@linxin666/dsh-remote-web-ui 0.1.13 → 0.1.15

package/lib/types/mobile-api.js

@@ -40,6 +40,8 @@ const MOBILE_ALLOWLIST = new Set([
 const MOBILE_PREFERENCES_METHOD = 'mobile.preferences';
 /** One session.list page (thin phones load incrementally). */
 const SESSION_PAGE_SIZE = 20;
+/** SSE keep-alive ping cadence for the live mux stream (single connection). */
+const DEFAULT_EVENTS_HEARTBEAT_MS = 15_000;
 /** Encode one list position as an opaque continuation cursor. */
 function sessionListCursor(updatedAt, sessionId) {
     return `${updatedAt}:${sessionId}`;
@@ -74,6 +76,7 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
  */
 export function makeMobileApiRoutes(deps) {
     const { service, apiProxy, mobileEnterToSend } = deps;
+    const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
     /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
     const gateOk = (req) => {
         const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
@@ -167,7 +170,7 @@ export function makeMobileApiRoutes(deps) {
             catch {
                 // The write failed; the close handler tears the subscription down.
             }
-        }, 15_000);
+        }, eventsHeartbeatMs);
         const onClose = () => {
             if (closed)
                 return;

package/lib/types/routes.d.ts

@@ -9,6 +9,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
+import { z } from 'zod';
 import { type PairingService, type PairingSnapshot } from './pairing.ts';
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
@@ -43,6 +44,22 @@ export declare const PAIR_PATHS: {
     readonly status: "/api/pair/status";
     readonly events: "/api/pair/events";
 };
+/**
+ * /api/pair request payload contracts. Each POST endpoint validates its body
+ * against one of these instead of reaching into a hand-parsed object: the
+ * control-plane endpoints that carry no meaningful payload use the permissive
+ * pairActionPayloadSchema so their smoke calls keep working unchanged, while
+ * issue/accept enforce their optional/required fields. Unknown (extra) keys
+ * are tolerated exactly as the previous manual reads ignored them.
+ */
+export declare const issuePayloadSchema: z.ZodObject<{
+    workspaceId: z.ZodOptional<z.ZodString>;
+    address: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const acceptPayloadSchema: z.ZodObject<{
+    token: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export declare const pairActionPayloadSchema: z.ZodObject<{}, z.core.$loose>;
 /** The SSE fan-out for desktop panel status. */
 export declare class PairingEventsStream {
     private readonly streams;

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAGhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAiCV,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAgK3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAGhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;CAOb,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA4CjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CA4K3D"}

package/lib/types/routes.js

@@ -7,6 +7,7 @@
  * cookie set on accept is the device identity the api/gate listener checks
  * on every other /api request.
  */
+import { z } from 'zod';
 import { UnknownLanAddressError } from "./pairing.js";
 import { isLoopbackClient, readCookie } from "./gate.js";
 /**
@@ -90,6 +91,32 @@ export const PAIR_PATHS = {
     status: '/api/pair/status',
     events: '/api/pair/events',
 };
+/**
+ * /api/pair request payload contracts. Each POST endpoint validates its body
+ * against one of these instead of reaching into a hand-parsed object: the
+ * control-plane endpoints that carry no meaningful payload use the permissive
+ * pairActionPayloadSchema so their smoke calls keep working unchanged, while
+ * issue/accept enforce their optional/required fields. Unknown (extra) keys
+ * are tolerated exactly as the previous manual reads ignored them.
+ */
+export const issuePayloadSchema = z.object({
+    workspaceId: z.string().min(1).optional(),
+    address: z.string().min(1).optional(),
+});
+export const acceptPayloadSchema = z.object({
+    token: z.string().default(''),
+});
+export const pairActionPayloadSchema = z.object({}).passthrough();
+/**
+ * Parse a pair request body through schema. A missing/empty or non-object
+ * body is treated as an empty object (the same way the previous manual reads
+ * yielded absent fields), and a value that fails the schema returns
+ * `undefined` so the caller can answer with the existing error shape.
+ */
+function parsePairPayload(schema, body) {
+    const result = schema.safeParse(body ?? {});
+    return result.success ? result.data : undefined;
+}
 /** One JSON response. */
 function writeJson(res, status, body) {
     const payload = JSON.stringify(body);
@@ -205,12 +232,12 @@ export function makeRoutes(deps) {
             return;
         }
         const body = await readJsonBody(req);
-        const workspaceId = body === undefined || typeof body.workspaceId !== 'string' || body.workspaceId === ''
-            ? undefined
-            : body.workspaceId;
-        const address = body === undefined || typeof body.address !== 'string' || body.address === ''
-            ? undefined
-            : body.address;
+        const payload = parsePairPayload(issuePayloadSchema, body);
+        if (payload === undefined) {
+            writeJson(res, 400, { ok: false, code: 'bad-payload' });
+            return;
+        }
+        const { workspaceId, address } = payload;
         try {
             const { token, expiresAt } = service.issue(workspaceId, address);
             // The default base is the public (tunneled) URL when configured — a
@@ -255,8 +282,12 @@ export function makeRoutes(deps) {
             return;
         }
         const body = await readJsonBody(req);
-        const token = typeof body?.token === 'string' ? body.token : '';
-        const result = service.accept(token);
+        const payload = parsePairPayload(acceptPayloadSchema, body);
+        if (payload === undefined) {
+            writeJson(res, 400, { ok: false, code: 'bad-payload' });
+            return;
+        }
+        const result = service.accept(payload.token);
         if (!result.ok) {
             writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code });
             return;
@@ -276,7 +307,11 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        await readJsonBody(req);
+        const body = await readJsonBody(req);
+        if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
+            writeJson(res, 400, { ok: false, code: 'bad-payload' });
+            return;
+        }
         service.stop();
         writeJson(res, 200, { ok: true });
     };
@@ -287,7 +322,11 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        await readJsonBody(req);
+        const body = await readJsonBody(req);
+        if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
+            writeJson(res, 400, { ok: false, code: 'bad-payload' });
+            return;
+        }
         const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
         if (deviceId === undefined || !service.heartbeat(deviceId)) {
             writeJson(res, 401, { ok: false, code: 'unpaired' });

package/lib/types/update.d.ts

@@ -180,9 +180,13 @@ export interface UpdateRunDeps {
     spawnImpl?: typeof spawn;
     /** Hard timeout; the child is killed on expiry. */
     timeoutMs?: number;
+    /** Platform override (defaults to process.platform; test seam). */
+    platform?: NodeJS.Platform;
 }
 /**
- * Run the update: `pnpm update <packages>` inside the profile directory.
+ * Run the update inside the profile directory. Tries pnpm first, falls back
+ * to corepack and then npx when the previous command is missing (ENOENT);
+ * all candidates share one hard timeout and keep accumulating output.
  * @param deps - profile dir, package list, and spawn/timeout seams.
  * @returns the outcome with captured output.
  */

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,GAAG,SAAS,CASpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAaD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa,CAAA;AAEjB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAKD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAuCvE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GACrC,MAAM,GAAG,SAAS,CASpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAaD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa,CAAA;AAEjB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAYD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAsHvE"}

package/lib/types/update.js

@@ -286,48 +286,144 @@ export async function checkUpdates(deps) {
 /** Cap on captured pnpm output (keeps error payloads bounded). */
 const OUTPUT_CAP = 16 * 1024;
 /**
- * Run the update: `pnpm update <packages>` inside the profile directory.
+ * Windows cmd command-not-found stderr. With shell:true a missing shim
+ * exits with code 1 (cmd cannot report ENOENT), so the fallback chain
+ * detects this message instead of the spawn error event.
+ */
+const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+/**
+ * Run the update inside the profile directory. Tries pnpm first, falls back
+ * to corepack and then npx when the previous command is missing (ENOENT);
+ * all candidates share one hard timeout and keep accumulating output.
  * @param deps - profile dir, package list, and spawn/timeout seams.
  * @returns the outcome with captured output.
  */
 export function runUpdate(deps) {
     return new Promise((resolve) => {
-        const child = (deps.spawnImpl ?? spawn)('pnpm', ['update', ...deps.packages], {
+        const spawnImpl = deps.spawnImpl ?? spawn;
+        const packages = deps.packages;
+        const platform = deps.platform ?? process.platform;
+        // Windows ships pnpm/corepack/npx as .cmd shims; Node's spawn cannot
+        // start .cmd files directly (ENOENT even when installed), so route
+        // them through cmd.exe there. POSIX spawns stay shell-free.
+        const spawnOptions = {
             cwd: deps.profileDir,
             stdio: ['ignore', 'pipe', 'pipe'],
-        });
+            ...(platform === 'win32' ? { shell: true } : {}),
+        };
+        // Ordered fallback chain: each is tried only when the previous one is
+        // missing on PATH (ENOENT on the spawn error event, never on close).
+        const candidates = [
+            { command: 'pnpm', args: ['update', ...packages] },
+            { command: 'corepack', args: ['pnpm', 'update', ...packages] },
+            { command: 'npx', args: ['--yes', 'pnpm', 'update', ...packages] },
+        ];
+        // `output` accumulates across candidates for UI display; `currentOutput`
+        // is reset per candidate and carries only that candidate's own diagnostics
+        // (its tail is subject to OUTPUT_CAP). The win32 missing-command test must
+        // run against `currentOutput` so a previous candidate's 'not recognized'
+        // stderr cannot misclassify a real failure in the next one.
         let output = '';
+        let currentOutput = '';
         const append = (chunk) => {
             output += chunk.toString('utf8');
             if (output.length > OUTPUT_CAP)
                 output = output.slice(output.length - OUTPUT_CAP);
+            currentOutput += chunk.toString('utf8');
+            if (currentOutput.length > OUTPUT_CAP)
+                currentOutput = currentOutput.slice(currentOutput.length - OUTPUT_CAP);
+        };
+        let currentChild;
+        // Terminal guard: once a result is produced the promise is settled and no
+        // further candidate is started (a killed child's late close must not
+        // respawn anything after a timeout resolution).
+        let finished = false;
+        const finish = (result) => {
+            if (finished)
+                return;
+            finished = true;
+            clearTimeout(timer);
+            resolve(result);
         };
-        child.stdout?.on('data', append);
-        child.stderr?.on('data', append);
         const timer = setTimeout(() => {
-            child.kill('SIGTERM');
-            resolve({ ok: false, exitCode: null, output, error: 'update timed out; install process killed', errorCode: 'timeout' });
+            if (finished)
+                return;
+            if (platform === 'win32') {
+                // cmd.exe under shell:true only kills the shell wrapper; kill the whole
+                // process tree best-effort so pnpm/npx do not keep running.
+                const pid = currentChild?.pid;
+                if (pid !== undefined && pid > 0) {
+                    try {
+                        spawnImpl('taskkill', ['/pid', String(pid), '/t', '/f'], { stdio: 'ignore' });
+                    }
+                    catch {
+                        // Best-effort kill; fall through to the timeout result.
+                    }
+                }
+            }
+            else {
+                currentChild?.kill('SIGTERM');
+            }
+            finish({ ok: false, exitCode: null, output, error: 'update timed out; install process killed', errorCode: 'timeout' });
         }, deps.timeoutMs ?? 10 * 60_000);
-        child.on('error', (error) => {
-            clearTimeout(timer);
-            const missing = error.code === 'ENOENT';
-            resolve({
-                ok: false,
-                exitCode: null,
-                output,
-                error: missing ? 'pnpm not found on PATH' : error.message,
-                errorCode: missing ? 'pnpm-missing' : undefined,
+        const runCandidate = (index) => {
+            if (finished)
+                return;
+            if (index >= candidates.length) {
+                finish({
+                    ok: false,
+                    exitCode: null,
+                    output,
+                    error: 'pnpm not found on PATH (tried pnpm, corepack, npx); install pnpm and restart the app',
+                    errorCode: 'pnpm-missing',
+                });
+                return;
+            }
+            const candidate = candidates[index];
+            currentOutput = '';
+            const child = spawnImpl(candidate.command, candidate.args, spawnOptions);
+            currentChild = child;
+            let settled = false;
+            const once = (fn) => {
+                if (settled)
+                    return;
+                settled = true;
+                fn();
+            };
+            child.stdout?.on('data', append);
+            child.stderr?.on('data', append);
+            child.on('error', (error) => {
+                once(() => {
+                    if (error.code === 'ENOENT') {
+                        // Command missing: try the next candidate in the chain.
+                        runCandidate(index + 1);
+                    }
+                    else {
+                        finish({ ok: false, exitCode: null, output, error: error.message, errorCode: undefined });
+                    }
+                });
             });
-        });
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({
-                ok: code === 0,
-                exitCode: code,
-                output,
-                error: code === 0 ? undefined : 'pnpm exited with code ' + String(code),
-                ...(code === 0 ? {} : { errorCode: 'pnpm-failed' }),
+            child.on('close', (code) => {
+                if (settled || finished)
+                    return;
+                // Windows + shell: a missing command reports exit 1 with
+                // 'not recognized' instead of ENOENT — keep the chain going. Checked
+                // against this candidate's own output so a prior fallback's stderr
+                // cannot misclassify a real failure here.
+                if (platform === 'win32' && code !== 0 && WIN_CMD_MISSING_RE.test(currentOutput)) {
+                    runCandidate(index + 1);
+                    return;
+                }
+                settled = true;
+                finish({
+                    ok: code === 0,
+                    exitCode: code,
+                    output,
+                    error: code === 0 ? undefined : 'pnpm exited with code ' + String(code),
+                    ...(code === 0 ? {} : { errorCode: 'pnpm-failed' }),
+                });
             });
-        });
+        };
+        runCandidate(0);
     });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/PluginSettingsCard.tsx

@@ -1,25 +1,44 @@
+// Generated by scripts/sync-shared.mjs from shared/client/settings/PluginSettingsCard.tsx. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
 /**
- * Shared chrome for the plugin settings card: a disclosure header naming the
- * plugin and what its settings govern, the controls inside, and the save that
- * writes them. Renders nothing while the namespace is unavailable — a
+ * Family-shared chrome for plugin settings cards: a disclosure header naming
+ * the plugin and what its settings govern, the controls inside, and the save
+ * that writes them. Renders nothing while the namespace is unavailable — a
  * deployment that does not compose the owning plugin should show no trace of
- * it. Mirrors the official ui-plugin-config PluginCard in a self-contained
- * slice (this package must not depend on a sibling UI package).
+ * it. Inlined into each consumer's client bundle; mirrors the official
+ * ui-plugin-config PluginCard in a self-contained slice.
  */
 
 import { useState, type ReactNode } from 'react'
 import type { CardShell } from './settings-form.ts'
-import type { SettingsCardKey } from './locales.ts'
 import css from './settings-card.module.css'
 
+/** Copy keys the card chrome itself reads; every consumer locale carries this shared vocabulary. */
+export const CARD_COPY_KEYS = [
+  'settings.collapse',
+  'settings.expand',
+  'settings.notExposed',
+  'settings.unsaved',
+  'settings.readOnly',
+  'settings.saveFailed',
+  'settings.discard',
+  'settings.save',
+  'settings.saving',
+] as const
+
+/** Copy key the card chrome itself reads. */
+export type CardCopyKey = (typeof CARD_COPY_KEYS)[number]
+
+/** Key domain for the plugin's own copy (inferred per consumer). */
+export type SettingsCardKey<TKey extends string = string> = TKey | CardCopyKey
+
 /** Card chrome shared by every plugin settings card. */
-export interface PluginSettingsCardProps {
+export interface PluginSettingsCardProps<TKey extends string = string> {
   /** Locale reader for this card's copy. */
-  t: (key: SettingsCardKey) => string
+  t: (key: SettingsCardKey<TKey>, params?: Record<string, string | number>) => string
   /** Locale key of the plugin's name. */
-  titleKey: SettingsCardKey
+  titleKey: TKey
   /** Locale key of the line describing what this plugin's settings govern. */
-  descriptionKey: SettingsCardKey
+  descriptionKey: TKey
   /** The card's form state: availability, writability, and what a save would do. */
   state: CardShell
   /** Write every staged edit. */
@@ -35,11 +54,12 @@ export interface PluginSettingsCardProps {
  * @param props - the plugin's copy keys, its form state, and its controls.
  * @returns the card, or nothing while the namespace is still loading.
  */
-export function PluginSettingsCard(props: PluginSettingsCardProps) {
+export function PluginSettingsCard<TKey extends string = string>(props: PluginSettingsCardProps<TKey>) {
   const [open, setOpen] = useState(false)
   const { state } = props
   if (!state.available) return null
   const title = props.t(props.titleKey)
+  const description = props.t(props.descriptionKey)
   const blocked = !state.dirty || state.invalid || state.saving
   const cardClass = open ? `${css.cardOpen} ${css.card}` : css.card
   // The namespace exists but the Host does not serve it to this client (the
@@ -57,8 +77,8 @@ export function PluginSettingsCard(props: PluginSettingsCardProps) {
           onClick={() => { setOpen(!open) }}
         >
           <span className={css.headText}>
-            <span className={css.name}>{title}</span>
-            <span className={css.description}>{props.t(props.descriptionKey)}</span>
+            <span className={css.name} title={title}>{title}</span>
+            <span className={css.description} title={description}>{description}</span>
           </span>
           <svg
             width="14"
@@ -94,10 +114,10 @@ export function PluginSettingsCard(props: PluginSettingsCardProps) {
         onClick={() => { setOpen(!open) }}
       >
         <span className={css.headText}>
-          <span className={css.name}>{title}</span>
-          <span className={css.description}>{props.t(props.descriptionKey)}</span>
+          <span className={css.name} title={title}>{title}</span>
+          <span className={css.description} title={description}>{description}</span>
         </span>
-        {state.dirty ? <span className={css.pending}>{props.t('settings.unsaved')}</span> : null}
+        {state.dirty ? <span className={css.pending} title={props.t('settings.unsaved')}>{props.t('settings.unsaved')}</span> : null}
         <svg
           width="14"
           height="14"
@@ -259,4 +279,50 @@ export function BooleanField(props: FieldProps & {
       <p className={css.hint}>{props.hint}</p>
     </div>
   )
-}
+}
+
+/** A staged enumerated field rendered as a select. */
+export function ChoiceField(props: FieldProps & {
+  /** Copy for the inherit option (draft text is the empty string). */
+  inheritLabel: string
+  /** Choices rendered in order; `value` is the draft/stored text. */
+  choices: ReadonlyArray<{ value: string; label: string }>
+}) {
+  return (
+    <div className={css.field}>
+      <div className={css.head}>
+        <label className={css.label} htmlFor={props.id}>{props.label}</label>
+        {props.overridden
+          ? (
+            <span className={css.badges}>
+              <span className={css.badge}>{props.overriddenLabel}</span>
+              <button
+                type="button"
+                className={css.reset}
+                disabled={props.disabled}
+                onClick={props.onReset}
+              >
+                {props.resetLabel}
+              </button>
+            </span>
+          )
+          : null}
+      </div>
+      <select
+        id={props.id}
+        className={css.select}
+        value={props.text}
+        disabled={props.disabled}
+        onChange={(event) => { props.onEdit(event.target.value) }}
+      >
+        <option value="">{props.inheritLabel}</option>
+        {props.choices.map(choice => (
+          <option key={choice.value} value={choice.value}>{choice.label}</option>
+        ))}
+      </select>
+      <p className={props.invalid ? css.invalid : css.hint}>
+        {props.invalid ? props.invalidLabel : props.hint}
+      </p>
+    </div>
+  )
+}

package/src/client/locales.ts

@@ -97,7 +97,7 @@ export const zh = {
   'update.packages': '组件版本',
   'update.retry': '重新检查',
   'update.close': '关闭更新面板',
-  'update.error.pnpmMissing': '未找到 pnpm，请先安装 pnpm（brew install pnpm 或 corepack enable）。',
+  'update.error.pnpmMissing': '未找到 pnpm，已尝试 pnpm / corepack / npx 仍不可用。请安装 pnpm 后重启应用（Windows: npm install -g pnpm 或 corepack enable；macOS: brew install pnpm 或 corepack enable）。',
   'update.error.timeout': '更新超时，已终止安装进程，请重试。',
   'update.error.notFound': '未找到 dsh-web-ui 聚合包安装，无法更新。',
   'update.error.link': '当前为本地开发模式（链接安装），无法自动更新。',
@@ -208,7 +208,7 @@ export const en = {
   'update.packages': 'Component versions',
   'update.retry': 'Check again',
   'update.close': 'Close update panel',
-  'update.error.pnpmMissing': 'pnpm was not found. Install it first (brew install pnpm or corepack enable).',
+  'update.error.pnpmMissing': 'pnpm was not found (tried pnpm / corepack / npx). Install pnpm and restart the app (Windows: npm install -g pnpm or corepack enable; macOS: brew install pnpm or corepack enable).',
   'update.error.timeout': 'The update timed out and the install process was killed; try again.',
   'update.error.notFound': 'The dsh-web-ui aggregate package is not installed; nothing to update.',
   'update.error.link': 'Local development mode (link install) — automatic update is unavailable.',

package/src/client/settings-card.module.css

@@ -1,3 +1,4 @@
+/* Generated by scripts/sync-shared.mjs from shared/client/settings/settings-card.module.css. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs". */
 /* Plugin settings card chrome + staged form fields.
  * Aligned with the official ui-settings-plugins PluginCard / fields CSS:
  * same semantic tokens, radius, typography and states so family cards read
@@ -229,6 +230,11 @@
   outline-offset: 2px;
 }
 
+.reset:focus-visible {
+  outline: 2px solid var(--dsw-alias-brand-primary);
+  outline-offset: 2px;
+}
+
 .input,
 .select {
   border: 1px solid var(--dsw-alias-border-l2);