remote-dsh 0.8.0 → 0.9.0

package/dist/bin.js

@@ -299,7 +299,7 @@ async function handleHostServe(_args, configPath) {
     if (config.mode === "join") {
         if (config.hub === undefined)
             throw new Error("host.json 缺 hub（join 模式）；先 `rdsh host join <hub>`");
-        await join({ hubUrl: config.hub, name: config.name, insecure: config.insecure, dshPath: config.dshPath, dshUiCompat: config.dshUiCompat });
+        await join({ hubUrl: config.hub, name: config.name, insecure: config.insecure, dshPath: config.dshPath, dshUiCompat: config.dshUiCompat, gateway: config.gateway });
         return;
     }
     await serve({ configPath: target });
@@ -583,8 +583,7 @@ async function handleHubUser(args, configPath) {
             case "add": {
                 const name = args[1];
                 if (name === undefined)
-                    throw new Error("usage: rdsh hub user add <name> [--no-password] [--role <user|readonly|operator|admin>]");
-                const noPassword = args.includes("--no-password");
+                    throw new Error("usage: rdsh hub user add <name> [--role <user|readonly|operator|admin>]");
                 const roleIdx = args.indexOf("--role");
                 const role = roleIdx >= 0 && args[roleIdx + 1] !== undefined ? args[roleIdx + 1] : "user";
                 if (!["user", "readonly", "operator", "admin"].includes(role))
@@ -592,12 +591,11 @@ async function handleHubUser(args, configPath) {
                 const hubConfigPath = resolveHubConfigPath(configPath);
                 if (db.getUserByName(name) !== null)
                     throw new Error(`user '${name}' already exists`);
-                const user = noPassword
-                    ? db.createUser(name, "scrypt:disabled", new Date().toISOString(), true)
-                    : db.createUser(name, await hashPassword(await promptPasswordTwice(`password for ${name}: `)));
+                // 建号即设初始密码（安全修复 F1：不再提供 --no-password 公开首密码激活路径，防账号抢占）
+                const user = db.createUser(name, await hashPassword(await promptPasswordTwice(`password for ${name}: `)));
                 if (role !== "user")
                     db.setRole(user.id, role);
-                console.log(`rdsh: user '${name}' created (role: ${role}${noPassword ? " — must set password on first sign-in" : ""})`);
+                console.log(`rdsh: user '${name}' created (role: ${role})`);
                 return;
             }
             case "passwd": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "remote-dsh",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Secure remote access for DeepSeek Harness: rdsh serve / rdsh join / rdsh hub",
   "license": "MIT",
   "type": "module",
@@ -23,8 +23,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "rdsh-gateway": "0.6.0",
-    "rdsh-hub": "0.5.0"
+    "rdsh-gateway": "0.7.0",
+    "rdsh-hub": "0.6.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",