dsh-relay-phone 0.11.0 → 0.11.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-relay-phone",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
   "type": "module",
   "main": "src/index.js",

package/src/mobile/assets/app.js

@@ -72,6 +72,7 @@
       polling: false,
       timer: null,
       busy: false,
+      text: '', // everything received so far; the host only sends new lines
     },
   }
 
@@ -2597,7 +2598,8 @@
     $('terminalTitle').textContent = '终端'
     try {
       await ensureTerminal()
-      await refreshTerminal()
+      state.terminal.text = ''
+      await refreshTerminal(true)
       startTerminalPoll()
     } catch (error) {
       $('terminalOut').textContent = '终端不可用：' + (error.message || error)
@@ -2607,6 +2609,7 @@
   function closeTerminal() {
     $('terminalPanel').hidden = true
     state.terminal.open = false
+    state.terminal.text = ''
     stopTerminalPoll()
   }
 
@@ -2660,15 +2663,22 @@
       .replace(/\u001b(\[[0-9;?]*)?$/g, '')
   }
 
-  async function refreshTerminal() {
+  async function refreshTerminal(reset) {
     if (!state.terminal.id || !state.terminal.open) return
     var result = await rpc('terminal.read', {
       sessionId: state.currentId,
       terminalId: state.terminal.id,
       count: 300,
+      reset: reset === true,
     })
     var out = $('terminalOut')
-    var text = plainTerminalText(result.text) || '(无输出)'
+    // The bridge sends only the lines this phone has not seen; append them,
+    // and replace the buffer whenever it says the gap cannot be bridged.
+    var chunk = plainTerminalText(result.text)
+    if (result.appended !== true) state.terminal.text = chunk
+    else if (chunk) state.terminal.text = (state.terminal.text || '') + (state.terminal.text ? '\n' : '') + chunk
+    if (state.terminal.text.length > 200000) state.terminal.text = state.terminal.text.slice(-200000)
+    var text = state.terminal.text || '(无输出)'
     if (out.textContent !== text) {
       out.textContent = text
       out.scrollTop = out.scrollHeight
@@ -2714,12 +2724,13 @@
       var created = await rpc('terminal.create', { sessionId: state.currentId })
       state.terminal.id = created.id
       state.terminal.name = created.name || created.type
-      $('terminalOut').textContent = created.motd || ''
+      state.terminal.text = plainTerminalText(created.motd)
+      $('terminalOut').textContent = state.terminal.text || ''
       toast('已新建终端')
     } catch (error) {
       toast('新建终端失败：' + (error.message || error))
     }
-    refreshTerminal().catch(function () {})
+    refreshTerminal(true).catch(function () {})
   }
 
   async function terminalKill() {

package/src/mobile/bridge.js

@@ -85,6 +85,7 @@ export class MobileBridge {
     this.continued = new Map() // key (`q:<callId>`) -> {sessionId, callId, questions}
     this.titles = new Map() // sessionId -> title from list rows
     this.ownTerminals = new Map() // `${sessionId}:${id}` -> plugin-owned fallback PTY
+    this.terminalCursors = new Map() // `${sessionId}:${id}` -> last line index sent to the phone
     this.disposers = []
     this.started = false
     this.phoneCount = 0
@@ -989,8 +990,10 @@ export class MobileBridge {
     const sessionId = params?.sessionId
     const id = params?.terminalId
     if (typeof sessionId !== 'string' || typeof id !== 'string') throw fail('bad-request', 'sessionId and terminalId required')
+    const key = `${sessionId}:${id}`
+    if (params?.reset === true) this.terminalCursors.delete(key)
     const owned = this.ownTerminal(sessionId, id)
-    if (owned) return this.readOwnTerminal(owned, Number.isFinite(params?.offset) ? params.offset : 0, clampInt(params?.count, 20, 400, 120))
+    if (owned) return this.slimTerminal(key, this.readOwnTerminal(owned, Number.isFinite(params?.offset) ? params.offset : 0, clampInt(params?.count, 20, 400, 120)))
     const agent = await this.resolveLiveAgent(sessionId)
     const registry = this.presetTerminals(agent)
     if (!registry) throw fail('unavailable', 'terminal service unavailable for this agent')
@@ -998,13 +1001,36 @@ export class MobileBridge {
       offset: Number.isFinite(params?.offset) ? params.offset : 0,
       count: clampInt(params?.count, 20, 400, 120),
     })
-    return {
+    return this.slimTerminal(key, {
       text: result?.text ?? '',
       totalLines: result?.totalLines ?? 0,
       lineBegin: result?.lineBegin ?? 0,
       lineEnd: result?.lineEnd ?? 0,
       truncated: result?.truncated === true,
-    }
+    })
+  }
+
+  /**
+   * Send only what the phone has not seen yet.
+   *
+   * The panel polls once a second, and re-sending the last 300 lines every time
+   * is what made an open terminal the most expensive thing on the relay. The
+   * read above stays as wide as before (it is a local read), but the wire now
+   * carries just the new lines; when nothing changed the reply is an empty
+   * string. `appended` tells the page whether to append or replace, and a jumped
+   * `lineBegin` (ring buffer overflow) forces a replace so no gap is hidden.
+   */
+  slimTerminal(key, fresh) {
+    const previous = this.terminalCursors.get(key)
+    this.terminalCursors.set(key, fresh.lineEnd)
+    if (!previous || fresh.lineBegin > previous) {
+      return { ...fresh, appended: false }
+    }
+    const skip = Math.max(0, previous - fresh.lineBegin)
+    if (!fresh.text) return { ...fresh, text: '', appended: true }
+    const lines = fresh.text.split('\n')
+    if (skip >= lines.length) return { ...fresh, text: '', appended: true }
+    return { ...fresh, text: lines.slice(skip).join('\n'), appended: true }
   }
 
   async terminalSend(params) {

package/src/panel.js

@@ -89,9 +89,17 @@ export async function registerPanel(ctx, service) {
     kind: 'exact',
     path: '/relay-bridge/panel',
     handler: async (req, res) => {
-      // Same ticket policy as /relay-bridge/api: relayed requests already
-      // carry a ticket; a local page load mints one so its write actions
-      // authenticate.
+      // Desktop-only. This page hands out the pairing entry URL, which embeds
+      // the device PSK (`#k=`); a relayed request is a phone, and a phone that
+      // could read it would be able to pair unlimited extra devices. The pump
+      // marks relayed requests, so this cannot be forged by the client.
+      if (req.headers['x-dsh-relay']) {
+        res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })
+        res.end('dsh-relay: the management panel is desktop-only. Open it on 127.0.0.1.\n')
+        return
+      }
+      // Same ticket policy as /relay-bridge/api: a local page load mints one so
+      // its write actions authenticate.
       if (!service.pairing.sessionForHeaders(req.headers)) {
         if (!isLoopback(req.socket?.remoteAddress ?? '')) {
           res.writeHead(401, { 'content-type': 'text/plain; charset=utf-8' })
@@ -117,6 +125,13 @@ export async function registerPanel(ctx, service) {
         res.end(JSON.stringify(value))
       }
 
+      // Desktop-only, for the same reason as the page: the snapshot contains
+      // the pairing URL with the device PSK, and the relay key can be changed
+      // from here.
+      if (req.headers['x-dsh-relay']) {
+        return reply(403, { ok: false, error: 'desktop-only' })
+      }
+
       // Pairing-ticket gate. Requests arriving through the relay already
       // carry a valid ticket (the pump refuses ticketless traffic), so this
       // check only ever fires for DIRECT local access — the local user's own

package/src/pump.js

@@ -365,6 +365,17 @@ export class PumpManager {
       return
     }
 
+    // The plugin's own console is a desktop tool: it prints the pairing URL
+    // (which carries the device PSK) and can change the relay key. A phone that
+    // reached it would be able to pair unlimited extra devices, so relayed
+    // requests never see it, ticketed or not.
+    if (stream.relay && info.path.startsWith('/relay-bridge/')) {
+      auditLog(`relayed request to the management panel blocked: ${info.path}`)
+      this.respondInline(sid, 403, 'Forbidden', 'dsh-relay-phone: the management panel is desktop-only\n')
+      this.closeStream(sid)
+      return
+    }
+
     if (!session) {
       auditLog(`unauthenticated ${info.method} ${info.path} -> pairing page`)
       this.respond(sid, 200, 'text/html; charset=utf-8',
@@ -530,10 +541,12 @@ export class PumpManager {
       if (lower.startsWith('connection:')) continue
       if (lower.startsWith('accept-encoding:')) continue
       if (lower.startsWith('x-relay-enc:') || lower.startsWith('x-relay-ct:')) continue
+      if (lower.startsWith('x-dsh-relay:')) continue // the pump sets its own
       headers.push(line)
     }
     headers.unshift(`Host: ${target.authority}`)
     headers.unshift(`Origin: ${target.origin}`)
+    headers.push('x-dsh-relay: 1')
     if (authCookie) headers.push(`Cookie: ${authCookie}`)
     headers.push(`Content-Type: ${info.headers.get('x-relay-ct') ?? 'text/plain;charset=UTF-8'}`)
     headers.push(`Content-Length: ${plain.length}`)
@@ -603,6 +616,8 @@ export class PumpManager {
         hasHost = true
       } else if (/^origin:/i.test(line)) {
         rewritten.push(`Origin: ${target.origin}`)
+      } else if (/^x-dsh-relay:/i.test(line)) {
+        // Dropped: the pump adds its own marker below.
       } else if (/^cookie:/i.test(line)) {
         // The phone's relay ticket authenticates it to the pump, not to DSH;
         // upstream speaks the browser-session credential instead.
@@ -621,6 +636,10 @@ export class PumpManager {
     }
     if (!hasHost) rewritten.unshift(`Host: ${target.authority}`)
     if (!isUpgrade && !hasConnection) rewritten.push('Connection: close')
+    // Mark the request as relayed. The plugin's own console uses this to refuse
+    // phone-side access: it hands out pairing links, which embed the device PSK.
+    // Any inbound copy was dropped in the loop above, so a client cannot forge it.
+    rewritten.push('x-dsh-relay: 1')
     if (authCookie) rewritten.push(`Cookie: ${authCookie}`)
     const out = `${lines[0]}\r\n${rewritten.join('\r\n')}\r\n\r\n`
 

package/src/relay-client.js

@@ -12,6 +12,16 @@ import { auditLog } from './identity.js'
 const CONNECT_TIMEOUT = 15000
 const HEARTBEAT_INTERVAL = 20000
 
+// Reasons a multi-tenant relay can reject a registration, in words the panel
+// and the phone can show without translation.
+const REJECT_TEXT = {
+  'quota-exceeded': '今日流量已用完，明天 0 点恢复',
+  'key-disabled': '这个 relay 密钥已被停用',
+  'unknown-key': 'relay 不认识这个密钥（可能已失效）',
+  'replaced': '同样的密钥在另一处接入，这一条被中继断开',
+  'bad key proof': '密钥不正确',
+}
+
 export class RelayClient extends EventTarget {
   constructor(options) {
     super()
@@ -140,7 +150,15 @@ export class RelayClient extends EventTarget {
       }, HEARTBEAT_INTERVAL)
       ws.on('pong', () => { this.pongMisses = 0 })
 
-      ws.send(JSON.stringify({ t: 'hello', v: 1, id: this.identity.id, gate: this.identity.gate }))
+      // keyId lets a multi-tenant relay find the tenant without being told the
+      // key: it is the same hash both sides derive, so nothing new to configure.
+      ws.send(JSON.stringify({
+        t: 'hello',
+        v: 1,
+        id: this.identity.id,
+        gate: this.identity.gate,
+        keyId: crypto.createHash('sha256').update(String(this.relayKey)).digest('hex').slice(0, 12),
+      }))
     })
 
     ws.on('message', (data, isBinary) => {
@@ -155,11 +173,18 @@ export class RelayClient extends EventTarget {
         }
         if (msg.t === 'registered') {
           this.backoff = 1000
+          this.backoffCap = 30000
           this.emitStatus('connected', url)
           return
         }
         if (msg.t === 'rejected') {
-          this.emitStatus('rejected', msg.reason ?? 'rejected by relay')
+          const reason = String(msg.reason ?? 'rejected by relay')
+          this.emitStatus('rejected', REJECT_TEXT[reason] ?? reason)
+          // Retrying fast cannot fix these: back off hard so a suspended or
+          // exhausted key does not hammer the relay all day.
+          if (reason === 'quota-exceeded') this.slowDown(5 * 60 * 1000)
+          else if (reason === 'key-disabled' || reason === 'unknown-key') this.slowDown(15 * 60 * 1000)
+          else if (reason === 'replaced') this.slowDown(60 * 1000)
           return
         }
         if (msg.t === 'close' && typeof msg.sid === 'number') {
@@ -184,11 +209,18 @@ export class RelayClient extends EventTarget {
   scheduleReconnect(detail) {
     if (this.stopped) return
     this.emitStatus('reconnecting', detail)
-    const delay = Math.min(30000, this.backoff) * (0.75 + Math.random() * 0.5)
-    this.backoff = Math.min(30000, this.backoff * 2)
+    const cap = this.backoffCap ?? 30000
+    const delay = Math.min(cap, this.backoff) * (0.75 + Math.random() * 0.5)
+    this.backoff = Math.min(cap, this.backoff * 2)
     this.reconnectTimer = setTimeout(() => this.connect(), delay)
   }
 
+  /** Widen the retry window after a rejection that retrying cannot fix. */
+  slowDown(delayMs) {
+    this.backoffCap = delayMs
+    this.backoff = Math.max(this.backoff, delayMs)
+  }
+
   // -- data -----------------------------------------------------------------
   sendStream(sid, chunk) {
     if (!this.connected()) return false