dsh-mobile 0.1.0-alpha.4 → 0.1.0-alpha.6

package/README.md

@@ -61,12 +61,12 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
+Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, stores plugin data under `$DSH_HOME/mobile-access/`, and on Windows requests administrator approval for LAN-only TCP/UDP firewall rules. Use `--no-firewall` only when those rules are managed separately. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
 
 1. Copy the generated `dsh-mobile-ca.cer` to Android and install it once as a user CA certificate.
 2. Open the Mobile card in the lower-left corner of the desktop DSH UI.
 3. Start access and select **Create pairing key**. The key is copied to the clipboard; the same card also shows a complete browser link.
-4. Open the Android app; it finds DSH on the LAN automatically. Paste the key and connect. Alternatively, open the browser link directly on the phone.
+4. Open the Android app, select **Scan**, then select the discovered DSH. Paste the key and connect. Alternatively, open the browser link directly on the phone.
 
 The key and browser link expire after two minutes and work once. After pairing, Android stores a revocable device credential encrypted by Android Keystore. The app can rediscover the same DSH installation on the default port after its LAN address changes and renew its short Web session without another key. Browser profiles still pair separately.
 
@@ -79,7 +79,7 @@ The two access modes are equivalent:
 - Android app: a thin system WebView shell without browser address and tab bars.
 - Mobile browser: open the setup origin directly; no app installation is required.
 
-Android discovery scans only the current Wi-Fi `/24` on the default HTTPS port `3443`. It returns a stable, non-secret installation identifier; credentials never appear in discovery responses. A custom port or unusual subnet remains available through manual address entry.
+Android first sends a UDP discovery query on the default port `3443`; the plugin replies with only its HTTPS origin and stable, non-secret installation identifier. It falls back to HTTPS scanning of visible private Wi-Fi and hotspot `/24` networks. Credentials never appear in discovery responses. The first screen contains only Scan and the discovered DSH list; the pairing-key field appears after selecting one result.
 
 ## Customize the mobile Web UI
 

package/README.zh.md

@@ -61,12 +61,12 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
+两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`。Windows 会请求管理员批准两条仅限所选局域网的 TCP/UDP 防火墙规则；只有自行管理规则时才使用 `--no-firewall`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
 
 1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中一次性安装为用户 CA 证书。
 2. 在电脑 DSH 左下角打开“移动端”卡片。
 3. 确认服务已开启，点击“生成配对密钥”。密钥会复制到剪贴板，同一卡片也会显示完整的浏览器链接。
-4. 打开 Android App，它会自动在局域网中找到 DSH。粘贴密钥并连接；也可直接在手机浏览器打开卡片中的链接。
+4. 打开 Android App，点击“扫描”并选择发现的 DSH，再粘贴密钥连接；也可直接在手机浏览器打开卡片中的链接。
 
 密钥和浏览器链接两分钟内有效且只能使用一次。配对后，Android 会用 Android Keystore 加密保存可随时撤销的设备凭据。局域网 IP 变化后，App 能在默认端口重新找到同一个 DSH，并自动续期短期 Web 会话，不需要新密钥。浏览器仍需单独配对。
 
@@ -79,7 +79,7 @@ pnpm dsh --profile web
 - Android App：使用系统 WebView 打开同一 DSH 页面，没有浏览器地址栏和标签栏。
 - 手机浏览器：直接访问向导显示的 `https://局域网地址:端口`，无需安装 App。
 
-Android 自动发现只扫描当前 Wi-Fi 的 `/24` 网段和默认 HTTPS 端口 `3443`。发现响应只包含稳定的非机密安装标识，不包含任何凭据。使用自定义端口或特殊子网时，仍可手动输入地址。
+Android 会先在默认端口 `3443` 发送 UDP 发现请求，插件只回复 HTTPS 地址和稳定的非机密安装标识；失败时才回退扫描手机可见的私有 Wi-Fi 和热点 `/24` 网段。发现响应不包含任何凭据。首页只有扫描按钮和 DSH 列表，点击其中一项后才会显示配对密钥输入框。
 
 ## 自定义移动端 Web UI
 

package/SECURITY.md

@@ -15,7 +15,8 @@ The maintainer will acknowledge a complete report within seven days. Publication
 ## Deployment requirements
 
 - Keep the ordinary DSH Web listener on loopback.
-- Expose only the plugin-owned HTTPS listener to the LAN.
+- Expose only the plugin-owned HTTPS listener to the LAN.
+- UDP discovery on the same port accepts only the fixed discovery query from the configured LAN CIDR and returns only the public HTTPS origin and non-secret installation identifier. It never returns credentials or configuration.
 - Use a certificate trusted by every client platform; never instruct a WebView to ignore TLS errors.
 - Keep pairing closed except during a short local onboarding action.
 - Revoke a lost device immediately and rotate the device registry if credential theft is suspected.

package/lib/cli.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { execFile } from "node:child_process";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
 import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { generate } from "selfsigned";
 //#region src/managed-setup.ts
@@ -170,10 +172,14 @@ async function refreshManagedServerCertificate(setup, address) {
 }
 //#endregion
 //#region src/cli.ts
+const execFile$1 = promisify(execFile);
+const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
+const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
 function parseOptions(args) {
 	let address;
 	let port = 3443;
 	let dshPort = 3080;
+	let configureFirewall = true;
 	for (let index = 0; index < args.length; index += 1) {
 		const name = args[index];
 		const value = args[index + 1];
@@ -192,6 +198,10 @@ function parseOptions(args) {
 			index += 1;
 			continue;
 		}
+		if (name === "--no-firewall") {
+			configureFirewall = false;
+			continue;
+		}
 		throw new Error(`unknown setup option: ${name ?? ""}`);
 	}
 	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
@@ -199,12 +209,46 @@ function parseOptions(args) {
 	return {
 		...address === void 0 ? {} : { address },
 		port,
-		dshPort
+		dshPort,
+		configureFirewall
 	};
 }
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
+async function runElevatedPowerShell(script) {
+	const launch = [
+		"$ErrorActionPreference = 'Stop'; $process = Start-Process -FilePath 'powershell.exe' -Verb RunAs -WindowStyle Hidden -Wait -PassThru",
+		`  -ArgumentList @('-NoProfile','-NonInteractive','-EncodedCommand','${Buffer.from(script, "utf16le").toString("base64")}')`,
+		"; exit $process.ExitCode"
+	].join(" ");
+	await execFile$1("powershell.exe", [
+		"-NoProfile",
+		"-NonInteractive",
+		"-Command",
+		launch
+	], { windowsHide: true });
+}
+async function configureWindowsFirewall(port, cidr) {
+	if (process.platform !== "win32") return;
+	const script = [
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress '${cidr}' -Profile Any | Out-Null`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress '${cidr}' -Profile Any | Out-Null`
+	].join("; ");
+	console.log("Windows will request administrator approval for two LAN-only firewall rules.");
+	await runElevatedPowerShell(script);
+}
+async function removeWindowsFirewall() {
+	if (process.platform !== "win32") return;
+	await runElevatedPowerShell([
+		"$ErrorActionPreference = 'Stop'",
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
+		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`
+	].join("; "));
+}
 async function setup(args) {
 	const options = parseOptions(args);
 	const network = selectLanNetwork(options.address);
@@ -249,6 +293,7 @@ async function setup(args) {
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
 	]);
+	if (options.configureFirewall) await configureWindowsFirewall(options.port, network.cidr);
 	const customCss = join(directory, "mobile.css");
 	try {
 		await readFile(customCss);
@@ -287,7 +332,7 @@ async function setup(args) {
 	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
 	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log("Start DSH with: dsh --profile web");
-	console.log("Then open the Mobile card in the lower-left corner and create a pairing link.");
+	console.log("Then open the Mobile card in the lower-left corner and create a pairing key.");
 }
 async function purge(args) {
 	if (args.length !== 1 || args[0] !== "--yes") throw new Error("purge requires --yes");
@@ -296,11 +341,12 @@ async function purge(args) {
 		recursive: true,
 		force: true
 	});
+	await removeWindowsFirewall();
 	console.log("Removed DSH Mobile certificates, devices, preferences, and custom Web files.");
 }
 function help() {
 	console.log([
-		"dsh-mobile setup [--address 192.168.x.x] [--port 3443] [--dsh-port 3080]",
+		"dsh-mobile setup [--address 192.168.x.x] [--port 3443] [--dsh-port 3080] [--no-firewall]",
 		"dsh-mobile purge --yes",
 		"",
 		"Run through the DSH profile:",

package/lib/index.d.mts

@@ -352,6 +352,7 @@ declare class MobileAccessGateway {
   private readonly tlsEnabled;
   private policy;
   private server;
+  private discoverySocket;
   private listenerPort;
   private readonly connectedSockets;
   private readonly activeRequests;
@@ -365,6 +366,7 @@ declare class MobileAccessGateway {
   constructor(config: ResolvedGatewayConfig, store: DeviceStore);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
+  private startDiscovery;
   private closeFailedStart;
   /** Actual bound address, available after start and safe for loopback status output. */
   address(): {

package/lib/index.mjs

@@ -3,6 +3,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { connect, isIP } from "node:net";
 import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createSocket } from "node:dgram";
 import { createServer, request } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import { Transform } from "node:stream";
@@ -1019,6 +1020,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin) {
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
+const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
 const PAIR_PAGE = `<!doctype html>
 <html lang="en">
 <meta charset="utf-8">
@@ -1292,6 +1294,7 @@ var MobileAccessGateway = class {
 	tlsEnabled;
 	policy;
 	server;
+	discoverySocket;
 	listenerPort;
 	connectedSockets = /* @__PURE__ */ new Set();
 	activeRequests = /* @__PURE__ */ new Map();
@@ -1376,12 +1379,38 @@ var MobileAccessGateway = class {
 			if (address === null || typeof address === "string") throw new Error("gateway listener has no TCP address");
 			this.listenerPort = address.port;
 			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
+			await this.startDiscovery(address.port);
 		} catch (error) {
 			await this.closeFailedStart();
 			throw error;
 		}
 	}
+	async startDiscovery(port) {
+		const socket = createSocket("udp4");
+		this.discoverySocket = socket;
+		socket.on("message", (message, remote) => {
+			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
+			const response = Buffer.from(JSON.stringify({
+				protocol: 1,
+				instanceId: this.config.instanceId,
+				origin: this.address().origin
+			}), "utf8");
+			socket.send(response, remote.port, remote.address, () => void 0);
+		});
+		await new Promise((resolve, reject) => {
+			const failed = (error) => {
+				reject(error);
+			};
+			socket.once("error", failed);
+			socket.bind(port, "0.0.0.0", () => {
+				socket.off("error", failed);
+				resolve();
+			});
+		});
+	}
 	async closeFailedStart() {
+		this.discoverySocket?.close();
+		this.discoverySocket = void 0;
 		for (const socket of this.connectedSockets) socket.destroy();
 		const server = this.server;
 		this.server = void 0;
@@ -1926,6 +1955,11 @@ var MobileAccessGateway = class {
 			websocket.upstream.destroy();
 		}
 		for (const socket of this.connectedSockets) socket.destroy();
+		const discoverySocket = this.discoverySocket;
+		this.discoverySocket = void 0;
+		if (discoverySocket !== void 0) await new Promise((resolve) => {
+			discoverySocket.close(() => resolve());
+		});
 		const server = this.server;
 		this.server = void 0;
 		if (server !== void 0 && server.listening) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.6",
   "private": false,
   "description": "Authenticated Android and mobile-browser access for the stock DeepSeek Harness Web UI",
   "type": "module",