dsh-mobile 0.6.6 → 0.6.7

package/lib/index.d.mts

@@ -333,6 +333,15 @@ interface PluginConfig {
     keyFile?: string;
     caFile?: string;
   };
+  /**
+   * Reserved cpolar subdomain passed through as `cpolar http -subdomain`.
+   *
+   * A compatible account reservation and region are required. Unset or blank values
+   * keep provider-selected allocation; credentials may still expire or be revoked.
+   */
+  cpolarSubdomain?: string;
+  /** cpolar region for `-region`; use the region chosen when reserving the subdomain. */
+  cpolarRegion?: string;
   pairingTtlMs?: number;
   deviceTtlMs?: number;
   sessionTtlMs?: number;
@@ -664,8 +673,8 @@ declare class ExtensionWorkerHost {
   private cancelStream;
 }
 //#endregion
-//#region src/extensions.d.ts
-/** Maximum sizes enforced at the local-extension filesystem boundary. */
+//#region src/extension-limits.d.ts
+/** Maximum sizes enforced when reading local extension files. */
 export declare const EXTENSION_LIMITS: Readonly<{
   manifest: number;
   script: number;
@@ -675,6 +684,8 @@ export declare const EXTENSION_LIMITS: Readonly<{
   assetBytes: number;
   assetDepth: 8;
 }>;
+//#endregion
+//#region src/extensions.d.ts
 /** A controlled business failure returned by an extension action or route. */
 export declare class MobileExtensionError extends Error {
   readonly code: string;

package/lib/index.mjs

@@ -956,6 +956,8 @@ const Config = z.object({
 		keyFile: z.string(),
 		caFile: z.string()
 	}),
+	cpolarSubdomain: z.string(),
+	cpolarRegion: z.string(),
 	pairingTtlMs: z.natural(),
 	deviceTtlMs: z.natural(),
 	sessionTtlMs: z.natural(),
@@ -1991,6 +1993,13 @@ function attributeValue(tag, name) {
 function commentRanges(html) {
 	return [...html.matchAll(/<!--[\s\S]*?-->/gu)].map((match) => [match.index, match.index + match[0].length]);
 }
+/** Mark an authenticated Gateway document without changing its layout, transport or module selection. */
+function ensureMobileGatewayMarker(html) {
+	const comments = commentRanges(html);
+	const first = [...html.matchAll(/<script\b[^>]*>/giu)].find((match) => !comments.some(([start, end]) => match.index >= start && match.index < end));
+	if (first === void 0) return html;
+	return `${html.slice(0, first.index)}<meta name="dsh-mobile-gateway" content="authenticated">${html.slice(first.index)}`;
+}
 /**
 * Load the compatibility bundle synchronously, before the first DSH script.
 *
@@ -2010,6 +2019,16 @@ function ensureMobileCompatibility(html) {
 	const script = `<script src="${MOBILE_COMPAT_PATH}"${attribute}><\/script>`;
 	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
 }
+/** Maximum sizes enforced when reading local extension files. */
+const EXTENSION_LIMITS = Object.freeze({
+	manifest: 65536,
+	script: 1048576,
+	css: 524288,
+	asset: 8388608,
+	assetFiles: 256,
+	assetBytes: 33554432,
+	assetDepth: 8
+});
 //#endregion
 //#region src/http-cache.ts
 /** Entity-tag handling for authenticated GET and HEAD cache validation. */
@@ -3066,16 +3085,6 @@ var WorkerStreamBridge = class extends Readable {
 };
 //#endregion
 //#region src/extensions.ts
-/** Maximum sizes enforced at the local-extension filesystem boundary. */
-const EXTENSION_LIMITS = Object.freeze({
-	manifest: 65536,
-	script: 1048576,
-	css: 524288,
-	asset: 8388608,
-	assetFiles: 256,
-	assetBytes: 33554432,
-	assetDepth: 8
-});
 /** A misbehaving host activation must not wedge the local watcher forever. */
 const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
 /** The previous Host outlives the hidden-page refresh interval and one timed refresh. */
@@ -4811,7 +4820,7 @@ function rewriteMobileIndexWithBatch(html, options = {}) {
 	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${mobileCsrfFetchBootstrap(options.csrfCookie ?? "dsh_ma_csrf")}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
 	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements))),
+		html: ensureMobileGatewayMarker(ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements)))),
 		batches
 	});
 }
@@ -5986,8 +5995,9 @@ var MobileAccessGateway = class {
 		const stockFrontend = new URL(target.raw, this.address().origin).searchParams.get("frontend") === "stock";
 		const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
 		const frontendDocument = target.decodedPathname === "/" || target.decodedPathname === "/index.html";
-		if (request.method === "GET" && frontendDocument && acceptsHtml && !stockFrontend) {
-			await this.proxyMobileIndex(request, response, authorization);
+		if (request.method === "GET" && frontendDocument && acceptsHtml) {
+			if (stockFrontend && target.decodedPathname === "/") request.url = "/";
+			await this.proxyMobileIndex(request, response, authorization, stockFrontend);
 			return;
 		}
 		if (stockFrontend && target.decodedPathname === "/") request.url = "/";
@@ -6378,6 +6388,8 @@ var MobileAccessGateway = class {
 			signal.throwIfAborted();
 			if (upstreamCookie !== void 0) headers.cookie = upstreamCookie;
 			headers["accept-encoding"] = "identity";
+			delete headers["if-none-match"];
+			delete headers["if-modified-since"];
 			const proxied = await new Promise((resolve, reject) => {
 				upstreamRequest = request({
 					protocol: "http:",
@@ -6417,7 +6429,7 @@ var MobileAccessGateway = class {
 			upstreamRequest?.destroy();
 		}
 	}
-	async proxyMobileIndex(request, response, authorization) {
+	async proxyMobileIndex(request, response, authorization, stockFrontend = false) {
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
 		const onClose = () => {
@@ -6427,50 +6439,53 @@ var MobileAccessGateway = class {
 		response.once("close", onClose);
 		try {
 			const index = await this.fetchAuthenticatedUpstreamIndex(operation.signal, request);
-			const preference = await this.clientModulePreferences.read(authorization.deviceId);
-			const excludedClientModules = preference.excludedClientModules;
 			let body;
-			try {
-				const html = index.html;
-				const plan = parseMobileBootPlan(html, excludedClientModules);
-				const options = plan.rewrittenBatchEntries === void 0 ? { excludedClientModules } : {
-					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries), operation.signal),
-					excludedClientModules
-				};
-				const cookies = browserAuthCookies(request.headers.cookie);
-				const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
-				const rewritten = rewriteMobileIndexWithBatch(html, {
-					...options,
-					csrfCookie
-				});
-				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
-				body = Buffer.from(rewritten.html);
-			} catch (error) {
-				if (error instanceof ExcludedClientModulesError) {
-					const detail = error.message.replace(/[\r\n]/gu, " ").slice(0, 512);
-					if (detail !== this.lastModuleExclusionError) {
-						this.lastModuleExclusionError = detail;
-						process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
-					}
-					if (preference.source === "device" || preference.source === "computer") {
-						operation.signal.throwIfAborted();
-						const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
-						const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
-						setSecurityHeaders(response, this.tlsEnabled);
-						response.writeHead(200, {
-							"Content-Type": "text/html; charset=utf-8",
-							"Content-Length": recovery.byteLength
-						});
-						response.end(recovery);
+			if (stockFrontend) body = Buffer.from(ensureMobileGatewayMarker(index.html));
+			else {
+				const preference = await this.clientModulePreferences.read(authorization.deviceId);
+				const excludedClientModules = preference.excludedClientModules;
+				try {
+					const html = index.html;
+					const plan = parseMobileBootPlan(html, excludedClientModules);
+					const options = plan.rewrittenBatchEntries === void 0 ? { excludedClientModules } : {
+						...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries), operation.signal),
+						excludedClientModules
+					};
+					const cookies = browserAuthCookies(request.headers.cookie);
+					const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
+					const rewritten = rewriteMobileIndexWithBatch(html, {
+						...options,
+						csrfCookie
+					});
+					for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
+					body = Buffer.from(rewritten.html);
+				} catch (error) {
+					if (error instanceof ExcludedClientModulesError) {
+						const detail = error.message.replace(/[\r\n]/gu, " ").slice(0, 512);
+						if (detail !== this.lastModuleExclusionError) {
+							this.lastModuleExclusionError = detail;
+							process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
+						}
+						if (preference.source === "device" || preference.source === "computer") {
+							operation.signal.throwIfAborted();
+							const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
+							const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
+							setSecurityHeaders(response, this.tlsEnabled);
+							response.writeHead(200, {
+								"Content-Type": "text/html; charset=utf-8",
+								"Content-Length": recovery.byteLength
+							});
+							response.end(recovery);
+							return;
+						}
+						sendJson(response, 409, {
+							error: "excluded_client_modules_invalid",
+							detail
+						}, this.tlsEnabled);
 						return;
 					}
-					sendJson(response, 409, {
-						error: "excluded_client_modules_invalid",
-						detail
-					}, this.tlsEnabled);
-					return;
+					throw new HttpError(502, "upstream_unavailable");
 				}
-				throw new HttpError(502, "upstream_unavailable");
 			}
 			operation.signal.throwIfAborted();
 			const headers = sanitizeResponseHeaders(index.headers, this.config.upstreamOrigin);
@@ -13281,11 +13296,11 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 //#region src/mobile-guide.ts
 /** Compose the guide with the current customization state injected. */
 function buildMobileGuide(state) {
-	const styleLine = state.hasCustomCss ? "存在（当前生效的自定义样式）" : "不存在（使用内置默认样式）";
-	const scriptLine = state.hasCustomJs ? "存在（当前生效的自定义脚本）" : "不存在（无自定义脚本）";
+	const styleLine = state.hasCustomCss ? "存在（已检测到文件，需在已配对页面验证加载）" : "不存在（使用内置默认样式）";
+	const scriptLine = state.hasCustomJs ? "存在（已检测到文件，需在已配对页面验证加载）" : "不存在（无自定义脚本）";
 	const extensionLines = state.extensions.length === 0 ? "（无）" : state.extensions.map((entry) => `- ${entry.id}（${entry.name} v${entry.version}）${entry.executionMode === void 0 ? "" : ` · ${entry.executionMode}${entry.executionState === "unavailable" ? " · 当前不可用，需要显式重启扩展" : ""}`}`).join("\n");
 	const failureLine = state.failedExtensionCount > 0 ? `注意：${state.failedExtensionCount} 个扩展的电脑端 host 激活失败，如改动相关扩展请先检查其 host.mjs 与 extension.json。` : "";
-	return `${`## 手机端当前状态（改动前必读，避免覆盖已有定制）
+	return `${`## 本机定制文件与扩展状态（改动前必读，避免覆盖已有定制）
 
 - 定制目录：${state.directory}（所有改动只允许在这里进行）
 - mobile.css：${styleLine}
@@ -13309,7 +13324,9 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
 1. 界面与交互 —— 只改外观和交互，不需要碰电脑的文件或程序：
    - $DSH_HOME/mobile-access/mobile.css：手机端样式
    - $DSH_HOME/mobile-access/mobile.js：手机端脚本，用 window.dshMobile.register(({ root }) => { ... }) 把内容挂载到 root，返回清理函数
-   - 保存后手机端几秒内自动应用，无需重启
+   - 保存后已配对的 DSH Mobile 页面会自动检查并应用，无需重启；文件存在不表示某个页面已成功加载
+
+定制资源通过 DSH Mobile Gateway 的移动配对会话认证。普通 DSH 网页的登录凭据不等于移动配对凭据；直接打开普通 DSH 地址或仅用手机视口预览，不能据此验证 mobile.css / mobile.js。若扩展 manifest 返回 401，页面不会继续加载定制样式与脚本；先确认是通过“移动访问”配对入口进入，并检查实际请求与页面中的定制样式，不要盲改 CSS 或放松认证。核对 Cookie 时只确认是否存在，不读取或公开其值。
 
 动手前先读已有的定制文件。若要调整 DSH 自带的输入框、侧栏或设置等现有界面，先确认当前 DSH 版本与手机页面模式（专用移动页面或 ?frontend=stock），只读核对运行页面的 DOM、属性和样式；本机有同版本前端源码时可参考相应组件，没有源码时可查看已安装的客户端产物，不必下载源码。优先使用扩展 API、插槽和稳定的 data-* 标记，不凭猜测依赖构建类名。只读查看不改变前述写入范围。
 
@@ -14824,6 +14841,7 @@ const CPOLAR_HOST_SUFFIXES = Object.freeze([
 	".cpolar.top",
 	".cpolar.com"
 ]);
+const CPOLAR_SUBDOMAIN_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/u;
 function publicStatus(status) {
 	return Object.freeze({
 		enabled: status.enabled,
@@ -14918,7 +14936,16 @@ var CpolarController = class {
 	constructor(options) {
 		this.options = options;
 		if (!isAbsolute(options.executable) || !isAbsolute(options.configFile)) throw new Error("cpolar paths must be absolute");
-		if (options.region !== void 0 && !/^[a-z][a-z0-9_]{0,31}$/u.test(options.region)) throw new Error("cpolar region is invalid");
+		const { subdomain: rawSubdomain, region: rawRegion, ...resources } = options;
+		const subdomain = rawSubdomain?.trim() || void 0;
+		const region = rawRegion?.trim() || void 0;
+		if (region !== void 0 && !/^[a-z][a-z0-9_]{0,31}$/u.test(region)) throw new Error("cpolar region is invalid");
+		if (subdomain !== void 0 && !CPOLAR_SUBDOMAIN_PATTERN.test(subdomain)) throw new Error("cpolar subdomain is invalid");
+		this.options = {
+			...resources,
+			...subdomain === void 0 ? {} : { subdomain },
+			...region === void 0 ? {} : { region }
+		};
 	}
 	/** Restore the remembered cpolar switch independently from LAN and Funnel state. */
 	async initialize(initialState) {
@@ -15068,6 +15095,7 @@ var CpolarController = class {
 		const args = [
 			"http",
 			`-config=${resolve(this.options.configFile)}`,
+			...this.options.subdomain === void 0 ? [] : [`-subdomain=${this.options.subdomain}`],
 			...this.options.region === void 0 ? [] : [`-region=${this.options.region}`],
 			"-inspect-addr=false",
 			"-redirect-https=true",
@@ -17271,6 +17299,8 @@ async function apply(ctx, config) {
 			store: cpolarStore,
 			executable: cpolarComponent.executable,
 			configFile: cpolarComponent.configFile,
+			...config.cpolarSubdomain === void 0 ? {} : { subdomain: config.cpolarSubdomain },
+			...config.cpolarRegion === void 0 ? {} : { region: config.cpolarRegion },
 			createGateway: createRemoteGateway
 		}),
 		cloudflared: new CloudflaredController({