dsh-multi-chat 0.4.3 → 0.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-multi-chat",
-  "version": "0.4.3",
+  "version": "0.5.1",
   "description": "DSH 多对话：在官方 DeepSeek Harness Web 界面里并排运行和监控多个对话实例（多窗口墙），并内置带口令认证的手机访问网关。npx dsh-multi-chat install|start|stop",
   "license": "MIT",
   "type": "module",

package/plugin/dsh-client-ui-multi-wall/README.md

@@ -6,7 +6,7 @@ Multi-window wall plugin, browser half + node half: a grid of every running DSH
 
 The wall's business state is a single store (`dsh.multi-wall`): the discovered port list and the grid column count, persisted across view switches and reloads. Discovery, liveness, create, and stop all flow through the node half's read-only JSON routes — `/multi/api/ports` (auto-discovery, excluding nothing so the serving instance is also watchable), `/multi/api/status` (liveness of a specific port list), `/multi/api/stop` (terminate a chosen instance), `/multi/api/create` (start a fresh instance, surfacing the child's stderr on failure), and `/multi/api/link` (phone access).
 
-Phone/remote access: the official CLI forbids `--host 0.0.0.0` (it would expose remote code execution), so `/multi/api/link` lazily starts an **inline authenticated gateway** (raw `node:net` reverse proxy with an HMAC-signed session-cookie login, targets `127.0.0.1:<self-port>`, rewrites Host/Origin so the official `/api` browser-trust fence sees a local request, and passes WebSocket upgrades through). The route returns the LAN URLs plus the login token; the gateway falls back to an OS-assigned port when its intended port hits a Windows excluded range or is already bound.
+Phone/remote access: the official CLI forbids `--host 0.0.0.0` (it would expose remote code execution), so `/multi/api/link` lazily starts an **inline authenticated gateway** (raw `node:net` reverse proxy with an HMAC-signed session-cookie login, targets `127.0.0.1:<self-port>`, rewrites Host/Origin so the official `/api` browser-trust fence sees a local request, and passes WebSocket upgrades through). The route returns the LAN URLs plus the login token. The returned addresses drop virtual NICs (VMware/VirtualBox/WSL/Docker/Hyper-V/VPN — unreachable from a phone) and put physical NICs (Wi-Fi/Ethernet) first; the gateway falls back to an OS-assigned port when its intended port hits a Windows excluded range or is already bound.
 
 The `/client` exports the plugin body (`apply`/`inject`), the `WallView`/`WallToggle` components, the wall store factory, and the injected probe-face types.
 

package/plugin/dsh-client-ui-multi-wall/lib/client.js

@@ -14,8 +14,8 @@ window.__ModuleLoader__.load({
 		const zh = {
 			"toggle": "多窗口",
 			"toggle.aria": "打开或关闭多窗口",
-			"view.multiWall": "多窗口墙",
-			"overlay.title": "多窗口墙",
+			"view.multiWall": "多窗口",
+			"overlay.title": "多窗口",
 			"overlay.close": "关闭",
 			"scan": "发现实例",
 			"scan.from": "起始端口",
@@ -25,7 +25,7 @@ window.__ModuleLoader__.load({
 			"create.failed": "创建失败：{error}",
 			"create.unknown": "未知原因",
 			"exit": "退出",
-			"exit.aria": "退出多窗口墙，返回对话",
+			"exit.aria": "退出多窗口，返回对话",
 			"link": "手机访问",
 			"link.aria": "获取手机访问链接",
 			"link.fetching": "正在获取链接…",
@@ -60,8 +60,8 @@ window.__ModuleLoader__.load({
 		const en = {
 			"toggle": "Multi-Window",
 			"toggle.aria": "Toggle multi-window",
-			"view.multiWall": "Multi-Window Wall",
-			"overlay.title": "Multi-Window Wall",
+			"view.multiWall": "Multi-Window",
+			"overlay.title": "Multi-Window",
 			"overlay.close": "Close",
 			"scan": "Discover",
 			"scan.from": "Start port",
@@ -71,7 +71,7 @@ window.__ModuleLoader__.load({
 			"create.failed": "Create failed: {error}",
 			"create.unknown": "unknown reason",
 			"exit": "Exit",
-			"exit.aria": "Exit the wall and return to chat",
+			"exit.aria": "Exit multi-window and return to chat",
 			"link": "Phone access",
 			"link.aria": "Get phone access link",
 			"link.fetching": "Fetching link…",
@@ -242,33 +242,33 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var WallView_module_css_default = {
-			"paneTitle": "ouhzTG_paneTitle",
-			"hint": "ouhzTG_hint",
-			"toolbar": "ouhzTG_toolbar",
+			"danger": "ouhzTG_danger",
+			"action": "ouhzTG_action",
 			"confirm": "ouhzTG_confirm",
-			"paneActions": "ouhzTG_paneActions",
-			"linkBar": "ouhzTG_linkBar",
-			"grid": "ouhzTG_grid",
-			"paneHead": "ouhzTG_paneHead",
-			"empty": "ouhzTG_empty",
-			"title": "ouhzTG_title",
 			"field": "ouhzTG_field",
-			"controls": "ouhzTG_controls",
 			"wall": "ouhzTG_wall",
-			"zoomed": "ouhzTG_zoomed",
+			"grid": "ouhzTG_grid",
+			"hint": "ouhzTG_hint",
 			"status": "ouhzTG_status",
-			"pane": "ouhzTG_pane",
-			"danger": "ouhzTG_danger",
-			"paneBody": "ouhzTG_paneBody",
+			"paneTitle": "ouhzTG_paneTitle",
+			"controls": "ouhzTG_controls",
 			"linkText": "ouhzTG_linkText",
+			"paneHead": "ouhzTG_paneHead",
+			"paneBody": "ouhzTG_paneBody",
+			"empty": "ouhzTG_empty",
 			"dot": "ouhzTG_dot",
-			"action": "ouhzTG_action"
+			"toolbar": "ouhzTG_toolbar",
+			"linkBar": "ouhzTG_linkBar",
+			"title": "ouhzTG_title",
+			"pane": "ouhzTG_pane",
+			"paneActions": "ouhzTG_paneActions",
+			"zoomed": "ouhzTG_zoomed"
 		};
 		//#endregion
 		//#region src/client/WallView.tsx
 		/**
 		* WallView: the multi-window wall as a `conversation.view` ring entry. When
-		* the header's "多窗口墙" tab is selected, the right panel swaps from the
+		* the header's "多窗口" tab is selected, the right panel swaps from the
 		* chat to this view — a toolbar plus a grid of iframes, one pane per running
 		* DSH instance (127.0.0.1:<port>). Pure additive UI; no existing slot is
 		* replaced.
@@ -469,7 +469,10 @@ window.__ModuleLoader__.load({
 			const copyFirstLink = async () => {
 				if (linkInfo === null || linkInfo.lan.length === 0) return;
 				try {
-					await navigator.clipboard.writeText(linkInfo.lan[0] ?? "");
+					const base = linkInfo.lan[0] ?? "";
+					const token = linkInfo.token ?? "";
+					const url = token !== "" ? `${base}?token=${encodeURIComponent(token)}` : base;
+					await navigator.clipboard.writeText(url);
 					setLinkCopied(true);
 				} catch {
 					setLinkCopied(false);
@@ -657,15 +660,15 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var WallToggle_module_css_default = {
-			"row": "bmjS6q_row",
-			"label": "bmjS6q_label"
+			"label": "bmjS6q_label",
+			"row": "bmjS6q_row"
 		};
 		//#endregion
 		//#region src/client/WallToggle.tsx
 		/**
 		* WallToggle: the sidebar-foot shortcut. Clicking it opens the wall view —
 		* the `conversation.view` ring switches to the 'multi-wall' entry, which the
-		* header renders as the "多窗口墙" tab. The click is a plain user-equivalent
+		* header renders as the "多窗口" tab. The click is a plain user-equivalent
 		* activation: it finds the header's view-ring tab for this plugin's label and
 		* clicks it, so the official view-ring state machine (the chat store's active
 		* view field) performs the switch. No store is declared: the ring decides

package/plugin/dsh-client-ui-multi-wall/lib/index.js

@@ -119,6 +119,27 @@ cache-control: no-store\r
 	socket.end();
 }
 /**
+* Send a 302 that mints a session cookie and drops the `token` query param.
+* A `?token=` URL authenticates exactly one request, so on first arrival the
+* gateway exchanges it for an HMAC-signed cookie and redirects to the same
+* path without `token=` (keeps the secret out of the address bar / history).
+*/
+function respondSessionRedirect(socket, parsed, cookie) {
+	let location = parsed.target;
+	try {
+		const url = new URL(parsed.target, "http://gateway.local");
+		url.searchParams.delete("token");
+		location = url.pathname + url.search;
+	} catch {}
+	socket.write(`HTTP/1.1 302 Found\r
+location: ${location}\r\nset-cookie: ${cookie}\r\ncontent-length: 0\r
+connection: close\r
+cache-control: no-store\r
+\r
+`);
+	socket.end();
+}
+/**
 * Rebuild the request head for the loopback target. Host and Origin point at
 * `127.0.0.1:<target-port>` so the DSH `/api` browser-trust fence sees a local
 * request. Non-upgrade requests get `connection: close` (fresh connection per
@@ -158,17 +179,16 @@ function startGateway(options) {
 			return false;
 		}
 	};
-	const isAuthed = (parsed) => {
+	const authKind = (parsed) => {
 		const cookie = parsed.map.cookie ?? "";
 		const session = /(?:^|;\s*)dsh_gw_session=([^;]+)/.exec(cookie);
-		if (session !== null && verifySession(session[1] ?? "")) return true;
+		if (session !== null && verifySession(session[1] ?? "")) return "cookie";
 		const bearer = parsed.map.authorization ?? "";
-		if (bearer.startsWith("Bearer ") && bearer.slice(7) === token) return true;
+		if (bearer.startsWith("Bearer ") && bearer.slice(7) === token) return "bearer";
 		try {
-			return new URL(parsed.target, "http://gateway.local").searchParams.get("token") === token;
-		} catch {
-			return false;
-		}
+			if (new URL(parsed.target, "http://gateway.local").searchParams.get("token") === token) return "query";
+		} catch {}
+		return "none";
 	};
 	const attempts = /* @__PURE__ */ new Map();
 	const isBlocked = (ip) => {
@@ -262,10 +282,15 @@ connection: close\r
 				handleLogin(socket, parsed, buffer.subarray(parsed.headBytes));
 				return;
 			}
-			if (!isAuthed(parsed)) {
+			const kind = authKind(parsed);
+			if (kind === "none") {
 				respondLogin(socket, name, path === "/" ? "/" : path);
 				return;
 			}
+			if (kind === "query") {
+				respondSessionRedirect(socket, parsed, `dsh_gw_session=${signSession(Date.now() + maxAgeHours * 36e5)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAgeHours * 3600}`);
+				return;
+			}
 			const target = connect(targetPort, "127.0.0.1");
 			const rest = buffer.subarray(parsed.headBytes);
 			let connected = false;
@@ -607,13 +632,67 @@ async function startInstance(launcher, port, timeoutMs = 2e4) {
 	}
 }
 /**
+* Interface-name patterns that mark a *virtual* NIC (VM bridge, WSL,
+* Docker, Hyper-V, VPN adapters, Loopback Pseudo-Instance, etc.). These
+* interfaces are never reachable from a phone on the same LAN, so they are
+* dropped from the link list entirely.
+*/
+const VIRTUAL_IFACE_PATTERNS = [
+	/vEthernet/i,
+	/vmware/i,
+	/virtualbox/i,
+	/^vbox/i,
+	/wsl/i,
+	/docker/i,
+	/hyper-v/i,
+	/tap-windows/i,
+	/^tap/i,
+	/^tun/i,
+	/ppp/i,
+	/loopback/i,
+	/apipa/i,
+	/^utun/i,
+	/^awdl/i,
+	/^llw/i,
+	/^bridge/i,
+	/bluetooth/i
+];
+/**
+* Interface-name patterns that mark a *physical* NIC (Wi-Fi / Ethernet).
+* Matches kept addresses are ordered before any unknown-but-surviving
+* address so the phone-first address is the machine's real NIC.
+*/
+const PHYSICAL_IFACE_PATTERNS = [
+	/^(wi-?fi|wlan|wireless)/i,
+	/^(eth(ernet)?|以太网|以太)/i,
+	/^(en|wan)[0-9]/i,
+	/^本地连接/i,
+	/^e[0-9]+$/i,
+	/^w[0-9]+$/i
+];
+/**
 * The non-loopback IPv4 addresses of this machine (the LAN reachable URLs).
+* Virtual NICs (VM/WSL/Docker/VPN/loopback pseudo) are filtered out; the
+* remaining addresses are ordered with physical NICs (Wi-Fi/Ethernet) first
+* so the phone shows the actually-reachable LAN address at the top.
 * @returns the address list (possibly empty).
 */
 function lanAddresses() {
-	const out = [];
-	for (const ifaces of Object.values(networkInterfaces())) for (const iface of ifaces ?? []) if (iface.family === "IPv4" && !iface.internal) out.push(iface.address);
-	return out;
+	const candidates = [];
+	for (const [name, ifaces] of Object.entries(networkInterfaces())) {
+		const virtual = VIRTUAL_IFACE_PATTERNS.some((re) => re.test(name));
+		const physical = !virtual && PHYSICAL_IFACE_PATTERNS.some((re) => re.test(name));
+		for (const iface of ifaces ?? []) {
+			if (iface.family !== "IPv4" || iface.internal) continue;
+			if (virtual) continue;
+			candidates.push({
+				address: iface.address,
+				physical
+			});
+		}
+	}
+	candidates.sort((a, b) => Number(b.physical) - Number(a.physical));
+	return candidates.map((c) => c.address);
 }
 /**
 * Register the probe routes. Everything lives under `/multi/api` so the