dsh-remote-hub 0.3.2 → 0.3.4

package/README.md

@@ -267,6 +267,27 @@ curl http://127.0.0.1:<bridgePort>/_dsh-remote/health
 > 提示：`cordis.patch.yml` 里的 `port` 只是**首选**端口。若被占用，实际端口会写在 `~/.dsh/dsh-remote/status.json`，
 > 一切链接与二维码都以那里为准，不必手改配置。
 
+### 用自己的服务器做中转（阿里云等自建 relay）
+
+如果你不用 ngrok，而是用一台云服务器（Caddy/nginx 终止 TLS + SSH 反向隧道）把本机暴露出去，
+就让插件把这个地址写进二维码，否则扫码只会得到 ngrok/cloudflared 的地址：
+
+```bash
+# 方式一：临时环境变量
+export DSH_REMOTE_PUBLIC_URL="https://your-relay.example"     # Windows: $env:DSH_REMOTE_PUBLIC_URL="https://..."
+dsh-remote start --open
+
+# 方式二：写进 profile 配置（推荐，长期有效）
+# ~/.dsh/profiles/<name>/cordis.patch.yml 的 dsh-remote 行：
+#   publicUrl: 'https://your-relay.example'
+```
+
+配置后插件不再启动 ngrok/cloudflared，并把该地址作为「公网地址」放进配对载荷；
+启动时会探测 `<publicUrl>/_dsh-remote/health`，结果记在 `status.json` 的 `public.reachable`
+（中转在、但反向隧道断了 → `false` 并打印警告）。
+
+前提：服务器侧确实把请求转发到**桥接监听的端口**（默认 6300）。
+
 ### 扫码配对（一次性配对码）
 
 不想手抄 Cookie 就用二维码：

package/bin/dsh-remote.mjs

@@ -5,7 +5,7 @@
  *   dsh-remote status      show LAN URL, public URL, cookie and upstream port
  *   dsh-remote connect     print the two lines to paste into the phone
  *   dsh-remote cookie      print only the cookie
- *   dsh-remote start [--open]  run the supervisor in the foreground; --open 打印地址并打开配对页
+ *   dsh-remote start [--open] [--public-url=URL]  run the supervisor; --open 打印地址并打开配对页
  *   dsh-remote stop        ask a foreground `start` to stop (best effort, via status file)
  *   dsh-remote doctor      check every prerequisite in one pass
  *   dsh-remote qr          open the pairing page (QR) in the default browser
@@ -62,6 +62,21 @@ function printStatus() {
   console.log('')
 }
 
+/** Describe the process listening on a port (Windows only, best effort). */
+function describePortOwner(port) {
+  if (process.platform !== 'win32') return Promise.resolve(null)
+  const script =
+    `$c = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1;` +
+    'if ($c) { $p = Get-CimInstance Win32_Process -Filter (\"ProcessId=$($c.OwningProcess)\");' +
+    ' "PID $($c.OwningProcess): $($p.CommandLine)" }'
+  return new Promise((resolve) => {
+    execFile('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { timeout: 8000, windowsHide: true }, (err, stdout) => {
+      const out = String(stdout || '').trim()
+      resolve(err || !out ? null : out.slice(0, 180))
+    })
+  })
+}
+
 function openBrowser(url) {
   const cmd = process.platform === 'win32' ? 'cmd' : process.platform === 'darwin' ? 'open' : 'xdg-open'
   const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
@@ -188,6 +203,29 @@ async function doctor() {
   }
   console.log('  ' + '-'.repeat(52))
   console.log('')
+  // Who owns the bridge port right now, and what public URL is advertised.
+  const bridgePort = Number(process.env.DSH_REMOTE_PORT || 6300)
+  const health = await bridgeHealthy(bridgePort)
+  if (health) {
+    console.log(`  ✔ 桥接端口        ${bridgePort}（本插件，pairing=${health.pairing}）`)
+  } else {
+    console.log(`  · 桥接端口        ${bridgePort} 上没有本插件在跑`)
+    const owner = await describePortOwner(bridgePort)
+    if (owner) console.log(`     被其它进程占用:   ${owner}`)
+  }
+  const st = readStatus()
+  const pub = st?.public
+  if (pub?.url) {
+    const tag = pub.kind === 'relay' ? '自建中转' : pub.kind
+    console.log(`  ▲ 公网地址        ${pub.url}（${tag}${pub.reachable === false ? '，当前不可达' : ''}）`)
+    if (pub.kind !== 'relay' && process.env.DSH_REMOTE_PUBLIC_URL) {
+      console.log('     （已设置 DSH_REMOTE_PUBLIC_URL，但当前桥接未采用：需要重启桥接）')
+    }
+  } else if (process.env.DSH_REMOTE_PUBLIC_URL) {
+    console.log(`  · 公网地址        未生效（要重启桥接才会用 ${process.env.DSH_REMOTE_PUBLIC_URL}）`)
+  } else {
+    console.log('  · 公网地址        未配置（如需自建中转，设置 DSH_REMOTE_PUBLIC_URL）')
+  }
 }
 
 async function main() {
@@ -222,9 +260,12 @@ async function main() {
       break
     case 'start': {
       const wantOpen = process.argv.includes('--open')
+      // --public-url=https://relay.example  advertises a self-hosted relay in the QR payload.
+      const publicArg = process.argv.find((a) => a.startsWith('--public-url='))
+      const publicUrl = publicArg ? publicArg.slice('--public-url='.length) : process.env.DSH_REMOTE_PUBLIC_URL || ''
       let handle
       try {
-        handle = await start({ log: (m) => console.log(m) })
+        handle = await start({ publicUrl, log: (m) => console.log(m) })
       } catch (err) {
         // Port already taken: another bridge is serving; just show its pairing page.
         if (/EADDRINUSE/.test(String(err?.message ?? err))) {

package/cordis.patch.yml

@@ -9,6 +9,8 @@
 #   port           local bridge port the phone connects to on the LAN
 #   authority      Host header the bridge presents; the signed cookie is bound to it
 #   tunnel         "auto" (ngrok if found, else cloudflared), "off", "ngrok" or "cloudflared"
+#   publicUrl      explicit public address to advertise (a self-hosted relay, e.g. the Aliyun box).
+#                  When set, nothing is launched for the tunnel and this URL goes into the QR code.
 #   upstreamPort   pin the DSH host port; 0 means discover it automatically
 - insert:
     - id: dsh-remote
@@ -18,4 +20,5 @@
         port: 6300
         authority: '127.0.0.1:1815'
         tunnel: 'auto'
+        publicUrl: ''
         upstreamPort: 0

package/lib/index.js

@@ -16,7 +16,7 @@ import { start } from './supervisor.js'
 
 export const name = 'dsh-remote-hub'
 
-export const version = '0.3.2'
+export const version = '0.3.4'
 
 /** No host services are required: the plugin only needs Node builtins. */
 export const inject = []

package/lib/pairing-routes.js

@@ -23,7 +23,10 @@ export const PAIR_PREFIX = '/_dsh-remote/pair'
  * when that transport is unavailable that moment.
  */
 export function buildPairPayload({ lan, publicUrl, code, expiresAt }) {
-  return JSON.stringify({ v: 1, l: lan ?? null, u: publicUrl ?? null, c: code, e: expiresAt })
+  // `l` is a LIST of LAN URLs: a machine can have several private adapters and only one of them is
+  // reachable from the phone, so the client probes them in order instead of trusting our pick.
+  const lanList = Array.isArray(lan) ? lan.filter(Boolean) : lan ? [lan] : []
+  return JSON.stringify({ v: 2, l: lanList, u: publicUrl ?? null, c: code, e: expiresAt })
 }
 
 /**
@@ -74,8 +77,8 @@ export async function handlePairing({ req, res, current, store }) {
       JSON.stringify({
         ok: true,
         // `url` keeps the old single-address shape working; new clients read lan/public.
-        url: snapshot.public ?? snapshot.lan ?? null,
-        lan: snapshot.lan ?? null,
+        url: snapshot.public ?? (Array.isArray(snapshot.lan) ? snapshot.lan[0] : snapshot.lan) ?? null,
+        lan: Array.isArray(snapshot.lan) ? snapshot.lan : snapshot.lan ? [snapshot.lan] : [],
         public: snapshot.public ?? null,
         cookie: result.cookie,
         issuedAt: result.issuedAt,
@@ -119,7 +122,7 @@ export async function handlePairing({ req, res, current, store }) {
   <p>配对码 <code>${code}</code> · ${minutes} 分钟内有效，且只能用一次</p>
   <div class="qr">${svg}</div>
   <p class="ok">扫码后自动填入地址并换取登录凭据</p>
-  <p class="addr">${snapshot.lan ? `局域网：${snapshot.lan}<br>` : ''}${snapshot.public ? `公网：${snapshot.public}` : ''}</p>
+  <p class="addr">${(Array.isArray(snapshot.lan) ? snapshot.lan : snapshot.lan ? [snapshot.lan] : []).map((u) => `局域网：${u}`).join('<br>')}${snapshot.public ? `<br>公网：${snapshot.public}` : ''}</p>
   <p class="addr">扫一次会同时存下局域网与公网地址，之后自动优先走局域网</p>
 </div></body></html>`
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' })

package/lib/supervisor.js

@@ -10,6 +10,8 @@
  */
 
 import http from 'node:http'
+import https from 'node:https'
+import { execFile } from 'node:child_process'
 import fs from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -36,6 +38,29 @@ function appendLog(line) {
   } catch {}
 }
 
+/** Every private IPv4 address this machine has, best candidate first. */
+export function lanAddresses() {
+  const nets = os.networkInterfaces()
+  const VIRTUAL = /vEthernet|WSL|Docker|Hyper-V|VMware|VirtualBox|Loopback|Tunnel|Tailscale|ZeroTier/i
+  const scored = []
+  for (const [name, addrs] of Object.entries(nets)) {
+    for (const a of addrs || []) {
+      if (a.family !== 'IPv4' || a.internal) continue
+      const isPrivate = /^192\.168\.|^10\.|^172\.(1[6-9]|2\d|3[01])\./.test(a.address)
+      if (!isPrivate) continue
+      let score = 0
+      if (/^192\.168\./.test(a.address)) score += 40
+      else if (/^10\./.test(a.address)) score += 20
+      else score += 5
+      if (/wi-?fi|wlan|WLAN|en0|Ethernet|以太网/i.test(name)) score += 10
+      if (VIRTUAL.test(name)) score -= 60
+      scored.push({ address: a.address, score })
+    }
+  }
+  scored.sort((a, b) => b.score - a.score)
+  return [...new Set(scored.filter((s2) => s2.score > 0).map((s2) => s2.address))]
+}
+
 /**
  * LAN address a phone on the same network can reach.
  *
@@ -102,6 +127,50 @@ function writeStatus(status) {
   fs.writeFileSync(CONNECT_FILE, lines.join(os.EOL), 'utf8')
 }
 
+/** Best-effort description of the process listening on `port` (Windows), for diagnostics. */
+function describePortOwner(port) {
+  if (process.platform !== 'win32') return Promise.resolve(null)
+  const script =
+    `$c = Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1;` +
+    'if ($c) { $p = Get-CimInstance Win32_Process -Filter (\"ProcessId=$($c.OwningProcess)\");' +
+    ' "PID $($c.OwningProcess): $($p.CommandLine)" }'
+  return new Promise((resolve) => {
+    execFile('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { timeout: 8000, windowsHide: true }, (err, stdout) => {
+      const out = String(stdout || '').trim()
+      resolve(err || !out ? null : out.slice(0, 200))
+    })
+  })
+}
+
+/** Probe a full URL (used for the configured public relay) and report whether it answers. */
+function probeHealthUrl(url, timeoutMs = 4000) {
+  return new Promise((resolve) => {
+    let parsed
+    try {
+      parsed = new URL(url)
+    } catch {
+      return resolve(false)
+    }
+    // A relay is usually HTTPS, so pick the transport from the scheme instead of hard-coding http.
+    const transport = parsed.protocol === 'https:' ? https : http
+    let req
+    try {
+      req = transport.request(parsed, { method: 'GET', timeout: timeoutMs }, (res) => {
+        res.resume()
+        resolve(res.statusCode >= 200 && res.statusCode < 500)
+      })
+    } catch {
+      return resolve(false)
+    }
+    req.on('error', () => resolve(false))
+    req.on('timeout', () => {
+      req.destroy()
+      resolve(false)
+    })
+    req.end()
+  })
+}
+
 /** Ask whatever listens on `port` whether it is a dsh-remote bridge, and what it supports. */
 function probeHealth(port, timeoutMs = 1200) {
   return new Promise((resolve) => {
@@ -158,6 +227,7 @@ export async function start(config = {}) {
     port = 6300,
     authority = '127.0.0.1:1815',
     tunnel: tunnelKind = 'auto',
+    publicUrl = '',
     upstreamPort = 0,
     domain = '',
     log = appendLog,
@@ -201,6 +271,9 @@ export async function start(config = {}) {
   let lastPublicUrl = null
 
   /** The bridge may have fallen back to an ephemeral port; everything must report the real one. */
+  const lanUrlsFor = (bridgePort) =>
+    lanAddresses().map((address) => `http://${address}:${bridgePort}`)
+
   let bridgeInstance = null
   const actualBridgePort = () => (bridgeInstance ? bridgeInstance.port : Number(port) || 6300)
 
@@ -210,7 +283,7 @@ export async function start(config = {}) {
     store: pairingStore,
     // Read at redeem time so a tunnel URL that appears later is still handed to the phone.
     current: () => ({
-      lan: ipForPairing ? `http://${ipForPairing}:${actualBridgePort()}` : null,
+      lan: lanUrlsFor(actualBridgePort()),
       public: lastPublicUrl ?? null,
       cookie,
     }),
@@ -275,6 +348,10 @@ export async function start(config = {}) {
       log('dsh-remote: port is held by an old bridge WITHOUT pairing support; using another port')
     } else {
       log(`dsh-remote: port ${wanted} is busy (not a dsh-remote bridge); using another port`)
+      // Say WHO holds it: the usual culprit is a leftover lan-proxy.mjs from an older setup, and
+      // knowing the PID is what lets the user stop it instead of guessing.
+      const owner = await describePortOwner(wanted)
+      if (owner) log(`dsh-remote: port ${wanted} is held by: ${owner}`)
     }
     bridge = await startBridge({
       listenPort: 0,
@@ -308,6 +385,7 @@ export async function start(config = {}) {
 
   const tunnel = await startTunnel({
     kind: tunnelKind,
+    publicUrl,
     bridgePort: bridge.port,
     authority,
     domain,
@@ -328,6 +406,15 @@ export async function start(config = {}) {
   })
 
   lastPublicUrl = tunnel.publicUrl
+  // A configured relay can be "up" while its reverse tunnel is down; probe it so status does not
+  // advertise a URL that cannot answer.
+  let publicReachable = null
+  if (publicUrl && tunnel.publicUrl) {
+    publicReachable = await probeHealthUrl(`${tunnel.publicUrl}/_dsh-remote/health`)
+    if (publicReachable === false) {
+      log(`dsh-remote: WARNING ${tunnel.publicUrl} does not answer — is the relay's SSH tunnel up?`)
+    }
+  }
   const ip = ipForPairing
   const status = {
     updatedAt: Date.now(),
@@ -336,7 +423,12 @@ export async function start(config = {}) {
     authority,
     upstreamPort: discovery.port || null,
     lan: { ip, url: ip ? `http://${ip}:${bridge.port}` : null },
-    public: { url: tunnel.publicUrl, kind: tunnel.kind, ...(tunnel.note ? { note: tunnel.note } : {}) },
+    public: {
+      url: tunnel.publicUrl,
+      kind: tunnel.kind,
+      ...(publicReachable === null ? {} : { reachable: publicReachable }),
+      ...(tunnel.note ? { note: tunnel.note } : {}),
+    },
     cookie,
     cookieExpiresAt: expiresAt ?? cookieExpiry(cookie),
     pairing: {

package/lib/tunnel.js

@@ -148,7 +148,15 @@ export async function ensureCloudflared({ log = () => {} } = {}) {
  * @param {(msg: string) => void} [options.log]
  * @returns {Promise<{publicUrl: string|null, kind: string, close: () => void, note?: string}>}
  */
-export async function startTunnel({ kind = 'auto', bridgePort, authority, domain = '', log = () => {} }) {
+export async function startTunnel({ kind = 'auto', bridgePort, authority, domain = '', publicUrl = '', log = () => {} }) {
+  // An explicitly configured public URL (a self-hosted relay, e.g. the Aliyun box) wins over any
+  // detected tunnel: for that setup there is nothing to launch here, the relay is kept alive by its
+  // own reverse SSH tunnel.
+  if (publicUrl) {
+    const trimmed = String(publicUrl).trim().replace(/\/+$/, '')
+    log(`using the configured public URL: ${trimmed}`)
+    return { publicUrl: trimmed, kind: 'relay', close: () => {} }
+  }
   if (kind === 'off') return { publicUrl: null, kind: 'none', close: () => {}, note: 'tunnel disabled by config' }
 
   const wantNgrok = kind === 'auto' || kind === 'ngrok'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-hub",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "DSH 插件：把电脑上的 DeepSeek Harness 变成手机可访问的服务——起桥接、自动开隧道（ngrok / cloudflared）、签发 30 天 Cookie，并输出地址与凭据，配合 DSH Remote Android App 使用。",
   "type": "module",
   "main": "lib/index.js",