Idea: let deployments declare loopback trust in __DSH_BOOT__ instead of URL inference

[JUANWANG-BUAA]

Summary

The web client infers loopback trust from the page URL (connection.isLoopback), and privileged APIs such as settings.*, credentials.*, and host.listDirectory are gated on that check. This makes every remote setup (phone on LAN, public tunnel) fail with 403 unless a plugin rewrites request headers.

Proposal

Let the deployment declare trust explicitly in the boot contract instead of inferring it from location. For example, __DSH_BOOT__ (or a profile/config field) could carry a trust declaration such as:

__DSH_BOOT__.trust = 'loopback' | 'deployment'

• loopback (default): current behavior, inferred from the URL.
• deployment: set by an operator who deliberately exposes the web server behind their own TLS and authentication layer.

Why

• Remote access is a recurring request in this community; the current check forces plugins to rewrite Host/Origin to loopback. That workaround disables the original protection and each plugin must re-implement its own access-control layer to compensate.
• An explicit declaration keeps the safe default while giving deployments a supported path, so remote setups become safe by construction instead of relying on header tricks.
• The trust decision is a deployment fact, not a per-session fact; the boot contract is the natural place to carry it.