dsh-remote-plugin 0.6.25 → 0.6.26

package/gateway.cjs

@@ -72,6 +72,8 @@ const WS_IDLE_MS = durationEnv('GATEWAY_WS_IDLE_MS', 180000, 0, 24 * 60 * 60 * 1
 const WS_UPGRADE_TIMEOUT_MS = durationEnv('GATEWAY_WS_UPGRADE_TIMEOUT_MS', 15000, 1000, 5 * 60 * 1000)
 const UPSTREAM_REQUEST_TIMEOUT_MS = durationEnv('GATEWAY_UPSTREAM_TIMEOUT_MS', 30000, 1000, 10 * 60 * 1000)
 const UPSTREAM = new URL(process.env.DSH_UPSTREAM || 'http://127.0.0.1:3080')
+// URL 中 IPv6 带方括号，http.request 的 hostname 则要求裸地址。
+const UPSTREAM_HOSTNAME = UPSTREAM.hostname.replace(/^\[|\]$/g, '')
 const UPSTREAM_TRANSPORT = UPSTREAM.protocol === 'https:' ? https : http
 const UPSTREAM_PORT = Number(UPSTREAM.port) || (UPSTREAM.protocol === 'https:' ? 443 : 80)
 const UPSTREAM_AUTHORITY = `${UPSTREAM.hostname}${UPSTREAM.port ? ':' + UPSTREAM.port : ''}`
@@ -2766,7 +2768,7 @@ function serveStatic(req, res, url) {
 // ---------- 管理 API ----------
 function upstreamReachable(cb) {
   const req = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: 'GET',
     path: '/health',
@@ -3347,7 +3349,8 @@ function sha256FileHex(file, cb) {
 const activeUploads = new Map()
 const uploadPartDirs = new Set()
 function fsActiveKey(dirReal, name, session) {
-  return dirReal + '\n' + name + '\n' + (session || '')
+  const key = fsPartPath(dirReal, name, session)
+  return process.platform === 'win32' ? key.toLowerCase() : key
 }
 
 function rememberUploadDir(dirReal) {
@@ -3355,8 +3358,8 @@ function rememberUploadDir(dirReal) {
 }
 
 function uploadDirHasActive(dirReal) {
-  const prefix = dirReal + '\n'
-  for (const key of activeUploads.keys()) if (key.startsWith(prefix)) return true
+  const dir = process.platform === 'win32' ? dirReal.toLowerCase() : dirReal
+  for (const key of activeUploads.keys()) if (path.dirname(key) === dir) return true
   return false
 }
 
@@ -3431,24 +3434,49 @@ function fsUploadPipe(res, url, dirLex, dirReal, name) {
   return up ? fsUploadPipeFromTarget(res, up) : null
 }
 
+/** 同目录提交：覆盖用原子 rename；禁止覆盖用排他 link，绝不先删旧文件。 */
+function fsCommitUpload(tmp, target, overwrite) {
+  if (overwrite) fs.renameSync(tmp, target)
+  else {
+    fs.linkSync(tmp, target)
+    // 目标已提交，临时名字清理失败不应把成功误报为失败。
+    try { fs.unlinkSync(tmp) } catch {}
+  }
+}
+
 function fsUploadPipeFromTarget(res, up) {
   let finished = false
+  let ending = false
+  let written = false
   const cleanup = () => {
     if (finished) return
     finished = true
     try { up.stream.destroy() } catch {}
-    try { fs.unlinkSync(up.tmp) } catch {}
+    up.stream.once('close', () => { try { fs.unlinkSync(up.tmp) } catch {} })
   }
   up.stream.on('error', () => {
     if (finished) return
     finished = true
-    try { fs.unlinkSync(up.tmp) } catch {}
+    up.stream.once('close', () => { try { fs.unlinkSync(up.tmp) } catch {} })
     if (!res.headersSent) fsJson(res, 500, { error: 'write-failed' })
     else try { res.destroy() } catch {}
   })
+  up.stream.once('finish', () => { written = true })
+  up.stream.once('close', () => {
+    if (finished || !written) return
+    finished = true
+    try {
+      fsCommitUpload(up.tmp, up.target, up.overwrite)
+    } catch (err) {
+      try { fs.unlinkSync(up.tmp) } catch {}
+      if (!res.headersSent) fsJson(res, err.code === 'EEXIST' ? 409 : 403, { error: err.code === 'EEXIST' ? 'conflict' : 'write-failed', detail: err.message })
+      return
+    }
+    fsJson(res, 201, { ok: true, path: up.displayPath, name: up.name, size: up.bytes })
+  })
   return {
     write(chunk) {
-      if (finished) return
+      if (finished || ending) return
       up.bytes += chunk.length
       if (up.bytes > FS_MAX_UPLOAD) {
         cleanup()
@@ -3459,19 +3487,9 @@ function fsUploadPipeFromTarget(res, up) {
       up.stream.write(chunk)
     },
     end() {
-      if (finished) return
-      finished = true
-      up.stream.end(() => {
-        try {
-          if (up.overwrite) fs.rmSync(up.target, { force: true })
-          fs.renameSync(up.tmp, up.target)
-        } catch (err) {
-          try { fs.unlinkSync(up.tmp) } catch {}
-          if (!res.headersSent) return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
-          return
-        }
-        fsJson(res, 201, { ok: true, path: up.displayPath, name: up.name, size: up.bytes })
-      })
+      if (finished || ending) return
+      ending = true
+      up.stream.end()
     },
     abort(status, msg) {
       cleanup()
@@ -3659,6 +3677,8 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '文件名不能为空且不能包含路径分隔符' })
   const session = url.searchParams.get('session') || ''
   if (!session) return fsJson(res, 400, { error: 'missing-session', detail: '断点续传需要 session 参数' })
+  const activeKey = fsActiveKey(dirReal, name, session)
+  if (activeUploads.has(activeKey)) return fsJson(res, 409, { error: 'upload-busy' })
   const queryOffsetRaw = url.searchParams.get('offset')
   const headerOffsetRaw = req.headers['upload-offset']
   const offsetRaw = queryOffsetRaw ?? headerOffsetRaw
@@ -3719,21 +3739,37 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   } catch (err) {
     return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
   }
-  const activeKey = fsActiveKey(dirReal, name, session)
   activeUploads.set(activeKey, stream)
 
   let bytes = 0
   let finished = false
+  let written = false
+  let cancelled = false
+  const release = () => {
+    if (activeUploads.get(activeKey) === stream) activeUploads.delete(activeKey)
+  }
+  res.once('finish', () => { finished = true; if (!cancelled) release() })
   const abort = (status, msg, extra = {}) => {
     if (finished) return
     finished = true
-    activeUploads.delete(activeKey)
+    cancelled = true
+    const cleanup = () => {
+      if (status === 413 || status === 500 || msg === 'cancelled') { try { fs.unlinkSync(part) } catch {} }
+      release()
+    }
+    if (stream.closed) cleanup()
+    else stream.once('close', cleanup)
     try { stream.destroy() } catch {}
     // 网络中断时保留分片, 客户端 probe 后续传; 只有超限/写失败才删
-    if (status === 413 || status === 500) { try { fs.unlinkSync(part) } catch {} }
     if (!res.headersSent) fsJson(res, status, { error: msg, ...extra })
     else try { res.destroy() } catch {}
   }
+  stream.cancelUpload = () => {
+    const closed = stream.closed ? Promise.resolve() : new Promise(resolve => stream.once('close', resolve))
+    abort(409, 'cancelled')
+    return closed
+  }
+  res.once('close', () => { if (!finished) abort(400, 'client-aborted') })
 
   stream.on('error', (err) => {
     abort(500, err.code === 'ENOENT' ? 'part-missing' : 'write-failed', { detail: err.message })
@@ -3751,9 +3787,11 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
   })
   req.on('end', () => {
     if (finished) return
-    finished = true
-    stream.end(() => {
-      activeUploads.delete(activeKey)
+    stream.end()
+  })
+  stream.once('finish', () => { written = true })
+  stream.once('close', () => {
+      if (finished || !written) return
       const total = offset + bytes
       try {
         const st = fs.statSync(part)
@@ -3771,21 +3809,22 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
           return
         }
         const commit = (actualSha256) => {
+          if (cancelled) return
           try {
             const ts = fsTargetState(target)
             if (ts.status) return fsJson(res, ts.status, { error: ts.error, detail: ts.detail })
             if (ts.exists && !overwrite) return fsJson(res, 409, { error: 'conflict', detail: '文件已存在, overwrite=1 可覆盖' })
-            if (ts.exists) fs.rmSync(target, { force: true })
-            fs.renameSync(part, target)
+            fsCommitUpload(part, target, overwrite)
             fsJson(res, 201, { ok: true, name, path: path.join(dirLex, name), size: total, resumed: offset > 0, session, uploadLength, ...(actualSha256 ? { sha256: actualSha256 } : {}) }, fsUploadHeaders(total, uploadLength))
           } catch (err) {
-            if (!res.headersSent) fsJson(res, 403, { error: 'write-failed', detail: err.message })
+            if (!res.headersSent) fsJson(res, err.code === 'EEXIST' ? 409 : 403, { error: err.code === 'EEXIST' ? 'conflict' : 'write-failed', detail: err.message })
             else try { res.destroy() } catch {}
           }
         }
         if (sha256Expected) {
           // 落盘前校验: 不匹配保留分片并返回 422, 客户端可重传或取消
           sha256FileHex(part, (err, actual) => {
+            if (cancelled) return
             if (err) return fsJson(res, 403, { error: 'checksum-failed', detail: err.message })
             if (actual !== sha256Expected) {
               return fsJson(res, 422, { error: 'checksum-mismatch', expected: sha256Expected, actual, partialSize: total, session }, fsUploadHeaders(total, uploadLength, Date.now() + FS_UPLOAD_TTL_MS))
@@ -3799,7 +3838,6 @@ function fsUploadResumable(req, res, url, dirLex, dirReal) {
         if (!res.headersSent) fsJson(res, 403, { error: 'write-failed', detail: err.message })
         else try { res.destroy() } catch {}
       }
-    })
   })
 }
 
@@ -3828,17 +3866,15 @@ async function fsUploadControl(req, res, url) {
   const part = fsPartPath(checked.abs, name, session)
   const active = activeUploads.get(fsActiveKey(checked.abs, name, session))
   if (active) {
-    try { active.destroy() } catch {}
-    activeUploads.delete(fsActiveKey(checked.abs, name, session))
+    await active.cancelUpload()
+    return fsJson(res, 200, { ok: true, cancelled: true, session })
   }
-  // 等写流关闭后再删, 防止 write 把分片重新创建出来
-  setTimeout(() => {
+  // 无活动写流时同步删除，不留下可被新上传插入的延时窗口。
     let removed = false
     try { fs.unlinkSync(part); removed = true } catch (err) {
       if (err.code !== 'ENOENT') return fsJson(res, 403, { error: 'permission-denied', detail: err.message })
     }
     fsJson(res, 200, { ok: true, cancelled: true, removed, session })
-  }, 80)
 }
 
 async function serveFs(req, res, url) {
@@ -4164,7 +4200,7 @@ async function proxyLegacyApi(req, res, url) {
 
   let responseDone = false
   const upstreamReq = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: req.method,
     path: url.pathname + url.search,
@@ -4552,7 +4588,7 @@ server.on('upgrade', (req, socket, head) => {
     handshakeTimer = null
   }
   const upstreamReq = UPSTREAM_TRANSPORT.request({
-    hostname: UPSTREAM.hostname,
+    hostname: UPSTREAM_HOSTNAME,
     port: UPSTREAM_PORT,
     method: req.method,
     path: url.pathname + url.search,

package/index.mjs

@@ -77,6 +77,14 @@ try {
 let dshListen = { host: '127.0.0.1', port: 3080 }
 let dshConnection = null
 
+// 监听通配地址不是连接目标；保留地址族，避免 IPv6-only 服务退回 IPv4。
+export function upstreamUrlForListener({ host, port }) {
+  let target = String(host || '127.0.0.1').replace(/^\[|\]$/g, '')
+  if (target === '0.0.0.0') target = '127.0.0.1'
+  if (net.isIP(target) === 6 && new URL(`http://[${target}]`).hostname === '[::]') target = '::1'
+  return `http://${net.isIP(target) === 6 ? `[${target}]` : target}:${port}`
+}
+
 function dshUpstreamCookieFile() {
   return process.env.DSH_REMOTE_DSH_COOKIE_FILE || `${homedir()}/.dsh-remote/dsh-upstream.cookie`
 }
@@ -88,7 +96,7 @@ function dshUpstreamCookieFile() {
  */
 async function refreshDshUpstreamCookie() {
   if (typeof dshConnection?.authenticatedUrl !== 'function') return false
-  const upstream = `http://${dshListen.host}:${dshListen.port}`
+  const upstream = upstreamUrlForListener(dshListen)
   try {
     const loginUrl = dshConnection.authenticatedUrl(upstream)
     const response = await fetch(loginUrl, {
@@ -254,11 +262,16 @@ function portInUse(port) {
 
 async function gatewayRunning() {
   try {
-    const res = await fetch(`${gatewayBase()}/health`, { signal: AbortSignal.timeout(3000) })
+    const base = gatewayBase()
+    const res = await fetch(`${base}/health`, { signal: AbortSignal.timeout(6000) })
     if (!res.ok) return { running: false }
     const data = await res.json().catch(() => ({}))
+    if (data.service !== 'dsh-remote' || !Number.isInteger(data.pid) || data.pid <= 1
+      || typeof data.version !== 'string' || typeof data.upstream !== 'string'
+      || !data.events?.mux || !data.events?.host) return { running: false }
     return {
       running: true,
+      base,
       pid: Number(data.pid) || 0,
       version: typeof data.version === 'string' ? data.version : '',
       upstream: typeof data.upstream === 'string' ? data.upstream : '',
@@ -274,15 +287,6 @@ async function gatewayRunning() {
 
 function gatewayPidFile() { return `${homedir()}/.dsh-remote/plugin-gateway.pid` }
 
-function readGatewayPid() {
-  try {
-    const pid = Number(readFileSync(gatewayPidFile(), 'utf8').trim())
-    return Number.isFinite(pid) && pid > 0 ? pid : 0
-  } catch {
-    return 0
-  }
-}
-
 function writeGatewayPid(pid) {
   try {
     mkdirSync(`${homedir()}/.dsh-remote`, { recursive: true })
@@ -298,19 +302,22 @@ function logGateway(msg) {
 }
 
 async function killGateway(health) {
-  const pid = (health && Number(health.pid)) || readGatewayPid()
-  if (!pid) return false
+  // PID 文件和公开健康响应不能证明进程归属；仅走网关认证关闭接口。
+  if (!health?.running || !Number.isInteger(health.pid) || health.pid <= 1) return false
+  const token = gatewayToken()
+  if (!token) return false
   try {
-    if (process.platform === 'win32') {
-      await runExit('taskkill', ['/F', '/PID', String(pid)])
-    } else {
-      process.kill(pid)
-    }
-    logGateway('已停止旧网关 PID=' + pid)
+    const res = await fetch(`${health.base || gatewayBase()}/admin/api/shutdown`, {
+      method: 'POST', headers: { authorization: `Bearer ${token}`, 'x-dsh-remote-client': 'admin' },
+      signal: AbortSignal.timeout(2000),
+    })
+    const body = await res.json().catch(() => ({}))
+    if (!res.ok || body.ok !== true || body.bye !== true) return false
+    logGateway('已请求旧网关认证关闭')
     await sleep(300)
     return true
   } catch (e) {
-    logGateway('停止旧网关失败 PID=' + pid + ' ' + (e?.message || String(e)))
+    logGateway('认证关闭旧网关失败: ' + (e?.message || String(e)))
     return false
   }
 }
@@ -337,7 +344,7 @@ function setGatewayEnabled(on) {
 
 /** 启动随插件分发的 gateway.cjs; 已运行则直接返回。 */
 async function startGateway() {
-  const upstream = `http://${dshListen.host}:${dshListen.port}`
+  const upstream = upstreamUrlForListener(dshListen)
   const health = await gatewayRunning()
   if (health.running) {
     setGatewayEnabled(true)
@@ -413,7 +420,7 @@ function ensureGateway() {
         const out = await startGateway()
         return !!out.running
       }
-      const upstream = `http://${dshListen.host}:${dshListen.port}`
+      const upstream = upstreamUrlForListener(dshListen)
       const oldUpstream = health.upstream || ''
       const oldVersion = health.version || '?'
       const versionMismatch = oldVersion !== version
@@ -421,7 +428,10 @@ function ensureGateway() {
       // 重启只能制造额外断线，网关应保持运行并通过 /health 暴露 degraded 状态。
       if (versionMismatch || (oldUpstream && oldUpstream !== upstream) || (!oldUpstream && upstream)) {
         logGateway(`网关需刷新: 版本 ${oldVersion} -> ${version}, 上游 ${oldUpstream || '?'} -> ${upstream}`)
-        await killGateway(health)
+        if (!await killGateway(health)) {
+          logGateway('拒绝自动重启: 无法通过认证关闭旧网关，请检查令牌或端口占用')
+          return false
+        }
         for (let i = 0; i < 10; i++) {
           if (!(await gatewayRunning()).running) break
           await sleep(200)
@@ -439,20 +449,10 @@ function ensureGateway() {
 
 /** 通过网关自身的 /admin/api/shutdown 优雅停止(不管它当初是谁拉起的); 并写入 off 防自愈拉起。 */
 async function stopGateway() {
-  const token = gatewayToken()
-  if (!token) return { ok: false, running: false, error: '找不到 ~/.dsh-remote/token, 无法认证网关' }
-  try {
-    const res = await fetch(`${gatewayBase()}/admin/api/shutdown`, {
-      method: 'POST',
-      headers: { authorization: `Bearer ${token}`, 'x-dsh-remote-client': 'admin' },
-      signal: AbortSignal.timeout(2000),
-    })
-    const json = await res.json().catch(() => ({}))
-    if (res.ok) setGatewayEnabled(false)
-    return { ok: res.ok, running: false, ...json }
-  } catch (e) {
-    return { ok: false, running: false, error: '网关不可达: ' + (e?.message || e) }
-  }
+  const health = await gatewayRunning()
+  if (!await killGateway(health)) return { ok: false, running: health.running, error: '无法确认网关身份或认证关闭失败，请检查令牌与端口占用' }
+  setGatewayEnabled(false)
+  return { ok: true, running: false, bye: true }
 }
 
 // ---------- 统计事件投递(实时 assistant/message + usage -> 网关 /stats/ingest) ----------
@@ -750,6 +750,10 @@ async function serveStatic(req, res, ctx) {
       // 先在切换配置前读取旧端口上的健康状态；写入新端口后 gatewayRunning()
       // 只会探测新端口，否则旧网关会变成孤儿进程继续占用旧端口。
       const oldHealth = process.env.DSH_REMOTE_GATEWAY ? { running: false } : await gatewayRunning()
+      if (!process.env.DSH_REMOTE_GATEWAY_PORT && port !== oldPort && oldHealth.running && !await killGateway(oldHealth)) {
+        sendJson(res, 409, { ok: false, error: '无法通过认证关闭旧网关，端口配置未修改' })
+        return
+      }
       try {
         mkdirSync(`${homedir()}/.dsh-remote`, { recursive: true })
         writeFileSync(gatewayPortFile(), String(port) + '\n')
@@ -758,9 +762,6 @@ async function serveStatic(req, res, ctx) {
         return
       }
       const effectivePort = Number(readGatewayPort())
-      if (effectivePort !== oldPort) {
-        if (oldHealth.running) await killGateway(oldHealth)
-      }
       let running = (await gatewayRunning()).running
       if (gatewayAutostart()) {
         const startOut = await startGateway()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.6.25",
+  "version": "0.6.26",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",

package/public/genui.css

@@ -1,2 +1,8 @@
 .genui{margin:14px 0;padding:14px;border:1px solid #8884;border-radius:12px;line-height:1.65;overflow:hidden;color:inherit;background:#88808;font-size:14px}
 .genui *{box-sizing:border-box}.genui h1,.genui h2,.genui h3,.genui h4,.genui p{margin:0 0 10px}.genui-caption{font-size:11px;opacity:.65;margin-bottom:12px}.genui-row{display:flex;flex-wrap:wrap;gap:12px}.genui-row>*{flex:1;min-width:120px}.genui-col{display:grid;gap:12px}.genui-grid{display:grid;grid-template-columns:repeat(var(--genui-cols,2),minmax(0,1fr));gap:12px}.genui-card{border:1px solid #8884;border-radius:8px;padding:12px;min-width:0}.genui-card>h4{font-size:16px}.genui-stat{display:flex;flex-direction:column;min-width:0;padding:8px 0}.genui-stat strong{font-size:28px;line-height:1.25;font-variant-numeric:tabular-nums;overflow-wrap:anywhere}.genui-stat small,.genui-stat span{opacity:.75}.genui-badge{display:inline-block;padding:2px 9px;border:1px solid #8885;border-radius:20px}.genui progress{display:block;width:100%;accent-color:#2563eb;height:10px;margin:7px 0}.genui-spacer{height:12px}.genui-callout{border-left:3px solid #2563eb;padding:10px 12px;background:#2563eb12}.genui-chart{margin:10px 0}.genui-chart figcaption{font-weight:600}.genui-chart svg{display:block;width:100%;height:auto;max-height:520px}.genui-chart svg text{fill:currentColor;font:11px system-ui}.genui-gridline{stroke:currentColor;opacity:.15;fill:none}.genui-legend{display:flex;flex-wrap:wrap;gap:7px 14px;font-size:12px}.genui-legend i{display:inline-block;width:9px;height:9px;border-radius:2px;margin-right:5px}.genui-scroll{overflow:auto;max-height:420px}.genui table{width:100%;border-collapse:collapse;font-size:12px}.genui td,.genui th{text-align:left;padding:7px;border-bottom:1px solid #8884;white-space:nowrap}.genui-source{margin-top:12px}.genui summary{cursor:pointer;font-size:12px}.genui pre{max-height:320px;overflow:auto;white-space:pre-wrap;word-break:break-word}.genui-unsupported{border-left:2px solid #d97706;padding:8px;margin:8px 0}.genui-html{display:block;width:100%;height:440px;border:1px solid #8884;border-radius:7px;background:white}.genui dl{display:grid;grid-template-columns:auto 1fr;gap:6px 12px}.genui dd{margin:0}.genui li{margin:4px 0}@media(max-width:520px){.genui{padding:10px}.genui-grid{grid-template-columns:repeat(2,minmax(0,1fr))}.genui-stat strong{font-size:23px}.genui-html{height:380px}}
+.genui-tabs>[role=tablist]{display:flex;gap:5px;overflow-x:auto;margin-bottom:12px;border-bottom:1px solid #8884;padding-bottom:6px}
+.genui button{font:inherit;color:inherit;background:transparent;border:1px solid #8884;border-radius:6px;padding:5px 9px;cursor:pointer}
+.genui button:focus-visible{outline:2px solid #2563eb;outline-offset:2px}.genui [role=tab][aria-selected=true]{background:#2563eb20;border-color:#2563eb}.genui [hidden]{display:none!important}
+.genui .genui-spark{display:block;width:120px;height:30px;max-width:100%;color:#2563eb}.genui-ring{display:inline-flex;gap:8px;align-items:center}.genui-ring svg{width:40px;height:40px;flex:none;color:#2563eb}
+.genui-positive{color:#059669}.genui-negative{color:#dc2626}.genui-table tfoot{font-weight:600}.genui-table th[aria-sort=ascending] button::after{content:' ↑'}.genui-table th[aria-sort=descending] button::after{content:' ↓'}
+.genui-tree{list-style:none;padding-left:16px;border-left:1px solid #8884}.genui-diff{margin:10px 0}.genui-diff section{min-width:0}.genui-diff pre{white-space:pre;overflow:auto}.genui-diff .genui-grid{gap:12px;margin-top:8px}@media(max-width:520px){.genui-diff .genui-grid{grid-template-columns:1fr}}

package/public/genui.js

@@ -11,13 +11,32 @@
   const color = (value, i) => /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i.test(value || '') ? value : palette[i % palette.length]
   const raw = value => '<pre><code>' + esc(typeof value === 'string' ? value : JSON.stringify(value, null, 2)) + '</code></pre>'
   const details = value => '<details class="genui-source"><summary>JSON / 源码</summary>' + raw(value) + '</details>'
+  let uid = 0
+  function spark(values) {
+    if (!Array.isArray(values) || values.length < 2 || values.length > 100 || !values.every(number)) return ''
+    const low = Math.min(...values), span = Math.max(...values) - low || 1
+    return '<svg class="genui-spark" viewBox="0 0 120 30" role="img" aria-label="趋势"><title>' + esc(values.join(', ')) + '</title><polyline fill="none" stroke="currentColor" stroke-width="2" points="' + values.map((v, i) => (2 + i * 116 / (values.length - 1)) + ',' + (28 - (v - low) / span * 26)).join(' ') + '"/></svg>'
+  }
+  function ring(value, label) {
+    const pct = Math.max(0, Math.min(100, value))
+    return '<span class="genui-ring"><svg viewBox="0 0 40 40" aria-hidden="true"><circle cx="20" cy="20" r="16" fill="none" stroke="currentColor" opacity=".15" stroke-width="4"/><circle cx="20" cy="20" r="16" fill="none" stroke="currentColor" stroke-width="4" pathLength="100" stroke-dasharray="' + pct + ' 100" transform="rotate(-90 20 20)"/></svg><span>' + esc(label) + '</span></span>'
+  }
+  function numeric(value) {
+    if (typeof value === 'number') return Number.isFinite(value) ? value : NaN
+    let s = String(value ?? '').trim().replace(/^[¥$€£]/, '').replace(/%$/, '')
+    if (!s) return NaN
+    let factor = 1
+    const unit = s.slice(-1).toLowerCase()
+    if ('kmb万亿'.includes(unit)) { factor = ({ k: 1e3, m: 1e6, b: 1e9, 万: 1e4, 亿: 1e8 })[unit]; s = s.slice(0, -1) }
+    return s.trim() ? Number(s.replace(/[,，\s]/g, '')) * factor : NaN
+  }
   function unsupported(node, reason) {
     return '<div class="genui-unsupported">暂不支持 / Unsupported: ' + esc(reason || node?.type || 'spec') + details(node) + '</div>'
   }
 
   function chart(node) {
     const kind = node.kind || 'bars'
-    if (!['bars', 'line', 'donut'].includes(kind) || node.stacked || node.filter || node.sortField) return unsupported(node, 'chart options')
+    if (!['bars', 'line', 'donut'].includes(kind) || (node.stacked && kind !== 'bars') || node.filter || node.sortField) return unsupported(node, 'chart options')
     const series = array(node.series).length ? node.series : [{ label: node.title || '', data: node.data }]
     if (series.length > 6 || (kind === 'donut' && series.length !== 1)) return unsupported(node, 'chart series')
     if (series.some(s => !s || !Array.isArray(s.data) || !s.data.length || s.data.length > 100 || s.data.some(d => !d || !number(d.value)))) return unsupported(node, 'chart data')
@@ -40,6 +59,11 @@
       svg += '<div class="genui-legend">' + data.map((d, i) => '<span><i style="background:' + color(d.color || array(node.palette)[i], i) + '"></i>' + esc(d.label) + ' · ' + (d.value / total * 100).toFixed(1) + '%</span>').join('') + '</div>'
     } else {
       const values = series.flatMap(s => s.data.map(d => d.value))
+      const stacked = node.stacked === true && kind === 'bars'
+      if (stacked) data.forEach((_, i) => {
+        values.push(series.reduce((sum, s) => sum + Math.max(0, s.data[i].value), 0))
+        values.push(series.reduce((sum, s) => sum + Math.min(0, s.data[i].value), 0))
+      })
       let min = Math.min(0, ...values), max = Math.max(0, ...values)
       if (min === max) max = min + 1
       const horizontal = kind === 'bars' && node.horizontal === true
@@ -57,14 +81,15 @@
       series.forEach((s, si) => {
         const points = []
         s.data.forEach((d, i) => {
-          const center = (horizontal ? top : left) + step * (i + 0.5), pos = scale(d.value)
+          const base = stacked ? series.slice(0, si).reduce((sum, prev) => sum + (d.value >= 0 ? Math.max(0, prev.data[i].value) : Math.min(0, prev.data[i].value)), 0) : 0
+          const center = (horizontal ? top : left) + step * (i + 0.5), pos = scale(base + d.value)
           const hint = '<title>' + esc((s.label ? s.label + ' · ' : '') + d.label + ': ' + d.value) + '</title>'
           if (kind === 'line') {
             points.push(center + ',' + pos)
             svg += '<circle cx="' + center + '" cy="' + pos + '" r="3" fill="' + colors[si] + '">' + hint + '</circle>'
           } else {
-            const size = step * 0.7 / series.length, lane = center - step * 0.35 + si * size
-            const zero = scale(0)
+            const size = step * 0.7 / (stacked ? 1 : series.length), lane = center - step * 0.35 + (stacked ? 0 : si * size)
+            const zero = scale(base)
             svg += '<rect x="' + (horizontal ? Math.min(zero, pos) : lane) + '" y="' + (horizontal ? lane : Math.min(zero, pos)) + '" width="' + (horizontal ? Math.abs(zero - pos) : size) + '" height="' + (horizontal ? size : Math.abs(zero - pos)) + '" fill="' + (series.length === 1 ? color(d.color || array(node.palette)[i], i) : colors[si]) + '">' + hint + '</rect>'
           }
         })
@@ -85,9 +110,38 @@
     if (!spec || typeof spec !== 'object') throw Error('Invalid spec')
     let count = 0
     function nodes(items, depth) { return array(items).map(n => node(n, depth)).join('') }
+    function fileTree(items, depth) {
+      if (depth > 12 || (count += array(items).length) > 240) throw Error('Component limit')
+      return '<ul class="genui-tree">' + array(items).map(v => !v || typeof v !== 'object' ? '<li>' + esc(v) + '</li>' : '<li>' + (v.type === 'dir' || Array.isArray(v.children) ? '<details open><summary>' + esc(v.name) + '</summary>' + fileTree(v.children, depth + 1) + '</details>' : '<span>' + esc(v.name) + '</span>') + '</li>').join('') + '</ul>'
+    }
+    function table(n, depth) {
+      const columns = array(n.columns), rows = array(n.rows), types = array(n.types)
+      if (!columns.length || rows.some(r => !Array.isArray(r)) || types.some(t => !['text', 'num', 'delta', 'bar', 'badge', 'spark', 'ring', 'index'].includes(t))) return unsupported(n, 'table shape/types')
+      const cell = (v, type, i) => {
+        const num = numeric(v)
+        if (type === 'index') return String(i + 1)
+        if (type === 'spark') return spark(String(v).split(/[\s,;]+/).map(Number)) || esc(v)
+        if (type === 'ring' && Number.isFinite(num)) return ring(num, v)
+        if (type === 'bar' && Number.isFinite(num)) return '<span>' + esc(v) + '</span><progress max="100" value="' + Math.max(0, Math.min(100, num)) + '"></progress>'
+        if (type === 'badge') return '<span class="genui-badge">' + esc(v) + '</span>'
+        if (type === 'delta') return '<span class="genui-' + (num > 0 ? 'positive' : num < 0 ? 'negative' : 'neutral') + '">' + esc(v) + '</span>'
+        return esc(v)
+      }
+      let foot = ''
+      if (n.total) foot = '<tfoot><tr>' + columns.map((_, j) => {
+        const values = rows.map(r => numeric(r[j]))
+        return '<td>' + (j === 0 ? '合计 / Total' : values.length && values.every(Number.isFinite) && !['index', 'spark', 'ring', 'bar'].includes(types[j]) ? esc(Number(values.reduce((a, b) => a + b, 0).toPrecision(12))) : '') + '</td>'
+      }).join('') + '</tr></tfoot>'
+      return '<div class="genui-scroll"><table class="genui-table"><thead><tr>' + columns.map((v, j) => '<th aria-sort="none"><button type="button" data-genui-sort="' + j + '">' + esc(v) + ' ↕</button></th>').join('') + '</tr></thead>' + rows.map((r, i) => '<tbody data-genui-order="' + i + '"><tr>' + columns.map((_, j) => '<td data-genui-value="' + esc(r[j]) + '">' + cell(r[j], types[j], i) + '</td>').join('') + '</tr>' + (array(n.details?.[i]).length ? '<tr><td colspan="' + columns.length + '"><details><summary>详情 / Details</summary>' + nodes(n.details[i], depth + 1) + '</details></td></tr>' : '') + '</tbody>').join('') + foot + '</table></div>' + (n.export ? '<details><summary>导出数据 / CSV</summary>' + raw([columns, ...rows].map(r => r.map(v => '"' + String(v ?? '').replace(/"/g, '""') + '"').join(',')).join('\n')) + '</details>' : '')
+    }
     function node(n, depth) {
       if (++count > 240 || depth > 12) throw Error('Component limit')
       if (!n || typeof n !== 'object' || Array.isArray(n)) return unsupported(n)
+      // 插件公开的常用字段别名。
+      n = { ...n }
+      if (n.type === 'text' && n.content === undefined) n.content = n.text
+      if (n.type === 'table') { n.columns ??= n.headers; n.rows ??= n.data }
+      if (n.type === 'card') { n.title ??= n.label; n.items ??= n.content }
       const type = n.type
       // Reject data-transforming options rather than silently displaying different data.
       if (n.filter || n.sortField) return unsupported(n, type + ' filter/sort')
@@ -98,21 +152,33 @@
         return '<section class="genui-' + type + '"' + (type === 'grid' ? ' style="--genui-cols:' + cols + '"' : '') + '>' + (n.title ? '<h4>' + esc(n.title) + '</h4>' : '') + nodes(n.items, depth + 1) + '</section>'
       }
       if (type === 'text') { const tag = ['h1', 'h2', 'h3'].includes(n.size) ? n.size : 'p'; return '<' + tag + '>' + esc(n.content) + '</' + tag + '>' }
-      if (type === 'hero') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><h4>' + esc(n.title) + '</h4><span>' + esc(n.subtitle) + '</span><span>' + esc(n.delta) + '</span></div>'
-      if (type === 'stat') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><span>' + esc(n.delta) + '</span></div>'
+      if (type === 'hero') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><h4>' + esc(n.title) + '</h4><span>' + esc(n.subtitle) + '</span><span>' + esc(n.delta) + '</span>' + spark(n.spark) + '</div>'
+      if (type === 'stat') return '<div class="genui-stat"><small>' + esc(n.label) + '</small><strong>' + esc(n.value) + '</strong><span>' + esc(n.delta) + '</span>' + spark(n.spark) + '</div>'
       if (type === 'badge') return '<span class="genui-badge">' + esc(n.label) + '</span>'
       if (type === 'divider') return '<hr>'
       if (type === 'spacer') return '<div class="genui-spacer"></div>'
       if (type === 'progress' && !number(n.value)) return unsupported(n, 'progress value')
+      if (type === 'progress' && n.variant === 'ring') return '<div>' + esc(n.label) + ring(n.value, n.valueLabel || n.value + '%') + (number(n.target) ? '<small>目标 / Target: ' + esc(n.target) + '%</small>' : '') + '</div>'
       if (type === 'progress') return '<div>' + esc(n.label) + '<progress max="100" value="' + Math.max(0, Math.min(100, Number(n.value) || 0)) + '"></progress><small>' + esc(n.valueLabel || String(n.value || 0) + '%') + '</small>' + (number(n.target) ? '<small> · 目标 / Target: ' + esc(n.target) + '%</small>' : '') + '</div>'
       if (type === 'callout') return '<aside class="genui-callout"><strong>' + esc(n.title) + '</strong><p>' + esc(n.content) + '</p></aside>'
       if (type === 'code' || type === 'json') return raw(type === 'code' ? n.code : n.value)
       if (type === 'list' || type === 'timeline' || type === 'steps') return '<ul>' + array(n.items || n.steps).slice(0, 100).map(v => '<li>' + (v && typeof v === 'object' ? (v.type ? node(v, depth + 1) : '<strong>' + esc(v.title) + '</strong> ' + esc(v.desc) + ' ' + esc(v.time)) : esc(v)) + '</li>').join('') + '</ul>'
       if (type === 'keyvalue') return '<dl>' + array(n.pairs).slice(0, 100).map(v => '<dt>' + esc(v?.key) + '</dt><dd>' + esc(v?.value) + '</dd>').join('') + '</dl>'
-      if (type === 'table') return '<div class="genui-scroll"><table><thead><tr>' + array(n.columns).slice(0, 30).map(v => '<th>' + esc(v) + '</th>').join('') + '</tr></thead><tbody>' + array(n.rows).slice(0, 200).map(row => '<tr>' + array(row).slice(0, 30).map(v => '<td>' + esc(v) + '</td>').join('') + '</tr>').join('') + '</tbody></table></div>'
+      if (type === 'table') return table(n, depth)
+      if (type === 'file-tree') return fileTree(n.items, depth + 1)
+      if (type === 'breadcrumb') return '<nav aria-label="路径">' + array(n.items).map(esc).join(' › ') + '</nav>'
+      if (type === 'avatar') return '<span class="genui-badge">' + esc(n.name) + '</span>'
+      if (type === 'diff') {
+        if (array(n.diffs).length > 30) return unsupported(n, 'diff size limit')
+        return array(n.diffs).map(d => '<details class="genui-diff" open><summary>' + esc(d?.path) + '</summary><div class="genui-grid">' + (d?.oldText == null ? '<section>新增文件 / New file</section>' : '<section><strong>修改前 / Before</strong>' + raw(d.oldText) + '</section>') + '<section><strong>修改后 / After</strong>' + raw(d?.newText) + '</section></div></details>').join('')
+      }
       if (type === 'chart') return chart(n)
       if (type === 'echart' && !n.option && ['bar', 'line', 'pie'].includes(n.preset)) return '<small>ECharts 基础数据预览 / Basic preview</small>' + chart({ ...n, type: 'chart', kind: { bar: 'bars', line: 'line', pie: 'donut' }[n.preset] })
-      if (type === 'accordion' || type === 'tabs') return array(n.tabs || n.items).slice(0, 30).map(v => '<details><summary>' + esc(v?.label || v?.title) + '</summary>' + nodes(v?.items, depth + 1) + '</details>').join('')
+      if (type === 'tabs') {
+        const id = 'genui-tabs-' + (++uid), tabs = array(n.tabs).slice(0, 30)
+        return '<div class="genui-tabs"><div role="tablist" aria-label="' + esc(n.title || '标签页') + '">' + tabs.map((v, i) => '<button type="button" role="tab" id="' + id + '-tab-' + i + '" aria-controls="' + id + '-panel-' + i + '" aria-selected="' + (i === 0) + '" tabindex="' + (i === 0 ? 0 : -1) + '" data-genui-tab="' + i + '">' + esc(v?.label) + '</button>').join('') + '</div>' + tabs.map((v, i) => '<div role="tabpanel" id="' + id + '-panel-' + i + '" aria-labelledby="' + id + '-tab-' + i + '"' + (i ? ' hidden' : '') + '>' + nodes(v?.items || v?.content, depth + 1) + '</div>').join('') + '</div>'
+      }
+      if (type === 'accordion') return array(n.items).slice(0, 30).map(v => '<details><summary>' + esc(v?.title) + '</summary>' + nodes(v?.items, depth + 1) + '</details>').join('')
       return unsupported(n)
     }
     const body = Array.isArray(spec) ? nodes(spec, 0) : spec.type ? node(spec, 0) : nodes(spec.items, 0)
@@ -140,5 +206,49 @@
     const srcDoc = '<!doctype html><html><head><meta http-equiv="Content-Security-Policy" content="' + policy + '"><meta name="viewport" content="width=device-width,initial-scale=1"><style>body{font:14px/1.6 system-ui;margin:16px;overflow-wrap:anywhere}table{border-collapse:collapse}td,th{padding:6px;border:1px solid #ccc}pre{white-space:pre-wrap}*{max-width:100%;box-sizing:border-box}</style></head><body>' + template.innerHTML + '</body></html>'
     return '<section class="genui"><div class="genui-caption">HTML · 只读预览（脚本及外部资源已禁用）</div><iframe class="genui-html" sandbox="" referrerpolicy="no-referrer" title="HTML preview" srcdoc="' + esc(srcDoc) + '"></iframe></section>'
   }
-  return { render, html }
+  function activateTab(button, focus = false) {
+    const list = button.parentElement, tabs = Array.from(list.children)
+    tabs.forEach(tab => {
+      const active = tab === button
+      tab.setAttribute('aria-selected', String(active)); tab.tabIndex = active ? 0 : -1
+      const panel = Array.from(list.parentElement.children).find(p => p.id === tab.getAttribute('aria-controls'))
+      if (panel) panel.hidden = !active
+    })
+    if (focus) button.focus()
+  }
+  function compareCells(a, b) {
+    const x = numeric(a), y = numeric(b)
+    if (Number.isFinite(x) && Number.isFinite(y)) return x - y
+    if (Number.isFinite(x)) return -1
+    if (Number.isFinite(y)) return 1
+    return String(a ?? '').localeCompare(String(b ?? ''))
+  }
+  if (typeof document !== 'undefined') {
+    document.addEventListener('click', event => {
+      const button = event.target.closest?.('.genui button')
+      if (!button) return
+      if (button.hasAttribute('data-genui-tab')) activateTab(button)
+      if (button.hasAttribute('data-genui-sort')) {
+        const table = button.closest('table'), th = button.parentElement
+        const col = Number(button.dataset.genuiSort)
+        const previous = th.getAttribute('aria-sort'), direction = previous === 'ascending' ? 'descending' : previous === 'descending' ? 'none' : 'ascending'
+        Array.from(table.tHead.rows[0].cells).forEach(cell => cell.setAttribute('aria-sort', 'none'))
+        th.setAttribute('aria-sort', direction)
+        Array.from(table.tBodies).sort((a, b) => {
+          const order = Number(a.dataset.genuiOrder) - Number(b.dataset.genuiOrder)
+          if (direction === 'none') return order
+          const compared = compareCells(a.rows[0].cells[col]?.dataset.genuiValue, b.rows[0].cells[col]?.dataset.genuiValue)
+          return (direction === 'ascending' ? compared : -compared) || order
+        }).forEach(body => table.insertBefore(body, table.tFoot))
+      }
+    })
+    document.addEventListener('keydown', event => {
+      const button = event.target.closest?.('.genui [data-genui-tab]')
+      if (!button || !['ArrowLeft', 'ArrowRight', 'Home', 'End'].includes(event.key)) return
+      const tabs = Array.from(button.parentElement.children), i = tabs.indexOf(button)
+      const next = event.key === 'Home' ? 0 : event.key === 'End' ? tabs.length - 1 : (i + (event.key === 'ArrowRight' ? 1 : -1) + tabs.length) % tabs.length
+      event.preventDefault(); activateTab(tabs[next], true)
+    })
+  }
+  return { render, html, compareCells }
 })

package/public/update.json

@@ -1,10 +1,14 @@
 {
-  "version": "0.6.25",
+  "version": "0.6.26",
   "apkUrl": "dsh-remote.apk",
-  "sha256": "56e3aa905bcc4a746c604af7b09a5bfe50c21deafd1b04756a345bd03cc44828",
-  "releasedAt": "2026-09-16T06:56:53.046Z",
-  "notes": "0.6.25：适配 DSH 0.1.5 的实时思考、文件消息与 V3 会话统计；修复 Windows 跨盘文件访问和空会话持久归档；完善 APK 下载进度与校验；新增 dsh-ui 常用组件及柱状图、折线图、环形图只读预览，HTML 代码块支持隔离预览，未支持的高级组件保留原始规格。",
+  "sha256": "5b60977e3960d65b1ab60cb9f168835c8de927113738d925881340749122d2aa",
+  "releasedAt": "2026-09-16T16:59:10.029Z",
+  "notes": "0.6.26：修复 DSH 通配监听地址导致的认证与实时连接失败，兼容 IPv6-only；上传覆盖失败保留原文件，避免并发同名覆盖和续传分片竞争；网关改用认证关闭，避免误杀其他进程；完善 dsh-ui 堆叠柱状图、标签页、表格排序与特殊单元格、趋势线、环形进度、文件树和修改前后预览。已通过 Windows 自动测试与浏览器检查，Linux/Docker 专项实测仍待完成。",
   "history": [
+    {
+      "version": "0.6.26",
+      "notes": "0.6.26：修复 DSH 通配监听地址导致的认证与实时连接失败，兼容 IPv6-only；上传覆盖失败保留原文件，避免并发同名覆盖和续传分片竞争；网关改用认证关闭，避免误杀其他进程；完善 dsh-ui 堆叠柱状图、标签页、表格排序与特殊单元格、趋势线、环形进度、文件树和修改前后预览。已通过 Windows 自动测试与浏览器检查，Linux/Docker 专项实测仍待完成。"
+    },
     {
       "version": "0.6.25",
       "notes": "0.6.25：适配 DSH 0.1.5 的实时思考、文件消息与 V3 会话统计；修复 Windows 跨盘文件访问和空会话持久归档；完善 APK 下载进度与校验；新增 dsh-ui 常用组件及柱状图、折线图、环形图只读预览，HTML 代码块支持隔离预览，未支持的高级组件保留原始规格。"
@@ -40,10 +44,6 @@
     {
       "version": "0.6.17",
       "notes": "0.6.17：修复 host.describe 初次失败后总览误报 DSH 上游离线并增加恢复重试；识别 Docker、无 systemd 和插件内嵌等外部生命周期环境，隐藏不可用的 DSH 启停并给出明确提示；兼容 Caddy Basic Auth，避免管理 API 覆盖 Authorization 导致登录循环；支持通过环境变量或管理页手动补充 Docker 宿主、局域网和 Tailscale 地址并写入配对二维码；完整适配 Windows 盘符、UNC、多文件根和跨主机文件路径清理，并新增 Windows 原生 CI 安全门禁。"
-    },
-    {
-      "version": "0.6.16",
-      "notes": "0.6.16：Windows 端 DSH 服务启动/重启接入 Windows Service（实验性功能），启动后继续检查 DSH HTTP 与 mux/host 实时通道；空对话退出时清理 App 本地残留；网关控制台主机 IP 改为可逐项启用的地址表，关闭地址不再进入配对二维码、诊断和防火墙建议；Android 设置新增模型配置、自定义模型思考深度档位和小米/系统 ASR 功能测试，支持复制设备、权限、partial/final、session 重建和错误诊断日志。"
     }
   ]
 }

package/public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.6.25"
+  "version": "0.6.26"
 }