@skillpie/dsh-remote 1.0.0 → 1.1.0

package/README.md

@@ -60,12 +60,30 @@ DeepSeek Harness(DSH)插件:像 ZCodeOnline 远程协助一样,用 **8 位远程
 | `relay.mode` | `gui` | 中转面给访客的体验(同上) |
 | `relay.maxVisitorsPerHost` | `8` | 单宿主机并发访客/拼接上限 |
 
+## 地址栏隐私（远程码不落 URL）
+
+打开 `https://dsh.skillpie.cn/12345678/` 后,页面脚本会把远程码存入浏览器(localStorage + sessionStorage)、立刻用 `history.replaceState` 把地址栏改写为 `https://dsh.skillpie.cn/`,并把 `<base>` 钉到隧道前缀保证资源继续加载。同时注册一个 origin 级 Service Worker(`/dsh-remote-sw.js`):之后直接访问裸域名也会自动恢复到对应宿主机的隧道,**全程不需要把码拼回 URL**。
+
+- 转发/收藏裸域名即可再次进入(同一浏览器);`?gui` 参数可跳过恢复(例如访客想看中转站自己的 GUI 或排除故障)。
+- 携带中转站属主会话 cookie(`dsh-auth-*`)的浏览器不受 SW 影响,裸域名始终是中转站自己的 GUI。
+- 宿主机离线时,SW 回源得到的是离线占位页,不会渲染任何宿主内容。
+- 清除站点数据(或换浏览器)后裸域名不再自动恢复,需要原始带码链接重新进入。
+- 码以明文存在访客浏览器 localStorage 中——这是为「无需重复输入」做的权衡;公用电脑请勿勾选记住,或用后清除站点数据。
+
+## 访客文件下载
+
+远程访问时,文件预览页的打开方式菜单(LibreOffice/WorkBuddy/… 那个)会在**最前面**多出一项「下载文件」:点击后把宿主机磁盘上的该文件经隧道流回访客浏览器,由浏览器弹出保存框存到本地——GUI 本身的菜单只能把路径交给宿主机桌面,远程访客原本无从取回生成的文件(xlsx/pdf/任意类型均可)。
+
+- 路径来自预览页头的完整路径显示;页面找不到路径时,退用最近一次通过 mux 请求过的文件路径;都拿不到会提示「无法定位文件」。
+- 下载路由 `/dsh-remote-file` 挂在宿主机自己的 web 服务上,仅接受 GET/HEAD,经隧道访问时由宿主会话 cookie 保护;另外校验一个由宿主 hostId 派生的密钥(`x-dsh-remote-key`,自动注入),防止本机回环的其他进程任意读文件。只允许下载普通文件,单文件上限 512MB。
+- 仅访客态注入该菜单项,宿主机本地 GUI 不受影响。
+
 ## 安全（重要）
 
-- **gui 模式下访客拥有与属主等价的完整 GUI 权限**(可见所有会话、可操作界面、含设置页)。远程码就是分享授权:**只把链接给你信任的人**;不再需要时用属主面板「重新生成远程码」立即作废旧链接。
+- **gui 模式下访客拥有与属主等价的完整 GUI 权限**(可见所有会话、可操作界面、含设置页)。远程码就是分享授权:**只把链接给你信任的人**;不再需要时用属主面板「重新生成远程码」立即作废旧链接(浏览器缓存的旧码会失效,SW 恢复到离线占位页)。
 - 远程码/宿主 token:token 只存哈希;owner 会话 cookie 只在宿主机进程内持有并逐请求注入,不进入访客浏览器。
 - 每台宿主机限制并发访客;请求体、帧大小、空闲时间均有上限;帧处理器带异常边界,任何桥接错误只断开对应连接,不会影响宿主进程。
-- 局限:gui 模式是多宿主共享入口,属主面板的「在线访客」仅统计拼接连接;首次加载资源走隧道一次(之后浏览器缓存生效)。
+- 局限:gui 模式是多宿主共享入口,属主面板的「在线访客」仅统计拼接连接;首次加载资源走隧道一次(之后浏览器缓存生效)。Service Worker 需要安全上下文(https 或 localhost),LAN 明文 http 下仅地址栏摘除生效,无自动恢复。
 
 ## 验证（本仓库）
 

package/lib/file-route.js

@@ -0,0 +1,159 @@
+/**
+ * dsh-remote — host-side visitor file download route.
+ *
+ * Visitors of the real GUI have no way to save a generated file locally: the
+ * built-in file menu only hands paths to the Host desktop (open / reveal),
+ * which is invisible to a remote browser. This route reads a file from this
+ * host's disk and streams it back with `Content-Disposition: attachment`,
+ * so the visitor's browser opens its own save dialog.
+ *
+ * The route registers on the HOST's own web server under `/dsh-remote-file`;
+ * visitor requests reach it through the tunnel (relay prefix proxy or direct
+ * pipe) with the bridge-minted owner cookie attached. Everything else is
+ * gated by a shared-secret key derived from the host id (`?k=` or the
+ * `x-dsh-remote-key` header) so loopback strangers cannot read arbitrary
+ * files. The same derivation runs on the relay to stamp the key into the
+ * visitor shim, so no protocol change carries it.
+ */
+import { createReadStream } from 'node:fs'
+import { stat } from 'node:fs/promises'
+import { createHash } from 'node:crypto'
+
+/** Largest file one download may serve. */
+const MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024
+
+const MIME_BY_EXT = new Map([
+  ['.xlsx', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
+  ['.xlsm', 'application/vnd.ms-excel.sheet.macroEnabled.12'],
+  ['.xls', 'application/vnd.ms-excel'],
+  ['.csv', 'text/csv; charset=utf-8'],
+  ['.tsv', 'text/tab-separated-values; charset=utf-8'],
+  ['.docx', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'],
+  ['.doc', 'application/msword'],
+  ['.pptx', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'],
+  ['.ppt', 'application/vnd.ms-powerpoint'],
+  ['.pdf', 'application/pdf'],
+  ['.json', 'application/json; charset=utf-8'],
+  ['.txt', 'text/plain; charset=utf-8'],
+  ['.md', 'text/markdown; charset=utf-8'],
+  ['.html', 'text/html; charset=utf-8'],
+  ['.htm', 'text/html; charset=utf-8'],
+  ['.xml', 'application/xml; charset=utf-8'],
+  ['.yml', 'text/yaml; charset=utf-8'],
+  ['.yaml', 'text/yaml; charset=utf-8'],
+  ['.png', 'image/png'],
+  ['.jpg', 'image/jpeg'],
+  ['.jpeg', 'image/jpeg'],
+  ['.gif', 'image/gif'],
+  ['.webp', 'image/webp'],
+  ['.svg', 'image/svg+xml'],
+  ['.zip', 'application/zip'],
+  ['.gz', 'application/gzip'],
+  ['.mp4', 'video/mp4'],
+  ['.mp3', 'audio/mpeg'],
+  ['.wav', 'audio/wav'],
+])
+
+export function mimeOf(name) {
+  const at = name.lastIndexOf('.')
+  if (at === -1) return 'application/octet-stream'
+  return MIME_BY_EXT.get(name.slice(at).toLowerCase()) ?? 'application/octet-stream'
+}
+
+/** attachment disposition with an UTF-8 form plus an ASCII fallback. */
+export function dispositionOf(name) {
+  const clean = String(name ?? '').replace(/[\r\n]/g, ' ').trim() || 'download'
+  const fallback = clean.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_')
+  return `attachment; filename="${fallback}"; filename*=UTF-8''${encodeURIComponent(clean)}`
+}
+
+/**
+ * Shared secret gating the host's file route. Derived from the host id only,
+ * so it survives token regeneration and needs no protocol change: the relay
+ * derives the same value from the hello hostId to stamp the visitor shim.
+ */
+export function fileRouteKey(hostId) {
+  return createHash('sha256').update(`dsh-remote-file:v1:${hostId}`).digest('hex').slice(0, 32)
+}
+
+/** Constant-time-ish comparison for short hex strings. */
+function keyMatches(given, expected) {
+  const a = Buffer.from(String(given ?? ''))
+  const b = Buffer.from(String(expected ?? ''))
+  if (a.length !== b.length) return false
+  let diff = 0
+  for (let i = 0; i < b.length; i++) diff |= a[i] ^ b[i]
+  return diff === 0
+}
+
+/**
+ * Register the download route on the host web server.
+ * @param services { webServer: object with register(route) → disposer }
+ * @param key string from fileRouteKey(identity.hostId)
+ * @param log fn(kind, text)
+ * @returns disposer
+ */
+export function registerFileRoute({ webServer, key, log = () => {} }) {
+  return webServer.register({
+    kind: 'prefix',
+    path: '/dsh-remote-file',
+    handler: (req, res) => {
+      try {
+        void handle(req, res)
+      } catch (error) {
+        log('file-route', `下载路由处理异常（已隔离）: ${error?.message ?? error}`)
+        try { res.writeHead(500).end() } catch { try { res.destroy() } catch { /* gone */ } }
+      }
+    },
+  })
+
+  async function handle(req, res) {
+    const url = new URL(req.url ?? '/', 'http://localhost')
+    const send = (status, text) => {
+      if (res.headersSent) { try { res.destroy() } catch { res.end() } ; return }
+      res.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' })
+      res.end(`${text}\n`)
+    }
+    if (!url.pathname.startsWith('/dsh-remote-file')) return send(404, 'not found')
+    if (req.method !== 'GET' && req.method !== 'HEAD') return send(405, 'method not allowed')
+    // Loopback strangers and forged pages must not read files; only requests
+    // carrying the key survive (the visitor shim stamps it, tunnel or direct).
+    const given = url.searchParams.get('k') ?? req.headers['x-dsh-remote-key'] ?? ''
+    if (!keyMatches(given, key)) return send(403, 'bad download key')
+    const filePath = url.searchParams.get('path') ?? ''
+    if (!filePath || !filePath.startsWith('/') || filePath.includes('\0')) return send(400, 'path must be absolute')
+    let info
+    try {
+      info = await stat(filePath)
+    } catch {
+      return send(404, 'file not found')
+    }
+    if (!info.isFile()) return send(404, 'not a regular file')
+    if (info.size > MAX_DOWNLOAD_BYTES) return send(413, 'file too large')
+    const name = filePath.split('/').pop() || 'download'
+    let stream
+    try {
+      stream = createReadStream(filePath)
+    } catch (error) {
+      return send(404, `file unreadable: ${error?.message ?? error}`)
+    }
+    res.writeHead(200, {
+      'Content-Type': mimeOf(name),
+      'Content-Length': String(info.size),
+      'Content-Disposition': dispositionOf(name),
+      'Cache-Control': 'no-store',
+      'X-Content-Type-Options': 'nosniff',
+    })
+    stream.on('error', (error) => {
+      log('file-route', `下载流中断: ${error?.message ?? error}`)
+      try { res.destroy() } catch { res.end() }
+    })
+    req.on('close', () => { try { stream.destroy() } catch { /* gone */ } })
+    if (req.method === 'HEAD') {
+      stream.destroy()
+      res.end()
+      return
+    }
+    stream.pipe(res)
+  }
+}

package/lib/index.js

@@ -28,7 +28,8 @@ import { HOST_UPGRADE_PATH, OWNER_API_PATH, PROTOCOL_VERSION, generateCode, gene
 import { HostEngine } from './engine.js'
 import { GuiBridge } from './bridge.js'
 import { RelayLink } from './remote.js'
-import { RelayCore } from './relay-core.js'
+import { RelayCore, serveServiceWorker } from './relay-core.js'
+import { registerFileRoute, fileRouteKey } from './file-route.js'
 import { consoleHtml } from './console.js'
 import { createPipePair } from './pipe.js'
 
@@ -285,6 +286,15 @@ export default {
         logLine('owner-api', `属主 API 已挂载（${OWNER_API_PATH}）`)
       }
 
+      // 5.5 Visitor file downloads: stream files from this host to the
+      //     remote browser with a save dialog (see lib/file-route.js).
+      //     Host roles only; the key derives from the host id, which the
+      //     relay also derives from the hello to stamp the visitor shim.
+      if (enabled || direct) {
+        disposers.push(registerFileRoute({ webServer, key: fileRouteKey(identity.hostId), log: logLine }))
+        logLine('file-route', '访客文件下载路由已挂载（/dsh-remote-file）')
+      }
+
       // 6. Direct mode: the same surface on the local web server.
       if (direct) {
         const [hostEnd, relayEnd] = createPipePair()
@@ -316,7 +326,18 @@ export default {
         logLine('direct', `本机直连路由已挂载（/${identity.code}/，模式 ${mode}）`)
       }
 
-      // 7. Relay face (server deployments only).
+      // 7. Visitor restore worker: conceals the code from the address bar and
+      //    keeps the bare origin reopening the tunnel (see concealScript).
+      if (mode === 'gui' && (direct || relayFaceEnabled)) {
+        disposers.push(webServer.register({
+          kind: 'exact',
+          path: '/dsh-remote-sw.js',
+          handler: (req, res) => { try { serveServiceWorker(req, res) } catch { try { res.destroy() } catch { /* gone */ } } },
+        }))
+        logLine('sw', '访客恢复 Worker 已挂载（/dsh-remote-sw.js）')
+      }
+
+      // 8. Relay face (server deployments only).
       if (relayFaceEnabled) {
         const relayCore = new RelayCore({
           webServer,

package/lib/relay-core.js

@@ -32,6 +32,7 @@ import {
   decodeBin,
 } from './protocol.js'
 import { adaptSocket } from './ws-adapter.js'
+import { fileRouteKey } from './file-route.js'
 
 const HELLO_TIMEOUT_MS = 5_000
 const OFFLINE_GRACE_MS = 10 * 60_000
@@ -220,6 +221,7 @@ export class RelayCore {
       httpOps: new Map(),
       splices: new Map(),
       routes: [],
+      fileKey: undefined,
       createdAt: Date.now(),
     }
     if (existing) {
@@ -231,6 +233,7 @@ export class RelayCore {
     host.name = typeof hello.name === 'string' ? hello.name.slice(0, 80) : host.name
     host.dsh = typeof hello.dsh === 'string' ? hello.dsh.slice(0, 40) : host.dsh
     host.ip = ip
+    host.fileKey = fileRouteKey(hostId)
     host.tokenHash = hashToken(newToken)
     host.socket = socket
     host.lastSeen = Date.now()
@@ -353,7 +356,7 @@ export class RelayCore {
 
   offlineHtml(code) {
     return `<!DOCTYPE html>
-<html lang="zh-CN"><head><meta charset="utf-8"><meta http-equiv="refresh" content="5"><script>try{localStorage.setItem('dsh-remote-last-code','${code}')}catch(e){}</script>
+<html lang="zh-CN"><head><meta charset="utf-8"><meta http-equiv="refresh" content="5"><script>(function(){try{localStorage.setItem('dsh-remote-last-code','${code}');sessionStorage.setItem('dsh-remote-last-code','${code}');if((location.search||'').indexOf('gui')===-1)history.replaceState(null,'','/')}catch(e){}})();</script>
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>远程控制 ${code}</title>
 <style>body{margin:0;height:100vh;display:flex;align-items:center;justify-content:center;flex-direction:column;gap:10px;background:#101114;color:#e8eaed;font:14px/1.6 -apple-system,"PingFang SC","Microsoft YaHei",sans-serif}.big{font-size:17px}.hint{font-size:12.5px;color:#9aa0a6}code{font-family:ui-monospace,Menlo,monospace;color:#6b84ff}</style></head>
@@ -389,11 +392,162 @@ window.WebSocket=class extends OW{constructor(u,p){u=rebase(typeof u==='string'?
 })(/* dsh-remote visitor shim */);</script>`
   }
 
-  injectVisitorShim(html, code) {
+  /**
+   * Code concealment: remember the code, pin relative resolution to the
+   * tunnel prefix (history.replaceState would change how `<base href="./">`
+   * resolves), strip the code from the visible URL, and register the
+   * origin-level service worker so later visits to the bare origin restore
+   * the tunnel without the code ever reappearing in the address bar.
+   * Injected right after `<base>`; runs before app scripts.
+   */
+  concealScript(code) {
+    const codeJson = JSON.stringify(code)
+    const prefixJson = JSON.stringify(`/${code}/`)
+    return `<script>(function(){
+window.__DSH_REMOTE_CONCEAL__=true;
+try{
+  var C=${codeJson};
+  if((location.search||'').indexOf('gui')!==-1){try{sessionStorage.setItem('dsh-remote-bypass','1')}catch(e){}return}
+  var b=document.querySelector('base');
+  if(b)b.setAttribute('href',${prefixJson});
+  try{localStorage.setItem('dsh-remote-last-code',C)}catch(e){}
+  try{sessionStorage.setItem('dsh-remote-last-code',C)}catch(e){}
+  try{history.replaceState(null,'','/')}catch(e){}
+  if(navigator.serviceWorker&&window.isSecureContext){
+    navigator.serviceWorker.register('/dsh-remote-sw.js?code='+C,{scope:'/'}).catch(function(){})
+  }
+}catch(e){}
+})(/* dsh-remote conceal */);</script>`
+  }
+
+  /**
+   * Visitor-side "download file" menu patch. The host GUI's file menu
+   * (OpenTargetButton) only hands paths to the host desktop; a remote
+   * visitor has no way to save the file locally. This script watches for
+   * that menu opening, prepends a "下载文件" item (styled after the native
+   * menu rows) and serves the file through the host's `/dsh-remote-file`
+   * route via the tunnel.
+   *
+   * The absolute path comes from the preview header's PathLabel
+   * (`[data-path-label]` holds it in `title`); as a fallback we tap mux
+   * frames for the last path the app requested (openWorkspacePath /
+   * workspacePathApplications payloads carry `"path":"…"`).
+   * Injected last, after the visitor shim (its WebSocket wrapper stays).
+   */
+  downloadMenuScript(code, key) {
+    const codeJson = JSON.stringify(code)
+    const keyJson = JSON.stringify(String(key ?? ''))
+    return `<script>(function(){
+window.__DSH_REMOTE_DOWNLOAD__=true;
+try{
+var C=${codeJson};var K=${keyJson};
+var M=/显示文件位置|Show file location|ファイルの場所| 파일 위치|Открыть расположение/;
+var PATH_RE=/^([\\/~]|[A-Za-z]:[\\\\\\/])/;
+function isPath(s){return typeof s==='string'&&s.length>1&&s.length<1024&&PATH_RE.test(s)&&s.indexOf('/')>-1}
+var lastMux=null;
+function notePath(p){if(isPath(p))lastMux={path:p,at:Date.now()}}
+var OW=window.WebSocket;
+window.WebSocket=class extends OW{constructor(u,p){super(u,p);var self=this;var s=super.send;
+// tap outgoing mux frames for file paths (fallback when no PathLabel DOM)
+this.send=function(data){
+  try{
+    if(typeof data==='string'&&data.indexOf('"path"')>-1){
+      var m=data.match(/"path"\\s*:\\s*"((?:[^"\\\\]|\\\\(?:u[0-9a-fA-F]{4}|.))*)"/);
+      if(m){try{notePath(JSON.parse('"'+m[1]+'"'))}catch(e){}}
+    }
+  }catch(e){}
+  return s.call(self,data)}
+}};
+function base(){return location.pathname.replace(new RegExp('^/'+C+'(/|$)'),'/')==='/'
+  ? '/'+C : location.pathname.split('/').slice(0,2).join('/')}
+function download(path){
+  var url=base()+'/dsh-remote-file?path='+encodeURIComponent(path);
+  return fetch(url,{credentials:'omit',headers:{'x-dsh-remote-key':K}}).then(function(r){
+    if(!r.ok)throw new Error('HTTP '+r.status);
+    var cd=r.headers.get('content-disposition')||'';
+    var m=cd.match(/filename\\*=UTF-8''([^;]+)/i);
+    var name=m?decodeURIComponent(m[1]):(path.split('/').pop()||'download');
+    return r.blob().then(function(b){
+      var a=document.createElement('a');a.href=URL.createObjectURL(b);a.download=name;
+      document.body.appendChild(a);a.click();a.remove();
+      setTimeout(function(){URL.revokeObjectURL(a.href)},30000);
+    });
+  });
+}
+function findLabel(el){
+  for(var n=el,i=0;n&&i<8;i++,n=n.parentElement){
+    var lbl=n.querySelector&&n.querySelector('[data-path-label]');
+    if(lbl){var t=lbl.getAttribute('title')||lbl.textContent;if(isPath(t))return t}
+  }
+  return null;
+}
+function patch(menu){
+  if(menu.getAttribute('data-dsh-remote-dl'))return;
+  menu.setAttribute('data-dsh-remote-dl','1');
+  var items=menu.querySelectorAll('[role=menuitem]');
+  if(!items.length)return;
+  var itemsArr=Array.prototype.slice.call(items);
+  // Only file menus: the native reveal item, or a menu anchored by the file target.
+  var trigger=null;
+  var mid=menu.id||'';
+  if(mid){var cands=document.querySelectorAll('[aria-controls]');
+    for(var i=0;i<cands.length;i++){var v=(cands[i].getAttribute('aria-controls')||'').split(/\\s+/);
+      if(v.indexOf(mid)>-1){trigger=cands[i];break}}}
+  var hasReveal=itemsArr.some(function(it){return M.test(it.textContent||'')});
+  var isFile=hasReveal||(trigger&&trigger.closest&&trigger.closest('[data-open-target="file"]'));
+  if(!isFile)return;
+  var first=itemsArr[0];
+  var btn=document.createElement('button');
+  btn.setAttribute('role','menuitem');
+  btn.setAttribute('type','button');
+  btn.className=first.className||'';
+  btn.style.cssText='all:unset;display:flex;align-items:center;gap:8px;width:100%;box-sizing:border-box;cursor:pointer;color:inherit;font:inherit;';
+  for(var a=0;a<first.attributes.length;a++){var at=first.attributes[a];
+    if(at.name!=='role'&&at.name!=='type'&&at.name!=='disabled'&&at.name.indexOf('data-')!==0&&!/^(id|aria-(labelledby|describedby))$/.test(at.name)){try{btn.setAttribute(at.name,at.value)}catch(e){}}}
+  btn.setAttribute('data-dsh-remote-dl-item','1');
+  var zh=(document.documentElement.lang||'').toLowerCase().indexOf('zh')===0;
+  btn.innerHTML='<span style="display:inline-flex;align-items:center;justify-content:center;width:16px;height:16px;opacity:.85">'
+    +'<svg width="14" height="14" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M8 2.2v7.6m0 0 2.8-2.8M8 9.8 5.2 7M3 12.6h10" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"/></svg>'
+    +'</span><span></span>';
+  btn.lastElementChild.textContent=zh?'下载文件':'Download file';
+  btn.addEventListener('click',function(ev){
+    ev.preventDefault();ev.stopPropagation();
+    var path=findLabel(trigger||first)||((lastMux&&Date.now()-(lastMux.at||0)<120000)?lastMux.path:null);
+    if(!path){
+      var t=btn.lastElementChild;var old=t.textContent;
+      t.textContent=zh?'无法定位文件':'Cannot locate file';
+      setTimeout(function(){t.textContent=old},1200);
+      return;
+    }
+    download(path).catch(function(){});
+  });
+  first.parentNode.insertBefore(btn,first);
+}
+var mo=new MutationObserver(function(muts){
+  for(var i=0;i<muts.length;i++){var add=muts[i].addedNodes;
+    for(var j=0;j<add.length;j++){var n=add[j];
+      if(!n||n.nodeType!==1)continue;
+      var menus=n.matches&&n.matches('[role=menu]')?[n]:(n.querySelectorAll?n.querySelectorAll('[role=menu]'):[]);
+      for(var k=0;k<menus.length;k++){try{patch(menus[k])}catch(e){}}
+    }}
+});
+function start(){try{mo.observe(document.body,{childList:true,subtree:true})}catch(e){}}
+if(document.body)start();else document.addEventListener('DOMContentLoaded',start);
+// Menus already open before the observer started.
+try{document.querySelectorAll('[role=menu]').forEach(patch)}catch(e){}
+}catch(e){}
+})(/* dsh-remote download menu */);</script>`
+  }
+
+  injectVisitorShim(html, code, fileKey) {
     if (typeof html !== 'string' || html.length === 0) return html
-    const shim = this.visitorShimScript(code)
-    if (/<head[^>]*>/i.test(html)) return html.replace(/<head[^>]*>/i, (m) => m + shim)
-    return shim + html
+    let scripts = this.concealScript(code) + this.visitorShimScript(code)
+    if (typeof fileKey === 'string' && fileKey.length > 0) {
+      scripts += this.downloadMenuScript(code, fileKey)
+    }
+    if (/<base[^>]*>/i.test(html)) return html.replace(/<base[^>]*>/i, (m) => m + scripts)
+    if (/<head[^>]*>/i.test(html)) return html.replace(/<head[^>]*>/i, (m) => m + scripts)
+    return scripts + html
   }
 
   proxyHttp(req, res, code, host) {
@@ -552,7 +706,7 @@ window.WebSocket=class extends OW{constructor(u,p){u=rebase(typeof u==='string'?
     op.done = true
     try {
       if (op.htmlInject) {
-        const html = this.injectVisitorShim(Buffer.concat(op.parts).toString('utf8'), host.code)
+        const html = this.injectVisitorShim(Buffer.concat(op.parts).toString('utf8'), host.code, host.fileKey)
         op.res.end(html)
       } else {
         op.res.end()
@@ -821,3 +975,51 @@ window.WebSocket=class extends OW{constructor(u,p){u=rebase(typeof u==='string'?
 }
 
 export { PROTOCOL_VERSION }
+
+/**
+ * Origin-level service worker served at /dsh-remote-sw.js. It reads its own
+ * scriptURL query for the code and, from then on, intercepts navigations to
+ * the bare origin (which belong to the relay's authenticated GUI and 401 for
+ * visitors) and serves the tunnel under /<code>/ instead — the address bar
+ * keeps showing the bare origin. Carriers of the relay server's own session
+ * cookie (`dsh-auth-…`) pass through untouched, so the relay owner's GUI is
+ * never hijacked, and `?gui` is a manual escape.
+ */
+export function serviceWorkerScript() {
+  return `/* dsh-remote visitor restore worker */
+var CODE='';
+try{CODE=new URL(self.location.href).searchParams.get('code')||''}catch(e){}
+self.addEventListener('install',function(e){self.skipWaiting()});
+self.addEventListener('activate',function(e){e.waitUntil(self.clients.claim())});
+self.addEventListener('fetch',function(event){
+  try{
+    var req=event.request;
+    if(req.mode!=='navigate')return;
+    var url=new URL(req.url);
+    if(url.origin!==self.location.origin)return;
+    if((url.search||'').indexOf('gui')!==-1)return;
+    if((req.headers.get('cookie')||'').indexOf('dsh-auth-')!==-1)return;
+    if(url.pathname!=='/'&&url.pathname!=='')return;
+    if(!/^[1-9]\\d{7}$/.test(CODE))return;
+    event.respondWith((async function(){
+      var up;
+      try{up=await fetch('/'+CODE+'/',{cache:'no-store'})}catch(e){return}
+      var ct=up.headers.get('content-type')||'';
+      if(ct.indexOf('text/html')===-1)return up;
+      var text=await up.text();
+      if(text.indexOf('__DSH_REMOTE_VISITOR__')===-1)return fetch(req);
+      return new Response(text,{status:up.status,statusText:up.statusText,headers:up.headers});
+    })());
+  }catch(e){}
+});
+`
+}
+
+export function serveServiceWorker(req, res) {
+  res.writeHead(200, {
+    'Content-Type': 'text/javascript; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'Service-Worker-Allowed': '/',
+  })
+  res.end(serviceWorkerScript())
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillpie/dsh-remote",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Remote control for DeepSeek Harness: reach any host by its 8-digit code through a relay origin such as dsh.skillpie.cn.",
   "type": "module",
   "license": "MIT",