@jingyi0605/codingns4dsh 0.1.2 → 0.1.7-rc.3

package/data/build/dist/host/lan-access-dsh.js

@@ -6,6 +6,19 @@ import { homedir } from 'node:os';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { CodingNsRpcError } from './rpc-table.js';
+/**
+ * Cookie 不包含端口信息；多个 DSH 实例若共用名称，浏览器会在实例之间覆盖会话。
+ * 正式环境保留旧名称，开发环境由启动包装命令显式指定独立名称。
+ */
+export const DEFAULT_LOGIN_PROTECTION_COOKIE_NAME = 'dsh_codingns_session';
+const LOGIN_PROTECTION_COOKIE_NAME_ENV = 'CODINGNS4DSH_LOGIN_COOKIE_NAME';
+const COOKIE_NAME_PATTERN = /^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/u;
+export function resolveLoginProtectionCookieName(configured = process.env[LOGIN_PROTECTION_COOKIE_NAME_ENV]) {
+    const value = configured?.trim();
+    return value !== undefined && value !== '' && value.length <= 128 && COOKIE_NAME_PATTERN.test(value)
+        ? value
+        : DEFAULT_LOGIN_PROTECTION_COOKIE_NAME;
+}
 /** 浏览器中继只携带短期签名票据，密码哈希和签名密钥始终留在 Host。 */
 export async function openLoginProtectionSession(store, username, password, scope) {
     const config = await store.read();
@@ -13,9 +26,15 @@ export async function openLoginProtectionSession(store, username, password, scop
         return { token: '', expiresAt: new Date().toISOString() };
     if (username !== config.username || !verifyPassword(password, config))
         throw new CodingNsRpcError('CODINGNS_RPC_UNAUTHENTICATED', '本地用户名或密码错误');
-    const expiresAt = Date.now() + config.timeoutSeconds * 1000;
-    const payload = encodeSessionPayload({ username: config.username, scope, expiresAt, nonce: randomBytes(16).toString('base64url') });
-    return { token: `${payload}.${signSessionPayload(payload, config)}`, expiresAt: new Date(expiresAt).toISOString() };
+    return issueLoginProtectionSession(config, scope);
+}
+/** 在旧票据仍有效时滚动续签；过期票据不能借此恢复登录。 */
+export async function refreshLoginProtectionSession(store, token, scope) {
+    const config = await store.read();
+    if (config === null || !config.enabled || !config.scopes[scope] || typeof token !== 'string' || !verifySignedSessionToken(token, config, scope)) {
+        throw new CodingNsRpcError('CODINGNS_RPC_UNAUTHENTICATED', '登录保护会话已失效，请重新登录');
+    }
+    return issueLoginProtectionSession(config, scope);
 }
 /** 校验中继票据；配置关闭或未覆盖该范围时保持向后兼容，直接放行。 */
 export async function verifyLoginProtectionSession(store, token, scope) {
@@ -121,10 +140,12 @@ export class LanAccessDshProxy {
     /** 当前进程内主动退出的会话；正常会话由签名令牌承载，可跨代理重建复用。 */
     revokedSessions = new Set();
     upstreamCookie = null;
-    constructor(runtime = createNodeLanAccessDshRuntime(), authenticatedUrl) {
+    constructor(runtime = createNodeLanAccessDshRuntime(), authenticatedUrl, sessionCookieName = resolveLoginProtectionCookieName()) {
         this.runtime = runtime;
         this.authenticatedUrl = authenticatedUrl;
+        this.sessionCookieName = resolveLoginProtectionCookieName(sessionCookieName);
     }
+    sessionCookieName;
     listenHosts() {
         return this.runtime.listListenHosts();
     }
@@ -238,8 +259,9 @@ export class LanAccessDshProxy {
             dshSocket.once('error', removeDsh);
             // DSH 的 API 信任校验依据上游看到的 Host/Origin。局域网入口的地址
             // 与真实 DSH 地址不同，直接透传会导致静态页面能打开但所有 /api 返回 403。
-            // 只改写请求头，响应和 WebSocket 帧仍然原样双向转发。测试运行时的最小
-            // FakeStream 没有 Node Writable 接口，保留原始 pipe 以便验证连接关系。
+            // 改写请求头，并兼容旧版 Connection RPC 的正文格式；响应和 WebSocket 帧仍然
+            // 原样双向转发。测试运行时的最小 FakeStream 没有 Node Writable 接口，保留原始
+            // pipe 以便验证连接关系。
             if (typeof dshSocket.on === 'function') {
                 const localAddress = isLoopbackSocket(localSocket);
                 const authTransform = new LanAccessDshAuthTransform(localSocket, (request) => this.authorize(request, localAddress));
@@ -267,14 +289,26 @@ export class LanAccessDshProxy {
     authorize(request, localAddress) {
         const config = this.loginConfig;
         if (request.path === '/__codingns/session' && request.method === 'GET') {
-            const token = readCookie(request.headers.cookie, 'dsh_codingns_session');
+            const token = readCookie(request.headers.cookie, this.sessionCookieName);
             const authenticated = !localAddress && config !== null && config.enabled && config.scopes.lan
                 && token !== undefined && !this.revokedSessions.has(token)
                 && verifySignedSessionToken(token, config, 'lan');
+            const expiresAt = authenticated && config !== null && token !== undefined ? readLoginProtectionSessionExpiresAt(token, config, 'lan') : null;
             return loginJsonResponse(200, authenticated
-                ? { authenticated: true, username: config.username }
+                ? { authenticated: true, username: config.username, ...(expiresAt === null ? {} : { expiresAt }) }
                 : { authenticated: false });
         }
+        if (request.path === '/__codingns/session/refresh' && request.method === 'POST') {
+            const token = readCookie(request.headers.cookie, this.sessionCookieName);
+            if (localAddress || config === null || !config.enabled || !config.scopes.lan || token === undefined || this.revokedSessions.has(token) || !verifySignedSessionToken(token, config, 'lan')) {
+                return loginJsonResponse(401, { authenticated: false });
+            }
+            const session = issueLoginProtectionSession(config, 'lan');
+            this.revokedSessions.delete(session.token);
+            return loginJsonResponse(200, { authenticated: true, username: config.username, expiresAt: session.expiresAt }, {
+                'Set-Cookie': sessionCookie(this.sessionCookieName, session.token, config.timeoutSeconds),
+            });
+        }
         if (localAddress || config === null || !config.enabled || !config.scopes.lan)
             return 'pass';
         if (request.path === '/__codingns/login' && request.method === 'POST') {
@@ -286,19 +320,19 @@ export class LanAccessDshProxy {
             const payload = encodeSessionPayload({ username: config.username, scope: 'lan', expiresAt, nonce: randomBytes(16).toString('base64url') });
             const token = `${payload}.${signSessionPayload(payload, config)}`;
             this.revokedSessions.delete(token);
-            return loginResponse(303, '', { 'Set-Cookie': sessionCookie(token, config.timeoutSeconds), Location: '/' });
+            return loginResponse(303, '', { 'Set-Cookie': sessionCookie(this.sessionCookieName, token, config.timeoutSeconds), Location: '/' });
         }
         if (request.path === '/__codingns/logout') {
-            const token = readCookie(request.headers.cookie, 'dsh_codingns_session');
+            const token = readCookie(request.headers.cookie, this.sessionCookieName);
             if (token !== undefined && verifySignedSessionToken(token, config, 'lan'))
                 this.revokedSessions.add(token);
-            return loginResponse(303, '', { 'Set-Cookie': 'dsh_codingns_session=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0', Location: '/' });
+            return loginResponse(303, '', { 'Set-Cookie': clearSessionCookie(this.sessionCookieName), Location: '/' });
         }
         // 浏览器会在页面刷新时独立请求 Web App manifest；它只包含静态元数据，
         // 不应因为登录保护缺少 Cookie 而产生 401 控制台噪声。
         if (request.path === '/manifest.webmanifest' && request.method === 'GET')
             return 'pass';
-        const token = readCookie(request.headers.cookie, 'dsh_codingns_session');
+        const token = readCookie(request.headers.cookie, this.sessionCookieName);
         if (token !== undefined && !this.revokedSessions.has(token) && verifySignedSessionToken(token, config, 'lan')) {
             return 'pass';
         }
@@ -397,8 +431,16 @@ function readCookie(value, name) {
     }
     return undefined;
 }
-function sessionCookie(token, timeoutSeconds) {
-    return `dsh_codingns_session=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${timeoutSeconds}`;
+function sessionCookie(name, token, timeoutSeconds) {
+    return `${name}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${timeoutSeconds}`;
+}
+function issueLoginProtectionSession(config, scope) {
+    const expiresAt = Date.now() + config.timeoutSeconds * 1000;
+    const payload = encodeSessionPayload({ username: config.username, scope, expiresAt, nonce: randomBytes(16).toString('base64url') });
+    return { token: `${payload}.${signSessionPayload(payload, config)}`, expiresAt: new Date(expiresAt).toISOString() };
+}
+function clearSessionCookie(name) {
+    return `${name}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0`;
 }
 function getSetCookie(headers) {
     const extended = headers;
@@ -423,8 +465,8 @@ function loginResponse(status, body, extra = {}) {
     const head = encodeLatin1(`HTTP/1.1 ${status} ${statusText(status)}\r\n${Object.entries(headers).map(([key, value]) => `${key}: ${value}`).join('\r\n')}\r\n\r\n`);
     return concatBytes(head, content);
 }
-function loginJsonResponse(status, value) {
-    return loginResponse(status, JSON.stringify(value), { 'Content-Type': 'application/json; charset=utf-8' });
+function loginJsonResponse(status, value, extra = {}) {
+    return loginResponse(status, JSON.stringify(value), { 'Content-Type': 'application/json; charset=utf-8', ...extra });
 }
 function loginPage() {
     // 视觉规则直接复用 codingns4dsh-h5/styles.css 的 Cyber 登录区，只把 Connect
@@ -450,11 +492,11 @@ function escapeHtml(value) { return value.replace(/[&<>"']/g, (char) => ({ '&':
  * Content-Length/分块边界时误把 keep-alive 上的第二个请求当成正文。WebSocket
  * 升级请求则保持 Upgrade，升级后的帧不再经过头部解析。
  */
-class LanAccessDshRequestTransform extends Transform {
+export class LanAccessDshRequestTransform extends Transform {
     targetAuthority;
     upstreamCookie;
     pending = new Uint8Array(0);
-    bodyRemaining = 0;
+    pendingRequest = null;
     finished = false;
     constructor(targetAuthority, upstreamCookie = null) {
         super();
@@ -471,6 +513,14 @@ class LanAccessDshRequestTransform extends Transform {
         callback();
     }
     _flush(callback) {
+        if (this.pendingRequest !== null) {
+            // 请求正文不完整时无法判断是否为 JSON，保留原正文并只改写请求头。
+            this.push(rewriteLanAccessDshRequestHeaders(this.pendingRequest.head, this.targetAuthority, this.upstreamCookie ?? undefined));
+            if (this.pending.length > 0)
+                this.push(this.pending);
+            callback();
+            return;
+        }
         if (this.pending.length > 0)
             callback(null, this.pending);
         else
@@ -478,13 +528,15 @@ class LanAccessDshRequestTransform extends Transform {
     }
     drainPending() {
         while (!this.finished) {
-            if (this.bodyRemaining > 0) {
-                const size = Math.min(this.bodyRemaining, this.pending.length);
-                if (size === 0)
+            if (this.pendingRequest !== null) {
+                if (this.pending.length < this.pendingRequest.bodyLength)
                     return;
-                this.push(this.pending.subarray(0, size));
-                this.pending = this.pending.subarray(size);
-                this.bodyRemaining -= size;
+                const body = this.pending.subarray(0, this.pendingRequest.bodyLength);
+                this.pending = this.pending.subarray(this.pendingRequest.bodyLength);
+                const normalizedBody = normalizeLanAccessDshRpcBody(this.pendingRequest.path, this.pendingRequest.method, body);
+                const head = rewriteLanAccessDshRequestHeaders(this.pendingRequest.head, this.targetAuthority, this.upstreamCookie ?? undefined);
+                this.push(concatBytes(rewriteContentLength(head, normalizedBody.length), normalizedBody));
+                this.pendingRequest = null;
                 continue;
             }
             const end = findHeaderEnd(this.pending);
@@ -500,9 +552,9 @@ class LanAccessDshRequestTransform extends Transform {
             const head = this.pending.subarray(0, end + 4);
             this.pending = this.pending.subarray(end + 4);
             const upgrade = isUpgradeRequest(head);
-            this.push(rewriteLanAccessDshRequestHeaders(head, this.targetAuthority, this.upstreamCookie ?? undefined));
             if (upgrade) {
                 // WebSocket 头部之后全部是帧数据，不能再次进入 HTTP 头缓存。
+                this.push(rewriteLanAccessDshRequestHeaders(head, this.targetAuthority, this.upstreamCookie ?? undefined));
                 this.finished = true;
                 if (this.pending.length > 0) {
                     this.push(this.pending);
@@ -513,6 +565,7 @@ class LanAccessDshRequestTransform extends Transform {
             // DSH 的普通请求均为无体 GET 或带 Content-Length 的 JSON POST。
             // 分块上传无法安全识别下一条请求，遇到它时透传本连接剩余字节。
             if (/\r\ntransfer-encoding:\s*[^\r\n]*\bchunked\b/iu.test(decodeLatin1(head))) {
+                this.push(rewriteLanAccessDshRequestHeaders(head, this.targetAuthority, this.upstreamCookie ?? undefined));
                 this.finished = true;
                 if (this.pending.length > 0) {
                     this.push(this.pending);
@@ -520,10 +573,43 @@ class LanAccessDshRequestTransform extends Transform {
                 }
                 return;
             }
-            this.bodyRemaining = contentLengthOf(head);
+            const bodyLength = contentLengthOf(head);
+            if (bodyLength === 0) {
+                this.push(rewriteLanAccessDshRequestHeaders(head, this.targetAuthority, this.upstreamCookie ?? undefined));
+                continue;
+            }
+            const requestLine = decodeLatin1(head).split('\r\n', 1)[0] ?? '';
+            const parts = requestLine.split(' ');
+            this.pendingRequest = {
+                head,
+                method: parts[0] ?? 'GET',
+                path: (parts[1] ?? '/').split('?', 1)[0] ?? '/',
+                bodyLength,
+            };
         }
     }
 }
+/** 兼容旧版 DSH Web Client 直接把 RPC 参数放入 payload 的请求格式。 */
+export function normalizeLanAccessDshRpcBody(path, method, body) {
+    if (method.toUpperCase() !== 'POST' || !path.startsWith('/api/'))
+        return body;
+    try {
+        const message = JSON.parse(new TextDecoder().decode(body));
+        if (!isOfficialConnectionRpcMessage(message) || !isRecord(message.payload) || 'args' in message.payload)
+            return body;
+        return new TextEncoder().encode(JSON.stringify({ ...message, payload: { args: message.payload } }));
+    }
+    catch {
+        return body;
+    }
+}
+/** 只兼容 DSH 官方两段式 Remote endpoint，不能改写 CodingNS 自有 RPC。 */
+function isOfficialConnectionRpcMessage(value) {
+    if (!isRecord(value) || value.type !== 'client-request' || typeof value.method !== 'string')
+        return false;
+    const parts = value.method.split('/');
+    return parts.length === 2 && parts.every((part) => part !== '') && parts[0] !== 'codingns';
+}
 /** 改写请求中的 Host、Origin，并关闭普通 HTTP 上游连接。 */
 export function rewriteLanAccessDshRequestHeaders(input, targetAuthority, upstreamCookie) {
     const text = decodeLatin1(input);
@@ -569,6 +655,14 @@ function contentLengthOf(input) {
     const match = /\r\ncontent-length:\s*(\d+)/iu.exec(decodeLatin1(input));
     return match?.[1] === undefined ? 0 : Number(match[1]);
 }
+function rewriteContentLength(input, length) {
+    const lines = decodeLatin1(input).split('\r\n');
+    for (let index = 1; index < lines.length; index += 1) {
+        if (/^content-length\s*:/iu.test(lines[index] ?? ''))
+            lines[index] = `Content-Length: ${length}`;
+    }
+    return encodeLatin1(lines.join('\r\n'));
+}
 function isUpgradeRequest(input) {
     const text = decodeLatin1(input);
     return /\r\nconnection:\s*[^\r\n]*\bupgrade\b/iu.test(text)
@@ -660,6 +754,10 @@ export function createLanAccessDshRpcHandler(proxy, settings, loginStore = new F
                 const input = parseLoginSessionPayload(payload);
                 return openLoginProtectionSession(loginStore, input.username, input.password, input.scope);
             }
+            case 'login/session/refresh': {
+                const input = parseLoginSessionRefreshPayload(payload);
+                return refreshLoginProtectionSession(loginStore, input.token, input.scope);
+            }
             case 'start':
                 return proxy.start(parseStartPayload(payload));
             case 'stop':
@@ -682,6 +780,16 @@ function parseLoginSessionPayload(value) {
         throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '登录会话应用范围无效');
     return { username, password: input.password, scope };
 }
+function parseLoginSessionRefreshPayload(value) {
+    if (!value || typeof value !== 'object')
+        throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '登录会话刷新参数必须是对象');
+    const input = value;
+    const token = requireLoginText(input.token, '会话票据', 32, 4096);
+    const scope = input.scope === 'lan' || input.scope === 'relay' ? input.scope : undefined;
+    if (scope === undefined)
+        throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', '登录会话范围无效');
+    return { token, scope };
+}
 function defaultLanAccessDshSettings() {
     return { autoStart: false, listenHost: '0.0.0.0', listenPort: 13080, dshPort: 0 };
 }
@@ -757,6 +865,17 @@ function verifySignedSessionToken(token, config, scope) {
         return false;
     }
 }
+function readLoginProtectionSessionExpiresAt(token, config, scope) {
+    if (!verifySignedSessionToken(token, config, scope))
+        return null;
+    try {
+        const value = JSON.parse(Buffer.from(token.slice(0, token.lastIndexOf('.')), 'base64url').toString('utf8'));
+        return typeof value.expiresAt === 'number' && Number.isFinite(value.expiresAt) ? value.expiresAt : null;
+    }
+    catch {
+        return null;
+    }
+}
 function requireLoginText(value, field, min, max) {
     if (typeof value !== 'string' || value.trim().length < min || value.trim().length > max || /[\u0000-\u001F\u007F]/u.test(value))
         throw new LanAccessDshError('LAN_ACCESS_DSH_INVALID', `${field} 格式无效`);

package/data/build/dist/host/modules/peer-host/host-api-proxy-service.d.ts

@@ -0,0 +1,52 @@
+import type { HostScope, PeerHostErrorCode } from '../../../shared/contracts/peer-host.js';
+import { PeerHostSessionService } from './peer-host-session.js';
+import { PeerHostStore } from './peer-host-store.js';
+export declare const PEER_HOST_HTTP_PROXY_RULES: readonly [{
+    readonly prefix: "/api/workspaces";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly prefix: "/api/sessions";
+    readonly methods: readonly ["GET", "POST"];
+}, {
+    readonly prefix: "/api/file-tree";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly prefix: "/api/files";
+    readonly methods: readonly ["GET", "PUT", "POST"];
+}, {
+    readonly prefix: "/api/git";
+    readonly methods: readonly ["GET", "POST"];
+}, {
+    readonly prefix: "/api/terminal";
+    readonly methods: readonly ["GET", "POST"];
+}, {
+    readonly prefix: "/api/right-tools";
+    readonly methods: readonly ["GET", "POST"];
+}];
+export declare class PeerHostProxyError extends Error {
+    readonly code: PeerHostErrorCode;
+    constructor(code: PeerHostErrorCode, message: string);
+}
+/** 当前 Host 到目标 Host 的 HTTP 正向代理。 */
+export declare class PeerHostHttpProxyService {
+    private readonly store;
+    private readonly sessions;
+    private readonly fetchImpl;
+    constructor(store: PeerHostStore, sessions: PeerHostSessionService, options?: {
+        readonly fetchImpl?: typeof fetch;
+    });
+    handle(peerHostId: string, request: Request): Promise<Response>;
+    /** 将 RPC 的结构化请求转换为同一条 HTTP 白名单代理；不接受绝对 URL。 */
+    request(peerHostId: string, input: {
+        readonly scope: HostScope;
+        readonly path: string;
+        readonly method?: string;
+        readonly body?: string;
+    }): Promise<{
+        readonly status: number;
+        readonly headers: readonly [string, string][];
+        readonly body: string;
+    }>;
+    private requireReady;
+}
+//# sourceMappingURL=host-api-proxy-service.d.ts.map

package/data/build/dist/host/modules/peer-host/host-api-proxy-service.js

@@ -0,0 +1,166 @@
+import { PEER_HOST_ERROR_CODES } from '../../../shared/contracts/peer-host.js';
+import { PeerHostSessionService } from './peer-host-session.js';
+import { PeerHostStore } from './peer-host-store.js';
+import { peerHostSafeError } from './peer-host-diagnostics.js';
+const MAX_PROXY_BODY_BYTES = 4 * 1024 * 1024;
+const ALLOWED_QUERY = new Set(['workspaceId', 'sessionId', 'scopeGeneration', 'cursor', 'path', 'toolId']);
+const HOP_BY_HOP_HEADERS = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'authorization']);
+export const PEER_HOST_HTTP_PROXY_RULES = [
+    { prefix: '/api/workspaces', methods: ['GET'] },
+    { prefix: '/api/sessions', methods: ['GET', 'POST'] },
+    { prefix: '/api/file-tree', methods: ['GET'] },
+    { prefix: '/api/files', methods: ['GET', 'PUT', 'POST'] },
+    { prefix: '/api/git', methods: ['GET', 'POST'] },
+    { prefix: '/api/terminal', methods: ['GET', 'POST'] },
+    { prefix: '/api/right-tools', methods: ['GET', 'POST'] },
+];
+export class PeerHostProxyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'PeerHostProxyError';
+    }
+}
+/** 当前 Host 到目标 Host 的 HTTP 正向代理。 */
+export class PeerHostHttpProxyService {
+    store;
+    sessions;
+    fetchImpl;
+    constructor(store, sessions, options = {}) {
+        this.store = store;
+        this.sessions = sessions;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+    }
+    async handle(peerHostId, request) {
+        try {
+            const record = await this.requireReady(peerHostId);
+            const scope = readScope(request.headers, peerHostId);
+            const targetPath = parseProxyPath(request.url);
+            validateQuery(targetPath);
+            validateRule(request.method, targetPath.pathname);
+            const body = await readBody(request);
+            const accessToken = await this.sessions.getAccessToken(peerHostId);
+            const targetUrl = buildTargetUrl(record, targetPath);
+            const response = await this.fetchImpl(targetUrl, {
+                method: request.method,
+                headers: buildForwardHeaders(request.headers, accessToken),
+                ...(body === undefined ? {} : { body }),
+            });
+            if (response.status === 401) {
+                await this.sessions.invalidate(peerHostId);
+                throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.SESSION_REQUIRED, '目标 Host 登录态已失效');
+            }
+            return await forwardResponse(response, scope);
+        }
+        catch (error) {
+            return errorResponse(error);
+        }
+    }
+    /** 将 RPC 的结构化请求转换为同一条 HTTP 白名单代理；不接受绝对 URL。 */
+    async request(peerHostId, input) {
+        const path = typeof input.path === 'string' ? input.path : '';
+        if (!path.startsWith('/api/') || path.includes('://'))
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理路径必须是固定 API 路径');
+        const method = (input.method ?? 'GET').toUpperCase();
+        const body = input.body === undefined ? undefined : String(input.body);
+        if (body !== undefined && new TextEncoder().encode(body).byteLength > MAX_PROXY_BODY_BYTES)
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理请求体过大');
+        const headers = new Headers({
+            'x-codingns-host-id': input.scope.hostId,
+            'x-codingns-target-host-id': input.scope.targetHostId ?? '',
+            'x-codingns-workspace-id': input.scope.workspaceId,
+            'x-codingns-scope-generation': String(input.scope.scopeGeneration),
+            ...(input.scope.sessionId === null ? {} : { 'x-codingns-session-id': input.scope.sessionId }),
+            ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+        });
+        const response = await this.handle(peerHostId, new Request(new URL(path, 'http://peer-host.invalid'), { method, headers, ...(body === undefined ? {} : { body }) }));
+        const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+        if (response.body !== null && !contentType.includes('json') && !contentType.startsWith('text/'))
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.RESPONSE_INVALID, '目标 Host 返回了不支持的响应类型');
+        return { status: response.status, headers: [...response.headers.entries()], body: await response.text() };
+    }
+    async requireReady(peerHostId) {
+        const record = await this.store.get(peerHostId);
+        if (record === null)
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.NOT_FOUND, 'PeerHost 不存在');
+        if (record.status !== 'ready')
+            throw new PeerHostProxyError(record.status === 'session_required' ? PEER_HOST_ERROR_CODES.SESSION_REQUIRED : PEER_HOST_ERROR_CODES.NOT_READY, 'PeerHost 尚未准备好代理');
+        if (record.route.kind !== 'lan')
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.RELAY_UNAVAILABLE, '中转 PeerHost 暂不可用');
+        return record;
+    }
+}
+function readScope(headers, peerHostId) {
+    const hostId = headers.get('x-codingns-host-id')?.trim() ?? '';
+    const targetHostId = headers.get('x-codingns-target-host-id')?.trim() ?? '';
+    const workspaceId = headers.get('x-codingns-workspace-id')?.trim() ?? '';
+    const sessionHeader = headers.get('x-codingns-session-id');
+    const generation = Number(headers.get('x-codingns-scope-generation'));
+    if (!hostId || targetHostId !== peerHostId || !workspaceId || !Number.isSafeInteger(generation) || generation < 0) {
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.SCOPE_MISMATCH, 'PeerHost 请求作用域不匹配');
+    }
+    return { hostId, targetHostId, workspaceId, sessionId: sessionHeader?.trim() || null, scopeGeneration: generation };
+}
+function parseProxyPath(rawUrl) {
+    const url = new URL(rawUrl);
+    if (!url.pathname.startsWith('/api/'))
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理路径不在 API 范围内');
+    return url;
+}
+function validateQuery(url) {
+    for (const key of url.searchParams.keys())
+        if (!ALLOWED_QUERY.has(key))
+            throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理查询参数未加入白名单');
+}
+function validateRule(method, pathname) {
+    const rule = PEER_HOST_HTTP_PROXY_RULES.find((candidate) => pathname === candidate.prefix || pathname.startsWith(`${candidate.prefix}/`));
+    if (rule === undefined || !rule.methods.includes(method.toUpperCase()))
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理路径或方法未加入白名单');
+}
+async function readBody(request) {
+    if (request.method === 'GET' || request.method === 'HEAD')
+        return undefined;
+    const contentLength = Number(request.headers.get('content-length') ?? '0');
+    if (Number.isFinite(contentLength) && contentLength > MAX_PROXY_BODY_BYTES)
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理请求体过大');
+    const body = await request.text();
+    if (new TextEncoder().encode(body).byteLength > MAX_PROXY_BODY_BYTES)
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED, 'PeerHost 代理请求体过大');
+    return body;
+}
+function buildTargetUrl(record, source) {
+    if (record.route.kind !== 'lan')
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.RELAY_UNAVAILABLE, '中转 PeerHost 暂不可用');
+    return new URL(`${source.pathname}${source.search}`, record.route.normalizedOrigin).toString();
+}
+function buildForwardHeaders(source, accessToken) {
+    const headers = new Headers();
+    source.forEach((value, name) => {
+        const normalized = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(normalized) || normalized.startsWith('x-codingns-'))
+            return;
+        if (normalized === 'content-length')
+            return;
+        headers.set(name, value);
+    });
+    headers.set('authorization', `Bearer ${accessToken}`);
+    return headers;
+}
+async function forwardResponse(response, scope) {
+    const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+    if (response.body !== null && !contentType.includes('json') && !contentType.startsWith('text/'))
+        throw new PeerHostProxyError(PEER_HOST_ERROR_CODES.RESPONSE_INVALID, '目标 Host 返回了不支持的响应类型');
+    const headers = new Headers();
+    response.headers.forEach((value, name) => { if (!HOP_BY_HOP_HEADERS.has(name.toLowerCase()))
+        headers.set(name, value); });
+    headers.set('x-codingns-scope-generation', String(scope.scopeGeneration));
+    return new Response(response.body, { status: response.status, headers });
+}
+function errorResponse(error) {
+    const code = error instanceof PeerHostProxyError ? error.code : PEER_HOST_ERROR_CODES.PROXY_UNREACHABLE;
+    const message = error instanceof PeerHostProxyError ? peerHostSafeError(error.code).message : '目标 Host 代理请求失败';
+    const status = code === PEER_HOST_ERROR_CODES.SCOPE_MISMATCH || code === PEER_HOST_ERROR_CODES.PROXY_PATH_NOT_ALLOWED ? 400 : code === PEER_HOST_ERROR_CODES.NOT_FOUND ? 404 : code === PEER_HOST_ERROR_CODES.SESSION_REQUIRED ? 401 : 502;
+    return Response.json({ error: { code, message } }, { status });
+}
+//# sourceMappingURL=host-api-proxy-service.js.map

package/data/build/dist/host/modules/peer-host/host-ws-connector.d.ts

@@ -0,0 +1,31 @@
+import type { PeerHostRemoteConnector } from './host-ws-proxy-service.js';
+/** DSH 原生工作台 WebSocket 的固定入口；不接受客户端传入路径。 */
+export declare const PEER_HOST_REMOTE_WS_PATH = "/ws";
+export interface PeerHostRawWebSocket {
+    readonly readyState: number;
+    on(event: 'open' | 'message' | 'close' | 'error' | 'unexpected-response', listener: (...args: any[]) => void): unknown;
+    once(event: 'open' | 'close' | 'error' | 'unexpected-response', listener: (...args: any[]) => void): unknown;
+    off?(event: 'open' | 'close' | 'error' | 'unexpected-response', listener: (...args: any[]) => void): unknown;
+    send(data: string): void;
+    close(code?: number, reason?: string): void;
+    terminate?(): void;
+}
+export declare class PeerHostConnectorError extends Error {
+    readonly code: 'PEER_HOST_SESSION_REQUIRED' | 'PEER_HOST_PROXY_UNREACHABLE' | 'PEER_HOST_RELAY_UNAVAILABLE';
+    constructor(code: 'PEER_HOST_SESSION_REQUIRED' | 'PEER_HOST_PROXY_UNREACHABLE' | 'PEER_HOST_RELAY_UNAVAILABLE', message: string);
+}
+export interface PeerHostWsConnectorOptions {
+    readonly timeoutMs?: number;
+    readonly websocketFactory?: (url: string, options: {
+        readonly headers: Readonly<Record<string, string>>;
+    }) => PeerHostRawWebSocket;
+}
+/**
+ * 创建当前 Host 到目标 DSH 的 LAN 工作台 connector。
+ *
+ * 目标 URL、access token 和 WebSocket 路径均由 Host 侧生成；Client 只能通过
+ * 上层代理提交 HostScope。目标 DSH 的消息白名单仍由 `PeerHostWsProxyService`
+ * 在双端转发前执行，这里只负责固定端点的认证握手和消息类型的文本适配。
+ */
+export declare function createPeerHostRemoteConnector(options?: PeerHostWsConnectorOptions): PeerHostRemoteConnector;
+//# sourceMappingURL=host-ws-connector.d.ts.map