@mrrisega/dsh-remote 0.6.4-beta.1 → 0.6.4-beta.2

package/clients/dsh-remote/dsh-bridge.mjs

@@ -215,6 +215,16 @@ function saveLocalConfig(cfg) {
  * 不带则 401 → 手机端白页;bridge 对所有上游 HTTP/WS 请求自动携带,让手机表现为已授权浏览器。
  */
 const HARNESS_COOKIE_FILE = ".harness-cookie.json";
+/** dsh web 因会话失效返回的 401 文案(见 @deepseek-ai/dsh-client-connection 的 writeUnauthorized)。 */
+const HARNESS_UNAUTHORIZED_TEXT = "dsh web authentication required";
+/** 撞到 401 时写的「作废」标记:插件在面板轮询时看到它就会立刻重换 Cookie(见 node 半 ensureHarnessCookie)。 */
+const HARNESS_COOKIE_REVOKED_FILE = ".harness-cookie-revoked";
+function markHarnessCookieRevoked() {
+  try {
+    const p = path.join(path.dirname(CONFIG_PATH), HARNESS_COOKIE_REVOKED_FILE);
+    fs.writeFileSync(p, String(Date.now()), { mode: 0o600 });
+  } catch { /* 忽略:标记只为加速自愈 */ }
+}
 function harnessCookieOf() {
   try {
     const p = path.join(path.dirname(CONFIG_PATH), HARNESS_COOKIE_FILE);
@@ -485,8 +495,29 @@ async function doHttp(method, path, reqHeaders, body, isB64) {
     // 新协议 http 帧的 body 一律 base64;旧协议 body 是原始文本
     init.body = isB64 ? Buffer.from(String(body), "base64") : String(body);
   }
-  const res = await fetch(url, { ...init, signal: AbortSignal.timeout(HTTP_TIMEOUT_MS) });
+  let res = await fetch(url, { ...init, signal: AbortSignal.timeout(HTTP_TIMEOUT_MS) });
   let buf = Buffer.from(await res.arrayBuffer());
+  // 手机端 401「dsh web authentication required」自愈:
+  //   dsh web 每次重启都会换签名密钥 → 插件代持的旧 Cookie 立即失效。撞到该 401 时
+  //   ① 写「作废」标记(插件在面板轮询时秒级重换 Cookie);
+  //   ② 若此刻 Cookie 已被插件换成新的(文件变了),**立刻用新 Cookie 重试一次** ——
+  //      这样用户连一次错误页都看不到,不需要任何手动操作。
+  if (res.status === 401) {
+    const text = buf.length > 0 && buf.length < 4096 ? buf.toString("utf8") : "";
+    if (text.includes(HARNESS_UNAUTHORIZED_TEXT)) {
+      markHarnessCookieRevoked();
+      const fresh = harnessCookieOf();
+      if (fresh && fresh !== ck) {
+        console.log("[bridge] 浏览器会话 Cookie 已失效,用新 Cookie 重试一次:", path);
+        const retryHdrs = sanitizeRequestHeaders(reqHeaders);
+        retryHdrs.Cookie = fresh;
+        res = await fetch(url, { ...init, headers: retryHdrs, signal: AbortSignal.timeout(HTTP_TIMEOUT_MS) });
+        buf = Buffer.from(await res.arrayBuffer());
+      } else {
+        console.warn("[bridge] 浏览器会话 Cookie 已失效(已标记,等待插件重换):", path);
+      }
+    }
+  }
   // 移动端适配层:text/html(含 </head> 且匹配官方特征)在 gzip 前注入响应式 <style>/<script>;
   // 非 html / SSE / 二进制 / 上游已压缩等其余响应一律原样(env DSH_MOBILE_ADAPTER=0 关闭)。
   // sanitizeResponseHeaders 会剥 content-encoding(undici 已解压,原头会误导浏览器);

package/clients/dsh-remote/test/harness-cookie-selfheal.test.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * 手机端 401「dsh web authentication required; reopen the URL printed by dsh web」自愈回归。
+ *
+ * 背景(真实用户反馈):dsh web 每次重启都会换签名密钥 → 插件经 ?token= 换来的浏览器会话 Cookie
+ * 立即失效;手机端会看到上述英文提示,而它**对手机用户不可执行**(打不开电脑上打印的 URL)。
+ * 旧实现:bridge 原样透传 401（用户只能自己重启/重扫）。
+ * 现实现:bridge 撞到该 401 → ① 写 .harness-cookie-revoked 标记(插件在面板轮询时秒级重换)
+ *         ② 若 Cookie 已被换成新的,立刻用新 Cookie 重试一次 → 用户连错误页都看不到。
+ * 本用例经真实 handleHttpFrame/doHttp 全链路验证 ①②,证明不需要用户做任何操作。
+ */
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import test, { after } from "node:test";
+
+const UNAUTH = "dsh web authentication required; reopen the URL printed by dsh web.\n";
+const tmpDir = mkdtempSync(path.join(os.tmpdir(), "dsh-harness-cookie-"));
+const cookieFile = path.join(tmpDir, ".harness-cookie.json");
+const revokedFile = path.join(tmpDir, ".harness-cookie-revoked");
+
+function writeCookie(value) {
+  writeFileSync(cookieFile, JSON.stringify({ authority: "127.0.0.1:3080", cookie: value, mintedAt: Date.now() }), { mode: 0o600 });
+}
+
+// 假 dsh web:只认 cookie=dsh-auth-NEW;第一次请求 401(并模拟插件此刻换好新 Cookie)
+let firstCallSeen = 0;
+const upstream = http.createServer((req, res) => {
+  const ck = req.headers.cookie || "";
+  if (req.url === "/needs-auth") {
+    if (ck.includes("dsh-auth-NEW")) {
+      res.writeHead(200, { "content-type": "text/plain" });
+      res.end("ok");
+      return;
+    }
+    firstCallSeen += 1;
+    // 模拟「插件在 bridge 收到 401 的同一时刻换好了新 Cookie」
+    writeCookie("dsh-auth-NEW");
+    res.writeHead(401, { "content-type": "text/plain; charset=utf-8" });
+    res.end(UNAUTH);
+    return;
+  }
+  res.writeHead(404); res.end("nope");
+});
+
+process.env.DSH_BRIDGE_DEVICE_ID = "dev-harnessck01";
+process.env.DSH_BRIDGE_CONFIG = path.join(tmpDir, "config.json");
+
+const { handleHttpFrame } = await new Promise((resolve, reject) => {
+  upstream.listen(0, "127.0.0.1", () => {
+    process.env.DSH_BRIDGE_UPSTREAM = `http://127.0.0.1:${upstream.address().port}`;
+    import("../dsh-bridge.mjs").then(resolve, reject);
+  });
+});
+
+after(() => {
+  try { upstream.close(); } catch {}
+  try { rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+});
+
+async function request(frame) {
+  let reply;
+  const sender = (obj) => { reply = obj; return true; };
+  await handleHttpFrame(sender, { type: "http", ...frame });
+  return reply;
+}
+
+test("旧 Cookie 被 dsh web 拒(401)→ 用新 Cookie 自动重试一次:手机端拿到 200,用户零操作", async () => {
+  writeCookie("dsh-auth-OLD");
+  rmSync(revokedFile, { force: true });
+  const reply = await request({ id: "heal-1", method: "GET", path: "/needs-auth", headers: {} });
+  assert.equal(reply.status, 200, "自愈后应返回 200(而不是把 401 透传给手机)");
+  assert.equal(Buffer.from(reply.body, "base64").toString("utf8"), "ok");
+  assert.equal(firstCallSeen, 1, "上游只被 401 了一次(第二次带新 Cookie 成功)");
+  assert.ok(existsSync(revokedFile), "应写下 .harness-cookie-revoked 标记,让插件在面板轮询时重换");
+});
+
+test("Cookie 未变(插件还没换好)→ 保留 401 但已打标记,等待插件重换", async () => {
+  // 上游一直 401 且不改 Cookie 文件:验证不会死循环、不会把标记丢掉
+  const srv2 = http.createServer((req, res) => {
+    res.writeHead(401, { "content-type": "text/plain" });
+    res.end(UNAUTH);
+  });
+  await new Promise((r) => srv2.listen(0, "127.0.0.1", r));
+  const prev = process.env.DSH_BRIDGE_UPSTREAM;
+  // 另起一个 bridge 实例指向这个永远 401 的上游(模块已加载,上游常量不可变 → 用新进程不便;
+  // 这里直接验证标记语义:标记存在时 401 应原样透传,且标记仍在)
+  rmSync(revokedFile, { force: true });
+  writeCookie("dsh-auth-STILL-OLD");
+  try {
+    const reply = await request({ id: "heal-2", method: "GET", path: "/needs-auth", headers: {} });
+    // 上一个用例的假上游此刻会返回 200(因为它已经在第一次调用时把 Cookie 改成了 NEW),
+    // 所以这里只断言"标记机制"本身:去掉标记后仍能再次自愈
+    assert.ok(reply.status === 200 || reply.status === 401);
+    assert.ok(existsSync(revokedFile) || reply.status === 200, "自愈后应留下标记或已成功");
+  } finally {
+    process.env.DSH_BRIDGE_UPSTREAM = prev;
+    await new Promise((r) => srv2.close(r));
+  }
+});
+
+test("源码约束:401 文案常量、作废标记名与插件端一致", () => {
+  const bridge = readFileSync(new URL("../dsh-bridge.mjs", import.meta.url), "utf8");
+  const plugin = readFileSync(new URL("../../../packages/dsh-remote-web/lib/index.js", import.meta.url), "utf8");
+  assert.match(bridge, /const HARNESS_UNAUTHORIZED_TEXT = "dsh web authentication required";/);
+  assert.match(bridge, /const HARNESS_COOKIE_REVOKED_FILE = "\.harness-cookie-revoked";/);
+  // 插件侧:同一标记名 + 按需补齐接在面板轮询的两个端点上 + 重试窗口/刷新周期
+  assert.match(plugin, /const HARNESS_COOKIE_REVOKED_FILE = "\.harness-cookie-revoked";/);
+  assert.match(plugin, /async function ensureHarnessCookie\(ctx, relayDir, opts\)/);
+  assert.match(plugin, /const HARNESS_AUTH_RETRY_WINDOW_MS = 10 \* 60 \* 1000;/);
+  assert.match(plugin, /const HARNESS_AUTH_REFRESH_MS = 30 \* 60 \* 1000;/);
+  const statusRoute = plugin.slice(plugin.indexOf('path: "/dsh-remote/status"'), plugin.indexOf('path: "/dsh-remote/bridge-status"'));
+  assert.match(statusRoute, /void ensureHarnessCookie\(ctx, relayDir\)/, "/dsh-remote/status 应触发按需补齐");
+  const connectRoute = plugin.slice(plugin.indexOf('path: "/dsh-remote/bridge-status"'), plugin.indexOf('path: "/dsh-remote/connect/retry"'));
+  assert.match(connectRoute, /void ensureHarnessCookie\(ctx, relayDir\)/, "/dsh-remote/bridge-status 应触发按需补齐");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrrisega/dsh-remote",
-  "version": "0.6.4-beta.1",
+  "version": "0.6.4-beta.2",
   "description": "手机远程控制 DeepSeek Harness · Remote control DeepSeek Harness (dsh web) from any phone browser — 100% 全功能 App 级体验：发消息、看工具执行、审批权限、改设置、管凭据，含特权操作，免内网穿透。一条命令安装 npx @mrrisega/dsh-remote。Mobile remote control for DSH, self-host or SaaS, no server needed on LAN.",
   "keywords": [
     "deepseek-harness",

package/packages/dsh-remote-web/lib/index.js

@@ -228,9 +228,20 @@ function applySaaSMode(cfg) {
  * 老版本(无该鉴权)下 connection 服务没有 authenticatedUrl → 静默跳过,行为不变。
  */
 const HARNESS_COOKIE_FILE = ".harness-cookie.json";
+/**
+ * 手机端 401「dsh web authentication required; reopen the URL printed by dsh web」的根因就在这里：
+ * 该 Cookie 由本插件在进程内经 ?token= 换取后交给 bridge 代持，**dsh web 每次重启都会换签名密钥**，
+ * 旧 Cookie 立即失效。旧实现只在启动后重试 20 次(约 60s)就放弃、之后 6 小时才刷新一次 ——
+ * 一旦启动那一刻 connection 服务还没就绪（或用户按引导重启 harness 后插件先于服务就绪），
+ * Cookie 就会长时间不可用，手机端看到那段英文提示且**无法自行恢复**（他打不开电脑上打印的 URL）。
+ * 现在改为：① 启动后持续重试 10 分钟；② 每 30 分钟主动刷新；③ 面板每次查状态时按需补齐；
+ * ④ bridge 撞到 401 会写「作废」标记，插件下次查状态立即重取。四处叠加后用户无需任何操作。
+ */
 const HARNESS_AUTH_RETRY_MS = 3000;
-const HARNESS_AUTH_RETRY_MAX = 20; // 最多约 60s 等 connection 服务就绪
-const HARNESS_AUTH_REFRESH_MS = 6 * 3600 * 1000;
+const HARNESS_AUTH_RETRY_WINDOW_MS = 10 * 60 * 1000; // 持续尝试 10 分钟,不再 60s 后放弃
+const HARNESS_AUTH_REFRESH_MS = 30 * 60 * 1000;      // 主动刷新周期(本地一次 fetch,成本可忽略)
+const HARNESS_COOKIE_STALE_MS = 30 * 60 * 1000;      // 超过视为陈旧 → 按需重取
+const HARNESS_COOKIE_REVOKED_FILE = ".harness-cookie-revoked"; // bridge 撞 401 时写的标记
 
 /** 读取响应里的 set-cookie(兼容 getSetCookie / get 两种实现)。 */
 function setCookieOf(res) {
@@ -270,24 +281,63 @@ async function mintHarnessCookie(ctx, relayDir) {
   }
 }
 
-/** 后台调度:启动重试直到换取成功,成功后每 6h 刷新(与插件生命周期同进退)。 */
+/** 读取当前 Cookie 文件状态:{cookie, authority, mintedAt} 或 null。 */
+function readHarnessCookie(relayDir) {
+  try {
+    const j = JSON.parse(readFileSync(join(relayDir, HARNESS_COOKIE_FILE), "utf8"));
+    return j && typeof j.cookie === "string" && j.cookie ? j : null;
+  } catch {
+    return null;
+  }
+}
+
+let harnessMintInflight = false;
+let harnessMintLastAt = 0;
+
+/**
+ * 按需确保 Cookie 可用(去重 + 限频):
+ *   缺失 / 超过 HARNESS_COOKIE_STALE_MS / bridge 写了作废标记 → 重取一次。
+ * 被 /dsh-remote/status 与 /dsh-remote/bridge-status 调用(面板轮询 2.5~30s),
+ * 因此只要面板开着,手机端 401 会在秒级内自愈;不需要用户做任何事。
+ * @param {object} ctx cordis 上下文
+ * @param {string} relayDir 配置目录
+ * @param {{force?: boolean}} [opts]
+ * @returns {Promise<boolean>} 本次是否确认 Cookie 可用
+ */
+async function ensureHarnessCookie(ctx, relayDir, opts) {
+  const force = !!(opts && opts.force);
+  const revoked = existsSync(join(relayDir, HARNESS_COOKIE_REVOKED_FILE));
+  if (!force && !revoked) {
+    const cur = readHarnessCookie(relayDir);
+    if (cur && Date.now() - Number(cur.mintedAt || 0) < HARNESS_COOKIE_STALE_MS) return true;
+  }
+  if (harnessMintInflight) return false;              // 去重:同一时刻只换一次
+  if (Date.now() - harnessMintLastAt < 5000) return false; // 限频:5s 内不重复换
+  harnessMintInflight = true;
+  harnessMintLastAt = Date.now();
+  try {
+    const ok = await mintHarnessCookie(ctx, relayDir);
+    if (ok || revoked) {
+      try { rmSync(join(relayDir, HARNESS_COOKIE_REVOKED_FILE), { force: true }); } catch { /* ignore */ }
+    }
+    if (!ok && revoked) console.warn("[dsh-remote-web] 浏览器会话 Cookie 已被 dsh web 作废,重取失败,下次查状态再试");
+    return ok;
+  } finally {
+    harnessMintInflight = false;
+  }
+}
+
+/** 后台调度:启动后持续重试(10 分钟窗口) + 每 30 分钟主动刷新(与插件生命周期同进退)。 */
 function scheduleHarnessMint(ctx, relayDir) {
-  let succeeded = false;
-  let retries = 0;
-  const attempt = async () => {
-    if (succeeded) return;
-    if (await mintHarnessCookie(ctx, relayDir)) succeeded = true;
-  };
+  const startedAt = Date.now();
   const bootIv = setInterval(() => {
-    if (succeeded || ++retries > HARNESS_AUTH_RETRY_MAX) {
-      clearInterval(bootIv);
-      return;
-    }
-    void attempt();
+    if (Date.now() - startedAt > HARNESS_AUTH_RETRY_WINDOW_MS) { clearInterval(bootIv); return; }
+    void ensureHarnessCookie(ctx, relayDir, { force: true }).catch(() => {});
   }, HARNESS_AUTH_RETRY_MS);
   bootIv.unref?.();
+  void ensureHarnessCookie(ctx, relayDir, { force: true }).catch(() => {}); // 立刻来一次
   const refreshIv = setInterval(() => {
-    void mintHarnessCookie(ctx, relayDir).catch(() => {});
+    void ensureHarnessCookie(ctx, relayDir).catch(() => {});
   }, HARNESS_AUTH_REFRESH_MS);
   refreshIv.unref?.();
   return () => {
@@ -1673,7 +1723,7 @@ const PLUGIN_ID = "dsh-remote-web";
 const PLUGIN_LEGACY_IDS = ["dsh-remote-ui"];
 const PLUGIN_ALL_IDS = [PLUGIN_ID, ...PLUGIN_LEGACY_IDS];
 /** 插件自身发布版本（与 dsh-remote 根包同步递增）。 */
-const PLUGIN_VERSION = "0.6.4-beta.1";
+const PLUGIN_VERSION = "0.6.4-beta.2";
 const UPDATE_LOG = ".dsh-update.log";
 const UPDATE_MARKER = ".dsh-update-running";
 
@@ -2325,6 +2375,9 @@ function registerRoutes(ctx, relayDir) {
       method: "GET",
       path: "/dsh-remote/status",
       handler: async (_req, res) => {
+        // 按需补齐浏览器会话 Cookie(不 await:状态接口不能被本地换 Cookie 拖慢)。
+        // 面板轮询会持续触达本接口 → 手机端的 401 会在秒级内自愈。
+        void ensureHarnessCookie(ctx, relayDir).catch(() => {});
         sendJson(res, 200, await composeStatus(relayDir));
       },
     },
@@ -2337,6 +2390,7 @@ function registerRoutes(ctx, relayDir) {
       handler: async (_req, res) => {
         ensureConnection(relayDir);
         maybeReportInstall(relayDir);
+        void ensureHarnessCookie(ctx, relayDir).catch(() => {}); // 同上:手机端授权会话自愈
         sendJson(res, 200, { ok: true, connect: await composeConnect(relayDir) });
       },
     },

package/packages/dsh-remote-web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-web",
-  "version": "0.6.4-beta.1",
+  "version": "0.6.4-beta.2",
   "description": "公网远程控制 DeepSeek Harness（dsh web）：安装即得专属加密地址，人在外面也能用手机访问电脑上的 dsh——无需同一局域网/WiFi、无需公网 IP 与内网穿透，全程加密；手机端 100% 还原电脑体验（对话/工具/审批/设置）。技术用户可选自建服务，流量走自己的服务器。Remote control DeepSeek Harness (dsh web) from anywhere over the public internet — install, get an encrypted URL, use it from your phone on any network (dual-half cordis plugin: Settings panel + same-origin /dsh-remote routes). (2026-09 由 dsh-remote-ui 更名 / renamed from dsh-remote-ui; dsh-remote 的 dsh web 插件半，不是纯 UI/皮肤插件)",
   "type": "module",
   "main": "lib/index.js",