dsh-remote-sudo 0.1.0 → 0.1.1

package/README.md

@@ -17,6 +17,7 @@ A composer-hosted sudo password prompt for DeepSeek Harness: the password goes t
 ### 功能
 
 - **composer 面板**：接管输入框，显示主机、命令、密码；Enter 提交，Esc 取消。
+- **多端同步**：电脑和手机（dsh-pocket）同时打开时，任意一端提交或取消密码，其他端的面板会立即撤销，不会残留。
 - **单一缓存开关**：`passwordTtlMs: 0` 每次都要密码；正整数时密码只在宿主内存保留该时长。
 - **不依赖 sudo ticket**：每次执行后 `sudo -k`，不假设 ticket 能跨 ssh 复用。
 - **自动探测 sudo**：先试常见绝对路径，再用 `command -v sudo` 兜底。
@@ -33,10 +34,10 @@ dsh plugin --profile desktop add dsh-remote-sudo
 **从 GitHub**：
 
 ```bash
-dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.0
+dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.1
 ```
 
-或在插件管理器里选“从 Git 仓库安装”，填 `github:seudut/dsh-remote-sudo#v0.1.0`。
+或在插件管理器里选“从 Git 仓库安装”，填 `github:seudut/dsh-remote-sudo#v0.1.1`。
 
 然后在 profile 的 `cordis.patch.yml` 加入：
 
@@ -73,7 +74,7 @@ config:
 | `command` | 是 | 远端 root 命令 |
 | `description` | 否 | 面板里的短标签 |
 
-需要密码时弹面板；`passwordTtlMs` 内不重复弹；取消/停止会结束调用。
+需要密码时弹面板；`passwordTtlMs` 内不重复弹；取消/停止会结束调用。多端同时打开时每端都会看到同一个 prompt，先提交者生效，其余端自动撤销。
 
 ### 安全边界
 
@@ -102,6 +103,7 @@ node test/real-host-probe.mjs   # 手动：真实主机 + 错误密码验证链
 ### Features
 
 - **Composer panel**: takes over the input box with host, command, and password; Enter submits, Esc cancels.
+- **Multi-device sync**: with the desktop and a phone (dsh-pocket) pointing at the same Host, answering or cancelling on one browser dismisses the prompt everywhere instead of stranding a stale panel.
 - **One cache knob**: `passwordTtlMs: 0` asks every call; a positive value keeps the password in host memory for that window.
 - **No sudo ticket reuse**: runs `sudo -k` after every command and never assumes a no-TTY ticket survives across ssh.
 - **Auto-detect sudo**: common absolute paths first, then `command -v sudo`.
@@ -118,10 +120,10 @@ dsh plugin --profile desktop add dsh-remote-sudo
 **From GitHub**:
 
 ```bash
-dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.0
+dsh plugin --profile desktop add github:seudut/dsh-remote-sudo#v0.1.1
 ```
 
-Or use the plugin manager's "install from Git repository" with `github:seudut/dsh-remote-sudo#v0.1.0`.
+Or use the plugin manager's "install from Git repository" with `github:seudut/dsh-remote-sudo#v0.1.1`.
 
 Then add this row to the profile's `cordis.patch.yml`:
 
@@ -158,7 +160,7 @@ Ask the agent to call `remote_sudo`:
 | `command` | yes | root command to run remotely |
 | `description` | no | short label shown in the panel |
 
-The panel appears when a password is needed; within `passwordTtlMs` it does not ask again. Cancel/stop ends the call.
+The panel appears when a password is needed; within `passwordTtlMs` it does not ask again. Cancel/stop ends the call. When several browsers are open, each shows the same prompt; the first answer wins and the others dismiss themselves.
 
 ### Security
 

package/client.js

@@ -1,11 +1,14 @@
 /**
  * dsh-remote-sudo — Client half.
  *
- * Long-polls the Host route for a pending sudo prompt, publishes it as a
- * `uiSession` pending interaction, and takes over `conversation.composer`
- * exactly like the approval panel: the prompt replaces the composer while it
- * is pending. The password travels browser → Host over the same authenticated
- * origin; it never enters the session log or a tool call.
+ * Long-polls the Host route for a pending sudo prompt and the pending-set
+ * revision, publishes it as a `uiSession` pending interaction, and takes over
+ * `conversation.composer` exactly like the approval panel: the prompt replaces
+ * the composer while it is pending. Because the Host is polled even while a
+ * panel is open, a prompt answered or cancelled by another browser (a phone
+ * through dsh-pocket, another tab) settles this panel instead of stranding it.
+ * The password travels browser → Host over the same authenticated origin; it
+ * never enters the session log or a tool call.
  */
 
 window.__ModuleLoader__.load({
@@ -18,6 +21,7 @@ window.__ModuleLoader__.load({
     const BASE = '/_dsh/dsh-remote-sudo'
     const POLL_WAIT_MS = 20000
     const RETRY_DELAY_MS = 2000
+    const LEGACY_RECHECK_MS = 2000
     const KIND = 'sudo-password'
     const NS = 'dsh-remote-sudo'
 
@@ -154,7 +158,7 @@ window.__ModuleLoader__.load({
 
     /** One published prompt; the composer panel drives answer/cancel. */
     class SudoPrompt {
-      constructor(value) {
+      constructor(value, noteHostState) {
         this.kind = KIND
         this.key = value.id
         this.id = value.id
@@ -162,6 +166,7 @@ window.__ModuleLoader__.load({
         this.command = value.command
         this.description = value.description
         this.sessionId = value.sessionId
+        this.noteHostState = noteHostState
         this.settled = false
         this.completion = new Promise((resolve) => {
           this.resolveCompletion = resolve
@@ -181,9 +186,16 @@ window.__ModuleLoader__.load({
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ id: this.id, password }),
         })
+        const body = await response.json().catch(() => null)
+        this.noteHostState?.(body)
         if (!response.ok) {
-          const body = await response.json().catch(() => ({}))
-          throw new Error(typeof body.error === 'string' ? body.error : `HTTP ${response.status}`)
+          if (response.status === 409) {
+            // Another browser answered first or the Host already withdrew the
+            // prompt: the panel must go away instead of showing an error.
+            this.settle()
+            return
+          }
+          throw new Error(typeof body?.error === 'string' ? body.error : `HTTP ${response.status}`)
         }
         this.settle()
       }
@@ -191,11 +203,13 @@ window.__ModuleLoader__.load({
       async cancel() {
         if (this.settled) return
         try {
-          await fetch(`${BASE}/cancel`, {
+          const response = await fetch(`${BASE}/cancel`, {
             method: 'POST',
             headers: { 'content-type': 'application/json' },
             body: JSON.stringify({ id: this.id }),
           })
+          const body = await response.json().catch(() => null)
+          this.noteHostState?.(body)
         } catch {
           // The Host may already have dropped the prompt; cancelling is best effort.
         }
@@ -316,30 +330,92 @@ window.__ModuleLoader__.load({
         )
         const controller = new AbortController()
         let active = null
+        let revision = -1
+        let epoch = null
+        /** Prompt ids settled here; a late view must not revive them. */
+        const settledIds = new Set()
+
+        /** Remember one settled prompt id, keeping the set bounded. */
+        function rememberSettled(id) {
+          settledIds.add(id)
+          if (settledIds.size > 50) settledIds.delete(settledIds.values().next().value)
+        }
+
+        /**
+         * Apply the Host identity and revision carried by a view or an
+         * answer/cancel response.
+         * @param {unknown} value Host body with optional `epoch`/`revision`.
+         * @returns {boolean} false when this is an older view that was already
+         *   in flight when a newer revision was learned; it must not revive a
+         *   settled panel.
+         */
+        function applyHostState(value) {
+          if (value === null || typeof value !== 'object') return true
+          const nextEpoch = typeof value.epoch === 'string' ? value.epoch : undefined
+          const epochChanged = nextEpoch !== undefined && epoch !== null && nextEpoch !== epoch
+          if (epochChanged) {
+            // A restarted Host starts a new revision space; drop the old one.
+            revision = -1
+            settledIds.clear()
+          }
+          if (nextEpoch !== undefined) epoch = nextEpoch
+          const viewRevision = Number.isSafeInteger(value.revision) && value.revision >= 0
+            ? value.revision
+            : undefined
+          if (viewRevision === undefined) return true
+          if (viewRevision < revision && !epochChanged) return false
+          revision = viewRevision
+          return true
+        }
+
+        /**
+         * Reconcile one Host view with the panel this browser shows. The Host
+         * is authoritative: when the prompt disappears, another browser
+         * answered, cancelled, or withdrew it, and this panel must settle
+         * instead of waiting for an answer that will never come.
+         * @param {unknown} value decoded `/pending` body.
+         */
+        function reconcile(value) {
+          const view = value !== null && typeof value === 'object' ? value : {}
+          if (!applyHostState(view)) return
+          const next = typeof view.id === 'string' ? view : null
+          if (active !== null && (next === null || next.id !== active.id)) {
+            const stale = active
+            active = null
+            rememberSettled(stale.id)
+            stale.settle()
+          }
+          if (next !== null && active === null && !settledIds.has(next.id)) {
+            const sessionId = typeof next.sessionId === 'string'
+              ? next.sessionId
+              : ctx.uiSession.current?.value?.key
+            const prompt = new SudoPrompt({ ...next, sessionId }, applyHostState)
+            active = prompt
+            const remove = publish(prompt, () => prompt.settle())
+            prompt.completion.then(() => {
+              rememberSettled(prompt.id)
+              if (active === prompt) active = null
+              remove()
+            })
+          }
+        }
 
         async function poll() {
           while (!controller.signal.aborted) {
-            if (active !== null) {
-              await active.completion
-              active = null
-              continue
-            }
             try {
-              const response = await fetch(`${BASE}/pending?wait=${POLL_WAIT_MS}`, {
+              const query = `wait=${POLL_WAIT_MS}&since=${revision}&epoch=${encodeURIComponent(epoch ?? '')}`
+              const response = await fetch(`${BASE}/pending?${query}`, {
                 signal: controller.signal,
                 headers: { accept: 'application/json' },
                 cache: 'no-store',
               })
               if (!response.ok) throw new Error(`HTTP ${response.status}`)
               const value = await response.json()
-              if (value !== null && typeof value === 'object' && typeof value.id === 'string') {
-                const sessionId = typeof value.sessionId === 'string'
-                  ? value.sessionId
-                  : ctx.uiSession.current?.value?.key
-                const prompt = new SudoPrompt({ ...value, sessionId })
-                active = prompt
-                const remove = publish(prompt, () => prompt.settle())
-                prompt.completion.then(() => remove())
+              reconcile(value)
+              if (active !== null && !Number.isSafeInteger(value?.revision)) {
+                // A Host without revisions cannot push settlement: re-check at a
+                // low rate so another browser's answer still settles this panel.
+                await new Promise((resolve) => setTimeout(resolve, LEGACY_RECHECK_MS))
               }
             } catch {
               if (controller.signal.aborted) return

package/index.js

@@ -3,6 +3,12 @@
  *
  * Registers the `remote_sudo` tool and the `/_dsh/dsh-remote-sudo/*` route the
  * Client half uses to fetch a pending password prompt and submit the password.
+ * Every pending-set change advances a monotonic revision, and clients long-poll
+ * with the revision they last saw: a prompt answered, cancelled, or withdrawn
+ * by one browser therefore settles the stale panels on every other browser
+ * (for example the desktop when the password was submitted from a phone).
+ * An epoch identifies one Host instance, so a restart cannot hide a new prompt
+ * behind a revision number a client already saw.
  *
  * Password handling: the password lives only in this process's memory and in
  * the ssh child's stdin. It is never placed in the tool call, the session log,
@@ -117,6 +123,19 @@ function numberOption(value, min, max, fallback) {
   return Math.min(Math.max(parsed, min), max)
 }
 
+/**
+ * Parse the `since` revision a polling client already observed.
+ * @param {string|null} value raw query value.
+ * @returns {number|undefined} safe integer -1..n (-1 means the client has not
+ *   seen a revision yet), or undefined when the parameter is absent or
+ *   malformed (the legacy no-revision poll).
+ */
+function parseRevision(value) {
+  if (value === null || value.length === 0) return undefined
+  const parsed = Number(value)
+  return Number.isSafeInteger(parsed) && parsed >= -1 ? parsed : undefined
+}
+
 /**
  * Resolve the plugin row's config with safe defaults.
  * @param {unknown} config raw row config.
@@ -282,6 +301,10 @@ export function apply(ctx, config = {}) {
   const waiters = new Set()
   /** @type {Map<string, {value: string, expiresAt: number}>} */
   const cachedPasswords = new Map()
+  /** Monotonic revision of the pending set, echoed by every `/pending` view. */
+  let revision = 0
+  /** Identity of this Host instance; a restart starts a new revision space. */
+  const epoch = randomUUID()
 
   function snapshot() {
     const first = pending.values().next().value
@@ -294,6 +317,8 @@ export function apply(ctx, config = {}) {
       ...(first.sessionId === undefined ? {} : { sessionId: first.sessionId }),
       createdAt: first.createdAt,
       count: pending.size,
+      revision,
+      epoch,
     }
   }
 
@@ -301,15 +326,34 @@ export function apply(ctx, config = {}) {
     for (const wake of [...waiters]) wake()
   }
 
+  /**
+   * Record one pending-set change and wake every long-poll. Called for a new
+   * prompt and for every way a prompt can end: answer, cancel, turn abort, or
+   * plugin unload.
+   */
+  function touch() {
+    revision += 1
+    wakeWaiters()
+  }
+
   /**
    * Resolve with the current or next prompt, or null after the wait.
    * @param {number} ms maximum wait.
    * @param {import('node:http').IncomingMessage} req request used to stop early.
+   * @param {number|undefined} since revision the caller already observed;
+   *   undefined keeps the legacy policy of waiting only while no prompt exists.
+   * @param {string|undefined} clientEpoch Host instance the caller believes it
+   *   is talking to; a mismatch returns immediately so a restart cannot hide a
+   *   prompt behind a reused revision. Undefined keeps revision-only semantics
+   *   for Clients written before the epoch field existed.
    * @returns {Promise<ReturnType<typeof snapshot>>} prompt snapshot.
    */
-  function waitForPrompt(ms, req) {
-    const now = snapshot()
-    if (now !== null || ms <= 0) return Promise.resolve(now)
+  function waitForPrompt(ms, req, since, clientEpoch) {
+    const changed = () => {
+      if (since === undefined) return snapshot() !== null
+      return revision !== since || (clientEpoch !== undefined && clientEpoch !== epoch)
+    }
+    if (ms <= 0 || changed()) return Promise.resolve(snapshot())
     return new Promise((resolve) => {
       let settled = false
       const finish = () => {
@@ -342,16 +386,18 @@ export function apply(ctx, config = {}) {
         ...(request.sessionId === undefined ? {} : { sessionId: request.sessionId }),
         createdAt: Date.now(),
         resolve: (value) => {
-          pending.delete(id)
+          if (!pending.delete(id)) return
+          touch()
           resolve(value)
         },
         reject: (error) => {
-          pending.delete(id)
+          if (!pending.delete(id)) return
+          touch()
           reject(error)
         },
       }
       pending.set(id, entry)
-      wakeWaiters()
+      touch()
       request.signal?.addEventListener('abort', () => {
         entry.reject(new Error('remote_sudo was aborted before the password was entered'))
       }, { once: true })
@@ -383,8 +429,10 @@ export function apply(ctx, config = {}) {
         }
         const requested = Number(url.searchParams.get('wait') ?? '0')
         const wait = Number.isFinite(requested) ? Math.min(Math.max(requested, 0), 25000) : 0
-        const prompt = await waitForPrompt(wait, req)
-        sendJson(res, 200, prompt ?? {})
+        const since = parseRevision(url.searchParams.get('since'))
+        const clientEpoch = url.searchParams.get('epoch') ?? undefined
+        const prompt = await waitForPrompt(wait, req, since, clientEpoch)
+        sendJson(res, 200, prompt ?? { revision, epoch })
         return
       }
 
@@ -398,15 +446,15 @@ export function apply(ctx, config = {}) {
         const password = typeof body?.password === 'string' ? body.password : ''
         const entry = pending.get(id)
         if (entry === undefined) {
-          sendJson(res, 409, { error: 'no pending prompt with that id' })
+          sendJson(res, 409, { error: 'no pending prompt with that id', revision, epoch })
           return
         }
         if (password.length === 0) {
-          sendJson(res, 400, { error: 'password required' })
+          sendJson(res, 400, { error: 'password required', revision, epoch })
           return
         }
         entry.resolve(password)
-        sendJson(res, 200, { ok: true })
+        sendJson(res, 200, { ok: true, revision, epoch })
         return
       }
 
@@ -419,11 +467,11 @@ export function apply(ctx, config = {}) {
         const id = typeof body?.id === 'string' ? body.id : ''
         const entry = pending.get(id)
         if (entry === undefined) {
-          sendJson(res, 409, { error: 'no pending prompt with that id' })
+          sendJson(res, 409, { error: 'no pending prompt with that id', revision, epoch })
           return
         }
         entry.reject(new Error('sudo password prompt was cancelled by the user'))
-        sendJson(res, 200, { ok: true })
+        sendJson(res, 200, { ok: true, revision, epoch })
         return
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote-sudo",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Ask for a sudo password in the DSH composer and run remote root commands over SSH without putting the password in the transcript.",
   "type": "module",
   "license": "MIT",
@@ -45,7 +45,7 @@
     "node": ">=22"
   },
   "scripts": {
-    "test": "node test/host-test.mjs && node test/client-render-test.mjs"
+    "test": "node test/host-test.mjs && node test/client-render-test.mjs && node test/client-settle-test.mjs && node test/multi-client-e2e-test.mjs"
   },
   "dsh": {
     "bundle": {