dsh-remote-hub 0.4.1 → 0.4.3

package/README.md

@@ -28,7 +28,7 @@ Kotlin/Compose 直连 DSH 自带的 HTTP API + WebSocket 网关。
 手机端不通过 npm 分发——npm 包 `dsh-remote-hub` 是电脑侧的 DSH 插件，两者配合使用：
 
 ```
-电脑：dsh plugin --profile desktop add dsh-remote-hub   → 起桥接 / 开隧道 / 签 Cookie
+电脑：dsh plugin --profile desktop add dsh-remote-hub@0.4.3 --registry=https://registry.npmjs.org → 起桥接 / 开隧道 / 签 Cookie
 手机：装上面这个 APK → 填电脑给出的地址与 Cookie → 连接
 ```
 
@@ -184,8 +184,8 @@ node mint.mjs "127.0.0.1:1815" 30              # 签发 30 天 Cookie
 ```bash
 # 从 NPM 安装（推荐，会出现在 DSH 内的「插件中心」）
 # https://www.npmjs.com/package/dsh-remote-hub
-dsh plugin --profile desktop add dsh-remote-hub
-dsh plugin --profile web add dsh-remote-hub      # web profile 同样可用
+dsh plugin --profile desktop add dsh-remote-hub@0.4.3 --registry=https://registry.npmjs.org
+dsh plugin --profile web add dsh-remote-hub@0.4.3 --registry=https://registry.npmjs.org
 
 # 或直接从本仓库源码安装（不经过 NPM）
 dsh plugin --profile web add github:liaoguogang-hub/dsh-remote-public
@@ -222,6 +222,10 @@ dsh-remote start      # 不开 DSH 也能单独前台跑（Ctrl+C 退出）
 > 公网隧道受网络影响：`api.trycloudflare.com` 不可达时插件会跳过公网、只给局域网地址，
 > 并在 `status.json` 里写明原因，不会假装成功。
 
+> **安装时必须带版本号**（如 `@0.4.1`）。pnpm 11 默认开启 `minimumReleaseAge` 安全策略，
+> 新发布的版本在一段时间内不会被 `@latest` 解析到，会**回退安装到很旧的版本**（0.1.0 没有扫码配对，
+> 表现就是「扫码页打不开」）。显式写版本号可绕过该策略。
+
 ### 装完之后
 
 插件随 DSH 启动自动工作，**不需要手动跑 connect.cmd**；装的时候没有提示是正常的，日志里会出现：
@@ -238,7 +242,9 @@ dsh-remote: ready — 手机端扫码：dsh-remote qr（或浏览器打开 http:
 ### 升级插件（重要：必须完全重启 DSH）
 
 ```bash
-dsh plugin --profile desktop add dsh-remote-hub     # 或 --profile web
+dsh plugin --profile desktop add dsh-remote-hub@0.4.3 --registry=https://registry.npmjs.org
+# web profile 把 desktop 换成 web
+
 ```
 
 **升级后请完全退出 DSH 再重新打开，不要只靠插件热重载。** 原因是旧版本的桥接监听可能不会被热重载回收，
@@ -313,3 +319,7 @@ dsh-remote qr
 | GET | `/_dsh-remote/pair` | 配对页（二维码 HTML） |
 | GET | `/_dsh-remote/pair.svg` | 只要二维码 SVG |
 | POST | `/_dsh-remote/pair/redeem` | `{code}` → `{url, cookie}`；用过即失效 |
+
+---
+
+发版流程（版本号约定、tag 命名、发布 checklist、踩过的坑）：见 [RELEASING.md](RELEASING.md)

package/bin/dsh-remote.mjs

@@ -23,6 +23,7 @@ import { credentialsPath, mintCookie, readSigningSecret } from '../lib/cookie.js
 import { listeningPorts, probePort } from '../lib/discover.js'
 import { findCloudflared, findNgrok } from '../lib/tunnel.js'
 import { CONNECT_FILE, STATUS_FILE, readStatus, start } from '../lib/supervisor.js'
+import { version as VERSION } from '../lib/index.js'
 
 const args = process.argv.slice(2)
 const command = args[0] || 'status'
@@ -42,6 +43,7 @@ function printStatus() {
   const remaining = status.cookieExpiresAt ? Math.round((status.cookieExpiresAt - Date.now()) / 86400000) : null
   console.log('')
   console.log('  DSH Remote 状态')
+  console.log(`  插件版本     v${VERSION}`)
   console.log('  ' + '-'.repeat(52))
   console.log(`  局域网地址   ${status.lan?.url ?? '(未检测到局域网 IP)'}`)
   console.log(`  公网地址     ${status.public?.url ?? `无（${status.public?.note ?? '未开启'}）`}`)
@@ -58,6 +60,7 @@ function printStatus() {
   } else if (status.error) {
     console.log(`  错误   ${status.error}`)
   }
+  console.log(`  ✔ 插件版本        v${VERSION}`)
   console.log('  ' + '-'.repeat(52))
   console.log('')
 }
@@ -270,6 +273,18 @@ async function main() {
         const live = await bridgeHealthy(Number(process.env.DSH_REMOTE_PORT || 6300))
         const mismatch = live && (live.relay || null) !== (publicUrl || null)
         if (mismatch && live.pid) {
+          // NEVER signal a bridge that lives inside the desktop app: health.pid is then the DSH
+          // host process, and killing it takes the whole app down (this actually happened).
+          if (live.runtime === 'electron') {
+            console.log('')
+            console.log('  桥接由 DSH 桌面端内部托管（PID ' + live.pid + ' 就是 DSH 本体），不能在这里停止。')
+            console.log('  它的公网配置来自 profile 的 cordis.patch.yml：')
+            console.log(`    当前 relay = ${live.relay ?? '（未配置）'}，本次启动想要 ${publicUrl || '（不用中转）'}`)
+            console.log('  要改配置：编辑 cordis.patch.yml 里的 publicUrl 后重启 DSH；')
+            console.log('  要临时用本启动器的配置：先完全退出 DSH，再双击 connect.cmd。')
+            console.log('')
+            return
+          }
           console.log(`已有桥接配置不同（relay=${live.relay ?? '无'}），先停止它（PID ${live.pid}）再按当前配置启动`)
           try {
             process.kill(Number(live.pid))

package/lib/bridge.js

@@ -156,6 +156,9 @@ export function startBridge({ listenPort, authority, upstream, pairing = null, r
         ok: true,
         service: 'dsh-remote-bridge',
         pid: process.pid,
+        // 'electron' when the bridge lives inside the DSH desktop host (plugin mode). Callers must
+        // NEVER signal that pid: it is the app itself, not a disposable node helper.
+        runtime: process.versions.electron ? 'electron' : 'node',
         // Whether this bridge advertises a self-hosted relay; a launcher that expects none must not
         // adopt a bridge that has one, or the public app would show the self-use relay.
         relay: relayUrl || null,

package/lib/discover.js

@@ -108,6 +108,57 @@ export function probePort(port) {
   })
 }
 
+/** Map local listening port -> owning PID (Windows only). */
+async function portOwners() {
+  if (process.platform !== 'win32') return new Map()
+  const out = await run('netstat', ['-ano', '-p', 'tcp'])
+  const map = new Map()
+  for (const line of splitLines(out)) {
+    const m = /^\s*TCP\s+\S+:(\d+)\s+\S+\s+LISTENING\s+(\d+)/i.exec(line)
+    if (m) map.set(Number(m[1]), Number(m[2]))
+  }
+  return map
+}
+
+/** Process name for a PID, or '' when unknown (uses tasklist; cheap enough at discovery time). */
+const NAME_CACHE = new Map()
+async function processName(pid) {
+  if (process.platform !== 'win32') return ''
+  if (NAME_CACHE.has(pid)) return NAME_CACHE.get(pid)
+  const out = await run('tasklist', ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH'])
+  const line = splitLines(out).find((l) => l.trim().length > 0)
+  if (!line) return ''
+  const m = /^"([^"]+)"/.exec(line.trim())
+  const name = m ? m[1] : ''
+  NAME_CACHE.set(pid, name)
+  return name
+}
+
+/**
+ * Pick the best DSH host when several profile hosts are running.
+ *
+ * A machine can run the desktop app and a CLI host (e.g. a Lark profile) at the same time; both
+ * answer the fingerprint. The phone wants the DESKTOP one, so a host whose image is not node.exe
+ * (the Electron app) wins over a plain `node` host.
+ */
+async function rankHosts(ports) {
+  if (process.platform !== 'win32' || ports.length <= 1) return ports
+  const owners = await portOwners()
+  const ranked = []
+  for (const port of ports) {
+    const pid = owners.get(port)
+    let name = ''
+    if (pid) {
+      // eslint-disable-next-line no-await-in-loop
+      name = await processName(pid)
+    }
+    const desktop = name && !/^node(\.exe)?$/i.test(name)
+    ranked.push({ port, desktop })
+  }
+  const preferred = ranked.filter((r) => r.desktop)
+  return (preferred.length ? preferred : ranked).map((r) => r.port)
+}
+
 /**
  * A resolver that remembers the last known-good port.
  *
@@ -128,16 +179,24 @@ export function createDiscovery({ pinned = 0, ttlMs = 30_000, exclude = [] } = {
     inFlight = (async () => {
       const skip = new Set(exclude.filter((p) => Number.isInteger(p) && p > 0))
       const ports = (await listeningPorts()).filter((p) => !skip.has(p))
-      // Probe the remembered port first: it is usually still right and saves a full sweep.
-      const ordered = port && ports.includes(port) ? [port, ...ports.filter((p) => p !== port)] : ports
-      for (const candidate of ordered) {
-        // eslint-disable-next-line no-await-in-loop
-        if (await probePort(candidate)) {
-          port = candidate
-          resolvedAt = Date.now()
-          return port
+      // Probe in parallel: a full sweep touches dozens of ports, and a serial walk made the first
+      // request after startup take 10+ seconds.
+      const CONCURRENCY = 12
+      let cursor = 0
+      const hits = []
+      async function worker() {
+        while (cursor < ports.length) {
+          const candidate = ports[cursor++]
+          // eslint-disable-next-line no-await-in-loop
+          if (await probePort(candidate)) hits.push(candidate)
         }
       }
+      await Promise.all(Array.from({ length: Math.min(CONCURRENCY, ports.length) }, worker))
+      if (hits.length === 0) return port
+      // Keep the remembered port when it is still a hit; otherwise prefer the desktop host.
+      const ranked = hits.includes(port) ? [port, ...hits.filter((p) => p !== port)] : await rankHosts(hits)
+      port = ranked[0]
+      resolvedAt = Date.now()
       return port
     })()
     try {

package/lib/index.js

@@ -16,7 +16,7 @@ import { start } from './supervisor.js'
 
 export const name = 'dsh-remote-hub'
 
-export const version = '0.4.1'
+export const version = '0.4.3'
 
 /** No host services are required: the plugin only needs Node builtins. */
 export const inject = []
@@ -56,7 +56,7 @@ export function apply(ctx, config = {}) {
         // Make the next step discoverable from the log: after installing the plugin there is no
         // other place telling the user how to get the phone connected.
         log(
-          `dsh-remote: ready — 手机端扫码：dsh-remote qr（或浏览器打开 http://127.0.0.1:${started.status.bridgePort}/_dsh-remote/pair）；` +
+          `dsh-remote: ready (v${version}) — 手机端扫码：dsh-remote qr（或浏览器打开 http://127.0.0.1:${started.status.bridgePort}/_dsh-remote/pair）；` +
             '不想装插件时也可以直接双击仓库里的 connect.cmd',
         )
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-hub",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "DSH 插件：把电脑上的 DeepSeek Harness 变成手机可访问的服务——起桥接、自动开隧道（ngrok / cloudflared）、签发 30 天 Cookie，并输出地址与凭据，配合 DSH Remote Android App 使用。",
   "type": "module",
   "main": "lib/index.js",