dsh-zen-remote 2.2.8 → 2.3.1

package/lib/wizard/cloudflared.js

@@ -0,0 +1,158 @@
+/**
+ * cloudflared process lifecycle (GW-7, 路 C's last mile). The tunnel's
+ * connector runs in the foreground (`tunnel run`) as a child of the DSH
+ * host, managed through the same subprocess service as the gateway child
+ * and the managed Caddy.
+ *
+ * The connector secret NEVER touches argv (visible to every process on
+ * the machine via ps) and is never an environment variable either — it is
+ * written to `<DSH_HOME>/zen-remote-ingress/tunnel-token`, mode 0600,
+ * through a temp-file-then-rename so a crash mid-write can never leave a
+ * half token at the real path, and handed to cloudflared with
+ * `--token-file`.
+ *
+ * Idempotency and cleanup mirror caddy-process.ts: a live child refuses a
+ * second start (stop first to switch tunnels), stop is idempotent, and an
+ * exited child clears its own slot. The host wiring hands stop to
+ * ctx.effect so the row's disposal kills cloudflared too.
+ */
+import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ensureBinary, BinaryDownloadError } from './binary-io.js';
+import { ingressDir } from './binary.js';
+/** Where the connector secret lives (design.md: 不进 Config 的字段). */
+export function tunnelTokenPath(dshHome) {
+    return join(ingressDir(dshHome), 'tunnel-token');
+}
+/** Whether a non-empty tunnel-token file exists (the projection's boolean
+ * only — GW-fix-4/M1: the manager's EXISTENCE says nothing about whether a
+ * token has been stored). */
+export function tunnelTokenConfigured(dshHome) {
+    try {
+        return statSync(tunnelTokenPath(dshHome)).isFile() && readFileSync(tunnelTokenPath(dshHome), 'utf8').trim() !== '';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Persist the tunnel connector secret: 0600, atomic (write the `.part`
+ * sibling, then rename over the real path).
+ */
+export function writeTunnelTokenFile(dshHome, token) {
+    const finalPath = tunnelTokenPath(dshHome);
+    const partPath = `${finalPath}.part`;
+    try {
+        mkdirSync(ingressDir(dshHome), { recursive: true });
+        writeFileSync(partPath, token, { mode: 0o600 });
+        try {
+            renameSync(partPath, finalPath);
+        }
+        catch {
+            writeFileSync(finalPath, token, { mode: 0o600 });
+            rmSync(partPath, { force: true });
+        }
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+    return finalPath;
+}
+export function createCloudflaredManager(options) {
+    const { subprocess, dshHome } = options;
+    const maxLogBytes = options.maxLogBytes ?? 64 * 1024;
+    let handle = null;
+    let startedOnce = false;
+    // GW-fix-2/L3: whitelist env — the host process carries the relay secret
+    // and DSH's own credentials, and cloudflared needs none of them (its
+    // connector secret comes through the 0600 token file). Include Windows
+    // system/profile variables so Go's TLS root-cert store and winsock
+    // initialize cleanly on Windows.
+    const childEnv = () => {
+        const env = {};
+        for (const key of [
+            'PATH', 'HOME', 'TMPDIR', 'LANG', 'TZ',
+            'SystemRoot', 'SYSTEMROOT', 'windir', 'WINDIR',
+            'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'PROGRAMDATA', 'TEMP', 'TMP',
+        ]) {
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        }
+        return env;
+    };
+    const spawnChild = (argv) => subprocess.spawn({
+        argv,
+        cwd: dshHome,
+        // GW-fix-2/L3: whitelist env — the token rides the 0600 file, so the
+        // child needs nothing from the host's environment beyond the basics.
+        env: childEnv(),
+        stdio: {
+            stdin: 'ignore',
+            stdout: { maxBytes: maxLogBytes },
+            stderr: { maxBytes: maxLogBytes },
+        },
+        graceMs: 3000,
+    });
+    const clearSlot = (child) => {
+        if (handle === child)
+            handle = null;
+    };
+    return {
+        async start(input) {
+            if (handle !== null)
+                return { ok: false, error: 'already-running' };
+            const tunnelToken = typeof input.tunnelToken === 'string' && input.tunnelToken.trim() !== '' ? input.tunnelToken : undefined;
+            if (tunnelToken === undefined)
+                return { ok: false, error: 'missing-token' };
+            let binaryPath;
+            try {
+                binaryPath = (await ensureBinary(dshHome, 'cloudflared', {
+                    fetchImpl: options.fetchImpl,
+                    platform: options.platform,
+                    onProgress: options.onProgress,
+                })).path;
+            }
+            catch (error) {
+                if (error instanceof BinaryDownloadError) {
+                    return { ok: false, error: 'download-failed', detail: error.message, installUrl: error.installUrl };
+                }
+                return { ok: false, error: 'download-failed', detail: String(error?.message ?? error) };
+            }
+            let tokenFile;
+            try {
+                tokenFile = writeTunnelTokenFile(dshHome, tunnelToken);
+            }
+            catch (error) {
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+            try {
+                const child = spawnChild([binaryPath, 'tunnel', 'run', '--token-file', tokenFile]);
+                handle = child;
+                startedOnce = true;
+                void child.done.then(() => clearSlot(child)).catch(() => clearSlot(child));
+                return { ok: true, binaryPath, tokenFile, alreadyRunning: false };
+            }
+            catch (error) {
+                handle = null;
+                return { ok: false, error: 'spawn-failed', detail: String(error?.message ?? error) };
+            }
+        },
+        stop() {
+            if (handle === null)
+                return;
+            const child = handle;
+            handle = null;
+            try {
+                void child.terminate();
+            }
+            catch {
+                // A dead child's terminate is a no-op or a throw — either way done.
+            }
+        },
+        isRunning: () => handle !== null,
+        /** Whether any start has succeeded in this manager's lifetime. */
+        hasStarted: () => startedOnce,
+    };
+}
+//# sourceMappingURL=cloudflared.js.map

package/lib/wizard/cloudflared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflared.js","sourceRoot":"","sources":["../../src/wizard/cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC9F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAyB,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,UAAU,EAAuB,MAAM,aAAa,CAAA;AAG7D,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAA;AAClD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IACpH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAa;IACjE,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAA;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;YAChD,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAqCD,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,GAAG,IAAI,CAAA;IACpD,IAAI,MAAM,GAAgC,IAAI,CAAA;IAC9C,IAAI,WAAW,GAAG,KAAK,CAAA;IAEvB,yEAAyE;IACzE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,GAAsB,EAAE;QACvC,MAAM,GAAG,GAAsB,EAAE,CAAA;QACjC,KAAK,MAAM,GAAG,IAAI;YAChB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI;YACtC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ;YAC9C,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK;SACvE,EAAE,CAAC;YACF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjE,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,IAAc,EAAwB,EAAE,CAC1D,UAAU,CAAC,KAAK,CAAC;QACf,IAAI;QACJ,GAAG,EAAE,OAAO;QACZ,qEAAqE;QACrE,qEAAqE;QACrE,GAAG,EAAE,QAAQ,EAAE;QACf,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;YACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAClC;QACD,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEJ,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAQ,EAAE;QACtD,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM,GAAG,IAAI,CAAA;IACrC,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAA;YACnE,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5H,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;YAE3E,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE;oBACvD,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC,CAAC,IAAI,CAAA;YACV,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAA;gBACrG,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACpG,CAAC;YAED,IAAI,SAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,SAAS,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;YACxD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAA;gBAClF,MAAM,GAAG,KAAK,CAAA;gBACd,WAAW,GAAG,IAAI,CAAA;gBAClB,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;YACnE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,IAAI,CAAA;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,EAAE,CAAA;YACjG,CAAC;QACH,CAAC;QAED,IAAI;YACF,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAM;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAA;YACpB,MAAM,GAAG,IAAI,CAAA;YACb,IAAI,CAAC;gBACH,KAAK,KAAK,CAAC,SAAS,EAAE,CAAA;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,KAAK,IAAI;QAChC,kEAAkE;QAClE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW;KAC9B,CAAA;AACH,CAAC"}

package/lib/wizard/probe.js

@@ -0,0 +1,118 @@
+/**
+ * hostPath probe (GW-8): the server machine walks its OWN public URL and
+ * classifies what answers, so the wizard can say something sharper than
+ * "it didn't work" — the pairing page showing up means TLS + proxying to
+ * the gateway both work; the admin surface answering 200 means the proxy
+ * is DROPPING the forwarded headers the gateway trusts; a redirect smells
+ * like Cloudflare Access or a proxy rewriting to a login page.
+ *
+ * Split exactly as the ticket asks: the two `classify*Response` functions
+ * are pure (the check scripts can drive them), `probeHostPath` owns the
+ * fetch I/O — `redirect: 'manual'` so a proxy's 3xx is SEEN, never
+ * followed — with the URL admission reusing client-pairing's
+ * `normalizeServerUrl` (https anywhere; plain http only for the explicit
+ * private-network allowances) and a 10 s ceiling per request.
+ */
+import { normalizeServerUrl } from '../client-pairing.js';
+/**
+ * `GET /`: the ONE right answer is the gateway's pairing page — 401,
+ * text/html, carrying the claim-endpoint marker the page's own script
+ * posts to. A 200 means the URL belongs to something else entirely.
+ */
+export function classifyRootResponse(status, contentType, body) {
+    if (status === 401) {
+        if (contentType.includes('text/html') && body.includes('/lan-gate/pair/claim'))
+            return 'gateway-pairing-page';
+        return 'unexpected-401';
+    }
+    if (status >= 200 && status < 300)
+        return 'unexpected-200';
+    if (status >= 300 && status < 400)
+        return 'redirect';
+    return 'unexpected';
+}
+/**
+ * `GET /lan-gate/admin`: right is the gateway's own 403 JSON — a public
+ * visitor must not get in. 200 + HTML is the DANGEROUS shape: something
+ * answered with a page, meaning the proxy forwarded without the
+ * forwarded headers and the gateway's local-only wall never saw a
+ * proxied request (the admin page leaked). 403 + HTML smells like
+ * Cloudflare Access interposing its own login.
+ */
+export function classifyAdminResponse(status, contentType, body) {
+    const isHtml = contentType.includes('text/html');
+    if (status === 403) {
+        if (isHtml)
+            return 'proxy-403';
+        if (contentType.includes('application/json')) {
+            try {
+                const parsed = JSON.parse(body);
+                if (parsed !== null && typeof parsed === 'object' && parsed.ok === false) {
+                    return 'gateway-admin-403';
+                }
+            }
+            catch {
+                // JSON-shaped header with a non-JSON body: not our gateway's answer.
+            }
+        }
+        return 'unexpected';
+    }
+    if (status >= 200 && status < 300 && isHtml)
+        return 'admin-exposed';
+    return 'unexpected';
+}
+/** One manual-redirect GET, classified. Sends a browser-shaped `Accept:
+ * text/html` (never `application/json`, which tells `lan-gate-server.cjs`
+ * the caller is an XHR/API client and makes `GET /` answer 401 JSON
+ * `{"ok":false,"reason":"unpaired"}` instead of the HTML pairing page;
+ * `/lan-gate/admin` answers 403 JSON regardless of `Accept`). */
+async function probeOnce(fetchImpl, url, timeoutMs) {
+    const response = await fetchImpl(url, {
+        redirect: 'manual',
+        signal: AbortSignal.timeout(timeoutMs),
+        headers: { Accept: 'text/html' },
+    });
+    const body = await response.text();
+    return { status: response.status, contentType: String(response.headers.get('content-type') ?? ''), body };
+}
+/**
+ * Probe the machine's public URL from here: both the root path and the
+ * admin surface, never following a redirect. The two requests run
+ * concurrently; the answer carries both classifications and the elapsed
+ * time. Every failure mode is a VALUE (`kind: 'unreachable'`), never a
+ * throw — the wizard routes render whichever verdict arrived.
+ */
+export async function probeHostPath(publicUrl, options = {}) {
+    const started = (options.now ?? Date.now)();
+    const elapsed = () => (options.now ?? Date.now)() - started;
+    // Same admission the client pairing uses: https anywhere, plain http
+    // only into the explicit private-network allowances.
+    const normalized = normalizeServerUrl(typeof publicUrl === 'string' ? publicUrl : '');
+    if (!normalized.ok) {
+        return { kind: 'unreachable', reason: normalized.reason === 'insecure-http' ? 'insecure-http' : 'invalid-url', ms: 0 };
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    try {
+        const [root, admin] = await Promise.all([
+            probeOnce(fetchImpl, `${normalized.url}/`, timeoutMs),
+            probeOnce(fetchImpl, `${normalized.url}/lan-gate/admin`, timeoutMs),
+        ]);
+        return {
+            kind: 'reached',
+            root: classifyRootResponse(root.status, root.contentType, root.body),
+            admin: classifyAdminResponse(admin.status, admin.contentType, admin.body),
+            ms: elapsed(),
+        };
+    }
+    catch (error) {
+        const name = error?.name;
+        return {
+            kind: 'unreachable',
+            reason: name === 'TimeoutError' || name === 'AbortError' ? 'timeout' : 'network',
+            detail: String(error?.message ?? error),
+            ms: elapsed(),
+        };
+    }
+}
+//# sourceMappingURL=probe.js.map

package/lib/wizard/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/wizard/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAiBzD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IACpF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,OAAO,sBAAsB,CAAA;QAC7G,OAAO,gBAAgB,CAAA;IACzB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,gBAAgB,CAAA;IAC1D,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,UAAU,CAAA;IACpD,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAmB,EAAE,IAAY;IACrF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAChD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,IAAI,MAAM;YAAE,OAAO,WAAW,CAAA;QAC9B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACxC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAK,MAA2B,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;oBAC/F,OAAO,mBAAmB,CAAA;gBAC5B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;QACD,OAAO,YAAY,CAAA;IACrB,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM;QAAE,OAAO,eAAe,CAAA;IACnE,OAAO,YAAY,CAAA;AACrB,CAAC;AA6BD;;;;iEAIiE;AACjE,KAAK,UAAU,SAAS,CACtB,SAAuB,EACvB,GAAW,EACX,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACtC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;KACjC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAA;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAkB,EAAE,UAAwB,EAAE;IAChF,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,CAAA;IAC3D,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACrF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,EAAE,CAAA;IACxH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtC,SAAS,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,GAAG,EAAE,SAAS,CAAC;YACrD,SAAS,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,GAAG,iBAAiB,EAAE,SAAS,CAAC;SACpE,CAAC,CAAA;QACF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC;YACpE,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC;YACzE,EAAE,EAAE,OAAO,EAAE;SACd,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAAe,EAAE,IAAI,CAAA;QACnC,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAChF,MAAM,EAAE,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC;YAClD,EAAE,EAAE,OAAO,EAAE;SACd,CAAA;IACH,CAAC;AACH,CAAC"}

package/lib/wizard/proxy-snippets.js

@@ -0,0 +1,112 @@
+/**
+ * Reverse-proxy configuration snippets (GW-5, 路 B) — for the user who
+ * ALREADY runs their own proxy, the wizard hands out copy-paste material
+ * instead of managing a process. Everything here is pure text generation:
+ * every interpolated value passes a charset gate (the domain through
+ * config.ts's `hostOf`, the upstream host likewise, the port in [1,
+ * 65535]), so a hostile form value cannot smuggle a directive into
+ * anyone's nginx.
+ *
+ * The upstream port is the gateway's ACTUAL port — the caller reads it
+ * from the running gateway (it may have retried past the configured one),
+ * never from config.
+ */
+import { hostOf } from '../config.js';
+/** Integers in [1, 65535] only. */
+function portOf(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 && value <= 65535 ? value : undefined;
+}
+function validatedParts(input) {
+    const domain = hostOf(input.domain);
+    if (domain === undefined)
+        return { error: { ok: false, error: 'bad-domain' } };
+    const upstream = hostOf(input.upstreamHost);
+    if (upstream === undefined)
+        return { error: { ok: false, error: 'bad-upstream-host' } };
+    const port = portOf(input.upstreamPort);
+    if (port === undefined)
+        return { error: { ok: false, error: 'bad-upstream-port' } };
+    return { domain, upstream, port };
+}
+/**
+ * nginx: a complete server block. The WebSocket upgrade map sits outside
+ * the server (http-level context) — the snippet says so in a comment, the
+ * user pastes it into the http/server scope their setup offers. Long
+ * idle tunnels need the 3600s read/send timeouts, uploads the 128m
+ * client body cap, and streaming the buffering switch — all three are
+ * the shapes DSH's relay traffic actually needs.
+ */
+export function nginxSnippet(input) {
+    const parts = validatedParts(input);
+    if ('error' in parts)
+        return parts.error;
+    const { domain, upstream, port } = parts;
+    const text = [
+        '# 这段放在 http {} 层（若已有同名 map 则跳过）',
+        'map $http_upgrade $connection_upgrade {',
+        '    default upgrade;',
+        "    ''      close;",
+        '}',
+        '',
+        'server {',
+        '    listen 443 ssl;',
+        `    server_name ${domain};`,
+        '',
+        '    location / {',
+        `        proxy_pass http://${upstream}:${port};`,
+        '        proxy_http_version 1.1;',
+        '        proxy_set_header Upgrade $http_upgrade;',
+        '        proxy_set_header Connection $connection_upgrade;',
+        '        proxy_set_header Host $host;',
+        '        proxy_set_header X-Real-IP $remote_addr;',
+        '        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;',
+        '        proxy_set_header X-Forwarded-Proto $scheme;',
+        '        proxy_buffering off;',
+        '        client_max_body_size 128m;',
+        '        proxy_read_timeout 3600s;',
+        '        proxy_send_timeout 3600s;',
+        '    }',
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, text };
+}
+/**
+ * Caddy (user-operated, not the wizard-managed one): the site block is
+ * one `reverse_proxy` line — Caddy routes the rest itself.
+ */
+export function caddySnippet(input) {
+    const parts = validatedParts(input);
+    if ('error' in parts)
+        return parts.error;
+    const { domain, upstream, port } = parts;
+    const text = [
+        `${domain} {`,
+        `    reverse_proxy ${upstream}:${port}`,
+        '}',
+        '',
+    ].join('\n');
+    return { ok: true, text };
+}
+/**
+ * Lucky (Web 服务反代) three steps: listen 443, proxy to the upstream,
+ * flip the catch-all switch. Text only — Lucky has no config file format
+ * to generate.
+ */
+export function luckySteps(input) {
+    const upstream = hostOf(input.upstreamHost);
+    if (upstream === undefined)
+        return { ok: false, error: 'bad-upstream-host' };
+    const port = portOf(input.upstreamPort);
+    if (port === undefined)
+        return { ok: false, error: 'bad-upstream-port' };
+    return {
+        ok: true,
+        steps: [
+            '在 Lucky 的「Web 服务」里新建一条规则，监听 443 端口，绑定你的域名。',
+            `后端（反代目标）填 http://${upstream}:${port}，开启 WebSocket 支持。`,
+            '打开「万事大吉」开关（放行全部路径），保存即可生效。',
+        ],
+    };
+}
+//# sourceMappingURL=proxy-snippets.js.map

package/lib/wizard/proxy-snippets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-snippets.js","sourceRoot":"","sources":["../../src/wizard/proxy-snippets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAgBrC,mCAAmC;AACnC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACjH,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAAA;IAC9E,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAA;IACvF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAA;IACnF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAA;IACxC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,MAAM,IAAI,GAAG;QACX,iCAAiC;QACjC,yCAAyC;QACzC,sBAAsB;QACtB,oBAAoB;QACpB,GAAG;QACH,EAAE;QACF,UAAU;QACV,qBAAqB;QACrB,mBAAmB,MAAM,GAAG;QAC5B,EAAE;QACF,kBAAkB;QAClB,6BAA6B,QAAQ,IAAI,IAAI,GAAG;QAChD,iCAAiC;QACjC,iDAAiD;QACjD,0DAA0D;QAC1D,sCAAsC;QACtC,kDAAkD;QAClD,sEAAsE;QACtE,qDAAqD;QACrD,8BAA8B;QAC9B,oCAAoC;QACpC,mCAAmC;QACnC,mCAAmC;QACnC,OAAO;QACP,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,OAAO,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAA;IACxC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACxC,MAAM,IAAI,GAAG;QACX,GAAG,MAAM,IAAI;QACb,qBAAqB,QAAQ,IAAI,IAAI,EAAE;QACvC,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC3B,CAAC;AAMD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAuD;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACxE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,4CAA4C;YAC5C,oBAAoB,QAAQ,IAAI,IAAI,mBAAmB;YACvD,4BAA4B;SAC7B;KACF,CAAA;AACH,CAAC"}