@linxin666/dsh-remote-web-ui 0.1.19 → 0.2.0

package/src/pairing.persist.test.ts

@@ -0,0 +1,145 @@
+/**
+ * PairingService device-session persistence: with `devicesFile` set, sessions
+ * written on accept/stop survive a process restart (a new PairingService
+ * instance), so a previously paired phone — whose cookie already lives 365
+ * days — never needs to re-scan the QR after `dsh web` restarts.
+ */
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { pairingConfigOf } from './index.ts'
+import { PairingService, type PairingClock, type PairingConfig } from './pairing.ts'
+
+const BASE_CONFIG: Omit<PairingConfig, 'devicesFile'> = {
+  tokenTtlMs: 60_000,
+  offlineAfterMs: 25_000,
+  maxDevices: 4,
+  cookieName: 'dsh_pair',
+}
+
+/** Deterministic clock: tokens are issued in a fixed, readable sequence. */
+function makeClock(): PairingClock {
+  let n = 0
+  return {
+    now: () => 1_000_000 + n,
+    randomToken: () => `tok${(n++).toString().padStart(6, '0')}`,
+  }
+}
+
+/** Pair a device on a service: issue a token and immediately accept it. */
+function pairDevice(service: PairingService): string {
+  service.setPublicBaseUrl('https://pairing.example.trycloudflare.com')
+  const { token } = service.issue()
+  const result = service.accept(token)
+  if (!result.ok) throw new Error(`pair failed: ${result.code}`)
+  return result.deviceId
+}
+
+describe('PairingService device persistence', () => {
+  let dir: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'remote-web-ui-persist-'))
+  })
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('restores paired sessions across a process restart', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    const deviceId = pairDevice(first)
+    expect(readFileSync(file, 'utf8')).toContain(deviceId)
+    // Device ids are session credentials: the persisted file is 0600.
+    expect(statSync(file).mode & 0o777).toBe(0o600)
+
+    // Simulated restart: a brand-new service instance reading the same file.
+    const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(true)
+  })
+
+  it('carries devicesFile through the config mapping used by sync() (regression)', () => {
+    const file = join(dir, 'devices.json')
+    const mapped = pairingConfigOf({
+      tokenTtlMs: 60_000,
+      offlineAfterMs: 25_000,
+      maxDevices: 4,
+      cookieName: 'dsh_pair',
+      devicesFile: file,
+    })
+    expect(mapped.devicesFile).toBe(file)
+  })
+
+  it('keeps persisting after a sync-style service.config rebuild', () => {
+    const file = join(dir, 'devices.json')
+    const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    // applyImpl/sync() reassigns service.config from the resolved config on
+    // mount and on every settings change; the rebuild must not drop devicesFile.
+    service.config = pairingConfigOf({
+      tokenTtlMs: 60_000,
+      offlineAfterMs: 25_000,
+      maxDevices: 4,
+      cookieName: 'dsh_pair',
+      devicesFile: file,
+    })
+    const deviceId = pairDevice(service)
+    const restarted = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(restarted.hasDevice(deviceId)).toBe(true)
+  })
+
+  it('clamps a persisted table to maxDevices when the file holds more sessions', () => {
+    const file = join(dir, 'devices.json')
+    writeFileSync(file, JSON.stringify({
+      dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
+      dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
+      dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
+    }))
+    const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    expect(service.hasDevice('dev3')).toBe(true)
+    expect(service.hasDevice('dev2')).toBe(true)
+    expect(service.hasDevice('dev1')).toBe(false)
+  })
+
+  it('keeps sessions memory-only when devicesFile is unset', () => {
+    const first = new PairingService({ ...BASE_CONFIG }, makeClock())
+    const deviceId = pairDevice(first)
+    // No file was written; a fresh instance without the option knows nothing.
+    const second = new PairingService({ ...BASE_CONFIG }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(false)
+  })
+
+  it('persists revocation by stop() across a restart', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    const deviceId = pairDevice(first)
+    first.stop()
+
+    const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(false)
+  })
+
+  it('persists FIFO eviction when the device cap is reached', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    const firstDevice = pairDevice(first)
+    const secondDevice = pairDevice(first)
+    const thirdDevice = pairDevice(first) // evicts firstDevice
+    expect(first.hasDevice(firstDevice)).toBe(false)
+
+    const second = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    expect(second.hasDevice(secondDevice)).toBe(true)
+    expect(second.hasDevice(thirdDevice)).toBe(true)
+    expect(second.hasDevice(firstDevice)).toBe(false)
+  })
+
+  it('tolerates a corrupt or missing file instead of refusing to boot', () => {
+    const file = join(dir, 'devices.json')
+    writeFileSync(file, '{ this is not json !!!')
+    expect(() => new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())).not.toThrow()
+
+    const ghost = join(dir, 'does-not-exist.json')
+    expect(() => new PairingService({ ...BASE_CONFIG, devicesFile: ghost }, makeClock())).not.toThrow()
+  })
+})

package/src/pairing.ts

@@ -16,6 +16,8 @@
  */
 
 import { randomBytes } from 'node:crypto'
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 /** The observable pairing phases the panel renders. */
 export type PairingPhase =
@@ -95,6 +97,13 @@ export interface PairingConfig {
   maxDevices: number
   /** Cookie name carrying the device id. */
   cookieName: string
+  /**
+   * Path to a JSON file where paired device sessions are persisted. When
+   * set, sessions survive process restarts (the phone keeps its 365-day
+   * cookie), so re-pairing after a dsh web restart is not required. When
+   * unset (default), sessions stay memory-only — the previous behavior.
+   */
+  devicesFile?: string
 }
 
 /** Result of one accept() attempt. */
@@ -154,7 +163,65 @@ export class PairingService {
   constructor(
     public config: PairingConfig,
     private readonly clock: PairingClock = defaultClock,
-  ) {}
+  ) {
+    this.loadPersisted()
+  }
+
+  /**
+   * Restore device sessions persisted by a previous process run. A corrupt
+   * or missing file is tolerated (an empty device table, never a throw) —
+   * persistence is an availability convenience, not a security boundary.
+   */
+  private loadPersisted(): void {
+    const file = this.config.devicesFile
+    if (file === undefined) return
+    try {
+      const saved = JSON.parse(readFileSync(file, 'utf8')) as unknown
+      if (typeof saved !== 'object' || saved === null) return
+      for (const [deviceId, session] of Object.entries(saved)) {
+        if (typeof deviceId !== 'string') continue
+        if (typeof session !== 'object' || session === null) continue
+        const { createdAt, lastSeenAt } = session as { createdAt?: unknown; lastSeenAt?: unknown }
+        if (typeof createdAt !== 'number' || typeof lastSeenAt !== 'number') continue
+        this.devices.set(deviceId, { createdAt, lastSeenAt })
+      }
+      this.clampToMaxDevices()
+    } catch {
+      // Unreadable/corrupt: start empty rather than refusing to boot.
+    }
+  }
+
+  /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+  private clampToMaxDevices(): void {
+    if (this.devices.size <= this.config.maxDevices) return
+    const overflow = this.devices.size - this.config.maxDevices
+    const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt)
+    for (const [id] of ordered.slice(0, overflow)) this.devices.delete(id)
+  }
+
+  /**
+   * Write the current device table to the configured file. Called on the
+   * mutation boundaries that change the set of live sessions (accept and
+   * stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+   * per-request write storm is avoided — after a restart the phone's first
+   * heartbeat re-warms its own session.
+   *
+   * Device ids are session credentials (the gate authorizes requests by the
+   * cookie's device id), so the file is written 0600 via a temp file and
+   * atomic rename; a crash mid-write can never leave a half-written store.
+   */
+  private persist(): void {
+    const file = this.config.devicesFile
+    if (file === undefined) return
+    try {
+      mkdirSync(dirname(file), { recursive: true })
+      const temp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`
+      writeFileSync(temp, JSON.stringify(Object.fromEntries(this.devices)), { mode: 0o600 })
+      renameSync(temp, file)
+    } catch (error) {
+      console.error('remote-web-ui: failed to persist paired devices', error)
+    }
+  }
 
   /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
   get lanBaseUrl(): string | undefined {
@@ -254,6 +321,7 @@ export class PairingService {
       if (oldest !== undefined) this.devices.delete(oldest.id)
     }
     this.devices.set(deviceId, { createdAt: now, lastSeenAt: now })
+    this.persist()
     this.notify()
     return { ok: true, deviceId }
   }
@@ -266,6 +334,7 @@ export class PairingService {
   stop(): void {
     this.tokens.clear()
     this.devices.clear()
+    this.persist()
     this.stopped = true
     this.notify()
   }

package/src/routes.ts

@@ -13,6 +13,7 @@ import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import { z, type ZodType } from 'zod'
 import { UnknownLanAddressError, type PairingService, type PairingSnapshot } from './pairing.ts'
 import { isLoopbackClient, readCookie } from './gate.ts'
+import { readBoundedJson, writeJson } from './http.ts'
 
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
@@ -120,25 +121,10 @@ function parsePairPayload<T>(schema: ZodType<T>, body: Record<string, unknown> |
   return result.success ? result.data : undefined
 }
 
-/** One JSON response. */
-function writeJson(res: ServerResponse, status: number, body: unknown): void {
-  const payload = JSON.stringify(body)
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
-  res.end(payload)
-}
-
-/** Read a request body up to MAX_BODY_BYTES and parse it as JSON. */
+/** Read a request body up to MAX_BODY_BYTES and parse it as JSON (undefined on failure). */
 async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown> | undefined> {
-  const chunks: Buffer[] = []
-  let size = 0
-  for await (const chunk of req) {
-    const buffer = chunk as Buffer
-    size += buffer.length
-    if (size > MAX_BODY_BYTES) return undefined
-    chunks.push(buffer)
-  }
   try {
-    const parsed: unknown = JSON.parse(Buffer.concat(chunks).toString('utf8'))
+    const parsed: unknown = await readBoundedJson(req, MAX_BODY_BYTES)
     return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : undefined
   } catch {
     return undefined
@@ -238,6 +224,14 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
   const rateLimitAccept = (req: IncomingMessage): boolean => {
     const ip = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
     const nowMs = Date.now()
+    // The map lives as long as the plugin: prune expired windows once the
+    // table grows past a modest size so distinct source IPs (LAN clients,
+    // brute-force scans) cannot accumulate forever.
+    if (acceptAttempts.size > 256) {
+      for (const [key, attempt] of acceptAttempts) {
+        if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key)
+      }
+    }
     const entry = acceptAttempts.get(ip)
     if (entry === undefined || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
       acceptAttempts.set(ip, { count: 1, windowStart: nowMs })
@@ -270,7 +264,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       const workspaceQuery = workspaceId === undefined ? '' : `&workspace=${encodeURIComponent(workspaceId)}`
       writeJson(res, 200, {
         ok: true,
-        url: `${base}/?pair=${token}${workspaceQuery}`,
+        url: `${base}/m/?pair=${token}${workspaceQuery}`,
         token,
         expiresAt,
         // Every constructible base, so a multi-homed panel can switch the

package/src/update-routes.ts

@@ -8,6 +8,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 import type { UpdateRunResult, UpdateStatus } from './update.ts'
+import { writeJson } from './http.ts'
 
 /** Route paths (exact matches under /api). */
 export const UPDATE_PATHS = {
@@ -25,13 +26,6 @@ export interface UpdateRoutesDeps {
   run(): Promise<UpdateRunResult>
 }
 
-/** One JSON response. */
-function writeJson(res: ServerResponse, status: number, body: unknown): void {
-  const payload = JSON.stringify(body)
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
-  res.end(payload)
-}
-
 /**
  * Build the /api/update route family.
  * @param deps - fence + check/run seams.

package/src/update.ts

@@ -1,8 +1,8 @@
 /**
  * Remote update support for the dsh-web-ui family — host half. Detects the
- * installed aggregate package (@linxin666/dsh-web-ui-all) and its family
- * children, probes the npm registry for newer releases, and runs the actual
- * update as `pnpm update --latest` inside the owning dsh profile directory.
+ * installed aggregate package (@linxin666/dsh-web-ui-all), or the directly
+ * installed family packages when the aggregate is absent, probes npm for newer
+ * releases, and runs `pnpm update --latest` inside the owning dsh profile.
  *
  * Pure logic with injected seams (manifest reading, registry fetches, process
  * spawning) so the whole surface is unit-testable without touching disk,
@@ -235,10 +235,13 @@ export function resolveUpdateTarget(
   const profileManifest = readManifest(join(profile.dir, 'package.json'))
   const spec = (profileManifest?.dependencies as Record<string, DependencySpec> | undefined)?.[anchor]
   if (isLinkedSpec(spec)) return { error: 'link' }
+  // Standalone installs carry no aggregate: the anchor's own dependency
+  // list misses every sibling @linxin666/* plugin installed directly into
+  // the profile, so union the profile's direct family deps (#377).
   return {
     profileName: profile.name,
     profileDir: profile.dir,
-    packages: [anchor, ...familyChildren(manifest)],
+    packages: familyUpdatePackages(anchor, manifest, profileManifest),
   }
 }
 
@@ -253,6 +256,21 @@ export function familyChildren(anchorManifest: Record<string, unknown>): string[
   return names
 }
 
+/** Registry-managed family packages covered by one update operation. */
+function familyUpdatePackages(
+  anchor: string,
+  anchorManifest: Record<string, unknown>,
+  profileManifest: Record<string, unknown> | undefined,
+): string[] {
+  const names = new Set([anchor, ...familyChildren(anchorManifest)])
+  const dependencies = profileManifest?.dependencies
+  if (typeof dependencies !== 'object' || dependencies === null) return [...names]
+  for (const [name, spec] of Object.entries(dependencies)) {
+    if (name.startsWith(FAMILY_SCOPE) && typeof spec === 'string' && !isLinkedSpec(spec)) names.add(name)
+  }
+  return [...names]
+}
+
 /**
  * Probe the npm registry for one package's latest release.
  * @param name - the package name (scope slash URL-encoded).
@@ -292,14 +310,21 @@ export async function fetchLatestVersion(
 const VERSION_UNKNOWN = '0.0.0'
 
 /** The resolved current version of one family package (probe failure tolerated). */
-function readInstalledVersion(resolve: (specifier: string) => string | undefined, name: string): string {
+function readInstalledVersion(
+  resolve: (specifier: string) => string | undefined,
+  name: string,
+  profileDir?: string,
+): string {
   try {
     const path = resolve(name + '/package.json')
     const version = path === undefined ? undefined : readManifest(path)?.version
-    return typeof version === 'string' ? version : VERSION_UNKNOWN
-  } catch {
-    return VERSION_UNKNOWN
-  }
+    if (typeof version === 'string') return version
+  } catch { /* fall through to the profile's direct dependency path */ }
+  // Names originate in the profile dependency map, but still validate the
+  // npm package shape before using one as path segments.
+  if (profileDir === undefined || !/^@linxin666\/[a-z0-9][a-z0-9._-]*$/.test(name)) return VERSION_UNKNOWN
+  const version = readManifest(join(profileDir, 'node_modules', ...name.split('/'), 'package.json'))?.version
+  return typeof version === 'string' ? version : VERSION_UNKNOWN
 }
 
 /**
@@ -331,20 +356,26 @@ export async function checkUpdates(deps: UpdateCheckDeps): Promise<UpdateStatus>
   if (profile === undefined) {
     return { mode: 'link', packages: [], outdated: false }
   }
-  const names = [anchor, ...familyChildren(manifest)]
+  // Union the profile's direct family deps so standalone installs (no
+  // aggregate) still check every installed @linxin666/* plugin (#377);
+  // familyUpdatePackages skips link:/file: development dependencies.
+  const names = familyUpdatePackages(anchor, manifest, profileManifest)
+  // The registry probes are independent: run them together instead of
+  // serializing up to N x 10s of registry latency behind one status call.
+  const latestList = await Promise.all(names.map(name => deps.fetchLatest(name)))
   const packages: UpdatePackageStatus[] = []
   let probeFailures = 0
-  for (const name of names) {
-    const latest = await deps.fetchLatest(name)
+  names.forEach((name, index) => {
+    const latest = latestList[index]
     if (latest === undefined) probeFailures++
-    const current = readInstalledVersion(deps.resolve, name)
+    const current = readInstalledVersion(deps.resolve, name, profile.dir)
     packages.push({
       name,
       current,
       latest,
       outdated: latest !== undefined && latest !== current && compareVersions(latest, current) > 0,
     })
-  }
+  })
   // Registry unreachable: every probe failed — report the outage distinctly
   // instead of a misleading "all up to date" (the panel needs the reason).
   const error = probeFailures === names.length && names.length > 0 ? 'registry-unreachable' : undefined
@@ -601,7 +632,7 @@ export async function runUpdateVerified(deps: UpdateRunVerifiedDeps): Promise<Up
   // green exit that left everything in place could be mistaken for success.
   const before = new Map<string, string>()
   for (const name of deps.run.packages) {
-    const version = readInstalledVersion(deps.check.resolve, name)
+    const version = readInstalledVersion(deps.check.resolve, name, deps.run.profileDir)
     if (version !== VERSION_UNKNOWN) before.set(name, version)
   }
   const result = await runUpdate(deps.run)