@jingyi0605/codingns4dsh 0.1.2 → 0.1.7-rc.3

package/data/build/dist/host/features/peer-host.js

@@ -0,0 +1,322 @@
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { CODINGNS_VERSION, DSH_VERSION, isDshVersionCompatible } from '../../shared/contracts/version.js';
+import { PeerHostHandshakeService } from '../modules/peer-host/peer-host-handshake.js';
+import { PeerHostSessionService } from '../modules/peer-host/peer-host-session.js';
+import { PeerHostHttpProxyService } from '../modules/peer-host/host-api-proxy-service.js';
+import { EncryptedFilePeerHostCredentialStore, FilePeerHostRecordStore, PeerHostStore, } from '../modules/peer-host/peer-host-store.js';
+import { PeerHostAggregateService } from '../modules/peer-host/peer-host-aggregate-service.js';
+import { CodingNsRpcError } from '../rpc-table.js';
+import { PeerHostWebSocketGateway, PEER_HOST_WS_PATH } from '../modules/peer-host/peer-host-ws-gateway.js';
+import { PeerHostWsProxyError, PeerHostWsProxyService } from '../modules/peer-host/host-ws-proxy-service.js';
+import { createPeerHostRemoteConnector } from '../modules/peer-host/host-ws-connector.js';
+import { createPeerHostRelayConnector, PeerHostReconnectManager } from '../modules/peer-host/peer-host-relay.js';
+import { PEER_HOST_ERROR_CODES } from '../../shared/contracts/peer-host.js';
+import { FileLanAccessDshLoginStore, resolveLoginProtectionCookieName, verifyLoginProtectionSession } from '../lan-access-dsh.js';
+import { createPeerHostDiagnosticSink, toPeerHostDiagnosticSnapshot } from '../modules/peer-host/peer-host-diagnostics.js';
+/** PeerHost Host 模块；配置、握手和目标登录态只在 Host 进程内装配。 */
+export function createPeerHostFeature(options = {}) {
+    return {
+        descriptor: {
+            name: 'peerHost',
+            version: '0.1.0',
+            enabledByDefault: false,
+            // 与 Client 保持一致；历史配置中的 true 也不能让未验收能力启动。
+            disabled: true,
+            dependencies: [],
+            runtime: 'host',
+            requires: [
+                { capability: 'peer-host.store', required: false, fallback: 'degrade' },
+                { capability: 'peer-host.handshake', required: false, fallback: 'degrade' },
+                { capability: 'peer-host.http-proxy', required: false, fallback: 'degrade' },
+                { capability: 'peer-host.ws-proxy', required: false, fallback: 'degrade' },
+                { capability: 'peer-host.aggregate', required: false, fallback: 'degrade' },
+                { capability: 'peer-host.relay-route', required: false, fallback: 'degrade' },
+            ],
+        },
+        async start(context) {
+            const stateDirectory = options.stateDirectory ?? process.env.CODINGNS4DSH_STATE_DIR?.trim() ?? join(homedir(), '.config', 'codingns4dsh');
+            const ownerUserId = options.ownerUserId ?? process.env.CODINGNS4DSH_OWNER_ID?.trim() ?? 'local-host';
+            const encryptionKey = options.encryptionKey ?? await loadPeerHostKey(join(stateDirectory, 'peer-host-key.bin'));
+            const credentials = new EncryptedFilePeerHostCredentialStore(join(stateDirectory, 'peer-host-credentials.enc'), encryptionKey);
+            const store = new PeerHostStore(ownerUserId, new FilePeerHostRecordStore(join(stateDirectory, 'peer-host-records.json')), credentials);
+            const handshake = new PeerHostHandshakeService(store, credentials, {
+                productId: 'CodingNS',
+                pluginId: '@jingyi0605/codingns4dsh',
+                pluginVersion: CODINGNS_VERSION,
+                apiCompatibility: 'peer-host-v1',
+                isDshVersionSupported: isDshVersionCompatible,
+                ...(options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl }),
+            });
+            const sessions = new PeerHostSessionService(store, credentials, options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl });
+            const httpProxy = new PeerHostHttpProxyService(store, sessions, options.fetchImpl === undefined ? {} : { fetchImpl: options.fetchImpl });
+            const aggregate = new PeerHostAggregateService();
+            const diagnostics = createPeerHostDiagnosticSink({
+                enabled: process.env.CODINGNS4DSH_DEBUG === '1',
+                sink: (event, snapshot) => console.info('[codingns4dsh:peer-host]', { event, ...snapshot }),
+            });
+            const lanConnector = options.connectRemote ?? createPeerHostRemoteConnector();
+            const relayConnector = createPeerHostRelayConnector({ ...(options.relayTransport === undefined ? {} : { transport: options.relayTransport }) });
+            const connector = (record, accessToken, scope) => record.route.kind === 'relay'
+                ? relayConnector(record, accessToken, scope)
+                : lanConnector(record, accessToken, scope);
+            const reconnectManager = new PeerHostReconnectManager({
+                connect: connector,
+                onState: async (snapshot) => {
+                    const current = await store.get(snapshot.peerHostId);
+                    if (current === null || snapshot.state === 'connecting' || snapshot.state === 'reconnecting' || snapshot.state === 'stopped')
+                        return;
+                    if (snapshot.state === 'ready') {
+                        if (current.status !== 'ready')
+                            await store.updateStatus(snapshot.peerHostId, 'ready', null);
+                        return;
+                    }
+                    const errorCode = snapshot.lastErrorCode === PEER_HOST_ERROR_CODES.RELAY_UNAVAILABLE
+                        ? PEER_HOST_ERROR_CODES.RELAY_UNAVAILABLE
+                        : PEER_HOST_ERROR_CODES.UNREACHABLE;
+                    await store.updateStatus(snapshot.peerHostId, 'unreachable', errorCode);
+                },
+            });
+            context.resources.add(() => reconnectManager.close());
+            // WS 代理的客户端 socket 无法在关闭后替换远端 socket；因此这里保持一条连接一一绑定，
+            // 重连 manager 仅治理显式的 Host 侧长连接消费者，避免后台重连产生孤立远端连接。
+            const wsProxy = new PeerHostWsProxyService(store, sessions, connector);
+            const loginStore = new FileLanAccessDshLoginStore();
+            const lanSettings = context.services.settings?.get().lanAccessDsh;
+            const gateway = new PeerHostWebSocketGateway({
+                listenHost: process.env.CODINGNS4DSH_PEER_HOST_WS_HOST?.trim() || (lanSettings?.autoStart === true ? lanSettings.listenHost : '127.0.0.1'),
+                listenPort: parsePort(process.env.CODINGNS4DSH_PEER_HOST_WS_PORT),
+                path: PEER_HOST_WS_PATH,
+                authorizeUpgrade: (request) => authorizePeerHostUpgrade(loginStore, request),
+                onConnection: (socket, request) => {
+                    const scope = parseWebSocketScope(request.url);
+                    if (scope.targetHostId === null) {
+                        throw new PeerHostWsProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost WebSocket 缺少目标 Host');
+                    }
+                    return wsProxy.open(scope.targetHostId, socket, scope);
+                },
+            });
+            let wsEndpoint = null;
+            try {
+                wsEndpoint = await gateway.start();
+                context.resources.add(() => gateway.close());
+            }
+            catch {
+                console.error('codingns4dsh: PeerHost WebSocket 网关启动失败');
+            }
+            if (context.services.registerPeerHostHandshakeRoute !== undefined) {
+                const unregisterHandshake = context.services.registerPeerHostHandshakeRoute(async () => Response.json({
+                    productId: 'CodingNS',
+                    pluginId: '@jingyi0605/codingns4dsh',
+                    pluginVersion: CODINGNS_VERSION,
+                    dshVersion: context.services.dshVersion ?? DSH_VERSION,
+                    apiCompatibility: 'peer-host-v1',
+                    fingerprint: process.env.CODINGNS4DSH_HOST_FINGERPRINT?.trim() || null,
+                    capabilities: ['peer-host.store', 'peer-host.handshake', 'peer-host.http-proxy', 'peer-host.ws-proxy', 'peer-host.aggregate'],
+                }));
+                context.resources.add(unregisterHandshake);
+            }
+            const unregister = context.services.rpc.register('peerHost', async (action, payload) => {
+                const input = record(payload);
+                switch (action) {
+                    case 'list': return (await store.list()).map(toPeerHostClientRecord);
+                    case 'diagnostics': {
+                        const snapshots = (await store.list()).map(toPeerHostDiagnosticSnapshot);
+                        for (const snapshot of snapshots)
+                            diagnostics.emit('peer-host.snapshot', snapshot);
+                        return snapshots;
+                    }
+                    case 'create': return toPeerHostClientRecord(await store.create({ displayName: requiredString(input.displayName, 'displayName'), route: parseRoute(input.route) }));
+                    case 'update': return toPeerHostClientRecord(await store.update(requiredString(input.peerHostId, 'peerHostId'), {
+                        ...(input.displayName === undefined ? {} : { displayName: requiredString(input.displayName, 'displayName') }),
+                        ...(input.route === undefined ? {} : { route: parseRoute(input.route) }),
+                    }));
+                    case 'remove':
+                        await store.remove(requiredString(input.peerHostId, 'peerHostId'));
+                        return { removed: true };
+                    case 'check': return handshake.check(requiredString(input.peerHostId, 'peerHostId')).then(toPeerHostClientRecord);
+                    case 'reconnect': {
+                        const peerHostId = requiredString(input.peerHostId, 'peerHostId');
+                        await store.updateStatus(peerHostId, 'reconnecting', null);
+                        return handshake.check(peerHostId).then(toPeerHostClientRecord);
+                    }
+                    case 'login': return sessions.login(requiredString(input.peerHostId, 'peerHostId'), {
+                        username: requiredString(input.username, 'username'),
+                        password: requiredString(input.password, 'password'),
+                    });
+                    case 'logout': return sessions.logout(requiredString(input.peerHostId, 'peerHostId'));
+                    case 'wsEndpoint': return wsEndpoint;
+                    case 'aggregate': {
+                        if (options.aggregateSources === undefined) {
+                            return aggregate.load([{
+                                    hostId: 'local-host',
+                                    targetHostId: null,
+                                    hostLabel: '当前 Host',
+                                    capability: { available: false, reason: '当前 Host 尚未提供可验证的工作区/会话摘要 source' },
+                                    load: async () => [],
+                                }]);
+                        }
+                        return aggregate.load(await options.aggregateSources());
+                    }
+                    case 'request': {
+                        const peerHostId = requiredString(input.peerHostId, 'peerHostId');
+                        const scope = parseScope(input.scope);
+                        return httpProxy.request(peerHostId, {
+                            scope,
+                            path: requiredString(input.path, 'path'),
+                            ...(input.method === undefined ? {} : { method: requiredString(input.method, 'method') }),
+                            ...(input.body === undefined ? {} : { body: requiredString(input.body, 'body') }),
+                        });
+                    }
+                    default: throw new CodingNsRpcError('CODINGNS_RPC_NOT_FOUND', `未知 PeerHost RPC: peerHost/${action}`);
+                }
+            });
+            context.resources.add(unregister);
+        },
+    };
+}
+async function authorizePeerHostUpgrade(loginStore, request) {
+    const origin = request.headers.origin;
+    const host = request.headers.host;
+    if (typeof origin === 'string' && typeof host === 'string') {
+        try {
+            const originUrl = new URL(origin);
+            const originHost = normalizeHostName(originUrl.hostname);
+            const requestHost = normalizeHostName(readRequestHost(host));
+            if (originHost !== requestHost)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    const config = await loginStore.read();
+    if (config === null || !config.enabled || !config.scopes.lan)
+        return true;
+    const token = readCookie(request.headers.cookie, resolveLoginProtectionCookieName());
+    return verifyLoginProtectionSession(loginStore, token, 'lan');
+}
+function parseWebSocketScope(rawUrl) {
+    if (rawUrl === undefined)
+        throw new PeerHostWsProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost WebSocket 缺少作用域');
+    const url = new URL(rawUrl, 'http://peer-host.invalid');
+    const allowed = new Set(['hostId', 'targetHostId', 'workspaceId', 'sessionId', 'scopeGeneration']);
+    for (const key of url.searchParams.keys())
+        if (!allowed.has(key))
+            throw new PeerHostWsProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost WebSocket 查询参数未加入白名单');
+    for (const key of allowed)
+        if (url.searchParams.getAll(key).length > 1)
+            throw new PeerHostWsProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost WebSocket 作用域参数不得重复');
+    const hostId = requiredString(url.searchParams.get('hostId'), 'hostId');
+    const targetHostId = requiredString(url.searchParams.get('targetHostId'), 'targetHostId');
+    const workspaceId = requiredString(url.searchParams.get('workspaceId'), 'workspaceId');
+    const sessionId = url.searchParams.get('sessionId');
+    const scopeGeneration = Number(url.searchParams.get('scopeGeneration'));
+    if (!Number.isSafeInteger(scopeGeneration) || scopeGeneration < 0)
+        throw new PeerHostWsProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost WebSocket 作用域 generation 无效');
+    return { hostId, targetHostId, workspaceId, sessionId: sessionId?.trim() || null, scopeGeneration };
+}
+function readCookie(value, name) {
+    for (const item of (value ?? '').split(';')) {
+        const separator = item.indexOf('=');
+        if (separator > 0 && item.slice(0, separator).trim() === name)
+            return item.slice(separator + 1).trim();
+    }
+    return undefined;
+}
+function parsePort(value) {
+    if (value === undefined || value.trim() === '')
+        return 0;
+    const port = Number(value);
+    return Number.isSafeInteger(port) && port >= 0 && port <= 65_535 ? port : 0;
+}
+function normalizeHostName(value) {
+    const host = value.trim().toLowerCase();
+    if (host === 'localhost' || host === '::1' || host === '::ffff:127.0.0.1')
+        return '127.0.0.1';
+    return host;
+}
+function readRequestHost(value) {
+    const host = value.trim();
+    if (host.startsWith('[')) {
+        const end = host.indexOf(']');
+        return end > 1 ? host.slice(1, end) : '';
+    }
+    return host.split(':')[0] ?? '';
+}
+async function loadPeerHostKey(path) {
+    try {
+        const key = await readFile(path);
+        if (key.byteLength !== 32)
+            throw new Error('PeerHost 密钥文件长度无效');
+        return key;
+    }
+    catch (error) {
+        if (!isNodeError(error, 'ENOENT'))
+            throw error;
+        const key = randomBytes(32);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        try {
+            await writeFile(path, key, { mode: 0o600, flag: 'wx' });
+            return key;
+        }
+        catch (writeError) {
+            if (!isNodeError(writeError, 'EEXIST'))
+                throw writeError;
+            const existing = await readFile(path);
+            if (existing.byteLength !== 32)
+                throw new Error('PeerHost 密钥文件长度无效');
+            return existing;
+        }
+    }
+}
+function parseRoute(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new TypeError('route 必须是对象');
+    const route = value;
+    if (route.kind === 'lan')
+        return { kind: 'lan', baseUrl: requiredString(route.baseUrl, 'baseUrl'), normalizedOrigin: typeof route.normalizedOrigin === 'string' ? route.normalizedOrigin : '' };
+    if (route.kind === 'relay')
+        return { kind: 'relay', deviceId: requiredString(route.deviceId, 'deviceId'), relayEntryId: requiredString(route.relayEntryId, 'relayEntryId'), transportVersion: requiredString(route.transportVersion, 'transportVersion') };
+    throw new TypeError('route.kind 无效');
+}
+function record(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new TypeError('PeerHost RPC 参数必须是对象');
+    return value;
+}
+function requiredString(value, field) {
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new TypeError(`${field} 不能为空`);
+    return value.trim();
+}
+function parseScope(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new TypeError('scope 必须是对象');
+    const scope = value;
+    const hostId = requiredString(scope.hostId, 'scope.hostId');
+    const targetHostId = scope.targetHostId === null ? null : requiredString(scope.targetHostId, 'scope.targetHostId');
+    const workspaceId = requiredString(scope.workspaceId, 'scope.workspaceId');
+    const sessionId = scope.sessionId === null ? null : requiredString(scope.sessionId, 'scope.sessionId');
+    if (typeof scope.scopeGeneration !== 'number' || !Number.isSafeInteger(scope.scopeGeneration) || scope.scopeGeneration < 0)
+        throw new TypeError('scope.scopeGeneration 无效');
+    return { hostId, targetHostId, workspaceId, sessionId, scopeGeneration: scope.scopeGeneration };
+}
+export function toPeerHostClientRecord(record) {
+    return {
+        ...record,
+        fingerprint: redactFingerprint(record.fingerprint),
+        route: record.route.kind === 'lan' ? { kind: 'lan' } : { kind: 'relay' },
+    };
+}
+function redactFingerprint(value) {
+    if (value === null || value.length <= 12)
+        return value;
+    return `${value.slice(0, 8)}...${value.slice(-4)}`;
+}
+function isNodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+//# sourceMappingURL=peer-host.js.map

package/data/build/dist/host/features/types.d.ts

@@ -35,7 +35,11 @@ export interface CodingNsHostServices {
     readonly debug?: DebugWorkspaceService;
     /** Debug 模块启用时注册其专属 Fetch 路由，停用时由模块资源注销。 */
     readonly registerDebugProxyRoute?: (handler: (request: Request) => Promise<Response>) => () => Promise<void>;
+    /** PeerHost 固定握手入口；只允许模块返回脱敏能力摘要。 */
+    readonly registerPeerHostHandshakeRoute?: (handler: (request: Request) => Promise<Response>) => () => Promise<void>;
     /** 由 Host 权威解析 Workspace ID，Client 不可覆盖。 */
     readonly resolveWorkspaceRoot?: (workspaceId: string) => string | null;
+    /** 返回 Host 当前已知的工作区根目录，用于文件管理路径校验。 */
+    readonly listWorkspaceRoots?: () => readonly string[];
 }
 //# sourceMappingURL=types.d.ts.map

package/data/build/dist/host/host-router.d.ts

@@ -0,0 +1,3 @@
+export { HostRouter } from '../features/host-router.js';
+export type { HostRouterInput } from '../features/host-router.js';
+//# sourceMappingURL=host-router.d.ts.map

package/data/build/dist/host/host-router.js

@@ -0,0 +1,2 @@
+export { HostRouter } from '../features/host-router.js';
+//# sourceMappingURL=host-router.js.map

package/data/build/dist/host/index-injection.d.ts

@@ -0,0 +1,17 @@
+/** 启动页注入表中的全局变量记录。 */
+export interface DshIndexInjectionEntry {
+    readonly kind?: unknown;
+    readonly name?: unknown;
+    readonly value?: unknown;
+    readonly [key: string]: unknown;
+}
+/**
+ * 在启动页声明 Host 所有权，同时保留 Desktop 已经提供的完整 Transport。
+ *
+ * 这里只使用 DSH WebServer 支持的 JSON global 行，不在首页安装全局 setter。
+ * 页面可能由 Desktop Shell 在更晚的阶段注入自己的 Transport；因此找不到
+ * 已有 Transport 时必须保持不变，不能追加同名全局，否则会覆盖 Desktop 的
+ * `streamBaseUrl`，让 `/api/remote.mux` 退回 `ws://app`。
+ */
+export declare function injectDshWebTransportOwnership(table: unknown[]): void;
+//# sourceMappingURL=index-injection.d.ts.map

package/data/build/dist/host/index-injection.js

@@ -0,0 +1,24 @@
+/**
+ * 在启动页声明 Host 所有权，同时保留 Desktop 已经提供的完整 Transport。
+ *
+ * 这里只使用 DSH WebServer 支持的 JSON global 行，不在首页安装全局 setter。
+ * 页面可能由 Desktop Shell 在更晚的阶段注入自己的 Transport；因此找不到
+ * 已有 Transport 时必须保持不变，不能追加同名全局，否则会覆盖 Desktop 的
+ * `streamBaseUrl`，让 `/api/remote.mux` 退回 `ws://app`。
+ */
+export function injectDshWebTransportOwnership(table) {
+    const index = table.findIndex((entry) => isTransportInjection(entry));
+    if (index < 0)
+        return;
+    const entry = table[index];
+    if (!isRecord(entry) || !isRecord(entry.value))
+        return;
+    table[index] = { ...entry, value: { ...entry.value, ownsHost: true } };
+}
+function isTransportInjection(value) {
+    return isRecord(value) && value.name === '__DSH_TRANSPORT__';
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=index-injection.js.map

package/data/build/dist/host/index.d.ts

@@ -7,7 +7,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 export declare function apply(ctx?: Context): void;
-export { HOST_FEATURES, createAuthFeature, createLanAccessDshFeature, createTerminalStatusFeature, createHostFeatures, createCliAdaptersFeature, createTerminalProcessFeature, createGitManagementFeature, } from './features/index.js';
+export { HOST_FEATURES, createAuthFeature, createLanAccessDshFeature, createTerminalStatusFeature, createHostFeatures, createCliAdaptersFeature, createTerminalProcessFeature, createGitManagementFeature, createFileManagementFeature, createPeerHostFeature, } from './features/index.js';
 export type { CodingNsHostServices } from './features/index.js';
 export { CodingNsSettingsSchema, registerCodingNsSettings } from './settings.js';
 export { createCodingNsRpcHandler, createCodingNsSettingsRpcHandler, registerCodingNsRpc } from './rpc.js';
@@ -44,4 +44,7 @@ export type { LoginByEmailResponse, RefreshTokenRequest, RefreshTokenResponse, }
 export { LanAccessDshError, LanAccessDshProxy, FileLanAccessDshLoginStore, InMemoryLanAccessDshLoginStore, createLanAccessDshRpcHandler, createNodeLanAccessDshRuntime, normalizeLanAccessDshConfig, openLoginProtectionSession, verifyLoginProtectionSession, type LanAccessDshRuntime, type LanAccessDshStream, type LanAccessDshLoginRecord, type LanAccessDshLoginStore, } from './lan-access-dsh.js';
 export { CODINGNS_TUNNEL_DATA_CHANNEL_LABEL, FileHostDtlsIdentityStore, createRegisteredHostSignalingSocket, createWeriftPeerConnectionFactory, ensureHostDtlsIdentity, formatHostDtlsFingerprint, generateHostDtlsIdentity, startHostRelayRuntime, type HostDtlsIdentityMaterial, type HostDtlsIdentityStore, type HostRelayRuntime, type HostRelayRuntimeOptions, type HostRelaySession, type HostSignalingSocket, } from './relay-tunnel-runtime.js';
 export * from './terminal/index.js';
+export { PeerHostWebSocketGateway, PEER_HOST_WS_PATH } from './modules/peer-host/peer-host-ws-gateway.js';
+export { createPeerHostRelayConnector, PeerHostReconnectManager, type PeerHostRelayConnectorOptions, type PeerHostRelayTransportFactory, type PeerHostReconnectManagerOptions, type PeerHostReconnectSnapshot, type PeerHostReconnectState, } from './modules/peer-host/peer-host-relay.js';
+export { createPeerHostDiagnosticSink, peerHostSafeError, toPeerHostDiagnosticSnapshot, type PeerHostDiagnosticSink, type PeerHostDiagnosticSnapshot, } from './modules/peer-host/peer-host-diagnostics.js';
 //# sourceMappingURL=index.d.ts.map

package/data/build/dist/host/index.js

@@ -9,8 +9,9 @@ import { installTerminalController } from './terminal/startup.js';
 import { DebugWorkspaceService } from './debug.js';
 import { detectRuntimeDshVersion, DSH_VERSION_INJECTION_NAME } from './dsh-runtime-version.js';
 import { createDshCapabilityRegistry } from '../dsh-capabilities/index.js';
-import { debugInfo } from '../shared/debug.js';
+import { debugInfo, debugWarn } from '../shared/debug.js';
 import { repairLegacySessionLogs } from './session-migration-repair.js';
+import { injectDshWebTransportOwnership } from './index-injection.js';
 export function apply(ctx) {
     if (ctx === undefined)
         return;
@@ -58,14 +59,21 @@ export function apply(ctx) {
             hasWebServer: hostCtx.webServer !== undefined,
         });
         const webServerPort = hostCtx.webServer.port;
-        // LAN 入口和中继 Web 页面可能使用非 loopback URL，但它们都已经经过
-        // DSH Host 的认证边界并回到本机 Host。通过启动页注入 transport 所有权，
-        // 让 DSH 原生 ui-settings 保持 host 模式，而不是错误降级为 memory 模式。
+        // 仅在 DSH 已提供 Transport 时补充 ownsHost；普通 Web 的 Codingns4DSH
+        // 设置由 Client RPC 桥接持久化，不能在这里追加同名全局覆盖 Desktop。
         const indexInjectionEvents = hostCtx;
         debugInfo('codingns4dsh: host index injection registration begin');
         indexInjectionEvents.on('webserver/index-inject', (table) => {
-            table.push({ kind: 'global', name: '__DSH_TRANSPORT__', value: { ownsHost: true } });
-            table.push({ kind: 'global', name: DSH_VERSION_INJECTION_NAME, value: dshVersion });
+            try {
+                injectDshWebTransportOwnership(table);
+                table.push({ kind: 'global', name: DSH_VERSION_INJECTION_NAME, value: dshVersion });
+            }
+            catch (error) {
+                // 首页认证不应因插件注入表异常变成 WebServer 的 HTTP 400。
+                debugWarn('codingns4dsh: host index injection skipped', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
         });
         debugInfo('codingns4dsh: host index injection registration ready');
         debugInfo('codingns4dsh: host settings registration begin');
@@ -90,12 +98,19 @@ export function apply(ctx) {
             nativeSessions: createCodingNsNativeSessionBridge(hostCtx, dshVersion),
             terminalProcesses: terminal.processService,
             resolveWorkspaceRoot: (workspaceId) => workspaceRoots.get(workspaceId) ?? resolveWorkspaceRoot(hostCtx, workspaceId),
+            listWorkspaceRoots: () => [...workspaceRoots.values(), ...readWorkspaceRoots(hostCtx)],
             registerDebugProxyRoute: (handler) => hostCtx.connection.fetch.register({
                 path: '/api/codingns/debug-proxy',
                 methods: ['GET', 'HEAD', 'POST'],
                 requestBody: 'streaming',
                 fetch: handler,
             }),
+            registerPeerHostHandshakeRoute: (handler) => hostCtx.connection.fetch.register({
+                path: '/api/public/host-handshake',
+                methods: ['GET'],
+                requestBody: 'buffered',
+                fetch: handler,
+            }),
         };
         const debug = new DebugWorkspaceService({
             resolveWorkspaceRoot: (workspaceId) => workspaceRoots.get(workspaceId) ?? resolveWorkspaceRoot(hostCtx, workspaceId),
@@ -163,7 +178,23 @@ function resolveWorkspaceRoot(ctx, workspaceId) {
     }
     return null;
 }
-export { HOST_FEATURES, createAuthFeature, createLanAccessDshFeature, createTerminalStatusFeature, createHostFeatures, createCliAdaptersFeature, createTerminalProcessFeature, createGitManagementFeature, } from './features/index.js';
+function readWorkspaceRoots(ctx) {
+    try {
+        const registry = ctx.get('workspaceRegistry');
+        return (registry?.list?.() ?? []).flatMap((entry) => {
+            for (const key of ['rootPath', 'path', 'cwd', 'directory']) {
+                const value = entry[key];
+                if (typeof value === 'string' && value.trim() !== '')
+                    return [value.trim()];
+            }
+            return [];
+        });
+    }
+    catch {
+        return [];
+    }
+}
+export { HOST_FEATURES, createAuthFeature, createLanAccessDshFeature, createTerminalStatusFeature, createHostFeatures, createCliAdaptersFeature, createTerminalProcessFeature, createGitManagementFeature, createFileManagementFeature, createPeerHostFeature, } from './features/index.js';
 export { CodingNsSettingsSchema, registerCodingNsSettings } from './settings.js';
 export { createCodingNsRpcHandler, createCodingNsSettingsRpcHandler, registerCodingNsRpc } from './rpc.js';
 export { DebugWorkspaceService, NodeDebugPortInspector, } from './debug.js';
@@ -197,4 +228,7 @@ export { createLocalDshWebRuntimeProvider, createRemoteWebRuntimeFeature, } from
 export { LanAccessDshError, LanAccessDshProxy, FileLanAccessDshLoginStore, InMemoryLanAccessDshLoginStore, createLanAccessDshRpcHandler, createNodeLanAccessDshRuntime, normalizeLanAccessDshConfig, openLoginProtectionSession, verifyLoginProtectionSession, } from './lan-access-dsh.js';
 export { CODINGNS_TUNNEL_DATA_CHANNEL_LABEL, FileHostDtlsIdentityStore, createRegisteredHostSignalingSocket, createWeriftPeerConnectionFactory, ensureHostDtlsIdentity, formatHostDtlsFingerprint, generateHostDtlsIdentity, startHostRelayRuntime, } from './relay-tunnel-runtime.js';
 export * from './terminal/index.js';
+export { PeerHostWebSocketGateway, PEER_HOST_WS_PATH } from './modules/peer-host/peer-host-ws-gateway.js';
+export { createPeerHostRelayConnector, PeerHostReconnectManager, } from './modules/peer-host/peer-host-relay.js';
+export { createPeerHostDiagnosticSink, peerHostSafeError, toPeerHostDiagnosticSnapshot, } from './modules/peer-host/peer-host-diagnostics.js';
 //# sourceMappingURL=index.js.map

package/data/build/dist/host/lan-access-dsh.d.ts

@@ -1,3 +1,4 @@
+import { Transform, type TransformCallback } from 'node:stream';
 import type { SettingsScope } from '@deepseek-ai/dsh-settings';
 import type { CodingNsSettings, LanAccessDshLoginSettings, LoginProtectionScopes } from '../shared/contracts/config.js';
 import type { LanAccessDshConfig, LanAccessDshLoginConfig, LanAccessDshSnapshot } from '../shared/contracts/lan-access-dsh.js';
@@ -22,11 +23,22 @@ export interface LanAccessDshLoginStore {
     write(record: LanAccessDshLoginRecord): Promise<void>;
     clear(): Promise<void>;
 }
+/**
+ * Cookie 不包含端口信息；多个 DSH 实例若共用名称，浏览器会在实例之间覆盖会话。
+ * 正式环境保留旧名称，开发环境由启动包装命令显式指定独立名称。
+ */
+export declare const DEFAULT_LOGIN_PROTECTION_COOKIE_NAME = "dsh_codingns_session";
+export declare function resolveLoginProtectionCookieName(configured?: string | undefined): string;
 /** 浏览器中继只携带短期签名票据，密码哈希和签名密钥始终留在 Host。 */
 export declare function openLoginProtectionSession(store: LanAccessDshLoginStore, username: string, password: string, scope: keyof LoginProtectionScopes): Promise<{
     token: string;
     expiresAt: string;
 }>;
+/** 在旧票据仍有效时滚动续签；过期票据不能借此恢复登录。 */
+export declare function refreshLoginProtectionSession(store: LanAccessDshLoginStore, token: string | undefined, scope: keyof LoginProtectionScopes): Promise<{
+    token: string;
+    expiresAt: string;
+}>;
 /** 校验中继票据；配置关闭或未覆盖该范围时保持向后兼容，直接放行。 */
 export declare function verifyLoginProtectionSession(store: LanAccessDshLoginStore, token: string | undefined, scope: keyof LoginProtectionScopes): Promise<boolean>;
 /** 测试和嵌入式宿主使用的内存凭据存储。 */
@@ -56,7 +68,8 @@ export declare class LanAccessDshProxy {
     /** 当前进程内主动退出的会话；正常会话由签名令牌承载，可跨代理重建复用。 */
     private readonly revokedSessions;
     private upstreamCookie;
-    constructor(runtime?: LanAccessDshRuntime, authenticatedUrl?: string | undefined);
+    constructor(runtime?: LanAccessDshRuntime, authenticatedUrl?: string | undefined, sessionCookieName?: string);
+    private readonly sessionCookieName;
     listenHosts(): readonly string[];
     detect(): Promise<readonly number[]>;
     start(input: Partial<LanAccessDshConfig>): Promise<LanAccessDshSnapshot>;
@@ -72,6 +85,26 @@ export declare class LanAccessDshProxy {
     /** DSH 启动时的认证 URL 只在 Host 内交换一次 Cookie，绝不下发到浏览器。 */
     private takeOverDshWebToken;
 }
+/**
+ * 将局域网入口发往上游 DSH 的 HTTP 请求头改成上游自身的 authority。
+ *
+ * 代理是单用途的：每个普通 HTTP 请求都要求上游关闭连接，避免在不知道
+ * Content-Length/分块边界时误把 keep-alive 上的第二个请求当成正文。WebSocket
+ * 升级请求则保持 Upgrade，升级后的帧不再经过头部解析。
+ */
+export declare class LanAccessDshRequestTransform extends Transform {
+    private readonly targetAuthority;
+    private readonly upstreamCookie;
+    private pending;
+    private pendingRequest;
+    private finished;
+    constructor(targetAuthority: string, upstreamCookie?: string | null);
+    _transform(chunk: Uint8Array, _encoding: string, callback: TransformCallback): void;
+    _flush(callback: TransformCallback): void;
+    private drainPending;
+}
+/** 兼容旧版 DSH Web Client 直接把 RPC 参数放入 payload 的请求格式。 */
+export declare function normalizeLanAccessDshRpcBody(path: string, method: string, body: Uint8Array): Uint8Array;
 /** 改写请求中的 Host、Origin，并关闭普通 HTTP 上游连接。 */
 export declare function rewriteLanAccessDshRequestHeaders(input: Uint8Array, targetAuthority: string, upstreamCookie?: string): Uint8Array;
 export declare class LanAccessDshError extends Error {