rdsh-gateway 0.11.1 → 0.11.3

package/dist/direct.js

@@ -29,6 +29,9 @@ export async function startDirect(opts) {
         actualPort,
         candidates: () => lanCandidates(actualPort),
         stop: async () => {
+            // 先强制断开所有连接（含 keep-alive）：否则有活跃连接时 server.close() 的回调
+            // 永不触发，面板「断开」的 RPC 会一直挂住、按钮卡在 loading。
+            gateway.server.closeAllConnections();
             await new Promise((resolve) => gateway.server.close(() => resolve()));
             gateway.dispose();
         },

package/dist/index.d.ts

@@ -23,13 +23,14 @@ export { loginPageHtml } from "./login-page.ts";
 export { installService, uninstallService, serviceStatus, startService, stopService, restartService, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.ts";
 export type { ServiceSpec } from "./service.ts";
 export declare const NAME = "rdsh-gateway";
-export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.ts";
+export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs, hubRequest } from "./join.ts";
 export type { JoinOptions, RegisterOutcome, JoinState, JoinHooks, StartJoinOptions, JoinHandle } from "./join.ts";
 export { startDirect, lanCandidates, isPrivateIpv4 } from "./direct.ts";
 export type { DirectOptions, DirectHandle } from "./direct.ts";
 export { createDirectTicketManager } from "./direct-ticket.ts";
 export type { DirectTicketManager } from "./direct-ticket.ts";
 export { loadOrCreateDirectSecret, directSecretPath } from "./direct-secret.ts";
-export { readPersistedToken, clearPersistedToken } from "./token-store.ts";
+export { readPersistedToken, persistToken, clearPersistedToken } from "./token-store.ts";
 export { acquireJoinLock, releaseJoinLock, readJoinLock, JOIN_LOCK_PATH } from "./lock.ts";
 export type { JoinLock, JoinLockRole } from "./lock.ts";
+export { loadOrCreateE2eeKeyPair, e2eeKeyFilePath } from "./e2ee-key-store.ts";

package/dist/index.js

@@ -15,10 +15,11 @@ export { loadTls } from "./tls.js";
 export { loginPageHtml } from "./login-page.js";
 export { installService, uninstallService, serviceStatus, startService, stopService, restartService, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.js";
 export const NAME = "rdsh-gateway";
-export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.js";
+export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs, hubRequest } from "./join.js";
 export { startDirect, lanCandidates, isPrivateIpv4 } from "./direct.js";
 export { createDirectTicketManager } from "./direct-ticket.js";
 export { loadOrCreateDirectSecret, directSecretPath } from "./direct-secret.js";
-export { readPersistedToken, clearPersistedToken } from "./token-store.js";
+export { readPersistedToken, persistToken, clearPersistedToken } from "./token-store.js";
 export { acquireJoinLock, releaseJoinLock, readJoinLock, JOIN_LOCK_PATH } from "./lock.js";
+export { loadOrCreateE2eeKeyPair, e2eeKeyFilePath } from "./e2ee-key-store.js";
 //# sourceMappingURL=index.js.map

package/dist/join.d.ts

@@ -111,6 +111,16 @@ export interface JoinHandle {
 }
 /** 探测 hub 是否需 insecure：以严格校验握手一次；证书错误 → true（需 insecure）。 */
 export declare function detectInsecure(hubUrl: string): Promise<boolean>;
+/** hub HTTP 调用（node:https 支持自签跳过校验 —— undici fetch 不受 NODE_TLS_REJECT_UNAUTHORIZED 影响）。 */
+export declare function hubRequest(baseUrl: string, path: string, opts: {
+    method: string;
+    insecure: boolean;
+    body?: unknown;
+}): Promise<{
+    ok: boolean;
+    status: number;
+    body: Record<string, unknown>;
+}>;
 /** 调用 hub self-revoke 注销本机（host 持自己的 host token）。`rdsh host leave` 使用。 */
 export declare function selfRevoke(hubUrl: string, token: string, insecure: boolean): Promise<void>;
 /** 解析 host token（--token 注册 > 持久化复用）+ 自动检测证书；供 CLI 配置命令与 join() 复用。 */

package/dist/join.js

@@ -64,7 +64,7 @@ const PONG_TIMEOUT_MS = 10_000;
 const RECONNECT_BASE_MS = 1_000;
 const RECONNECT_MAX_MS = 60_000;
 /** hub HTTP 调用（node:https 支持自签跳过校验 —— undici fetch 不受 NODE_TLS_REJECT_UNAUTHORIZED 影响）。 */
-function hubRequest(baseUrl, path, opts) {
+export function hubRequest(baseUrl, path, opts) {
     const url = new URL(baseUrl + path);
     const lib = url.protocol === "https:" ? httpsRequest : httpRequest;
     return new Promise((resolve, reject) => {
@@ -481,27 +481,19 @@ export function startJoin(opts) {
                 send(encodeFrame(FRAME_TYPE.ERROR, frame.streamId, jsonPayload({ code: "BAD_OPEN", message: "malformed open" })));
                 return;
             }
-            // ---- raw 门禁 + 候选端点（仅 raw inner dispatcher：dio.rawGate 定义时）----
-            if (dio?.rawGate !== undefined) {
-                // raw 门禁（仅设口令时）：授权前只接受 authorize 请求，否则 fail-closed 关流（修 raw 绕过，R7）
-                if (gate.accessCode !== null && !rawAuthorized) {
-                    if (path.startsWith("/__rdsh/authorize")) {
-                        const token = new URL(path, "http://rdsh.local").searchParams.get("token") ?? "";
-                        if (token !== "" && verifyGateCookie(gate.accessCode, token)) {
-                            rawAuthorized = true;
-                            sendSyntheticHttp(send, frame.streamId, 204, {}, Buffer.alloc(0));
-                            return;
-                        }
+            // ---- raw 门禁（仅 raw inner dispatcher：dio.rawGate 定义时）----
+            if (dio?.rawGate !== undefined && gate.accessCode !== null && !rawAuthorized) {
+                // 授权前只接受 authorize 请求，否则 fail-closed 关流（修 raw 绕过，R7）
+                if (path.startsWith("/__rdsh/authorize")) {
+                    const token = new URL(path, "http://rdsh.local").searchParams.get("token") ?? "";
+                    if (token !== "" && verifyGateCookie(gate.accessCode, token)) {
+                        rawAuthorized = true;
+                        sendSyntheticHttp(send, frame.streamId, 204, {}, Buffer.alloc(0));
+                        return;
                     }
-                    send(encodeFrame(FRAME_TYPE.CLOSE, frame.streamId, jsonPayload({ code: 403, message: "raw stream not authorized" })));
-                    return;
-                }
-                // 候选 + 一次性直连票（无论是否设口令都提供；经 E2EE，hub 不可见，R3/R4）
-                if (path === "/__rdsh/direct-candidates" || path.startsWith("/__rdsh/direct-candidates?")) {
-                    const body = Buffer.from(JSON.stringify({ candidates: dio.rawGate.candidates(), ticket: dio.rawGate.mintTicket() }));
-                    sendSyntheticHttp(send, frame.streamId, 200, { "content-type": "application/json" }, body);
-                    return;
                 }
+                send(encodeFrame(FRAME_TYPE.CLOSE, frame.streamId, jsonPayload({ code: 403, message: "raw stream not authorized" })));
+                return;
             }
             // ---- 访问口令 gate（仅 plain dispatcher：dio.gate=true 且已设 accessCode）----
             if (dio?.gate === true && gate.accessCode !== null) {
@@ -525,6 +517,21 @@ export function startJoin(opts) {
                     return;
                 }
             }
+            // ---- 直连候选 + 一次性票（**raw 与 plain 两条路径都要提供**）----
+            // 位置在**两道门禁之后**：raw 已过 rawGate，plain 已过访问口令（未过则上面已 return），
+            // 因此既不会泄露内网候选地址、也不会在未授权时签发直连票（R3/R4/R7）。
+            // 为什么 plain 也要提供：plain 页同样注入了直连 bootstrap（见 plainDispatcher 的 htmlInject），
+            // 缺了这个端点，页面里的 fetch("/__rdsh/direct-candidates") 会被转发给 dsh web → 404，
+            // 于是 window.__rdshDirectInfo 永不赋值 —— 即 2026-10-04 真机 "no __rdshDirectInfo" 的根因。
+            if (dio?.directCandidates !== undefined &&
+                (path === "/__rdsh/direct-candidates" || path.startsWith("/__rdsh/direct-candidates?"))) {
+                const body = Buffer.from(JSON.stringify({
+                    candidates: dio.directCandidates.candidates(),
+                    ticket: dio.directCandidates.mintTicket(),
+                }));
+                sendSyntheticHttp(send, frame.streamId, 200, { "content-type": "application/json" }, body);
+                return;
+            }
             if (kind === "ws") {
                 openWsStream(frame.streamId, path, headers);
                 return;
@@ -563,7 +570,11 @@ export function startJoin(opts) {
                         delete outHeaders["transfer-encoding"];
                         if (!adapterInjectionLogged) {
                             adapterInjectionLogged = true;
-                            console.log("[rdsh] rdsh webview api injected (window.__rdshWebViewApi v1)");
+                            // 按**实际注入的内容**打日志：raw 路径只注入直连 bootstrap，不含 WebView API。
+                            // （旧文案一律说 "webview api injected"，在 raw 路径上是假的，曾误导排查。）
+                            console.log(inject.includes("__rdshWebViewApi")
+                                ? "[rdsh] html inject: webview api + direct bootstrap (plain path)"
+                                : "[rdsh] html inject: direct bootstrap only (raw/E2EE path)");
                         }
                         send(encodeFrame(FRAME_TYPE.OPEN, streamId, jsonPayload({ kind: "http", status, reason: upRes.statusMessage, headers: outHeaders })));
                         sendChunkedBody(send, streamId, Buffer.from(html));
@@ -731,6 +742,8 @@ export function startJoin(opts) {
     const plainDispatcher = makeInnerDispatcher(sendTunnelFrame, {
         jsPatch: () => uiCompat.trustE2EEAsLoopback,
         gate: true,
+        // plain 页也要能取直连候选：它同样注入了直连 bootstrap，端点由下方统一提供
+        directCandidates: rawGate,
         htmlInject: () => {
             // 直连 bootstrap 始终注入（join 模式）；页面授权 token 仅设口令时生成（无口令则跳过 raw 授权、只取候选）
             return RDSH_WEBVIEW_API + pageAuthorizeScript(gate.accessCode);
@@ -770,6 +783,7 @@ export function startJoin(opts) {
         }, {
             jsPatch: () => uiCompat.trustE2EEAsLoopback,
             rawGate,
+            directCandidates: rawGate,
             // raw 门禁的解锁脚本：与 plain 同一来源（pageAuthorizeScript）。
             // raw 流不转发 cookie，这里是页面唯一的授权入口；缺了它 raw 门禁必然 fail-closed。
             htmlInject: () => pageAuthorizeScript(gate.accessCode),
@@ -940,8 +954,15 @@ export function startJoin(opts) {
                 client.terminate();
                 return;
             }
-            for (const frame of frames)
-                handleFrame(frame);
+            for (const frame of frames) {
+                // 单帧处理异常不能崩宿主进程：对端（含旧版客户端）可能发来不完整/不兼容的帧。
+                try {
+                    handleFrame(frame);
+                }
+                catch (err) {
+                    log("error", `frame handling failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
         });
         client.on("close", () => {
             cleanupStreams();
@@ -960,7 +981,15 @@ export function startJoin(opts) {
             }
             setState("reconnecting", { delayMs: reconnectDelay });
             log("info", `tunnel lost — reconnecting in ${Math.round(reconnectDelay / 1000)}s...`);
-            setTimeout(connect, reconnectDelay + Math.random() * 500);
+            // 定时器里的异常不会被上层捕获 —— 必须自己兜住，否则一次重连失败就崩掉宿主进程。
+            setTimeout(() => {
+                try {
+                    connect();
+                }
+                catch (err) {
+                    log("error", `reconnect failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, reconnectDelay + Math.random() * 500);
             reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
         });
         client.on("error", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rdsh-gateway",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "description": "rdsh host-side component: LAN auth gateway + outbound tunnel endpoint (spawns dsh web)",
   "license": "MIT",
   "type": "module",