dsh-remote-hub 0.2.1 → 0.3.0

package/README.md

@@ -19,9 +19,9 @@ Kotlin/Compose 直连 DSH 自带的 HTTP API + WebSocket 网关。
 
 ## 下载手机端 App
 
-**DSH Remote v4.19.1** · Android 8.0 (API 26) 及以上 · 2.8 MB
+**DSH Remote v4.20.1** · Android 8.0 (API 26) 及以上 · 2.8 MB
 
-[⬇️ 下载 APK](https://github.com/liaoguogang-hub/dsh-remote-public/releases/download/v4.19.1/DSH-Remote-v4.19.1.apk) ·
+[⬇️ 下载 APK](https://github.com/liaoguogang-hub/dsh-remote-public/releases/download/v4.20.1/DSH-Remote-v4.20.1.apk) ·
 [全部版本](https://github.com/liaoguogang-hub/dsh-remote-public/releases)
 
 安装后应用名「DSH Remote」，包名 `com.dsh.remote.ngrok`（可与作者的 `DSH` 自用版共存）。
@@ -222,6 +222,19 @@ dsh-remote start      # 不开 DSH 也能单独前台跑（Ctrl+C 退出）
 > 公网隧道受网络影响：`api.trycloudflare.com` 不可达时插件会跳过公网、只给局域网地址，
 > 并在 `status.json` 里写明原因，不会假装成功。
 
+### 装完之后
+
+插件随 DSH 启动自动工作，**不需要手动跑 connect.cmd**；装的时候没有提示是正常的，日志里会出现：
+
+```
+dsh-remote: ready — 手机端扫码：dsh-remote qr（或浏览器打开 http://127.0.0.1:<端口>/_dsh-remote/pair）
+```
+
+想手动确认/手动起，就在仓库目录双击 `connect.cmd`（它和插件是同一份代码，会打印地址与 Cookie 并自动打开二维码）。
+
+**Cookie 跨重启有效**：桥接始终向 DSH 呈现固定 authority（默认 `127.0.0.1:1815`），
+所以 DSH 换端口、桥接重启都不会让手机上的凭据失效；只有签名密钥变化或 Cookie 到期（30 天）才需要重新扫码。
+
 ### 扫码配对（一次性配对码）
 
 不想手抄 Cookie 就用二维码：
@@ -233,7 +246,7 @@ dsh-remote qr
 浏览器会打开 `http://127.0.0.1:6300/_dsh-remote/pair`，显示一个二维码。手机 DSH Remote 里点
 「扫码配对」，扫完自动填入地址并换取登录凭据，直接连上。
 
-扫码后会自动判断：返回的是私有地址就填进「局域网」，公网地址填进「自定义」。
+扫码一次会同时写入「局域网」和「ngrok」两档地址；连接时优先局域网（同 WiFi 最快），局域网不通才走 ngrok。扫码后即保存，之后不用再扫。
 
 安全设计：
 - 二维码里**不含 Cookie**，只含一个 **10 分钟有效的一次性配对码**（`{"v":1,"u":"<地址>","c":"<配对码>","e":<过期时间>}`）；

package/bin/dsh-remote.mjs

@@ -136,6 +136,11 @@ async function main() {
   switch (command) {
     case 'status':
       printStatus()
+      if (!readStatus()) {
+        console.log('  下一步：dsh-remote start --open  （起桥接并打开配对二维码）')
+        console.log('         或双击仓库里的 connect.cmd')
+        console.log('')
+      }
       break
     case 'connect':
       if (fs.existsSync(CONNECT_FILE)) console.log(fs.readFileSync(CONNECT_FILE, 'utf8'))

package/lib/bridge.js

@@ -149,6 +149,21 @@ export function startBridge({ listenPort, authority, upstream, pairing = null, l
     })
 
   const server = http.createServer((req, res) => {
+    // Health probe: lets the CLI and a second instance tell "my bridge is already running"
+    // apart from "some other program holds the port".
+    if (String(req.url || '') === '/_dsh-remote/health') {
+      const body = JSON.stringify({
+        ok: true,
+        service: 'dsh-remote-bridge',
+        bridgePort: listenPort,
+        authority,
+        upstreamPort: upstream.port || null,
+      })
+      res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+      res.end(body)
+      return
+    }
+
     // Pairing is served by the bridge itself: it must work before the phone has any credential,
     // and it must NOT be proxied to DSH.
     if (pairing && String(req.url || '').startsWith('/_dsh-remote/pair')) {

package/lib/discover.js

@@ -2,13 +2,13 @@
  * Find the DSH host's HTTP port.
  *
  * The desktop host listens on a **different port every restart** (observed 1815, 5894, 14299,
- * 8312, 12077), so the port cannot be configured once and forgotten. It also shares the machine
- * with the inspector and other loopback services, so "the port is listening" is not enough —
- * only the real web server answers our authenticated RPC.
+ * 8312, 12077), so the port cannot be configured once and forgotten.
  *
- * Strategy: enumerate local listening ports, then probe each with the signed cookie and the
- * authority the bridge presents. First 200 wins. Results are cached with a TTL so a host restart
- * is picked up on the next failure instead of pinning a dead port forever.
+ * Detection is a fingerprint, not a status code: a **cookieless** `GET /` addressed with the port
+ * as Host answers `401 dsh web authentication required`. That sentence is DSH's own trust fence,
+ * and no other local service produces it. A plain 200 is worthless here — plenty of tools answer
+ * 200 to anything (a real false-positive source on other machines), and an authenticated probe
+ * cannot run before the credential exists.
  *
  * @module lib/discover
  */
@@ -17,13 +17,14 @@ import http from 'node:http'
 import { execFile } from 'node:child_process'
 
 const PROBE_TIMEOUT_MS = 1500
-const PROBE_PATH = '/api/session/list'
-const PROBE_BODY = JSON.stringify({
-  type: 'client-request',
-  rpcId: 'probe',
-  method: 'session/list',
-  payload: { args: { _request: {} } },
-})
+const NEWLINE = String.fromCharCode(10)
+const CARRIAGE = String.fromCharCode(13)
+
+function splitLines(text) {
+  return String(text)
+    .split(NEWLINE)
+    .map((line) => line.split(CARRIAGE).join(''))
+}
 
 function run(cmd, args, timeout = 8000) {
   return new Promise((resolve) => {
@@ -38,7 +39,7 @@ export async function listeningPorts() {
   const ports = new Set()
   if (process.platform === 'win32') {
     const out = await run('netstat', ['-ano', '-p', 'tcp'])
-    for (const line of out.split(/\r?\n/)) {
+    for (const line of splitLines(out)) {
       const m = /^\s*TCP\s+(\S+):(\d+)\s+\S+\s+LISTENING\s+(\d+)/i.exec(line)
       if (!m) continue
       const addr = m[1]
@@ -49,17 +50,16 @@ export async function listeningPorts() {
     }
     return [...ports]
   }
-  // macOS / Linux
   const ss = await run('ss', ['-ltn'])
   if (ss) {
-    for (const line of ss.split(/\r?\n/)) {
+    for (const line of splitLines(ss)) {
       const m = /\s(?:\S*):(\d+)\s/.exec(` ${line} `)
       if (m) ports.add(Number(m[1]))
     }
   }
   if (ports.size === 0) {
     const lsof = await run('lsof', ['-nP', '-iTCP', '-sTCP:LISTEN'])
-    for (const line of lsof.split(/\r?\n/)) {
+    for (const line of splitLines(lsof)) {
       const m = /:(\d+)\s+\(LISTEN\)/.exec(line)
       if (m) ports.add(Number(m[1]))
     }
@@ -67,29 +67,36 @@ export async function listeningPorts() {
   return [...ports].filter((p) => Number.isInteger(p) && p > 0)
 }
 
-/** Does `port` answer the authenticated DSH RPC? */
-export function probePort(port, { authority, cookie }) {
+/**
+ * Is `port` the DSH web server?
+ *
+ * Resolves true only for `401` + `dsh web authentication required`, and false for anything that
+ * carries our own bridge tag (a bridge would forward the same response).
+ */
+export function probePort(port) {
   return new Promise((resolve) => {
     const req = http.request(
       {
         host: '127.0.0.1',
         port,
-        path: PROBE_PATH,
-        method: 'POST',
+        path: '/',
+        method: 'GET',
         timeout: PROBE_TIMEOUT_MS,
-        headers: {
-          'content-type': 'application/json',
-          'content-length': Buffer.byteLength(PROBE_BODY),
-          host: authority,
-          cookie,
-        },
+        headers: { host: `127.0.0.1:${port}` },
       },
       (res) => {
-        // Another dsh-remote bridge also answers our RPC (it forwards to the real host); treating
-        // it as upstream would chain bridges, so tagged responses are rejected.
         const isBridge = res.headers['x-dsh-remote-bridge'] === '1'
-        res.resume()
-        resolve(res.statusCode === 200 && !isBridge)
+        const chunks = []
+        let seen = 0
+        res.on('data', (chunk) => {
+          if (seen < 8192) chunks.push(chunk)
+          seen += chunk.length
+        })
+        res.on('end', () => {
+          if (isBridge) return resolve(false)
+          const head = Buffer.concat(chunks).toString('utf8')
+          resolve(res.statusCode === 401 && /dsh web authentication required/i.test(head))
+        })
       },
     )
     req.on('error', () => resolve(false))
@@ -97,7 +104,6 @@ export function probePort(port, { authority, cookie }) {
       req.destroy()
       resolve(false)
     })
-    req.write(PROBE_BODY)
     req.end()
   })
 }
@@ -105,39 +111,28 @@ export function probePort(port, { authority, cookie }) {
 /**
  * A resolver that remembers the last known-good port.
  *
- * @param {object} options
- * @param {string} options.authority
- * @param {() => Promise<string>|string} options.cookie  current cookie (may be re-minted)
- * @param {number} [options.pinned=0]                    skip discovery when > 0
+ * @param {object} [options]
+ * @param {number} [options.pinned=0]  skip discovery entirely when > 0
  * @param {number} [options.ttlMs=30000]
+ * @param {number[]} [options.exclude=[]]  ports that must never be treated as upstream (our bridge)
  */
-export function createDiscovery({ authority, cookie, pinned = 0, ttlMs = 30_000, exclude = [] }) {
+export function createDiscovery({ pinned = 0, ttlMs = 30_000, exclude = [] } = {}) {
   let port = pinned || 0
   let resolvedAt = 0
   let inFlight = null
 
-  async function resolveCookie() {
-    try {
-      return await cookie()
-    } catch {
-      return ''
-    }
-  }
-
   async function resolve(force = false) {
     if (pinned) return pinned
     if (!force && port && Date.now() - resolvedAt < ttlMs) return port
     if (inFlight) return inFlight
     inFlight = (async () => {
-      const ck = await resolveCookie()
-      if (!ck) return port
       const skip = new Set(exclude.filter((p) => Number.isInteger(p) && p > 0))
       const ports = (await listeningPorts()).filter((p) => !skip.has(p))
       // Probe the remembered port first: it is usually still right and saves a full sweep.
       const ordered = port && ports.includes(port) ? [port, ...ports.filter((p) => p !== port)] : ports
       for (const candidate of ordered) {
         // eslint-disable-next-line no-await-in-loop
-        if (await probePort(candidate, { authority, cookie: ck })) {
+        if (await probePort(candidate)) {
           port = candidate
           resolvedAt = Date.now()
           return port

package/lib/index.js

@@ -16,7 +16,7 @@ import { start } from './supervisor.js'
 
 export const name = 'dsh-remote-hub'
 
-export const version = '0.2.1'
+export const version = '0.3.0'
 
 /** No host services are required: the plugin only needs Node builtins. */
 export const inject = []
@@ -52,6 +52,14 @@ export function apply(ctx, config = {}) {
   start({ ...config, log })
     .then((started) => {
       handle = started
+      if (started?.status?.bridgePort) {
+        // Make the next step discoverable from the log: after installing the plugin there is no
+        // other place telling the user how to get the phone connected.
+        log(
+          `dsh-remote: ready — 手机端扫码：dsh-remote qr（或浏览器打开 http://127.0.0.1:${started.status.bridgePort}/_dsh-remote/pair）；` +
+            '不想装插件时也可以直接双击仓库里的 connect.cmd',
+        )
+      }
       if (closed) return handle.close()
       return undefined
     })

package/lib/pairing-routes.js

@@ -15,9 +15,15 @@ import QRCode from 'qrcode'
 
 export const PAIR_PREFIX = '/_dsh-remote/pair'
 
-/** Build the payload the phone parses. `u` is the URL the phone should talk to. */
-export function buildPairPayload({ url, code, expiresAt }) {
-  return JSON.stringify({ v: 1, u: url, c: code, e: expiresAt })
+/**
+ * Build the payload the phone parses.
+ *
+ * Both addresses are shipped together so one scan can fill both tabs and the phone can pick the
+ * fastest one at connect time: `l` = LAN (private address), `u` = public tunnel. Either may be null
+ * when that transport is unavailable that moment.
+ */
+export function buildPairPayload({ lan, publicUrl, code, expiresAt }) {
+  return JSON.stringify({ v: 1, l: lan ?? null, u: publicUrl ?? null, c: code, e: expiresAt })
 }
 
 /**
@@ -67,7 +73,10 @@ export async function handlePairing({ req, res, current, store }) {
     res.end(
       JSON.stringify({
         ok: true,
-        url: snapshot.url,
+        // `url` keeps the old single-address shape working; new clients read lan/public.
+        url: snapshot.public ?? snapshot.lan ?? null,
+        lan: snapshot.lan ?? null,
+        public: snapshot.public ?? null,
         cookie: result.cookie,
         issuedAt: result.issuedAt,
       }),
@@ -77,7 +86,7 @@ export async function handlePairing({ req, res, current, store }) {
 
   // Any other GET under the prefix hands out a fresh code.
   const { code, expiresAt, ttlMs } = store.issue(snapshot.cookie)
-  const payload = buildPairPayload({ url: snapshot.url, code, expiresAt })
+  const payload = buildPairPayload({ lan: snapshot.lan, publicUrl: snapshot.public, code, expiresAt })
 
   if (url === PAIR_PREFIX + '/svg') {
     const svg = await QRCode.toString(payload, { type: 'svg', margin: 1, width: 320, errorCorrectionLevel: 'M' })
@@ -110,8 +119,8 @@ export async function handlePairing({ req, res, current, store }) {
   <p>配对码 <code>${code}</code> · ${minutes} 分钟内有效，且只能用一次</p>
   <div class="qr">${svg}</div>
   <p class="ok">扫码后自动填入地址并换取登录凭据</p>
-  <p class="addr">本页地址：<br>${snapshot.url}</p>
-  <p class="addr">手输备用：打开 App → 设置 → 扫码配对 → 输入配对码</p>
+  <p class="addr">${snapshot.lan ? `局域网：${snapshot.lan}<br>` : ''}${snapshot.public ? `公网：${snapshot.public}` : ''}</p>
+  <p class="addr">扫一次会同时存下局域网与公网地址，之后自动优先走局域网</p>
 </div></body></html>`
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })
   res.end(html)

package/lib/supervisor.js

@@ -107,7 +107,7 @@ function writeStatus(status) {
  * @param {object} config
  * @param {boolean} [config.enabled=true]
  * @param {number} [config.port=6300]
- * @param {string} [config.authority='127.0.0.1:1815']
+ * @param {string} [config.authority='127.0.0.1:1815']  fixed on purpose; 'auto' follows the host port
  * @param {'auto'|'off'|'ngrok'|'cloudflared'} [config.tunnel='auto']
  * @param {number} [config.upstreamPort=0]
  * @param {string} [config.domain='']
@@ -149,38 +149,78 @@ export async function start(config = {}) {
   }
 
   // The bridge listens on `port`; probing it would forward to itself, so it must be excluded
-  // from upstream discovery.
+  // from upstream discovery. Discovery never blocks startup: the bridge must come up even when the
+  // DSH web server has not bound its port yet (plugin loads early in host boot), otherwise the
+  // pairing page is unreachable and the failure looks like "the plugin did nothing".
   const discovery = createDiscovery({
-    authority,
-    cookie: () => cookie,
     pinned: Number(upstreamPort) || 0,
     exclude: [Number(port) || 6300],
   })
-  const initialPort = await discovery.resolve(true)
-  if (initialPort) log(`dsh-remote: upstream host on 127.0.0.1:${initialPort}`)
-  else log('dsh-remote: no upstream host found yet; the bridge will keep retrying')
+
+  const ipForPairing = lanAddress()
+  /** Public URL is filled in after the tunnel starts; pairing reads it lazily. */
+  let lastPublicUrl = null
+
+  /** The bridge may have fallen back to an ephemeral port; everything must report the real one. */
+  let bridgeInstance = null
+  const actualBridgePort = () => (bridgeInstance ? bridgeInstance.port : Number(port) || 6300)
 
   // Pairing: the QR carries a one-time code, not the cookie; redeeming burns it.
   const pairingStore = createPairingStore()
   const pairing = {
     store: pairingStore,
-    // `current()` is read at redeem time so a URL that appears later (tunnel is still coming up)
-    // is still handed to the phone.
-    current: () => ({ url: lastPublicUrl ?? (ipForPairing ? `http://${ipForPairing}:${Number(port) || 6300}` : ''), cookie }),
+    // Read at redeem time so a tunnel URL that appears later is still handed to the phone.
+    current: () => ({
+      lan: ipForPairing ? `http://${ipForPairing}:${actualBridgePort()}` : null,
+      public: lastPublicUrl ?? null,
+      cookie,
+    }),
   }
 
-  const ipForPairing = lanAddress()
-  /** Public URL is filled in after the tunnel starts; pairing reads it lazily. */
-  let lastPublicUrl = null
+  let bridge
+  try {
+    bridge = await startBridge({
+      listenPort: Number(port) || 6300,
+      authority,
+      upstream: discovery,
+      pairing,
+      log,
+    })
+  } catch (err) {
+    // The usual cause is an older bridge (or a watchdog) still holding the port. Falling back to
+    // an ephemeral port keeps the pairing page reachable; the real port is reported everywhere.
+    if (!/EADDRINUSE/.test(String(err?.message ?? err))) throw err
+    log(`dsh-remote: port ${port} is busy, falling back to an ephemeral port`)
+    bridge = await startBridge({
+      listenPort: 0,
+      authority,
+      upstream: discovery,
+      pairing,
+      log,
+    })
+  }
 
-  const bridge = await startBridge({
-    listenPort: Number(port) || 6300,
-    authority,
-    upstream: discovery,
-    pairing,
-    log,
-  })
+  // Wait for the host's web server in the background: plugin mode runs before DSH binds its port.
+  const waitDeadline = Date.now() + 120_000
+  const waitForHost = async () => {
+    let attempts = 0
+    while (Date.now() < waitDeadline) {
+      attempts += 1
+      // eslint-disable-next-line no-await-in-loop
+      const found = await discovery.resolve(true)
+      if (found) {
+        log(`dsh-remote: upstream host on 127.0.0.1:${found} (after ${attempts} probe(s))`)
+        return found
+      }
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise((r) => setTimeout(r, 1500))
+    }
+    log('dsh-remote: no DSH web server found after 2 minutes — is DSH running?')
+    return 0
+  }
+  const upstreamReady = waitForHost()
 
+  bridgeInstance = bridge
   const tunnel = await startTunnel({
     kind: tunnelKind,
     bridgePort: bridge.port,
@@ -193,6 +233,7 @@ export async function start(config = {}) {
   const ip = ipForPairing
   const status = {
     updatedAt: Date.now(),
+    phase: 'ready',
     bridgePort: bridge.port,
     authority,
     upstreamPort: discovery.port || null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-hub",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "DSH 插件：把电脑上的 DeepSeek Harness 变成手机可访问的服务——起桥接、自动开隧道（ngrok / cloudflared）、签发 30 天 Cookie，并输出地址与凭据，配合 DSH Remote Android App 使用。",
   "type": "module",
   "main": "lib/index.js",