@linxin666/dsh-remote-web-ui 0.1.19 → 0.1.20

package/src/client/RemotePanel.tsx

@@ -16,7 +16,7 @@ import css from './remote.module.css'
 
 /** The panel's view state, owned by the entry component. */
 export type PanelState =
-  | { kind: 'lan-required' }
+  | { kind: 'lan-required'; tunnel?: TunnelStatusFrame }
   | { kind: 'loopback-required' }
   | { kind: 'unreachable' }
   | {

package/src/http.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared HTTP helpers for the route families: one JSON writer and one
+ * bounded JSON body reader. Previously copy-pasted across routes.ts,
+ * update-routes.ts, and mobile-api.ts with drifting failure contracts.
+ */
+
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+/** One JSON response. */
+export function writeJson(res: ServerResponse, status: number, body: unknown): void {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
+  res.end(payload)
+}
+
+/**
+ * Read a request body up to maxBytes and parse it as JSON.
+ * @throws 'body too large' beyond the cap, or the JSON.parse error.
+ */
+export async function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown> {
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) throw new Error('body too large')
+    chunks.push(buffer)
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}

package/src/index.ts

@@ -31,6 +31,7 @@ import {
   type UpdateRunResult,
 } from './update.ts'
 import { makeUpdateRoutes } from './update-routes.ts'
+import { mountOnce } from './mount-once.ts'
 
 declare module '@deepseek-ai/cordis' {
   interface Events {
@@ -147,7 +148,9 @@ const DEFAULTS: ResolvedConfig = {
  * @param ctx - host plugin context carrying webServer.
  * @param config - resolved plugin config (schema defaults applied by the loader).
  */
-export function apply(ctx: Context, config?: Config): void {
+export const apply = mountOnce('@linxin666/dsh-remote-web-ui', applyImpl)
+
+function applyImpl(ctx: Context, config?: Config): void {
   const resolved: ResolvedConfig = {
     tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
     offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,

package/src/mobile/markdown.test.ts

@@ -22,6 +22,11 @@ describe('safeUrl', () => {
     expect(safeUrl('')).toBeNull()
     expect(safeUrl('   ')).toBeNull()
   })
+
+  it('rejects protocol-relative targets that escape the origin', () => {
+    expect(safeUrl('//attacker.example/x')).toBeNull()
+    expect(safeUrl('  //attacker.example/track.png')).toBeNull()
+  })
 })
 
 describe('renderInline', () => {

package/src/mobile/markdown.ts

@@ -22,15 +22,18 @@ export function escapeHtml(text: string): string {
 
 /**
  * Guard a raw link/image target against dangerous protocols. Returns the
- * (trimmed) raw string when safe, else null. Only http:, https:, mailto:
- * and fragment anchors (#...) are allowed; anything with another scheme
- * — javascript:, data:, vbscript:, etc. — is rejected so the value never
- * reaches dangerouslySetInnerHTML.
+ * (trimmed) raw string when safe, else null. Only http:, https:, mailto:,
+ * fragment anchors (#...) and strictly relative paths are allowed; anything
+ * with another scheme — javascript:, data:, vbscript:, etc. — or a
+ * protocol-relative //host target (the browser resolves it against the
+ * current scheme, reaching an arbitrary origin) is rejected so the value
+ * never reaches dangerouslySetInnerHTML.
  */
 export function safeUrl(raw: string): string | null {
   const trimmed = raw.trim()
   if (trimmed === '') return null
   if (trimmed.startsWith('#')) return trimmed
+  if (trimmed.startsWith('//')) return null
   const scheme = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(trimmed)
   if (scheme === null) return trimmed
   const name = scheme[1].toLowerCase()

package/src/mobile/messages.ts

@@ -615,5 +615,18 @@ export function foldEvents(events: readonly WireEvent[], existing?: readonly Ren
     if (event.seq <= watermark) continue
     applyEvent(state, event)
   }
-  return [...state.messages].sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1))
+  // Incremental tails (the live-stream hot path) are appended in seq order
+  // or updated in place, so the list is usually ordered already — verify in
+  // O(n) and skip the O(n log n) re-sort when it is.
+  const out = state.messages
+  let ordered = true
+  for (let index = 1; index < out.length; index += 1) {
+    const prev = out[index - 1]!
+    const current = out[index]!
+    if (prev.seq > current.seq || (prev.seq === current.seq && prev.id >= current.id)) {
+      ordered = false
+      break
+    }
+  }
+  return ordered ? out : [...out].sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1))
 }

package/src/mobile/views/App.tsx

@@ -30,18 +30,6 @@ export interface SessionView {
   blank: boolean
 }
 
-/** One rendered chat message (produced by the fold). */
-export interface RenderMessage {
-  id: string
-  kind: 'user' | 'assistant'
-  text: string
-  seq: number
-  time: number
-  pending?: boolean
-  failed?: boolean
-  toolSummary?: string
-}
-
 /** Read the optional workspace target carried from the pairing QR flow. */
 export function mobileWorkspaceTarget(search: string): string | undefined {
   const value = new URLSearchParams(search).get('workspace')

package/src/mobile-api.ts

@@ -25,6 +25,7 @@ import type { ApiProxy } from '@deepseek-ai/dsh-host-apiproxy'
 import type { RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
 import type { PairingService } from './pairing.ts'
+import { readBoundedJson, writeJson } from './http.ts'
 import { readCookie } from './gate.ts'
 
 /** Methods the phone surface may call. Everything else is refused. */
@@ -122,11 +123,6 @@ export function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[] {
     return touchDeviceFor(req)
   }
 
-  const writeJson = (res: ServerResponse, status: number, body: unknown): void => {
-    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' })
-    res.end(JSON.stringify(body))
-  }
-
   const handleMethod = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (req.method !== 'POST') {
       res.writeHead(405)
@@ -170,7 +166,11 @@ export function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[] {
       return
     }
     try {
-      const response = await dispatch(apiProxy, method, parsed?.payload, rpcId)
+      // Cancel the host-side work when the phone goes away mid-call (the
+      // response stream closing before we answer means nobody is listening).
+      const abort = new AbortController()
+      res.on('close', () => { if (!res.writableEnded) abort.abort() })
+      const response = await dispatch(apiProxy, method, parsed?.payload, rpcId, abort.signal)
       writeJson(res, 200, response)
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error)
@@ -244,19 +244,11 @@ export function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[] {
 
 /** Read a request body as JSON (bounded). */
 async function readJsonBody(req: IncomingMessage): Promise<unknown> {
-  const chunks: Buffer[] = []
-  let size = 0
-  for await (const chunk of req) {
-    const buffer = chunk as Buffer
-    size += buffer.length
-    if (size > 64 * 1024) throw new Error('body too large')
-    chunks.push(buffer)
-  }
-  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  return readBoundedJson(req, 64 * 1024)
 }
 
 /** Dispatch one allowlisted method through the host ApiProxy. */
-async function dispatch(apiProxy: ApiProxy, method: string, payload: unknown, rpcId: string): Promise<unknown> {
+async function dispatch(apiProxy: ApiProxy, method: string, payload: unknown, rpcId: string, signal?: AbortSignal): Promise<unknown> {
   const request: RpcRequest<unknown> = { rpcId: RpcId(rpcId), payload }
   if (method === 'session.list') {
     const full = await apiProxy.sessions.list(request as never)
@@ -302,7 +294,7 @@ async function dispatch(apiProxy: ApiProxy, method: string, payload: unknown, rp
   if (method === 'workspace.list') return wrap(await apiProxy.workspace.list(request as never))
   if (method === 'session.create') return wrap(await apiProxy.sessions.create(request as never))
   if (method === 'session.history') return wrap(await apiProxy.sessions.history(request as never))
-  if (method === 'session.search') return wrap(await apiProxy.sessions.search(request as never, new AbortController().signal))
+  if (method === 'session.search') return wrap(await apiProxy.sessions.search(request as never, signal ?? new AbortController().signal))
   if (method === 'session.prompt') return wrap(await apiProxy.sessions.prompt(request as never))
   if (method === 'session.models') return wrap(await apiProxy.sessions.models(request as never))
   if (method === 'session.selectModel') return wrap(await apiProxy.sessions.selectModel(request as never))

package/src/mobile-routes.ts

@@ -76,18 +76,24 @@ export function makeMobileRoutes(): WebRoute[] {
   const handlePage = (_req: IncomingMessage, res: ServerResponse): void => {
     writeStatic(res, 200, 'text/html', pageHtml('/m/mobile.js'))
   }
+  // The bundle is immutable for the process lifetime (a rebuild requires a
+  // host restart), so the ~456KB body is read from disk once, not per phone.
+  let bundleBody: string | undefined
   const handleBundle = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    const path = mobileBundlePath()
-    if (!existsSync(path)) {
-      writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build')
-      return
-    }
-    try {
-      const body = await readFile(path, 'utf8')
-      writeStatic(res, 200, 'text/javascript', body)
-    } catch {
-      writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle')
+    if (bundleBody === undefined) {
+      const path = mobileBundlePath()
+      if (!existsSync(path)) {
+        writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build')
+        return
+      }
+      try {
+        bundleBody = await readFile(path, 'utf8')
+      } catch {
+        writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle')
+        return
+      }
     }
+    writeStatic(res, 200, 'text/javascript', bundleBody)
   }
   const handleIcon = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
     const path = appleTouchIconPath()

package/src/mount-once.ts

@@ -0,0 +1,48 @@
+// Generated by scripts/sync-shared.mjs from shared/host/mount-once.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+
+const MOUNTED = Symbol.for('dsh-web-ui.mounted-plugins')
+
+interface MountRegistry {
+  [MOUNTED]?: Set<string>
+}
+
+function mountedSet(): Set<string> {
+  const registry = globalThis as MountRegistry
+  return (registry[MOUNTED] ??= new Set())
+}
+
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T {
+  return ((...args: unknown[]) => {
+    const mounted = mountedSet()
+    if (mounted.has(packageName)) return
+    mounted.add(packageName)
+    const ctx = args[0] as { effect?: (effect: () => unknown) => unknown } | undefined
+    ctx?.effect?.(() => () => {
+      mounted.delete(packageName)
+    })
+    return fn(...args)
+  }) as T
+}

package/src/routes.ts

@@ -13,6 +13,7 @@ import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { z, type ZodType } from 'zod'
 import { UnknownLanAddressError, type PairingService, type PairingSnapshot } from './pairing.ts'
 import { isLoopbackClient, readCookie } from './gate.ts'
+import { readBoundedJson, writeJson } from './http.ts'
 
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
@@ -120,25 +121,10 @@ function parsePairPayload<T>(schema: ZodType<T>, body: Record<string, unknown> |
   return result.success ? result.data : undefined
 }
 
-/** One JSON response. */
-function writeJson(res: ServerResponse, status: number, body: unknown): void {
-  const payload = JSON.stringify(body)
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
-  res.end(payload)
-}
-
-/** Read a request body up to MAX_BODY_BYTES and parse it as JSON. */
+/** Read a request body up to MAX_BODY_BYTES and parse it as JSON (undefined on failure). */
 async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown> | undefined> {
-  const chunks: Buffer[] = []
-  let size = 0
-  for await (const chunk of req) {
-    const buffer = chunk as Buffer
-    size += buffer.length
-    if (size > MAX_BODY_BYTES) return undefined
-    chunks.push(buffer)
-  }
   try {
-    const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+    const parsed: unknown = await readBoundedJson(req, MAX_BODY_BYTES)
     return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : undefined
   } catch {
     return undefined
@@ -238,6 +224,14 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
   const rateLimitAccept = (req: IncomingMessage): boolean => {
     const ip = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
     const nowMs = Date.now()
+    // The map lives as long as the plugin: prune expired windows once the
+    // table grows past a modest size so distinct source IPs (LAN clients,
+    // brute-force scans) cannot accumulate forever.
+    if (acceptAttempts.size > 256) {
+      for (const [key, attempt] of acceptAttempts) {
+        if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key)
+      }
+    }
     const entry = acceptAttempts.get(ip)
     if (entry === undefined || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
       acceptAttempts.set(ip, { count: 1, windowStart: nowMs })

package/src/update-routes.ts

@@ -8,6 +8,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import type { UpdateRunResult, UpdateStatus } from './update.ts'
+import { writeJson } from './http.ts'
 
 /** Route paths (exact matches under /api). */
 export const UPDATE_PATHS = {
@@ -25,13 +26,6 @@ export interface UpdateRoutesDeps {
   run(): Promise<UpdateRunResult>
 }
 
-/** One JSON response. */
-function writeJson(res: ServerResponse, status: number, body: unknown): void {
-  const payload = JSON.stringify(body)
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
-  res.end(payload)
-}
-
 /**
  * Build the /api/update route family.
  * @param deps - fence + check/run seams.

package/src/update.ts

@@ -332,10 +332,13 @@ export async function checkUpdates(deps: UpdateCheckDeps): Promise<UpdateStatus>
     return { mode: 'link', packages: [], outdated: false }
   }
   const names = [anchor, ...familyChildren(manifest)]
+  // The registry probes are independent: run them together instead of
+  // serializing up to N x 10s of registry latency behind one status call.
+  const latestList = await Promise.all(names.map(name => deps.fetchLatest(name)))
   const packages: UpdatePackageStatus[] = []
   let probeFailures = 0
-  for (const name of names) {
-    const latest = await deps.fetchLatest(name)
+  names.forEach((name, index) => {
+    const latest = latestList[index]
     if (latest === undefined) probeFailures++
     const current = readInstalledVersion(deps.resolve, name)
     packages.push({
@@ -344,7 +347,7 @@ export async function checkUpdates(deps: UpdateCheckDeps): Promise<UpdateStatus>
       latest,
       outdated: latest !== undefined && latest !== current && compareVersions(latest, current) > 0,
     })
-  }
+  })
   // Registry unreachable: every probe failed — report the outage distinctly
   // instead of a misleading "all up to date" (the panel needs the reason).
   const error = probeFailures === names.length && names.length > 0 ? 'registry-unreachable' : undefined