@linxin666/dsh-remote-web-ui 0.4.2 → 0.4.3

package/lib/types/mount-once.js

@@ -5,38 +5,122 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for('dsh-web.mounted-plugins');
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for('dsh-web.mounted-plugins.waiters');
+/**
+ * The shared name registry, always a `Set` whatever another build stored here:
+ * a foreign value (an interim shape, a hand-written global) must not take every
+ * family plugin down with it.
+ * @returns the process-wide set of mounted package names.
+ */
 function mountedSet() {
     const registry = globalThis;
-    return (registry[MOUNTED] ??= new Set());
+    const existing = registry[MOUNTED];
+    if (existing instanceof Set)
+        return existing;
+    const created = new Set();
+    registry[MOUNTED] = created;
+    return created;
+}
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters() {
+    const registry = globalThis;
+    return (registry[WAITERS] ??= new Map());
 }
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.
  */
 export function mountOnce(packageName, fn) {
-    return ((...args) => {
+    const mount = (...args) => {
         const mounted = mountedSet();
-        if (mounted.has(packageName))
+        const ctx = args[0];
+        if (mounted.has(packageName)) {
+            // Another fiber (the aggregate row, a standalone install, or a copy built
+            // from an older revision of this guard) owns the name. Queue instead of
+            // dropping: dropping lost the plugin for the rest of the process when the
+            // holder was disposed by a reload.
+            const waiters = mountWaiters();
+            const queue = waiters.get(packageName) ?? [];
+            let alive = true;
+            const pending = {
+                run: () => {
+                    if (alive)
+                        mount(...args);
+                },
+            };
+            // A fiber that dies while it waits must not be replayed afterwards: its
+            // context is disposed and registering effects on it would throw.
+            ctx?.effect?.(() => () => {
+                alive = false;
+                const index = queue.indexOf(pending);
+                if (index >= 0)
+                    queue.splice(index, 1);
+            });
+            queue.push(pending);
+            waiters.set(packageName, queue);
             return;
+        }
         mounted.add(packageName);
-        const ctx = args[0];
         ctx?.effect?.(() => () => {
             mounted.delete(packageName);
+            const waiters = mountWaiters();
+            const queue = waiters.get(packageName);
+            if (queue === undefined)
+                return;
+            waiters.delete(packageName);
+            // Defer the handover one microtask so the disposing mount's own effects
+            // (routes, ledger, timers) are torn down before the next one registers.
+            for (const waiter of queue.splice(0))
+                queueMicrotask(() => { waiter.run(); });
         });
         return fn(...args);
-    });
+    };
+    return mount;
 }

package/lib/types/tunnel.d.ts

@@ -12,9 +12,16 @@
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
- * backoff) around it. All seams — the tunnel factory, binary readiness,
- * timers — are injectable so the whole lifecycle is unit-testable without
- * a real binary or network.
+ * backoff, and the public-URL readiness watchdog) around it. All seams — the
+ * tunnel factory, binary readiness, the URL probe, timers — are injectable
+ * so the whole lifecycle is unit-testable without a real binary or network.
+ *
+ * 'running' is not a terminal state: the connector can lose its edge
+ * registration while the process keeps living, which leaves a hostname that
+ * no longer resolves. The watchdog below probes the public URL of a running
+ * tunnel and reuses the crash-restart path when it stops answering, so the
+ * relay is re-registered against a freshly minted URL instead of proxying a
+ * dead one (issue #1723).
  */
 /** The observable tunnel lifecycle the settings/panel surfaces render. */
 export type TunnelPhase = 'stopped' | 'starting' | 'running' | 'failed';
@@ -68,6 +75,21 @@ export interface TunnelHandle {
     off(event: string, listener: (...args: any[]) => void): unknown;
     stop(): boolean;
 }
+/**
+ * Probe one public tunnel URL from the host. Resolves true when the URL is
+ * served (any HTTP answer below 500 — a harness without credentials answers
+ * 401/403, which is a healthy round trip), false for a DNS failure, a refused
+ * connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+ * — the shapes a tunnel that lost its edge registration produces.
+ *
+ * The probe must never reject: the watchdog reads a rejection as a dead
+ * tunnel and restarts on it, so a local programming error would otherwise
+ * recycle working tunnels forever.
+ * @param url - the tunnel's public URL.
+ * @param timeoutMs - how long one probe may take.
+ * @returns whether the URL answered as a live origin.
+ */
+export declare function probeTunnelUrl(url: string, timeoutMs: number): Promise<boolean>;
 /** Injectable seams (defaults are the real cloudflared package + node timers). */
 export interface TunnelManagerOptions {
     /** Spawn one tunnel process for the target (quick or named). */
@@ -85,6 +107,14 @@ export interface TunnelManagerOptions {
         setTimeout(fn: () => void, ms: number): unknown;
         clearTimeout(t: unknown): void;
     };
+    /** Probe one public URL; false means the tunnel stopped answering. */
+    probe?: (url: string, timeoutMs: number) => Promise<boolean>;
+    /** How often to probe the public URL of a running tunnel (0 disables it). */
+    healthCheckIntervalMs?: number;
+    /** Consecutive probe failures after which the tunnel is restarted. */
+    healthCheckFailures?: number;
+    /** How long one probe may take. */
+    probeTimeoutMs?: number;
 }
 /**
  * Probe whether the binary at `path` actually executes on this machine. The
@@ -109,6 +139,12 @@ export interface BinaryReadinessSeams {
 export declare function createBinaryReadiness(executable: string, seams?: BinaryReadinessSeams): () => Promise<void>;
 /** How many archive downloads one process may attempt before giving up. */
 export declare const MAX_BINARY_INSTALL_ATTEMPTS = 3;
+/** How often a running tunnel's public URL is probed (issue #1723). */
+export declare const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60000;
+/** Consecutive failed probes before the tunnel is declared dead. */
+export declare const DEFAULT_HEALTH_CHECK_FAILURES = 2;
+/** How long one public-URL probe may take. */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 10000;
 /**
  * Spawn flags for one quick target. `originHostHeader` stamps the Host the
  * local webserver sees: the plugin's phone-facing fence trusts the configured
@@ -150,6 +186,10 @@ export declare class TunnelManager {
     private readonly restartBaseMs;
     private readonly restartMaxMs;
     private readonly timer;
+    private readonly probe;
+    private readonly healthCheckIntervalMs;
+    private readonly healthCheckFailures;
+    private readonly probeTimeoutMs;
     private phase;
     private url;
     private error;
@@ -157,6 +197,8 @@ export declare class TunnelManager {
     private handle;
     private urlTimer;
     private restartTimer;
+    private healthTimer;
+    private healthFailures;
     private attempts;
     private generation;
     private stopping;
@@ -189,6 +231,21 @@ export declare class TunnelManager {
     onPhase(listener: (info: TunnelInfo) => void): () => void;
     private attempt;
     private handleUrl;
+    /**
+     * Watch the readiness of a running tunnel. cloudflared can keep its process
+     * (and its metrics port) alive while every edge connection is gone, leaving
+     * a minted hostname that no longer resolves: the manager used to report
+     * 'running' forever and the relay kept forwarding to that dead address, so
+     * the phone hit Cloudflare 1016 instead of the relay's offline page
+     * (issue #1723). A bounded number of consecutive probe failures ends the
+     * attempt through the ordinary fail/backoff path, which mints a new URL and
+     * re-announces the relay.
+     */
+    private startHealthWatch;
+    /** One probe round of the running tunnel's public URL. */
+    private healthCheck;
+    /** Cancel the readiness watchdog (teardown, restart, stop). */
+    private stopHealthWatch;
     private handleExit;
     private fail;
     /** Stop the current process and cancel every pending timer (no phase change). */

package/lib/types/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CA+B/G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAa5C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAS5E;AA0BD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBrF;AAOD,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;IAC3F,sEAAsE;IACtE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,6EAA6E;IAC7E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CA+B/G;AAED,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAE5C,uEAAuE;AACvE,eAAO,MAAM,gCAAgC,QAAS,CAAA;AACtD,oEAAoE;AACpE,eAAO,MAAM,6BAA6B,IAAI,CAAA;AAC9C,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,QAAS,CAAA;AAa9C;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAS5E;AA0BD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAC3G,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsD;IAC5E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAQ;IAC9C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;IAEvC,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAa9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAqBjB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAgBxB,0DAA0D;YAC5C,WAAW;IA2BzB,+DAA+D;IAC/D,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAsBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,QAAQ;CAWjB"}

package/lib/types/tunnel.js

@@ -12,9 +12,16 @@
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
- * backoff) around it. All seams — the tunnel factory, binary readiness,
- * timers — are injectable so the whole lifecycle is unit-testable without
- * a real binary or network.
+ * backoff, and the public-URL readiness watchdog) around it. All seams — the
+ * tunnel factory, binary readiness, the URL probe, timers — are injectable
+ * so the whole lifecycle is unit-testable without a real binary or network.
+ *
+ * 'running' is not a terminal state: the connector can lose its edge
+ * registration while the process keeps living, which leaves a hostname that
+ * no longer resolves. The watchdog below probes the public URL of a running
+ * tunnel and reuses the crash-restart path when it stops answering, so the
+ * relay is re-registered against a freshly minted URL instead of proxying a
+ * dead one (issue #1723).
  */
 import { existsSync } from 'node:fs';
 import { spawn } from 'node:child_process';
@@ -65,6 +72,45 @@ export function namedTunnelHandle(inner, publicUrl) {
     };
     return handle;
 }
+/**
+ * Probe one public tunnel URL from the host. Resolves true when the URL is
+ * served (any HTTP answer below 500 — a harness without credentials answers
+ * 401/403, which is a healthy round trip), false for a DNS failure, a refused
+ * connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+ * — the shapes a tunnel that lost its edge registration produces.
+ *
+ * The probe must never reject: the watchdog reads a rejection as a dead
+ * tunnel and restarts on it, so a local programming error would otherwise
+ * recycle working tunnels forever.
+ * @param url - the tunnel's public URL.
+ * @param timeoutMs - how long one probe may take.
+ * @returns whether the URL answered as a live origin.
+ */
+export async function probeTunnelUrl(url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, timeoutMs);
+    try {
+        const response = await fetch(url, {
+            method: 'GET',
+            redirect: 'manual',
+            cache: 'no-store',
+            signal: controller.signal,
+        });
+        // Drain so the connection is reusable instead of half-read.
+        await response.body?.cancel().catch(() => undefined);
+        return response.status < 500;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Default probe: the real network round trip. */
+async function defaultProbe(url, timeoutMs) {
+    return await probeTunnelUrl(url, timeoutMs);
+}
 /** Time box for the `--version` probe that validates a staged binary. */
 const BINARY_PROBE_TIMEOUT_MS = 10_000;
 /**
@@ -128,6 +174,12 @@ export function createBinaryReadiness(executable, seams = {}) {
 }
 /** How many archive downloads one process may attempt before giving up. */
 export const MAX_BINARY_INSTALL_ATTEMPTS = 3;
+/** How often a running tunnel's public URL is probed (issue #1723). */
+export const DEFAULT_HEALTH_CHECK_INTERVAL_MS = 60_000;
+/** Consecutive failed probes before the tunnel is declared dead. */
+export const DEFAULT_HEALTH_CHECK_FAILURES = 2;
+/** How long one public-URL probe may take. */
+export const DEFAULT_PROBE_TIMEOUT_MS = 10_000;
 /** The readiness policy the manager uses by default: the package's real binary path. */
 const defaultBinaryReadiness = createBinaryReadiness(bin);
 /** Default binary readiness: keep a working platform binary at `bin`. */
@@ -216,6 +268,10 @@ export class TunnelManager {
     restartBaseMs;
     restartMaxMs;
     timer;
+    probe;
+    healthCheckIntervalMs;
+    healthCheckFailures;
+    probeTimeoutMs;
     phase = 'stopped';
     url;
     error;
@@ -223,6 +279,8 @@ export class TunnelManager {
     handle;
     urlTimer;
     restartTimer;
+    healthTimer;
+    healthFailures = 0;
     attempts = 0;
     // Generation counter: a stale ensureBinary resolution from an earlier
     // start() must not spawn a second handle after a stop/start cycle.
@@ -240,6 +298,10 @@ export class TunnelManager {
         this.restartBaseMs = options.restartBaseMs ?? 5_000;
         this.restartMaxMs = options.restartMaxMs ?? 60_000;
         this.timer = options.timer ?? nodeTimer;
+        this.probe = options.probe ?? defaultProbe;
+        this.healthCheckIntervalMs = options.healthCheckIntervalMs ?? DEFAULT_HEALTH_CHECK_INTERVAL_MS;
+        this.healthCheckFailures = options.healthCheckFailures ?? DEFAULT_HEALTH_CHECK_FAILURES;
+        this.probeTimeoutMs = options.probeTimeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
     }
     /** The current status frame. */
     get info() {
@@ -342,6 +404,9 @@ export class TunnelManager {
         this.error = undefined;
         this.attempts = 0;
         this.setPhase('running');
+        // The URL is out; from here the connector can still lose its edge
+        // registration without the process exiting, so readiness is supervised.
+        this.startHealthWatch(value);
         for (const listener of this.urlListeners) {
             try {
                 listener(value);
@@ -351,6 +416,72 @@ export class TunnelManager {
             }
         }
     }
+    /**
+     * Watch the readiness of a running tunnel. cloudflared can keep its process
+     * (and its metrics port) alive while every edge connection is gone, leaving
+     * a minted hostname that no longer resolves: the manager used to report
+     * 'running' forever and the relay kept forwarding to that dead address, so
+     * the phone hit Cloudflare 1016 instead of the relay's offline page
+     * (issue #1723). A bounded number of consecutive probe failures ends the
+     * attempt through the ordinary fail/backoff path, which mints a new URL and
+     * re-announces the relay.
+     */
+    startHealthWatch(url) {
+        this.stopHealthWatch();
+        // A phase listener may have stopped the tunnel or replaced its target
+        // while this URL was being announced; only a live running phase schedules.
+        if (this.stopping || this.phase !== 'running')
+            return;
+        if (this.healthCheckIntervalMs <= 0 || this.healthCheckFailures <= 0)
+            return;
+        this.healthFailures = 0;
+        const schedule = () => {
+            this.healthTimer = this.timer.setTimeout(() => {
+                this.healthTimer = undefined;
+                void this.healthCheck(url);
+            }, this.healthCheckIntervalMs);
+        };
+        schedule();
+    }
+    /** One probe round of the running tunnel's public URL. */
+    async healthCheck(url) {
+        // The tunnel may have been stopped, failed, or replaced while the probe
+        // was in flight; only a still-running tunnel toward this same URL is
+        // judged by the result.
+        if (this.stopping || this.phase !== 'running' || this.url !== url)
+            return;
+        let alive = false;
+        try {
+            alive = await this.probe(url, this.probeTimeoutMs);
+        }
+        catch {
+            alive = false;
+        }
+        if (this.stopping || this.phase !== 'running' || this.url !== url)
+            return;
+        if (alive) {
+            this.healthFailures = 0;
+        }
+        else {
+            this.healthFailures += 1;
+            if (this.healthFailures >= this.healthCheckFailures) {
+                this.fail('the tunnel stopped answering on its public URL');
+                return;
+            }
+        }
+        this.healthTimer = this.timer.setTimeout(() => {
+            this.healthTimer = undefined;
+            void this.healthCheck(url);
+        }, this.healthCheckIntervalMs);
+    }
+    /** Cancel the readiness watchdog (teardown, restart, stop). */
+    stopHealthWatch() {
+        if (this.healthTimer !== undefined) {
+            this.timer.clearTimeout(this.healthTimer);
+            this.healthTimer = undefined;
+        }
+        this.healthFailures = 0;
+    }
     handleExit() {
         // The exit handler is detached during teardown, so reaching this point
         // means an unexpected death: fail the current phase and schedule a retry.
@@ -371,6 +502,7 @@ export class TunnelManager {
             this.timer.clearTimeout(this.urlTimer);
             this.urlTimer = undefined;
         }
+        this.stopHealthWatch();
         this.setPhase('failed');
         this.attempts += 1;
         const delay = Math.min(this.restartBaseMs * 2 ** (this.attempts - 1), this.restartMaxMs);
@@ -382,6 +514,7 @@ export class TunnelManager {
     /** Stop the current process and cancel every pending timer (no phase change). */
     teardown() {
         this.stopping = true;
+        this.stopHealthWatch();
         if (this.urlTimer !== undefined) {
             this.timer.clearTimeout(this.urlTimer);
             this.urlTimer = undefined;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "icon": "icon.svg",
   "type": "module",
   "engines": {
@@ -53,10 +53,10 @@
     }
   },
   "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.4",
     "cloudflared": "^0.7.3",
     "clsx": "^2.1.1",
     "qrcode.react": "^4.2.0",
-    "schemastery": "^3.18.0",
     "yaml": "^2.8.2",
     "zod": "^4.4.3"
   },

package/src/client/RemoteEntry.tsx

@@ -1,11 +1,11 @@
 /**
- * The sidebar remote-control seat: the update trigger plus the phone-icon
- * trigger beside the settings button, and the pairing panel modal. Owns the
- * panel behavior — token minting on open, the status SSE subscription,
- * stop/refresh/copy — and renders the pure {@link RemotePanel} body. The
- * update seat (the dsh-web self-update flow) rides the same footer row,
- * rendered by {@link UpdateEntry}. Component-local state per the client
- * stack rules: nothing here survives remounts or crosses entries.
+ * The sidebar remote-control seat: the phone-icon trigger beside the
+ * settings button, and the pairing panel modal. Owns the panel behavior —
+ * token minting on open, the status SSE subscription, stop/refresh/copy — and
+ * renders the pure {@link RemotePanel} body. The family self-update seat is
+ * its own plugin (dsh-update) and no longer rides this row. Component-local
+ * state per the client stack rules: nothing here survives remounts or crosses
+ * entries.
  */
 import { useCallback, useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
@@ -14,7 +14,6 @@ import type { PairingPhase } from '../pairing.ts'
 import { RemotePanel, type PanelState } from './RemotePanel.tsx'
 import { copyText, issuePair, revokePair, stopPair, type DeviceFrame, type IssueResponse, type PairStateFrame, type RelayStatusFrame, type TunnelStatusFrame } from './pair-api.ts'
 import { PhoneIcon } from './PhoneIcon.tsx'
-import { UpdateEntry } from './UpdateEntry.tsx'
 import css from './remote.module.css'
 
 /** Entry props: the sidebar column state and the standard locale seat. */
@@ -233,7 +232,6 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
   return (
     <>
       <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
-        <UpdateEntry wide={wide} t={t} />
         <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} expanded={open} />
       </div>
       {open && createPortal((

package/src/client/RemoteSettingsCard.tsx

@@ -175,8 +175,6 @@ export function RemoteSettingsCard(props: RemoteSettingsCardProps) {
       descriptionKey="settings.description"
       defaultOpen={false}
       state={state}
-      renderChildrenWhenNotExposed
-      hideNotExposedNotice
       onSave={props.save}
       onDiscard={props.discard}
     >

package/src/client/index.ts

@@ -41,6 +41,7 @@ import { FenceNotice } from './FenceNotice.tsx'
 import { reportDailyHeartbeat } from './telemetry.ts'
 import { startMobileAdapt, type RemoteAdaptGlobal } from './mobile-adapt.ts'
 import { installPluginCard } from './plugin-card-seat.ts'
+import { createServedEntryForm } from './settings-entry-form.ts'
 
 // Portrait-touch adaptation of the official UI: installed under the plugin
 // lifecycle (apply) so disabling the plugin in cordis patch (disabled: true)
@@ -51,8 +52,6 @@ export type { PanelState, RemotePanelProps } from './RemotePanel.tsx'
 export type { PairFailedNoticeProps } from './PairFailedNotice.tsx'
 export type { RemoteKey } from './locales.ts'
 export type { RemoteSettingsCardFace, RemoteSettingsCardState } from './RemoteSettingsCard.tsx'
-export type { UpdateEntryProps } from './UpdateEntry.tsx'
-export type { UpdatePanelProps, UpdateView } from './UpdatePanel.tsx'
 
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface LocaleNamespaceMap {
@@ -110,22 +109,70 @@ declare module '@deepseek-ai/cordis' {
 /** Dictionary namespace owned by this plugin. */
 const NS = 'remote'
 
-/** Settings namespace the remote-control card edits (the Host plugin registers it). */
+/**
+ * Settings namespace the remote-control card edits: the family identity of
+ * this plugin's own settings form, and the row id a standalone bundle install
+ * carries.
+ */
 const REMOTE_WEB_UI_NS = 'remote-web-ui'
+
+/** Profile entry id the family aggregate's generated row carries. */
 const AGGREGATE_ENTRY_ID = 'web-ui-remote-web-ui'
+
+/** Profile entry ids this package's patch rows carry, most specific first. */
 const REMOTE_WEB_UI_ENTRY_IDS: readonly string[] = [AGGREGATE_ENTRY_ID, 'ui-remote-web-ui', REMOTE_WEB_UI_NS]
 
-function servedEntryId(forms: ConfigForms): string {
+/**
+ * The profile entry id this package's own row carries, for a page that serves
+ * no family binder.
+ *
+ * The shared describe mirror answers asynchronously, so at plugin activation it
+ * usually holds nothing yet — and an unanswered or empty mirror is not evidence
+ * of absence. Binding the bare namespace there left the card bound to an entry
+ * the Host does not serve, and the form is bound once per session, so the card
+ * never recovered (every save answered `No configurable plugin entry`). The
+ * aggregate row id matches nearly every deployment; only a mirror that answers
+ * with OTHER plugins' rows falls back to the namespace itself (the pre-0.1.7
+ * keying shape), because that answer is the one that actually proves this
+ * package's own row is not served.
+ * @param forms - the shared configuration forms service.
+ * @returns the entry id to bind.
+ */
+export function servedEntryId(forms: ConfigForms): string {
   let served: readonly string[] | undefined
   try {
     served = forms.describe().getSnapshot().view?.namespaces.map(view => view.ns)
   } catch {
+    // A mirror that refuses the read is unanswered too, not absent.
     served = undefined
   }
-  if (!served || served.length === 0) return REMOTE_WEB_UI_NS
+  if (served === undefined || served.length === 0) return AGGREGATE_ENTRY_ID
   return REMOTE_WEB_UI_ENTRY_IDS.find(id => served.includes(id)) ?? REMOTE_WEB_UI_NS
 }
 
+/**
+ * Bind the settings form the remote-control card reads and writes.
+ *
+ * The family binder comes first: it resolves this package's family namespace
+ * onto the profile entry id the Host serves the form under, and keeps the
+ * loopback bridge as its own fallback. A page without that group (or one where
+ * its client half has not applied yet) binds through the shared forms service,
+ * on the entry id the describe mirror justifies and rebound as soon as the
+ * mirror answers — see {@link createServedEntryForm}.
+ * @param ctx - client context carrying the family binder and/or the shared forms service.
+ * @returns the form the card stages and saves through.
+ */
+export function bindSettingsForm(ctx: ClientContext): ConfigForm<RemoteSettings> {
+  const family = ctx.get('webUiSettings')
+  if (family !== undefined && typeof family.bind === 'function') {
+    return family.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
+  }
+  return createServedEntryForm<RemoteSettings>({
+    forms: ctx.configForms,
+    entryIds: REMOTE_WEB_UI_ENTRY_IDS,
+  })
+}
+
 /** Heartbeat cadence from a paired phone (presence + revocation liveness). */
 const HEARTBEAT_INTERVAL_MS = 10_000
 
@@ -204,10 +251,7 @@ export function apply(ctx: ClientContext): void {
   // shared form (natively, or over its loopback bridge); without that group the
   // namespace IS the owning entry id, so the official service is addressed
   // directly.
-  const family = ctx.get('webUiSettings')
-  const settingsForm: ConfigForm<RemoteSettings> = family !== undefined && typeof family.bind === 'function'
-    ? family.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
-    : ctx.configForms.get<RemoteSettings>(servedEntryId(ctx.configForms))
+  const settingsForm: ConfigForm<RemoteSettings> = bindSettingsForm(ctx)
   const enabled = (): boolean => {
     const snapshot = settingsForm.getSnapshot()
     return snapshot.status === 'ready'