fix: enable host settings persistence in runtime-7.3

image/Dockerfile

@@ -13,6 +13,8 @@ RUN node /usr/local/lib/dsh-mgr/install-free-search.mjs
 COPY install-workspace.mjs /usr/local/lib/dsh-mgr/install-workspace.mjs
 RUN node /usr/local/lib/dsh-mgr/install-workspace.mjs
 COPY init-profile.mjs /usr/local/lib/dsh-mgr/init-profile.mjs
+COPY install-host-settings.mjs /usr/local/lib/dsh-mgr/install-host-settings.mjs
+RUN node /usr/local/lib/dsh-mgr/install-host-settings.mjs
 COPY --from=proxy /usr/bin/caddy /usr/bin/caddy
 # Strip upstream file capabilities without granting any runtime capabilities.
 # A fresh file copy omits security.capability xattrs; port 8080 needs none.

image/install-host-settings.mjs

@@ -0,0 +1,27 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+export const target = 'const persistence = ctx.remote.$host.isLoopback ? "host" : "memory";';
+const replacement = 'const persistence = "host"; /* dsh-mgr: authenticated remote settings */';
+
+// Deliberately scoped to the settings UI, not connection.isLoopback or auth.
+// Fail closed on upstream changes instead of silently shipping a broken UI.
+export function patchSettings(source, version) {
+  if (version !== '0.2.0-rc.2') throw new Error('unsupported DSH version for host settings patch');
+  if (source.split(target).length !== 2 || source.includes(replacement)) {
+    throw new Error('expected exactly one unpatched settings persistence selector');
+  }
+  return source.replace(target, replacement);
+}
+
+export function install(root = '/usr/local/lib/node_modules/@deepseek-ai/dsh') {
+  const { version } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+  const file = join(root, 'node_modules/@deepseek-ai/dsh-client-ui-settings/lib/client.js');
+  const source = readFileSync(file, 'utf8');
+  writeFileSync(file, patchSettings(source, version));
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  install();
+}

image/install-host-settings.test.mjs

@@ -0,0 +1,32 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { runInNewContext } from 'node:vm';
+import { readFileSync } from 'node:fs';
+import { patchSettings, target } from './install-host-settings.mjs';
+
+test('settings use host persistence on domains without changing loopback facts', () => {
+  for (const isLoopback of [false, true]) {
+    const ctx = { remote: { $host: { isLoopback } } };
+    const source = '(function(ctx) { ' + target + ' return persistence; })(ctx)';
+    assert.equal(runInNewContext(patchSettings(source, '0.2.0-rc.2'), { ctx }), 'host');
+    assert.equal(ctx.remote.$host.isLoopback, isLoopback);
+  }
+});
+
+test('reject unsupported versions, changed selectors, duplicates and repeat installation', () => {
+  assert.throws(() => patchSettings(target, '0.2.0-rc.3'), /unsupported DSH version/);
+  for (const source of ['', target.replace('isLoopback', 'isLocal'), target + target,
+    patchSettings(target, '0.2.0-rc.2')]) {
+    assert.throws(() => patchSettings(source, '0.2.0-rc.2'), /exactly one/);
+  }
+});
+
+test('patch leaves surrounding code unchanged and is wired into the image', () => {
+  const source = 'before; ' + target + ' after;';
+  const result = patchSettings(source, '0.2.0-rc.2');
+  assert.ok(result.startsWith('before; '));
+  assert.ok(result.endsWith(' after;'));
+  const dockerfile = readFileSync(new URL('./Dockerfile', import.meta.url), 'utf8');
+  assert.ok(dockerfile.includes('COPY install-host-settings.mjs /usr/local/lib/dsh-mgr/install-host-settings.mjs'));
+  assert.ok(dockerfile.indexOf('RUN node /usr/local/lib/dsh-mgr/install-host-settings.mjs') > dockerfile.indexOf('npm install --global --foreground-scripts'));
+});