npm - rdsh-gateway - Versions diffs - 0.1.0 - Mend

rdsh-gateway 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/dist/index.d.ts +17 -0
package/dist/index.js +13 -0
package/dist/pair-page.d.ts +5 -0
package/dist/pair-page.js +84 -0
package/dist/pair.d.ts +20 -0
package/dist/pair.js +60 -0
package/dist/proxy.d.ts +26 -0
package/dist/proxy.js +150 -0
package/dist/secure-context-polyfill.d.ts +10 -0
package/dist/secure-context-polyfill.js +30 -0
package/dist/serve.d.ts +15 -0
package/dist/serve.js +69 -0
package/dist/server.d.ts +32 -0
package/dist/server.js +124 -0
package/dist/session.d.ts +26 -0
package/dist/session.js +121 -0
package/dist/spawn-dsh.d.ts +19 -0
package/dist/spawn-dsh.js +91 -0
package/package.json +32 -0

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+/**
+ * rdsh-gateway — host-side component. One process, two modes:
+ * - `serve` (MVP): LAN auth gateway in front of a spawned `dsh web`
+ * - `join` (M2): outbound tunnel endpoint connected to rdsh-hub
+ */
+export { serve } from "./serve.ts";
+export type { ServeOptions } from "./serve.ts";
+export { SessionManager, SESSION_COOKIE, sessionTokenFromCookie } from "./session.ts";
+export type { SessionPayload } from "./session.ts";
+export { PairManager } from "./pair.ts";
+export { startGateway } from "./server.ts";
+export type { GatewayOptions, RunningGateway } from "./server.ts";
+export { findDsh, spawnDsh } from "./spawn-dsh.ts";
+export type { SpawnedDsh } from "./spawn-dsh.ts";
+export { forwardHttp, createUpgradeProxy } from "./proxy.ts";
+export type { ProxyTarget } from "./proxy.ts";
+export declare const NAME = "rdsh-gateway";

package/dist/index.js ADDED Viewed

@@ -0,0 +1,13 @@
+/**
+ * rdsh-gateway — host-side component. One process, two modes:
+ * - `serve` (MVP): LAN auth gateway in front of a spawned `dsh web`
+ * - `join` (M2): outbound tunnel endpoint connected to rdsh-hub
+ */
+export { serve } from "./serve.js";
+export { SessionManager, SESSION_COOKIE, sessionTokenFromCookie } from "./session.js";
+export { PairManager } from "./pair.js";
+export { startGateway } from "./server.js";
+export { findDsh, spawnDsh } from "./spawn-dsh.js";
+export { forwardHttp, createUpgradeProxy } from "./proxy.js";
+export const NAME = "rdsh-gateway";
+//# sourceMappingURL=index.js.map

package/dist/pair-page.d.ts ADDED Viewed

@@ -0,0 +1,5 @@
+/**
+ * pair-page.ts — 配对页（内联纯 HTML/CSS/JS，零外部资源）。
+ * 文案引导用户在开发机终端查看配对码（物理信任锚点）。
+ */
+export declare function pairPageHtml(): string;

package/dist/pair-page.js ADDED Viewed

@@ -0,0 +1,84 @@
+/**
+ * pair-page.ts — 配对页（内联纯 HTML/CSS/JS，零外部资源）。
+ * 文案引导用户在开发机终端查看配对码（物理信任锚点）。
+ */
+export function pairPageHtml() {
+    return `<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>rdsh 配对</title>
+<style>
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; margin: 0; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    background: #0f172a; color: #e2e8f0; min-height: 100vh;
+    display: flex; align-items: center; justify-content: center; padding: 24px;
+  }
+  main { width: 100%; max-width: 360px; text-align: center; }
+  .logo { font-size: 40px; font-weight: 800; color: #38bdf8; letter-spacing: 1px; }
+  .hint { margin: 16px 0 24px; color: #94a3b8; font-size: 14px; line-height: 1.6; }
+  code { background: #1e293b; padding: 2px 6px; border-radius: 4px; color: #7dd3fc; }
+  input {
+    width: 100%; padding: 14px; font-size: 24px; text-align: center; letter-spacing: 8px;
+    background: #1e293b; color: #f1f5f9; border: 1px solid #334155; border-radius: 10px;
+    outline: none;
+  }
+  input:focus { border-color: #38bdf8; }
+  button {
+    width: 100%; margin-top: 12px; padding: 14px; font-size: 16px; font-weight: 600;
+    background: #0284c7; color: #fff; border: 0; border-radius: 10px; cursor: pointer;
+  }
+  button:disabled { opacity: .5; cursor: wait; }
+  .error { margin-top: 14px; color: #f87171; font-size: 14px; }
+</style>
+</head>
+<body>
+<main>
+  <div class="logo">rdsh</div>
+  <p class="hint">在<strong>开发机终端</strong>查看配对码（运行 <code>rdsh serve</code> 的窗口），输入后即可访问 DeepSeek Harness。</p>
+  <form id="pair-form">
+    <input id="code" inputmode="numeric" maxlength="6" autocomplete="one-time-code"
+           placeholder="6 位配对码" autofocus aria-label="配对码">
+    <button type="submit" id="submit">配对</button>
+  </form>
+  <p class="error" id="error" hidden></p>
+</main>
+<script>
+  const form = document.getElementById("pair-form");
+  const codeInput = document.getElementById("code");
+  const submit = document.getElementById("submit");
+  const error = document.getElementById("error");
+  form.addEventListener("submit", async (e) => {
+    e.preventDefault();
+    error.hidden = true;
+    submit.disabled = true;
+    try {
+      const res = await fetch("/pair", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code: codeInput.value.trim() }),
+      });
+      if (res.ok) { location.href = "/"; return; }
+      if (res.status === 429) {
+        const secs = Number(res.headers.get("Retry-After") || 600);
+        error.textContent = "尝试次数过多，请 " + Math.ceil(secs / 60) + " 分钟后再试";
+      } else {
+        error.textContent = "配对码错误，请重试";
+      }
+      error.hidden = false;
+    } catch {
+      error.textContent = "网络错误，请重试";
+      error.hidden = false;
+    } finally {
+      submit.disabled = false;
+      codeInput.select();
+    }
+  });
+</script>
+</body>
+</html>`;
+}
+//# sourceMappingURL=pair-page.js.map

package/dist/pair.d.ts ADDED Viewed

@@ -0,0 +1,20 @@
+export interface PairCheckResult {
+    ok: boolean;
+    /** 该 IP 当前是否处于锁定状态 */
+    locked: boolean;
+    /** 剩余锁定毫秒数（用于 429 Retry-After） */
+    retryAfterMs: number;
+}
+export declare class PairManager {
+    private readonly code;
+    private readonly locks;
+    constructor(code?: string);
+    /** 当前配对码（终端展示用）。 */
+    codeValue(): string;
+    /**
+     * 校验输入；成功清零该 IP 失败计数；失败累加并可能触发锁定。
+     */
+    check(input: string, ip: string): PairCheckResult;
+    /** 该 IP 剩余锁定毫秒（0 = 未锁定），供 429 Retry-After。 */
+    lockRemainingMs(ip: string): number;
+}

package/dist/pair.js ADDED Viewed

@@ -0,0 +1,60 @@
+/**
+ * pair.ts — 配对码生成/校验 + IP 维度限流。
+ *
+ * 安全要点：
+ * - 恒定时间比较：先 SHA-256 再 timingSafeEqual（规避长度侧信道）；
+ * - 限流：每 IP 5 次失败锁定 10 分钟（内存实现，进程生命周期有效）。
+ */
+import { createHash, randomInt, timingSafeEqual } from "node:crypto";
+const PAIR_DIGITS = 6;
+const MAX_FAILS = 5;
+const LOCK_MS = 10 * 60 * 1000;
+export class PairManager {
+    code;
+    locks = new Map();
+    constructor(code) {
+        this.code = code ?? generateCode();
+    }
+    /** 当前配对码（终端展示用）。 */
+    codeValue() {
+        return this.code;
+    }
+    /**
+     * 校验输入；成功清零该 IP 失败计数；失败累加并可能触发锁定。
+     */
+    check(input, ip) {
+        const now = Date.now();
+        const state = this.locks.get(ip) ?? { fails: 0, lockedUntil: 0 };
+        if (state.lockedUntil > now) {
+            return { ok: false, locked: true, retryAfterMs: state.lockedUntil - now };
+        }
+        if (constantEqual(input.trim(), this.code)) {
+            this.locks.delete(ip);
+            return { ok: true, locked: false, retryAfterMs: 0 };
+        }
+        state.fails += 1;
+        if (state.fails >= MAX_FAILS) {
+            state.fails = 0;
+            state.lockedUntil = now + LOCK_MS;
+        }
+        this.locks.set(ip, state);
+        return { ok: false, locked: state.lockedUntil > now, retryAfterMs: Math.max(0, state.lockedUntil - now) };
+    }
+    /** 该 IP 剩余锁定毫秒（0 = 未锁定），供 429 Retry-After。 */
+    lockRemainingMs(ip) {
+        const state = this.locks.get(ip);
+        if (!state)
+            return 0;
+        return Math.max(0, state.lockedUntil - Date.now());
+    }
+}
+/** 恒定时间字符串比较（长度差异也走相同路径：hash 后定长比较）。 */
+function constantEqual(a, b) {
+    const ha = createHash("sha256").update(a).digest();
+    const hb = createHash("sha256").update(b).digest();
+    return timingSafeEqual(ha, hb);
+}
+function generateCode() {
+    return String(randomInt(10 ** (PAIR_DIGITS - 1), 10 ** PAIR_DIGITS));
+}
+//# sourceMappingURL=pair.js.map

package/dist/proxy.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+export interface ProxyTarget {
+    host: string;
+    port: number;
+}
+export interface ForwardOptions {
+    /**
+     * 注入到 text/html 响应的 <head> 的脚本。
+     * 用途：http://局域网IP 非 secure context 下，浏览器不提供 crypto.randomUUID
+     * （DSH 浏览器侧 RPC 依赖它），用非 secure context 也可用的 getRandomValues polyfill。
+     */
+    htmlInject?: string;
+}
+/** 转发一个 HTTP 请求（含 SSE：响应流式写回，零缓冲）。 */
+export declare function forwardHttp(req: IncomingMessage, res: ServerResponse, target: ProxyTarget, opts?: ForwardOptions): void;
+/**
+ * WebSocket 转发：服务端完成客户端握手后，桥接客户端连接与上游 ws 客户端。
+ * - 服务端握手用 ws 的 noServer WebSocketServer（帧编码正确）；
+ * - handleUpgrade 成功后 ws 库会自动 emit 'connection'，这里不再手动 emit；
+ * - 客户端消息立即入队，upstream open 后按序发送（避免握手竞态丢消息）。
+ */
+export declare function createUpgradeProxy(target: ProxyTarget): {
+    /** 完成客户端 upgrade 握手并桥接（转发前必须已通过认证）。 */
+    handleUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer): void;
+};

package/dist/proxy.js ADDED Viewed

@@ -0,0 +1,150 @@
+/**
+ * proxy.ts — 转发内核：HTTP/SSE 流式转发 + WebSocket 双向桥接。
+ *
+ * 关键事实（discussion.md §2）：DSH 的 Host 围栏只信任 loopback/trusted Host，
+ * 因此**所有转发请求必须把 Host 重写为 127.0.0.1:<port>**，否则 /api 一律 403。
+ */
+import { request } from "node:http";
+import { WebSocket, WebSocketServer } from "ws";
+/** 转发一个 HTTP 请求（含 SSE：响应流式写回，零缓冲）。 */
+export function forwardHttp(req, res, target, opts) {
+    const headers = { ...req.headers };
+    headers.host = `${target.host}:${target.port}`;
+    // DSH 围栏（isTrustedApiRequest）要求 Origin.host === Host.host。
+    // 浏览器 Origin 是网关的 LAN 地址（如 http://192.168.x.x:8443），而 Host 已被
+    // 重写为 loopback —— 不一致会 403。改写 Origin 使其与 Host 一致；浏览器视角
+    // 请求仍是发往网关的同源请求，不影响 CORS。
+    if (headers.origin !== undefined) {
+        headers.origin = `http://${target.host}:${target.port}`;
+    }
+    const upstream = request({
+        host: target.host,
+        port: target.port,
+        path: req.url ?? "/",
+        method: req.method ?? "GET",
+        headers,
+    }, (upstreamRes) => {
+        const contentType = upstreamRes.headers["content-type"];
+        const canInject = opts?.htmlInject !== undefined &&
+            typeof contentType === "string" &&
+            contentType.includes("text/html") &&
+            upstreamRes.headers["content-encoding"] === undefined;
+        if (canInject) {
+            // 页面 HTML 很小（KB 级），缓冲注入后转发；其余流量仍走流式
+            void (async () => {
+                const chunks = [];
+                for await (const chunk of upstreamRes)
+                    chunks.push(chunk);
+                let html = Buffer.concat(chunks).toString("utf8");
+                const script = `<script>${opts.htmlInject}</script>`;
+                if (html.includes("</head>"))
+                    html = html.replace("</head>", `${script}</head>`);
+                else
+                    html = `${script}${html}`;
+                const outHeaders = { ...upstreamRes.headers };
+                outHeaders["content-length"] = String(Buffer.byteLength(html));
+                // 拷贝上游头时剔除 Node 自行管理的编码/连接头，避免与 content-length 冲突
+                delete outHeaders["transfer-encoding"];
+                delete outHeaders["content-encoding"];
+                delete outHeaders.connection;
+                res.writeHead(upstreamRes.statusCode ?? 200, outHeaders);
+                res.end(html);
+            })().catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(502, { "content-type": "text/plain" });
+                res.end("bad gateway");
+            });
+            return;
+        }
+        res.writeHead(upstreamRes.statusCode ?? 502, upstreamRes.headers);
+        upstreamRes.pipe(res);
+    });
+    upstream.on("error", () => {
+        if (!res.headersSent)
+            res.writeHead(502, { "content-type": "text/plain" });
+        res.end("bad gateway");
+    });
+    // 客户端断开 → 取消上游请求
+    res.on("close", () => upstream.destroy());
+    req.pipe(upstream);
+}
+/**
+ * WebSocket 转发：服务端完成客户端握手后，桥接客户端连接与上游 ws 客户端。
+ * - 服务端握手用 ws 的 noServer WebSocketServer（帧编码正确）；
+ * - handleUpgrade 成功后 ws 库会自动 emit 'connection'，这里不再手动 emit；
+ * - 客户端消息立即入队，upstream open 后按序发送（避免握手竞态丢消息）。
+ */
+export function createUpgradeProxy(target) {
+    const wss = new WebSocketServer({ noServer: true });
+    wss.on("connection", (clientWs, req) => {
+        const headers = { ...req.headers };
+        headers.host = `${target.host}:${target.port}`;
+        // 同 forwardHttp：改写 Origin 使其与重写后的 Host 一致，通过 DSH 围栏校验
+        if (headers.origin !== undefined) {
+            headers.origin = `http://${target.host}:${target.port}`;
+        }
+        const upstreamUrl = `ws://${target.host}:${target.port}${req.url ?? "/"}`;
+        const upstream = new WebSocket(upstreamUrl, { headers });
+        const queue = [];
+        clientWs.on("message", (data, isBinary) => {
+            const buf = Array.isArray(data)
+                ? Buffer.concat(data)
+                : Buffer.isBuffer(data)
+                    ? data
+                    : Buffer.from(data);
+            if (upstream.readyState === WebSocket.OPEN) {
+                upstream.send(buf, { binary: isBinary });
+            }
+            else {
+                queue.push({ data: buf, binary: isBinary });
+            }
+        });
+        upstream.on("open", () => {
+            for (const m of queue)
+                upstream.send(m.data, { binary: m.binary });
+            queue.length = 0;
+            // 上游 → 客户端
+            upstream.on("message", (data, isBinary) => {
+                if (clientWs.readyState === WebSocket.OPEN)
+                    clientWs.send(data, { binary: isBinary });
+            });
+            // 任一端断开 → 另一端强制销毁（优雅 close 会等对端回帧，可能悬挂）
+            const close = () => {
+                try {
+                    clientWs.terminate();
+                }
+                catch {
+                    /* 已关闭 */
+                }
+                try {
+                    upstream.terminate();
+                }
+                catch {
+                    /* 已关闭 */
+                }
+            };
+            clientWs.on("close", close);
+            upstream.on("close", close);
+            clientWs.on("error", close);
+            upstream.on("error", close);
+        });
+        upstream.on("error", () => {
+            try {
+                clientWs.terminate();
+            }
+            catch {
+                /* 已关闭 */
+            }
+        });
+    });
+    return {
+        /** 完成客户端 upgrade 握手并桥接（转发前必须已通过认证）。 */
+        handleUpgrade(req, socket, head) {
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                // handleUpgrade 不会自动 emit 'connection'，需手动触发桥接逻辑
+                wss.emit("connection", ws, req);
+            });
+        },
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/secure-context-polyfill.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+/**
+ * secure-context-polyfill.ts — 非 secure context 兼容脚本（注入 DSH 首页）。
+ *
+ * 背景（查档）：DSH 浏览器侧 RPC（dsh-client-connection/lib/client.js）用
+ * crypto.randomUUID() 生成 MessageId/RpcId；但该 API 仅在 secure context
+ * （HTTPS / localhost）可用。局域网模式为 http://<LAN-IP>（非 secure
+ * context），故需 polyfill：crypto.getRandomValues 是唯一非 secure context
+ * 也可用的 WebCrypto API，用它实现 UUID v4。
+ */
+export declare const SECURE_CONTEXT_POLYFILL = "(function () {\n  if (typeof crypto === \"undefined\") return;\n  if (typeof crypto.randomUUID === \"function\") return;\n  try {\n    Object.defineProperty(crypto, \"randomUUID\", {\n      value: function () {\n        var b = crypto.getRandomValues(new Uint8Array(16));\n        b[6] = (b[6] & 0x0f) | 0x40;\n        b[8] = (b[8] & 0x3f) | 0x80;\n        var h = \"\";\n        for (var i = 0; i < 16; i++) {\n          if (i === 4 || i === 6 || i === 8 || i === 10) h += \"-\";\n          h += b[i].toString(16).padStart(2, \"0\");\n        }\n        return h;\n      },\n      writable: true\n    });\n  } catch (e) { /* ignore */ }\n})();";

package/dist/secure-context-polyfill.js ADDED Viewed

@@ -0,0 +1,30 @@
+/**
+ * secure-context-polyfill.ts — 非 secure context 兼容脚本（注入 DSH 首页）。
+ *
+ * 背景（查档）：DSH 浏览器侧 RPC（dsh-client-connection/lib/client.js）用
+ * crypto.randomUUID() 生成 MessageId/RpcId；但该 API 仅在 secure context
+ * （HTTPS / localhost）可用。局域网模式为 http://<LAN-IP>（非 secure
+ * context），故需 polyfill：crypto.getRandomValues 是唯一非 secure context
+ * 也可用的 WebCrypto API，用它实现 UUID v4。
+ */
+export const SECURE_CONTEXT_POLYFILL = `(function () {
+  if (typeof crypto === "undefined") return;
+  if (typeof crypto.randomUUID === "function") return;
+  try {
+    Object.defineProperty(crypto, "randomUUID", {
+      value: function () {
+        var b = crypto.getRandomValues(new Uint8Array(16));
+        b[6] = (b[6] & 0x0f) | 0x40;
+        b[8] = (b[8] & 0x3f) | 0x80;
+        var h = "";
+        for (var i = 0; i < 16; i++) {
+          if (i === 4 || i === 6 || i === 8 || i === 10) h += "-";
+          h += b[i].toString(16).padStart(2, "0");
+        }
+        return h;
+      },
+      writable: true
+    });
+  } catch (e) { /* ignore */ }
+})();`;
+//# sourceMappingURL=secure-context-polyfill.js.map

package/dist/serve.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+export interface ServeOptions {
+    host: string;
+    port: number;
+    pairCode?: string;
+    sessionTtlSeconds: number;
+    dshPath?: string;
+    reset?: boolean;
+    /** true = 跳过配对码认证（仅限完全可信网络！打印警告） */
+    noCode?: boolean;
+}
+/**
+ * 启动 LAN 认证网关。进程常驻：SIGINT/SIGTERM 时先关网关再终止 dsh 子进程。
+ * 启动失败（dsh 缺失/启动失败/端口占用）→ 抛错（CLI 负责以非零码退出）。
+ */
+export declare function serve(opts: ServeOptions): Promise<void>;

package/dist/serve.js ADDED Viewed

@@ -0,0 +1,69 @@
+/**
+ * serve.ts — `rdsh serve` 编排：spawn dsh → 启动网关 → 打印启动信息 → 生命周期。
+ */
+import { networkInterfaces } from "node:os";
+import { startGateway } from "./server.js";
+import { findDsh, spawnDsh } from "./spawn-dsh.js";
+/**
+ * 启动 LAN 认证网关。进程常驻：SIGINT/SIGTERM 时先关网关再终止 dsh 子进程。
+ * 启动失败（dsh 缺失/启动失败/端口占用）→ 抛错（CLI 负责以非零码退出）。
+ */
+export async function serve(opts) {
+    const dshPath = findDsh(opts.dshPath);
+    if (dshPath === null) {
+        throw new Error("cannot find 'dsh' in PATH. Install DeepSeek Harness first, or pass --dsh <path>.");
+    }
+    const dsh = await spawnDsh(dshPath);
+    if (opts.noCode) {
+        console.warn("\n⚠  rdsh: --no-code 已启用 —— 跳过配对码认证！\n" +
+            "     任何能访问该端口的设备都将直接操作 DSH（可执行任意命令）。\n" +
+            "     仅限完全可信的局域网（家庭/公司内网）使用！\n");
+    }
+    const gateway = await startGateway({
+        host: opts.host,
+        port: opts.port,
+        pairCode: opts.pairCode,
+        sessionTtlSeconds: opts.sessionTtlSeconds,
+        dshPort: dsh.port,
+        reset: opts.reset,
+        noCode: opts.noCode,
+    });
+    const lan = lanAddresses();
+    const displayHost = opts.host === "0.0.0.0" ? (lan[0] ?? "127.0.0.1") : opts.host;
+    console.log(`rdsh serve: gateway on http://${displayHost}:${gateway.actualPort}`);
+    if (opts.host === "0.0.0.0" && lan.length > 0) {
+        console.log(`rdsh serve: LAN: ${lan.map((ip) => `http://${ip}:${gateway.actualPort}`).join(", ")}`);
+    }
+    console.log(`rdsh serve: dsh web on 127.0.0.1:${dsh.port}`);
+    console.log(`rdsh serve: pair code: ${gateway.pair.codeValue()}`);
+    console.log("rdsh serve: enter the pair code in the browser on your other device.");
+    let shuttingDown = false;
+    const shutdown = async (signal) => {
+        if (shuttingDown)
+            return; // 幂等：重复信号不再处理
+        shuttingDown = true;
+        console.log(`\nrdsh: received ${signal}, shutting down...`);
+        // 停止接受新连接；残留活跃连接由进程退出时由 OS 清理
+        gateway.server.close();
+        let code;
+        try {
+            code = await dsh.stop();
+        }
+        catch {
+            code = 1;
+        }
+        // 必须显式退出：仅设 exitCode 会因残留句柄（信号监听器/管道）而挂住
+        process.exit(code === 0 ? 0 : 1);
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    // 覆盖默认行为：SIGHUP（关终端/断 SSH）也优雅清理，避免 dsh 子进程成为孤儿
+    process.on("SIGHUP", () => void shutdown("SIGHUP"));
+}
+function lanAddresses() {
+    return Object.values(networkInterfaces())
+        .flat()
+        .filter((i) => i !== undefined && i.family === "IPv4" && !i.internal)
+        .map((i) => i.address);
+}
+//# sourceMappingURL=serve.js.map

package/dist/server.d.ts ADDED Viewed

@@ -0,0 +1,32 @@
+/**
+ * server.ts — HTTP 服务器 + 认证中间件 + 路由。
+ *
+ * 路由：
+ *   GET  /pair        → 配对页
+ *   POST /pair        → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair
+ */
+import { createServer } from "node:http";
+import { SessionManager } from "./session.ts";
+import { PairManager } from "./pair.ts";
+export interface GatewayOptions {
+    host: string;
+    port: number;
+    pairCode?: string;
+    sessionTtlSeconds: number;
+    dshPort: number;
+    /** true = 启动时重置会话密钥（全部会话失效） */
+    reset?: boolean;
+    /** 会话密钥目录（默认 ~/.rdsh；测试可注入临时目录） */
+    keyDir?: string;
+    /** true = 跳过配对码认证（仅限完全可信网络！启动会打印警告） */
+    noCode?: boolean;
+}
+export interface RunningGateway {
+    server: ReturnType<typeof createServer>;
+    sessions: SessionManager;
+    pair: PairManager;
+    /** 实际监听端口（port 0 → OS 分配） */
+    actualPort: number;
+}
+export declare function startGateway(opts: GatewayOptions): Promise<RunningGateway>;

package/dist/server.js ADDED Viewed

@@ -0,0 +1,124 @@
+/**
+ * server.ts — HTTP 服务器 + 认证中间件 + 路由。
+ *
+ * 路由：
+ *   GET  /pair        → 配对页
+ *   POST /pair        → 校验配对码（成功 Set-Cookie + 302 /；失败 401/429）
+ *   其余路径（含 upgrade）→ 有有效会话转发 dsh；无 → 307 /pair
+ */
+import { createServer } from "node:http";
+import { SessionManager, sessionTokenFromCookie } from "./session.js";
+import { PairManager } from "./pair.js";
+import { createUpgradeProxy, forwardHttp } from "./proxy.js";
+import { pairPageHtml } from "./pair-page.js";
+import { SECURE_CONTEXT_POLYFILL } from "./secure-context-polyfill.js";
+export async function startGateway(opts) {
+    const sessions = new SessionManager(opts.keyDir);
+    if (opts.reset) {
+        await sessions.reset();
+    }
+    else {
+        await sessions.init();
+    }
+    const pair = new PairManager(opts.pairCode);
+    const target = { host: "127.0.0.1", port: opts.dshPort };
+    const upgradeProxy = createUpgradeProxy(target);
+    const ctx = {
+        sessions,
+        pair,
+        target,
+        sessionTtlSeconds: opts.sessionTtlSeconds,
+        noCode: opts.noCode === true,
+    };
+    const server = createServer((req, res) => {
+        void handleHttp(req, res, ctx).catch(() => {
+            if (!res.headersSent)
+                res.writeHead(500);
+            res.end();
+        });
+    });
+    server.on("upgrade", (req, socket, head) => {
+        if (!ctx.noCode && !hasValidSession(req, sessions)) {
+            socket.write("HTTP/1.1 307 Temporary Redirect\r\nLocation: /pair\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        upgradeProxy.handleUpgrade(req, socket, head);
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(opts.port, opts.host, () => resolve());
+    });
+    const address = server.address();
+    const actualPort = typeof address === "object" && address !== null ? address.port : opts.port;
+    return { server, sessions, pair, actualPort };
+}
+function hasValidSession(req, sessions) {
+    const token = sessionTokenFromCookie(req.headers.cookie);
+    return token !== null && sessions.verify(token) !== null;
+}
+async function handleHttp(req, res, ctx) {
+    const pathname = new URL(req.url ?? "/", "http://rdsh.local").pathname;
+    if (req.method === "GET" && pathname === "/pair") {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end(pairPageHtml());
+        return;
+    }
+    if (req.method === "POST" && pathname === "/pair") {
+        await handlePairPost(req, res, ctx);
+        return;
+    }
+    if (!ctx.noCode && !hasValidSession(req, ctx.sessions)) {
+        res.writeHead(307, { location: "/pair" });
+        res.end();
+        return;
+    }
+    forwardHttp(req, res, ctx.target, { htmlInject: SECURE_CONTEXT_POLYFILL });
+}
+async function handlePairPost(req, res, ctx) {
+    const ip = req.socket.remoteAddress ?? "unknown";
+    let body = "";
+    for await (const chunk of req) {
+        body += chunk;
+        if (body.length > 1024) {
+            res.writeHead(413, { "content-type": "application/json" });
+            res.end(JSON.stringify({ error: { code: "TOO_LARGE", message: "body too large" } }));
+            return;
+        }
+    }
+    let code;
+    try {
+        code = JSON.parse(body).code;
+    }
+    catch {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid body" } }));
+        return;
+    }
+    if (typeof code !== "string" || code.length > 16) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: { code: "BAD_REQUEST", message: "invalid code" } }));
+        return;
+    }
+    const result = ctx.pair.check(code, ip);
+    if (result.ok) {
+        res.writeHead(302, {
+            location: "/",
+            "set-cookie": ctx.sessions.cookieHeader(ctx.sessionTtlSeconds),
+        });
+        res.end();
+        return;
+    }
+    if (result.locked) {
+        const retryAfter = Math.max(1, Math.ceil(result.retryAfterMs / 1000));
+        res.writeHead(429, {
+            "content-type": "application/json",
+            "retry-after": String(retryAfter),
+        });
+        res.end(JSON.stringify({ error: { code: "RATE_LIMITED", message: "too many attempts" } }));
+        return;
+    }
+    res.writeHead(401, { "content-type": "application/json" });
+    res.end(JSON.stringify({ error: { code: "BAD_CODE", message: "invalid pair code" } }));
+}
+//# sourceMappingURL=server.js.map

package/dist/session.d.ts ADDED Viewed

@@ -0,0 +1,26 @@
+export declare const SESSION_COOKIE = "rdsh_session";
+export interface SessionPayload {
+    sid: string;
+    /** 过期时刻（epoch 秒） */
+    exp: number;
+}
+export declare class SessionManager {
+    private key;
+    private readonly dir;
+    /** @param dir 密钥目录（默认 ~/.rdsh；测试可注入临时目录） */
+    constructor(dir?: string);
+    private get keyFile();
+    /** 加载或创建密钥；必须在 sign/verify 前调用。 */
+    init(): Promise<void>;
+    /** 删除密钥并重建 —— 全部已签发会话立即失效。 */
+    reset(): Promise<void>;
+    /** 签发一个有效期 ttlSeconds 的会话 token。 */
+    sign(ttlSeconds: number): string;
+    /** 校验 token；无效/过期/被篡改 → null。 */
+    verify(token: string): SessionPayload | null;
+    /** 生成 Set-Cookie 头（HttpOnly + SameSite=Lax）。 */
+    cookieHeader(ttlSeconds: number): string;
+    private requireKey;
+}
+/** 从请求 Cookie 头解析出会话 token（无 → null）。 */
+export declare function sessionTokenFromCookie(cookieHeader: string | undefined): string | null;

package/dist/session.js ADDED Viewed

@@ -0,0 +1,121 @@
+/**
+ * session.ts — 会话密钥管理 + 签名 Cookie。
+ *
+ * 会话为无状态签名 Cookie：HMAC-SHA256(payload, key)。
+ * 密钥存 ~/.rdsh/secret.key（0600，首次生成）；reset() 删除重建（全部会话失效）。
+ */
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+const RDSH_DIR = join(homedir(), ".rdsh");
+const KEY_BYTES = 32;
+export const SESSION_COOKIE = "rdsh_session";
+/** 兜底上限：防伪造"未来过期时间"的 token 长存。 */
+const MAX_EXP_FUTURE_SECONDS = 365 * 24 * 3600;
+export class SessionManager {
+    key = null;
+    dir;
+    /** @param dir 密钥目录（默认 ~/.rdsh；测试可注入临时目录） */
+    constructor(dir) {
+        this.dir = dir ?? RDSH_DIR;
+    }
+    get keyFile() {
+        return join(this.dir, "secret.key");
+    }
+    /** 加载或创建密钥；必须在 sign/verify 前调用。 */
+    async init() {
+        this.key = await loadOrCreateKey(this.keyFile);
+    }
+    /** 删除密钥并重建 —— 全部已签发会话立即失效。 */
+    async reset() {
+        this.key = null;
+        await rm(this.keyFile, { force: true });
+        this.key = await loadOrCreateKey(this.keyFile);
+    }
+    /** 签发一个有效期 ttlSeconds 的会话 token。 */
+    sign(ttlSeconds) {
+        const key = this.requireKey();
+        const payload = {
+            sid: randomUUID(),
+            exp: Math.floor(Date.now() / 1000) + ttlSeconds,
+        };
+        const body = Buffer.from(JSON.stringify(payload));
+        const mac = createHmac("sha256", key).update(body).digest("base64url");
+        return `${mac}.${body.toString("base64url")}`;
+    }
+    /** 校验 token；无效/过期/被篡改 → null。 */
+    verify(token) {
+        const key = this.requireKey();
+        const dot = token.indexOf(".");
+        if (dot <= 0)
+            return null;
+        const mac = token.slice(0, dot);
+        const body = token.slice(dot + 1);
+        let bodyBytes;
+        try {
+            bodyBytes = Buffer.from(body, "base64url");
+        }
+        catch {
+            return null;
+        }
+        const expected = createHmac("sha256", key).update(bodyBytes).digest("base64url");
+        if (!safeEqual(mac, expected))
+            return null;
+        try {
+            const payload = JSON.parse(bodyBytes.toString("utf8"));
+            if (typeof payload.sid !== "string" || typeof payload.exp !== "number")
+                return null;
+            const now = Math.floor(Date.now() / 1000);
+            if (payload.exp <= now)
+                return null;
+            if (payload.exp > now + MAX_EXP_FUTURE_SECONDS)
+                return null;
+            return payload;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** 生成 Set-Cookie 头（HttpOnly + SameSite=Lax）。 */
+    cookieHeader(ttlSeconds) {
+        const token = this.sign(ttlSeconds);
+        return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${ttlSeconds}`;
+    }
+    requireKey() {
+        if (this.key === null)
+            throw new Error("SessionManager.init() must be called before sign/verify");
+        return this.key;
+    }
+}
+/** 从请求 Cookie 头解析出会话 token（无 → null）。 */
+export function sessionTokenFromCookie(cookieHeader) {
+    if (!cookieHeader)
+        return null;
+    for (const part of cookieHeader.split(";")) {
+        const [name, ...rest] = part.trim().split("=");
+        if (name === SESSION_COOKIE)
+            return rest.join("=");
+    }
+    return null;
+}
+function safeEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+async function loadOrCreateKey(keyFile) {
+    try {
+        await access(keyFile);
+        return await readFile(keyFile);
+    }
+    catch {
+        await mkdir(dirname(keyFile), { recursive: true, mode: 0o700 });
+        const key = randomBytes(KEY_BYTES);
+        await writeFile(keyFile, key, { mode: 0o600 });
+        return key;
+    }
+}
+//# sourceMappingURL=session.js.map

package/dist/spawn-dsh.d.ts ADDED Viewed

@@ -0,0 +1,19 @@
+import type { ChildProcess } from "node:child_process";
+export interface SpawnedDsh {
+    /** dsh 实际监听端口（OS 分配） */
+    port: number;
+    child: ChildProcess;
+    /** 终止 dsh（SIGTERM，超时 SIGKILL），返回退出码 */
+    stop(): Promise<number>;
+}
+/**
+ * 在 PATH 中查找 dsh 可执行文件；`override` 直接使用。
+ * 找不到返回 null。
+ */
+export declare function findDsh(override?: string): string | null;
+/**
+ * spawn `dsh web --port 0 --no-open` 并等待其报告监听端口。
+ * 就绪后把 dsh 的 stdout/stderr 透传到本进程。
+ * dsh 启动失败/超时 → reject。
+ */
+export declare function spawnDsh(dshPath: string): Promise<SpawnedDsh>;

package/dist/spawn-dsh.js ADDED Viewed

@@ -0,0 +1,91 @@
+/**
+ * spawn-dsh.ts — 发现并启动 dsh web，解析其实际监听端口。
+ *
+ * 事实依据（discussion.md §2）：`dsh web --port 0 --no-open` 由 OS 分配端口，
+ * 启动时打印 `dsh web: http://127.0.0.1:<port>`（dsh-web-app/lib/index.js）。
+ */
+import { spawn } from "node:child_process";
+import { accessSync } from "node:fs";
+import { createInterface } from "node:readline";
+/** dsh 的 URL 行格式（`dsh web: http://127.0.0.1:<port> (LAN: ...)`）。 */
+const URL_LINE_RE = /dsh web:\s*http:\/\/127\.0\.0\.1:(\d+)/;
+const READY_TIMEOUT_MS = 30_000;
+const STOP_TIMEOUT_MS = 5_000;
+/**
+ * 在 PATH 中查找 dsh 可执行文件；`override` 直接使用。
+ * 找不到返回 null。
+ */
+export function findDsh(override) {
+    if (override)
+        return override;
+    const path = process.env.PATH ?? "";
+    for (const dir of path.split(":")) {
+        if (!dir)
+            continue;
+        for (const name of ["dsh", "dsh.cmd", "dsh.exe"]) {
+            const candidate = `${dir}/${name}`;
+            try {
+                accessSync(candidate);
+                return candidate;
+            }
+            catch {
+                /* 继续找下一个 */
+            }
+        }
+    }
+    return null;
+}
+/**
+ * spawn `dsh web --port 0 --no-open` 并等待其报告监听端口。
+ * 就绪后把 dsh 的 stdout/stderr 透传到本进程。
+ * dsh 启动失败/超时 → reject。
+ */
+export function spawnDsh(dshPath) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(dshPath, ["web", "--port", "0", "--no-open"], {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stderrBuf = "";
+        const timeout = setTimeout(() => {
+            child.kill("SIGKILL");
+            reject(new Error(`dsh did not report a listening port within ${READY_TIMEOUT_MS}ms: ${stderrBuf.slice(0, 200)}`));
+        }, READY_TIMEOUT_MS);
+        const rl = createInterface({ input: child.stdout ?? undefined });
+        rl.on("line", (line) => {
+            const m = URL_LINE_RE.exec(line);
+            if (m) {
+                clearTimeout(timeout);
+                // 就绪：后续 dsh 输出全部透传
+                child.stdout?.pipe(process.stdout);
+                child.stderr?.pipe(process.stderr);
+                resolve({ port: Number(m[1]), child, stop: () => stopDsh(child) });
+            }
+            else {
+                process.stdout.write(`${line}\n`);
+            }
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderrBuf += chunk.toString("utf8");
+        });
+        child.on("error", (err) => {
+            clearTimeout(timeout);
+            reject(new Error(`failed to launch dsh: ${err.message}`));
+        });
+        child.on("exit", (code) => {
+            clearTimeout(timeout);
+            reject(new Error(`dsh exited before reporting a port (code ${code ?? "?"})`));
+        });
+    });
+}
+function stopDsh(child) {
+    return new Promise((resolve) => {
+        if (child.exitCode !== null) {
+            resolve(child.exitCode);
+            return;
+        }
+        child.once("exit", (code) => resolve(code ?? 0));
+        child.kill("SIGTERM");
+        setTimeout(() => child.kill("SIGKILL"), STOP_TIMEOUT_MS).unref();
+    });
+}
+//# sourceMappingURL=spawn-dsh.js.map

package/package.json ADDED Viewed

@@ -0,0 +1,32 @@
+{
+  "name": "rdsh-gateway",
+  "version": "0.1.0",
+  "description": "rdsh host-side component: LAN auth gateway + outbound tunnel endpoint (spawns dsh web)",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.map"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.5.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test test/"
+  }
+}