dshost-plugin 0.1.5 → 0.1.9

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-remote contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,106 @@
+# dshost-plugin
+
+[![npm version](https://img.shields.io/npm/v/dshost-plugin.svg)](https://www.npmjs.com/package/dshost-plugin)
+[![license](https://img.shields.io/npm/l/dshost-plugin.svg)](./LICENSE)
+[![node](https://img.shields.io/node/v/dshost-plugin.svg)](https://www.npmjs.com/package/dshost-plugin)
+[![GitHub](https://img.shields.io/badge/GitHub-NoelJudeNoel%2Fdshost--plugin-blue)](https://github.com/NoelJudeNoel/dshost-plugin)
+
+**DSHost 官方 DSH 远程中继插件** — 在你的 dsh（DeepSeek Harness）实例上运行一个 Agent，
+通过 `wss` 主动外连 DHost 中继，让你在世界任何地方用浏览器安全访问自己的 dsh Web UI，
+无需公网 IP、无需端口映射。
+
+*Official remote cloud relay plugin for DSHost (dshost.me): securely access your
+dsh Web UI from anywhere.*
+
+## 特性
+
+- **零公网 IP**：Agent 主动外连中继（`wss://dshost.me/agent`），本机不开任何入站端口
+- **零破坏性多版本兼容**：同时支持 dsh `0.0.1-rc.*` / `0.1.0-rc.*` / `0.1.1-*` / `0.1.2-*`
+- **安全**：中继层 Host/Origin 重写遵守 dsh 信任栅栏；`settings.describe` 密钥脱敏下发；
+  生产环境强制 `wss://`
+- **随 dsh 启动**：以 cordis 插件身份随 `dsh web` 加载，自动重连、休眠省流
+
+## 快速开始
+
+### 1. 申请 Token
+
+在 [dshost.me](https://dshost.me) 注册/登录（支持 GitHub OAuth），创建实例获得
+`dsh_` 开头的接入 Token。
+
+### 2. 一键安装（推荐）
+
+```bash
+curl -fsSL https://dshost.me/install.sh | bash
+```
+
+脚本会安装 pnpm、通过 `dsh plugin add dshost-plugin` 把插件装入当前 profile，
+并写入 profile 的 `cordis.patch.yml`。
+
+### 3. 手动安装
+
+```bash
+# 装入 dsh profile（等价于在 profile 目录执行 pnpm add dshost-plugin）
+dsh plugin add dshost-plugin
+```
+
+然后在 profile 的 `cordis.patch.yml` 里声明插件（新增行必须放在 `- insert:` 块内）：
+
+```yaml
+- insert:
+    - id: dsh-remote-agent
+      name: 'dshost-plugin'
+      config:
+        token: dsh_your_token_here
+        relayUrl: wss://dshost.me/agent
+        autoConnect: true
+```
+
+### 4. 重启 dsh
+
+```bash
+sudo systemctl restart dsh   # 或你的启动方式
+```
+
+启动后控制台（dshost.me）应看到实例上线。
+
+## 配置项
+
+| 字段 | 必填 | 说明 |
+|---|---|---|
+| `token` | ✔ | 中继接入 Token（`dsh_` 前缀，在 dshost.me 申请） |
+| `relayUrl` | ✔ | 中继 WebSocket 地址，生产必须 `wss://` |
+| `autoConnect` | ✕ | 默认 `true`；启动即连接 |
+| `dshHost` / `dshPort` | ✕ | 本机 dsh web 地址，默认 `127.0.0.1:3080` |
+
+## 兼容性
+
+| dsh 版本 | 支持 |
+|---|---|
+| `0.1.2-*`（含 `--trusted-host`、BrowserAuth、remote.mux） | ✔ |
+| `0.1.1-*` / `0.1.0-rc.7+`（insert 块 patch 格式） | ✔ |
+| `0.1.0-rc.2 ~ rc.6` / `0.0.1-rc.*` | ✔（旧包名 `@noeljude/dsh-remote-plugin` 亦可解析） |
+
+## 仓库结构
+
+```
+├── package.json         # npm 包定义（dsh.bundle.patch 指向 cordis.patch.yml）
+├── cordis.patch.yml     # bundle patch（有意为空：插件入口由用户 profile 声明）
+├── lib/index.js         # 插件入口（cordis apply）
+├── agent/core.js        # Agent 引擎（与独立 agent 共享的唯一源）
+├── common/protocol.js   # 中继协议
+└── scripts/prepack.mjs  # npm pack 时物化 lib/core.js + lib/protocol.js
+```
+
+`prepack.mjs` 是布局自适应的：在本 monorepo（源码位于 `src/agent`、`src/common`）与
+本仓库独立检出（`agent/`、`common/` 位于包根）下均可运行，支持
+`npm i github:NoelJudeNoel/dshost-plugin` 的 git 直装（经 `prepare` 构建）。
+
+## 发布流程
+
+npm 与 GitHub 同步发布：改动主仓源码 → bump `version` → `npm publish` →
+`bash scripts/publish-github.sh`（同步 GitHub、打 `vX.Y.Z` tag、刷新 topics）。
+完整标准规则见 [`docs/github-release-sop.md`](./docs/github-release-sop.md)。
+
+## License
+
+[MIT](./LICENSE) © 2026 dsh-remote contributors

package/lib/core.js

@@ -67,6 +67,20 @@ function getInstanceId() {
   return cachedInstanceId;
 }
 
+/**
+ * Effective instance id. DSH_INSTANCE_ID (env) overrides the derived id —
+ * used when a dedicated services agent coexists with the dsh-hosted plugin
+ * on the SAME machine: both derive the identical hostname+machine-id id,
+ * and the relay would treat them as one instance, evicting each other in a
+ * reconnect war. The override must be stable across restarts (it is the
+ * key sessions/tickets bind to).
+ */
+function getEffectiveInstanceId() {
+  const override = (process.env.DSH_INSTANCE_ID || '').trim();
+  if (override && /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(override)) return override;
+  return getInstanceId();
+}
+
 /**
  * Collect every real disk partition (df -kPT), not just the root filesystem.
  * Filters to physical filesystems (/dev/* or common on-disk types), excludes
@@ -105,14 +119,87 @@ function collectDisks() {
   return disks;
 }
 
+/**
+ * Locate the dsh runtime this agent actually serves and reports.
+ *
+ * dsh >= 0.1.2 installs are frequently built from a source checkout with
+ * /usr/bin/dsh symlinked into it (e.g. /root/dsh-src/apps/cli/lib/bin.js),
+ * which leaves the historical hardcoded npm-global package.json stale the
+ * moment the host upgrades — the dashboard then keeps showing the previous
+ * release's version forever. Resolution order:
+ *   1. DSH_VERSION env var (explicit pin / tests)
+ *   2. the CLI entry that started this process (the plugin runs inside
+ *      `dsh web`, so process.argv[1] IS the runtime, symlink included)
+ *   3. the first `dsh` executable on PATH (standalone agent / manual runs)
+ *   4. legacy npm global install path (dsh <= 0.1.1 behavior)
+ * Only a package.json of the dsh package itself is accepted while walking
+ * up, so an unrelated ancestor package (this repo's own package.json among
+ * them) can never be mistaken for the runtime.
+ * @returns {{version?: string, root?: string}}
+ */
+function findDshRuntime() {
+  if (process.env.DSH_VERSION) return { version: process.env.DSH_VERSION };
+  const entryPoints = [];
+  const pushEntry = (p) => { try { entryPoints.push(fs.realpathSync(p)); } catch {} };
+  if (process.argv[1]) pushEntry(process.argv[1]);
+  try {
+    for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+      if (!dir) continue;
+      const bin = path.join(dir, 'dsh');
+      let st = null;
+      try { st = fs.statSync(bin); } catch { continue; }
+      if (st.isFile()) { pushEntry(bin); break; }
+    }
+  } catch {}
+  for (const entry of entryPoints) {
+    let dir = path.dirname(entry);
+    for (let depth = 0; depth < 8; depth++) {
+      try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        const name = pkg.name || '';
+        if (pkg.version && (name === '@deepseek-ai/dsh' || name === 'dsh' || name.startsWith('@deepseek-ai/dsh'))) {
+          return { version: pkg.version, root: dir };
+        }
+      } catch {}
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  try {
+    const legacyRoot = '/usr/lib/node_modules/@deepseek-ai/dsh';
+    const pkg = JSON.parse(fs.readFileSync(path.join(legacyRoot, 'package.json'), 'utf8'));
+    if (pkg.version) return { version: pkg.version, root: legacyRoot };
+  } catch {}
+  return {};
+}
+
+/** Version of <name> as installed under <rootDir>/node_modules, or ''. */
+function pluginVersionAt(rootDir, name) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(rootDir, 'node_modules', name, 'package.json'), 'utf8')).version || '';
+  } catch { return ''; }
+}
+
 /** Automatically detect local DSH runtime metadata (version + installed profile plugins with exact versions) */
 function detectDshMetadata() {
-  let dshVersion = '0.1.0-rc.7';
+  const runtime = findDshRuntime();
+  const dshVersion = runtime.version || '0.1.0-rc.7';
+  // Where bundled dsh plugins may live: the runtime package itself plus the
+  // workspace roots above it (source-checkout / pnpm layouts hoist deps to
+  // the repo root), then the legacy npm global install.
+  const dshModuleRoots = [];
+  if (runtime.root) {
+    let dir = runtime.root;
+    for (let depth = 0; depth < 3; depth++) {
+      dshModuleRoots.push(dir);
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  }
+  dshModuleRoots.push('/usr/lib/node_modules/@deepseek-ai/dsh');
   let plugins = [];
-  try {
-    const pkg = JSON.parse(fs.readFileSync('/usr/lib/node_modules/@deepseek-ai/dsh/package.json', 'utf8'));
-    if (pkg.version) dshVersion = pkg.version;
-  } catch {}
   try {
     const profileDir = os.homedir() + '/.dsh/profiles/web';
     const profilePkgPath = profileDir + '/package.json';
@@ -129,12 +216,12 @@ function detectDshMetadata() {
           const p1 = profileDir + '/node_modules/' + name + '/package.json';
           if (fs.existsSync(p1)) ver = JSON.parse(fs.readFileSync(p1, 'utf8')).version || '';
         } catch {}
-        // 2. Check dsh embedded node_modules (for dsh bundles)
+        // 2. Check dsh runtime node_modules (npm global / source checkout)
         if (!ver) {
-          try {
-            const p2 = '/usr/lib/node_modules/@deepseek-ai/dsh/node_modules/' + name + '/package.json';
-            if (fs.existsSync(p2)) ver = JSON.parse(fs.readFileSync(p2, 'utf8')).version || '';
-          } catch {}
+          for (const root of dshModuleRoots) {
+            ver = pluginVersionAt(root, name);
+            if (ver) break;
+          }
         }
         // 3. Check global node_modules
         if (!ver) {
@@ -163,7 +250,7 @@ export function collectSystemInfo(defaultVersion) {
   const cpus = os.cpus();
   const meta = detectDshMetadata();
   return {
-    instanceId: getInstanceId(),
+    instanceId: getEffectiveInstanceId(),
     hostname: os.hostname(),
     platform: os.platform(),
     release: os.release(),
@@ -185,6 +272,77 @@ export function collectSystemInfo(defaultVersion) {
   };
 }
 
+// ── Plugin workspace services（config.services）───────────────────────
+// 实例在 cordis.patch.yml（插件配置）或 standalone agent 的 DSH_SERVICES env
+// JSON 中声明的本地/内网上游清单。relay 只能经本 agent 隧道触达这些上游。
+// 安全关键：上游白名单在此强制 —— 回环 + EasyTier mesh 10.144.144.0/24 +
+// AGENT_UPSTREAM_ALLOW 显式追加。被攻破的 relay 也无法借隧道横移到宿主者
+// 未声明的任意内网地址；仅接受字面 IP（localhost 归一为 127.0.0.1），
+// 不做 DNS 解析，杜绝 DNS rebinding 绕过白名单。
+const SVC_ID_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+
+function parseUpstream(raw) {
+  const m = /^(.+):(\d{1,5})$/.exec(String(raw || '').trim());
+  if (!m) return null;
+  const host = m[1].toLowerCase() === 'localhost' ? '127.0.0.1' : m[1];
+  const port = parseInt(m[2], 10);
+  if (!/^\d{1,3}(\.\d{1,3}){3}$|^[0-9a-f:]+$/i.test(host)) return null;
+  if (port < 1 || port > 65535) return null;
+  return { host, port };
+}
+
+function upstreamAllowed(host) {
+  if (host === '::1' || /^127\./.test(host)) return true;
+  if (/^10\.144\.144\./.test(host)) return true; // EasyTier wolo-mesh 网段
+  const extra = (process.env.AGENT_UPSTREAM_ALLOW || '').split(',').map((s) => s.trim()).filter(Boolean);
+  return extra.includes(host);
+}
+
+/**
+ * Normalize + validate the declared services list. Invalid entries are
+ * skipped with a warning, never thrown — one bad line must not take down
+ * the dsh remote tunnel.
+ * @returns {Array<{id,name,desc,icon,auth,entry,ssoSecret,host,port}>}
+ */
+export function normalizeServices(raw, log) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  const seen = new Set();
+  for (const s of raw) {
+    if (!s || typeof s !== 'object') continue;
+    const id = String(s.id || '').trim();
+    const up = parseUpstream(s.upstream);
+    if (!SVC_ID_RE.test(id) || id === 'dsh') {
+      log?.warn?.(`[agent] service "${id || '(unnamed)'}": invalid/reserved id, skipped`);
+      continue;
+    }
+    if (seen.has(id)) continue;
+    if (!up) {
+      log?.warn?.(`[agent] service "${id}": bad upstream "${s.upstream}" (want host:port), skipped`);
+      continue;
+    }
+    if (!upstreamAllowed(up.host)) {
+      log?.warn?.(`[agent] service "${id}": upstream ${up.host} not in allowlist (loopback / 10.144.144.0/24 / AGENT_UPSTREAM_ALLOW), skipped`);
+      continue;
+    }
+    seen.add(id);
+    out.push({
+      id,
+      name: String(s.name || id).slice(0, 64),
+      desc: String(s.desc || '').slice(0, 200),
+      icon: String(s.icon || '').slice(0, 32),
+      auth: s.auth === 'sso' ? 'sso' : 'open',
+      entry: typeof s.entry === 'string' && s.entry.startsWith('/') ? s.entry : '/',
+      ssoSecret: typeof s.ssoSecret === 'string' && s.ssoSecret ? s.ssoSecret : '',
+      basicUser: typeof s.basicUser === 'string' ? s.basicUser : '',
+      basicPassword: typeof s.basicPassword === 'string' ? s.basicPassword : '',
+      host: up.host,
+      port: up.port,
+    });
+  }
+  return out;
+}
+
 /**
  * Start the agent connection loop.
  * @param {object} opts
@@ -193,8 +351,10 @@ export function collectSystemInfo(defaultVersion) {
  * @param {string} [opts.version]    agent version reported at registration
  * @param {string} [opts.dshHost]    local dsh host (default 127.0.0.1)
  * @param {number} [opts.dshPort]    local dsh port (default 3080)
+ * @param {string} [opts.webToken]   local dsh web launch token (dsh >= 0.1.2 auth mode)
  * @param {object} [opts.log]        logger with log/warn/error (default console)
  * @param {string} [opts.dshVersion] reported dsh version (default rc.6)
+ * @param {Array}  [opts.services]   plugin workspace services (see normalizeServices)
  * @returns {{ stop: () => void }}
  */
 export function startAgent(opts) {
@@ -206,8 +366,16 @@ export function startAgent(opts) {
     dshPort = 3080,
     log = console,
     dshVersion,
+    services = [],
   } = opts;
 
+  const svcList = normalizeServices(services, log);
+  const svcMap = new Map(svcList.map((s) => [s.id, s]));
+  let relayUsername = null; // set on 'registered'; subject of SSO trust headers
+  if (svcList.length) {
+    log.log?.(`[agent] plugin services: ${svcList.map((s) => `${s.id}->${s.host}:${s.port}${s.auth === 'sso' ? ' (sso)' : ''}`).join(', ')}`);
+  }
+
   if (!token) {
     log.error?.('[agent] No token configured.');
     return { stop() {} };
@@ -217,6 +385,60 @@ export function startAgent(opts) {
     return { stop() {} };
   }
 
+  // ── Local web auth (dsh >= 0.1.2 one-time launch token → signed cookie) ──
+  // dsh 0.1.2 gates its web UI behind a per-process launch token: GET
+  // /?token=X mints a signed authority-bound browser cookie, everything else
+  // 401s. When the plugin runs inside the dsh host process it hands us the
+  // live token via setWebToken() (see plugin index.js ctx.inject hook);
+  // standalone agents can use DSH_WEB_TOKEN. With a token on file we mint a
+  // cookie once and inject it into proxied HTTP/WS requests; a 401 drops the
+  // cookie and re-mints (covers dsh restarts rotating the token). On
+  // dsh <= 0.1.1 there is no web auth: with no token source nothing is
+  // injected and behavior is identical to plugin 0.1.5 (ApiProxy era).
+  let webToken = opts.webToken || process.env.DSH_WEB_TOKEN || null;
+  let authCookie = null;
+  let minting = null;
+
+  function mintAuthCookie() {
+    if (minting) return minting;
+    if (!webToken) return Promise.resolve(null);
+    minting = new Promise((resolve) => {
+      const req = http.get(
+        `http://${dshHost}:${dshPort}/?token=${encodeURIComponent(webToken)}`,
+        { timeout: 5000 },
+        (res) => {
+          res.resume();
+          const set = res.headers['set-cookie'];
+          if (res.statusCode === 303 && Array.isArray(set) && set[0]) {
+            authCookie = set[0].split(';')[0];
+            log.log?.('[agent] local web auth cookie minted');
+            resolve(authCookie);
+          } else {
+            log.warn?.(`[agent] local web auth mint failed (HTTP ${res.statusCode})`);
+            resolve(null);
+          }
+        },
+      );
+      req.on('timeout', () => req.destroy(new Error('mint timeout')));
+      req.on('error', (err) => {
+        log.warn?.(`[agent] local web auth mint error: ${err.message}`);
+        resolve(null);
+      });
+    });
+    minting.then(() => { minting = null; }, () => { minting = null; });
+    return minting;
+  }
+
+  function setWebToken(token) {
+    if (!token || token === webToken) return;
+    webToken = token;
+    authCookie = null;
+    log.log?.('[agent] web launch token acquired (dsh 0.1.2 auth mode)');
+    mintAuthCookie();
+  }
+
+  if (webToken) mintAuthCookie();
+
   const streams = new Map();
   let registered = false;
   let reconnectTimer = null;
@@ -244,8 +466,14 @@ export function startAgent(opts) {
       if (msg.type === 'registered') {
         registered = true;
         reconnectAttempt = 0;
+        relayUsername = msg.username || null;
         log.log?.(`[agent] Registered as ${msg.username} (session ${msg.sessionId || ''})`);
         send(ws, { type: 'system-info', info: collectSystemInfo(dshVersion) });
+        // 插件工作区：上报本实例声明的服务清单（relay 存实例维度，供 /p 路由校验）
+        send(ws, {
+          type: 'services',
+          services: svcList.map(({ id, name, desc, icon, auth, entry }) => ({ id, name, desc, icon, auth, entry })),
+        });
         startHeartbeat(ws);
         return;
       }
@@ -253,7 +481,8 @@ export function startAgent(opts) {
       if (msg.type === 'heartbeat') return;
 
       if (msg.type === 'http:request') {
-        if (serveArtifactIfRequested(ws, msg)) return;
+        // [Artifact Viewer] 是 dsh UI 注入脚本的专属旁路；插件流不经过它。
+        if (!msg.target && serveArtifactIfRequested(ws, msg)) return;
         handleHttpRequest(ws, msg);
       } else if (msg.type === 'http:body') {
         const ab = artifactFormBodies.get(msg.streamId);
@@ -266,7 +495,13 @@ export function startAgent(opts) {
         const stream = streams.get(msg.streamId);
         if (stream && stream.dshReq) stream.dshReq.end();
       } else if (msg.type === 'ws:open') {
-        handleWsOpen(ws, msg);
+        // dsh >= 0.1.2: make sure the auth cookie exists before the upgrade
+        // （仅 dsh 目标需要本地 web auth cookie；插件上游不做 cookie 注入）。
+        if ((!msg.target || msg.target === 'dsh') && (webToken || authCookie) && !authCookie) {
+          mintAuthCookie().then(() => handleWsOpen(ws, msg));
+        } else {
+          handleWsOpen(ws, msg);
+        }
       } else if (msg.type === 'ws:frame') {
         const stream = streams.get(msg.streamId);
         if (stream && stream.dshWs) {
@@ -418,82 +653,200 @@ export function startAgent(opts) {
     return true;
   }
 
-  function handleHttpRequest(ws, msg) {
-    const { streamId, method, path, headers } = msg;
+  function respondError(ws, streamId, status, message) {
+    send(ws, {
+      type: 'http:response',
+      streamId,
+      status,
+      headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' },
+    });
+    send(ws, { type: 'http:data', streamId, data: b64(Buffer.from(message)) });
+    send(ws, { type: 'http:end-response', streamId });
+    streams.delete(streamId);
+  }
 
-    const dshHeaders = {
-      ...headers,
-      host: `${dshHost}:${dshPort}`,
-      origin: `http://${dshHost}:${dshPort}`,
-    };
-    delete dshHeaders['content-length'];
-
-    const dshReq = http.request({
-      hostname: dshHost,
-      port: dshPort,
-      path,
-      method,
-      headers: dshHeaders,
-    }, (dshRes) => {
-      send(ws, {
-        type: 'http:response',
-        streamId,
-        status: dshRes.statusCode,
-        headers: dshRes.headers,
-      });
+  /** Resolve msg.target to a dial target. null = plugin not declared. */
+  function resolveTarget(msg) {
+    const t = msg.target || 'dsh';
+    if (t === 'dsh') return { id: 'dsh', host: dshHost, port: dshPort, dsh: true, svc: null };
+    const svc = svcMap.get(t);
+    if (!svc) return null;
+    return { id: t, host: svc.host, port: svc.port, dsh: false, svc };
+  }
 
-      // Backpressure: pause reading from dsh when the relay link is slow.
-      // NOTE: the ws library does NOT emit 'drain' (verified), so resume is
-      // driven by polling bufferedAmount down below the high-water mark —
-      // a once('drain') here would never fire and would deadlock (truncated
-      // responses, hanging browsers).
-      dshRes.on('data', (chunk) => {
-        if (ws.bufferedAmount > WS_SEND_HIGH_WATER) {
-          dshRes.pause();
-          const resumeWhenDrained = () => {
-            if (ws.readyState !== WebSocket.OPEN) return;
-            if (ws.bufferedAmount < WS_SEND_HIGH_WATER / 2) {
-              dshRes.resume();
-            } else {
-              setTimeout(resumeWhenDrained, 50);
-            }
-          };
-          setTimeout(resumeWhenDrained, 50);
+  /** auth:'sso' 服务出站的信任头（M3：relay↔业务系统共享密钥的 HMAC 链）。 */
+  function ssoHeaders(svc) {
+    if (!svc || svc.auth !== 'sso' || !svc.ssoSecret || !relayUsername) return {};
+    const ts = Date.now().toString();
+    const sig = crypto.createHmac('sha256', svc.ssoSecret).update(`${relayUsername}.${ts}`).digest('hex');
+    return { 'x-sso-user': relayUsername, 'x-sso-ts': ts, 'x-sso-sig': sig };
+  }
+
+  /** auth:'open' 服务的上游 Basic 凭据注入（服务自身保留 Basic Auth 时的代填）。 */
+  function basicHeader(svc) {
+    if (!svc || svc.auth !== 'open' || !svc.basicPassword) return undefined;
+    return 'Basic ' + Buffer.from(`${svc.basicUser || 'user'}:${svc.basicPassword}`).toString('base64');
+  }
+
+  function handleHttpRequest(ws, msg, isRetry) {
+    const { streamId, method, path, headers } = msg;
+    const target = resolveTarget(msg);
+    if (!target) {
+      respondError(ws, streamId, 404, `dsh-remote: plugin "${msg.target}" is not declared on this instance`);
+      return;
+    }
+
+    // dsh >= 0.1.2 web auth: inject the minted browser cookie when we have
+    // one. dsh <= 0.1.1 has no web auth; with no token/cookie nothing is
+    // injected and requests go out exactly like plugin 0.1.5 sent them.
+    // 插件上游：不注入 dsh cookie，注入 SSO 信任头（若声明），剥除 Origin。
+    const issue = (cookie) => {
+      const upstreamHeaders = {
+        ...headers,
+        host: `${target.host}:${target.port}`,
+      };
+      if (target.dsh) {
+        upstreamHeaders.origin = `http://${target.host}:${target.port}`;
+        if (cookie) upstreamHeaders.cookie = cookie;
+      } else {
+        delete upstreamHeaders.origin;
+        // 插件上游不透传 dshost 站点 Cookie（dsh_session 等），业务自身的
+        // Bearer authorization 保留（relay 侧已放行）。
+        delete upstreamHeaders.cookie;
+        Object.assign(upstreamHeaders, ssoHeaders(target.svc));
+        const basic = basicHeader(target.svc);
+        if (basic) upstreamHeaders.authorization = basic;
+      }
+      delete upstreamHeaders['content-length'];
+
+      const dshReq = http.request({
+        hostname: target.host,
+        port: target.port,
+        path,
+        method,
+        headers: upstreamHeaders,
+      }, (dshRes) => {
+        if (target.dsh && dshRes.statusCode === 401 && cookie) {
+          // Cached cookie rejected (launch token rotated, e.g. dsh restarted).
+          // Re-mint; body-less requests are retried once with the fresh
+          // cookie, everything else forwards the 401 and the browser app
+          // retries its next action with the fresh cookie.
+          dshRes.resume();
+          authCookie = null;
+          const remint = mintAuthCookie();
+          if ((method === 'GET' || method === 'HEAD') && !isRetry) {
+            log.log?.('[agent] local dsh 401, re-minting web auth cookie and retrying');
+            remint.then((c) => {
+              if (c) handleHttpRequest(ws, msg, true);
+              else respondError(ws, streamId, 502, 'dsh-remote: local web auth re-mint failed');
+            });
+          } else {
+            log.log?.('[agent] local dsh 401 on body request, re-minting web auth cookie for next requests');
+          }
+          return;
         }
-        send(ws, { type: 'http:data', streamId, data: b64(chunk) });
-      });
-      dshRes.on('end', () => {
-        send(ws, { type: 'http:end-response', streamId });
-        streams.delete(streamId);
+        const respHeaders = { ...dshRes.headers };
+        // The dsh index carries no cache-control; a heuristically cached stale
+        // HTML from a previous build references dead module revs and breaks
+        // the client module system. HTML must always revalidate.
+        if (String(respHeaders['content-type'] || '').includes('text/html')) {
+          respHeaders['cache-control'] = 'no-store';
+        }
+        send(ws, {
+          type: 'http:response',
+          streamId,
+          status: dshRes.statusCode,
+          headers: respHeaders,
+        });
+
+        // Backpressure: pause reading from dsh when the relay link is slow.
+        // NOTE: the ws library does NOT emit 'drain' (verified), so resume is
+        // driven by polling bufferedAmount down below the high-water mark —
+        // a once('drain') here would never fire and would deadlock (truncated
+        // responses, hanging browsers).
+        dshRes.on('data', (chunk) => {
+          if (ws.bufferedAmount > WS_SEND_HIGH_WATER) {
+            dshRes.pause();
+            const resumeWhenDrained = () => {
+              if (ws.readyState !== WebSocket.OPEN) return;
+              if (ws.bufferedAmount < WS_SEND_HIGH_WATER / 2) {
+                dshRes.resume();
+              } else {
+                setTimeout(resumeWhenDrained, 50);
+              }
+            };
+            setTimeout(resumeWhenDrained, 50);
+          }
+          send(ws, { type: 'http:data', streamId, data: b64(chunk) });
+        });
+        dshRes.on('end', () => {
+          send(ws, { type: 'http:end-response', streamId });
+          streams.delete(streamId);
+        });
+        dshRes.on('error', () => {
+          send(ws, { type: 'error', streamId, message: `${target.dsh ? 'Local dsh' : `Plugin ${target.id}`} response error` });
+          streams.delete(streamId);
+        });
       });
-      dshRes.on('error', () => {
-        send(ws, { type: 'error', streamId, message: 'Local dsh response error' });
+
+      dshReq.on('error', (err) => {
+        log.error?.(`[agent] HTTP Error: ${err.message}`);
+        send(ws, { type: 'error', streamId, message: `${target.dsh ? 'local dsh' : `plugin ${target.id}`} upstream: ${err.message}` });
         streams.delete(streamId);
       });
-    });
 
-    dshReq.on('error', (err) => {
-      log.error?.(`[agent] HTTP Error: ${err.message}`);
-      send(ws, { type: 'error', streamId, message: err.message });
-      streams.delete(streamId);
-    });
+      streams.set(streamId, { dshReq, dshRes: null, chunks: [] });
 
-    streams.set(streamId, { dshReq, dshRes: null, chunks: [] });
+      // Body-less requests are complete the moment they are created: end them
+      // now so a 401-retry (whose http:end frame was already consumed by the
+      // first attempt) still transmits. The later http:end frame, when it
+      // arrives, calls dshReq.end() again — a safe no-op. Body-bearing
+      // requests keep waiting for http:body/http:end frames as before.
+      if (method === 'GET' || method === 'HEAD') dshReq.end();
+    };
+
+    if (!target.dsh) {
+      issue(undefined);
+    } else if ((webToken || authCookie) && !authCookie) {
+      // A token is known but the eager mint has not landed yet (startup
+      // race): mint first, then issue. Body frames arriving during the mint
+      // window are dropped (no streams entry yet) — only POSTs racing the
+      // very first mint are affected; the eager mint on token acquisition
+      // makes this path practically unreachable.
+      mintAuthCookie().then((c) => issue(c));
+    } else {
+      issue(authCookie || undefined);
+    }
   }
 
   function handleWsOpen(ws, msg) {
     const { streamId, path, headers } = msg;
-    const dshWsUrl = `ws://${dshHost}:${dshPort}${path || '/'}`;
-    log.log?.(`[agent] WS OPEN stream ${streamId} -> ${dshWsUrl}`);
+    const target = resolveTarget(msg);
+    if (!target) {
+      send(ws, { type: 'error', streamId, message: `dsh-remote: plugin "${msg.target}" is not declared on this instance` });
+      return;
+    }
+    const dshWsUrl = `ws://${target.host}:${target.port}${path || '/'}`;
+    log.log?.(`[agent] WS OPEN stream ${streamId} -> ${target.id}@${dshWsUrl}`);
 
     const options = {
       headers: {
         ...headers,
-        host: `${dshHost}:${dshPort}`,
-        origin: `https://${dshHost}:${dshPort}`,
+        host: `${target.host}:${target.port}`,
       },
       rejectUnauthorized: false,
     };
+    if (target.dsh) {
+      // dsh 信任栅栏要求 Origin 与本地 web 一致
+      options.headers.origin = `https://${target.host}:${target.port}`;
+      // dsh >= 0.1.2 gates the WS upgrade behind the same browser cookie.
+      if (authCookie) options.headers.cookie = authCookie;
+    } else {
+      delete options.headers.origin;
+      Object.assign(options.headers, ssoHeaders(target.svc));
+      const basic = basicHeader(target.svc);
+      if (basic) options.headers.authorization = basic;
+    }
 
     const dshWs = new WebSocket(dshWsUrl, undefined, options);
     const pending = [];
@@ -552,6 +905,8 @@ export function startAgent(opts) {
   connect();
 
   return {
+    /** Provide the local dsh web launch token (dsh >= 0.1.2 auth mode). */
+    setWebToken,
     stop() {
       if (heartbeatInterval) clearInterval(heartbeatInterval);
       if (reconnectTimer) clearTimeout(reconnectTimer);

package/lib/index.js

@@ -16,26 +16,58 @@ export function apply(ctx, config) {
   const relayUrl = config.relayUrl || process.env.DSH_RELAY_URL || 'wss://relay.example.com/agent';
   const autoConnect = config.autoConnect !== false;
   // Local dsh instance this plugin proxies (config-overridable for tests/dev)
-  const dshHost = config.dshHost || process.env.DSH_HOST || '127.0.0.1';
-  const dshPort = parseInt(config.dshPort || process.env.DSH_PORT || '3080', 10);
+  const dshHost = config.dshHost || process.env.DSH_HOST || DSH_HOST;
+  const dshPort = parseInt(config.dshPort || process.env.DSH_PORT || String(DSH_PORT), 10);
+  // 插件工作区服务清单（cordis.patch.yml 的 config.services 数组）
+  const services = Array.isArray(config.services) ? config.services : [];
 
   console.log('[dsh-remote] Plugin loaded, token:', token ? '***' : 'none');
+  if (services.length) console.log('[dsh-remote] Plugin services:', services.map((s) => s && s.id).filter(Boolean).join(', '));
 
   if (!token) {
     console.warn('[dsh-remote] No token configured. Please set token in settings.');
-    return;
+    return { setWebToken() {}, stop() {} };
   }
 
   if (!autoConnect) {
     console.log('[dsh-remote] Auto-connect disabled.');
-    return;
+    return { setWebToken() {}, stop() {} };
   }
 
   // Start the agent connection (wss enforcement lives in core.js)
-  startAgent({
+  const agent = startAgent({
     token,
     relayUrl,
     dshHost,
     dshPort,
+    services,
   });
+
+  // dsh >= 0.1.2 web auth: the web UI is gated behind a per-process one-time
+  // launch token (the @Remote gateway era replaced the plain ApiProxy surface
+  // and added BrowserAuth on the shared /api FetchHandler). Our agent runs
+  // inside the host process, so it asks the connection service for the
+  // authenticated URL and mints a browser cookie for all proxied traffic.
+  // dsh <= 0.1.1 has no 'connection' service: the guarded inject below never
+  // fires and the plugin keeps its 0.1.5 behavior — one build, both hosts.
+  try {
+    if (ctx && typeof ctx.inject === 'function') {
+      ctx.inject(['connection'], (connectionCtx) => {
+        try {
+          const conn = connectionCtx && connectionCtx.connection;
+          if (!conn || typeof conn.authenticatedUrl !== 'function') return;
+          const url = conn.authenticatedUrl(`http://${dshHost}:${dshPort}/`);
+          const webToken = new URL(url).searchParams.get('token');
+          if (webToken) agent.setWebToken(webToken);
+        } catch (err) {
+          console.warn('[dsh-remote] web launch token acquisition failed:', err && err.message);
+        }
+      });
+    }
+  } catch {
+    // Non-cordis ctx (smoke tests) or an older host without the service
+    // registry shape: legacy mode, no web auth injection.
+  }
+
+  return agent;
 }

package/lib/protocol.js

@@ -36,10 +36,10 @@ export function sanitizeCloseCode(code) {
 }
 
 // Relay -> Agent
-export const HTTP_REQUEST = 'http:request'; // { streamId, method, path, headers }
+export const HTTP_REQUEST = 'http:request'; // { streamId, method, path, headers, target? }
 export const HTTP_BODY = 'http:body';        // { streamId, data }
 export const HTTP_END = 'http:end';          // { streamId }
-export const WS_OPEN = 'ws:open';            // { streamId, path, headers }
+export const WS_OPEN = 'ws:open';            // { streamId, path, headers, target? }
 export const WS_FRAME = 'ws:frame';          // { streamId, data, binary }
 export const WS_CLOSE = 'ws:close';          // { streamId, code, reason }
 
@@ -53,3 +53,8 @@ export const ERROR = 'error';                 // { streamId?, message }
 export const REGISTER = 'register';    // Agent -> Relay: { token, version }
 export const REGISTERED = 'registered'; // Relay -> Agent: { username, sessionId }
 export const HEARTBEAT = 'heartbeat';  // { ts }
+
+// Agent -> Relay: advertise the plugin workspace services declared in this
+// instance's cordis config (config.services). Sent right after system-info.
+// { services: [{id, name, desc, icon, auth, mount, upstreamLabel}] }
+export const SERVICES = 'services';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dshost-plugin",
-  "version": "0.1.5",
+  "version": "0.1.9",
   "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",
   "type": "module",
   "main": "lib/index.js",
@@ -14,8 +14,27 @@
     "scripts"
   ],
   "scripts": {
-    "prepack": "node scripts/prepack.mjs"
+    "prepack": "node scripts/prepack.mjs",
+    "prepare": "node scripts/prepack.mjs"
   },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "cordis",
+    "deepseek-harness",
+    "remote-access",
+    "relay",
+    "websocket",
+    "tunnel"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NoelJudeNoel/dshost-plugin.git"
+  },
+  "bugs": {
+    "url": "https://github.com/NoelJudeNoel/dshost-plugin/issues"
+  },
+  "homepage": "https://dshost.me",
   "license": "MIT",
   "engines": {
     "node": ">=22.5.0"

package/scripts/prepack.mjs

@@ -14,8 +14,16 @@ const here = path.dirname(fileURLToPath(import.meta.url));
 const pkgRoot = path.resolve(here, '..');
 const repoRoot = path.resolve(pkgRoot, '..', '..');
 
-const coreSrc = path.join(repoRoot, 'src', 'agent', 'core.js');
-const protocolSrc = path.join(repoRoot, 'src', 'common', 'protocol.js');
+// Source resolution is layout-aware so one script serves both checkouts:
+//  · GitHub standalone repo (dshost-plugin): repo root == package root, with
+//    agent/core.js and common/protocol.js beside the package.
+//  · dshost monorepo (/root/dshost): sources live under src/.
+const coreSrc = fs.existsSync(path.join(pkgRoot, 'agent', 'core.js'))
+  ? path.join(pkgRoot, 'agent', 'core.js')
+  : path.join(repoRoot, 'src', 'agent', 'core.js');
+const protocolSrc = fs.existsSync(path.join(pkgRoot, 'common', 'protocol.js'))
+  ? path.join(pkgRoot, 'common', 'protocol.js')
+  : path.join(repoRoot, 'src', 'common', 'protocol.js');
 const coreDest = path.join(pkgRoot, 'lib', 'core.js');
 const protocolDest = path.join(pkgRoot, 'lib', 'protocol.js');