dshost-plugin 0.1.15 → 0.1.17

package/lib/core.js

@@ -19,8 +19,93 @@ const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 *
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 60000;
 
+const IGNORE_IFACE_RE = /^(lo|docker\d*|br-[0-9a-f]+|veth[0-9a-f]+|virbr\d*|cni\d*|flannel\d*)$/i;
+const TRANSPARENT_GIF = Buffer.from('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7', 'base64');
+
+/**
+ * Enumerate and classify all candidate IPv4 addresses for intranet direct probing.
+ * Excludes loopback, internal interfaces, Docker bridges, container veths,
+ * sing-box/clash virtual tun interfaces (e.g. 172.18.0.1), and public WAN IPs.
+ * Categorizes EasyTier (10.144.x.x), Tailscale (100.64-127.x.x), and LAN (192.168.x.x, 10.x.x.x).
+ * @returns {Array<{ip: string, name: string, type: 'lan'|'vpn', desc: string, prio: number}>}
+ */
+export function collectCandidateIpv4s() {
+  const list = [];
+  const seenIps = new Set();
+  try {
+    const ifaces = os.networkInterfaces();
+    for (const [name, addrs] of Object.entries(ifaces)) {
+      if (IGNORE_IFACE_RE.test(name)) continue;
+      for (const a of addrs || []) {
+        if (a.family !== 'IPv4' || a.internal) continue;
+        const ip = a.address;
+        if (!ip || ip.startsWith('127.') || ip.startsWith('169.254.') || ip === '0.0.0.0') continue;
+        if (seenIps.has(ip)) continue;
+
+        // 1. Identify virtual tun/tap interfaces
+        const isTunTap = /^(tun|tap|utun)/i.test(name);
+        const isEasyTier = ip.startsWith('10.144.') || /easytier/i.test(name);
+        const isTailscale = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(ip) || /tailscale/i.test(name);
+
+        // If it's a tun/tap interface but NOT a recognized mesh VPN, it is a local proxy
+        // (e.g. sing-box/clash fake-ip or 172.18.0.1 tun) -> STRICTLY EXCLUDE.
+        if (isTunTap && !isEasyTier && !isTailscale) {
+          continue;
+        }
+
+        // 2. Filter out 172.16.0.0/12 (Docker networks, sing-box tun endpoints)
+        if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) {
+          continue;
+        }
+
+        let type = null;
+        let desc = name;
+        let prio = 99;
+
+        if (isEasyTier) {
+          type = 'vpn';
+          desc = 'EasyTier 专网';
+          prio = 1; // Prioritize mesh VPN across heterogeneous networks
+        } else if (isTailscale) {
+          type = 'vpn';
+          desc = 'Tailscale 专网';
+          prio = 1;
+        } else if (ip.startsWith('192.168.')) {
+          type = 'lan';
+          desc = '物理局域网 (192.168.x)';
+          prio = 2;
+        } else if (ip.startsWith('10.')) {
+          type = 'lan';
+          desc = '私有内网 (10.x)';
+          prio = 3;
+        } else {
+          // Public WAN IPs MUST NEVER be reported as intranet direct probe candidates!
+          continue;
+        }
+
+        seenIps.add(ip);
+        list.push({ ip, name, type, desc, prio });
+      }
+    }
+  } catch {}
+
+  // Explicit override or additional candidate IPs via env var
+  const envCandidates = (process.env.DSH_CANDIDATE_IPS || '').split(',').map((s) => s.trim()).filter(Boolean);
+  for (const raw of envCandidates) {
+    if (!seenIps.has(raw) && /^(\d{1,3}\.){3}\d{1,3}$/.test(raw)) {
+      seenIps.add(raw);
+      list.unshift({ ip: raw, name: 'env', type: 'lan', desc: '指定内网地址', prio: 0 });
+    }
+  }
+
+  list.sort((a, b) => a.prio - b.prio);
+  return list;
+}
+
 /** First non-internal IPv4 of this host (for the dashboard), or null. */
 function localIPv4() {
+  const c = collectCandidateIpv4s();
+  if (c.length > 0) return c[0].ip;
   try {
     for (const addrs of Object.values(os.networkInterfaces())) {
       for (const a of addrs || []) {
@@ -242,20 +327,28 @@ function detectDshMetadata() {
 }
 
 /** Collect local system info for the relay dashboard. */
-export function collectSystemInfo(defaultVersion) {
+export function collectSystemInfo(defaultVersion, lanBridgeInfo = null) {
   const disks = collectDisks();
   const diskTotal = disks.reduce((a, d) => a + d.total, 0);
   const diskUsed = disks.reduce((a, d) => a + d.used, 0);
   const diskFree = disks.reduce((a, d) => a + d.free, 0);
   const cpus = os.cpus();
   const meta = detectDshMetadata();
+  const candidates = collectCandidateIpv4s();
+  const bridgePort = lanBridgeInfo?.port || parseInt(process.env.LAN_BRIDGE_PORT || '3088', 10);
+  const bridgeEnabled = lanBridgeInfo ? lanBridgeInfo.enabled : process.env.LAN_BRIDGE_ENABLED !== '0';
   return {
     instanceId: getEffectiveInstanceId(),
     hostname: os.hostname(),
     platform: os.platform(),
     release: os.release(),
     arch: os.arch(),
-    ip: localIPv4(),
+    ip: candidates[0]?.ip || localIPv4(),
+    network: {
+      bridgePort,
+      bridgeEnabled,
+      candidates,
+    },
     cpuModel: cpus[0]?.model || '',
     cpuCores: cpus.length,
     loadAvg: os.loadavg(),
@@ -347,6 +440,244 @@ export function normalizeServices(raw, log) {
   return out;
 }
 
+/**
+ * Start lightweight LAN bridge listener for browser probing and direct LAN offloading.
+ * - Handles /__dsh_probe.gif and /__dsh_probe with CORS + Private Network Access headers.
+ * - Reverse proxies all other requests to local DSH (127.0.0.1:3080) rewriting Host/Origin.
+ * - Forwards WebSocket upgrades cleanly.
+ */
+export function startLanBridge({
+  port = 3088,
+  dshHost = '127.0.0.1',
+  dshPort = 3080,
+  getInstanceId: getInstId = getInstanceId,
+  getWebToken = null,
+  getAuthCookie = null,
+  mintAuthCookie = null,
+  log = console,
+}) {
+  let isListening = false;
+  // Track authenticated client IPs with expiration (7 days)
+  const authenticatedClients = new Map();
+
+  function isClientAuthed(ip, cookieHeader = '') {
+    if (cookieHeader.includes('dsh-auth-') || cookieHeader.includes('dsh_lan_auth=1')) {
+      return true;
+    }
+    const exp = authenticatedClients.get(ip);
+    if (exp && exp > Date.now()) {
+      return true;
+    }
+    return false;
+  }
+
+  function markClientAuthed(ip) {
+    if (ip) {
+      authenticatedClients.set(ip, Date.now() + 7 * 86400000);
+      if (authenticatedClients.size > 1000) {
+        const now = Date.now();
+        for (const [k, v] of authenticatedClients) {
+          if (v <= now) authenticatedClients.delete(k);
+        }
+      }
+    }
+  }
+
+  const server = http.createServer((req, res) => {
+    // CORS + PNA headers for modern browser cross-network access
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Private-Network', 'true');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS, HEAD');
+    res.setHeader('Access-Control-Allow-Headers', '*');
+
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    const rawUrl = req.url || '/';
+    const pathOnly = rawUrl.split('?')[0];
+
+    // 1. Lightweight probe image for PNA / Mixed Content bypass
+    if (pathOnly === '/__dsh_probe.gif') {
+      res.setHeader('Content-Type', 'image/gif');
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
+      res.writeHead(200);
+      res.end(TRANSPARENT_GIF);
+      return;
+    }
+
+    // 2. JSON probe endpoint
+    if (pathOnly === '/__dsh_probe') {
+      res.setHeader('Content-Type', 'application/json');
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
+      res.writeHead(200);
+      res.end(JSON.stringify({
+        ok: true,
+        instanceId: getInstId ? getInstId() : null,
+        hostname: os.hostname(),
+        ts: Date.now(),
+      }));
+      return;
+    }
+
+    const clientIp = req.socket?.remoteAddress;
+    const incomingCookie = req.headers.cookie || '';
+
+    // Check if request query contains a launch/direct token
+    let hasValidTokenInQuery = false;
+    let queryToken = null;
+    try {
+      const u = new URL(rawUrl, 'http://127.0.0.1');
+      queryToken = u.searchParams.get('token');
+      const activeToken = getWebToken ? getWebToken() : null;
+      if (queryToken && activeToken && queryToken === activeToken) {
+        hasValidTokenInQuery = true;
+        markClientAuthed(clientIp);
+      }
+    } catch {}
+
+    const clientAuthed = hasValidTokenInQuery || isClientAuthed(clientIp, incomingCookie);
+
+    // 3. Reverse proxy to local dsh on 127.0.0.1:3080
+    const dshHeaders = { ...req.headers };
+    dshHeaders.host = `${dshHost}:${dshPort}`;
+    if (dshHeaders.origin) {
+      dshHeaders.origin = `http://${dshHost}:${dshPort}`;
+    }
+    if (clientIp) {
+      dshHeaders['x-forwarded-for'] = clientIp;
+    }
+
+    // Auth injection: If request lacks dsh-auth- cookie, but client is authenticated
+    // (via token exchange, dsh_lan_auth cookie, or client IP match),
+    // inject active authCookie so local DSH never 401s on browser cross-origin redirects
+    const currentAuthCookie = getAuthCookie ? getAuthCookie() : null;
+    if (!incomingCookie.includes('dsh-auth-') && clientAuthed && currentAuthCookie) {
+      dshHeaders.cookie = incomingCookie ? `${incomingCookie}; ${currentAuthCookie}` : currentAuthCookie;
+    }
+
+    const dshReq = http.request(
+      `http://${dshHost}:${dshPort}${rawUrl}`,
+      {
+        method: req.method,
+        headers: dshHeaders,
+      },
+      (dshRes) => {
+        const resHeaders = { ...dshRes.headers };
+
+        // Rewrite Set-Cookie: SameSite=Strict -> SameSite=Lax
+        // Also attach dsh_lan_auth cookie if client is authenticated
+        const sc = resHeaders['set-cookie'];
+        if (sc) {
+          const list = Array.isArray(sc) ? sc : [sc];
+          const rewritten = list.map((c) => c.replace(/;\s*SameSite=Strict/i, '; SameSite=Lax'));
+          if (clientAuthed) {
+            rewritten.push('dsh_lan_auth=1; Path=/; SameSite=Lax; Max-Age=2592000');
+          }
+          resHeaders['set-cookie'] = rewritten;
+        } else if (hasValidTokenInQuery || clientAuthed) {
+          resHeaders['set-cookie'] = ['dsh_lan_auth=1; Path=/; SameSite=Lax; Max-Age=2592000'];
+        }
+
+        if (dshRes.statusCode === 401 && mintAuthCookie) {
+          mintAuthCookie().catch(() => {});
+        }
+
+        res.writeHead(dshRes.statusCode, resHeaders);
+        dshRes.pipe(res);
+      }
+    );
+
+    dshReq.on('error', (err) => {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end(`LAN Bridge Error: unable to connect to local DSH at ${dshHost}:${dshPort} (${err.message})`);
+      }
+    });
+
+    req.pipe(dshReq);
+  });
+
+  // Handle WebSocket Upgrade (e.g. terminals, RPC streams)
+  server.on('upgrade', (req, socket, head) => {
+    const clientIp = req.socket?.remoteAddress;
+    const incomingCookie = req.headers.cookie || '';
+    const dshHeaders = { ...req.headers };
+    dshHeaders.host = `${dshHost}:${dshPort}`;
+    if (dshHeaders.origin) {
+      dshHeaders.origin = `http://${dshHost}:${dshPort}`;
+    }
+
+    const currentAuthCookie = getAuthCookie ? getAuthCookie() : null;
+    const clientAuthed = isClientAuthed(clientIp, incomingCookie);
+    if (!incomingCookie.includes('dsh-auth-') && (clientAuthed || currentAuthCookie) && currentAuthCookie) {
+      dshHeaders.cookie = incomingCookie ? `${incomingCookie}; ${currentAuthCookie}` : currentAuthCookie;
+    }
+
+    const proxyReq = http.request({
+      hostname: dshHost,
+      port: dshPort,
+      path: req.url,
+      method: req.method,
+      headers: dshHeaders,
+    });
+
+    proxyReq.on('upgrade', (proxyRes, proxySocket, proxyHead) => {
+      let rawHeaders = `HTTP/1.1 101 Switching Protocols\r\n`;
+      for (const [k, v] of Object.entries(proxyRes.headers)) {
+        if (Array.isArray(v)) {
+          for (const item of v) rawHeaders += `${k}: ${item}\r\n`;
+        } else {
+          rawHeaders += `${k}: ${v}\r\n`;
+        }
+      }
+      rawHeaders += '\r\n';
+      socket.write(rawHeaders);
+
+      if (proxyHead && proxyHead.length) socket.write(proxyHead);
+      if (head && head.length) proxySocket.write(head);
+
+      proxySocket.pipe(socket);
+      socket.pipe(proxySocket);
+
+      proxySocket.on('error', () => socket.destroy());
+      socket.on('error', () => proxySocket.destroy());
+    });
+
+    proxyReq.on('error', (err) => {
+      log.warn?.(`[lan-bridge] WS upgrade to ${dshHost}:${dshPort} error: ${err.message}`);
+      socket.destroy();
+    });
+
+    proxyReq.end();
+  });
+
+  server.on('error', (err) => {
+    isListening = false;
+    log.warn?.(`[lan-bridge] Failed to bind 0.0.0.0:${port}: ${err.message}`);
+  });
+
+  try {
+    server.listen(port, '0.0.0.0', () => {
+      isListening = true;
+      log.log?.(`[lan-bridge] Listening on 0.0.0.0:${port} -> proxying to ${dshHost}:${dshPort}`);
+    });
+  } catch (err) {
+    log.warn?.(`[lan-bridge] Failed to start listener: ${err.message}`);
+  }
+
+  return {
+    server,
+    port,
+    get enabled() { return isListening && server.listening; },
+    close() {
+      try { server.close(); } catch {}
+    },
+  };
+}
+
 /**
  * Start the agent connection loop.
  * @param {object} opts
@@ -498,8 +829,43 @@ export function startAgent(opts) {
     mintAuthCookie();
   }
 
+  function getActiveWebToken() {
+    if (webToken) return webToken;
+    try {
+      if (fs.existsSync('/var/log/dsh-web.log')) {
+        const content = fs.readFileSync('/var/log/dsh-web.log', 'utf8');
+        const matches = [...content.matchAll(/\?token=([A-Za-z0-9_-]+)/g)];
+        if (matches.length > 0) {
+          return matches[matches.length - 1][1];
+        }
+      }
+    } catch {}
+    return null;
+  }
+
   if (webToken) mintAuthCookie();
 
+  // ── LAN Bridge for local/intranet direct offload & timing-gap probing ──
+  const lanBridgePort = parseInt(process.env.LAN_BRIDGE_PORT || '3088', 10);
+  const lanBridgeEnabled = process.env.LAN_BRIDGE_ENABLED !== '0' && process.env.DSH_SERVICES_ONLY !== '1';
+  let lanBridge = null;
+  if (lanBridgeEnabled) {
+    try {
+      lanBridge = startLanBridge({
+        port: lanBridgePort,
+        dshHost,
+        dshPort,
+        getInstanceId: getEffectiveInstanceId,
+        getWebToken: getActiveWebToken,
+        getAuthCookie: () => authCookie,
+        mintAuthCookie,
+        log,
+      });
+    } catch (e) {
+      log.warn?.(`[agent] Failed to initialize LAN bridge: ${e.message}`);
+    }
+  }
+
   const streams = new Map();
   let registered = false;
   let reconnectTimer = null;
@@ -541,7 +907,13 @@ export function startAgent(opts) {
         reconnectAttempt = 0;
         relayUsername = msg.username || null;
         log.log?.(`[agent] Registered as ${msg.username} (session ${msg.sessionId || ''})`);
-        send(ws, { type: 'system-info', info: collectSystemInfo(dshVersion) });
+        send(ws, {
+          type: 'system-info',
+          info: collectSystemInfo(dshVersion, {
+            port: lanBridgePort,
+            enabled: lanBridge ? lanBridge.enabled : false,
+          }),
+        });
         // 插件工作区：上报本实例声明的服务清单（relay 存实例维度，供 /p 路由校验）
         // DSH_SERVICES_ONLY=1：独立 services agent，relay 不注册主实例（服务旁挂到同机 dsh 实例）
         send(ws, servicesFrame());
@@ -551,6 +923,29 @@ export function startAgent(opts) {
 
       if (msg.type === 'heartbeat') return;
 
+      // 直连免密换票请求响应
+      if (msg.type === 'lan-ticket:request') {
+        const activeToken = getActiveWebToken();
+        if (!authCookie && activeToken) {
+          mintAuthCookie().catch(() => {});
+        }
+        send(ws, {
+          type: 'lan-ticket:response',
+          reqId: msg.reqId,
+          ok: true,
+          token: activeToken || '',
+          bridgePort: lanBridgePort,
+          bridgeEnabled: lanBridge ? lanBridge.enabled : false,
+        });
+        return;
+      }
+
+      // WebRTC P2P 穿透打洞信令交互
+      if (msg.type === 'webrtc:signal') {
+        handleWebRtcSignalMessage(ws, msg);
+        return;
+      }
+
       // 门户托管业务下发（仅宿主开启 remoteServices 时接受）
       if (msg.type === 'services:config') {
         if (!remoteServices) { log.warn?.('[agent] services:config ignored (remoteServices disabled)'); return; }
@@ -997,6 +1392,305 @@ export function startAgent(opts) {
     streams.set(streamId, { dshWs, pending });
   }
 
+  // ── WebRTC P2P Hole Punching Engine (werift) ──────────────────────
+  let weriftModule = null;
+  async function loadWerift() {
+    if (weriftModule) return weriftModule;
+    try {
+      weriftModule = await import('werift');
+      return weriftModule;
+    } catch (e) {
+      log.warn?.(`[agent] werift WebRTC module load failed: ${e.message}`);
+      return null;
+    }
+  }
+
+  const activeRtcPeers = new Map(); // clientId -> { pc, dc, wsStreams }
+
+  async function handleWebRtcSignalMessage(ws, msg) {
+    const { reqId, signalType, sdp, candidate, clientId = 'default' } = msg;
+    if (signalType === 'offer') {
+      const werift = await loadWerift();
+      if (!werift || !werift.RTCPeerConnection) {
+        send(ws, {
+          type: 'webrtc:signal-response',
+          reqId,
+          ok: false,
+          error: '宿主机未安装或加载 werift WebRTC 模块',
+        });
+        return;
+      }
+
+      // 确保本地 Auth Cookie 就绪
+      if (!authCookie && webToken) {
+        try { await mintAuthCookie(); } catch {}
+      }
+
+      try {
+        const existing = activeRtcPeers.get(clientId);
+        if (existing) {
+          try { existing.pc.close(); } catch {}
+          activeRtcPeers.delete(clientId);
+        }
+
+        const pc = new werift.RTCPeerConnection({
+          iceServers: [
+            { urls: 'stun:stun.cloudflare.com:3478' },
+            { urls: 'stun:stun.l.google.com:19302' },
+          ],
+        });
+
+        const peer = {
+          clientId,
+          pc,
+          dc: null,
+          wsStreams: new Map(),
+        };
+        activeRtcPeers.set(clientId, peer);
+
+        pc.ondatachannel = (event) => {
+          const dc = event.channel;
+          peer.dc = dc;
+          log.log?.(`[agent-webrtc] DataChannel opened (${dc.label}) for client ${clientId}`);
+
+          dc.onmessage = (e) => {
+            handleRtcDataChannelMessage(peer, dc, e.data);
+          };
+
+          dc.onclose = () => {
+            log.log?.(`[agent-webrtc] DataChannel closed for client ${clientId}`);
+            for (const [, sWs] of peer.wsStreams) {
+              try { sWs.close(); } catch {}
+            }
+            peer.wsStreams.clear();
+            activeRtcPeers.delete(clientId);
+          };
+
+          dc.onerror = (err) => {
+            log.warn?.(`[agent-webrtc] DataChannel error: ${err.message}`);
+          };
+        };
+
+        await pc.setRemoteDescription({ type: 'offer', sdp });
+        const answer = await pc.createAnswer();
+        await pc.setLocalDescription(answer);
+
+        // 等待 ICE 候选收集（嵌入至 localDescription 中返回，单次 RTT 快速握手）
+        await new Promise((resolve) => {
+          if (pc.iceGatheringState === 'complete') return resolve();
+          const timer = setTimeout(resolve, 800);
+          pc.onicegatheringstatechange = () => {
+            if (pc.iceGatheringState === 'complete') {
+              clearTimeout(timer);
+              resolve();
+            }
+          };
+        });
+
+        send(ws, {
+          type: 'webrtc:signal-response',
+          reqId,
+          ok: true,
+          signalType: 'answer',
+          sdp: pc.localDescription.sdp,
+        });
+      } catch (err) {
+        log.warn?.(`[agent-webrtc] Offer 协商异常: ${err.message}`);
+        send(ws, {
+          type: 'webrtc:signal-response',
+          reqId,
+          ok: false,
+          error: err.message,
+        });
+      }
+      return;
+    }
+
+    if (signalType === 'candidate') {
+      const peer = activeRtcPeers.get(clientId);
+      if (peer && peer.pc && candidate) {
+        try { await peer.pc.addIceCandidate(candidate); } catch {}
+      }
+      send(ws, { type: 'webrtc:signal-response', reqId, ok: true });
+      return;
+    }
+  }
+
+  function handleRtcDataChannelMessage(peer, dc, raw) {
+    let msg;
+    try {
+      msg = JSON.parse(typeof raw === 'string' ? raw : raw.toString('utf8'));
+    } catch {
+      return;
+    }
+
+    if (!msg || !msg.type) return;
+
+    // 1. P2P 测速与探测 (Ping / Pong)
+    if (msg.type === 'ping') {
+      try {
+        dc.send(JSON.stringify({
+          type: 'pong',
+          reqId: msg.reqId,
+          ts: msg.ts,
+          agentTs: Date.now(),
+          instanceId: getEffectiveInstanceId(),
+          hostname: os.hostname(),
+        }));
+      } catch {}
+      return;
+    }
+
+    // 2. HTTP 虚拟流转发
+    if (msg.type === 'http:request') {
+      const { streamId, method = 'GET', url = '/', headers = {}, body } = msg;
+      const targetHeaders = { ...headers };
+      targetHeaders.host = `${dshHost}:${dshPort}`;
+      targetHeaders.origin = `http://${dshHost}:${dshPort}`;
+      if (authCookie) targetHeaders.cookie = authCookie;
+      delete targetHeaders['content-length'];
+
+      const dshReq = http.request(`http://${dshHost}:${dshPort}${url}`, {
+        method,
+        headers: targetHeaders,
+      }, (dshRes) => {
+        const resHeaders = { ...dshRes.headers };
+        const sc = resHeaders['set-cookie'];
+        if (sc) {
+          const list = Array.isArray(sc) ? sc : [sc];
+          resHeaders['set-cookie'] = list.map(c => c.replace(/;\s*SameSite=Strict/i, '; SameSite=Lax'));
+        }
+
+        try {
+          dc.send(JSON.stringify({
+            type: 'http:response',
+            streamId,
+            status: dshRes.statusCode,
+            headers: resHeaders,
+          }));
+        } catch {}
+
+        dshRes.on('data', (chunk) => {
+          try {
+            dc.send(JSON.stringify({
+              type: 'http:chunk',
+              streamId,
+              data: chunk.toString('base64'),
+            }));
+          } catch {}
+        });
+
+        dshRes.on('end', () => {
+          try {
+            dc.send(JSON.stringify({ type: 'http:end', streamId }));
+          } catch {}
+        });
+      });
+
+      dshReq.on('error', (err) => {
+        try {
+          dc.send(JSON.stringify({
+            type: 'http:response',
+            streamId,
+            status: 502,
+            headers: { 'content-type': 'text/plain' },
+          }));
+          dc.send(JSON.stringify({
+            type: 'http:chunk',
+            streamId,
+            data: Buffer.from(`DSH WebRTC proxy error: ${err.message}`).toString('base64'),
+          }));
+          dc.send(JSON.stringify({ type: 'http:end', streamId }));
+        } catch {}
+      });
+
+      if (body) {
+        dshReq.write(Buffer.from(body, 'base64'));
+      }
+      dshReq.end();
+      return;
+    }
+
+    // 3. WebSocket 虚拟流转发 (终端 / RPC)
+    if (msg.type === 'ws:open') {
+      const { streamId, url = '/api/remote.mux' } = msg;
+      const wsHeaders = {
+        host: `${dshHost}:${dshPort}`,
+        origin: `http://${dshHost}:${dshPort}`,
+      };
+      if (authCookie) wsHeaders.cookie = authCookie;
+
+      const dshWs = new WebSocket(`ws://${dshHost}:${dshPort}${url}`, {
+        headers: wsHeaders,
+      });
+
+      peer.wsStreams.set(streamId, dshWs);
+
+      dshWs.on('open', () => {
+        try {
+          dc.send(JSON.stringify({ type: 'ws:opened', streamId }));
+        } catch {}
+      });
+
+      dshWs.on('message', (data, isBinary) => {
+        try {
+          dc.send(JSON.stringify({
+            type: 'ws:message',
+            streamId,
+            data: isBinary ? data.toString('base64') : data.toString(),
+            binary: !!isBinary,
+          }));
+        } catch {}
+      });
+
+      dshWs.on('close', (code, reason) => {
+        peer.wsStreams.delete(streamId);
+        try {
+          dc.send(JSON.stringify({
+            type: 'ws:close',
+            streamId,
+            code,
+            reason: reason?.toString(),
+          }));
+        } catch {}
+      });
+
+      dshWs.on('error', (err) => {
+        try {
+          dc.send(JSON.stringify({
+            type: 'ws:error',
+            streamId,
+            message: err.message,
+          }));
+        } catch {}
+      });
+      return;
+    }
+
+    if (msg.type === 'ws:message') {
+      const { streamId, data, binary } = msg;
+      const dshWs = peer.wsStreams.get(streamId);
+      if (dshWs && dshWs.readyState === WebSocket.OPEN) {
+        if (binary) {
+          dshWs.send(Buffer.from(data, 'base64'), { binary: true });
+        } else {
+          dshWs.send(data);
+        }
+      }
+      return;
+    }
+
+    if (msg.type === 'ws:close') {
+      const { streamId, code, reason } = msg;
+      const dshWs = peer.wsStreams.get(streamId);
+      if (dshWs) {
+        try { dshWs.close(code, reason); } catch {}
+        peer.wsStreams.delete(streamId);
+      }
+      return;
+    }
+  }
+
   connect();
 
   return {
@@ -1005,6 +1699,11 @@ export function startAgent(opts) {
     stop() {
       if (heartbeatInterval) clearInterval(heartbeatInterval);
       if (reconnectTimer) clearTimeout(reconnectTimer);
+      if (lanBridge) lanBridge.close();
+      for (const [, peer] of activeRtcPeers) {
+        try { peer.pc.close(); } catch {}
+      }
+      activeRtcPeers.clear();
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dshost-plugin",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",
   "type": "module",
   "main": "lib/index.js",
@@ -40,6 +40,7 @@
     "node": ">=22.5.0"
   },
   "dependencies": {
+    "werift": "^0.26.0",
     "ws": "^8.18.0"
   },
   "dsh": {