@linxin666/dsh-remote-web-ui 0.2.0 → 0.2.2

package/src/mobile/views/SessionListView.test.tsx

@@ -10,12 +10,14 @@ import { type SessionView } from './App.tsx'
 vi.mock('../api.ts', () => ({
   listSessions: vi.fn(),
   listWorkspaces: vi.fn(),
+  listAgentPresets: vi.fn(),
   createSession: vi.fn(),
 }))
-import { createSession, listSessions, listWorkspaces } from '../api.ts'
+import { createSession, listAgentPresets, listSessions, listWorkspaces } from '../api.ts'
 
 const listSessionsMock = vi.mocked(listSessions)
 const listWorkspacesMock = vi.mocked(listWorkspaces)
+const listAgentPresetsMock = vi.mocked(listAgentPresets)
 const createSessionMock = vi.mocked(createSession)
 
 const workspace: WorkspaceRow = {
@@ -49,6 +51,7 @@ function renderList(props: Partial<SessionListViewProps> = {}): void {
 beforeEach(() => {
   listSessionsMock.mockResolvedValue({ items: [], hasMore: false })
   listWorkspacesMock.mockResolvedValue([workspace])
+  listAgentPresetsMock.mockResolvedValue({ presets: [], authorable: false, hasDocument: false })
   createSessionMock.mockResolvedValue({ sessionId: 's-new' })
 })
 
@@ -111,6 +114,71 @@ describe('SessionListView creation', () => {
     expect(await screen.findByText('新会话')).toBeTruthy()
   })
 
+  it('creates the session with the selected agent preset', async () => {
+    listAgentPresetsMock.mockResolvedValue({
+      presets: [
+        { id: 'router-standard', name: 'Router Standard', trust: 'system', isDefault: true },
+        { id: 'router-spec', name: 'Router Spec', description: '规格驱动模式', trust: 'system', isDefault: false },
+      ],
+      authorable: false,
+      hasDocument: false,
+    })
+    renderList()
+
+    const picker = await screen.findByRole('combobox', { name: 'Agent 模式' })
+    expect((picker as HTMLSelectElement).value).toBe('router-standard')
+    fireEvent.change(picker, { target: { value: 'router-spec' } })
+    fireEvent.click(screen.getByRole('button', { name: '+ 新建会话' }))
+
+    await waitFor(() => {
+      expect(createSessionMock).toHaveBeenCalledWith({ workspaceId: 'w-1', agentPreset: 'router-spec' })
+    })
+    expect(await screen.findByText('规格驱动模式')).toBeTruthy()
+  })
+
+  it('skips a broken default preset and disables it in the picker', async () => {
+    listAgentPresetsMock.mockResolvedValue({
+      presets: [
+        { id: 'broken-default', trust: 'system', isDefault: true, broken: 'missing plugin' },
+        { id: 'local-router', name: 'Local Router', trust: 'user', isDefault: false },
+      ],
+      authorable: false,
+      hasDocument: false,
+    })
+    renderList()
+
+    const picker = await screen.findByRole('combobox', { name: 'Agent 模式' }) as HTMLSelectElement
+    expect(picker.value).toBe('local-router')
+    expect(screen.getByRole('option', { name: 'broken-default（默认）（不可用）' }).hasAttribute('disabled')).toBe(true)
+    expect(screen.getByRole('option', { name: 'Local Router（本地）' })).toBeTruthy()
+  })
+
+  it('keeps default session creation available when the preset roster fails', async () => {
+    listAgentPresetsMock.mockRejectedValue(new Error('preset roster unavailable'))
+    renderList()
+    await screen.findByText(/还没有会话/)
+
+    const button = await screen.findByRole('button', { name: '+ 新建会话' })
+    await waitFor(() => { expect(button.hasAttribute('disabled')).toBe(false) })
+    fireEvent.click(button)
+
+    await waitFor(() => {
+      expect(createSessionMock).toHaveBeenCalledWith({ workspaceId: 'w-1' })
+    })
+  })
+
+  it('waits for the preset roster before enabling session creation', async () => {
+    let resolvePresets: (value: Awaited<ReturnType<typeof listAgentPresets>>) => void = () => {}
+    listAgentPresetsMock.mockReturnValue(new Promise(resolve => { resolvePresets = resolve }))
+    renderList()
+
+    const button = screen.getByRole('button', { name: '+ 新建会话' })
+    expect(button.hasAttribute('disabled')).toBe(true)
+
+    resolvePresets({ presets: [], authorable: false, hasDocument: false })
+    await waitFor(() => { expect(button.hasAttribute('disabled')).toBe(false) })
+  })
+
   it('keeps the button disabled while a creation is in flight', async () => {
     let resolveCreate: (value: { sessionId: string }) => void = () => {}
     createSessionMock.mockReturnValue(new Promise(resolve => { resolveCreate = resolve }))

package/src/mobile/views/SessionListView.tsx

@@ -13,8 +13,9 @@
 
 import { useCallback, useEffect, useRef, useState } from 'react'
 import type { WorkspaceView as WorkspaceRow } from '@deepseek-ai/dsh-host-apiproxy/api/workspace'
+import type { AgentPresetEntry } from '@deepseek-ai/dsh-host-apiproxy/api/agent-presets'
 import type { SessionSummary } from '@deepseek-ai/dsh-host-apiproxy/api/sessions'
-import { createSession, listSessions, listWorkspaces } from '../api.ts'
+import { createSession, listAgentPresets, listSessions, listWorkspaces } from '../api.ts'
 import { errorText, formatTime, staleHostHint, toSessionView, type SessionView } from './App.tsx'
 import { ThemeToggle } from '../theme-toggle.tsx'
 
@@ -45,6 +46,9 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
   const [error, setError] = useState<string | undefined>(undefined)
   const [creating, setCreating] = useState(false)
   const [createError, setCreateError] = useState<string | undefined>(undefined)
+  const [presets, setPresets] = useState<readonly AgentPresetEntry[]>([])
+  const [selectedPreset, setSelectedPreset] = useState<string | undefined>(undefined)
+  const [presetsLoading, setPresetsLoading] = useState(true)
   const cursorRef = useRef<string | undefined>(undefined)
   const busyRef = useRef(false)
 
@@ -74,6 +78,27 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
     return () => { cancelled = true }
   }, [workspace])
 
+  useEffect(() => {
+    let cancelled = false
+    setPresets([])
+    setSelectedPreset(undefined)
+    setPresetsLoading(true)
+    void listAgentPresets().then(
+      (roster) => {
+        if (cancelled) return
+        const usable = roster.presets.filter(preset => preset.broken === undefined)
+        setPresets(roster.presets)
+        setSelectedPreset((usable.find(preset => preset.isDefault) ?? usable[0])?.id)
+        setPresetsLoading(false)
+      },
+      () => {
+        if (cancelled) return
+        setPresetsLoading(false)
+      },
+    )
+    return () => { cancelled = true }
+  }, [workspace])
+
   /** Pull the next page and append the rows that belong to this workspace. */
   const loadMore = useCallback(() => {
     if (busyRef.current) return
@@ -102,7 +127,10 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
     if (creating) return
     setCreating(true)
     setCreateError(undefined)
-    void createSession({ workspaceId: workspace.workspaceId }).then(
+    void createSession({
+      workspaceId: workspace.workspaceId,
+      ...(selectedPreset !== undefined ? { agentPreset: selectedPreset } : {}),
+    }).then(
       (created) => {
         setCreating(false)
         const view: SessionView = {
@@ -120,9 +148,10 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
         setCreateError(errorText(reason))
       },
     )
-  }, [creating, workspace, onPick])
+  }, [creating, workspace, onPick, selectedPreset])
 
   const createHint = createError !== undefined ? staleHostHint(createError) : undefined
+  const selectedPresetEntry = presets.find(preset => preset.id === selectedPreset)
 
   return (
     <div className="mobile">
@@ -132,11 +161,35 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
         <ThemeToggle />
       </header>
       {error !== undefined && <p className="mobile-error mobile-pad">{error}</p>}
-      <div className="mobile-pad">
+      <div className="mobile-create mobile-pad">
+        {presets.length > 0 && (
+          <label className="mobile-preset">
+            <span className="mobile-presetLabel">Agent 模式</span>
+            <select
+              className="mobile-presetSelect"
+              value={selectedPreset ?? ''}
+              disabled={selectedPreset === undefined}
+              onChange={(event) => { setSelectedPreset(event.target.value) }}
+            >
+              {selectedPreset === undefined && <option value="">无可用 Agent 模式</option>}
+              {presets.map(preset => (
+                <option key={preset.id} value={preset.id} disabled={preset.broken !== undefined}>
+                  {preset.name ?? preset.id}
+                  {preset.isDefault ? '（默认）' : ''}
+                  {preset.trust === 'user' ? '（本地）' : ''}
+                  {preset.broken !== undefined ? '（不可用）' : ''}
+                </option>
+              ))}
+            </select>
+          </label>
+        )}
+        {selectedPresetEntry?.description !== undefined && (
+          <p className="mobile-presetDescription">{selectedPresetEntry.description}</p>
+        )}
         <button
           type="button"
           className="mobile-new"
-          disabled={creating}
+          disabled={creating || presetsLoading}
           onClick={() => { void handleCreate() }}
         >
           {creating ? '创建中…' : '+ 新建会话'}

package/src/mobile/views/WorkspaceView.tsx

@@ -27,6 +27,8 @@ export interface WorkspaceViewProps {
 export function WorkspaceView({ initialWorkspaceId, onPick }: WorkspaceViewProps) {
   const [items, setItems] = useState<WorkspaceRow[] | undefined>(undefined)
   const [error, setError] = useState<string | undefined>(undefined)
+  // Bumped by the retry button to re-run the roster fetch effect.
+  const [reload, setReload] = useState(0)
 
   useEffect(() => {
     let cancelled = false
@@ -48,7 +50,7 @@ export function WorkspaceView({ initialWorkspaceId, onPick }: WorkspaceViewProps
       },
     )
     return () => { cancelled = true }
-  }, [initialWorkspaceId, onPick])
+  }, [initialWorkspaceId, onPick, reload])
 
   if (error !== undefined) {
     return (
@@ -59,7 +61,7 @@ export function WorkspaceView({ initialWorkspaceId, onPick }: WorkspaceViewProps
         </header>
         <div className="mobile-empty">
           <p className="mobile-error">加载失败：{error}</p>
-          <button type="button" className="mobile-button" onClick={() => { setError(undefined); setItems(undefined) }}>
+          <button type="button" className="mobile-button" onClick={() => { setError(undefined); setItems(undefined); setReload(n => n + 1) }}>
             重试
           </button>
         </div>

package/src/mobile-api.ts

@@ -28,9 +28,16 @@ import type { PairingService } from './pairing.ts'
 import { readBoundedJson, writeJson } from './http.ts'
 import { readCookie } from './gate.ts'
 
-/** Methods the phone surface may call. Everything else is refused. */
+/**
+ * Methods the phone surface may call. Everything else is refused HERE — but
+ * note the paired-device cookie also passes the global api/gate for the full
+ * ApiProxy surface (gate.ts), so a paired phone is a full-control credential:
+ * the allowlist only constrains this /m/api proxy, not the cookie's reach.
+ * stop() revokes every device; there is no per-device revocation yet.
+ */
 const MOBILE_ALLOWLIST = new Set([
   'workspace.list',
+  'agentPreset.list',
   'session.create',
   'session.list',
   'session.history',
@@ -292,6 +299,7 @@ async function dispatch(apiProxy: ApiProxy, method: string, payload: unknown, rp
     result: response.result,
   })
   if (method === 'workspace.list') return wrap(await apiProxy.workspace.list(request as never))
+  if (method === 'agentPreset.list') return wrap(await apiProxy.agentPresets.list(request as never))
   if (method === 'session.create') return wrap(await apiProxy.sessions.create(request as never))
   if (method === 'session.history') return wrap(await apiProxy.sessions.history(request as never))
   if (method === 'session.search') return wrap(await apiProxy.sessions.search(request as never, signal ?? new AbortController().signal))

package/src/routes.ts

@@ -222,7 +222,16 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
   const ACCEPT_MAX_ATTEMPTS = 10
   const ACCEPT_WINDOW_MS = 30_000
   const rateLimitAccept = (req: IncomingMessage): boolean => {
-    const ip = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
+    const socketIp = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
+    // Behind the auto-tunnel every internet client arrives from 127.0.0.1,
+    // so a single shared bucket would let one attacker keep the legitimate
+    // owner rate-limited. Partition the availability bucket by the first
+    // client-visible XFF hop (set by the tunnel edge): XFF is untrusted for
+    // authentication and only separates buckets, it never grants access.
+    const forwarded = typeof req.headers['x-forwarded-for'] === 'string'
+      ? (req.headers['x-forwarded-for'].split(',')[0] ?? '').trim()
+      : undefined
+    const ip = forwarded === undefined || forwarded === '' ? socketIp : socketIp + '|' + forwarded
     const nowMs = Date.now()
     // The map lives as long as the plugin: prune expired windows once the
     // table grows past a modest size so distinct source IPs (LAN clients,
@@ -306,6 +315,9 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code })
       return
     }
+    // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
+    // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
+    // top-level navigations working while blocking cross-site subrequests.
     res.writeHead(200, {
       'content-type': 'application/json; charset=utf-8',
       'set-cookie': [
@@ -356,7 +368,15 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       return
     }
     const deviceId = readCookie(req.headers.cookie, service.config.cookieName)
-    writeJson(res, 200, { ok: true, paired: deviceId !== undefined && service.hasDevice(deviceId), ...service.snapshot() })
+    const paired = deviceId !== undefined && service.hasDevice(deviceId)
+    const snapshot = service.snapshot()
+    // Unpaired LAN/tunnel clients get only the pairing-relevant fields; the
+    // token expiry, device roster, and public tunnel URL are an oracle for
+    // targeting and timing and stay behind a live device cookie.
+    const visible = paired
+      ? snapshot
+      : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses }
+    writeJson(res, 200, { ok: true, paired, ...visible })
   }
 
   const handleEvents = (req: IncomingMessage, res: ServerResponse): void => {

package/src/tunnel.ts

@@ -86,6 +86,9 @@ export class TunnelManager {
   private urlTimer: unknown | undefined
   private restartTimer: unknown | undefined
   private attempts = 0
+  // Generation counter: a stale ensureBinary resolution from an earlier
+  // start() must not spawn a second handle after a stop/start cycle.
+  private generation = 0
   private stopping = false
   private readonly urlListeners = new Set<(url: string) => void>()
   private readonly phaseListeners = new Set<(info: TunnelInfo) => void>()
@@ -123,6 +126,7 @@ export class TunnelManager {
     this.stopping = false
     this.targetUrl = targetUrl
     this.attempts = 0
+    this.generation += 1
     this.attempt()
   }
 
@@ -153,12 +157,13 @@ export class TunnelManager {
 
   private attempt(): void {
     if (this.stopping || this.targetUrl === undefined) return
+    const gen = this.generation
     this.setPhase('starting')
     this.handle = undefined
     this.url = undefined
     this.error = undefined
     void this.ensureBinary().then(() => {
-      if (this.stopping || this.targetUrl === undefined) return
+      if (this.stopping || this.targetUrl === undefined || gen !== this.generation) return
       const handle = this.factory(this.targetUrl)
       this.handle = handle
       this.urlTimer = this.timer.setTimeout(() => {
@@ -181,7 +186,7 @@ export class TunnelManager {
       })
     }).catch((value: unknown) => {
       // Binary install failed (no network, no platform build): report it.
-      if (this.stopping || this.targetUrl === undefined) return
+      if (this.stopping || this.targetUrl === undefined || gen !== this.generation) return
       const message = value instanceof Error ? value.message : String(value)
       this.fail(`could not obtain the cloudflared binary: ${message}`)
     })

package/src/update.ts

@@ -280,14 +280,14 @@ function familyUpdatePackages(
  */
 export async function fetchLatestVersion(
   name: string,
-  fetchImpl: (url: string) => Promise<{ ok: boolean; json(): Promise<unknown> }>,
+  fetchImpl: (url: string, init?: RequestInit) => Promise<{ ok: boolean; json(): Promise<unknown> }>,
   timeoutMs = 10_000,
 ): Promise<string | undefined> {
   try {
     const controller = new AbortController()
     const timer = setTimeout(() => { controller.abort() }, timeoutMs)
     try {
-      const response = await fetchImpl(NPM_REGISTRY + '/' + name.replace('/', '%2F') + '/latest')
+      const response = await fetchImpl(NPM_REGISTRY + '/' + name.replace('/', '%2F') + '/latest', { signal: controller.signal })
       if (!response.ok) return undefined
       const body = await response.json()
       if (typeof body !== 'object' || body === null) return undefined