@skillpie/dsh-remote 1.1.0 → 1.2.0

package/lib/index.js

@@ -327,7 +327,9 @@ export default {
       }
 
       // 7. Visitor restore worker: conceals the code from the address bar and
-      //    keeps the bare origin reopening the tunnel (see concealScript).
+      //    keeps the bare origin reopening the tunnel (see concealScript). The
+      //    worker also probes 8-digit code paths and swaps a 404 (unknown or
+      //    offline-revoked code) for the code-entry dialog.
       if (mode === 'gui' && (direct || relayFaceEnabled)) {
         disposers.push(webServer.register({
           kind: 'exact',

package/lib/relay-core.js

@@ -65,6 +65,92 @@ export class RelayCore {
     this.cmdSeq = 0
     this.timers = new Set()
     this.closed = false
+    this.enterDisposers = []
+    // 未知远程码兜底:webServer 的前缀匹配是「p 或 p/」语义,任何短于 8 字符
+    // 的前缀都命中不了 /<code>/ 路径,所以无法用通配路由接管数字码;改为
+    // ①独立输码页路由(供手动访问/边缘转发目标),②由 index.js 用
+    // webServer.tapIndex 把守卫脚本注进服务器 SPA 文档——未知码路径命中的
+    // 正是 SPA fallback 渲染的 index,守卫脚本据 pathname 弹输码框。
+    if (this.mode === 'gui') {
+      try {
+        this.enterDisposers.push(this.webServer.register({
+          kind: 'prefix',
+          path: '/dsh-remote-enter',
+          handler: (req, res) => {
+            try { this.serveEnter(req, res) } catch (error) {
+              this.log('relay', `输码页请求失败（已隔离）: ${error?.message ?? error}`)
+              try { res.writeHead(500).end() } catch { /* gone */ }
+            }
+          },
+        }))
+      } catch (error) {
+        this.log('relay', `输码路由注册失败（已隔离）: ${error?.message ?? error}`)
+      }
+    }
+  }
+
+  /**
+   * Standalone code-entry page: `/dsh-remote-enter?code=NNNNNNNN` renders the
+   * dialog pre-flagged with that code as invalid; without a code it opens the
+   * blank dialog. Also the redirect target for edge-level unknown-code rules.
+   */
+  serveEnter(req, res) {
+    let code = ''
+    try { code = new URL(req.url ?? '/', 'http://localhost').searchParams.get('code') ?? '' } catch { code = '' }
+    const send = (status, body, headers = {}) => {
+      if (res.headersSent) { try { res.destroy() } catch { res.end() } ; return }
+      res.writeHead(status, { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...headers })
+      res.end(body)
+    }
+    const bad = /^[1-9]\d{7}$/.test(code) ? code : ''
+    if (code !== '' && bad === '') {
+      send(400, 'bad code\n', { 'Content-Type': 'text/plain; charset=utf-8' })
+      return
+    }
+    send(200, this.enterHtml(bad), { 'Content-Type': 'text/html; charset=utf-8' })
+  }
+
+  /**
+   * Code-entry page: shown for a well-formed but unknown remote code instead
+   * of the SPA's 404. Asks the visitor for a valid code and forwards to
+   * /<code>/, where the normal conceal+tunnel flow takes over — the entered
+   * code never lingers in a form, and a live code behaves exactly like
+   * opening its link for the first time.
+   */
+  enterHtml(badCode) {
+    const hint = badCode
+      ? `<div class="err">远程码 <code>${badCode}</code> 无效或宿主机未在线，请核对后重试。</div>`
+      : ''
+    return `<!DOCTYPE html>
+<html lang="zh-CN"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>DeepSeek 远程访问</title>
+<style>body{margin:0;height:100vh;display:flex;align-items:center;justify-content:center;background:#101114;color:#e8eaed;font:14px/1.6 -apple-system,"PingFang SC","Microsoft YaHei",sans-serif}
+.card{width:min(360px,90vw);background:#1a1c21;border:1px solid #2a2d34;border-radius:14px;padding:28px 26px;box-sizing:border-box}
+h1{margin:0 0 6px;font-size:16px;font-weight:600}.sub{margin:0 0 18px;font-size:12.5px;color:#9aa0a6}
+.row{display:flex;gap:8px}
+input{flex:1;min-width:0;background:#101114;border:1px solid #2a2d34;border-radius:8px;color:#e8eaed;padding:9px 12px;font:15px ui-monospace,Menlo,monospace;letter-spacing:.12em;outline:none}
+input:focus{border-color:#6b84ff}
+button{background:#4a5cff;border:0;border-radius:8px;color:#fff;padding:9px 16px;font:14px inherit;cursor:pointer}
+button:hover{background:#5b6bff}
+.err{margin-top:14px;font-size:12.5px;color:#ff8a80;word-break:break-all}code{font-family:ui-monospace,Menlo,monospace;color:#ffb4a9}
+.tip{margin-top:16px;font-size:11.5px;color:#6b7078}</style></head>
+<body><div class="card"><h1>DeepSeek 远程访问</h1><p class="sub">请输入 8 位远程码以连接对应的宿主机。</p>
+${hint}
+<form class="row"><input name="code" inputmode="numeric" autocomplete="off" maxlength="8" placeholder="12345678" autofocus><button type="submit">进入</button></form>
+<div class="tip">远程码由宿主机属主面板提供，仅在宿主机在线时可用。</div></div>
+<script>(function(){
+var f=document.querySelector('form');var i=document.querySelector('input');
+i.addEventListener('input',function(){i.value=i.value.replace(/\\D/g,'').slice(0,8)});
+f.addEventListener('submit',function(ev){
+  ev.preventDefault();
+  var c=i.value;
+  if(!/^[1-9]\\d{7}$/.test(c)){i.focus();return}
+  location.assign('/'+c+'/');
+});
+i.focus();
+})();</script></body></html>`
   }
 
   later(fn, ms) {
@@ -951,6 +1037,8 @@ try{document.querySelectorAll('[role=menu]').forEach(patch)}catch(e){}
 
   detachAll() {
     this.closed = true
+    for (const dispose of this.enterDisposers) { try { dispose() } catch { /* gone */ } }
+    this.enterDisposers = []
     for (const timer of this.timers) clearTimeout(timer)
     this.timers.clear()
     for (const hostId of [...this.hosts.keys()]) this.removeHost(hostId, 'relay shutting down')
@@ -989,21 +1077,40 @@ export function serviceWorkerScript() {
   return `/* dsh-remote visitor restore worker */
 var CODE='';
 try{CODE=new URL(self.location.href).searchParams.get('code')||''}catch(e){}
+var CODE_RE=/^\\/([1-9]\\d{7})(\\/|$)/;
 self.addEventListener('install',function(e){self.skipWaiting()});
 self.addEventListener('activate',function(e){e.waitUntil(self.clients.claim())});
 self.addEventListener('fetch',function(event){
   try{
     var req=event.request;
+    if(req.method!=='GET')return;
     if(req.mode!=='navigate')return;
     var url=new URL(req.url);
     if(url.origin!==self.location.origin)return;
     if((url.search||'').indexOf('gui')!==-1)return;
     if((req.headers.get('cookie')||'').indexOf('dsh-auth-')!==-1)return;
+    /* Unknown-code guard: an 8-digit path that answers 404 (no live host)
+       gets the code-entry dialog instead of the bare 404 page. */
+    var cm=url.pathname.match(CODE_RE);
+    if(cm){
+      event.respondWith((async function(){
+        var probe;
+        try{probe=await fetch(new Request(req.url,{method:'HEAD',cache:'no-store'}))}catch(e){return fetch(req)}
+        if(probe&&probe.status===404){
+          try{return await fetch('/dsh-remote-enter?code='+cm[1],{cache:'no-store'})}catch(e){return fetch(req)}
+        }
+        return fetch(req);
+      })());
+      return;
+    }
     if(url.pathname!=='/'&&url.pathname!=='')return;
     if(!/^[1-9]\\d{7}$/.test(CODE))return;
     event.respondWith((async function(){
       var up;
       try{up=await fetch('/'+CODE+'/',{cache:'no-store'})}catch(e){return}
+      if(up.status===404){
+        try{return await fetch('/dsh-remote-enter?code='+CODE,{cache:'no-store'})}catch(e){return fetch(req)}
+      }
       var ct=up.headers.get('content-type')||'';
       if(ct.indexOf('text/html')===-1)return up;
       var text=await up.text();
@@ -1023,3 +1130,4 @@ export function serveServiceWorker(req, res) {
   })
   res.end(serviceWorkerScript())
 }
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillpie/dsh-remote",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Remote control for DeepSeek Harness: reach any host by its 8-digit code through a relay origin such as dsh.skillpie.cn.",
   "type": "module",
   "license": "MIT",