dsh-remote-plugin 0.6.4 → 0.6.6

package/README.en.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add "github:Blank-not-black/dsh-Remote#main&path:/packa
 - On/off intent persists in `~/.dsh-remote/gateway.enabled`; it can be stopped/started from the drawer.
 - Token lives in `~/.dsh-remote/token` (auto-generated on first run, reused and never overwritten), shown in the drawer and copyable; supports **QR pairing** and **one-click rotation**.
 - Env var `DSH_REMOTE_AUTOSTART=0` disables auto management.
-- File endpoints: `/fs/list` (list directory), `/fs/file` (download with Range support), `/fs/upload` (chunked resume with pause/cancel, SHA-256 verified before writing to disk); default root is `~`, and `DSH_REMOTE_FS_ROOT` opens multiple roots (`:`-separated).
+- File endpoints: `/fs/list` (list directory), `/fs/file` (download with Range support), `/fs/upload` (chunked resume with pause/cancel, SHA-256 verified before writing to disk); default root is `~`, and `DSH_REMOTE_FS_ROOT` opens multiple roots (`:` on Linux/macOS, `;` on Windows).
 - Feedback endpoint: `POST /feedback` (the app / desktop "Write feedback" dialog), forwarded by the gateway to the feedback collector; default `http://100.84.128.29/submit` (Tailscale internal network), overridable via `DSH_REMOTE_FEEDBACK_URL` — no tokens to configure.
 
 ## Mobile App

package/README.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add "github:Blank-not-black/dsh-Remote#main&path:/packa
 - 开关持久化在 `~/.dsh-remote/gateway.enabled`；抽屉内可停止/启动。
 - 令牌在 `~/.dsh-remote/token`（首次自动生成，重复使用不覆盖），抽屉里显示并可复制；支持**二维码扫码配对**与**一键轮换**。
 - 环境变量 `DSH_REMOTE_AUTOSTART=0` 可关闭自动管理。
-- 文件端点：`/fs/list`（列目录）、`/fs/file`（下载，支持 Range）、`/fs/upload`（分块续传，支持暂停/取消，落盘前 SHA-256 校验）；默认根目录 `~`，`DSH_REMOTE_FS_ROOT` 可开多根（`:` 分隔）。
+- 文件端点：`/fs/list`（列目录）、`/fs/file`（下载，支持 Range）、`/fs/upload`（分块续传，支持暂停/取消，落盘前 SHA-256 校验）；默认根目录 `~`，`DSH_REMOTE_FS_ROOT` 可开多根（Linux/macOS 用 `:`，Windows 用 `;` 分隔）。
 - 反馈端点：`POST /feedback`（App / 桌面端「写反馈」），网关转发到反馈收集器；默认 `http://100.84.128.29/submit`（Tailscale 内网），可用 `DSH_REMOTE_FEEDBACK_URL` 覆盖，无需配置任何 token。
 
 ## 手机 App

package/gateway-stats.cjs

@@ -247,7 +247,11 @@ class StatsStore {
 
     const model = eventModel(event) || fallbackModel || 'unknown'
     const { date, hour, period } = eventKey(time)
-    if (date < PRICING_START_DATE) return { processed: false, gap: false, skip: true }
+    if (date < PRICING_START_DATE) {
+      // 定价生效日前的事件不计费，但必须推进游标；否则生效日后的第一条事件会被误判为 gap。
+      this._setCursor(sessionId, seq)
+      return { processed: false, gap: false, skip: true }
+    }
     const day = this._loadDay(date)
     const hourBucket = day.hours[hour] || (day.hours[hour] = {})
     const modelBucket = hourBucket[model] || (hourBucket[model] = emptyBucket())
@@ -267,10 +271,13 @@ class StatsStore {
    * 用系统 zstd 命令解压(项目约束: 不新增 npm 运行时依赖; Windows 无 zstd 时跳过)。
    */
   scanFile(file, onProgress) {
+    return this._enqueue(() => this._scanFile(file, onProgress))
+  }
+
+  _scanFile(file, onProgress) {
     return new Promise((resolvePromise) => {
       const sessionId = path.basename(path.dirname(file))
       const cur = this._cursor(sessionId)
-      const startSeq = cur ? cur.lastSeq + 1 : 0
       let lastSeq = cur ? cur.lastSeq : -1
       let processed = 0
       let currentModel = ''

package/gateway.cjs

@@ -18,13 +18,14 @@
  *   DSH_UPSTREAM  DSH web 服务地址, 默认 http://127.0.0.1:3080
  *   TOKEN       访问令牌; 不设置则读 TOKEN_FILE, 仍没有则自动生成
  *   TOKEN_FILE  令牌文件, 默认 ~/.dsh-remote/token
- *   DSH_REMOTE_FS_ROOT       文件传输允许根, 默认 ~, 多个用 ':' 分隔
+ *   DSH_REMOTE_FS_ROOT       文件传输允许根, 默认 ~, 使用系统路径分隔符配置多根
  *   DSH_REMOTE_FS_MAX_UPLOAD 上传字节上限, 默认 2147483648 (2GB)
  */
 'use strict'
 
 const http = require('node:http')
 const https = require('node:https')
+const { execFile } = require('node:child_process')
 const fs = require('node:fs')
 const path = require('node:path')
 const os = require('node:os')
@@ -43,10 +44,12 @@ const ROOT = __dirname
 const PUBLIC_DIR = path.join(ROOT, 'public')
 const PORT = Number(process.env.PORT) || 8787
 const HOST = process.env.HOST || '0.0.0.0'
+const WS_IDLE_MS = Number(process.env.GATEWAY_WS_IDLE_MS) || 60000
 const UPSTREAM = new URL(process.env.DSH_UPSTREAM || 'http://127.0.0.1:3080')
 const TOKEN_FILE = process.env.TOKEN_FILE || path.join(os.homedir(), '.dsh-remote', 'token')
 const NOTES_FILE = process.env.DSH_REMOTE_NOTES || path.join(os.homedir(), '.dsh-remote', 'device-notes.json')
 const STARTED_AT = Date.now()
+const DSH_SERVICE = String(process.env.DSH_REMOTE_DSH_SERVICE || 'dsh-web').trim()
 
 // 更新检查: GitHub 为默认源, 可用环境变量覆盖(国内镜像 / 代理)
 const UPDATE_CHECK_URL = process.env.UPDATE_CHECK_URL ||
@@ -81,12 +84,13 @@ const MIME = {
 }
 
 // ---------- /fs 文件传输 ----------
-// 允许访问的根目录: DSH_REMOTE_FS_ROOT 用 ':' 分隔多个根, 默认仅 ~。
+// 允许访问的根目录: DSH_REMOTE_FS_ROOT 使用系统路径分隔符分隔多个根,
+// POSIX 为 ':'、Windows 为 ';'；默认仅 ~。
 // 所有 /fs/* 路径 resolve 后都必须位于某个根内, 已存在的路径还会用 realpath
 // 复核一次, 防止 ../ 穿越与符号链接逃逸。
 const FS_DEFAULT_ROOT = path.resolve(os.homedir())
 const FS_ROOTS = (process.env.DSH_REMOTE_FS_ROOT || FS_DEFAULT_ROOT)
-  .split(':')
+  .split(path.delimiter)
   .filter(Boolean)
   .map(r => path.resolve(r.trim() === '~' ? FS_DEFAULT_ROOT : r.trim()))
 const FS_MAX_UPLOAD = Number(process.env.DSH_REMOTE_FS_MAX_UPLOAD) || 2 * 1024 * 1024 * 1024
@@ -306,7 +310,9 @@ function httpGetJson(url, cb) {
   const isHttps = u.protocol === 'https:'
   const lib = isHttps ? https : http
   const proxyEnv = process.env.UPDATE_PROXY ||
-    (isHttps ? process.env.HTTPS_PROXY : process.env.HTTP_PROXY) || ''
+    (isHttps
+      ? (process.env.HTTPS_PROXY || process.env.https_proxy)
+      : (process.env.HTTP_PROXY || process.env.http_proxy)) || ''
   const done = (err, value) => { if (settled) return; settled = true; cb(err, value) }
   let settled = false
   const timer = setTimeout(() => done(new Error('检查超时')), 6000)
@@ -412,6 +418,109 @@ function cors(res) {
   res.setHeader('access-control-allow-methods', 'GET, POST, OPTIONS')
 }
 
+function readBody(req, maxBytes = 64 * 1024) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    let settled = false
+    req.on('data', chunk => {
+      if (settled) return
+      size += chunk.length
+      if (size > maxBytes) {
+        settled = true
+        reject(new Error('request body too large'))
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (settled) return
+      settled = true
+      resolve(Buffer.concat(chunks).toString('utf8'))
+    })
+    req.on('error', err => {
+      if (settled) return
+      settled = true
+      reject(err)
+    })
+  })
+}
+
+function execFileResult(file, args, timeout = 5000) {
+  return new Promise((resolvePromise) => {
+    execFile(file, args, { timeout, windowsHide: true }, (error, stdout, stderr) => {
+      resolvePromise({
+        ok: !error,
+        code: error?.code ?? 0,
+        stdout: String(stdout || '').trim(),
+        stderr: String(stderr || '').trim(),
+      })
+    })
+  })
+}
+
+async function dshServiceStatus() {
+  if (process.platform === 'win32') {
+    return { ok: true, supported: false, running: false, service: DSH_SERVICE, message: 'Windows 请配置 DSH_REMOTE_DSH_SERVICE 后接入任务计划程序' }
+  }
+  if (!/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
+    return { ok: false, supported: false, running: false, service: DSH_SERVICE, message: '服务名配置不合法' }
+  }
+  const r = await execFileResult('systemctl', ['--user', 'is-active', DSH_SERVICE], 3000)
+  return { ok: true, supported: true, running: r.stdout === 'active', service: DSH_SERVICE, state: r.stdout || 'unknown', detail: r.stderr || '' }
+}
+
+async function serveDshControl(req, res, url) {
+  if (req.method === 'OPTIONS') {
+    cors(res)
+    res.writeHead(204)
+    res.end()
+    return
+  }
+  if (!authorized(req, url)) {
+    authFailures++
+    touchDevice(req, { failedAuth: true })
+    cors(res)
+    res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ error: 'unauthorized' }))
+    return
+  }
+  touchDevice(req, { kind: 'admin' })
+  if (req.method === 'GET') {
+    cors(res)
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+    res.end(JSON.stringify(await dshServiceStatus()))
+    return
+  }
+  if (req.method !== 'POST') {
+    cors(res)
+    res.writeHead(405, { allow: 'GET, POST' })
+    res.end()
+    return
+  }
+  let body = {}
+  try { body = JSON.parse((await readBody(req, 4096)) || '{}') } catch {}
+  const action = body?.action
+  if (action !== 'start' && action !== 'restart') {
+    cors(res)
+    res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: false, error: 'action 必须是 start 或 restart' }))
+    return
+  }
+  if (process.platform === 'win32' || !/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
+    cors(res)
+    res.writeHead(501, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: false, supported: false, error: '当前系统未配置可控的 dsh-web 服务', service: DSH_SERVICE }))
+    return
+  }
+  const r = await execFileResult('systemctl', ['--user', action, DSH_SERVICE], 10000)
+  const status = await dshServiceStatus()
+  cors(res)
+  res.writeHead(r.ok ? 200 : 502, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(JSON.stringify({ ...status, ok: r.ok, action, detail: r.stderr || r.stdout || '' }))
+}
+
 // ---------- 事件轮询缓冲 ----------
 // 网关自己维护到 DSH 的 mux/host WebSocket，把事件写入内存环形缓冲；
 // 前端在 WebSocket 被隧道/受限网络阻断时改走 GET /api/events.poll 增量拉取。
@@ -419,6 +528,10 @@ const EVENT_BUFFER_MAX = 300
 const EVENT_MAX_STRING = 16 * 1024
 const eventBuffers = { mux: [], host: [] }
 const eventNextSeq = { mux: 1, host: 1 }
+const eventCollectorState = {
+  mux: { connected: false, lastEventAt: 0, lastConnectAt: 0, reconnects: 0, lastError: '' },
+  host: { connected: false, lastEventAt: 0, lastConnectAt: 0, reconnects: 0, lastError: '' },
+}
 
 /** 递归截断超大字段，避免单条超大事件撑爆环形缓冲。 */
 function truncateEventValue(v, depth = 0) {
@@ -437,6 +550,7 @@ function truncateEventValue(v, depth = 0) {
 
 function pushEvent(kind, full) {
   if (!eventBuffers[kind] || !full || typeof full !== 'object') return
+  if (eventCollectorState[kind]) eventCollectorState[kind].lastEventAt = Date.now()
   const buf = eventBuffers[kind]
   buf.push({ seq: eventNextSeq[kind]++, ts: Date.now(), event: truncateEventValue(full) })
   if (buf.length > EVENT_BUFFER_MAX) buf.shift()
@@ -487,6 +601,7 @@ function serveEventPoll(req, res, url) {
 /** 网关自带上游事件采集：mux/host 各一条 WS，断线自动重连。 */
 function startEventCollector(kind) {
   if (typeof WebSocket !== 'function') return null
+  const state = eventCollectorState[kind]
   let ws = null
   let stopped = false
   let retryTimer = null
@@ -500,6 +615,11 @@ function startEventCollector(kind) {
       return
     }
     ws.onopen = () => {
+      if (state) {
+        state.connected = true
+        state.lastConnectAt = Date.now()
+        state.lastError = ''
+      }
       if (stopped) { try { ws.close() } catch {} }
     }
     ws.onmessage = (ev) => {
@@ -510,10 +630,17 @@ function startEventCollector(kind) {
       } catch {}
     }
     ws.onclose = () => {
+      if (state) {
+        state.connected = false
+        state.reconnects++
+      }
       ws = null
       if (!stopped) retryTimer = setTimeout(connect, 3000)
     }
-    ws.onerror = () => { try { ws.close() } catch {} }
+    ws.onerror = (err) => {
+      if (state) state.lastError = String(err?.message || 'websocket error')
+      try { ws.close() } catch {}
+    }
   }
   connect()
   return {
@@ -817,6 +944,7 @@ function upstreamReachable(cb) {
 
 function serveAdminApi(req, res, url) {
   const sub = url.pathname.slice('/admin/api'.length) || '/'
+  if (sub === '/dsh') return serveDshControl(req, res, url)
   if (sub === '/state' && req.method === 'GET') {
     if (!authorized(req, url)) {
       authFailures++
@@ -1371,6 +1499,37 @@ function fsUploadProbe(req, res, url) {
   })
 }
 
+/** POST /fs/mkdir?path=<parent>&name=<directory> 创建一个工作区目录。 */
+function fsMkdir(req, res, url) {
+  if (req.method !== 'POST') {
+    res.writeHead(405, { allow: 'POST' })
+    res.end()
+    return
+  }
+  if (!fsAuthorized(req, url, res)) return
+  touchDevice(req)
+  const resolved = fsResolve(url.searchParams.get('path') ?? '')
+  if (resolved.error) return fsJson(res, resolved.error === 'forbidden' ? 403 : 404, { error: resolved.error })
+  const checked = fsRealChecked(resolved.abs)
+  if (checked.error) return fsJson(res, checked.error === 'forbidden' ? 403 : 404, { error: checked.error })
+  try {
+    if (!fs.statSync(checked.abs).isDirectory()) return fsJson(res, 400, { error: 'not-a-directory' })
+  } catch (err) {
+    return fsJson(res, err.code === 'ENOENT' ? 404 : 403, { error: err.code === 'ENOENT' ? 'not-found' : 'permission-denied' })
+  }
+
+  const name = url.searchParams.get('name') || ''
+  if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '目录名不能为空且不能包含路径分隔符' })
+  const target = path.join(checked.abs, name)
+  try {
+    fs.mkdirSync(target)
+  } catch (err) {
+    if (err.code === 'EEXIST') return fsJson(res, 409, { error: 'exists' })
+    return fsJson(res, ['EACCES', 'EPERM', 'EROFS'].includes(err.code) ? 403 : 400, { error: 'mkdir-failed', detail: err.message })
+  }
+  fsJson(res, 201, { ok: true, name, path: path.join(resolved.abs, name) })
+}
+
 function fsUploadResumable(req, res, url, dirLex, dirReal) {
   const name = url.searchParams.get('name') || ''
   if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '文件名不能为空且不能包含路径分隔符' })
@@ -1551,6 +1710,7 @@ function serveFs(req, res, url) {
 
   if (sub === '/list') return fsList(req, res, url)
   if (sub === '/file') return fsFile(req, res, url)
+  if (sub === '/mkdir') return fsMkdir(req, res, url)
   if (sub === '/upload-probe') return fsUploadProbe(req, res, url)
   if (sub === '/upload-control') return fsUploadControl(req, res, url)
 
@@ -1666,7 +1826,15 @@ async function serveHealth(res) {
   }
   cors(res)
   res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
-  res.end(JSON.stringify({ ok: true, service: 'dsh-remote', version: VERSION, pid: process.pid, upstream: UPSTREAM.origin, upstreamOk }))
+  res.end(JSON.stringify({
+    ok: true,
+    service: 'dsh-remote',
+    version: VERSION,
+    pid: process.pid,
+    upstream: UPSTREAM.origin,
+    upstreamOk,
+    events: eventCollectorState,
+  }))
 }
 
 function lanAddresses() {
@@ -1778,11 +1946,43 @@ server.on('upgrade', (req, socket, head) => {
     upSocket.setNoDelay(true)
     upSocket.pipe(socket)
     socket.pipe(upSocket)
-    const close = () => { upSocket.destroy(); socket.destroy() }
+    // 双向 idle 检测: 任一侧 60s 无数据即视为死连接, 同时销毁两侧
+    let upIdle = null
+    let clientIdle = null
+    const clearIdle = () => {
+      clearTimeout(upIdle)
+      clearTimeout(clientIdle)
+      upIdle = null
+      clientIdle = null
+    }
+    const destroyBoth = () => {
+      clearIdle()
+      upSocket.destroy()
+      socket.destroy()
+    }
+    const close = () => {
+      clearIdle()
+      upSocket.destroy()
+      socket.destroy()
+    }
+    const touchUp = () => {
+      clearTimeout(upIdle)
+      upIdle = setTimeout(destroyBoth, WS_IDLE_MS)
+      upIdle?.unref?.()
+    }
+    const touchClient = () => {
+      clearTimeout(clientIdle)
+      clientIdle = setTimeout(destroyBoth, WS_IDLE_MS)
+      clientIdle?.unref?.()
+    }
+    upSocket.on('data', touchUp)
+    socket.on('data', touchClient)
+    touchUp()
+    touchClient()
     upSocket.on('error', close)
     socket.on('error', close)
-    upSocket.on('close', () => socket.end())
-    socket.on('close', () => upSocket.end())
+    upSocket.on('close', () => { clearIdle(); if (!socket.destroyed) socket.end() })
+    socket.on('close', () => { clearIdle(); if (!upSocket.destroyed) upSocket.end() })
   })
 
   upstreamReq.on('error', () => {

package/index.mjs

@@ -80,7 +80,12 @@ function lanIPs() {
 }
 
 function targetPath(pathname) {
-  const rel = decodeURIComponent(pathname.slice(MOUNT.length)) || '/'
+  let rel
+  try {
+    rel = decodeURIComponent(pathname.slice(MOUNT.length)) || '/'
+  } catch {
+    return null
+  }
   const file = rel === '/' ? INDEX_FILE : rel.replace(/^\/+/, '')
   const abs = resolve(PUBLIC_DIR, normalize(file))
   if (abs !== PUBLIC_DIR && !abs.startsWith(PUBLIC_DIR)) return null
@@ -143,6 +148,24 @@ function runExit(cmd, args) {
   })
 }
 
+const GATEWAY_ENV_KEYS = [
+  'TOKEN', 'TOKEN_FILE', 'DSH_REMOTE_TOKEN', 'DSH_REMOTE_FS_ROOT', 'DSH_REMOTE_FS_MAX_UPLOAD',
+  'DSH_REMOTE_NOTES', 'DSH_REMOTE_DSH_SERVICE', 'DSH_REMOTE_FEEDBACK_URL',
+  'UPDATE_CHECK_URL', 'UPDATE_INTERVAL_MS', 'UPDATE_PROXY', 'GATEWAY_WS_IDLE_MS',
+  'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY',
+  'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy'
+]
+
+function gatewaySystemdEnvArgs() {
+  const args = []
+  for (const key of GATEWAY_ENV_KEYS) {
+    const value = process.env[key]
+    if (value === undefined || /[\0\r\n]/.test(value)) continue
+    args.push('--setenv=' + key + '=' + value)
+  }
+  return args
+}
+
 /** 127.0.0.1 端口占用预检: 能连上=被占用, 连接被拒/超时=可用。 */
 function portInUse(port) {
   return new Promise((resolvePromise) => {
@@ -168,6 +191,7 @@ async function gatewayRunning() {
     return {
       running: true,
       pid: Number(data.pid) || 0,
+      version: typeof data.version === 'string' ? data.version : '',
       upstream: typeof data.upstream === 'string' ? data.upstream : '',
       upstreamOk: data.upstreamOk === true,
     }
@@ -264,6 +288,7 @@ async function startGateway() {
     await runExit('systemctl', ['--user', 'reset-failed', 'dsh-remote-gateway'])
     sysd = (await runExit('systemd-run', [
       '--user', '--unit=dsh-remote-gateway', '--service-type=exec',
+      ...gatewaySystemdEnvArgs(),
       '--setenv=PORT=' + port, '--setenv=HOST=0.0.0.0', '--setenv=DSH_UPSTREAM=' + upstream,
       '--', process.execPath, script,
     ])) === 0
@@ -317,8 +342,10 @@ function ensureGateway() {
       }
       const upstream = `http://${dshListen.host}:${dshListen.port}`
       const oldUpstream = health.upstream || ''
-      if (health.upstreamOk === false || (oldUpstream && oldUpstream !== upstream) || (!oldUpstream && upstream)) {
-        logGateway(`网关上游需刷新: 旧=${oldUpstream || '?'} 新=${upstream}`)
+      const oldVersion = health.version || '?'
+      const versionMismatch = oldVersion !== version
+      if (versionMismatch || health.upstreamOk === false || (oldUpstream && oldUpstream !== upstream) || (!oldUpstream && upstream)) {
+        logGateway(`网关需刷新: 版本 ${oldVersion} -> ${version}, 上游 ${oldUpstream || '?'} -> ${upstream}`)
         await killGateway(health)
         for (let i = 0; i < 10; i++) {
           if (!(await gatewayRunning()).running) break
@@ -552,6 +579,9 @@ async function serveStatic(req, res, ctx) {
         return
       }
       const oldPort = Number(readGatewayPort())
+      // 先在切换配置前读取旧端口上的健康状态；写入新端口后 gatewayRunning()
+      // 只会探测新端口，否则旧网关会变成孤儿进程继续占用旧端口。
+      const oldHealth = process.env.DSH_REMOTE_GATEWAY ? { running: false } : await gatewayRunning()
       try {
         mkdirSync(`${homedir()}/.dsh-remote`, { recursive: true })
         writeFileSync(gatewayPortFile(), String(port) + '\n')
@@ -561,14 +591,7 @@ async function serveStatic(req, res, ctx) {
       }
       const effectivePort = Number(readGatewayPort())
       if (effectivePort !== oldPort) {
-        const h = await gatewayRunning()
-        if (h.running) {
-          await killGateway(h)
-          for (let i = 0; i < 10; i++) {
-            if (!(await gatewayRunning()).running) break
-            await sleep(200)
-          }
-        }
+        if (oldHealth.running) await killGateway(oldHealth)
       }
       let running = (await gatewayRunning()).running
       if (gatewayAutostart()) {
@@ -587,7 +610,7 @@ async function serveStatic(req, res, ctx) {
   if (pathname === `${MOUNT}/admin/api/gateway`) {
     if (req.method === 'GET') {
       const h = await gatewayRunning()
-      sendJson(res, 200, { ok: true, running: h.running, upstream: h.upstream || '', upstreamOk: h.upstreamOk === true })
+      sendJson(res, 200, { ok: true, running: h.running, version: h.version || '', upstream: h.upstream || '', upstreamOk: h.upstreamOk === true })
       return
     }
     if (req.method === 'POST') {
@@ -606,6 +629,23 @@ async function serveStatic(req, res, ctx) {
     return
   }
 
+  // 远程启动/重启 DSH: 内嵌抽屉通过插件前缀转发到独立网关。
+  if (pathname === `${MOUNT}/admin/api/dsh`) {
+    if (req.method !== 'GET' && req.method !== 'POST') {
+      res.writeHead(405, { allow: 'GET, POST' })
+      res.end()
+      return
+    }
+    const body = req.method === 'POST' ? await readBody(req, 4096) : ''
+    const proxied = await proxyGateway('/admin/api/dsh', req.method, body)
+    if (proxied !== null) {
+      sendJson(res, proxied.status, proxied.json)
+    } else {
+      sendJson(res, 502, { ok: false, error: '本地网关不可用，无法控制 DSH' })
+    }
+    return
+  }
+
   // 斜杠命令桥接：客户端 → 网关 → 插件端点 → ctx.commands.execute
   if (pathname === `${MOUNT}/api/command`) {
     if (req.method !== 'POST') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",