rdsh-gateway 0.8.6 → 0.9.0

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { ipInCidrs, parseCidr, ipToInt } from "./cidr.ts";
 export { loadTls } from "./tls.ts";
 export type { TlsMaterial } from "./tls.ts";
 export { loginPageHtml } from "./login-page.ts";
-export { installService, uninstallService, serviceStatus, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.ts";
+export { installService, uninstallService, serviceStatus, startService, stopService, restartService, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.ts";
 export type { ServiceSpec } from "./service.ts";
 export declare const NAME = "rdsh-gateway";
 export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.ts";

package/dist/index.js

@@ -14,7 +14,7 @@ export { hashPassword, verifyPassword, UserManager } from "./auth.js";
 export { ipInCidrs, parseCidr, ipToInt } from "./cidr.js";
 export { loadTls } from "./tls.js";
 export { loginPageHtml } from "./login-page.js";
-export { installService, uninstallService, serviceStatus, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.js";
+export { installService, uninstallService, serviceStatus, startService, stopService, restartService, systemdUnit, launchdPlist, SERVICE_NAME, JOIN_SERVICE_NAME, HOST_SERVICE_NAME, HUB_SERVICE_NAME } from "./service.js";
 export const NAME = "rdsh-gateway";
 export { join, startJoin, registerJoin, detectInsecure, selfRevoke, patchLoopbackJs } from "./join.js";
 export { readPersistedToken, clearPersistedToken } from "./token-store.js";

package/dist/join.js

@@ -301,6 +301,14 @@ export function startJoin(opts) {
         const gatedHttp = new Map();
         /** 已报告过"loopback 补丁未命中"的路径（每个路径只报一次，避免日志刷屏）。 */
         const patchMissReported = new Set();
+        /** 已报告过"loopback 补丁命中"的路径（与 miss 对称：只看得到 miss 会让人误判"补丁从未生效"）。 */
+        const patchHitReported = new Set();
+        /**
+         * 已确认**不含**补丁目标串的 URL（键为完整 path，含 query）——命中过一次 miss 后直接走流式，
+         * 不再每次页面加载都缓冲 + 解压 + 全量扫描（DSH 前端壳资源 2 个就 ~1.3 MB）。
+         * 键含 query 且不截断：combo 路由用 query 选内容，资源 URL 由内容决定（rev/hash），内容一变 URL 就变。
+         */
+        const patchSkipped = new Set();
         /** 从转发头里取 rdsh_gate cookie（hub D12 白名单透传）。 */
         function gateCookie(headers) {
             const ck = headers["cookie"];
@@ -474,7 +482,8 @@ export function startJoin(opts) {
                 responded = true;
                 const status = upRes.statusCode ?? 502;
                 const baseHeaders = normalizeRespHeaders(upRes.headers);
-                const wantsPatch = dio?.jsPatch?.() === true && isJsContentType(upRes.headers);
+                // 已确认该 URL 不含目标串（DSH 前端壳资源就属此类）→ 直接流式，省掉白解压与全量扫描
+                const wantsPatch = dio?.jsPatch?.() === true && isJsContentType(upRes.headers) && !patchSkipped.has(path);
                 // 非 JS / 未开补丁：保持原流式路径（OPEN 立即发，body 边到边发）
                 if (!wantsPatch) {
                     send(encodeFrame(FRAME_TYPE.OPEN, streamId, jsonPayload({ kind: "http", status, reason: upRes.statusMessage, headers: baseHeaders })));
@@ -503,8 +512,11 @@ export function startJoin(opts) {
                     let body = raw;
                     let outHeaders = baseHeaders;
                     let hit = false;
+                    /** 解码成功、且明文里确实**没有**目标串 → 该 URL 可以永久短路（换编码回来也一样没有）。 */
+                    let targetAbsent = false;
                     if (decoded !== null) {
                         const patched = patchLoopbackJs(decoded);
+                        targetAbsent = patched === null;
                         const recoded = patched === null ? null : encodeBody(patched, encoding);
                         if (recoded !== null) {
                             body = recoded;
@@ -516,17 +528,26 @@ export function startJoin(opts) {
                             outHeaders["cache-control"] = "public, max-age=300";
                         }
                     }
-                    // 未命中必须留痕（每个路径一次）：fail-open 是刻意设计，但"补丁从未生效"不能静默
-                    //（2026-09-14 gzip 事故正是因为没有这条日志而排查了很久）
-                    if (!hit) {
-                        const key = (path.split("?")[0] ?? path).slice(0, 120);
-                        if (!patchMissReported.has(key)) {
-                            patchMissReported.add(key);
-                            console.log(`[patch] miss: ${key} (${raw.length}B, content-encoding=${encoding === "" ? "identity" : encoding})`);
+                    // 命中与未命中都必须留痕（每个路径一次）：fail-open 是刻意设计，但"补丁是否生效"不能靠猜。
+                    // 两次误判都源于只看得到一半日志：2026-09-14 gzip 事故（只见 miss）、2026-09-17
+                    // 「补丁在 0.1.5-rc.2 上永不命中」（把前端壳资源的 miss 当成了判据所在的 bundle）。
+                    const logKey = (path.split("?")[0] ?? path).slice(0, 120);
+                    if (hit) {
+                        if (!patchHitReported.has(logKey) || process.env.RDSH_DEBUG_PATCH === "1") {
+                            patchHitReported.add(logKey);
+                            console.log(`[patch] hit: ${logKey} (${raw.length}B → ${body.length}B, ${encoding === "" ? "identity" : encoding})`);
                         }
                     }
-                    else if (process.env.RDSH_DEBUG_PATCH === "1") {
-                        console.log(`[patch] hit: ${path.slice(0, 120)} (${raw.length}B → ${body.length}B, ${encoding === "" ? "identity" : encoding})`);
+                    else {
+                        const firstMiss = !patchMissReported.has(logKey);
+                        patchMissReported.add(logKey);
+                        // 只有"解码后确实没有目标串"才永久短路；编码不支持（decoded === null）时并没看过明文，
+                        // 保持每次尝试（同一 URL 换个编码回来仍能被补丁）；重压失败同理不算。
+                        if (targetAbsent)
+                            patchSkipped.add(path);
+                        if (firstMiss) {
+                            console.log(`[patch] miss: ${logKey} (${raw.length}B, content-encoding=${encoding === "" ? "identity" : encoding}) — fail-open${targetAbsent ? "；此 URL 后续不再尝试补丁" : ""}`);
+                        }
                     }
                     send(encodeFrame(FRAME_TYPE.OPEN, streamId, jsonPayload({ kind: "http", status, reason: upRes.statusMessage, headers: outHeaders })));
                     sendChunkedBody(send, streamId, body);

package/dist/proxy.js

@@ -7,6 +7,20 @@
 import { request } from "node:http";
 import { WebSocket, WebSocketServer } from "ws";
 import { decodeBody, encodeBody, firstEncoding } from "./http-encoding.js";
+/**
+ * 已知**不含**补丁目标串的 URL（按 patcher 函数身份隔离——目标串由 patcher 决定，只看 URL 会误判）。
+ * 目的与隧道路径（`join.ts` 的 `patchSkipped`）一致：DSH 前端壳资源每次页面加载都被缓冲 + 解压 + 全量扫描，
+ * 而这些字节永远不会命中；记住一次即可一直走流式。
+ */
+const jsPatchMissedUrls = new WeakMap();
+function missedUrlsFor(patcher) {
+    const existing = jsPatchMissedUrls.get(patcher);
+    if (existing !== undefined)
+        return existing;
+    const created = new Set();
+    jsPatchMissedUrls.set(patcher, created);
+    return created;
+}
 /**
  * 重写转发头以通过 DSH 围栏（isTrustedApiRequest 要求 Host/Origin 一致且为 loopback）。
  * - Host → 127.0.0.1:<port>（M1 事实：DSH 只信任 loopback/trusted Host）
@@ -81,7 +95,12 @@ export function forwardHttp(req, res, target, opts) {
             });
             return;
         }
-        const canPatchJs = opts?.jsPatch !== undefined && typeof contentType === "string" && /javascript/i.test(contentType);
+        const patchUrl = req.url ?? "";
+        const patchMissed = opts?.jsPatch === undefined ? undefined : missedUrlsFor(opts.jsPatch);
+        const canPatchJs = opts?.jsPatch !== undefined &&
+            typeof contentType === "string" &&
+            /javascript/i.test(contentType) &&
+            patchMissed?.has(patchUrl) !== true;
         if (canPatchJs) {
             // JS bundle 需缓冲后才能替换目标串；先按 content-encoding 解码（dsh 会 gzip JS），
             // 补丁后按原编码重压（fail-open：未命中/不支持编码 → 原字节原头透传）
@@ -95,6 +114,9 @@ export function forwardHttp(req, res, target, opts) {
                 const patched = decoded === null ? null : opts.jsPatch(decoded);
                 const recoded = patched === null ? null : encodeBody(patched, encoding);
                 const outBody = recoded ?? raw;
+                // 只有"解码后确实没有目标串"才记住该 URL（编码不支持时没看过明文，保持每次尝试）
+                if (patched === null && decoded !== null)
+                    patchMissed?.add(patchUrl);
                 const outHeaders = { ...upstreamRes.headers };
                 if (recoded !== null) {
                     outHeaders["content-length"] = String(outBody.length);

package/dist/service.d.ts

@@ -30,3 +30,9 @@ export declare function installService(spec: ServiceSpec): Promise<string>;
 export declare function serviceStatus(name?: string): Promise<string>;
 /** 停止并移除服务。 */
 export declare function uninstallService(name?: string): Promise<string>;
+/** 启动服务（运行时控制，不改变开机自启配置）。 */
+export declare function startService(name?: string): Promise<string>;
+/** 停止服务（运行时控制，不改变开机自启配置）。 */
+export declare function stopService(name?: string): Promise<string>;
+/** 重启服务（运行时控制，不改变开机自启配置）。 */
+export declare function restartService(name?: string): Promise<string>;

package/dist/service.js

@@ -158,4 +158,33 @@ export async function uninstallService(name = SERVICE_NAME) {
     await rm(launchdPlistPath(name), { force: true });
     return `removed ${launchdPlistPath(name)}`;
 }
+/** 启动服务（运行时控制，不改变开机自启配置）。 */
+export async function startService(name = SERVICE_NAME) {
+    if (isLinux()) {
+        await run("systemctl", ["--user", "start", name]);
+        return `started ${name}`;
+    }
+    // macOS：kickstart -k 确保在跑（已运行则先停再启）。
+    await run("launchctl", ["kickstart", "-k", `com.${name}`]);
+    return `started com.${name}`;
+}
+/** 停止服务（运行时控制，不改变开机自启配置）。 */
+export async function stopService(name = SERVICE_NAME) {
+    if (isLinux()) {
+        await run("systemctl", ["--user", "stop", name]);
+        return `stopped ${name}`;
+    }
+    // macOS：stop 仅停当前实例；KeepAlive（仅失败退出重启）可能立即拉起 —— 与 systemd stop 语义不同。
+    await run("launchctl", ["stop", `com.${name}`]).catch(() => undefined);
+    return `stopped com.${name}`;
+}
+/** 重启服务（运行时控制，不改变开机自启配置）。 */
+export async function restartService(name = SERVICE_NAME) {
+    if (isLinux()) {
+        await run("systemctl", ["--user", "restart", name]);
+        return `restarted ${name}`;
+    }
+    await run("launchctl", ["kickstart", "-k", `com.${name}`]);
+    return `restarted com.${name}`;
+}
 //# sourceMappingURL=service.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rdsh-gateway",
-  "version": "0.8.6",
+  "version": "0.9.0",
   "description": "rdsh host-side component: LAN auth gateway + outbound tunnel endpoint (spawns dsh web)",
   "license": "MIT",
   "type": "module",