dshmarket 1.71.0 → 1.72.0

package/lib/http.js

@@ -147,7 +147,10 @@ export function trustedAuthority(host, trustedHosts) {
  * - a cross-site page is refused — its Origin is present and different;
  * - `Origin: null` (a sandboxed iframe, a `data:` document) is refused, because
  *   `null` is a present-but-unparseable origin, not an absent one;
- * - a same-host-but-different-port request is refused;
+ * - a same-host-but-different-port request is refused, except that a loopback
+ *   Host accepts a port-less same-hostname Origin (#1031: Chrome 151+ omits
+ *   the port on loopback Origins, and the dsh core fence follows the same
+ *   rule);
  * - an EMPTY Origin is refused too: the header being present and unparseable
  *   is not the same statement as its being absent, and only absence is what
  *   a stripping proxy produces.
@@ -202,6 +205,16 @@ export function sameOrigin(request) {
     // equality cannot: a cross-site request whose Origin happens to match.
     if (request.headers['sec-fetch-site'] === 'cross-site')
         return false;
+    // Chrome 151+ serializes a loopback Origin WITHOUT its explicit port
+    // (#1031): the page at `http://127.0.0.1:3080` now states `Origin:
+    // http://127.0.0.1` on its same-origin POSTs, so the strict `host` equality
+    // below refuses installs and updates from the newest browsers. Mirror the
+    // dsh core rule (`isSameAuthorityOrigin`): the hostname must match, and the
+    // omitted port is honoured only on the loopback fence — `loopbackAuthority`
+    // above has already decided the Host names loopback, a cross-site page still
+    // fails the hostname test, and a rebinding page still cannot get its own
+    // name through both. Declared LAN names and proxies keep needing the exact
+    // port, as before.
     const origin = request.headers.origin;
     // A missing Origin is not a cross-site request: browsers send it on every
     // POST, same-origin included, so its absence means the caller is not a
@@ -211,7 +224,14 @@ export function sameOrigin(request) {
     if (origin === undefined)
         return true;
     try {
-        return new URL(origin).host === host;
+        const originUrl = new URL(origin);
+        if (originUrl.host === host)
+            return true;
+        if (originUrl.port === '' && host !== undefined && loopbackAuthority(host)) {
+            const hostUrl = parseAuthority(host);
+            return hostUrl !== null && originUrl.hostname === hostUrl.hostname;
+        }
+        return false;
     }
     catch {
         return false;

package/lib/types/http.d.ts

@@ -77,7 +77,10 @@ export declare function trustedAuthority(host: string, trustedHosts: readonly st
  * - a cross-site page is refused — its Origin is present and different;
  * - `Origin: null` (a sandboxed iframe, a `data:` document) is refused, because
  *   `null` is a present-but-unparseable origin, not an absent one;
- * - a same-host-but-different-port request is refused;
+ * - a same-host-but-different-port request is refused, except that a loopback
+ *   Host accepts a port-less same-hostname Origin (#1031: Chrome 151+ omits
+ *   the port on loopback Origins, and the dsh core fence follows the same
+ *   rule);
  * - an EMPTY Origin is refused too: the header being present and unparseable
  *   is not the same statement as its being absent, and only absence is what
  *   a stripping proxy produces.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dshmarket",
   "description": "Visual plugin market inside DeepSeek Harness — browse, search, and one-click install community plugins. · DSH 可视化插件市场：逛一逛，点一下，装好。",
-  "version": "1.71.0",
+  "version": "1.72.0",
   "icon": "assets/logo.svg",
   "type": "module",
   "main": "lib/index.js",

package/src/client/MarketSection.tsx

@@ -3424,15 +3424,23 @@ export function MarketSection(props: MarketSectionProps) {
     // pluginBlocked closes over the installed map and the catalog match.
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [pluginsAll, blockedNameSet, installed, repoIdentities, data, repoHints])
+  // A sort the user chose is a request to see the list in THAT order, and
+  // this block ignores the sort by design (it is "what was added in the last
+  // seven days", ordered by downloads). Left in place it sits between the
+  // control and the list it just reordered: on a 1166px window it fills the
+  // screen, so switching to Stars looked like it did nothing (#1016). The
+  // block is a front-page teaser for the unfiltered default view — one more
+  // narrowing, alongside query, category and time range.
   const recentlyAdded = useMemo(
     () => data === null || tab !== 'discover' || q.trim() !== '' || cat !== 'all' || timeRange !== 'all'
+      || sortField !== 'downloads' || sortDir !== 'desc'
       ? []
       : visiblePlugins(data.plugins, {
           category: 'all', query: '', lang, sort: 'downloads-desc', sinceDays: 7,
           hostCompatibility, compatibleWithHost,
         }).filter(plugin => !pluginBlocked(plugin)),
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [data, tab, q, cat, timeRange, lang, hostCompatibility, compatibleWithHost, blockedNameSet, installed, repoIdentities, repoHints])
+    [data, tab, q, cat, timeRange, sortField, sortDir, lang, hostCompatibility, compatibleWithHost, blockedNameSet, installed, repoIdentities, repoHints])
   const recentRowRef = useRef<HTMLDivElement>(null)
   // Two per row, like the grid below it: three across read as a different
   // list rather than the same one (and left an odd one out at any width).

package/src/client/index.ts

@@ -9,7 +9,7 @@ import { createElement as h } from 'react'
 import type { ReactNode } from 'react'
 import * as primitives from '@deepseek-ai/dsh-client-ui-primitives'
 import { missingIcons } from './icons.ts'
-import { en, zh } from './locales.ts'
+import { en, ja, zh } from './locales.ts'
 import { InstallToast } from './InstallToast.tsx'
 import { MarketErrorBoundary } from './ErrorBoundary.tsx'
 import { MarketSection } from './MarketSection.tsx'
@@ -75,7 +75,7 @@ interface ThemeService {
 
 /** The subset of the locale service this plugin touches. */
 interface LocaleService {
-  register(namespace: string, dicts: { zh: Record<string, string>; en: Record<string, string> }): unknown
+  register(namespace: string, dicts: { zh: Record<string, string>; en: Record<string, string>; ja?: Record<string, string> }): unknown
   bind(namespace: string): Translate
   subscribe(callback: () => void): () => void
   getSnapshot(): { active: string }
@@ -155,7 +155,7 @@ export function apply(ctx: MarketClientContext): void {
  * of them. Not exported: the split is a guard, not a surface.
  */
 function mountMarket(ctx: MarketClientContext): void {
-  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-market: dictionaries')
+  ctx.effect(() => ctx.locale.register(NS, { zh, en, ja }), 'dsh-market: dictionaries')
   const t = ctx.locale.bind(NS)
 
   // The section's nav glyph. The shell picks nav icons from its own built-in