@linxin666/dsh-remote-web-ui 0.1.14 → 0.1.15

package/lib/index.js

@@ -3,6 +3,7 @@ import { setInterval as setInterval$1 } from "node:timers";
 import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
+import { z as z$1 } from "zod";
 import { readFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -638,6 +639,30 @@ const PAIR_PATHS = {
 	status: "/api/pair/status",
 	events: "/api/pair/events"
 };
+/**
+* /api/pair request payload contracts. Each POST endpoint validates its body
+* against one of these instead of reaching into a hand-parsed object: the
+* control-plane endpoints that carry no meaningful payload use the permissive
+* pairActionPayloadSchema so their smoke calls keep working unchanged, while
+* issue/accept enforce their optional/required fields. Unknown (extra) keys
+* are tolerated exactly as the previous manual reads ignored them.
+*/
+const issuePayloadSchema = z$1.object({
+	workspaceId: z$1.string().min(1).optional(),
+	address: z$1.string().min(1).optional()
+});
+const acceptPayloadSchema = z$1.object({ token: z$1.string().default("") });
+const pairActionPayloadSchema = z$1.object({}).passthrough();
+/**
+* Parse a pair request body through schema. A missing/empty or non-object
+* body is treated as an empty object (the same way the previous manual reads
+* yielded absent fields), and a value that fails the schema returns
+* `undefined` so the caller can answer with the existing error shape.
+*/
+function parsePairPayload(schema, body) {
+	const result = schema.safeParse(body ?? {});
+	return result.success ? result.data : void 0;
+}
 /** One JSON response. */
 function writeJson$1(res, status, body) {
 	const payload = JSON.stringify(body);
@@ -762,8 +787,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const workspaceId = body === void 0 || typeof body.workspaceId !== "string" || body.workspaceId === "" ? void 0 : body.workspaceId;
-		const address = body === void 0 || typeof body.address !== "string" || body.address === "" ? void 0 : body.address;
+		const payload = parsePairPayload(issuePayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const { workspaceId, address } = payload;
 		try {
 			const { token, expiresAt } = service.issue(workspaceId, address);
 			const base = address === void 0 ? service.publicBaseUrl ?? service.lanBaseUrl : service.lanBaseUrlFor(address);
@@ -801,8 +833,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const token = typeof body?.token === "string" ? body.token : "";
-		const result = service.accept(token);
+		const payload = parsePairPayload(acceptPayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const result = service.accept(payload.token);
 		if (!result.ok) {
 			writeJson$1(res, result.code === "used" ? 409 : 404, {
 				ok: false,
@@ -828,7 +867,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		service.stop();
 		writeJson$1(res, 200, { ok: true });
 	};
@@ -841,7 +887,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 		if (deviceId === void 0 || !service.heartbeat(deviceId)) {
 			writeJson$1(res, 401, {
@@ -1008,6 +1061,8 @@ const MOBILE_ALLOWLIST = /* @__PURE__ */ new Set([
 const MOBILE_PREFERENCES_METHOD = "mobile.preferences";
 /** One session.list page (thin phones load incrementally). */
 const SESSION_PAGE_SIZE = 20;
+/** SSE keep-alive ping cadence for the live mux stream (single connection). */
+const DEFAULT_EVENTS_HEARTBEAT_MS = 15e3;
 /** Encode one list position as an opaque continuation cursor. */
 function sessionListCursor(updatedAt, sessionId) {
 	return `${updatedAt}:${sessionId}`;
@@ -1040,6 +1095,7 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 */
 function makeMobileApiRoutes(deps) {
 	const { service, apiProxy, mobileEnterToSend } = deps;
+	const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
 	/** The phone gate: a live paired-device cookie, or nothing else proceeds. */
 	const gateOk = (req) => {
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
@@ -1166,7 +1222,7 @@ function makeMobileApiRoutes(deps) {
 			try {
 				res.write(": ping\n\n");
 			} catch {}
-		}, 15e3);
+		}, eventsHeartbeatMs);
 		const onClose = () => {
 			if (closed) return;
 			closed = true;

package/lib/mobile.js

@@ -12770,6 +12770,12 @@ function browserSource(url) {
 }
 const DEFAULT_POLL_INTERVAL_MS = 3e3;
 const DEFAULT_STALL_THRESHOLD_MS = 12e3;
+/**
+* Stall-check granularity: the single scheduler tick runs at least this
+* often so fallback arms within a second of the stall threshold passing,
+* while the poll cadence itself stays {@link MuxClientOptions.pollIntervalMs}.
+*/
+const STALL_CHECK_MS = 1e3;
 /** Poll window: enough recent events to cover a few seconds of agent output. */
 const DEFAULT_POLL_PAGE_SIZE = 50;
 /**
@@ -12800,9 +12806,11 @@ var MuxClient = class {
 	sseAlive = false;
 	/** Per-session highest event seq already emitted, for poll dedup. */
 	pollWatermark = /* @__PURE__ */ new Map();
-	stallTimer;
-	pollTimer;
+	/** Single scheduler tick: both the stall check and the poll cadence ride this one interval. */
+	tickTimer;
 	polling = false;
+	/** Epoch ms of the next due poll while polling (kept on the same tick timer). */
+	nextPollAt = 0;
 	/**
 	* @param url - the mobile events endpoint (browser-relative).
 	* @param options - seams.
@@ -12820,15 +12828,16 @@ var MuxClient = class {
 		this.stopped = false;
 		this.lastDataAt = this.now();
 		if (this.source === void 0) this.connect();
-		this.startStallChecker();
+		this.startTick();
 	}
 	/** Close for good. */
 	stop() {
 		this.stopped = true;
-		this.stopStallChecker();
+		this.stopTick();
 		this.stopPolling();
 		this.closeSource();
 		this.observeSessionId = void 0;
+		this.nextPollAt = 0;
 	}
 	/** Subscribe to validated frames; returns an unsubscribe function. */
 	onFrame(listener) {
@@ -12866,36 +12875,46 @@ var MuxClient = class {
 			if (this.observeSessionId !== void 0) this.startPolling();
 		};
 	}
-	startStallChecker() {
-		this.stopStallChecker();
-		this.stallTimer = setInterval(() => {
-			if (this.stopped) return;
-			if (this.observeSessionId === void 0) return;
-			if (this.polling) return;
-			if (this.sseAlive) return;
-			if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
-		}, 1e3);
-	}
-	stopStallChecker() {
-		if (this.stallTimer !== void 0) {
-			clearInterval(this.stallTimer);
-			this.stallTimer = void 0;
+	/**
+	* The single scheduler tick is the only interval this client owns. One
+	* timer (at the finer of the stall-check and poll cadences) both arms the
+	* polling fallback once the stall threshold passes and drives each poll at
+	* {@link MuxClientOptions.pollIntervalMs} — one timer instead of two.
+	*/
+	startTick() {
+		if (this.tickTimer !== void 0) return;
+		const cadence = Math.min(this.pollIntervalMs, STALL_CHECK_MS);
+		this.tickTimer = setInterval(() => {
+			this.tick();
+		}, cadence);
+	}
+	stopTick() {
+		if (this.tickTimer !== void 0) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = void 0;
+		}
+	}
+	tick() {
+		if (this.stopped) return;
+		if (this.observeSessionId === void 0) return;
+		if (this.polling) {
+			if (this.now() >= this.nextPollAt) {
+				this.nextPollAt = this.now() + this.pollIntervalMs;
+				this.pollTick();
+			}
+			return;
 		}
+		if (this.sseAlive) return;
+		if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
 	}
 	startPolling() {
 		if (this.polling || this.stopped) return;
 		this.polling = true;
+		this.nextPollAt = this.now() + this.pollIntervalMs;
 		this.pollTick();
-		this.pollTimer = setInterval(() => {
-			this.pollTick();
-		}, this.pollIntervalMs);
 	}
 	stopPolling() {
 		this.polling = false;
-		if (this.pollTimer !== void 0) {
-			clearInterval(this.pollTimer);
-			this.pollTimer = void 0;
-		}
 	}
 	/**
 	* Fetch the latest history page for the observed session and re-emit any