0.5.0: remove the launch-token check by default again

0.4.0 made the browser-session check opt-out, so a deployment whose whole
point is "no trusted host, no token" started asking for the launch token on
every new device — including a phone, where producing it is the friction the
plugin exists to remove.

The bypass itself was never in doubt and is unchanged: `disableAuth: true`
still replaces `connection.admit`, `requestRejection`, `authorizeIndex` and
`authenticatedUrl`. Measured on DSH 0.2.1-rc.2 over a non-loopback Host with
no cookie: `GET /` answers 200 and a socket upgrade to `/api/remote.mux`
answers 101. Only the default moved.

`disableAuth: false` keeps 0.4.0's posture — the launch token, the 30-day
cookie bound to the rewritten loopback authority, and the check.

README.md

@@ -1,24 +1,27 @@
 # dsh-trustworthy
 
-**Removes the untrusted-origin restriction from DeepSeek Harness.** Every browser
-window is treated as if it were running on the harness machine itself: no process
-token, no declared trusted host, and no per-plugin origin fence, because one
-interceptor answers every request with the loopback authority.
+**Removes the untrusted-origin restriction from DeepSeek Harness, and the
+launch-token prompt with it.** Every browser window is treated as if it were
+running on the harness machine itself: no declared trusted host, no per-plugin
+origin fence, and no process token to paste into a phone — one interceptor
+answers every request with the loopback authority, and the session check is off
+by default.
 
 A window that reaches the harness by a LAN address, a DNS name, or a tunnel
 authenticates normally and then fails every mutating request with
 `403 {"error":"untrusted origin"}`. Cards render, but Install, Update, toggle,
 and "Update all" do nothing that the user can see. This plugin removes the
-distinction between a local window and a remote one — with no token, no
-`--trusted-host`, no per-plugin configuration, and no second listener on a
-second port.
+distinction between a local window and a remote one — with no declared trusted
+host, no `--trusted-host`, and no per-plugin configuration. The launch-token
+check is removed as well; `disableAuth: false` puts it back.
 
 ---
 
 ## ⚠️ Read this before enabling it
 
 **This plugin is a deliberate and total removal of the harness's request-identity
-fence. It is not a bug fix and it is not a workaround for one specific plugin.**
+fence, and by default of its browser-session check too. It is not a bug fix and
+it is not a workaround for one specific plugin.**
 
 The harness fences requests by their `Host` and `Origin` headers for one
 reason: those are the only headers a page on another origin cannot forge, so
@@ -29,25 +32,41 @@ while the harness is reachable. With this plugin enabled:
 - **A page on any other origin** can issue mutating requests to the API.
 - Those requests can **run commands on your machine** through the agent.
 
-With `disableAuth: true` (the default) there is no session check either, so
+And with the default `disableAuth: true` there is no session check either:
 **anyone who can reach the port has full control of the agent, including code
-execution.** Reachability becomes the only access control.
+execution.** Reachability is the only access control.
 
-That is a reasonable posture when the port is behind something that
-authenticates on your behalf, or when it is bound to a network you fully
-control. It is a poor posture for a `0.0.0.0` bind fronted by a public tunnel
-with no authentication of its own. Decide accordingly, and re-read this
-section if you change how the port is exposed.
+That posture is reasonable when the port is behind something that authenticates
+on your behalf, or when it is bound to a network you fully control. It is a poor
+posture for a `0.0.0.0` bind fronted by a public tunnel with no authentication of
+its own. Decide accordingly, and re-read this section if you change how the port
+is exposed. Set `disableAuth: false` to restore the launch token as a second
+line of defence.
+
+### The launch token, and the `disableAuth` switch
+
+The Web UI prints a one-time launch token in the process log —
+`dsh web: http://…/?token=…` — and from `0.2.1-alpha.4` the container entrypoint
+writes that line into the Docker log as well. The token rotates on every
+restart. With the check enabled, every new device or origin must open that URL
+once; the harness exchanges the token for a **30-day cookie** bound to the
+authority it was minted under, and until then every page answers `401`.
+
+`0.4.0` made that check the default, on the argument that one exchange covers
+every domain because the plugin rewrites `Host` to the same loopback authority
+the cookie is bound to. In practice it still means producing a token on each new
+device, which is the friction this plugin exists to remove — `0.5.0` therefore
+restores `disableAuth: true` as the default. Set `disableAuth: false` to get the
+check, and the cookie, back.
 
-If you want the errors gone but not the exposure, set `disableAuth: false`.
-That keeps the process token as the access control while still answering the
-identity fence, which is what actually produces the 403.
 
 ---
 
 ## What it changes
 
-Four things, each one reachable only by a different kind of fence.
+Five things, each one reachable only by a different kind of fence. None of them
+touches the browser-session check; removing that is the separate `disableAuth`
+key described at the end of this section.
 
 **1. Request identity, at the server.** The plugin installs `request` and
 `upgrade` listeners with `prependListener` on the raw `node:http` server the
@@ -84,6 +103,14 @@ plus the metadata that makes the page installable on a phone. These are unrelate
 to request identity and are here so that one plugin covers the whole "I want to
 reach this from another machine" problem. See `shimClipboard` below.
 
+**5. The `webRuntime` service, for plugins that never get to fence at all.** A
+plugin whose injection list names a service nobody provides is held `pending` by
+Cordis: its routes are never registered, and the URLs its pane calls answer `405`
+from the core static handler. Releases from `0.2.1-alpha.2` stopped providing
+`webRuntime`, which is how the sidebar's Files pane started failing to preview or
+download anything. The plugin provides it — when nothing else has — built from
+the trust data the harness still holds. See `provideWebRuntime` below.
+
 It deliberately does **not** touch `sec-fetch-site`. The harness refuses
 `cross-site` outright, and that refusal is the last judgement a browser makes
 on its own behalf. Rewriting it would make a page on another origin look
@@ -148,6 +175,7 @@ Override any key in your profile's `cordis.patch.yml`:
     disableAuth: true
     forceClientLoopback: true
     grantPairing: true
+    provideWebRuntime: true
     spoofSocketAddress: false
     shimClipboard: true
     shimRandomUuid: true
@@ -157,14 +185,95 @@ Override any key in your profile's `cordis.patch.yml`:
 | Key | Default | Effect |
 |---|---|---|
 | `enabled` | `true` | Master switch. `false` loads the plugin and changes nothing. |
-| `disableAuth` | `true` | Also removes the browser-session check, so no process token is needed. **This is the one that removes access control.** |
+| `disableAuth` | `true` | **Also** removes the browser-session check, so no launch token and no per-device pairing are needed. This is the default: reachability is the only access control. Set `false` to keep the token — exchange it once and the 30-day cookie covers every rewritten request. |
 | `forceClientLoopback` | `true` | Grants the browser-side `isLoopback` flag so the settings and model surfaces act as they do on the host. |
 | `grantPairing` | `true` | Provides the paired-device service that plugins like the Skill Center accept instead of a loopback peer. See below. |
+| `provideWebRuntime` | `true` | Restores the `webRuntime` trust snapshot the harness stopped publishing in 0.2.1-alpha.2, so plugins that inject it (the sidebar) mount instead of answering 405. See below. |
 | `spoofSocketAddress` | `false` | Also reports the peer address as loopback, for plugins with no pairing path. See below. |
 | `shimClipboard` | `true` | Restores `navigator.clipboard.writeText` on plain HTTP. See below. |
 | `shimRandomUuid` | `true` | Restores `crypto.randomUUID` on plain HTTP. See below. |
 | `shimPwa` | `true` | Serves a manifest and adds the installable-app metadata. See below. |
 
+### `disableAuth` — the two postures
+
+Every key above only answers fences. `disableAuth` is the one that changes who
+may talk to the harness at all.
+
+- **`true` (default).** The session check is replaced too: `connection.admit`
+  returns the owner's own peer for every request, `authorizeIndex` admits the
+  index, and `authenticatedUrl` stops appending the token to the printed URL. No
+  token, no cookie, no login, nothing to type on a phone — and anyone who reaches
+  the port controls the agent. Use it behind an authenticating proxy, on a
+  network that is already trusted, or when the port is otherwise unreachable from
+  untrusted networks.
+- **`false`.** The request-identity fence is still rewritten away, and the
+  browser-session check is left exactly as the harness built it. A new browser
+  shows `401` until the launch URL from the process log is opened once; that
+  exchange sets the 30-day cookie, and every later request — including the ones
+  this plugin rewrote the `Host` on — carries it. Each new device still has to be
+  given the token, which is why it is not the default.
+
+The implementation replaces `admit` because that is where every shape of the
+gate ends up: releases up to `0.2.1-alpha.2` call `requestRejection` from inside
+`admit` and wrap its answer, while `0.2.1-alpha.3` and later apply the fence and
+session check in `admit` itself. `requestRejection` is replaced as well so the
+older shape cannot short-circuit around the newer one, and every replacement is
+liveness-aware, so a host that switches the plugin off without running its
+disposers gets the real gate back.
+
+### `provideWebRuntime` — the Files pane, and HTTP 405
+
+`0.2.1-alpha.2` stopped providing a service named `webRuntime`. Its value was the
+LAN-trust snapshot — `resolveLanTrust(ctx.webServer.host, trustedHosts)`, that is
+`{ lanAddresses, trustedHosts }` — and third-party plugins inject it to learn
+which authorities their own copy of the request fence should accept:
+
+```js
+export const inject = ['webServer', 'sessions', 'webRuntime', 'tools']
+const fence = (req) => isTrustedApiRequest(req, ctx.webRuntime.trustedHosts)
+```
+
+Cordis holds a row whose injection is unsatisfied in `pending`: the module loads,
+its inject list is read, and **no `apply` runs** — so none of its routes are
+registered, and the boot log names it:
+
+```
+dsh: warning: 1 entry did not activate
+better-sidebar (dsh-better-sidebar): pending (waiting for service: webRuntime)
+```
+
+That 405 is the whole of the "opening a file stopped working" symptom: the routes
+are not refusing the request, they do not exist. The core static handler answers
+every unmounted `POST` with an empty `405`, while the plugin's own paths answer
+`404` — measured over a non-loopback `Host`, on one profile, with the sidebar's
+own Files requests:
+
+| Request | `provideWebRuntime: false` | `provideWebRuntime: true` |
+|---|---|---|
+| `POST /sidebar/api/fs.tree` | `405`, 0 bytes | `200`, `{"ok":true,…,"entries":[…]}` |
+| `POST /sidebar/api/fs.read` | `405`, 0 bytes | `200`, `{"ok":true,"value":{"kind":"text",…}}` |
+| `GET /sidebar/file?sessionId=…&path=…` | `404` | `200 application/octet-stream` |
+| `GET /sidebar/file?…&download=1` | `404` | `200`, `content-disposition: attachment` |
+
+The same release moved `--trusted-host` authorities into `connection.trustedHosts`
+(it is `trustedHosts: !!js ctx.webStartup.trustedHosts` in the web bundle's patch),
+which is what the `/api` fence reads. So the service can be rebuilt from what the
+harness still has, which is what this key does: it provides `webRuntime` — when
+nothing else has — with `trustedHosts` read **live** from `connection` rather than
+cloned at assembly time, plus the listener's own bind address, which the core
+fence accepts separately (`isBindAddressAuthority`) and a two-argument plugin fence
+otherwise cannot. `lanAddresses` is `[]`, which is what alpha.1 returned for every
+bind alpha.2 permits.
+
+This does not weaken anything by itself. It is not a declaration of the arriving
+authority, and it is inert on the request path whenever the interceptor above is
+installed: every request already carries the loopback authority by the time any
+fence reads it. It exists so that a plugin **mounts** at all.
+
+Set `provideWebRuntime: false` to leave those plugins unmounted — for instance on
+a harness that removed the service deliberately and where you would rather run
+plugins without it than republish an interface the harness retired.
+
 ### `grantPairing` — the Skill Center
 
 Some plugins authorize a request either by a loopback peer or by a **live paired
@@ -241,17 +350,40 @@ three are `true` by default; serving over HTTPS makes the first two redundant.
 
 ## Compatibility
 
-Verified against **DSH 0.1.7-rc.2**, **0.2.0-rc.1**, and **0.2.1-alpha.1**. The
-plugin depends on three things that are internal rather than public API, so a
-harness release that renames any of them will break it:
+Verified against **DSH 0.1.7-rc.2**, **0.2.0-rc.1**, **0.2.1-alpha.1**,
+**0.2.1-alpha.2**, **0.2.1-alpha.4**, and **0.2.1-rc.1**. From 0.4.0 the
+manifest also declares the range:
+
+```json
+"engines": { "dsh": ">=0.1.7-rc.2 <0.3.0-0" }
+```
+
+`0.2.1-alpha.4` made `engines.dsh` the compatibility declaration a plugin should
+provide — the harness uses it, when present, in place of guessing from
+`@deepseek-ai/dsh-*` peer ranges. This plugin has no dsh peers at all, so the
+declaration is the only statement of support it makes, and it is bounded above
+at the next minor release, excluding its prereleases, rather than left open. `0.2.1-rc.2` is not listed as a
+separate version because `dsh-client-connection`, `dsh-host-webserver`,
+`dsh-web-app`, and the frontend static bundle are byte-identical between rc.1
+and rc.2.
+
+The plugin depends on several things that are internal rather than public API,
+so a harness release that renames any of them will break it:
 
 | Depends on | Where |
 |---|---|
 | `webServer.server` — the raw `node:http` server | `@deepseek-ai/dsh-host-webserver` |
+| `webServer.host` — the listener's own bind address | `@deepseek-ai/dsh-host-webserver` |
 | `webServer.register` / `webServer.tapIndex` — the route registry and index transforms | `@deepseek-ai/dsh-host-webserver` |
+| `connection.trustedHosts` — the authorities the `/api` fence reads | `@deepseek-ai/dsh-client-connection` |
+| `connection.admit` — the fence and session check, alone from 0.2.1-alpha.3 | `@deepseek-ai/dsh-client-connection` |
 | `connection.requestRejection` / `authorizeIndex` / `authenticatedUrl` | `@deepseek-ai/dsh-client-connection` |
 | the `webserver/index-inject` channel and the `ownsHost` marker | webserver + connection client |
 
+The only one used conditionally is `connection.admit`: the bypass path replaces
+it when `disableAuth: true` (the default). With `disableAuth: false` the plugin
+does not touch it at all.
+
 Every one of those is probed before use. If a release reshapes the surface, the
 plugin logs which capability it lost and carries on with the rest, rather than
 failing the fiber and taking the parts that still work down with it. Losing the
@@ -263,6 +395,79 @@ interceptor was not installed and a Host fence will still refuse a remote
 window; the harness surface may have changed
 ```
 
+### What was checked on 0.2.1-rc.1
+
+This is the release the 0.4.0 change answers. Two things moved.
+
+**The gate moved into `admit`.** `requestRejection` is now a façade over
+`admit`, and the `/api` route and the WebSocket upgrade call `admit` directly.
+A plugin that only answered `requestRejection` — which is all 0.3.0 did when
+`disableAuth: true` — left the index reachable and every WebSocket refused with
+`401`, so the page loaded and then showed a disconnected shell. The bypass path
+now replaces `admit` itself and returns the owner's peer (`browserPeer` on this
+release, `operator` before alpha.3); measured on a sandboxed rc.1 with a
+non-loopback `Host`, the upgrade answered `101` with no cookie.
+
+**The session check, when enabled, survives the rewrite.** The plugin rewrites
+`Host`/`Origin` to `127.0.0.1:<port>`, which is also the authority the harness
+mints the session cookie for. Measured on a sandbox, with `disableAuth: false`,
+in order:
+
+| Request (`Host: ai.milesward.dev`) | Result |
+|---|---|
+| `GET /` with no cookie | `401` |
+| `GET /?token=<launch token>` | `303`, `location: ./`, `Set-Cookie: dsh-auth-…` |
+| `GET /` with that cookie | `200` index |
+| `Upgrade /api/remote.mux` with that cookie | `101` |
+
+The cookie payload's `authority` is `127.0.0.1:<port>` — the rewritten one — so
+the browser keeps the cookie for the public origin it opened, and the plugin's
+rewrite presents the matching authority on every request afterwards. This is
+what lets the 30-day session survive a Host rewrite, and it is why
+`disableAuth: false` is a viable posture for anyone who would rather keep the
+check.
+
+The token rotates whenever the process restarts (`dsh web: …?token=…` in the
+process log; the container entrypoint prints that line into the Docker log from
+0.2.1-alpha.4). The safety property the old bypass traded away is exactly this
+one: after `disableAuth: true` the printed URL has no token and every session is
+unauthenticated.
+
+Also verified on this release: `webServer.server` / `register` / `tapIndex` and
+the `webserver/index-inject` channel are unchanged, so the interceptor, the
+browser grant, the shims, and the PWA route need no adjustment. The
+`dsh-client-connection`, `dsh-host-webserver`, `dsh-web-app`, and
+`dsh-host-frontend-static` bundles are byte-identical between 0.2.1-rc.1 and
+0.2.1-rc.2.
+
+### What was checked on 0.2.1-alpha.2
+
+Everything in the table above is still present and still of the shape this plugin
+reaches for — with one removal, which is what 0.3.0 answers.
+
+* `webRuntime` is **gone**. `dsh-web-app` no longer provides it, no package
+  provides it, and a plugin that injects it is held `pending` (the boot-log line
+  quoted under `provideWebRuntime`).
+* `connection.trustedHosts` is not gone but **changed source**: the web bundle's
+  patch now sets it from `webStartup.trustedHosts` (the `--trusted-host` values),
+  and `isBindAddressAuthority` accepts `webServer.host` alongside it. It stays a
+  plain `string[]` this plugin can read per request, which is what the snapshot is
+  rebuilt from.
+* `webServer.host` is a **config value, not a socket fact**: it is the concrete
+  IPv4/IPv6 literal passed to `--host`, and the setter now rejects a wildcard
+  (`"0.0.0.0" is an unspecified (wildcard) address, which is not supported`).
+* `webServer.server` and `webServer.register` still exist, so the interceptor and
+  the shims are unaffected. That the interceptor still works is visible in the
+  table's right-hand column: every one of those requests arrived with a
+  **non-loopback** `Host` (`172.17.0.4:3104`) and still reached the plugin's own
+  fence, which only a rewritten request identity can do on an undeclared
+  authority.
+
+Not re-measured on alpha.2: the seven-point fence matrix from alpha.1 below, and
+the `--help`/peer-gate notes. The alpha.1 note is kept because it is still what
+the fence behaviour rests on, and because the `resolveLanTrust` details in it
+describe the value this plugin now rebuilds.
+
 ### What was checked on 0.2.1-alpha.1
 
 The three packages this plugin reaches into are **byte-identical** between
@@ -297,17 +502,27 @@ to reject it on and it skips nothing at boot.
 ### Why it never writes the trusted-host lists
 
 The obvious fix for this problem is to add the arriving host to
-`connection.trustedHosts`. This plugin deliberately does not, for two reasons.
+`connection.trustedHosts`. This plugin deliberately does not — and that is a
+narrower statement than it looks, now that `provideWebRuntime` exists: it
+*publishes* a `webRuntime` value built from that list, and writes nothing into
+`connection.trustedHosts` itself.
 
-The harness assembles **two** trusted-host arrays — one on `webRuntime`, one on
-`connection` — and they are separate objects cloned at assembly time. A host
-declared into one is invisible to the other, so half the fix silently does
-nothing. More importantly, a fence that compares against a **literal loopback
-value** rather than against the list is not moved by any declaration at all.
-Plugin markets published before the list existed hardcode exactly that check, and
-they are the ones producing the 403 users actually see. Rewriting the request
-identity satisfies every fence, of every shape and every age; a list entry
-satisfies only the fences that read the list.
+The reason is the same one that has always applied. A fence that compares against
+a **literal loopback value** rather than against a list is not moved by any
+declaration at all; plugin markets published before the list existed hardcode
+exactly that check, and they are the ones producing the 403 users actually see.
+Rewriting the request identity satisfies every fence, of every shape and every
+age; a list entry satisfies only the fences that read the list. The same argument
+applies to the restored snapshot: its list is a faithful reproduction of what the
+harness already believes, not an attempt to talk a fence into accepting something
+the harness would refuse.
+
+On **0.2.1-alpha.1** there was a second, version-specific reason: the harness
+assembled two trusted-host arrays — one on `webRuntime`, one on `connection` —
+as separate objects cloned at assembly time, so a host declared into one was
+invisible to the other and half the fix silently did nothing. `0.2.1-alpha.2`
+removed the `webRuntime` array along with the service, leaving `connection` as
+the single source, which is what the snapshot reads.
 
 ### Reload safety
 
@@ -342,14 +557,17 @@ Three guards follow from that, and each has a test:
 - `sec-fetch-site: cross-site` is refused **unconditionally** by
   `isTrustedApiRequest`, before the `Origin` check and regardless of the
   trusted-host list. No header rewrite can defeat it, and this plugin does not
-  try. It is inert with the default `disableAuth: true`, because the gateway
-  never reaches the fence. It is the one thing that can still refuse a request
-  with `disableAuth: false`.
-- Rewriting `Host` changes the **cookie authority** the harness derives from it
-  (`dsh-auth-<sha256(authority)>`). With `disableAuth: false` that invalidates
-  sessions minted under the hostname you used before — one re-login — and
-  afterwards a single login covers every entry domain instead of one per domain.
-  Inert with `disableAuth: true`.
+  try. It only guards requests a browser itself marks as cross-site, so it has
+  no effect on normal navigation or on the WebSocket. With `disableAuth: true`
+  (the default) the gate that calls it is replaced, so it does not run either.
+- Rewriting `Host` decides the **cookie authority** the harness derives from it
+  (`dsh-auth-<sha256(authority)>`). With `disableAuth: false` the launch token is
+  exchanged for the rewritten authority, so the resulting 30-day cookie matches
+  every request the plugin intercepts. The authority is the loopback bind
+  (`127.0.0.1:<port>`), so changing `--port` mints a new one and requires one new
+  exchange. A session cookie you already
+  hold under the public hostname is not reused; expect one re-login on enabling
+  the plugin.
 - `Referer` is read by no layer of the harness, core or plugin. It is rewritten
   only for third-party code that might read it.
 
@@ -425,14 +643,20 @@ node test/fence.test.mjs     # drives real requests past the real plugin-market
 node test/apply.test.mjs     # wiring, including that unload restores every original
 node test/handover.test.mjs  # the reload orderings: predecessor vs. successor, liveness
 node test/shims.test.mjs     # executes the generated shim in a context without the APIs
+node test/web-runtime.test.mjs  # the restored webRuntime value, and when it is provided
 node scripts/live-probe.mjs  # against the running harness, over a non-loopback peer
 ```
 
-All four suites together — **52 tests** (fence 8, apply 20, handover 15,
-shims 9) — are `node --test test/*.test.mjs` from the plugin directory. The
-shell has to expand that glob: `node --test test/` fails with `MODULE_NOT_FOUND`
+All five suites together — **60 tests** (fence 8, apply 21, handover 15,
+shims 9, web-runtime 7) — are `node --test test/*.test.mjs` from the plugin
+directory. The shell has to expand that glob: `node --test test/` fails with `MODULE_NOT_FOUND`
 on Node 22.
 
+The manifest pins what it supports: `engines.dsh` is
+`>=0.1.7-rc.2 <0.3.0-0`, so a harness from a future minor release skips this
+plugin instead of loading it against a surface it was never checked on. Bump the
+range only after re-running the probe matrix above.
+
 `test/fence.test.mjs` loads `sameOrigin()` from the installed `dshmarket` when a
 profile is present and says which source it used, so a run against a bundled
 copy is never mistaken for a run against the real thing. `test/shims.test.mjs`
@@ -452,7 +676,10 @@ remote client and always looks like it passes.
 
 | Version | What changed |
 |---|---|
-| **0.2.1** | Documentation and compatibility only — **no code change from 0.2.0**. Records the 0.2.1-alpha.1 validation above, and how to install so the market can update it. |
+| **0.5.0** | Restores `disableAuth: true` as the default: no launch token and no per-device pairing, which is what the plugin exists to remove. `0.4.0`'s keep-the-check posture remains available with `disableAuth: false`. No code change beyond the default and the documentation; validated on DSH `0.2.1-rc.2`, where the bypass still replaces `connection.admit`. |
+| **0.4.0** | Keeps the browser-session check by default (`disableAuth: false`) and makes the 0.2.1-alpha.3 launch-token → 30-day-cookie flow survive the Host rewrite, including on a remote origin; the no-check posture moves to `disableAuth: true` and now replaces `connection.admit` as well, because the gate moved there. Declares `engines.dsh` (the 0.2.1-alpha.4 recommendation) and is validated on 0.2.1-alpha.4 and 0.2.1-rc.1. |
+| **0.3.0** | Provides the `webRuntime` trust snapshot that `0.2.1-alpha.2` stopped publishing (`lib/web-runtime.js`, `provideWebRuntime`), so a plugin that injects it — the sidebar among them — mounts instead of answering 405 on every request. The value is read live from `connection.trustedHosts` plus the listener's bind address, and an existing provider is left alone. |
+| 0.2.1 | Documentation and compatibility only — **no code change from 0.2.0**. Records the 0.2.1-alpha.1 validation above, and how to install so the market can update it. |
 | 0.2.0 | Renamed from `dsh-disable-untrusted-origin`. Added `lib/handover.js`: originals recorded once on a `Symbol.for` carrier, a liveness check (`fiber.uid === null`) on every delegated path, and an interceptor that retires a tagged predecessor. Capabilities now degrade with a warning instead of failing the fiber. |
 | 0.1.2 | Restored `crypto.randomUUID` and `navigator.clipboard` on plain HTTP, added the PWA manifest, and widened the viewport for notched screens. |
 | 0.1.1 | Provided the paired-device service, so the Skill Center works over a remote address instead of answering 400. |

cordis.patch.yml

@@ -4,13 +4,17 @@
 # (package.json declares dsh.bundle.patch).
 #
 # The defaults below are the plugin's stated posture: the identity fence is
-# disarmed, the browser-session check is removed, the browser is granted the
-# host's own isLoopback flag, and the APIs a non-secure page is denied are
-# restored. Override any key in your profile patch:
+# disarmed, no process token or per-device pairing is required, the browser is
+# granted the host's own isLoopback flag, and the APIs a non-secure page is
+# denied are restored. Reachability is therefore the only access control — put
+# the port behind something that authenticates on your behalf if it is exposed.
+# To keep the harness's own browser-session check instead (the first visit is
+# then the one-time launch token from the process log, exchanged for a 30-day
+# cookie), set `disableAuth: false`. Override any key in your profile patch:
 #
 #   - id: trustworthy
 #     config:
-#       disableAuth: false        # keep the process token, disarm only the fence
+#       disableAuth: false        # keep the launch-token check; one token per device
 #       grantPairing: false       # when dsh-remote-web-ui provides the pairing service itself
 #       spoofSocketAddress: true  # also satisfy socket-based fences with no pairing path
 #       shimClipboard: false      # unnecessary when you reach the harness over HTTPS

lib/index.js

@@ -11,7 +11,13 @@
  * request with `403`, which reads to the user as a button that does nothing.
  *
  * This plugin removes the distinction in two places, and separately restores
- * the browser capabilities a non-secure page is denied.
+ * the browser capabilities a non-secure page is denied. It removes the origin
+ * fence and the harness's own browser-session check by default, so a window is
+ * admitted with no process token and no per-device pairing. Set
+ * `disableAuth: false` to keep the session check, in which case the first visit
+ * is the one-time launch token from the process log (`dsh web: …?token=…`; the
+ * container entrypoint prints it into the Docker log from `0.2.1-alpha.4`),
+ * exchanged for a 30-day cookie bound to the authority it was minted under.
  *
  * 1. A `request`/`upgrade` listener installed ahead of every route answers
  *    each connection with the loopback authority. One interception covers the
@@ -25,14 +31,20 @@
  *    `navigator.clipboard`, both of which exist only in a secure context, plus
  *    the metadata that makes the page installable on a phone.
  *
- * What it deliberately does not do is write the trusted-host lists.
- * `webRuntime.trustedHosts` and the `connection` service's own `trustedHosts`
- * are separate arrays cloned at assembly time, and only the second is what the
- * `/api` fence reads — declaring an authority in the first, or in a config
- * patch that reaches neither, produces a name the gate never sees. Rewriting
- * the request needs no declaration at all, and reaches fences a declaration
- * cannot: a plugin comparing the header against a hardcoded loopback literal is
- * unmoved by any entry in a list it never consults.
+ * What it deliberately does not do is *declare* the arriving authority. The
+ * `connection` service's `trustedHosts` is what the `/api` fence reads, and an
+ * entry there changes which names the gate accepts — a weaker and narrower
+ * guarantee than rewriting the request, and one no declaration can give a fence
+ * that compares against a hardcoded loopback literal. Rewriting needs no
+ * declaration at all.
+ *
+ * It does, separately, **restore** the `webRuntime` service that releases from
+ * `0.2.1-alpha.2` on stopped providing, when nothing else provides it. That
+ * service was the LAN-trust snapshot a third-party plugin injects to learn the
+ * authorities its own copy of the fence should accept; without it the row stays
+ * `pending`, its routes never mount, and its URLs fall through to the core
+ * handler — which is what a `405` in a plugin's own pane actually is. See
+ * `lib/web-runtime.js` and `provideWebRuntime`.
  *
  * Reload safety: everything installed here is a mutation of an object the
  * harness owns, and a reload can run a successor's installation before its
@@ -41,12 +53,14 @@
  * still owns the installation — so a reload cannot leave the plugin inert while
  * it believes it is mounted, nor let a superseded interceptor keep acting.
  *
- * Security: this is a deliberate and total removal of the request-identity
- * fence across the whole HTTP surface. It defends against DNS rebinding and
- * against another page in the same browser driving this API, and both
- * defences stop applying once this plugin is enabled. Read the README before
- * turning it on, and keep the listening port behind something that
- * authenticates on your behalf.
+ * Security: removing the request-identity fence is deliberate and total for
+ * every window that reaches the port. It defends against DNS rebinding and
+ * against another page in the same browser driving this API, and both defences
+ * stop applying once this plugin is enabled. The default also removes the
+ * session check, so reachability is the only access control — a `0.0.0.0` bind
+ * fronted by a public tunnel with no authentication of its own is wide open.
+ * Set `disableAuth: false` to keep the launch-token check. Read the README
+ * before deploying either posture.
  *
  * @module dsh-trustworthy
  */
@@ -73,10 +87,24 @@ import {
   shimSource,
   withCoverViewport,
 } from './shims.js'
+import {
+  WEB_RUNTIME_SERVICE,
+  bindAuthority,
+  connectionAuthorities,
+  trustedAuthorities,
+  webRuntimeShim,
+} from './web-runtime.js'
 
 export { CLIENT_LOOPBACK_GRANT, loopbackAuthority, loopbackise, spoofPeerAddress }
 export { HANDOVER, INTERCEPTOR, fiberLive, installInterceptor, installReplacements, originalOf }
 export { MANIFEST_PATH, manifest, pwaMarkup, shimSource, withCoverViewport }
+export {
+  WEB_RUNTIME_SERVICE,
+  bindAuthority,
+  connectionAuthorities,
+  trustedAuthorities,
+  webRuntimeShim,
+}
 
 /** Stable Cordis plugin name. */
 export const name = 'trustworthy'
@@ -103,10 +131,15 @@ export const Config = z.object({
     .boolean()
     .default(true)
     .description(
-      'Also remove the browser-session check, so no process token is needed. '
-        + 'Anyone who can reach the port then has full control of the agent, '
-        + 'including code execution. Keep this true only behind a port or '
-        + 'tunnel that authenticates on its own.',
+      'Remove the browser-session check as well, so no process token is ever '
+        + 'needed and no device has to be paired. Anyone who can reach the port '
+        + 'then has full control of the agent, including code execution: '
+        + 'reachability is the only access control. This is the default because '
+        + 'the plugin exists to make every window behave like the host window, '
+        + 'and a token paste on each new device defeats that. Set it false to '
+        + 'keep the harness\'s launch-token check: open the URL from the process '
+        + 'log once, and the 30-day cookie it exchanges covers this plugin\'s '
+        + 'rewritten requests too.',
     ),
   forceClientLoopback: z
     .boolean()
@@ -126,6 +159,17 @@ export const Config = z.object({
         + 'off when @linxin666/dsh-remote-web-ui is installed: it provides the '
         + 'same service, and two providers for one name is a load error.',
     ),
+  provideWebRuntime: z
+    .boolean()
+    .default(true)
+    .description(
+      'Provide the Web-runtime trust snapshot that releases from 0.2.1-alpha.2 '
+        + 'on stopped publishing, when nothing else provides it. Plugins that '
+        + 'inject `webRuntime` — the sidebar among them — stay pending without '
+        + 'it, and their routes are never registered, which their pane reports '
+        + 'as an HTTP 405. Turn this off to leave those plugins unmounted on a '
+        + 'harness that removed the service.',
+    ),
   spoofSocketAddress: z
     .boolean()
     .default(false)
@@ -209,9 +253,17 @@ export function apply(ctx, config) {
 
   if (config.disableAuth) {
     const connection = ctx.connection
-    // The `/api` gateway asks one method whether the request may proceed; it
-    // applies the identity fence and then the session check. Answering
-    // `undefined` admits both.
+    // The gate is one method. Releases up to `0.2.1-alpha.2` asked
+    // `requestRejection` first and `admit` wrapped its answer; from
+    // `0.2.1-alpha.3` on `admit` applies the fence and the session check
+    // itself, and `requestRejection` is a façade over it. Replacing `admit`
+    // therefore satisfies both shapes, and replacing `requestRejection` keeps
+    // the older shape from short-circuiting around it.
+    //
+    // The peer that comes back is one the harness already owns: `operator` up
+    // to `0.2.1-alpha.2`, `browserPeer` from `0.2.1-alpha.3` on. There is no
+    // synthetic identity to invent, and returning the owner's peer is exactly
+    // what the session check would have produced for a logged-in browser.
     //
     // `authenticatedUrl` is the startup URL and the remote-access handoff;
     // returning the base URL keeps the process token out of the printed link.
@@ -231,7 +283,14 @@ export function apply(ctx, config) {
         const original = originalOf(connection, key)
         return original === undefined ? undefined : original.apply(this, args)
       }
+    const admit = (request) => {
+      const peer = connection.browserPeer ?? connection.operator
+      if (peer !== undefined) return { peer }
+      const original = originalOf(connection, 'admit')
+      return original === undefined ? undefined : original.call(connection, request)
+    }
     const restore = installReplacements(connection, {
+      admit: delegate('admit', admit),
       requestRejection: delegate('requestRejection', () => undefined),
       authorizeIndex: delegate('authorizeIndex', () => true),
       authenticatedUrl: delegate('authenticatedUrl', (baseUrl) => baseUrl),
@@ -268,6 +327,33 @@ export function apply(ctx, config) {
     }
   }
 
+  if (config.provideWebRuntime) {
+    // Not a fence change, and not a declaration of the arriving authority: this
+    // restores a service the harness stopped publishing, for plugins that inject
+    // it and would otherwise never mount at all. The value is read live from
+    // `connection`, so it follows the same trust source the `/api` fence derives
+    // its own list from rather than a snapshot frozen at assembly time.
+    //
+    // Registered on this plugin's own fiber, so unload withdraws it and a
+    // consumer that depended on it is released with it. Unlike the pairing
+    // service below there is no liveness gate on the answer: that one *decides*
+    // whether a device is paired, so a registration outliving its disposers
+    // would keep vouching for devices, while this one only republishes the
+    // authorities `connection` already carries. Probing first matters for the
+    // same reason it does for pairing: a second registration of one service
+    // name is a load error.
+    if (ctx.get(WEB_RUNTIME_SERVICE) === undefined) {
+      ctx.provide(WEB_RUNTIME_SERVICE, webRuntimeShim(ctx))
+      ctx.logger?.info(
+        `trustworthy: provided the ${WEB_RUNTIME_SERVICE} service this harness no longer publishes`,
+      )
+    } else {
+      ctx.logger?.info(
+        `trustworthy: ${WEB_RUNTIME_SERVICE} is already provided; leaving that provider in place`,
+      )
+    }
+  }
+
   if (config.forceClientLoopback) {
     ctx.inject(['webServer'], (webCtx) => {
       // `on` takes options, not a label; the subscription lives with the

lib/web-runtime.js

@@ -0,0 +1,111 @@
+/**
+ * dsh-trustworthy — the `webRuntime` seam, for harness releases that stopped
+ * providing it.
+ *
+ * `@deepseek-ai/dsh-web-app` used to provide a `webRuntime` service whose value
+ * was the LAN-trust snapshot — `resolveLanTrust(ctx.webServer.host, trustedHosts)`,
+ * that is `{ lanAddresses, trustedHosts }`. Releases from `0.2.1-alpha.2` on no
+ * longer provide it: the `--trusted-host` authorities are parsed by the
+ * `webStartup` service and consumed by `@deepseek-ai/dsh-client-connection` into
+ * `connection.trustedHosts`, and the listener's own bind address is accepted by
+ * the `/api` fence as a separate case.
+ *
+ * Plugins written against the old shape never learn that it moved. They declare
+ * `inject: ['webRuntime']`, so Cordis holds their row **pending** — the module
+ * loads and its inject list is read, but the fiber never mounts. Their routes
+ * are then simply absent, and the core fallback answers in their place: a
+ * `POST /sidebar/api/fs.list` that matches no route falls through to the
+ * static-file handler, which allows `GET`/`HEAD` only and answers **405**.
+ *
+ * This module fills that seam. Same service name, same value shape, but read
+ * live from the trust source the harness actually has now, rather than cloned
+ * at assembly time — so a later `--trusted-host`, or a row that changed
+ * `connection`'s config, is visible to a plugin's own copy of the fence.
+ *
+ * @module dsh-trustworthy/web-runtime
+ */
+
+/** Service name sibling plugins inject, and read, for the Web runtime snapshot. */
+export const WEB_RUNTIME_SERVICE = 'webRuntime'
+
+/**
+ * Bind hosts that name every interface rather than one of them. A wildcard can
+ * be written as an authority but never *means* one, so it is not an entry.
+ */
+const WILDCARD_BIND_HOSTS = new Set(['0.0.0.0', '::', '::0', '*'])
+
+/**
+ * The non-loopback authorities this deployment declared — the `--trusted-host`
+ * values, as `connection` received them. Read per call rather than captured, so
+ * the snapshot tracks the same list the `/api` fence is using.
+ *
+ * @param ctx - host plugin context carrying `connection`.
+ * @returns declared authorities, in the order they were configured.
+ */
+export function connectionAuthorities(ctx) {
+  const declared = ctx.connection?.trustedHosts
+  if (!Array.isArray(declared)) return []
+  return declared.filter((entry) => typeof entry === 'string' && entry !== '')
+}
+
+/**
+ * The listener's own bind address, when it names one interface. `0.2.1-alpha.2`'s
+ * `/api` fence accepts this address on its own (`isBindAddressAuthority`), and
+ * a plugin carrying a private copy of the older two-argument fence cannot: it
+ * only ever compares against the list it is handed. Publishing the bind address
+ * as an entry makes that older fence accept exactly what the core fence accepts
+ * — the entry is port-less, so like the core check it matches the address on any
+ * port, and a wildcard is not an authority: `0.2.1-alpha.2` refuses to bind one
+ * at all (`host "0.0.0.0" is an unspecified (wildcard) address, which is not
+ * supported`), so that case is unreachable rather than merely unused.
+ *
+ * @param ctx - host plugin context carrying `webServer`.
+ * @returns the bind host, or undefined when the surface is gone or wildcarded.
+ */
+export function bindAuthority(ctx) {
+  const host = ctx.webServer?.host
+  if (typeof host !== 'string' || host === '' || WILDCARD_BIND_HOSTS.has(host)) return undefined
+  return host
+}
+
+/**
+ * The authorities the removed `webRuntime.trustedHosts` would carry today.
+ *
+ * @param ctx - host plugin context carrying `connection` and `webServer`.
+ * @returns deduplicated authorities: the declared ones, then the bind address.
+ */
+export function trustedAuthorities(ctx) {
+  const declared = connectionAuthorities(ctx)
+  const bind = bindAuthority(ctx)
+  return bind === undefined ? [...new Set(declared)] : [...new Set([...declared, bind])]
+}
+
+/**
+ * The value of the `webRuntime` service, shaped as `0.2.1-alpha.1` provided it.
+ *
+ * Both members are getters: a consumer reads `trustedHosts` inside its fence, per
+ * request, so a snapshot that could not see a later authority would quietly
+ * refuse requests the `/api` gateway admits. `lanAddresses` stays empty because
+ * `0.2.1-alpha.2` rejects a wildcard bind — alpha.1 filled it from the host's
+ * interfaces only for `0.0.0.0`, so the empty list is that same function's
+ * answer for every bind this harness allows.
+ *
+ * When dsh-trustworthy's interceptor is installed the list is inert for the
+ * plugin's own routes: every request arrives carrying the loopback authority, so
+ * a fence written against this value admits it before reading the list. The
+ * populated list matters to consumers that read it for another reason, and to a
+ * deployment that installs this shim without the interceptor.
+ *
+ * @param ctx - host plugin context carrying `connection` and `webServer`.
+ * @returns the service value.
+ */
+export function webRuntimeShim(ctx) {
+  return {
+    get trustedHosts() {
+      return trustedAuthorities(ctx)
+    },
+    get lanAddresses() {
+      return []
+    },
+  }
+}

package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-trustworthy",
-  "version": "0.2.1",
-  "description": "Removes the untrusted-origin restriction from DeepSeek Harness. Every browser window is treated as if it were running on the harness machine itself: no process token, no declared trusted host, and no per-plugin origin fence, because one interceptor answers every request with the loopback authority.",
+  "version": "0.5.0",
+  "description": "Removes the untrusted-origin restriction from DeepSeek Harness while keeping its own session check: every browser window is treated as if it were running on the harness machine itself, so no declared trusted host and no per-plugin origin fence refuse it. One interceptor answers every request with the loopback authority, and the one-time launch token is exchanged for a 30-day cookie exactly as on the loopback host.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
@@ -9,7 +9,8 @@
     "./authority": "./lib/authority.js",
     "./handover": "./lib/handover.js",
     "./package.json": "./package.json",
-    "./shims": "./lib/shims.js"
+    "./shims": "./lib/shims.js",
+    "./web-runtime": "./lib/web-runtime.js"
   },
   "files": [
     "lib/",
@@ -18,6 +19,9 @@
     "LICENSE"
   ],
   "license": "MIT",
+  "engines": {
+    "dsh": ">=0.1.7-rc.2 <0.3.0-0"
+  },
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -32,7 +36,7 @@
       "patch": "./cordis.patch.yml"
     },
     "compatibility": {
-      "dsh": ">=0.1.7-rc.2"
+      "dsh": ">=0.1.7-rc.2 <0.3.0-0"
     }
   },
   "peerDependencies": {

scripts/live-probe.mjs

@@ -4,8 +4,11 @@
  * Verifies, against the process actually serving your browser, that
  *   1. a non-loopback `Host` is admitted by the plugin market's fence,
  *   2. the shell is served without a process token,
- *   3. the Skill Center answers a non-loopback *peer*, and
- *   4. the browser shims and the PWA manifest actually reach the page.
+ *   3. the Skill Center answers a non-loopback *peer*,
+ *   4. the browser shims and the PWA manifest actually reach the page, and
+ *   5. the sidebar's Files API is registered rather than falling through to the
+ *      static handler as a 405 — the shape a plugin takes when the service it
+ *      injects (`webRuntime`) is not provided.
  *
  * Point 3 is the one that needs care: the Skill Center fences on the socket
  * address as well as the Host, so a probe over 127.0.0.1 can never reproduce a
@@ -140,11 +143,33 @@ try {
 }
 record('manifest is served', manifestOk, `${manifest.status}`)
 
+// A plugin whose injection is unsatisfied never runs `apply`, so its routes are
+// absent and this URL is answered by the core static handler, which allows only
+// GET/HEAD. A registered route answers 400 (no sessionId) or 404 in the plugin's
+// own JSON shape; 405 is the fall-through, and is the whole of "the Files pane
+// stopped previewing anything".
+const sidebar = await request({
+  method: 'POST',
+  path: '/sidebar/api/fs.tree',
+  host: anyIdentity,
+  body: '{}',
+})
+const sidebarMounted = sidebar.status !== 405 && sidebar.status !== 0
+record(
+  'sidebar Files API is registered',
+  sidebarMounted,
+  sidebarMounted
+    ? `${sidebar.status} from a registered route`
+    : '405 from the static handler: the plugin never mounted (is webRuntime provided?)',
+)
+
 const failed = checks.filter((check) => !check.ok)
 console.log(`\n${checks.length - failed.length}/${checks.length} passed`)
 if (failed.length > 0) {
   console.log('\nA 403 on the market means the origin fence is still in force.')
   console.log('A 400 on the Skill Center means it is still refusing (or throwing for) a remote peer.')
   console.log('A missing shim or manifest usually means the updated bundle is not loaded yet.')
+  console.log('A 405 on the Files API means a plugin stayed pending: check the boot log for')
+  console.log('"did not activate" and whether the service it injects is provided.')
   process.exit(1)
 }

test/apply.test.mjs

@@ -25,6 +25,9 @@ async function mockHost({ rawServer = true, registry = true } = {}) {
     requestRejection: function requestRejection() {
       return 403
     },
+    admit: function admit() {
+      return { rejection: 401 }
+    },
     authorizeIndex: function authorizeIndex() {
       return false
     },
@@ -32,7 +35,12 @@ async function mockHost({ rawServer = true, registry = true } = {}) {
       return `${baseUrl}?token=launch-secret`
     },
   }
-  const connection = { ...originals }
+  const connection = {
+    ...originals,
+    // Releases up to 0.2.1-alpha.2 named the owner peer `operator`; from
+    // 0.2.1-alpha.3 on it is `browserPeer`. A real host has one or the other.
+    browserPeer: { id: 'browser-peer' },
+  }
   const provided = new Map()
   const server = createServer((_request, response) => {
     response.writeHead(200)
@@ -195,21 +203,39 @@ test('disableAuth replaces the session methods and unload restores them', async
   const host = await mockHost()
   const { apply } = await import(PLUGIN)
   apply(host.ctx, CONFIG)
+  assert.deepEqual(host.connection.admit({}), { peer: host.connection.browserPeer })
   assert.equal(host.connection.requestRejection({}), undefined)
   assert.equal(host.connection.authorizeIndex({}, {}), true)
   assert.equal(host.connection.authenticatedUrl('http://box:3080'), 'http://box:3080')
   host.unload()
+  assert.deepEqual(host.connection.admit({}), { rejection: 401 })
   assert.equal(host.connection.requestRejection({}), 403)
   assert.equal(host.connection.authorizeIndex({}, {}), false)
   assert.equal(host.connection.authenticatedUrl('http://box:3080'), 'http://box:3080?token=launch-secret')
   await new Promise((resolve) => host.server.close(resolve))
 })
 
+test('disableAuth admits through the operator peer on 0.2.1-alpha.2 and older', async () => {
+  const host = await mockHost()
+  const operator = { id: 'operator-peer' }
+  delete host.connection.browserPeer
+  host.connection.operator = operator
+  const { apply } = await import(PLUGIN)
+  apply(host.ctx, CONFIG)
+  try {
+    assert.deepEqual(host.connection.admit({}), { peer: operator })
+  } finally {
+    host.unload()
+    await new Promise((resolve) => host.server.close(resolve))
+  }
+})
+
 test('disableAuth false leaves the session methods untouched', async () => {
   const host = await mockHost()
   const { apply } = await import(PLUGIN)
   apply(host.ctx, { ...CONFIG, disableAuth: false })
   try {
+    assert.deepEqual(host.connection.admit({}), { rejection: 401 })
     assert.equal(host.connection.requestRejection({}), 403)
     assert.equal(host.connection.authorizeIndex({}, {}), false)
   } finally {
@@ -418,11 +444,13 @@ test('a disposed fiber stops admitting requests', async () => {
   const { apply } = await import(PLUGIN)
   apply(host.ctx, CONFIG)
 
+  assert.deepEqual(host.connection.admit({}), { peer: host.connection.browserPeer }, 'admitting while mounted')
   assert.equal(host.connection.requestRejection(), undefined, 'admitted while mounted')
   assert.equal(host.connection.authorizeIndex(), true)
   assert.equal(host.connection.authenticatedUrl('/base'), '/base')
 
   host.ctx.fiber.uid = null
+  assert.deepEqual(host.connection.admit({}), { rejection: 401 }, 'the real gate answers again')
   assert.equal(host.connection.requestRejection(), 403, 'the real fence answers again')
   assert.equal(host.connection.authorizeIndex(), false)
   assert.equal(
@@ -516,3 +544,12 @@ test('a webserver with no route registry is reported, not fatal', async () => {
   host.unload()
   await new Promise((resolve) => host.server.close(resolve))
 })
+
+test('the shipped default removes the session check', async () => {
+  // A token prompt on every new device is the friction this plugin exists to
+  // remove; 0.4.0 made the check opt-out, and that regressed the posture.
+  const { Config } = await import(PLUGIN)
+  const defaults = Config({})
+  assert.equal(defaults.enabled, true)
+  assert.equal(defaults.disableAuth, true)
+})

test/web-runtime.test.mjs

@@ -0,0 +1,175 @@
+/**
+ * The `webRuntime` seam: the value it publishes, and the wiring that publishes
+ * it only when the harness has not.
+ *
+ * The fence and apply suites cover the request identity; this one covers the
+ * service releases from `0.2.1-alpha.2` on stopped providing, whose absence
+ * leaves an injecting plugin `pending` and its routes unregistered — the 405 a
+ * user sees in the sidebar's Files tab.
+ *
+ *   node test/web-runtime.test.mjs
+ */
+
+import assert from 'node:assert/strict'
+import { createServer } from 'node:http'
+import test from 'node:test'
+
+import { Config, apply } from '../lib/index.js'
+import {
+  WEB_RUNTIME_SERVICE,
+  bindAuthority,
+  connectionAuthorities,
+  trustedAuthorities,
+  webRuntimeShim,
+} from '../lib/web-runtime.js'
+
+/** A config with every engagement off but the one under test. */
+function quietConfig(overrides = {}) {
+  return {
+    enabled: true,
+    disableAuth: false,
+    forceClientLoopback: false,
+    grantPairing: false,
+    provideWebRuntime: true,
+    spoofSocketAddress: false,
+    shimClipboard: false,
+    shimRandomUuid: false,
+    shimPwa: false,
+    ...overrides,
+  }
+}
+
+/**
+ * A host context carrying only what `apply` touches, plus the real raw server
+ * the interceptor is installed on.
+ *
+ * @param options - bind host, the authorities `connection` was given, and any
+ *   value already registered under the `webRuntime` name.
+ */
+async function mockHost({ host = '172.17.0.4', trustedHosts = [], webRuntime } = {}) {
+  const provided = new Map()
+  if (webRuntime !== undefined) provided.set(WEB_RUNTIME_SERVICE, webRuntime)
+  const logs = []
+  const server = createServer((_request, response) => {
+    response.writeHead(200)
+    response.end('route handler')
+  })
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve))
+  const ctx = {
+    fiber: { uid: 1 },
+    logger: {
+      info(message) {
+        logs.push(message)
+      },
+      warn(message) {
+        logs.push(message)
+      },
+    },
+    webServer: { port: server.address().port, host, server },
+    connection: { trustedHosts },
+    effect() {},
+    inject(_services, callback) {
+      callback(ctx)
+    },
+    on() {},
+    // Cordis's `get` answers undefined for a name nobody provided, and its
+    // `provide` throws on a second registration of one name.
+    get(service) {
+      return provided.get(service)
+    },
+    provide(service, value) {
+      if (provided.has(service)) throw new Error(`service "${service}" has been registered`)
+      provided.set(service, value)
+      return () => provided.delete(service)
+    },
+  }
+  return { ctx, server, provided, logs }
+}
+
+test('declared authorities survive as strings and malformed entries do not', () => {
+  assert.deepEqual(connectionAuthorities({ connection: { trustedHosts: [] } }), [])
+  assert.deepEqual(
+    connectionAuthorities({
+      connection: { trustedHosts: ['ai.milesward.dev', '', 7, null, '192.168.1.49:3080'] },
+    }),
+    ['ai.milesward.dev', '192.168.1.49:3080'],
+  )
+  // A harness that never built the list, or a host context without the service.
+  assert.deepEqual(connectionAuthorities({}), [])
+  assert.deepEqual(connectionAuthorities({ connection: {} }), [])
+})
+
+test('the bind address is an authority only when it names one interface', () => {
+  assert.equal(bindAuthority({ webServer: { host: '172.17.0.4' } }), '172.17.0.4')
+  assert.equal(bindAuthority({ webServer: { host: '::1' } }), '::1')
+  // A wildcard can be written as an authority but never means one.
+  for (const host of ['0.0.0.0', '::', '::0', '*', '']) {
+    assert.equal(bindAuthority({ webServer: { host } }), undefined, host)
+  }
+  assert.equal(bindAuthority({}), undefined)
+  assert.equal(bindAuthority({ webServer: {} }), undefined)
+})
+
+test('the snapshot is the declared authorities plus the bind address, deduplicated', () => {
+  assert.deepEqual(
+    trustedAuthorities({
+      connection: { trustedHosts: ['ai.milesward.dev', '172.17.0.4'] },
+      webServer: { host: '172.17.0.4' },
+    }),
+    ['ai.milesward.dev', '172.17.0.4'],
+  )
+  // The wildcard bind adds nothing — alpha.1's resolveLanTrust agreed, and
+  // alpha.2 refuses a wildcard `--host` outright.
+  assert.deepEqual(
+    trustedAuthorities({ connection: { trustedHosts: ['app.internal'] }, webServer: { host: '0.0.0.0' } }),
+    ['app.internal'],
+  )
+})
+
+test('the snapshot is read per request, not captured once', () => {
+  const connection = { trustedHosts: ['ai.milesward.dev'] }
+  const runtime = webRuntimeShim({ connection, webServer: { host: '10.0.0.7' } })
+  assert.deepEqual(runtime.trustedHosts, ['ai.milesward.dev', '10.0.0.7'])
+  assert.deepEqual(runtime.lanAddresses, [])
+
+  // A fence reads the list inside a request; a value frozen at mount time would
+  // go on refusing a name the `/api` gateway had since admitted.
+  connection.trustedHosts = ['ai.milesward.dev', 'app.internal']
+  assert.deepEqual(runtime.trustedHosts, ['ai.milesward.dev', 'app.internal', '10.0.0.7'])
+})
+
+test('the seam is on by default, and `apply` provides it', async (t) => {
+  assert.equal(Config({}).provideWebRuntime, true)
+
+  const { ctx, server, provided, logs } = await mockHost({ trustedHosts: ['ai.milesward.dev'] })
+  t.after(() => server.close())
+  apply(ctx, quietConfig())
+
+  assert.deepEqual(provided.get(WEB_RUNTIME_SERVICE)?.trustedHosts, [
+    'ai.milesward.dev',
+    '172.17.0.4',
+  ])
+  assert.ok(logs.some((line) => line.includes('provided the webRuntime service')), logs.join('\n'))
+})
+
+test('an existing provider is left alone', async (t) => {
+  const existing = { trustedHosts: ['someone-else.example'] }
+  const { ctx, server, provided, logs } = await mockHost({ webRuntime: existing })
+  t.after(() => server.close())
+  apply(ctx, quietConfig())
+
+  assert.equal(provided.get(WEB_RUNTIME_SERVICE), existing)
+  assert.ok(logs.some((line) => line.includes('already provided')), logs.join('\n'))
+})
+
+test('the seam can be switched off, and a suspended plugin provides nothing', async (t) => {
+  const off = await mockHost()
+  t.after(() => off.server.close())
+  apply(off.ctx, quietConfig({ provideWebRuntime: false }))
+  assert.equal(off.provided.has(WEB_RUNTIME_SERVICE), false)
+
+  const suspended = await mockHost()
+  t.after(() => suspended.server.close())
+  apply(suspended.ctx, quietConfig({ enabled: false }))
+  assert.equal(suspended.provided.has(WEB_RUNTIME_SERVICE), false)
+})