dsh-zen-remote 2.0.3 → 2.2.1

package/src/client-data/remote-status.ts

@@ -51,6 +51,11 @@ export interface RemoteStatusView {
   versionMismatch: boolean
   serverName: string
   closed: Readonly<Record<string, RemoteClosedReason>>
+  /** The plugins whose bridge verdict is bridged RIGHT NOW (PB-2; sorted
+   * server-side). A garbage or missing field degrades to the empty list —
+   * nothing is ever considered bridged on a shape the parse does not
+   * trust. */
+  bridgedPlugins: readonly string[]
   /** When this view was parsed off a GET body. */
   asOf: number
 }
@@ -80,10 +85,35 @@ export function parseRemoteStatusBody(body: unknown, now: number): RemoteStatusV
     versionMismatch: record.versionMismatch === true,
     serverName: typeof record.serverName === 'string' ? record.serverName : '',
     closed,
+    bridgedPlugins: Array.isArray(record.bridgedPlugins)
+      ? record.bridgedPlugins.filter((name): name is string => typeof name === 'string' && name !== '')
+      : [],
     asOf: now,
   }
 }
 
+// --- the bridge stamp (PB-14) -----------------------------------------------
+
+/**
+ * Whether ONE plugin's bridge verdict is bridged RIGHT NOW, judged off the
+ * `bridgedPlugins` list the remote-status body carries. Tolerant by the
+ * same discipline as the parse: a garbage list (an older server that never
+ * learned the field, a broken body) reads as "not bridged" — the hiding
+ * rules stay in force unless the server positively says otherwise, never
+ * the reverse. This is the pure core behind the
+ * `html[data-zr-bridge-<plugin>]` stamp the remote-session stylesheet
+ * spends.
+ */
+export function shouldStampBridgeAttribute(bridgedPlugins: unknown, plugin: string): boolean {
+  return Array.isArray(bridgedPlugins) && bridgedPlugins.includes(plugin)
+}
+
+/** The plugin the bridge stamp names. */
+export const BRIDGE_STAMP_PLUGIN = 'dsh-better-sidebar'
+
+/** The html attribute the stamp writes (`data-zr-bridge-dsh-better-sidebar`). */
+export const BRIDGE_STAMP_ATTRIBUTE = `data-zr-bridge-${BRIDGE_STAMP_PLUGIN}`
+
 // --- the icon's states -------------------------------------------------------
 
 /** The locale keys `describeRemoteStatus` needs. */

package/src/client-data/settings-form.ts

@@ -26,6 +26,7 @@
  */
 
 import { RESTART_FIELDS } from '../restart-fields.ts'
+import { derivePluginBridgeStatuses, type PluginBridgeStatusView } from './plugin-bridge.ts'
 
 // --- wire shapes -----------------------------------------------------------
 
@@ -88,6 +89,8 @@ export const ADMIN_STATUS_ROUTE = '/_dsh/zen-remote/admin/status'
 export const ADMIN_PAIR_ROUTE = '/_dsh/zen-remote/admin/pair'
 export const ADMIN_ACTION_ROUTE = '/_dsh/zen-remote/admin/action'
 export const ADMIN_PUSH_TEST_ROUTE = '/_dsh/zen-remote/admin/push-test'
+/** PB-5: the plugin bridge's registered-plugin listing (GET, server-local only). */
+export const ADMIN_PLUGIN_BRIDGE_ROUTE = '/_dsh/zen-remote/admin/plugin-bridge'
 
 /** Same-origin client routes the sub-client block talks to (host half: T16). */
 export const CLIENT_CLAIM_ROUTE = '/_dsh/zen-remote/client/claim'
@@ -153,6 +156,13 @@ export interface ClientStatusBody {
    * string[], unavailable: string[], incompatibleCalls: { time: number,
    * endpoint: string, code: string }[] }` (presence-gated). */
   compat?: unknown
+  /** PB-2: the per-plugin bridge verdicts (`BridgeStatus[]` verbatim,
+   * presence-gated — older servers answer without it). */
+  pluginBridge?: unknown
+  /** PB-4: the plugin-route interception's diagnostics (presence-gated —
+   * a host role or a refused install may still answer it; a server without
+   * the field never does). */
+  pluginRouteIntercept?: unknown
 }
 
 /** One remote-call failure line in the diagnostics lists. `time` is epoch
@@ -200,6 +210,13 @@ export interface ClientConnectionView {
   deviceName: string
   intercept: ClientInterceptView | undefined
   compat: ClientCompatView | undefined
+  /** PB-5: the bridge verdicts as the 诊断区 renders them, input order kept
+   * (undefined when the body carried none — the group stays hidden). */
+  pluginBridge: PluginBridgeStatusView[] | undefined
+  /** PB-5: the route interception's install state (`installed: false`
+   * renders the 本机改道未启用 line with the shape reasons; undefined when
+   * the body carried none). */
+  pluginRouteIntercept: { installed: boolean; reasons: string[] } | undefined
 }
 
 const CLIENT_STATES: readonly ClientConnectionView['state'][] = ['unpaired', 'connected', 'revoked', 'unreachable', 'unexpected', 'invalid-url', 'incompatible']
@@ -258,6 +275,18 @@ function deriveInterceptView(value: unknown): ClientInterceptView | undefined {
   }
 }
 
+/** PB-4 route-interception block, presence-gated the same way: only the
+ * install flag and the shape reasons (the 本机改道未启用 line) — the
+ * counters belong to the status surface, not this copy. */
+function derivePluginRouteInterceptView(value: unknown): { installed: boolean; reasons: string[] } | undefined {
+  if (value === undefined || value === null) return undefined
+  const record = asRecord(value)
+  return {
+    installed: record.installed === true,
+    reasons: stringListOf(record.reasons, 20),
+  }
+}
+
 /** T42 compat block, only when the body carried the field at all. The wire
  * names are the status route's (`different` / `incompatibleCalls`); the view
  * keeps the render-side names the block was written against. */
@@ -302,6 +331,8 @@ export function deriveClientStatusView(body: ClientStatusBody): ClientConnection
     deviceName: typeof safe.deviceName === 'string' ? safe.deviceName : '',
     intercept: deriveInterceptView(safe.intercept),
     compat: deriveCompatView(safe.compat),
+    pluginBridge: derivePluginBridgeStatuses(safe.pluginBridge),
+    pluginRouteIntercept: derivePluginRouteInterceptView(safe.pluginRouteIntercept),
   }
 }
 
@@ -641,6 +672,47 @@ export function boolField(field: string): SettingsFieldSpec {
   }
 }
 
+/**
+ * `pluginBridgeConsent` (PB-5): a name → boolean map staged as its canonical
+ * JSON draft. Nothing renders it as text — the 插件桥 toggles stage the NEXT
+ * map wholesale (`togglePluginConsent` builds it, one key per click) — but
+ * riding the shared spec table is what puts the field on the SAME save path
+ * as `autoShareNewSessions`: one staged revision, one save button, one
+ * atomic mutation. `format` keeps the value's own key order so a staged
+ * draft equal to the displayed value reads as "no change"; an illegal stored
+ * map formats as `{}` (the toggle then writes from scratch, and the junk
+ * stays refused by the row validator, never laundered through).
+ */
+export function consentField(field: string): SettingsFieldSpec {
+  const format = (value: unknown): string => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) return '{}'
+    const out: Record<string, boolean> = {}
+    for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+      if (typeof entry === 'boolean') out[key] = entry
+    }
+    return JSON.stringify(out)
+  }
+  return {
+    field,
+    format,
+    parse: (text) => {
+      let parsed: unknown
+      try {
+        parsed = JSON.parse(text)
+      } catch {
+        return undefined
+      }
+      if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return undefined
+      const out: Record<string, boolean> = {}
+      for (const [key, entry] of Object.entries(parsed as Record<string, unknown>)) {
+        if (typeof entry !== 'boolean') return undefined
+        out[key] = entry
+      }
+      return { kind: 'set', value: out }
+    },
+  }
+}
+
 /** Names of the row fields the settings page edits, in group order. */
 export type SettingsFieldName =
   | 'role'
@@ -657,6 +729,7 @@ export type SettingsFieldName =
   | 'serverName'
   | 'idleHours'
   | 'autoShareNewSessions'
+  | 'pluginBridgeConsent'
 
 /** Longest legal `serverName`, mirroring src/config.ts's cap. */
 export const SERVER_NAME_MAX = 40
@@ -680,6 +753,7 @@ export const SETTINGS_FIELDS: readonly SettingsFieldSpec[] = [
   nameField('serverName', SERVER_NAME_MAX),
   hoursField('idleHours', IDLE_HOURS_MAX),
   boolField('autoShareNewSessions'),
+  consentField('pluginBridgeConsent'),
 ]
 
 // --- the status -> view mapping ---------------------------------------------
@@ -894,6 +968,10 @@ export interface ZenRemoteFormState extends SettingsFormShellState {
   serverName: SettingsFieldState
   idleHours: SettingsFieldState
   autoShareNewSessions: SettingsFieldState
+  /** The consent map's staged state (PB-5). No text control renders it — the
+   * 插件桥 toggles stage the next map wholesale — but its `invalid` flag
+   * (a malformed draft) still gates the save like any field's. */
+  pluginBridgeConsent: SettingsFieldState
   deviceToken: SettingsSecretFieldState
   /** A restart-required field ({@link RESTART_FIELDS}) has a staged change a
    * save would actually write: the save will move the row and the host

package/src/client-routes.ts

@@ -31,7 +31,9 @@ import type { ClaimOutcome, ProbeState } from './client-pairing.js'
 import { unwrapVolatile } from './config.js'
 import type { FetchRouteInterceptDiagnostics } from './fetch-route-intercept.js'
 import type { CurrentSessionRead, InterceptDiagnostics } from './intercept.js'
+import type { PluginRouteInterceptDiagnostics } from './plugin-route-intercept.js'
 import { responseJson, sameOriginPost } from './http.js'
+import type { BridgeStatus } from './plugin-bridge.js'
 import { RELAY_HTTP_ROUTES } from './relay-access.js'
 import { relayCredentialsDigest, RelayError } from './relay-client.js'
 import type { RelayClient, RelayHttpResult } from './relay-client.js'
@@ -118,6 +120,17 @@ export interface ClientHandlerOptions {
    * its refusal counters. Undefined when this composition never attempted
    * one (no connection service, or no fileUploads service to inject). */
   getFetchRouteIntercept?: () => FetchRouteInterceptDiagnostics | undefined
+  /** The plugin-route interception's diagnostics (PB-4), read live per
+   * request: the local webServer `match` wrap that forwards bridged-plugin
+   * requests for remote sessions. Undefined when this composition never
+   * attempted one (a host role, or no webServer). */
+  getPluginRouteIntercept?: () => PluginRouteInterceptDiagnostics | undefined
+  /** The plugin bridge's live verdict (PB-2), computed PER CALL off the local
+   * registry, the last handshake's `plugins` table and the connection state —
+   * never a stored conclusion. Wired only by the CLIENT role's mount; absent
+   * (the host mount, old tests) both routes answer the empty shape: status's
+   * `pluginBridge: []` and remote-status's `bridgedPlugins: []`. */
+  getPluginBridgeStatus?: () => BridgeStatus[]
   /** Serve ONLY the remote-status route (T41a-fix2, the host role's mount):
    * every other route under the prefix answers the same 404 an unknown path
    * would. The claim / status / reconnect / unshare routes exist for a
@@ -456,6 +469,7 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
         // that.
         const intercept = options.getIntercept?.()
         const fetchRouteIntercept = options.getFetchRouteIntercept?.()
+        const pluginRouteIntercept = options.getPluginRouteIntercept?.()
         const compatRelay = options.getRelayClient?.()
         const compat =
           compatRelay?.compat !== undefined || (intercept?.incompatibleCalls.length ?? 0) > 0
@@ -467,8 +481,13 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
               }
             : undefined
         const withDiagnostics = (body: Record<string, unknown>): Record<string, unknown> => {
-          let next = intercept === undefined ? body : { ...body, intercept }
+          // PB-2: the per-plugin bridge verdict rides EVERY status answer —
+          // the settings surface explains a not-bridged plugin whatever the
+          // connection state (unpaired reads all-offline, the honest verdict).
+          let next: Record<string, unknown> = { ...body, pluginBridge: options.getPluginBridgeStatus?.() ?? [] }
+          if (intercept !== undefined) next = { ...next, intercept }
           if (fetchRouteIntercept !== undefined) next = { ...next, fetchRouteIntercept }
+          if (pluginRouteIntercept !== undefined) next = { ...next, pluginRouteIntercept }
           return compat === undefined ? next : { ...next, compat }
         }
         // The ROW decides its own two shapes first, per request (both fields
@@ -571,6 +590,11 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
         // T34: the T34 client parts' data source — no token, no server
         // address, nothing but the serving state, the compat verdict's
         // difference flag, the display name and the closed-session map.
+        // PB-2 adds `bridgedPlugins`: the names whose bridge verdict is
+        // bridged RIGHT NOW, sorted (the list arrives plugin-sorted, but the
+        // sort is pinned here so the field's shape never depends on the
+        // registry's internal order). The host mount — no verdict source —
+        // answers [].
         const relay = options.getRelayClient?.()
         const intercept = options.getIntercept?.()
         responseJson(res, 200, {
@@ -578,6 +602,10 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
           versionMismatch: (relay?.compat?.different?.length ?? 0) > 0,
           serverName: relay?.handshakeInfo?.serverName ?? '',
           closed: Object.fromEntries((intercept?.closedSessions ?? []).map((record) => [record.sessionId, record.reason])),
+          bridgedPlugins: (options.getPluginBridgeStatus?.() ?? [])
+            .filter((status) => status.bridged)
+            .map((status) => status.plugin)
+            .sort(),
         })
         return
       }

package/src/config.ts

@@ -77,6 +77,12 @@ export interface ZenRemoteConfig {
   idleHours: number
   /** Auto-share every newly created session to the paired phone (T16). */
   autoShareNewSessions: boolean
+  /** Per-plugin consent for bridging whole-machine data (plugin bridge,
+   * PB-1): plugin name → whether the server owner lets that plugin's
+   * `scope:'server'` routes be forwarded inside remote sessions. Absent or
+   * false means NO — default `{}` keeps every plugin unconsented. Volatile:
+   * read at compare time, deliberately NOT in RESTART_FIELDS. */
+  pluginBridgeConsent: Record<string, boolean>
 }
 
 function defaultServerName(): string {
@@ -101,6 +107,7 @@ export const DEFAULTS: ZenRemoteConfig = {
   serverName: defaultServerName(),
   idleHours: 48,
   autoShareNewSessions: false,
+  pluginBridgeConsent: {},
 }
 
 // --- per-field validators -------------------------------------------------
@@ -176,6 +183,22 @@ function serverNameOf(value: unknown): string | undefined {
   return name === undefined ? undefined : name.slice(0, SERVER_NAME_MAX)
 }
 
+/** `pluginBridgeConsent`: a plain object mapping plugin names to STRICT
+ * booleans. Anything else — null, an array, a non-boolean value (`"yes"`,
+ * `1`; unlike the scalar booleans there is no historic `1`/`"1"` convention
+ * to honor, this map only ever came from the settings surface or a
+ * hand-edited row/file) — makes the layer transparent, because a half-valid
+ * consent map must never read as "consented". Object keys are strings by
+ * construction in both JSON and YAML; the per-key string check stays as the
+ * cheap belt over the iteration. */
+function consentMap(value: unknown): Record<string, boolean> | undefined {
+  if (value === null || typeof value !== 'object' || Array.isArray(value)) return undefined
+  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+    if (typeof key !== 'string' || typeof entry !== 'boolean') return undefined
+  }
+  return value as Record<string, boolean>
+}
+
 /** Env validator applied to `Number(env[name])`, so `LAN_GATE_PORT='abc'`
  * lands in the same "unset" bucket as a bad row value. */
 function envNumber(
@@ -263,6 +286,10 @@ const FIELDS: { [K in keyof ZenRemoteConfig]: FieldResolver<ZenRemoteConfig[K]>
   serverName: { row: serverNameOf, file: serverNameOf },
   idleHours: { row: inRange(0, 8760), file: inRange(0, 8760) },
   autoShareNewSessions: { row: boolLike, file: boolLike },
+  // No env layer on purpose (PB-1): a per-plugin consent map has no historic
+  // flat variable to stay compatible with, and a consent decision is a
+  // settings-page action, not something set through the environment.
+  pluginBridgeConsent: { row: consentMap, file: consentMap },
 }
 
 /**
@@ -346,6 +373,7 @@ export function resolveConfig(
     serverName: resolveField('serverName', safeRow, safeFile, env, sources),
     idleHours: resolveField('idleHours', safeRow, safeFile, env, sources),
     autoShareNewSessions: resolveField('autoShareNewSessions', safeRow, safeFile, env, sources),
+    pluginBridgeConsent: resolveField('pluginBridgeConsent', safeRow, safeFile, env, sources),
   }
   return { values, sources }
 }
@@ -432,6 +460,10 @@ export const Config = z.object({
   serverName: z.any().volatile(),
   idleHours: z.any().volatile(),
   autoShareNewSessions: z.any().volatile(),
+  // Plugin-bridge consent (PB-1): a name → boolean map, live-read at compare
+  // time — a consent flip must apply without a row restart, so it is
+  // deliberately NOT in RESTART_FIELDS.
+  pluginBridgeConsent: z.any().volatile(),
   // Client-half knobs (T16): where the phone finds the gateway, and the
   // pairing token it presents. `role('secret')` keeps the token out of every
   // settings wire surface, like the verifier plugin's API key.

package/src/http.ts

@@ -66,3 +66,15 @@ export function sameOriginPost(req: IncomingMessage): boolean {
     return false
   }
 }
+
+
+/**
+ * One plugin-bridge refusal (PB-3): the standard JSON envelope plus the
+ * `x-zen-remote-error` marker header — the sub-client's passthrough layer
+ * classifies a refusal off the header alone, because the success path
+ * streams opaque plugin bytes and must never have to parse a body.
+ */
+export function pluginBridgeError(res: ServerResponse, status: number, code: string): void {
+  res.setHeader('x-zen-remote-error', code)
+  responseJson(res, status, { ok: false, error: { code } })
+}