dsh-code-server-app 0.2.0 → 0.2.2

package/lib/index.js

@@ -99,6 +99,9 @@ export const Config = z.object({
    *  (同源、无额外端口、复用 DSH 的 Host/Origin + cookie 防护;需要 DSH 提供 webServer 服务,
    *  缺失或注册失败时自动回退 loopback)。 */
   serve: z.union([z.const('loopback'), z.const('dsh')]).default('loopback'),
+  /** keepResident=true(默认)客户端在宿主 running 后把 IDE 预先加载到"停放区",
+   *  切标签/收起侧栏不再重载;false 则只在打开面板时才加载(省内存)。 */
+  keepResident: z.boolean().default(true),
 });
 
 const DEFAULT_CONFIG = {
@@ -384,6 +387,7 @@ export async function apply(ctx, config) {
   let reserveComposer = true;
   let windowedOpen = false;
   let serveSetting = 'loopback';
+  let keepResident = true; // 客户端常驻预热(0.2.2)
   if (settingsSvc !== undefined && typeof settingsSvc.register === 'function') {
     try {
       const scope = settingsSvc.register(SETTINGS_NS, Config);
@@ -393,6 +397,7 @@ export async function apply(ctx, config) {
         reserveComposer = resolved && typeof resolved.reserveComposer === 'boolean' ? resolved.reserveComposer : true;
         windowedOpen = resolved && typeof resolved.windowedOpen === 'boolean' ? resolved.windowedOpen : false;
         serveSetting = resolved && resolved.serve === 'dsh' ? 'dsh' : 'loopback';
+        keepResident = resolved && typeof resolved.keepResident === 'boolean' ? resolved.keepResident : true;
       }
       scope.watch((next) => {
         if (next != null && typeof next.reserveComposer === 'boolean') {
@@ -409,6 +414,10 @@ export async function apply(ctx, config) {
             console.log(`[code-server] serve updated: ${serveSetting}(下次启动生效)`);
           }
         }
+        if (next != null && typeof next.keepResident === 'boolean') {
+          keepResident = next.keepResident;
+          console.log(`[code-server] keepResident updated: ${keepResident}`);
+        }
       });
     } catch (error) {
       console.error(`[code-server] settings unavailable; using defaults (reserveComposer=true, windowedOpen=false): ${error.message}`);
@@ -502,6 +511,7 @@ export async function apply(ctx, config) {
       adopted: state.adopted,
       reserveComposer,
       windowedOpen,
+      keepResident,
       env: state.env,
       setup: {
         running: state.setup.running,

package/lib/launcher.mjs

@@ -207,6 +207,56 @@ function handleProxyUpgrade(req, socket, head, target) {
   socket.on('close', () => upstream.destroy());
 }
 
+// ---------------------------------------------------------------- 跨源防护(等价 code-server 的 ensureOrigin)
+
+/** 取请求 Host:优先 `Forwarded: host=`、其次 `X-Forwarded-Host`(取第一个)、最后 `Host`。
+ *  trim + 小写,与 code-server 的 getHost() 同语义(反向代理未透传 Host 时返回 undefined)。 */
+function getHostHeader(req) {
+  const first = (name) => {
+    const value = req.headers[name];
+    return Array.isArray(value) ? value[0] : value;
+  };
+  const forwarded = first('forwarded');
+  if (forwarded !== undefined && forwarded !== '') {
+    for (const part of forwarded.split(/[;,]/)) {
+      const eq = part.indexOf('=');
+      if (eq < 0) continue;
+      const key = part.slice(0, eq).trim().toLowerCase();
+      const value = part.slice(eq + 1).trim();
+      if (key === 'host' && value !== '') return value.toLowerCase();
+    }
+  }
+  const xHost = first('x-forwarded-host');
+  if (xHost !== undefined && xHost !== '') {
+    const head = xHost.split(',')[0];
+    if (head !== undefined && head.trim() !== '') return head.trim().toLowerCase();
+  }
+  const host = first('host');
+  return host !== undefined && host !== '' ? host.trim().toLowerCase() : undefined;
+}
+
+/** code-server `authenticateOrigin()` 的等价物:带 Origin 的请求(浏览器)其 host 必须等于 Host;
+ *  缺 Origin(非浏览器,如本地工具/测试)放行。code-server 另外支持 `--trusted-origins` /
+ *  `--proxy-domain` 通配,本插件没有这两个概念,故不实现。
+ *  为什么必须有:VS Code 的 handleUpgrade 不校验来源,而 IDE 是 auth=none —— 缺了这道检查,
+ *  本机任意浏览器页面都能开 ws://127.0.0.1:<port>/stable-<commit> 直接驱动 IDE。
+ *  (dsh 模式下请求来自 DSH 自己的路由并已过 requestRejection,Origin/Host 天然一致。) */
+function originAllowed(req) {
+  const raw = req.headers.origin;
+  const originRaw = Array.isArray(raw) ? raw[0] : raw;
+  if (originRaw === undefined || originRaw === '') return true;
+  let origin;
+  try {
+    origin = new URL(originRaw).host.trim().toLowerCase();
+  } catch {
+    return false;
+  }
+  if (origin === '') return false;
+  const host = getHostHeader(req);
+  if (host === undefined) return false;
+  return host === origin;
+}
+
 // ---------------------------------------------------------------- HTTP / WS 分发
 
 const server = createHttpServer((req, res) => {
@@ -243,6 +293,12 @@ server.on('upgrade', (req, socket, head) => {
   const url = req.url ?? '/';
   recentUpgrades.push(url);
   if (recentUpgrades.length > 10) recentUpgrades.shift();
+  // 跨源防护(与 code-server 一致:只卡 upgrade,HTTP 侧 VS Code 仅接受 GET 且状态变更都走 WS)
+  if (!originAllowed(req)) {
+    log(`拒绝跨源 WebSocket:origin=${req.headers.origin} host=${req.headers.host ?? '-'} url=${url}`);
+    socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    return;
+  }
   if (!args.disableProxy) {
     const target = proxyTarget(url);
     if (target !== null) { handleProxyUpgrade(req, socket, head, target); return; }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.2.0",
-  "description": "VS Code (from a code-server release) inside DSH Web and Desktop: right-sidebar tab with a floating-ball fallback, driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
+  "version": "0.2.2",
+  "description": "VS Code (from a code-server release) inside DSH Web and Desktop: right-sidebar tab with a floating-ball fallback, driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads the workbench. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
     "type": "git",

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.136.1",
   "productPath": "stable-8d5f383f301ca20681f5b6606b8207d9dc87bdd8",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-10T08:30:15.204Z",
+  "preparedAt": "2026-09-10T13:43:43.880Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",