dsh-deeppilot 0.2.1 → 0.2.2

package/lib/index.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { createServer } from "node:http";
 import { createPrivateKey, randomBytes, randomUUID, sign, timingSafeEqual } from "node:crypto";
 import { access, mkdir, readFile, rename, writeFile } from "node:fs/promises";
@@ -11,6 +12,7 @@ import { connect } from "node:http2";
 import { spawn } from "node:child_process";
 import { constants } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { request } from "node:https";
 //#region src/token.ts
 /** Expand a leading ~ using the process home directory. */
 function expandHome(p) {
@@ -2322,9 +2324,13 @@ function parseReport(value) {
 	const lanAddresses = s.lanAddresses;
 	if (!Array.isArray(devices)) reject("devices");
 	if (!Array.isArray(lanAddresses) || lanAddresses.some((value) => typeof value !== "string")) reject("lanAddresses");
+	const releaseUrl = s.releaseUrl;
 	return {
 		protocolVersion: num(s, "protocolVersion", "protocolVersion"),
 		serverVersion: str(s, "serverVersion", "serverVersion"),
+		pluginVersion: str(s, "pluginVersion", "pluginVersion"),
+		...s.updateAvailable === true ? { updateAvailable: true } : {},
+		...typeof releaseUrl === "string" && releaseUrl.length > 0 ? { releaseUrl } : {},
 		enabled: bool(s, "enabled", "enabled"),
 		tokenPath: str(s, "tokenPath", "tokenPath"),
 		tokenReady: bool(s, "tokenReady", "tokenReady"),
@@ -2876,9 +2882,30 @@ function parseHelperEvent(line) {
 		return null;
 	}
 }
-function bundledHelperPath() {
+/** Build the list of candidate locations for the embedded tunnel helper, in
+*  priority order. The first existing executable wins at start() time. The
+*  order matters: explicit config (handled by the caller) > npm install
+*  layout > DSH-bundled layout > user data dir. */
+function bundledHelperCandidates() {
 	const here = dirname(fileURLToPath(import.meta.url));
-	return resolve(here, "..", "bin", `${process.platform}-${process.arch}`, "dsh-deeppilot-tunnel");
+	const pkgRoot = resolve(here, "..");
+	const fileName = process.platform === "win32" ? "dsh-deeppilot-tunnel.exe" : "dsh-deeppilot-tunnel";
+	const platformDir = `${process.platform}-${process.arch}`;
+	const candidates = [];
+	candidates.push(resolve(pkgRoot, "bin", platformDir, fileName));
+	candidates.push(resolve(pkgRoot, "..", "..", "..", "node_modules", "dsh-deeppilot", "bin", platformDir, fileName));
+	candidates.push(resolve(pkgRoot, "..", "..", "dsh-deeppilot", "bin", platformDir, fileName));
+	candidates.push(resolve(pkgRoot, "..", "..", "..", "..", "node_modules", "dsh-deeppilot", "bin", platformDir, fileName));
+	try {
+		const resolved = createRequire(import.meta.url).resolve(`dsh-deeppilot/bin/${platformDir}/${fileName}`);
+		if (!candidates.includes(resolved)) candidates.push(resolved);
+	} catch {}
+	const home = process.env.DSH_HOME?.trim() || process.env.HOME || process.env.USERPROFILE;
+	if (home && home.length > 0) {
+		const dataDir = resolve(home, ".dsh");
+		candidates.push(join(dataDir, "deeppilot", "bin", platformDir, fileName));
+	}
+	return candidates;
 }
 /** Owns exactly one embedded tunnel helper and restarts it after failures. */
 var RemoteSupervisor = class {
@@ -2901,10 +2928,29 @@ var RemoteSupervisor = class {
 	}
 	async start(originURL) {
 		if (!this.options.enabled || this.child !== void 0 || this.stopping) return;
-		const helper = expandHome(this.options.helperPath ?? bundledHelperPath());
 		const statePath = expandHome(this.options.statePath);
+		const configured = this.options.helperPath?.trim() ?? "";
+		const candidates = configured ? [expandHome(configured)] : bundledHelperCandidates();
+		let helper;
+		let lastError;
+		for (const candidate of candidates) try {
+			await access(candidate, constants.X_OK);
+			helper = candidate;
+			break;
+		} catch (error) {
+			lastError = error;
+		}
+		if (helper === void 0) {
+			if (this.stopping) return;
+			const platform = `${process.platform}-${process.arch}`;
+			const message = configured ? `embedded tunnel helper unavailable: ${configured}: ${String(lastError ?? "not found")}` : `embedded tunnel helper not found for ${platform} (tried: ${candidates.join(", ")}); set remote.helperPath to override`;
+			this.setStatus({
+				phase: "unavailable",
+				message
+			});
+			return;
+		}
 		try {
-			await access(helper, constants.X_OK);
 			await mkdir(statePath, {
 				recursive: true,
 				mode: 448
@@ -2913,7 +2959,7 @@ var RemoteSupervisor = class {
 			if (this.stopping) return;
 			this.setStatus({
 				phase: "unavailable",
-				message: `embedded tunnel helper unavailable: ${String(error)}`
+				message: `cannot create remote state dir: ${String(error)}`
 			});
 			return;
 		}
@@ -3076,6 +3122,203 @@ function localLANIPv4Addresses() {
 	return [...new Set(candidates.map(({ address }) => address))];
 }
 //#endregion
+//#region src/update-check.ts
+/**
+* Lightweight self-update check for dsh-deeppilot.
+*
+* On Host boot we ask the GitHub Releases API (REST) which is the latest
+* stable tag, compare it to the installed plugin version, and surface a
+* "newer release exists" flag plus the GitHub release URL through the
+* report Remote. The settings page renders one small line at the bottom;
+* a successful check is enough — no manual button, no persistent cache
+* (the host process is the lifetime of the answer).
+*
+* Deliberately no third-party dependency: we use {@link https.request}
+* directly to keep parity with the rest of the project (remote-supervisor
+* uses node:http, host-bridge uses ws, etc).
+*
+* Failure policy: every network/parse error collapses to a single log
+* line and the in-memory snapshot stays "unknown". The bridge must never
+* crash because GitHub rate-limited us, returned a 5xx, or the user is
+* offline.
+*/
+/** GitHub repo (no .git suffix). Public, unauthenticated, low rate limit. */
+const RELEASES_PATH = "/repos/Mars-Sea/dsh-deeppilot/releases";
+/** Hard ceiling on the network round-trip. The host must never hang. */
+const FETCH_TIMEOUT_MS = 8e3;
+/** Per-page limit. We only need the first stable release, but pre-releases
+*  tend to be listed first; fetching 20 gives the comparator enough room. */
+const PER_PAGE = 20;
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseStableEntry(value) {
+	if (!isPlainObject(value)) return null;
+	const tag = value.tag_name;
+	if (typeof tag !== "string") return null;
+	if (value.prerelease === true || value.draft === true) return null;
+	if (parseStableTag(tag) === null) return null;
+	const url = value.html_url;
+	return {
+		tag,
+		url: typeof url === "string" ? url : null
+	};
+}
+/** Parse one stable release from the `tag_name` shape `vX.Y.Z` (the v is
+*  optional; `1.2.3` is also accepted). Pre-release tags like `0.3.0-rc.1`
+*  return null — the policy is "stable channel only". */
+function parseStableTag(tag) {
+	const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(tag.trim());
+	if (match === null) return null;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3])
+	};
+}
+/** Semver compare for X.Y.Z. Returns -1 / 0 / 1. */
+function compareSemver(a, b) {
+	const pa = parseStableTag(a);
+	const pb = parseStableTag(b);
+	if (pa === null && pb === null) return 0;
+	if (pa === null) return -1;
+	if (pb === null) return 1;
+	if (pa.major !== pb.major) return pa.major < pb.major ? -1 : 1;
+	if (pa.minor !== pb.minor) return pa.minor < pb.minor ? -1 : 1;
+	if (pa.patch !== pb.patch) return pa.patch < pb.patch ? -1 : 1;
+	return 0;
+}
+/** Hit the GitHub Releases API. Resolves with the first stable release
+*  GitHub returned, or null if the list contains no stable entries.
+*  Network / parse errors reject — the caller is responsible for
+*  collapsing them to a log line. */
+function fetchLatestStableRelease() {
+	return new Promise((resolve, reject) => {
+		const req = request({
+			method: "GET",
+			host: "api.github.com",
+			path: `${RELEASES_PATH}?per_page=${PER_PAGE}`,
+			headers: {
+				"user-agent": "dsh-deeppilot-update-check",
+				"accept": "application/vnd.github+json"
+			}
+		}, (res) => {
+			const status = res.statusCode ?? 0;
+			if (status < 200 || status >= 300) {
+				res.resume();
+				reject(/* @__PURE__ */ new Error(`github releases http ${status}`));
+				return;
+			}
+			const chunks = [];
+			res.on("data", (chunk) => chunks.push(chunk));
+			res.on("end", () => {
+				try {
+					const body = Buffer.concat(chunks).toString("utf8");
+					const parsed = JSON.parse(body);
+					if (!Array.isArray(parsed)) {
+						reject(/* @__PURE__ */ new Error("github releases: response is not an array"));
+						return;
+					}
+					for (const entry of parsed) {
+						const stable = parseStableEntry(entry);
+						if (stable !== null) {
+							resolve(stable);
+							return;
+						}
+					}
+					resolve(null);
+				} catch (error) {
+					reject(error instanceof Error ? error : new Error(String(error)));
+				}
+			});
+			res.on("error", (error) => reject(error));
+		});
+		req.setTimeout(FETCH_TIMEOUT_MS, () => {
+			req.destroy(/* @__PURE__ */ new Error("github releases: timeout after 8000ms"));
+		});
+		req.on("error", (error) => reject(error));
+		req.end();
+	});
+}
+/**
+* Process-wide check state. Constructed once in `apply()`, queried
+* synchronously by the report snapshot. The check itself fires once in
+* the background shortly after boot; the answer lives for the lifetime
+* of the host process — re-running the page in the Web UI does not
+* trigger another network call.
+*/
+var UpdateChecker = class {
+	log;
+	currentVersion;
+	fetchImpl;
+	initialDelayMs;
+	snapshot;
+	inflight = null;
+	constructor(options) {
+		this.log = options.log;
+		this.currentVersion = options.currentVersion;
+		this.fetchImpl = options.fetchImpl ?? fetchLatestStableRelease;
+		this.initialDelayMs = options.initialDelayMs ?? 2e3;
+		this.snapshot = {
+			currentVersion: this.currentVersion,
+			available: false,
+			releaseUrl: null,
+			latestVersion: null
+		};
+	}
+	/** Return the current in-memory snapshot — safe to call from any host
+	*  thread. Never throws, never awaits. */
+	get() {
+		return this.snapshot;
+	}
+	/**
+	* Schedule one background refresh after the configured initial delay.
+	* Used by the plugin entry to do the first check without blocking boot.
+	*/
+	scheduleInitial() {
+		if (this.initialDelayMs <= 0) {
+			this.runOnce();
+			return;
+		}
+		const timer = setTimeout(() => {
+			this.runOnce();
+		}, this.initialDelayMs);
+		if (typeof timer.unref === "function") timer.unref();
+	}
+	async runOnce() {
+		if (this.inflight !== null) {
+			await this.inflight;
+			return;
+		}
+		const task = (async () => {
+			try {
+				const stable = await this.fetchImpl();
+				if (stable === null) return;
+				if (compareSemver(stable.tag, this.currentVersion) > 0) this.snapshot = {
+					currentVersion: this.currentVersion,
+					available: true,
+					releaseUrl: stable.url,
+					latestVersion: stable.tag
+				};
+				else this.snapshot = {
+					currentVersion: this.currentVersion,
+					available: false,
+					releaseUrl: null,
+					latestVersion: null
+				};
+			} catch (error) {
+				this.log("update check failed: " + (error instanceof Error ? error.message : String(error)));
+			}
+		})();
+		this.inflight = task.finally(() => {
+			this.inflight = null;
+		});
+		return this.inflight;
+	}
+	/** No-op kept for API symmetry with the host lifecycle wiring. */
+	dispose() {}
+};
+//#endregion
 //#region src/index.ts
 /**
 * dsh-deeppilot — data bridge between the DSH host and DeepPilot
@@ -3134,7 +3377,7 @@ const Config = z.object({
 		relayToken: ""
 	})
 });
-const SERVER_VERSION = "0.2.0";
+const SERVER_VERSION = readOwnPackageVersion();
 const MAX_CLIENT_CONNECTIONS = 16;
 /**
 * Single-frame bound. Covers the protocol maximum (4 × 8 MB base64 images
@@ -3142,6 +3385,22 @@ const MAX_CLIENT_CONNECTIONS = 16;
 * pre-hello buffering far below ws's 100 MiB default.
 */
 const MAX_FRAME_BYTES = 67108864;
+/**
+* Resolve the host plugin's own version from the installed package.json.
+* Sourced at boot so the wire / UI always agrees with what npm published.
+* `createRequire(import.meta.url)` is the tsdown-bundled ESM equivalent of
+* CommonJS's `require`; the package.json sits next to lib/index.js after
+* the build, so `../package.json` resolves to the published manifest.
+*/
+function readOwnPackageVersion() {
+	try {
+		const pkg = createRequire(import.meta.url)("../package.json");
+		if (typeof pkg.version === "string" && pkg.version.length > 0) return pkg.version;
+	} catch {}
+	const envVersion = process.env.npm_package_version;
+	if (typeof envVersion === "string" && envVersion.length > 0) return envVersion;
+	return "0.0.0+unknown";
+}
 function rejectUpgrade(socket, status, reason) {
 	const body = JSON.stringify({ error: reason });
 	socket.end("HTTP/1.1 " + status + " Forbidden\r\nContent-Type: application/json\r\nContent-Length: " + Buffer.byteLength(body) + "\r\nConnection: close\r\n\r\n" + body);
@@ -3588,6 +3847,12 @@ function apply(ctx, options) {
 		phase: currentConfig().remote?.enabled === true ? "stopped" : "disabled",
 		updatedAt: Date.now()
 	};
+	const updateChecker = new UpdateChecker({
+		log,
+		currentVersion: SERVER_VERSION
+	});
+	updateChecker.scheduleInitial();
+	const updateInfo = () => updateChecker.get();
 	applyReportRemote(ctx, async () => {
 		let tokenReady = false;
 		let devices = [];
@@ -3606,9 +3871,13 @@ function apply(ctx, options) {
 				} } : {}
 			}));
 		} catch {}
+		const update = updateInfo();
 		return {
 			protocolVersion: 1,
 			serverVersion: SERVER_VERSION,
+			pluginVersion: update.currentVersion,
+			...update.available ? { updateAvailable: true } : {},
+			...update.releaseUrl !== null ? { releaseUrl: update.releaseUrl } : {},
 			enabled: currentConfig().enabled === true,
 			tokenPath: expandHome(currentConfig().authTokenPath ?? join(bridgeDataDir(), "auth-token")),
 			tokenReady,