@linxin666/dsh-remote-web-ui 0.1.14 → 0.1.16

package/lib/index.js

@@ -3,6 +3,7 @@ import { setInterval as setInterval$1 } from "node:timers";
 import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
+import { z as z$1 } from "zod";
 import { readFile } from "node:fs/promises";
 import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -638,6 +639,30 @@ const PAIR_PATHS = {
 	status: "/api/pair/status",
 	events: "/api/pair/events"
 };
+/**
+* /api/pair request payload contracts. Each POST endpoint validates its body
+* against one of these instead of reaching into a hand-parsed object: the
+* control-plane endpoints that carry no meaningful payload use the permissive
+* pairActionPayloadSchema so their smoke calls keep working unchanged, while
+* issue/accept enforce their optional/required fields. Unknown (extra) keys
+* are tolerated exactly as the previous manual reads ignored them.
+*/
+const issuePayloadSchema = z$1.object({
+	workspaceId: z$1.string().min(1).optional(),
+	address: z$1.string().min(1).optional()
+});
+const acceptPayloadSchema = z$1.object({ token: z$1.string().default("") });
+const pairActionPayloadSchema = z$1.object({}).passthrough();
+/**
+* Parse a pair request body through schema. A missing/empty or non-object
+* body is treated as an empty object (the same way the previous manual reads
+* yielded absent fields), and a value that fails the schema returns
+* `undefined` so the caller can answer with the existing error shape.
+*/
+function parsePairPayload(schema, body) {
+	const result = schema.safeParse(body ?? {});
+	return result.success ? result.data : void 0;
+}
 /** One JSON response. */
 function writeJson$1(res, status, body) {
 	const payload = JSON.stringify(body);
@@ -762,8 +787,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const workspaceId = body === void 0 || typeof body.workspaceId !== "string" || body.workspaceId === "" ? void 0 : body.workspaceId;
-		const address = body === void 0 || typeof body.address !== "string" || body.address === "" ? void 0 : body.address;
+		const payload = parsePairPayload(issuePayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const { workspaceId, address } = payload;
 		try {
 			const { token, expiresAt } = service.issue(workspaceId, address);
 			const base = address === void 0 ? service.publicBaseUrl ?? service.lanBaseUrl : service.lanBaseUrlFor(address);
@@ -801,8 +833,15 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody$1(req);
-		const token = typeof body?.token === "string" ? body.token : "";
-		const result = service.accept(token);
+		const payload = parsePairPayload(acceptPayloadSchema, body);
+		if (payload === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
+		const result = service.accept(payload.token);
 		if (!result.ok) {
 			writeJson$1(res, result.code === "used" ? 409 : 404, {
 				ok: false,
@@ -828,7 +867,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		service.stop();
 		writeJson$1(res, 200, { ok: true });
 	};
@@ -841,7 +887,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		await readJsonBody$1(req);
+		const body = await readJsonBody$1(req);
+		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
+			writeJson$1(res, 400, {
+				ok: false,
+				code: "bad-payload"
+			});
+			return;
+		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 		if (deviceId === void 0 || !service.heartbeat(deviceId)) {
 			writeJson$1(res, 401, {
@@ -1008,6 +1061,8 @@ const MOBILE_ALLOWLIST = /* @__PURE__ */ new Set([
 const MOBILE_PREFERENCES_METHOD = "mobile.preferences";
 /** One session.list page (thin phones load incrementally). */
 const SESSION_PAGE_SIZE = 20;
+/** SSE keep-alive ping cadence for the live mux stream (single connection). */
+const DEFAULT_EVENTS_HEARTBEAT_MS = 15e3;
 /** Encode one list position as an opaque continuation cursor. */
 function sessionListCursor(updatedAt, sessionId) {
 	return `${updatedAt}:${sessionId}`;
@@ -1040,6 +1095,7 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 */
 function makeMobileApiRoutes(deps) {
 	const { service, apiProxy, mobileEnterToSend } = deps;
+	const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
 	/** The phone gate: a live paired-device cookie, or nothing else proceeds. */
 	const gateOk = (req) => {
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
@@ -1166,7 +1222,7 @@ function makeMobileApiRoutes(deps) {
 			try {
 				res.write(": ping\n\n");
 			} catch {}
-		}, 15e3);
+		}, eventsHeartbeatMs);
 		const onClose = () => {
 			if (closed) return;
 			closed = true;
@@ -1577,13 +1633,16 @@ function isLinkedSpec(spec) {
 }
 /**
 * Resolve the anchor package's manifest path. The aggregate package is the
-* canonical entry point; this plugin's own package is the fallback.
+* canonical entry point; this plugin's own package is the fallback. Both a
+* throwing resolve and an undefined return mean "not installed" and move on
+* to the next candidate.
 * @param resolve - a Node resolve implementation scoped to the host process.
 * @returns the absolute manifest path, or undefined when neither is installed.
 */
 function resolveAnchorManifest(resolve) {
 	for (const name of [AGGREGATE_PACKAGE, SELF_PACKAGE]) try {
-		return resolve(name + "/package.json");
+		const path = resolve(name + "/package.json");
+		if (path !== void 0) return path;
 	} catch {}
 }
 /**
@@ -1645,14 +1704,21 @@ async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
 		return;
 	}
 }
+/**
+* Sentinel for an installed version that could not be read (missing manifest
+* or resolve failure). It is a real-looking version so `checkUpdates` can
+* render the affected row, but the verified-update comparison must never
+* treat it as evidence — a read failure is not a version that "moved".
+*/
+const VERSION_UNKNOWN = "0.0.0";
 /** The resolved current version of one family package (probe failure tolerated). */
 function readInstalledVersion(resolve, name) {
 	try {
 		const path = resolve(name + "/package.json");
 		const version = path === void 0 ? void 0 : readManifest(path)?.version;
-		return typeof version === "string" ? version : "0.0.0";
+		return typeof version === "string" ? version : VERSION_UNKNOWN;
 	} catch {
-		return "0.0.0";
+		return VERSION_UNKNOWN;
 	}
 }
 /**
@@ -1744,13 +1810,18 @@ function runUpdate(deps) {
 		const candidates = [
 			{
 				command: "pnpm",
-				args: ["update", ...packages]
+				args: [
+					"update",
+					"--latest",
+					...packages
+				]
 			},
 			{
 				command: "corepack",
 				args: [
 					"pnpm",
 					"update",
+					"--latest",
 					...packages
 				]
 			},
@@ -1760,6 +1831,7 @@ function runUpdate(deps) {
 					"--yes",
 					"pnpm",
 					"update",
+					"--latest",
 					...packages
 				]
 			}
@@ -1856,6 +1928,70 @@ function runUpdate(deps) {
 		runCandidate(0);
 	});
 }
+/**
+* Run the update, then verify the installed versions actually moved. pnpm
+* exits 0 even when it silently kept the installed versions — the pnpm 11
+* `minimumReleaseAge` gate refuses same-day releases by default — so a green
+* exit alone would report a misleading "update complete". Re-read the
+* installed versions afterwards and surface a `stale` failure (with the
+* captured pnpm output) when nothing moved, so the panel can tell the user
+* how to unblock the gate instead of claiming success.
+*
+* The stale decision anchors on the pre-run installed versions, not on the
+* registry latest: under a lenient gate pnpm may move 0.1.12 -> 0.1.13 while
+* latest stays 0.1.15 — that is a real update, not stale. The post-run anchor
+* path is re-resolved rather than reused from boot time: pnpm removes the old
+* version's .pnpm directory on update, so a boot-time captured path would
+* fail to read and collapse a successful update into a bogus 'missing'.
+*
+* A green exit whose verification has nothing to compare (registry probe
+* outage, missing anchor, non-npm mode) is reported as `verify-failed` — it
+* must never read as success. A green exit where no package moved but the
+* post-run check could not prove the install is fully current (a partial
+* probe failure hides whether a gate kept something back) is also
+* `verify-failed`: it must not collapse into a success either.
+* @param deps - the run and check seams.
+* @returns the run result; `stale` when exit 0 left every version in place,
+* `verify-failed` when the post-run check could not verify anything.
+*/
+async function runUpdateVerified(deps) {
+	const before = /* @__PURE__ */ new Map();
+	for (const name of deps.run.packages) {
+		const version = readInstalledVersion(deps.check.resolve, name);
+		if (version !== VERSION_UNKNOWN) before.set(name, version);
+	}
+	const result = await runUpdate(deps.run);
+	if (!result.ok) return result;
+	const anchorManifestPath = resolveAnchorManifest(deps.check.resolve) ?? deps.check.anchorManifestPath;
+	const status = await checkUpdates({
+		...deps.check,
+		anchorManifestPath
+	});
+	if (status.error !== void 0 || status.mode !== "npm") return {
+		...result,
+		ok: false,
+		errorCode: "verify-failed",
+		error: "pnpm exited 0 but the post-run version check could not verify the install"
+	};
+	if (status.packages.some((packageStatus) => {
+		const beforeVersion = before.get(packageStatus.name);
+		if (beforeVersion === void 0 || packageStatus.current === VERSION_UNKNOWN) return false;
+		return packageStatus.current !== beforeVersion;
+	})) return result;
+	if (status.outdated) return {
+		...result,
+		ok: false,
+		errorCode: "stale",
+		error: "pnpm exited 0 but the installed versions did not change"
+	};
+	if (status.packages.some((packageStatus) => packageStatus.latest === void 0)) return {
+		...result,
+		ok: false,
+		errorCode: "verify-failed",
+		error: "pnpm exited 0 but the post-run version check could not verify the install"
+	};
+	return result;
+}
 //#endregion
 //#region src/update-routes.ts
 /** Route paths (exact matches under /api). */
@@ -2037,11 +2173,17 @@ function apply(ctx, config) {
 	const apiProxy = ctx.get("apiProxy");
 	if (apiProxy === void 0) console.warn("remote-web-ui: apiProxy service unavailable — the mobile data channel is disabled");
 	const requireFromHost = createRequire(import.meta.url);
-	const anchorManifestPath = resolveAnchorManifest((specifier) => requireFromHost.resolve(specifier));
+	const resolveAnchorPath = () => resolveAnchorManifest((specifier) => {
+		try {
+			return requireFromHost.resolve(specifier);
+		} catch {
+			return;
+		}
+	});
 	const updateRoutes = makeUpdateRoutes({
 		fence: (request) => isTrustedApiRequest(request, []),
 		check: () => checkUpdates({
-			anchorManifestPath,
+			anchorManifestPath: resolveAnchorPath(),
 			resolve: (specifier) => {
 				try {
 					return requireFromHost.resolve(specifier);
@@ -2052,7 +2194,7 @@ function apply(ctx, config) {
 			fetchLatest: (name) => fetchLatestVersion(name, fetch)
 		}),
 		run: async () => {
-			const target = resolveUpdateTarget({ anchorManifestPath });
+			const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() });
 			if ("error" in target) {
 				const code = target.error;
 				return {
@@ -2063,9 +2205,22 @@ function apply(ctx, config) {
 					errorCode: code
 				};
 			}
-			return runUpdate({
-				profileDir: target.profileDir,
-				packages: target.packages
+			return runUpdateVerified({
+				run: {
+					profileDir: target.profileDir,
+					packages: target.packages
+				},
+				check: {
+					anchorManifestPath: resolveAnchorPath(),
+					resolve: (specifier) => {
+						try {
+							return requireFromHost.resolve(specifier);
+						} catch {
+							return;
+						}
+					},
+					fetchLatest: (name) => fetchLatestVersion(name, fetch)
+				}
 			});
 		}
 	});

package/lib/mobile.js

@@ -12770,6 +12770,12 @@ function browserSource(url) {
 }
 const DEFAULT_POLL_INTERVAL_MS = 3e3;
 const DEFAULT_STALL_THRESHOLD_MS = 12e3;
+/**
+* Stall-check granularity: the single scheduler tick runs at least this
+* often so fallback arms within a second of the stall threshold passing,
+* while the poll cadence itself stays {@link MuxClientOptions.pollIntervalMs}.
+*/
+const STALL_CHECK_MS = 1e3;
 /** Poll window: enough recent events to cover a few seconds of agent output. */
 const DEFAULT_POLL_PAGE_SIZE = 50;
 /**
@@ -12800,9 +12806,11 @@ var MuxClient = class {
 	sseAlive = false;
 	/** Per-session highest event seq already emitted, for poll dedup. */
 	pollWatermark = /* @__PURE__ */ new Map();
-	stallTimer;
-	pollTimer;
+	/** Single scheduler tick: both the stall check and the poll cadence ride this one interval. */
+	tickTimer;
 	polling = false;
+	/** Epoch ms of the next due poll while polling (kept on the same tick timer). */
+	nextPollAt = 0;
 	/**
 	* @param url - the mobile events endpoint (browser-relative).
 	* @param options - seams.
@@ -12820,15 +12828,16 @@ var MuxClient = class {
 		this.stopped = false;
 		this.lastDataAt = this.now();
 		if (this.source === void 0) this.connect();
-		this.startStallChecker();
+		this.startTick();
 	}
 	/** Close for good. */
 	stop() {
 		this.stopped = true;
-		this.stopStallChecker();
+		this.stopTick();
 		this.stopPolling();
 		this.closeSource();
 		this.observeSessionId = void 0;
+		this.nextPollAt = 0;
 	}
 	/** Subscribe to validated frames; returns an unsubscribe function. */
 	onFrame(listener) {
@@ -12866,36 +12875,46 @@ var MuxClient = class {
 			if (this.observeSessionId !== void 0) this.startPolling();
 		};
 	}
-	startStallChecker() {
-		this.stopStallChecker();
-		this.stallTimer = setInterval(() => {
-			if (this.stopped) return;
-			if (this.observeSessionId === void 0) return;
-			if (this.polling) return;
-			if (this.sseAlive) return;
-			if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
-		}, 1e3);
-	}
-	stopStallChecker() {
-		if (this.stallTimer !== void 0) {
-			clearInterval(this.stallTimer);
-			this.stallTimer = void 0;
+	/**
+	* The single scheduler tick is the only interval this client owns. One
+	* timer (at the finer of the stall-check and poll cadences) both arms the
+	* polling fallback once the stall threshold passes and drives each poll at
+	* {@link MuxClientOptions.pollIntervalMs} — one timer instead of two.
+	*/
+	startTick() {
+		if (this.tickTimer !== void 0) return;
+		const cadence = Math.min(this.pollIntervalMs, STALL_CHECK_MS);
+		this.tickTimer = setInterval(() => {
+			this.tick();
+		}, cadence);
+	}
+	stopTick() {
+		if (this.tickTimer !== void 0) {
+			clearInterval(this.tickTimer);
+			this.tickTimer = void 0;
+		}
+	}
+	tick() {
+		if (this.stopped) return;
+		if (this.observeSessionId === void 0) return;
+		if (this.polling) {
+			if (this.now() >= this.nextPollAt) {
+				this.nextPollAt = this.now() + this.pollIntervalMs;
+				this.pollTick();
+			}
+			return;
 		}
+		if (this.sseAlive) return;
+		if (this.now() - this.lastDataAt > this.stallThresholdMs) this.startPolling();
 	}
 	startPolling() {
 		if (this.polling || this.stopped) return;
 		this.polling = true;
+		this.nextPollAt = this.now() + this.pollIntervalMs;
 		this.pollTick();
-		this.pollTimer = setInterval(() => {
-			this.pollTick();
-		}, this.pollIntervalMs);
 	}
 	stopPolling() {
 		this.polling = false;
-		if (this.pollTimer !== void 0) {
-			clearInterval(this.pollTimer);
-			this.pollTimer = void 0;
-		}
 	}
 	/**
 	* Fetch the latest history page for the observed session and re-emit any