@linxin666/dsh-remote-web-ui 0.4.1 → 0.4.2

package/src/remote-channel-rules.ts

@@ -11,6 +11,111 @@ export const REMOTE_PREFIX = '/remote'
 
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from './remote-methods.ts'
 
+/**
+ * The schemes that can deliver a page a remote party controls: the network
+ * transports, plus the documents a network page can mint. Every other scheme
+ * is registered and served by an application on this machine, so its page is
+ * the machine's own page whatever the application calls the scheme.
+ *
+ * The list is deliberately the *web* side rather than an allowlist of known
+ * desktop shells. The official DSH Desktop shell serves its Web GUI from
+ * `dsh-app://app/` (`location.hostname === 'app'`), which no hostname
+ * predicate can recognise; a scheme allowlist fixed that instance (#1682) but
+ * left the next shell — or a `file:` page — fenced behind a pairing page it
+ * can never complete, because a pairing link is reachable only over the
+ * network. Naming the web side instead makes an unknown application scheme
+ * local by construction.
+ *
+ * `blob:`, `data:`, `about:` and `filesystem:` stay on the web side: a
+ * network page mints those documents, so they must keep the fence.
+ */
+export const WEB_PAGE_PROTOCOLS: readonly string[] = [
+  'http:',
+  'https:',
+  'blob:',
+  'data:',
+  'about:',
+  'filesystem:',
+]
+
+/**
+ * Whether one page scheme can carry a document a remote party controls.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @returns true for the network transports and the documents they mint.
+ */
+export function isWebPageProtocol(protocol: string): boolean {
+  return WEB_PAGE_PROTOCOLS.includes(protocol)
+}
+
+/**
+ * Hostname-only loopback classification: localhost, the IPv6 loopback literal
+ * (WHATWG keeps its brackets) and any 127/8 IPv4 literal. Kept string-in,
+ * boolean-out and dependency-free so the browser half and the inlined boot
+ * script can both run it verbatim.
+ * @param hostname - a page/cookie hostname, IPv6 literals bracketed.
+ * @returns true for a loopback name or literal.
+ */
+export function isLoopbackHostname(hostname: string): boolean {
+  if (hostname === 'localhost' || hostname === '::1' || hostname === '[::1]') return true
+  const parts = hostname.split('.')
+  return parts.length === 4 && parts[0] === '127' && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
+}
+
+/**
+ * Whether the current page is served from the machine running the host, so
+ * its same-origin traffic must NOT be fenced behind the pairing channel.
+ * Three independent facts all describe the page itself and any one is enough:
+ *
+ * - the page's own hostname is loopback;
+ * - the page's protocol is not a {@link WEB_PAGE_PROTOCOLS} web scheme, so an
+ *   application on this machine delivered it — the desktop shell's
+ *   `dsh-app://app/` is one such page, and a scheme this build has never
+ *   heard of is another;
+ * - the official connection transport already declared this shell the host
+ *   owner (`__DSH_TRANSPORT__.ownsHost === true`) AND the page is not a
+ *   network origin. The official client reads the same hook to derive
+ *   `connection.isLoopback`, and the desktop shell sets it before any boot
+ *   entry — without this term the plugin's predicate contradicts the host's
+ *   own conclusion (#1682). The network-origin guard is deliberate: this
+ *   plugin's own device-gated landing (a LAN or tunnel page) publishes the
+ *   same hook to grant a paired remote the full UI, and that page must keep
+ *   riding the gated channel — `ownsHost` buys the presentation, never an
+ *   exemption from the pairing fence.
+ *
+ * The order matters: loopback is checked first so a loopback page keeps its
+ * exemption even on a scheme no list carries, and the scheme test runs before
+ * the hook test so a web page always reaches the network-origin guard. A
+ * missing or empty scheme is not evidence of a local page - the fence stays
+ * up - because a real document always reports its own scheme.
+ *
+ * @param hostname - `location.hostname` of the page.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @param transportOwnsHost - `__DSH_TRANSPORT__?.ownsHost` as read by the caller.
+ * @returns true when the page is local and needs no remote channel.
+ */
+export function isLocalPage(hostname: string, protocol?: string, transportOwnsHost?: boolean): boolean {
+  if (isLoopbackHostname(hostname)) return true
+  // A missing or empty scheme is not evidence of a local page: a real
+  // document always reports one, so the fence stays up when it is unreadable.
+  if (protocol !== undefined && protocol !== '' && !isWebPageProtocol(protocol)) return true
+  // A granted remote also sets ownsHost; only a page whose own origin is
+  // otherwise local may treat the hook as proof of a local page.
+  return transportOwnsHost === true && !isNetworkOrigin(hostname)
+}
+
+/**
+ * Whether a hostname can only be reached across a network, so a page on it is
+ * remote whatever transport hook it carries: any IPv4/IPv6 literal (a dot or a
+ * colon) or any dotted DNS name. A hostname with no dot and no colon is a
+ * scheme-local authority (the desktop shell's `app`), which is why this test,
+ * not a loopback test, is what the `ownsHost` term is gated on.
+ * @param hostname - the page hostname.
+ * @returns true when the page cannot be the machine's own local page.
+ */
+function isNetworkOrigin(hostname: string): boolean {
+  return hostname.includes('.') || hostname.includes(':')
+}
+
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY }
 
 /** Connection-plugin method prefix under the gated channel. */
@@ -44,6 +149,13 @@ export interface RemoteChannelRules {
   readonly uploadPath: string
   /** Page global the pre-Cordis upload hook is published under. */
   readonly uploadHookGlobal: string
+  /**
+   * Schemes that can carry a remotely controlled document (see
+   * WEB_PAGE_PROTOCOLS): a page on any other scheme is delivered by an
+   * application on this machine. Carried in the rules so the inlined boot
+   * script applies the same list.
+   */
+  readonly webProtocols: readonly string[]
   /**
    * Page global carrying the server-issued host-mode grant. Only the plugin's
    * own device-gated app landing (/pair-app) publishes it; the boot patch
@@ -79,6 +191,7 @@ export const REMOTE_CHANNEL_RULES: RemoteChannelRules = {
   deviceQuery: REMOTE_DEVICE_QUERY,
   uploadPath: '/api/session/uploadFileBinary',
   uploadHookGlobal: '__DSH_FILE_UPLOAD__',
+  webProtocols: WEB_PAGE_PROTOCOLS,
   hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL,
 }
 

package/src/update.ts

@@ -307,6 +307,34 @@ function familyUpdatePackages(
   return [...names]
 }
 
+/** Concurrent registry probes in flight for one update-status call. */
+export const UPDATE_PROBE_CONCURRENCY = 4
+
+/**
+ * Probe every package's latest version with a bounded number of requests in
+ * flight, preserving the caller's order in the result.
+ * @param names - package names to probe.
+ * @param fetchLatest - the probe for one package (returns undefined on failure).
+ * @returns one result per name, in the input order.
+ */
+export async function probeLatestVersions(
+  names: readonly string[],
+  fetchLatest: (name: string) => Promise<string | undefined>,
+): Promise<(string | undefined)[]> {
+  const results: (string | undefined)[] = new Array(names.length)
+  let next = 0
+  const worker = async (): Promise<void> => {
+    for (;;) {
+      const index = next++
+      if (index >= names.length) return
+      results[index] = await fetchLatest(names[index]!)
+    }
+  }
+  const workers = Math.min(UPDATE_PROBE_CONCURRENCY, names.length)
+  await Promise.all(Array.from({ length: workers }, () => worker()))
+  return results
+}
+
 /**
  * Probe the npm registry for one package's latest release.
  * @param name - the package name (scope slash URL-encoded).
@@ -483,9 +511,14 @@ export async function checkUpdates(deps: UpdateCheckDeps): Promise<UpdateStatus>
   // aggregate) still check every installed @linxin666/* plugin (#377);
   // familyUpdatePackages skips link:/file: development dependencies.
   const names = familyUpdatePackages(anchor, manifest, profileManifest)
-  // The registry probes are independent: run them together instead of
-  // serializing up to N x 10s of registry latency behind one status call.
-  const latestList = await Promise.all(names.map(name => deps.fetchLatest(name)))
+  // The registry probes are independent, so they run concurrently — but with a
+  // small ceiling rather than all at once. A full install fans out ~20 probes,
+  // and on hosts behind an application-aware security middlebox that burst is
+  // what gets the node process's outbound connections throttled (the update
+  // check itself only ever loses latency: one probe is 10s-bounded and a
+  // failure is shown as a probe failure). Four keeps the status call quick
+  // while staying inside the concurrency such a middlebox tolerates (#1677).
+  const latestList = await probeLatestVersions(names, deps.fetchLatest)
   const packages: UpdatePackageStatus[] = []
   let probeFailures = 0
   names.forEach((name, index) => {