dshmarket 1.65.3 → 1.65.4

package/lib/index.js

@@ -104,12 +104,31 @@ function agentsLookupOf(ctx) {
  * exactly as it was, which is the behaviour every release so far has had.
  * @returns a restore function for the effect that installed it.
  */
-function useTrustedHosts(ctx) {
-    const connection = ctx.get('connection');
-    const declared = Array.isArray(connection?.trustedHosts)
-        ? connection.trustedHosts.filter((entry) => typeof entry === 'string')
-        : [];
-    const previous = setTrustedHostsSource(() => declared);
+export function useTrustedHosts(ctx) {
+    // Resolved per request, not at mount -- the same reason `agentsLookupOf` is
+    // lazy. The host provides `connection` only after its own async init
+    // (`HostConnectionService` is constructed behind `await BrowserAuth.create`),
+    // and the market mounts on `webServer` + `loader`, which are ready first: a
+    // mount-time read therefore sees no service on a web host, and the [] fallback
+    // then narrows the fence to loopback for the life of the process -- every
+    // mutating route 403 on a deployment that is reached by a name, while loopback
+    // keeps working (#729).
+    //
+    // Exported for the spec that covers this wiring; the fence it feeds is tested
+    // through `sameOrigin` in tests/http.spec.ts.
+    let warned = false;
+    const previous = setTrustedHostsSource(() => {
+        const connection = ctx.get('connection');
+        if (connection === undefined && !warned) {
+            // The silent version of this is what hid #729: "no service" and "no
+            // authorities declared" produced the same fence.
+            warned = true;
+            console.warn('dsh-market: the host connection service is not available; the origin fence accepts loopback only');
+        }
+        return Array.isArray(connection?.trustedHosts)
+            ? connection.trustedHosts.filter((entry) => typeof entry === 'string')
+            : [];
+    });
     // The setter returns the PREVIOUS source, not a restore closure — the same
     // contract as setBuildEnvSource in dsh-cli.ts.
     return () => { setTrustedHostsSource(previous); };

package/lib/types/index.d.ts

@@ -7,4 +7,19 @@ import { type MarketConfig } from './routes.ts';
 export declare const name = "dsh-market";
 /** Optional cordis.yml configuration; profile defaults to `web`. */
 export type Config = Partial<Pick<MarketConfig, 'profile' | 'allowRestart' | 'maxSnapshots' | 'buildEnv'>>;
+/**
+ * The deployment's declared authorities, read from the host (#729).
+ *
+ * DSH's own /api fence accepts loopback OR an authority the operator declared
+ * (`dsh web --trusted-host <name>`, plus the LAN literals the CLI derives when
+ * bound to 0.0.0.0). The market's routes are `exact` registrations on the bare
+ * webServer, and exact matches win over that fence's prefix, so they never
+ * pass through it — and a loopback-only rule of its own made every mutating
+ * route 403 on any deployment reached by a name.
+ *
+ * The `connection` service is optional: a host without it leaves the fence
+ * exactly as it was, which is the behaviour every release so far has had.
+ * @returns a restore function for the effect that installed it.
+ */
+export declare function useTrustedHosts(ctx: Context): () => void;
 export declare function apply(ctx: Context, config?: Config): void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.65.3",
+  "version": "1.65.4",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",

package/src/index.ts

@@ -147,12 +147,31 @@ function agentsLookupOf(ctx: Context): () => AgentsServiceLike | undefined {
  * exactly as it was, which is the behaviour every release so far has had.
  * @returns a restore function for the effect that installed it.
  */
-function useTrustedHosts(ctx: Context): () => void {
-  const connection = ctx.get('connection') as { trustedHosts?: unknown } | undefined
-  const declared = Array.isArray(connection?.trustedHosts)
-    ? connection.trustedHosts.filter((entry): entry is string => typeof entry === 'string')
-    : []
-  const previous = setTrustedHostsSource(() => declared)
+export function useTrustedHosts(ctx: Context): () => void {
+  // Resolved per request, not at mount -- the same reason `agentsLookupOf` is
+  // lazy. The host provides `connection` only after its own async init
+  // (`HostConnectionService` is constructed behind `await BrowserAuth.create`),
+  // and the market mounts on `webServer` + `loader`, which are ready first: a
+  // mount-time read therefore sees no service on a web host, and the [] fallback
+  // then narrows the fence to loopback for the life of the process -- every
+  // mutating route 403 on a deployment that is reached by a name, while loopback
+  // keeps working (#729).
+  //
+  // Exported for the spec that covers this wiring; the fence it feeds is tested
+  // through `sameOrigin` in tests/http.spec.ts.
+  let warned = false
+  const previous = setTrustedHostsSource(() => {
+    const connection = ctx.get('connection') as { trustedHosts?: unknown } | undefined
+    if (connection === undefined && !warned) {
+      // The silent version of this is what hid #729: "no service" and "no
+      // authorities declared" produced the same fence.
+      warned = true
+      console.warn('dsh-market: the host connection service is not available; the origin fence accepts loopback only')
+    }
+    return Array.isArray(connection?.trustedHosts)
+      ? connection.trustedHosts.filter((entry): entry is string => typeof entry === 'string')
+      : []
+  })
   // The setter returns the PREVIOUS source, not a restore closure — the same
   // contract as setBuildEnvSource in dsh-cli.ts.
   return () => { setTrustedHostsSource(previous) }