ export interface SkillHubRouteDeps {
         get(name: string, options?: SkillLookupLike): Promise<SkillDefinition | undefined>;
     };
     store: SkillHubStore;
+    /**
+     * Request fence for the whole family: returns the rejection status (401/403)
+     * or `undefined` to proceed. Production passes the host's own `/api` fence
+     * (`ctx.connection.requestRejection`); absent falls back to literal loopback.
+     */
+    fence?: RouteFence;
     /** DSH home override (tests isolate the writable roots; defaults to ~/.dsh). */
     home?: string;
     /** Invalidate the registry catalog cache after hub-driven mutations. */

package/lib/types/routes/helpers.d.ts

@@ -1,15 +1,15 @@
 /**
- * routes 共享层：请求围栏（回环信任/方法/总开关/JSON 体）、统一错误映射、
- * 可写技能解析、目录/分组数据装配。handler 只写业务，从这里 import。
- * 从 routes.ts 原样搬出，行为不变。
- * 本文件是聚合出口（barrel）：实现按域拆到 ./http.ts（围栏/错误映射/读体）、
+ * routes 共享层：请求栅栏（宿主 /api 信任模型 → 方法 → 总开关 → JSON 体）、
+ * 统一错误映射、可写技能解析、目录/分组数据装配。handler 只写业务，从这里 import。
+ * 本文件是聚合出口（barrel）：实现按域拆到 ./http.ts（栅栏/错误映射/读体）、
  * ./deps.ts（依赖视图/可写解析）、./collection.ts（集合装配）、
  * ./catalog-data.ts（目录装配）；对外导出面保持不变。
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { WebRoute, WebRouteKind } from '@deepseek-ai/dsh-host-webserver';
 import { type SkillHubRouteDeps } from './deps.ts';
-export { MAX_JSON_BODY_BYTES, STORE_ERROR_STATUS, isLoopbackRequest, pathExists, queryParam, readJsonBody, readString, readStrings, writeError, writeJson, writeRouteError, } from './http.ts';
+export { MAX_JSON_BODY_BYTES, STORE_ERROR_STATUS, isLoopbackRequest, loopbackOnlyFence, pathExists, queryParam, readJsonBody, readString, readStrings, writeError, writeJson, writeRouteError, } from './http.ts';
+export type { RouteFence } from './http.ts';
 export { configOf, disabledGate, homeOf, isWritableSource, resolveWritableSkill, savedOf, } from './deps.ts';
 export type { SkillHubRouteDeps, SkillLookupLike, WritableSkill, WritableSkillRefusal, WritableSkillResult, } from './deps.ts';
 export { buildCollections, buildGroups } from './collection.ts';
@@ -45,8 +45,13 @@ export interface RouteSpec {
 }
 /**
  * Wrap one handler in the shared request fences. Order matches the
- * original per-handler prologue: loopback trust → HTTP method → master
+ * original per-handler prologue: trust fence → HTTP method → master
  * switch → JSON body. The outer catch maps errors onto the JSON error
  * body (preserving RepoFetchError status codes).
+ *
+ * The trust fence is the host's `/api` model (`deps.fence`) whenever the
+ * composition mounts Connection, so a reverse-proxied deployment is judged by
+ * the same authorities dsh already trusts; without that service the historical
+ * literal-loopback check stands in.
  */
 export declare function createRoute(deps: SkillHubRouteDeps, spec: RouteSpec): WebRoute;

package/lib/types/routes/http.d.ts

@@ -1,12 +1,37 @@
 /**
- * routes 共享层 · HTTP 围栏：回环信任检查、JSON 响应与错误映射、请求体读取、
- * 查询/字段读取与文件存在性检查。从 helpers.ts 原样搬出，行为不变。
+ * routes 共享层 · HTTP 围栏：请求信任栅栏（复用宿主 `/api` 模型，见 RouteFence）、
+ * JSON 响应与错误映射、请求体读取、查询/字段读取与文件存在性检查。
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 /** Cap on JSON request bodies (toggle/create payloads are tiny). */
 export declare const MAX_JSON_BODY_BYTES: number;
 /** Loopback literal check plus browser same-origin markers. */
 export declare function isLoopbackRequest(request: IncomingMessage): boolean;
+/**
+ * The route family's request fence: the HTTP status a request is rejected
+ * with (`401` unauthenticated / `403` untrusted authority), or `undefined`
+ * when it may reach the handler.
+ *
+ * dsh owns **one** browser-trust model for the whole `/api` tree — loopback,
+ * the listener's own bind address, every `--trusted-host` authority, then the
+ * browser session — and publishes it as `ctx.connection.requestRejection`,
+ * whose contract is written for exactly this case ("apply Connection's
+ * Host/Origin checks ... to another Web route"). Our paths are exact routes
+ * registered beside the shared `/api` prefix, so the host's own fence never
+ * sees them; asking its entry point instead of re-deriving the rule keeps a
+ * single trust model rather than a second, stricter one. Issue #17 is what the
+ * second one cost: behind a reverse proxy the literals checkable in this file
+ * are the gateway address and the public domain, so every route answered 403
+ * while the rest of the GUI worked.
+ */
+export type RouteFence = (request: IncomingMessage) => number | undefined;
+/**
+ * Fallback fence for a host that mounts no Connection service (unit tests, and
+ * any composition serving the webserver alone): the historical literal-loopback
+ * check, so a missing service degrades to the previous behaviour instead of an
+ * open or a dead route family.
+ */
+export declare function loopbackOnlyFence(request: IncomingMessage): number | undefined;
 /** One JSON response. */
 export declare function writeJson(res: ServerResponse, status: number, body: unknown): void;
 /** One JSON error response. */

package/lib/types/routes.d.ts

@@ -3,20 +3,45 @@
  * official registry + hub-disabled skills + discovery diagnostics), skill
  * detail, enable/disable toggle, new-skill scaffold, user groups (tags +
  * origin collections), and upstream source tracking (check/sync/follow
- * upstream deletion into a restorable trash). Every route carries a
- * loopback-only trust fence — these endpoints rename files under the user's
- * skill roots, so LAN-exposed dsh web deployments must not serve them.
+ * upstream deletion into a restorable trash). Every route carries the host's
+ * own `/api` trust fence (loopback, the listener's bind address, each
+ * `--trusted-host` authority, then the browser session) — these endpoints
+ * rename files under the user's skill roots, so they must never be laxer than
+ * the GUI around them (issue #17).
  *
  * 按域拆分后的聚合入口：各域 handler 在 ./routes/<domain>.ts，共享围栏在
  * ./routes/helpers.ts，节流/任务状态在 ./routes/route-state.ts。
  * 老 `from './routes.ts'`（makeRoutes + SkillHubRouteDeps）保持可用。
  */
+import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
 import { type SkillHubRouteDeps } from './routes/helpers.ts';
+import { type RouteFence } from './routes/http.ts';
 export type { SkillHubRouteDeps, SkillLookupLike } from './routes/helpers.ts';
+export type { RouteFence } from './routes/http.ts';
+/**
+ * Build the family's trust fence from the host's `/api` model.
+ *
+ * `ctx.connection.requestRejection` is the documented hook for fencing another
+ * Web route; with no Connection service (a webserver-only composition, or a
+ * unit test) the literal-loopback check stands in, so the fallback is the old
+ * behaviour rather than an open route family.
+ *
+ * The service is read **per request**, not once at mount: plugins start in
+ * composition order, so a one-shot read at `apply()` time would latch the
+ * fallback whenever this plugin happens to come up before Connection. A
+ * persistent absence is almost certainly an upstream composition change rather
+ * than a transient startup order, so the first miss fires `onMissing` once —
+ * without that signal the fallback would silently reproduce issue #17 after
+ * any future upstream rename of the service.
+ * @param read - resolves `ctx.connection`, or `undefined` when absent.
+ * @param onMissing - called once, the first time the service reads absent.
+ * @returns the fence every route in this family runs first.
+ */
+export declare function hostTrustFence(read: () => HostConnectionHandle | undefined, onMissing?: () => void): RouteFence;
 /**
  * Build every /api/skill-hub route.
- * @param deps - skill registry view + sidecar store.
+ * @param deps - skill registry view + sidecar store + trust fence.
  * @returns the exact-path routes plus the family's 404 catch-all.
  */
 export declare function makeRoutes(deps: SkillHubRouteDeps): WebRoute[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.21",
+  "version": "0.3.22",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {

package/src/client/locales/settings.ts

@@ -21,7 +21,7 @@ export const zhSettings = {
   'settings.statsScanMinutes': '自动统计间隔（分钟）',
   'settings.statsScanMinutesHint': '后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。',
   'settings.githubToken': 'GitHub Token',
-  'settings.githubTokenHint': '市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅回环可读；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。',
+  'settings.githubTokenHint': '市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。',
   'settings.githubTokenPlaceholder': 'ghp_… / github_pat_…（留空为匿名）',
   'settings.inherit': '继承',
   'settings.overridden': '已覆盖',
@@ -59,7 +59,7 @@ export const enSettings: Record<keyof typeof zhSettings, string> = {
   'settings.statsScanMinutes': 'Auto stats interval (minutes)',
   'settings.statsScanMinutesHint': 'How often the background session-log scan runs (min 1); heavy scans automatically stretch it.',
   'settings.githubToken': 'GitHub token',
-  'settings.githubTokenHint': 'Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, loopback-only; empty means anonymous (or GITHUB_TOKEN env).',
+  'settings.githubTokenHint': 'Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, reachable only through dsh\'s /api trust fence (loopback / bind address / --trusted-host); empty means anonymous (or GITHUB_TOKEN env).',
   'settings.githubTokenPlaceholder': 'ghp_… / github_pat_… (empty = anonymous)',
   'settings.inherit': 'Inherit',
   'settings.overridden': 'Overridden',

package/src/index.ts

@@ -14,6 +14,8 @@ import type { SettingsForms, SettingsNamespace, SettingsPathOp } from '@deepseek
 // loader's `fiber.runtime.Config` handling) only exist here. Every official
 // plugin imports it under this name.
 import z from '@deepseek-ai/schemastery'
+// Type-only, for the `ctx.connection` augmentation (the `/api` trust fence).
+import type {} from '@deepseek-ai/dsh-client-connection'
 import type {} from '@deepseek-ai/dsh-host-webserver'
 import type {} from '@deepseek-ai/dsh-skill'
 import type {} from '@deepseek-ai/dsh-system-prompt'
@@ -21,7 +23,7 @@ import type {} from '@deepseek-ai/dsh-session-query'
 import type {} from '@deepseek-ai/dsh-settings'
 import { HUB_CONFIG_DEFAULTS, HUB_ENTRY_ID, HEX_COLOR_RE, resolveHubConfig, type HubConfig } from './protocol.ts'
 import { SkillHubProvider } from './provider.ts'
-import { makeRoutes } from './routes.ts'
+import { hostTrustFence, makeRoutes } from './routes.ts'
 import { createSkillStatsReader, asPersistenceSeam, type SessionPersistenceLike, type SessionQueryLike, type SkillStatsReader } from './stats.ts'
 import { SkillHubStore } from './store.ts'
 import { reconcileDisabledSkills, pruneStaleDisabledSkills } from './reconcile.ts'
@@ -132,8 +134,8 @@ const SECTION_ORDER = 152
 
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
 export const SKILL_HUB_GUIDANCE = [
-  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由仅回环可访问。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
-  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; routes are loopback-only. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
+  '本机已安装 dsh-skill-hub 插件（DSH Web GUI 技能中枢）：设置 →「技能」分区为管理主页；本插件的配置页（启用/公告开关、圆点颜色、GitHub token、统计窗口）在插件管理页——侧边栏「插件」→ 本插件，是本插件自己注册的配置卡片（默认折叠，点标题展开）。能力：完整本地技能目录（项目/自定义/用户/内置全部来源，走官方 ctx.skills 注册表，含第三方 provider）；按来源与自定义分组浏览，分组/来源头部的滑动开关可一键启用/禁用整组（跨组冲突时询问）；市场：内置市场目录（精选仓库一键添加）加自定义仓库源，扫描后勾选安装，每个市场源行显示已装/可更新/上游已删数量，支持「检查全部」与「全部更新」；来源跟踪：从 GitHub 仓库（市场源或直接地址）导入的技能记录上游 repo/commit 快照，可检查更新、选择同步、上游删除时跟进删除（移入回收站可恢复，恢复后保留来源与场景归属）；个人技能（无来源记录）不跟踪；调用次数与最近使用时间统计；查看技能正文；发现诊断；新建技能向导（写入 ~/.dsh/skills 或 ~/.agents/skills）。限制：仅用户级技能（user-dsh/user-agents 根目录）可写，项目/内置/运行时技能只读展示；路由受 dsh 自身的 /api 信任栅栏保护（回环、监听器绑定地址、--trusted-host 声明的 authority，外加浏览器会话认证），因此反代部署下与 GUI 同一套放行规则。用户提到「技能管理 / 技能列表 / 技能开关 / 技能同步 / 技能市场 / 更新技能 / 新建技能」时即指本插件，请据此协作。',
+  'The dsh-skill-hub plugin is installed (the DSH Web GUI skill hub): Settings → "Skills" is the management page; the plugin\'s configuration page (enable / announcement toggles, dot colors, GitHub token, stats window) is registered by the plugin itself on its own page in the Plugins manager (sidebar → 插件 → the plugin; collapsed until you expand the title). Capabilities: full local skill catalog (project / custom / user / bundled roots via the official ctx.skills registry, including third-party providers); browsing by source and custom groups, each group header carrying a sliding switch to enable/disable the whole group in one click (cross-group conflicts prompt the user); market: a built-in catalog of curated repos (one-click add) plus custom repo sources, scan-and-install import, per-source installed / updatable / deleted-upstream badges with "check all" and "update all" actions; upstream source tracking: skills imported from GitHub repos (market sources or direct URLs) record the repo/commit snapshot, support update checks, selective sync, and follow-up deletion when the upstream removes a skill (moves it into a restorable trash; restoring keeps the source and scene membership); personal skills (no source record) are never tracked; invocation counts and last-used times; skill body inspection; discovery diagnostics; new-skill wizard (writes to ~/.dsh/skills or ~/.agents/skills). Limits: only user-level skills (user-dsh/user-agents roots) are writable; project/bundled/runtime skills are read-only; the routes sit behind dsh\'s own /api trust fence (loopback, the listener\'s bind address, any --trusted-host authority, plus browser-session authentication), so a reverse-proxied deployment is judged exactly like the GUI around it. When the user mentions "skill management / skill list / skill toggle / skill sync / skill market / update skills / new skill", this plugin is what they mean — collaborate accordingly.'
 ].join('\n\n')
 
 /**
@@ -262,6 +264,16 @@ export function apply(ctx: Context, config?: Config): void {
         const disposers = makeRoutes({
           skills: ctx.skills,
           store,
+          // The host's own `/api` trust fence (loopback ∪ bind address ∪
+          // --trusted-host ∪ browser session). Read per request: Connection
+          // may be provided after this plugin starts, and a one-shot read here
+          // would latch the literal-loopback fallback for the whole process.
+          // A *persistent* absence means the upstream composition changed —
+          // say so once instead of silently re-creating issue #17.
+          fence: hostTrustFence(
+            () => ctx.get('connection'),
+            () => ctx.logger.warn('[dsh-skill-hub] Connection service absent: routes fall back to literal-loopback; reverse-proxy deployments will 403 until it mounts'),
+          ),
           invalidate: () => { providerControl?.invalidate() },
           stats,
           config: current,

package/src/protocol/config.ts

@@ -60,7 +60,7 @@ export type HubSettingsValue = {
   statsWindowDays?: number
   /** 自动统计扫描间隔（分钟）。 */
   statsScanMinutes?: number
-  /** GitHub token（明文存本地设置文档，仅回环可读；缺省为匿名）。 */
+  /** GitHub token（明文存本地设置文档，仅经 dsh 的 /api 信任栅栏可读；缺省为匿名）。 */
   githubToken?: string
 }
 

package/src/routes/deps.ts

@@ -1,6 +1,6 @@
 /**
  * routes 共享层 · 依赖视图：路由依赖接口、配置解析与可写技能解析（HTTP
- * 围栏在 ./http.ts）。从 helpers.ts 原样搬出，行为不变。
+ * 围栏在 ./http.ts）。
  */
 
 import type { ServerResponse } from 'node:http'
@@ -8,7 +8,7 @@ import type { SkillDefinition, SkillSummary } from '@deepseek-ai/dsh-skill'
 import { resolveHubConfig, type HubConfig, type WritableRoot } from '../protocol.ts'
 import { rootOfPath } from '../skillfs.ts'
 import { dshHome, type SkillHubStore } from '../store.ts'
-import { writeError } from './http.ts'
+import { writeError, type RouteFence } from './http.ts'
 
 /** Sources the hub may toggle (the user-level filesystem roots). */
 export function isWritableSource(source: string): source is WritableRoot {
@@ -27,6 +27,12 @@ export interface SkillHubRouteDeps {
     get(name: string, options?: SkillLookupLike): Promise<SkillDefinition | undefined>
   }
   store: SkillHubStore
+  /**
+   * Request fence for the whole family: returns the rejection status (401/403)
+   * or `undefined` to proceed. Production passes the host's own `/api` fence
+   * (`ctx.connection.requestRejection`); absent falls back to literal loopback.
+   */
+  fence?: RouteFence
   /** DSH home override (tests isolate the writable roots; defaults to ~/.dsh). */
   home?: string
   /** Invalidate the registry catalog cache after hub-driven mutations. */

package/src/routes/helpers.ts

@@ -1,8 +1,7 @@
 /**
- * routes 共享层：请求围栏（回环信任/方法/总开关/JSON 体）、统一错误映射、
- * 可写技能解析、目录/分组数据装配。handler 只写业务，从这里 import。
- * 从 routes.ts 原样搬出，行为不变。
- * 本文件是聚合出口（barrel）：实现按域拆到 ./http.ts（围栏/错误映射/读体）、
+ * routes 共享层：请求栅栏（宿主 /api 信任模型 → 方法 → 总开关 → JSON 体）、
+ * 统一错误映射、可写技能解析、目录/分组数据装配。handler 只写业务，从这里 import。
+ * 本文件是聚合出口（barrel）：实现按域拆到 ./http.ts（栅栏/错误映射/读体）、
  * ./deps.ts（依赖视图/可写解析）、./collection.ts（集合装配）、
  * ./catalog-data.ts（目录装配）；对外导出面保持不变。
  */
@@ -10,12 +9,13 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute, WebRouteKind } from '@deepseek-ai/dsh-host-webserver'
 import { disabledGate, type SkillHubRouteDeps } from './deps.ts'
-import { isLoopbackRequest, readJsonBody, writeError, writeRouteError } from './http.ts'
+import { loopbackOnlyFence, readJsonBody, writeError, writeRouteError } from './http.ts'
 
 export {
   MAX_JSON_BODY_BYTES,
   STORE_ERROR_STATUS,
   isLoopbackRequest,
+  loopbackOnlyFence,
   pathExists,
   queryParam,
   readJsonBody,
@@ -25,6 +25,7 @@ export {
   writeJson,
   writeRouteError,
 } from './http.ts'
+export type { RouteFence } from './http.ts'
 export {
   configOf,
   disabledGate,
@@ -83,16 +84,26 @@ export interface RouteSpec {
 
 /**
  * Wrap one handler in the shared request fences. Order matches the
- * original per-handler prologue: loopback trust → HTTP method → master
+ * original per-handler prologue: trust fence → HTTP method → master
  * switch → JSON body. The outer catch maps errors onto the JSON error
  * body (preserving RepoFetchError status codes).
+ *
+ * The trust fence is the host's `/api` model (`deps.fence`) whenever the
+ * composition mounts Connection, so a reverse-proxied deployment is judged by
+ * the same authorities dsh already trusts; without that service the historical
+ * literal-loopback check stands in.
  */
 export function createRoute(deps: SkillHubRouteDeps, spec: RouteSpec): WebRoute {
+  const fence = deps.fence ?? loopbackOnlyFence
   return {
     kind: spec.kind ?? 'exact',
     path: spec.path,
     handler: async (req, res) => {
-      if (!isLoopbackRequest(req)) { writeError(res, 403, 'forbidden: loopback-only'); return }
+      const rejection = fence(req)
+      if (rejection !== undefined) {
+        writeError(res, rejection, rejection === 401 ? 'unauthorized: browser session required' : 'forbidden: untrusted authority')
+        return
+      }
       if (!spec.methods.includes(req.method as 'GET' | 'POST')) {
         writeError(res, 405, 'method not allowed: ' + (req.method ?? ''))
         return

package/src/routes/http.ts

@@ -1,6 +1,6 @@
 /**
- * routes 共享层 · HTTP 围栏：回环信任检查、JSON 响应与错误映射、请求体读取、
- * 查询/字段读取与文件存在性检查。从 helpers.ts 原样搬出，行为不变。
+ * routes 共享层 · HTTP 围栏：请求信任栅栏（复用宿主 `/api` 模型，见 RouteFence）、
+ * JSON 响应与错误映射、请求体读取、查询/字段读取与文件存在性检查。
  */
 
 import { stat } from 'node:fs/promises'
@@ -35,6 +35,35 @@ export function isLoopbackRequest(request: IncomingMessage): boolean {
   }
 }
 
+/**
+ * The route family's request fence: the HTTP status a request is rejected
+ * with (`401` unauthenticated / `403` untrusted authority), or `undefined`
+ * when it may reach the handler.
+ *
+ * dsh owns **one** browser-trust model for the whole `/api` tree — loopback,
+ * the listener's own bind address, every `--trusted-host` authority, then the
+ * browser session — and publishes it as `ctx.connection.requestRejection`,
+ * whose contract is written for exactly this case ("apply Connection's
+ * Host/Origin checks ... to another Web route"). Our paths are exact routes
+ * registered beside the shared `/api` prefix, so the host's own fence never
+ * sees them; asking its entry point instead of re-deriving the rule keeps a
+ * single trust model rather than a second, stricter one. Issue #17 is what the
+ * second one cost: behind a reverse proxy the literals checkable in this file
+ * are the gateway address and the public domain, so every route answered 403
+ * while the rest of the GUI worked.
+ */
+export type RouteFence = (request: IncomingMessage) => number | undefined
+
+/**
+ * Fallback fence for a host that mounts no Connection service (unit tests, and
+ * any composition serving the webserver alone): the historical literal-loopback
+ * check, so a missing service degrades to the previous behaviour instead of an
+ * open or a dead route family.
+ */
+export function loopbackOnlyFence(request: IncomingMessage): number | undefined {
+  return isLoopbackRequest(request) ? undefined : 403
+}
+
 /** One JSON response. */
 export function writeJson(res: ServerResponse, status: number, body: unknown): void {
   const payload = JSON.stringify(body)