正在写deepseek透传的相关事宜

dsh-local-403-fix/cordis.patch.yml

@@ -0,0 +1,18 @@
+# Local 403 fix for the web profile.
+# Official dsh pins privileged /api methods (settings, credentials, presets,
+# host dialogs, llm.discoverModels) to loopback by re-checking them with an
+# empty trusted-host list. That makes a reverse-proxied /api always return 403
+# even when --trusted-host lists the public host.
+#
+# This bundle inserts one row that registers exact /api/<method> routes for
+# those methods and validates them against the same webRuntime.trustedHosts
+# list the rest of /api uses, so a host listed in --trusted-host can call them.
+#
+# trustedHosts keeps the official webRuntime expression, so
+# `dsh web --trusted-host <authority>` still feeds this fence.
+- insert:
+    - id: local-403-fix
+      name: dsh-local-403-fix
+      inject: [webRuntime]
+      config:
+        trustedHosts: !!js ctx.webRuntime.trustedHosts