[Bug] Desktop welcome: Web authentication failed on startup due to net.fetch stripping SameSite=Strict cookies on 303 redirect

[cedricwyh]

[Bug] Desktop welcome: Web authentication failed on startup due to net.fetch stripping SameSite=Strict cookies on 303 redirect / 桌面端启动在欢迎页握手时因 net.fetch 剥离重定向 Cookie 导致认证崩溃循环

---

English Description

1. Summary

On macOS (arm64), launching the desktop application (e.g., 0.2.1-rc.5 / 0.2.1-rc.3) encounters an unhandled fatal error during the initial desktop welcome phase:
Error: desktop welcome: Web authentication failed at connectDesktopWelcome
This causes dsh-desktop:boot to reject, crashing the Electron main process and renderer, resulting in an endless restart/crash loop under process supervisors.

2. Root Cause Analysis

In apps/desktop/src/main.ts (around line 458):

welcomeBackend = await connectDesktopWelcome(
  ready.url,
  (input, init) => net.fetch(input, init),
  async () => (await session.defaultSession.cookies.get({ url: ready.url })).map(cookie => `${cookie.name}=${cookie.value}`).join('; ')
)

and apps/desktop/src/welcome-backend.ts:

export async function connectDesktopWelcome(
  authenticatedUrl: string,
  send: (input: string, init?: RequestInit) => Promise<Response>,
  cookies: () => Promise<string> = () => Promise.resolve(''),
) {
  const origin = new URL(authenticatedUrl).origin
  const authenticated = await send(authenticatedUrl, { credentials: 'include' })
  await authenticated.body?.cancel()
  if (!authenticated.ok) throw new Error('desktop welcome: Web authentication failed')
  ...
}

• When Electron's net.fetch is invoked from the Node/main process environment, there is no top-level browsing context.
• When the local host service issues a 303 See Other redirect during authentication, Chromium's underlying network stack strips SameSite=Strict cookies across the redirect hop.
• Consequently, the redirected endpoint receives no session cookies, responding with HTTP 401 Unauthorized.
• connectDesktopWelcome checks !authenticated.ok and throws Error: desktop welcome: Web authentication failed, aborting the desktop boot sequence.

3. Stack Trace (Sanitized)

Error: desktop welcome: Web authentication failed
    at connectDesktopWelcome (file:///Applications/DeepSeek%20Harness.app/Contents/Resources/app.asar/lib/main.js:8886:31)
    at async Object.start (file:///Applications/DeepSeek%20Harness.app/Contents/Resources/app.asar/lib/main.js:12195:22)
    at async file:///Applications/DeepSeek%20Harness.app/Contents/Resources/app.asar/lib/main.js:7162:5
    at async file:///Applications/DeepSeek%20Harness.app/Contents/Resources/app.asar/lib/main.js:12313:4

4. Suggested Fix

In apps/desktop/src/main.ts, ensure request headers explicitly carry the resolved host cookies during handshake, or wrap fetch to preserve cookies across redirects:

// Example fix in apps/desktop/src/main.ts
welcomeBackend = await connectDesktopWelcome(
  ready.url,
  async (input, init) => {
    const headers = new Headers(init?.headers)
    if (hostCookie) headers.set('cookie', hostCookie)
    return fetch(input, { ...init, headers })
  },
  async () => hostCookie ?? ''
)

And in apps/desktop/src/welcome-backend.ts, allow 303 redirect responses or follow-through:

if (!authenticated.ok && authenticated.status !== 303) {
  throw new Error('desktop welcome: Web authentication failed')
}

---

中文说明 (Chinese Description)

1. 问题概述

在 macOS (arm64) 环境下启动桌面端官方包（如 0.2.1-rc.5 及 0.2.1-rc.3）时，主进程在欢迎页鉴权阶段报未捕获异常：
Error: desktop welcome: Web authentication failed at connectDesktopWelcome
导致 dsh-desktop:boot 远程调用拒绝，主进程及渲染器闪退退出，在进程看门狗下陷入反复重启与崩溃循环。

2. 根因剖析

在 apps/desktop/src/main.ts（约 458 行）中：
welcomeBackend = await connectDesktopWelcome(ready.url, (input, init) => net.fetch(input, init), ...)

• Electron 主进程调用的 net.fetch 运行在 Node 宿主上下文，缺少顶层浏览上下文（Top-Level Browsing Context）；
• 本地服务在握手鉴权时响应 303 See Other 临时重定向；
• Chromium 底层网络协议栈出于跨上下文安全策略，在跟随重定向时强制剥离（Strip）了标记为 SameSite=Strict 的认证 Cookie；
• 重定向目标端点缺少 Cookie 凭据，直接返回 HTTP 401 Unauthorized；
• welcome-backend.ts 判定 !authenticated.ok 抛出 desktop welcome: Web authentication failed，主进程初始化中断崩溃。

3. 建议修复

在 apps/desktop/src/main.ts 中改用显式挂载 hostCookie 的 Fetch 包装器，避免依赖缺失上下文的 net.fetch 自动 Cookie 转发；并在 welcome-backend.ts 中放宽重定向状态码校验。

[drscrewdriver]

pnpm install dsh-cookie-cleaner

① 先看现状（客户端开着也能跑，只会告诉你读不到）

& "$env:USERPROFILE.dsh\profiles\desktop\node_modules.bin\dsh-cookie-cleaner.cmd"

② 完全退出客户端：托盘图标 → 退出，并确认进程列表已无 DeepSeek Harness

Get-Process | Where-Object { $_.ProcessName -match 'DeepSeek|dsh' } # 应当没有输出

③ 清理（先看会删几条，再真删）

& "$env:USERPROFILE.dsh\profiles\desktop\node_modules.bin\dsh-cookie-cleaner.cmd" --clean --dry-run
& "$env:USERPROFILE.dsh\profiles\desktop\node_modules.bin\dsh-cookie-cleaner.cmd" --clean