dsh-remote-control-plugin 0.3.0 → 0.3.2

package/INSTALL.md

@@ -5,17 +5,17 @@ build step, no postinstall script.
 
 ## 1. Install it
 
-Open DSH on the other desktop, start a session, and send:
+In the Web GUI: **Plugins → Add plugin**, enter `dsh-remote-control-plugin@0.3.2`, keep the
+official npm registry selected, then **Install** and **Enable now**. Restart DSH.
 
-> Install the DSH plugin bundle `dsh-remote-control-plugin@0.3.0` with plugin_manager, then tell me when it is applied.
+A **Devices** icon appears in the sidebar.
 
-Then restart DSH. A **Devices** icon appears in the sidebar.
+From a chat, the same install works where the plugin tool is enabled (Standard or Creator
+preset — PTC disables `tool-plugin-manager`):
 
-`dsh plugin add` does not work for this: it forwards to `pnpm`, which is not on `PATH` outside
-the app. The agent route uses the bundled pnpm and also registers the bundle in the profile,
-which a bare `pnpm add` would not do.
+> Install the DSH plugin bundle `dsh-remote-control-plugin@0.3.2` with plugin_manager, then tell me when it is applied.
 
-## 2. Connect the two machines
+## 2. Connect two machines
 
 Pick the machine with a reachable address (same LAN, VPN, or a forwarded port):
 
@@ -23,6 +23,8 @@ Pick the machine with a reachable address (same LAN, VPN, or a forwarded port):
 2. On the other machine: **Devices → Relay**, paste the invite into the URL field, **Connect**.
 3. Either machine: **Request** next to the peer, then **Allow** on the target.
 
+Two machines on the same LAN need no relay at all — LAN discovery lists them directly.
+
 No reachable machine? Run a relay anywhere both can reach (`PORT=8787 node relay/server.js`) and
 paste `http://<host>:8787 <workspace key>` into both panels.
 
@@ -31,5 +33,7 @@ paste `http://<host>:8787 <workspace key>` into both panels.
 - The account label is cosmetic; trust comes from the one-time **Allow** on the target device.
 - Approvals persist in `$DSH_HOME/remote-control-peers.json`; deleting it revokes every peer.
 - The relay and the control API share one port (default `57330`), so one forwarded port is enough.
-- Device trusts are per install: the published plugin and a locally built copy share the protocol
-  but keep separate approval stores.
+- Peer traffic is signed but not encrypted. Use a private network or TLS in front of the port.
+- 0.3.2 fixes three relay bugs: a hosted relay now survives a restart, peers no
+  longer linger as `503 relay-offline` after a relay goes away, and a blocked
+  direct LAN route falls back to the outbound relay instead of failing.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 hkrds1996
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/host/fabric.js

@@ -122,7 +122,9 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
    */
   function syncRelayPeers() {
     if (!relay) return
+    const present = new Set()
     for (const item of relay.peers()) {
+      present.add(item.deviceId)
       const existing = peers.get(item.deviceId)
       if (existing && existing.proto !== 'relay') continue
       peers.set(item.deviceId, {
@@ -137,6 +139,11 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
         secret: approvals.get(item.deviceId)?.secret ?? existing?.secret,
       })
     }
+    // Drop relay peers the relay no longer lists, so a device that leaves or a
+    // relay that goes away cannot leave a peer that always answers 503.
+    for (const [deviceId, peer] of peers) {
+      if (peer.proto === 'relay' && !present.has(deviceId)) peers.delete(deviceId)
+    }
   }
 
   async function loadApprovals() {
@@ -367,8 +374,17 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
    */
   async function peerCall(peer, method, pathname, body, secret) {
     if (peer.proto !== 'relay') {
-      return callRaw(peer, method, pathname, body, secret, self().deviceId)
+      const direct = await callRaw(peer, method, pathname, body, secret, self().deviceId)
+      // A direct LAN route can be silently blocked (firewall profile, VPN
+      // change). The relay is outbound-only, so fall back instead of failing.
+      if (!direct.error || !relay) return direct
+      const viaRelay = await relayCall(peer, method, pathname, body, secret)
+      return viaRelay.ok || viaRelay.status !== 503 ? viaRelay : direct
     }
+    return relayCall(peer, method, pathname, body, secret)
+  }
+
+  async function relayCall(peer, method, pathname, body, secret) {
     if (!relay) return { ok: false, status: 503, json: { error: 'relay-offline' } }
     const callerId = self().deviceId
     const timestamp = String(Date.now())
@@ -432,17 +448,18 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
       }, res)
       return
     }
+    const streamHeaders = {
+      accept: 'text/event-stream',
+      'x-dsh-peer-id': callerId,
+      'x-dsh-peer-ts': timestamp,
+      'x-dsh-peer-sig': sign(approval.secret, callerId, 'GET', target, timestamp, ''),
+    }
     const upstream = http.request({
       host: peer.address,
       port: peer.port,
       path: target,
       method: 'GET',
-      headers: {
-        accept: 'text/event-stream',
-        'x-dsh-peer-id': callerId,
-        'x-dsh-peer-ts': timestamp,
-        'x-dsh-peer-sig': sign(approval.secret, callerId, 'GET', target, timestamp, ''),
-      },
+      headers: streamHeaders,
     }, (response) => {
       res.writeHead(response.statusCode ?? 502, {
         'content-type': response.headers['content-type'] || 'text/event-stream; charset=utf-8',
@@ -454,6 +471,12 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
       response.on('end', () => { try { res.end() } catch { /* ignore */ } })
     })
     upstream.on('error', () => {
+      // Same fallback as peerCall: a blocked LAN route may still reach the
+      // peer through the outbound relay.
+      if (relay && !res.headersSent) {
+        relay.stream(peer.deviceId, { path: target, headers: streamHeaders }, res)
+        return
+      }
       try { json(res, 502, { error: 'peer-unreachable' }) } catch { /* ignore */ }
     })
     res.on('close', () => { try { upstream.destroy() } catch { /* ignore */ } })
@@ -469,7 +492,17 @@ export function createFabric({ log, config, self, sessions, stateFile }) {
     callPeer,
     proxyStream,
     handlePeer,
-    setRelay(link) { relay = link },
+    setRelay(link) {
+      relay = link
+      if (!link) {
+        // Without a relay every relay-only peer is unreachable; keeping it
+        // would make each call fail with a misleading 503.
+        for (const [deviceId, peer] of peers) {
+          if (peer.proto === 'relay') peers.delete(deviceId)
+        }
+      }
+    },
+
     snapshot() {
       syncRelayPeers()
       const who = self()

package/index.js

@@ -157,7 +157,12 @@ export function apply(ctx, rawConfig) {
   async function loadRelayConfig() {
     try {
       const raw = JSON.parse(await readFile(relayFile, 'utf8'))
-      if (raw && typeof raw.url === 'string' && typeof raw.key === 'string') return { url: raw.url, key: raw.key }
+      if (raw && typeof raw.url === 'string' && typeof raw.key === 'string') {
+        // `hosted` decides whether boot remounts the relay before connecting.
+        // Dropping it made every restart fall into the join branch, which then
+        // pointed at an unmounted /v1/* and left the relay dead.
+        return { hosted: raw.hosted === true, url: raw.url, key: raw.key }
+      }
     } catch (error) {
       if (error?.code !== 'ENOENT') log.warn(`[remote-control] could not read ${relayFile}: ${error?.message || error}`)
     }
@@ -177,7 +182,6 @@ export function apply(ctx, rawConfig) {
   }
 
   async function startRelay(url, key) {
-    stopRelay()
     const link = createRelayLink({
       url,
       key,
@@ -187,7 +191,9 @@ export function apply(ctx, rawConfig) {
       localPort: info.port,
       log,
     })
+    // Connect first: a failed join must not tear down a working relay link.
     await link.start()
+    stopRelay()
     relayLink = link
     fabric.setRelay(link)
     log.info(`[remote-control] relay connected: ${url}`)
@@ -316,11 +322,11 @@ export function apply(ctx, rawConfig) {
         return json(res, 400, { error: 'bad-key', message: 'Workspace key must be at least 16 characters.' })
       }
       try {
-        stopHostedRelay()
         await startRelay(url, key)
       } catch (error) {
         return json(res, 502, { error: 'relay-unreachable', message: String(error?.message || error) })
       }
+      stopHostedRelay()
       await saveRelayConfig({ hosted: false, url, key })
       return json(res, 200, { ok: true })
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-control-plugin",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Remote control for DSH: a Devices panel that discovers other DSH desktops, pairs with them once, and drives their sessions across LAN or a relay.",
   "license": "MIT",
   "type": "module",
@@ -27,6 +27,7 @@
     "icon.svg",
     "README.md",
     "INSTALL.md",
+    "LICENSE",
     "web/index.html",
     "web/app.js",
     "web/app.css",