v0.1.2 — documentation sync (dsh 0.1.6-alpha.1 compatibility)

dsh-remote-auth v0.1.2 — documentation sync

No code changes. This release syncs the documentation with the current DSH kernel.

• Records compatibility re-check against dsh 0.1.6-alpha.1: the extension points this plugin relies on — ctx.webServer.register (dsh-host-webserver), tapIndex, and ctx.connection.authenticatedUrl / authorizeIndex / requestRejection / trustedHosts (dsh-client-connection) — are unchanged, as is the browser-auth model (per-process launch token → authority-bound signed cookie).
• Full /mobile-auth flow re-verified on 0.1.6-alpha.1: PIN form (401 + autofocus), page contains no PIN, clickable link + real QR, token exchange 303 → cookie → root 200, loopback-free trust fence over trustedHosts.
• Adds CHANGELOG.md covering 0.1.0 / 0.1.1 / 0.1.2.

Install / upgrade:

dsh plugin --profile web add dsh-remote-auth@0.1.2 -w
# or
dsh plugin --profile web update dsh-remote-auth --latest -w

v0.1.1 — never render the PIN on the page

dsh-remote-auth v0.1.1 — security fix

Never render the PIN on the /mobile-auth page.

The previous build showed the PIN in plaintext whenever the request looked like it came from loopback. That trust was based on the TCP peer address, so any local reverse proxy (tailscale serve, Caddy, gateway plugins) would make remote visitors appear as 127.0.0.1 and leak the PIN to them. Screenshots and screen sharing leaked it too.

The page now never displays the PIN; it only states that the PIN gate is configured server-side (profile cordis.patch.yml). docs/VERIFY.md gained an assertion that the page must not contain the PIN.

Install / upgrade:

dsh plugin --profile web add dsh-remote-auth@0.1.1 -w
# or
dsh plugin --profile web update dsh-remote-auth --latest -w

v0.1.0

dsh-remote-auth v0.1.0

DSH 远程授权页：点一下链接或扫一下二维码，设备即可获得当前 dsh web 进程的浏览器会话（30 天），无需再翻服务日志找 launch token。

Features

• GET /mobile-auth：可点击授权链接 + 二维码 + 复制框（链接/QR 与访问所用 authority 一致）
• 门禁 = OR 语义：Host ∈ allowedAuthorities 或 源 IP ∈ allowedSubnets；回环恒放行；fail closed
• 可选 8 位 PIN：constant-time 比较，同 IP 连错 5 次锁 60 秒
• 纯宿主插件、零运行时依赖（vendored MIT qrcode-generator，.cjs 防 ESM 误载）
• 基于官方扩展点：ctx.webServer.register + ctx.connection.authenticatedUrl

Install

dsh plugin --profile web add dsh-remote-auth -w

Verified

• dsh 0.1.2-rc.1；隔离冒烟 12/12 + 生产全链路（LAN / .local / Tailscale）验证通过
• 验证清单见 docs/VERIFY.md，发布/收录清单见 docs/PUBLISH.md