@linxin666/dsh-remote-web-ui 0.4.4 → 0.4.6

package/src/client/plugin-card-seat.ts

@@ -86,6 +86,11 @@ export interface PluginCardSeat {
   label?: () => string
   /** Locale namespace the card renders with. */
   locale: string
+  /**
+   * Child slots this card declares and renders. Forwarded to whichever seat
+   * the host renders; absent for a card that declares none.
+   */
+  children?: Record<string, unknown>
   /** Business-face factory of the registration. */
   inject?: () => object
   /**
@@ -162,12 +167,14 @@ export function installPluginCard(ctx: PluginCardContext, seat: PluginCardSeat):
           ...(seat.order === undefined ? {} : { order: seat.order }),
           ...(seat.label === undefined ? {} : { label: seat.label }),
           locale: seat.locale,
+          ...(seat.children === undefined ? {} : { children: seat.children }),
           ...(seat.inject === undefined ? {} : { inject }),
         }
         : {
           name: OFFICIAL_PLUGIN_CARD_SEAT,
           key: seat.bundle,
           locale: seat.locale,
+          ...(seat.children === undefined ? {} : { children: seat.children }),
           ...(seat.inject === undefined ? {} : { inject }),
         }) as never, component) as () => void
       current = target

package/src/client/settings-card.module.css

@@ -36,8 +36,8 @@
   border: 0;
   border-radius: 12px;
   align-items: center;
-  gap: 12px;
-  padding: 14px 16px;
+  gap: 13px;
+  padding: 16px;
   display: flex;
 }
 
@@ -51,8 +51,8 @@
   box-sizing: border-box;
   border-radius: 12px;
   align-items: center;
-  gap: 12px;
-  padding: 14px 16px;
+  gap: 13px;
+  padding: 16px;
   display: flex;
 }
 
@@ -64,6 +64,25 @@
   display: flex;
 }
 
+/* Optional leading plugin mark: a quiet tile that takes the ink color on
+   hover and while the card is open, so the whole row reads as one control. */
+.mark {
+  flex: none;
+  display: grid;
+  place-items: center;
+  width: 34px;
+  height: 34px;
+  border-radius: 10px;
+  background: var(--dsw-alias-bg-module-platform);
+  color: var(--dsw-alias-label-secondary);
+  transition: color 0.16s;
+}
+
+.header:hover .mark,
+.cardOpen .mark {
+  color: var(--dsw-alias-label-primary);
+}
+
 .name {
   color: var(--dsw-alias-label-primary);
   font-size: 15px;
@@ -95,7 +114,13 @@
 .chevron {
   color: var(--dsw-alias-label-tertiary);
   flex: none;
-  transition: transform 0.16s;
+  width: 16px;
+  height: 16px;
+  transition: transform 0.16s, color 0.16s;
+}
+
+.header:hover .chevron {
+  color: var(--dsw-alias-label-secondary);
 }
 
 .chevronOpen {
@@ -406,6 +431,7 @@
 @media (prefers-reduced-motion: reduce) {
   .card,
   .header,
+  .mark,
   .chevron,
   .chevronOpen,
   .discard,

package/src/client/settings-form.ts

@@ -215,6 +215,8 @@ export class CardForm<T> {
   private readonly disposeForm: () => void
   private disposed = false
   private saving = false
+  /** A save asked for while one was in flight; it runs once the first settles (#1754). */
+  private saveQueued = false
   private failed = false
   private failedReason: string | undefined
 
@@ -283,7 +285,7 @@ export class CardForm<T> {
       resetField: (field) => {
         this.stage(field, { text: this.specOf(field).format(this.baseValue(field)), clear: true })
       },
-      save: () => { void this.save() },
+      save: () => { void this.requestSave() },
       discard: () => {
         if (this.staged.size === 0 && !this.failed) return
         this.staged.clear()
@@ -310,6 +312,30 @@ export class CardForm<T> {
    * the user can correct them instead of retyping.
    * @returns settlement after the mutation and the read-back.
    */
+  /**
+   * Run one save, and re-run it once if another was asked for while this one
+   * was still in flight.
+   *
+   * A save is a Host round trip that also drives the profile reconcile, and
+   * the Host runs that write inside one exclusive transaction. Answering a
+   * press that arrives mid-flight by returning immediately dropped the edit
+   * with no explanation, which is the "the save button stops working after a
+   * few rounds" report (#1754). Serializing instead means a save pressed while
+   * another is still settling runs against the settled state - which is what
+   * the operator meant by pressing it again.
+   * @returns settlement after the mutation and the read-back.
+   */
+  async requestSave(): Promise<void> {
+    if (this.saving) {
+      this.saveQueued = true
+      return
+    }
+    await this.save()
+    if (!this.saveQueued) return
+    this.saveQueued = false
+    await this.requestSave()
+  }
+
   async save(): Promise<void> {
     const plan = this.plan()
     const valid = plan.filter((item): item is PlannedWrite & { judge: () => boolean } => item.judge !== undefined)

package/src/detached-work.ts

@@ -0,0 +1,58 @@
+// Generated by scripts/sync-shared.mjs from shared/host/detached-work.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Run one piece of work outside the caller's async context.
+ *
+ * A Host mutation that runs inside `hmr.runExclusive` marks the running async
+ * context with an AsyncLocalStorage store. Side effects on that path that write
+ * a file the HMR config watcher refreshes from - `cordis.patch.yml` above all -
+ * must not run under that mark, or the watcher's refresh re-enters the
+ * exclusive transaction and is refused with "HMR transactions cannot be nested"
+ * (#1751, #1754, #1816).
+ *
+ * Deferring is NOT enough, and the earlier belt that this one replaces was
+ * built on a disproven premise: Node propagates an AsyncLocalStorage store into
+ * `setImmediate`, into `node:timers`, into promise continuations, and into any
+ * AsyncResource scoped to the current async id. Measured on Node 24:
+ *
+ * ```
+ * als.run(true, () => setImmediate(() => als.getStore()))   // -> true
+ * ```
+ *
+ * What DOES start clean is an AsyncResource whose `triggerAsyncId` is not the
+ * transaction. A resource created once at module scope - that is, before any
+ * transaction existed - carries no store, and everything it schedules inherits
+ * that emptiness rather than the caller's mark:
+ *
+ * ```
+ * const detached = new AsyncResource('...')      // module scope
+ * als.run(true, () => detached.runInAsyncScope(() => setImmediate(() => als.getStore())))
+ * // -> undefined
+ * ```
+ *
+ * @module dsh-web-shared/host/detached-work
+ */
+
+import { AsyncResource } from 'node:async_hooks'
+
+/**
+ * The escape hatch, created at module scope on purpose: a resource built while
+ * a transaction is running would capture that transaction, so this single
+ * instance is the only one the module ever needs. It carries no context of its
+ * own, so every job run through it starts from the process's root context.
+ */
+const DETACHED = new AsyncResource('dsh-web:detached-work', { triggerAsyncId: 0 })
+
+/**
+ * Run `work` outside the caller's AsyncLocalStorage context.
+ *
+ * The call itself is synchronous - this schedules, it does not defer. Work that
+ * must not block the caller should schedule its own `setImmediate` inside
+ * `work`, which then also starts clean because it inherits this resource's
+ * empty context rather than the caller's.
+ *
+ * @param work - the side effect to detach from the caller's async context.
+ * @returns whatever `work` returns.
+ */
+export function runDetached<T>(work: () => T): T {
+  return DETACHED.runInAsyncScope(work)
+}

package/src/index.ts

@@ -39,6 +39,7 @@ import { withIdentityEncoding } from './http.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
 import { PublicBaseKeeper } from './public-base.ts'
 import { mountOnce } from './mount-once.ts'
+import { runDetached } from './detached-work.ts'
 import { REMOTE_CHANNEL_BOOT_SCRIPT } from './remote-channel-boot.ts'
 import { UUID_POLYFILL_SCRIPT } from './uuid-polyfill.ts'
 
@@ -743,14 +744,26 @@ function applyImpl(ctx: Context, config?: ResolvedConfigFields): void {
   // the re-assert at every boot keeps it in sync with both the toggle and
   // the flags.
   //
-  // This work must leave the caller's async context first: a settings save
-  // runs inside the Host's hmr.runExclusive, and cordis.patch.yml is exactly
-  // the file the HMR config watcher refreshes from. A write issued on that
-  // same context makes the watcher's refresh re-enter runExclusive, which
-  // rejects with "HMR transactions cannot be nested" and fails the user's
-  // save (issue #1751). setImmediate starts a fresh AsyncLocalStorage store,
-  // so the assertion runs outside the transaction; it is idempotent, so the
-  // coalesced follow-up sync() re-reading the same block writes nothing.
+  // cordis.patch.yml is exactly the file the Host's HMR config watcher
+  // refreshes from, and a settings save runs inside the Host's exclusive HMR
+  // transaction. Writing that file while the caller's transaction is open makes
+  // the watcher's refresh re-enter it, which the Host refuses with "HMR
+  // transactions cannot be nested" and which surfaces on the user's save
+  // (#1751, #1754).
+  //
+  // Deferring alone does NOT escape that context, and the earlier belt rested
+  // on a premise that measurement disproves: AsyncLocalStorage is propagated
+  // into setImmediate, into node:timers, and into AsyncResource scopes (a
+  // plain resource built while the transaction runs inherits it), so
+  // "setImmediate starts a fresh store" is false. What does start clean is an
+  // AsyncResource created at module scope, before any transaction existed -
+  // see detached-work.ts. scheduleLanBindWork runs the scheduling through it,
+  // so the write lands outside the caller's transaction.
+  //
+  // The assertion is also idempotent on its own: the write is guarded by the
+  // current-vs-desired comparison below, so once the profile carries the block
+  // a coalesced follow-up sync() finds nothing to do. That guard is a second
+  // belt, not the fix.
   const applyLanBindWork = (value: ResolvedConfig): void => {
     if (value.lanBind !== undefined) {
       const startup = ctx.get('webStartup') as StartupFacts | undefined
@@ -794,11 +807,19 @@ function applyImpl(ctx: Context, config?: ResolvedConfigFields): void {
   // The LAN bind assertion never blocks the caller: one pending work item is
   // enough, and it always re-reads the config through `resolve()` at run time
   // so a toggle flipped twice before the tick lands on the last value.
+  //
+  // The scheduling itself runs through runDetached: the settings save that
+  // drives sync() holds the Host's exclusive HMR transaction in its async
+  // context, and a `setImmediate` scheduled directly from here would inherit
+  // that mark (measured on Node 24), so the write would still land inside the
+  // transaction the watcher then tries to re-enter. Scheduling from the
+  // module-scope resource starts the timer - and therefore the write - with no
+  // store at all.
   let lanBindWorkPending = false
   const scheduleLanBindWork = (): void => {
     if (lanBindWorkPending) return
     lanBindWorkPending = true
-    setImmediate(() => {
+    runDetached(() => setImmediate(() => {
       lanBindWorkPending = false
       try {
         applyLanBindWork(resolve())
@@ -808,7 +829,7 @@ function applyImpl(ctx: Context, config?: ResolvedConfigFields): void {
         // reads the live block state back on its own poll.
         console.error(`remote-web-ui: the deferred lan-bind assertion failed: ${error instanceof Error ? error.message : String(error)}`)
       }
-    })
+    }))
   }
   ctx.effect(() => () => { lanBindWorkPending = false }, 'remote-web-ui: lan-bind work')
 

package/src/lan-bind.ts

@@ -57,17 +57,105 @@ function readPatchContent(file: string): string {
   return readFileSync(file, 'utf8')
 }
 
-/** Escape one literal string for embedding into a RegExp pattern. */
-function escapeRegex(text: string): string {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+/** One top-level sequence item inside a managed-block region. */
+interface BlockItem {
+  /** Offset of the item's first character inside the region. */
+  start: number
+  /** Offset just past the item's last character inside the region. */
+  end: number
+  /** The item's source text, line terminator included. */
+  text: string
 }
 
-/** Remove the managed block (and its markers) from patch content. */
+/**
+ * Split a block-sequence region into its top-level items. Only a column-0 `-`
+ * starts an item: that is the shape every writer of this file produces - the
+ * managed block itself and the YAML document API's block-style re-emission.
+ * @param region - text between two line boundaries.
+ * @returns the items in source order; text outside them is not returned.
+ */
+function blockItems(region: string): BlockItem[] {
+  const items: BlockItem[] = []
+  let start = -1
+  let offset = 0
+  for (const line of region.split('\n')) {
+    if (line.startsWith('- ') || line === '-') {
+      if (start !== -1) items.push({ start, end: offset, text: region.slice(start, offset) })
+      start = offset
+    }
+    offset += line.length + 1
+  }
+  if (start !== -1) items.push({ start, end: region.length, text: region.slice(start) })
+  return items
+}
+
+/**
+ * Whether one top-level item is the webserver row this plugin's block owns.
+ * The row id is the whole signal: the markers declare everything inside them
+ * managed, our block always writes `- id: webserver`, and a same-id row later
+ * in the patch replaces this one wholesale anyway - so an id-webserver row
+ * found inside our markers is this plugin's row (a hand-truncated block may
+ * have lost its `name` line).
+ * @param item - one top-level item's text.
+ * @returns true when the item is the managed webserver row.
+ */
+function isManagedWebserverItem(item: string): boolean {
+  return /^- id:\s*['"]?webserver['"]?[ \t]*(?:\r?\n|$)/.test(item)
+}
+
+/**
+ * The text between a block's BEGIN and END markers: from the character after
+ * the BEGIN line's terminator to the start of the END marker's line (or to
+ * the end of the content without an END marker).
+ * @param content - the patch file text.
+ * @param begin - index of the BEGIN marker.
+ * @param end - index of the END marker, or -1 when the block is unterminated.
+ * @returns the region's text.
+ */
+function managedRegion(content: string, begin: number, end: number): string {
+  const newlineAfterBegin = content.indexOf('\n', begin)
+  const innerStart = newlineAfterBegin === -1 ? content.length : newlineAfterBegin + 1
+  const endLineStart = end === -1 ? content.length : content.lastIndexOf('\n', end - 1) + 1
+  return content.slice(innerStart, Math.max(innerStart, endLineStart))
+}
+
+/**
+ * Remove the managed block (its markers and the webserver row this plugin
+ * wrote) from patch content, keeping every other row.
+ *
+ * The markers travel with the file through writers that append rows through
+ * the YAML document API: the appended rows land at the end of the sequence,
+ * which is BEFORE a trailing END comment, so the region between the markers
+ * can hold rows this plugin never wrote. Deleting the whole region silently
+ * removed the user's model, plugin and remote-control rows on the next rewrite
+ * - the remote-control row carries the LAN toggle itself, so the feature reset
+ * to `undefined` and the phone was locked out again after a restart (DSH
+ * Desktop report, 2026-09-30). Only the managed item is removed here; every
+ * foreign row is kept in place and the fresh block is appended after them (the
+ * same-id row last wins).
+ * @param content - the patch file text.
+ * @returns the text with the markers and the managed row removed.
+ */
 export function stripManagedBlock(content: string): string {
-  const begin = escapeRegex(LAN_BIND_BLOCK_BEGIN)
-  const end = escapeRegex(LAN_BIND_BLOCK_END)
-  const pattern = new RegExp(`\\r?\\n?${begin}[\\s\\S]*?${end}\\r?\\n?`, 'g')
-  return content.replace(pattern, '\n')
+  let text = content
+  for (;;) {
+    const begin = text.indexOf(LAN_BIND_BLOCK_BEGIN)
+    if (begin === -1) return text
+    const end = text.indexOf(LAN_BIND_BLOCK_END, begin)
+    const blockStart = text.lastIndexOf('\n', begin - 1) + 1
+    const newlineAfterEnd = end === -1 ? -1 : text.indexOf('\n', end)
+    const resumeAt = end === -1 ? text.length : (newlineAfterEnd === -1 ? text.length : newlineAfterEnd + 1)
+    const region = managedRegion(text, begin, end)
+    let kept = ''
+    let cursor = 0
+    for (const item of blockItems(region)) {
+      if (!isManagedWebserverItem(item.text)) continue
+      kept += region.slice(cursor, item.start)
+      cursor = item.end
+    }
+    kept += region.slice(cursor)
+    text = text.slice(0, blockStart) + kept + text.slice(resumeAt)
+  }
 }
 
 /**
@@ -163,9 +251,16 @@ export function managedBindOf(content: string): ManagedBindState | undefined {
   const begin = content.indexOf(LAN_BIND_BLOCK_BEGIN)
   if (begin === -1) return undefined
   const end = content.indexOf(LAN_BIND_BLOCK_END, begin)
-  const block = end === -1 ? content.slice(begin) : content.slice(begin, end)
-  const hostMatch = /host:\s*'([^']+)'/.exec(block)
-  const portMatch = /port:\s*(\d+)/.exec(block)
+  const region = managedRegion(content, begin, end)
+  // Read the bind out of the managed row itself. A region a YAML writer
+  // displaced holds foreign rows too, and their `host`/`port` keys are not
+  // this block's bind - reading them made the boot re-assert
+  // believe the block was already applied. A region without a recognizable
+  // managed row (hand-edited literals) keeps the historical whole-region read.
+  const items = blockItems(region).filter(item => isManagedWebserverItem(item.text))
+  const scope = items.length > 0 ? items.map(item => item.text).join('') : region
+  const hostMatch = /host:\s*'([^']+)'/.exec(scope)
+  const portMatch = /port:\s*(\d+)/.exec(scope)
   return {
     host: hostMatch?.[1] ?? '',
     port: portMatch !== null ? Number(portMatch[1]) : undefined,
@@ -184,9 +279,10 @@ export function lanBindState(profile: string, home: string = dshHome()): { block
  * patch file is preserved; the block is rewritten atomically (unique temp
  * file + rename, so concurrent writers can never rename a half-written
  * file) with the original file's permissions preserved. A hand-truncated
- * unterminated block (BEGIN marker without END, which stripManagedBlock
- * cannot match) is truncated at its BEGIN marker first so the rewrite can
- * never stack a second webserver row onto the orphan.
+ * unterminated block (BEGIN marker without END) is consumed by
+ * stripManagedBlock as well - markers and managed row removed, foreign rows
+ * kept - so the rewrite can never stack a second webserver row onto the
+ * orphan.
  *
  * The written file is always exactly one valid YAML document: a base the
  * plugin manager left in flow style is re-emitted as a block sequence before
@@ -194,9 +290,7 @@ export function lanBindState(profile: string, home: string = dshHome()): { block
  */
 export function writeLanBind(host: LanBindHost, port: number, profile: string, home: string = dshHome()): void {
   const file = profilePatchFile(profile, home)
-  const stripped = stripManagedBlock(readPatchContent(file))
-  const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN)
-  const rawBase = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()
+  const rawBase = stripManagedBlock(readPatchContent(file)).trimEnd()
   const base = rawBase.replace(/\[\s*\]\s*$/, '').trimEnd()
   const block = managedBlock(host, port)
   const content = mergePatchContent(base, block, file)

package/src/remote-channel-boot.ts

@@ -204,7 +204,7 @@ export function buildRemoteChannelBootScript(rules: RemoteChannelRules = REMOTE_
 /** Boot-watchdog latch: one self-reload per session while the boot is broken. */
 export const BOOT_WATCHDOG_KEY = 'dsh-remote-boot-reload'
 
-/** Total wait for the app's first conversation surface before the reload. */
+/** Post-load wait for the app's first conversation surface before the reload. */
 const BOOT_WATCHDOG_WAIT_MS = 15_000
 
 /** Watchdog poll cadence. */
@@ -227,6 +227,9 @@ export function buildBootWatchdogScript(waitMs = BOOT_WATCHDOG_WAIT_MS, pollMs =
     ';function wBoot(){try{return !!(w.document&&w.document.querySelector&&(w.document.querySelector("[data-conversation-scroll]")||w.document.querySelector("[data-slot=\\"conversation\\"]")))}catch(e){return false}}' +
     'function wTick(n){try{' +
     'if(wBoot()){try{w.sessionStorage.removeItem(' + key + ')}catch(e){}return}' +
+    // Parse-time installation must not spend the recovery budget downloading
+    // the initial scripts/styles over a slow remote link (issue #1845).
+    'if(!w.document||w.document.readyState!=="complete"){w.setTimeout(function(){wTick(0)},' + pollMs + ');return}' +
     'if(n<' + waitMs + '){w.setTimeout(function(){wTick(n+' + pollMs + ')},' + pollMs + ');return}' +
     'var done=false;try{done=w.sessionStorage.getItem(' + key + ')==="1"}catch(e){}' +
     'if(done)return;' +