feat: integrate web-deps and move webclient to docker/web-client

[rophy]

Summary

• Rename deploy/docker/webclient/ to docker/web-client/ to match GHCR image naming
• Pin web-deps image to ghcr.io/rophy/rustdesk/web-deps:20260823-1
• Extract cache-busting sed logic into docker/web-client/cache-bust.sh with grep validation
• Update README with correct GHCR image paths and directory references

Test plan

• Build web-client image using pinned GHCR web-deps
• Verify cache-bust.sh adds hash params to libopus and JS bundle URLs
• Verify web client connects to remote peer

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fc2c6ab6-70d9-4979-a29b-c057071c83af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[npe-pr-agent]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 Security concerns Reduced Security Hardening: The libopus build process in docker/web-deps/Dockerfile disables stack protector and hardening (--disable-stack-protector --disable-hardening). While this might be necessary for WASM compatibility or performance, it generally reduces protections against certain memory corruption vulnerabilities. If libopus processes untrusted audio data, a sophisticated attacker could potentially exploit this lack of hardening. The practical impact is uncertain, but it's a trade-off worth noting.

⚡ Recommended focus areas for review Fragile Logic The sed commands used to inject content hashes into resource URLs are brittle. They rely on exact string matches for paths like ./libopus.js, libopus.wasm, js/dist/index.js, and js/dist/vendor.js. Any future changes to how these paths are referenced in the Flutter build output or libopus.js could cause these sed commands to fail silently or incorrectly, leading to stale assets being served from the CDN. && tar xzf /tmp/web_deps.tar.gz -C build/web \ && HASH=$(sha256sum build/web/libopus.js | cut -c1-8) \ && sed -i "s|./libopus.js|./libopus.js?v=$HASH|g" build/web/js/dist/index.js \ && HASH=$(sha256sum build/web/libopus.wasm | cut -c1-8) \ && sed -i "s|libopus.wasm|libopus.wasm?v=$HASH|g" build/web/libopus.js \ && HASH=$(sha256sum build/web/js/dist/index.js | cut -c1-8) \ && sed -i "s|js/dist/index.js|js/dist/index.js?v=$HASH|g" build/web/index.html \ && HASH=$(sha256sum build/web/js/dist/vendor.js | cut -c1-8) \ && sed -i "s|js/dist/vendor.js|js/dist/vendor.js?v=$HASH|g" build/web/index.html Code in Dockerfile The WORKER_GLUE JavaScript code is embedded directly within the Dockerfile. Embedding application-specific logic in a Dockerfile makes it harder to test, maintain, and evolve independently. It also reduces the Dockerfile's readability and couples it tightly to the application's runtime needs. It would be more conventional to place this glue code in a separate .js file and copy it into the image. RUN cat >> api.js <<'WORKER_GLUE' var dec; var i = 0; self.addEventListener('message', (e) => { if (e.data.channels > 0) { if (dec) dec.destroy(); dec = new Decoder(e.data.channels, e.data.sampleRate); } else { dec.input(e.data); self.postMessage(dec.output().slice(0)); } }); WORKER_GLUE

[npe-pr-agent]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Handle uninitialized decoder in worker The WORKER_GLUE JavaScript code has a critical bug where dec.input(e.data) can be called on an uninitialized dec object. If the first message received by the worker does not have e.data.channels > 0, dec will be undefined, leading to a runtime error. Ensure dec is initialized before processing input data. docker/web-deps/Dockerfile [24-34] var dec; -var i = 0; self.addEventListener('message', (e) => { if (e.data.channels > 0) { if (dec) dec.destroy(); dec = new Decoder(e.data.channels, e.data.sampleRate); } else { + if (!dec) { + console.error("Opus decoder not initialized. An initialization message with 'channels > 0' must be sent first."); + return; + } dec.input(e.data); self.postMessage(dec.output().slice(0)); } }); Suggestion importance[1-10]: 9 __ Why: The suggestion correctly identifies a critical bug where dec.input(e.data) could be called on an uninitialized dec object, leading to a runtime error. The improved_code provides a robust fix by adding a check for dec before processing input.	High
General	Remove unused variable The variable i is declared but never used within the WORKER_GLUE JavaScript code. Remove this unused variable to improve code clarity and prevent potential confusion. docker/web-deps/Dockerfile [24-34] var dec; -var i = 0; self.addEventListener('message', (e) => { if (e.data.channels > 0) { if (dec) dec.destroy(); dec = new Decoder(e.data.channels, e.data.sampleRate); } else { + if (!dec) { + console.error("Opus decoder not initialized. An initialization message with 'channels > 0' must be sent first."); + return; + } dec.input(e.data); self.postMessage(dec.output().slice(0)); } }); Suggestion importance[1-10]: 0 __ Why: While the suggestion correctly identifies that var i = 0; is an unused variable, the improved_code includes additional changes (the if (!dec) block) that are not related to the suggestion's summary or content. This violates the guideline that the improved_code must accurately reflect only the suggested changes.	Low

[npe-pr-agent]

Preparing answer...

[rophy]

Bot reviews are stale (pre-rebase diff). All flagged issues were already addressed: sed logic extracted into cache-bust.sh with grep validation, worker glue moved to separate file, decoder null guard and try/catch added, unused var removed — all landed via PR #22.