dsh-remote 0.8.26 → 0.8.27

package/lib/client.js

@@ -143,6 +143,7 @@ window.__ModuleLoader__.load({
         'settings.updateApplied': '✅ 已更新到 v{to}（{from} → {to}），宿主半已在线热切换。',
 'settings.updateAppliedNoReload': '✅ 已更新到 v{to}（{from} → {to}）。重启 Harness 生效。',
 'settings.updatePendingReload': '⚠️ 磁盘已是 v{disk}，运行中的仍是 v{loaded}；点「立即更新」或重启 Harness 完成切换。',
+'settings.selfUpdateBlocked': 'ℹ️ 当前是 link:/开发模式安装（不在 node_modules 下），已禁止自动更新以免覆盖源码——请在你的源码仓库里更新。',
         'settings.updateFailed': '更新失败',
         'settings.updateFailedMsg': '更新失败: {msg}',
         'settings.registryUnreachable': '无法连接 npm registry',
@@ -369,6 +370,7 @@ window.__ModuleLoader__.load({
         'settings.updateApplied': '✅ Updated to v{to} ({from} → {to}); the host half hot-swapped in place.',
 'settings.updateAppliedNoReload': '✅ Updated to v{to} ({from} → {to}). Restart Harness to apply.',
 'settings.updatePendingReload': '⚠️ v{disk} is on disk but v{loaded} is still running; update again or restart Harness to switch.',
+'settings.selfUpdateBlocked': 'ℹ️ This is a link:/dev install (not under node_modules), so self-update is disabled to avoid overwriting source — update it from its source repo.',
         'settings.updateFailed': 'Update failed',
         'settings.updateFailedMsg': 'Update failed: {msg}',
         'settings.registryUnreachable': 'Cannot reach the npm registry',
@@ -820,7 +822,9 @@ window.__ModuleLoader__.load({
       const [upd, setUpd] = React.useState(null) // { current, latest, updateAvailable, updateMode, updatedMarker }
       const [updBusy, setUpdBusy] = React.useState(false)
       const [updMsg, setUpdMsg] = React.useState('')
-      const [updMode, setUpdMode] = React.useState('manual')
+      // Mirrors the host default (DEFAULT_UPDATE_MODE = 'auto') so the panel
+      // does not flash "manual" before the first /update-check answers.
+      const [updMode, setUpdMode] = React.useState('auto')
       const checkUpdate = (quiet) => {
         if (updBusy) return
         setUpdBusy(true); setUpdMsg('')
@@ -1139,6 +1143,10 @@ window.__ModuleLoader__.load({
             ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: T.warn } },
                 tr('settings.updatePendingReload', { disk: upd.disk, loaded: upd.loaded }))
             : null,
+          upd && upd.selfUpdateAllowed === false
+            ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: T.warn } },
+                tr('settings.selfUpdateBlocked'))
+            : null,
           updMsg ? React.createElement('div', { style: { marginTop: 6, fontSize: 12, color: updMsg.startsWith('✅') ? T.ok : 'inherit', opacity: 0.9 } }, updMsg) : null,
         ),
         React.createElement('div', { style: { display: 'flex', gap: 12, alignItems: 'center', flexWrap: 'wrap', fontSize: 11, opacity: 0.65, borderTop: '1px solid ' + T.border, paddingTop: 10, marginTop: 4 } },

package/lib/index.js

@@ -41,7 +41,7 @@ import { searchRemote } from './search.js'
 import { resolveMirror, poolKey, lookupSessionCwd, encodeSegmentSafe, readSessionHeaderCwd, requestSessionHint } from './binding.js'
 import { TaskManager } from './tasks.js'
 import { ForwardManager } from './forwards.js'
-import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload } from './update.js'
+import { selfDir, diskVersion, LOADED_VERSION, gtVersion, fetchLatestVersion, applyUpdate, persistUpdateMode, readUpdateMode, reloadSelf, scheduleSelfReload, isInstalledCopy } from './update.js'
 import { sendHeartbeat, pseudonym, heartbeatUrl, hasPersistedId, installIdPath } from './telemetry.js'
 import { loadMachines as _loadMachines, saveMachines as _saveMachines, sanitizeMachine as _sanitizeMachine, applyMachine as _applyMachine, machineId as _machineId } from './registry.js'
 import { registerHttpTransports } from './http-transport.js'
@@ -51,6 +51,16 @@ import { listDirStructured, removeRemoteTree } from './remote-fs.js'
 
 export const name = 'dsh-remote'
 
+/** Update mode used when neither the persisted `update-mode` file nor the
+ *  profile config supplies one.
+ *
+ *  Kept as one exported constant on purpose: the value appears in the schema
+ *  default, in the `/update-check` response and in the auto-update gate, and
+ *  three hard-coded copies drift (the first version of this change left two
+ *  `|| 'manual'` fallbacks that quietly disagreed with the new schema default).
+ *  Changing the default must change exactly one place. */
+export const DEFAULT_UPDATE_MODE = 'auto'
+
 // Web and Desktop share the SSH tools; each optional UI transport is attached
 // reactively below, so service startup order does not drop the JSON routes.
 export const inject = ['tools', 'systemPrompt']
@@ -124,11 +134,18 @@ export const Config = z.object({
   /** Wall-clock budget (ms) for one remote `@` index pass; on expiry the
    *  partial index answers rather than making the caret wait. */
   fileReferenceTimeoutMs: z.number().step(1).min(200).default(4000),
-  /** Update mode: `manual` (default) only checks when asked; `auto` checks on
-   * load and periodically, applying a newer npm release automatically;
-   * `off` disables version checks entirely. (schemastery 3.18 has no .enum —
-   * keep string and validate in code.) */
-  updateMode: z.string().default('manual'),
+  /** Update mode: `auto` (default) checks on load and periodically, applies a
+   * newer npm release automatically, then hot-swaps the host half (see
+   * `updateAutoReload`); `manual` only checks when the user asks; `off` disables
+   * version checks entirely. (schemastery 3.18 has no .enum — keep string and
+   * validate in code.)
+   *
+   * `auto` became the default in 0.8.27. It could not have been a safe default
+   * before 0.8.24: an update only replaced files on disk and needed a restart,
+   * which left users running a new browser half against an old host half with no
+   * visible signal. 0.8.24 added the hot swap (and `pendingReload` when it is
+   * turned off), so an unattended update now actually takes effect. */
+  updateMode: z.string().default(DEFAULT_UPDATE_MODE),
   /** How often (ms) auto mode checks the npm registry for a newer release. */
   updateCheckIntervalMs: z.number().step(1).min(60000).default(6 * 3600 * 1000),
   /** Whether a landed update also hot-swaps the running host half (default
@@ -2789,14 +2806,21 @@ export async function apply(ctx, config) {
         // They differ between an applied update and its hot swap (or a boot).
         const loaded = LOADED_VERSION
         const disk = diskVersion()
-        const rawMode = readUpdateMode() || config.updateMode || 'manual'
+        // Three-layer precedence: the persisted `update-mode` override (settings
+        // UI) beats the profile config, which beats DEFAULT_UPDATE_MODE. The
+        // fallback must not hard-code a second default here, or this path would
+        // silently disagree with the schema default.
+        const rawMode = readUpdateMode() || config.updateMode || DEFAULT_UPDATE_MODE
         const base = {
           current: loaded,
           loaded,
           disk,
           pendingReload: gtVersion(disk, loaded),
-          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual',
+          updateMode: ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : DEFAULT_UPDATE_MODE,
           updatedMarker: existsSync(path.join(selfDir(), '.dsh-remote-updated')),
+          // Exposed so the settings page can explain why `auto` may not act:
+          // a link:/dev install must not be overwritten by an npm publish.
+          selfUpdateAllowed: isInstalledCopy(),
         }
         const latest = await fetchLatestVersion()
         if (latest === null) return sendJson(res, 200, { ok: false, ...base, error: '无法连接 npm registry' })
@@ -2875,9 +2899,10 @@ export async function apply(ctx, config) {
 
   // ── auto-update: check on load + on an interval; apply silently ───────────
   // Failures are swallowed (never break the plugin). The persisted override
-  // (settings UI) wins over the profile-config default.
-  const rawMode = readUpdateMode() || config.updateMode || 'manual'
-  const effectiveUpdateMode = ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : 'manual'
+  // (settings UI) wins over the profile-config default, which wins over
+  // DEFAULT_UPDATE_MODE — the single source of truth for the fallback.
+  const rawMode = readUpdateMode() || config.updateMode || DEFAULT_UPDATE_MODE
+  const effectiveUpdateMode = ['manual', 'auto', 'off'].includes(rawMode) ? rawMode : DEFAULT_UPDATE_MODE
   if (effectiveUpdateMode === 'auto') {
     const checkAndApply = async () => {
       const latest = await fetchLatestVersion()
@@ -2892,6 +2917,9 @@ export async function apply(ctx, config) {
       try {
         await applyUpdate(latest)
       } catch {
+        // 常见且预期的失败：link:/开发模式安装时 applyUpdate 会拒绝
+        // （避免覆盖源码仓库）。这不是异常，静默即可——那类用户在自己的
+        // 仓库里更新。
         return
       }
       // Landed: swap the running host half too, otherwise the code being served

package/lib/update.js

@@ -39,6 +39,27 @@ export function selfDir() {
   }
 }
 
+/**
+ * 本插件是否装在 `node_modules` 之下（即真正的"安装副本"）。
+ *
+ * ★ 为什么必须有这道判断（实测依据，不是防御性猜测）：
+ *   `selfDir()` 基于 `import.meta.url`，而 **Node 的 ESM 解析会对符号链接做
+ *   realpath**（已实测：经由 symlink 导入时 `import.meta.url` 报告的是
+ *   `/real/mod.mjs` 而不是 `/link/mod.mjs`）。于是当插件以 `link:` / 开发模式
+ *   安装时，`selfDir()` 指向的是**用户的源码仓库**，而不是安装副本。
+ *   一旦 `auto` 更新落地，`applyUpdate` 就会拿 npm 包覆盖那份源码
+ *   （丢改动、脏工作树）。默认改成 `auto` 之后这个风险从"手点才触发"
+ *   变成"自动发生"，所以在此拦下：不在 node_modules 下就不自更新。
+ *
+ * 代价：少数把插件放在非标准路径的部署不会被自动更新——他们仍可手动更新。
+ * 这个方向的取舍是正确的：宁可少更新，也不能悄悄毁掉源码。
+ * @param dir - 要判定的目录（默认本插件的 selfDir()）。
+ */
+export function isInstalledCopy(dir = selfDir()) {
+  const normalized = String(dir).split(path.sep).join('/').toLowerCase()
+  return normalized.includes('/node_modules/')
+}
+
 /** Read the installed package.json version; "0.0.0" when unreadable. */
 export function readVersion() {
   try {
@@ -77,6 +98,9 @@ export async function fetchLatestVersion(timeoutMs = 8000) {
   try {
     const controller = new AbortController()
     const timer = setTimeout(() => controller.abort(), timeoutMs)
+    // 纯看门狗：调用方并不 await 它，所以必须 unref，否则这一段超时窗口
+    // 会拖住事件循环、让本该退出的短命进程（脚本、测试）多挂数秒。
+    if (typeof timer.unref === 'function') timer.unref()
     try {
       const res = await fetch(REGISTRY_URL, { signal: controller.signal, headers: { accept: 'application/json' } })
       if (!res.ok) return null
@@ -117,6 +141,13 @@ function parseTar(buf) {
  * @param targetVersion - exact npm version to install (e.g. "0.8.0").
  */
 export async function applyUpdate(targetVersion, options = {}) {
+  // 拒绝对非安装副本自更新：`auto` 默认开启后，一次自动更新就会覆盖
+  // `selfDir()` 指向的目录，而以 link:/开发模式安装时那正是用户的源码仓库
+  // （见 isInstalledCopy 的实测说明）。测试用 options.dir 指向临时目录，
+  // 因此不受此限（options.dir 存在即视为显式指定，跳过检查）。
+  if (!options.dir && !isInstalledCopy()) {
+    throw new Error('refusing to self-update: this copy is not under node_modules (link/dev install) — update it from its source repo instead')
+  }
   const tarballUrl = `https://registry.npmjs.org/${NPM_PACKAGE}/-/${NPM_PACKAGE}-${targetVersion}.tgz`
   const dir = options.dir || selfDir()
   const doFetch = options.fetchImpl || fetch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-remote",
-  "version": "0.8.26",
+  "version": "0.8.27",
   "description": "Remote-work assistant for DeepSeek Harness: connect SSH (password/key/agent/keyboard-interactive/proxy jump), pick a remote workspace, operate on it with 20 rw_* tools (incl. rw_edit/rw_stat/rw_mkdir/rw_remove/rw_move/rw_forward), conflict-aware mirror sync, port forwarding, optional side-bar remote file editing, audit log, keychain passwords.",
   "license": "MIT",
   "author": "flymysql <flyphp@outlook.com>",