dsh-remote-plugin 0.7.0-rc.3 → 0.7.1

package/client.js

@@ -20,7 +20,11 @@ window.__ModuleLoader__.load({
     }
 
     var DRAWER_STYLE = {
-      position: 'fixed', top: 12, right: 12, bottom: 12, zIndex: 2147483000,
+      // Desktop's hidden title bar overlays the page (40px on Windows).
+      // Electron exposes its current height through the CSS environment value;
+      // keep a safe fallback for Desktop hosts without that value.
+      position: 'fixed', top: window.location && window.location.protocol === 'dsh-app:' ? 'calc(12px + env(titlebar-area-height, 40px))' : 12,
+      right: 12, bottom: 12, zIndex: 2147483000,
       width: 'min(520px, calc(100vw - 24px))', background: '#0b0e1a',
       border: '1px solid rgba(125, 207, 255, .22)', borderRadius: 24, overflow: 'hidden',
       boxShadow: '-16px 18px 48px rgba(0,0,0,.46), 0 0 0 1px rgba(91,140,255,.08)',
@@ -141,7 +145,13 @@ window.__ModuleLoader__.load({
       }, [])
       return React.createElement('div', {
         'aria-hidden': !open,
-        style: Object.assign({}, DRAWER_STYLE, { transform: open ? 'translateX(0)' : 'translateX(102%)' }),
+        style: Object.assign({}, DRAWER_STYLE, {
+          transform: open ? 'translateX(0)' : 'translateX(102%)',
+          boxShadow: open ? DRAWER_STYLE.boxShadow : 'none',
+          pointerEvents: open ? 'auto' : 'none',
+          visibility: open ? 'visible' : 'hidden',
+          transition: open ? 'transform .22s ease' : 'transform .22s ease, visibility 0s linear .22s',
+        }),
       },
         loaded.current ? React.createElement('iframe', {
           src: '/remote/plugin.html',

package/gateway.cjs

@@ -23,13 +23,15 @@
  *   DSH_REMOTE_FS_MAX_UPLOAD 上传字节上限, 默认 2147483648 (2GB)
  *   DSH_REMOTE_WORKBENCH     工作台绑定文件, 默认 ~/.dsh-remote/workbench.json
  *   DSH_REMOTE_ADVERTISE_HOSTS 额外写入配对二维码的宿主 IP/主机名, 逗号或空白分隔
- *   DSH_REMOTE_DSH_CONTROL_MODE DSH 生命周期后端: auto/systemd/windows/disabled
+ *   DSH_REMOTE_DSH_CONTROL_MODE DSH 生命周期后端: auto/systemd/windows/process/disabled
+ *   DSH_REMOTE_DSH_LAUNCH_FILE 本机 DSH 启动配置, 默认 ~/.dsh-remote/dsh-launch.json
  */
 'use strict'
 
 const http = require('node:http')
 const https = require('node:https')
-const { execFile } = require('node:child_process')
+const { execFile, spawn } = require('node:child_process')
+const net = require('node:net')
 const fs = require('node:fs')
 const path = require('node:path')
 const os = require('node:os')
@@ -91,7 +93,8 @@ const DSH_SERVICE = String(process.env.DSH_REMOTE_DSH_SERVICE || 'dsh-web').trim
 const SYSTEMCTL = String(process.env.DSH_REMOTE_SYSTEMCTL || 'systemctl').trim() || 'systemctl'
 const WINDOWS_SC = String(process.env.DSH_REMOTE_WINDOWS_SC || 'sc.exe').trim() || 'sc.exe'
 const DSH_CONTROL_MODE_RAW = String(process.env.DSH_REMOTE_DSH_CONTROL_MODE || 'auto').trim().toLowerCase()
-const DSH_CONTROL_MODE = ['auto', 'systemd', 'windows', 'disabled'].includes(DSH_CONTROL_MODE_RAW) ? DSH_CONTROL_MODE_RAW : 'auto'
+const DSH_CONTROL_MODE = ['auto', 'systemd', 'windows', 'process', 'disabled'].includes(DSH_CONTROL_MODE_RAW) ? DSH_CONTROL_MODE_RAW : 'auto'
+const DSH_LAUNCH_FILE = process.env.DSH_REMOTE_DSH_LAUNCH_FILE || path.join(os.homedir(), '.dsh-remote', 'dsh-launch.json')
 const DSH_CONTROL_TIMEOUT_MS = durationEnv('DSH_REMOTE_DSH_CONTROL_TIMEOUT_MS', 45000, 2000, 5 * 60 * 1000)
 const DSH_CONTROL_POLL_MS = durationEnv('DSH_REMOTE_DSH_CONTROL_POLL_MS', 500, 50, 5000)
 const HTTP_REQUEST_TIMEOUT_MS = durationEnv('GATEWAY_HTTP_REQUEST_TIMEOUT_MS', 15 * 60 * 1000, 0, 24 * 60 * 60 * 1000)
@@ -154,6 +157,7 @@ function containerRuntimeDetected() {
 }
 
 function dshControlSupport() {
+  if (DSH_CONTROL_MODE === 'process') return { supported: true, manager: 'process' }
   if (DSH_CONTROL_MODE === 'disabled') {
     return { supported: false, code: 'EXTERNAL_LIFECYCLE', message: '当前 DSH 由 Docker、面板或其他外部平台管理' }
   }
@@ -1035,6 +1039,96 @@ async function windowsServiceStatus() {
   }
 }
 
+// Only a live ChildProcess handle grants restart authority. Never trust a saved PID:
+// a gateway restart or PID reuse must not turn an unrelated process into our child.
+let dshManagedChild = null
+let dshManagedExit = null
+function readDshLaunch() {
+  const config = JSON.parse(fs.readFileSync(DSH_LAUNCH_FILE, 'utf8'))
+  if (config.version !== 1 || !path.isAbsolute(config.executable || '') ||
+      !path.isAbsolute(config.cwd || '') || !Array.isArray(config.args) ||
+      !config.args.length || !config.args.every(arg => typeof arg === 'string' && !arg.includes('\0')) ||
+      !path.isAbsolute(config.args[0]) || !fs.statSync(config.args[0]).isFile() ||
+      !fs.statSync(config.executable).isFile() || !fs.statSync(config.cwd).isDirectory()) {
+    throw new Error('DSH 启动配置无效，请从 DSH Web 插件重新生成')
+  }
+  if (!['127.0.0.1', 'localhost', '[::1]'].includes(UPSTREAM.hostname) || config.upstream !== UPSTREAM.origin) {
+    throw new Error('DSH 启动配置与本机上游地址不匹配')
+  }
+  const env = {}
+  for (const key of ['DSH_HOME', 'HOME', 'USERPROFILE', 'PATH', 'NODE_OPTIONS']) {
+    if (typeof config.env?.[key] === 'string') env[key] = config.env[key]
+  }
+  return { ...config, env }
+}
+
+function dshPortOccupied() {
+  return new Promise(resolve => {
+    const socket = net.connect({ host: UPSTREAM.hostname.replace(/^\[|\]$/g, ''), port: UPSTREAM.port || (UPSTREAM.protocol === 'https:' ? 443 : 80) })
+    const finish = value => { socket.destroy(); resolve(value) }
+    socket.once('connect', () => finish(true))
+    socket.once('error', err => finish(err.code !== 'ECONNREFUSED'))
+    socket.setTimeout(1500, () => finish(true)) // uncertainty must not spawn a duplicate
+  })
+}
+
+async function dshProcessStatus() {
+  const base = { ok: true, supported: true, manager: 'process', service: 'dsh-process', running: false, mainPid: 0, canRestart: false }
+  try { readDshLaunch() } catch (err) {
+    return { ...base, supported: false, code: 'LAUNCH_CONFIG_INVALID', message: '缺少有效 DSH 启动配置，请先从 DSH Web 启动 Remote 插件', detail: err.message }
+  }
+  if (dshManagedChild) {
+    return { ...base, running: true, mainPid: dshManagedChild.pid, owned: true, canRestart: true, activeState: 'active', subState: 'running' }
+  }
+  const occupied = await dshPortOccupied()
+  const probe = occupied ? await probeDshUpstream() : null
+  return { ...base, running: !!probe?.ok, occupied, owned: false,
+    activeState: occupied ? (probe?.ok ? 'active' : 'inactive') : dshManagedExit ? 'failed' : 'inactive',
+    subState: occupied ? 'external' : 'stopped',
+    ...(dshManagedExit && !occupied ? { result: 'process-exited', execMainStatus: dshManagedExit.code, logFile: dshManagedExit.logFile } : {}),
+  }
+}
+
+async function executeDshProcessAction(action) {
+  const config = readDshLaunch()
+  if (action === 'restart' && !dshManagedChild && await dshPortOccupied()) {
+    return { ok: false, code: 'EXTERNAL_PROCESS', error: '当前 DSH 并非本网关启动，不能安全重启；请在原启动器中停止后重试' }
+  }
+  if (action === 'restart' && dshManagedChild) {
+    const child = dshManagedChild
+    const stopped = new Promise(resolve => {
+      const timer = setTimeout(() => { child.removeListener('exit', onExit); resolve(false) }, 5000)
+      const onExit = () => { clearTimeout(timer); resolve(true) }
+      child.once('exit', onExit)
+    })
+    child.kill()
+    if (!await stopped) return { ok: false, code: 'PROCESS_STOP_TIMEOUT', error: 'DSH 进程未及时退出，未启动第二个实例' }
+  }
+  if (dshManagedChild || await dshPortOccupied()) return { ok: false, code: 'PORT_IN_USE', error: 'DSH 端口已被占用，未启动重复实例' }
+  const logFile = path.join(path.dirname(DSH_LAUNCH_FILE), 'dsh-process.log')
+  fs.mkdirSync(path.dirname(logFile), { recursive: true })
+  const fd = fs.openSync(logFile, 'a', 0o600)
+  let child
+  try {
+    child = spawn(config.executable, config.args, {
+      cwd: config.cwd, env: { ...process.env, ...config.env },
+      detached: true, windowsHide: true, shell: false, stdio: ['ignore', fd, fd],
+    })
+  } finally { fs.closeSync(fd) }
+  dshManagedChild = child
+  dshManagedExit = null
+  child.once('exit', code => {
+    if (dshManagedChild === child) { dshManagedChild = null; dshManagedExit = { code, logFile } }
+  })
+  return new Promise(resolve => {
+    child.once('error', err => {
+      if (dshManagedChild === child) { dshManagedChild = null; dshManagedExit = { code: err.code, logFile } }
+      resolve({ ok: false, code: 'PROCESS_START_FAILED', error: `${err.message}；日志：${logFile}` })
+    })
+    child.once('spawn', () => { child.unref(); resolve({ ok: true, code: 0 }) })
+  })
+}
+
 async function dshServiceStatus() {
   if (!/^[A-Za-z0-9_.@-]+$/.test(DSH_SERVICE)) {
     return { ok: false, supported: false, running: false, service: DSH_SERVICE, code: 'INVALID_SERVICE', message: 'DSH_REMOTE_DSH_SERVICE 服务名配置不合法' }
@@ -1042,7 +1136,12 @@ async function dshServiceStatus() {
   if (!DSH_CONTROL_SUPPORT.supported) {
     return { ok: true, supported: false, running: false, service: DSH_SERVICE, ...DSH_CONTROL_SUPPORT }
   }
-  if (process.platform === 'win32') return windowsServiceStatus()
+  if (DSH_CONTROL_MODE === 'process') return dshProcessStatus()
+  if (process.platform === 'win32') {
+    const service = await windowsServiceStatus()
+    if (DSH_CONTROL_MODE === 'auto' && service.code === 'SERVICE_NOT_FOUND') return dshProcessStatus()
+    return { ...service, manager: 'windows' }
+  }
   const r = await execFileResult(SYSTEMCTL, [
     '--user', 'show', DSH_SERVICE,
     '--property=Id,LoadState,ActiveState,SubState,UnitFileState,MainPID,Result,ExecMainStatus',
@@ -1081,6 +1180,7 @@ async function dshServiceStatus() {
 }
 
 async function executeDshServiceAction(action, initial) {
+  if (initial?.manager === 'process') return executeDshProcessAction(action)
   if (process.platform !== 'win32') {
     return execFileResult(SYSTEMCTL, ['--user', '--no-block', action, DSH_SERVICE], 5000)
   }
@@ -1171,27 +1271,25 @@ function reconnectDshEventCollectors() {
 
 async function runDshControlOperation(operation) {
   try {
-    const manager = process.platform === 'win32' ? 'Windows 服务' : 'systemd 用户服务'
-    dshOperationStep(operation, 'checking', `正在检查 ${manager} ${DSH_SERVICE}`)
+    dshOperationStep(operation, 'checking', '正在检查 DSH 启动配置与运行状态')
     const initial = await dshServiceStatus()
     operation.initialStatus = initial
     operation.observed = initial
+    const manager = initial.manager === 'process' ? '本机进程' : process.platform === 'win32' ? 'Windows 服务' : 'systemd 用户服务'
+    operation.service = initial.service
     if (!initial.supported) {
       failDshOperation(operation, initial.code || 'UNSUPPORTED', initial.message || '当前 DSH 服务不可控', initial.detail, initial)
       return
     }
-    if (operation.action === 'start' && initial.running) {
-      dshOperationStep(operation, 'complete', `DSH 已在运行（${initial.service}，PID ${initial.mainPid || '未知'}）`, {
-        ok: true, done: true, code: 'ALREADY_RUNNING', status: initial, upstream: await probeDshUpstream(),
-      })
-      return
-    }
-
     dshOperationStep(operation, 'command', `正在向 ${manager} 提交 DSH ${operation.action === 'start' ? '启动' : '重启'}命令`)
-    const command = await executeDshServiceAction(operation.action, initial)
+    const command = operation.action === 'start' && initial.running
+      ? { ok: true, code: 'ALREADY_RUNNING' }
+      : await executeDshServiceAction(operation.action, initial)
     operation.command = { ok: command.ok, code: command.code, signal: command.signal }
     if (!command.ok) {
-      const failure = classifyDshServiceFailure(command)
+      const failure = initial.manager === 'process'
+        ? { code: command.code, message: command.error, detail: '' }
+        : classifyDshServiceFailure(command)
       failDshOperation(operation, failure.code, failure.message, failure.detail, await dshServiceStatus())
       return
     }
@@ -1216,7 +1314,7 @@ async function runDshControlOperation(operation) {
       }
       if (operation.action === 'restart' && (status.mainPid > 0 && status.mainPid !== initialPid || status.activeState !== 'active')) restartObserved = true
       if (status.activeState === 'failed') {
-        failDshOperation(operation, 'SERVICE_FAILED', `DSH 服务进入 failed 状态（Result=${status.result || 'unknown'}，ExecMainStatus=${status.execMainStatus}）`, '', status)
+        failDshOperation(operation, 'SERVICE_FAILED', `DSH 启动进程已退出（Result=${status.result || 'unknown'}，ExecMainStatus=${status.execMainStatus}）`, status.logFile ? `启动日志：${status.logFile}` : '', status)
         return
       }
       if (status.running && restartObserved) {
@@ -1605,6 +1703,12 @@ async function translateModernRpc(method, payload, rpcId) {
     if (!['create', 'rename', 'delete', 'insertBefore', 'insertSessionBefore', 'archiveSession'].includes(verb)) return legacyFallback('no generated RPC adapter')
     endpoint = 'workspace/' + verb
     args = { request: payload }
+    if (verb === 'archiveSession') transform = value => {
+      // The HTTP receipt precedes workspace/follow on another connection.
+      // Publish the committed archive set before a client's immediate refresh.
+      if (Array.isArray(value?.archivedSessionIds)) applyModernWorkspaceFrame({ type: 'archived', ...value })
+      return value
+    }
   } else if (method.startsWith('goal.')) {
     const verb = method.slice('goal.'.length)
     if (!['create', 'edit', 'pause', 'resume', 'complete', 'clear'].includes(verb)) return legacyFallback('no generated RPC adapter')
@@ -1660,7 +1764,40 @@ async function translateModernRpc(method, payload, rpcId) {
     return legacyFallback('no generated RPC adapter')
   }
 
-  const response = await callUpstreamRemote(endpoint, args, rpcId)
+  let response = await callUpstreamRemote(endpoint, args, rpcId)
+  if (method === 'session.prompt' && imageAdmissionRejected(response.body)) {
+    try {
+      const bridged = await bridgeVisionPrompt(args.request)
+      if (bridged) response = await callUpstreamRemote(endpoint, { ...args, request: bridged }, rpcId)
+    } catch (error) {
+      return legacyEnvelope(rpcId, modernError(error.message, 'image-vision-failed'))
+    }
+  }
+  if (method === 'subagent.list' && modernResponseNeedsLegacyFallback(response)) {
+    // DSH 0.2 removed subagents/list; discovery is now a non-activating
+    // read of the parent's durable catalog and each child's projections.
+    const parent = await callUpstreamRemote('session/projections', { request: { sessionId: payload.parentSessionId } }, rpcId)
+    if (modernResponseNeedsLegacyFallback(parent)) return legacyFallback('generated subagent catalog unavailable')
+    if (!parent.body?.result?.ok) return parent.body || legacyEnvelope(rpcId, modernError('DSH subagent catalog read failed'))
+    const catalog = parent.body.result.value?.values?.subagentCatalog
+    if (!Array.isArray(catalog)) return legacyEnvelope(rpcId, modernError('DSH did not expose a subagent catalog projection', 'subagent/projections-unavailable'))
+    await refreshModernSessions()
+    const entries = await Promise.all(catalog.map(async child => {
+      if (!['one-shot', 'continuable'].includes(child.mode)) return { kind: 'diagnostic', id: child.id, reason: 'unsupported' }
+      try {
+        const read = await callUpstreamRemote('session/projections', { request: { sessionId: child.id } })
+        if (!read.body?.result?.ok || !read.body.result.value) return { kind: 'diagnostic', id: child.id, reason: 'unavailable' }
+        const values = read.body.result.value.values
+        const identity = values?.subagent
+        if (!identity || identity.mode !== child.mode) return { kind: 'diagnostic', id: child.id, reason: 'corrupt' }
+        return { kind: 'child', id: child.id, mode: identity.mode,
+          ...(identity.label === undefined ? {} : { label: identity.label }),
+          activity: modernState.sessions.get(child.id)?.running ? 'running' : 'inactive',
+          hasChildren: Array.isArray(values.subagentCatalog) && values.subagentCatalog.length > 0 }
+      } catch { return { kind: 'diagnostic', id: child.id, reason: 'unavailable' } }
+    }))
+    return legacyEnvelope(rpcId, { ok: true, value: { entries, parentAvailable: !!modernState.sessions.get(payload.parentSessionId)?.agentAvailable } })
+  }
   if (modernResponseNeedsLegacyFallback(response)) return legacyFallback(`generated RPC ${endpoint} unavailable`)
   if (!response.body?.result?.ok) {
     recordCompatibility('generated-rpc-error', { method, status: response.status, detail: remoteFailureKind(response) })
@@ -1712,6 +1849,8 @@ function rememberCollectorReplay(kind, full, raw) {
   let key = ''
   if (payload.type === 'session/subscribed' && payload.sessionId) key = `session:${payload.sessionId}`
   else if (payload.type === 'session/reasoning' && payload.sessionId) key = `reasoning:${payload.sessionId}`
+  else if (payload.type === 'session/queue' && payload.sessionId) key = `queue:${payload.sessionId}`
+  else if (payload.type === 'session/jobs' && payload.sessionId) key = `jobs:${payload.sessionId}`
   else if (payload.type === 'approval/requested' && payload.approvalId) key = `approval:${payload.approvalId}`
   else if (payload.type === 'question/requested' && full.rpcId) key = `question:${full.rpcId}`
   else if (payload.type === 'approval/resolved' && payload.approvalId) replay.delete(`approval:${payload.approvalId}`)
@@ -1989,6 +2128,28 @@ function openModernSessionStream(ws, sessionId) {
     type: 'open', streamId, endpoint: 'session/follow',
     payload: { args: { request: { address: { kind: 'session', sessionId }, assistantStream: true } } },
   }))
+  ws.send(JSON.stringify({
+    type: 'open', streamId: 'jobs:' + sessionId, endpoint: 'job/list',
+    payload: { args: { request: { sessionId } } },
+  }))
+}
+
+function applyModernProjection(sessionId, key, value, seq) {
+  legacyPush('mux', { type: 'session/projection', sessionId, key, value, seq })
+  if (key === 'inbox') {
+    // DSH 0.2 stores queue/steer state in the durable Inbox projection.
+    const items = ['next-turn', 'next-step'].flatMap(target =>
+      (Array.isArray(value?.[target]) ? value[target] : []).filter(message => message?.id).map(message => ({
+        id: message.id, placement: target === 'next-turn' ? 'queued' : 'context', message,
+      })))
+    legacyPush('mux', { type: 'session/queue', sessionId, items })
+  }
+}
+
+function applyModernJobFrame(sessionId, value) {
+  if (value?.type === 'rows' && Array.isArray(value.jobs)) {
+    legacyPush('mux', { type: 'session/jobs', sessionId, jobs: value.jobs })
+  }
 }
 
 function applyModernControlFrame(value) {
@@ -2001,16 +2162,14 @@ function applyModernControlFrame(value) {
     }
     for (const [sessionId, block] of Object.entries(value.value?.projections || {})) {
       for (const [key, projection] of Object.entries(block?.values || {})) {
-        legacyPush('mux', { type: 'session/projection', sessionId, key, value: projection, seq: block?.asOfSeq ?? 0 })
+        applyModernProjection(sessionId, key, projection, block?.asOfSeq ?? 0)
       }
     }
     return
   }
   if (value?.type === 'queue') legacyPush('mux', { type: 'session/queue', sessionId: value.sessionId, items: value.items || [] })
   else if (value?.type === 'jobs') legacyPush('mux', { type: 'session/jobs', sessionId: value.sessionId, jobs: value.jobs || [] })
-  else if (value?.type === 'projection') legacyPush('mux', {
-    type: 'session/projection', sessionId: value.sessionId, key: value.key, value: value.value, seq: value.seq,
-  })
+  else if (value?.type === 'projection') applyModernProjection(value.sessionId, value.key, value.value, value.seq)
 }
 
 function applyModernWorkspaceFrame(value) {
@@ -2103,7 +2262,7 @@ function applyModernSessionFrame(sessionId, value) {
       if (record?.event) legacyPush('mux', { type: 'session/event', sessionId, event: record.event })
     }
     for (const [key, projection] of Object.entries(value.projections?.values || {})) {
-      legacyPush('mux', { type: 'session/projection', sessionId, key, value: projection, seq: value.projections?.asOfSeq ?? value.cursor })
+      applyModernProjection(sessionId, key, projection, value.projections?.asOfSeq ?? value.cursor)
     }
     return
   }
@@ -2176,7 +2335,11 @@ function applyModernRemoteEvent(ws, value) {
     modernState.sessionCursors.delete(args[0])
     modernState.assistantStreams.delete(args[0])
     collectorReplay.mux.delete(`reasoning:${args[0]}`)
+    collectorReplay.mux.delete(`session:${args[0]}`)
+    collectorReplay.mux.delete(`queue:${args[0]}`)
+    collectorReplay.mux.delete(`jobs:${args[0]}`)
     try { ws.send(JSON.stringify({ type: 'cancel', streamId: 'session:' + args[0] })) } catch {}
+    try { ws.send(JSON.stringify({ type: 'cancel', streamId: 'jobs:' + args[0] })) } catch {}
     legacyPush('host', { type: 'host/session-removed', sessionId: args[0] })
   } else if (value.event === 'api-session/status') {
     legacyPush('host', { type: 'host/session-status', sessionId: args[0], running: !!args[1] })
@@ -2265,6 +2428,9 @@ function startModernEventCollector() {
         const data = typeof ev.data === 'string' ? ev.data : Buffer.isBuffer(ev.data) ? ev.data.toString() : String(ev.data)
         const frame = JSON.parse(data)
         if (frame.type === 'error') {
+          // Old generated-RPC Hosts may have no job namespace. This optional
+          // roster must not degrade the working session and approval streams.
+          if (frame.streamId?.startsWith('jobs:') && ['gateway/definition-unavailable', 'gateway/invocation-unavailable', 'gateway/service-unavailable', 'gateway/method-unavailable', 'method-unavailable', 'not-found'].includes(frame.error?.code)) return
           const message = frame.error?.message || 'modern stream error'
           for (const state of Object.values(eventCollectorState)) state.lastError = message
           legacyPush('mux', { type: 'stream/error', error: frame.error || { message } })
@@ -2274,6 +2440,7 @@ function startModernEventCollector() {
         if (frame.streamId === 'events') applyModernRemoteEvent(current, frame.value)
         else if (frame.streamId === 'control') applyModernControlFrame(frame.value)
         else if (frame.streamId === 'workspaces') applyModernWorkspaceFrame(frame.value)
+        else if (frame.streamId.startsWith('jobs:')) applyModernJobFrame(frame.streamId.slice(5), frame.value)
         else if (frame.streamId.startsWith('session:')) applyModernSessionFrame(frame.streamId.slice(8), frame.value)
       } catch {}
     }
@@ -2761,7 +2928,7 @@ function serveStatic(req, res, url) {
     })
     return
   }
-  const apkOverride = pathname === '/dsh-remote.apk'
+  const apkOverride = pathname === '/dsh-remote.apk' || pathname === '/dsh-remote-harmonyos-unsigned.hap' || pathname === '/dsh-remote-harmonyos.hap'
   const baseDir = apkOverride ? path.join(ROOT, 'apk') : PUBLIC_DIR
   const filePath = path.normalize(path.join(baseDir, pathname))
   if (filePath !== baseDir && !filePath.startsWith(baseDir + path.sep)) {
@@ -2787,7 +2954,7 @@ function serveStatic(req, res, url) {
     }
     res.writeHead(200, {
       'content-type': MIME[ext] || 'application/octet-stream',
-      'cache-control': ext === '.html' || ext === '.js' || ext === '.css' ? 'no-cache' : 'public, max-age=300',
+      'cache-control': pathname === '/harmonyos-update.json' ? 'no-store' : ext === '.html' || ext === '.js' || ext === '.css' ? 'no-cache' : 'public, max-age=300',
       'content-length': st.size,
       'last-modified': lastModified
     })
@@ -2814,7 +2981,7 @@ function upstreamReachable(cb) {
   req.end()
 }
 
-function serveAdminApi(req, res, url) {
+async function serveAdminApi(req, res, url) {
   const sub = url.pathname.slice('/admin/api'.length) || '/'
   if (sub === '/dsh') return serveDshControl(req, res, url)
   if (sub === '/state' && req.method === 'GET') {
@@ -2825,6 +2992,7 @@ function serveAdminApi(req, res, url) {
       res.end(JSON.stringify({ error: 'unauthorized' }))
       return
     }
+    const control = await dshControlDescription()
     upstreamReachable((reachable) => {
       res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
       res.end(JSON.stringify({
@@ -2840,8 +3008,8 @@ function serveAdminApi(req, res, url) {
         host: HOST,
         port: PORT,
         protocol: { version: PROTOCOL_VERSION },
-        capabilities: CAPABILITIES,
-        dshControl: DSH_CONTROL_SUPPORT,
+        capabilities: { ...CAPABILITIES, dshLifecycle: control.supported ? 2 : 0 },
+        dshControl: control,
         upstream: { url: UPSTREAM.origin, reachable },
         latest: {
           version: latestState.version,
@@ -4090,11 +4258,14 @@ function serveHandoff(req, res, url) {
       fsJson(res, 400, { error: 'sessionId required' })
       return
     }
+    // 白名单字段只接受字符串：对象/数字/数组等一律按空串处理，
+    // 避免 String({}) 产出 '[object Object]' 之类垃圾落盘并广播到其他设备
+    const str = (v) => typeof v === 'string' ? v : ''
     handoffSave({
       sessionId: sessionId.slice(0, 128),
-      title: String(payload.title || '').slice(0, 200),
-      device: String(payload.device || '').slice(0, 80),
-      clientId: String(payload.clientId || '').slice(0, 96),
+      title: str(payload.title).slice(0, 200),
+      device: str(payload.device).slice(0, 80),
+      clientId: str(payload.clientId).slice(0, 96),
       at: Date.now()
     })
     fsJson(res, 200, { ok: true })
@@ -4218,7 +4389,50 @@ function readApiRequest(req, maxBytes = 4 * 1024 * 1024) {
   })
 }
 
-async function forwardLegacyRpc(url, raw) {
+// Only the explicit pre-admission image rejection is safe to retry. Never retry
+// a timeout, ambiguous transport failure, or an already accepted prompt.
+function imageAdmissionRejected(body) {
+  const result = body?.result
+  return result?.ok === false && result.error?.code === 'session/attachment-invalid'
+    && result.error?.details?.reason === 'MODEL_DOES_NOT_SUPPORT_IMAGES'
+}
+
+async function bridgeVisionPrompt(payload) {
+  if (!Array.isArray(payload?.content) || !payload.content.some(part => part?.type === 'image')) return null
+  const pluginFetch = (route, options = {}) => fetch(new URL('/api/dsh-image-vision/' + route, UPSTREAM), {
+    ...options,
+    headers: dshUpstreamHeaders({ 'content-type': 'application/json' }),
+    signal: AbortSignal.timeout(UPSTREAM_REQUEST_TIMEOUT_MS),
+    redirect: 'error',
+  })
+  const configResponse = await pluginFetch('config')
+  if (configResponse.status === 404) throw new Error('当前模型不支持图片，未找到兼容的 dsh-image-vision 插件；请安装并启用视觉辅助插件，或切换视觉模型。')
+  if (!configResponse.ok) throw new Error('无法检查视觉辅助插件状态，请稍后重试。')
+  const config = await configResponse.json()
+  if (config?.config?.enabled !== true) throw new Error('当前模型不支持图片，视觉辅助插件尚未开启。请在 DSH 中启用插件后重试。')
+  const content = []
+  for (const part of payload.content) {
+    if (part?.type !== 'image') { content.push(part); continue }
+    if (typeof part.data !== 'string' || !part.data || typeof part.mediaType !== 'string') {
+      throw new Error('视觉辅助转换失败：图片缺少内联数据，请重新选择图片。')
+    }
+    const response = await pluginFetch('attach', { method: 'POST', body: JSON.stringify({
+      data: part.data, mediaType: part.mediaType,
+      ...(typeof part.name === 'string' ? { name: part.name } : {}),
+    }) })
+    const value = await response.json().catch(() => null)
+    // Accept only the plugin's same-upstream attachment reference, not arbitrary
+    // returned text/URLs. Preserve every other block and the original send mode.
+    if (!response.ok || value?.ok !== true || typeof value.markdown !== 'string'
+      || !/^!\[图片\]\(\/api\/dsh-image-vision\/raw\/[A-Za-z0-9%._~-]+\?[^\s()<>]+\)$/.test(value.markdown)) {
+      throw new Error('视觉辅助图片上传失败，消息尚未发送，请检查插件后重试。')
+    }
+    content.push({ type: 'text', text: value.markdown })
+  }
+  return { ...payload, content }
+}
+
+async function forwardLegacyRpc(url, raw, allowVisionBridge = true) {
   const target = new URL(url.pathname + url.search, UPSTREAM)
   const response = await fetch(target, {
     method: 'POST',
@@ -4226,7 +4440,20 @@ async function forwardLegacyRpc(url, raw) {
     body: raw,
     signal: AbortSignal.timeout(UPSTREAM_REQUEST_TIMEOUT_MS),
   })
-  return { status: response.status, headers: response.headers, raw: await response.text() }
+  const result = { status: response.status, headers: response.headers, raw: await response.text() }
+  if (allowVisionBridge) {
+    let body, request
+    try { body = JSON.parse(result.raw); request = JSON.parse(raw) } catch {}
+    if (request?.method === 'session.prompt' && imageAdmissionRejected(body)) {
+      try {
+        const bridged = await bridgeVisionPrompt(request.payload)
+        if (bridged) return forwardLegacyRpc(url, JSON.stringify({ ...request, payload: bridged }), false)
+      } catch (error) {
+        return { ...result, status: 200, raw: JSON.stringify(legacyEnvelope(request.rpcId, modernError(error.message, 'image-vision-failed'))) }
+      }
+    }
+  }
+  return result
 }
 
 function sendBufferedUpstreamResponse(res, response) {
@@ -4416,6 +4643,15 @@ function proxyApi(req, res, url) {
 }
 
 // ---------- 其它 ----------
+async function dshControlDescription() {
+  if (!DSH_CONTROL_SUPPORT.supported) return DSH_CONTROL_SUPPORT
+  if (process.platform !== 'win32' && DSH_CONTROL_MODE !== 'process') return DSH_CONTROL_SUPPORT
+  const status = await dshServiceStatus()
+  return { supported: status.supported, manager: status.manager || DSH_CONTROL_SUPPORT.manager,
+    ...(status.code ? { code: status.code, message: status.message } : {}),
+    ...(status.canRestart !== undefined ? { canRestart: status.canRestart } : {}) }
+}
+
 async function serveHealth(req, res, url) {
   restoreMissingTokenFile()
   const eventHealth = Object.fromEntries(Object.entries(eventCollectorState).map(([kind, state]) => [kind, {
@@ -4456,6 +4692,7 @@ async function serveHealth(req, res, url) {
   const eventsOk = eventHealth.mux.connected && eventHealth.host.connected
   const readiness = { ok: upstreamOk && eventsOk, upstreamOk, eventsOk }
   const status = readiness.ok ? 'ready' : upstreamReachable ? 'degraded' : 'offline'
+  const control = await dshControlDescription()
   cors(res)
   res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
   res.end(JSON.stringify({
@@ -4466,8 +4703,8 @@ async function serveHealth(req, res, url) {
     readiness,
     version: VERSION,
     protocol: { version: PROTOCOL_VERSION },
-    capabilities: CAPABILITIES,
-    dshControl: DSH_CONTROL_SUPPORT,
+    capabilities: { ...CAPABILITIES, dshLifecycle: control.supported ? 2 : 0 },
+    dshControl: control,
     pid: process.pid,
     upstream: UPSTREAM.origin,
     upstreamProbe: DSH_HEALTH_PATH,
@@ -4500,7 +4737,7 @@ const server = http.createServer(async (req, res) => {
     if (url.pathname === '/diagnostics') return serveDiagnostics(req, res, url)
     if (url.pathname === '/feedback') return serveFeedback(req, res, url)
     if (url.pathname === '/handoff') return serveHandoff(req, res, url)
-    if (url.pathname.startsWith('/admin/api')) return serveAdminApi(req, res, url)
+    if (url.pathname.startsWith('/admin/api')) return await serveAdminApi(req, res, url)
     if (url.pathname.startsWith('/stats')) return serveStats(req, res, url)
     if (url.pathname === '/api/ws-ticket') return serveWsTicket(req, res, url)
     if (url.pathname === '/api/events.poll') return serveEventPoll(req, res, url)

package/index.mjs

@@ -6,13 +6,13 @@
  * 浏览器侧入口由 client half 注册在 DSH 原生侧边栏(见 client.js)。
  */
 import { execFileSync, spawn } from 'node:child_process'
-import { appendFileSync, chmodSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, writeFileSync } from 'node:fs'
+import { appendFileSync, chmodSync, createReadStream, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, renameSync } from 'node:fs'
 import { stat } from 'node:fs/promises'
 import net from 'node:net'
 import { homedir, hostname, networkInterfaces } from 'node:os'
 import { dirname, extname, normalize, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { createPluginCenter } from './plugin-center.mjs'
+import { createPluginCenter, detectProfile } from './plugin-center.mjs'
 
 export const name = 'dsh-remote'
 export const inject = ['webServer', 'commands', 'agents', 'connection']
@@ -976,10 +976,37 @@ async function serveStatic(req, res, ctx) {
 }
 
 const pluginCenters = new WeakMap()
+export function saveDshLaunchConfig(ctx) {
+  // Desktop owns its Electron runtime. Never record a desktop or unknown launcher.
+  if (process.platform !== 'win32' || process.versions.electron) return false
+  const profile = detectProfile(ctx)
+  if (!profile?.cli || profile.name === 'desktop' || resolve(process.argv[1] || '') !== resolve(profile.cli)) return false
+  const env = { DSH_HOME: profile.home }
+  for (const key of ['HOME', 'USERPROFILE', 'PATH', 'NODE_OPTIONS']) {
+    if (process.env[key] !== undefined) env[key] = process.env[key]
+  }
+  const args = [profile.cli, ...process.argv.slice(2)]
+  if (!args.includes('--no-open')) args.push('--no-open')
+  const config = { version: 1, executable: process.execPath, args, cwd: process.cwd(),
+    env, profile: profile.name, upstream: upstreamUrlForListener({ host: ctx.webServer.host, port: ctx.webServer.port }) }
+  const file = process.env.DSH_REMOTE_DSH_LAUNCH_FILE || `${homedir()}/.dsh-remote/dsh-launch.json`
+  const tmp = `${file}.${process.pid}.tmp`
+  try {
+    mkdirSync(dirname(file), { recursive: true })
+    writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 })
+    renameSync(tmp, file)
+    return true
+  } catch (err) {
+    logGateway('无法保存 DSH 启动配置: ' + err.message)
+    return false
+  }
+}
+
 export function apply(ctx) {
   pluginCenters.set(ctx, createPluginCenter(ctx))
   dshListen = { host: ctx.webServer.host, port: ctx.webServer.port }
   dshConnection = ctx.connection
+  saveDshLaunchConfig(ctx)
   ctx.effect(() => ctx.webServer.register({
     kind: 'prefix',
     path: MOUNT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-plugin",
-  "version": "0.7.0-rc.3",
+  "version": "0.7.1",
   "description": "DSH Remote 官方 bundle 插件：DSH 左侧原生边栏入口 + 右侧抽屉内嵌管理控制台；内置网关随 DSH 自动启停(systemd 独立单元)，抽屉直显令牌与设备监控；网关提供 /fs/* 文件传输端点(列表/断点下载/上传)，配合 Android App 远程操控会话/审批/提问/goal 与文件互传(多服务器测速切换、聊天记录离线缓存)。",
   "type": "module",
   "main": "./index.mjs",

package/public/desktop/desktop.js

@@ -501,9 +501,11 @@ function closeNotesModal() {
 }
 async function checkNotesOnStart() {
   try {
-    const res = await fetch('../update.json?t=' + Date.now())
-    if (!res.ok) return
-    openNotesModal(await res.json())
+    const res = await fetch('../update.json?t=' + Date.now(), { cache: 'no-store' })
+    if (!res.ok || res.redirected || !String(res.headers.get('content-type') || '').includes('application/json')) return
+    const info = await res.json()
+    if (!info || typeof info !== 'object' || !info.version) return
+    openNotesModal(info)
   } catch {}
 }
 async function submitFeedback() {

package/public/update.json

@@ -1,10 +1,18 @@
 {
-  "version": "0.7.0-rc.3",
+  "version": "0.7.1",
   "apkUrl": "dsh-remote.apk",
-  "sha256": "482490d9801a9e5c947fe02e3c7636b39c7089db8b38f55d732a963d848ee3fa",
-  "releasedAt": "2026-09-20T09:53:01.965Z",
-  "notes": "0.7.0-rc.3：手机端新增可选长按插队发送，默认关闭，可设置繁忙时默认排队或插队；直接提交插队请求，等待、超时与已接受状态分别提示，避免误认为工具已中断，失败时保留草稿。合入鸿蒙客户端、平板分栏与服务卡片源码，完善跨端接续接口；修复 WebSocket Ping 跨包组帧及接续接口非法输入处理。保留 rc.2 令牌恢复、认证状态和 IPv6 监听修复。本次提供 Android APK 与网关，未提供签名鸿蒙 HAP；鸿蒙大文件哈希、断点续传、快速切换服务器及 Android/Linux/fnOS 真机场景仍待验收。",
+  "sha256": "7ca47a78d152754d4991d5605d8e368ee0e4a20b7bfe1a90055d72c04069cff1",
+  "releasedAt": "2026-10-02T13:59:16.334Z",
+  "notes": "适配 DSH 0.2.0-rc.2 的 Inbox 队列、后台任务流与子代理目录，修复子代理接口 404 和归档后刷新状态滞后，保留旧版实时通道兼容；修复 Desktop 插件面板被标题栏遮挡、收起后阴影残留及更新说明响应校验。合入鸿蒙插件中心、长按发送和主题改进，并修复切换连接时的旧确认卡、误发送及迟到回执问题；鸿蒙本次仅更新源码，暂不提供安装包。",
   "history": [
+    {
+      "version": "0.7.1",
+      "notes": "适配 DSH 0.2.0-rc.2 的 Inbox 队列、后台任务流与子代理目录，修复子代理接口 404 和归档后刷新状态滞后，保留旧版实时通道兼容；修复 Desktop 插件面板被标题栏遮挡、收起后阴影残留及更新说明响应校验。合入鸿蒙插件中心、长按发送和主题改进，并修复切换连接时的旧确认卡、误发送及迟到回执问题；鸿蒙本次仅更新源码，暂不提供安装包。"
+    },
+    {
+      "version": "0.7.0",
+      "notes": "0.7.0：Windows 上未注册为服务的 DSH 可由 Remote 网关按已检查的 CLI 启动配置受控启动；已有 Windows 服务仍优先使用，网关只重启自己启动并持有句柄的进程。手机发送图片遇到 DSH 明确拒绝（当前模型不支持图片）时，可通过已启用的 dsh-image-vision 插件桥接附件；桥接失败不会提交不完整消息。保留长按插队发送、跨设备接续、鸿蒙客户端源码与平板分栏、网关 WebSocket Ping 分帧修复等 0.7.0 RC 功能。本次提供 Android APK 与 Windows/Linux 网关，不提供鸿蒙 HAP。"
+    },
     {
       "version": "0.6.26",
       "notes": "0.6.26：修复 DSH 通配监听地址导致的认证与实时连接失败，兼容 IPv6-only；上传覆盖失败保留原文件，避免并发同名覆盖和续传分片竞争；网关改用认证关闭，避免误杀其他进程；完善 dsh-ui 堆叠柱状图、标签页、表格排序与特殊单元格、趋势线、环形进度、文件树和修改前后预览。已通过 Windows 自动测试与浏览器检查，Linux/Docker 专项实测仍待完成。"
@@ -36,14 +44,6 @@
     {
       "version": "0.6.19",
       "notes": "0.6.19：全面优化手机端、桌面端、管理页和插件页的布局、动效与响应式体验，并支持减少动态效果偏好；重做蓝色、草原、音乐厅等主题的明暗层级和文字图标对比度，新增利落的黑白配色；统一主页图标配色并修正设置齿轮中心孔偏移；目标面板支持收起为始终可见的侧边入口，保留运行状态、可随时恢复，并按会话与目标在本地记忆。"
-    },
-    {
-      "version": "0.6.18",
-      "notes": "0.6.18：新增独立 Token 量趋势统计并保留原有费用趋势；服务器连接身份改为地址加令牌，支持同地址不同令牌并兼容旧配置；投票在网关不可达时尝试直连公网收集器托底（需收集器允许 App/Web CORS）；修复 Windows 下 gateway-stats 调用 zstd 时弹出终端窗口的问题，并补充回归测试；同步完善相关模块文档。"
-    },
-    {
-      "version": "0.6.17",
-      "notes": "0.6.17：修复 host.describe 初次失败后总览误报 DSH 上游离线并增加恢复重试；识别 Docker、无 systemd 和插件内嵌等外部生命周期环境，隐藏不可用的 DSH 启停并给出明确提示；兼容 Caddy Basic Auth，避免管理 API 覆盖 Authorization 导致登录循环；支持通过环境变量或管理页手动补充 Docker 宿主、局域网和 Tailscale 地址并写入配对二维码；完整适配 Windows 盘符、UNC、多文件根和跨主机文件路径清理，并新增 Windows 原生 CI 安全门禁。"
     }
   ]
 }

package/public/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.7.0-rc.3"
+  "version": "0.7.1"
 }