dsh-remote 0.8.25 → 0.8.27

package/README.md

@@ -10,7 +10,7 @@
 [![license](https://img.shields.io/github/license/flymysql/dsh-remote)](LICENSE)
 [![dsh-plugin](https://img.shields.io/badge/topic-dsh--plugin-7a3ef3)](https://github.com/topics/dsh-plugin)
 
-Maintained by [@flymysql](https://github.com/flymysql) · [Blog](https://gitpull.cn) · [Discussions](https://github.com/flymysql/dsh-remote/discussions) · [Issues](https://github.com/flymysql/dsh-remote/issues) · [中文说明](./README.zh.md)
+Maintained by [@flymysql](https://github.com/flymysql) · [Homepage](https://flymysql.github.io/dsh-remote/) · [Usage stats](https://flymysql.github.io/dsh-remote/stats/) · [Blog](https://gitpull.cn) · [Discussions](https://github.com/flymysql/dsh-remote/discussions) · [Issues](https://github.com/flymysql/dsh-remote/issues) · [中文说明](./README.zh.md)
 
 ![dsh-remote — make any SSH machine a real DSH workspace](docs/cover.png)
 

package/README.zh.md

@@ -4,7 +4,7 @@
 
 # dsh-remote
 
-由 [@flymysql](https://github.com/flymysql) 维护 · [博客](https://gitpull.cn) · [讨论区](https://github.com/flymysql/dsh-remote/discussions) · [Issue](https://github.com/flymysql/dsh-remote/issues) · [English](./README.md)
+由 [@flymysql](https://github.com/flymysql) 维护 · [主页](https://flymysql.github.io/dsh-remote/) · [用量统计](https://flymysql.github.io/dsh-remote/stats/) · [博客](https://gitpull.cn) · [讨论区](https://github.com/flymysql/dsh-remote/discussions) · [Issue](https://github.com/flymysql/dsh-remote/issues) · [English](./README.md)
 
 ## 官方 Desktop 兼容适配（实验性，尚未发布）
 

package/lib/client.js

@@ -143,6 +143,7 @@ window.__ModuleLoader__.load({
         'settings.updateApplied': '✅ 已更新到 v{to}（{from} → {to}），宿主半已在线热切换。',
 'settings.updateAppliedNoReload': '✅ 已更新到 v{to}（{from} → {to}）。重启 Harness 生效。',
 'settings.updatePendingReload': '⚠️ 磁盘已是 v{disk}，运行中的仍是 v{loaded}；点「立即更新」或重启 Harness 完成切换。',
+'settings.selfUpdateBlocked': 'ℹ️ 当前是 link:/开发模式安装（不在 node_modules 下），已禁止自动更新以免覆盖源码——请在你的源码仓库里更新。',
         'settings.updateFailed': '更新失败',
         'settings.updateFailedMsg': '更新失败: {msg}',
         'settings.registryUnreachable': '无法连接 npm registry',
@@ -369,6 +370,7 @@ window.__ModuleLoader__.load({
         'settings.updateApplied': '✅ Updated to v{to} ({from} → {to}); the host half hot-swapped in place.',
 'settings.updateAppliedNoReload': '✅ Updated to v{to} ({from} → {to}). Restart Harness to apply.',
 'settings.updatePendingReload': '⚠️ v{disk} is on disk but v{loaded} is still running; update again or restart Harness to switch.',
+'settings.selfUpdateBlocked': 'ℹ️ This is a link:/dev install (not under node_modules), so self-update is disabled to avoid overwriting source — update it from its source repo.',
         'settings.updateFailed': 'Update failed',
         'settings.updateFailedMsg': 'Update failed: {msg}',
         'settings.registryUnreachable': 'Cannot reach the npm registry',
@@ -820,7 +822,9 @@ window.__ModuleLoader__.load({
       const [upd, setUpd] = React.useState(null) // { current, latest, updateAvailable, updateMode, updatedMarker }
       const [updBusy, setUpdBusy] = React.useState(false)
       const [updMsg, setUpdMsg] = React.useState('')
-      const [updMode, setUpdMode] = React.useState('manual')
+      // Mirrors the host default (DEFAULT_UPDATE_MODE = 'auto') so the panel
+      // does not flash "manual" before the first /update-check answers.
+      const [updMode, setUpdMode] = React.useState('auto')
       const checkUpdate = (quiet) => {
         if (updBusy) return
         setUpdBusy(true); setUpdMsg('')
@@ -1139,6 +1143,10 @@ window.__ModuleLoader__.load({
             ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: T.warn } },
                 tr('settings.updatePendingReload', { disk: upd.disk, loaded: upd.loaded }))
             : null,
+          upd && upd.selfUpdateAllowed === false
+            ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: T.warn } },
+                tr('settings.selfUpdateBlocked'))
+            : null,
           updMsg ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: updMsg.startsWith('✅') ? T.ok : 'inherit', opacity: 0.9 } }, updMsg) : null,
         ),
         React.createElement('div', { style: { display: 'flex', gap: 12, alignItems: 'center', flexWrap: 'wrap', fontSize: 11, opacity: 0.65, borderTop: '1px solid ' + T.border, paddingTop: 10, marginTop: 4 } },

package/lib/index.js

@@ -41,7 +41,7 @@ import { searchRemote } from './search.js'
 import { resolveMirror, poolKey, lookupSessionCwd, encodeSegmentSafe, readSessionHeaderCwd, requestSessionHint } from './binding.js'
 import { TaskManager } from './tasks.js'
 import { ForwardManager } from './forwards.js'
-import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload } from './update.js'
+import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload, isInstalledCopy } from './update.js'
 import { sendHeartbeat, pseudonym, heartbeatUrl, hasPersistedId, installIdPath } from './telemetry.js'
 import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
@@ -51,6 +51,16 @@ import { listDirStructured, removeRemoteTree } from './remote-fs.js'
 
 export const name = 'dsh-remote'
 
+/** Update mode used when neither the persisted `update-mode` file nor the
+ *  profile config supplies one.
+ *
+ *  Kept as one exported constant on purpose: the value appears in the schema
+ *  default, in the `/update-check` response and in the auto-update gate, and
+ *  three hard-coded copies drift (the first version of this change left two
+ *  `|| 'manual'` fallbacks that quietly disagreed with the new schema default).
+ *  Changing the default must change exactly one place. */
+export const DEFAULT_UPDATE_MODE = 'auto'
+
 // Web and Desktop share the SSH tools; each optional UI transport is attached
 // reactively below, so service startup order does not drop the JSON routes.
 export const inject = ['tools', 'systemPrompt']
@@ -124,11 +134,18 @@ export const Config = z.object({
   /** Wall-clock budget (ms) for one remote `@` index pass; on expiry the
    *  partial index answers rather than making the caret wait. */
   fileReferenceTimeoutMs: z.number().step(1).min(200).default(4000),
-  /** Update mode: `manual` (default) only checks when asked; `auto` checks on
-   * load and periodically, applying a newer npm release automatically;
-   * `off` disables version checks entirely. (schemastery 3.18 has no .enum —
-   * keep string and validate in code.) */
-  updateMode: z.string().default('manual'),
+  /** Update mode: `auto` (default) checks on load and periodically, applies a
+   * newer npm release automatically, then hot-swaps the host half (see
+   * `updateAutoReload`); `manual` only checks when the user asks; `off` disables
+   * version checks entirely. (schemastery 3.18 has no .enum — keep string and
+   * validate in code.)
+   *
+   * `auto` became the default in 0.8.27. It could not have been a safe default
+   * before 0.8.24: an update only replaced files on disk and needed a restart,
+   * which left users running a new browser half against an old host half with no
+   * visible signal. 0.8.24 added the hot swap (and `pendingReload` when it is
+   * turned off), so an unattended update now actually takes effect. */
+  updateMode: z.string().default(DEFAULT_UPDATE_MODE),
   /** How often (ms) auto mode checks the npm registry for a newer release. */
   updateCheckIntervalMs: z.number().step(1).min(60000).default(6 * 3600 * 1000),
   /** Whether a landed update also hot-swaps the running host half (default
@@ -2789,14 +2806,21 @@ export async function apply(ctx, config) {
         // They differ between an applied update and its hot swap (or a boot).
         const loaded = LOADED_VERSION
         const disk = diskVersion()
-        const rawMode = readUpdateMode() || config.updateMode || 'manual'
+        // Three-layer precedence: the persisted `update-mode` override (settings
+        // UI) beats the profile config, which beats DEFAULT_UPDATE_MODE. The
+        // fallback must not hard-code a second default here, or this path would
+        // silently disagree with the schema default.
+        const rawMode = readUpdateMode() || config.updateMode || DEFAULT_UPDATE_MODE
         const base = {
           current: loaded,
           loaded,
           disk,
           pendingReload: gtVersion(disk, loaded),
-          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual',
+          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : DEFAULT_UPDATE_MODE,
           updatedMarker: existsSync(path.join(selfDir(), '.dsh-remote-updated')),
+          // Exposed so the settings page can explain why `auto` may not act:
+          // a link:/dev install must not be overwritten by an npm publish.
+          selfUpdateAllowed: isInstalledCopy(),
         }
         const latest = await fetchLatestVersion()
         if (latest === null) return sendJson(res, 200, { ok: false, ...base, error: '无法连接 npm registry' })
@@ -2875,9 +2899,10 @@ export async function apply(ctx, config) {
 
   // ── auto-update: check on load + on an interval; apply silently ───────────
   // Failures are swallowed (never break the plugin). The persisted override
-  // (settings UI) wins over the profile-config default.
-  const rawMode = readUpdateMode() || config.updateMode || 'manual'
-  const effectiveUpdateMode = ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual'
+  // (settings UI) wins over the profile-config default, which wins over
+  // DEFAULT_UPDATE_MODE — the single source of truth for the fallback.
+  const rawMode = readUpdateMode() || config.updateMode || DEFAULT_UPDATE_MODE
+  const effectiveUpdateMode = ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : DEFAULT_UPDATE_MODE
   if (effectiveUpdateMode === 'auto') {
     const checkAndApply = async () => {
       const latest = await fetchLatestVersion()
@@ -2892,6 +2917,9 @@ export async function apply(ctx, config) {
       try {
         await applyUpdate(latest)
       } catch {
+        // 常见且预期的失败：link:/开发模式安装时 applyUpdate 会拒绝
+        // （避免覆盖源码仓库）。这不是异常，静默即可——那类用户在自己的
+        // 仓库里更新。
         return
       }
       // Landed: swap the running host half too, otherwise the code being served

package/lib/telemetry.js

@@ -23,8 +23,19 @@ import { createHmac, randomUUID } from 'node:crypto'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 
-/** 上报端点（CloudBase HTTP 访问服务）。改域名只需改这一行。 */
-const HEARTBEAT_URL = 'https://gitbolg-d7gmnsrw46e011706-1256429518.ap-shanghai.app.tcloudbase.com/dsh-hb/heartbeat'
+/** 上报端点（CloudBase HTTP 访问服务）。改域名只需改这一行。
+ *  可用 `DSH_REMOTE_HEARTBEAT_URL` 覆盖——存在的理由不是"让用户改"
+ *  （默认行为不该需要配置），而是：① 测试必须能把它重定向掉，
+ *  否则跑一次 npm test 就会往生产统计里灌假装机（发生过）；
+ *  ② 作者换端点/灰度时不必为了改一行字符串发一次版。 */
+const DEFAULT_HEARTBEAT_URL = 'https://gitbolg-d7gmnsrw46e011706-1256429518.ap-shanghai.app.tcloudbase.com/dsh-hb/heartbeat'
+
+/** 解析实际使用的端点（env 覆盖优先，仅接受 https，避免被降级到明文）。 */
+export function heartbeatUrl() {
+  const override = process.env.DSH_REMOTE_HEARTBEAT_URL
+  if (override && /^https:\/\//i.test(override)) return override
+  return DEFAULT_HEARTBEAT_URL
+}
 /** 伪名盐：服务端无法反推身份，且换盐即可切断历史关联。 */
 const SALT = 'dsh-remote/telemetry/v1'
 const ID_FILE = '.dsh-remote-install-id'
@@ -80,16 +91,34 @@ export function pseudonym(home) {
 /** 是否到该上报了（进程内节流，避免每次工具调用都发）。 */
 let lastSentAt = 0
 
+/** 是否处于测试进程。
+ *
+ *  ★ 这是一道**代码级**兜底，不是便利设施。事故背景：光靠 package.json 里的
+ *  `--import ./test/setup-telemetry-off.mjs` 前置不够——它只覆盖 `npm test`，
+ *  任何人直接 `node --test test/upload.test.js` 就会绕过它，而 upload.test.js
+ *  会调用真实 apply()，于是**线上日活表被写进来自测试的假装机**
+ *  （实测：直接跑一次，云端立刻多一行；曾出现"只用过 Windows 的机器冒出 Linux 装机"）。
+ *
+ *  Node 的测试运行器会在**子进程**里设 `NODE_TEST_CONTEXT`（如 child-v8），
+ *  父进程可能没有，所以同时看父进程的 `--test` 参数。判定为真时直接不发。
+ *  代价：测试里也就无法验证"真的发出去了"——那正是本函数要保证的，
+ *  真机端到端请用隔离沙箱启动真实 DSH（README 有说明）。
+ */
+export function inTestProcess() {
+  if (process.env.NODE_TEST_CONTEXT) return true
+  const execArgv = process.execArgv || []
+  if (execArgv.some((a) => a === '--test' || String(a).startsWith('--test-'))) return true
+  return false
+}
+
 /**
- * 发送一次心跳。**永不抛出**，也永不返回可导致分支的失败态：
- * 调用方不需要 try/catch，心跳成功与否都不应改变任何行为。
- * @param home - DSH_HOME 绝对路径。
- * @param version - 运行中的插件版本（用 LOADED_VERSION，即真正在跑的代码版本）。
- * @param options.delayMs - 发送前延迟（默认 {@link STARTUP_DELAY_MS}）；
- *   避开启动高峰。测试可传 0。
- * @returns 是否真的发出了请求（仅用于测试与自检）。
+ * 真正执行发送（不含"是否处于测试进程"的守卫）。
+ *
+ * 拆出来的原因：守卫本身必须可测，而"能测"又不能变成生产代码的后门——
+ * 所以守卫只存在于 {@link sendHeartbeat} 里，本函数只被它与测试直接调用，
+ * 且**不导出给业务代码**（导出名带下划线前缀，见文件末尾）。
  */
-export async function sendHeartbeat(home, version, options = {}) {
+async function deliver(home, version, options = {}) {
   const now = Date.now()
   if (now - lastSentAt < MIN_INTERVAL_MS) return false
 
@@ -98,8 +127,12 @@ export async function sendHeartbeat(home, version, options = {}) {
   lastSentAt = now
   try {
     if (delayMs) await new Promise((r) => {
-      const t = setTimeout(r, delayMs)
-      if (typeof t.unref === 'function') t.unref()
+      // ★ 这里**不能 unref**。曾经 unref 过延迟定时器，结果是：await 一个已
+      //    unref 的定时器不会让事件循环保活，当进程恰好没有别的 pending 句柄时
+      //    Node 会**直接退出**，心跳一次都发不出去（CI 上稳定复现：本地因为其它
+      //    测试还留着句柄而侥幸变绿）。延迟是为了让心跳成功，就必须让它把进程
+      //    留住这几秒；插件真实运行时也不可能因为多等 3s 影响用户。
+      setTimeout(r, delayMs)
     })
     const body = JSON.stringify({
       idHash: pseudonym(home),
@@ -111,7 +144,7 @@ export async function sendHeartbeat(home, version, options = {}) {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), TIMEOUT_MS)
     try {
-      await fetch(HEARTBEAT_URL, {
+      await fetch(heartbeatUrl(), {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body,
@@ -129,6 +162,21 @@ export async function sendHeartbeat(home, version, options = {}) {
   }
 }
 
+/**
+ * 发送一次心跳。**永不抛出**，也永不返回可导致分支的失败态：
+ * 调用方不需要 try/catch，心跳成功与否都不应改变任何行为。
+ * @param home - DSH_HOME 绝对路径。
+ * @param version - 运行中的插件版本（用 LOADED_VERSION，即真正在跑的代码版本）。
+ * @param options.delayMs - 发送前延迟（默认 {@link STARTUP_DELAY_MS}）；
+ *   避开启动高峰。测试可传 0。
+ * @returns 是否真的发出了请求（仅用于测试与自检）。
+ */
+export async function sendHeartbeat(home, version, options = {}) {
+  // 测试进程一律不外呼：统计数据的可信度比"测试里能验证外呼"重要得多。
+  if (inTestProcess()) return false
+  return deliver(home, version, options)
+}
+
 /** 清空节流与缓存（仅测试用）。 */
 export function _resetForTest() {
   lastSentAt = 0
@@ -137,12 +185,7 @@ export function _resetForTest() {
 
 /** 心跳是否已配置（供设置页显示；不含端点本身）。 */
 export function heartbeatEnabled() {
-  return typeof HEARTBEAT_URL === 'string' && HEARTBEAT_URL.startsWith('https://')
-}
-
-/** 供自检/文档使用的端点（不涉密，可公开）。 */
-export function heartbeatUrl() {
-  return HEARTBEAT_URL
+  return heartbeatUrl().startsWith('https://')
 }
 
 /** 身份文件是否已存在（自检用，不创建）。 */
@@ -159,5 +202,12 @@ export function installIdPath(home) {
   return path.join(home, ID_FILE)
 }
 
-// existsSync 仅用于自检导出，避免被 tree-shake 掉误报
-export { existsSync as _existsSync }
+/**
+ * 测试专用入口：绕过"测试进程不外呼"的守卫，用来验证发送逻辑本身
+ * （字段白名单、节流、失败回滚、延迟）。
+ *
+ * 之所以必须存在：守卫让 sendHeartbeat 在测试里恒返回 false，于是发送逻辑
+ * 就完全测不到了。真正的安全来自**端点可覆盖**（测试把 URL 指向本地不可达地址）
+ * 而不是来自这个函数——它只是把守卫那道门打开给测试用。
+ */
+export const _deliverForTest = deliver

package/lib/update.js

@@ -39,6 +39,27 @@ export function selfDir() {
   }
 }
 
+/**
+ * 本插件是否装在 `node_modules` 之下（即真正的"安装副本"）。
+ *
+ * ★ 为什么必须有这道判断（实测依据，不是防御性猜测）：
+ *   `selfDir()` 基于 `import.meta.url`，而 **Node 的 ESM 解析会对符号链接做
+ *   realpath**（已实测：经由 symlink 导入时 `import.meta.url` 报告的是
+ *   `/real/mod.mjs` 而不是 `/link/mod.mjs`）。于是当插件以 `link:` / 开发模式
+ *   安装时，`selfDir()` 指向的是**用户的源码仓库**，而不是安装副本。
+ *   一旦 `auto` 更新落地，`applyUpdate` 就会拿 npm 包覆盖那份源码
+ *   （丢改动、脏工作树）。默认改成 `auto` 之后这个风险从"手点才触发"
+ *   变成"自动发生"，所以在此拦下：不在 node_modules 下就不自更新。
+ *
+ * 代价：少数把插件放在非标准路径的部署不会被自动更新——他们仍可手动更新。
+ * 这个方向的取舍是正确的：宁可少更新，也不能悄悄毁掉源码。
+ * @param dir - 要判定的目录（默认本插件的 selfDir()）。
+ */
+export function isInstalledCopy(dir = selfDir()) {
+  const normalized = String(dir).split(path.sep).join('/').toLowerCase()
+  return normalized.includes('/node_modules/')
+}
+
 /** Read the installed package.json version; "0.0.0" when unreadable. */
 export function readVersion() {
   try {
@@ -77,6 +98,9 @@ export async function fetchLatestVersion(timeoutMs = 8000) {
   try {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), timeoutMs)
+    // 纯看门狗：调用方并不 await 它，所以必须 unref，否则这一段超时窗口
+    // 会拖住事件循环、让本该退出的短命进程（脚本、测试）多挂数秒。
+    if (typeof timer.unref === 'function') timer.unref()
     try {
       const res = await fetch(REGISTRY_URL, { signal: controller.signal, headers: { accept: 'application/json' } })
       if (!res.ok) return null
@@ -117,6 +141,13 @@ function parseTar(buf) {
  * @param targetVersion - exact npm version to install (e.g. "0.8.0").
  */
 export async function applyUpdate(targetVersion, options = {}) {
+  // 拒绝对非安装副本自更新：`auto` 默认开启后，一次自动更新就会覆盖
+  // `selfDir()` 指向的目录，而以 link:/开发模式安装时那正是用户的源码仓库
+  // （见 isInstalledCopy 的实测说明）。测试用 options.dir 指向临时目录，
+  // 因此不受此限（options.dir 存在即视为显式指定，跳过检查）。
+  if (!options.dir && !isInstalledCopy()) {
+    throw new Error('refusing to self-update: this copy is not under node_modules (link/dev install) — update it from its source repo instead')
+  }
   const tarballUrl = `https://registry.npmjs.org/${NPM_PACKAGE}/-/${NPM_PACKAGE}-${targetVersion}.tgz`
   const dir = options.dir || selfDir()
   const doFetch = options.fetchImpl || fetch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.25",
+  "version": "0.8.27",
   "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 20 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",
@@ -77,6 +77,6 @@
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --import ./test/setup-telemetry-off.mjs --test"
   }
 }