v0.1.13

基线推进到 dsh 0.2.1 正式通道，双时代兼容适配随之转正。

变更内容

dsh-web-startup-auth v0.1.13，以 dsh next 通道为基线（0.2.1-rc.2）。

新增

• 兼容 dsh 0.2.1 线：上游在该版本收紧了 --host 值域（只收单个具体 IP、拒绝通配绑定），本插件原地拓宽 schema，--host 0.0.0.0 与 --host :: 继续可用（#f924307）。
• 透传上游两个新启动能力：--public-url <url>（声明反代后的对外访问 URL）与 --tls-cert/--tls-key（直连 HTTPS，自签证书也可用）。开启 HTTPS 后，会话 cookie 与自动补发的浏览器 cookie 都会带上 ; Secure（#f924307）。
• 依赖基线推进到 dsh 0.2.1-rc.2（next 通道）；在低于 0.2.1 的 dsh 上使用新旗标会明确报错提示需要 dsh ≥ 0.2.1，而不是被静默忽略（#9cbfbb8）。

修复

• 无。

验证

• 230 个 vitest 测试全绿；typecheck / build 干净。
• 隔离实例实机（dsh 0.2.1-rc.2）三形态全绿：--host 0.0.0.0 登录墙十二探针、具体 IP + TLS 自签全链、--host :: 双栈信任围栏；flag 门禁报错文案与上游逐字一致。

---

What's changed

The baseline moves to the official dsh 0.2.1 channel, and the dual-line compatibility work ships with it.

Changes

dsh-web-startup-auth v0.1.13, baseline dsh next channel (0.2.1-rc.2).

Added

• dsh 0.2.1 line support: upstream tightened the --host value domain in that release (one concrete IP only, wildcard binds rejected); this plugin widens the schema in place so --host 0.0.0.0 and --host :: keep working (#f924307).
• Passthrough for two new upstream startup capabilities: --public-url <url> (advertise the externally reachable URL behind a reverse proxy) and --tls-cert/--tls-key (direct HTTPS; self-signed certificates work too). With HTTPS on, the session cookie and the minted browser cookies both carry ; Secure (#f924307).
• Dependency baseline moved to dsh 0.2.1-rc.2 (next channel). Using the new flags on a dsh older than 0.2.1 fails with an explicit "requires dsh >= 0.2.1" error instead of being silently ignored (#9cbfbb8).

Fixed

• Nothing.

Verification

• 230 vitest tests pass; typecheck / build clean.
• Isolated-instance acceptance on dsh 0.2.1-rc.2, three bind shapes all green: the twelve-probe login wall on --host 0.0.0.0, the full self-signed TLS chain on a concrete IP, and the dual-stack trust fence on --host ::. The flag-gate error messages match upstream verbatim.

v0.1.12

加固 API 会话防护（双层闸门 + dsh 版本门槛），支持 IPv6 绑定，基线跟进 0.2.0-rc.1

变更内容

dsh-web-startup-auth v0.1.12，以 dsh next 通道为基线（0.2.0-rc.1）。

新增

• dsh web --host 支持 IPv6 绑定（如 --host ::，Linux 下默认双栈，IPv4 也能连）：纯 IPv6 的局域网不再卡在启动、也不会被挡在登录页之前（#3712227）。
• API 访问新增第二层会话防护：只有登录会话（或真本机访问）能调用共享 API，上游的 30 天浏览器凭据不能单独作为 API 通行凭据；两层防护互为保险，任一侧上游接口变化都不会让 API 裸奔（#dea2c55）。
• 声明支持的 dsh 版本范围（0.1.7-rc.1 起、0.3.0 之前）：跑在不兼容的 dsh 上时插件会被明确跳过并打印原因，不再静默运行（#dea2c55）。
• 基线跟进 dsh 0.2.0-rc.1（next 通道），依赖声明同步升级（#de9a149）。

修复

• 无。

验证

• 213 个 vitest 测试全绿（含 IPv6 绑定与信任围栏用例）；typecheck / build 干净；IPv6 双栈与围栏经隔离实例实机验收。

---

What's changed

Hardened API session protection (two-layer gate + dsh version range), IPv6 bind support, baseline moved to 0.2.0-rc.1

dsh-web-startup-auth v0.1.12, targeting the dsh next channel baseline (0.2.0-rc.1).

Added

• dsh web --host now accepts IPv6 bind addresses (e.g. --host ::; dual-stack by default on Linux, so IPv4 keeps working): pure-IPv6 LANs no longer get stuck at startup or blocked before the login page (#3712227).
• A second session layer protecting API access: only a login session (or a genuine local caller) can reach the shared API — the upstream 30-day browser cookie never works as an API credential on its own. The two layers insure each other, so an upstream interface change on either side cannot leave the API unprotected (#dea2c55).
• A declared supported dsh version range (from 0.1.7-rc.1, before 0.3.0): on an incompatible dsh the plugin is now skipped with a clear printed reason instead of running silently (#dea2c55).
• Baseline moved to dsh 0.2.0-rc.1 (next channel), with dependency declarations updated to match (#de9a149).

Fixed

• Nothing.

Verification

• 213 vitest tests green (including IPv6 bind and trust-fence cases); typecheck / build clean; IPv6 dual-stack and the fence verified on an isolated live instance.

v0.1.11

新增可选滑块拼图验证，凭据路径与 OAuth 回调适配 dsh 0.1.7-rc.1

变更内容

dsh-web-startup-auth v0.1.11，以 dsh next 通道为基线（0.1.7-rc.1）。

新增

• 可选的登录滑块拼图验证（设置面板 → 认证 → 人机验证，默认关闭）：开启后登录前先拼对图。它是应网友要求加的彩蛋，不是安全边界（答案画在图上，脚本可读）（#4430a9a）。
• 拼图带一个形状永远不同的假缺口，认形状、不认位置——解题靠观察，不背答案（#4430a9a）。

修复

• DeepSeek 账号登录的 OAuth 回调不再被登录墙吃掉：/oauth/callback 现在保持免登，换浏览器点登录链接也能正常回跳，授权码不再丢失（#4430a9a）。
• 凭据文件跟随 $DSH_HOME：自定义 DSH_HOME 或跑多实例时不再和 ~/.dsh 共用同一份账号（此前新实例可能读到另一实例的管理员账号）（#4430a9a）。
• 依赖声明跟进到 dsh 0.1.7-rc.1（5 个 @deepseek-ai/dsh-*），并在构建前清空 lib/，删除源文件后旧产物不会再跟着发布包走（#a5e1f58）。

验证

• 180 个 vitest 测试全绿；typecheck / build 干净（构建后 lib/ 零漂移，产物可复现）。

---

What's changed

An optional login slider puzzle, plus credential-path and OAuth-callback fixes for the dsh 0.1.7-rc.1 baseline

dsh-web-startup-auth v0.1.11, targeting the dsh next channel baseline (0.1.7-rc.1).

Added

• An optional slider puzzle in front of the login form (Settings → Auth → Human verification, off by default): when enabled, you align the piece before submitting a password. It's an easter egg requested by users, not a security boundary — the answer is drawn on the image and a script can read it (#4430a9a).
• Every puzzle also draws a decoy notch whose shape is always different from the real one, so you solve it by looking rather than by memorizing (#4430a9a).

Fixed

• DeepSeek account sign-in is no longer swallowed by the login wall: /oauth/callback now stays reachable while unauthenticated, so opening the sign-in link from another browser bounces back correctly and the authorization code is no longer lost (#4430a9a).
• The credential file now follows $DSH_HOME, so a custom home or a second instance no longer shares one account with ~/.dsh (previously a fresh instance could pick up another instance's admin account) (#4430a9a).
• Dependency declarations now target dsh 0.1.7-rc.1 (all five @deepseek-ai/dsh-* packages), and the build clears lib/ first so removed sources can no longer ship stale artifacts in the published package (#a5e1f58).

Verification

• 180 vitest tests green; typecheck / build clean (lib/ shows zero drift after a rebuild, so artifacts are reproducible).

v0.1.10

本机首次设置管理员账号与「本机登录校验」开关，认证页状态不再误报

变更内容

dsh-web-startup-auth v0.1.10，以 dsh next 通道为基线（0.1.5-rc.2）。

新增

• 本机默认免登录时也能设置管理员账号：认证页会给出入口，登录页在未注册时保持注册表单，不再把你弹回首页（#6977b37）。
• 新增「本机登录校验」开关（设置面板 → 认证 → 登录要求）：打开后本机地址也要求登录，适合多人共享的服务器（#6977b37）。
• 认证页区分「已登录」与「本机免登录」：只有确实持有登录状态时才显示退出登录入口（#6977b37）。

修复

• 登录成功后认证页不再短暂显示「当前未登录，或登录已失效」：状态还没读到时不下结论（#6977b37）。
• 「本机登录校验」开关不再显示为关闭（实际已开启）：读取期间显示「正在读取登录要求…」并保持不可点（#6977b37）。
• 认证页的状态信息提前读取，打开面板无需等待（#6977b37）。

验证

• 96 个 vitest 测试全绿；typecheck / build 干净。

---

What's changed

Setting up the admin account locally, a "require login on loopback" switch, and an auth tab that no longer misreports its state

dsh-web-startup-auth v0.1.10, targeting the dsh next channel baseline (0.1.5-rc.2).

Added

• A local browser can now set up the admin account even though loopback is trusted by default: the auth tab offers the entry point, and the login page keeps its registration form instead of bouncing you back to the app (#6977b37).
• New "require login on loopback" switch (Settings → Auth → Login requirements): when on, the loopback address needs a session too — useful on a shared server (#6977b37).
• The auth tab distinguishes "signed in" from "exempt because it is the local address": the sign-out entry point only appears when you actually hold a login (#6977b37).

Fixed

• Right after logging in, the auth tab no longer briefly claims "当前未登录，或登录已失效" — it draws no conclusion until the state has been read (#6977b37).
• The "require login on loopback" switch no longer renders as off while the backend says on; while reading it shows "正在读取登录要求…" and stays non-interactive (#6977b37).
• The auth tab reads its state up front, so opening the panel no longer waits on a request (#6977b37).

Verification

• 96 vitest tests green; typecheck / build clean.

v0.1.9 — 明暗主题适配，跟进 dsh 0.1.5-rc.2

变更内容

dsh-web-startup-auth v0.1.9，以 dsh next 通道为基线（0.1.5-rc.2）。

新增

• 认证设置页跟随 DSH 应用的明暗主题自动切换配色，暗色模式下不再固定浅色（#57f8ebd）。
• 登录页跟随操作系统明暗偏好自动切换配色（#292ce5c）。
• 跟进 dsh 0.1.5-rc.2 基线：依赖范围与文档一并更新到新版 dsh，配合新版 dsh 安装即可，插件源码无需改动（#8d3f415）。

修复

• 无。

验证

• 93 个 vitest 测试全绿；typecheck / build 干净。

---

What's changed

dsh-web-startup-auth v0.1.9, targeting the dsh next channel baseline (0.1.5-rc.2).

Added

• The auth settings page now follows the DSH app light/dark theme instead of staying light-only (#57f8ebd).
• The login page now follows the operating system's light/dark preference (#292ce5c).
• Tracks the dsh 0.1.5-rc.2 baseline: dependency ranges and docs are updated to the newer dsh, so installing alongside a recent dsh works with no plugin source changes (#8d3f415).

Fixed

• Nothing.

Verification

• 93 vitest tests green; typecheck / build clean.

v0.1.8 — 跟进 dsh 0.1.5-rc.1 基线

变更内容

dsh-web-startup-auth v0.1.8，以 dsh next 通道为基线（0.1.5-rc.1）。

新增

• 跟进 dsh 0.1.5-rc.1 基线：依赖范围与文档一并更新到新版 dsh，配合新版 dsh 安装即可，插件源码无需改动（#116cf53）。

修复

• 无。

验证

• 93 个 vitest 测试全绿；typecheck / build 干净。

---

What's changed

dsh-web-startup-auth v0.1.8, targeting the dsh next channel baseline (0.1.5-rc.1).

Added

• Tracks the dsh 0.1.5-rc.1 baseline: dependency ranges and docs are updated to the newer dsh, so installing alongside a recent dsh works with no plugin source changes (#116cf53).

Fixed

• Nothing.

Verification

• 93 vitest tests green; typecheck / build clean.

v0.1.7 — 会话有效期档位调节 + 认证标签页导航图标

变更内容

dsh-web-startup-auth v0.1.7，以 dsh next 通道为基线（0.1.2-rc.1）。

新增

• 会话有效期可调：设置面板「认证」标签页新增有效期下拉（3/7/14/30/60/90/180 天，默认 14 天），即选即存，只对新登录的会话生效（#227342e）。
• 「认证」标签页的导航图标改为盾牌+勾，便于在设置面板中一眼识别（#8cedd05）。

修复

• 无。

验证

• 93 个 vitest 测试全绿；typecheck / build 干净。

---

What's changed

dsh-web-startup-auth v0.1.7, targeting the dsh next channel baseline (0.1.2-rc.1).

Added

• Configurable session lifetime: the "认证" settings tab gains a lifetime dropdown (3/7/14/30/60/90/180 days, default 14), applied on selection, affecting newly issued sessions only (#227342e).
• The "认证" tab's nav icon is now a shield-and-check mark, easier to spot among settings sections (#8cedd05).

Fixed

• Nothing.

Verification

• 93 vitest tests green; typecheck / build clean.

v0.1.6

变更内容

dsh-web-startup-auth v0.1.6 是一轮以设置面板体验为主的小迭代，并补齐一处安全边界与一项社区贡献的功能。本版继续以 dsh next 通道为基线（0.1.2-rc.1）。

设置面板「认证」标签页 UI 精调（refactor, #87bf536）

• 四个区块改为卡片式分隔，层次更清晰，不再挤成一团。
• 「修改用户名」「修改密码」表单默认收起，点击 chevron 箭头展开，节省纵向空间。
• 「本机登录校验」开关改为左右滑动样式（默认关闭）。
• chevron 箭头：黑色、顺时针旋转、对称 SVG 保证绕视觉中心旋转、扩大可点击区域而不改变视觉位置。

新增「本机登录校验」开关（移植自 PR #17，#565890d）

• 管理员可要求所有地址（含本机回环）都需登录：开启后 isTrustedOrigin 恒为 false，回环地址不再隐式受信任。
• 新增 /api/auth/policy 端点（GET 读取、POST 切换，需已认证）；设置面板新增对应开关。
• 默认关闭，现有部署（本机免登录）行为不变。感谢 @mzzsfy 提出此功能。

fallback 仅保护 index 入口（fix, #fd56fcb）

• webServer.registerFallback 的事后追溯式包装现在只保护 index 入口路径（/、/index.html）；其余 fallback 路径（dist 公开资源如 /favicon.svg）对匿名 GET/HEAD 直接转发，避免登录页引用资源 401 破图。

验证

• 83 个 vitest 测试全绿；npm run typecheck / npm run build 干净。

---

What's changed

dsh-web-startup-auth v0.1.6 is a small iteration focused on settings-panel UX, plus a security-boundary fix and a community-contributed feature. This release continues to target the dsh next channel baseline (0.1.2-rc.1).

Settings-panel "认证" tab UI polish (refactor, #87bf536)

• The four blocks are now separated as cards for a clearer hierarchy.
• The "修改用户名" / "修改密码" forms are collapsed by default and expand on chevron click, saving vertical space.
• The "本机登录校验" toggle is now a left/right sliding switch (off by default).
• Chevron: black, clockwise rotation, a symmetric SVG keeps it rotating about its true visual center, and a larger hit area with no visual shift.

New "本机登录校验" toggle (ported from PR #17, #565890d)

• An admin can require every address — loopback included — to log in: when on, isTrustedOrigin is always false, so loopback is no longer implicitly trusted.
• New /api/auth/policy endpoint (GET to read, POST to toggle, requires auth); the settings panel gains a matching switch.
• Off by default, so existing deployments (loopback login-free) are unchanged. Thanks to @mzzsfy for proposing this.

Fallback guards index entry only (fix, #fd56fcb)

• The retroactive webServer.registerFallback wrapper now guards only the index entry paths (/, /index.html); other fallback paths (public dist assets like /favicon.svg) are forwarded for anonymous GET/HEAD, avoiding 401 breakage on login-page resources.

Verification

• 83 vitest tests green; npm run typecheck / npm run build clean.

v0.1.5

变更内容

dsh-web-startup-auth v0.1.5 随 dsh 0.1.2 适配 与实机验收中发现的一个 LAN 浏览器问题修复一起发布。本版以 dsh next 通道为基线（0.1.2-rc.1）；0.1.1 时代的安装不再支持。

dsh 0.1.2 适配（feat, #f3fa144）

• 移除 Host/Origin 回环改写（上游已删 PRIVILEGED_METHODS 与 authority:"loopback" channel）以及 rc.8–0.1.1 的 connection.isLoopback 覆盖——后者在 0.1.2 下会破坏 web boot（26 个前端插件 pending）。
• 新增原生浏览器认证桥接：凡我方会话层信任的调用方（有效 dsh_sid 或真回环）都会被即时补发上游 dsh-auth-<sha256(authority)> cookie——页面导航走单次 303 补签，登录响应双 cookie、登出双清。dsh_sid 仍是唯一可撤销的认证边界。
• index fallback 座保护：0.1.2 的 SPA index 经 webServer.registerFallback 提供（不在 exact/prefix 路由表内），现已被事后追溯式包装覆盖。
• 客户端插件脱离已删除的 dsh-client-runtime 包；设置面板「认证」标签页改用 cordis Context + 窄结构断言。

LAN 设置镜像修复（fix, #2476ec9）

• 远程（LAN）浏览器此前仍会拿到 memory 模式的 settings mirror——ui-settings 按 connection.isLoopback（location.hostname）派生持久化——导致 Models「提供方目录」报 settings are unavailable in this browser。现在 SPA 在客户端 bundle 运行前声明 window.__DSH_TRANSPORT__ = { ownsHost: true }，让 connection 报告回环而不改写 cordis 服务。真实 LAN 浏览器验证：全部设置面（含 Models）正常渲染，无 boot 回归、无控制台错误。

验证

• 74 个 vitest 测试全绿；npm run typecheck / npm run build 干净。
• 实机 A/B（LAN 192.168.5.216 + 回环，headless chromium）：登录流程、303 cookie 桥、Models 提供方目录、「认证」标签页全部可用。

---

What's changed

dsh-web-startup-auth v0.1.5 ships the dsh 0.1.2 adaptation plus a LAN browser fix found during live verification. This release targets the dsh next channel baseline (0.1.2-rc.1); 0.1.1-era installs are not supported anymore.

dsh 0.1.2 adaptation (feat, #f3fa144)

• Dropped the Host/Origin loopback-rewrite shim (PRIVILEGED_METHODS / authority:"loopback" were removed upstream) and the rc.8–0.1.1 connection.isLoopback override that broke the web boot in 0.1.2 (26 entries pending).
• Added a native browser-auth bridge: callers our session layer trusts (dsh_sid or genuine loopback) get the upstream dsh-auth-<sha256(authority)> cookie minted on the fly — single 303 hop for page navigations, dual cookies on login, dual clear on logout. dsh_sid remains the only revocable auth boundary.
• Index fallback seat coverage: the 0.1.2 SPA index is served through webServer.registerFallback (outside the exact/prefix route tables), now wrapped with retroactive fallback protection.
• Client bundles reworked off the removed dsh-client-runtime package; settings-panel "认证" tab now runs on cordis Context with narrow structural typing.

LAN settings-mirror fix (fix, #2476ec9)

• Remote (LAN) browsers still got a memory settings mirror — ui-settings derives persistence from connection.isLoopback (location.hostname) — so the Models "provider directory" section failed with settings are unavailable in this browser. The SPA now declares window.__DSH_TRANSPORT__ = { ownsHost: true } before the client bundles load, making connection report loopback without rewriting the cordis service. Verified on real LAN browsers: full settings surfaces (Models included) render, no boot regression, no console errors.

Verification

• 74 vitest tests green; npm run typecheck / npm run build clean.
• Live A/B (LAN 192.168.5.216 + loopback, headless chromium): login flow, 303 cookie bridge, Models provider directory, auth tab — all functional.