@khorsheed/dsh-mobile 0.1.1 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # 变更记录
 
+## 0.1.2（2026-09-28）
+
+- **public tunnel 恢复**，QR 码按隧道可达性门禁——隧道不通时不再展示一张扫不开的二维码
+
 ## 0.1.1（2026-09-27）
 
 按活体试用反馈修复六处移动端问题；README 中英统一为中文主版并落地实拍截图（两张从未存在的引用删除）。对宿主 `0.1.7-rc.2` 类型面构建+测试通过（2026-09-27）。

package/README.en.md

@@ -6,9 +6,9 @@ Your dsh sessions, in your pocket — the Mac still runs the sessions, models, s
 
 The official Web client is desktop-shaped: a sidebar that eats the screen, a dense composer, touch targets made for a mouse. This plugin re-presents the very same client for narrow touch screens — a conversation library with grouping and search, a wrapping composer with reachable controls, a sheet for picking directories on the computer — and adds an optional [iOS shell](../../apps/ios/README.md) that embeds that same official Web client and pairs to it over a QR login link. Everything stays removable: uninstalling restores the official desktop UI exactly, and no Host or sibling-plugin state is ever written.
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/mobile-library.png" width="640" alt="the mobile conversation library: time and workspace grouping, the bottom search field and the QR pairing entry">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/mobile-library.png" width="640" alt="the mobile conversation library: time and workspace grouping, the bottom search field and the QR pairing entry">
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/mobile-conversation.png" width="640" alt="a conversation in mobile layout: the session header with its Members tab, the message flow, and the composer toolbar at the bottom">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/mobile-conversation.png" width="640" alt="a conversation in mobile layout: the session header with its Members tab, the message flow, and the composer toolbar at the bottom">
 
 ## Features
 
@@ -55,6 +55,15 @@ DSH_MOBILE_PUBLIC_ORIGIN=https://YOUR-HOST.trycloudflare.com dsh web --no-open -
 
 Different physical networks need an independently configured HTTPS/WSS ingress to the loopback Host port, valid official authentication, an awake/online Mac and a reachable phone — starting the Host alone does not establish remote access, and the App does not configure networking or credentials for you. Debug simulator builds allow HTTP on loopback only; Release requires HTTPS.
 
+
+### Desktop Quick Tunnel recovery
+
+The connection page anonymously probes the configured public root before offering or generating a QR. An unavailable origin returns an actionable state without issuing a login URL. A displayed QR is checked every 15 seconds and hidden if the endpoint fails or changes. This is a computer-side reachability check, not a guarantee about the phone's network.
+
+For this repository's supervised 3080 deployment, `pnpm mobile:tunnel` runs an opt-in desktop recovery manager; `--repair-now` skips the initial three-check delay. It checks every 30 seconds, waits through a local host outage, and rebuilds only after three consecutive public failures. Recovery attempts have a ten-minute cooldown. It starts an exact-origin loopback ingress and a new Quick Tunnel, then calls `pnpm deploy:3080 --package packages/mobile --mobile-origin https://new-link.trycloudflare.com`. This runs the normal build/test and guarded `reconfigure` path, updating the existing public-origin/trusted-host bindings and preserving other launch settings. It restarts the host; failure retains the guard's restore-previous behavior. Changed mobile/deployment source files block automated deployment.
+
+Keep the manager running under the computer's service manager (for example, a per-user macOS LaunchAgent). It is separate from the host process and is not installed by the plugin. `DSH_HOME` selects the existing supervised deployment; `CLOUDFLARED_BIN` optionally supplies the installed cloudflared binary. State and diagnostic logs live under `$DSH_HOME/state/mobile-tunnel/`; they contain no login tokens. Only an existing explicit Quick Tunnel binding is supported: no wildcard trusted hosts, account provisioning, or automatic changes to the phone. After rotation, reopen **Connect phone** and scan its new QR.
+
 ## Optional: a Quick Tunnel preview
 
 Networking is deployment configuration, not a plugin dependency — bring your own HTTPS reverse tunnel/server or private networking; the plugin embeds no domain, server or Cloudflare account. For temporary previews, [Cloudflare Quick Tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/) mint a temporary HTTPS address without an account or domain: no uptime guarantee, 200 concurrent requests, no SSE (the tested conversation transport uses WebSocket).

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/mobile/README.en.md
-packages/mobile/README.en.md: 68ecfef324379a455d01be189d2febf9d99e4c1c
-packages/mobile/README.md: 23668e6d25f50d04c0b8e3184294dd86d7e626b3
+packages/mobile/README.en.md: aedcdd10fd6a33f134e2b47764852c251e8571ae
+packages/mobile/README.md: 872d2ff32cf881a39fa40404ed7f5edd17d06c41

package/README.md

@@ -6,9 +6,9 @@
 
 官方 Web 客户端是桌面形态：侧栏吃掉半个屏幕、输入区密密麻麻、触控目标按鼠标设计。这个插件把同一套客户端重新呈现给窄屏触控设备——带分组和搜索的会话首页、可换行且够得着的输入工具栏、在手机上选电脑目录的面板——再配上一个可选的 [iOS 薄壳](../../apps/ios/README.zh.md)：嵌入同一套官方 Web 客户端，扫码登录即用。一切都可以干净移除：卸载即精确还原官方桌面界面，绝不写入宿主或兄弟插件的状态。
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/mobile-library.png" width="640" alt="移动端会话首页:时间与工作区分组、底部搜索框与扫码入口">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/mobile-library.png" width="640" alt="移动端会话首页:时间与工作区分组、底部搜索框与扫码入口">
 
-<img src="https://raw.githubusercontent.com/Khorsheed/dsh-web-basic/main/docs/screenshots/mobile-conversation.png" width="640" alt="移动布局下的会话页:会话头部与成员 tab、消息流、底部输入工具栏">
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/mobile-conversation.png" width="640" alt="移动布局下的会话页:会话头部与成员 tab、消息流、底部输入工具栏">
 
 ## 特性
 
@@ -55,6 +55,15 @@ DSH_MOBILE_PUBLIC_ORIGIN=https://YOUR-HOST.trycloudflare.com dsh web --no-open -
 
 跨物理网络需要独立配置的 HTTPS/WSS 入口转发到 loopback Host 端口、有效官方认证、保持唤醒联网的 Mac 和网络可达的手机——仅启动 Host 不等于远程可用，App 也不会替你配置网络或凭据。Debug 模拟器构建仅允许 loopback HTTP，Release 要求 HTTPS。
 
+
+### 电脑端 Quick Tunnel 自动恢复
+
+连接手机页面在提供或生成二维码前，会匿名检查已配置的公网入口。不可达时返回明确状态，不签发登录链接。正在展示的二维码每 15 秒复查一次，入口失效或变化时收起。这是电脑侧连通性检查，不能保证手机所处网络同样可达。
+
+本仓库受监督的 3080 部署可选择运行 `pnpm mobile:tunnel`，`--repair-now` 可跳过初始三次检测的等待。管理进程每 30 秒检测一次，本地宿主不可用时等待；公网连续三次失败才重建，恢复尝试之间至少间隔十分钟。它启动严格绑定新域名的 loopback 转发和新 Quick Tunnel，再调用 `pnpm deploy:3080 --package packages/mobile --mobile-origin https://new-link.trycloudflare.com`，通过正常构建、测试及受控 `reconfigure` 更新原有公网地址和信任域名，其余启动设置不变。此过程会重启宿主，失败保留守护进程的回退机制。移动包或部署代码存在未提交修改时，自动部署会被阻止。
+
+通过电脑的服务管理器保持运行，例如 macOS 的用户级 LaunchAgent。它独立于宿主进程，不由插件自动安装。`DSH_HOME` 指向现有受监督部署，`CLOUDFLARED_BIN` 可指定已安装的 cloudflared。状态和诊断日志位于 `$DSH_HOME/state/mobile-tunnel/`，不包含登录 token。仅支持已明确配置的 Quick Tunnel：不增加通配信任、不注册账号、不自动修改手机地址。域名切换后重新打开「连接手机」，扫描新二维码即可。
+
 ## 可选：Quick Tunnel 预览
 
 网络接入属于部署配置，不是插件依赖——自建 HTTPS 反向隧道/服务器或私网连接均可；插件不嵌入任何域名、服务器或 Cloudflare 账号。临时预览可用 [Cloudflare Quick Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/)：无需账号或自有域名即可生成临时 HTTPS 地址，但不保证在线时间、限 200 并发、不支持 SSE（实测会话传输走 WebSocket）。

package/lib/client.js

@@ -2603,9 +2603,16 @@ window.__ModuleLoader__.load({
 							body: "{}"
 						} : {}
 					});
-					if (!response.ok) throw new Error("unavailable");
 					const result = await response.json();
 					if (controller.signal.aborted) return;
+					if (!response.ok) {
+						if (result.state === "unreachable") {
+							setInfo(result);
+							return;
+						}
+						throw new Error("unavailable");
+					}
+					if (controller.signal.aborted) return;
 					if (generate) {
 						const url = new URL(result.loginUrl);
 						if (!info?.origin || url.origin !== info.origin || url.protocol !== "https:" || !url.searchParams.get("token")) throw new Error("invalid");
@@ -2632,6 +2639,38 @@ window.__ModuleLoader__.load({
 					window.removeEventListener("pagehide", hide);
 				};
 			}, []);
+			(0, react.useEffect)(() => {
+				if (!login) return;
+				const controller = new AbortController();
+				let checking = false;
+				const poll = setInterval(async () => {
+					if (checking) return;
+					checking = true;
+					try {
+						const response = await fetch(CONNECT_PATH, {
+							credentials: "same-origin",
+							cache: "no-store",
+							signal: controller.signal
+						});
+						if (!response.ok) throw new Error("unavailable");
+						const next = await response.json();
+						if (controller.signal.aborted) return;
+						setInfo(next);
+						if (next.state !== "ready" || next.origin !== new URL(login).origin) hide();
+					} catch {
+						if (!controller.signal.aborted) {
+							hide();
+							setFailed(true);
+						}
+					} finally {
+						checking = false;
+					}
+				}, 15e3);
+				return () => {
+					controller.abort();
+					clearInterval(poll);
+				};
+			}, [login]);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				"data-mobile-connect": true,
 				children: [
@@ -2644,7 +2683,7 @@ window.__ModuleLoader__.load({
 					}),
 					info && info.state !== "ready" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						role: "status",
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t(info.state === "untrusted-origin" ? "connectUntrusted" : info.state === "unsupported" ? "connectUnsupported" : "connectSetup") })
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t(info.state === "unreachable" ? "connectUnreachable" : info.state === "untrusted-origin" ? "connectUntrusted" : info.state === "unsupported" ? "connectUnsupported" : "connectSetup") })
 					}),
 					failed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						role: "alert",
@@ -5844,6 +5883,7 @@ html[data-dsh-mobile] [data-mobile-picker=preset] [data-mobile-picker-divider] {
 			connectStepConfirm: "Scan this code, check the host address, then confirm the connection.",
 			connectPrivacy: "This QR code grants access to this host. Keep it private. Hiding the code does not revoke the official login link; it remains valid until the host process restarts.",
 			connectNetwork: "Keep the computer and its HTTPS entry online. Scanning reconnects the App; it cannot repair a disconnected tunnel.",
+			connectUnreachable: "The public connection is unavailable. Wait for the computer to restore it, then retry to get a new QR code.",
 			connectSetup: "The operator must configure a reachable HTTPS origin using mobile.publicOrigin or DSH_MOBILE_PUBLIC_ORIGIN, and add its hostname to the host trusted hosts.",
 			connectUntrusted: "The configured address is not trusted by this host. Update --trusted-host and restart the host before generating a code.",
 			connectUnsupported: "This host version cannot provide official login links. Update the supported host/plugin combination.",
@@ -5980,6 +6020,7 @@ html[data-dsh-mobile] [data-mobile-picker=preset] [data-mobile-picker-divider] {
 			connectStepConfirm: "扫描二维码，核对主机地址后确认连接。",
 			connectPrivacy: "二维码可授予这台主机的访问权限，请勿分享。隐藏二维码不会撤销官方登录链接；链接在宿主进程重启前仍然有效。",
 			connectNetwork: "请保持电脑和 HTTPS 入口在线。扫码用于重新连接 App，无法修复已经断开的隧道。",
+			connectUnreachable: "公网入口暂不可用。请等待电脑端恢复后重试，获取新的二维码。",
 			connectSetup: "请由部署者通过 mobile.publicOrigin 或 DSH_MOBILE_PUBLIC_ORIGIN 配置手机可达的 HTTPS 地址，并将域名加入宿主信任列表。",
 			connectUntrusted: "宿主尚未信任配置的地址。请更新 --trusted-host 并重启宿主后再生成二维码。",
 			connectUnsupported: "此宿主版本不能提供官方登录链接，请更新到支持的宿主和插件组合。",

package/lib/index.js

@@ -23,6 +23,25 @@ function mobileHandshake() {
 }
 const DIRECTORY_PATH = "/api/mobile/directories";
 //#endregion
+//#region lib/types/reachability.js
+/** Probe only the operator-configured origin, anonymously and without redirects.
+* Official protected roots answer 401; unprotected roots can answer 2xx.
+* A login token must never be used as a connectivity probe. */
+async function publicOriginReachable(origin, request = fetch) {
+	try {
+		const response = await request(`${origin}/`, {
+			method: "GET",
+			redirect: "manual",
+			signal: AbortSignal.timeout(6e3),
+			headers: { "cache-control": "no-cache" }
+		});
+		await response.body?.cancel();
+		return response.status === 401 || response.ok;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region lib/types/connect.js
 const headers = {
 	"cache-control": "no-store",
@@ -65,10 +84,14 @@ function connectInfo(connection, configured) {
 	};
 }
 /** Called only behind the official authenticated Fetch registry. */
-function connectResponse(connection, configured) {
+function connectResponse(connection, configured, reachable = publicOriginReachable) {
 	return async (request) => {
 		const info = connectInfo(connection, configured);
-		if (request.method === "GET") return Response.json(info, { headers });
+		const checked = async () => info.state === "ready" && info.origin && !await reachable(info.origin) ? {
+			...info,
+			state: "unreachable"
+		} : info;
+		if (request.method === "GET") return Response.json(await checked(), { headers });
 		let sameOrigin = false;
 		try {
 			const origin = new URL(request.headers.get("origin") ?? "");
@@ -83,6 +106,11 @@ function connectResponse(connection, configured) {
 			status: 409,
 			headers
 		});
+		const live = await checked();
+		if (live.state !== "ready") return Response.json(live, {
+			status: 503,
+			headers
+		});
 		try {
 			const login = new URL(connection.authenticatedUrl(info.origin));
 			if (login.origin !== info.origin || login.pathname !== "/" || login.username || login.password || login.hash || !login.searchParams.get("token") || [...login.searchParams].length !== 1) throw new Error("unsupported");

package/lib/types/client/ConnectPhone.js

@@ -32,9 +32,16 @@ export function ConnectPhone({ t }) {
         try {
             const response = await fetch(CONNECT_PATH, { method: generate ? 'POST' : 'GET', credentials: 'same-origin', cache: 'no-store', signal: controller.signal,
                 ...(generate ? { headers: { 'content-type': 'application/json' }, body: '{}' } : {}) });
-            if (!response.ok)
-                throw new Error('unavailable');
             const result = await response.json();
+            if (controller.signal.aborted)
+                return;
+            if (!response.ok) {
+                if (result.state === 'unreachable') {
+                    setInfo(result);
+                    return;
+                }
+                throw new Error('unavailable');
+            }
             if (controller.signal.aborted)
                 return;
             if (generate) {
@@ -64,7 +71,39 @@ export function ConnectPhone({ t }) {
         window.addEventListener('pagehide', hide);
         return () => { request.current?.abort(); clearTimeout(timer.current); document.removeEventListener('visibilitychange', conceal); window.removeEventListener('pagehide', hide); };
     }, []);
-    return _jsxs("section", { "data-mobile-connect": true, children: [_jsx("style", { children: styles }), _jsx("h2", { children: t('connectPhone') }), _jsx("p", { children: t('connectIntro') }), info?.origin && _jsxs("div", { "data-connect-host": true, children: [_jsx("span", { children: t('server') }), _jsx("strong", { children: new URL(info.origin).host })] }), info && info.state !== 'ready' && _jsx("div", { role: "status", children: _jsx("p", { children: t(info.state === 'untrusted-origin' ? 'connectUntrusted' : info.state === 'unsupported' ? 'connectUnsupported' : 'connectSetup') }) }), failed && _jsx("p", { role: "alert", children: t('connectError') }), busy && _jsx("p", { role: "status", children: t('connectLoading') }), login ? _jsxs("div", { "data-connect-code": true, children: [_jsx(LoginQR, { value: login, label: t('connectQR') }), _jsx("p", { children: t('connectConceal') }), _jsx("button", { type: "button", onClick: hide, children: t('connectHide') })] })
+    useEffect(() => {
+        if (!login)
+            return;
+        const controller = new AbortController();
+        let checking = false;
+        const poll = setInterval(async () => {
+            if (checking)
+                return;
+            checking = true;
+            try {
+                const response = await fetch(CONNECT_PATH, { credentials: 'same-origin', cache: 'no-store', signal: controller.signal });
+                if (!response.ok)
+                    throw new Error('unavailable');
+                const next = await response.json();
+                if (controller.signal.aborted)
+                    return;
+                setInfo(next);
+                if (next.state !== 'ready' || next.origin !== new URL(login).origin)
+                    hide();
+            }
+            catch {
+                if (!controller.signal.aborted) {
+                    hide();
+                    setFailed(true);
+                }
+            }
+            finally {
+                checking = false;
+            }
+        }, 15_000);
+        return () => { controller.abort(); clearInterval(poll); };
+    }, [login]);
+    return _jsxs("section", { "data-mobile-connect": true, children: [_jsx("style", { children: styles }), _jsx("h2", { children: t('connectPhone') }), _jsx("p", { children: t('connectIntro') }), info?.origin && _jsxs("div", { "data-connect-host": true, children: [_jsx("span", { children: t('server') }), _jsx("strong", { children: new URL(info.origin).host })] }), info && info.state !== 'ready' && _jsx("div", { role: "status", children: _jsx("p", { children: t(info.state === 'unreachable' ? 'connectUnreachable' : info.state === 'untrusted-origin' ? 'connectUntrusted' : info.state === 'unsupported' ? 'connectUnsupported' : 'connectSetup') }) }), failed && _jsx("p", { role: "alert", children: t('connectError') }), busy && _jsx("p", { role: "status", children: t('connectLoading') }), login ? _jsxs("div", { "data-connect-code": true, children: [_jsx(LoginQR, { value: login, label: t('connectQR') }), _jsx("p", { children: t('connectConceal') }), _jsx("button", { type: "button", onClick: hide, children: t('connectHide') })] })
                 : _jsx("button", { type: "button", disabled: busy, onClick: () => { void load(info?.state === 'ready'); }, children: t(info?.state === 'ready' ? 'connectGenerate' : 'directoryRetry') }), _jsxs("ol", { children: [_jsx("li", { children: t('connectStepOpen') }), _jsx("li", { children: t('connectStepScan') }), _jsx("li", { children: t('connectStepConfirm') })] }), _jsx("p", { "data-connect-note": true, children: t('connectPrivacy') }), _jsx("p", { "data-connect-note": true, children: t('connectNetwork') })] });
 }
 const styles = `

package/lib/types/client/locales.d.ts

@@ -12,6 +12,7 @@ export declare const en: {
     readonly connectStepConfirm: "Scan this code, check the host address, then confirm the connection.";
     readonly connectPrivacy: "This QR code grants access to this host. Keep it private. Hiding the code does not revoke the official login link; it remains valid until the host process restarts.";
     readonly connectNetwork: "Keep the computer and its HTTPS entry online. Scanning reconnects the App; it cannot repair a disconnected tunnel.";
+    readonly connectUnreachable: "The public connection is unavailable. Wait for the computer to restore it, then retry to get a new QR code.";
     readonly connectSetup: "The operator must configure a reachable HTTPS origin using mobile.publicOrigin or DSH_MOBILE_PUBLIC_ORIGIN, and add its hostname to the host trusted hosts.";
     readonly connectUntrusted: "The configured address is not trusted by this host. Update --trusted-host and restart the host before generating a code.";
     readonly connectUnsupported: "This host version cannot provide official login links. Update the supported host/plugin combination.";

package/lib/types/client/locales.js

@@ -12,6 +12,7 @@ export const en = {
     connectStepConfirm: "Scan this code, check the host address, then confirm the connection.",
     connectPrivacy: "This QR code grants access to this host. Keep it private. Hiding the code does not revoke the official login link; it remains valid until the host process restarts.",
     connectNetwork: "Keep the computer and its HTTPS entry online. Scanning reconnects the App; it cannot repair a disconnected tunnel.",
+    connectUnreachable: "The public connection is unavailable. Wait for the computer to restore it, then retry to get a new QR code.",
     connectSetup: "The operator must configure a reachable HTTPS origin using mobile.publicOrigin or DSH_MOBILE_PUBLIC_ORIGIN, and add its hostname to the host trusted hosts.",
     connectUntrusted: "The configured address is not trusted by this host. Update --trusted-host and restart the host before generating a code.",
     connectUnsupported: "This host version cannot provide official login links. Update the supported host/plugin combination.",
@@ -51,6 +52,7 @@ export const zh = {
     connectStepConfirm: "扫描二维码，核对主机地址后确认连接。",
     connectPrivacy: "二维码可授予这台主机的访问权限，请勿分享。隐藏二维码不会撤销官方登录链接；链接在宿主进程重启前仍然有效。",
     connectNetwork: "请保持电脑和 HTTPS 入口在线。扫码用于重新连接 App，无法修复已经断开的隧道。",
+    connectUnreachable: "公网入口暂不可用。请等待电脑端恢复后重试，获取新的二维码。",
     connectSetup: "请由部署者通过 mobile.publicOrigin 或 DSH_MOBILE_PUBLIC_ORIGIN 配置手机可达的 HTTPS 地址，并将域名加入宿主信任列表。",
     connectUntrusted: "宿主尚未信任配置的地址。请更新 --trusted-host 并重启宿主后再生成二维码。",
     connectUnsupported: "此宿主版本不能提供官方登录链接，请更新到支持的宿主和插件组合。",

package/lib/types/connect.d.ts

@@ -3,5 +3,5 @@ import type { MobileConnectInfo } from './protocol.ts';
 /** Deployment-owned destination only: a browser cannot choose where a bearer is sent. */
 export declare function connectInfo(connection: HostConnectionHandle, configured?: string): MobileConnectInfo;
 /** Called only behind the official authenticated Fetch registry. */
-export declare function connectResponse(connection: HostConnectionHandle, configured?: string): (request: Request) => Promise<Response>;
+export declare function connectResponse(connection: HostConnectionHandle, configured?: string, reachable?: (origin: string) => Promise<boolean>): (request: Request) => Promise<Response>;
 //# sourceMappingURL=connect.d.ts.map

package/lib/types/connect.js

@@ -1,3 +1,4 @@
+import { publicOriginReachable } from './reachability.js';
 const headers = { 'cache-control': 'no-store', 'referrer-policy': 'no-referrer' };
 /** Deployment-owned destination only: a browser cannot choose where a bearer is sent. */
 export function connectInfo(connection, configured) {
@@ -24,11 +25,13 @@ export function connectInfo(connection, configured) {
     return { state: 'ready', origin: url.origin };
 }
 /** Called only behind the official authenticated Fetch registry. */
-export function connectResponse(connection, configured) {
+export function connectResponse(connection, configured, reachable = publicOriginReachable) {
     return async (request) => {
         const info = connectInfo(connection, configured);
+        const checked = async () => info.state === 'ready' && info.origin && !await reachable(info.origin)
+            ? { ...info, state: 'unreachable' } : info;
         if (request.method === 'GET')
-            return Response.json(info, { headers });
+            return Response.json(await checked(), { headers });
         // Explicit same-origin action; a navigation/form must never reveal a login URL.
         // The official HTTP bridge uses an internal Request URL. Compare the
         // preserved Host/Origin headers, as the official trust fence does, so an
@@ -46,6 +49,9 @@ export function connectResponse(connection, configured) {
         }
         if (info.state !== 'ready' || !info.origin)
             return Response.json(info, { status: 409, headers });
+        const live = await checked();
+        if (live.state !== 'ready')
+            return Response.json(live, { status: 503, headers });
         try {
             const login = new URL(connection.authenticatedUrl(info.origin));
             if (login.origin !== info.origin || login.pathname !== '/' || login.username || login.password || login.hash

package/lib/types/protocol.d.ts

@@ -4,7 +4,7 @@ export declare const BRIDGE_VERSION = 1;
 export declare const HANDSHAKE_PATH = "/api/mobile/handshake";
 export declare const CONNECT_PATH = "/api/mobile/connect";
 export interface MobileConnectInfo {
-    state: 'ready' | 'not-configured' | 'invalid-origin' | 'untrusted-origin' | 'unsupported';
+    state: 'ready' | 'not-configured' | 'invalid-origin' | 'untrusted-origin' | 'unsupported' | 'unreachable';
     origin: string | null;
 }
 /** Read-only feature discovery; this does not create a login or grant access. */

package/lib/types/reachability.d.ts

@@ -0,0 +1,5 @@
+/** Probe only the operator-configured origin, anonymously and without redirects.
+ * Official protected roots answer 401; unprotected roots can answer 2xx.
+ * A login token must never be used as a connectivity probe. */
+export declare function publicOriginReachable(origin: string, request?: typeof fetch): Promise<boolean>;
+//# sourceMappingURL=reachability.d.ts.map

package/lib/types/reachability.js

@@ -0,0 +1,14 @@
+/** Probe only the operator-configured origin, anonymously and without redirects.
+ * Official protected roots answer 401; unprotected roots can answer 2xx.
+ * A login token must never be used as a connectivity probe. */
+export async function publicOriginReachable(origin, request = fetch) {
+    try {
+        const response = await request(`${origin}/`, { method: 'GET', redirect: 'manual', signal: AbortSignal.timeout(6000),
+            headers: { 'cache-control': 'no-cache' } });
+        await response.body?.cancel();
+        return response.status === 401 || response.ok;
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khorsheed/dsh-mobile",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Removable mobile presentation and iOS bridge for DeepSeek Harness.",
   "type": "module",
   "license": "MIT",