@cjhyy/code-shell-server 0.9.52 → 0.10.1

package/dist/panels/process-service.d.ts

@@ -26,9 +26,9 @@ export interface PanelAppProcessServiceOptions {
     /** Rechecked after asynchronous work and immediately before admitting a process. */
     isOwnerAuthorized?(owner: PanelProcessOwner): boolean | Promise<boolean>;
     /**
-     * Desktop delegates durable approval lifetime to its Host hooks. Web uses guest
-     * to isolate each authenticated instance; guest approvals never use the
-     * app-wide durable hooks.
+     * When executable confirmation is required, app scope can delegate durable
+     * approval to Host hooks. Guest scope isolates authenticated instances and
+     * never uses the app-wide durable hooks.
      */
     approvalScope?: "app" | "guest";
     confirmExecution(input: {
@@ -40,7 +40,7 @@ export interface PanelAppProcessServiceOptions {
     }): Promise<boolean>;
     isExecutionApproved?(scope: PanelProcessApprovalScope): Promise<boolean>;
     rememberExecutionApproval?(scope: PanelProcessApprovalScope): Promise<void>;
-    /** Desktop can use installed-app process permission and trusted-project binding as consent. */
+    /** Hosts can use installed-app process permission and authorized-project binding as consent. */
     allowAuthorizedProcessWithoutPrompt?: boolean;
     /** Resolve a declared entry in this app revision; return a canonical, reviewed file. */
     resolvePackageEntry?(owner: PanelProcessOwner, name: string): Promise<{
@@ -75,6 +75,7 @@ export declare class PanelAppProcessService {
     private readonly retiring;
     private readonly receipts;
     private readonly approvedExecutables;
+    private readonly pendingExecutionApprovals;
     private readonly guestEpochs;
     private readonly reservations;
     private closed;

package/dist/panels/process-service.js

@@ -169,6 +169,7 @@ export class PanelAppProcessService {
     retiring = new Map();
     receipts;
     approvedExecutables = new Set();
+    pendingExecutionApprovals = new Map();
     guestEpochs = new Map();
     reservations = new Map();
     closed = false;
@@ -447,6 +448,7 @@ export class PanelAppProcessService {
         // Admission is reserved before the first await, including a user's approval dialog.
         const releaseExecution = this.options.acquireExecution?.(owner);
         let processOwnsExecution = false;
+        let pendingApproval;
         this.reservations.set(owner.guestId, reserved + 1);
         try {
             await this.authorize(owner, epoch);
@@ -462,29 +464,45 @@ export class PanelAppProcessService {
             const guestScoped = this.options.approvalScope === "guest";
             const approvalKey = (guestScoped ? `${owner.guestId}\0${epoch}\0` : "") +
                 `${scope.appId}\0${scope.revision}\0${scope.executablePath}\0${scope.executableFingerprint}`;
-            // Desktop already checks installed-app process permission and a trusted,
-            // bound project in authorize(). Web keeps its per-guest confirmation path.
+            // Hosts may use installed-app process permission and their authorized,
+            // bound project as consent; authorize() still runs before every spawn.
             let approved = this.options.allowAuthorizedProcessWithoutPrompt === true ||
                 this.approvedExecutables.has(approvalKey);
             if (!approved && !guestScoped && this.options.isExecutionApproved) {
                 approved = await this.options.isExecutionApproved(scope).catch(() => false);
                 await this.authorize(owner, epoch);
             }
+            approved ||= this.approvedExecutables.has(approvalKey);
             if (!approved) {
-                const allowed = await this.options.confirmExecution({
-                    guestId: owner.guestId,
-                    appId: owner.appId,
-                    appTitle: owner.appTitle,
-                    executable: executable.name,
-                    executablePath: executable.path,
-                });
-                await this.authorize(owner, epoch);
-                if (!allowed)
-                    throw new Error(`User denied running ${executable.name}`);
-                if (!guestScoped) {
-                    await this.options.rememberExecutionApproval?.(scope).catch(() => undefined);
-                    await this.authorize(owner, epoch);
+                let approval = this.pendingExecutionApprovals.get(approvalKey);
+                if (!approval) {
+                    approval = {
+                        guestId: owner.guestId,
+                        waiters: 0,
+                        result: (async () => {
+                            const allowed = await this.options.confirmExecution({
+                                guestId: owner.guestId,
+                                appId: owner.appId,
+                                appTitle: owner.appTitle,
+                                executable: executable.name,
+                                executablePath: executable.path,
+                            });
+                            await this.authorize(owner, epoch);
+                            if (!allowed)
+                                throw new Error(`User denied running ${executable.name}`);
+                            if (!guestScoped) {
+                                await this.options.rememberExecutionApproval?.(scope).catch(() => undefined);
+                                await this.authorize(owner, epoch);
+                            }
+                        })(),
+                    };
+                    this.pendingExecutionApprovals.set(approvalKey, approval);
                 }
+                approval.waiters++;
+                pendingApproval = { key: approvalKey, approval };
+                await approval.result;
+                // Sharing consent does not share a caller's authority or process handles.
+                await this.authorize(owner, epoch);
             }
             // A binary replaced while a dialog was open must earn a new approval.
             if ((await executableFingerprint(executable.path)) !== scope.executableFingerprint) {
@@ -618,6 +636,13 @@ export class PanelAppProcessService {
                 }),
             };
             this.processes.set(processId, running);
+            // A successful launcher may leave children behind (including children
+            // retaining stdout). Reap its group on leader exit, before close/lease release.
+            child.once("exit", () => {
+                const pid = child.pid;
+                if (!running.termination && typeof pid === "number" && pid > 1)
+                    running.termination = killProcessGroup(pid).catch(() => { });
+            });
             if (modelTraceOwner && this.options.modelTraces) {
                 const channel = new PanelModelTraceChannel({
                     service: this.options.modelTraces,
@@ -668,7 +693,7 @@ export class PanelAppProcessService {
                     clearTimeout(lifetime);
                     if (inputChecks)
                         clearInterval(inputChecks);
-                    // Cancellation also waits for the process group, not just its leader.
+                    // Natural exit and cancellation both wait for the entire process group.
                     await running.termination;
                     let finalCode = code;
                     if (inputChecks && this.processes.get(processId) === running) {
@@ -704,6 +729,14 @@ export class PanelAppProcessService {
             return { processId, executable: executable.name };
         }
         finally {
+            if (pendingApproval) {
+                const { key, approval } = pendingApproval;
+                approval.waiters--;
+                // Keep successful consent in flight until a caller has cached it after
+                // all spawn checks. Rejections disappear once every waiter has observed them.
+                if (!approval.waiters && this.pendingExecutionApprovals.get(key) === approval)
+                    this.pendingExecutionApprovals.delete(key);
+            }
             if (!processOwnsExecution)
                 releaseExecution?.();
             const remaining = (this.reservations.get(owner.guestId) ?? 1) - 1;
@@ -874,6 +907,10 @@ export class PanelAppProcessService {
     }
     revokeGuest(guestId) {
         this.guestEpochs.set(guestId, (this.guestEpochs.get(guestId) ?? 0) + 1);
+        for (const [key, approval] of this.pendingExecutionApprovals) {
+            if (approval.guestId === guestId)
+                this.pendingExecutionApprovals.delete(key);
+        }
         if (this.options.approvalScope === "guest") {
             for (const key of this.approvedExecutables) {
                 if (key.startsWith(`${guestId}\0`))
@@ -938,6 +975,7 @@ export class PanelAppProcessService {
         for (const guestId of guests)
             this.revokeGuest(guestId);
         this.approvedExecutables.clear();
+        this.pendingExecutionApprovals.clear();
         this.receipts.close();
     }
     terminate(running) {

package/dist/panels/runtime.js

@@ -412,6 +412,14 @@ function injectBridge(html, source) {
     const offset = doctype?.[0].length ?? 0;
     return html.slice(0, offset) + script + html.slice(offset);
 }
+// CSP3 and Chromium resolve 'self' in a sandboxed document to its URL's origin,
+// but WebKit (every iOS browser) matches nothing, blocking all of a panel's own
+// scripts and styles. Spell that origin out so every engine enforces one policy.
+function resolveMetaPolicySelf(html, origin) {
+    return html.replace(/<meta\b[^>]*>/gi, (tag) => /\shttp-equiv\s*=\s*(["']?)content-security-policy\1/i.test(tag)
+        ? tag.replaceAll("'self'", origin)
+        : tag);
+}
 /** Owner-bound capability grants serve reviewed static bytes to an opaque-origin iframe. */
 export function createPanelRuntime(options) {
     const publicPathPrefix = options.publicPathPrefix ?? "";
@@ -557,6 +565,9 @@ export function createPanelRuntime(options) {
             holder: { kind: "process" },
         }),
         approvalScope: "guest",
+        // Match Desktop: installed process permission and the authorized project binding
+        // are consent. Every spawn still rechecks owner/revision, handles and fingerprints.
+        allowAuthorizedProcessWithoutPrompt: true,
         resolvePackageEntry: async (owner, name) => {
             const taskScope = toolOwners.get(owner.guestId);
             if (taskScope) {
@@ -583,13 +594,7 @@ export function createPanelRuntime(options) {
             const grant = byGuest.get(owner.guestId);
             return !!grant && (await authorized(grant));
         },
-        confirmExecution: async (input) => {
-            if (toolOwners.has(input.guestId))
-                return true;
-            const grant = byGuest.get(input.guestId);
-            return (!!grant &&
-                (await confirm(grant, `允许 ${input.appTitle} 运行 ${input.executable}？`, `程序将在服务端运行，可使用当前运行用户的文件与网络权限。\n程序：${input.executablePath}`)));
-        },
+        confirmExecution: async () => true,
     });
     const resources = new PanelResourceService({
         rootDirectory: join(options.dataDir, "panel-app-media"),
@@ -1360,6 +1365,7 @@ export function createPanelRuntime(options) {
                 instanceId: id,
                 src: ASSETS + asset + "/" + app.entry.split("/").map(encodeURIComponent).join("/"),
                 expiresAt: grant.expiresAt,
+                serverTime: now(),
                 context,
                 limitations: panel.compatibility.reasons,
             };
@@ -1595,9 +1601,8 @@ export function createPanelRuntime(options) {
         if (method.startsWith("agent.task.")) {
             if (!agentTasks)
                 error(501, "当前宿主未提供独立面板任务。");
-            if (method === "agent.task.start" &&
-                !(await confirm(grant, `启动 ${grant.app.title.default} 的 AI 任务？`, String(params?.prompt ?? "").slice(0, 8000))))
-                error(403, "你取消了面板 AI 任务。");
+            // Match Desktop: the installed app's agent.task permission and live project
+            // binding authorize task creation. Worker tool approvals stay independent.
             return agentTasks.call(taskScope(grant), method, params);
         }
         if (method.startsWith("process.") || method.startsWith("filesystem.")) {
@@ -1904,7 +1909,7 @@ export function createPanelRuntime(options) {
                     if (!(await authorized(grant)))
                         error(410, "面板授权已失效。");
                     grant.expiresAt = now() + GRANT_TTL;
-                    json(response, 200, { expiresAt: grant.expiresAt });
+                    json(response, 200, { expiresAt: grant.expiresAt, serverTime: now() });
                 }
                 else if (request.method === "GET" && match[2] === "events") {
                     const after = Number(url.searchParams.get("after") ?? 0);
@@ -1913,7 +1918,11 @@ export function createPanelRuntime(options) {
                     grant.events = grant.events.filter((entry) => entry.id > after);
                     grant.eventBytes = grant.events.reduce((total, entry) => total + Buffer.byteLength(JSON.stringify(entry.payload) ?? "null"), 0);
                     const batch = grant.events.slice(0, 128);
-                    json(response, 200, { events: batch, cursor: batch.at(-1)?.id ?? after });
+                    json(response, 200, {
+                        events: batch,
+                        cursor: batch.at(-1)?.id ?? after,
+                        serverTime: now(),
+                    });
                 }
                 else if (request.method === "POST" && match[2] === "directory-picker") {
                     if (request.headers.origin !== grant.origin)
@@ -2091,12 +2100,14 @@ export function createPanelRuntime(options) {
                 // including when the public site is behind HTTPS termination.
                 const source = publicPathPrefix + ASSETS + grant.asset + "/";
                 if (extname(path).toLowerCase() === ".html") {
-                    bytes = Buffer.from(injectBridge(bytes.toString("utf8"), source));
                     const resourceOrigin = grant.origin;
+                    bytes = Buffer.from(resolveMetaPolicySelf(injectBridge(bytes.toString("utf8"), source), resourceOrigin));
                     const assetSource = resourceOrigin + source;
                     // Panels export their own generated files (for example JSON backups).
                     // Download permission does not grant origin access, network fetches or popups.
                     // The embedding iframe must enable the same permission.
+                    // Forms need submission events and method=dialog for local UI. The
+                    // enforcing form-action policy still blocks every form navigation.
                     response.setHeader("Content-Security-Policy", "default-src 'none'; script-src " +
                         assetSource +
                         " 'wasm-unsafe-eval'; style-src " +
@@ -2109,7 +2120,7 @@ export function createPanelRuntime(options) {
                         assetSource +
                         " data:; connect-src " +
                         assetSource +
-                        "; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; sandbox allow-scripts allow-downloads; frame-ancestors " +
+                        "; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; sandbox allow-scripts allow-downloads allow-forms; frame-ancestors " +
                         resourceOrigin);
                     response.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=(), display-capture=()");
                 }

package/dist/panels/tool-jobs-storage.d.ts

@@ -5,9 +5,13 @@ export declare class ToolJobStorage {
     private root;
     private identity;
     private nonce;
+    private ownerClaimFile;
     private readonly directories;
     constructor(configuredRoot: string);
     initialize(): Promise<void>;
+    private assertDeadOwner;
+    private acquireOwnerClaim;
+    private releaseOwnerClaim;
     directory(id?: string, work?: boolean, create?: boolean): Promise<string>;
     read(path: string, limit: number): Promise<unknown>;
     write(id: string, value: unknown, limit: number): Promise<void>;

package/dist/panels/tool-jobs-storage.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, realpath, readdir, rename, rm, rmdir, unlink } from "node:fs/promises";
 import { dirname, isAbsolute, join } from "node:path";
 export function toolJobJson(value, limit) {
     let text;
@@ -20,6 +20,7 @@ export class ToolJobStorage {
     root = "";
     identity = "";
     nonce = "";
+    ownerClaimFile = "";
     directories = new Map();
     constructor(configuredRoot) {
         this.configuredRoot = configuredRoot;
@@ -33,43 +34,114 @@ export class ToolJobStorage {
             throw new Error("invalid tool job root");
         this.root = await realpath(this.configuredRoot);
         this.identity = `${initial.dev}:${initial.ino}`;
-        const lockPath = join(this.root, "owner.lock");
-        const create = () => open(lockPath, "wx", 0o600);
-        let lock;
+        this.nonce = randomUUID();
         try {
-            lock = await create();
+            await this.acquireOwnerClaim();
+            // Keep the previous file format as an interoperability barrier for older
+            // Hosts. All current Hosts hold the atomic directory claim before touching it.
+            const lockPath = join(this.root, "owner.lock");
+            try {
+                const current = (await this.read(lockPath, 1024));
+                this.assertDeadOwner(current.pid);
+                await rm(lockPath);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            const lock = await open(lockPath, "wx", 0o600);
+            try {
+                await lock.writeFile(JSON.stringify({ pid: process.pid, nonce: this.nonce }));
+                await lock.sync();
+            }
+            finally {
+                await lock.close();
+            }
         }
         catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            const current = (await this.read(lockPath, 1024));
-            let alive = false;
-            if (Number.isSafeInteger(current.pid) && Number(current.pid) > 1) {
-                try {
-                    process.kill(Number(current.pid), 0);
-                    alive = true;
+            await this.releaseOwnerClaim();
+            this.nonce = "";
+            throw error;
+        }
+    }
+    assertDeadOwner(pid) {
+        if (!Number.isSafeInteger(pid) || Number(pid) <= 1) {
+            throw new Error("invalid tool job ownership lock");
+        }
+        try {
+            process.kill(Number(pid), 0);
+        }
+        catch (error) {
+            if (error.code === "ESRCH")
+                return;
+        }
+        throw new Error("tool job storage is already owned by a running Host");
+    }
+    async acquireOwnerClaim() {
+        const destination = join(this.root, "owner.claim");
+        const temporary = join(this.root, `.owner-${this.nonce}`);
+        const marker = `${this.nonce}.json`;
+        await mkdir(temporary, { mode: 0o700 });
+        try {
+            const file = await open(join(temporary, marker), "wx", 0o600);
+            try {
+                await file.writeFile(JSON.stringify({ pid: process.pid, nonce: this.nonce }));
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            try {
+                await rename(temporary, destination);
+            }
+            catch (error) {
+                if (!["EEXIST", "ENOTEMPTY", "EPERM"].includes(error.code ?? ""))
+                    throw error;
+                const directory = await lstat(destination);
+                if (!directory.isDirectory() || directory.isSymbolicLink())
+                    throw new Error("invalid tool job ownership claim", { cause: error });
+                const entries = await readdir(destination);
+                if (entries.length > 1 || entries.some((entry) => !/^[a-f0-9-]{36}\.json$/.test(entry))) {
+                    throw new Error("invalid tool job ownership claim", { cause: error });
                 }
-                catch (cause) {
-                    if (cause.code !== "ESRCH")
-                        alive = true;
+                if (entries[0]) {
+                    const stalePath = join(destination, entries[0]);
+                    try {
+                        const current = (await this.read(stalePath, 1024));
+                        this.assertDeadOwner(current.pid);
+                        // Delete only the observed owner's unique marker. A delayed
+                        // reclaimer cannot unlink a new owner's different marker.
+                        await unlink(stalePath);
+                    }
+                    catch (cause) {
+                        if (cause.code !== "ENOENT")
+                            throw cause;
+                    }
                 }
+                // Never move the existing claim: a replacement may already own it.
+                // Some platforms cannot replace even an empty destination directory.
+                // rmdir is safe here: it cannot remove a newly published nonempty claim.
+                await rmdir(destination).catch((cause) => {
+                    if (cause.code !== "ENOENT")
+                        throw cause;
+                });
+                await rename(temporary, destination);
             }
-            else
-                throw new Error("invalid tool job ownership lock", { cause: error });
-            if (alive)
-                throw new Error("tool job storage is already owned by a running Host", { cause: error });
-            await rm(lockPath);
-            lock = await create();
-        }
-        this.nonce = randomUUID();
-        try {
-            await lock.writeFile(JSON.stringify({ pid: process.pid, nonce: this.nonce }));
-            await lock.sync();
+            this.ownerClaimFile = join(destination, marker);
         }
         finally {
-            await lock.close();
+            await rm(temporary, { recursive: true, force: true });
         }
     }
+    async releaseOwnerClaim() {
+        if (!this.ownerClaimFile)
+            return;
+        await unlink(this.ownerClaimFile).catch((error) => {
+            if (error.code !== "ENOENT")
+                throw error;
+        });
+        this.ownerClaimFile = "";
+    }
     async directory(id, work = false, create = false) {
         const info = await lstat(this.root);
         if (!info.isDirectory() ||
@@ -186,12 +258,17 @@ export class ToolJobStorage {
     async close() {
         if (!this.nonce)
             return;
-        const path = join(await this.directory(), "owner.lock");
-        const lock = (await this.read(path, 1024));
-        if (lock.nonce === this.nonce)
-            await rm(path);
-        this.nonce = "";
-        this.directories.clear();
+        try {
+            const path = join(await this.directory(), "owner.lock");
+            const lock = (await this.read(path, 1024));
+            if (lock.nonce === this.nonce)
+                await rm(path);
+        }
+        finally {
+            await this.releaseOwnerClaim();
+            this.nonce = "";
+            this.directories.clear();
+        }
     }
     async remove(id) {
         const path = await this.directory(id);

package/dist/panels/types.d.ts

@@ -1,97 +1 @@
-import type { GitPanelAppDiscoveryCandidate, GitPanelAppDiscoveryIssue, PanelAppPreview } from "@cjhyy/code-shell-core";
-export interface PanelCompatibility {
-    supported: boolean;
-    reasons: string[];
-}
-export interface PanelGitSource {
-    kind: "git";
-    url: string;
-    /** The original branch/tag, retained separately from the pinned archive commit. */
-    ref: string;
-    subdir?: string;
-    commit: string;
-}
-export interface ManagedPanel extends Omit<PanelAppPreview, "reviewToken" | "alreadyInstalled" | "warnings" | "source"> {
-    packageDigest?: string;
-    revision: string;
-    bound: boolean;
-    enabled: boolean;
-    globalDisabled: boolean;
-    updatable: boolean;
-    source: {
-        kind: "git" | "local";
-        label: string;
-        url?: string;
-        ref?: string;
-        commit?: string;
-        subdir?: string;
-    };
-    compatibility: PanelCompatibility;
-}
-export interface PanelPackageIssue {
-    id: string;
-    revision: string;
-    code: "package_unavailable";
-    version?: string;
-    packageDigest?: string;
-    bound: boolean;
-    globalDisabled: boolean;
-}
-export interface PanelSnapshot {
-    panels: ManagedPanel[];
-    issues?: PanelPackageIssue[];
-    workspace: string;
-    hasProject: boolean;
-    canRestorePackages?: boolean;
-}
-export interface PanelDiscovery {
-    panels: GitPanelAppDiscoveryCandidate[];
-    issues: GitPanelAppDiscoveryIssue[];
-    source: PanelGitSource;
-}
-export interface PanelReview {
-    reviewToken: string;
-    expiresAt: number;
-    kind: "install" | "update";
-    preview: Omit<PanelAppPreview, "reviewToken">;
-    source: PanelGitSource;
-    expectedRevision: string | null;
-    compatibility: PanelCompatibility;
-    /** The installed package selected for this project, when its manifest is available. */
-    installedVersion?: string;
-    /** Reviewed permissions of that same installed package; an empty array is a known baseline. */
-    installedPermissions?: PanelAppPreview["permissions"];
-}
-/** Trusted native hosts may review local sources without exposing paths to Web routes. */
-export type PanelProjectReview = Omit<PanelReview, "source">;
-export interface PanelOperationContext {
-    ownerId: string;
-    authorize: () => boolean | Promise<boolean>;
-}
-export interface PanelPackageVersion {
-    version: string;
-    packageDigest: string;
-    permissions: PanelAppPreview["permissions"];
-    compatibility: PanelCompatibility;
-}
-export interface PanelPackageHistory {
-    appId: string;
-    title: PanelAppPreview["title"];
-    expectedRevision: string;
-    current: {
-        version: string;
-        packageDigest?: string;
-        unavailable?: boolean;
-    };
-    versions: PanelPackageVersion[];
-    unavailablePackages: number;
-}
-export interface PanelPackageRestoreReview extends PanelPackageVersion {
-    appId: string;
-    title: PanelAppPreview["title"];
-    current: PanelPackageHistory["current"];
-    addedPermissions: PanelAppPreview["permissions"];
-    expectedRevision: string;
-    reviewToken: string;
-    expiresAt: number;
-}
+export type { PanelCompatibility, PanelGitSource, ManagedPanel, PanelPackageIssue, PanelSnapshot, PanelDiscovery, PanelReview, PanelProjectReview, PanelOperationContext, PanelPackageVersion, PanelPackageHistory, PanelPackageRestoreReview, } from "@cjhyy/code-shell-web/panels";

package/dist/remote-relay/connector.d.ts

@@ -19,6 +19,14 @@ export interface DeviceRelayConnectorOptions {
     /** Additional trusted CA for private installations; TLS verification stays enabled. */
     ca?: ConnectionOptions["ca"];
     onState?: (state: DeviceRelayState) => void;
+    /**
+     * Opt-in: lets the directory mint a one-time phone pairing token for its
+     * owner. Omitted, the feature is neither advertised nor accepted.
+     */
+    issuePairing?: () => {
+        token: string;
+        expiresAt: number;
+    };
 }
 export interface DeviceRelayConnector {
     /** Idempotent while running. Callers must await close before restarting. */

package/dist/remote-relay/connector.js

@@ -1,12 +1,13 @@
 import { WebSocket } from "ws";
 import { openRelayStream } from "./local-stream.js";
-import { isRelayHostId, isRelayOrigin, isRelayToken, parseRelayControlMessage, RELAY_CONNECT_PATH, RELAY_CONTROL_MAX_BYTES, RELAY_MAX_STREAMS, RELAY_PING_INTERVAL_MS, RELAY_PONG_TIMEOUT_MS, RELAY_SETUP_TIMEOUT_MS, } from "./protocol.js";
+import { isRelayHostId, isRelayOrigin, isRelayToken, parseRelayControlMessage, RELAY_CONNECT_PATH, RELAY_CONTROL_MAX_BYTES, RELAY_FEATURE_PAIRING, RELAY_FEATURES_HEADER, RELAY_MAX_STREAMS, RELAY_PING_INTERVAL_MS, RELAY_PONG_TIMEOUT_MS, RELAY_SETUP_TIMEOUT_MS, } from "./protocol.js";
 export function createDeviceRelayConnector(options) {
     if (!isRelayOrigin(options.relayOrigin) ||
         !isRelayOrigin(options.publicOrigin) ||
         !isRelayHostId(options.hostId) ||
         (!options.getCredential && !isRelayToken(options.credential)) ||
         (options.getCredential !== undefined && typeof options.getCredential !== "function") ||
+        (options.issuePairing !== undefined && typeof options.issuePairing !== "function") ||
         !options.localHost ||
         !Number.isInteger(options.localHost.port) ||
         options.localHost.port < 1 ||
@@ -96,7 +97,10 @@ export function createDeviceRelayConnector(options) {
         const url = new URL(RELAY_CONNECT_PATH, config.relayOrigin);
         url.protocol = "wss:";
         const ws = new WebSocket(url, {
-            headers: { Authorization: `Bearer ${credential}` },
+            headers: {
+                Authorization: `Bearer ${credential}`,
+                ...(config.issuePairing ? { [RELAY_FEATURES_HEADER]: RELAY_FEATURE_PAIRING } : {}),
+            },
             ca: config.ca,
             followRedirects: false,
             perMessageDeflate: false,
@@ -180,6 +184,29 @@ export function createDeviceRelayConnector(options) {
                 state("ready");
                 return;
             }
+            if (message.type === "pair") {
+                if (!config.issuePairing || !leaseId || message.leaseId !== leaseId)
+                    return ws.terminate();
+                let reply = {
+                    type: "pair-failed",
+                    v: 1,
+                    leaseId,
+                    requestId: message.requestId,
+                };
+                try {
+                    const issued = config.issuePairing();
+                    if (isRelayToken(issued?.token) &&
+                        Number.isSafeInteger(issued.expiresAt) &&
+                        issued.expiresAt > Date.now())
+                        reply = { ...reply, type: "paired", token: issued.token, expiresAt: issued.expiresAt };
+                }
+                catch {
+                    /* Refused or unavailable: the directory reports failure to its owner. */
+                }
+                if (current() && ws.readyState === ws.OPEN)
+                    ws.send(JSON.stringify(reply));
+                return;
+            }
             if (message.type !== "open" ||
                 !leaseId ||
                 message.leaseId !== leaseId ||