dsh-mobile 0.1.0-alpha.6 → 0.1.0-alpha.7

package/README.md

@@ -61,7 +61,7 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, stores plugin data under `$DSH_HOME/mobile-access/`, and on Windows requests administrator approval for LAN-only TCP/UDP firewall rules. Use `--no-firewall` only when those rules are managed separately. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
+Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, stores plugin data under `$DSH_HOME/mobile-access/`, and on Windows requests administrator approval once for TCP/UDP rules limited to Windows' dynamic `LocalSubnet`. Use `--no-firewall` only when those rules are managed separately. While DSH is running, the plugin follows DHCP, Wi-Fi, and phone-hotspot address changes on that interface, rebinds the gateway, and signs a matching server certificate from the same CA. Paired devices and the Android CA trust remain valid.
 
 1. Copy the generated `dsh-mobile-ca.cer` to Android and install it once as a user CA certificate.
 2. Open the Mobile card in the lower-left corner of the desktop DSH UI.

package/README.zh.md

@@ -61,7 +61,7 @@ pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
 
-两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`。Windows 会请求管理员批准两条仅限所选局域网的 TCP/UDP 防火墙规则；只有自行管理规则时才使用 `--no-firewall`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
+两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`。Windows 只在首次设置时请求管理员批准两条受动态 `LocalSubnet` 限制的 TCP/UDP 规则；只有自行管理规则时才使用 `--no-firewall`。DSH 运行期间，如果该网卡因 DHCP、切换 Wi-Fi 或手机热点而改变地址，插件会自动重绑网关，并用同一 CA 签发匹配的新服务器证书；已有设备配对和 Android CA 信任不会失效。
 
 1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中一次性安装为用户 CA 证书。
 2. 在电脑 DSH 左下角打开“移动端”卡片。

package/lib/cli.js

@@ -229,14 +229,14 @@ async function runElevatedPowerShell(script) {
 		launch
 	], { windowsHide: true });
 }
-async function configureWindowsFirewall(port, cidr) {
+async function configureWindowsFirewall(port) {
 	if (process.platform !== "win32") return;
 	const script = [
 		"$ErrorActionPreference = 'Stop'",
 		`Get-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
 		`Get-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -ErrorAction SilentlyContinue | Remove-NetFirewallRule`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress '${cidr}' -Profile Any | Out-Null`,
-		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress '${cidr}' -Profile Any | Out-Null`
+		`New-NetFirewallRule -DisplayName '${FIREWALL_TCP_RULE}' -Direction Inbound -Action Allow -Protocol TCP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`,
+		`New-NetFirewallRule -DisplayName '${FIREWALL_UDP_RULE}' -Direction Inbound -Action Allow -Protocol UDP -LocalPort ${String(port)} -RemoteAddress LocalSubnet -Profile Any | Out-Null`
 	].join("; ");
 	console.log("Windows will request administrator approval for two LAN-only firewall rules.");
 	await runElevatedPowerShell(script);
@@ -293,7 +293,7 @@ async function setup(args) {
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
 	]);
-	if (options.configureFirewall) await configureWindowsFirewall(options.port, network.cidr);
+	if (options.configureFirewall) await configureWindowsFirewall(options.port);
 	const customCss = join(directory, "mobile.css");
 	try {
 		await readFile(customCss);

package/lib/index.mjs

@@ -687,6 +687,60 @@ function parseGatewayConfig(raw) {
 }
 //#endregion
 //#region src/control.ts
+/** Keeps one runtime aligned with a changing network selection. */
+var FollowingMobileAccessRuntime = class {
+	select;
+	onRefreshError;
+	runtime;
+	key;
+	queue = Promise.resolve();
+	closed = false;
+	timer;
+	constructor(select, onRefreshError) {
+		this.select = select;
+		this.onRefreshError = onRefreshError;
+	}
+	/** Start the current selection and optionally poll for later changes. */
+	async initialize(refreshIntervalMs) {
+		await this.refresh();
+		if (refreshIntervalMs === void 0) return;
+		this.timer = setInterval(() => {
+			this.refresh().catch(this.onRefreshError);
+		}, refreshIntervalMs);
+		this.timer.unref();
+	}
+	/** Reconcile the active runtime with the latest selection. */
+	refresh() {
+		return this.enqueue(async () => {
+			if (this.closed) return;
+			const selection = await this.select();
+			if (this.closed || this.runtime !== void 0 && this.key === selection.key) return;
+			const previous = this.runtime;
+			this.runtime = void 0;
+			this.key = void 0;
+			if (previous !== void 0) await previous.close();
+			this.runtime = await selection.start();
+			this.key = selection.key;
+		});
+	}
+	/** Stop polling and close the most recently selected runtime. */
+	close() {
+		if (this.closed) return this.queue;
+		this.closed = true;
+		if (this.timer !== void 0) clearInterval(this.timer);
+		return this.enqueue(async () => {
+			const runtime = this.runtime;
+			this.runtime = void 0;
+			this.key = void 0;
+			if (runtime !== void 0) await runtime.close();
+		});
+	}
+	enqueue(operation) {
+		const run = this.queue.then(operation, operation);
+		this.queue = run.then(() => {}, () => {});
+		return run;
+	}
+};
 /** Validate control state loaded across the filesystem boundary. */
 function parseMobileAccessControlState(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile-access control state must be an object");
@@ -2295,14 +2349,25 @@ const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"instanceId",
 	"tls"
 ]);
+function withoutSetupKeys(config) {
+	const merged = { ...config };
+	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+	return merged;
+}
 async function loadSetup(config) {
-	if (config.setupFile === void 0) return config;
+	if (config.setupFile === void 0) return {
+		kind: "fixed",
+		config
+	};
 	if (!isAbsolute(config.setupFile)) throw new Error("setupFile must be an absolute file path");
 	let source;
 	try {
 		source = await readFile(resolve(config.setupFile), "utf8");
 	} catch (error) {
-		if (error.code === "ENOENT") return config;
+		if (error.code === "ENOENT") return {
+			kind: "fixed",
+			config
+		};
 		throw error;
 	}
 	let parsed;
@@ -2313,29 +2378,27 @@ async function loadSetup(config) {
 	}
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
 	const record = parsed;
-	if (record.version === 2) {
-		const setup = await materializeManagedSetup(parseManagedSetup(record));
-		const merged = { ...config };
-		for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
-		return {
-			...merged,
-			...setup
-		};
-	}
+	if (record.version === 2) return {
+		kind: "managed",
+		config: withoutSetupKeys(config),
+		setup: parseManagedSetup(record)
+	};
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
-	const merged = { ...config };
-	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
 	return {
-		...merged,
-		...setup
+		kind: "fixed",
+		config: {
+			...withoutSetupKeys(config),
+			...setup
+		}
 	};
 }
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 async function apply(ctx, config) {
-	const resolved = parseGatewayConfig(await loadSetup(config));
+	const loaded = await loadSetup(config);
 	let gateway;
-	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), async () => {
+	const startGateway = async (candidateConfig) => {
+		const resolved = parseGatewayConfig(candidateConfig);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices));
 		await candidate.start();
 		gateway = candidate;
@@ -2343,7 +2406,25 @@ async function apply(ctx, config) {
 			if (gateway === candidate) gateway = void 0;
 			await candidate.close();
 		} };
-	});
+	};
+	const startRuntime = async () => {
+		if (loaded.kind === "fixed") return startGateway(loaded.config);
+		const following = new FollowingMobileAccessRuntime(async () => {
+			const network = selectLanNetwork(void 0, loaded.setup.networkInterface);
+			return {
+				key: `${network.name}\0${network.address}\0${network.cidr}`,
+				start: async () => startGateway({
+					...loaded.config,
+					...await materializeManagedSetup(loaded.setup)
+				})
+			};
+		}, (error) => {
+			process.emitWarning(`DSH Mobile could not follow the current LAN address: ${error instanceof Error ? error.message : String(error)}`, { code: "DSH_MOBILE_NETWORK_REFRESH" });
+		});
+		await following.initialize(2e3);
+		return following;
+	};
+	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
 	const adminRoute = {
 		kind: "prefix",
 		path: LOCAL_ADMIN_PREFIX,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.6",
+  "version": "0.1.0-alpha.7",
   "private": false,
   "description": "Authenticated Android and mobile-browser access for the stock DeepSeek Harness Web UI",
   "type": "module",