@linxin666/dsh-remote-web-ui 0.4.1 → 0.4.3

package/lib/types/tunnel.d.ts

@@ -12,9 +12,16 @@
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
- * backoff) around it. All seams — the tunnel factory, binary readiness,
- * timers — are injectable so the whole lifecycle is unit-testable without
- * a real binary or network.
+ * backoff, and the public-URL readiness watchdog) around it. All seams — the
+ * tunnel factory, binary readiness, the URL probe, timers — are injectable
+ * so the whole lifecycle is unit-testable without a real binary or network.
+ *
+ * 'running' is not a terminal state: the connector can lose its edge
+ * registration while the process keeps living, which leaves a hostname that
+ * no longer resolves. The watchdog below probes the public URL of a running
+ * tunnel and reuses the crash-restart path when it stops answering, so the
+ * relay is re-registered against a freshly minted URL instead of proxying a
+ * dead one (issue #1723).
  */
 /** The observable tunnel lifecycle the settings/panel surfaces render. */
 export type TunnelPhase = 'stopped' | 'starting' | 'running' | 'failed';
@@ -68,6 +75,21 @@ export interface TunnelHandle {
     off(event: string, listener: (...args: any[]) => void): unknown;
     stop(): boolean;
 }
+/**
+ * Probe one public tunnel URL from the host. Resolves true when the URL is
+ * served (any HTTP answer below 500 — a harness without credentials answers
+ * 401/403, which is a healthy round trip), false for a DNS failure, a refused
+ * connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+ * — the shapes a tunnel that lost its edge registration produces.
+ *
+ * The probe must never reject: the watchdog reads a rejection as a dead
+ * tunnel and restarts on it, so a local programming error would otherwise
+ * recycle working tunnels forever.
+ * @param url - the tunnel's public URL.
+ * @param timeoutMs - how long one probe may take.
+ * @returns whether the URL answered as a live origin.
+ */
+export declare function probeTunnelUrl(url: string, timeoutMs: number): Promise<boolean>;
 /** Injectable seams (defaults are the real cloudflared package + node timers). */
 export interface TunnelManagerOptions {
     /** Spawn one tunnel process for the target (quick or named). */
@@ -85,6 +107,14 @@ export interface TunnelManagerOptions {
         setTimeout(fn: () => void, ms: number): unknown;
         clearTimeout(t: unknown): void;
     };
+    /** Probe one public URL; false means the tunnel stopped answering. */
+    probe?: (url: string, timeoutMs: number) => Promise<boolean>;
+    /** How often to probe the public URL of a running tunnel (0 disables it). */
+    healthCheckIntervalMs?: number;
+    /** Consecutive probe failures after which the tunnel is restarted. */
+    healthCheckFailures?: number;
+    /** How long one probe may take. */
+    probeTimeoutMs?: number;
 }
 /**
  * Probe whether the binary at `path` actually executes on this machine. The
@@ -109,6 +139,12 @@ export interface BinaryReadinessSeams {
 export declare function createBinaryReadiness(executable: string, seams?: BinaryReadinessSeams): () => Promise<void>;
 /** How many archive downloads one process may attempt before giving up. */
 export declare const MAX_BINARY_INSTALL_ATTEMPTS = 3;
+/** How often a running tunnel's public URL is probed (issue #1723). */
+export declare const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60000;
+/** Consecutive failed probes before the tunnel is declared dead. */
+export declare const DEFAULT_HEALTH_CHECK_FAILURES = 2;
+/** How long one public-URL probe may take. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 10000;
 /**
  * Spawn flags for one quick target. `originHostHeader` stamps the Host the
  * local webserver sees: the plugin's phone-facing fence trusts the configured
@@ -150,6 +186,10 @@ export declare class TunnelManager {
     private readonly restartBaseMs;
     private readonly restartMaxMs;
     private readonly timer;
+    private readonly probe;
+    private readonly healthCheckIntervalMs;
+    private readonly healthCheckFailures;
+    private readonly probeTimeoutMs;
     private phase;
     private url;
     private error;
@@ -157,6 +197,8 @@ export declare class TunnelManager {
     private handle;
     private urlTimer;
     private restartTimer;
+    private healthTimer;
+    private healthFailures;
     private attempts;
     private generation;
     private stopping;
@@ -189,6 +231,21 @@ export declare class TunnelManager {
     onPhase(listener: (info: TunnelInfo) => void): () => void;
     private attempt;
     private handleUrl;
+    /**
+     * Watch the readiness of a running tunnel. cloudflared can keep its process
+     * (and its metrics port) alive while every edge connection is gone, leaving
+     * a minted hostname that no longer resolves: the manager used to report
+     * 'running' forever and the relay kept forwarding to that dead address, so
+     * the phone hit Cloudflare 1016 instead of the relay's offline page
+     * (issue #1723). A bounded number of consecutive probe failures ends the
+     * attempt through the ordinary fail/backoff path, which mints a new URL and
+     * re-announces the relay.
+     */
+    private startHealthWatch;
+    /** One probe round of the running tunnel's public URL. */
+    private healthCheck;
+    /** Cancel the readiness watchdog (teardown, restart, stop). */
+    private stopHealthWatch;
     private handleExit;
     private fail;
     /** Stop the current process and cancel every pending timer (no phase change). */

package/lib/types/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CA+B/G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAa5C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAS5E;AA0BD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBrF;AAOD,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IAC3F,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CA+B/G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAE5C,uEAAuE;AACvE,eAAO,MAAM,gCAAgC,QAAS,CAAA;AACtD,oEAAoE;AACpE,eAAO,MAAM,6BAA6B,IAAI,CAAA;AAC9C,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAa9C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAS5E;AA0BD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAC3G,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAEvC,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAa9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAqBjB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAgBxB,0DAA0D;YAC5C,WAAW;IA2BzB,+DAA+D;IAC/D,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAsBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,QAAQ;CAWjB"}

package/lib/types/tunnel.js

@@ -12,9 +12,16 @@
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
- * backoff) around it. All seams — the tunnel factory, binary readiness,
- * timers — are injectable so the whole lifecycle is unit-testable without
- * a real binary or network.
+ * backoff, and the public-URL readiness watchdog) around it. All seams — the
+ * tunnel factory, binary readiness, the URL probe, timers — are injectable
+ * so the whole lifecycle is unit-testable without a real binary or network.
+ *
+ * 'running' is not a terminal state: the connector can lose its edge
+ * registration while the process keeps living, which leaves a hostname that
+ * no longer resolves. The watchdog below probes the public URL of a running
+ * tunnel and reuses the crash-restart path when it stops answering, so the
+ * relay is re-registered against a freshly minted URL instead of proxying a
+ * dead one (issue #1723).
  */
 import { existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
@@ -65,6 +72,45 @@ export function namedTunnelHandle(inner, publicUrl) {
     };
     return handle;
 }
+/**
+ * Probe one public tunnel URL from the host. Resolves true when the URL is
+ * served (any HTTP answer below 500 — a harness without credentials answers
+ * 401/403, which is a healthy round trip), false for a DNS failure, a refused
+ * connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+ * — the shapes a tunnel that lost its edge registration produces.
+ *
+ * The probe must never reject: the watchdog reads a rejection as a dead
+ * tunnel and restarts on it, so a local programming error would otherwise
+ * recycle working tunnels forever.
+ * @param url - the tunnel's public URL.
+ * @param timeoutMs - how long one probe may take.
+ * @returns whether the URL answered as a live origin.
+ */
+export async function probeTunnelUrl(url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    try {
+        const response = await fetch(url, {
+            method: 'GET',
+            redirect: 'manual',
+            cache: 'no-store',
+            signal: controller.signal,
+        });
+        // Drain so the connection is reusable instead of half-read.
+        await response.body?.cancel().catch(() => undefined);
+        return response.status < 500;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Default probe: the real network round trip. */
+async function defaultProbe(url, timeoutMs) {
+    return await probeTunnelUrl(url, timeoutMs);
+}
 /** Time box for the `--version` probe that validates a staged binary. */
 const BINARY_PROBE_TIMEOUT_MS = 10_000;
 /**
@@ -128,6 +174,12 @@ export function createBinaryReadiness(executable, seams = {}) {
 }
 /** How many archive downloads one process may attempt before giving up. */
 export const MAX_BINARY_INSTALL_ATTEMPTS = 3;
+/** How often a running tunnel's public URL is probed (issue #1723). */
+export const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60_000;
+/** Consecutive failed probes before the tunnel is declared dead. */
+export const DEFAULT_HEALTH_CHECK_FAILURES = 2;
+/** How long one public-URL probe may take. */
+export const DEFAULT_PROBE_TIMEOUT_MS = 10_000;
 /** The readiness policy the manager uses by default: the package's real binary path. */
 const defaultBinaryReadiness = createBinaryReadiness(bin);
 /** Default binary readiness: keep a working platform binary at `bin`. */
@@ -216,6 +268,10 @@ export class TunnelManager {
     restartBaseMs;
     restartMaxMs;
     timer;
+    probe;
+    healthCheckIntervalMs;
+    healthCheckFailures;
+    probeTimeoutMs;
     phase = 'stopped';
     url;
     error;
@@ -223,6 +279,8 @@ export class TunnelManager {
     handle;
     urlTimer;
     restartTimer;
+    healthTimer;
+    healthFailures = 0;
     attempts = 0;
     // Generation counter: a stale ensureBinary resolution from an earlier
     // start() must not spawn a second handle after a stop/start cycle.
@@ -240,6 +298,10 @@ export class TunnelManager {
         this.restartBaseMs = options.restartBaseMs ?? 5_000;
         this.restartMaxMs = options.restartMaxMs ?? 60_000;
         this.timer = options.timer ?? nodeTimer;
+        this.probe = options.probe ?? defaultProbe;
+        this.healthCheckIntervalMs = options.healthCheckIntervalMs ?? DEFAULT_HEALTH_CHECK_INTERVAL_MS;
+        this.healthCheckFailures = options.healthCheckFailures ?? DEFAULT_HEALTH_CHECK_FAILURES;
+        this.probeTimeoutMs = options.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
     }
     /** The current status frame. */
     get info() {
@@ -342,6 +404,9 @@ export class TunnelManager {
         this.error = undefined;
         this.attempts = 0;
         this.setPhase('running');
+        // The URL is out; from here the connector can still lose its edge
+        // registration without the process exiting, so readiness is supervised.
+        this.startHealthWatch(value);
         for (const listener of this.urlListeners) {
             try {
                 listener(value);
@@ -351,6 +416,72 @@ export class TunnelManager {
             }
         }
     }
+    /**
+     * Watch the readiness of a running tunnel. cloudflared can keep its process
+     * (and its metrics port) alive while every edge connection is gone, leaving
+     * a minted hostname that no longer resolves: the manager used to report
+     * 'running' forever and the relay kept forwarding to that dead address, so
+     * the phone hit Cloudflare 1016 instead of the relay's offline page
+     * (issue #1723). A bounded number of consecutive probe failures ends the
+     * attempt through the ordinary fail/backoff path, which mints a new URL and
+     * re-announces the relay.
+     */
+    startHealthWatch(url) {
+        this.stopHealthWatch();
+        // A phase listener may have stopped the tunnel or replaced its target
+        // while this URL was being announced; only a live running phase schedules.
+        if (this.stopping || this.phase !== 'running')
+            return;
+        if (this.healthCheckIntervalMs <= 0 || this.healthCheckFailures <= 0)
+            return;
+        this.healthFailures = 0;
+        const schedule = () => {
+            this.healthTimer = this.timer.setTimeout(() => {
+                this.healthTimer = undefined;
+                void this.healthCheck(url);
+            }, this.healthCheckIntervalMs);
+        };
+        schedule();
+    }
+    /** One probe round of the running tunnel's public URL. */
+    async healthCheck(url) {
+        // The tunnel may have been stopped, failed, or replaced while the probe
+        // was in flight; only a still-running tunnel toward this same URL is
+        // judged by the result.
+        if (this.stopping || this.phase !== 'running' || this.url !== url)
+            return;
+        let alive = false;
+        try {
+            alive = await this.probe(url, this.probeTimeoutMs);
+        }
+        catch {
+            alive = false;
+        }
+        if (this.stopping || this.phase !== 'running' || this.url !== url)
+            return;
+        if (alive) {
+            this.healthFailures = 0;
+        }
+        else {
+            this.healthFailures += 1;
+            if (this.healthFailures >= this.healthCheckFailures) {
+                this.fail('the tunnel stopped answering on its public URL');
+                return;
+            }
+        }
+        this.healthTimer = this.timer.setTimeout(() => {
+            this.healthTimer = undefined;
+            void this.healthCheck(url);
+        }, this.healthCheckIntervalMs);
+    }
+    /** Cancel the readiness watchdog (teardown, restart, stop). */
+    stopHealthWatch() {
+        if (this.healthTimer !== undefined) {
+            this.timer.clearTimeout(this.healthTimer);
+            this.healthTimer = undefined;
+        }
+        this.healthFailures = 0;
+    }
     handleExit() {
         // The exit handler is detached during teardown, so reaching this point
         // means an unexpected death: fail the current phase and schedule a retry.
@@ -371,6 +502,7 @@ export class TunnelManager {
             this.timer.clearTimeout(this.urlTimer);
             this.urlTimer = undefined;
         }
+        this.stopHealthWatch();
         this.setPhase('failed');
         this.attempts += 1;
         const delay = Math.min(this.restartBaseMs * 2 ** (this.attempts - 1), this.restartMaxMs);
@@ -382,6 +514,7 @@ export class TunnelManager {
     /** Stop the current process and cancel every pending timer (no phase change). */
     teardown() {
         this.stopping = true;
+        this.stopHealthWatch();
         if (this.urlTimer !== undefined) {
             this.timer.clearTimeout(this.urlTimer);
             this.urlTimer = undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "icon": "icon.svg",
   "type": "module",
   "engines": {
@@ -38,7 +38,7 @@
   "license": "Apache-2.0",
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.7-rc.1"
+      "dsh": ">=0.1.7-rc.2"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -53,35 +53,36 @@
     }
   },
   "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.4",
     "cloudflared": "^0.7.3",
     "clsx": "^2.1.1",
     "qrcode.react": "^4.2.0",
-    "schemastery": "^3.18.0",
+    "yaml": "^2.8.2",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh": ">=0.1.7-rc.2",
     "react": "^18.2.0",
     "react-dom": "^18.2.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh-agent": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-api-session-controller": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-store": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-commands": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-connection": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-store": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-commands": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.7-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.7-rc.2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",

package/src/client/RemoteEntry.tsx

@@ -1,11 +1,11 @@
 /**
- * The sidebar remote-control seat: the update trigger plus the phone-icon
- * trigger beside the settings button, and the pairing panel modal. Owns the
- * panel behavior — token minting on open, the status SSE subscription,
- * stop/refresh/copy — and renders the pure {@link RemotePanel} body. The
- * update seat (the dsh-web self-update flow) rides the same footer row,
- * rendered by {@link UpdateEntry}. Component-local state per the client
- * stack rules: nothing here survives remounts or crosses entries.
+ * The sidebar remote-control seat: the phone-icon trigger beside the
+ * settings button, and the pairing panel modal. Owns the panel behavior —
+ * token minting on open, the status SSE subscription, stop/refresh/copy — and
+ * renders the pure {@link RemotePanel} body. The family self-update seat is
+ * its own plugin (dsh-update) and no longer rides this row. Component-local
+ * state per the client stack rules: nothing here survives remounts or crosses
+ * entries.
  */
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
@@ -14,7 +14,6 @@ import type { PairingPhase } from '../pairing.ts'
 import { RemotePanel, type PanelState } from './RemotePanel.tsx'
 import { copyText, issuePair, revokePair, stopPair, type DeviceFrame, type IssueResponse, type PairStateFrame, type RelayStatusFrame, type TunnelStatusFrame } from './pair-api.ts'
 import { PhoneIcon } from './PhoneIcon.tsx'
-import { UpdateEntry } from './UpdateEntry.tsx'
 import css from './remote.module.css'
 
 /** Entry props: the sidebar column state and the standard locale seat. */
@@ -128,7 +127,7 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
     // unreachable origins are fenced out of the events endpoint, so opening
     // it there would just start a doomed reconnect loop.
     if (next.kind !== 'ready' && next.kind !== 'lan-required') return
-    const source = new EventSource('/api/pair/events')
+    const source = new EventSource('api/pair/events')
     eventSource.current = source
     source.onmessage = (event) => {
       try {
@@ -233,7 +232,6 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
   return (
     <>
       <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
-        <UpdateEntry wide={wide} t={t} />
         <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} expanded={open} />
       </div>
       {open && createPortal((

package/src/client/RemoteSettingsCard.tsx

@@ -175,8 +175,6 @@ export function RemoteSettingsCard(props: RemoteSettingsCardProps) {
       descriptionKey="settings.description"
       defaultOpen={false}
       state={state}
-      renderChildrenWhenNotExposed
-      hideNotExposedNotice
       onSave={props.save}
       onDiscard={props.discard}
     >

package/src/client/index.ts

@@ -31,15 +31,17 @@ import { readPairGatePolicy, sendHeartbeat, shouldStopHeartbeat } from './pair-a
 import {
   channelTransition,
   installRemoteChannel,
-  isLoopbackHostname,
+  pageOriginFacts,
   remoteChannelRequired,
   REMOTE_CHANNEL_BOOT_GLOBAL,
   type RemoteChannelBootSeat,
 } from './remote-channel.ts'
+import { isLocalPage } from '../remote-channel-rules.ts'
 import { FenceNotice } from './FenceNotice.tsx'
 import { reportDailyHeartbeat } from './telemetry.ts'
 import { startMobileAdapt, type RemoteAdaptGlobal } from './mobile-adapt.ts'
 import { installPluginCard } from './plugin-card-seat.ts'
+import { createServedEntryForm } from './settings-entry-form.ts'
 
 // Portrait-touch adaptation of the official UI: installed under the plugin
 // lifecycle (apply) so disabling the plugin in cordis patch (disabled: true)
@@ -50,8 +52,6 @@ export type { PanelState, RemotePanelProps } from './RemotePanel.tsx'
 export type { PairFailedNoticeProps } from './PairFailedNotice.tsx'
 export type { RemoteKey } from './locales.ts'
 export type { RemoteSettingsCardFace, RemoteSettingsCardState } from './RemoteSettingsCard.tsx'
-export type { UpdateEntryProps } from './UpdateEntry.tsx'
-export type { UpdatePanelProps, UpdateView } from './UpdatePanel.tsx'
 
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface LocaleNamespaceMap {
@@ -109,22 +109,70 @@ declare module '@deepseek-ai/cordis' {
 /** Dictionary namespace owned by this plugin. */
 const NS = 'remote'
 
-/** Settings namespace the remote-control card edits (the Host plugin registers it). */
+/**
+ * Settings namespace the remote-control card edits: the family identity of
+ * this plugin's own settings form, and the row id a standalone bundle install
+ * carries.
+ */
 const REMOTE_WEB_UI_NS = 'remote-web-ui'
+
+/** Profile entry id the family aggregate's generated row carries. */
 const AGGREGATE_ENTRY_ID = 'web-ui-remote-web-ui'
+
+/** Profile entry ids this package's patch rows carry, most specific first. */
 const REMOTE_WEB_UI_ENTRY_IDS: readonly string[] = [AGGREGATE_ENTRY_ID, 'ui-remote-web-ui', REMOTE_WEB_UI_NS]
 
-function servedEntryId(forms: ConfigForms): string {
+/**
+ * The profile entry id this package's own row carries, for a page that serves
+ * no family binder.
+ *
+ * The shared describe mirror answers asynchronously, so at plugin activation it
+ * usually holds nothing yet — and an unanswered or empty mirror is not evidence
+ * of absence. Binding the bare namespace there left the card bound to an entry
+ * the Host does not serve, and the form is bound once per session, so the card
+ * never recovered (every save answered `No configurable plugin entry`). The
+ * aggregate row id matches nearly every deployment; only a mirror that answers
+ * with OTHER plugins' rows falls back to the namespace itself (the pre-0.1.7
+ * keying shape), because that answer is the one that actually proves this
+ * package's own row is not served.
+ * @param forms - the shared configuration forms service.
+ * @returns the entry id to bind.
+ */
+export function servedEntryId(forms: ConfigForms): string {
   let served: readonly string[] | undefined
   try {
     served = forms.describe().getSnapshot().view?.namespaces.map(view => view.ns)
   } catch {
+    // A mirror that refuses the read is unanswered too, not absent.
     served = undefined
   }
-  if (!served || served.length === 0) return REMOTE_WEB_UI_NS
+  if (served === undefined || served.length === 0) return AGGREGATE_ENTRY_ID
   return REMOTE_WEB_UI_ENTRY_IDS.find(id => served.includes(id)) ?? REMOTE_WEB_UI_NS
 }
 
+/**
+ * Bind the settings form the remote-control card reads and writes.
+ *
+ * The family binder comes first: it resolves this package's family namespace
+ * onto the profile entry id the Host serves the form under, and keeps the
+ * loopback bridge as its own fallback. A page without that group (or one where
+ * its client half has not applied yet) binds through the shared forms service,
+ * on the entry id the describe mirror justifies and rebound as soon as the
+ * mirror answers — see {@link createServedEntryForm}.
+ * @param ctx - client context carrying the family binder and/or the shared forms service.
+ * @returns the form the card stages and saves through.
+ */
+export function bindSettingsForm(ctx: ClientContext): ConfigForm<RemoteSettings> {
+  const family = ctx.get('webUiSettings')
+  if (family !== undefined && typeof family.bind === 'function') {
+    return family.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
+  }
+  return createServedEntryForm<RemoteSettings>({
+    forms: ctx.configForms,
+    entryIds: REMOTE_WEB_UI_ENTRY_IDS,
+  })
+}
+
 /** Heartbeat cadence from a paired phone (presence + revocation liveness). */
 const HEARTBEAT_INTERVAL_MS = 10_000
 
@@ -203,10 +251,7 @@ export function apply(ctx: ClientContext): void {
   // shared form (natively, or over its loopback bridge); without that group the
   // namespace IS the owning entry id, so the official service is addressed
   // directly.
-  const family = ctx.get('webUiSettings')
-  const settingsForm: ConfigForm<RemoteSettings> = family !== undefined && typeof family.bind === 'function'
-    ? family.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
-    : ctx.configForms.get<RemoteSettings>(servedEntryId(ctx.configForms))
+  const settingsForm: ConfigForm<RemoteSettings> = bindSettingsForm(ctx)
   const enabled = (): boolean => {
     const snapshot = settingsForm.getSnapshot()
     return snapshot.status === 'ready'
@@ -333,7 +378,7 @@ export function apply(ctx: ClientContext): void {
     showFenceNotice()
   }
   const channelActive = (): boolean => remoteChannelRequired(
-    window.location.hostname,
+    pageOriginFacts(window),
     settingsForm.getSnapshot(),
     hostPairingPolicy,
   )
@@ -387,7 +432,8 @@ export function apply(ctx: ClientContext): void {
   }
   settingsForm.subscribe(syncChannel)
   syncChannel()
-  if (!isLoopbackHostname(window.location.hostname) && settingsForm.getSnapshot().status !== 'ready') {
+  const pageOrigin = pageOriginFacts(window)
+  if (!isLocalPage(pageOrigin.hostname, pageOrigin.protocol, pageOrigin.transportOwnsHost) && settingsForm.getSnapshot().status !== 'ready') {
     void readPairGatePolicy().then((policy) => {
       hostPairingPolicy = policy.requirePairingForLan
       syncChannel()