@lvxianchao/dsh-web-guard 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 3.0.1 — 2026-11-10
+
+### Fixed
+
+- **The proxy no longer leaks upstream sockets when a browser disconnects.** Closing a tab, reloading or dropping the link mid-response left the upstream request alive; for a response that never ends — an SSE stream, a long poll — the socket stayed allocated in the shared keep-alive agent forever. Once `maxSockets` (128) of them had accumulated, every later request through the proxy queued until the reverse proxy in front gave up with `504` — while `/__guard/session` kept answering 200, which made it look like the harness was up. The guard now destroys the upstream request when the client closes and treats the resulting error as expected instead of logging it.
+- **The launch-token exchange is bounded to 10 seconds.** An unanswered exchange used to stay `inflight` forever, stalling every request that awaited it.
+
+### Upgrade
+
+1. `dsh plugin --profile web add @lvxianchao/dsh-web-guard@3.0.1` (or reinstall from the same source you use).
+2. `sudo systemctl restart dsh-web` (or however the harness is supervised). Sessions survive the restart; open pages reconnect on their own.
+
 ## 3.0.0 — 2026-11-06
 
 ### Breaking

package/lib/index.js

@@ -235,7 +235,9 @@ export function apply(ctx, config = {}) {
         const pending = (async () => {
             try {
                 const url = ctx.connection.authenticatedUrl(`${targetOrigin}/`);
-                const res = await fetch(url, { redirect: 'manual' });
+                // Bound the exchange: an unanswered fetch would otherwise stay
+                // `inflight` forever and stall every request that awaits it.
+                const res = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(10_000) });
                 const parts = res.headers.getSetCookie();
                 const value = parts.map((line) => line.split(';')[0]).filter(Boolean).join('; ');
                 if (!value)

package/lib/proxy.js

@@ -110,7 +110,19 @@ export function forward(req, res, options) {
     const proxyReq = secure
         ? https.request(requestOptions, (proxyRes) => forwardResponse(proxyRes, res, req, started, log))
         : http.request(requestOptions, (proxyRes) => forwardResponse(proxyRes, res, req, started, log));
+    // A browser can walk away mid-response (tab closed, reload, flaky link).
+    // Without this the upstream request survives the client, and a response that
+    // never ends — an SSE stream, a long poll — keeps its socket allocated in the
+    // shared keep-alive agent forever. Once `maxSockets` of those pile up every
+    // later request queues until the proxy in front gives up (504).
+    res.on('close', () => {
+        if (!res.writableEnded)
+            proxyReq.destroy();
+    });
     proxyReq.on('error', (err) => {
+        // Destroying the upstream is the expected outcome of a client hangup.
+        if (res.destroyed || res.writableEnded)
+            return;
         log(`upstream error ${req.method} ${req.url}: ${err.message}`);
         if (!res.headersSent) {
             res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
@@ -123,10 +135,15 @@ export function forward(req, res, options) {
     req.pipe(proxyReq);
 }
 function forwardResponse(proxyRes, res, req, started, log) {
+    if (res.destroyed) {
+        proxyRes.destroy();
+        return;
+    }
     const headers = { ...proxyRes.headers };
     // Never leak the harness cookie to the browser: the guard owns it.
     delete headers['set-cookie'];
     res.writeHead(proxyRes.statusCode ?? 502, headers);
+    proxyRes.on('error', () => res.destroy());
     proxyRes.pipe(res);
     // Quiet by default: the Web UI polls constantly. Log failures and slow
     // requests only, so the journal does not fill with 200s.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvxianchao/dsh-web-guard",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Password login for the DeepSeek Harness Web UI, so it can be exposed on the internet: sign in from anywhere instead of chasing one-off tokens, with reverse-proxy quirks handled. Ships a native DSH settings page.",
   "type": "module",
   "main": "lib/index.js",