dshb-auth 0.0.1

package/lib/startup.d.ts

@@ -0,0 +1,15 @@
+import { t as Context } from "./index-CLOUBKxU.js";
+//#region src/startup.d.ts
+declare const name = "web-startup";
+declare const inject: string[];
+declare const WEB_STARTUP_SERVICE = "webStartup";
+interface WebStartupValues {
+  openBrowser: boolean;
+  host?: string;
+  port?: number;
+  trustedHosts: string[];
+}
+declare function apply(ctx: Context): void;
+//#endregion
+export { WEB_STARTUP_SERVICE, WebStartupValues, apply, inject, name };
+//# sourceMappingURL=startup.d.ts.map

package/lib/startup.js

@@ -0,0 +1,68 @@
+import { sanitizeUsername, sharedCredentialStore } from "./credentials.js";
+import { Command } from "commander";
+import { parseCmdline } from "@deepseek-ai/dsh-cmdline";
+//#region src/startup.ts
+const name = "web-startup";
+const inject = ["cmdlineArgs"];
+const WEB_STARTUP_SERVICE = "webStartup";
+function runAuthReset(args) {
+	const store = sharedCredentialStore();
+	if (!store.isInitialized()) {
+		console.error("auth-reset: 尚未初始化管理员账号");
+		process.exit(1);
+	}
+	let password;
+	let username;
+	for (let i = 1; i < args.length; i++) if (args[i] === "--password") password = args[++i];
+	else if (args[i] === "--username") username = args[++i];
+	if (password === void 0 && username === void 0) {
+		console.error("auth-reset: 需要 --password <新密码> 和/或 --username <新用户名>");
+		process.exit(1);
+	}
+	if (password !== void 0 && password.length < 8) {
+		console.error("auth-reset: 密码至少 8 个字符");
+		process.exit(1);
+	}
+	if (username !== void 0) {
+		username = sanitizeUsername(username);
+		if (!username) {
+			console.error("auth-reset: 用户名不能为空");
+			process.exit(1);
+		}
+	}
+	if (password !== void 0) store.changePassword(username ?? store.username, password);
+	else store.changeUsername(username);
+	console.log("auth-reset: 已更新凭据并轮换会话密钥，全部已签发会话作废");
+	process.exit(0);
+}
+function webCommand() {
+	return new Command().name("dsh --profile web").description("Serve the DeepSeek Harness browser UI.").helpOption("-h, --help", "show this help").option("--host <host>", "bind host").option("--no-open", "do not open the Web UI in the default browser").option("--port <port>", "listen port; pass 0 to let the OS pick a free one").option("--trusted-host <authority...>", "extra authority the /api browser-trust fence accepts (host or host:port; repeatable)").addHelpText("after", `
+Examples:
+  dsh --profile web                          serve on the composed host and port
+  dsh --profile web --no-open                serve without opening a browser
+  dsh --profile web --port 8080              serve on another port
+  dsh --profile web --host 0.0.0.0           serve on all interfaces (DSHB: auth plugin guards access)
+  dsh --profile web auth-reset --password <新密码>   reset admin credentials and revoke all sessions
+`);
+}
+function apply(ctx) {
+	const args = ctx.cmdlineArgs?.get() ?? [];
+	if (args[0] === "auth-reset") runAuthReset(args);
+	const program = webCommand();
+	program.action(() => {
+		const options = program.opts();
+		if (options.port !== void 0 && !/^\d+$/.test(options.port)) program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`);
+		const values = {
+			openBrowser: options.open,
+			...options.host !== void 0 && { host: options.host },
+			...options.port !== void 0 && { port: Number(options.port) },
+			trustedHosts: options.trustedHost ?? []
+		};
+		ctx.provide(WEB_STARTUP_SERVICE, values);
+	});
+	parseCmdline(ctx, program);
+}
+//#endregion
+export { WEB_STARTUP_SERVICE, apply, inject, name };
+
+//# sourceMappingURL=startup.js.map

package/lib/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","names":[],"sources":["../src/startup.ts"],"sourcesContent":["import { Command } from 'commander'\nimport { parseCmdline } from '@deepseek-ai/dsh-cmdline'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sanitizeUsername, sharedCredentialStore } from './credentials.js'\n\nexport const name = 'web-startup'\n\nexport const inject = ['cmdlineArgs']\n\nexport const WEB_STARTUP_SERVICE = 'webStartup'\n\nexport interface WebStartupValues {\n  openBrowser: boolean\n  host?: string\n  port?: number\n  trustedHosts: string[]\n}\n\nfunction runAuthReset(args: readonly string[]): never {\n  const store = sharedCredentialStore()\n  if (!store.isInitialized()) {\n    console.error('auth-reset: 尚未初始化管理员账号')\n    process.exit(1)\n  }\n  let password: string | undefined\n  let username: string | undefined\n  for (let i = 1; i < args.length; i++) {\n    if (args[i] === '--password') password = args[++i]\n    else if (args[i] === '--username') username = args[++i]\n  }\n  if (password === undefined && username === undefined) {\n    console.error('auth-reset: 需要 --password <新密码> 和/或 --username <新用户名>')\n    process.exit(1)\n  }\n  if (password !== undefined && password.length < 8) {\n    console.error('auth-reset: 密码至少 8 个字符')\n    process.exit(1)\n  }\n  if (username !== undefined) {\n    username = sanitizeUsername(username)\n    if (!username) {\n      console.error('auth-reset: 用户名不能为空')\n      process.exit(1)\n    }\n  }\n  if (password !== undefined) store.changePassword(username ?? store.username!, password)\n  else store.changeUsername(username!)\n  console.log('auth-reset: 已更新凭据并轮换会话密钥，全部已签发会话作废')\n  process.exit(0)\n}\n\nfunction webCommand(): Command {\n  return new Command()\n    .name('dsh --profile web')\n    .description('Serve the DeepSeek Harness browser UI.')\n    .helpOption('-h, --help', 'show this help')\n    .option('--host <host>', 'bind host')\n    .option('--no-open', 'do not open the Web UI in the default browser')\n    .option('--port <port>', 'listen port; pass 0 to let the OS pick a free one')\n    .option(\n      '--trusted-host <authority...>',\n      'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)',\n    )\n    .addHelpText(\n      'after',\n      `\nExamples:\n  dsh --profile web                          serve on the composed host and port\n  dsh --profile web --no-open                serve without opening a browser\n  dsh --profile web --port 8080              serve on another port\n  dsh --profile web --host 0.0.0.0           serve on all interfaces (DSHB: auth plugin guards access)\n  dsh --profile web auth-reset --password <新密码>   reset admin credentials and revoke all sessions\n`,\n    )\n}\n\nexport function apply(ctx: Context): void {\n  const args = ctx.cmdlineArgs?.get() ?? []\n  if (args[0] === 'auth-reset') runAuthReset(args)\n  const program = webCommand()\n  program.action(() => {\n    const options = program.opts()\n    if (options.port !== undefined && !/^\\d+$/.test(options.port)) {\n      program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`)\n    }\n    const values: WebStartupValues = {\n      openBrowser: options.open,\n      ...(options.host !== undefined && { host: options.host }),\n      ...(options.port !== undefined && { port: Number(options.port) }),\n      trustedHosts: options.trustedHost ?? [],\n    }\n    ctx.provide(WEB_STARTUP_SERVICE, values)\n  })\n  parseCmdline(ctx, program)\n}\n"],"mappings":";;;;AAKA,MAAa,OAAO;AAEpB,MAAa,SAAS,CAAC,aAAa;AAEpC,MAAa,sBAAsB;AASnC,SAAS,aAAa,MAAgC;CACpD,MAAM,QAAQ,sBAAsB;CACpC,IAAI,CAAC,MAAM,cAAc,GAAG;EAC1B,QAAQ,MAAM,wBAAwB;EACtC,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI;CACJ,IAAI;CACJ,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAC/B,IAAI,KAAK,OAAO,cAAc,WAAW,KAAK,EAAE;MAC3C,IAAI,KAAK,OAAO,cAAc,WAAW,KAAK,EAAE;CAEvD,IAAI,aAAa,KAAA,KAAa,aAAa,KAAA,GAAW;EACpD,QAAQ,MAAM,uDAAuD;EACrE,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI,aAAa,KAAA,KAAa,SAAS,SAAS,GAAG;EACjD,QAAQ,MAAM,wBAAwB;EACtC,QAAQ,KAAK,CAAC;CAChB;CACA,IAAI,aAAa,KAAA,GAAW;EAC1B,WAAW,iBAAiB,QAAQ;EACpC,IAAI,CAAC,UAAU;GACb,QAAQ,MAAM,qBAAqB;GACnC,QAAQ,KAAK,CAAC;EAChB;CACF;CACA,IAAI,aAAa,KAAA,GAAW,MAAM,eAAe,YAAY,MAAM,UAAW,QAAQ;MACjF,MAAM,eAAe,QAAS;CACnC,QAAQ,IAAI,oCAAoC;CAChD,QAAQ,KAAK,CAAC;AAChB;AAEA,SAAS,aAAsB;CAC7B,OAAO,IAAI,QAAQ,CAAC,CACjB,KAAK,mBAAmB,CAAC,CACzB,YAAY,wCAAwC,CAAC,CACrD,WAAW,cAAc,gBAAgB,CAAC,CAC1C,OAAO,iBAAiB,WAAW,CAAC,CACpC,OAAO,aAAa,+CAA+C,CAAC,CACpE,OAAO,iBAAiB,mDAAmD,CAAC,CAC5E,OACC,iCACA,sFACF,CAAC,CACA,YACC,SACA;;;;;;;CAQF;AACJ;AAEA,SAAgB,MAAM,KAAoB;CACxC,MAAM,OAAO,IAAI,aAAa,IAAI,KAAK,CAAC;CACxC,IAAI,KAAK,OAAO,cAAc,aAAa,IAAI;CAC/C,MAAM,UAAU,WAAW;CAC3B,QAAQ,aAAa;EACnB,MAAM,UAAU,QAAQ,KAAK;EAC7B,IAAI,QAAQ,SAAS,KAAA,KAAa,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAC1D,QAAQ,MAAM,uCAAuC,KAAK,UAAU,QAAQ,IAAI,GAAG;EAErF,MAAM,SAA2B;GAC/B,aAAa,QAAQ;GACrB,GAAI,QAAQ,SAAS,KAAA,KAAa,EAAE,MAAM,QAAQ,KAAK;GACvD,GAAI,QAAQ,SAAS,KAAA,KAAa,EAAE,MAAM,OAAO,QAAQ,IAAI,EAAE;GAC/D,cAAc,QAAQ,eAAe,CAAC;EACxC;EACA,IAAI,QAAQ,qBAAqB,MAAM;CACzC,CAAC;CACD,aAAa,KAAK,OAAO;AAC3B"}

package/lib/webserver.d.ts

@@ -0,0 +1,18 @@
+import { t as Context } from "./index-CLOUBKxU.js";
+import WebServer, { WebRoute, WebUpgradeRoute } from "@deepseek-ai/dsh-host-webserver";
+//#region src/webserver.d.ts
+declare class AuthedWebServer extends WebServer {
+  private readonly gate;
+  constructor(ctx: Context, config: {
+    host: '127.0.0.1' | '0.0.0.0';
+    port: number;
+  });
+  register(route: WebRoute): () => void;
+  registerFallback(handler: WebRoute['handler']): () => void;
+  registerUpgrade(route: WebUpgradeRoute): () => void;
+  private guarded;
+  private guardedUpgrade;
+}
+//#endregion
+export { AuthedWebServer as default };
+//# sourceMappingURL=webserver.d.ts.map

package/lib/webserver.js

@@ -0,0 +1,60 @@
+import { sharedCredentialStore } from "./credentials.js";
+import { AuthGate, rewriteToLoopback } from "./gate.js";
+import WebServer from "@deepseek-ai/dsh-host-webserver";
+//#region src/webserver.ts
+var AuthedWebServer = class extends WebServer {
+	gate = new AuthGate(sharedCredentialStore());
+	constructor(ctx, config) {
+		super(ctx, config);
+	}
+	register(route) {
+		return super.register({
+			...route,
+			handler: (req, res) => this.guarded(route, req, res)
+		});
+	}
+	registerFallback(handler) {
+		return super.registerFallback((req, res) => this.guarded({
+			kind: "exact",
+			path: "/",
+			handler
+		}, req, res));
+	}
+	registerUpgrade(route) {
+		return super.registerUpgrade({
+			...route,
+			handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head)
+		});
+	}
+	guarded(route, req, res) {
+		const decision = this.gate.decide(req);
+		if (decision === "allow") {
+			rewriteToLoopback(req, this.port);
+			return route.handler(req, res);
+		}
+		if (decision === "exempt") return route.handler(req, res);
+		if (decision === "redirect-login") {
+			res.writeHead(302, { location: "/login" });
+			res.end();
+			return;
+		}
+		res.writeHead(401, { "content-type": "application/json" });
+		res.end(JSON.stringify({
+			ok: false,
+			error: "unauthorized"
+		}));
+	}
+	guardedUpgrade(route, req, socket, head) {
+		const decision = this.gate.decide(req);
+		if (decision === "allow" || decision === "exempt") {
+			if (decision === "allow") rewriteToLoopback(req, this.port);
+			return route.handler(req, socket, head);
+		}
+		socket.write("HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n");
+		socket.destroy();
+	}
+};
+//#endregion
+export { AuthedWebServer as default };
+
+//# sourceMappingURL=webserver.js.map

package/lib/webserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webserver.js","names":[],"sources":["../src/webserver.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from 'node:http'\nimport type { Duplex } from 'node:stream'\nimport WebServer from '@deepseek-ai/dsh-host-webserver'\nimport type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver'\nimport type { Context } from '@deepseek-ai/cordis'\nimport { sharedCredentialStore } from './credentials.js'\nimport { AuthGate, rewriteToLoopback } from './gate.js'\n\nexport default class AuthedWebServer extends WebServer {\n  private readonly gate = new AuthGate(sharedCredentialStore())\n\n  constructor(ctx: Context, config: { host: '127.0.0.1' | '0.0.0.0'; port: number }) {\n    super(ctx, config)\n  }\n\n  override register(route: WebRoute): () => void {\n    return super.register({ ...route, handler: (req, res) => this.guarded(route, req, res) })\n  }\n\n  override registerFallback(handler: WebRoute['handler']): () => void {\n    return super.registerFallback((req, res) =>\n      this.guarded({ kind: 'exact', path: '/', handler }, req, res),\n    )\n  }\n\n  override registerUpgrade(route: WebUpgradeRoute): () => void {\n    return super.registerUpgrade({\n      ...route,\n      handler: (req, socket, head) => this.guardedUpgrade(route, req, socket, head),\n    })\n  }\n\n  private guarded(route: WebRoute, req: IncomingMessage, res: ServerResponse): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow') {\n      rewriteToLoopback(req, this.port)\n      return route.handler(req, res)\n    }\n    if (decision === 'exempt') {\n      return route.handler(req, res)\n    }\n    if (decision === 'redirect-login') {\n      res.writeHead(302, { location: '/login' })\n      res.end()\n      return\n    }\n    res.writeHead(401, { 'content-type': 'application/json' })\n    res.end(JSON.stringify({ ok: false, error: 'unauthorized' }))\n  }\n\n  private guardedUpgrade(\n    route: WebUpgradeRoute,\n    req: IncomingMessage,\n    socket: Duplex,\n    head: Buffer,\n  ): void | Promise<void> {\n    const decision = this.gate.decide(req)\n    if (decision === 'allow' || decision === 'exempt') {\n      if (decision === 'allow') rewriteToLoopback(req, this.port)\n      return route.handler(req, socket, head)\n    }\n    socket.write('HTTP/1.1 401 Unauthorized\\r\\nConnection: close\\r\\n\\r\\n')\n    socket.destroy()\n  }\n}\n"],"mappings":";;;;AAQA,IAAqB,kBAArB,cAA6C,UAAU;CACrD,OAAwB,IAAI,SAAS,sBAAsB,CAAC;CAE5D,YAAY,KAAc,QAAyD;EACjF,MAAM,KAAK,MAAM;CACnB;CAEA,SAAkB,OAA6B;EAC7C,OAAO,MAAM,SAAS;GAAE,GAAG;GAAO,UAAU,KAAK,QAAQ,KAAK,QAAQ,OAAO,KAAK,GAAG;EAAE,CAAC;CAC1F;CAEA,iBAA0B,SAA0C;EAClE,OAAO,MAAM,kBAAkB,KAAK,QAClC,KAAK,QAAQ;GAAE,MAAM;GAAS,MAAM;GAAK;EAAQ,GAAG,KAAK,GAAG,CAC9D;CACF;CAEA,gBAAyB,OAAoC;EAC3D,OAAO,MAAM,gBAAgB;GAC3B,GAAG;GACH,UAAU,KAAK,QAAQ,SAAS,KAAK,eAAe,OAAO,KAAK,QAAQ,IAAI;EAC9E,CAAC;CACH;CAEA,QAAgB,OAAiB,KAAsB,KAA2C;EAChG,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,SAAS;GACxB,kBAAkB,KAAK,KAAK,IAAI;GAChC,OAAO,MAAM,QAAQ,KAAK,GAAG;EAC/B;EACA,IAAI,aAAa,UACf,OAAO,MAAM,QAAQ,KAAK,GAAG;EAE/B,IAAI,aAAa,kBAAkB;GACjC,IAAI,UAAU,KAAK,EAAE,UAAU,SAAS,CAAC;GACzC,IAAI,IAAI;GACR;EACF;EACA,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU;GAAE,IAAI;GAAO,OAAO;EAAe,CAAC,CAAC;CAC9D;CAEA,eACE,OACA,KACA,QACA,MACsB;EACtB,MAAM,WAAW,KAAK,KAAK,OAAO,GAAG;EACrC,IAAI,aAAa,WAAW,aAAa,UAAU;GACjD,IAAI,aAAa,SAAS,kBAAkB,KAAK,KAAK,IAAI;GAC1D,OAAO,MAAM,QAAQ,KAAK,QAAQ,IAAI;EACxC;EACA,OAAO,MAAM,wDAAwD;EACrE,OAAO,QAAQ;CACjB;AACF"}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "dshb-auth",
+  "version": "0.0.1",
+  "description": "DSHB 管理端认证与网络暴露（登录页 / 会话 Cookie / startup 替换）",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./startup": "./lib/startup.js",
+    "./webserver": "./lib/webserver.js",
+    "./loopback": "./lib/loopback.js",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-cmdline": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "commander": "^15.0.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@types/react": "^19.0.0",
+    "react": "^19.0.0"
+  },
+  "types": "lib/index.d.ts",
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit"
+  }
+}