dsh-code-server-app 0.2.13 → 0.3.6

package/lib/launcher.mjs

@@ -9,12 +9,25 @@
  * Module 解析、多处 process.exit),且 node-pty/sqlite 崩溃时必须只带走 IDE、不能带走 DSH host。
  *
  * 用法(由 lib/index.js 调用):node lib/launcher.mjs --tree <树根> --user-data-dir <dir>
- *   --extensions-dir <dir> (--port <n> [--host 127.0.0.1] | --pipe <name>) [--parent-pid <pid>] [--locale zh-cn]
+ *   --extensions-dir <dir> (--port <n> [--host 127.0.0.1] [--token-file <path>] [--endpoint-file <path>]
+ *   | --pipe <name>) [--parent-pid <pid>] [--locale zh-cn]
  * 就绪信号:stdout 打印 `dshcs-ready <productPath> <mode> <addr>`。
+ *
+ * 安全模型(0.2.14 起):
+ *   - **随机端口**:host 传 `--port 0`,由系统分配空闲端口,launcher 把实际地址写进 `--endpoint-file`
+ *     (host 读回)。固定端口在 `port` 配置里显式指定时仍然照用。
+ *   - **路径令牌**:`--token-file` 给出的随机令牌成为 URL 的**路径前缀**(`http://127.0.0.1:<port>/<token>/…`)。
+ *     为什么不走 VS Code 自带的 `connection-token`:它靠 `?tkn=` → 302 + `Set-Cookie: vscode-tkn; SameSite=Lax`,
+ *     而本插件的桌面端 iframe 是**跨源**的(dsh-app:// → 127.0.0.1),Lax cookie 在跨站子框架里不会被带上
+ *     ⇒ 那样会把 desktop 直接打挂。路径前缀不需要 cookie:workbench 的资源与 WS 全部由 `location.pathname`
+ *     派生(`serve: dsh` 挂载在 /code-server/ 下已验证同一机制),前缀天然跟随每个子请求与 WS 握手。
+ *   - **Host 白名单**:回环模式下只接受 `127.0.0.1|localhost|[::1]:<实际端口>`,挡 DNS rebinding
+ *     (即便请求不带 Origin,originAllowed 也放行不了)。
+ *   - 令牌只存在于文件与 URL 路径里,**不进 argv、不进日志**。
  */
 
 import { createServer as createHttpServer, request as httpRequest } from 'node:http';
-import { createReadStream, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
+import { createReadStream, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { connect } from 'node:net';
 import { dirname, extname, join, normalize, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -36,6 +49,10 @@ function parseArgs(argv) {
     parentPid: null,
     locale: null,
     disableProxy: false,
+    /** 路径令牌文件(host 写;回环模式下必给)。 */
+    tokenFile: null,
+    /** 实际监听地址回报文件(launcher 写;host 读)。 */
+    endpointFile: null,
     /** ?v= 缓存击穿标记(host 传 DSHCS_HTML_TAG;为空则每次启动生成一个)。 */
     htmlTag: process.env.DSHCS_HTML_TAG ?? null,
   };
@@ -47,6 +64,8 @@ function parseArgs(argv) {
     else if (a === '--host') out.host = argv[++i];
     else if (a === '--port') out.port = Number(argv[++i]);
     else if (a === '--pipe') out.pipe = argv[++i];
+    else if (a === '--token-file') out.tokenFile = argv[++i];
+    else if (a === '--endpoint-file') out.endpointFile = argv[++i];
     else if (a === '--parent-pid') out.parentPid = Number(argv[++i]);
     else if (a === '--locale') out.locale = argv[++i];
     else if (a === '--disable-proxy') out.disableProxy = true;
@@ -63,6 +82,20 @@ const tree = resolve(args.tree);
 const serverMain = join(tree, 'lib', 'vscode', 'out', 'server-main.js');
 if (!existsSync(serverMain)) fail(`不是一棵 VS Code 树(缺少 ${serverMain})`);
 if (args.pipe === null && !Number.isFinite(args.port)) fail('必须给 --port 或 --pipe');
+// 端口 0 = 由系统分配空闲端口(host 从 --endpoint-file 读回实际值)
+if (args.pipe === null && (!Number.isInteger(args.port) || args.port < 0 || args.port > 65535)) fail(`--port 非法: ${args.port}`);
+
+/** 路径令牌:非空 → 要求 URL 以此为前缀(见文件头"安全模型")。 */
+const TOKEN_RE = /^[0-9A-Za-z_-]{16,128}$/;
+const pathToken = (() => {
+  if (args.tokenFile === null) return null;
+  let raw;
+  try { raw = readFileSync(args.tokenFile, 'utf8').trim(); } catch (error) { fail(`读不到令牌文件 ${args.tokenFile}: ${error.message}`); }
+  if (!TOKEN_RE.test(raw)) fail(`令牌文件内容不合法(应为 16~128 位 [0-9A-Za-z_-]): ${args.tokenFile}`);
+  return raw;
+})();
+if (args.pipe !== null && pathToken !== null) fail('管道模式下不需要 --token-file(DSH 侧已做鉴权)');
+const prefix = pathToken === null ? null : `/${pathToken}`;
 
 const userDataDir = resolve(args.userDataDir ?? join(PACKAGE_ROOT, '.dshcs-data', 'user-data'));
 const extensionsDir = resolve(args.extensionsDir ?? join(userDataDir, '..', 'extensions'));
@@ -253,6 +286,31 @@ function originAllowed(req) {
   return host === origin;
 }
 
+/** 回环模式下的 Host 白名单:只接受本机字面量 + **实际**监听端口。
+ *  为什么必须:originAllowed() 对"不带 Origin"的请求放行(本地工具/测试需要),而 DNS rebinding
+ *  恰恰能构造出不带 Origin 的请求 —— 没有这道检查,一个恶意页面就能用 127.0.0.1 以外的域名
+ *  打到本机端口上。端口在 listen 之后才确定,故用变量在请求到达时求值。 */
+let boundPort = Number.isFinite(args.port) ? args.port : 0;
+function hostAllowed(req) {
+  if (prefix === null) return true; // 管道模式:Host 由 DSH 的 webServer 决定,已过 requestRejection
+  const host = getHostHeader(req);
+  if (host === undefined || host === '') return false;
+  const m = /^(\[[0-9a-fA-F:.]+\]|[^:]+)(?::(\d+))?$/.exec(host);
+  if (m === null) return false;
+  const name = m[1].replace(/^\[/, '').replace(/\]$/, '').toLowerCase();
+  const port = m[2] === undefined ? 80 : Number(m[2]);
+  if (port !== boundPort) return false;
+  return name === '127.0.0.1' || name === 'localhost' || name === '::1' || name === String(args.host).toLowerCase();
+}
+
+/** 校验并剥掉路径令牌前缀。返回 null = 前缀不对(调用方回 404,不泄露"这里是个 IDE")。 */
+function stripToken(url) {
+  if (prefix === null) return url;
+  if (url === prefix) return '/';
+  if (url.startsWith(`${prefix}/`)) return url.slice(prefix.length);
+  return null;
+}
+
 // ---------------------------------------------------------------- HTTP / WS 分发
 
 /** 工作台 HTML 的响应改写:给 workbench.js / workbench.css / nls 资源加 `?v=<tag>` 缓存击穿。
@@ -310,16 +368,39 @@ function interceptHtmlResponse(res) {
 
 const server = createHttpServer((req, res) => {
   const url = req.url ?? '/';
+  // 令牌只出现在 URL 路径里 —— 别让它经 Referer 漏给站外资源
+  res.setHeader('Referrer-Policy', 'no-referrer');
+  if (!hostAllowed(req)) {
+    log(`拒绝 Host 头: host=${req.headers.host ?? '-'} ${req.method} ${url}`);
+    res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end('forbidden');
+    return;
+  }
+  // 前缀少了结尾斜杠 → 302 补上(否则文档里的相对引用会从根开始解析)
+  if (prefix !== null && url.split('?')[0] === prefix) {
+    const query = url.slice(prefix.length);
+    res.writeHead(302, { location: `${prefix}/${query.startsWith('?') ? query : ''}` });
+    res.end();
+    return;
+  }
+  const stripped = stripToken(url);
+  if (stripped === null) {
+    res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' });
+    res.end('not found');
+    return;
+  }
+  req.url = stripped;
   // **按路径匹配,别拿整串比**:客户端加载文档时永远带查询串(`?folder=<cwd>`),
   // 用 `url === '/'` 判断会让改写整条失效(0.3.x 就踩过这个坑);`/healthz`、`/manifest.json`
   // 同理要用路径匹配,否则带查询串的探针会掉到 VS Code 那边变成 404。
-  const urlPath = url.split('?')[0];
+  const urlPath = stripped.split('?')[0];
   if (urlPath === '/healthz') {
     res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
     res.end(JSON.stringify({
       ok: true,
       productPath,
       pid: process.pid,
+      port: boundPort,
       mode: args.pipe === null ? 'tcp' : 'pipe',
       htmlTag: args.htmlTag,
       recentUpgrades: recentUpgrades.slice(-3),
@@ -357,6 +438,17 @@ server.on('upgrade', (req, socket, head) => {
   const url = req.url ?? '/';
   recentUpgrades.push(url);
   if (recentUpgrades.length > 10) recentUpgrades.shift();
+  if (!hostAllowed(req)) {
+    log(`拒绝 Host 头的 WebSocket: host=${req.headers.host ?? '-'} url=${url}`);
+    socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    return;
+  }
+  const stripped = stripToken(url);
+  if (stripped === null) {
+    socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');
+    return;
+  }
+  req.url = stripped;
   // 跨源防护(与 code-server 一致:只卡 upgrade,HTTP 侧 VS Code 仅接受 GET 且状态变更都走 WS)
   if (!originAllowed(req)) {
     log(`拒绝跨源 WebSocket:origin=${req.headers.origin} host=${req.headers.host ?? '-'} url=${url}`);
@@ -364,7 +456,7 @@ server.on('upgrade', (req, socket, head) => {
     return;
   }
   if (!args.disableProxy) {
-    const target = proxyTarget(url);
+    const target = proxyTarget(stripped);
     if (target !== null) { handleProxyUpgrade(req, socket, head, target); return; }
   }
   socket.pause();
@@ -418,11 +510,35 @@ try {
 const listenTarget = args.pipe === null ? { host: args.host, port: args.port } : args.pipe;
 server.on('error', (error) => { fail(`监听失败(${JSON.stringify(listenTarget)}): ${error.message}`); });
 
+/** 把**实际**监听地址写给 host(端口 0 时 host 只能从这里知道端口;原子写避免读到半截)。 */
+function writeEndpoint(addr) {
+  if (args.endpointFile === null) return;
+  const payload = {
+    host: addr.address,
+    port: addr.port,
+    pid: process.pid,
+    productPath,
+    mode: args.pipe === null ? 'tcp' : 'pipe',
+    tokenized: prefix !== null,
+    startedAt: Date.now(),
+  };
+  try {
+    const tmp = `${args.endpointFile}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8');
+    renameSync(tmp, args.endpointFile);
+  } catch (error) {
+    log(`写 endpoint 文件失败(${args.endpointFile}): ${error.message}`);
+  }
+}
+
 server.listen(listenTarget, () => {
   const addr = server.address();
   const shown = typeof addr === 'string' ? addr : `${addr.address}:${addr.port}`;
+  if (typeof addr === 'object' && addr !== null) boundPort = addr.port;
+  if (typeof addr === 'object' && addr !== null) writeEndpoint(addr);
   log(`listening on ${shown} (tree=${tree})`);
   log(`user-data-dir=${userDataDir} extensions-dir=${extensionsDir}`);
+  log(`path token: ${prefix === null ? '(无)' : '已启用(URL 前缀,不写日志)'}`);
   console.log(`dshcs-ready ${productPath} ${args.pipe === null ? 'tcp' : 'pipe'} ${shown}`);
 });
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-code-server-app",
-  "version": "0.2.13",
-  "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
+  "version": "0.3.6",
+  "description": "VS Code (from a code-server release) inside DSH: a right-sidebar tab driven by the plugin's own launcher over the in-process VS Code server (lib/launcher.mjs). Since 0.3.0 the bundle also ships an editor bridge (assets/extensions/dshcs-editor-bridge): a read-only channel between the in-tree VS Code extension host and DSH, giving the agent what only the editor knows (unsaved buffers, language-server diagnostics, the active selection) and letting editor gestures drive the session. The tab claims DSH file addresses (dsh-resource://file/**) by file type (setting claimExtensions), so the product's own produced-file chips, delivered-file previews and inline prose mentions open in the workbench. The IDE is a resident surface moved with Element.moveBefore instead of being remounted, so switching sidebar tabs no longer reloads it. Opening the tab switches the right sidebar to fullscreen by default (setting fullscreenOnOpen). Following a workspace switch is lightweight: the workbench re-navigates with the new ?folder= and the IDE process is not restarted (since 0.2.12). Requires a DSH with the right-sidebar services (sidebarRightTabs/sidebarRight, >= 0.1.5-alpha.1); older DSH versions get a single upgrade notice on the settings page and no other UI. Two serving modes: loopback port (default) or same-origin mount on DSH's own webServer (/code-server, protected by ctx.connection.requestRejection). No code-server Node layer, no argon2, no C++ toolchain.",
   "homepage": "https://github.com/jinsiyu/dsh-code-server-app",
   "repository": {
     "type": "git",
@@ -41,6 +41,11 @@
     "lib/index.js",
     "lib/client.js",
     "lib/claim-types.js",
+    "lib/bridge.mjs",
+    "lib/bridge-tools.mjs",
+    "lib/bridge-session.mjs",
+    "lib/bridge-observe.mjs",
+    "lib/dsh-resolve.mjs",
     "lib/launcher.mjs",
     "lib/serve-dsh.mjs",
     "lib/vendor.js",
@@ -48,6 +53,7 @@
     "assets/favicon.ico",
     "assets/favicon.svg",
     "assets/extensions/dshcs-open-file",
+    "assets/extensions/dshcs-editor-bridge",
     "scripts/vendor-vscode-server.mjs",
     "scripts/vendor-code-server.mjs",
     "scripts/vendor-repacks.mjs",
@@ -117,6 +123,8 @@
     "test:launcher-routes": "node scripts/test-launcher-routes.mjs",
     "test:fullscreen": "node scripts/test-sidebar-fullscreen.mjs",
     "test:claim-types": "node scripts/test-claim-types.mjs",
-    "test:workspace-switch": "node scripts/test-workspace-switch.mjs"
+    "test:workspace-switch": "node scripts/test-workspace-switch.mjs",
+    "test:bridge-routes": "node scripts/test-bridge-routes.mjs",
+    "test:bridge-extension": "node scripts/test-bridge-extension.mjs"
   }
 }

package/vendor/VENDOR.json

@@ -3,7 +3,7 @@
   "vscodeVersion": "1.137.0",
   "productPath": "stable-b11dabdaca0d3369986975be285db92c8795cea5",
   "layout": "vscode-only",
-  "preparedAt": "2026-09-11T14:13:32.827Z",
+  "preparedAt": "2026-09-11T15:40:32.321Z",
   "source": "registry",
   "node": "v24.13.1",
   "platform": "win32",