@yezack/dsh-remote-mobile 1.9.2 → 1.10.0

package/lib/index.js

@@ -17,7 +17,10 @@ import { createGlobalAuthGate } from './auth/gate.js';
 import { createRoutes } from './routes/api.js';
 import { StyleSnippetStore } from './styles/style-snippets.js';
 import { getLocalTailscaleIp, getLocalLanIp } from './auth/tailscale.js';
-import { patchHttpServerWithVirtualizer, mountIndexInjections, registerRemoteWebUiPairingBridge, takeOverConnectionAuth, } from './bridge/compat.js';
+import { patchHttpServerWithVirtualizer, mountIndexInjections, registerRemoteWebUiPairingBridge, takeOverConnectionAuth, injectTrustedHosts, } from './bridge/compat.js';
+import { detectServerMode } from './gateway/detector.js';
+import { GatewayServer } from './gateway/server.js';
+import { generateGatewaySecret, setGatewaySecret, clearGatewaySecret } from './gateway/secret.js';
 /** Cordis 插件名称标识 */
 export const name = 'dsh-remote-mobile';
 /** DSH 设置命名空间 */
@@ -79,10 +82,15 @@ function bindDshSettings(ctx, store) {
  * @param config - 插件持久化配置选项 (SessionStoreOptions)
  */
 export function apply(ctx, config = {}) {
-    // 1. 初始化会话与令牌持久化管理器
+    // 1. 初始化会话与令牌持久化管理器及内部握手密钥
     const store = new SessionStore(config);
     const styleStore = new StyleSnippetStore();
     const gateMiddleware = createGlobalAuthGate(store);
+    // 为本次插件生命周期生成高强度握手 Secret，并绑定到底座 Server
+    const gatewaySecret = generateGatewaySecret();
+    if (ctx.webServer?.server) {
+        setGatewaySecret(ctx.webServer.server, gatewaySecret);
+    }
     // 2. 接入 DSH Settings 服务 (命名空间: dsh-remote-mobile)
     bindDshSettings(ctx, store);
     // 3. 挂载底座 WebServer 相关的门禁拦截与路由注册
@@ -90,8 +98,8 @@ export function apply(ctx, config = {}) {
         if (ctx.webServer.server) {
             patchHttpServerWithVirtualizer(ctx.webServer.server, gateMiddleware, store, styleStore);
         }
-        // 挂载 HTML 模板层的 Crypto Polyfill 注入钩子
-        mountIndexInjections(ctx);
+        // 挂载 HTML 模板层的样式与 Polyfill 注入钩子（在 Gzip 压缩前注入）
+        mountIndexInjections(ctx, styleStore);
         // 注册插件专属的 HTTP & SSE API 路由
         if (typeof ctx.webServer.register === 'function') {
             const routes = createRoutes(store, styleStore);
@@ -146,7 +154,70 @@ export function apply(ctx, config = {}) {
             ctx.logger?.debug?.('[dsh-remote-mobile] 注册 connection 动态注入失败:', e);
         }
     }
-    // 6. 服务就绪时输出提示横幅与接入地址
+    // 动态同步受信任主机到所有底层运行时（webRuntime、connection、webStartup）
+    const syncTrustedHosts = (target) => {
+        try {
+            injectTrustedHosts(target || ctx, [store.getActivePort(), 3080, 3081], store.getOptions().trustedHosts);
+        }
+        catch { }
+    };
+    syncTrustedHosts();
+    if (typeof ctx.inject === 'function') {
+        try {
+            ctx.inject(['webRuntime'], (runtimeCtx) => {
+                syncTrustedHosts(runtimeCtx);
+            });
+        }
+        catch { }
+    }
+    // 6. 探测 DSH 底座网络暴露姿态，自适应裁决是否拉起独立安全反向代理网关
+    // 配置错误（如 mode: 'gateway' + 具体 LAN IP）不能把整个插件 apply 抛崩；
+    // 捕获后回退到 direct 模式，让用户仍可通过 3080 本机/局域网访问并修改配置。
+    let modeFallbackError = '';
+    let detection;
+    try {
+        detection = detectServerMode(ctx, store.getOptions().mode, ctx.webServer?.port ?? 3080);
+    }
+    catch (err) {
+        modeFallbackError = err?.message || String(err);
+        ctx.logger?.error?.('[dsh-remote-mobile] 网关模式不可用，已回退 direct 模式:', err);
+        detection = detectServerMode(ctx, 'direct', ctx.webServer?.port ?? 3080);
+    }
+    // 强制 gateway 且底座已监听通配地址时，输出安全提醒：核心 3080 仍暴露，
+    // 网关只是附加入口，不能替代核心侧的 Host/Origin 防护。
+    const modeWarning = detection.mode === 'gateway' && !detection.isLoopback
+        ? `底座本身已监听 ${detection.rawCoreHost}，3080 仍是对外入口；网关 3081 为附加入口，建议优先恢复 127.0.0.1 监听。`
+        : '';
+    let gatewayServer = null;
+    let gatewayReadyPromise = null;
+    if (detection.mode === 'gateway') {
+        const opts = store.getOptions();
+        gatewayServer = new GatewayServer({
+            port: opts.gatewayPort ?? 3081,
+            host: opts.gatewayHost ?? '0.0.0.0',
+            corePort: detection.corePort,
+            coreHost: detection.coreHost,
+        }, store, gateMiddleware, ctx.logger);
+        // 初始标记为正在启动中
+        store.setActiveGatewayInfo('gateway', opts.gatewayPort ?? 3081, detection.corePort, false);
+        gatewayReadyPromise = gatewayServer.start().then(({ port }) => {
+            if (gatewayServer?.getServer()) {
+                setGatewaySecret(gatewayServer.getServer(), gatewaySecret);
+            }
+            store.setActiveGatewayInfo('gateway', port, detection.corePort, true);
+            syncTrustedHosts();
+            return port;
+        }).catch((err) => {
+            store.setActiveGatewayInfo('gateway', opts.gatewayPort ?? 3081, detection.corePort, false, err?.message || String(err));
+            ctx.logger?.error?.('[dsh-remote-mobile] 独立安全反向代理网关启动失败:', err);
+            return opts.gatewayPort ?? 3081;
+        });
+    }
+    else {
+        store.setActiveGatewayInfo('direct', detection.corePort, detection.corePort, true);
+        gatewayReadyPromise = Promise.resolve(detection.corePort);
+    }
+    // 7. 服务就绪时输出提示横幅与接入地址
     let printed = false;
     let disposed = false;
     let timer1 = null;
@@ -158,18 +229,42 @@ export function apply(ctx, config = {}) {
                 clearTimeout(timer1);
             if (timer2)
                 clearTimeout(timer2);
+            if (gatewayServer) {
+                clearGatewaySecret(gatewayServer.getServer());
+                gatewayServer.close().catch(() => { });
+            }
+            const webServer = (typeof ctx.get === 'function' ? ctx.get('webServer') : undefined) || ctx.webServer;
+            if (webServer?.server) {
+                clearGatewaySecret(webServer.server);
+            }
         });
     }
     catch { }
-    const printReadyBanner = () => {
+    const printReadyBanner = async () => {
         // 生命周期守卫：若上下文已废弃/进入 dispose，放弃回调
         if (disposed || printed)
             return;
         printed = true;
+        // 等待网关就绪以获得准确的对外端口（避免端口自增探测竞态）
+        try {
+            if (gatewayReadyPromise) {
+                await Promise.race([
+                    gatewayReadyPromise,
+                    new Promise((r) => setTimeout(r, 2000)),
+                ]);
+            }
+        }
+        catch { }
+        // 等待期间插件可能已被 dispose / 热重载；此时绝不能再 setGatewaySecret / patch / mount
+        if (disposed)
+            return;
         try {
+            syncTrustedHosts();
             const webServer = (typeof ctx.get === 'function' ? ctx.get('webServer') : undefined) || ctx.webServer;
             if (webServer?.server) {
+                setGatewaySecret(webServer.server, gatewaySecret);
                 patchHttpServerWithVirtualizer(webServer.server, gateMiddleware, store, styleStore);
+                mountIndexInjections(ctx, styleStore);
             }
             try {
                 const conn = typeof ctx.get === 'function' ? ctx.get('connection') : undefined;
@@ -181,18 +276,49 @@ export function apply(ctx, config = {}) {
             }
             const tsIp = getLocalTailscaleIp();
             const lanIp = getLocalLanIp();
-            const port = webServer?.port ?? 3080;
+            const activePort = store.getActivePort();
+            const activeMode = store.getActiveMode();
+            const corePort = store.getCorePort();
             const opts = store.getOptions();
+            const gwStatus = store.getGatewayStatus();
             const divider = '─'.repeat(72);
             console.log(`\n┌${divider}`);
             console.log(`│ [dsh-remote-mobile] 官方临时 Token 鉴权已接管，PC/移动端访问无需携带官方token`);
-            console.log(`│ 远程安全网关已就绪，支持手机浏览器访问:`);
-            console.log(`│   • 本机回环:   http://127.0.0.1:${port}`);
-            if (lanIp && lanIp !== '127.0.0.1') {
-                console.log(`│   • 局域网:     http://${lanIp}:${port} (同 Wi-Fi 局域网直连)`);
+            if (modeFallbackError) {
+                console.log(`│ ⚠️ 网关配置不可用，已回退 direct 模式: ${modeFallbackError}`);
             }
-            if (tsIp) {
-                console.log(`│   • 虚拟私网:   http://${tsIp}:${port} (Tailscale 私网异地直连)`);
+            if (modeWarning) {
+                console.log(`│ ⚠️ ${modeWarning}`);
+            }
+            if (activeMode === 'gateway') {
+                if (gwStatus.running) {
+                    console.log(`│ 独立安全反代网关已激活 (0.0.0.0:${activePort} -> 127.0.0.1:${corePort})`);
+                    console.log(`│ 手机/远程设备请访问安全网关地址:`);
+                    if (lanIp && lanIp !== '127.0.0.1') {
+                        console.log(`│   • 局域网:     http://${lanIp}:${activePort} (同 Wi-Fi 局域网直连)`);
+                    }
+                    if (tsIp) {
+                        console.log(`│   • 虚拟私网:   http://${tsIp}:${activePort} (Tailscale 私网异地直连)`);
+                    }
+                    console.log(`│ 电脑本机浏览器访问控制台:`);
+                    console.log(`│   • 本机回环:   http://127.0.0.1:${corePort}`);
+                }
+                else {
+                    console.log(`│ ⚠️ 独立安全反代网关未成功启动: ${gwStatus.error || '端口占用'}`);
+                    console.log(`│ 外部手机设备当前暂时无法连接，请检查 3081 端口占用`);
+                    console.log(`│ 电脑本机浏览器仍可直接访问:`);
+                    console.log(`│   • 本机回环:   http://127.0.0.1:${corePort}`);
+                }
+            }
+            else {
+                console.log(`│ 远程安全网关已就绪，支持手机浏览器访问:`);
+                console.log(`│   • 本机回环:   http://127.0.0.1:${corePort}`);
+                if (lanIp && lanIp !== '127.0.0.1') {
+                    console.log(`│   • 局域网:     http://${lanIp}:${corePort} (同 Wi-Fi 局域网直连)`);
+                }
+                if (tsIp) {
+                    console.log(`│   • 虚拟私网:   http://${tsIp}:${corePort} (Tailscale 私网异地直连)`);
+                }
             }
             console.log(`│ 访问与配置说明:`);
             console.log(`│   - 手机/远程设备打开对应地址即可直接访问`);
@@ -200,9 +326,9 @@ export function apply(ctx, config = {}) {
             console.log(`│     可开启免密直连(局域网/Tailscale)、查看 6 位临时配对码或设置长期密码`);
             console.log(`│   - 项目文档:   https://github.com/IceApriler/dsh-remote-mobile`);
             console.log(`└${divider}\n`);
-            ctx.logger?.info?.(`[dsh-remote-mobile] 移动端远程控制与安全门禁已激活 (上下文虚拟化桥接就绪，样式片段: ${styleStore.list().length} 个)`);
+            ctx.logger?.info?.(`[dsh-remote-mobile] 移动端远程控制与安全门禁已激活 (运行模式: ${activeMode}, 对外端口: ${activePort})`);
             if (tsIp) {
-                ctx.logger?.info?.(`[dsh-remote-mobile] Tailscale 地址: http://${tsIp}:${port} (免密直连: ${opts.allowTailscale ? '已开启' : '已关闭'})`);
+                ctx.logger?.info?.(`[dsh-remote-mobile] Tailscale 地址: http://${tsIp}:${activePort} (免密直连: ${opts.allowTailscale ? '已开启' : '已关闭'})`);
             }
         }
         catch (e) {
@@ -234,3 +360,5 @@ export * from './auth/gate.js';
 export * from './routes/api.js';
 export * from './bridge/compat.js';
 export * from './styles/style-snippets.js';
+export * from './gateway/detector.js';
+export * from './gateway/server.js';

package/lib/routes/api.js

@@ -86,6 +86,12 @@ export function createRoutes(store, styleStore) {
                     pairingBridgeMode: bridgeState.mode,
                     pairingBridgeConflict: bridgeState.conflictWith || '',
                     pairingBridgeConflictId: bridgeState.conflictEntryId || '',
+                    // 独立安全网关运行状态
+                    gateway: {
+                        ...store.getGatewayStatus(),
+                        activePort: store.getActivePort(),
+                        gatewayPort: opts.gatewayPort || 3081,
+                    },
                 });
             },
         },
@@ -298,16 +304,16 @@ export function createRoutes(store, styleStore) {
                 const visitCheck = store.recordAuthVisit(clientIp, ua);
                 if (!visitCheck.allowed) {
                     res.writeHead(429, { 'Content-Type': 'text/html; charset=utf-8' });
-                    return res.end(`
-            <!DOCTYPE html>
-            <html>
-            <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>安全限制 - DSH</title>
-            <style>body{background:#0f172a;color:#fff;font-family:-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;padding:20px;box-sizing:border-box;text-align:center;}
-            .card{background:rgba(255,255,255,0.06);border:1px solid rgba(239,68,68,0.4);border-radius:16px;padding:28px 20px;max-width:380px;box-shadow:0 8px 32px rgba(0,0,0,0.4);}
-            h2{color:#ef4444;margin:0 0 10px 0;font-size:20px;}p{color:#94a3b8;font-size:14px;line-height:1.6;margin:0;}</style>
-            </head>
-            <body><div class="card"><h2>⚠️ 访问限制 (429)</h2><p>${visitCheck.reason || '当前 IP 请求过于频繁或已被临时锁定，请稍后刷新重试。'}</p></div></body>
-            </html>
+                    return res.end(`
+            <!DOCTYPE html>
+            <html>
+            <head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>安全限制 - DSH</title>
+            <style>body{background:#0f172a;color:#fff;font-family:-apple-system,sans-serif;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;padding:20px;box-sizing:border-box;text-align:center;}
+            .card{background:rgba(255,255,255,0.06);border:1px solid rgba(239,68,68,0.4);border-radius:16px;padding:28px 20px;max-width:380px;box-shadow:0 8px 32px rgba(0,0,0,0.4);}
+            h2{color:#ef4444;margin:0 0 10px 0;font-size:20px;}p{color:#94a3b8;font-size:14px;line-height:1.6;margin:0;}</style>
+            </head>
+            <body><div class="card"><h2>⚠️ 访问限制 (429)</h2><p>${visitCheck.reason || '当前 IP 请求过于频繁或已被临时锁定，请稍后刷新重试。'}</p></div></body>
+            </html>
           `);
                 }
                 const acceptLang = req.headers['accept-language'] || '';