dsh-remote-plugin 0.6.5 → 0.6.7

package/README.en.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add "github:Blank-not-black/dsh-Remote#main&path:/packa
 - On/off intent persists in `~/.dsh-remote/gateway.enabled`; it can be stopped/started from the drawer.
 - Token lives in `~/.dsh-remote/token` (auto-generated on first run, reused and never overwritten), shown in the drawer and copyable; supports **QR pairing** and **one-click rotation**.
 - Env var `DSH_REMOTE_AUTOSTART=0` disables auto management.
-- File endpoints: `/fs/list` (list directory), `/fs/file` (download with Range support), `/fs/upload` (chunked resume with pause/cancel, SHA-256 verified before writing to disk); default root is `~`, and `DSH_REMOTE_FS_ROOT` opens multiple roots (`:`-separated).
+- File endpoints: `/fs/list` (list directory), `/fs/file` (download with Range support), `/fs/upload` (chunked resume with pause/cancel, SHA-256 verified before writing to disk); default root is `~`, and `DSH_REMOTE_FS_ROOT` opens multiple roots (`:` on Linux/macOS, `;` on Windows).
 - Feedback endpoint: `POST /feedback` (the app / desktop "Write feedback" dialog), forwarded by the gateway to the feedback collector; default `http://100.84.128.29/submit` (Tailscale internal network), overridable via `DSH_REMOTE_FEEDBACK_URL` — no tokens to configure.
 
 ## Mobile App

package/README.md

@@ -28,7 +28,7 @@ dsh plugin --profile web add "github:Blank-not-black/dsh-Remote#main&path:/packa
 - 开关持久化在 `~/.dsh-remote/gateway.enabled`；抽屉内可停止/启动。
 - 令牌在 `~/.dsh-remote/token`（首次自动生成，重复使用不覆盖），抽屉里显示并可复制；支持**二维码扫码配对**与**一键轮换**。
 - 环境变量 `DSH_REMOTE_AUTOSTART=0` 可关闭自动管理。
-- 文件端点：`/fs/list`（列目录）、`/fs/file`（下载，支持 Range）、`/fs/upload`（分块续传，支持暂停/取消，落盘前 SHA-256 校验）；默认根目录 `~`，`DSH_REMOTE_FS_ROOT` 可开多根（`:` 分隔）。
+- 文件端点：`/fs/list`（列目录）、`/fs/file`（下载，支持 Range）、`/fs/upload`（分块续传，支持暂停/取消，落盘前 SHA-256 校验）；默认根目录 `~`，`DSH_REMOTE_FS_ROOT` 可开多根（Linux/macOS 用 `:`，Windows 用 `;` 分隔）。
 - 反馈端点：`POST /feedback`（App / 桌面端「写反馈」），网关转发到反馈收集器；默认 `http://100.84.128.29/submit`（Tailscale 内网），可用 `DSH_REMOTE_FEEDBACK_URL` 覆盖，无需配置任何 token。
 
 ## 手机 App

package/gateway-stats.cjs

@@ -247,7 +247,11 @@ class StatsStore {
 
     const model = eventModel(event) || fallbackModel || 'unknown'
     const { date, hour, period } = eventKey(time)
-    if (date < PRICING_START_DATE) return { processed: false, gap: false, skip: true }
+    if (date < PRICING_START_DATE) {
+      // 定价生效日前的事件不计费，但必须推进游标；否则生效日后的第一条事件会被误判为 gap。
+      this._setCursor(sessionId, seq)
+      return { processed: false, gap: false, skip: true }
+    }
     const day = this._loadDay(date)
     const hourBucket = day.hours[hour] || (day.hours[hour] = {})
     const modelBucket = hourBucket[model] || (hourBucket[model] = emptyBucket())
@@ -267,10 +271,13 @@ class StatsStore {
    * 用系统 zstd 命令解压(项目约束: 不新增 npm 运行时依赖; Windows 无 zstd 时跳过)。
    */
   scanFile(file, onProgress) {
+    return this._enqueue(() => this._scanFile(file, onProgress))
+  }
+
+  _scanFile(file, onProgress) {
     return new Promise((resolvePromise) => {
       const sessionId = path.basename(path.dirname(file))
       const cur = this._cursor(sessionId)
-      const startSeq = cur ? cur.lastSeq + 1 : 0
       let lastSeq = cur ? cur.lastSeq : -1
       let processed = 0
       let currentModel = ''

package/gateway.cjs

@@ -18,13 +18,15 @@
  *   DSH_UPSTREAM  DSH web 服务地址, 默认 http://127.0.0.1:3080
  *   TOKEN       访问令牌; 不设置则读 TOKEN_FILE, 仍没有则自动生成
  *   TOKEN_FILE  令牌文件, 默认 ~/.dsh-remote/token
- *   DSH_REMOTE_FS_ROOT       文件传输允许根, 默认 ~, 多个用 ':' 分隔
+ *   DSH_REMOTE_FS_ROOT       文件传输允许根, 默认 ~, 使用系统路径分隔符配置多根
  *   DSH_REMOTE_FS_MAX_UPLOAD 上传字节上限, 默认 2147483648 (2GB)
+ *   DSH_REMOTE_WORKBENCH     工作台绑定文件, 默认 ~/.dsh-remote/workbench.json
  */
 'use strict'
 
 const http = require('node:http')
 const https = require('node:https')
+const { execFile } = require('node:child_process')
 const fs = require('node:fs')
 const path = require('node:path')
 const os = require('node:os')
@@ -47,7 +49,9 @@ const WS_IDLE_MS = Number(process.env.GATEWAY_WS_IDLE_MS) || 60000
 const UPSTREAM = new URL(process.env.DSH_UPSTREAM || 'http://127.0.0.1:3080')
 const TOKEN_FILE = process.env.TOKEN_FILE || path.join(os.homedir(), '.dsh-remote', 'token')
 const NOTES_FILE = process.env.DSH_REMOTE_NOTES || path.join(os.homedir(), '.dsh-remote', 'device-notes.json')
+const WORKBENCH_FILE = process.env.DSH_REMOTE_WORKBENCH || path.join(os.homedir(), '.dsh-remote', 'workbench.json')
 const STARTED_AT = Date.now()
+const DSH_SERVICE = String(process.env.DSH_REMOTE_DSH_SERVICE || 'dsh-web').trim()
 
 // 更新检查: GitHub 为默认源, 可用环境变量覆盖(国内镜像 / 代理)
 const UPDATE_CHECK_URL = process.env.UPDATE_CHECK_URL ||
@@ -82,12 +86,13 @@ const MIME = {
 }
 
 // ---------- /fs 文件传输 ----------
-// 允许访问的根目录: DSH_REMOTE_FS_ROOT 用 ':' 分隔多个根, 默认仅 ~。
+// 允许访问的根目录: DSH_REMOTE_FS_ROOT 使用系统路径分隔符分隔多个根,
+// POSIX 为 ':'、Windows 为 ';'；默认仅 ~。
 // 所有 /fs/* 路径 resolve 后都必须位于某个根内, 已存在的路径还会用 realpath
 // 复核一次, 防止 ../ 穿越与符号链接逃逸。
 const FS_DEFAULT_ROOT = path.resolve(os.homedir())
 const FS_ROOTS = (process.env.DSH_REMOTE_FS_ROOT || FS_DEFAULT_ROOT)
-  .split(':')
+  .split(path.delimiter)
   .filter(Boolean)
   .map(r => path.resolve(r.trim() === '~' ? FS_DEFAULT_ROOT : r.trim()))
 const FS_MAX_UPLOAD = Number(process.env.DSH_REMOTE_FS_MAX_UPLOAD) || 2 * 1024 * 1024 * 1024
@@ -307,7 +312,9 @@ function httpGetJson(url, cb) {
   const isHttps = u.protocol === 'https:'
   const lib = isHttps ? https : http
   const proxyEnv = process.env.UPDATE_PROXY ||
-    (isHttps ? process.env.HTTPS_PROXY : process.env.HTTP_PROXY) || ''
+    (isHttps
+      ? (process.env.HTTPS_PROXY || process.env.https_proxy)
+      : (process.env.HTTP_PROXY || process.env.http_proxy)) || ''
   const done = (err, value) => { if (settled) return; settled = true; cb(err, value) }
   let settled = false
   const timer = setTimeout(() => done(new Error('检查超时')), 6000)
@@ -413,6 +420,109 @@ function cors(res) {
   res.setHeader('access-control-allow-methods', 'GET, POST, OPTIONS')
 }
 
+function readBody(req, maxBytes = 64 * 1024) {
+  return new Promise((resolve, reject) => {
+    const chunks = []
+    let size = 0
+    let settled = false
+    req.on('data', chunk => {
+      if (settled) return
+      size += chunk.length
+      if (size > maxBytes) {
+        settled = true
+        reject(new Error('request body too large'))
+        req.destroy()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (settled) return
+      settled = true
+      resolve(Buffer.concat(chunks).toString('utf8'))
+    })
+    req.on('error', err => {
+      if (settled) return
+      settled = true
+      reject(err)
+    })
+  })
+}
+
+function execFileResult(file, args, timeout = 5000) {
+  return new Promise((resolvePromise) => {
+    execFile(file, args, { timeout, windowsHide: true }, (error, stdout, stderr) => {
+      resolvePromise({
+        ok: !error,
+        code: error?.code ?? 0,
+        stdout: String(stdout || '').trim(),
+        stderr: String(stderr || '').trim(),
+      })
+    })
+  })
+}
+
+async function dshServiceStatus() {
+  if (process.platform === 'win32') {
+    return { ok: true, supported: false, running: false, service: DSH_SERVICE, message: 'Windows 请配置 DSH_REMOTE_DSH_SERVICE 后接入任务计划程序' }
+  }
+  if (!/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
+    return { ok: false, supported: false, running: false, service: DSH_SERVICE, message: '服务名配置不合法' }
+  }
+  const r = await execFileResult('systemctl', ['--user', 'is-active', DSH_SERVICE], 3000)
+  return { ok: true, supported: true, running: r.stdout === 'active', service: DSH_SERVICE, state: r.stdout || 'unknown', detail: r.stderr || '' }
+}
+
+async function serveDshControl(req, res, url) {
+  if (req.method === 'OPTIONS') {
+    cors(res)
+    res.writeHead(204)
+    res.end()
+    return
+  }
+  if (!authorized(req, url)) {
+    authFailures++
+    touchDevice(req, { failedAuth: true })
+    cors(res)
+    res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ error: 'unauthorized' }))
+    return
+  }
+  touchDevice(req, { kind: 'admin' })
+  if (req.method === 'GET') {
+    cors(res)
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+    res.end(JSON.stringify(await dshServiceStatus()))
+    return
+  }
+  if (req.method !== 'POST') {
+    cors(res)
+    res.writeHead(405, { allow: 'GET, POST' })
+    res.end()
+    return
+  }
+  let body = {}
+  try { body = JSON.parse((await readBody(req, 4096)) || '{}') } catch {}
+  const action = body?.action
+  if (action !== 'start' && action !== 'restart') {
+    cors(res)
+    res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: false, error: 'action 必须是 start 或 restart' }))
+    return
+  }
+  if (process.platform === 'win32' || !/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
+    cors(res)
+    res.writeHead(501, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: false, supported: false, error: '当前系统未配置可控的 dsh-web 服务', service: DSH_SERVICE }))
+    return
+  }
+  const r = await execFileResult('systemctl', ['--user', action, DSH_SERVICE], 10000)
+  const status = await dshServiceStatus()
+  cors(res)
+  res.writeHead(r.ok ? 200 : 502, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(JSON.stringify({ ...status, ok: r.ok, action, detail: r.stderr || r.stdout || '' }))
+}
+
 // ---------- 事件轮询缓冲 ----------
 // 网关自己维护到 DSH 的 mux/host WebSocket，把事件写入内存环形缓冲；
 // 前端在 WebSocket 被隧道/受限网络阻断时改走 GET /api/events.poll 增量拉取。
@@ -420,6 +530,10 @@ const EVENT_BUFFER_MAX = 300
 const EVENT_MAX_STRING = 16 * 1024
 const eventBuffers = { mux: [], host: [] }
 const eventNextSeq = { mux: 1, host: 1 }
+const eventCollectorState = {
+  mux: { connected: false, lastEventAt: 0, lastConnectAt: 0, reconnects: 0, lastError: '' },
+  host: { connected: false, lastEventAt: 0, lastConnectAt: 0, reconnects: 0, lastError: '' },
+}
 
 /** 递归截断超大字段，避免单条超大事件撑爆环形缓冲。 */
 function truncateEventValue(v, depth = 0) {
@@ -438,6 +552,7 @@ function truncateEventValue(v, depth = 0) {
 
 function pushEvent(kind, full) {
   if (!eventBuffers[kind] || !full || typeof full !== 'object') return
+  if (eventCollectorState[kind]) eventCollectorState[kind].lastEventAt = Date.now()
   const buf = eventBuffers[kind]
   buf.push({ seq: eventNextSeq[kind]++, ts: Date.now(), event: truncateEventValue(full) })
   if (buf.length > EVENT_BUFFER_MAX) buf.shift()
@@ -488,6 +603,7 @@ function serveEventPoll(req, res, url) {
 /** 网关自带上游事件采集：mux/host 各一条 WS，断线自动重连。 */
 function startEventCollector(kind) {
   if (typeof WebSocket !== 'function') return null
+  const state = eventCollectorState[kind]
   let ws = null
   let stopped = false
   let retryTimer = null
@@ -501,6 +617,11 @@ function startEventCollector(kind) {
       return
     }
     ws.onopen = () => {
+      if (state) {
+        state.connected = true
+        state.lastConnectAt = Date.now()
+        state.lastError = ''
+      }
       if (stopped) { try { ws.close() } catch {} }
     }
     ws.onmessage = (ev) => {
@@ -511,10 +632,17 @@ function startEventCollector(kind) {
       } catch {}
     }
     ws.onclose = () => {
+      if (state) {
+        state.connected = false
+        state.reconnects++
+      }
       ws = null
       if (!stopped) retryTimer = setTimeout(connect, 3000)
     }
-    ws.onerror = () => { try { ws.close() } catch {} }
+    ws.onerror = (err) => {
+      if (state) state.lastError = String(err?.message || 'websocket error')
+      try { ws.close() } catch {}
+    }
   }
   connect()
   return {
@@ -788,11 +916,20 @@ function serveStatic(req, res, url) {
       return
     }
     const ext = path.extname(filePath).toLowerCase()
+    const lastModified = st.mtime.toUTCString()
+    const mtimeSec = Math.floor(st.mtime.getTime() / 1000) * 1000
     cors(res)
+    const ims = req.headers['if-modified-since']
+    if (ims && new Date(ims).getTime() >= mtimeSec) {
+      res.writeHead(304, { 'last-modified': lastModified })
+      res.end()
+      return
+    }
     res.writeHead(200, {
       'content-type': MIME[ext] || 'application/octet-stream',
       'cache-control': ext === '.html' || ext === '.js' || ext === '.css' ? 'no-cache' : 'public, max-age=300',
-      'content-length': st.size
+      'content-length': st.size,
+      'last-modified': lastModified
     })
     if (req.method === 'HEAD') res.end()
     else fs.createReadStream(filePath).pipe(res)
@@ -818,6 +955,7 @@ function upstreamReachable(cb) {
 
 function serveAdminApi(req, res, url) {
   const sub = url.pathname.slice('/admin/api'.length) || '/'
+  if (sub === '/dsh') return serveDshControl(req, res, url)
   if (sub === '/state' && req.method === 'GET') {
     if (!authorized(req, url)) {
       authFailures++
@@ -1372,6 +1510,37 @@ function fsUploadProbe(req, res, url) {
   })
 }
 
+/** POST /fs/mkdir?path=<parent>&name=<directory> 创建一个工作区目录。 */
+function fsMkdir(req, res, url) {
+  if (req.method !== 'POST') {
+    res.writeHead(405, { allow: 'POST' })
+    res.end()
+    return
+  }
+  if (!fsAuthorized(req, url, res)) return
+  touchDevice(req)
+  const resolved = fsResolve(url.searchParams.get('path') ?? '')
+  if (resolved.error) return fsJson(res, resolved.error === 'forbidden' ? 403 : 404, { error: resolved.error })
+  const checked = fsRealChecked(resolved.abs)
+  if (checked.error) return fsJson(res, checked.error === 'forbidden' ? 403 : 404, { error: checked.error })
+  try {
+    if (!fs.statSync(checked.abs).isDirectory()) return fsJson(res, 400, { error: 'not-a-directory' })
+  } catch (err) {
+    return fsJson(res, err.code === 'ENOENT' ? 404 : 403, { error: err.code === 'ENOENT' ? 'not-found' : 'permission-denied' })
+  }
+
+  const name = url.searchParams.get('name') || ''
+  if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '目录名不能为空且不能包含路径分隔符' })
+  const target = path.join(checked.abs, name)
+  try {
+    fs.mkdirSync(target)
+  } catch (err) {
+    if (err.code === 'EEXIST') return fsJson(res, 409, { error: 'exists' })
+    return fsJson(res, ['EACCES', 'EPERM', 'EROFS'].includes(err.code) ? 403 : 400, { error: 'mkdir-failed', detail: err.message })
+  }
+  fsJson(res, 201, { ok: true, name, path: path.join(resolved.abs, name) })
+}
+
 function fsUploadResumable(req, res, url, dirLex, dirReal) {
   const name = url.searchParams.get('name') || ''
   if (!fsValidName(name)) return fsJson(res, 400, { error: 'bad-name', detail: '文件名不能为空且不能包含路径分隔符' })
@@ -1552,6 +1721,7 @@ function serveFs(req, res, url) {
 
   if (sub === '/list') return fsList(req, res, url)
   if (sub === '/file') return fsFile(req, res, url)
+  if (sub === '/mkdir') return fsMkdir(req, res, url)
   if (sub === '/upload-probe') return fsUploadProbe(req, res, url)
   if (sub === '/upload-control') return fsUploadControl(req, res, url)
 
@@ -1594,6 +1764,112 @@ function serveFs(req, res, url) {
   fsJson(res, 404, { error: 'not-found' })
 }
 
+// ---------- /workbench 工作台绑定 ----------
+// 工作台绑定一个文件夹；其下的子文件夹由客户端映射为 DSH 项目工作区。
+function workbenchPathInfo(rawPath) {
+  if (typeof rawPath !== 'string' || !path.isAbsolute(rawPath)) return { error: 'bad-path' }
+  const abs = path.resolve(rawPath)
+  let st
+  try { st = fs.statSync(abs) } catch (err) {
+    return { error: err.code === 'ENOENT' ? 'not-found' : 'permission-denied' }
+  }
+  if (!st.isDirectory()) return { error: 'not-a-directory' }
+  const checked = fsRealChecked(abs)
+  if (checked.error) return { error: checked.error === 'forbidden' ? 'outside-roots' : checked.error }
+  return { path: checked.abs }
+}
+
+function loadWorkbench() {
+  try {
+    const raw = JSON.parse(fs.readFileSync(WORKBENCH_FILE, 'utf8'))
+    if (!raw || typeof raw.path !== 'string' || !raw.path) return null
+    const checked = workbenchPathInfo(raw.path)
+    return checked.path ? { path: checked.path } : null
+  } catch {
+    return null
+  }
+}
+
+function saveWorkbench(binding) {
+  try {
+    fs.mkdirSync(path.dirname(WORKBENCH_FILE), { recursive: true })
+    fs.writeFileSync(WORKBENCH_FILE, JSON.stringify(binding, null, 2) + '\n')
+    return true
+  } catch {
+    return false
+  }
+}
+
+function serveWorkbench(req, res, url) {
+  const sub = url.pathname.slice('/workbench'.length)
+  if (req.method === 'OPTIONS') {
+    cors(res)
+    res.writeHead(204)
+    res.end()
+    return
+  }
+  if (!fsAuthorized(req, url, res)) return
+
+  if (sub === '' && req.method === 'GET') {
+    const binding = loadWorkbench()
+    fsJson(res, 200, {
+      bound: !!binding,
+      path: binding?.path || null,
+      title: binding ? path.basename(binding.path) : null
+    })
+    return
+  }
+
+  if (sub === '/bind' && req.method === 'POST') {
+    let body = ''
+    let done = false
+    const fail = (status, payload) => {
+      if (done || res.headersSent) return
+      done = true
+      fsJson(res, status, payload)
+    }
+    req.on('data', chunk => {
+      if (done) return
+      body += chunk
+      if (Buffer.byteLength(body) > 4096) {
+        req.destroy()
+        fail(413, { error: 'too-large' })
+      }
+    })
+    req.on('error', () => { if (!done) done = true })
+    req.on('end', () => {
+      if (done) return
+      try {
+        const rawPath = JSON.parse(body || '{}')?.path
+        const checked = workbenchPathInfo(rawPath)
+        if (checked.error) {
+          const status = checked.error === 'forbidden' ? 403 : 400
+          fail(status, { error: checked.error, detail: checked.error === 'outside-roots' ? '绑定目录必须在文件传输允许根目录内' : undefined })
+          return
+        }
+        if (!saveWorkbench({ path: checked.path })) {
+          fail(500, { error: 'save-failed' })
+          return
+        }
+        done = true
+        fsJson(res, 200, { bound: true, path: checked.path, title: path.basename(checked.path) })
+      } catch {
+        fail(400, { error: 'bad-request' })
+      }
+    })
+    return
+  }
+
+  if (sub === '/unbind' && req.method === 'POST') {
+    try { fs.rmSync(WORKBENCH_FILE, { force: true }) } catch {}
+    fsJson(res, 200, { bound: false })
+    return
+  }
+
+  res.writeHead(405, { allow: 'GET, POST' })
+  res.end()
+}
+
 // ---------- /api 代理 ----------
 function proxyApi(req, res, url) {
   if (req.method === 'OPTIONS') {
@@ -1667,7 +1943,15 @@ async function serveHealth(res) {
   }
   cors(res)
   res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
-  res.end(JSON.stringify({ ok: true, service: 'dsh-remote', version: VERSION, pid: process.pid, upstream: UPSTREAM.origin, upstreamOk }))
+  res.end(JSON.stringify({
+    ok: true,
+    service: 'dsh-remote',
+    version: VERSION,
+    pid: process.pid,
+    upstream: UPSTREAM.origin,
+    upstreamOk,
+    events: eventCollectorState,
+  }))
 }
 
 function lanAddresses() {
@@ -1684,6 +1968,7 @@ const server = http.createServer((req, res) => {
   try {
     const url = new URL(req.url, 'http://dsh-remote.local')
     if (url.pathname === '/fs' || url.pathname.startsWith('/fs/')) return serveFs(req, res, url)
+    if (url.pathname === '/workbench' || url.pathname.startsWith('/workbench/')) return serveWorkbench(req, res, url)
     if (url.pathname === '/feedback') return serveFeedback(req, res, url)
     if (url.pathname.startsWith('/admin/api')) return serveAdminApi(req, res, url)
     if (url.pathname.startsWith('/stats')) return serveStats(req, res, url)

package/index.mjs

@@ -80,7 +80,12 @@ function lanIPs() {
 }
 
 function targetPath(pathname) {
-  const rel = decodeURIComponent(pathname.slice(MOUNT.length)) || '/'
+  let rel
+  try {
+    rel = decodeURIComponent(pathname.slice(MOUNT.length)) || '/'
+  } catch {
+    return null
+  }
   const file = rel === '/' ? INDEX_FILE : rel.replace(/^\/+/, '')
   const abs = resolve(PUBLIC_DIR, normalize(file))
   if (abs !== PUBLIC_DIR && !abs.startsWith(PUBLIC_DIR)) return null
@@ -143,6 +148,24 @@ function runExit(cmd, args) {
   })
 }
 
+const GATEWAY_ENV_KEYS = [
+  'TOKEN', 'TOKEN_FILE', 'DSH_REMOTE_TOKEN', 'DSH_REMOTE_FS_ROOT', 'DSH_REMOTE_FS_MAX_UPLOAD',
+  'DSH_REMOTE_NOTES', 'DSH_REMOTE_WORKBENCH', 'DSH_REMOTE_DSH_SERVICE', 'DSH_REMOTE_FEEDBACK_URL',
+  'UPDATE_CHECK_URL', 'UPDATE_INTERVAL_MS', 'UPDATE_PROXY', 'GATEWAY_WS_IDLE_MS',
+  'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY',
+  'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy'
+]
+
+function gatewaySystemdEnvArgs() {
+  const args = []
+  for (const key of GATEWAY_ENV_KEYS) {
+    const value = process.env[key]
+    if (value === undefined || /[\0\r\n]/.test(value)) continue
+    args.push('--setenv=' + key + '=' + value)
+  }
+  return args
+}
+
 /** 127.0.0.1 端口占用预检: 能连上=被占用, 连接被拒/超时=可用。 */
 function portInUse(port) {
   return new Promise((resolvePromise) => {
@@ -168,6 +191,7 @@ async function gatewayRunning() {
     return {
       running: true,
       pid: Number(data.pid) || 0,
+      version: typeof data.version === 'string' ? data.version : '',
       upstream: typeof data.upstream === 'string' ? data.upstream : '',
       upstreamOk: data.upstreamOk === true,
     }
@@ -264,6 +288,7 @@ async function startGateway() {
     await runExit('systemctl', ['--user', 'reset-failed', 'dsh-remote-gateway'])
     sysd = (await runExit('systemd-run', [
       '--user', '--unit=dsh-remote-gateway', '--service-type=exec',
+      ...gatewaySystemdEnvArgs(),
       '--setenv=PORT=' + port, '--setenv=HOST=0.0.0.0', '--setenv=DSH_UPSTREAM=' + upstream,
       '--', process.execPath, script,
     ])) === 0
@@ -317,8 +342,10 @@ function ensureGateway() {
       }
       const upstream = `http://${dshListen.host}:${dshListen.port}`
       const oldUpstream = health.upstream || ''
-      if (health.upstreamOk === false || (oldUpstream && oldUpstream !== upstream) || (!oldUpstream && upstream)) {
-        logGateway(`网关上游需刷新: 旧=${oldUpstream || '?'} 新=${upstream}`)
+      const oldVersion = health.version || '?'
+      const versionMismatch = oldVersion !== version
+      if (versionMismatch || health.upstreamOk === false || (oldUpstream && oldUpstream !== upstream) || (!oldUpstream && upstream)) {
+        logGateway(`网关需刷新: 版本 ${oldVersion} -> ${version}, 上游 ${oldUpstream || '?'} -> ${upstream}`)
         await killGateway(health)
         for (let i = 0; i < 10; i++) {
           if (!(await gatewayRunning()).running) break
@@ -552,6 +579,9 @@ async function serveStatic(req, res, ctx) {
         return
       }
       const oldPort = Number(readGatewayPort())
+      // 先在切换配置前读取旧端口上的健康状态；写入新端口后 gatewayRunning()
+      // 只会探测新端口，否则旧网关会变成孤儿进程继续占用旧端口。
+      const oldHealth = process.env.DSH_REMOTE_GATEWAY ? { running: false } : await gatewayRunning()
       try {
         mkdirSync(`${homedir()}/.dsh-remote`, { recursive: true })
         writeFileSync(gatewayPortFile(), String(port) + '\n')
@@ -561,14 +591,7 @@ async function serveStatic(req, res, ctx) {
       }
       const effectivePort = Number(readGatewayPort())
       if (effectivePort !== oldPort) {
-        const h = await gatewayRunning()
-        if (h.running) {
-          await killGateway(h)
-          for (let i = 0; i < 10; i++) {
-            if (!(await gatewayRunning()).running) break
-            await sleep(200)
-          }
-        }
+        if (oldHealth.running) await killGateway(oldHealth)
       }
       let running = (await gatewayRunning()).running
       if (gatewayAutostart()) {
@@ -587,7 +610,7 @@ async function serveStatic(req, res, ctx) {
   if (pathname === `${MOUNT}/admin/api/gateway`) {
     if (req.method === 'GET') {
       const h = await gatewayRunning()
-      sendJson(res, 200, { ok: true, running: h.running, upstream: h.upstream || '', upstreamOk: h.upstreamOk === true })
+      sendJson(res, 200, { ok: true, running: h.running, version: h.version || '', upstream: h.upstream || '', upstreamOk: h.upstreamOk === true })
       return
     }
     if (req.method === 'POST') {
@@ -606,6 +629,23 @@ async function serveStatic(req, res, ctx) {
     return
   }
 
+  // 远程启动/重启 DSH: 内嵌抽屉通过插件前缀转发到独立网关。
+  if (pathname === `${MOUNT}/admin/api/dsh`) {
+    if (req.method !== 'GET' && req.method !== 'POST') {
+      res.writeHead(405, { allow: 'GET, POST' })
+      res.end()
+      return
+    }
+    const body = req.method === 'POST' ? await readBody(req, 4096) : ''
+    const proxied = await proxyGateway('/admin/api/dsh', req.method, body)
+    if (proxied !== null) {
+      sendJson(res, proxied.status, proxied.json)
+    } else {
+      sendJson(res, 502, { ok: false, error: '本地网关不可用，无法控制 DSH' })
+    }
+    return
+  }
+
   // 斜杠命令桥接：客户端 → 网关 → 插件端点 → ctx.commands.execute
   if (pathname === `${MOUNT}/api/command`) {
     if (req.method !== 'POST') {
@@ -664,10 +704,19 @@ async function serveStatic(req, res, ctx) {
     return
   }
   const { abs, info } = found
+  const lastModified = info.mtime.toUTCString()
+  const mtimeSec = Math.floor(info.mtime.getTime() / 1000) * 1000
+  const ims = req.headers['if-modified-since']
+  if (ims && new Date(ims).getTime() >= mtimeSec) {
+    res.writeHead(304, { 'last-modified': lastModified })
+    res.end()
+    return
+  }
   res.writeHead(200, {
     'content-type': MIME[extname(abs)] ?? 'application/octet-stream',
     'content-length': info.size,
     'cache-control': 'no-cache',
+    'last-modified': lastModified,
   })
   if (req.method === 'HEAD') {
     res.end()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",