@lenorin/dsh-tauri-launcher 1.0.1 → 1.0.2

package/README.en.md

@@ -145,6 +145,10 @@ fit common deployments):
 
 - The npm package ships a pre-built exe (`launcher/bin/dsh-launcher.exe`); the plugin auto-detects it on install — ready to use out of the box;
 - Local build: `pwsh -File launcher/build.ps1` (optional `-Offline -CargoHome <dir>`);
+- ⚠️ Maintenance rule: **after editing Rust sources under `launcher/src-tauri`, you must
+  rebuild and re-sync `launcher/bin/dsh-launcher.exe`** (see [docs/release.md](docs/release.md)),
+  or the shipped exe will drift from the sources; keep the version in `package.json` /
+  `Cargo.toml` / `tauri.conf.json` in sync.
 - GitHub Release: push a `v*` tag; CI auto-builds the Windows exe and publishes it
   (Linux/macOS builds are not enabled yet — see [docs/release.md](docs/release.md)).
 

package/README.md

@@ -138,6 +138,10 @@ dsh plugin --profile web remove @lenorin/dsh-tauri-launcher
 
 - npm 包自带预编译 exe（`launcher/bin/dsh-launcher.exe`），插件安装后自动探测、装上即用；
 - 本地自行构建：`pwsh -File launcher/build.ps1`（可选 `-Offline -CargoHome <dir>`）；
+- ⚠️ 维护纪律：**修改 `launcher/src-tauri` 下的 Rust 源码后，必须重新构建并同步
+  `launcher/bin/dsh-launcher.exe`**（发布流程见 [docs/release.md](docs/release.md)），
+  否则 npm 包内 exe 与源码漂移；版本号需在 `package.json` / `Cargo.toml` /
+  `tauri.conf.json` 三处同步。
 - GitHub Release：推送 `v*` tag，CI 自动构建 Windows exe 并发布（Linux/macOS 构建
   尚未启用，见 [docs/release.md](docs/release.md)）。
 

package/lib/client.js

@@ -64,22 +64,28 @@ window.__ModuleLoader__.load({
 `
 
     const API_BASE = '/api/dsh-tauri-launcher'
+    /** 自定义请求头：同源 fetch 可带，跨站 form POST 无法伪造（CSRF 防线）。 */
+    const CSRF_HEADERS = { 'x-requested-with': 'dsh-tauri-launcher' }
 
     const api = {
       async state() {
-        const response = await fetch(API_BASE + '/state')
+        const response = await fetch(API_BASE + '/state', { headers: CSRF_HEADERS })
         return response.json()
       },
       async setDesktop(enabled) {
         const response = await fetch(API_BASE + '/set-desktop', {
           method: 'POST',
-          headers: { 'content-type': 'application/json' },
+          headers: { ...CSRF_HEADERS, 'content-type': 'application/json' },
           body: JSON.stringify({ enabled }),
         })
         return response.json()
       },
       async setShortcut() {
-        const response = await fetch(API_BASE + '/set-shortcut', { method: 'POST' })
+        const response = await fetch(API_BASE + '/set-shortcut', { method: 'POST', headers: CSRF_HEADERS })
+        return response.json()
+      },
+      async diagnose() {
+        const response = await fetch(API_BASE + '/diagnose', { headers: CSRF_HEADERS })
         return response.json()
       },
     }
@@ -105,9 +111,14 @@ window.__ModuleLoader__.load({
       async function fetchState() {
         try {
           const state = await api.state()
-          return { desktop: state.desktop, shortcut: Boolean(state.shortcut), error: '', diag: state.diag || '' }
+          return { desktop: state.desktop, shortcut: Boolean(state.shortcut), error: '', diag: '' }
         } catch (error) {
-          return { desktop: null, shortcut: false, error: '读取状态失败：' + errText(error), diag: '' }
+          let diag = ''
+          try {
+            const diagnosed = await api.diagnose()
+            diag = (diagnosed && diagnosed.diag) || ''
+          } catch { /* 诊断失败不影响错误展示 */ }
+          return { desktop: null, shortcut: false, error: '读取状态失败：' + errText(error), diag }
         }
       }
 

package/lib/index.js

@@ -25,12 +25,8 @@ const STDIO = { stdin: 'ignore', stdout: 'inherit', stderr: 'inherit' }
 /** 本包随附的预编译桌面应用 exe 目录（无论安装到哪个 profile 都能定位）。 */
 const PACKAGE_BIN = fileURLToPath(new URL('../launcher/bin', import.meta.url))
 
-/** 未配置 launcherDirs 时的默认候选目录（包内 exe 优先，本机常见布局兜底，可被行配置覆盖）。 */
-const DEFAULT_DIRS = [
-  PACKAGE_BIN,
-  'F:\\DeepSeek Harness\\DeepSeek Harness Tauri\\dsh-launcher\\src-tauri\\target\\release',
-  'F:\\DeepSeek Harness\\DeepSeek Harness Tauri\\dsh-launcher\\src-tauri\\target\\debug',
-]
+/** 未配置 launcherDirs 时的默认候选目录（仅包内随附的预编译 exe；本地自行构建的 exe 通过行配置 launcherDirs/launcherExe 指定）。 */
+const DEFAULT_DIRS = [PACKAGE_BIN]
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
 const psQuote = (value) => "'" + String(value).replace(/'/g, "''") + "'"
@@ -41,9 +37,17 @@ function writeJson(res, status, body) {
   res.end(payload)
 }
 
+/** 请求体大小上限（回环接口的防御性约束）。 */
+const MAX_BODY_BYTES = 1024 * 1024
+
 async function readJsonBody(req) {
   const chunks = []
-  for await (const chunk of req) chunks.push(chunk)
+  let total = 0
+  for await (const chunk of req) {
+    total += chunk.length
+    if (total > MAX_BODY_BYTES) return {}
+    chunks.push(chunk)
+  }
   try {
     const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'))
     return typeof parsed === 'object' && parsed !== null ? parsed : {}
@@ -58,6 +62,31 @@ function isLoopback(req) {
   return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1'
 }
 
+/**
+ * CSRF 防线（#4）：回环之外直接拒绝；回环内还须满足任一——
+ * 1. 携带本插件约定的自定义头（同源 fetch 可带，跨站 form POST 无法伪造）；
+ * 2. Origin 为 DSH 自身页面地址（http://127.0.0.1|localhost|[::1]:port）；
+ * 3. Referer 指向 DSH 自身页面地址。
+ * 三者全缺（如 <img>/<script> 等无头请求）拒绝。
+ */
+function isTrustedRequest(req, port) {
+  if (!isLoopback(req)) return false
+  const headers = req.headers || {}
+  if (headers['x-requested-with'] === 'dsh-tauri-launcher') return true
+  const allowed = new Set([
+    'http://127.0.0.1:' + port,
+    'http://localhost:' + port,
+    'http://[::1]:' + port,
+  ])
+  if (headers.origin && allowed.has(headers.origin)) return true
+  const referer = headers.referer
+  if (referer) {
+    const base = referer.split('/').slice(0, 3).join('/')
+    if (allowed.has(base)) return true
+  }
+  return false
+}
+
 export function apply(ctx, config) {
   // 注入的服务由加载器保证在 apply 前就绪（不能在 apply 时用 ctx.get 提前
   // 捕获未就绪的服务，否则会永久拿到 undefined）。
@@ -88,12 +117,6 @@ export function apply(ctx, config) {
       if (slash > 0) list.push(resolved.launcherExe.slice(0, slash))
     }
     for (const dir of DEFAULT_DIRS) list.push(dir)
-    const root = sandboxPolicy && sandboxPolicy.workspaceRoot
-    if (root) {
-      const r = String(root).replace(/[\\/]+$/, '')
-      list.push(r + '\\dsh-launcher\\src-tauri\\target\\release')
-      list.push(r + '\\dsh-launcher\\src-tauri\\target\\debug')
-    }
     return [...new Set(list)]
   }
 
@@ -110,11 +133,8 @@ export function apply(ctx, config) {
   }
 
   async function exeDirs() {
-    const dirs = []
-    for (const dir of baseDirs()) {
-      if (await exeExists(dir)) dirs.push(dir)
-    }
-    return dirs
+    const checked = await Promise.all(baseDirs().map(async (dir) => ((await exeExists(dir)) ? dir : null)))
+    return checked.filter((dir) => dir !== null)
   }
 
   async function fileText(dir, name) {
@@ -189,7 +209,7 @@ export function apply(ctx, config) {
     if (!subprocess) throw new Error('subprocess 服务不可用')
     const handle = subprocess.spawn({
       argv: ['powershell', '-NoProfile', '-NonInteractive', '-Command', script],
-      cwd: cwd || (await pickExe() ? await pickExe() : ''),
+      cwd: cwd || (await pickExe()) || '',
       stdio: STDIO,
       graceMs: 3000,
     })
@@ -334,8 +354,11 @@ export function apply(ctx, config) {
     const running = await isRunning()
     const exe = await pickExe()
     const shortcut = await shortcutExists()
-    const diag = await buildDiag()
-    return { ok: true, desktop: running, shortcut, exe: exe || null, diag }
+    return { ok: true, desktop: running, shortcut, exe: exe || null }
+  }
+
+  async function getDiag() {
+    return { ok: true, diag: await buildDiag() }
   }
 
   async function setDesktop(enabled) {
@@ -357,10 +380,10 @@ export function apply(ctx, config) {
       const state = await waitFresh(20)
       if (state === true) {
         if (!(await ensureShortcut())) lastMarkerError = 'shortcut sync failed (create)'
-        return { ok: true, desktop: true, shortcut: await shortcutExists(), diag: await buildDiag() }
+        return { ok: true, desktop: true, shortcut: await shortcutExists(), diag: '' }
       }
-      if (state === null) return { ok: true, desktop: null, shortcut: await shortcutExists(), diag: await buildDiag() }
-      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: await buildDiag() }
+      if (state === null) return { ok: true, desktop: null, shortcut: await shortcutExists(), diag: '' }
+      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: '' }
     }
 
     const owned = spawnHandle
@@ -379,33 +402,35 @@ export function apply(ctx, config) {
       if (owned && owned.done) await Promise.race([owned.done.catch(() => {}), sleep(3000)])
       writeQuitMarkerNoWait('0')
       if (!(await removeShortcut())) lastMarkerError = 'shortcut sync failed (delete)'
-      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: await buildDiag() }
+      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: '' }
     }
     writeQuitMarkerNoWait('0')
     const state = await waitGone(20)
     if (state === true) {
       if (!(await removeShortcut())) lastMarkerError = 'shortcut sync failed (delete)'
-      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: await buildDiag() }
+      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: '' }
     }
-    if (state === null) return { ok: true, desktop: null, shortcut: await shortcutExists(), diag: await buildDiag() }
+    if (state === null) return { ok: true, desktop: null, shortcut: await shortcutExists(), diag: '' }
     try {
       const exe = await pickExe()
       const dir = exe ? exe.slice(0, exe.lastIndexOf('\\')) : process.cwd()
-      await runPowerShell('Stop-Process -Name dsh-launcher -Force -ErrorAction SilentlyContinue', dir)
+      // 仅终止与探测到的 exe 路径匹配的进程，避免误杀其他同名程序。
+      const script = "$p = Get-Process -Name dsh-launcher -ErrorAction SilentlyContinue | Where-Object { $_.Path -eq " + psQuote(exe || '') + " }; if ($p) { $p | Stop-Process -Force -ErrorAction SilentlyContinue }"
+      await runPowerShell(script, dir)
     } catch (error) {
       lastMarkerError = String((error && error.message) || error)
     }
     const state2 = await waitGone(8)
     if (state2 === true) {
       if (!(await removeShortcut())) lastMarkerError = 'shortcut sync failed (delete)'
-      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: await buildDiag() }
+      return { ok: true, desktop: false, shortcut: await shortcutExists(), diag: '' }
     }
     return { ok: false, error: '桌面应用仍在运行（退出请求与强制结束均未生效）。', shortcut: await shortcutExists(), diag: await buildDiag() }
   }
 
   async function setShortcut() {
     const ok = await ensureShortcut()
-    if (ok) return { ok: true, shortcut: true, diag: await buildDiag() }
+    if (ok) return { ok: true, shortcut: true, diag: '' }
     return { ok: false, error: '创建桌面快捷方式失败。', shortcut: await shortcutExists(), diag: await buildDiag() }
   }
 
@@ -415,7 +440,7 @@ export function apply(ctx, config) {
         kind: 'exact',
         path: '/api/dsh-tauri-launcher/state',
         handler: async (req, res) => {
-          if (!isLoopback(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+          if (!isTrustedRequest(req, ctx.webServer.port)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
           writeJson(res, 200, await getState())
         },
       },
@@ -423,7 +448,7 @@ export function apply(ctx, config) {
         kind: 'exact',
         path: '/api/dsh-tauri-launcher/set-desktop',
         handler: async (req, res) => {
-          if (!isLoopback(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+          if (!isTrustedRequest(req, ctx.webServer.port)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
           const body = await readJsonBody(req)
           writeJson(res, 200, await setDesktop(Boolean(body.enabled)))
         },
@@ -432,10 +457,18 @@ export function apply(ctx, config) {
         kind: 'exact',
         path: '/api/dsh-tauri-launcher/set-shortcut',
         handler: async (req, res) => {
-          if (!isLoopback(req)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+          if (!isTrustedRequest(req, ctx.webServer.port)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
           writeJson(res, 200, await setShortcut())
         },
       },
+      {
+        kind: 'exact',
+        path: '/api/dsh-tauri-launcher/diagnose',
+        handler: async (req, res) => {
+          if (!isTrustedRequest(req, ctx.webServer.port)) return writeJson(res, 403, { ok: false, error: 'forbidden' })
+          writeJson(res, 200, await getDiag())
+        },
+      },
     ]
     const disposers = routes.map((route) => ctx.webServer.register(route))
     return () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenorin/dsh-tauri-launcher",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "DSH Web 插件：基于 Tauri 2 的 DeepSeek Harness 桌面启动器，自动联动桌面快捷方式，exe 路径与探测窗口可配置。",
   "type": "module",
   "main": "lib/index.js",