dsh-clean-desktop-shell 0.1.9 → 0.1.10

package/electron/update.js

@@ -20,6 +20,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { spawn } from 'node:child_process'
 import { basename, dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import semver from 'semver'
 import { showProgress, setProgress, closeProgress } from './progress.js'
 import { loadConfig } from './config.js'
 
@@ -197,11 +198,16 @@ export async function checkForUpdatesAuto() {
   }
 }
 
-/** Parse "v1.2.3" / "1.2.3" → [1,2,3]; null when malformed. */
-function parseVersion(v) {
+/**
+ * Version parsing/comparison via semver — the industry-standard
+ * implementation (update-notifier, npm itself). Coercion strips the 'v'
+ * prefix and any prerelease/build suffix; gt compares correctly across
+ * digit-width differences that a hand-rolled tuple or string compare
+ * would get wrong.
+ */
+function coerceVersion(v) {
   if (!v) return null
-  const m = String(v).replace(/^v/i, '').trim().match(/^(\d+)\.(\d+)\.(\d+)/)
-  return m ? [Number(m[1]), Number(m[2]), Number(m[3])] : null
+  return semver.coerce(String(v))
 }
 
 /**
@@ -215,11 +221,7 @@ function currentVersion() {
 
 /** True when a is strictly newer than b. */
 function isNewer(a, b) {
-  if (!a || !b) return false
-  for (let i = 0; i < 3; i++) {
-    if (a[i] !== b[i]) return a[i] > b[i]
-  }
-  return false
+  return !!(a && b && semver.gt(a, b))
 }
 
 /**
@@ -233,17 +235,14 @@ export async function checkForUpdate() {
   let url = REPO_URL
 
   try {
-    const controller = new AbortController()
-    const timer = setTimeout(() => controller.abort(), 8000)
     const res = await fetch(RELEASES_API, {
-      signal: controller.signal,
+      signal: AbortSignal.timeout(8000),
       headers: { Accept: 'application/vnd.github+json' },
     })
-    clearTimeout(timer)
     if (res.ok) {
       const data = await res.json()
       tag = data.tag_name || null
-      latest = parseVersion(tag)
+      latest = coerceVersion(tag)
       if (data.html_url) url = data.html_url
     }
   } catch {
@@ -281,10 +280,7 @@ export async function checkForUpdateNpm() {
   const url = 'https://www.npmjs.com/package/dsh-clean-desktop-shell'
 
   try {
-    const controller = new AbortController()
-    const timer = setTimeout(() => controller.abort(), 8000)
-    const res = await fetch(NPM_REGISTRY_API, { signal: controller.signal })
-    clearTimeout(timer)
+    const res = await fetch(NPM_REGISTRY_API, { signal: AbortSignal.timeout(8000) })
     if (res.ok) {
       const data = await res.json()
       latestStr = data['dist-tags']?.latest || null
@@ -293,8 +289,8 @@ export async function checkForUpdateNpm() {
     // Network error — no update known.
   }
 
-  const currentV = parseVersion(current)
-  const latestV = parseVersion(latestStr)
+  const currentV = coerceVersion(current)
+  const latestV = coerceVersion(latestStr)
   return {
     hasUpdate: isNewer(latestV, currentV),
     latest: latestStr ? `v${latestStr}` : null,
@@ -354,13 +350,36 @@ function updateCommandVariants(pm) {
   }
 }
 
+/**
+ * Kill a shell-spawned child and its whole subtree. On Windows the direct
+ * child is a cmd.exe wrapper — killing it alone leaves the actual worker
+ * (e.g. pnpm/node) running; `taskkill /T` is the recognized tree kill.
+ */
+function treeKill(child) {
+  if (process.platform === 'win32' && child.pid) {
+    spawn('taskkill', ['/PID', String(child.pid), '/T', '/F'], {
+      windowsHide: true,
+      stdio: 'ignore',
+    })
+  } else {
+    try {
+      child.kill('SIGKILL')
+    } catch {
+      // already gone
+    }
+  }
+}
+
 /**
  * Run a shell command, capturing tail output. Node's spawn with shell:true
  * always uses cmd.exe on Windows (regardless of the user's login shell being
  * PowerShell or cmd), which is also required for .cmd shims like pnpm — a
- * bare spawn would throw EINVAL. Resolves { ok, out, err }.
+ * bare spawn would throw EINVAL. Output is kept as a bounded tail so a
+ * chatty build cannot grow memory without limit. Resolves { ok, out, err }.
  */
 function runShell(cmd, cwd, timeoutMs = 5 * 60 * 1000) {
+  const CAP = 16 * 1024
+  const cap = (s) => (s.length > CAP ? s.slice(-CAP) : s)
   return new Promise((resolve) => {
     let out = ''
     let err = ''
@@ -371,10 +390,10 @@ function runShell(cmd, cwd, timeoutMs = 5 * 60 * 1000) {
       windowsHide: true, // no console flash from the GUI process
     })
     const timer = setTimeout(() => {
-      if (!settled) child.kill()
+      if (!settled) treeKill(child)
     }, timeoutMs)
-    child.stdout?.on('data', (d) => { out += d })
-    child.stderr?.on('data', (d) => { err += d })
+    child.stdout?.on('data', (d) => { out = cap(out + d) })
+    child.stderr?.on('data', (d) => { err = cap(err + d) })
     child.on('error', () => {
       settled = true
       clearTimeout(timer)

package/electron/window.js

@@ -18,7 +18,7 @@
 import { app, BrowserWindow, ipcMain } from 'electron'
 import { existsSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fileURLToPath, pathToFileURL } from 'node:url'
 import { probe, onStatusChange, detect } from './service.js'
 import { startBackendWithProgress, chooseBackendFolder } from './tray.js'
 import { APP_USER_MODEL_ID } from './aumid.js'
@@ -35,8 +35,11 @@ const TASKBAR_ICO = join(PKG_ROOT, 'build', 'icon.ico')
 const ICON_PATH = existsSync(TASKBAR_ICO)
   ? TASKBAR_ICO
   : fileURLToPath(new URL('../build/icon.png', import.meta.url))
-// Local fallback page shown while the backend is down.
+// Local fallback page shown while the backend is down. The file URL is
+// precomputed so "is the offline page showing?" is an exact comparison,
+// not a substring sniff over arbitrary web content.
 const ERROR_PAGE = fileURLToPath(new URL('./error.html', import.meta.url))
+const ERROR_PAGE_URL = pathToFileURL(ERROR_PAGE).href
 
 // How often we re-probe the backend while the window is in "offline" mode.
 const RECONNECT_INTERVAL_MS = 2500
@@ -214,8 +217,7 @@ export function createMainWindow({ target }) {
   // Instant flip when the backend state machine changes (tray stop/start).
   const unsub = onStatusChange((st) => {
     if (win.isDestroyed()) return
-    const current = win.webContents.getURL()
-    const isOffline = current.includes('error.html')
+    const isOffline = win.webContents.getURL().startsWith(ERROR_PAGE_URL)
     if ((st.status === 'stopped' || st.status === 'error') && !isOffline) {
       // Backend went down while a real page is showing — go dark at once.
       showOffline(win)
@@ -230,7 +232,7 @@ export function createMainWindow({ target }) {
     if (!isMainFrame || code === ERR_ABORTED) return
     // Offline screen already showing — just keep re-probing, do not
     // reload the offline page again (avoids a reload loop if it fails).
-    if (win.webContents.getURL().includes('error.html')) {
+    if (win.webContents.getURL().startsWith(ERROR_PAGE_URL)) {
       startReconnect(win, target)
       return
     }

package/lib/common.js

@@ -6,6 +6,7 @@
  * location electron/ and build/ live in the published package.
  */
 import { homedir } from 'node:os'
+import { spawn } from 'node:child_process'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -51,3 +52,23 @@ export function runtimeRoot() {
 export function launchLogPath() {
   return join(dshHome(), 'desktop-shell-launch.log')
 }
+
+/**
+ * Download a file to disk via curl — shared by runtime provisioning and
+ * icon patching. Chosen over native fetch because undici (Node's fetch)
+ * ignores HTTP(S)_PROXY env vars unless a proxy dispatcher is wired in,
+ * while curl honors them out of the box (users behind Clash/v2ray rely on
+ * that). --max-time keeps a stalled proxy from hanging forever; --retry
+ * rides out transient failures.
+ */
+export function fetchFile(url, dest, timeoutSec = 600) {
+  return new Promise((resolve) => {
+    const child = spawn(
+      'curl',
+      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', String(timeoutSec), '-o', dest, url],
+      { windowsHide: true, stdio: 'ignore' },
+    )
+    child.on('error', () => resolve(false))
+    child.on('exit', (code) => resolve(code === 0))
+  })
+}

package/lib/icon.js

@@ -14,7 +14,7 @@
 import { spawn } from 'node:child_process'
 import { existsSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { PKG_ROOT, isWin, runtimeRoot } from './common.js'
+import { PKG_ROOT, isWin, runtimeRoot, fetchFile } from './common.js'
 
 export async function patchExeIcon(ctx, exe) {
   if (!isWin) return
@@ -49,15 +49,3 @@ export async function patchExeIcon(ctx, exe) {
     ctx.logger.warn('[clean-desktop-shell] rcedit patch failed — taskbar icon stays default')
   }
 }
-
-function fetchFile(url, dest) {
-  return new Promise((resolve) => {
-    const child = spawn(
-      'curl',
-      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', '600', '-o', dest, url],
-      { windowsHide: true, stdio: 'ignore' },
-    )
-    child.on('error', () => resolve(false))
-    child.on('exit', (code) => resolve(code === 0))
-  })
-}

package/lib/runtime.js

@@ -13,6 +13,8 @@
  *   4. drop stale electron-v* dirs (no unbounded disk growth)
  */
 import { spawn } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { createReadStream } from 'node:fs'
 import {
   cpSync,
   existsSync,
@@ -23,6 +25,7 @@ import {
   rmSync,
   symlinkSync,
 } from 'node:fs'
+import { pipeline } from 'node:stream/promises'
 import { basename, join } from 'node:path'
 import {
   PKG_ROOT,
@@ -33,6 +36,7 @@ import {
   isWin,
   isMac,
   runtimeRoot,
+  fetchFile,
 } from './common.js'
 
 function electronVersion() {
@@ -124,17 +128,26 @@ function ensureExecutable(ctx, target) {
 async function downloadRuntime(ctx, version, root, dir) {
   const tmpZip = join(root, `.electron-${version}.zip.tmp`)
   rmSync(tmpZip, { force: true })
-  const urls = await runtimeUrls(version)
-  const innerName = zipName(version).replace(/\.zip$/, '')
+  const candidates = await runtimeCandidates(version)
+  const zip = zipName(version)
+  const innerName = zip.replace(/\.zip$/, '')
 
-  for (const url of urls) {
-    ctx.logger.info(`[clean-desktop-shell] downloading electron ${version} from ${url}`)
-    if (!(await fetchFile(url, tmpZip))) {
+  for (const c of candidates) {
+    ctx.logger.info(`[clean-desktop-shell] downloading electron ${version} from ${c.url}`)
+    if (!(await fetchFile(c.url, tmpZip))) {
       // Failed download — drop the partial file so a later run starts clean.
       rmSync(tmpZip, { force: true })
       continue
     }
 
+    // Integrity check against the source's own SHASUMS256.txt (same check
+    // the `electron` package's installer performs). A mismatch means the
+    // bytes are corrupt or tampered — the source is skipped entirely.
+    if (!(await verifySha256(ctx, tmpZip, c.shasums, zip))) {
+      rmSync(tmpZip, { force: true })
+      continue
+    }
+
     // Extract into a scratch dir, never into the shared runtime root: a
     // half-extracted zip there would be indistinguishable from a real
     // runtime, and the sibling electron-v* dirs must not be disturbed.
@@ -142,7 +155,7 @@ async function downloadRuntime(ctx, version, root, dir) {
     const ok = await extractZip(ctx, tmpZip, scratch)
     rmSync(tmpZip, { force: true })
     if (!ok) {
-      ctx.logger.warn(`[clean-desktop-shell] no extractor succeeded for ${url}`)
+      ctx.logger.warn(`[clean-desktop-shell] no extractor succeeded for ${c.url}`)
       rmSync(scratch, { recursive: true, force: true })
       continue
     }
@@ -169,6 +182,54 @@ async function downloadRuntime(ctx, version, root, dir) {
   throw new Error('electron download failed from all sources')
 }
 
+/**
+ * Verify a downloaded zip against the source's SHASUMS256.txt — the same
+ * integrity check the `electron` package's own installer performs. Returns
+ * false on a checksum mismatch (fatal for that source); a temporarily
+ * unreachable SHASUMS file only warns, so a reachable zip is not wasted
+ * over an unrelated blocker.
+ */
+async function verifySha256(ctx, file, shasumsUrl, name) {
+  let expected = null
+  let reason = ''
+  try {
+    const res = await fetch(shasumsUrl, { signal: AbortSignal.timeout(10000) })
+    if (!res.ok) {
+      reason = `HTTP ${res.status}`
+    } else {
+      const text = await res.text()
+      for (const line of text.split('\n')) {
+        const m = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i)
+        if (m && m[2].trim() === name) {
+          expected = m[1].toLowerCase()
+          break
+        }
+      }
+      if (!expected) reason = 'entry not found'
+    }
+  } catch (err) {
+    reason = err?.message || 'fetch failed'
+  }
+  if (!expected) {
+    ctx.logger.warn(
+      `[clean-desktop-shell] SHASUMS256.txt unavailable from ${shasumsUrl} (${reason}) — skipping integrity check`,
+    )
+    return true
+  }
+  // Stream the hash — the zip can be ~270 MB and must not be read whole
+  // into memory.
+  const hash = createHash('sha256')
+  await pipeline(createReadStream(file), hash)
+  const actual = hash.digest('hex')
+  if (actual !== expected) {
+    ctx.logger.warn(
+      `[clean-desktop-shell] checksum mismatch for ${name}: expected ${expected}, got ${actual}`,
+    )
+    return false
+  }
+  return true
+}
+
 /** The dir that directly holds the electron payload right after extraction. */
 function findPayload(scratch, wrapper) {
   if (existsSync(join(wrapper, EXE_TOP))) return wrapper
@@ -212,21 +273,25 @@ function clearQuarantine(ctx, target) {
  * (direct connection, 3s each). The fastest reachable source goes first —
  * this naturally prefers the domestic npmmirror mirror on CN networks,
  * the official GitHub source on international/well-proxied networks, and
- * never wastes a full download on a dead source.
+ * never wastes a full download on a dead source. Each candidate carries
+ * its own SHASUMS256.txt location for the post-download integrity check.
  */
-async function runtimeUrls(version) {
+async function runtimeCandidates(version) {
+  const base = (name, urlBase) => ({
+    name,
+    url: `${urlBase}/${zipName(version)}`,
+    shasums: `${urlBase}/SHASUMS256.txt`,
+  })
   const candidates = [
-    { name: 'github', url: `https://github.com/electron/electron/releases/download/v${version}/${zipName(version)}` },
-    { name: 'npmmirror', url: `https://npmmirror.com/mirrors/electron/${version}/${zipName(version)}` },
+    base('github', `https://github.com/electron/electron/releases/download/v${version}`),
+    base('npmmirror', `https://npmmirror.com/mirrors/electron/${version}`),
   ]
   const results = await Promise.all(
     candidates.map(async (c) => {
       const t0 = Date.now()
       try {
-        const ctrl = new AbortController()
-        const timer = setTimeout(() => ctrl.abort(), 3000)
-        const res = await fetch(c.url, { signal: ctrl.signal, method: 'HEAD' })
-        clearTimeout(timer)
+        // AbortSignal.timeout — the standard self-cleaning probe timeout.
+        const res = await fetch(c.url, { signal: AbortSignal.timeout(3000), method: 'HEAD' })
         if (res.status < 500) return { ...c, ms: Date.now() - t0 }
       } catch {
         // unreachable — drop
@@ -237,26 +302,10 @@ async function runtimeUrls(version) {
   const ok = results.filter(Boolean).sort((a, b) => a.ms - b.ms)
   if (ok.length === 0) {
     // Probes all failed (offline?) — still try both, mirror first (cheap).
-    return [candidates[1].url, candidates[0].url]
+    return [candidates[1], candidates[0]]
   }
-  const rest = candidates.map((c) => c.url).filter((u) => u !== ok[0].url)
-  return [ok[0].url, ...rest]
-}
-
-function fetchFile(url, dest) {
-  return new Promise((resolve) => {
-    // curl is available on Windows 10+; streams to disk, honors proxy env.
-    // --max-time keeps a stalled download from hanging forever (a proxy
-    // stall previously left a half-written .zip.tmp and blocked the shell
-    // launch); --retry 2 rides out transient failures.
-    const child = spawn(
-      'curl',
-      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', '600', '-o', dest, url],
-      { windowsHide: true, stdio: 'ignore' },
-    )
-    child.on('error', () => resolve(false))
-    child.on('exit', (code) => resolve(code === 0))
-  })
+  const rest = candidates.filter((c) => c.url !== ok[0].url)
+  return [ok[0], ...rest]
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-clean-desktop-shell",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Clean desktop shell for DeepSeek Harness (DSH) as a DSH plugin — wraps your web profile in a native window, tray-managed backend, offline auto-reconnect, zero visual changes. DSH 插件形态的纯净桌面壳：复用现有 web profile，托盘管理后端，零视觉改造。",
   "repository": {
     "type": "git",
@@ -33,7 +33,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "check": "node --check lib/index.js && node scripts/selftest-runtime.mjs",
+    "check": "node scripts/check-syntax.mjs && node scripts/selftest-runtime.mjs",
     "dev": "electron electron/main.js",
     "icons": "node scripts/gen-icons.mjs",
     "pack": "electron-builder --win nsis",
@@ -118,7 +118,8 @@
     "electron@33.4.11": true
   },
   "dependencies": {
-    "electron-updater": "^6.8.9"
+    "electron-updater": "^6.8.9",
+    "semver": "^7.7.2"
   },
   "desktopShell": {
     "electronVersion": "33.4.11"

package/scripts/check-syntax.mjs

@@ -0,0 +1,54 @@
+/**
+ * Syntax gate: `node --check` every JS file that ships in the package
+ * (electron/ main-process modules + lib/ host/client bundle). Previously
+ * only lib/index.js was checked — a syntax slip in any other file shipped
+ * unnoticed.
+ *
+ * The two sandboxed preloads are CommonJS (require/module.exports) while
+ * package.json declares "type": "module", so plain --check on them fails
+ * spuriously; they are validated through a temporary .cjs copy instead.
+ */
+import { spawnSync } from 'node:child_process'
+import { readdirSync, readFileSync, statSync, rmSync, writeFileSync, mkdtempSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { fileURLToPath } from 'node:url'
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)))
+// CJS files relative to electron/ — parsed as CommonJS despite the ESM package.
+const CJS_FILES = new Set(['preload.js', 'progress-preload.js'])
+
+function listJs(dir) {
+  return readdirSync(join(root, dir)).filter((f) => f.endsWith('.js'))
+}
+
+const scratch = mkdtempSync(join(tmpdir(), 'dsh-shell-check-'))
+let bad = 0
+let checked = 0
+
+try {
+  for (const dir of ['electron', 'lib']) {
+    for (const f of listJs(dir)) {
+      const full = join(root, dir, f)
+      if (!statSync(full).isFile()) continue
+      const cjs = CJS_FILES.has(f)
+      const target = cjs ? join(scratch, `${dir}-${f}.cjs`) : full
+      if (cjs) writeFileSync(target, readFileSync(full))
+      const r = spawnSync(process.execPath, ['--check', target], { stdio: 'pipe' })
+      const ok = r.status === 0
+      checked++
+      if (!ok) {
+        bad++
+        console.log(`  FAIL ${dir}/${f}${cjs ? ' (checked as CJS)' : ''}`)
+        if (r.stderr) console.error(r.stderr.toString().trim())
+      } else {
+        console.log(`  ok   ${dir}/${f}${cjs ? ' (checked as CJS)' : ''}`)
+      }
+    }
+  }
+} finally {
+  rmSync(scratch, { recursive: true, force: true })
+}
+
+console.log(bad === 0 ? `PASS (${checked} files)` : `FAIL (${bad}/${checked} file(s))`)
+process.exit(bad === 0 ? 0 : 1)

package/src/host/common.js

@@ -6,6 +6,7 @@
  * location electron/ and build/ live in the published package.
  */
 import { homedir } from 'node:os'
+import { spawn } from 'node:child_process'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -51,3 +52,23 @@ export function runtimeRoot() {
 export function launchLogPath() {
   return join(dshHome(), 'desktop-shell-launch.log')
 }
+
+/**
+ * Download a file to disk via curl — shared by runtime provisioning and
+ * icon patching. Chosen over native fetch because undici (Node's fetch)
+ * ignores HTTP(S)_PROXY env vars unless a proxy dispatcher is wired in,
+ * while curl honors them out of the box (users behind Clash/v2ray rely on
+ * that). --max-time keeps a stalled proxy from hanging forever; --retry
+ * rides out transient failures.
+ */
+export function fetchFile(url, dest, timeoutSec = 600) {
+  return new Promise((resolve) => {
+    const child = spawn(
+      'curl',
+      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', String(timeoutSec), '-o', dest, url],
+      { windowsHide: true, stdio: 'ignore' },
+    )
+    child.on('error', () => resolve(false))
+    child.on('exit', (code) => resolve(code === 0))
+  })
+}

package/src/host/icon.js

@@ -14,7 +14,7 @@
 import { spawn } from 'node:child_process'
 import { existsSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
-import { PKG_ROOT, isWin, runtimeRoot } from './common.js'
+import { PKG_ROOT, isWin, runtimeRoot, fetchFile } from './common.js'
 
 export async function patchExeIcon(ctx, exe) {
   if (!isWin) return
@@ -49,15 +49,3 @@ export async function patchExeIcon(ctx, exe) {
     ctx.logger.warn('[clean-desktop-shell] rcedit patch failed — taskbar icon stays default')
   }
 }
-
-function fetchFile(url, dest) {
-  return new Promise((resolve) => {
-    const child = spawn(
-      'curl',
-      ['-L', '--fail', '--silent', '--show-error', '--retry', '2', '--max-time', '600', '-o', dest, url],
-      { windowsHide: true, stdio: 'ignore' },
-    )
-    child.on('error', () => resolve(false))
-    child.on('exit', (code) => resolve(code === 0))
-  })
-}