@lvxianchao/dsh-web-guard 2.1.1 → 3.0.1

package/lib/proxy.js

@@ -6,176 +6,198 @@
  * loopback request: Host and Origin are rewritten to the upstream authority,
  * which is exactly what the /api browser-trust fence accepts.
  */
-import http from 'node:http'
-import https from 'node:https'
-import net from 'node:net'
-import tls from 'node:tls'
-import fs from 'node:fs'
-import { URL } from 'node:url'
-
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import tls from 'node:tls';
+import fs from 'node:fs';
+import { URL } from 'node:url';
 /** Headers never forwarded verbatim to the upstream. */
-const DROP = new Set(['host', 'origin', 'proxy-connection', 'connection', 'keep-alive', 'upgrade', 'transfer-encoding'])
-
+const DROP = new Set(['host', 'origin', 'proxy-connection', 'connection', 'keep-alive', 'upgrade', 'transfer-encoding']);
 /** Build the upstream header set with loopback authority substitution. */
 export function upstreamHeaders(headers, target, cookie) {
-  const out = {}
-  for (const [key, value] of Object.entries(headers)) {
-    if (DROP.has(key.toLowerCase())) continue
-    out[key] = value
-  }
-  out.host = target.host
-  // Only restate Origin when the browser sent one: dsh accepts a request
-  // without Origin, and a fabricated one would have to stay consistent.
-  if (headers.origin !== undefined) out.origin = target.origin
-  if (cookie) out.cookie = cookie
-  out['x-forwarded-proto'] = target.protocol.replace(':', '')
-  return out
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (DROP.has(key.toLowerCase()))
+            continue;
+        out[key] = value;
+    }
+    out.host = target.host;
+    // Only restate Origin when the browser sent one: dsh accepts a request
+    // without Origin, and a fabricated one would have to stay consistent.
+    if (headers.origin !== undefined)
+        out.origin = target.origin;
+    if (cookie)
+        out.cookie = cookie;
+    out['x-forwarded-proto'] = target.protocol.replace(':', '');
+    return out;
 }
-
-/**
- * Create the public-facing listener.
- * @param {object} options
- * @param {string} options.host
- * @param {number} options.port
- * @param {string | null} options.tlsCert - PEM chain path, enables HTTPS
- * @param {string | null} options.tlsKey
- * @param {(req: import('node:http').IncomingMessage, res: import('node:http').ServerResponse) => void} options.handler
- * @param {(req: import('node:http').IncomingMessage, socket: import('node:net').Socket, head: Buffer) => void} options.onUpgrade
- * @param {(line: string) => void} options.log
- */
-export function createListener({ host, port, tlsCert, tlsKey, handler, onUpgrade, log }) {
-  let server
-  if (tlsCert && tlsKey) {
-    server = https.createServer(
-      { cert: fs.readFileSync(tlsCert), key: fs.readFileSync(tlsKey) },
-      wrap(handler, log),
-    )
-    server.on('tlsClientError', (err) => log(`tls error: ${err.message}`))
-  } else {
-    server = http.createServer(wrap(handler, log))
-  }
-  server.on('upgrade', (req, socket, head) => {
-    socket.on('error', () => socket.destroy())
-    try {
-      onUpgrade(req, socket, head)
-    } catch (err) {
-      log(`upgrade error: ${err.message}`)
-      socket.destroy()
+/** Create the public-facing listener. */
+export function createListener(options) {
+    const { host, port, tlsCert, tlsKey, handler, onUpgrade, log } = options;
+    const wrapped = wrap(handler, log);
+    let server;
+    if (tlsCert && tlsKey) {
+        const secure = https.createServer({ cert: fs.readFileSync(tlsCert), key: fs.readFileSync(tlsKey) }, wrapped);
+        secure.on('tlsClientError', (err) => log(`tls error: ${err.message}`));
+        server = secure;
     }
-  })
-  server.on('clientError', (err, socket) => {
-    if (socket.writable) socket.end('HTTP/1.1 400 Bad Request\r\n\r\n')
-    socket.destroy()
-    log(`client error: ${err.message}`)
-  })
-  server.on('error', (err) => log(`listener error: ${err.message}`))
-  return {
-    server,
-    listen: () => new Promise((resolve, reject) => {
-      server.once('error', reject)
-      server.listen(port, host, () => {
-        server.removeListener('error', reject)
-        resolve()
-      })
-    }),
-    close: () => {
-      server.closeAllConnections?.()
-      server.close()
-    },
-  }
+    else {
+        server = http.createServer(wrapped);
+    }
+    server.on('upgrade', (req, socket, head) => {
+        socket.on('error', () => socket.destroy());
+        try {
+            onUpgrade(req, socket, head);
+        }
+        catch (err) {
+            log(`upgrade error: ${errorMessage(err)}`);
+            socket.destroy();
+        }
+    });
+    server.on('clientError', (err, socket) => {
+        if (socket.writable)
+            socket.end('HTTP/1.1 400 Bad Request\r\n\r\n');
+        socket.destroy();
+        log(`client error: ${err.message}`);
+    });
+    server.on('error', (err) => log(`listener error: ${err.message}`));
+    return {
+        server,
+        listen: () => new Promise((resolve, reject) => {
+            const onError = (err) => reject(err);
+            server.once('error', onError);
+            server.listen(port, host, () => {
+                server.removeListener('error', onError);
+                resolve();
+            });
+        }),
+        close: () => {
+            server.closeAllConnections();
+            server.close();
+        },
+    };
 }
-
 function wrap(handler, log) {
-  return (req, res) => {
-    Promise.resolve(handler(req, res)).catch((err) => {
-      log(`handler error: ${err?.stack ?? err}`)
-      if (!res.headersSent) {
-        res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' })
-        res.end('dsh-web-guard: internal error\n')
-      } else {
-        res.destroy()
-      }
-    })
-  }
+    return (req, res) => {
+        Promise.resolve(handler(req, res)).catch((err) => {
+            log(`handler error: ${err instanceof Error ? err.stack ?? err.message : String(err)}`);
+            if (!res.headersSent) {
+                res.writeHead(500, { 'content-type': 'text/plain; charset=utf-8' });
+                res.end('dsh-web-guard: internal error\n');
+            }
+            else {
+                res.destroy();
+            }
+        });
+    };
 }
-
 /** Forward one HTTP request to the upstream listener. */
-export function forward(req, res, { targetOrigin, cookie, agent, log }) {
-  const target = new URL(targetOrigin)
-  const secure = target.protocol === 'https:'
-  const transport = secure ? https : http
-  const started = Date.now()
-  const proxyReq = transport.request({
-    agent: secure ? undefined : agent,
-    host: target.hostname,
-    port: target.port || (secure ? 443 : 80),
-    method: req.method,
-    path: req.url,
-    headers: upstreamHeaders(req.headers, target, cookie),
-    rejectUnauthorized: false,
-  }, (proxyRes) => {
-    const headers = { ...proxyRes.headers }
+export function forward(req, res, options) {
+    const { targetOrigin, cookie, agent, log } = options;
+    const target = new URL(targetOrigin);
+    const secure = target.protocol === 'https:';
+    const started = Date.now();
+    const requestOptions = {
+        agent: secure ? undefined : agent,
+        host: target.hostname,
+        port: target.port || (secure ? 443 : 80),
+        method: req.method,
+        path: req.url,
+        headers: upstreamHeaders(req.headers, target, cookie),
+        rejectUnauthorized: false,
+    };
+    const proxyReq = secure
+        ? https.request(requestOptions, (proxyRes) => forwardResponse(proxyRes, res, req, started, log))
+        : http.request(requestOptions, (proxyRes) => forwardResponse(proxyRes, res, req, started, log));
+    // A browser can walk away mid-response (tab closed, reload, flaky link).
+    // Without this the upstream request survives the client, and a response that
+    // never ends — an SSE stream, a long poll — keeps its socket allocated in the
+    // shared keep-alive agent forever. Once `maxSockets` of those pile up every
+    // later request queues until the proxy in front gives up (504).
+    res.on('close', () => {
+        if (!res.writableEnded)
+            proxyReq.destroy();
+    });
+    proxyReq.on('error', (err) => {
+        // Destroying the upstream is the expected outcome of a client hangup.
+        if (res.destroyed || res.writableEnded)
+            return;
+        log(`upstream error ${req.method} ${req.url}: ${err.message}`);
+        if (!res.headersSent) {
+            res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+            res.end('dsh-web-guard: upstream unreachable\n');
+        }
+        else {
+            res.destroy();
+        }
+    });
+    req.pipe(proxyReq);
+}
+function forwardResponse(proxyRes, res, req, started, log) {
+    if (res.destroyed) {
+        proxyRes.destroy();
+        return;
+    }
+    const headers = { ...proxyRes.headers };
     // Never leak the harness cookie to the browser: the guard owns it.
-    delete headers['set-cookie']
-    res.writeHead(proxyRes.statusCode ?? 502, headers)
-    proxyRes.pipe(res)
+    delete headers['set-cookie'];
+    res.writeHead(proxyRes.statusCode ?? 502, headers);
+    proxyRes.on('error', () => res.destroy());
+    proxyRes.pipe(res);
     // Quiet by default: the Web UI polls constantly. Log failures and slow
     // requests only, so the journal does not fill with 200s.
     proxyRes.on('end', () => {
-      const code = proxyRes.statusCode ?? 0
-      const ms = Date.now() - started
-      if (code >= 400 || ms > 1000) log(`${req.method} ${req.url} ${code} ${ms}ms`)
-    })
-  })
-  proxyReq.on('error', (err) => {
-    log(`upstream error ${req.method} ${req.url}: ${err.message}`)
-    if (!res.headersSent) {
-      res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' })
-      res.end('dsh-web-guard: upstream unreachable\n')
-    } else {
-      res.destroy()
-    }
-  })
-  req.pipe(proxyReq)
+        const code = proxyRes.statusCode ?? 0;
+        const ms = Date.now() - started;
+        if (code >= 400 || ms > 1000)
+            log(`${req.method} ${req.url} ${code} ${ms}ms`);
+    });
 }
-
 /** Forward a WebSocket (or any HTTP upgrade) with the same header rewrite. */
-export function forwardUpgrade(req, socket, head, { targetOrigin, cookie, log }) {
-  const target = new URL(targetOrigin)
-  const secure = target.protocol === 'https:'
-  const port = Number(target.port || (secure ? 443 : 80))
-  const lines = [`${req.method} ${req.url} HTTP/1.1`]
-  const raw = req.rawHeaders ?? []
-  for (let i = 0; i + 1 < raw.length; i += 2) {
-    const lower = raw[i].toLowerCase()
-    if (lower === 'host' || lower === 'origin' || lower === 'proxy-connection') continue
-    lines.push(`${raw[i]}: ${raw[i + 1]}`)
-  }
-  lines.push(`Host: ${target.host}`)
-  if (req.headers.origin !== undefined) lines.push(`Origin: ${target.origin}`)
-  if (cookie) lines.push(`Cookie: ${cookie}`)
-  lines.push('', '')
-
-  const backend = secure
-    ? tls.connect({ host: target.hostname, port, servername: target.hostname, rejectUnauthorized: false })
-    : net.connect(port, target.hostname)
-  const teardown = (err) => {
-    if (err) log(`ws error ${req.url}: ${err.message}`)
-    socket.destroy()
-    backend.destroy()
-  }
-  socket.on('error', teardown)
-  backend.on('error', teardown)
-  socket.on('close', () => backend.destroy())
-  backend.on('close', () => socket.destroy())
-  backend.on('connect', () => {
-    log(`ws ${req.url}`)
-    backend.write(lines.join('\r\n'))
-    if (head?.length) backend.write(head)
-    backend.pipe(socket)
-    socket.pipe(backend)
-  })
+export function forwardUpgrade(req, socket, head, options) {
+    const { targetOrigin, cookie, log } = options;
+    const target = new URL(targetOrigin);
+    const secure = target.protocol === 'https:';
+    const port = Number(target.port || (secure ? 443 : 80));
+    const lines = [`${req.method} ${req.url} HTTP/1.1`];
+    const raw = req.rawHeaders ?? [];
+    for (let i = 0; i + 1 < raw.length; i += 2) {
+        const lower = raw[i].toLowerCase();
+        if (lower === 'host' || lower === 'origin' || lower === 'proxy-connection')
+            continue;
+        lines.push(`${raw[i]}: ${raw[i + 1]}`);
+    }
+    lines.push(`Host: ${target.host}`);
+    if (req.headers.origin !== undefined)
+        lines.push(`Origin: ${target.origin}`);
+    if (cookie)
+        lines.push(`Cookie: ${cookie}`);
+    lines.push('', '');
+    const backend = secure
+        ? tls.connect({ host: target.hostname, port, servername: target.hostname, rejectUnauthorized: false })
+        : net.connect(port, target.hostname);
+    const teardown = (err) => {
+        if (err)
+            log(`ws error ${req.url}: ${err.message}`);
+        socket.destroy();
+        backend.destroy();
+    };
+    socket.on('error', (err) => teardown(err));
+    backend.on('error', (err) => teardown(err));
+    socket.on('close', () => backend.destroy());
+    backend.on('close', () => socket.destroy());
+    backend.on('connect', () => {
+        log(`ws ${req.url}`);
+        backend.write(lines.join('\r\n'));
+        if (head?.length)
+            backend.write(head);
+        backend.pipe(socket);
+        socket.pipe(backend);
+    });
 }
-
 /** Shared keep-alive agent for upstream requests. */
-export const upstreamAgent = new http.Agent({ keepAlive: true, maxSockets: 128 })
+export const upstreamAgent = new http.Agent({ keepAlive: true, maxSockets: 128 });
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/lib/shared/api.js

@@ -0,0 +1,19 @@
+/**
+ * The JSON contract between the server half of dsh-web-guard and the React
+ * settings page in the client bundle. Both halves compile against this file, so
+ * a shape change breaks the build instead of the settings page.
+ *
+ * Authentication is the ordinary session cookie: the native page lives on the
+ * same origin as the harness, so `fetch` with `credentials: 'same-origin'`
+ * carries it. Every mutating call is checked against the request `Origin`, and
+ * the JSON content type forces a CORS preflight, which makes cross-site form
+ * posts from another origin impossible.
+ */
+/** Route table, relative to the deployment origin. */
+export const GUARD_API = {
+    state: '/__guard/api/state',
+    settings: '/__guard/api/settings',
+    password: '/__guard/api/password',
+    kick: '/__guard/api/kick',
+    logoutAll: '/__guard/api/logout-all',
+};

package/lib/shared/theme.js

@@ -0,0 +1,109 @@
+/**
+ * Palette for the pages this plugin renders itself: the login form and the
+ * signed-out page. Those are standalone documents before
+ * the harness boots, so they cannot use the harness `--dsw-alias-*` tokens;
+ * they carry their own two palettes. The server half forces the harness
+ * `ui-theme` preference when it is `light`/`dark`; `system`/unset follows the
+ * operating system, and `?theme=light|dark` overrides both (screenshots, kiosks).
+ *
+ * The native settings page does NOT use this file: it renders inside the
+ * harness React tree and inherits the live `--dsw-alias-*` tokens directly.
+ * Keep the values close to the measured harness palette (0.2.2-rc.1) so a user
+ * who opens the standalone page sees a familiar surface.
+ */
+export const PALETTES = {
+    light: {
+        bg: '#ffffff',
+        card: '#ffffff',
+        inset: '#f5f6f7',
+        line: 'rgba(15, 17, 21, 0.10)',
+        lineStrong: 'rgba(15, 17, 21, 0.18)',
+        text: '#0f1115',
+        muted: '#61666b',
+        accent: '#4176e6',
+        accentHover: '#2f63d4',
+        accentText: '#ffffff',
+        danger: '#c2402f',
+        dangerSurface: 'rgba(194, 64, 47, 0.08)',
+        ok: '#1f7a46',
+        okSurface: 'rgba(31, 122, 70, 0.10)',
+        hoverSurface: 'rgba(15, 17, 21, 0.05)',
+    },
+    dark: {
+        bg: '#151517',
+        card: '#232324',
+        inset: '#2c2c2e',
+        line: 'rgba(249, 250, 251, 0.10)',
+        lineStrong: 'rgba(249, 250, 251, 0.18)',
+        text: '#f9fafb',
+        muted: '#cfd3d6',
+        accent: '#7aaaff',
+        accentHover: '#9dbdff',
+        accentText: '#0b0d10',
+        danger: '#ff8f87',
+        dangerSurface: 'rgba(255, 123, 114, 0.12)',
+        ok: '#8fdca8',
+        okSurface: 'rgba(143, 220, 168, 0.12)',
+        hoverSurface: 'rgba(249, 250, 251, 0.07)',
+    },
+};
+/** Custom property name for a palette entry. */
+const VARS = [
+    ['bg', '--gws-bg'],
+    ['card', '--gws-card'],
+    ['inset', '--gws-inset'],
+    ['line', '--gws-line'],
+    ['lineStrong', '--gws-line-strong'],
+    ['text', '--gws-text'],
+    ['muted', '--gws-muted'],
+    ['accent', '--gws-accent'],
+    ['accentHover', '--gws-accent-hover'],
+    ['accentText', '--gws-accent-text'],
+    ['danger', '--gws-danger'],
+    ['dangerSurface', '--gws-danger-surface'],
+    ['ok', '--gws-ok'],
+    ['okSurface', '--gws-ok-surface'],
+    ['hoverSurface', '--gws-hover'],
+];
+/** `--gws-*` declarations for one palette, without a selector. */
+export function cssVariables(theme) {
+    const palette = PALETTES[theme];
+    const decls = VARS.map(([key, name]) => `${name}:${palette[key]}`).join(';');
+    return `color-scheme:${theme};${decls}`;
+}
+/**
+ * The page-level theme block: light by default, dark when the system asks for
+ * it, and either palette forced by `data-theme` (set from `?theme=`).
+ * The forced selectors come last so they win over the media query.
+ */
+export function themeCss() {
+    return [
+        `:root{${cssVariables('light')}}`,
+        `@media (prefers-color-scheme: dark){:root{${cssVariables('dark')}}}`,
+        `:root[data-theme="dark"]{${cssVariables('dark')}}`,
+        `:root[data-theme="light"]{${cssVariables('light')}}`,
+    ].join('\n');
+}
+/** Parse `?theme=light|dark`; anything else means "follow the system". */
+export function themeFromQuery(search) {
+    if (!search)
+        return undefined;
+    const value = new URLSearchParams(search.startsWith('?') ? search : `?${search}`).get('theme');
+    return value === 'light' || value === 'dark' ? value : undefined;
+}
+/**
+ * Head script for the forced-theme case. It runs before first paint so a
+ * `?theme=dark` screenshot does not flash light first.
+ *
+ * Precedence: explicit `?theme=` query, then the harness preference read from
+ * the profile patch (`ui-theme`), then nothing — nothing means the document
+ * follows `prefers-color-scheme`, which is the system fallback.
+ * @param search - request query string.
+ * @param harnessPreference - raw `light|dark|system` value from the profile.
+ */
+export function themeBootScript(search, harnessPreference) {
+    const forced = themeFromQuery(search) ?? (harnessPreference === 'light' || harnessPreference === 'dark' ? harnessPreference : undefined);
+    if (!forced)
+        return '';
+    return `<script>document.documentElement.setAttribute('data-theme',${JSON.stringify(forced)})</script>`;
+}

package/package.json

@@ -1,17 +1,26 @@
 {
   "name": "@lvxianchao/dsh-web-guard",
-  "version": "2.1.1",
-  "description": "Password login for the DeepSeek Harness Web UI, so it can be exposed on the internet: sign in from anywhere instead of chasing one-off tokens, with reverse-proxy quirks handled.",
+  "version": "3.0.1",
+  "description": "Password login for the DeepSeek Harness Web UI, so it can be exposed on the internet: sign in from anywhere instead of chasing one-off tokens, with reverse-proxy quirks handled. Ships a native DSH settings page.",
   "type": "module",
   "main": "lib/index.js",
   "exports": {
     ".": "./lib/index.js",
+    "./client": "./lib/client.js",
     "./package.json": "./package.json",
     "./locale/*": "./locale/*"
   },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
     }
   },
   "files": [
@@ -33,6 +42,16 @@
   "bugs": {
     "url": "https://github.com/lvxianchao/dsh-web-guard/issues"
   },
+  "funding": [
+    {
+      "type": "individual",
+      "url": "https://afdian.com/a/lvxianchao"
+    },
+    {
+      "type": "individual",
+      "url": "https://ko-fi.com/lvxianchao"
+    }
+  ],
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -46,12 +65,25 @@
     "cordis"
   ],
   "engines": {
-    "node": ">=22.19"
+    "node": ">=22.19",
+    "dsh": ">=0.2.2-rc.1 <0.3.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "test": "node test/e2e.mjs"
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json",
+    "test": "node test/e2e.mjs",
+    "prepare": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "@types/react": "^19.2.2",
+    "esbuild": "^0.28.2",
+    "typescript": "^5.9.3"
+  },
+  "allowScripts": {
+    "esbuild": true
   }
 }