dsh-desktop-link 1.0.0 → 1.2.1

package/index.js

@@ -1,12 +1,15 @@
 /**
  * dsh-desktop-link —— 宿主半区。
  *
- * 只做一件事：把两个地址交给浏览器半区。
- * 唯一的路由是一条只读 JSON：
+ * 只做一件事：把两个地址交给浏览器半区，并允许在界面上改这两个地址。
+ * 路由（均为同源 JSON）：
  *
- *   GET /api/desktop-link/info
+ *   GET  /api/desktop-link/info
  *     → { ok, launchUrl, desktopUrl, source }
  *
+ *   POST /api/desktop-link/config   { desktopUrl?, launchUrl? }
+ *     → { ok, path, launchUrl, desktopUrl, source }；写入 $DSH_HOME/desktop-url.txt
+ *
  *   launchUrl   点按钮时真正打开的地址（可以是中转的一次性链接）
  *   desktopUrl  桌面版 GUI 的长期地址（书签用，也是 launchUrl 的兜底）
  *
@@ -20,9 +23,84 @@
  * 用来指向 dsha-pair/bridge.py 的 /open.html（每次点都铸一枚新码）。
  * 没配 launchUrl 时，launchUrl 恒等于 desktopUrl。
  */
-import { existsSync, readFileSync } from 'node:fs'
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/**
+ * Resolve `@deepseek-ai/schemastery`, which ships inside the harness
+ * installation rather than as a dependency of this package.
+ *
+ * A bare `import` here fails with ERR_MODULE_NOT_FOUND and takes the whole
+ * plugin down, so the module is located at runtime: first as a normal package
+ * import from this file, then by walking up from the running `dsh` binary (the
+ * harness's own node_modules), and finally by asking Node's global paths. The
+ * `Config` export is omitted entirely when none of those resolve — the plugin
+ * still works from config files, it just has no settings form.
+ * @returns the schemastery `z` function, or undefined.
+ */
+function loadSchemastery() {
+  const requireFrom = createRequire(import.meta.url)
+  const candidates = ['@deepseek-ai/schemastery']
+
+  // The harness entry point: .../node_modules/@deepseek-ai/dsh/lib/bin.js
+  const argv1 = process.argv[1]
+  if (typeof argv1 === 'string' && argv1) {
+    const dir = dirname(resolve(argv1))
+    candidates.push(join(dir, '..', 'node_modules', '@deepseek-ai', 'schemastery'))
+    candidates.push(join(dir, 'node_modules', '@deepseek-ai', 'schemastery'))
+  }
+  try {
+    for (const base of requireFrom.resolve.paths?.('@deepseek-ai/schemastery') ?? []) {
+      candidates.push(join(base, '@deepseek-ai', 'schemastery'))
+    }
+  } catch {
+    // resolve.paths is not on every Node build; the other candidates stand.
+  }
+
+  for (const candidate of candidates) {
+    try {
+      const mod = requireFrom(candidate)
+      const z = mod?.default ?? mod
+      if (typeof z === 'function' && typeof z.object === 'function') return z
+    } catch {
+      // try the next candidate
+    }
+  }
+  return undefined
+}
+
+const z = loadSchemastery()
+
+/**
+ * Row config.
+ *
+ * Everything is optional. An install with no config falls through to the
+ * environment, then to `desktop-url.txt`, then to the relay origin that
+ * `dsh-remote-web-ui` publishes. The form exists so a phone — where there is no
+ * shell to write that file with — can set the address from the GUI.
+ *
+ * The loader validates Config through schemastery's own `meta`/`dict` shape, so
+ * a plain JSON Schema object is not interchangeable here (`undefined.validate`
+ * when it tries). When schemastery cannot be located the export is omitted: no
+ * settings form, but the row still activates.
+ */
+const configSchema = typeof z === 'function'
+  ? z.object({
+    desktopUrl: z.string().description(
+      '桌面版 DSH 的长期地址（书签用），例如 https://xxx.dsh-market.com。'
+      + '留空则依次读环境变量 DSH_DESKTOP_URL、$DSH_HOME/desktop-url.txt、'
+      + 'dsh-remote-web-ui 的固定中继地址。'),
+    launchUrl: z.string().description(
+      '点按钮时真正打开的地址。留空则等于 desktopUrl。'
+      + '填一个会临时铸配对码的端点（如 bridge.py 的 /open.html?k=…），'
+      + '未配对过的手机也能一次进入。'),
+  })
+  : undefined
+
+export { configSchema as Config }
 
 function dshHome() {
   const fromEnv = process.env.DSH_HOME
@@ -122,32 +200,211 @@ function resolveUrls(config) {
   return { launchUrl, desktopUrl, source }
 }
 
+/**
+ * Nothing to do here — kept as the single place that maps a URL string to a
+ * file line, so the write path and the read path agree on what counts as a URL.
+ * @param value - candidate URL.
+ * @returns the trimmed URL, or an empty string when it is not http(s).
+ */
+/** Minimal HTML escaping for the fallback page. */
+function escapeHtml(value) {
+  return String(value ?? '').replace(/[&<>"']/g, (ch) => (
+    ch === '&' ? '&amp;' : ch === '<' ? '&lt;' : ch === '>' ? '&gt;' : ch === '"' ? '&quot;' : '&#39;'
+  ))
+}
+
+/**
+ * Whether a request came from this origin.
+ *
+ * `/api/desktop-link/set` writes a URL on a bare GET, and registered routes
+ * sit outside the harness's own auth fence — so the check has to be here or any
+ * page on the internet could repoint the user's button with an image tag.
+ * A request typed into the address bar arrives with no Origin and no
+ * `Sec-Fetch-Site`; that is allowed on purpose, because it is the exact case
+ * the fallback page exists for.
+ * @param req - the incoming request.
+ * @returns whether the request is same-origin (or origin-less).
+ */
+function sameOrigin(req) {
+  try {
+    const site = String(req.headers['sec-fetch-site'] ?? '')
+    if (site === 'cross-site') return false
+    const origin = String(req.headers.origin ?? '')
+    if (!origin) return true
+    return new URL(origin).host === String(req.headers.host ?? '')
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Send the fallback page.
+ * @param res - the response.
+ * @param status - HTTP status.
+ * @param title - heading and document title.
+ * @param body - one paragraph of outcome text.
+ */
+function sendPage(res, status, title, body) {
+  const page = `<!doctype html><meta charset="utf-8">`
+    + `<meta name="viewport" content="width=device-width,initial-scale=1">`
+    + `<title>${escapeHtml(title)}</title>`
+    + `<body style="font:15px/1.6 system-ui,-apple-system,sans-serif;padding:24px;max-width:720px;color:#222">`
+    + `<h1 style="font-size:18px;margin:0 0 12px">${escapeHtml(title)}</h1>`
+    + `<p style="margin:0 0 16px;word-break:break-all">${escapeHtml(body)}</p>`
+    + `<p style="margin:0"><a href="/" style="color:#4d6bfe">← DSH</a></p></body>`
+  res.writeHead(status, {
+    'content-type': 'text/html; charset=utf-8',
+    'content-length': Buffer.byteLength(page),
+    'cache-control': 'no-store',
+  })
+  res.end(page)
+}
+
+function cleanUrl(value) {
+  return urlish(value)
+}
+
+/**
+ * Persist both addresses to `$DSH_HOME/desktop-url.txt`.
+ *
+ * Written to a sibling temp file and renamed into place: a half-written file
+ * would be read back by the next `/api/desktop-link/info` and silently point
+ * the button at a truncated URL. An empty pair removes the file entirely, which
+ * restores the relay-registry fallback instead of pinning a dead address.
+ * @param desktopUrl - the long-lived origin, or ''.
+ * @param launchUrl - what a click opens, or '' for "same as desktopUrl".
+ * @returns the file path written, or '' when the file was removed.
+ */
+function writeUrlFile(desktopUrl, launchUrl) {
+  const file = join(dshHome(), 'desktop-url.txt')
+  const lines = []
+  if (desktopUrl) lines.push(desktopUrl)
+  // Line 2 only carries meaning next to a line 1; a lone launchUrl is written
+  // as line 1 so a user who only knows the minting endpoint still gets one.
+  if (launchUrl && launchUrl !== desktopUrl) {
+    if (lines.length === 0) lines.push(launchUrl)
+    else lines.push(launchUrl)
+  }
+  if (lines.length === 0) {
+    try { rmSync(file, { force: true }) } catch { /* already gone */ }
+    return ''
+  }
+  const payload = `${lines.join('\n')}\n`
+  const tmp = `${file}.tmp`
+  writeFileSync(tmp, payload, { encoding: 'utf8', mode: 0o600 })
+  try {
+    renameSync(tmp, file)
+  } catch {
+    // Android's proot rootfs can refuse a rename across its overlay; a direct
+    // write is not atomic but it still leaves a complete file, which beats a
+    // settings form that can never save.
+    writeFileSync(file, payload, { encoding: 'utf8', mode: 0o600 })
+    try { rmSync(tmp, { force: true }) } catch { /* best effort */ }
+  }
+  return file
+}
+
+/**
+ * Read a small JSON request body.
+ *
+ * Bounded on purpose: this route is reachable from any paired device, and an
+ * unbounded read would let one request hold the process's memory. The cap is
+ * far above the two URLs the form sends.
+ * @param req - the incoming request.
+ * @returns the parsed object, or null when the body is absent, oversized, or
+ * not JSON.
+ */
+function readJsonBody(req) {
+  return new Promise((resolveBody) => {
+    const chunks = []
+    let size = 0
+    let settled = false
+    const finish = (value) => {
+      if (settled) return
+      settled = true
+      resolveBody(value)
+    }
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > 8192) { finish(null); req.destroy(); return }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (!chunks.length) return finish({})
+      const text = Buffer.concat(chunks).toString('utf8')
+      try {
+        const parsed = JSON.parse(text)
+        return finish(parsed && typeof parsed === 'object' ? parsed : null)
+      } catch {
+        // Some WebViews send a form body even when asked for JSON.
+      }
+      try {
+        const form = new URLSearchParams(text)
+        const out = {}
+        for (const [key, value] of form) out[key] = value
+        return finish(Object.keys(out).length ? out : null)
+      } catch {
+        return finish(null)
+      }
+    })
+    req.on('error', () => finish(null))
+  })
+}
+
 /** Host half: publish the desktop address. */
 export const inject = ['webServer']
 
 /**
- * Register the info route, the launch route, and the index global.
+ * Register the info route and the index global.
  *
  * The browser half reads `globalThis.__DSHA_DESKTOP_LINK__` synchronously, so
  * the button is usable on first paint. `paired` tells it whether this instance
  * ever paired a device: when it never has, the client mints a token itself
  * through `/api/pair/issue` (same-origin, loopback, so the pairing service
  * answers) instead of opening a URL that would hit the harness 401 fence.
+ *
+ * `config` is read per request rather than captured once: the settings form
+ * writes through the Host's config layer, and a request that arrived after such
+ * a write must see the new value without a restart.
  * @param ctx - host plugin context carrying webServer.
- * @param config - the row's config (`{ desktopUrl?, launchUrl? }`).
+ * @param config - the row's live config (`{ desktopUrl?, launchUrl? }`).
  */
 export function apply(ctx, config) {
+  /**
+   * A Cordis config value may be a getter-backed proxy that throws when a field
+   * is read outside the loader's own evaluation, so every read is guarded: a
+   * failing field is treated as absent, and the chain simply continues.
+   */
+  const field = (name) => {
+    try {
+      const source = typeof config === 'function' ? config() : config
+      const value = source?.[name]
+      return typeof value === 'string' ? value : ''
+    } catch {
+      return ''
+    }
+  }
+  const live = () => resolveUrls({ desktopUrl: field('desktopUrl'), launchUrl: field('launchUrl') })
+
   const disposeGlobal = ctx.on('webserver/index-inject', (table) => {
-    table.push({ kind: 'global', name: '__DSHA_DESKTOP_LINK__', value: resolveUrls(config) })
+    table.push({ kind: 'global', name: '__DSHA_DESKTOP_LINK__', value: live() })
   })
 
   const info = ctx.webServer.register({
     kind: 'exact',
     path: '/api/desktop-link/info',
     handler(_req, res) {
-      // Re-read per request: editing desktop-url.txt takes effect on the next
-      // click without restarting the profile.
-      const body = JSON.stringify({ ok: true, ...resolveUrls(config) })
+      // Re-read per request: editing desktop-url.txt (or saving the settings
+      // form) takes effect on the next click without restarting the profile.
+      // Never let a resolve failure answer with a bare 400 — the button reads
+      // this and a crash here looks exactly like "the plugin is gone".
+      let payload
+      try {
+        payload = { ok: true, ...live() }
+      } catch (error) {
+        payload = { ok: false, error: String(error?.message ?? error) }
+      }
+      const body = JSON.stringify(payload)
       res.writeHead(200, {
         'content-type': 'application/json; charset=utf-8',
         'content-length': Buffer.byteLength(body),
@@ -157,8 +414,113 @@ export function apply(ctx, config) {
     },
   })
 
+  /**
+   * Save the two addresses.
+   *
+   * This is the form a phone can actually reach: DSH renders a settings form
+   * only for entries it considers editable, and an installed bundle's own row
+   * is not always one of them. The route writes the same file the file-based
+   * chain reads, so both entry points converge on one source of truth.
+   *
+   * POST /api/desktop-link/config  { desktopUrl?, launchUrl? }
+   */
+  const save = ctx.webServer.register({
+    kind: 'exact',
+    path: '/api/desktop-link/config',
+    handler(req, res) {
+      const reply = (status, payload) => {
+        const body = JSON.stringify(payload)
+        res.writeHead(status, {
+          'content-type': 'application/json; charset=utf-8',
+          'content-length': Buffer.byteLength(body),
+          'cache-control': 'no-store',
+        })
+        res.end(body)
+      }
+      if (req.method !== 'POST') return reply(405, { ok: false, error: 'POST only' })
+      readJsonBody(req).catch(() => null).then((body) => {
+        if (!body) return reply(400, { ok: false, error: 'invalid JSON body' })
+        const desktopUrl = cleanUrl(body.desktopUrl)
+        const launchUrl = cleanUrl(body.launchUrl)
+        // A supplied non-empty value that fails validation is an error, not a
+        // silent "unset": the user typed something and deserves to know it was
+        // rejected instead of watching the button stay grey.
+        if (body.desktopUrl && !desktopUrl) {
+          return reply(400, { ok: false, error: 'desktopUrl must be an http(s) URL' })
+        }
+        if (body.launchUrl && !launchUrl) {
+          return reply(400, { ok: false, error: 'launchUrl must be an http(s) URL' })
+        }
+        try {
+          const path = writeUrlFile(desktopUrl, launchUrl)
+          return reply(200, { ok: true, path, ...live() })
+        } catch (error) {
+          return reply(500, { ok: false, error: String(error?.message ?? error) })
+        }
+      })
+    },
+  })
+
+  /**
+   * The no-dialog path.
+   *
+   * Everything the settings panel does, reachable as one URL, so a phone whose
+   * WebView misbehaves — or a user with only a terminal — can still set the
+   * address without touching the sidebar:
+   *
+   *   GET /api/desktop-link/set?desktopUrl=https://xxx.dsh-market.com
+   */
+  const setRoute = ctx.webServer.register({
+    kind: 'exact',
+    path: '/api/desktop-link/set',
+    handler(req, res) {
+      if (req.method !== 'GET') {
+        res.writeHead(405, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+        res.end(JSON.stringify({ ok: false, error: 'GET only' }))
+        return
+      }
+      if (!sameOrigin(req)) {
+        sendPage(res, 403, '已拒绝', '这个地址只能从本机页面写入（跨站请求会被拒绝）。')
+        return
+      }
+      let query
+      try {
+        query = new URL(String(req.url ?? '/'), 'http://127.0.0.1').searchParams
+      } catch {
+        sendPage(res, 400, '参数无法解析', '请求地址无法解析，请重新打开一次。')
+        return
+      }
+      const rawDesktop = query.get('desktopUrl') ?? query.get('desktop') ?? ''
+      const rawLaunch = query.get('launchUrl') ?? query.get('launch') ?? ''
+      if (!rawDesktop && !rawLaunch) {
+        sendPage(res, 400, '缺少参数',
+          '用法：/api/desktop-link/set?desktopUrl=https://xxx.dsh-market.com'
+          + '（可再加 &launchUrl=https://…/open.html?k=…）')
+        return
+      }
+      const desktopUrl = cleanUrl(rawDesktop)
+      const launchUrl = cleanUrl(rawLaunch)
+      if ((rawDesktop && !desktopUrl) || (rawLaunch && !launchUrl)) {
+        sendPage(res, 400, '地址不合法', '只接受 http(s) 地址。')
+        return
+      }
+      try {
+        const file = writeUrlFile(desktopUrl, launchUrl)
+        const now = live()
+        sendPage(res, 200, '已保存',
+          `${file ? `已写入 ${file}。` : '已清空地址文件。'}`
+          + `桌面地址：${now.desktopUrl || '（未配置）'}；点按钮打开：${now.launchUrl || '（未配置）'}。`
+          + '回到 DSH 点一下按钮即可。')
+      } catch (error) {
+        sendPage(res, 500, '保存失败', `写入桌面地址文件时出错：${String(error?.message ?? error)}`)
+      }
+    },
+  })
+
   ctx.effect(() => () => {
     if (typeof disposeGlobal === 'function') disposeGlobal()
     if (typeof info === 'function') info()
-  }, 'dsha-desktop-link: info route + index global')
+    if (typeof save === 'function') save()
+    if (typeof setRoute === 'function') setRoute()
+  }, 'dsha-desktop-link: info + config routes + index global')
 }

package/package.json

@@ -1,59 +1,60 @@
-{
-  "name": "dsh-desktop-link",
-  "version": "1.0.0",
-  "type": "module",
-  "icon": "./icon.svg",
-  "exports": {
-    ".": "./index.js",
-    "./client": "./client.js",
-    "./locale/*.json": "./locale/*.json",
-    "./icon": "./icon.svg",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "index.js",
-    "client.js",
-    "cordis.patch.yml",
-    "icon.svg",
-    "locale"
-  ],
-  "dsh": {
-    "engines": {
-      "dsh": ">=0.2.1-rc.2"
-    },
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "immediately": true,
-      "inject": [
-        "@deepseek-ai/dsh-client-ui-sidebar"
-      ]
-    }
-  },
-  "license": "MIT",
-  "author": "lzlrt",
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek",
-    "deepseek-harness",
-    "dsha",
-    "remote",
-    "sidebar",
-    "mobile"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/lzlrt/dsha-desktop-link.git"
-  },
-  "homepage": "https://github.com/lzlrt/dsha-desktop-link#readme",
-  "bugs": {
-    "url": "https://github.com/lzlrt/dsha-desktop-link/issues"
-  },
-  "description": "DSH sidebar button: open the desktop DSH Web GUI from DSHA on your phone, in one tap.",
-  "engines": {
-    "node": "^22.19.0 || >=24.0.0"
-  }
+{
+  "name": "dsh-desktop-link",
+  "version": "1.2.1",
+  "type": "module",
+  "icon": "./icon.svg",
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "cordis.patch.yml",
+    "icon.svg",
+    "locale",
+    "assets"
+  ],
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.2.1-rc.2"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    }
+  },
+  "license": "MIT",
+  "author": "lzlrt",
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek",
+    "deepseek-harness",
+    "dsha",
+    "remote",
+    "sidebar",
+    "mobile"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lzlrt/dsha-desktop-link.git"
+  },
+  "homepage": "https://github.com/lzlrt/dsha-desktop-link#readme",
+  "bugs": {
+    "url": "https://github.com/lzlrt/dsha-desktop-link/issues"
+  },
+  "description": "DSH sidebar button: open the desktop DSH Web GUI from DSHA on your phone, in one tap.",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  }
 }