dsh-zen-remote 2.2.9 → 2.3.1

package/src/index.ts

@@ -16,11 +16,11 @@
  */
 
 import { createOwnerPeerSource, createSharedApiFetchGetter } from './owner-peer.js'
-import { lstat, mkdir, open, realpath, rm, writeFile } from 'node:fs/promises'
+import { lstat, mkdir, open, realpath, rename, rm, writeFile } from 'node:fs/promises'
 import type { FileHandle } from 'node:fs/promises'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import { randomBytes } from 'node:crypto'
-import { homedir } from 'node:os'
+import { homedir, networkInterfaces } from 'node:os'
 import { basename, extname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import type { Context } from '@deepseek-ai/cordis'
 import type {} from '@deepseek-ai/dsh-agent'
@@ -68,6 +68,15 @@ import { ADAPTERS } from './adapters/index.js'
 import { createRelayHandler, loadServerId, RELAY_PREFIX, resolveDshVersion } from './relay-server.js'
 import type { RelayGateway, RelayHandler } from './relay-server.js'
 import { createBridgeRegistry, compareBridges } from './plugin-bridge.js'
+import { createWizardHandler, WIZARD_ROUTE_PREFIX } from './wizard/routes.js'
+import { createCaddyManager } from './wizard/caddy-process.js'
+import type { SubprocessServiceLike } from './wizard/caddy-process.js'
+import { cfTokenConfigured, deleteCfTokenFile, readCfTokenFile, writeCfTokenFile } from './wizard/token-store.js'
+import { createCloudflaredManager, tunnelTokenConfigured } from './wizard/cloudflared.js'
+import { checkDomainOnCloudflare as runTunnelCheck, setupTunnel } from './wizard/tunnel-orchestrator.js'
+import { writeTunnelTokenFile } from './wizard/cloudflared.js'
+import { detectForwardedSource, parseProxyList } from './wizard/source-detect.js'
+import { createVerificationManager } from './wizard/verify.js'
 import type { BridgeDeclaration, BridgeRegistry, BridgeStatus, ServerPluginEntry, ZenRemoteService } from './plugin-bridge.js'
 import { createPluginLoopback } from './plugin-loopback.js'
 import { createPluginTunnel } from './plugin-tunnel.js'
@@ -789,6 +798,222 @@ export function apply(ctx: Context, config: MobileNavConfig = {}): void {
         }),
       }), 'dsh-zen-remote: admin routes')
     })
+    // Gateway-wizard routes (GW-4, extended by GW-5): a separate LONGEST-
+    // prefix registration under the admin prefix — the host web server
+    // matches the longest prefix first, so /admin/wizard/* lands here and
+    // everything else stays with the admin handler above. Same host-only
+    // gate and admit wall; the wizard handler applies its own via-marker
+    // and same-origin walls to every route. The runtime probe reads the
+    // gateway's own /lan-gate/status for the untrusted-proxy detection
+    // (read-only, best-effort); the trust-proxy persister merges into the
+    // FILE layer of lan-gate.config.json — the only writable config surface
+    // the plugin owns — which the restart watcher's poll picks up and
+    // reloads the row from (trustedProxies is a restart field), restarting
+    // the gateway with the new trust list. When the resolved value comes
+    // from env or the row the route refuses instead: a file-layer write
+    // would be shadowed there.
+    ctx.inject(['webServer', 'connection'], (wizardCtx) => {
+      // GW-13a: the managed Caddy lives in THIS row's closure — a row
+      // reload rebuilds the manager (and the row's disposal, below, kills
+      // the child), which is the reconcile-by-process-generation rule. The
+      // subprocess service is a lazy reflection lookup: adding it to the
+      // inject list would keep the whole wizard off compositions that lack
+      // it, and there `reflect.get` answers undefined instead.
+      const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+      const subprocessService = wizardCtx.reflect.get('subprocess') as SubprocessServiceLike | undefined
+      const caddyManager = subprocessService === undefined ? undefined : createCaddyManager({ subprocess: subprocessService, dshHome })
+      const cloudflaredManager = subprocessService === undefined ? undefined : createCloudflaredManager({ subprocess: subprocessService, dshHome })
+      // The verification session lives in THIS manager's closure (GW-9):
+      // memory-only by design, and a row reload rebuilds it — the same
+      // "stale" verdict the config fingerprint produces, arriving via the
+      // process generation instead.
+      const currentMode = (): string => resolveConfig(config, readFileConfig(), process.env).values.ingressMode
+      const detectLanAddress = (): string | undefined => {
+        try {
+          const nets = networkInterfaces()
+          let tailscaleIp: string | undefined
+          let lanIp: string | undefined
+          for (const entries of Object.values(nets)) {
+            if (!Array.isArray(entries)) continue
+            for (const entry of entries) {
+              if (!entry || entry.internal || entry.family !== 'IPv4') continue
+              const addr = entry.address
+              if (
+                /^192\.168\./.test(addr)
+                || /^10\./.test(addr)
+                || /^172\.(?:1[6-9]|2\d|3[01])\./.test(addr)
+              ) {
+                lanIp ??= addr
+              } else if (/^100\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(addr)) {
+                tailscaleIp ??= addr
+              }
+            }
+          }
+          return lanIp ?? tailscaleIp
+        } catch {
+          return undefined
+        }
+      }
+      // One runtime probe per request: the gateway's own status (source-IP
+      // detection + the ACTUAL port for snippets/QR), plus our processes'
+      // liveness for the projection.
+      const buildRuntime = async () => {
+        const lanAddress = detectLanAddress()
+        try {
+          const response = await fetch(`http://127.0.0.1:${effective.values.port}/lan-gate/status`, { signal: AbortSignal.timeout(3000) })
+          if (!response.ok) return { caddyRunning: caddyManager?.isRunning() === true, lanAddress }
+          const body = (await response.json()) as { port?: unknown; lastForwardedSource?: unknown }
+          return {
+            lastForwardedSource: detectForwardedSource(body),
+            // GW-fix-3/M2: the wizard's snippets and QR target the
+            // gateway's ACTUAL port (it may have retried past the
+            // configured one).
+            gatewayActualPort: typeof body?.port === 'number' ? body.port : undefined,
+            lanAddress,
+            caddyRunning: caddyManager?.isRunning() === true,
+            cloudflaredRunning: cloudflaredManager?.isRunning() === true,
+            tunnelTokenConfigured: cloudflaredManager !== undefined,
+            cfTokenConfigured: cfTokenConfigured(dshHome),
+          }
+        } catch {
+          // No answer is no detection — the status projection renders
+          // its null shape and the UI offers nothing.
+          return {
+            lanAddress,
+            caddyRunning: caddyManager?.isRunning() === true,
+            cloudflaredRunning: cloudflaredManager?.isRunning() === true,
+            tunnelTokenConfigured: tunnelTokenConfigured(dshHome),
+            cfTokenConfigured: cfTokenConfigured(dshHome),
+          }
+        }
+      }
+      const verification = createVerificationManager({
+        gatewayBase: `http://127.0.0.1:${effective.values.port}`,
+        getValues: () => resolveConfig(config, readFileConfig(), process.env).values,
+        // runtimeReady now covers the managed paths: Caddy must actually be
+        // alive; cloudflared arrives with GW-13b; the external path has no
+        // process of ours to wait for.
+        runtimeReady: () => {
+          const mode = currentMode()
+          if (mode === 'caddy') return caddyManager?.isRunning() === true
+          if (mode === 'cloudflared') return cloudflaredManager?.isRunning() === true
+          return true
+        },
+      })
+      wizardCtx.effect(() => {
+        const unregister = wizardCtx.webServer.register({
+        kind: 'prefix',
+        path: WIZARD_ROUTE_PREFIX,
+        handler: createWizardHandler({
+          admit: (req) => wizardCtx.connection.admit(req),
+          getConfig: () => resolveConfig(config, readFileConfig(), process.env),
+          tokenStore: {
+            writeCfToken: (token) => { writeCfTokenFile(dshHome, token) },
+            deleteCfToken: () => {
+              // Stop the consumers first (the mode-switch rule): whichever
+              // process might hold the token in its environment dies before
+              // the file disappears.
+              caddyManager?.stop()
+              cloudflaredManager?.stop()
+              deleteCfTokenFile(dshHome)
+            },
+            cfTokenConfigured: () => cfTokenConfigured(dshHome),
+            writeTunnelToken: (token) => { writeTunnelTokenFile(dshHome, token) },
+          },
+          ...(caddyManager === undefined ? {} : {
+            caddy: {
+              start: async (input: { domain: string; httpsPort: number; gatewayPort: number }) => {
+                // 模式切换：starting managed Caddy stops any running cloudflared tunnel first,
+                // and restarts Caddy if it was already running with an older config.
+                cloudflaredManager?.stop()
+                if (caddyManager.isRunning()) caddyManager.stop()
+                // The token rides the child env only — read from the store
+                // inside the wiring, never through a route payload.
+                const token = readCfTokenFile(dshHome)
+                if (token === undefined) return { ok: false as const, error: 'missing-token' as const }
+                return caddyManager.start({ ...input, cfToken: token })
+              },
+              stop: () => caddyManager.stop(),
+              status: () => (caddyManager.isRunning() ? 'running' as const : caddyManager.hasStarted() ? 'stopped' as const : 'never-started' as const),
+            },
+          }),
+          ...(cloudflaredManager === undefined ? {} : {
+            tunnel: {
+              checkDomain: (domain: string) => runTunnelCheck(
+                { readToken: () => readCfTokenFile(dshHome) },
+                domain,
+              ),
+              setup: (input: { domain: string; tunnelId?: string }) => setupTunnel(
+                {
+                  dshHome,
+                  readToken: () => readCfTokenFile(dshHome),
+                  gatewayPort: async () => {
+                    // The ingress service target is the gateway's ACTUAL
+                    // port — same fallback as the caddy start route: probe
+                    // /lan-gate/status first, fall back to the configured
+                    // port when it does not answer (GW-fix-4/M2).
+                    try {
+                      const response = await fetch(`http://127.0.0.1:${resolveConfig(config, readFileConfig(), process.env).values.port}/lan-gate/status`, { signal: AbortSignal.timeout(3000) })
+                      if (response.ok) {
+                        const body = (await response.json()) as { port?: unknown }
+                        if (typeof body?.port === 'number') return body.port
+                      }
+                    } catch { /* fall through to the configured port */ }
+                    return resolveConfig(config, readFileConfig(), process.env).values.port
+                  },
+                  cloudflared: {
+                    start: async (startInput: { tunnelToken: string }) => {
+                      if (cloudflaredManager.isRunning()) cloudflaredManager.stop()
+                      const started = await cloudflaredManager.start({ tunnelToken: startInput.tunnelToken })
+                      return started.ok ? ({ ok: true } as const) : ({ ok: false, error: started.error ?? 'spawn-failed' } as const)
+                    },
+                    // 模式切换：starting the tunnel stops the managed Caddy.
+                    stopCaddy: () => caddyManager?.stop(),
+                  },
+                },
+                input,
+              ),
+              stop: () => cloudflaredManager.stop(),
+              status: () => (cloudflaredManager.isRunning() ? 'running' as const : cloudflaredManager.hasStarted() ? 'stopped' as const : 'never-started' as const),
+            },
+          }),
+          verify: { start: (input) => verification.start(input), check: () => verification.check() },
+          getRuntime: () => buildRuntime(),
+          trustProxy: {
+            resolved: () => {
+              const snapshot = resolveConfig(config, readFileConfig(), process.env)
+              return { value: snapshot.values.trustedProxies, source: snapshot.sources.trustedProxies }
+            },
+            write: async (expected, list) => {
+              const home = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+              const file = join(home, 'lan-gate.config.json')
+              const current = readFileConfig()
+              // Concurrent-write guard (GW-fix-2/L2): the route resolved
+              // the list moments ago; if the file layer moved since (a
+              // parallel trust click, a hand edit), refuse instead of
+              // clobbering the other writer's entry. Both sides compare
+              // normalized so an illegal file value reads as "empty", the
+              // same thing resolveConfig saw.
+              const now = typeof current.trustedProxies === 'string' ? current.trustedProxies : ''
+              if (parseProxyList(now).join(',') !== parseProxyList(expected).join(',')) return false
+              const tmp = `${file}.tmp-${process.pid}-${Date.now()}`
+              await writeFile(tmp, `${JSON.stringify({ ...current, trustedProxies: list }, null, 2)}\n`, { mode: 0o600 })
+              await rename(tmp, file)
+              return true
+            },
+          },
+        }),
+      })
+      // H1: the row's disposal must not orphan the managed children — the
+      // Caddy/cloudflared processes die WITH the row that spawned them,
+      // before the route registration unregisters.
+      return () => {
+        caddyManager?.stop()
+        cloudflaredManager?.stop()
+        unregister()
+      }
+      }, 'dsh-zen-remote: wizard routes')
+    })
     // The idle sweeper (T22c): every minute, hand the table the CURRENT
     // idleHours and let it close sessions quiet past that. idleHours is a
     // volatile row field, so getIdleHours re-resolves from the SAME row

package/src/intercept.ts

@@ -1330,6 +1330,10 @@ interface MergedGlobalStreamDeps {
    * session" (T62); the merged stream re-judges immediately instead of
    * waiting for a frame or the fallback poll. Returns the disposer. */
   watchCurrentSession(fn: () => void): () => void
+  /** Subscribe one callback to {@link InterceptHandle.uninstall} so a live
+   * merged stream removes its remote groups and archives/hides its remote
+   * sessions when the plugin unloads or switches role from client to host. */
+  watchUninstall(fn: () => void): () => void
   /** T63: the summary-sync hub. The WORKSPACE route reports the virtual
    * session ids each forwarded frame batch carried, so the events leg's
    * sync can announce list rows the UI has no summary for; the control
@@ -1430,6 +1434,24 @@ async function* mergedGlobalStream(deps: MergedGlobalStreamDeps): AsyncGenerator
     for (const frame of merger.setCurrentSession(read.kind === 'open' ? read.sessionId : undefined)) channel.push(frame)
   }
   const offCurrentSession = deps.watchCurrentSession(informCurrentSession)
+  const offUninstall = deps.watchUninstall(() => {
+    try {
+      // When the client intercept is uninstalled (e.g. role switched from
+      // client to host), transition to `unpaired` (and ensure a readable
+      // current-session state so all remote sessions move into the archived
+      // set and are hidden from the default sidebar view while staying in
+      // their workspace group so they never become 「未分组」 strays).
+      const read = deps.getCurrentSession()
+      merger.setCurrentSession(read.kind === 'open' ? read.sessionId : undefined)
+      applyAnnotation('unpaired')
+      merger.onRemoteDown()
+      currentController?.abort()
+    } catch {
+      // ignore teardown errors
+    } finally {
+      flushWaiters()
+    }
+  })
   let sessionPoll: unknown = undefined
   const pollCurrentSession = (): void => {
     sessionPoll = undefined
@@ -1471,11 +1493,21 @@ async function* mergedGlobalStream(deps: MergedGlobalStreamDeps): AsyncGenerator
         // persisted server-side, so a re-pair to the SAME server keeps the
         // virtual prefix — and the UI's removedIds blacklist never clears
         // during a page's life, so a remove here would make the group
-        // un-revivable. Handle it exactly like a remote death: keep the
-        // shown state, cut the in-flight leg; the re-pair lands as `online`
-        // and the pump's wait resumes under the SAME identity.
+        // un-revivable. Handle it like a remote death: keep the shown
+        // workspace group, archive/hide the remote sessions via
+        // applyAnnotation → onStatusChanged (when `unpaired` or when
+        // current-session is readable), and cut the in-flight leg; the
+        // re-pair lands as `online` and restores the sessions under the SAME
+        // identity.
+        const read = deps.getCurrentSession()
+        if (state === 'unpaired' && read.kind === 'unavailable') {
+          merger.setCurrentSession(undefined)
+        } else {
+          informCurrentSession()
+        }
         applyAnnotation(annotationOf(state))
         merger.onRemoteDown()
+        ensureSessionPoll()
         currentController?.abort()
         return
       }
@@ -1703,6 +1735,7 @@ async function* mergedGlobalStream(deps: MergedGlobalStreamDeps): AsyncGenerator
     alive = false
     if (sessionPoll !== undefined) clock.clearTimeout(sessionPoll)
     offCurrentSession()
+    offUninstall()
     offState()
     if (signal !== undefined) signal.removeEventListener('abort', onExternalAbort)
     currentController?.abort()
@@ -2400,6 +2433,11 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
     currentSessionListeners.add(fn)
     return () => { currentSessionListeners.delete(fn) }
   }
+  const uninstallListeners = new Set<() => void>()
+  const watchUninstall = (fn: () => void): (() => void) => {
+    uninstallListeners.add(fn)
+    return () => { uninstallListeners.delete(fn) }
+  }
   const gateway = raw as Record<string | symbol, unknown>
   const shape = checkGatewayShape(raw)
   const counters = { openWireStream: 0, dispatchRpc: 0 }
@@ -3301,6 +3339,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
             clock,
             getCurrentSession,
             watchCurrentSession,
+            watchUninstall,
             summarySync,
           })
         })()
@@ -3378,6 +3417,7 @@ export function installIntercept(options: InstallInterceptOptions): InterceptHan
     uninstall() {
       if (!installed) return
       installed = false
+      for (const listener of [...uninstallListeners]) listener()
       // The catalog watcher dies with the wrap (T52-fix2): a late online
       // transition after this point belongs to another generation.
       offCatalogWatch?.()

package/src/merge-streams.ts

@@ -419,19 +419,43 @@ export function createWorkspaceMerger(options: WorkspaceMergerOptions): Workspac
     return currentOriginal() !== id
   }
 
-  /** T58: re-derive {@link hiddenSessions} from the live tombstone set —
-   * tombstones hide unless they ARE the current session (or no readable
-   * current is known, or the tombstone is inside the T65 hide grace);
-   * live-carried ids and ids that (re-)became the current session leave the
-   * set. Since T65 the hide/reveal transitions move ONLY the archived set —
-   * the session stays in its group's forwarded copy either way — so the
-   * caller emits just the merged archived frame when anything changed. */
+  /** Whether the relay status is an unpair or token revocation — while in
+   * either state, every known remote session is archived/hidden (except the
+   * currently open session when current session is readable, so its open page
+   * is not kicked home by `clearArchivedCurrent`). Reconnecting (`none`) or
+   * re-sharing automatically reveals them again. */
+  function isPairingDisconnected(): boolean {
+    return annotation === 'unpaired' || annotation === 'revoked'
+  }
+
+  /** T58: re-derive {@link hiddenSessions} from the live tombstone set (and
+   * when unpaired/revoked with a readable current session, every known remote
+   * session) — tombstones hide unless they ARE the current session (or no
+   * readable current is known, or the tombstone is inside the T65 hide
+   * grace); live-carried ids and ids that (re-)became the current session
+   * leave the set when paired. Since T65 the hide/reveal transitions move
+   * ONLY the archived set — the session stays in its group's forwarded copy
+   * either way — so the caller emits just the merged archived frame when
+   * anything changed. */
   function syncHiddenSessions(): { hidden: string[]; revealed: string[] } {
     const hidden: string[] = []
     const revealed: string[] = []
+    const disconnected = isPairingDisconnected()
+    const current = currentOriginal()
     for (const [id, home] of sessionHome) {
       const record = remote.get(home)
       if (record === undefined) continue
+      if (disconnected) {
+        if (currentReadable && current !== id) {
+          if (!hiddenSessions.has(id)) {
+            hiddenSessions.add(id)
+            hidden.push(id)
+          }
+        } else if (hiddenSessions.delete(id)) {
+          revealed.push(id)
+        }
+        continue
+      }
       if (stringList(record.sessionIds).includes(id)) {
         if (hiddenSessions.delete(id)) revealed.push(id)
         continue
@@ -794,7 +818,10 @@ export function createWorkspaceMerger(options: WorkspaceMergerOptions): Workspac
 
     onStatusChanged(): unknown[] {
       if (!localSeen || remote.size === 0) return []
-      return upsertFrames()
+      const changed = syncHiddenSessions()
+      const out = upsertFrames()
+      if (changed.hidden.length > 0 || changed.revealed.length > 0) out.push(mergedArchivedFrame())
+      return out
     },
 
     setCurrentSession(sessionId: string | undefined): unknown[] {
@@ -811,13 +838,15 @@ export function createWorkspaceMerger(options: WorkspaceMergerOptions): Workspac
     },
 
     get hasPendingHide(): boolean {
-      // Some tombstone is being kept visible: it is not in the hidden set
-      // (either it IS the current session, or no readable current made any
-      // decision yet) — the caller keeps polling until it hides.
+      // Some tombstone (or unpaired/revoked session) is being kept visible:
+      // it is not in the hidden set (either it IS the current session, or no
+      // readable current made any decision yet) — the caller keeps polling
+      // until it hides.
+      const disconnected = isPairingDisconnected()
       for (const [id, home] of sessionHome) {
         if (hiddenSessions.has(id)) continue
         const record = remote.get(home)
-        if (record !== undefined && !stringList(record.sessionIds).includes(id)) return true
+        if (record !== undefined && (disconnected || !stringList(record.sessionIds).includes(id))) return true
       }
       return false
     },