@linxin666/dsh-remote-web-ui 0.3.22 → 0.3.24

package/src/client/remote-channel.ts

@@ -207,6 +207,9 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
   const originalFetch = window.fetch
   const OriginalWebSocket = window.WebSocket
   const OriginalEventSource = window.EventSource
+  // Publish the official upload hook before the file-upload service reads it
+  // (issue #1580); removed again by the restore below.
+  const restoreUploadHook = installFileUploadHook(window as unknown as UploadHookWindow)
 
   const sameOrigin = (url: URL): boolean => url.origin === window.location.origin
   const rewrite = (raw: string): string => rewriteRawUrl(raw, window.location.href, window.location.origin)
@@ -301,6 +304,67 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
     window.WebSocket = OriginalWebSocket
     if (OriginalEventSource !== undefined) window.EventSource = OriginalEventSource
     for (const restore of restoreSrc) restore()
+    restoreUploadHook()
+  }
+}
+
+/** Page global the official pre-Cordis upload hook is published under. */
+export const FILE_UPLOAD_HOOK_GLOBAL = '__DSH_FILE_UPLOAD__'
+
+/** The subset of window the upload hook needs (injectable for tests). */
+export interface UploadHookWindow {
+  fetch: typeof globalThis.fetch
+  location: { href: string; origin: string }
+  /** Pre-existing hook owner; left untouched when present. */
+  __DSH_FILE_UPLOAD__?: {
+    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>
+  }
+}
+
+/**
+ * Publish the official pre-Cordis upload hook so background uploads keep
+ * riding the patched main-thread fetch (issue #1580).
+ *
+ * `@deepseek-ai/dsh-client-file-upload` reads `globalThis.__DSH_FILE_UPLOAD__`
+ * once when its runtime is constructed; without it the carrier is a Web
+ * Worker, whose own globals no main-thread patch reaches. That worker's XHR
+ * goes straight to `<origin>/api/session/uploadFileBinary` with neither the
+ * `/remote` rewrite nor the cookieless device credential, so the harness
+ * browser-auth fence answers 401 and every upload from a paired browser
+ * fails. Rewriting the worker URL cannot fix it: a worker context carries
+ * neither the pairing cookie nor the device header.
+ *
+ * The hook hands the runtime the same transport the rest of the page uses -
+ * the boot script publishes an identical one (remote-channel-boot.ts), and
+ * this is the fallback for pages served without it.
+ *
+ * @param window - the browser window (or a test double), BEFORE the channel patch.
+ * @returns a function retiring the hook (a pre-existing one is left alone).
+ */
+export function installFileUploadHook(window: UploadHookWindow): () => void {
+  if (window.__DSH_FILE_UPLOAD__ !== undefined) return () => {}
+  const originalFetch = window.fetch
+  const hook = {
+    fetch: (input: string | URL, init?: RequestInit): Promise<Response> => {
+      const raw = typeof input === 'string' ? input : input.href
+      let url: URL
+      try {
+        url = new URL(raw, window.location.href)
+      } catch {
+        return originalFetch.call(window, input, init)
+      }
+      // Delegate the whole decision to the patched fetch: rewriting the path
+      // here first would make it skip its own rewrite branch and drop the
+      // device credential the fence requires.
+      if (url.origin === window.location.origin && url.pathname === RULES.uploadPath) {
+        return window.fetch.call(window, raw, init)
+      }
+      return originalFetch.call(window, input, init)
+    },
+  }
+  window.__DSH_FILE_UPLOAD__ = hook
+  return () => {
+    if (window.__DSH_FILE_UPLOAD__ === hook) delete window.__DSH_FILE_UPLOAD__
   }
 }
 

package/src/console-output.ts

@@ -0,0 +1,97 @@
+// Generated by scripts/sync-shared.mjs from shared/host/console-output.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Console-output capture shared by the family's Host halves.
+ *
+ * A child process's stdout/stderr are raw bytes, and on Windows a console
+ * program writes the OEM code page (CP936/GBK on a zh-CN system), not UTF-8.
+ * Decoding each chunk on its own corrupts the text twice over: the
+ * encoding is guessed wrong, and a multi-byte character split across two reads
+ * decodes into two replacement characters. This capture accumulates raw bytes
+ * under a byte budget and decodes exactly once, at read time.
+ */
+
+/** Bounded byte accumulator for one child process's interleaved stdout/stderr. */
+export interface OutputCapture {
+  /** Append one raw chunk (the bytes are copied into the budget). */
+  push(chunk: Uint8Array): void
+  /**
+   * Decode everything captured so far. Idempotent, so a caller may read the
+   * tail both after a failure branch and at settlement.
+   */
+  read(): string
+}
+
+/** Count the U+FFFD replacement characters one candidate decode produced. */
+function replacementCount(text: string): number {
+  let count = 0
+  for (const character of text) {
+    if (character === '\uFFFD') count += 1
+  }
+  return count
+}
+
+/**
+ * Decode one console byte buffer. Strict UTF-8 wins whenever it is valid;
+ * otherwise the bytes are not UTF-8 at all and the console wrote its own code
+ * page, so the candidate that loses the least text is taken.
+ * @param bytes - the captured bytes.
+ * @returns the decoded text.
+ */
+export function decodeConsoleBytes(bytes: Uint8Array): string {
+  try {
+    return new TextDecoder('utf-8', { fatal: true }).decode(bytes)
+  } catch {
+    // Not valid UTF-8. Prefer whichever candidate leaves the fewest
+    // replacement characters so real UTF-8 text carrying one bad byte is not
+    // rewritten wholesale as GBK gibberish; without the legacy code page
+    // (small-ICU builds) the lenient UTF-8 pass is all that is left.
+    let best: string | undefined
+    let bestLoss = Number.POSITIVE_INFINITY
+    for (const label of ['gbk', 'utf-8']) {
+      let text: string
+      try {
+        text = new TextDecoder(label).decode(bytes)
+      } catch {
+        continue
+      }
+      const loss = replacementCount(text)
+      if (loss < bestLoss) {
+        best = text
+        bestLoss = loss
+      }
+    }
+    /* v8 ignore next 3 -- reachable only without the legacy code page AND without the lenient pass */
+    if (best === undefined) return Buffer.from(bytes).toString('utf8')
+    return best
+  }
+}
+
+/**
+ * Create a capture bounded to a byte budget. Overflow drops from the FRONT
+ * (the tail is what carries a failure reason), and the cut never lands inside
+ * a character: leading UTF-8 continuation bytes are dropped with it, and a
+ * legacy code page's dangling lead byte — indistinguishable from a real byte
+ * without knowing the encoding until the whole buffer is decoded — is removed
+ * with the one replacement character it produced, so an over-long stream still
+ * reads cleanly at the seam.
+ * @param maxBytes - maximum retained bytes.
+ * @returns the capture.
+ */
+export function createOutputCapture(maxBytes: number): OutputCapture {
+  let buffer = Buffer.alloc(0)
+  let trimmed = false
+  return {
+    push(chunk: Uint8Array): void {
+      buffer = buffer.length === 0 ? Buffer.from(chunk) : Buffer.concat([buffer, Buffer.from(chunk)])
+      if (buffer.length <= maxBytes) return
+      let start = buffer.length - maxBytes
+      while (start < buffer.length && (buffer[start] & 0xc0) === 0x80) start += 1
+      buffer = Buffer.from(buffer.subarray(start))
+      trimmed = true
+    },
+    read(): string {
+      const text = decodeConsoleBytes(buffer)
+      return trimmed && text.startsWith('\uFFFD') ? text.slice(1) : text
+    },
+  }
+}

package/src/index.ts

@@ -37,6 +37,7 @@ import { loadRelayIdentity, RelayRegistrar, type RelayState } from './relay-regi
 import { desiredBindHost, desiredBindPort, firewallActionNeeded, pendingRestartOf, type AppliedFirewallState, type StartupFacts } from './lan-bind-plan.ts'
 import { createInnerAuth } from './inner-auth.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
+import { PublicBaseKeeper } from './public-base.ts'
 import {
   checkUpdates,
   fetchGitHubReleaseNotes,
@@ -343,17 +344,18 @@ function applyImpl(ctx: Context, config?: Config): void {
   // raw quick URL is used, exactly as before. Named tunnels keep their fixed
   // dashboard hostname and never touch the relay.
   let relayRegistrar: RelayRegistrar | undefined
-  let relayUrl: string | undefined
-  let rawTunnelUrl: string | undefined
+  /**
+   * The public base the pairing fence trusts. A tunnel reconnect must not
+   * strip the host the QR still shows: named and relay hosts never change,
+   * and a quick tunnel's host survives a bounded grace window (issue #1547).
+   */
+  const publicBase = new PublicBaseKeeper((base) => { service.setPublicBaseUrl(base) })
   /** The tunnel target the registrar last announced (dedupes sync re-runs). */
   let relayAnnouncedFor: string | undefined
-  const setPublicBase = (): void => {
-    service.setPublicBaseUrl(relayUrl ?? rawTunnelUrl)
-  }
   const disposeRelayRegistrar = (unregister: boolean = false): void => {
     const registrar = relayRegistrar
     relayRegistrar = undefined
-    relayUrl = undefined
+    publicBase.setRelay(undefined)
     relayAnnouncedFor = undefined
     if (registrar === undefined) return
     // Toggle-off removes the registry row so the stable origin stops
@@ -371,16 +373,15 @@ function applyImpl(ctx: Context, config?: Config): void {
         relayRegistrar = new RelayRegistrar(identity, (state: RelayState) => {
           service.setRelayStatus(state.state === 'off' ? undefined : state)
           if (state.state === 'running') {
-            relayUrl = state.url
+            publicBase.setRelay(state.url)
           } else if (state.state === 'off') {
-            relayUrl = undefined
+            publicBase.setRelay(undefined)
           } else if (state.state === 'failed') {
             // Keep the last relay URL on failures: the phone origin only
             // breaks when the mapping itself goes stale, not when one
             // refresh call fails. The registrar retries with backoff.
             console.warn(`remote-web-ui: relay registration failed (${state.error}) — the stable origin may serve its offline page until the retry lands`)
           }
-          setPublicBase()
         })
       } catch (error) {
         console.warn(`remote-web-ui: relay registry unavailable (${error instanceof Error ? error.message : String(error)}) — the quick URL is the QR base`)
@@ -399,27 +400,28 @@ function applyImpl(ctx: Context, config?: Config): void {
   tunnel.onPhase((info: TunnelInfo) => {
     if (tunnelMode === 'off') return
     if (info.phase === 'running' && info.url !== undefined) {
-      rawTunnelUrl = info.url
-      setPublicBase()
+      publicBase.markRunning(info.url)
       service.setTunnelStatus({ state: 'running', url: info.url })
       const registrar = tunnelMode === 'quick' ? ensureRelayRegistrar() : undefined
       if (registrar !== undefined) announceRelay(registrar, info.url)
       runPostureProbe()
     } else if (info.phase === 'starting') {
-      // A restart mints a NEW hostname: the previous URL dies with the old
-      // process, so clear it now rather than advertising a dead link.
-      rawTunnelUrl = undefined
-      relayUrl = undefined
-      setPublicBase()
+      // A quick-tunnel restart mints a new hostname, but the old one is not
+      // dropped at once: the edge may still deliver a connection the phone
+      // already opened, and the reconnect usually lands inside the grace
+      // window (issue #1547). A named tunnel keeps its fixed hostname, and a
+      // registered relay its stable subdomain, so neither is ever dropped
+      // here — the previous code cleared the relay base on every restart.
+      publicBase.markReconnecting()
       service.setTunnelStatus({ state: 'starting' })
     } else if (info.phase === 'failed') {
-      rawTunnelUrl = undefined
-      setPublicBase()
+      publicBase.markReconnecting()
       service.setTunnelStatus(info.error === undefined ? { state: 'failed' } : { state: 'failed', error: info.error })
     }
   })
   ctx.effect(() => () => {
     disposeRelayRegistrar()
+    publicBase.dispose()
     tunnel.dispose()
   }, 'remote-web-ui: auto tunnel')
   // The bind facts are known by now (webServer is an inject edge): the LAN
@@ -768,22 +770,24 @@ function applyImpl(ctx: Context, config?: Config): void {
     // publicBaseUrl applies only when no tunnel runs.
     const plan = tunnelPlanOf(value, ctx.webServer.port)
     tunnelMode = plan.mode
+    publicBase.setMode(plan.mode)
+    const liveTunnelUrl = publicBase.quickUrl()
     if (plan.mode !== 'quick') {
       // The relay only fronts the quick tunnel; named mode owns its fixed
       // dashboard hostname and the off mode has no public base at all.
       disposeRelayRegistrar()
-      if (plan.mode !== 'named') setPublicBase()
+      if (plan.mode !== 'named') publicBase.refresh()
     } else if (value.relay === false) {
       // The relay toggle is off: no stable origin, the raw quick URL is the
       // QR base exactly as before the relay existed.
       disposeRelayRegistrar(true)
-      setPublicBase()
-    } else if (rawTunnelUrl !== undefined) {
+      publicBase.refresh()
+    } else if (liveTunnelUrl !== undefined) {
       // The relay just turned on (or the registrar is new) while the tunnel
       // already runs: announce now — no phase event will fire for an
       // unchanged target.
       const registrar = ensureRelayRegistrar()
-      if (registrar !== undefined) announceRelay(registrar, rawTunnelUrl)
+      if (registrar !== undefined) announceRelay(registrar, liveTunnelUrl)
     }
     if (plan.mode === 'quick') {
       for (const ignored of plan.ignored) {

package/src/public-base.ts

@@ -0,0 +1,122 @@
+/**
+ * The public base the pairing fence trusts while a tunnel is not running
+ * (issue #1547).
+ *
+ * The fence reads exactly one public host: `service.publicBaseUrl`. Dropping
+ * it the instant the tunnel leaves `running` makes every public request from
+ * the address still printed in the QR code answer 403 — including
+ * `/api/pair/status`, which exists to be callable before pairing. Two of the
+ * three tunnel modes never lose their host: a named tunnel keeps its fixed
+ * dashboard hostname, and a registered relay keeps its stable subdomain. A
+ * quick tunnel does mint a new hostname on restart, so its previous host is
+ * kept only for a bounded grace window: Cloudflare's edge can still deliver a
+ * connection the phone already opened, and a mobile network reconnects
+ * constantly, so an instant drop turns the phone's retry into a silent 403.
+ * @module @linxin666/dsh-remote-web-ui/public-base
+ */
+
+/** How long a quick-tunnel host stays trusted after the tunnel stops running. */
+export const PUBLIC_BASE_GRACE_MS = 60_000
+
+/** Tunnel ownership of the public base, as resolved from the settings document. */
+export type TunnelBaseMode = 'off' | 'quick' | 'named'
+
+/**
+ * Owns the trusted public base across tunnel and relay transitions.
+ *
+ * The keeper never decides on its own to widen trust: it only postpones
+ * dropping an address the operator (named/relay) or the tunnel (quick) had
+ * already published, and it forgets it once the tunnel comes back with the
+ * address that actually serves the QR.
+ */
+export class PublicBaseKeeper {
+  private mode: TunnelBaseMode = 'off'
+  private tunnelUrl: string | undefined
+  private relayUrl: string | undefined
+  private graceTimer: ReturnType<typeof setTimeout> | undefined
+
+  /**
+   * @param onChange - receives the base the fence should trust from now on.
+   * @param graceMs - how long a quick-tunnel host outlives its tunnel.
+   */
+  constructor(
+    private readonly onChange: (base: string | undefined) => void,
+    private readonly graceMs: number = PUBLIC_BASE_GRACE_MS,
+  ) {}
+
+  /** The base a fresh fence read should trust: the stable relay origin wins. */
+  current(): string | undefined {
+    return this.relayUrl ?? this.tunnelUrl
+  }
+
+  /** The mode that currently owns the public base. */
+  setMode(mode: TunnelBaseMode): void {
+    this.mode = mode
+  }
+
+  /** The last quick-tunnel URL, for callers that must announce it downstream. */
+  quickUrl(): string | undefined {
+    return this.tunnelUrl
+  }
+
+  /** A relay registration result; undefined withdraws the stable origin. */
+  setRelay(url: string | undefined): void {
+    this.relayUrl = url
+    this.emit()
+  }
+
+  /** The tunnel reported a live URL: it supersedes any pending grace. */
+  markRunning(url: string): void {
+    this.cancelGrace()
+    this.tunnelUrl = url
+    this.emit()
+  }
+
+  /**
+   * The tunnel left `running` (starting again, or failed). A named tunnel's
+   * fixed hostname stays trusted; a quick tunnel's previous host stays
+   * trusted for the grace window, then is dropped if nothing replaced it.
+   */
+  markReconnecting(): void {
+    if (this.mode === 'named') return
+    this.startGrace()
+  }
+
+  /** Re-publish the current base after a branch change that did not move it. */
+  refresh(): void {
+    this.emit()
+  }
+
+  /** Forget everything (teardown, or a mode change that stops the tunnel). */
+  reset(): void {
+    this.cancelGrace()
+    this.tunnelUrl = undefined
+    this.relayUrl = undefined
+    this.emit()
+  }
+
+  /** Cancel the pending grace timer; the keeper keeps its last base. */
+  dispose(): void {
+    this.cancelGrace()
+  }
+
+  private startGrace(): void {
+    if (this.tunnelUrl === undefined) return
+    if (this.graceTimer !== undefined) return
+    this.graceTimer = setTimeout(() => {
+      this.graceTimer = undefined
+      this.tunnelUrl = undefined
+      this.emit()
+    }, this.graceMs)
+  }
+
+  private cancelGrace(): void {
+    if (this.graceTimer === undefined) return
+    clearTimeout(this.graceTimer)
+    this.graceTimer = undefined
+  }
+
+  private emit(): void {
+    this.onChange(this.current())
+  }
+}

package/src/remote-channel-boot.ts

@@ -17,8 +17,11 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. The script self-skips on loopback origins and
- * never throws.
+ * gated /remote channel. It finally publishes the official pre-Cordis
+ * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
+ * transport otherwise runs inside a Web Worker whose own globals the
+ * main-thread rewrite cannot reach (issue #1580). The script self-skips on
+ * loopback origins and never throws.
  * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
  */
 
@@ -142,6 +145,29 @@ export function buildRemoteChannelBootScript(rules: RemoteChannelRules = REMOTE_
     'Object.defineProperty(C.prototype,"src",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});' +
     'restores.push(function(){Object.defineProperty(C.prototype,"src",d)})}' +
     'patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);' +
+    // Background uploads must stay on the patched main-thread fetch
+    // (issue #1580). Without this hook @deepseek-ai/dsh-client-file-upload
+    // runs its carrier in a Web Worker, whose own globals no main-thread
+    // patch reaches: the worker's XHR goes straight to <origin>/api/...
+    // without the /remote rewrite and without the device credential, so the
+    // harness browser-auth fence answers 401 and every upload from a paired
+    // browser fails. The hook is the official pre-Cordis seam (the runtime
+    // reads it once in its constructor) and rewriting the worker URL is
+    // provably insufficient - a worker context carries neither the pairing
+    // cookie nor the device header. Hand the runtime the patched fetch
+    // instead: it takes the absolute route URL and a RequestInit, and hands
+    // both to the patched w.fetch, which owns the /remote rewrite AND the
+    // cookieless device header. Delegating the whole decision is deliberate:
+    // rewriting the path here first would make w.fetch see an already-gated
+    // /remote/api path, skip its own rewrite branch, and drop the device
+    // credential that the fence requires.
+    'function uf(u,init){' +
+    'var raw=typeof u==="string"?u:u.href;' +
+    'if(typeof raw!=="string")return of.call(w,u,init||{});' +
+    'var q=new URL(raw,loc.href);' +
+    'if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});' +
+    'return of.call(w,u,init||{})}' +
+    'try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}' +
     'seat.restore=function(){' +
     'w.fetch=of;' +
     'w.WebSocket=OW;' +

package/src/remote-channel-rules.ts

@@ -33,6 +33,10 @@ export interface RemoteChannelRules {
   readonly deviceKey: string
   /** Query parameter carrying it on WebSocket upgrades. */
   readonly deviceQuery: string
+  /** Raw upload route the boot hook keeps on the gated channel. */
+  readonly uploadPath: string
+  /** Page global the pre-Cordis upload hook is published under. */
+  readonly uploadHookGlobal: string
 }
 
 /** The live rule set. */
@@ -57,6 +61,8 @@ export const REMOTE_CHANNEL_RULES: RemoteChannelRules = {
   deviceHeader: REMOTE_DEVICE_HEADER,
   deviceKey: 'dsh-remote-device',
   deviceQuery: REMOTE_DEVICE_QUERY,
+  uploadPath: '/api/session/uploadFileBinary',
+  uploadHookGlobal: '__DSH_FILE_UPLOAD__',
 }
 
 /** The window global the boot patch publishes its seat under. */

package/src/update.ts

@@ -12,6 +12,7 @@
 import { readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { spawn } from 'node:child_process'
+import { decodeConsoleBytes } from './console-output.ts'
 
 /** npm registry base used for version probes. */
 export const NPM_REGISTRY = 'https://registry.npmjs.org'
@@ -573,18 +574,12 @@ const WIN_CMD_MISSING_RE = /not recognized as an internal or external command|
 /**
  * Decode process output with tolerant decoding:
  * Defaults to UTF-8; if invalid byte sequences are encountered (common on
- * Windows consoles using code page 936/GBK), falls back to GBK via TextDecoder.
+ * Windows consoles using code page 936/GBK), falls back to the code page that
+ * loses the least text. Bytes are decoded once per whole chunk by the caller's
+ * accumulator — decoding per \`data\` event would split multi-byte characters.
  */
 function decodeProcessChunk(chunk: Buffer): string {
-  try {
-    return new TextDecoder('utf-8', { fatal: true }).decode(chunk)
-  } catch {
-    try {
-      return new TextDecoder('gbk').decode(chunk)
-    } catch {
-      return chunk.toString('utf8')
-    }
-  }
+  return decodeConsoleBytes(chunk)
 }
 
 /**