dsh-remote 0.8.35 → 0.8.36

package/README.en.md

@@ -47,7 +47,7 @@ The native **"Add workspace"** flow — a centered modal with two tabs, opening
 
 ## Features
 
-![Capabilities at a glance — multi-machine SSH, live alias resolution, the two-tab picker, three-way sync, remote @ completion, audit, port forwarding, sidebar editing, self-update, and the 20 rw_* tools](docs/shots/features.png)
+![Capabilities at a glance — multi-machine SSH, live alias resolution, the two-tab picker, three-way sync, remote @ completion, audit, port forwarding, sidebar editing, self-update, and the 21 rw_* tools](docs/shots/features.png)
 
 The image above is the overview. What follows is only what the image does not make obvious.
 
@@ -115,6 +115,58 @@ Since **v0.8.18** it installs and mounts only itself; the Web sidebar ([dsh-bett
 
 > **Remote context is session-scoped:** the "Remote workspace" system-prompt section appears only when the current session's workspace is a remote mirror; local sessions are unaffected and the model will not call `rw_*` on its own.
 
+## Open a remote machine's DSH Web UI locally
+
+The `dsh web` running on a remote machine can also be opened **as a page on this machine** (issue #46). The direction stays "this machine dials out":
+
+> **The remote opens no port.** DSH deliberately refuses `--host 0.0.0.0` (it would put remote
+> code execution on the network), so the correct shape is: SSH out, start a `dsh web` on the remote
+> that listens on **127.0.0.1 only**, and carry its port back over the SSH connection to a loopback
+> port here.
+
+Usage: Settings → Remote workspaces → **"Remote DSH Web UI"** → pick a machine → **Connect & open**.
+A new tab opens showing that remote machine's full DSH interface (chat, tool tree, settings).
+
+- The URL looks like `http://127.0.0.1:3088/?token=…`. That token is a one-time credential the remote
+  process prints at startup and is used once, on this machine, by that redirect: DSH exchanges it for a
+  30-day signed cookie and lands on a clean `/`. **Do not share that tokenized URL.**
+- "Disconnect" only closes the tunnel and deliberately does **not** kill the remote process (it may be
+  an instance you use elsewhere). "Disconnect & stop remote" also ends the process — but only one this
+  plugin started.
+- If the remote already runs an interface (for example one you started in a terminal), pick the machine
+  and paste its `http://127.0.0.1:<port>/?token=…` into the field, then "Attach to running instance" —
+  no second instance will be started.
+- When the remote `dsh` is not on the SSH login PATH, point `webAttachCommand` at its absolute path; to
+  keep an attached instance out of the remote user's own sessions and settings, point `webAttachDshHome`
+  at a scratch directory.
+
+### Cannot connect? Check the environment, then deploy in one click
+
+**A failed connect is usually not the plugin's fault: the remote dsh version or environment is wrong.**
+The classic case: dsh 0.1.0-rc.6 depends on `node-pty@1.1.0`, whose published package ships
+**no `linux-x64` prebuild**, so `dsh web` cannot start on Linux at all. Previously all you saw was
+"the remote DSH did not report a startup token", with no way to tell why.
+
+Settings → Remote workspaces → **"Remote dsh health check & deploy"**:
+
+1. **Check (read-only)** — probes the remote's platform / node / npm / dsh version / **whether the
+   native module can load** / whether it knows `--no-open` / proxy and npm registry, and reports a
+   verdict with a suggested fix. It **writes nothing**, so it is safe to run freely.
+2. **Deploy & verify** — appears only when step 1 says it is both needed and possible. It installs into
+   a **private directory** on the remote (default `~/.dsh-remote/dsh`): **no system directory, no PATH
+   change, no replacing the version you use**; deleting that directory is a complete rollback. It then
+   verifies step by step (binary / native module / `web` subcommand) and, on success, **records the
+   resulting dsh path per machine** so later connects use it.
+3. **Let the AI investigate** — appears only after a failure. It creates a session and hands the problem
+   to the built-in `dsh-remote-deploy` skill, which covers the long tail the deterministic path cannot
+   express (no npm, sudo-only systems, proxies, internal mirrors, Windows remotes). **Nothing is created
+   unless you click it**, because it spends model budget.
+
+Related config: `webInstallPrefix` (where; default `$HOME/.dsh-remote/dsh`), `webInstallVersion`
+(which version; default `0.1.5-rc.2`, the first that can start the web surface on Linux), and
+`webInstallRegistry` (npm registry; **empty keeps the remote's own config**, so an internal mirror is
+never overridden).
+
 ## CLI defaults (optional)
 
 Provide a default machine in `cordis.patch.yml`:
@@ -210,6 +262,13 @@ Deploying to a product profile is a separate, explicit action (`./sync.sh`) for
 | `updateMode` | string | `auto` | self-update behaviour: `auto` checks npm on load and every 6h and applies a newer release; `manual` only checks when asked; `off` disables checks. **Default changed to `auto` in 0.8.27** — safe because 0.8.24 added the host-half hot swap |
 | `updateCheckIntervalMs` | int | 21600000 (6h) | how often `auto` mode checks npm (floor 60000) |
 | `updateAutoReload` | bool | `true` | hot-swap the host half after an update lands; `false` defers it to the next process start and the panel reports `pendingReload` |
+| `webAttachPortStart` | int | `3088` | first local port for the "Remote DSH Web UI" tunnel (later ports are tried when taken; loopback only) |
+| `webAttachCommand` | string | `dsh` | command used to start `dsh web` on the remote; change it when the remote `dsh` is not on the SSH login PATH |
+| `webAttachDshHome` | string | `''` | `DSH_HOME` exported on the remote when attaching; empty reuses the remote user's own harness home |
+| `webAttachWaitSeconds` | int | `45` | how long to wait for a freshly started remote `dsh web` to print its launch token |
+| `webInstallPrefix` | string | `''` | where an automatic deployment installs dsh; empty means `$HOME/.dsh-remote/dsh` (no system directory, no PATH change) |
+| `webInstallVersion` | string | `0.1.5-rc.2` | dsh version an automatic deployment installs; the default is the first that can start the web surface on Linux |
+| `webInstallRegistry` | string | `''` | npm registry for the install; **empty keeps the remote's own config**, so an internal mirror is never overridden |
 
 > The authoritative list is the `Config` schema in `lib/index.js`; this table mirrors it.
 
@@ -235,6 +294,16 @@ Deploying to a product profile is a separate, explicit action (`./sync.sh`) for
 
 **The plugin vanished after a DSH upgrade** — DSH's compatibility check dropped the bundle; upgrade to **0.8.29+** (see "DSH version compatibility" above).
 
+**"Remote DSH Web UI" will not connect / spins forever** — first check that `dsh web` starts on that
+machine *at all*. Two known traps (the plugin names them in its error):
+1. **dsh 0.1.0-rc.6 cannot start the web surface on Linux** — the `node-pty@1.1.0` it depends on ships
+   macOS/Windows prebuilds but **no `linux-x64`**, so it fails with `Failed to load native module:
+   pty.node`. Upgrade to 0.1.5-rc.2+ (its `node-pty@1.2.0-beta.15` ships the Linux build).
+2. **dsh 0.1.0-rc.6 does not know `--no-open`** (the flag came later); the plugin drops it and retries
+   once automatically, so there is nothing to do.
+If the remote `dsh` is not on the SSH login PATH (a private prefix, say), point `webAttachCommand` at
+its absolute path.
+
 ## Safety
 
 Giving the plugin a machine's credentials lets the agent run **shell commands as your user** on that host — only add machines you trust. Passwords live in a local file (or the OS keychain); treat them as sensitive. With `auditLog` on, every command is recorded.

package/README.md

@@ -47,7 +47,7 @@ DSH 的 Web 界面刻意只监听 `127.0.0.1`（CLI 为安全拒绝 `--host 0.0.
 
 ## 功能
 
-![核心能力总览 — 多机 SSH / 别名实时解析 / 双 tab 选择器 / 三路同步 / 远程 @ 补全 / 安全审计 / 端口转发 / 侧栏编辑 / 自动更新，以及 20 个 rw_* 工具](docs/shots/features.png)
+![核心能力总览 — 多机 SSH / 别名实时解析 / 双 tab 选择器 / 三路同步 / 远程 @ 补全 / 安全审计 / 端口转发 / 侧栏编辑 / 自动更新，以及 21 个 rw_* 工具](docs/shots/features.png)
 
 上图是能力总览；下面只列**上图没说清、但用起来需要知道**的部分。
 
@@ -105,6 +105,49 @@ dsh plugin add dsh-remote
 
 > **Remote context 是 session 级的**：只有当前 session 的工作区是某个远程镜像时，system prompt 才注入「Remote workspace」段落；普通本地 session 不受影响，模型也不会主动调 `rw_*`。
 
+## 在本地打开远程机器上的 DSH 界面
+
+远程机器上那个 `dsh web` 也可以**当成本机的一个页面打开**（issue #46）。方向仍然是「本地主动连出去」：
+
+> **远端不需要开放任何端口**。DSH 刻意拒绝 `--host 0.0.0.0`（它会把远程代码执行能力暴露到网络上），
+> 所以正确的做法是由本机 SSH 连过去，在远端**只监听 127.0.0.1** 地起一个 `dsh web`，
+> 再把它的端口经 SSH 隧道搬回本机的一个 loopback 端口。
+
+用法：设置 → 远程工作区 → **「远程 DSH 界面」** → 选一台机器 → **连接并打开**。
+浏览器会新开一个标签页，显示的就是**那台远端机器**的完整 DSH 界面（聊天、工具树、设置都在）。
+
+- 界面地址形如 `http://127.0.0.1:3088/?token=…`。那个 token 是远端进程启动时打印的一次性凭据，
+  只在**本机**的这次跳转里用一次：DSH 会把它换成 30 天有效的签名 cookie 并跳转到干净的 `/`。
+  **请不要把这个带 token 的地址外发**。
+- 「断开」只关隧道，**不会**杀掉远端进程（它可能是你在别处也在用的实例）；
+  要连远端进程一起停，用「断开并停止远端」——它只会结束**本次由插件启动**的那个进程。
+- 若远端已经在跑一个界面（比如你自己在终端里起的），可以选机器后把它的
+  `http://127.0.0.1:<端口>/?token=…` 粘进输入框，点「连接已有实例」，插件不会再去启第二个。
+- 远端 `dsh` 不在 SSH 登录 PATH 时，用 `webAttachCommand` 指向它的绝对路径；
+  想让它别污染远端用户自己的会话/设置，用 `webAttachDshHome` 指一个临时目录。
+
+### 连不上？先体检，再一键部署
+
+**连不上大多不是插件的问题，而是远端 dsh 的版本或环境不对。** 最典型的一种：dsh 0.1.0-rc.6
+依赖 `node-pty@1.1.0`，而**那个版本发布的包里没有 `linux-x64` 预编译产物** ⇒ `dsh web`
+在 Linux 上根本起不来。这种情况以前只能看到「没拿到启动令牌」，无从判断。
+
+设置 → 远程工作区 → **「远端 dsh 体检与部署」**：
+
+1. **体检（只读）** —— 探测远端平台/node/npm/dsh 版本/**原生模块能否启动**/是否认识
+   `--no-open`/代理与 npm 源，给出结论与修复建议。**不写任何东西**，可以随便点。
+2. **部署并验证** —— 只在上一步判定「需要且可以自动装」时才出现。它会装到远端
+   **私有目录**（默认 `~/.dsh-remote/dsh`）：**不写系统目录、不改 PATH、不覆盖你在用的版本**，
+   删掉那个目录即完全回滚。装完逐步校验（二进制 / 原生模块 / `web` 子命令），
+   成功后**按机器记住**这条 dsh 路径，之后连接就用它。
+3. **让 AI 排查** —— 只在失败后出现。它会创建一个会话，让内置的 `dsh-remote-deploy`
+   技能去处理确定性流程覆盖不到的长尾（没有 npm、要 sudo、代理、内网镜像源、Windows 远端等）。
+   **只有你点它才会创建**，因为这会消耗模型额度。
+
+相关配置：`webInstallPrefix`（装哪，默认 `$HOME/.dsh-remote/dsh`）、
+`webInstallVersion`（装哪个版本，默认 `0.1.5-rc.2`——第一个在 Linux 上能起 web 的版本）、
+`webInstallRegistry`（npm 源；**留空则沿用远端自己的配置**，不会覆盖你的内网镜像）。
+
 ## 可选：CLI 默认机
 
 可在 `cordis.patch.yml` 提供默认机：
@@ -201,6 +244,13 @@ scripts/dev-run.sh --status    # 是否在运行
 | `updateMode` | string | `auto` | 自更新模式：`auto`=加载时及每 6 小时检查并自动应用、`manual`=仅在手动检查时查、`off`=完全不查。**0.8.27 起默认 `auto`**——之所以现在才安全，是因为 0.8.24 补上了宿主半热切换 |
 | `updateCheckIntervalMs` | int | 21600000（6h） | `auto` 模式检查 npm 的间隔（下限 60000） |
 | `updateAutoReload` | bool | `true` | 更新落地后自动热切换宿主半；`false` 则留到下次启动，设置页会显示 `pendingReload` |
+| `webAttachPortStart` | int | `3088` | 「远程 DSH 界面」在本机监听的起始端口（占用则顺延，仅监听 127.0.0.1） |
+| `webAttachCommand` | string | `dsh` | 在远端启动 `dsh web` 用的命令；远端 `dsh` 不在 SSH 登录 PATH 时改这里 |
+| `webAttachDshHome` | string | `''` | 远端启动时导出的 `DSH_HOME`；留空则复用远端用户自己的 harness home |
+| `webAttachWaitSeconds` | int | `45` | 等待远端 `dsh web` 打印启动令牌的秒数 |
+| `webInstallPrefix` | string | `''` | 自动部署装到远端的哪个目录；留空用 `$HOME/.dsh-remote/dsh`（不写系统目录、不改 PATH） |
+| `webInstallVersion` | string | `0.1.5-rc.2` | 自动部署安装的 dsh 版本；默认值是第一个在 Linux 上能启动 web 的版本 |
+| `webInstallRegistry` | string | `''` | 安装用的 npm 源；**留空沿用远端自己的配置**，不会覆盖内网镜像 |
 
 > 权威清单是 `lib/index.js` 里的 `Config` schema，本表与之一致。
 
@@ -226,6 +276,14 @@ scripts/dev-run.sh --status    # 是否在运行
 
 **升级后插件整个不见了** —— DSH 兼容性判定丢弃了 bundle，升到 **0.8.29+** 即可（见上文「DSH 版本兼容性」）。
 
+**「远程 DSH 界面」连不上/一直转圈** —— 先确认那台机器上的 `dsh web` **本身**能起来。
+两个已知坑（插件会在报错里直接点出来）：
+① **dsh 0.1.0-rc.6 在 Linux 上无法启动 web**——它依赖的 `node-pty@1.1.0` 只带了
+macOS/Windows 的预编译产物，**没有 `linux-x64`**，会报 `Failed to load native module: pty.node`。
+升到 0.1.5-rc.2+ 即可（其 `node-pty@1.2.0-beta.15` 带 Linux 预编译）。
+② **dsh 0.1.0-rc.6 不认识 `--no-open`**（该 flag 是后加的）；插件会自动去掉它重试一次，无需你处理。
+如果远端 `dsh` 不在 SSH 登录 PATH 里（例如装在私有前缀），用 `webAttachCommand` 指向它的绝对路径。
+
 ## 安全提醒
 
 把凭据交给插件等于允许 Agent 以你的用户身份在该主机执行 **shell 命令**——只添加可信机器。密码存在本机文件（或钥匙串），请当作敏感数据。开启 `auditLog` 时每条命令都会记入审计日志。

package/lib/client.js

@@ -105,6 +105,36 @@ window.__ModuleLoader__.load({
         'settings.audit': '最近执行的远程命令（审计日志）',
         'settings.auditEmpty': '暂无记录（在远端执行的命令会记录到 $DSH_HOME/remote-workspaces/audit.log）',
         'settings.auditRefresh': '刷新日志',
+        'settings.webAttach': '远程 DSH 界面',
+        'settings.webAttachHint': '在本机浏览器里打开远程机器上的 DSH 网页界面。不需要在远端开放任何端口：插件会主动 SSH 连出去，在远端启一个只监听 127.0.0.1 的 dsh web，再把它的端口通过 SSH 隧道搬回本机。',
+        'settings.webAttachMachine': '机器',
+        'settings.webAttachOpen': '连接并打开',
+        'settings.webAttachOpening': '正在连接…',
+        'settings.webAttachReopen': '打开',
+        'settings.webAttachClose': '断开',
+        'settings.webAttachCloseStop': '断开并停止远端',
+        'settings.webAttachReconnect': '重连',
+        'settings.webAttachDropped': '连接已断开',
+        'settings.webAttachNone': '尚未连接任何远程界面',
+        'settings.webAttachExisting': '或粘贴远端已在运行的界面地址（http://127.0.0.1:<端口>/?token=…）',
+        'settings.webAttachExistingGo': '连接已有实例',
+        'settings.webAttachTokenWarn': '地址含登录令牌，仅供本机使用，请勿外发。',
+        'settings.webAttachFailed': '连接失败：',
+        'settings.deploy': '远端 dsh 体检与部署',
+        'settings.deployHint': '连接失败大多不是插件的问题，而是远端 dsh 版本或环境不对（例如旧版在 Linux 上无法启动 web）。这里可以只读体检，也可以一键装到远端私有目录（不影响用户在用的版本）。',
+        'settings.deployProbe': '体检（只读）',
+        'settings.deployProbing': '正在体检…',
+        'settings.deployInstall': '部署并验证',
+        'settings.deployInstalling': '正在部署…',
+        'settings.deployConfirm': '将在远端私有目录安装 dsh（不写系统目录、不改 PATH、不覆盖用户在用的版本）。继续？',
+        'settings.deployInvestigate': '让 AI 排查',
+        'settings.deployInvestigating': '正在创建排查会话…',
+        'settings.deployOk': '远端环境可用',
+        'settings.deployBlocked': '远端环境有问题',
+        'settings.deployUseCommand': '将使用的 dsh',
+        'settings.deploySteps': '安装步骤',
+        'settings.deployDone': '部署完成，已记录该机器使用的 dsh',
+        'settings.deployInvestigateStarted': '已创建排查会话，请在会话里跟进。',
         'settings.badgePwd': '密码',
         'settings.badgeKeychain': '钥匙串',
         'settings.badgeProxy': '跳板',
@@ -333,6 +363,36 @@ window.__ModuleLoader__.load({
         'settings.audit': 'Recent remote commands (audit log)',
         'settings.auditEmpty': 'No records yet (commands run remotely are logged to $DSH_HOME/remote-workspaces/audit.log)',
         'settings.auditRefresh': 'Refresh log',
+        'settings.webAttach': 'Remote DSH Web UI',
+        'settings.webAttachHint': 'Open the DSH web interface of a remote machine in this browser. The remote never opens an inbound port: this plugin SSHes out, starts a loopback-only dsh web there, and carries its port back over the SSH connection.',
+        'settings.webAttachMachine': 'Machine',
+        'settings.webAttachOpen': 'Connect & open',
+        'settings.webAttachOpening': 'Connecting…',
+        'settings.webAttachReopen': 'Open',
+        'settings.webAttachClose': 'Disconnect',
+        'settings.webAttachCloseStop': 'Disconnect & stop remote',
+        'settings.webAttachReconnect': 'Reconnect',
+        'settings.webAttachDropped': 'Disconnected',
+        'settings.webAttachNone': 'No remote UI attached',
+        'settings.webAttachExisting': 'Or paste the URL of an interface already running there (http://127.0.0.1:<port>/?token=…)',
+        'settings.webAttachExistingGo': 'Attach to running instance',
+        'settings.webAttachTokenWarn': 'The URL carries a login token. It is for this machine only — do not share it.',
+        'settings.webAttachFailed': 'Could not attach: ',
+        'settings.deploy': 'Remote dsh health check & deploy',
+        'settings.deployHint': 'A failed connect is usually not the plugin\'s fault: the remote dsh version or environment is wrong (an old one cannot start the web surface on Linux at all). Check read-only, or install into a private directory on the remote that leaves the user\'s own version untouched.',
+        'settings.deployProbe': 'Check (read-only)',
+        'settings.deployProbing': 'Checking…',
+        'settings.deployInstall': 'Deploy & verify',
+        'settings.deployInstalling': 'Deploying…',
+        'settings.deployConfirm': 'Install dsh into a private directory on the remote (no system directory, no PATH change, no replacing the version in use). Continue?',
+        'settings.deployInvestigate': 'Let the AI investigate',
+        'settings.deployInvestigating': 'Creating a session…',
+        'settings.deployOk': 'Remote environment is usable',
+        'settings.deployBlocked': 'Remote environment has a problem',
+        'settings.deployUseCommand': 'dsh that will be used',
+        'settings.deploySteps': 'Install steps',
+        'settings.deployDone': 'Deployed; this machine now records the dsh it uses',
+        'settings.deployInvestigateStarted': 'A session was created — follow up there.',
         'settings.badgePwd': 'password',
         'settings.badgeKeychain': 'keychain',
         'settings.badgeProxy': 'jump',
@@ -785,6 +845,21 @@ window.__ModuleLoader__.load({
       const [advOpen, setAdvOpen] = React.useState(false) // 高级配置折叠
       const [fwdOpen, setFwdOpen] = React.useState(true)
       const [auditOpen, setAuditOpen] = React.useState(false)
+      // Issue #46: attach a REMOTE machine's DSH Web UI as a local page. One
+      // session per machine; `webAttach` holds the machineId currently opening.
+      const [webAttaches, setWebAttaches] = React.useState([])
+      const [webAttachMachine, setWebAttachMachine] = React.useState('')
+      const [webAttachOpen, setWebAttachOpen] = React.useState(false)
+      const [webAttachBusy, setWebAttachBusy] = React.useState('')
+      const [webAttachErr, setWebAttachErr] = React.useState('')
+      const [webAttachExisting, setWebAttachExisting] = React.useState('')
+      // Issue #46 P1–P4: deterministic remote deployment + the AI escape hatch.
+      // `deploy` holds the last probe/install outcome for the selected machine;
+      // `deployBusy` is the running step id, so the UI can show progress.
+      const [deploy, setDeploy] = React.useState(null)
+      const [deployBusy, setDeployBusy] = React.useState('')
+      const [deployErr, setDeployErr] = React.useState('')
+      const [deployOpen, setDeployOpen] = React.useState(false)
       React.useEffect(() => { ensureChromeCss() }, [])
 
       const testConn = () => {
@@ -874,6 +949,43 @@ window.__ModuleLoader__.load({
       const refreshForwards = () => api('GET', '/dsh-remote/forwards').then((r) => setForwards(r.forwards || [])).catch(() => {})
       React.useEffect(() => { refreshForwards(); api('GET', '/dsh-remote/audit?limit=30').then((r) => setAuditLines(r.lines || [])).catch(() => {}) }, [])
 
+      // ── 远程 DSH 界面（issue #46）─────────────────────────────────────────
+      // The remote never opens an inbound port; we SSH out and carry the remote
+      // loopback web UI back to a local port. One tunnel per machine.
+      const refreshWebAttaches = () => api('GET', '/dsh-remote/web-attach')
+        .then((r) => setWebAttaches(r.attaches || []))
+        .catch(() => {})
+      React.useEffect(() => { refreshWebAttaches(); const t = setInterval(refreshWebAttaches, 15000); return () => clearInterval(t) }, [])
+      const webAttachAction = (action, machineId, extra) => {
+        setWebAttachBusy(machineId + ':' + action); setWebAttachErr('')
+        return api('POST', '/dsh-remote/web-attach', { action, machineId, ...(extra || {}) })
+          .then((r) => { refreshWebAttaches(); return r })
+          .catch((e) => { setWebAttachErr(String((e && e.message) || e)); return null })
+          .then((r) => { setWebAttachBusy(''); return r })
+      }
+
+      // ── 远程部署：体检 / 部署并验证 / 让 AI 排查 ───────────────────────────
+      // The probe is read-only, so it is safe to run before the user agrees to
+      // anything; the install requires an explicit second click (confirm: true).
+      const deployAction = (action, machineId, extra) => {
+        setDeployBusy(action); setDeployErr('')
+        return api('POST', '/dsh-remote/web-attach', { action, machineId, ...(extra || {}) })
+          .then((r) => {
+            if (action === 'probe') setDeploy({ kind: 'probe', ...r, at: Date.now() })
+            if (action === 'install') setDeploy({ kind: 'install', ...r, at: Date.now() })
+            if (action === 'investigate') setDeploy({ kind: 'investigate', ...r, at: Date.now() })
+            return r
+          })
+          .catch((e) => {
+            const msg = String((e && e.message) || e)
+            setDeployErr(msg)
+            // Keep the failing step list so the operator sees WHERE it stopped.
+            setDeploy({ kind: action, ok: false, error: msg, at: Date.now() })
+            return null
+          })
+          .then((r) => { setDeployBusy(''); refreshWebAttaches(); return r })
+      }
+
       const setF = (k) => (ev) => setForm({ ...form, [k]: ev.target.value })
       const setFb = (k) => (ev) => setForm({ ...form, [k]: ev.target.checked })
       const startEdit = (m) => {
@@ -1092,6 +1204,132 @@ window.__ModuleLoader__.load({
           workspaces.map((w, i) => React.createElement('div', { key: w + i, style: { display: 'flex', gap: 8, alignItems: 'center', padding: '4px 0' } },
             React.createElement('code', { style: { flex: 1, fontSize: 12, fontFamily: 'monospace' } }, w),
             React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 10px' }, onClick: () => setWorkspaceNow(w) }, tr('settings.switch'))))) : null,
+        // 远程 DSH 界面（issue #46）
+        React.createElement('div', { style: boxS },
+          sectionToggle(webAttachOpen, setWebAttachOpen, tr('settings.webAttach')),
+          webAttachOpen ? React.createElement(React.Fragment, null,
+            React.createElement('div', { style: { opacity: 0.65, fontSize: 11, lineHeight: 1.5, marginBottom: 6 } }, tr('settings.webAttachHint')),
+            // The URL below carries a one-time login token. It stays on loopback,
+            // but a user could paste it into a chat — say so where the URL is.
+            React.createElement('div', { style: { color: T.warn, fontSize: 11, lineHeight: 1.5, marginBottom: 6 } }, tr('settings.webAttachTokenWarn')),
+            // Live tunnels, one row per machine.
+            webAttaches.length ? webAttaches.map((a) => React.createElement('div', { key: a.machineId || a.localPort, style: { display: 'flex', gap: 8, alignItems: 'center', padding: '6px 0', fontSize: 12, flexWrap: 'wrap' } },
+              React.createElement('span', { style: { color: a.active ? T.ok : T.muted } }, a.active ? '●' : '○'),
+              React.createElement('code', { style: { fontFamily: 'monospace' } }, a.cleanUrl || ''),
+              React.createElement('span', { style: { opacity: 0.6, fontFamily: 'monospace' } }, '→ :' + a.remotePort),
+              a.active ? React.createElement('a', {
+                className: 'dsh-rw-btn dsh-rw-primary', style: { ...primaryBtnS, textDecoration: 'none' },
+                // The token rides on this loopback URL only; DSH exchanges it
+                // for a signed cookie and redirects to a clean '/'.
+                href: a.url, target: '_blank', rel: 'noopener noreferrer',
+              }, tr('settings.webAttachReopen')) : null,
+              // A tunnel whose listener died (remote restart, sshd drop) keeps
+              // its row so the user can see what happened and reconnect. The
+              // remote process is NOT auto-restarted: that would silently
+              // resurrect a server on a machine the user may be done with.
+              !a.active ? React.createElement('button', {
+                type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 8px' },
+                disabled: !!webAttachBusy, onClick: () => webAttachAction('open', a.machineId),
+              }, tr('settings.webAttachReconnect')) : null,
+              !a.active ? React.createElement('span', { style: { color: T.muted, fontSize: 11 } }, a.error || tr('settings.webAttachDropped')) : null,
+              React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 8px' },
+                disabled: !!webAttachBusy, onClick: () => webAttachAction('close', a.machineId) }, tr('settings.webAttachClose')),
+              // Only offered for a process we started: an attach onto the user's
+              // own running DSH must never signal it.
+              a.managed
+                ? React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 8px' },
+                    disabled: !!webAttachBusy, onClick: () => webAttachAction('close', a.machineId, { stopRemote: true }) }, tr('settings.webAttachCloseStop'))
+                : null)) : React.createElement('div', { style: { opacity: 0.6, fontSize: 12 } }, tr('settings.webAttachNone')),
+            React.createElement('div', { style: { display: 'flex', gap: 6, alignItems: 'center', marginTop: 8, flexWrap: 'wrap' } },
+              React.createElement('select', { className: 'dsh-rw-input', value: webAttachMachine, onChange: (e) => setWebAttachMachine(e.target.value), style: { ...inputS, maxWidth: 200 } },
+                React.createElement('option', { value: '' }, tr('settings.webAttachMachine') + '…'),
+                machines.map((m) => React.createElement('option', { key: m.id, value: m.id }, `${m.name || m.host} (${m.username}@${m.host})`))),
+              React.createElement('button', {
+                type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: primaryBtnS,
+                disabled: !!webAttachBusy || !webAttachMachine,
+                // The machine is named explicitly in the request, so attaching
+                // never has to move the user's "current machine" selection.
+                onClick: () => webAttachAction('open', webAttachMachine),
+              }, webAttachBusy.endsWith(':open') ? tr('settings.webAttachOpening') : tr('settings.webAttachOpen'))),
+            React.createElement('div', { style: { display: 'flex', gap: 6, alignItems: 'center', marginTop: 6, flexWrap: 'wrap' } },
+              React.createElement('input', { className: 'dsh-rw-input', value: webAttachExisting, onChange: (e) => setWebAttachExisting(e.target.value), placeholder: tr('settings.webAttachExisting'), style: { ...inputS, flex: 1, minWidth: 260 } }),
+              React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 8px' },
+                disabled: !!webAttachBusy || !webAttachMachine || !webAttachExisting.trim(),
+                onClick: () => webAttachAction('open', webAttachMachine, { existingUrl: webAttachExisting.trim() }).then(() => setWebAttachExisting('')) }, tr('settings.webAttachExistingGo'))),
+            webAttachErr ? React.createElement('div', { style: { color: T.danger, fontSize: 12, marginTop: 6, wordBreak: 'break-all' } }, tr('settings.webAttachFailed') + webAttachErr) : null,
+          ) : React.createElement('div', { style: { fontSize: 11, opacity: 0.55 } }, String(webAttaches.length)),
+        ),
+        // 远端 dsh 体检与部署（issue #46 P1–P4）：确定性的体检/安装，失败再交给 AI。
+        React.createElement('div', { style: boxS },
+          sectionToggle(deployOpen, setDeployOpen, tr('settings.deploy')),
+          deployOpen ? React.createElement(React.Fragment, null,
+            React.createElement('div', { style: { opacity: 0.65, fontSize: 11, lineHeight: 1.5, marginBottom: 6 } }, tr('settings.deployHint')),
+            React.createElement('div', { style: { display: 'flex', gap: 6, alignItems: 'center', marginBottom: 6, flexWrap: 'wrap' } },
+              React.createElement('select', { className: 'dsh-rw-input', value: webAttachMachine, onChange: (e) => setWebAttachMachine(e.target.value), style: { ...inputS, maxWidth: 200 } },
+                React.createElement('option', { value: '' }, tr('settings.webAttachMachine') + '…'),
+                machines.map((m) => React.createElement('option', { key: m.id, value: m.id }, `${m.name || m.host} (${m.username}@${m.host})`))),
+              React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 10px' },
+                disabled: !!deployBusy || !webAttachMachine,
+                onClick: () => deployAction('probe', webAttachMachine) },
+                deployBusy === 'probe' ? tr('settings.deployProbing') : tr('settings.deployProbe'))),
+            // Verdict from the last probe/install, rendered as findings with the
+            // severity the backend assigned — the UI never re-classifies them.
+            deploy ? React.createElement('div', { style: { fontSize: 12, lineHeight: 1.6 } },
+              deploy.kind === 'probe' && deploy.verdict
+                ? React.createElement('div', { style: { fontWeight: 600, color: deploy.verdict.ok ? T.ok : T.danger, marginBottom: 4 } },
+                    deploy.verdict.ok ? tr('settings.deployOk') : tr('settings.deployBlocked'))
+                : null,
+              (deploy.verdict && deploy.verdict.findings || []).map((f, i) => React.createElement('div', { key: f.code + i, style: { display: 'flex', gap: 6, alignItems: 'flex-start', padding: '2px 0' } },
+                React.createElement('span', { style: { color: f.severity === 'blocker' ? T.danger : f.severity === 'warn' ? T.warn : f.severity === 'ok' ? T.ok : T.muted } },
+                  f.severity === 'blocker' ? '●' : f.severity === 'ok' ? '●' : '○'),
+                React.createElement('span', null,
+                  React.createElement('span', null, f.summary),
+                  f.detail ? React.createElement('span', { style: { opacity: 0.7 } }, ' —— ' + f.detail) : null,
+                  f.fix ? React.createElement('div', { style: { opacity: 0.8, fontSize: 11 } }, '→ ' + f.fix) : null))),
+              deploy.command || (deploy.verdict && deploy.verdict.useCommand)
+                ? React.createElement('div', { style: { marginTop: 4, fontFamily: 'monospace', fontSize: 11, opacity: 0.8, wordBreak: 'break-all' } },
+                    tr('settings.deployUseCommand') + '：' + (deploy.command || deploy.verdict.useCommand))
+                : null,
+              // Per-step progress: a failure names the step it stopped at, which
+              // is the whole reason the plan is split into separate commands.
+              Array.isArray(deploy.steps) && deploy.steps.length
+                ? React.createElement('div', { style: { marginTop: 6 } },
+                    React.createElement('div', { style: { fontWeight: 600, marginBottom: 2 } }, tr('settings.deploySteps')),
+                    deploy.steps.map((s) => React.createElement('div', { key: s.id, style: { fontSize: 11, fontFamily: 'monospace', display: 'flex', gap: 6 } },
+                      React.createElement('span', { style: { color: s.ok ? T.ok : T.danger } }, s.ok ? '✓' : '✗'),
+                      React.createElement('span', null, s.title),
+                      !s.ok && s.output ? React.createElement('span', { style: { opacity: 0.75, whiteSpace: 'pre-wrap', wordBreak: 'break-all' } }, ' — ' + String(s.output).slice(0, 300)) : null)))
+                : null,
+              deploy.ok === true && deploy.steps
+                ? React.createElement('div', { style: { color: T.ok, marginTop: 4 } }, tr('settings.deployDone'))
+                : null,
+              deploy.kind === 'investigate' && deploy.sessionId
+                ? React.createElement('div', { style: { color: T.ok, marginTop: 4 } }, tr('settings.deployInvestigateStarted') + ' (' + deploy.sessionId + ')')
+                : null,
+            ) : null,
+            // The install button only appears when a probe says it is both needed
+            // and possible; clicking it is the explicit consent (confirm: true).
+            deploy && deploy.verdict && deploy.verdict.canAutoInstall && !deploy.verdict.ok
+              ? React.createElement('button', { type: 'button', className: 'dsh-rw-btn dsh-rw-primary', style: { ...primaryBtnS, marginTop: 6 },
+                  disabled: !!deployBusy,
+                  onClick: () => { if (window.confirm(tr('settings.deployConfirm'))) deployAction('install', webAttachMachine, { confirm: true }) } },
+                  deployBusy === 'install' ? tr('settings.deployInstalling') : tr('settings.deployInstall'))
+              : null,
+            // The AI escape hatch: offered after a failure, and ONLY on click —
+            // it costs a model call, so it is never automatic.
+            (deployErr || (deploy && deploy.ok === false))
+              ? React.createElement('button', { type: 'button', className: 'dsh-rw-btn', style: { ...buttonS, padding: '2px 10px', marginTop: 6 },
+                  disabled: !!deployBusy,
+                  onClick: () => deployAction('investigate', webAttachMachine, {
+                    findings: (deploy && deploy.verdict && deploy.verdict.findings) || [],
+                    facts: deploy && deploy.facts,
+                    error: deployErr || (deploy && deploy.error) || '',
+                  }) },
+                  deployBusy === 'investigate' ? tr('settings.deployInvestigating') : tr('settings.deployInvestigate'))
+              : null,
+            deployErr ? React.createElement('div', { style: { color: T.danger, fontSize: 12, marginTop: 6, wordBreak: 'break-all' } }, deployErr) : null,
+          ) : React.createElement('div', { style: { fontSize: 11, opacity: 0.55 } }, deploy && deploy.verdict ? (deploy.verdict.ok ? tr('settings.deployOk') : tr('settings.deployBlocked')) : ''),
+        ),
         // 端口转发面板
         React.createElement('div', { style: boxS },
           sectionToggle(fwdOpen, setFwdOpen, tr('settings.forwards')),

package/lib/http-transport.js

@@ -67,11 +67,103 @@ export function connectionRoute(route) {
   }
 }
 
+/**
+ * Reject a browser-shaped request that is not same-origin ours.
+ *
+ * This is the FALLBACK fence, used only when the Connection service (which owns
+ * DSH's authoritative `requestRejection`) is absent — an old composition that
+ * has a `webServer` but no browser-authentication owner. It is deliberately
+ * fail-closed on the three browser vectors our own routes would otherwise
+ * accept:
+ *   • `sec-fetch-site: cross-site` — a page on any origin driving our API;
+ *   • an `Origin` that is not our own authority — the same, with CORS markers;
+ *   • a non-loopback `Host` — DNS rebinding, where a name the attacker controls
+ *     resolves to 127.0.0.1 so even `Origin === Host` looks "same-origin".
+ * Non-browser callers (curl, scripts) carry no `Sec-Fetch-*`/`Origin` and a
+ * loopback `Host`, so they keep working; that is the same shape DSH's own fence
+ * implements for `/api`.
+ *
+ * A request with no HTTP headers at all is not a browser request — it comes
+ * from an in-process caller (tests, and the Desktop carrier's IPC path, which
+ * authenticates before dispatch) — so there is no browser layer to defend.
+ *
+ * @param {import('node:http').IncomingMessage} req - the request under test.
+ * @returns {number|undefined} 403 to reject, undefined to proceed.
+ */
+function fallbackRejection(req) {
+  const headers = req && req.headers
+  if (!headers || typeof headers !== 'object') return undefined
+  const header = (name) => {
+    const value = headers[name]
+    return typeof value === 'string' ? value : Array.isArray(value) ? value[0] : undefined
+  }
+  if (header('sec-fetch-site') === 'cross-site') return 403
+  const host = header('host')
+  const origin = header('origin')
+  if (origin !== undefined && host !== undefined) {
+    try {
+      if (new URL(origin).host !== host) return 403
+    } catch {
+      return 403
+    }
+  }
+  if (host !== undefined) {
+    const hostname = host.replace(/:\d+$/, '').toLowerCase()
+    const loopback = hostname === 'localhost' || hostname === '[::1]'
+      || /^127(?:\.\d{1,3}){3}$/.test(hostname)
+    if (!loopback) return 403
+  }
+  return undefined
+}
+
+/**
+ * Wrap one route so every request passes DSH's browser trust fence first.
+ *
+ * The legacy `/dsh-remote/*` routes are registered straight on `webServer`, which
+ * applies no Host/Origin check and no browser authentication — `requestRejection`
+ * lives on the Connection service and is only wired to `/api` and the
+ * `/api/remote.mux` upgrade. Without this wrapper our mutating routes were
+ * reachable cross-site as "simple requests" (no preflight: a `text/plain` POST
+ * needs no CORS approval), so any page the user visited could define a tunnel,
+ * rewrite the machine registry, or drive `update-apply`. The model tools were
+ * never exposed that way; only these JSON routes were.
+ *
+ * The lookup is deferred to request time because `webServer` and `connection`
+ * arrive independently: the fence must engage as soon as authentication exists,
+ * and must not be baked in from whichever service happened to be present when
+ * the route was registered.
+ *
+ * @param {object} route - a webServer route definition.
+ * @param {() => object|undefined} connectionOf - resolves the live Connection service.
+ * @returns {object} a route whose handler enforces the fence before dispatching.
+ */
+export function guardRoute(route, connectionOf) {
+  const inner = route.handler
+  return {
+    ...route,
+    handler: async (req, res) => {
+      const connection = connectionOf()
+      const rejection = typeof connection?.requestRejection === 'function'
+        ? connection.requestRejection(req)
+        : fallbackRejection(req)
+      if (rejection !== undefined) {
+        res.writeHead(rejection, { 'content-type': 'text/plain; charset=utf-8' })
+        res.end(rejection === 401 ? 'unauthorized' : 'forbidden')
+        return
+      }
+      return inner(req, res)
+    },
+  }
+}
+
 export function registerHttpTransports(ctx, routes) {
   // Reactive injection matters: either service can arrive after the plugin.
   // Neither optional transport is a hard prerequisite for the SSH tools.
   ctx.inject(['webServer'], (inner) => {
-    const disposers = routes.map((route) => inner.get('webServer').register(route))
+    // Apply DSH's own browser fence to every legacy route; the Connection
+    // service is read per request so a late-arriving authenticator still counts.
+    const guarded = routes.map((route) => guardRoute(route, () => ctx.get('connection')))
+    const disposers = guarded.map((route) => inner.get('webServer').register(route))
     inner.effect(() => () => disposers.forEach((dispose) => dispose()), 'dsh-remote.web-routes')
   })
   ctx.inject(['connection'], (inner) => {