dsh-remote 0.7.4 → 0.7.5

package/lib/client.js

@@ -85,6 +85,46 @@ window.__ModuleLoader__.load({
       const refresh = () => api('GET', '/dsh-remote/machines').then((r) => { setMachines(r.machines || []); setCurrentId(r.currentId || '') })
       React.useEffect(() => { refresh() }, [])
 
+      // ── update state ────────────────────────────────────────────────────────
+      const [upd, setUpd] = React.useState(null) // { current, latest, updateAvailable, updateMode, updatedMarker }
+      const [updBusy, setUpdBusy] = React.useState(false)
+      const [updMsg, setUpdMsg] = React.useState('')
+      const [updMode, setUpdMode] = React.useState('manual')
+      const checkUpdate = (quiet) => {
+        if (updBusy) return
+        setUpdBusy(true); setUpdMsg('')
+        api('GET', '/dsh-remote/update-check')
+          .then((r) => {
+            if (!r || !r.ok) { setUpdMsg((r && r.error) || '检查更新失败'); return }
+            setUpd(r)
+            if (r.updateMode) setUpdMode(r.updateMode)
+            if (!quiet) setUpdMsg(r.updateAvailable ? '发现新版本 ' + r.latest : '已是最新版本（v' + r.current + '）')
+          })
+          .catch((e) => setUpdMsg(String((e && e.message) || e)))
+          .finally(() => setUpdBusy(false))
+      }
+      const applyUpdateNow = () => {
+        if (!upd || !upd.latest) return
+        if (!window.confirm('将更新 dsh-remote 到 v' + upd.latest + '，替换本机插件文件。更新后需重启 Harness 生效。继续？')) return
+        setUpdBusy(true); setUpdMsg('')
+        api('POST', '/dsh-remote/update-apply', { version: upd.latest })
+          .then((r) => {
+            if (r && r.ok) setUpdMsg('✅ 已更新到 v' + r.to + '（' + r.from + ' → ' + r.to + '）。重启 Harness 生效。')
+            else setUpdMsg((r && r.error) || '更新失败')
+            checkUpdate(true)
+          })
+          .catch((e) => setUpdMsg('更新失败: ' + String((e && e.message) || e)))
+          .finally(() => setUpdBusy(false))
+      }
+      // 更新模式持久化:auto/manual/off 通过 /dsh-remote/update-check 返回当前值;
+      // 修改模式这里仅本地提示(host 侧 config 由 profile 配置)。为简单可靠,
+      // 模式切换写入 host 配置目录下的 override 文件,host 加载时读取。
+      const saveUpdateMode = (mode) => {
+        setUpdMode(mode); setUpdMsg('更新模式已设为「' + (mode === 'auto' ? '自动' : mode === 'off' ? '关闭' : '手动') + '」')
+        api('POST', '/dsh-remote/update-mode', { mode }).catch((e) => setUpdMsg('模式保存失败: ' + String((e && e.message) || e)))
+      }
+      React.useEffect(() => { checkUpdate(true) }, [])
+
       const setF = (k) => (ev) => setForm({ ...form, [k]: ev.target.value })
       const startEdit = (m) => setForm({ name: m.name, host: m.host, port: String(m.port || 22), username: m.username || 'root', password: '', privateKeyPath: m.privateKeyPath || '', id: m.id })
       const save = (action) => {
@@ -140,12 +180,34 @@ window.__ModuleLoader__.load({
           ),
         ),
         err ? React.createElement('div', { style: { color: T.danger, fontSize: 13 } }, err) : null,
+        React.createElement('div', { style: boxS },
+          React.createElement('div', { style: { marginBottom: 6, fontSize: 13, fontWeight: 600 } }, '更新'),
+          React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center', flexWrap: 'wrap', fontSize: 12 } },
+            upd
+              ? React.createElement('span', { style: { opacity: 0.85 } }, '当前 v' + upd.current + (upd.updateAvailable ? React.createElement('b', { style: { color: T.ok, marginLeft: 6 } }, '→ 新版本 v' + upd.latest) : null))
+              : React.createElement('span', { style: { opacity: 0.6 } }, '版本信息加载中…'),
+            React.createElement('button', { style: { ...buttonS, padding: '2px 10px' }, onClick: () => checkUpdate(false), disabled: updBusy }, updBusy ? '检查中…' : '检查更新'),
+            upd && upd.updateAvailable
+              ? React.createElement('button', { style: { ...buttonS, padding: '2px 10px', fontWeight: 700, color: T.ok }, onClick: applyUpdateNow, disabled: updBusy }, '立即更新')
+              : null,
+          ),
+          React.createElement('div', { style: { display: 'flex', gap: 8, alignItems: 'center', marginTop: 6, fontSize: 12 } },
+            React.createElement('span', { style: { opacity: 0.8 } }, '更新模式：'),
+            ['manual', 'auto', 'off'].map((m) =>
+              React.createElement('button', {
+                key: m, style: { ...buttonS, padding: '2px 10px', fontWeight: updMode === m ? 700 : 400, color: updMode === m ? T.ok : 'inherit' },
+                onClick: () => saveUpdateMode(m), disabled: updBusy,
+              }, m === 'manual' ? '手动' : m === 'auto' ? '自动' : '关闭'),
+            ),
+          ),
+          updMsg ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: updMsg.startsWith('✅') || updMsg.startsWith('已是最新') ? T.ok : 'inherit', opacity: 0.9 } }, updMsg) : null,
+        ),
         React.createElement('div', { style: { display: 'flex', gap: 12, alignItems: 'center', flexWrap: 'wrap', fontSize: 11, opacity: 0.65, borderTop: '1px solid ' + T.border, paddingTop: 10, marginTop: 4 } },
           React.createElement('span', {}, '觉得好用？'),
           React.createElement('a', { href: 'https://github.com/flymysql/dsh-remote', target: '_blank', rel: 'noopener noreferrer', style: { color: 'inherit' } }, '⭐ 去 GitHub 点个 Star'),
           React.createElement('span', {}, '·'),
           React.createElement('a', { href: 'https://github.com/flymysql/dsh-remote/issues/new', target: '_blank', rel: 'noopener noreferrer', style: { color: 'inherit' } }, '💬 反馈建议 / 提 issue'),
-          React.createElement('span', { style: { marginLeft: 'auto', opacity: 0.5 } }, 'dsh-remote v0.7.4'),
+          React.createElement('span', { style: { marginLeft: 'auto', opacity: 0.5 } }, 'dsh-remote v0.7.5'),
         ),
       )
     }

package/lib/index.js

@@ -20,9 +20,10 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import ssh2 from 'ssh2'
 import { createHash } from 'node:crypto'
 import { execFile } from 'node:child_process'
-import { readFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, statSync, renameSync, copyFileSync, utimesSync } from 'node:fs'
+import { readFileSync, mkdirSync, writeFileSync, existsSync, readdirSync, statSync, renameSync, copyFileSync, utimesSync, rmSync } from 'node:fs'
 import { homedir } from 'node:os'
 import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 const { Client } = ssh2
 
@@ -62,6 +63,12 @@ export const Config = z.object({
    * accept-new); `verify` also rejects hosts never seen before; `off` skips
    * verification entirely (MITM-unsafe, not recommended). */
   hostKeyMode: z.string().default('accept-new'),
+  /** Update mode: `manual` (default) only checks when asked; `auto` checks on
+   * load and periodically, applying a newer npm release automatically;
+   * `off` disables version checks entirely. */
+  updateMode: z.enum(['manual', 'auto', 'off']).default('manual'),
+  /** How often (ms) auto mode checks the npm registry for a newer release. */
+  updateCheckIntervalMs: z.number().step(1).min(60000).default(6 * 3600 * 1000),
 })
 
 // ── shell / path helpers (proven in the read tooling) ───────────────────────
@@ -1462,6 +1469,169 @@ export async function apply(ctx, config) {
     res.setHeader('Content-Type', 'application/json; charset=utf-8')
     res.end(JSON.stringify(body))
   }
+
+  // ── self-update (version check + apply) ────────────────────────────────────
+  // dsh-remote is a zero-build plugin: the host half (lib/index.js) is loaded
+  // straight from the installed package, so "updating" = replacing the package
+  // files with the newer npm tarball. We never mutate node_modules directly
+  // (pnpm owns it); instead we write the fresh files into the same directory
+  // the loader already resolved, which is the profile's node_modules/dsh-remote
+  // (hoisted) or the .pnpm store copy — both are writable for the local user.
+  const NPM_PACKAGE = 'dsh-remote'
+  const REGISTRY_URL = 'https://registry.npmjs.org/' + NPM_PACKAGE + '/latest'
+  /** Absolute directory holding this plugin's installed files (lib/ + package.json). */
+  const selfDir = () => {
+    try {
+      return path.dirname(path.dirname(fileURLToPath(import.meta.url)))
+    } catch {
+      return path.dirname(path.dirname(process.argv[1] || ''))
+    }
+  }
+  const readVersion = () => {
+    try {
+      const pkg = JSON.parse(readFileSync(path.join(selfDir(), 'package.json'), 'utf8'))
+      return String(pkg.version || '0.0.0')
+    } catch {
+      return '0.0.0'
+    }
+  }
+  const currentVersion = readVersion()
+  // A mode persisted via the settings UI (/dsh-remote/update-mode) wins over
+  // the profile-config default, so the user's choice survives restarts without
+  // editing cordis config.
+  const persistedMode = (() => {
+    try {
+      const m = readFileSync(path.join(selfDir(), 'update-mode'), 'utf8').trim()
+      return ['manual', 'auto', 'off'].includes(m) ? m : null
+    } catch {
+      return null
+    }
+  })()
+  if (persistedMode) config.updateMode = persistedMode
+  /** Query the npm registry for the latest release; resolves null on any failure. */
+  const fetchLatestVersion = async (timeoutMs = 8000) => {
+    try {
+      const controller = new AbortController()
+      const timer = setTimeout(() => controller.abort(), timeoutMs)
+      try {
+        const res = await fetch(REGISTRY_URL, { signal: controller.signal, headers: { 'accept': 'application/json' } })
+        if (!res.ok) return null
+        const data = await res.json()
+        return typeof data?.version === 'string' && data.version ? data.version : null
+      } finally {
+        clearTimeout(timer)
+      }
+    } catch {
+      return null
+    }
+  }
+  /** Compare dotted versions; returns true when a > b. */
+  const gtVersion = (a, b) => {
+    const pa = String(a || '').split('.').map((n) => parseInt(n, 10) || 0)
+    const pb = String(b || '').split('.').map((n) => parseInt(n, 10) || 0)
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const da = pa[i] || 0
+      const db = pb[i] || 0
+      if (da !== db) return da > db
+    }
+    return false
+  }
+  /**
+   * Download the given version's tarball and atomically replace the installed
+   * package files (lib/*.js, cordis.patch.yml, package.json). A stale marker
+   * file (.dsh-remote-updated) is written so the client can tell the user to
+   * reload; the loader picks the new host half up on the next boot.
+   */
+  const applyUpdate = async (targetVersion) => {
+    const tarballUrl = `https://registry.npmjs.org/${NPM_PACKAGE}/-/${NPM_PACKAGE}-${targetVersion}.tgz`
+    const dir = selfDir()
+    const tmpRoot = path.join(dir, `.dsh-remote-update-${Date.now()}`)
+    const tmpPkg = path.join(tmpRoot, 'package')
+    try {
+      const controller = new AbortController()
+      const timer = setTimeout(() => controller.abort(), 60000)
+      let res
+      try {
+        res = await fetch(tarballUrl, { signal: controller.signal })
+      } finally {
+        clearTimeout(timer)
+      }
+      if (!res.ok) throw new Error(`download failed (HTTP ${res.status})`)
+      const buf = Buffer.from(await res.arrayBuffer())
+      // npm tarballs are gzipped tar; extract the package/ directory.
+      mkdirSync(tmpRoot, { recursive: true })
+      // Minimal tar.gz extractor: we only need package/{lib,package.json,cordis.patch.yml}.
+      // Use node's zlib gunzip + a tiny tar parser for the regular files we ship.
+      const { gunzipSync } = await import('node:zlib')
+      const tar = gunzipSync(buf)
+      const files = parseTar(tar)
+      let extracted = 0
+      for (const f of files) {
+        const rel = f.name.replace(/^package\//, '')
+        if (!rel || rel === 'package/' || rel.endsWith('/')) continue
+        if (rel !== 'package.json' && rel !== 'cordis.patch.yml' && !rel.startsWith('lib/')) continue
+        const dest = path.join(tmpPkg, rel)
+        mkdirSync(path.dirname(dest), { recursive: true })
+        writeFileSync(dest, f.data)
+        extracted++
+      }
+      if (extracted === 0) throw new Error('tarball contained no package files')
+      // Verify the downloaded package.json matches the requested version.
+      const newPkg = JSON.parse(readFileSync(path.join(tmpPkg, 'package.json'), 'utf8'))
+      if (newPkg.version !== targetVersion) throw new Error(`tarball version mismatch: ${newPkg.version}`)
+      // Atomically swap: copy fresh files over the installed ones.
+      const installLib = path.join(dir, 'lib')
+      const tmpLib = path.join(tmpPkg, 'lib')
+      for (const name of ['index.js', 'client.js']) {
+        const src = path.join(tmpLib, name)
+        if (existsSync(src)) copyFileSync(src, path.join(installLib, name))
+      }
+      for (const rel of ['package.json', 'cordis.patch.yml']) {
+        const src = path.join(tmpPkg, rel)
+        if (existsSync(src)) copyFileSync(src, path.join(dir, rel))
+      }
+      writeFileSync(path.join(dir, '.dsh-remote-updated'), String(targetVersion))
+      return { ok: true, from: currentVersion, to: targetVersion }
+    } catch (err) {
+      throw new Error('update failed: ' + ((err && err.message) || err))
+    } finally {
+      try { rmSync(tmpRoot, { recursive: true, force: true }) } catch {}
+    }
+  }
+  /** Minimal POSIX ustar parser (regular files only) for npm tarballs. */
+  function parseTar(buf) {
+    const files = []
+    let off = 0
+    while (off + 512 <= buf.length) {
+      const header = buf.subarray(off, off + 512)
+      const name = header.subarray(0, 100).toString('utf8').replace(/\0.*$/, '')
+      if (!name) break
+      const sizeStr = header.subarray(124, 136).toString('utf8').replace(/\0.*$/, '').trim()
+      const size = parseInt(sizeStr, 8) || 0
+      const type = String.fromCharCode(header[156] || 48)
+      off += 512
+      const data = type === '48' || type === '0' ? Buffer.from(buf.subarray(off, off + size)) : null
+      if (data) files.push({ name, data })
+      off += Math.ceil(size / 512) * 512
+    }
+    return files
+  }
+  // Auto mode: check once on load and on an interval; apply silently when a
+  // newer version exists. Failures are swallowed (never break the plugin).
+  let updateTimer = null
+  if (config.updateMode === 'auto') {
+    const checkAndApply = async () => {
+      const latest = await fetchLatestVersion()
+      if (latest && gtVersion(latest, currentVersion)) {
+        try { await applyUpdate(latest) } catch {}
+      }
+    }
+    void checkAndApply()
+    updateTimer = setInterval(checkAndApply, Math.max(config.updateCheckIntervalMs, 60000))
+    if (typeof updateTimer.unref === 'function') updateTimer.unref()
+    ctx.effect(() => () => { if (updateTimer) clearInterval(updateTimer) }, 'dsh-remote.update-timer')
+  }
+
   // Cap request bodies (1 MiB) so a malformed client cannot force us to buffer
   // unbounded memory on a local-only route.
   const MAX_BODY_BYTES = 1024 * 1024
@@ -1804,6 +1974,60 @@ export async function apply(ctx, config) {
         return sendJson(res, 200, { ok: true, ...status() })
       },
     },
+    {
+      kind: 'exact',
+      path: '/dsh-remote/update-check',
+      handler: async (req, res) => {
+        if (req.method !== 'GET') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
+        const latest = await fetchLatestVersion()
+        if (latest === null) return sendJson(res, 200, { ok: false, current: currentVersion, error: '无法连接 npm registry' })
+        const updateAvailable = gtVersion(latest, currentVersion)
+        const updatedMarker = existsSync(path.join(selfDir(), '.dsh-remote-updated'))
+        return sendJson(res, 200, {
+          ok: true,
+          current: currentVersion,
+          latest,
+          updateAvailable,
+          updateMode: config.updateMode,
+          updatedMarker,
+        })
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-remote/update-mode',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
+        try {
+          const body = JSON.parse((await readBody(req)) || '{}')
+          const mode = String(body.mode || '')
+          if (!['manual', 'auto', 'off'].includes(mode)) return sendJson(res, 400, { ok: false, error: 'mode must be manual | auto | off' })
+          // Persist to the plugin's install dir so it survives restarts; the
+          // effective value is read back on next load by the host half.
+          const dir = selfDir()
+          try { writeFileSync(path.join(dir, 'update-mode'), mode) } catch (e) { return sendJson(res, 500, { ok: false, error: 'cannot persist mode: ' + ((e && e.message) || e) }) }
+          return sendJson(res, 200, { ok: true, mode })
+        } catch (err) {
+          return sendJson(res, 500, { ok: false, error: String((err && err.message) || err) })
+        }
+      },
+    },
+    {
+      kind: 'exact',
+      path: '/dsh-remote/update-apply',
+      handler: async (req, res) => {
+        if (req.method !== 'POST') return sendJson(res, 405, { ok: false, error: 'method not allowed' })
+        try {
+          const body = JSON.parse((await readBody(req)) || '{}')
+          const target = String(body.version || '')
+          if (!target) return sendJson(res, 400, { ok: false, error: 'version is required' })
+          const result = await applyUpdate(target)
+          return sendJson(res, 200, { ok: true, ...result })
+        } catch (err) {
+          return sendJson(res, 500, { ok: false, error: String((err && err.message) || err) })
+        }
+      },
+    },
   ]
 
   const disposers = routes.map((r) => webServer.register(r))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password or key), pick a remote workspace, operate on it with rw_pick_workspace / rw_list_dir / rw_read_file / rw_exec / rw_sync tools, and mirror it to a real local directory (SFTP) so the DSH native workspace can adopt it.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",