dsh-mesh-ui 0.0.13 → 0.0.15

package/README.md

@@ -1,9 +1,19 @@
 # dsh-mesh-ui
 
-DSH settings-page panel for `dsh-mesh`: AI network topology, peer health, and delegation panel.
+DSH left-sidebar page for a `dsh-mesh` AI network: topology, peer health, local instances, delegation ledger and alerts. Public addresses (IP/domain) are hidden by default; LAN addresses remain visible.
+
+## Install
 
 ```sh
 dsh plugin --profile web add dsh-mesh-ui
 ```
 
+This installs `dsh-mesh-node` as a dependency. The page is read-only; it reads the local `~/.dsh-mesh` mesh state and never uploads or hardcodes peer addresses.
+
+To make this DSH instance a mesh node, also install the host bridge:
+
+```sh
+dsh plugin --profile web add dsh-mesh-host
+```
+
 See https://github.com/LinYanZhi/dsh-mesh

package/cordis.patch.yml

@@ -1,4 +1,4 @@
-# dsh-mesh-ui: settings-page panel
+# dsh-mesh-ui: left-sidebar AI network page
 - insert:
     - id: dsh-mesh-ui
       name: dsh-mesh-ui

package/lib/client.js

@@ -119,6 +119,37 @@ function nodeLabel(name) { return NODE_LABELS[String(name || '').toLowerCase()]
     function clampNum(v, min, max) { return Math.max(min, Math.min(max, v)) }
     // [layout-helpers-end]
     // [relay-helpers-begin] 2026-11-09 架构层：识别公网中转站(frps)与通信方式（纯函数，可单测）
+    // 2026-11-10 隐私：默认不展示公网 IP/域名；局域网/回环地址保留。
+    function isPrivateNetworkHost(raw) {
+      var h = String(raw || '').trim().toLowerCase().replace(/^\[|\]$/g, '')
+      h = h.replace(/^https?:\/\//, '').split('/')[0].replace(/:\d+$/, '')
+      if (!h) return true
+      if (h === 'localhost' || h === '::1' || h === '0.0.0.0' || h === '127.0.0.1') return true
+      if (/(\.local|\.lan|\.home|\.internal)$/.test(h)) return true
+      var m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h)
+      if (m) {
+        var a = Number(m[1]); var b = Number(m[2])
+        return a === 10 || a === 127 || (a === 192 && b === 168) || (a === 172 && b >= 16 && b <= 31)
+      }
+      return false
+    }
+    function maskHost(raw) {
+      var s = String(raw || '').trim()
+      if (!s) return '—'
+      var port = ''
+      var m = /^(.*):(\d+)$/.exec(s)
+      if (m && m[1].indexOf(']') < 0) { s = m[1]; port = ':' + m[2] }
+      return (isPrivateNetworkHost(s) ? s : '公网地址已隐藏') + port
+    }
+    function maskText(value) {
+      if (typeof value !== 'string') return value
+      return value
+        .replace(/https?:\/\/[^\s"'<>]+/gi, function (u) {
+          try { var x = new URL(u); return isPrivateNetworkHost(x.hostname) ? u : (x.protocol + '//公网地址已隐藏' + (x.port ? ':' + x.port : '')) } catch (e) { return u }
+        })
+        .replace(/\b(?!10\.|192\.168\.|127\.|172\.(?:1[6-9]|2\d|3[01])\.)(?:\d{1,3}\.){3}\d{1,3}\b/g, '公网地址已隐藏')
+        .replace(/\b(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+(?:com|net|org|io|dev|cn|top|xyz|me|cc|app|cloud)(?::\d+)?\b/gi, '公网地址已隐藏')
+    }
     // 判定：同一公网 host 被 >=2 个 peer 使用 → 视为共享中转站；LAN/loopback 不算。
     var RELAY_PUBLIC_KINDS = { wan: 1, frp: 1 }
     function relayGroups(peers) {
@@ -149,12 +180,12 @@ function nodeLabel(name) { return NODE_LABELS[String(name || '').toLowerCase()]
       if (!host) return { text: '—', short: '—' }
       var relay = relayHosts && relayHosts[host]
       var port = t.port ? ':' + t.port : ''
-      if (relay) return { text: (relay.kind === 'frp' ? '域名穿透' : '自建 frps 中转') + ' · ' + relay.host + port, short: '中转' + (t.port ? ' ' + t.port : '') }
+      if (relay) return { text: (relay.kind === 'frp' ? '域名穿透' : '自建 frps 中转') + ' · ' + maskHost(relay.host) + port, short: '中转' + (t.port ? ' ' + t.port : '') }
       if (t.kind === 'loopback') return { text: '本机回环', short: '本机' }
-      if (t.kind === 'lan') return { text: '局域网直连 · ' + t.host + port, short: 'LAN' }
-      if (t.kind === 'frp') return { text: '公网穿透 · ' + t.host + port, short: '穿透' }
-      if (t.kind === 'wan') return { text: '公网直连 · ' + t.host + port, short: '公网' }
-      return { text: (t.label || t.kind || '未知') + ' · ' + t.host + port, short: t.label || '未知' }
+      if (t.kind === 'lan') return { text: '局域网直连 · ' + maskHost(t.host) + port, short: 'LAN' }
+      if (t.kind === 'frp') return { text: '公网穿透 · ' + maskHost(t.host) + port, short: '穿透' }
+      if (t.kind === 'wan') return { text: '公网直连 · ' + maskHost(t.host) + port, short: '公网' }
+      return { text: (t.label || t.kind || '未知') + ' · ' + maskHost(t.host) + port, short: t.label || '未知' }
     }
     // [relay-helpers-end]
     var W = 560
@@ -643,7 +674,7 @@ body.light .dm-edge-label { stroke: rgba(255,255,255,.92); }
       return h('div', { className: 'dm-topo-wrap' },
         h('div', { className: 'dm-topbar' },
           h('div', { className: 'dm-filters' },
-            [['lan', '局域网'], ['public', '阿里云'], ['sakura', '樱花穿透']].map(function (it) {
+            [['lan', '局域网'], ['public', '公网 frps'], ['sakura', '第三方穿透']].map(function (it) {
               var tr = TRANSPORTS[it[0]]
               return h('label', { key: it[0], className: 'dm-flt' + (showFilters[it[0]] ? ' on' : ''), style: { '--c': tr.color } },
                 h('input', { type: 'checkbox', checked: showFilters[it[0]], onChange: function () { toggleFilter(it[0]) } }),
@@ -767,7 +798,7 @@ body.light .dm-edge-label { stroke: rgba(255,255,255,.92); }
             h('div', { className: 'dm-relay-link' }, h('span', { className: 'dm-relay-line' }), h('span', { className: 'dm-relay-dirlabel' }, '出站')),
             h('div', { className: 'dm-relay-hub' },
               h('div', { className: 'dm-relay-name' }, '公网中转站 · frps'),
-              h('div', { className: 'dm-relay-sub dm-mono' }, g.host),
+              h('div', { className: 'dm-relay-sub dm-mono' }, maskHost(g.host)),
               h('div', { className: 'dm-relay-chips' },
                 ports.map(function (p) { return h('span', { className: 'dm-chip', key: p, title: '隧道入口 :' + p }, ':' + p + ' ×' + g.ports[p]) }),
                 h('span', { className: 'dm-chip ' + (g.up === g.peers.length ? 'run' : 'bad') }, '在线 ' + g.up + '/' + g.peers.length)
@@ -788,8 +819,8 @@ body.light .dm-edge-label { stroke: rgba(255,255,255,.92); }
           h('span', { className: 'dm-k' }, '樱花隧道：'),
           h('span', { className: 'dm-chip ' + (sakuraAccount.online === sakuraAccount.total ? 'run' : 'bad') }, sakuraAccount.online + '/' + sakuraAccount.total + ' 在线'),
           (sakuraAccount.tunnels || []).map(function (t) {
-            return h('span', { className: 'dm-chip ' + (t.online ? 'run' : 'bad'), key: 'st' + t.id, title: (t.nodeName || '') + ' ' + t.addr + (t.online ? '' : '（离线）') },
-              (t.deviceKey || t.name) + ' ' + t.addr)
+            return h('span', { className: 'dm-chip ' + (t.online ? 'run' : 'bad'), key: 'st' + t.id, title: (t.nodeName || '') + ' ' + maskText(t.addr) + (t.online ? '' : '（离线）') },
+              (t.deviceKey || t.name) + ' ' + maskText(t.addr))
           })
         ) : null,
         direct.length ? h('div', { className: 'dm-relay-direct' },
@@ -858,22 +889,22 @@ function deviceLinkState(data, peer, lanMap) {
       var selfHost = lt.selfHosted || {}
       var entry = lt.publicEntry || selfHost || {}
       var localPort = entry.port || selfHost.port || null
-      var localHost = entry.host || selfHost.host || "relay.example.com"
+      var localHost = entry.host || selfHost.host || ''
       var localKey = peerDeviceKey(data.nodeName)
       var devs = [{ devKey: localKey, name: nodeDisplay(data.nodeName) + "（本机）", up: true, port: localPort, host: localHost }].concat(peers.filter(function (p) { return !isLanPeer(p) }).map(function (p) {
         var tu = p.tunnel || {}
-        return { devKey: peerDeviceKey(p.name), name: nodeDisplay(peerDeviceKey(p.name)), up: (tu.probe ? Boolean(tu.probe.up) : Boolean(p.up)), port: tu.port || null, host: tu.host || 'relay.example.com' }
+        return { devKey: peerDeviceKey(p.name), name: nodeDisplay(peerDeviceKey(p.name)), up: (tu.probe ? Boolean(tu.probe.up) : Boolean(p.up)), port: tu.port || null, host: tu.host || '' }
       }))
       var aliyunRows = devs.filter(function (d) { return d.port }).map(function (d) {
         return h('div', { key: d.devKey, className: 'dm-device-row' },
           h('span', { className: 'dm-device-k' }, d.name),
-          h('span', { className: 'dm-device-v' }, (d.up ? '✅ ' : '❌ ') + (d.host || 'relay.example.com') + ':' + d.port)
+          h('span', { className: 'dm-device-v' }, (d.up ? '✅ ' : '❌ ') + maskHost(d.host) + ':' + d.port)
         )
       })
       var tunnelRows = acc ? (acc.tunnels || []).map(function (x, i) {
         return h('div', { key: 'st' + i, className: 'dm-device-row' },
           h('span', { className: 'dm-device-k' }, (x.deviceKey ? nodeDisplay(peerDeviceKey(x.deviceKey)) : (x.name || '未归类'))),
-          h('span', { className: 'dm-device-v' }, (x.online ? '✅ ' : '❌ ') + (x.addr || ''))
+          h('span', { className: 'dm-device-v' }, (x.online ? '✅ ' : '❌ ') + maskText(x.addr || ''))
         )
       }) : null
       if (!aliyunRows.length && !tunnelRows) return null
@@ -881,19 +912,19 @@ function deviceLinkState(data, peer, lanMap) {
         h('div', { className: 'dm-infra-card' },
           h('div', { className: 'dm-infra-head' },
             h('span', { className: 'dm-dot ok', style: { background: TRANSPORTS.public.color } }),
-            h('span', null, '阿里云服务器 · ECS'),
+            h('span', null, '公网 frps 中转'),
             h('span', { className: 'dm-sub', style: { marginLeft: 'auto' } }, '自建 frps')
           ),
-          h('div', { className: 'dm-sub dm-mono', style: { marginBottom: 4 } }, 'relay.example.com · 隧道 ' + (devs.filter(function (d) { return d.port }).map(function (d) { return d.port }).sort().join(' / ') || '—')),
+          h('div', { className: 'dm-sub dm-mono', style: { marginBottom: 4 } }, '隧道 ' + (devs.filter(function (d) { return d.port }).map(function (d) { return d.port }).sort().join(' / ') || '—')),
           aliyunRows
         ),
         acc ? h('div', { className: 'dm-infra-card' },
           h('div', { className: 'dm-infra-head' },
             h('span', { className: 'dm-dot', style: { background: TRANSPORTS.sakura.color } }),
-            h('span', null, '樱花穿透服务器'),
+            h('span', null, '第三方 frps 穿透'),
             h('span', { className: 'dm-sub', style: { marginLeft: 'auto' } }, acc.online + '/' + acc.total + ' 在线')
           ),
-          h('div', { className: 'dm-sub dm-mono', style: { marginBottom: 4 } }, 'relay.example.com / relay.example.com / relay.example.com'),
+          h('div', { className: 'dm-sub dm-mono', style: { marginBottom: 4 } }, '公网地址已隐藏'),
           tunnelRows
         ) : null
       )
@@ -985,7 +1016,7 @@ function deviceLinkState(data, peer, lanMap) {
         var src = localTunnel.mainSource || (entry && entry.source === 'self-hosted-frps' ? 'self-hosted' : '')
         if (entry && entry.host) {
           var tag = src === 'self-hosted' ? '（自建 frps）' : (src === 'sakura' ? '（Sakura 备用）' : '')
-          return entry.host + ':' + entry.port + tag
+          return maskHost(entry.host) + ':' + entry.port + tag
         }
         if (localTunnel.frpRunning) return 'SakuraFrp 已开 · ' + (localTunnel.bind || '?') + ':' + localTunnel.port
         if (localTunnel.port) return '未开穿透 · ' + (localTunnel.bind || '?') + ':' + localTunnel.port
@@ -994,7 +1025,7 @@ function deviceLinkState(data, peer, lanMap) {
       function peerDomain(peer) {
         var t = peer.tunnel || {}
         if (!t.host) return '—'
-        return t.host + (t.port ? ':' + t.port : '') + (t.kind === 'lan' ? '（内网）' : '')
+        return maskHost(t.host) + (t.port ? ':' + t.port : '') + (t.kind === 'lan' ? '（内网）' : '')
       }
 
       // LAN peer 单独收集（dedupe 后可能被更快的 frp 记录覆盖，但 LAN 线仍要画）
@@ -1039,8 +1070,8 @@ function deviceLinkState(data, peer, lanMap) {
   var sakuraAcc = sakuraAccountOf(data)
   var aliyunPorts = peers.map(function (p) { return isLanPeer(p) ? null : (p.tunnel || {}).port }).filter(Boolean)
   var infra = [
-    { key: 'server-aliyun', transport: 'public', name: '阿里云服务器 · ECS', host: 'relay.example.com', color: TRANSPORTS.public.color, detail: '隧道 ' + (aliyunPorts.length ? aliyunPorts.sort().join('/') : '—'), up: true },
-    { key: 'server-sakura', transport: 'sakura', name: '樱花穿透服务器', host: 'relay.example.com / relay.example.com / relay.example.com', color: TRANSPORTS.sakura.color, detail: sakuraAcc ? (sakuraAcc.online + '/' + sakuraAcc.total + ' 在线') : '未采集', up: Boolean(sakuraAcc) },
+    { key: 'server-aliyun', transport: 'public', name: '公网 frps 中转', host: '公网地址已隐藏', color: TRANSPORTS.public.color, detail: '隧道 ' + (aliyunPorts.length ? aliyunPorts.sort().join('/') : '—'), up: true },
+    { key: 'server-sakura', transport: 'sakura', name: '第三方 frps 穿透', host: '公网地址已隐藏', color: TRANSPORTS.sakura.color, detail: sakuraAcc ? (sakuraAcc.online + '/' + sakuraAcc.total + ' 在线') : '未采集', up: Boolean(sakuraAcc) },
   ]
   // 2026-11-09-v8：服务器默认位置贴住扇形最高一排设备（用户要求缩小服务器↔设备的垂直间隔）
   function infraDefaultPos(idx) {
@@ -1146,13 +1177,13 @@ function deviceLinkState(data, peer, lanMap) {
     var pa = layout.positions[i]
     if (n.local) {
       // 主机自己的两条上级链路：自建 frps（阿里云） + 本机樱花隧道
-      if (show.public && localPub) svgEls = svgEls.concat(curve('pub-local', pa, aliyunPos, true, TRANSPORTS.public, localPub.host + ':' + localPub.port, sizeOf('local'), aliyunSize, edgeRelated('local', 'server-aliyun')))
-      if (show.sakura && localSak) svgEls = svgEls.concat(curve('sak-local', pa, sakuraPos, localSak.online === true, TRANSPORTS.sakura, localSak.addr || '', sizeOf('local'), sakuraSize, edgeRelated('local', 'server-sakura')))
+      if (show.public && localPub) svgEls = svgEls.concat(curve('pub-local', pa, aliyunPos, true, TRANSPORTS.public, maskHost(localPub.host) + ':' + localPub.port, sizeOf('local'), aliyunSize, edgeRelated('local', 'server-aliyun')))
+      if (show.sakura && localSak) svgEls = svgEls.concat(curve('sak-local', pa, sakuraPos, localSak.online === true, TRANSPORTS.sakura, maskText(localSak.addr || ''), sizeOf('local'), sakuraSize, edgeRelated('local', 'server-sakura')))
       return
     }
     var sizeN = sizeOf(n.key)
-    if (show.public) svgEls = svgEls.concat(curve('pub' + i, pa, aliyunPos, n.publicUp, TRANSPORTS.public, 'relay.example.com' + ((n.tunnel && n.tunnel.port) ? ':' + n.tunnel.port : ''), sizeN, aliyunSize, edgeRelated(n.key, 'server-aliyun')))
-    if (show.sakura && n.sakuraTunnel) svgEls = svgEls.concat(curve('sak' + i, pa, sakuraPos, n.sakuraUp === true, TRANSPORTS.sakura, n.sakuraTunnel.addr || '', sizeN, sakuraSize, edgeRelated(n.key, 'server-sakura')))
+    if (show.public) svgEls = svgEls.concat(curve('pub' + i, pa, aliyunPos, n.publicUp, TRANSPORTS.public, '公网 frps' + ((n.tunnel && n.tunnel.port) ? ':' + n.tunnel.port : ''), sizeN, aliyunSize, edgeRelated(n.key, 'server-aliyun')))
+    if (show.sakura && n.sakuraTunnel) svgEls = svgEls.concat(curve('sak' + i, pa, sakuraPos, n.sakuraUp === true, TRANSPORTS.sakura, maskText(n.sakuraTunnel.addr || ''), sizeN, sakuraSize, edgeRelated(n.key, 'server-sakura')))
     if (show.lan && n.lanUp) { var lt = n.lanTunnel || {}; var lanAddr = (lt.ip || lt.host || 'LAN') + (lt.port ? ':' + lt.port : ''); svgEls = svgEls.concat(curve('lan' + i, layout.positions[localNodeIdx], pa, n.lanUp, TRANSPORTS.lan, lanAddr, sizeOf('local'), sizeN, edgeRelated('local', n.key))) }
   })
   return h('div', null,
@@ -1239,16 +1270,16 @@ function deviceLinkState(data, peer, lanMap) {
       var localTunnelText = null
       var tunnels = localTunnel.tunnels || []
       var entry = localTunnel.publicEntry || null
-      var tunnelNames = tunnels.map(function (x) { return x.name + '→' + x.host + ':' + x.port }).join(' / ')
+      var tunnelNames = tunnels.map(function (x) { return x.name + '→' + maskHost(x.host) + ':' + x.port }).join(' / ')
       var mainSrc = localTunnel.mainSource || (entry && entry.source === 'self-hosted-frps' ? 'self-hosted' : (entry ? 'sakura' : 'none'))
       var entryText = entry && entry.host
-        ? entry.host + ':' + entry.port + (mainSrc === 'self-hosted' ? '（自建 frps · 主用）' : (mainSrc === 'sakura' ? '（Sakura · 备用）' : ''))
+        ? maskHost(entry.host) + ':' + entry.port + (mainSrc === 'self-hosted' ? '（自建 frps · 主用）' : (mainSrc === 'sakura' ? '（Sakura · 备用）' : ''))
         : '未配置'
       var localTunnelRows = [
         ['入口', entryText],
         ['监听 / frpc', (localTunnel.bind || '?') + ':' + (localTunnel.port || '?') + (localTunnel.tls ? ' (TLS)' : '') + ' · ' + (localTunnel.frpRunning ? 'frpc ×' + (localTunnel.frpcCount || 1) : 'frpc 未运行')]
       ]
-      if (tunnels.length) localTunnelRows.push(['Sakura 备用', tunnels.map(function (x) { return x.host + ':' + x.port }).join(' / ')])
+      if (tunnels.length) localTunnelRows.push(['Sakura 备用', tunnels.map(function (x) { return maskHost(x.host) + ':' + x.port }).join(' / ')])
       if (mainSrc === 'self-hosted' && localTunnel.selfHosted && localTunnel.selfHosted.configPath) localTunnelRows.push(['frpc 配置', localTunnel.selfHosted.configPath])
       var localTunnelAll = tunnelNames
       var memText = hw.memTotalGB ? ((hw.memFreeGB != null ? hw.memFreeGB : '?') + ' / ' + hw.memTotalGB + ' GB') : '—'
@@ -1444,6 +1475,61 @@ function deviceLinkState(data, peer, lanMap) {
       )
     }
 
+    // 2026-11-10：局域网首次接入（扫描 / 生成配对码 / 配对）。
+    function LanOnboarding() {
+      var sNodes = useState(null); var nodes = sNodes[0]; var setNodes = sNodes[1]
+      var sBusy = useState(false); var busy = sBusy[0]; var setBusy = sBusy[1]
+      var sMsg = useState(''); var msg = sMsg[0]; var setMsg = sMsg[1]
+      var sCode = useState(''); var code = sCode[0]; var setCode = sCode[1]
+      var sMine = useState(null); var mine = sMine[0]; var setMine = sMine[1]
+
+      function scan() {
+        setBusy(true); setMsg('')
+        fetch('/api/dsh-mesh/lan/scan').then(function (r) { return r.json() }).then(function (j) {
+          if (!j.ok) { setMsg(j.error || '扫描失败'); return }
+          setNodes(j.nodes || [])
+          setMsg((j.nodes || []).length ? '发现 ' + j.nodes.length + ' 个节点' : '没有发现局域网节点（对方需 bind 0.0.0.0 并放行 8124）')
+        }).catch(function (e) { setMsg(String(e.message || e)) }).finally(function () { setBusy(false) })
+      }
+      function myCode() {
+        setBusy(true); setMine(null); setMsg('')
+        fetch('/api/dsh-mesh/lan/code').then(function (r) { return r.json() }).then(function (j) {
+          if (!j.ok) { setMsg(j.error || '生成配对码失败'); return }
+          setMine(j)
+        }).catch(function (e) { setMsg(String(e.message || e)) }).finally(function () { setBusy(false) })
+      }
+      function pairWith(node) {
+        var c = String(code || '').trim()
+        if (!c) { setMsg('先填入对方显示的配对码'); return }
+        setBusy(true); setMsg('')
+        fetch('/api/dsh-mesh/lan/pair', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ url: String(node.url || '').replace(/\/mcp$/, ''), code: c, name: (node.node || 'lan') + '-lan', fingerprint: node.certFingerprint || '' }) })
+          .then(function (r) { return r.json() }).then(function (j) {
+            setMsg(j.ok ? '配对成功：' + (node.node || '') + '，稍后刷新网络' : ('配对失败：' + (j.stderr || j.error || j.stdout || '').slice(0, 300)))
+          }).catch(function (e) { setMsg(String(e.message || e)) }).finally(function () { setBusy(false) })
+      }
+      return h('div', null,
+        h('div', { className: 'dm-lan-row' },
+          h('button', { className: 'dm-btn', disabled: busy, onClick: scan }, busy ? '处理中…' : '扫描局域网'),
+          h('button', { className: 'dm-btn', disabled: busy, onClick: myCode }, '生成我的配对码'),
+          h('span', { className: 'dm-sub' }, '对方的 mesh 需 bind 0.0.0.0；第一次可能需放行 8124')
+        ),
+        msg ? h('div', { className: 'dm-sub', style: { marginTop: 6 } }, msg) : null,
+        mine ? h('div', { className: 'dm-lan-code', style: { marginTop: 8 } }, '配对码 ' + mine.pairingCode + ' · ' + (mine.endpoint || '') + (mine.certFingerprint ? ' · 指纹 ' + mine.certFingerprint : '')) : null,
+        nodes && nodes.length ? h('div', { style: { marginTop: 8 } },
+          nodes.map(function (node, i) {
+            return h('div', { className: 'dm-lan-node', key: i },
+              h('span', { className: 'dm-dot ok' }),
+              h('span', null, (node.node || '?') + ' · ' + (node.url || '').replace('/mcp', '')),
+              h('button', { className: 'dm-btn primary', disabled: busy, onClick: function () { pairWith(node) } }, '用此节点配对')
+            )
+          })
+        ) : null,
+        nodes && nodes.length ? h('div', { className: 'dm-lan-row' },
+          h('input', { placeholder: '对方显示的配对码，如 H5K4-9RXV', value: code, onChange: function (e) { setCode(e.target.value) } })
+        ) : null
+      )
+    }
+
     function MeshStatusSection() {
       var s0 = useState(null); var data = s0[0]; var setData = s0[1]
       var s1 = useState(true); var loading = s1[0]; var setLoading = s1[1]
@@ -1605,6 +1691,11 @@ function deviceLinkState(data, peer, lanMap) {
         ),
         error ? h('div', { className: 'dm-err' }, error) : null,
 
+        h('details', { className: 'dm-details dm-lan' },
+          h('summary', null, '局域网发现 / 配对（首次使用）'),
+          h(LanOnboarding)
+        ),
+
         h('div', { className: 'dm-body', style: splitW > 0 ? { '--dm-main-w': splitW + 'px' } : undefined },
           h('div', { className: 'dm-pane' },
             h(Viewport, { data: data, layout: computeLayout(1 + filterSelfPeers(dedupePeers(data.peers || []), data.nodeName).length), selectedKey: selectedKey, onSelect: setSelectedKey }),
@@ -1623,8 +1714,8 @@ function deviceLinkState(data, peer, lanMap) {
             h(Details, { title: '告警历史', badge: ((data.alerts && data.alerts.history) || []).length }, h(AlertList, { data: data })),
             (issues.length || hints.length) ? h(Details, { title: '诊断建议', badge: issues.length + hints.length },
               h('div', null,
-                issues.slice(0, 6).map(function (issue, i) { return h('div', { key: 'i' + i, className: 'dm-err', style: { marginTop: 3 } }, '· ' + issue) }),
-                hints.slice(0, 6).map(function (hint, i) { return h('div', { key: 'h' + i, className: 'dm-sub', style: { marginTop: 3 } }, '· ' + hint) })
+                issues.slice(0, 6).map(function (issue, i) { return h('div', { key: 'i' + i, className: 'dm-err', style: { marginTop: 3 } }, '· ' + maskText(issue)) }),
+                hints.slice(0, 6).map(function (hint, i) { return h('div', { key: 'h' + i, className: 'dm-sub', style: { marginTop: 3 } }, '· ' + maskText(hint)) })
               )
             ) : null
           )
@@ -2322,6 +2413,13 @@ body[data-ds-dark-theme] .dm-dg-fs-item.active { background:rgba(88,166,255,.28)
 @media (hover:hover) { .dm-width-handle:hover::after { opacity:1; } }
 @media (max-width: 1000px) { .dm-width-handle { display:none; } }
 .dm-body { display:grid; grid-template-columns:minmax(300px, var(--dm-main-w, 62%)) 8px minmax(0,1fr); gap:10px; align-items:start; }
+.dm-lan { border:1px solid rgba(128,128,128,.25); border-radius:12px; padding:10px 12px; background:rgba(128,128,128,.035); }
+.dm-lan-row { display:flex; gap:8px; align-items:center; flex-wrap:wrap; margin-top:8px; }
+.dm-lan input { font:inherit; font-size:12px; padding:5px 8px; border:1px solid rgba(128,128,128,.35); border-radius:7px; background:transparent; color:inherit; min-width:180px; }
+.dm-lan-node { display:flex; gap:8px; align-items:center; border-top:1px solid rgba(128,128,128,.16); padding:7px 0; font-size:12px; }
+.dm-lan-node:first-child { border-top:none; }
+.dm-lan-code { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; font-size:12px; padding:6px 8px; border-radius:8px; background:rgba(88,166,255,.1); border:1px solid rgba(88,166,255,.35); word-break:break-all; }
+
 .dm-pane { min-width:0; display:flex; flex-direction:column; gap:12px; }
 .dm-divider { cursor:col-resize; align-self:stretch; min-height:120px; border-radius:4px; position:relative; }
 .dm-divider::before { content:''; position:absolute; top:0; bottom:0; left:3px; width:1px; background:rgba(128,128,128,.28); }

package/lib/index.js

@@ -11,8 +11,10 @@
 //
 // 归宿：reusable（dsh-mesh/plugin/dsh-mesh-ui/lib/）
 
-import { collect, resolveRepo, meshHome } from './collect.js'
+import { collect, resolveRepo, meshHome, run, nodeExec } from './collect.js'
 import { listDelegations, sessionHistory, taskStatus } from './delegations.js'
+import { networkInterfaces } from 'node:os'
+import { join } from 'node:path'
 
 /** Cordis inject 列表：只需要 webServer。 */
 export const inject = ['webServer']
@@ -37,6 +39,32 @@ function writeJson(res, status, body) {
   res.end(JSON.stringify(body, null, 2))
 }
 
+function readBody(req, limit = 16 * 1024) {
+  return new Promise((resolve) => {
+    let size = 0
+    const chunks = []
+    req.on('data', (chunk) => {
+      size += chunk.length
+      if (size > limit) { resolve(null); req.destroy(); return }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}')) } catch { resolve(null) }
+    })
+    req.on('error', () => resolve(null))
+  })
+}
+
+function lanIPv4() {
+  const ifaces = networkInterfaces()
+  for (const list of Object.values(ifaces)) {
+    for (const item of list || []) {
+      if (item.family === 'IPv4' && !item.internal && !/^169\.254\./.test(item.address)) return item.address
+    }
+  }
+  return '127.0.0.1'
+}
+
 /**
  * Cordis apply：注册只读状态路由 + 后台刷新循环。
  * @param {import('@deepseek-ai/cordis').Context} ctx host 插件上下文（已注入 webServer）
@@ -158,6 +186,54 @@ export function apply(ctx) {
     }
   }
 
+  async function runCli(args, timeout = 30_000) {
+    if (!state.repo) return { error: 'dsh-mesh-node is not installed', stdout: '', stderr: '' }
+    return run(nodeExec(), [join(state.repo, 'src', 'cli.js'), ...args], { cwd: state.repo, timeout })
+  }
+
+  const lanScanRoute = readonlyRoute('/api/dsh-mesh/lan/scan', async () => {
+    const r = await runCli(['discover', '--json', '--timeout-ms', '1500'], 20_000)
+    if (r.error) return { ok: false, error: r.error, stderr: r.stderr }
+    try {
+      const data = JSON.parse(r.stdout)
+      return { ok: true, localAddress: lanIPv4(), nodes: data.nodes || [] }
+    } catch {
+      return { ok: false, error: 'invalid discover output', stdout: r.stdout, stderr: r.stderr }
+    }
+  })
+
+  const lanCodeRoute = readonlyRoute('/api/dsh-mesh/lan/code', async () => {
+    const host = `${lanIPv4()}:8124`
+    const r = await runCli(['pair', '--code', '--ttl', '600', '--role', 'node', '--host', host])
+    if (r.error) return { ok: false, error: r.error, stderr: r.stderr }
+    try {
+      return { ok: true, ...JSON.parse(r.stdout) }
+    } catch {
+      return { ok: false, error: 'invalid pair output', stdout: r.stdout, stderr: r.stderr }
+    }
+  })
+
+  const lanPairRoute = {
+    kind: 'exact',
+    path: '/api/dsh-mesh/lan/pair',
+    handler: async (req, res) => {
+      if (!isLoopback(req)) return writeJson(res, 403, { ok: false, error: 'forbidden: loopback-only' })
+      if ((req.method || 'GET').toUpperCase() !== 'POST') return writeJson(res, 405, { ok: false, error: 'method not allowed' })
+      const body = await readBody(req)
+      if (!body || typeof body.url !== 'string' || typeof body.code !== 'string') {
+        return writeJson(res, 400, { ok: false, error: 'url and code required' })
+      }
+      const args = ['peer', 'add', '--url', String(body.url), '--code', String(body.code), '--name', String(body.name || 'lan-peer')]
+      if (body.fingerprint) args.push('--fingerprint', String(body.fingerprint))
+      try {
+        const r = await runCli(args)
+        writeJson(res, 200, { ok: !r.error, error: r.error, stdout: r.stdout, stderr: r.stderr })
+      } catch (error) {
+        writeJson(res, 500, { ok: false, error: String(error?.message || error) })
+      }
+    }
+  }
+
   const delegateRoutes = [
     readonlyRoute('/api/dsh-mesh/delegations', async (url) => {
       // 缓存整份列表（与请求的 limit 无关），避免不同 limit 的请求互相污染缓存
@@ -187,6 +263,7 @@ export function apply(ctx) {
 
   ctx.effect(() => {
     const disposeRoute = ctx.webServer.register(route)
+    const disposeLanRoutes = [lanScanRoute, lanCodeRoute, lanPairRoute].map((item) => ctx.webServer.register(item))
     const disposeRoutes = delegateRoutes.map((item) => ctx.webServer.register(item))
     return () => {
       try {
@@ -194,7 +271,7 @@ export function apply(ctx) {
       } catch {
         /* ignore */
       }
-      for (const dispose of disposeRoutes) { try { dispose() } catch { /* ignore */ } }
+      for (const dispose of disposeLanRoutes.concat(disposeRoutes)) { try { dispose() } catch { /* ignore */ } }
       if (typeof disposeRoute === 'function') disposeRoute()
     }
   }, 'dsh-mesh-ui: GET /api/dsh-mesh/status + background refresh')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mesh-ui",
-  "version": "0.0.13",
+  "version": "0.0.15",
   "description": "DSH sidebar page for dsh-mesh: AI network topology, peer health, and delegation panel. Read-only; data is collected from the installed dsh-mesh-node package.",
   "icon": "icon.svg",
   "type": "module",
@@ -28,7 +28,7 @@
     }
   },
   "dependencies": {
-    "dsh-mesh-node": "0.0.12"
+    "dsh-mesh-node": "0.0.13"
   },
   "peerDependencies": {
     "@deepseek-ai/dsh": ">=0.2.0-rc.2 <0.3.0",