@linxin666/dsh-remote-web-ui 0.4.3 → 0.4.5

package/src/index.ts

@@ -39,6 +39,7 @@ import { withIdentityEncoding } from './http.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
 import { PublicBaseKeeper } from './public-base.ts'
 import { mountOnce } from './mount-once.ts'
+import { runDetached } from './detached-work.ts'
 import { REMOTE_CHANNEL_BOOT_SCRIPT } from './remote-channel-boot.ts'
 import { UUID_POLYFILL_SCRIPT } from './uuid-polyfill.ts'
 
@@ -736,18 +737,34 @@ function applyImpl(ctx: Context, config?: ResolvedConfigFields): void {
     console.warn('remote-web-ui: LAN-exposed bind — pairing gates the /remote channel; direct /api stays under the harness fence + browser auth (stop() does not revoke an already-redeemed browser credential)')
   }
 
-  // Apply the effective configuration to the running surfaces once per
-  // activation: the service tunables, the LAN-bind block/firewall, the tunnel
-  // plan, the pairing routes, the presence sweep, and the posture probe.
-  const sync = (): void => {
-    const value = resolve()
-    service.config = pairingConfigOf(value)
-    // LAN bind toggle: only write the managed patch block once the user has
-    // flipped it (undefined = untouched, never write). Desired host/port come
-    // from the CLI flags when given (flags win), else from the toggle and
-    // the currently bound port. The block takes effect on the next start, so
-    // the re-assert at every boot keeps it in sync with both the toggle and
-    // the flags.
+  // LAN bind toggle: only write the managed patch block once the user has
+  // flipped it (undefined = untouched, never write). Desired host/port come
+  // from the CLI flags when given (flags win), else from the toggle and
+  // the currently bound port. The block takes effect on the next start, so
+  // the re-assert at every boot keeps it in sync with both the toggle and
+  // the flags.
+  //
+  // cordis.patch.yml is exactly the file the Host's HMR config watcher
+  // refreshes from, and a settings save runs inside the Host's exclusive HMR
+  // transaction. Writing that file while the caller's transaction is open makes
+  // the watcher's refresh re-enter it, which the Host refuses with "HMR
+  // transactions cannot be nested" and which surfaces on the user's save
+  // (#1751, #1754).
+  //
+  // Deferring alone does NOT escape that context, and the earlier belt rested
+  // on a premise that measurement disproves: AsyncLocalStorage is propagated
+  // into setImmediate, into node:timers, and into AsyncResource scopes (a
+  // plain resource built while the transaction runs inherits it), so
+  // "setImmediate starts a fresh store" is false. What does start clean is an
+  // AsyncResource created at module scope, before any transaction existed -
+  // see detached-work.ts. scheduleLanBindWork runs the scheduling through it,
+  // so the write lands outside the caller's transaction.
+  //
+  // The assertion is also idempotent on its own: the write is guarded by the
+  // current-vs-desired comparison below, so once the profile carries the block
+  // a coalesced follow-up sync() finds nothing to do. That guard is a second
+  // belt, not the fix.
+  const applyLanBindWork = (value: ResolvedConfig): void => {
     if (value.lanBind !== undefined) {
       const startup = ctx.get('webStartup') as StartupFacts | undefined
       const desiredHost = desiredBindHost(value.lanBind === true, startup?.host)
@@ -785,6 +802,44 @@ function applyImpl(ctx: Context, config?: ResolvedConfigFields): void {
         }
       }
     }
+  }
+
+  // The LAN bind assertion never blocks the caller: one pending work item is
+  // enough, and it always re-reads the config through `resolve()` at run time
+  // so a toggle flipped twice before the tick lands on the last value.
+  //
+  // The scheduling itself runs through runDetached: the settings save that
+  // drives sync() holds the Host's exclusive HMR transaction in its async
+  // context, and a `setImmediate` scheduled directly from here would inherit
+  // that mark (measured on Node 24), so the write would still land inside the
+  // transaction the watcher then tries to re-enter. Scheduling from the
+  // module-scope resource starts the timer - and therefore the write - with no
+  // store at all.
+  let lanBindWorkPending = false
+  const scheduleLanBindWork = (): void => {
+    if (lanBindWorkPending) return
+    lanBindWorkPending = true
+    runDetached(() => setImmediate(() => {
+      lanBindWorkPending = false
+      try {
+        applyLanBindWork(resolve())
+      } catch (error) {
+        // A deferred assertion must never surface as an unhandled rejection:
+        // the settings save that triggered it already answered, and the card
+        // reads the live block state back on its own poll.
+        console.error(`remote-web-ui: the deferred lan-bind assertion failed: ${error instanceof Error ? error.message : String(error)}`)
+      }
+    }))
+  }
+  ctx.effect(() => () => { lanBindWorkPending = false }, 'remote-web-ui: lan-bind work')
+
+  // Apply the effective configuration to the running surfaces once per
+  // activation: the service tunables, the LAN-bind block/firewall, the tunnel
+  // plan, the pairing routes, the presence sweep, and the posture probe.
+  const sync = (): void => {
+    const value = resolve()
+    service.config = pairingConfigOf(value)
+    scheduleLanBindWork()
     // The plugin-managed tunnels own the public base while one runs: the URL
     // lands in the service through the tunnel's phase listener (the minted
     // quick URL, or the named tunnel's fixed public hostname). The manual

package/src/lan-bind.ts

@@ -57,17 +57,105 @@ function readPatchContent(file: string): string {
   return readFileSync(file, 'utf8')
 }
 
-/** Escape one literal string for embedding into a RegExp pattern. */
-function escapeRegex(text: string): string {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+/** One top-level sequence item inside a managed-block region. */
+interface BlockItem {
+  /** Offset of the item's first character inside the region. */
+  start: number
+  /** Offset just past the item's last character inside the region. */
+  end: number
+  /** The item's source text, line terminator included. */
+  text: string
 }
 
-/** Remove the managed block (and its markers) from patch content. */
+/**
+ * Split a block-sequence region into its top-level items. Only a column-0 `-`
+ * starts an item: that is the shape every writer of this file produces - the
+ * managed block itself and the YAML document API's block-style re-emission.
+ * @param region - text between two line boundaries.
+ * @returns the items in source order; text outside them is not returned.
+ */
+function blockItems(region: string): BlockItem[] {
+  const items: BlockItem[] = []
+  let start = -1
+  let offset = 0
+  for (const line of region.split('\n')) {
+    if (line.startsWith('- ') || line === '-') {
+      if (start !== -1) items.push({ start, end: offset, text: region.slice(start, offset) })
+      start = offset
+    }
+    offset += line.length + 1
+  }
+  if (start !== -1) items.push({ start, end: region.length, text: region.slice(start) })
+  return items
+}
+
+/**
+ * Whether one top-level item is the webserver row this plugin's block owns.
+ * The row id is the whole signal: the markers declare everything inside them
+ * managed, our block always writes `- id: webserver`, and a same-id row later
+ * in the patch replaces this one wholesale anyway - so an id-webserver row
+ * found inside our markers is this plugin's row (a hand-truncated block may
+ * have lost its `name` line).
+ * @param item - one top-level item's text.
+ * @returns true when the item is the managed webserver row.
+ */
+function isManagedWebserverItem(item: string): boolean {
+  return /^- id:\s*['"]?webserver['"]?[ \t]*(?:\r?\n|$)/.test(item)
+}
+
+/**
+ * The text between a block's BEGIN and END markers: from the character after
+ * the BEGIN line's terminator to the start of the END marker's line (or to
+ * the end of the content without an END marker).
+ * @param content - the patch file text.
+ * @param begin - index of the BEGIN marker.
+ * @param end - index of the END marker, or -1 when the block is unterminated.
+ * @returns the region's text.
+ */
+function managedRegion(content: string, begin: number, end: number): string {
+  const newlineAfterBegin = content.indexOf('\n', begin)
+  const innerStart = newlineAfterBegin === -1 ? content.length : newlineAfterBegin + 1
+  const endLineStart = end === -1 ? content.length : content.lastIndexOf('\n', end - 1) + 1
+  return content.slice(innerStart, Math.max(innerStart, endLineStart))
+}
+
+/**
+ * Remove the managed block (its markers and the webserver row this plugin
+ * wrote) from patch content, keeping every other row.
+ *
+ * The markers travel with the file through writers that append rows through
+ * the YAML document API: the appended rows land at the end of the sequence,
+ * which is BEFORE a trailing END comment, so the region between the markers
+ * can hold rows this plugin never wrote. Deleting the whole region silently
+ * removed the user's model, plugin and remote-control rows on the next rewrite
+ * - the remote-control row carries the LAN toggle itself, so the feature reset
+ * to `undefined` and the phone was locked out again after a restart (DSH
+ * Desktop report, 2026-09-30). Only the managed item is removed here; every
+ * foreign row is kept in place and the fresh block is appended after them (the
+ * same-id row last wins).
+ * @param content - the patch file text.
+ * @returns the text with the markers and the managed row removed.
+ */
 export function stripManagedBlock(content: string): string {
-  const begin = escapeRegex(LAN_BIND_BLOCK_BEGIN)
-  const end = escapeRegex(LAN_BIND_BLOCK_END)
-  const pattern = new RegExp(`\\r?\\n?${begin}[\\s\\S]*?${end}\\r?\\n?`, 'g')
-  return content.replace(pattern, '\n')
+  let text = content
+  for (;;) {
+    const begin = text.indexOf(LAN_BIND_BLOCK_BEGIN)
+    if (begin === -1) return text
+    const end = text.indexOf(LAN_BIND_BLOCK_END, begin)
+    const blockStart = text.lastIndexOf('\n', begin - 1) + 1
+    const newlineAfterEnd = end === -1 ? -1 : text.indexOf('\n', end)
+    const resumeAt = end === -1 ? text.length : (newlineAfterEnd === -1 ? text.length : newlineAfterEnd + 1)
+    const region = managedRegion(text, begin, end)
+    let kept = ''
+    let cursor = 0
+    for (const item of blockItems(region)) {
+      if (!isManagedWebserverItem(item.text)) continue
+      kept += region.slice(cursor, item.start)
+      cursor = item.end
+    }
+    kept += region.slice(cursor)
+    text = text.slice(0, blockStart) + kept + text.slice(resumeAt)
+  }
 }
 
 /**
@@ -163,9 +251,16 @@ export function managedBindOf(content: string): ManagedBindState | undefined {
   const begin = content.indexOf(LAN_BIND_BLOCK_BEGIN)
   if (begin === -1) return undefined
   const end = content.indexOf(LAN_BIND_BLOCK_END, begin)
-  const block = end === -1 ? content.slice(begin) : content.slice(begin, end)
-  const hostMatch = /host:\s*'([^']+)'/.exec(block)
-  const portMatch = /port:\s*(\d+)/.exec(block)
+  const region = managedRegion(content, begin, end)
+  // Read the bind out of the managed row itself. A region a YAML writer
+  // displaced holds foreign rows too, and their `host`/`port` keys are not
+  // this block's bind - reading them made the boot re-assert
+  // believe the block was already applied. A region without a recognizable
+  // managed row (hand-edited literals) keeps the historical whole-region read.
+  const items = blockItems(region).filter(item => isManagedWebserverItem(item.text))
+  const scope = items.length > 0 ? items.map(item => item.text).join('') : region
+  const hostMatch = /host:\s*'([^']+)'/.exec(scope)
+  const portMatch = /port:\s*(\d+)/.exec(scope)
   return {
     host: hostMatch?.[1] ?? '',
     port: portMatch !== null ? Number(portMatch[1]) : undefined,
@@ -184,9 +279,10 @@ export function lanBindState(profile: string, home: string = dshHome()): { block
  * patch file is preserved; the block is rewritten atomically (unique temp
  * file + rename, so concurrent writers can never rename a half-written
  * file) with the original file's permissions preserved. A hand-truncated
- * unterminated block (BEGIN marker without END, which stripManagedBlock
- * cannot match) is truncated at its BEGIN marker first so the rewrite can
- * never stack a second webserver row onto the orphan.
+ * unterminated block (BEGIN marker without END) is consumed by
+ * stripManagedBlock as well - markers and managed row removed, foreign rows
+ * kept - so the rewrite can never stack a second webserver row onto the
+ * orphan.
  *
  * The written file is always exactly one valid YAML document: a base the
  * plugin manager left in flow style is re-emitted as a block sequence before
@@ -194,9 +290,7 @@ export function lanBindState(profile: string, home: string = dshHome()): { block
  */
 export function writeLanBind(host: LanBindHost, port: number, profile: string, home: string = dshHome()): void {
   const file = profilePatchFile(profile, home)
-  const stripped = stripManagedBlock(readPatchContent(file))
-  const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN)
-  const rawBase = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()
+  const rawBase = stripManagedBlock(readPatchContent(file)).trimEnd()
   const base = rawBase.replace(/\[\s*\]\s*$/, '').trimEnd()
   const block = managedBlock(host, port)
   const content = mergePatchContent(base, block, file)

package/src/pairing.ts

@@ -24,7 +24,7 @@
 import { randomBytes } from 'node:crypto'
 import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
-import type { PostureSnapshot } from './posture.ts'
+import type { PostureHost, PostureSnapshot } from './posture.ts'
 
 /** The observable pairing phases the panel renders. */
 export type PairingPhase =
@@ -663,6 +663,7 @@ function snapshotsEqual(a: PairingSnapshot, b: PairingSnapshot): boolean {
     && a.publicUrl === b.publicUrl
     && tunnelEqual(a.tunnel, b.tunnel)
     && relayEqual(a.relay, b.relay)
+    && postureEqual(a.posture, b.posture)
     && a.tokenId === b.tokenId
     && a.tokenExpiresAt === b.tokenExpiresAt
     && a.deviceCount === b.deviceCount
@@ -695,6 +696,48 @@ function relayEqual(a: RelayStatus | undefined, b: RelayStatus | undefined): boo
     && a.state === b.state && a.url === b.url && a.error === b.error)
 }
 
+/**
+ * Posture equality. A probe round can change this frame while every other field
+ * stays put — the common case, since the probe re-runs on a settings change and
+ * on a tunnel reaching running, and a quick-tunnel restart churns the probed
+ * host set. Leaving the frame out of the comparison suppressed those emits, so
+ * the loopback SSE stream and the desktop panel could sit on a stale "exposed"
+ * (or stale "clean") verdict for as long as the phase and roster stayed put.
+ */
+function postureEqual(a: PostureSnapshot | undefined, b: PostureSnapshot | undefined): boolean {
+  if (a === b) return true
+  // A frame that is not an object at all (a hand-built context can pass
+  // anything) counts as changed instead of throwing out of the setter.
+  if (!isPostureFrame(a) || !isPostureFrame(b)) return false
+  return a.checkedAt === b.checkedAt && hostsEqual(a.hosts, b.hosts)
+}
+
+/** Whether a value has the shape a posture frame is compared on. */
+function isPostureFrame(value: unknown): value is PostureSnapshot {
+  return typeof value === 'object' && value !== null
+}
+
+/**
+ * Per-host posture equality (a round's verdicts, in probe order). Tolerates a
+ * frame that is not the expected shape: this runs inside the emit path, outside
+ * the listener error containment, so a malformed snapshot handed in by another
+ * host-fiber caller must degrade to "changed" instead of throwing out of the
+ * setter that produced it.
+ */
+function hostsEqual(a: readonly PostureHost[] | undefined, b: readonly PostureHost[] | undefined): boolean {
+  if (a === b) return true
+  if (!Array.isArray(a) || !Array.isArray(b)) return false
+  return a.length === b.length && a.every((host, index) => {
+    const other = b[index]
+    return isPostureHost(host) && isPostureHost(other) && host.host === other.host && host.exposed === other.exposed
+  })
+}
+
+/** Whether a value has the shape one probed host is compared on. */
+function isPostureHost(value: unknown): value is PostureHost {
+  return typeof value === 'object' && value !== null
+}
+
 /** Element-wise string list equality (interface order is meaningful). */
 function sameStrings(a: readonly string[], b: readonly string[]): boolean {
   return a.length === b.length && a.every((value, index) => value === b[index])

package/src/remote-api.ts

@@ -182,7 +182,19 @@ export function makeRemoteApiRoutes(deps: RemoteApiDeps): WebRoute[] {
 }
 
 /**
- * Map one outer upgrade URL onto the loopback path (query string included).
+ * Map one outer upgrade URL onto the loopback path, dropping the cookieless
+ * device credential on the way in.
+ *
+ * The outer handshake carries the device id as `?device=<id>` because WebSocket
+ * handshakes cannot carry headers from the Web API. That id is a live session
+ * credential — it opens the full host API through this same channel — and the
+ * inner leg is a request the rest of the loopback origin sees (on a WebSocket
+ * leg, a raw handshake request line written to a loopback socket), so forwarding
+ * it handed a working credential to every other observer of the local port for
+ * no benefit: the gate above has already authenticated the caller, and no
+ * upstream route reads the parameter (the gateway mux matches on path alone).
+ * The rest of the query rides through unchanged, so a caller's own parameters
+ * still reach the upstream.
  */
 export function upgradeInnerPath(reqUrl: string | undefined, fallbackPath: string): string {
   if (reqUrl === undefined || reqUrl === '') return fallbackPath
@@ -194,6 +206,7 @@ export function upgradeInnerPath(reqUrl: string | undefined, fallbackPath: strin
   }
   const inner = innerPathOf(url.pathname)
   if (inner === undefined) return fallbackPath
+  url.searchParams.delete(REMOTE_DEVICE_QUERY)
   return `${inner}${url.search}`
 }