dsh-remote 0.1.11

dsh-remote 0.1.11

Fixed

• Newer dsh builds guard the web app behind an authority-bound browser session
  cookie (browser token authentication): the index goes through
  authorizeIndex, and /api/* RPC plus the /api/remote.mux event WebSocket
  answer 401 for a trusted-but-unauthenticated request. The host plugin proxied
  the phone as a plain loopback client with no cookie, so every phone request
  hit that 401. The plugin now mints the loopback cookie in-process from the
  Connection launch token and attaches it to every upstream HTTP request and the
  local WebSocket dial; a 401 triggers one refresh-and-retry. The launch token
  never leaves the desktop. Older harness builds have no browser-auth service,
  so the auth owner stays a pass-through and behavior is unchanged.
• The local WebSocket dial now uses the ws client (to attach the cookie on the
  upgrade). ws stays an external runtime dependency and a dependencies
  entry — the plugin bundle is ESM, and bundling the CJS ws package turns its
  require('events'/*) builtins into unsupported dynamic requires.
• Upstream bodies are read through the fetch layer, which transparently decodes
  gzip/deflate/br — the host previously forwarded the decoded bytes with the
  original content-encoding header, so every proxied response failed
  decompression on the phone. The plane now requests accept-encoding: identity upstream and strips content-encoding from the response head.
• Cookie minting called connection.authorizeIndex as a detached function —
  cordis-traced service methods lose this there, which threw inside every
  proxied request and produced a 502. The mint now calls the methods
  receiver-bound on the raw browserAuth instance and swallows a mint failure
  to pass-through.

---

Install (desktop DSH, web profile): download dsh-remote-0.1.11.tgz below, then

dsh plugin --profile web add ./dsh-remote-0.1.11.tgz

Restart DSH after installing.