@wenbin_wb/dsh-bridge 2.10.3 → 2.10.4

package/lib/bridge-rpc.js

@@ -157,8 +157,8 @@ export function installBridgeRpc(ctx, { service, authManager, platformManager, l
           if (adminErr) return adminErr;
 
           // 未提供的字段保持 undefined 透传：服务端视为"保留现值"
-          const { serverUrl, accessToken } = payload;
-          await saveCustomTunnelConfig(serverUrl, accessToken);
+          const { serverUrl, accessToken, sseStreaming } = payload;
+          await saveCustomTunnelConfig(serverUrl, accessToken, sseStreaming);
           const status = await service.getStatus();
           return ok(status);
         }

package/lib/index.js

@@ -184,6 +184,7 @@ const HTML_HEAD_INJECTIONS = `<meta name="viewport" content="width=device-width,
 <link rel="manifest" href="/manifest.webmanifest">
 <link rel="icon" type="image/svg+xml" href="/__dsh_bridge__/pwa-icon.svg">
 <link rel="apple-touch-icon" href="/__dsh_bridge__/pwa-icon.svg">
+<style data-dsh-bridge-overscroll="1">html,body{overscroll-behavior-y:none;-webkit-overflow-scrolling:touch}</style>
 <script data-dsh-bridge-polyfill="1">!function(){try{if(self.crypto&&!self.crypto.randomUUID){self.crypto.randomUUID=function(){var b=new Uint8Array(16);self.crypto.getRandomValues(b);b[6]=b[6]&15|64;b[8]=b[8]&63|128;var h="";for(var i=0;i<16;i++){var x=b[i].toString(16);h+=(x.length<2?"0":"")+x;if(i===3||i===5||i===7||i===9)h+="-";}return h;}}}catch(e){}}();</script>
 ${BROWSER_ABORT_SIGNAL_POLYFILL}`;
 const INJECT_MARK = 'data-dsh-bridge-polyfill="1"';
@@ -443,6 +444,10 @@ class ProxyServer {
           const isLocked = this.authManager?.isIpBlocked(clientIp);
           const html = renderLoginPage({
             hasPassword: this.authManager?.hasPassword,
+            // 管理员是否从未设置过任何密码（含独立管理密码）：登录页需如实提示，
+            // 避免出现"输入任意密码都能进"的假门禁
+            noPasswordConfigured: !this.authManager?.hasPassword && !this.authManager?.hasAdminPassword,
+            mode: this.authManager?.mode,
             locked: isLocked,
             error: isLocked ? '尝试次数过多，请 60 秒后再试' : '',
           });
@@ -466,8 +471,13 @@ class ProxyServer {
           // 数十 MB（contextHeaders 投影无 UI 读取），剥离后显著降低公网传输体积。
           // 覆盖所有入口：局域网 / Cloudflare 隧道 / 外部隧道登记 / 自建隧道。
           const isSessionProjection = pathname.startsWith('/api/session.list') || pathname.startsWith('/api/session.history');
-          const shouldBuffer = contentType.includes('text/html')
-            || (isSessionProjection && proxyRes.statusCode === 200 && !isCompressed(proxyRes.headers));
+          // session 投影剥离须覆盖压缩(gzip)响应：v2.10.4 起 stripSessionProjections 支持
+          // gunzip 解压，因此压缩的 session 响应也应进入缓冲分支进行剥离（此前 !isCompressed
+          // 门控会跳过压缩响应，导致 DSH 启用 gzip 后局域网/CF/外部隧道入口剥离失效——只有
+          // 自建隧道入口正确剥离）。HTML 注入仍只在未压缩时进行（注入逻辑处理明文）。
+          const sessionProjectionBuffered = isSessionProjection && proxyRes.statusCode === 200;
+          const shouldBuffer = (contentType.includes('text/html') && !isCompressed(proxyRes.headers))
+            || sessionProjectionBuffered;
           if (shouldBuffer) {
             const chunks = [];
             proxyRes.on('data', (c) => chunks.push(c));
@@ -481,8 +491,12 @@ class ProxyServer {
                 }
                 out = Buffer.from(html, 'utf8');
               } else if (isSessionProjection) {
-                const { body, stripped } = stripSessionProjections(pathname, out);
-                if (stripped) out = body;
+                const { body, stripped } = stripSessionProjections(pathname, out, proxyRes.headers['content-encoding']);
+                if (stripped) {
+                  out = body;
+                  // 已修改 body，清除原始压缩编码标记
+                  delete outHeaders['content-encoding'];
+                }
               }
               // 缓冲改写过 body：必须去掉原始传输头，避免 content-length 与
               // transfer-encoding 并存导致客户端解析错误（HPE_INVALID_CONTENT_LENGTH）
@@ -801,6 +815,7 @@ class BridgeService {
         configured: !!(this.customTunnelConfig?.serverUrl && this.customTunnelConfig?.accessToken),
         serverUrl: this.customTunnelConfig?.serverUrl ?? '',
         running: !!this.customTunnel?.connected,
+        sseStreaming: Boolean(this.customTunnelConfig?.sseStreaming),
         url: customUrl,
         rawUrl: baseCustomUrl,
         qr: customUrl
@@ -896,6 +911,7 @@ class BridgeService {
       accessToken,
       localPort: this.proxyPort,
       internalTunnelSecret: this.authManager?.internalTunnelSecret,
+      sseStreaming: Boolean(this.customTunnelConfig?.sseStreaming),
       onStateChange: (state) => {
         this.customTunnelState = state;
       },
@@ -1852,13 +1868,14 @@ function apply(ctx, config = {}) {
     telegram,
     platformManager,
     logger,
-    saveCustomTunnelConfig: async (serverUrl, accessToken) => {
+    saveCustomTunnelConfig: async (serverUrl, accessToken, sseStreaming) => {
       const stored = await updateConfig((current) => {
         const prev = service.customTunnelConfig ?? {};
         const next = { ...prev };
         // 与 saveCloudflaredConfig 同契约：undefined/掩码保留现值，空串清除
         if (serverUrl !== undefined) next.serverUrl = String(serverUrl).trim();
         if (accessToken !== undefined) next.accessToken = accessToken === '******' ? (prev.accessToken ?? '') : accessToken;
+        if (sseStreaming !== undefined) next.sseStreaming = Boolean(sseStreaming);
         current.customTunnel = next;
         return current;
       });

package/lib/session-strip.js

@@ -9,6 +9,12 @@
 //   - tunnel-client.mjs（自建隧道）
 //   - index.js ProxyServer（局域网 / Cloudflare 隧道 / 外部隧道登记 —— 所有公网入口）
 // 命中失败（非 200 / 解析失败 / 结构不符）时原样返回，绝不破坏响应。
+//
+// DSH web 服务器默认开启 gzip 压缩（compression: gzip, level 1, threshold 1KB），
+// 所以 API 响应可能是 gzip 编码的。必须先解压才能 JSON.parse，否则解析失败，
+// catch {} 静默跳过剥离 → 完整 58MB+ 响应原样传输 → 隧道慢。
+
+import { gunzipSync } from 'node:zlib';
 
 const STRIP_PATHS = new Set(['/api/session.list', '/api/session.history']);
 
@@ -16,15 +22,19 @@ const STRIP_PATHS = new Set(['/api/session.list', '/api/session.history']);
  * 剥离 session.list / session.history 响应中的 contextHeaders 与 contextTimeline。
  * @param {string} pathname 请求路径（不含 query）
  * @param {Buffer} bodyBuf 原始响应体
- * @returns {{ body: Buffer, stripped: boolean }} stripped=true 表示发生了剥离（调用方需更新 content-length）
+ * @param {string} [contentEncoding] 响应的 content-encoding 头值（用于判断是否 gzip）
+ * @returns {{ body: Buffer, stripped: boolean }} stripped=true 表示发生了剥离（调用方需更新 content-length 和 content-encoding）
  */
-export function stripSessionProjections(pathname, bodyBuf) {
+export function stripSessionProjections(pathname, bodyBuf, contentEncoding) {
   const cleanPath = String(pathname || '').split('?')[0];
   if (!STRIP_PATHS.has(cleanPath) || !Buffer.isBuffer(bodyBuf)) {
     return { body: bodyBuf, stripped: false };
   }
   try {
-    const json = JSON.parse(bodyBuf.toString('utf8'));
+    // 如果 DSH 服务器 gzip 压缩了响应，先解压再解析
+    const isGzipped = String(contentEncoding ?? '').toLowerCase() === 'gzip';
+    const parseBuf = isGzipped ? gunzipSync(bodyBuf) : bodyBuf;
+    const json = JSON.parse(parseBuf.toString('utf8'));
     if (json?.result?.ok) {
       const v = json.result.value;
       let changed = false;
@@ -52,6 +62,6 @@ export function stripSessionProjections(pathname, bodyBuf) {
         return { body: Buffer.from(JSON.stringify(json), 'utf8'), stripped: true };
       }
     }
-  } catch { /* 解析失败则原样发送 */ }
+  } catch { /* 解析/解压失败则原样发送 */ }
   return { body: bodyBuf, stripped: false };
 }

package/lib/telegram/gateway.js

@@ -37,34 +37,36 @@ export function createConnectProxyAgent(proxyUrl) {
     ? 'Basic ' + Buffer.from(`${decodeURIComponent(parsed.username)}:${decodeURIComponent(parsed.password)}`).toString('base64')
     : undefined
 
-  return new https.Agent({
-    keepAlive: true,
-    createConnection(opts, callback) {
-      const connectReq = http.request({
-        host: proxyHost,
-        port: proxyPort,
-        method: 'CONNECT',
-        path: `${opts.host}:${opts.port || 443}`,
-        headers: authHeader ? { 'Proxy-Authorization': authHeader } : {},
-      })
+  // Node >=24 下自定义 createConnection 作为 https.Agent 构造参数会被静默忽略
+  // （https.Agent 不拷贝构造入参中的 createConnection，回退到原型默认直连方法）。
+  // 改为构造后赋值实例属性：实例自有属性会正确覆盖原型方法，Node 22/24 均生效。
+  const agent = new https.Agent({ keepAlive: true })
+  agent.createConnection = function createTunnelConnection(opts, callback) {
+    const connectReq = http.request({
+      host: proxyHost,
+      port: proxyPort,
+      method: 'CONNECT',
+      path: `${opts.host}:${opts.port || 443}`,
+      headers: authHeader ? { 'Proxy-Authorization': authHeader } : {},
+    })
 
-      connectReq.on('connect', (res, socket) => {
-        if (res.statusCode !== 200) {
-          socket.destroy()
-          return callback(new Error(`Proxy CONNECT failed with HTTP ${res.statusCode}`))
-        }
-        const tlsSocket = tls.connect({
-          host: opts.host,
-          socket,
-          servername: opts.servername || opts.host,
-        })
-        callback(null, tlsSocket)
+    connectReq.on('connect', (res, socket) => {
+      if (res.statusCode !== 200) {
+        socket.destroy()
+        return callback(new Error(`Proxy CONNECT failed with HTTP ${res.statusCode}`))
+      }
+      const tlsSocket = tls.connect({
+        host: opts.host,
+        socket,
+        servername: opts.servername || opts.host,
       })
+      callback(null, tlsSocket)
+    })
 
-      connectReq.on('error', (err) => callback(err))
-      connectReq.end()
-    },
-  })
+    connectReq.on('error', (err) => callback(err))
+    connectReq.end()
+  }
+  return agent
 }
 
 /**
@@ -627,4 +629,4 @@ export class TelegramGateway extends Service {
   dispose() {
     void this.stop()
   }
-}
+}

package/lib/tunnel-client.mjs

@@ -4,6 +4,7 @@ import { request as httpRequest } from 'node:http';
 import { connect as netConnect } from 'node:net';
 import { promisify } from 'node:util';
 import { gzip as gzipCallback } from 'node:zlib';
+import { randomBytes as cryptoRandomBytes } from 'node:crypto';
 import { stripSessionProjections } from './session-strip.js';
 
 const gzipAsync = promisify(gzipCallback);
@@ -22,7 +23,7 @@ const GZIP_THRESHOLD = 102400; // 100KB
 const COMPRESSIBLE_TYPES = ['text/', 'application/json', 'application/javascript', 'application/xml'];
 
 export class CustomTunnelClient {
-  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger }) {
+  constructor({ serverUrl, accessToken, localPort, internalTunnelSecret, signal, onStateChange, logger, sseStreaming = false }) {
     this.serverUrl = serverUrl;
     this.accessToken = accessToken;
     this.localPort = localPort;
@@ -30,6 +31,7 @@ export class CustomTunnelClient {
     this.signal = signal;
     this.onStateChange = onStateChange;
     this.logger = logger;
+    this.sseStreaming = sseStreaming;
     this.ws = null;
     this.publicUrl = null;
     this.connected = false;
@@ -161,8 +163,33 @@ export class CustomTunnelClient {
       const chunks = [];
 
       if (isSSE) {
-        // SSE 流式响应：隧道协议不支持流式，收集初始数据后立即返回
-        // 避免 SSE 永不 end 导致隧道服务器超时返回 504
+        if (this.sseStreaming) {
+          // ── 流式模式（需服务端支持 response-start/chunk/end 协议）──
+          // 逐 chunk 转发，SSE 长连接持续保持，浏览器端不会断连重连
+          const respHeaders = Object.fromEntries(
+            Object.entries(res.headers).filter(([k]) => !SKIP.has(k.toLowerCase()))
+          );
+          this._sendMessage({
+            type: 'response-start', requestId,
+            statusCode: res.statusCode, headers: respHeaders,
+          });
+          res.on('data', (c) => {
+            this._sendMessage({
+              type: 'response-chunk', requestId,
+              body: c.toString('base64'),
+            });
+          });
+          res.on('error', () => {
+            this._sendMessage({ type: 'response-end', requestId });
+          });
+          res.on('end', () => {
+            this._sendMessage({ type: 'response-end', requestId });
+          });
+          return;
+        }
+
+        // ── 截断模式（默认，兼容老服务端）──
+        // 收集初始数据后立即返回，避免 SSE 永不 end 导致隧道服务器超时 504
         let sseSent = false;
         const sseTimer = setTimeout(() => {
           if (sseSent) return;
@@ -257,17 +284,22 @@ export class CustomTunnelClient {
         let bodyBuf = Buffer.concat(chunks);
 
         // 剥离 session.list / session.history 的 contextHeaders 投影（无 UI 读取的大字段）
+        // 传入 content-encoding 以便 stripSessionProjections 先 gunzip 再解析
         if (res.statusCode === 200) {
-          const { body, stripped } = stripSessionProjections(path, bodyBuf);
+          const { body, stripped } = stripSessionProjections(path, bodyBuf, res.headers['content-encoding']);
           if (stripped) {
             bodyBuf = body;
+            // 已修改 body，清除原始压缩编码标记，让下方 gzip 逻辑重新压缩
+            delete respHeaders['content-encoding'];
             respHeaders['content-length'] = String(bodyBuf.length);
           }
         }
 
         // 大响应 gzip 压缩：异步执行，避免 gzipSync 卡住整个事件循环
         const respCt = String(res.headers['content-type'] ?? '').toLowerCase();
-        const alreadyEncoded = String(res.headers['content-encoding'] ?? '').toLowerCase();
+        // 注意：alreadyEncoded 从 respHeaders 读取（而非 res.headers），
+        // 因为上面的剥离逻辑可能已经删除了 respHeaders['content-encoding']
+        const alreadyEncoded = String(respHeaders['content-encoding'] ?? res.headers['content-encoding'] ?? '').toLowerCase();
         const compressible = COMPRESSIBLE_TYPES.some((t) => respCt.startsWith(t));
         if (bodyBuf.length > GZIP_THRESHOLD && compressible && !alreadyEncoded) {
           gzipAsync(bodyBuf).then((zipped) => {
@@ -316,9 +348,15 @@ export class CustomTunnelClient {
     let headerBuf = '';
     let upgraded = false;
 
+    // WebSocket 帧解析缓冲区 — 拦截 Ping (0x9) 自动回复 Pong (0xA)。
+    // DSH API Gateway 的 /api/remote.mux WebSocket 每 2s 发 Ping，连续 2 次没收到
+    // Pong 就 terminate。隧道用裸 TCP 转发，Pong 往返延迟可能超时，本地直接回复最可靠。
+    let wsFrameBuf = Buffer.alloc(0);
+
     sock.on('data', (chunk) => {
       if (upgraded) {
-        this._sendMessage({ type: 'ws-frame', wsId, data: chunk.toString('base64') });
+        wsFrameBuf = Buffer.concat([wsFrameBuf, chunk]);
+        wsFrameBuf = this._processWsFrames(wsId, wsFrameBuf, sock);
         return;
       }
       headerBuf += chunk.toString('binary');
@@ -326,6 +364,7 @@ export class CustomTunnelClient {
       if (sep === -1) return;
 
       upgraded = true;
+      const statusLine = headerBuf.slice(0, headerBuf.indexOf('\r\n'));
       const replyHeaders = {};
       const headerLines = headerBuf.slice(0, sep).split('\r\n');
       for (let i = 1; i < headerLines.length; i++) {
@@ -335,7 +374,20 @@ export class CustomTunnelClient {
             headerLines[i].slice(ci + 1).trim();
         }
       }
-      this._sendMessage({ type: 'ws-accept', wsId, replyHeaders });
+
+      // 解析状态码，传递给服务端以便正确转发（非 101 时浏览器能看到真实错误）
+      const statusMatch = /^HTTP\/1\.\d\s+(\d+)\s*(.*)/.exec(statusLine);
+      const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 101;
+      const statusMessage = statusMatch ? statusMatch[2] : '';
+
+      if (statusCode === 101) {
+        this._sendMessage({ type: 'ws-accept', wsId, statusCode, replyHeaders });
+      } else {
+        // 非 101 响应：转发状态码和头，让浏览器看到真实错误（如 401）
+        this._sendMessage({ type: 'ws-accept', wsId, statusCode, statusMessage, replyHeaders });
+        sock.destroy();
+        return;
+      }
 
       // 握手后紧跟的帧数据
       const rest = headerBuf.slice(sep + 4);
@@ -355,6 +407,70 @@ export class CustomTunnelClient {
     });
   }
 
+  // ── WebSocket 帧解析 ─────────────────────────────────────────────────────
+  // 在裸 TCP 层面解析 WebSocket 帧，拦截 Ping (0x9) 自动回复 Pong (0xA)，
+  // 其余帧原样转发。DSH API Gateway 每 2s 发 Ping，2 次没 Pong 就 terminate。
+  _processWsFrames(wsId, buf, sock) {
+    while (buf.length >= 2) {
+      const b0 = buf[0];
+      const b1 = buf[1];
+      const opcode = b0 & 0x0f;
+      const masked = b1 & 0x80;
+      let payloadLen = b1 & 0x7f;
+      let offset = 2;
+
+      if (payloadLen === 126) {
+        if (buf.length < 4) break;
+        payloadLen = buf.readUInt16BE(2);
+        offset = 4;
+      } else if (payloadLen === 127) {
+        if (buf.length < 10) break;
+        payloadLen = Number(buf.readBigUInt64BE(2));
+        offset = 10;
+      }
+      if (masked) offset += 4;
+      if (buf.length < offset + payloadLen) break;
+
+      const frameEnd = offset + payloadLen;
+      const frameBytes = buf.subarray(0, frameEnd);
+
+      if (opcode === 0x9) {
+        // Ping → 自动回复 Pong（同 payload，必须 mask，因为这是 client→server 方向）
+        // WebSocket 协议规定客户端→服务端的帧必须加 mask，否则服务端 ws 库会判定
+        // 协议错误（1002）并关闭连接。
+        const payload = buf.subarray(offset, frameEnd);
+        const mask = cryptoRandomBytes(4);
+        const maskedPayload = Buffer.alloc(payload.length);
+        for (let i = 0; i < payload.length; i++) {
+          maskedPayload[i] = payload[i] ^ mask[i % 4];
+        }
+        if (payload.length < 126) {
+          const hdr = Buffer.alloc(6);
+          hdr[0] = 0x8a; // fin + opcode 0xA (pong)
+          hdr[1] = 0x80 | payload.length; // masked + length
+          mask.copy(hdr, 2);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        } else if (payload.length < 65536) {
+          const hdr = Buffer.alloc(8);
+          hdr[0] = 0x8a; hdr[1] = 0x80 | 126;
+          hdr.writeUInt16BE(payload.length, 2);
+          mask.copy(hdr, 4);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        } else {
+          const hdr = Buffer.alloc(14);
+          hdr[0] = 0x8a; hdr[1] = 0x80 | 127;
+          hdr.writeBigUInt64BE(BigInt(payload.length), 2);
+          mask.copy(hdr, 10);
+          sock.write(Buffer.concat([hdr, maskedPayload]));
+        }
+      } else {
+        this._sendMessage({ type: 'ws-frame', wsId, data: frameBytes.toString('base64') });
+      }
+      buf = buf.subarray(frameEnd);
+    }
+    return buf;
+  }
+
   _handleWsFrame(msg) {
     const sock = this.localWsSockets.get(msg.wsId);
     if (sock && !sock.destroyed) sock.write(Buffer.from(msg.data, 'base64'));

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@wenbin_wb/dsh-bridge",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "description": "手机扫码即可在移动端/公网继续用 DeepSeek Harness，人不在电脑前也能接着干。一键局域网二维码、Cloudflare 公网隧道、自建隧道与微信 / QQ / 飞书 / Telegram Bot（多工作区/会话持久化/媒体/卡片审批/流式输出），无需自己搭公网服务器。",
-  "releaseNotes": "【v2.10.3】\n• 兼容 DSH 原生端口 3080 直连（issue #28）：本机直连不再被误判为远程而锁定，走代理与直连行为一致\n• 安全：AI [SEND_FILE] 仅允许发送工作目录内文件，拦截 .ssh/.credentials/.env 等敏感路径\n• 修复：代理响应头透传、QQ 流式重复发送、微信轮询竞态（iLink 403）、飞书群聊审批按钮误拦\n• 会话列表/历史大字段剥离覆盖局域网与 Cloudflare 等全部公网入口",
+  "releaseNotes": "【v2.10.4】\n• 修复：全新安装（未设置任何密码）时远程访问被误锁，需输入『管理密码』（任意输入皆可通过）才可进入——现无密码时远程免锁直进，并明确提示先设置访问密码\n• 修复：Telegram 代理在 Node ≥ 24 下不生效（createConnection 构造参数被忽略，改为构造后赋值）\n• 修复：移动端点击 workspace 分组名误关抽屉、自建隧道 gzip 会话剥离失效、目录弹窗深色模式适配\n• 新功能：自建隧道 SSE 流式传输 + WebSocket Ping/Pong 保活；远程/移动端禁用下拉刷新防误触",
   "type": "module",
   "main": "lib/index.js",
   "exports": {