@yezack/dsh-remote-mobile 1.10.0 → 1.10.2

package/lib/routes/api.js

@@ -1,9 +1,11 @@
+import { isIP } from 'node:net';
 import { AUTH_COOKIE_NAME, readGlobalLocale } from '../auth/token.js';
 import { getLocalTailscaleIp, getLocalLanIp, getAllNetworkIps, getClientIp, isTailscaleIp, isLanIp } from '../auth/tailscale.js';
 import { getPublicKeyPem, decryptWithPrivateKey, validateSecretStrength, RSA_KEY_FILE } from '../auth/crypto.js';
 import { getLoginPageHtml } from './login-page.js';
 import { DEFAULT_STYLE_FILE } from '../styles/style-snippets.js';
 import { getPairingBridgeState } from '../bridge/compat.js';
+import { getDirectoryPickerStatus, enableDirectoryPickerBrowse, disableDirectoryPickerBrowse, } from '../bridge/directory-picker.js';
 import { resolveRedirectPath } from '../auth/prefix.js';
 function jsonResponse(res, status, data) {
     res.writeHead(status, {
@@ -37,10 +39,11 @@ function parseJsonBody(req) {
         req.on('error', () => resolve({}));
     });
 }
-export function createRoutes(store, styleStore) {
+export function createRoutes(store, styleStore, routeOptions) {
     return [
         // 0. RSA 公钥获取接口 (RSA-OAEP-SHA256)
         {
+            kind: 'exact',
             method: 'GET',
             path: '/api/remote-mobile/public-key',
             handler: async (_req, res) => {
@@ -53,6 +56,7 @@ export function createRoutes(store, styleStore) {
         },
         // 1. 状态查询接口 (返回 Tailscale IP、局域网 LAN IP 与 IP 防暴破安全统计)
         {
+            kind: 'exact',
             method: 'GET',
             path: '/api/remote-mobile/status',
             handler: async (_req, res) => {
@@ -86,17 +90,23 @@ export function createRoutes(store, styleStore) {
                     pairingBridgeMode: bridgeState.mode,
                     pairingBridgeConflict: bridgeState.conflictWith || '',
                     pairingBridgeConflictId: bridgeState.conflictEntryId || '',
-                    // 独立安全网关运行状态
-                    gateway: {
+                    // 目录选择器（移动端添加工作区/选择文件夹）状态与补丁信息
+                    directoryPicker: getDirectoryPickerStatus(routeOptions?.patchFilePath),
+                    // 安全接入代理运行状态
+                    proxy: {
                         ...store.getGatewayStatus(),
                         activePort: store.getActivePort(),
-                        gatewayPort: opts.gatewayPort || 3081,
+                        configuredMode: opts.mode,
+                        proxyPort: opts.proxyPort || 3081,
+                        proxyHost: opts.proxyHost || '0.0.0.0',
+                        trustedHosts: opts.trustedHosts,
                     },
                 });
             },
         },
         // 2. 生成 6 位短期配对码
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/generate-code',
             handler: async (_req, res) => {
@@ -110,6 +120,7 @@ export function createRoutes(store, styleStore) {
         },
         // 3. 手机端验证与换取长效 Cookie (支持 RSA-OAEP 密文解密 + 防暴力破解 429 拦截)
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/verify',
             handler: async (req, res) => {
@@ -149,6 +160,7 @@ export function createRoutes(store, styleStore) {
         },
         // 3.1 手动解除某个 IP 的防暴破锁定
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/unlock-ip',
             handler: async (req, res) => {
@@ -160,6 +172,7 @@ export function createRoutes(store, styleStore) {
         },
         // 3.2 一键清空所有 IP 访问与安全审计日志
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/clear-ip-stats',
             handler: async (_req, res) => {
@@ -169,6 +182,7 @@ export function createRoutes(store, styleStore) {
         },
         // 4. 切换 Tailscale / 局域网免密直连开关
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/toggle-bypass',
             handler: async (req, res) => {
@@ -193,11 +207,46 @@ export function createRoutes(store, styleStore) {
             },
         },
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/update-options',
             handler: async (req, res) => {
                 const body = await parseJsonBody(req);
                 const updates = {};
+                if (body.mode !== undefined) {
+                    if (body.mode !== 'proxy' && body.mode !== 'direct') {
+                        return jsonResponse(res, 400, { success: false, reason: 'mode 必须为 proxy 或 direct' });
+                    }
+                    updates.mode = body.mode;
+                }
+                if (body.proxyPort !== undefined) {
+                    const port = Number(body.proxyPort);
+                    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                        return jsonResponse(res, 400, { success: false, reason: 'proxyPort 必须是 1-65535 的整数' });
+                    }
+                    updates.proxyPort = port;
+                }
+                if (body.proxyHost !== undefined) {
+                    const host = String(body.proxyHost || '').trim();
+                    const bareHost = host.replace(/^\[/, '').replace(/\]$/, '');
+                    if (!host || host.length > 255 || (bareHost !== 'localhost' && isIP(bareHost) === 0)) {
+                        return jsonResponse(res, 400, { success: false, reason: 'proxyHost 必须是有效 IP 地址或 localhost' });
+                    }
+                    updates.proxyHost = host;
+                }
+                if (body.trustedHosts !== undefined) {
+                    if (!Array.isArray(body.trustedHosts)) {
+                        return jsonResponse(res, 400, { success: false, reason: 'trustedHosts 必须是字符串数组' });
+                    }
+                    const hosts = body.trustedHosts
+                        .filter((h) => typeof h === 'string')
+                        .map((h) => h.trim())
+                        .filter(Boolean);
+                    if (hosts.some((h) => h.length > 255 || /[\s]/.test(h))) {
+                        return jsonResponse(res, 400, { success: false, reason: 'trustedHosts 中包含无效域名' });
+                    }
+                    updates.trustedHosts = Array.from(new Set(hosts));
+                }
                 if (typeof body.allowTailscale === 'boolean') {
                     updates.allowTailscale = body.allowTailscale;
                 }
@@ -216,6 +265,10 @@ export function createRoutes(store, styleStore) {
                 if (typeof body.lockDurationMs === 'number' && body.lockDurationMs > 0) {
                     updates.lockDurationMs = Math.floor(body.lockDurationMs);
                 }
+                const restartRequired = updates.mode !== undefined ||
+                    updates.proxyPort !== undefined ||
+                    updates.proxyHost !== undefined ||
+                    updates.trustedHosts !== undefined;
                 store.updateOptions(updates);
                 const opts = store.getOptions();
                 jsonResponse(res, 200, {
@@ -225,11 +278,19 @@ export function createRoutes(store, styleStore) {
                     maxVisitsPerMinute: opts.maxVisitsPerMinute,
                     maxFailedAttempts: opts.maxFailedAttempts,
                     lockDurationMs: opts.lockDurationMs,
+                    mode: opts.mode,
+                    proxyPort: opts.proxyPort,
+                    proxyHost: opts.proxyHost,
+                    trustedHosts: opts.trustedHosts,
+                    activeMode: store.getActiveMode(),
+                    activePort: store.getActivePort(),
+                    restartRequired,
                 });
             },
         },
         // 5. 设置并持久化长期访问密码 (支持 RSA 密文 + 6位以上字母数字复杂度校验)
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/set-secret',
             handler: async (req, res) => {
@@ -255,6 +316,7 @@ export function createRoutes(store, styleStore) {
         },
         // 5.1 清除长期访问密码
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/clear-secret',
             handler: async (_req, res) => {
@@ -264,6 +326,7 @@ export function createRoutes(store, styleStore) {
         },
         // 6. 撤销单个设备授权
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/revoke-device',
             handler: async (req, res) => {
@@ -275,6 +338,7 @@ export function createRoutes(store, styleStore) {
         },
         // 7. 一键撤销所有设备
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/revoke-all',
             handler: async (_req, res) => {
@@ -284,6 +348,7 @@ export function createRoutes(store, styleStore) {
         },
         // 8. 独立手机登录引导页面（已授权或 Tailscale/局域网免密设备访问时自动 302 跳转回工作区，支持 IP 访问计数与限频）
         {
+            kind: 'exact',
             method: 'GET',
             path: '/auth',
             handler: async (req, res) => {
@@ -328,6 +393,7 @@ export function createRoutes(store, styleStore) {
         },
         // 9. SSE 实时事件监听通道 (Server-Sent Events 0延时推送，彻底告别轮询)
         {
+            kind: 'exact',
             method: 'GET',
             path: '/api/remote-mobile/events',
             handler: async (req, res) => {
@@ -385,6 +451,7 @@ export function createRoutes(store, styleStore) {
         },
         // 10. 移动端样式片段（样式小插件）管理 API（合并 GET 与 POST 处理，避免 webserver.register 重复 path 冲突）
         {
+            kind: 'exact',
             path: '/api/remote-mobile/styles',
             handler: async (req, res) => {
                 if (!styleStore) {
@@ -422,6 +489,7 @@ export function createRoutes(store, styleStore) {
             },
         },
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/styles/toggle',
             handler: async (req, res) => {
@@ -435,6 +503,7 @@ export function createRoutes(store, styleStore) {
             },
         },
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/styles/delete',
             handler: async (req, res) => {
@@ -447,6 +516,7 @@ export function createRoutes(store, styleStore) {
             },
         },
         {
+            kind: 'exact',
             method: 'POST',
             path: '/api/remote-mobile/styles/reset',
             handler: async (_req, res) => {
@@ -457,5 +527,44 @@ export function createRoutes(store, styleStore) {
                 jsonResponse(res, 200, { success: true, snippets: styleStore.list() });
             },
         },
+        // 11. 移动端网页目录选择器（browse 模式）一键开启与还原（严格幂等去重写入 cordis.patch.yml）
+        {
+            kind: 'exact',
+            method: 'POST',
+            path: '/api/remote-mobile/directory-picker',
+            handler: async (req, res) => {
+                const body = await parseJsonBody(req);
+                if (typeof body.enabled !== 'boolean') {
+                    return jsonResponse(res, 400, {
+                        success: false,
+                        reason: 'enabled 必须为布尔值 (true 开启网页目录选择器 / false 恢复原生目录选择器)',
+                    });
+                }
+                try {
+                    const result = body.enabled
+                        ? enableDirectoryPickerBrowse(routeOptions?.patchFilePath)
+                        : disableDirectoryPickerBrowse(routeOptions?.patchFilePath);
+                    return jsonResponse(res, 200, {
+                        success: true,
+                        changed: result.changed,
+                        directoryPicker: {
+                            patchEnabled: result.patchEnabled,
+                            patchPartial: result.patchPartial,
+                            runtimeActive: result.runtimeActive,
+                            restartRequired: result.restartRequired,
+                            needsWarning: result.needsWarning,
+                            patchFilePath: result.patchFilePath,
+                            yamlSnippet: result.yamlSnippet,
+                        },
+                    });
+                }
+                catch (err) {
+                    return jsonResponse(res, 500, {
+                        success: false,
+                        reason: err?.message || '写入 cordis.patch.yml 失败',
+                    });
+                }
+            },
+        },
     ];
 }

package/lib/routes/login-page.js

@@ -11,10 +11,13 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
         headerDesc: isEn ? 'Enter 6-digit dynamic pairing code or persistent password' : '请输入 6 位动态配对码或长期访问密码',
         placeholder: isEn ? '6-digit code or password' : '6 位临时配对码 / 长期密码',
         submitBtn: isEn ? 'Authorize & Connect' : '立即授权连接',
-        footerSecurity: isEn ? '🔒 Protected by 2048-bit RSA encryption' : '🔒 全程受 2048 位 RSA 加密保护',
+        footerSecurity: isEn ? '🔒 Login credentials encrypted with 2048-bit RSA' : '🔒 登录凭证使用 2048 位 RSA 加密',
         verifying: isEn ? '🔐 Encrypting & verifying...' : '🔐 正在 RSA 加密与验证...',
         success: isEn ? 'Authorization successful! Entering workspace...' : '授权成功！正在进入工作区...',
         networkErr: isEn ? 'Network connection error, please try again' : '网络连接异常，请检查网络',
+        cryptoErr: isEn
+            ? 'Secure encryption is unavailable. Refresh the page or use another browser.'
+            : '当前环境无法安全加密，请刷新页面或更换浏览器。',
     };
     return `<!DOCTYPE html>
 <html lang="${isEn ? 'en' : 'zh-CN'}">
@@ -321,7 +324,8 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
         return { encryptedCredential: pureB64 };
       } catch (err) {
         console.error('RSA encrypt error:', err);
-        return { credential: plainText };
+        // 加密失败时绝不回退明文；调用方会提示用户更换浏览器或刷新页面。
+        throw new Error('ENCRYPTION_UNAVAILABLE');
       }
     }
 
@@ -338,10 +342,6 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
         if (document.baseURI && document.querySelector('base')) {
           return new URL('api/remote-mobile/verify', document.baseURI).toString();
         }
-        // 用 new RegExp 显式构造正则：字符串里不含反斜杠，杜绝外层模板字符串
-        // 把转义吃掉后拼出「两条斜杠开头的行注释」，进而使整段内联脚本
-        // SyntaxError（历史上曾因此完全无法登录，见 CHANGELOG 1.9.1 / 1.10.0）。
-        // 下两处同理。
         const pathname = window.location.pathname.replace(new RegExp('/auth/?$'), '/');
         return new URL('api/remote-mobile/verify', window.location.origin + pathname).toString();
       } catch (e) {
@@ -407,7 +407,9 @@ export function getLoginPageHtml(publicKeyPem, lang = 'zh') {
         }
       } catch (err) {
         statusMsg.className = 'status-msg error';
-        statusMsg.innerText = ${JSON.stringify(i18n.networkErr)};
+        statusMsg.innerText = err && err.message === 'ENCRYPTION_UNAVAILABLE'
+          ? ${JSON.stringify(i18n.cryptoErr)}
+          : ${JSON.stringify(i18n.networkErr)};
         statusMsg.style.display = 'block';
         submitBtn.disabled = false;
         submitBtn.innerText = ${JSON.stringify(i18n.submitBtn)};

package/lib/routes/register.d.ts

@@ -0,0 +1,9 @@
+import type { WebRoute } from './api.js';
+/**
+ * 将插件路由注册到 DSH WebServer。
+ *
+ * DSH 0.2.1+ 的 `register(route)` 返回一个撤销函数。这里统一收集这些函数，
+ * 并通过 Cordis `ctx.effect` 绑定到插件生命周期，避免插件重复激活时旧路由
+ * 残留导致 `duplicate undefined route`。
+ */
+export declare function registerWebRoutes(ctx: any, routes: WebRoute[]): void;

package/lib/routes/register.js

@@ -0,0 +1,53 @@
+/**
+ * 将插件路由注册到 DSH WebServer。
+ *
+ * DSH 0.2.1+ 的 `register(route)` 返回一个撤销函数。这里统一收集这些函数，
+ * 并通过 Cordis `ctx.effect` 绑定到插件生命周期，避免插件重复激活时旧路由
+ * 残留导致 `duplicate undefined route`。
+ */
+export function registerWebRoutes(ctx, routes) {
+    const webServer = ctx?.webServer;
+    if (!webServer || typeof webServer.register !== 'function')
+        return;
+    const registerAll = () => {
+        const disposers = [];
+        try {
+            for (const route of routes) {
+                const dispose = webServer.register({
+                    ...route,
+                    kind: route.kind ?? 'exact',
+                });
+                if (typeof dispose === 'function') {
+                    disposers.push(dispose);
+                }
+            }
+        }
+        catch (error) {
+            // 中途失败时撤销本轮已经注册的路由，避免留下半套 API。
+            for (const dispose of disposers.reverse()) {
+                try {
+                    dispose();
+                }
+                catch { }
+            }
+            throw error;
+        }
+        return () => {
+            for (const dispose of disposers.reverse()) {
+                try {
+                    dispose();
+                }
+                catch { }
+            }
+        };
+    };
+    if (typeof ctx.effect === 'function') {
+        ctx.effect(registerAll, 'dsh-remote-mobile:web-routes');
+        return;
+    }
+    // 兼容没有 ctx.effect 的旧宿主：至少尝试在 dispose 事件中回收路由。
+    const cleanup = registerAll();
+    if (typeof ctx.on === 'function') {
+        ctx.on('dispose', cleanup);
+    }
+}

package/lib/startup-hint.d.ts

@@ -0,0 +1,5 @@
+/**
+ * 在 DSH webserver 校验失败退出后追加一条针对通配地址错误的友好提示。
+ * 只在 stderr 命中 DSH 的 wildcard 报错时触发，其他启动错误不输出。
+ */
+export declare function installStartupFailureHint(): void;

package/lib/startup-hint.js

@@ -0,0 +1,72 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DSH_HOME } from './auth/token.js';
+const WILDCARD_ERROR_RE = /host\s+["']?(?:0\.0\.0\.0|::)["']?\s+is an unspecified \(wildcard\) address|binding every interface would expose remote code execution/i;
+let installed = false;
+let sawWildcardError = false;
+/** 查找配置中 webserver 使用通配地址的 profile patch 文件 */
+function findWildcardConfigFile() {
+    const files = [join(DSH_HOME, 'cordis.patch.yml')];
+    try {
+        for (const entry of readdirSync(join(DSH_HOME, 'profiles'), { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            files.push(join(DSH_HOME, 'profiles', entry.name, 'cordis.patch.yml'));
+        }
+    }
+    catch { }
+    for (const file of files) {
+        if (!existsSync(file))
+            continue;
+        let content = '';
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            if (!/^\s*-\s*id:\s*['"]?webserver['"]?\s*$/.test(lines[i]))
+                continue;
+            for (let j = i + 1; j < lines.length; j++) {
+                if (/^\s*-\s*id:/.test(lines[j]))
+                    break;
+                if (/^\s*host:\s*['"]?(?:0\.0\.0\.0|::)['"]?\s*$/.test(lines[j]))
+                    return file;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * 在 DSH webserver 校验失败退出后追加一条针对通配地址错误的友好提示。
+ * 只在 stderr 命中 DSH 的 wildcard 报错时触发，其他启动错误不输出。
+ */
+export function installStartupFailureHint() {
+    if (installed)
+        return;
+    installed = true;
+    const originalWrite = process.stderr.write.bind(process.stderr);
+    process.stderr.write = ((chunk, encoding, callback) => {
+        try {
+            if (WILDCARD_ERROR_RE.test(String(chunk)))
+                sawWildcardError = true;
+        }
+        catch { }
+        return originalWrite(chunk, encoding, callback);
+    });
+    process.once('exit', () => {
+        if (!sawWildcardError)
+            return;
+        const file = findWildcardConfigFile();
+        console.error(`
+[dsh-remote-mobile] 启动失败提示：
+检测到 DSH webserver 使用了通配地址 0.0.0.0 / ::。
+DSH 0.2.1+ 不允许这种监听方式，插件无法在 webserver 校验前接管。
+${file ? `请删除或注释 ${file} 中的 webserver 配置块；` : '请删除或注释 profile 的 cordis.patch.yml 中的 webserver 配置块；'}
+保持默认 127.0.0.1:3080，然后重启 dsh web。
+重启后 dsh-remote-mobile 会自动使用 3081 安全接入代理。
+`);
+    });
+}