@linxin666/dsh-remote-web-ui 0.1.16 → 0.1.18

package/lib/types/mobile/views/ChatView.test.js

@@ -461,3 +461,108 @@ describe('ChatView scrolling', () => {
         await waitFor(() => { expect(scrollWrites.length).toBe(writesBefore); });
     });
 });
+describe('ChatView display toggles and context usage', () => {
+    /** jsdom in this setup ships a bare localStorage object; install a real fake. */
+    const makeStorage = () => {
+        const map = new Map();
+        return {
+            getItem: (key) => map.get(key) ?? null,
+            setItem: (key, value) => { map.set(key, value); },
+            removeItem: (key) => { map.delete(key); },
+            clear: () => { map.clear(); },
+            key: (index) => [...map.keys()][index] ?? null,
+            get length() { return map.size; },
+        };
+    };
+    /** A user/message whose source.kind is 'plugin' (injected system message). */
+    const systemEvents = () => [
+        makeEntry('user/message', {
+            id: 'u-plugin',
+            role: 'user',
+            content: [{ type: 'text', text: '系统注入消息' }],
+            source: { kind: 'plugin', name: 'react-extension' },
+        }, 0),
+        makeEntry('user/message', { id: 'u-1', role: 'user', content: [{ type: 'text', text: '普通消息' }] }, 1),
+    ];
+    const toolEvents = () => [
+        makeEntry('user/message', { id: 'u-1', role: 'user', content: [{ type: 'text', text: '改文件' }] }, 0),
+        makeEntry('assistant/message', {
+            turn: 0,
+            step: 0,
+            message: { id: 'a-1', role: 'assistant', content: [{ type: 'text', text: '完成' }] },
+        }, 1),
+        makeEntry('tool/call', { turn: 0, step: 0, callId: 'c1', name: 'bash', arguments: '{}' }, 2),
+    ];
+    beforeEach(() => {
+        vi.stubGlobal('localStorage', makeStorage());
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+    it('hides injected user messages by default and reveals them via the display sheet', async () => {
+        loadHistoryMock.mockResolvedValue(historyPage(systemEvents()));
+        render(_jsx(ChatView, { session: session, onBack: () => { } }));
+        // The plugin-injected message is hidden by default; the real user message shows.
+        expect(await screen.findByText('普通消息')).toBeTruthy();
+        expect(screen.queryByText('系统注入消息')).toBeNull();
+        // Open the display sheet and flip the system-message switch on.
+        fireEvent.click(screen.getByRole('button', { name: /显示/ }));
+        const systemSwitch = await screen.findByRole('switch', { name: '系统提示词' });
+        expect(systemSwitch.getAttribute('aria-checked')).toBe('false');
+        fireEvent.click(systemSwitch);
+        expect(await screen.findByText('系统注入消息')).toBeTruthy();
+        // Flip it back off: the injected row disappears again.
+        const systemSwitchAfter = screen.getByRole('switch', { name: '系统提示词' });
+        expect(systemSwitchAfter.getAttribute('aria-checked')).toBe('true');
+        fireEvent.click(systemSwitchAfter);
+        expect(screen.queryByText('系统注入消息')).toBeNull();
+    });
+    it('hides the tool disclosure when the tool-call toggle is off', async () => {
+        loadHistoryMock.mockResolvedValue(historyPage(toolEvents()));
+        render(_jsx(ChatView, { session: session, onBack: () => { } }));
+        // Tool disclosure visible by default.
+        expect(await screen.findByRole('button', { name: /工具/ })).toBeTruthy();
+        fireEvent.click(screen.getByRole('button', { name: /显示/ }));
+        const toolSwitch = await screen.findByRole('switch', { name: '工具调用' });
+        expect(toolSwitch.getAttribute('aria-checked')).toBe('true');
+        fireEvent.click(toolSwitch);
+        // The disclosure is gone while reasoning/text remain.
+        expect(screen.queryByRole('button', { name: /工具/ })).toBeNull();
+        expect(screen.getByText('完成')).toBeTruthy();
+    });
+    it('renders the context usage chip from request/context plus assistant usage', async () => {
+        loadHistoryMock.mockResolvedValue(historyPage([
+            makeEntry('request/context', { provider: 'fx', model: 'fx-1', contextWindow: 100_000 }, 0),
+            makeEntry('user/message', { id: 'u-1', role: 'user', content: [{ type: 'text', text: 'hi' }] }, 1),
+            makeEntry('assistant/message', {
+                turn: 0,
+                step: 0,
+                message: { id: 'a-1', role: 'assistant', content: [{ type: 'text', text: 'ok' }] },
+                usage: { inputTokens: 30_000, outputTokens: 1_000 },
+            }, 2),
+        ]));
+        render(_jsx(ChatView, { session: session, onBack: () => { } }));
+        expect(await screen.findByText('上下文 30%')).toBeTruthy();
+    });
+    it('adds the warn class when context usage is at or above 80%', async () => {
+        loadHistoryMock.mockResolvedValue(historyPage([
+            makeEntry('request/context', { provider: 'fx', model: 'fx-1', contextWindow: 100_000 }, 0),
+            makeEntry('user/message', { id: 'u-1', role: 'user', content: [{ type: 'text', text: 'hi' }] }, 1),
+            makeEntry('assistant/message', {
+                turn: 0,
+                step: 0,
+                message: { id: 'a-1', role: 'assistant', content: [{ type: 'text', text: 'ok' }] },
+                usage: { inputTokens: 80_000, outputTokens: 0 },
+            }, 2),
+        ]));
+        render(_jsx(ChatView, { session: session, onBack: () => { } }));
+        const chip = await screen.findByText('上下文 80%');
+        expect(chip.className).toContain('chat-context-warn');
+    });
+    it('renders no context chip when there is no usage/context data', async () => {
+        loadHistoryMock.mockResolvedValue(historyPage(turnEvents()));
+        render(_jsx(ChatView, { session: session, onBack: () => { } }));
+        await screen.findByText('已完成修改');
+        expect(screen.queryByText(/上下文/)).toBeNull();
+    });
+});

package/lib/types/mobile-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA4HnE"}
+{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA6InE"}

package/lib/types/mobile-api.js

@@ -77,10 +77,23 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 export function makeMobileApiRoutes(deps) {
     const { service, apiProxy, mobileEnterToSend } = deps;
     const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
+    /**
+     * Refresh the paired device's presence and report whether it is live.
+     * The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
+     * sender, so any activity on the mobile channel — a gated RPC, or the live
+     * SSE stream staying open — must count as presence. Without this, an
+     * idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
+     * wrongly reports it as disconnected.
+     */
+    const touchDeviceFor = (req) => {
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined)
+            return false;
+        return service.touchDevice(deviceId);
+    };
     /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
     const gateOk = (req) => {
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        return deviceId !== undefined && service.hasDevice(deviceId);
+        return touchDeviceFor(req);
     };
     const writeJson = (res, status, body) => {
         res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
@@ -164,6 +177,10 @@ export function makeMobileApiRoutes(deps) {
         const heartbeat = setInterval(() => {
             if (closed)
                 return;
+            // An open SSE stream proves the phone is still live even while the agent
+            // idles (no RPC traffic), so refresh presence alongside the transport
+            // keepalive — otherwise an idle phone drifts to "disconnected".
+            touchDeviceFor(req);
             try {
                 res.write(': ping\n\n');
             }

package/lib/types/mobile-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAqC/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAqB7C"}
+{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAwD/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAmC7C"}

package/lib/types/mobile-routes.js

@@ -14,6 +14,10 @@ import { fileURLToPath } from 'node:url';
 function mobileBundlePath() {
     return fileURLToPath(new URL('../lib/mobile.js', import.meta.url));
 }
+/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
+function appleTouchIconPath() {
+    return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url));
+}
 /** The mobile page shell: minimal, offline-safe, no external assets. */
 function pageHtml(bundleUrl) {
     return [
@@ -24,6 +28,10 @@ function pageHtml(bundleUrl) {
         '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
         '<meta name="theme-color" content="#f3f5f9">',
         '<meta name="referrer" content="no-referrer">',
+        // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
+        // the PNG ships with the package (opaque background — iOS composites
+        // transparency onto black, so the icon avoids transparent regions).
+        '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
         '<title>移动端远程控制</title>',
         '</head>',
         '<body>',
@@ -42,6 +50,15 @@ function writeStatic(res, status, type, body) {
     });
     res.end(body);
 }
+/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+function writePng(res, status, body) {
+    res.writeHead(status, {
+        'content-type': 'image/png',
+        'cache-control': 'public, max-age=31536000, immutable',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(body);
+}
 /**
  * Build the mobile page routes.
  * @returns the two exact routes to register on webServer.
@@ -64,8 +81,23 @@ export function makeMobileRoutes() {
             writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
         }
     };
+    const handleIcon = async (_req, res) => {
+        const path = appleTouchIconPath();
+        if (!existsSync(path)) {
+            writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found');
+            return;
+        }
+        try {
+            const body = await readFile(path);
+            writePng(res, 200, body);
+        }
+        catch {
+            writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon');
+        }
+    };
     return [
         { kind: 'exact', path: '/m', handler: handlePage },
         { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
+        { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
     ];
 }

package/lib/types/update.d.ts

@@ -206,9 +206,11 @@ export interface UpdateRunVerifiedDeps {
 }
 /**
  * Run the update, then verify the installed versions actually moved. pnpm
- * exits 0 even when it silently kept the installed versions — the pnpm 11
- * `minimumReleaseAge` gate refuses same-day releases by default — so a green
- * exit alone would report a misleading "update complete". Re-read the
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
  * installed versions afterwards and surface a `stale` failure (with the
  * captured pnpm output) when nothing moved, so the panel can tell the user
  * how to unblock the gate instead of claiming success.

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAqBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAYD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA0HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAqBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAuBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA8HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}

package/lib/types/update.js

@@ -302,6 +302,16 @@ const OUTPUT_CAP = 16 * 1024;
  * detects this message instead of the spawn error event.
  */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+/**
+ * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
+ * silently skips same-day releases — `pnpm update --latest` then exits 0
+ * without moving anything and the post-run verification would misreport a
+ * stale no-op. The update here is explicitly user-initiated and the panel
+ * shows exactly which versions are being installed, so the gate only adds a
+ * confusing silent no-op; override it per-invocation instead of asking every
+ * user to edit the profile's pnpm-workspace.yaml.
+ */
+const MIN_RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
 /**
  * Run the update inside the profile directory. Tries pnpm first, falls back
  * to corepack and then npx when the previous command is missing (ENOENT);
@@ -328,10 +338,14 @@ export function runUpdate(deps) {
         // "0.1.12" without a range), and plain `pnpm update` treats an exact spec
         // as pinned — it prints "Already up to date" and exits 0 without moving
         // the installed version, so the panel would report a false success.
+        // `MIN_RELEASE_AGE_OVERRIDE` rides along every candidate: without it the
+        // pnpm 11 minimumReleaseAge gate (default 24 h) silently keeps same-day
+        // releases in place, which the post-run verification would then have to
+        // surface as `stale` even though the update is legitimate.
         const candidates = [
-            { command: 'pnpm', args: ['update', '--latest', ...packages] },
-            { command: 'corepack', args: ['pnpm', 'update', '--latest', ...packages] },
-            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', ...packages] },
+            { command: 'pnpm', args: ['update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'corepack', args: ['pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
         ];
         // `output` accumulates across candidates for UI display; `currentOutput`
         // is reset per candidate and carries only that candidate's own diagnostics
@@ -444,9 +458,11 @@ export function runUpdate(deps) {
 }
 /**
  * Run the update, then verify the installed versions actually moved. pnpm
- * exits 0 even when it silently kept the installed versions — the pnpm 11
- * `minimumReleaseAge` gate refuses same-day releases by default — so a green
- * exit alone would report a misleading "update complete". Re-read the
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
  * installed versions afterwards and surface a `stale` failure (with the
  * captured pnpm output) when nothing moved, so the panel can tell the user
  * how to unblock the gate instead of claiming success.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -30,6 +30,7 @@
     "lib/**/*.d.ts",
     "lib/**/*.d.ts.map",
     "src",
+    "assets",
     "cordis.patch.yml"
   ],
   "license": "Apache-2.0",

package/src/client/PluginSettingsCard.tsx

@@ -45,6 +45,17 @@ export interface PluginSettingsCardProps<TKey extends string = string> {
   onSave: () => void
   /** Drop every staged edit. */
   onDiscard: () => void
+  /**
+   * Render the controls expanded on arrival (still collapsible). Defaults to
+   * true: promoted first-level sections show their settings immediately.
+   */
+  defaultOpen?: boolean
+  /**
+   * Render without the collapse affordance: a static header and an always
+   * visible body. Used by first-level settings sections whose nav entry
+   * already provides the selection.
+   */
+  alwaysOpen?: boolean
   /** The plugin's controls. */
   children: ReactNode
 }
@@ -55,57 +66,27 @@ export interface PluginSettingsCardProps<TKey extends string = string> {
  * @returns the card, or nothing while the namespace is still loading.
  */
 export function PluginSettingsCard<TKey extends string = string>(props: PluginSettingsCardProps<TKey>) {
-  const [open, setOpen] = useState(false)
-  const { state } = props
+  const [open, setOpen] = useState(props.defaultOpen ?? true)
+  const { state, alwaysOpen } = props
   if (!state.available) return null
   const title = props.t(props.titleKey)
   const description = props.t(props.descriptionKey)
   const blocked = !state.dirty || state.invalid || state.saving
-  const cardClass = open ? `${css.cardOpen} ${css.card}` : css.card
-  // The namespace exists but the Host does not serve it to this client (the
-  // official settings allowlist omits third-party namespaces): show a card
-  // that explains the gap instead of vanishing, so a missing card never
-  // reads as a missing plugin.
-  if (!state.exposed) {
-    return (
-      <li className={cardClass}>
-        <button
-          type="button"
-          className={css.header}
-          aria-expanded={open}
-          aria-label={`${props.t(open ? 'settings.collapse' : 'settings.expand')}: ${title}`}
-          onClick={() => { setOpen(!open) }}
-        >
-          <span className={css.headText}>
-            <span className={css.name} title={title}>{title}</span>
-            <span className={css.description} title={description}>{description}</span>
-          </span>
-          <svg
-            width="14"
-            height="14"
-            viewBox="0 0 14 14"
-            fill="none"
-            xmlns="http://www.w3.org/2000/svg"
-            className={open ? `${css.chevron} ${css.chevronOpen}` : css.chevron}
-          >
-            <path
-              d="M11.8486 5.5L11.4238 5.92383L8.69727 8.65137C8.44157 8.90706 8.21562 9.13382 8.01172 9.29785C7.79912 9.46883 7.55595 9.61756 7.25 9.66602C7.08435 9.69222 6.91565 9.69222 6.75 9.66602C6.44405 9.61756 6.20088 9.46883 5.98828 9.29785C5.78438 9.13382 5.55843 8.90706 5.30273 8.65137L2.57617 5.92383L2.15137 5.5L3 4.65137L3.42383 5.07617L6.15137 7.80273C6.42595 8.07732 6.59876 8.24849 6.74023 8.3623C6.87291 8.46904 6.92272 8.47813 6.9375 8.48047C6.97895 8.48703 7.02105 8.48703 7.0625 8.48047C7.07728 8.47813 7.12709 8.46904 7.25977 8.3623C7.40124 8.24849 7.57405 8.07732 7.84863 7.80273L10.5762 5.07617L11 4.65137L11.8486 5.5Z"
-              fill="currentColor"
-            />
-          </svg>
-        </button>
-        {open
-          ? (
-            <div className={css.body}>
-              <p className={css.notExposed} role="status">{props.t('settings.notExposed')}</p>
-            </div>
-          )
-          : null}
-      </li>
+  const expanded = alwaysOpen === true || open
+  const cardClass = expanded ? `${css.cardOpen} ${css.card}` : css.card
+  // With alwaysOpen the nav entry already provides the selection, so the
+  // header is a static title row instead of a disclosure button.
+  const header = alwaysOpen === true
+    ? (
+      <div className={css.headerStatic}>
+        <span className={css.headText}>
+          <span className={css.name} title={title}>{title}</span>
+          <span className={css.description} title={description}>{description}</span>
+        </span>
+        {state.dirty ? <span className={css.pending} title={props.t('settings.unsaved')}>{props.t('settings.unsaved')}</span> : null}
+      </div>
     )
-  }
-  return (
-    <li className={cardClass}>
+    : (
       <button
         type="button"
         className={css.header}
@@ -132,7 +113,29 @@ export function PluginSettingsCard<TKey extends string = string>(props: PluginSe
           />
         </svg>
       </button>
-      {open
+    )
+  // The namespace exists but the Host does not serve it to this client (the
+  // official settings allowlist omits third-party namespaces): show a card
+  // that explains the gap instead of vanishing, so a missing card never
+  // reads as a missing plugin.
+  if (!state.exposed) {
+    return (
+      <li className={cardClass}>
+        {header}
+        {expanded
+          ? (
+            <div className={css.body}>
+              <p className={css.notExposed} role="status">{props.t('settings.notExposed')}</p>
+            </div>
+          )
+          : null}
+      </li>
+    )
+  }
+  return (
+    <li className={cardClass}>
+      {header}
+      {expanded
         ? (
           <div className={css.body}>
             {!state.writable ? <p className={css.readOnly} role="status">{props.t('settings.readOnly')}</p> : null}

package/src/client/settings-card.module.css

@@ -42,6 +42,15 @@
   outline-offset: -2px;
 }
 
+.headerStatic {
+  width: 100%;
+  border-radius: 12px;
+  align-items: center;
+  gap: 12px;
+  padding: 14px 16px;
+  display: flex;
+}
+
 .headText {
   flex-direction: column;
   flex: 1;

package/src/mobile/markdown.test.ts

@@ -0,0 +1,77 @@
+/**
+ * Mobile markdown renderer tests: GFM subset coverage plus the security
+ * contract — raw HTML escapes, dangerous link/image protocols are
+ * stripped, and code fences never parse their content.
+ */
+import { describe, expect, it } from 'vitest'
+import { escapeHtml, renderInline, renderMarkdown, safeUrl } from './markdown.ts'
+
+describe('safeUrl', () => {
+  it('allows http/https/mailto/fragments and scheme-less targets', () => {
+    expect(safeUrl('https://example.com/a')).toBe('https://example.com/a')
+    expect(safeUrl('http://example.com')).toBe('http://example.com')
+    expect(safeUrl('mailto:a@b.c')).toBe('mailto:a@b.c')
+    expect(safeUrl('#top')).toBe('#top')
+    expect(safeUrl('./rel/path')).toBe('./rel/path')
+  })
+
+  it('rejects javascript:/data:/vbscript: and blanks', () => {
+    expect(safeUrl('javascript:alert(1)')).toBeNull()
+    expect(safeUrl('data:text/html,x')).toBeNull()
+    expect(safeUrl('vbscript:x')).toBeNull()
+    expect(safeUrl('')).toBeNull()
+    expect(safeUrl('   ')).toBeNull()
+  })
+})
+
+describe('renderInline', () => {
+  it('renders code, bold, italic, strikethrough and links', () => {
+    expect(renderInline('`a<b`')).toBe('<code>a&lt;b</code>')
+    expect(renderInline('**b**')).toBe('<strong>b</strong>')
+    expect(renderInline('*i*')).toBe('<em>i</em>')
+    expect(renderInline('~~d~~')).toBe('<del>d</del>')
+    expect(renderInline('[x](https://e.com)')).toBe('<a href="https://e.com" target="_blank" rel="noopener noreferrer">x</a>')
+  })
+
+  it('strips unsafe link targets and renders the label as plain text', () => {
+    expect(renderInline('[x](javascript:alert(1))')).toBe('x')
+    expect(renderInline('![a](data:text/html,x)')).toBe('a')
+  })
+
+  it('escapes raw HTML instead of passing it through', () => {
+    expect(renderInline('<script>alert(1)</script>')).toBe('&lt;script&gt;alert(1)&lt;/script&gt;')
+  })
+})
+
+describe('renderMarkdown', () => {
+  it('renders headings, hr, paragraphs', () => {
+    const html = renderMarkdown('# T\n\npara\n\n---')
+    expect(html).toContain('<h1>T</h1>')
+    expect(html).toContain('<p>para</p>')
+    expect(html).toContain('<hr />')
+  })
+
+  it('renders fenced code without parsing its content', () => {
+    const html = renderMarkdown('```ts\nconst a = **bold** <x>\n```')
+    expect(html).toBe('<pre class="language-ts"><code>const a = **bold** &lt;x&gt;</code></pre>')
+  })
+
+  it('renders lists, blockquotes and tables', () => {
+    const html = renderMarkdown('- a\n- b\n\n1. x\n2. y\n\n> quote\n\n| h1 | h2 |\n| --- | --- |\n| c1 | c2 |')
+    expect(html).toContain('<ul><li>a</li><li>b</li></ul>')
+    expect(html).toContain('<ol><li>x</li><li>y</li></ol>')
+    expect(html).toContain('<blockquote><p>quote</p></blockquote>')
+    expect(html).toContain('<thead><tr><th>h1</th><th>h2</th></tr></thead>')
+    expect(html).toContain('<td>c1</td><td>c2</td>')
+  })
+
+  it('normalizes CRLF and keeps user-visible text intact', () => {
+    expect(renderMarkdown('a\r\nb')).toBe('<p>a\nb</p>')
+  })
+})
+
+describe('escapeHtml', () => {
+  it('escapes all five HTML-significant characters', () => {
+    expect(escapeHtml('<&>"\'')).toBe('&lt;&amp;&gt;&quot;&#39;')
+  })
+})