dshost-plugin 0.1.13 → 0.1.15

package/lib/core.js

@@ -375,6 +375,63 @@ export function startAgent(opts) {
 
   const svcList = normalizeServices(services, log);
   const svcMap = new Map(svcList.map((s) => [s.id, s]));
+  // 单业务配置管理（门户托管）：宿主显式开启 remoteServices 才接受 relay 下发的
+  // 'services:config'；下发项与本机声明走同一 normalizeServices 白名单，且只允许
+  // auth=open、不接受任何凭据字段；与本机声明同 id 的下发项一律拒绝（本机为准）。
+  const remoteServices = opts.remoteServices === true || process.env.DSH_REMOTE_SERVICES === '1';
+  let managedList = [];
+  let lastApplied = null;
+  function servicesFrame() {
+    const pub = ({ id, name, desc, icon, auth, entry, spa, category }) => ({ id, name, desc, icon, auth, entry, spa, category });
+    return {
+      type: 'services',
+      servicesOnly: process.env.DSH_SERVICES_ONLY === '1' || undefined,
+      capabilities: remoteServices && process.env.DSH_SERVICES_ONLY !== '1' ? { remoteConfig: 1 } : undefined,
+      services: [
+        ...svcList.map((s) => ({ ...pub(s), origin: 'local' })),
+        ...managedList.map((s) => ({ ...pub(s), origin: 'managed' })),
+      ],
+      applied: lastApplied || undefined,
+    };
+  }
+  function applyManagedConfig(raw) {
+    const results = [];
+    const accepted = [];
+    const localIds = new Set(svcList.map((s) => s.id));
+    for (const item of Array.isArray(raw) ? raw.slice(0, 32) : []) {
+      const id = String(item?.id || '');
+      if (localIds.has(id)) { results.push({ id, ok: false, error: '与本机声明的服务同名，以本机为准' }); continue; }
+      const warn = [];
+      const [svc] = normalizeServices([{
+        id, name: item?.name, desc: item?.desc, icon: item?.icon, upstream: item?.upstream,
+        entry: item?.entry, spa: item?.spa === true, auth: 'open',
+      }], { warn: (m) => warn.push(m) });
+      if (!svc) { results.push({ id, ok: false, error: (warn[0] || 'invalid').replace(/^\[agent\] /, '') }); continue; }
+      svc.category = typeof item?.category === 'string' ? item.category.slice(0, 16) : '';
+      accepted.push(svc);
+      results.push({ id, ok: true });
+    }
+    for (const s of managedList) svcMap.delete(s.id);
+    managedList = accepted;
+    for (const s of managedList) svcMap.set(s.id, s);
+    lastApplied = results;
+    log.log?.(`[agent] managed services applied: ${results.map((r) => `${r.id}:${r.ok ? 'ok' : 'rejected'}`).join(', ') || '(none)'}`);
+  }
+  function probeUpstream(ws, msg) {
+    const t0 = Date.now();
+    const reply = (r) => send(ws, { type: 'services:probe-result', reqId: msg.reqId, ms: Date.now() - t0, ...r });
+    const up = parseUpstream(msg.upstream);
+    if (!up) { reply({ ok: false, error: '上游地址格式错误' }); return; }
+    if (!upstreamAllowed(up.host)) { reply({ ok: false, error: `${up.host} 不在实例白名单内（回环 / 10.144.144.0/24 / AGENT_UPSTREAM_ALLOW）` }); return; }
+    const entry = typeof msg.entry === 'string' && msg.entry.startsWith('/') ? msg.entry : '/';
+    const req = http.request({ host: up.host, port: up.port, path: entry, method: 'GET', timeout: 5000, headers: { host: `${up.host}:${up.port}` } }, (res) => {
+      res.resume();
+      reply({ ok: res.statusCode < 500, status: res.statusCode });
+    });
+    req.on('timeout', () => { req.destroy(new Error('连接超时（5s）')); });
+    req.on('error', (e) => reply({ ok: false, error: e.code === 'ECONNREFUSED' ? '连接被拒绝（端口没有服务在监听）' : e.message }));
+    req.end();
+  }
   let relayUsername = null; // set on 'registered'; subject of SSO trust headers
   if (svcList.length) {
     log.log?.(`[agent] plugin services: ${svcList.map((s) => `${s.id}->${s.host}:${s.port}${s.auth === 'sso' ? ' (sso)' : ''}`).join(', ')}`);
@@ -458,7 +515,19 @@ export function startAgent(opts) {
     log.log?.(`[agent] Connecting to ${relayUrl} ...`);
     const ws = new WebSocket(relayUrl);
 
+    // 握手超时看门狗：如果 WS open 事件在 20s 内未到达（TCP 连上但 upgrade
+    // 响应丢失——WiFi 恢复期/代理链路抖动时常见），主动 terminate 触发 close
+    // → 重连，避免永久挂死在 CONNECTING 状态（旧逻辑的致命缺陷：startHeartbeat
+    // 只在 registered 后启动，握手挂死时无任何看门狗看管新连接）。
+    const handshakeTimer = setTimeout(() => {
+      if (ws.readyState === WebSocket.CONNECTING) {
+        log.log?.('[agent] handshake timeout (20s, no WS open), forcing reconnect');
+        try { ws.terminate(); } catch (eT) {}
+      }
+    }, 20000);
+
     ws.on('open', () => {
+      clearTimeout(handshakeTimer);
       log.log?.('[agent] Connected to relay');
       send(ws, { type: 'register', token, version });
     });
@@ -475,17 +544,26 @@ export function startAgent(opts) {
         send(ws, { type: 'system-info', info: collectSystemInfo(dshVersion) });
         // 插件工作区：上报本实例声明的服务清单（relay 存实例维度，供 /p 路由校验）
         // DSH_SERVICES_ONLY=1：独立 services agent，relay 不注册主实例（服务旁挂到同机 dsh 实例）
-        send(ws, {
-          type: 'services',
-          servicesOnly: process.env.DSH_SERVICES_ONLY === '1' || undefined,
-          services: svcList.map(({ id, name, desc, icon, auth, entry, spa }) => ({ id, name, desc, icon, auth, entry, spa })),
-        });
+        send(ws, servicesFrame());
         startHeartbeat(ws);
         return;
       }
 
       if (msg.type === 'heartbeat') return;
 
+      // 门户托管业务下发（仅宿主开启 remoteServices 时接受）
+      if (msg.type === 'services:config') {
+        if (!remoteServices) { log.warn?.('[agent] services:config ignored (remoteServices disabled)'); return; }
+        applyManagedConfig(msg.services);
+        send(ws, servicesFrame());
+        return;
+      }
+      if (msg.type === 'services:probe') {
+        if (!remoteServices) { send(ws, { type: 'services:probe-result', reqId: msg.reqId, ok: false, error: 'remoteServices disabled' }); return; }
+        probeUpstream(ws, msg);
+        return;
+      }
+
       if (msg.type === 'http:request') {
         // [Artifact Viewer] 是 dsh UI 注入脚本的专属旁路；插件流不经过它。
         if (!msg.target && serveArtifactIfRequested(ws, msg)) return;
@@ -545,6 +623,8 @@ export function startAgent(opts) {
     });
 
     ws.on('close', (code, reason) => {
+      clearTimeout(handshakeTimer);
+      if (heartbeatInterval) { clearInterval(heartbeatInterval); heartbeatInterval = null; }
       log.log?.(`[agent] Disconnected (${code}): ${reason}`);
       registered = false;
       for (const [, stream] of streams) {
@@ -560,6 +640,7 @@ export function startAgent(opts) {
     });
 
     ws.on('error', (err) => {
+      clearTimeout(handshakeTimer);
       log.error?.(`[agent] WS Error: ${err.message}`);
       ws.close();
     });

package/lib/index.js

@@ -20,6 +20,8 @@ export function apply(ctx, config) {
   const dshPort = parseInt(config.dshPort || process.env.DSH_PORT || String(DSH_PORT), 10);
   // 插件工作区服务清单（cordis.patch.yml 的 config.services 数组）
   const services = Array.isArray(config.services) ? config.services : [];
+  // 单业务配置管理：允许 dshost.me 门户下发托管业务（显式开启；上游白名单仍在本机强制）
+  const remoteServices = config.remoteServices === true;
 
   console.log('[dsh-remote] Plugin loaded, token:', token ? '***' : 'none');
   if (services.length) console.log('[dsh-remote] Plugin services:', services.map((s) => s && s.id).filter(Boolean).join(', '));
@@ -41,6 +43,7 @@ export function apply(ctx, config) {
     dshHost,
     dshPort,
     services,
+    remoteServices,
   });
 
   // dsh >= 0.1.2 web auth: the web UI is gated behind a per-process one-time

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dshost-plugin",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",
   "type": "module",
   "main": "lib/index.js",