@wenbin_wb/dsh-bridge 2.8.5 → 2.8.7

package/lib/bridge-rpc-constants.js

@@ -12,6 +12,7 @@ export const BRIDGE_ENDPOINTS = {
   saveCloudflaredConfig: 'saveCloudflaredConfig',
   setTunnelAutoStart: 'setTunnelAutoStart',
   saveCustomTunnelConfig: 'saveCustomTunnelConfig',
+  setLanIp: 'setLanIp',
   checkVersion: 'checkVersion',
   upgradePlugin: 'upgradePlugin',
   restartDsh: 'restartDsh',

package/lib/bridge-rpc.js

@@ -167,6 +167,15 @@ export function installBridgeRpc(ctx, { service, authManager, wechat, platformMa
           return ok(status);
         }
 
+        if (endpoint === BRIDGE_ENDPOINTS.setLanIp) {
+          const adminErr = checkAdminAuth(authManager, payload);
+          if (adminErr) return adminErr;
+
+          const { ip } = payload;
+          const status = await service.setLanIp({ ip });
+          return ok(status);
+        }
+
         if (endpoint === BRIDGE_ENDPOINTS.startCustomTunnel) {
           const adminErr = checkAdminAuth(authManager, payload);
           if (adminErr) return adminErr;

package/lib/cloudflared-manager.mjs

@@ -1,7 +1,5 @@
-// DSH Bridge - Cloudflared Manager
-
-import { spawn } from 'node:child_process';
-import { createWriteStream, existsSync, mkdirSync } from 'node:fs';
+import { spawn, execSync } from 'node:child_process';
+import { createWriteStream, existsSync, mkdirSync, readFileSync } from 'node:fs';
 import { chmod, stat, unlink, rename } from 'node:fs/promises';
 import { homedir, platform, arch } from 'node:os';
 import { join } from 'node:path';
@@ -73,6 +71,27 @@ async function downloadFile(url, dest, onProgress) {
   });
 }
 
+function findSystemCloudflared() {
+  const isWin = platform() === 'win32';
+  const candidates = [];
+  if (isWin) {
+    candidates.push('cloudflared.exe', 'cloudflared', 'C:\\Program Files (x86)\\cloudflared\\cloudflared.exe', 'C:\\Program Files\\cloudflared\\cloudflared.exe');
+  } else {
+    candidates.push('cloudflared', '/opt/homebrew/bin/cloudflared', '/usr/local/bin/cloudflared', '/usr/bin/cloudflared', '/bin/cloudflared');
+  }
+
+  for (const bin of candidates) {
+    try {
+      if (bin.includes('/') || bin.includes('\\')) {
+        if (!existsSync(bin)) continue;
+      }
+      execSync(`"${bin}" --version`, { stdio: 'ignore', timeout: 3000 });
+      return bin;
+    } catch {}
+  }
+  return null;
+}
+
 export class CloudflaredManager {
   constructor({ port, home, token, hostname, onStateChange, logger }) {
     this.port = port;
@@ -104,19 +123,47 @@ export class CloudflaredManager {
   }
 
   async _ensureBinary() {
+    // 1. 优先使用系统环境变量或 Homebrew / 包管理器已安装的全局二进制
+    const systemBin = findSystemCloudflared();
+    if (systemBin) {
+      this.binaryPath = systemBin;
+      this.logger?.info('优先使用系统全局 cloudflared: %s', systemBin);
+      return;
+    }
+
     const { url, name } = getCloudflaredInfo();
     const binDir = join(this.home, 'bin');
     const binPath = join(binDir, name);
     this.binaryPath = binPath;
 
+    // 2. 检查本地 ~/.dsh-bridge/bin/cloudflared 是否已存在且可用
     if (existsSync(binPath)) {
       try {
         const s = await stat(binPath);
         if (s.size > MIN_BINARY_SIZE) { // >5MB 才视为有效二进制
-          this.logger?.info('cloudflared 已存在: %s', binPath);
-          return;
+          // 检查是否为历史残留未解压的 gzip 压缩包 (0x1f 0x8b)
+          const fd = readFileSync(binPath);
+          const isGzip = fd.length >= 2 && fd[0] === 0x1f && fd[1] === 0x8b;
+          if (isGzip) {
+            this.logger?.warn('检测到历史残留的未解压 cloudflared.tgz 压缩包，正在清理重新准备...');
+            await unlink(binPath).catch(() => {});
+          } else {
+            // macOS / Linux 赋予可执行权限并清除 Gatekeeper 隔离属性
+            if (platform() !== 'win32') {
+              await chmod(binPath, 0o755).catch(() => {});
+              if (platform() === 'darwin') {
+                try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+              }
+            }
+            // 执行一次 --version 验证是否能正常 spawn
+            execSync(`"${binPath}" --version`, { stdio: 'ignore', timeout: 3000 });
+            this.logger?.info('cloudflared 已存在且验证通过: %s', binPath);
+            return;
+          }
         }
-      } catch {}
+      } catch (verifyErr) {
+        this.logger?.warn('现有 cloudflared 二进制验证失败 (%s)，准备重新下载', verifyErr.message);
+      }
       // 损坏文件，删掉重下
       await unlink(binPath).catch(() => {});
     }
@@ -135,16 +182,32 @@ export class CloudflaredManager {
         this._setState('downloading', `下载 cloudflared: ${mb}/${totalMb} MB (${percent}%)`);
       });
 
-      if (existsSync(binPath)) await unlink(binPath).catch(() => {});
-      await rename(tempPath, binPath);
+      if (url.endsWith('.tgz') || url.endsWith('.tar.gz')) {
+        try {
+          execSync(`tar -xzf "${tempPath}" -C "${binDir}"`);
+          await unlink(tempPath).catch(() => {});
+        } catch (tarErr) {
+          this.logger?.error('解压 cloudflared 压缩包失败: %s', tarErr.message);
+          throw new Error(`解压 cloudflared 失败: ${tarErr.message}`);
+        }
+      } else {
+        if (existsSync(binPath)) await unlink(binPath).catch(() => {});
+        await rename(tempPath, binPath);
+      }
 
       if (platform() !== 'win32') {
-        await chmod(binPath, 0o755);
+        await chmod(binPath, 0o755).catch(() => {});
+        if (platform() === 'darwin') {
+          try { execSync(`xattr -d com.apple.quarantine "${binPath}"`, { stdio: 'ignore' }); } catch {}
+        }
       }
-      this.logger?.info('cloudflared 下载完成');
+
+      // 执行 --version 最终确认
+      execSync(`"${binPath}" --version`, { stdio: 'ignore', timeout: 3000 });
+      this.logger?.info('cloudflared 下载并准备完成');
     } catch (err) {
       await unlink(tempPath).catch(() => {});
-      throw new Error(`下载失败: ${err.message}`);
+      throw new Error(`准备 cloudflared 失败: ${err.message}`);
     }
   }
 

package/lib/index.js

@@ -10,9 +10,10 @@ import { get as httpsGet } from 'node:https';
 import { networkInterfaces, homedir, totalmem, freemem, cpus, loadavg, platform, arch, release, hostname, uptime } from 'node:os';
 import { join, dirname, basename, resolve, normalize } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import { readFile, writeFile, mkdir, unlink, readdir, stat, access } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
+import { createHash, createHmac } from 'node:crypto';
 import QRCode from 'qrcode';
 import { installBridgeRpc } from './bridge-rpc.js';
 import { CustomTunnelClient } from './tunnel-client.mjs';
@@ -34,40 +35,67 @@ const inject = ['connection', 'webServer', 'sessions', 'agents', 'approval', 'wo
 const PACKAGE_JSON = JSON.parse(readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8'));
 const VERSION = PACKAGE_JSON.version ?? '0.0.0';
 
+const VIRTUAL_KEYWORDS = [
+  'vethernet', 'wsl', 'hyper-v', 'virtual', 'vmware', 'vbox', 'docker',
+  'tailscale', 'zerotier', 'tap', 'tun', 'utun', 'wireguard', 'loopback', 'bridge',
+];
+
 /**
- * 选择最佳局域网 IP
+ * 列出所有可用的局域网 IPv4 网卡与 IP 地址（按推荐优先级排序）
  */
-function selectLanIPv4() {
+function listAllLanIPv4() {
   const interfaces = networkInterfaces();
-  let best = null;
-  let bestScore = -1;
+  const list = [];
 
   for (const [ifname, addrs] of Object.entries(interfaces)) {
     if (!addrs) continue;
+    const lower = ifname.toLowerCase();
+    const isVirtual = VIRTUAL_KEYWORDS.some((kw) => lower.includes(kw));
 
     for (const addr of addrs) {
       if (addr.family !== 'IPv4' || addr.internal) continue;
 
       let score = 0;
+      // 1. IP 网段优先（家庭/企业物理局域网最常用网段）
       if (addr.address.startsWith('192.168.')) score += 100;
       else if (addr.address.startsWith('10.')) score += 90;
-      else if (addr.address.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./)) score += 90;
-
-      const lower = ifname.toLowerCase();
-      if (!lower.includes('virtual')) score += 50;
-      if (!lower.includes('vmware')) score += 50;
-      if (!lower.includes('vbox')) score += 50;
-      if (lower.includes('eth')) score += 20;
-      else if (lower.includes('en')) score += 10;
-
-      if (score > bestScore) {
-        bestScore = score;
-        best = addr.address;
+      else if (addr.address.match(/^172\.(1[6-9]|2[0-9]|3[0-1])\./)) score += 70;
+      else score += 10;
+
+      // 2. 物理网卡与名称特征优先
+      if (isVirtual) {
+        score -= 200; // 虚拟网卡大幅降权
+      } else {
+        score += 100;
+        if (lower.includes('wi-fi') || lower.includes('wlan') || lower.includes('wireless')) score += 50;
+        else if (lower.includes('ethernet') || lower.includes('以太网') || lower.includes('eth') || lower.includes('en')) score += 40;
       }
+
+      let label = ifname;
+      if (lower.includes('wi-fi') || lower.includes('wlan') || lower.includes('wireless')) label += ' (Wi-Fi 无线网卡)';
+      else if (lower.includes('ethernet') || lower.includes('以太网') || lower.includes('eth') || lower.includes('en')) label += ' (有线网卡)';
+      else if (isVirtual) label += ' (虚拟网卡 / WSL / 虚拟机)';
+
+      list.push({
+        name: ifname,
+        label,
+        address: addr.address,
+        netmask: addr.netmask,
+        isVirtual,
+        score,
+      });
     }
   }
 
-  return best;
+  return list.sort((a, b) => b.score - a.score);
+}
+
+/**
+ * 选择最佳默认局域网 IP
+ */
+function selectLanIPv4() {
+  const list = listAllLanIPv4();
+  return list[0]?.address || null;
 }
 
 /**
@@ -161,6 +189,37 @@ function isCompressed(headers) {
   return /(^|,\s*)(gzip|br|deflate)(\s*,|$)/i.test(String(headers['content-encoding'] ?? ''));
 }
 
+function encodeBase64Url(value) {
+  return Buffer.from(value).toString('base64url');
+}
+
+/**
+ * 读取 DSH 本地凭证并生成 loopback dsh-auth 认证签名 Cookie (适配 DSH 新版原生认证)
+ */
+function getDshLoopbackCookie(targetPort) {
+  try {
+    const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh');
+    const credPath = join(dshHome, '.credentials.yaml');
+    if (!existsSync(credPath)) return '';
+    const content = readFileSync(credPath, 'utf8');
+    const match = content.match(/secret:\s*([A-Za-z0-9_-]+)/);
+    if (!match) return '';
+    const secret = Buffer.from(match[1], 'base64url');
+
+    const authority = `127.0.0.1:${targetPort}`;
+    const name = 'dsh-auth-' + encodeBase64Url(createHash('sha256').update(authority).digest());
+    const issuedAt = Date.now() - 1000;
+    const expiresAt = issuedAt + 30 * 24 * 3600 * 1000;
+    const body = encodeBase64Url(Buffer.from(JSON.stringify({
+      version: 1, authority, issuedAt, expiresAt,
+    }), 'utf8'));
+    const sig = encodeBase64Url(createHmac('sha256', secret).update(body).digest());
+    return `${name}=v1.${body}.${sig}`;
+  } catch {
+    return '';
+  }
+}
+
 /** 把请求头中的 Host 和 Origin 改写成 loopback，让 DSH 的安全栅栏放行 */
 function loopbackHeaders(headers, targetPort) {
   const authority = `127.0.0.1:${targetPort}`;
@@ -168,6 +227,19 @@ function loopbackHeaders(headers, targetPort) {
   out['host'] = authority;
   if (out['origin']) out['origin'] = `http://${authority}`;
   if (out['Origin']) out['Origin'] = `http://${authority}`;
+
+  // 1. 注入 DSH 本地认证签名（若有）
+  const dshCookie = getDshLoopbackCookie(targetPort);
+  if (dshCookie) {
+    const existing = out['cookie'] || out['Cookie'] || '';
+    out['cookie'] = existing ? `${existing}; ${dshCookie}` : dshCookie;
+    delete out['Cookie'];
+  }
+
+  // 2. 禁用内部代理流量压缩，确保代理层拿到未压缩 HTML 以稳定注入 ownsHost 和 Polyfill
+  delete out['accept-encoding'];
+  delete out['Accept-Encoding'];
+
   return out;
 }
 
@@ -453,12 +525,13 @@ class ProxyServer {
  * Bridge Service
  */
 class BridgeService {
-  constructor({ dshPort, proxyPort, home, cloudflaredConfig, customTunnelConfig, authManager, onPersist, logger }) {
+  constructor({ dshPort, proxyPort, home, cloudflaredConfig, customTunnelConfig, lanConfig, authManager, onPersist, logger }) {
     this.dshPort = dshPort;
     this.proxyPort = proxyPort;
     this.home = home;
     this.cloudflaredConfig = cloudflaredConfig ?? { token: '', hostname: '', autoStart: false };
     this.customTunnelConfig = customTunnelConfig ?? null;
+    this.selectedLanIp = lanConfig?.selectedIp ?? null;
     this.authManager = authManager ?? null;
     this.onPersist = onPersist ?? null;
     this.logger = logger;
@@ -473,6 +546,14 @@ class BridgeService {
     this.cloudflaredState = { phase: 'idle', detail: '' };
   }
 
+  async setLanIp({ ip } = {}) {
+    const trimmed = ip ? String(ip).trim() : null;
+    this.selectedLanIp = trimmed || null;
+    await this.onPersist?.({ lan: { selectedIp: this.selectedLanIp } });
+    this.logger?.info('局域网选定 IP 更新为: %s', this.selectedLanIp || '自动推荐');
+    return this.getStatus();
+  }
+
   async startProxy() {
     if (this.proxy) return this.proxy;
 
@@ -488,7 +569,9 @@ class BridgeService {
   }
 
   async getStatus({ adminAuthValid = false } = {}) {
-    const lanIp = selectLanIPv4();
+    const allInterfaces = listAllLanIPv4();
+    const isSelectedValid = Boolean(this.selectedLanIp && allInterfaces.some(i => i.address === this.selectedLanIp));
+    const lanIp = isSelectedValid ? this.selectedLanIp : selectLanIPv4();
     const token = adminAuthValid ? this.authManager?.secretToken : null;
     const isAuthEnabled = Boolean(this.authManager?.enabled && this.authManager?.mode !== 'password_only' && token);
 
@@ -529,6 +612,8 @@ class BridgeService {
 
       lan: {
         ip: lanIp,
+        selectedIp: this.selectedLanIp || '',
+        interfaces: allInterfaces,
         url: lanUrl,
         rawUrl: baseLanUrl,
         qr: lanUrl ? await this.qrCache.get(lanUrl) : null,
@@ -742,10 +827,40 @@ class BridgeService {
     const pkgSpec = `@wenbin_wb/dsh-bridge@${targetVersion}`;
     const isWin = process.platform === 'win32';
 
+    // 自动构建包含 Homebrew / NVM / Node 兄弟目录的全量 PATH 环境变量
+    const nodeDir = dirname(process.execPath);
+    const home = homedir();
+    const extraPaths = isWin ? [
+      nodeDir,
+    ] : [
+      nodeDir,
+      '/opt/homebrew/bin',
+      '/opt/homebrew/sbin',
+      '/usr/local/bin',
+      '/usr/bin',
+      '/bin',
+      join(home, '.nvm/current/bin'),
+      join(home, '.fnm/current/bin'),
+      join(home, '.local/bin'),
+      join(home, '.cargo/bin'),
+    ];
+
+    const separator = isWin ? ';' : ':';
+    const existingPath = process.env.PATH || process.env.Path || '';
+    const augmentedEnv = {
+      ...process.env,
+      PATH: [...extraPaths, existingPath].filter(Boolean).join(separator),
+    };
+    if (isWin) augmentedEnv.Path = augmentedEnv.PATH;
+
+    // 寻找与当前 node 配对的 npm/npx 绝对路径
+    const siblingNpm = join(nodeDir, isWin ? 'npm.cmd' : 'npm');
+    const siblingNpx = join(nodeDir, isWin ? 'npx.cmd' : 'npx');
+
     const tasks = [
       { cmd: 'dsh', args: ['plugin', '--profile', 'web', 'add', pkgSpec] },
-      { cmd: 'npx', args: ['--yes', '@deepseek-ai/dsh', 'plugin', '--profile', 'web', 'add', pkgSpec] },
-      { cmd: 'npm', args: ['install', pkgSpec] },
+      { cmd: existsSync(siblingNpx) ? siblingNpx : 'npx', args: ['--yes', '@deepseek-ai/dsh', 'plugin', '--profile', 'web', 'add', pkgSpec] },
+      { cmd: existsSync(siblingNpm) ? siblingNpm : 'npm', args: ['install', pkgSpec] },
     ];
 
     let lastError = null;
@@ -757,7 +872,8 @@ class BridgeService {
           try {
             cp = spawn(task.cmd, task.args, {
               windowsHide: true,
-              shell: isWin ? true : false,
+              shell: true,
+              env: augmentedEnv,
               timeout: 120000,
             });
           } catch (spawnErr) {
@@ -1254,7 +1370,7 @@ class BridgeService {
  */
 function apply(ctx, config = {}) {
   const logger = ctx.logger(name);
-  const dshPort = ctx.webServer.port;
+  const dshPort = ctx.webServer?.port ?? config.targetPort ?? 3080;
 
   if (!dshPort) {
     logger.error('webServer port unavailable');
@@ -1344,6 +1460,7 @@ function apply(ctx, config = {}) {
     home: config.home,
     customTunnelConfig: config.customTunnel ?? null,
     cloudflaredConfig: config.cloudflared ?? null,
+    lanConfig: config.lan ?? null,
     authManager,
     onPersist: async (patch) => {
       const stored = await loadConfig();
@@ -1353,8 +1470,12 @@ function apply(ctx, config = {}) {
     logger,
   });
 
-  // 启动时读取已保存的公网隧道配置并按需自动拉起
+  // 启动时读取已保存的局域网网卡配置与公网隧道配置并按需自动拉起
   loadConfig().then(async (stored) => {
+    if (stored?.lan?.selectedIp) {
+      service.selectedLanIp = stored.lan.selectedIp;
+      logger.info('dsh-bridge: loaded saved lan config (selectedIp=%s)', service.selectedLanIp);
+    }
     if (stored?.cloudflared) {
       service.cloudflaredConfig = stored.cloudflared;
       logger.info('dsh-bridge: loaded saved cloudflared config (autoStart=%s, tokenConfigured=%s)', Boolean(service.cloudflaredConfig.autoStart), Boolean(service.cloudflaredConfig.token));
@@ -1680,4 +1801,4 @@ function apply(ctx, config = {}) {
   }, 'dsh-bridge: stop wechat, qq, feishu, telegram, proxy, auth and tunnels');
 }
 
-export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4 };
+export { name, inject, apply, ProxyServer, BridgeService, selectLanIPv4, listAllLanIPv4 };