@skillpie/dsh-remote 0.0.0-stage → 1.1.0

package/README.md

@@ -1,3 +1,96 @@
-# Temporary Holding Version
+# dsh-remote
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DeepSeek Harness(DSH)插件:像 ZCodeOnline 远程协助一样,用 **8 位远程码** 在浏览器里访问任意一台装有本插件的 DSH 宿主机 —— 打开 `https://dsh.skillpie.cn/12345678/` 即得到**该宿主机完整的真实 Web GUI**(会话、工具渲染、交付物、终端、设置无一裁剪),而不是另做一套简化前端。
+
+纯插件形态:只装在 profile 里,**不改任何 DSH 源码**,官方 DSH 升级后直接可用。
+
+## 工作模型
+
+```
+宿主机(你自己的 DSH + dsh-remote)              中转站(dsh.skillpie.cn 的 DSH + relay.enabled)
+  │ 出站 wss /dsh-remote/host ──────────────▶ /<code>/ 与 /<code>/api/remote.mux 随注册挂载
+  │  (无需公网 IP/端口)                        │
+  └──────── 字节级桥接 ◀─────────────────────┴── 访客浏览器 https://dsh.skillpie.cn/12345678/
+```
+
+- **GUI 透传(`mode: 'gui'`,默认)**:中转面把 `/<code>/…` 的 HTTP 请求剥掉前缀后经控制通道转发给宿主机;宿主机侧的 GUI 桥用进程内 launch token 自动铸造 owner 会话 cookie,对自己的 loopback web 服务完成请求;响应(含流式内容)原样回传。GUI 唯一的多路 WebSocket `/api/remote.mux` 按帧拼接(JSON 文本帧与二进制帧双向透传)。
+- **身份与会话**:远程码/宿主 ID/token 持久化在凭据记录 `dsh-remote/identity`(重启不漂移);token 只在中转站存哈希,重连凭 token 顶替旧路由,fail-closed 自愈。
+- **多宿主机隔离**:同一中转域名下,每台宿主机挂在自己的 `/<code>/` 前缀;owner cookie 由宿主机侧持有并逐请求注入,**不落到访客浏览器**,访客之间也互不可见。
+- **入口**：GUI 左侧栏底部（账号区上方）的「远程控制」按钮，点击弹窗进入属主面板；侧栏菜单不再有独立入口。侧栏收起时按钮自动变为纯图标。
+- **`mode: 'console'`(可选)**:轻量只读/控制页(会话列表、消息流、发送/中断),供想要最小暴露面或低带宽的场景使用。
+- **直连模式(`direct: true`,默认开)**:同一套桥接同时挂在本机 web 服务上,`http://<host>:<port>/<code>/` 可用——局域网使用与本地联调都走它。
+
+## 安装
+
+本机(宿主面,默认即可,装完重启 GUI):
+
+```text
+在 DSH 的插件管理器安装本目录即可,无需配置。
+```
+
+服务器(dsh.skillpie.cn 等,官方 npm 形态 DSH):安装同一包,并在该 profile 补丁层覆盖:
+
+```yaml
+- id: dsh-remote
+  name: dsh-remote
+  config:
+    enabled: false          # 服务器自身不必外连别的中转站
+    direct: false
+    relay:
+      enabled: true
+      mode: gui             # 默认值;console 为轻量页
+      maxVisitorsPerHost: 16
+```
+
+中转面复用 DSH 自带的 web 服务(nginx 只需透传 Host 与 WebSocket 升级),根路径 `/<code>/` 就绪,无需额外部署单元。
+
+## 配置
+
+| 键 | 默认 | 说明 |
+| --- | --- | --- |
+| `mode` | `gui` | 访客体验:`gui` 真实 GUI 透传 / `console` 轻量页 |
+| `enabled` | `true` | 宿主面总开关(外连中转站) |
+| `relayUrl` | `wss://dsh.skillpie.cn` | 中转站 origin |
+| `allowControl` | `true` | 仅 console 模式:`false` 为只读;gui 模式下见下方安全说明 |
+| `direct` | `true` | 本机 web 服务挂 `/<code>/` 直连路由 |
+| `code` | 自动生成 | 8 位远程码(1-9 开头),可手动指定 |
+| `hostId` / `token` | 自动 | 运行身份,自动持久化,勿手改 |
+| `name` | 主机名 | 设备名(属主面板/中转面显示) |
+| `relay.enabled` | `false` | **服务器侧**启用中转面 |
+| `relay.mode` | `gui` | 中转面给访客的体验(同上) |
+| `relay.maxVisitorsPerHost` | `8` | 单宿主机并发访客/拼接上限 |
+
+## 地址栏隐私（远程码不落 URL）
+
+打开 `https://dsh.skillpie.cn/12345678/` 后,页面脚本会把远程码存入浏览器(localStorage + sessionStorage)、立刻用 `history.replaceState` 把地址栏改写为 `https://dsh.skillpie.cn/`,并把 `<base>` 钉到隧道前缀保证资源继续加载。同时注册一个 origin 级 Service Worker(`/dsh-remote-sw.js`):之后直接访问裸域名也会自动恢复到对应宿主机的隧道,**全程不需要把码拼回 URL**。
+
+- 转发/收藏裸域名即可再次进入(同一浏览器);`?gui` 参数可跳过恢复(例如访客想看中转站自己的 GUI 或排除故障)。
+- 携带中转站属主会话 cookie(`dsh-auth-*`)的浏览器不受 SW 影响,裸域名始终是中转站自己的 GUI。
+- 宿主机离线时,SW 回源得到的是离线占位页,不会渲染任何宿主内容。
+- 清除站点数据(或换浏览器)后裸域名不再自动恢复,需要原始带码链接重新进入。
+- 码以明文存在访客浏览器 localStorage 中——这是为「无需重复输入」做的权衡;公用电脑请勿勾选记住,或用后清除站点数据。
+
+## 访客文件下载
+
+远程访问时,文件预览页的打开方式菜单(LibreOffice/WorkBuddy/… 那个)会在**最前面**多出一项「下载文件」:点击后把宿主机磁盘上的该文件经隧道流回访客浏览器,由浏览器弹出保存框存到本地——GUI 本身的菜单只能把路径交给宿主机桌面,远程访客原本无从取回生成的文件(xlsx/pdf/任意类型均可)。
+
+- 路径来自预览页头的完整路径显示;页面找不到路径时,退用最近一次通过 mux 请求过的文件路径;都拿不到会提示「无法定位文件」。
+- 下载路由 `/dsh-remote-file` 挂在宿主机自己的 web 服务上,仅接受 GET/HEAD,经隧道访问时由宿主会话 cookie 保护;另外校验一个由宿主 hostId 派生的密钥(`x-dsh-remote-key`,自动注入),防止本机回环的其他进程任意读文件。只允许下载普通文件,单文件上限 512MB。
+- 仅访客态注入该菜单项,宿主机本地 GUI 不受影响。
+
+## 安全（重要）
+
+- **gui 模式下访客拥有与属主等价的完整 GUI 权限**(可见所有会话、可操作界面、含设置页)。远程码就是分享授权:**只把链接给你信任的人**;不再需要时用属主面板「重新生成远程码」立即作废旧链接(浏览器缓存的旧码会失效,SW 恢复到离线占位页)。
+- 远程码/宿主 token:token 只存哈希;owner 会话 cookie 只在宿主机进程内持有并逐请求注入,不进入访客浏览器。
+- 每台宿主机限制并发访客;请求体、帧大小、空闲时间均有上限;帧处理器带异常边界,任何桥接错误只断开对应连接,不会影响宿主进程。
+- 局限:gui 模式是多宿主共享入口,属主面板的「在线访客」仅统计拼接连接;首次加载资源走隧道一次(之后浏览器缓存生效)。Service Worker 需要安全上下文(https 或 localhost),LAN 明文 http 下仅地址栏摘除生效,无自动恢复。
+
+## 验证（本仓库）
+
+- `node test/smoke.mjs` — 轻量控制台模式(注册/欢迎/历史/发送/中断/白名单/双通道扇出)
+- `node test/gui-smoke.mjs` — GUI 透传模式(302 挂载、cookie 仅宿主侧、POST 透传、资源代理、WS 拼接多帧 echo、离线页)
+- `node test/live-check.mjs [origin] [code]` — 对真实宿主进程的只读冒烟(welcome/会话列表/observe)
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# dsh-remote bundle patch.
+#
+# One dual-role row: the same apply() wires the host role (outbound relay
+# client, visitor command engine, owner panel API, optional local direct
+# routes) and, when config.relay.enabled is true, the relay role (registry,
+# /<code> console routes, host control-channel upgrade) for a server-side
+# deployment such as dsh.skillpie.cn.
+- insert:
+    - id: dsh-remote
+      name: "@skillpie/dsh-remote"
+      config: {}

package/icon.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
+  <!-- dsh-remote: one host radiating an encrypted link to a visitor dot -->
+  <rect x="4" y="4" width="56" height="56" rx="14" fill="currentColor" opacity="0.12"/>
+  <circle cx="22" cy="42" r="7" fill="currentColor"/>
+  <path d="M32 32a14.5 14.5 0 0 1 10 4.2" stroke="currentColor" stroke-width="4" stroke-linecap="round" opacity="0.55"/>
+  <path d="M37 24a24 24 0 0 1 12.5 6.5" stroke="currentColor" stroke-width="4" stroke-linecap="round" opacity="0.35"/>
+  <circle cx="46" cy="24" r="5.5" fill="currentColor" opacity="0.85"/>
+  <g fill="currentColor" opacity="0.6">
+    <rect x="12" y="12" width="5" height="5" rx="1.5"/>
+    <rect x="20" y="12" width="5" height="5" rx="1.5"/>
+    <rect x="28" y="12" width="5" height="5" rx="1.5"/>
+    <rect x="36" y="12" width="5" height="5" rx="1.5"/>
+  </g>
+</svg>

package/lib/bridge.js

@@ -0,0 +1,377 @@
+/**
+ * dsh-remote — host-side GUI bridge (`gui` mode).
+ *
+ * Serves the relay's splice frames from this process's own web server over
+ * loopback, so a visitor at `https://<relay>/<code>/…` uses the real DSH Web
+ * GUI — sessions, tools, deliverables, the mux WebSocket — exactly as the
+ * owner does locally.
+ *
+ * Authentication: the bridge mints one owner session cookie from the process
+ * launch token (`connection.authenticatedUrl`) and attaches it to every
+ * loopback request; a 401 forces one re-mint. Request headers that would
+ * otherwise break the loopback trust fence (`origin`, `referer`, `sec-*`,
+ * `host`, hop-by-hop) are stripped, leaving a plain owner request.
+ */
+import WebSocket from 'ws'
+import { encodeBin, decodeBin } from './protocol.js'
+
+const MAX_REQUEST_BODY = 64 * 1024 * 1024
+const READ_TIMEOUT_MS = 30_000
+const STRIP_HEADERS = new Set([
+  'host', 'origin', 'referer', 'referrer', 'connection', 'keep-alive',
+  'transfer-encoding', 'upgrade', 'accept-encoding', 'content-length',
+  'sec-websocket-key', 'sec-websocket-version', 'sec-websocket-extensions',
+  'sec-websocket-accept', 'sec-websocket-protocol',
+])
+
+/** ws message data (string | Buffer | Buffer[] | ArrayBuffer) → Buffer. */
+function toBuffer(data) {
+  if (Buffer.isBuffer(data)) return data
+  if (Array.isArray(data)) return Buffer.concat(data)
+  if (data instanceof ArrayBuffer) return Buffer.from(new Uint8Array(data))
+  return Buffer.from(String(data), 'utf8')
+}
+
+/** Case-insensitive header bag → plain object without stripped names. */
+function sanitizeHeaders(headers = {}) {
+  const out = {}
+  for (const [name, value] of Object.entries(headers)) {
+    const lower = name.toLowerCase()
+    if (STRIP_HEADERS.has(lower) || lower.startsWith('sec-')) continue
+    out[lower] = Array.isArray(value) ? value.join(', ') : String(value)
+  }
+  return out
+}
+
+export class GuiBridge {
+  /**
+   * @param services { webServer(): object|undefined, connection(): object|undefined }
+   * @param log fn(kind, text)
+   */
+  constructor({ services, log = () => {} }) {
+    this.services = services
+    this.log = log
+    /** channel → { channel, offMessage, offClose } */
+    this.channels = new Map()
+    this.cookieHeader = undefined
+    this.httpHandlers = new Map()
+    this.wsPipes = new Map()
+    this.seq = 0
+    this.closed = false
+  }
+
+  attach(channel) {
+    this.detach(channel)
+    const record = { channel, offMessage: undefined, offClose: undefined }
+    this.channels.set(channel, record)
+    record.offMessage = channel.onMessage((text) => {
+      try {
+        this.onFrame(text, channel)
+      } catch (error) {
+        this.log('bridge', `帧处理异常（已隔离）: ${error?.message ?? error}`)
+      }
+    })
+    record.offClose = channel.onClose(() => this.detach(channel))
+    this.log('bridge', 'GUI 桥已挂载')
+  }
+
+  /** Remove one transport; undefined removes all (plugin unload). */
+  detach(channel) {
+    const targets = channel === undefined ? [...this.channels.keys()] : [channel]
+    for (const target of targets) {
+      const record = this.channels.get(target)
+      if (!record) continue
+      this.channels.delete(target)
+      record.offMessage?.()
+      record.offClose?.()
+    }
+    if (channel === undefined) {
+      for (const handler of this.httpHandlers.values()) handler.abort?.()
+      this.httpHandlers.clear()
+      for (const pipe of this.wsPipes.values()) {
+        try { pipe.inner.close() } catch { pipe.inner.terminate() }
+      }
+      this.wsPipes.clear()
+    }
+  }
+
+  send(frame) {
+    for (const record of this.channels.values()) record.channel.send(frame)
+  }
+
+  origin() {
+    const webServer = this.services.webServer?.()
+    if (!webServer) return undefined
+    try { return webServer.getOrigin() } catch { return undefined }
+  }
+
+  onFrame(data, channel) {
+    if (this.closed) return
+    if (typeof data !== 'string') {
+      const decoded = decodeBin(Buffer.isBuffer(data) ? data : Buffer.from(data))
+      if (!decoded) return
+      const { meta, payload } = decoded
+      if (meta.t === 'hchunk') this.onRequestChunk(meta.id, payload, channel)
+      else if (meta.t === 'wdata') this.onWsData(meta.id, payload, channel)
+      return
+    }
+    let frame
+    try { frame = JSON.parse(data) } catch { return }
+    if (!frame || typeof frame !== 'object') return
+    switch (frame.t) {
+      case 'hreq': this.onHttpRequest(frame, channel); return
+      case 'hend': this.onRequestEnd(frame.id); return
+      case 'habort': this.onRequestAbort(frame.id); return
+      case 'wopen': this.onWsOpen(frame, channel); return
+      case 'wclose': this.onWsClose(frame); return
+      case 'wdata-text': this.onWsText(frame, channel); return
+      case 'hb': return
+      default: return
+    }
+  }
+
+  /** Mux wire frames are JSON text: forward them as socket text frames. */
+  onWsText(frame, channel) {
+    if (typeof frame.id !== 'string' || typeof frame.text !== 'string') return
+    const pipe = this.wsPipes.get(frame.id)
+    if (!pipe) return
+    if (pipe.inner.readyState === 1) {
+      pipe.inner.send(frame.text)
+      return
+    }
+    if (pipe.inner.readyState === 0) {
+      pipe.backlogBytes += frame.text.length
+      if (pipe.backlogBytes <= 8 * 1024 * 1024) {
+        pipe.backlog.push(frame.text)
+        return
+      }
+    }
+    channel.send({ t: 'wclose', id: frame.id, code: 1011, reason: 'inner not open' })
+    pipe.closed = true
+    this.wsPipes.delete(frame.id)
+    try { pipe.inner.terminate() } catch { /* gone */ }
+  }
+
+  onRequestAbort(id) {
+    const entry = this.httpHandlers.get(id)
+    if (!entry) return
+    entry.markEnded()
+    entry.abort?.()
+    this.httpHandlers.delete(id)
+  }
+
+  async ensureSession(force = false) {
+    if (!force && this.cookieHeader) return this.cookieHeader
+    const connection = this.services.connection?.()
+    const origin = this.origin()
+    if (!connection || !origin) throw new Error('connection 服务不可用')
+    const url = connection.authenticatedUrl(origin + '/')
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), READ_TIMEOUT_MS * 1000)
+    try {
+      const res = await fetch(url, { redirect: 'manual', signal: controller.signal })
+      const cookies = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+      const pairs = cookies.map((line) => line.split(';')[0]).filter((pair) => pair.includes('='))
+      if (pairs.length === 0) throw new Error('宿主机未签发会话 cookie')
+      this.cookieHeader = pairs.join('; ')
+      this.log('bridge', '已铸造访客会话 cookie')
+      return this.cookieHeader
+    } finally {
+      clearTimeout(timer)
+    }
+  }
+
+  async onHttpRequest(frame, channel) {
+    const { id, m, p } = frame
+    if (typeof id !== 'string' || typeof m !== 'string' || typeof p !== 'string') return
+    const entry = { chunks: [], size: 0, ended: false, abort: undefined }
+    // wss 路径上 hchunk/hend 是 hreq 之后的独立帧；fetch 必须等 body 到齐
+    // （pipe 同步送达时侥幸掩盖过这个时序问题）。
+    entry.markEnded = () => {
+      entry.ended = true
+      try { entry.readyResolve?.() } catch { /* noop */ }
+    }
+    entry.ready = new Promise((resolve) => { entry.readyResolve = resolve })
+    entry.channel = channel
+    this.httpHandlers.set(id, entry)
+    try {
+      const origin = this.origin()
+      if (!origin) throw new Error('webServer 服务不可用')
+      let cookie = await this.ensureSession()
+      // body 就绪后再发 fetch：hend 之前 entry.chunks 可能还是空的。
+      await Promise.race([
+        entry.ready,
+        new Promise((resolve) => setTimeout(resolve, 30_000)),
+      ])
+      let status
+      let res
+      for (let attempt = 0; attempt < 2; attempt++) {
+        const headers = { ...sanitizeHeaders(frame.h), cookie }
+        if (entry.size > 0) headers['content-length'] = String(entry.size)
+        const controller = new AbortController()
+        entry.abort = () => controller.abort()
+        const timer = setTimeout(() => controller.abort(), 120_000)
+        try {
+          res = await fetch(origin + p, {
+            method: m,
+            headers,
+            body: m === 'GET' || m === 'HEAD' ? undefined : Buffer.concat(entry.chunks),
+            signal: controller.signal,
+            duplex: 'half',
+          })
+        } finally {
+          clearTimeout(timer)
+        }
+        status = res.status
+        if (status !== 401) break
+        // Session expired or invalid: mint a fresh one and retry once.
+        cookie = await this.ensureSession(true)
+      }
+      const outHeaders = {}
+      res.headers.forEach((value, name) => {
+        const lower = name.toLowerCase()
+        if (lower === 'set-cookie' || lower === 'transfer-encoding' || lower === 'connection' || lower === 'content-encoding') return
+        outHeaders[lower] = value
+      })
+      const setCookies = typeof res.headers.getSetCookie === 'function' ? res.headers.getSetCookie() : []
+      channel.send({ t: 'hres', id, s: res.status, h: outHeaders, sc: setCookies })
+      if (res.body) {
+        for await (const chunk of res.body) {
+          if (this.closed || !this.httpHandlers.has(id)) return
+          channel.sendRaw(encodeBin({ t: 'hchunk', id }, Buffer.from(chunk)))
+        }
+      }
+      channel.send({ t: 'hend', id })
+    } catch (error) {
+      channel.send({ t: 'hfail', id, error: error?.message ?? String(error) })
+    } finally {
+      this.httpHandlers.delete(id)
+    }
+  }
+
+  onRequestChunk(id, payload) {
+    const entry = this.httpHandlers.get(id)
+    if (!entry || entry.ended) return
+    entry.size += payload.length
+    if (entry.size > MAX_REQUEST_BODY) {
+      entry.markEnded()
+      entry.channel?.send({ t: 'hfail', id, error: 'request body too large' })
+      return
+    }
+    entry.chunks.push(payload)
+  }
+
+  onRequestEnd(id) {
+    const entry = this.httpHandlers.get(id)
+    if (entry) entry.markEnded()
+  }
+
+  async onWsOpen(frame, channel) {
+    const { id, p } = frame
+    if (typeof id !== 'string' || typeof p !== 'string') return
+    const origin = this.origin()
+    if (!origin) {
+      channel.send({ t: 'wfail', id, error: 'webServer 服务不可用' })
+      return
+    }
+    // The mux WS often races the first HTTP request (cached document), so
+    // mint the owner session here too; a stale cookie re-mints once on 401.
+    let cookie
+    try {
+      cookie = await this.ensureSession()
+    } catch (error) {
+      channel.send({ t: 'wfail', id, error: `会话铸造失败: ${error?.message ?? error}` })
+      return
+    }
+    let inner
+    try {
+      inner = new WebSocket(origin + p, {
+        headers: {
+          ...sanitizeHeaders(frame.h),
+          cookie,
+        },
+        handshakeTimeout: 10_000,
+        maxPayload: 64 * 1024 * 1024,
+      })
+    } catch (error) {
+      channel.send({ t: 'wfail', id, error: error?.message ?? String(error) })
+      return
+    }
+    const pipe = { inner, closed: false, channel, backlog: [], backlogBytes: 0 }
+    this.wsPipes.set(id, pipe)
+    inner.on('open', () => {
+      if (pipe.closed) return
+      // The visitor may have raced ahead of the inner handshake; replay now.
+      const backlog = pipe.backlog.splice(0)
+      pipe.backlogBytes = 0
+      for (const item of backlog) {
+        if (inner.readyState !== 1) break
+        try { inner.send(typeof item === 'string' ? item : Buffer.from(item)) } catch { /* peer state raced */ }
+      }
+      channel.send({ t: 'wok', id })
+      this.log('bridge', `实时通道已拼接 ${p}`)
+    })
+    inner.on('message', (data, isBinary) => {
+      try {
+        if (pipe.closed || this.closed) return
+        if (isBinary) {
+          channel.sendRaw(encodeBin({ t: 'wdata', id }, toBuffer(data)))
+          return
+        }
+        const text = typeof data === 'string' ? data : toBuffer(data).toString('utf8')
+        channel.send({ t: 'wdata-text', id, text })
+      } catch (error) {
+        this.log('bridge', `origin 帧处理异常（已隔离）: ${error?.message ?? error}`)
+      }
+    })
+    inner.on('close', (code, reason) => {
+      if (pipe.closed) return
+      pipe.closed = true
+      this.wsPipes.delete(id)
+      channel.send({ t: 'wclose', id, code: code ?? 1005, reason: reason?.toString?.() ?? '' })
+    })
+    inner.on('unexpected-response', (_req, res) => {
+      if (pipe.closed) return
+      if (res.statusCode === 401 && this.cookieHeader === cookie) {
+        // Stale owner session: drop it so the next attempt re-mints.
+        this.cookieHeader = undefined
+      }
+    })
+    inner.on('error', (error) => {
+      if (pipe.closed) return
+      pipe.closed = true
+      this.wsPipes.delete(id)
+      channel.send({ t: 'wfail', id, error: error?.message ?? String(error) })
+    })
+  }
+
+  onWsData(id, payload, channel) {
+    const pipe = this.wsPipes.get(id)
+    if (!pipe) return
+    if (pipe.inner.readyState === 1) {
+      pipe.inner.send(payload)
+      return
+    }
+    if (pipe.inner.readyState === 0) {
+      // Still handshaking with the loopback origin: hold frames in order.
+      pipe.backlogBytes += payload.length
+      if (pipe.backlogBytes <= 8 * 1024 * 1024) {
+        pipe.backlog.push(payload)
+        return
+      }
+    }
+    channel.send({ t: 'wclose', id, code: 1011, reason: 'inner not open' })
+    pipe.closed = true
+    this.wsPipes.delete(id)
+    try { pipe.inner.terminate() } catch { /* gone */ }
+  }
+
+  onWsClose(frame) {
+    const pipe = this.wsPipes.get(frame.id)
+    if (!pipe) return
+    pipe.closed = true
+    this.wsPipes.delete(frame.id)
+    try { pipe.inner.close(frame.code ?? 1000, frame.reason ?? '') } catch { pipe.inner.terminate() }
+  }
+
+}