v0.1.5 - DSH Desktop login fix

0.1.5

修复 DSH Desktop 下点击「登录 xAI」时报 Failed to fetch 的问题。

原因

DSH Desktop 0.2.1 起，Web UI 不再从 http://127.0.0.1:<port> 加载，而是从特权 scheme dsh-app://app 加载。插件向本机控制服务 http://127.0.0.1:1457 发请求时携带的 Origin 是 dsh-app://app，旧的 origin 白名单只接受 localhost / 127.0.0.1，服务端返回 403 且不带 CORS 头，浏览器于是显示 Failed to fetch。

改动

• 本机控制服务接受 DSH Desktop 的 dsh-app://app origin。
• CORS 预检返回 Access-Control-Allow-Private-Network / Access-Control-Allow-Local-Network，通过 Chromium 的 Local Network Access 预检。
• 抽出 lib/origin.js，新增 test/origin.test.mjs，覆盖 origin 策略、预检头和真实 HTTP OPTIONS。

安装

dsh plugin --profile desktop add dsh-xai-oauth@0.1.5

或在插件市场里更新（npm 的 24 小时新版本等待期可能让刚发布的 0.1.5 暂时不可选）。

验证

node test/origin.test.mjs → 5/5 通过；DSH Desktop 重启后「登录 xAI」可正常拿到设备码并完成授权。

v0.1.4

Compatibility release for dsh 0.2.0-rc.1.

dsh 0.2.0-rc.1 introduced a startup compatibility gate: a plugin bundle whose
@deepseek-ai/dsh-* peerDependencies exclude the running runtime is skipped
entirely, and a ^0.1.x caret range caps below 0.2.0 — so 0.1.3 never loaded.

• Declare @deepseek-ai/dsh-credentials, @deepseek-ai/dsh-atomic-write and
  @deepseek-ai/dsh-home-paths as peerDependencies with
  ^0.1.0-rc.5 || ^0.2.0-rc.1 instead of pinning 0.1.x copies as dependencies.
  The runtime supplies these packages, and the duplicate nested copies are gone.
• Drop @deepseek-ai/dsh-client-runtime from dsh.client.inject; that package
  no longer exists in 0.2.
• No source changes were required: the credentials seam, atomic write, home
  paths, the system-prompt/assemble waterfall, the client module loader and
  the slots API are all unchanged in 0.2.

Verified against both runtimes: passes the gate on 0.2.0-rc.1 and remains
compatible with 0.1.3 – 0.1.7. Activation was confirmed end to end on
0.2.0-rc.1 (control server on 127.0.0.1:1457 serving live subscription status,
client bundle composed into the boot graph).

Install:

dsh plugin --profile web add dsh-xai-oauth@^0.1.4

v0.1.0

Initial release of dsh-xai-oauth.

Native xAI (Grok / X subscription) OAuth login plugin for DeepSeek Harness.

• RFC 8628 device-code authorization, no API key needed
• Auto-refresh access token near expiry (refresh token rotation)
• Secure local token storage (DollarDSH_HOME/xai-oauth.json, owner-only)
• Injects XAI_OAUTH_TOKEN into the DSH credentials seam
• Local control server (127.0.0.1:1457) with CSRF protection
• Subscription tier + Grok Build billing dashboard in Settings

Install:
dsh plugin --profile web add github:tonylee2022/dsh-xai-oauth