@linxin666/dsh-remote-web-ui 0.1.13 → 0.1.15

package/lib/index.js

@@ -3,6 +3,7 @@ import { setInterval as setInterval$1 } from "node:timers";
 import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
+import { z as z$1 } from "zod";
 import { readFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -638,6 +639,30 @@ const PAIR_PATHS = {
 	status: "/api/pair/status",
 	events: "/api/pair/events"
 };
+/**
+* /api/pair request payload contracts. Each POST endpoint validates its body
+* against one of these instead of reaching into a hand-parsed object: the
+* control-plane endpoints that carry no meaningful payload use the permissive
+* pairActionPayloadSchema so their smoke calls keep working unchanged, while
+* issue/accept enforce their optional/required fields. Unknown (extra) keys
+* are tolerated exactly as the previous manual reads ignored them.
+*/
+const issuePayloadSchema = z$1.object({
+	workspaceId: z$1.string().min(1).optional(),
+	address: z$1.string().min(1).optional()
+});
+const acceptPayloadSchema = z$1.object({ token: z$1.string().default("") });
+const pairActionPayloadSchema = z$1.object({}).passthrough();
+/**
+* Parse a pair request body through schema. A missing/empty or non-object
+* body is treated as an empty object (the same way the previous manual reads
+* yielded absent fields), and a value that fails the schema returns
+* `undefined` so the caller can answer with the existing error shape.
+*/
+function parsePairPayload(schema, body) {
+	const result = schema.safeParse(body ?? {});
+	return result.success ? result.data : void 0;
+}
 /** One JSON response. */
 function writeJson$1(res, status, body) {
 	const payload = JSON.stringify(body);
@@ -762,8 +787,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const workspaceId = body === void 0 || typeof body.workspaceId !== "string" || body.workspaceId === "" ? void 0 : body.workspaceId;
-		const address = body === void 0 || typeof body.address !== "string" || body.address === "" ? void 0 : body.address;
+		const payload = parsePairPayload(issuePayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const { workspaceId, address } = payload;
 		try {
 			const { token, expiresAt } = service.issue(workspaceId, address);
 			const base = address === void 0 ? service.publicBaseUrl ?? service.lanBaseUrl : service.lanBaseUrlFor(address);
@@ -801,8 +833,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const token = typeof body?.token === "string" ? body.token : "";
-		const result = service.accept(token);
+		const payload = parsePairPayload(acceptPayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const result = service.accept(payload.token);
 		if (!result.ok) {
 			writeJson$1(res, result.code === "used" ? 409 : 404, {
 				ok: false,
@@ -828,7 +867,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		service.stop();
 		writeJson$1(res, 200, { ok: true });
 	};
@@ -841,7 +887,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 		if (deviceId === void 0 || !service.heartbeat(deviceId)) {
 			writeJson$1(res, 401, {
@@ -1008,6 +1061,8 @@ const MOBILE_ALLOWLIST = /* @__PURE__ */ new Set([
 const MOBILE_PREFERENCES_METHOD = "mobile.preferences";
 /** One session.list page (thin phones load incrementally). */
 const SESSION_PAGE_SIZE = 20;
+/** SSE keep-alive ping cadence for the live mux stream (single connection). */
+const DEFAULT_EVENTS_HEARTBEAT_MS = 15e3;
 /** Encode one list position as an opaque continuation cursor. */
 function sessionListCursor(updatedAt, sessionId) {
 	return `${updatedAt}:${sessionId}`;
@@ -1040,6 +1095,7 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 */
 function makeMobileApiRoutes(deps) {
 	const { service, apiProxy, mobileEnterToSend } = deps;
+	const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
 	/** The phone gate: a live paired-device cookie, or nothing else proceeds. */
 	const gateOk = (req) => {
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
@@ -1166,7 +1222,7 @@ function makeMobileApiRoutes(deps) {
 			try {
 				res.write(": ping\n\n");
 			} catch {}
-		}, 15e3);
+		}, eventsHeartbeatMs);
 		const onClose = () => {
 			if (closed) return;
 			closed = true;
@@ -1715,30 +1771,85 @@ async function checkUpdates(deps) {
 /** Cap on captured pnpm output (keeps error payloads bounded). */
 const OUTPUT_CAP = 16 * 1024;
 /**
-* Run the update: `pnpm update <packages>` inside the profile directory.
+* Windows cmd command-not-found stderr. With shell:true a missing shim
+* exits with code 1 (cmd cannot report ENOENT), so the fallback chain
+* detects this message instead of the spawn error event.
+*/
+const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+/**
+* Run the update inside the profile directory. Tries pnpm first, falls back
+* to corepack and then npx when the previous command is missing (ENOENT);
+* all candidates share one hard timeout and keep accumulating output.
 * @param deps - profile dir, package list, and spawn/timeout seams.
 * @returns the outcome with captured output.
 */
 function runUpdate(deps) {
 	return new Promise((resolve) => {
-		const child = (deps.spawnImpl ?? spawn)("pnpm", ["update", ...deps.packages], {
+		const spawnImpl = deps.spawnImpl ?? spawn;
+		const packages = deps.packages;
+		const platform = deps.platform ?? process.platform;
+		const spawnOptions = {
 			cwd: deps.profileDir,
 			stdio: [
 				"ignore",
 				"pipe",
 				"pipe"
-			]
-		});
+			],
+			...platform === "win32" ? { shell: true } : {}
+		};
+		const candidates = [
+			{
+				command: "pnpm",
+				args: ["update", ...packages]
+			},
+			{
+				command: "corepack",
+				args: [
+					"pnpm",
+					"update",
+					...packages
+				]
+			},
+			{
+				command: "npx",
+				args: [
+					"--yes",
+					"pnpm",
+					"update",
+					...packages
+				]
+			}
+		];
 		let output = "";
+		let currentOutput = "";
 		const append = (chunk) => {
 			output += chunk.toString("utf8");
 			if (output.length > OUTPUT_CAP) output = output.slice(output.length - OUTPUT_CAP);
+			currentOutput += chunk.toString("utf8");
+			if (currentOutput.length > OUTPUT_CAP) currentOutput = currentOutput.slice(currentOutput.length - OUTPUT_CAP);
+		};
+		let currentChild;
+		let finished = false;
+		const finish = (result) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			resolve(result);
 		};
-		child.stdout?.on("data", append);
-		child.stderr?.on("data", append);
 		const timer = setTimeout(() => {
-			child.kill("SIGTERM");
-			resolve({
+			if (finished) return;
+			if (platform === "win32") {
+				const pid = currentChild?.pid;
+				if (pid !== void 0 && pid > 0) try {
+					spawnImpl("taskkill", [
+						"/pid",
+						String(pid),
+						"/t",
+						"/f"
+					], { stdio: "ignore" });
+				} catch {}
+			} else currentChild?.kill("SIGTERM");
+			finish({
 				ok: false,
 				exitCode: null,
 				output,
@@ -1746,27 +1857,59 @@ function runUpdate(deps) {
 				errorCode: "timeout"
 			});
 		}, deps.timeoutMs ?? 10 * 6e4);
-		child.on("error", (error) => {
-			clearTimeout(timer);
-			const missing = error.code === "ENOENT";
-			resolve({
-				ok: false,
-				exitCode: null,
-				output,
-				error: missing ? "pnpm not found on PATH" : error.message,
-				errorCode: missing ? "pnpm-missing" : void 0
+		const runCandidate = (index) => {
+			if (finished) return;
+			if (index >= candidates.length) {
+				finish({
+					ok: false,
+					exitCode: null,
+					output,
+					error: "pnpm not found on PATH (tried pnpm, corepack, npx); install pnpm and restart the app",
+					errorCode: "pnpm-missing"
+				});
+				return;
+			}
+			const candidate = candidates[index];
+			currentOutput = "";
+			const child = spawnImpl(candidate.command, candidate.args, spawnOptions);
+			currentChild = child;
+			let settled = false;
+			const once = (fn) => {
+				if (settled) return;
+				settled = true;
+				fn();
+			};
+			child.stdout?.on("data", append);
+			child.stderr?.on("data", append);
+			child.on("error", (error) => {
+				once(() => {
+					if (error.code === "ENOENT") runCandidate(index + 1);
+					else finish({
+						ok: false,
+						exitCode: null,
+						output,
+						error: error.message,
+						errorCode: void 0
+					});
+				});
 			});
-		});
-		child.on("close", (code) => {
-			clearTimeout(timer);
-			resolve({
-				ok: code === 0,
-				exitCode: code,
-				output,
-				error: code === 0 ? void 0 : "pnpm exited with code " + String(code),
-				...code === 0 ? {} : { errorCode: "pnpm-failed" }
+			child.on("close", (code) => {
+				if (settled || finished) return;
+				if (platform === "win32" && code !== 0 && WIN_CMD_MISSING_RE.test(currentOutput)) {
+					runCandidate(index + 1);
+					return;
+				}
+				settled = true;
+				finish({
+					ok: code === 0,
+					exitCode: code,
+					output,
+					error: code === 0 ? void 0 : "pnpm exited with code " + String(code),
+					...code === 0 ? {} : { errorCode: "pnpm-failed" }
+				});
 			});
-		});
+		};
+		runCandidate(0);
 	});
 }
 //#endregion

package/lib/mobile.js

@@ -12770,6 +12770,12 @@ function browserSource(url) {
 }
 const DEFAULT_POLL_INTERVAL_MS = 3e3;
 const DEFAULT_STALL_THRESHOLD_MS = 12e3;
+/**
+* Stall-check granularity: the single scheduler tick runs at least this
+* often so fallback arms within a second of the stall threshold passing,
+* while the poll cadence itself stays {@link MuxClientOptions.pollIntervalMs}.
+*/
+const STALL_CHECK_MS = 1e3;
 /** Poll window: enough recent events to cover a few seconds of agent output. */
 const DEFAULT_POLL_PAGE_SIZE = 50;
 /**
@@ -12800,9 +12806,11 @@ var MuxClient = class {
 	sseAlive = false;
 	/** Per-session highest event seq already emitted, for poll dedup. */
 	pollWatermark = /* @__PURE__ */ new Map();
-	stallTimer;
-	pollTimer;
+	/** Single scheduler tick: both the stall check and the poll cadence ride this one interval. */
+	tickTimer;
 	polling = false;
+	/** Epoch ms of the next due poll while polling (kept on the same tick timer). */
+	nextPollAt = 0;
 	/**
 	* @param url - the mobile events endpoint (browser-relative).
 	* @param options - seams.
@@ -12820,15 +12828,16 @@ var MuxClient = class {
 		this.stopped = false;
 		this.lastDataAt = this.now();
 		if (this.source === void 0) this.connect();
-		this.startStallChecker();
+		this.startTick();
 	}
 	/** Close for good. */
 	stop() {
 		this.stopped = true;
-		this.stopStallChecker();
+		this.stopTick();
 		this.stopPolling();
 		this.closeSource();
 		this.observeSessionId = void 0;
+		this.nextPollAt = 0;
 	}
 	/** Subscribe to validated frames; returns an unsubscribe function. */
 	onFrame(listener) {
@@ -12866,36 +12875,46 @@ var MuxClient = class {
 			if (this.observeSessionId !== void 0) this.startPolling();
 		};
 	}
-	startStallChecker() {
-		this.stopStallChecker();
-		this.stallTimer = setInterval(() => {
-			if (this.stopped) return;
-			if (this.observeSessionId === void 0) return;
-			if (this.polling) return;
-			if (this.sseAlive) return;
-			if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
-		}, 1e3);
-	}
-	stopStallChecker() {
-		if (this.stallTimer !== void 0) {
-			clearInterval(this.stallTimer);
-			this.stallTimer = void 0;
+	/**
+	* The single scheduler tick is the only interval this client owns. One
+	* timer (at the finer of the stall-check and poll cadences) both arms the
+	* polling fallback once the stall threshold passes and drives each poll at
+	* {@link MuxClientOptions.pollIntervalMs} — one timer instead of two.
+	*/
+	startTick() {
+		if (this.tickTimer !== void 0) return;
+		const cadence = Math.min(this.pollIntervalMs, STALL_CHECK_MS);
+		this.tickTimer = setInterval(() => {
+			this.tick();
+		}, cadence);
+	}
+	stopTick() {
+		if (this.tickTimer !== void 0) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = void 0;
+		}
+	}
+	tick() {
+		if (this.stopped) return;
+		if (this.observeSessionId === void 0) return;
+		if (this.polling) {
+			if (this.now() >= this.nextPollAt) {
+				this.nextPollAt = this.now() + this.pollIntervalMs;
+				this.pollTick();
+			}
+			return;
 		}
+		if (this.sseAlive) return;
+		if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
 	}
 	startPolling() {
 		if (this.polling || this.stopped) return;
 		this.polling = true;
+		this.nextPollAt = this.now() + this.pollIntervalMs;
 		this.pollTick();
-		this.pollTimer = setInterval(() => {
-			this.pollTick();
-		}, this.pollIntervalMs);
 	}
 	stopPolling() {
 		this.polling = false;
-		if (this.pollTimer !== void 0) {
-			clearInterval(this.pollTimer);
-			this.pollTimer = void 0;
-		}
 	}
 	/**
 	* Fetch the latest history page for the observed session and re-emit any