@linxin666/dsh-remote-web-ui 0.3.14 → 0.3.15

package/src/client/mobile-adapt.ts

@@ -236,7 +236,6 @@ const ADAPT_CSS: readonly string[] = [
   `body.${ACTIVE_CLASS} [data-dsh-plugin=\"task-board\"],`,
   `body.${ACTIVE_CLASS} [data-dsh-plugin=\"git-graph\"],`,
   `body.${ACTIVE_CLASS} [data-dsh-plugin=\"pet\"],`,
-  `body.${ACTIVE_CLASS} [data-dsh-plugin=\"perf\"],`,
   `body.${ACTIVE_CLASS} [data-dsh-plugin=\"usage\"]{display:none !important}`,
   // The official workbench (Files / source control) mounts into a
   // full-viewport portal layer with no data-dsh-plugin root, so the plugin
@@ -921,15 +920,11 @@ export function startMobileAdapt(): void {
     }
     lanOrigFocus.call(this, options)
   }
-  let lastComposerTapRegistered = false
-  if (!lastComposerTapRegistered) {
-    lastComposerTapRegistered = true
-    document.addEventListener('pointerdown', (e) => {
-      if (!active) return
-      const t = e.target
-      if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT') && t.closest('[class$="_composerSeat"]') !== null) lastComposerTap = Date.now()
-    }, true)
-  }
+  document.addEventListener('pointerdown', (e) => {
+    if (!active) return
+    const t = e.target
+    if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT') && t.closest('[class$="_composerSeat"]') !== null) lastComposerTap = Date.now()
+  }, true)
 
   // The plugin apply() wires toggleSidebar/closeDetails to ctx.layout once
   // it is live, and flips the master switch when the settings snapshot

package/src/index.ts

@@ -126,6 +126,13 @@ export interface Config {
    * warning (LAN-only behavior preserved). Ignored while `autoTunnel` is on.
    */
   publicBaseUrl?: string
+  /**
+   * Extra trusted host authorities (exact host:port or port-less host) allowed
+   * to access pairing endpoints and remote web services. Useful in Docker, reverse proxy,
+   * or NAT environments where incoming request Host headers differ from the container's
+   * internal network addresses. Can also be set via the DSH_REMOTE_TRUSTED_HOSTS env var.
+   */
+  trustedHosts?: string[]
   /**
    * Absolute path to a JSON file where paired device sessions are persisted.
    * Defaults to `$DSH_HOME/remote-web-ui-devices.json` so a paired device
@@ -199,6 +206,7 @@ export const Config: z<Config> = z.object({
   cookieName: z.string().min(1).default('dsh_pair'),
   requirePairingForLan: z.boolean().default(true),
   publicBaseUrl: z.string(),
+  trustedHosts: z.array(z.string()),
   devicesFile: z.string(),
   autoTunnel: z.boolean().default(false),
   tunnelToken: z.string().role('secret'),
@@ -216,8 +224,9 @@ const SWEEP_INTERVAL_MS = 10_000
  * which legitimately resolves to `undefined` when unset (the schema keeps it
  * optional, so `Required` alone would over-narrow it to `string`).
  */
-type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile' | 'lanBind' | 'profile' | 'tunnelToken'>> & {
+type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'trustedHosts' | 'devicesFile' | 'lanBind' | 'profile' | 'tunnelToken'>> & {
   publicBaseUrl: string | undefined
+  trustedHosts: string[] | undefined
   devicesFile: string
   /** undefined until the user flips the toggle once; undefined never writes the patch. */
   lanBind: boolean | undefined
@@ -259,6 +268,7 @@ const DEFAULTS: ResolvedConfig = {
   cookieName: 'dsh_pair',
   requirePairingForLan: true,
   publicBaseUrl: undefined,
+  trustedHosts: undefined,
   devicesFile: defaultDevicesFile(),
   autoTunnel: false,
   tunnelToken: undefined,
@@ -276,6 +286,7 @@ const DEFAULTS: ResolvedConfig = {
 export const apply = mountOnce('@linxin666/dsh-remote-web-ui', applyImpl)
 
 function applyImpl(ctx: Context, config?: Config): void {
+  const envPublicBase = process.env.DSH_REMOTE_PUBLIC_BASE_URL?.trim() || undefined
   const resolved: ResolvedConfig = {
     tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
     offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
@@ -283,7 +294,8 @@ function applyImpl(ctx: Context, config?: Config): void {
     idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
     cookieName: config?.cookieName ?? DEFAULTS.cookieName,
     requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-    publicBaseUrl: config?.publicBaseUrl,
+    publicBaseUrl: config?.publicBaseUrl ?? envPublicBase,
+    trustedHosts: config?.trustedHosts,
     devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
     autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
     tunnelToken: config?.tunnelToken,
@@ -305,7 +317,8 @@ function applyImpl(ctx: Context, config?: Config): void {
       idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
       cookieName: value.cookieName ?? DEFAULTS.cookieName,
       requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-      publicBaseUrl: value.publicBaseUrl,
+      publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
+      trustedHosts: value.trustedHosts,
       devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
       autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
       tunnelToken: value.tunnelToken,
@@ -445,13 +458,15 @@ function applyImpl(ctx: Context, config?: Config): void {
   // directory on update, so a boot-time captured path would fail to read
   // after a successful update; versions are re-read from disk per check.
   const requireFromHost = createRequire(import.meta.url)
-  const resolveAnchorPath = (): string | undefined => resolveAnchorManifest(specifier => {
+  /** Host-process resolve that degrades to "not installed" (undefined) instead of throwing. */
+  const hostResolve = (specifier: string): string | undefined => {
     try {
       return requireFromHost.resolve(specifier)
     } catch {
       return undefined
     }
-  })
+  }
+  const resolveAnchorPath = (): string | undefined => resolveAnchorManifest(hostResolve)
 
   const releaseNotesCache = new Map<string, { at: number; notes?: UpdateReleaseNotes }>()
   const fetchReleaseNotesCached = async (version: string): Promise<UpdateReleaseNotes | undefined> => {
@@ -467,13 +482,7 @@ function applyImpl(ctx: Context, config?: Config): void {
     fence: request => isTrustedApiRequest(request, []),
     check: () => checkUpdates({
       anchorManifestPath: resolveAnchorPath(),
-      resolve: specifier => {
-        try {
-          return requireFromHost.resolve(specifier)
-        } catch {
-          return undefined
-        }
-      },
+      resolve: hostResolve,
       fetchLatest: name => fetchLatestVersion(name, fetch),
       fetchReleaseNotes: fetchReleaseNotesCached,
     }),
@@ -497,13 +506,7 @@ function applyImpl(ctx: Context, config?: Config): void {
         run: { profileDir: target.profileDir, packages: target.packages },
         check: {
           anchorManifestPath: resolveAnchorPath(),
-          resolve: specifier => {
-            try {
-              return requireFromHost.resolve(specifier)
-            } catch {
-              return undefined
-            }
-          },
+          resolve: hostResolve,
           fetchLatest: name => fetchLatestVersion(name, fetch),
           fetchReleaseNotes: fetchReleaseNotesCached,
         },
@@ -589,10 +592,29 @@ function applyImpl(ctx: Context, config?: Config): void {
   const routes = [
     ...makeRoutes({
       service,
-      lanAddresses: service.lanAddresses,
       requirePairingForLan: () => resolve().requirePairingForLan,
       lanBindStatus,
       indexDocument: fetchAppShell,
+      trustedHosts: () => {
+        const list: string[] = []
+        const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS
+        if (typeof envHosts === 'string' && envHosts.trim() !== '') {
+          for (const item of envHosts.split(',')) {
+            const trimmed = item.trim()
+            if (trimmed !== '') list.push(trimmed)
+          }
+        }
+        const cfgHosts = resolve().trustedHosts
+        if (Array.isArray(cfgHosts)) {
+          for (const item of cfgHosts) {
+            if (typeof item === 'string') {
+              const trimmed = item.trim()
+              if (trimmed !== '') list.push(trimmed)
+            }
+          }
+        }
+        return list
+      },
     }),
     // The remote desktop channel: policy-gated `/remote` prefix that
     // re-issues fenced paths to loopback (see remote-api.ts). The live
@@ -852,13 +874,24 @@ function applyImpl(ctx: Context, config?: Config): void {
   }), 'remote-web-ui: remote channel boot patch')
 
   ctx.inject(['settings'], (settingsCtx) => {
-    settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-      setSource: (source) => {
-        current = source
+    try {
+      if (typeof settingsCtx.settings?.installSection === 'function') {
+        settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+          setSource: (source) => {
+            current = source
+            sync()
+          },
+          onChange: sync,
+        })
+      } else if (typeof settingsCtx.settings?.register === 'function') {
+        const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} })
+        current = () => scope?.get?.() ?? (config ?? {})
+        scope?.watch?.(() => { sync() })
         sync()
-      },
-      onChange: sync,
-    })
+      }
+    } catch {
+      // Defensive fallback against settings registration differences
+    }
   })
   sync()
 }

package/src/loopback-proxy.ts

@@ -93,6 +93,17 @@ function pipeLoopbackHttp(
     }
     res.writeHead(upstreamRes.statusCode ?? 502, out)
     upstreamRes.pipe(res)
+    // Inner leg died mid-response (reset, truncation): tear the outer leg
+    // down instead of letting the truncated response raise an unhandled
+    // 'error' with no listener.
+    upstreamRes.on('error', () => { res.destroy() })
+    // Outer leg died before the response finished (phone left mid-request):
+    // reset the inner request so the loopback server stops working on a call
+    // nobody will read. Guarded so a normal completion never destroys a
+    // keep-alive socket the agent would reuse.
+    res.on('close', () => {
+      if (!upstreamRes.readableEnded) upstream.destroy()
+    })
   })
   upstream.on('error', () => {
     if (!res.headersSent) {
@@ -101,6 +112,10 @@ function pipeLoopbackHttp(
     }
     res.destroy()
   })
+  // The outer request aborted mid-body: reset the inner request instead of
+  // feeding it a truncated body that still gets processed (mirror of the
+  // upgrade path's two-leg teardown).
+  req.on('error', () => { upstream.destroy() })
   req.pipe(upstream)
 }
 

package/src/routes.ts

@@ -66,6 +66,77 @@ export function isTrustedApiRequest(request: IncomingMessage, trustedHosts: read
   }
 }
 
+/**
+ * Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+ * Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+ * machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+ */
+export function isPrivateOrLocalHostname(hostname: string): boolean {
+  const normalized = hostname.toLowerCase().trim()
+  if (
+    normalized === 'localhost' ||
+    normalized.endsWith('.local') ||
+    normalized.endsWith('.lan') ||
+    normalized.endsWith('.internal') ||
+    normalized.endsWith('.home.arpa')
+  ) {
+    return true
+  }
+  let ip = normalized
+  if (ip.startsWith('[') && ip.endsWith(']')) ip = ip.slice(1, -1)
+  if (ip === '::1' || ip === '127.0.0.1') return true
+  if (ip.startsWith('fc') || ip.startsWith('fd') || ip.startsWith('fe80')) return true
+  const parts = ip.split('.').map(Number)
+  if (parts.length === 4 && parts.every(n => Number.isInteger(n) && n >= 0 && n <= 255)) {
+    const [a, b] = parts
+    if (a === 10) return true
+    if (a === 127) return true
+    if (a === 169 && b === 254) return true
+    if (a === 172 && b >= 16 && b <= 31) return true
+    if (a === 192 && b === 168) return true
+  }
+  return false
+}
+
+/**
+ * Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+ * and ensures Origin matches Host when present).
+ */
+export function isNonCrossSite(request: IncomingMessage): boolean {
+  if (request.headers['sec-fetch-site'] === 'cross-site') return false
+  const host = request.headers.host
+  if (typeof host !== 'string') return false
+  const origin = request.headers.origin
+  if (origin === undefined) return true
+  try {
+    const originUrl = new URL(origin)
+    const hostUrl = new URL(`http://${host}`)
+    return originUrl.host === hostUrl.host
+  } catch {
+    return false
+  }
+}
+
+/**
+ * The private-LAN fallback authority of a request: its Host header when the
+ * hostname is private/local (RFC 1918 / ULA / mDNS / loopback) and the
+ * browser markers are non-cross-site, else undefined. The accept paths and
+ * the lanFence fallback use this to serve container-bridged and reverse-proxy
+ * topologies whose Host is not among the advertised or configured authorities.
+ */
+function privateLanHostOf(request: IncomingMessage): string | undefined {
+  const host = request.headers.host
+  if (typeof host !== 'string') return undefined
+  let hostName = ''
+  try {
+    hostName = new URL(`http://${host}`).hostname
+  } catch {
+    return undefined
+  }
+  if (hostName === '' || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request)) return undefined
+  return host
+}
+
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
 const MAX_BODY_BYTES = 4096
 
@@ -85,6 +156,28 @@ export function acceptLimitKey(socketIp: string, forwarded: string | undefined,
   return `${bucket}|${socketIp}`
 }
 
+/**
+ * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
+ * every legitimate router/proxy aliasing shape, small enough that a flood of
+ * distinct private Host headers cannot grow the table unboundedly.
+ */
+export const MAX_DYNAMIC_TRUSTED_HOSTS = 64
+
+/**
+ * FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+ * (a Set iterates in insertion order). The dynamic trusted-host table is fed
+ * by caller-controlled Host headers, so it must stay bounded; an evicted
+ * legitimate host re-adds itself on that device's next gated request.
+ */
+export function addBounded(set: Set<string>, value: string, max: number): void {
+  if (set.has(value)) return
+  if (set.size >= max) {
+    const oldest = set.values().next().value
+    if (oldest !== undefined) set.delete(oldest)
+  }
+  set.add(value)
+}
+
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
@@ -339,8 +432,6 @@ export class PairingEventsStream {
 export interface PairRoutesDeps {
   /** The pairing service. */
   service: PairingService
-  /** The LAN IP literals the fence accepts (derived from the bind host). */
-  lanAddresses: readonly string[]
   /** Current desktop gate policy, re-read for every status response. */
   requirePairingForLan?: boolean | (() => boolean)
   /**
@@ -359,6 +450,8 @@ export interface PairRoutesDeps {
    * cookieless header/query credential). Undefined drops the route (tests).
    */
   indexDocument?: (deviceId: string) => Promise<string | undefined>
+  /** Extra trusted non-loopback hosts (from config or environment). */
+  trustedHosts?: readonly string[] | (() => readonly string[])
 }
 
 /**
@@ -367,21 +460,45 @@ export interface PairRoutesDeps {
  * @returns the exact routes to register on webServer.
  */
 export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
-  const { service, lanAddresses, requirePairingForLan = true } = deps
+  const { service, requirePairingForLan = true } = deps
   const pairingRequired = (): boolean => typeof requirePairingForLan === 'function'
     ? requirePairingForLan()
     : requirePairingForLan
   const events = new PairingEventsStream(service)
+  const dynamicTrustedHosts = new Set<string>()
 
   /** Loopback-only fence: the desktop panel's control endpoints. */
   const loopbackFence = (req: IncomingMessage): boolean => isTrustedApiRequest(req, [])
-  /** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
+  /** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
   const lanFence = (req: IncomingMessage): boolean => {
     const publicHost = publicHostOf(service.publicBaseUrl)
     // The service's LAN bases re-read per request: a hot rebind (the lan-bind
     // toggle) updates them mid-process, and the fence must follow.
     const bases = service.lanAddresses
-    return isTrustedApiRequest(req, publicHost === undefined ? bases : [...bases, publicHost])
+    const extraHosts = typeof deps.trustedHosts === 'function' ? deps.trustedHosts() : (deps.trustedHosts ?? [])
+    const combined = [
+      ...bases,
+      ...(publicHost !== undefined ? [publicHost] : []),
+      ...extraHosts,
+      ...dynamicTrustedHosts,
+    ]
+    if (isTrustedApiRequest(req, combined)) return true
+
+    // If request carries a valid paired device cookie from a private LAN host (e.g. after service restart), trust and remember it
+    const privateLanHost = privateLanHostOf(req)
+    if (privateLanHost !== undefined) {
+      const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName)
+      let queryDeviceId: string | null = null
+      try {
+        queryDeviceId = new URL(req.url ?? '/', 'http://pair.invalid').searchParams.get('device')
+      } catch {}
+      const deviceId = cookieDeviceId ?? queryDeviceId ?? undefined
+      if (deviceId !== undefined && service.hasDevice(deviceId)) {
+        addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+        return true
+      }
+    }
+    return false
   }
 
   const requireMethod = (req: IncomingMessage, res: ServerResponse, method: string): boolean => {
@@ -476,7 +593,8 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
 
   const handleAccept = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (!requireMethod(req, res, 'POST')) return
-    if (!lanFence(req)) {
+    const privateLanHost = privateLanHostOf(req)
+    if (!lanFence(req) && privateLanHost === undefined) {
       writeJson(res, 403, { ok: false, code: 'forbidden' })
       return
     }
@@ -493,9 +611,16 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     const ua = req.headers['user-agent']
     const result = service.accept(payload.token, typeof ua === 'string' ? ua : undefined)
     if (!result.ok) {
+      if (!lanFence(req)) {
+        writeJson(res, 403, { ok: false, code: 'forbidden' })
+        return
+      }
       writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code })
       return
     }
+    if (privateLanHost !== undefined) {
+      addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+    }
     // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
     // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
     // top-level navigations working while blocking cross-site subrequests.
@@ -612,7 +737,8 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
    */
   const handleAcceptPage = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (!requireMethod(req, res, 'GET')) return
-    if (!lanFence(req)) {
+    const privateLanHost = privateLanHostOf(req)
+    if (!lanFence(req) && privateLanHost === undefined) {
       res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
       res.end('forbidden')
       return
@@ -627,6 +753,11 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     const ua = req.headers['user-agent']
     const result = token === '' ? { ok: false as const, code: 'invalid' as const } : service.accept(token, typeof ua === 'string' ? ua : undefined)
     if (!result.ok) {
+      if (!lanFence(req)) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end('forbidden')
+        return
+      }
       // accept() now refuses only expired/unknown/stopped tokens: a consumed
       // token stays re-usable until its expiry or replacement, so a mobile
       // flow that split across cookie contexts (camera preview, in-app
@@ -646,6 +777,9 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       res.end(pairingFailurePage())
       return
     }
+    if (privateLanHost !== undefined) {
+      addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS)
+    }
     // Land the paired device on the cookieless app page: the official shell
     // served by this plugin, with the device id in the URL. No harness index
     // gate, no browser-auth cookie hop - the channel gate accepts the device