@linxin666/dsh-remote-web-ui 0.1.16 → 0.1.17

package/lib/index.js

@@ -981,6 +981,10 @@ function makeRoutes(deps) {
 function mobileBundlePath() {
 	return fileURLToPath(new URL("../lib/mobile.js", import.meta.url));
 }
+/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
+function appleTouchIconPath() {
+	return fileURLToPath(new URL("../assets/apple-touch-icon.png", import.meta.url));
+}
 /** The mobile page shell: minimal, offline-safe, no external assets. */
 function pageHtml(bundleUrl) {
 	return [
@@ -991,6 +995,7 @@ function pageHtml(bundleUrl) {
 		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover\">",
 		"<meta name=\"theme-color\" content=\"#f3f5f9\">",
 		"<meta name=\"referrer\" content=\"no-referrer\">",
+		"<link rel=\"apple-touch-icon\" href=\"/m/apple-touch-icon.png\">",
 		"<title>移动端远程控制</title>",
 		"</head>",
 		"<body>",
@@ -1009,6 +1014,15 @@ function writeStatic(res, status, type, body) {
 	});
 	res.end(body);
 }
+/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+function writePng(res, status, body) {
+	res.writeHead(status, {
+		"content-type": "image/png",
+		"cache-control": "public, max-age=31536000, immutable",
+		"referrer-policy": "no-referrer"
+	});
+	res.end(body);
+}
 /**
 * Build the mobile page routes.
 * @returns the two exact routes to register on webServer.
@@ -1029,15 +1043,35 @@ function makeMobileRoutes() {
 			writeStatic(res, 500, "text/plain", "failed to read the mobile bundle");
 		}
 	};
-	return [{
-		kind: "exact",
-		path: "/m",
-		handler: handlePage
-	}, {
-		kind: "exact",
-		path: "/m/mobile.js",
-		handler: handleBundle
-	}];
+	const handleIcon = async (_req, res) => {
+		const path = appleTouchIconPath();
+		if (!existsSync(path)) {
+			writeStatic(res, 404, "text/plain", "apple-touch-icon not found");
+			return;
+		}
+		try {
+			writePng(res, 200, await readFile(path));
+		} catch {
+			writeStatic(res, 500, "text/plain", "failed to read the apple-touch-icon");
+		}
+	};
+	return [
+		{
+			kind: "exact",
+			path: "/m",
+			handler: handlePage
+		},
+		{
+			kind: "exact",
+			path: "/m/mobile.js",
+			handler: handleBundle
+		},
+		{
+			kind: "exact",
+			path: "/m/apple-touch-icon.png",
+			handler: handleIcon
+		}
+	];
 }
 //#endregion
 //#region src/mobile-api.ts
@@ -1096,10 +1130,22 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 function makeMobileApiRoutes(deps) {
 	const { service, apiProxy, mobileEnterToSend } = deps;
 	const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
+	/**
+	* Refresh the paired device's presence and report whether it is live.
+	* The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
+	* sender, so any activity on the mobile channel — a gated RPC, or the live
+	* SSE stream staying open — must count as presence. Without this, an
+	* idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
+	* wrongly reports it as disconnected.
+	*/
+	const touchDeviceFor = (req) => {
+		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+		if (deviceId === void 0) return false;
+		return service.touchDevice(deviceId);
+	};
 	/** The phone gate: a live paired-device cookie, or nothing else proceeds. */
 	const gateOk = (req) => {
-		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-		return deviceId !== void 0 && service.hasDevice(deviceId);
+		return touchDeviceFor(req);
 	};
 	const writeJson = (res, status, body) => {
 		res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
@@ -1219,6 +1265,7 @@ function makeMobileApiRoutes(deps) {
 		let closed = false;
 		const heartbeat = setInterval(() => {
 			if (closed) return;
+			touchDeviceFor(req);
 			try {
 				res.write(": ping\n\n");
 			} catch {}
@@ -1787,6 +1834,16 @@ const OUTPUT_CAP = 16 * 1024;
 */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
 /**
+* Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
+* silently skips same-day releases — `pnpm update --latest` then exits 0
+* without moving anything and the post-run verification would misreport a
+* stale no-op. The update here is explicitly user-initiated and the panel
+* shows exactly which versions are being installed, so the gate only adds a
+* confusing silent no-op; override it per-invocation instead of asking every
+* user to edit the profile's pnpm-workspace.yaml.
+*/
+const MIN_RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
+/**
 * Run the update inside the profile directory. Tries pnpm first, falls back
 * to corepack and then npx when the previous command is missing (ENOENT);
 * all candidates share one hard timeout and keep accumulating output.
@@ -1813,6 +1870,7 @@ function runUpdate(deps) {
 				args: [
 					"update",
 					"--latest",
+					MIN_RELEASE_AGE_OVERRIDE,
 					...packages
 				]
 			},
@@ -1822,6 +1880,7 @@ function runUpdate(deps) {
 					"pnpm",
 					"update",
 					"--latest",
+					MIN_RELEASE_AGE_OVERRIDE,
 					...packages
 				]
 			},
@@ -1832,6 +1891,7 @@ function runUpdate(deps) {
 					"pnpm",
 					"update",
 					"--latest",
+					MIN_RELEASE_AGE_OVERRIDE,
 					...packages
 				]
 			}
@@ -1930,9 +1990,11 @@ function runUpdate(deps) {
 }
 /**
 * Run the update, then verify the installed versions actually moved. pnpm
-* exits 0 even when it silently kept the installed versions — the pnpm 11
-* `minimumReleaseAge` gate refuses same-day releases by default — so a green
-* exit alone would report a misleading "update complete". Re-read the
+* exits 0 even when it silently kept the installed versions — runUpdate
+* overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+* `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+* another silent no-op can still keep versions in place — so a green exit
+* alone must not report a misleading "update complete". Re-read the
 * installed versions afterwards and surface a `stale` failure (with the
 * captured pnpm output) when nothing moved, so the panel can tell the user
 * how to unblock the gate instead of claiming success.

package/lib/types/mobile-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA4HnE"}
+{"version":3,"file":"mobile-api.d.ts","sourceRoot":"","sources":["../../src/mobile-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAgDlD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,0DAA0D;IAC1D,QAAQ,EAAE,QAAQ,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,OAAO,CAAA;IAChC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,8BAA8B;AAC9B,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAOV;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA6InE"}

package/lib/types/mobile-api.js

@@ -77,10 +77,23 @@ const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
 export function makeMobileApiRoutes(deps) {
     const { service, apiProxy, mobileEnterToSend } = deps;
     const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
+    /**
+     * Refresh the paired device's presence and report whether it is live.
+     * The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
+     * sender, so any activity on the mobile channel — a gated RPC, or the live
+     * SSE stream staying open — must count as presence. Without this, an
+     * idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
+     * wrongly reports it as disconnected.
+     */
+    const touchDeviceFor = (req) => {
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined)
+            return false;
+        return service.touchDevice(deviceId);
+    };
     /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
     const gateOk = (req) => {
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        return deviceId !== undefined && service.hasDevice(deviceId);
+        return touchDeviceFor(req);
     };
     const writeJson = (res, status, body) => {
         res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
@@ -164,6 +177,10 @@ export function makeMobileApiRoutes(deps) {
         const heartbeat = setInterval(() => {
             if (closed)
                 return;
+            // An open SSE stream proves the phone is still live even while the agent
+            // idles (no RPC traffic), so refresh presence alongside the transport
+            // keepalive — otherwise an idle phone drifts to "disconnected".
+            touchDeviceFor(req);
             try {
                 res.write(': ping\n\n');
             }

package/lib/types/mobile-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAqC/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAqB7C"}
+{"version":3,"file":"mobile-routes.d.ts","sourceRoot":"","sources":["../../src/mobile-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAwD/D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,QAAQ,EAAE,CAmC7C"}

package/lib/types/mobile-routes.js

@@ -14,6 +14,10 @@ import { fileURLToPath } from 'node:url';
 function mobileBundlePath() {
     return fileURLToPath(new URL('../lib/mobile.js', import.meta.url));
 }
+/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
+function appleTouchIconPath() {
+    return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url));
+}
 /** The mobile page shell: minimal, offline-safe, no external assets. */
 function pageHtml(bundleUrl) {
     return [
@@ -24,6 +28,10 @@ function pageHtml(bundleUrl) {
         '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
         '<meta name="theme-color" content="#f3f5f9">',
         '<meta name="referrer" content="no-referrer">',
+        // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
+        // the PNG ships with the package (opaque background — iOS composites
+        // transparency onto black, so the icon avoids transparent regions).
+        '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
         '<title>移动端远程控制</title>',
         '</head>',
         '<body>',
@@ -42,6 +50,15 @@ function writeStatic(res, status, type, body) {
     });
     res.end(body);
 }
+/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+function writePng(res, status, body) {
+    res.writeHead(status, {
+        'content-type': 'image/png',
+        'cache-control': 'public, max-age=31536000, immutable',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(body);
+}
 /**
  * Build the mobile page routes.
  * @returns the two exact routes to register on webServer.
@@ -64,8 +81,23 @@ export function makeMobileRoutes() {
             writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
         }
     };
+    const handleIcon = async (_req, res) => {
+        const path = appleTouchIconPath();
+        if (!existsSync(path)) {
+            writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found');
+            return;
+        }
+        try {
+            const body = await readFile(path);
+            writePng(res, 200, body);
+        }
+        catch {
+            writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon');
+        }
+    };
     return [
         { kind: 'exact', path: '/m', handler: handlePage },
         { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
+        { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
     ];
 }

package/lib/types/update.d.ts

@@ -206,9 +206,11 @@ export interface UpdateRunVerifiedDeps {
 }
 /**
  * Run the update, then verify the installed versions actually moved. pnpm
- * exits 0 even when it silently kept the installed versions — the pnpm 11
- * `minimumReleaseAge` gate refuses same-day releases by default — so a green
- * exit alone would report a misleading "update complete". Re-read the
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
  * installed versions afterwards and surface a `stale` failure (with the
  * captured pnpm output) when nothing moved, so the panel can tell the user
  * how to unblock the gate instead of claiming success.

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAqBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAYD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA0HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,oEAAoE;AACpE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,8BAA8B,CAAA;AAE5D,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAQ1D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAED,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CACvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAiBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAC9E,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAqBD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgD/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;CAC3B;AAuBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CA8HvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}

package/lib/types/update.js

@@ -302,6 +302,16 @@ const OUTPUT_CAP = 16 * 1024;
  * detects this message instead of the spawn error event.
  */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i;
+/**
+ * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
+ * silently skips same-day releases — `pnpm update --latest` then exits 0
+ * without moving anything and the post-run verification would misreport a
+ * stale no-op. The update here is explicitly user-initiated and the panel
+ * shows exactly which versions are being installed, so the gate only adds a
+ * confusing silent no-op; override it per-invocation instead of asking every
+ * user to edit the profile's pnpm-workspace.yaml.
+ */
+const MIN_RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0';
 /**
  * Run the update inside the profile directory. Tries pnpm first, falls back
  * to corepack and then npx when the previous command is missing (ENOENT);
@@ -328,10 +338,14 @@ export function runUpdate(deps) {
         // "0.1.12" without a range), and plain `pnpm update` treats an exact spec
         // as pinned — it prints "Already up to date" and exits 0 without moving
         // the installed version, so the panel would report a false success.
+        // `MIN_RELEASE_AGE_OVERRIDE` rides along every candidate: without it the
+        // pnpm 11 minimumReleaseAge gate (default 24 h) silently keeps same-day
+        // releases in place, which the post-run verification would then have to
+        // surface as `stale` even though the update is legitimate.
         const candidates = [
-            { command: 'pnpm', args: ['update', '--latest', ...packages] },
-            { command: 'corepack', args: ['pnpm', 'update', '--latest', ...packages] },
-            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', ...packages] },
+            { command: 'pnpm', args: ['update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'corepack', args: ['pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+            { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
         ];
         // `output` accumulates across candidates for UI display; `currentOutput`
         // is reset per candidate and carries only that candidate's own diagnostics
@@ -444,9 +458,11 @@ export function runUpdate(deps) {
 }
 /**
  * Run the update, then verify the installed versions actually moved. pnpm
- * exits 0 even when it silently kept the installed versions — the pnpm 11
- * `minimumReleaseAge` gate refuses same-day releases by default — so a green
- * exit alone would report a misleading "update complete". Re-read the
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
  * installed versions afterwards and surface a `stale` failure (with the
  * captured pnpm output) when nothing moved, so the panel can tell the user
  * how to unblock the gate instead of claiming success.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -30,6 +30,7 @@
     "lib/**/*.d.ts",
     "lib/**/*.d.ts.map",
     "src",
+    "assets",
     "cordis.patch.yml"
   ],
   "license": "Apache-2.0",

package/src/mobile-api.ts

@@ -103,10 +103,23 @@ export function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[] {
   const { service, apiProxy, mobileEnterToSend } = deps
   const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS
 
+  /**
+   * Refresh the paired device's presence and report whether it is live.
+   * The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
+   * sender, so any activity on the mobile channel — a gated RPC, or the live
+   * SSE stream staying open — must count as presence. Without this, an
+   * idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
+   * wrongly reports it as disconnected.
+   */
+  const touchDeviceFor = (req: IncomingMessage): boolean => {
+    const deviceId = readCookie(req.headers.cookie, service.config.cookieName)
+    if (deviceId === undefined) return false
+    return service.touchDevice(deviceId)
+  }
+
   /** The phone gate: a live paired-device cookie, or nothing else proceeds. */
   const gateOk = (req: IncomingMessage): boolean => {
-    const deviceId = readCookie(req.headers.cookie, service.config.cookieName)
-    return deviceId !== undefined && service.hasDevice(deviceId)
+    return touchDeviceFor(req)
   }
 
   const writeJson = (res: ServerResponse, status: number, body: unknown): void => {
@@ -190,6 +203,10 @@ export function makeMobileApiRoutes(deps: MobileApiDeps): WebRoute[] {
     let closed = false
     const heartbeat = setInterval(() => {
       if (closed) return
+      // An open SSE stream proves the phone is still live even while the agent
+      // idles (no RPC traffic), so refresh presence alongside the transport
+      // keepalive — otherwise an idle phone drifts to "disconnected".
+      touchDeviceFor(req)
       try {
         res.write(': ping\n\n')
       } catch {

package/src/mobile-routes.ts

@@ -19,6 +19,11 @@ function mobileBundlePath(): string {
   return fileURLToPath(new URL('../lib/mobile.js', import.meta.url))
 }
 
+/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
+function appleTouchIconPath(): string {
+  return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url))
+}
+
 /** The mobile page shell: minimal, offline-safe, no external assets. */
 function pageHtml(bundleUrl: string): string {
   return [
@@ -29,6 +34,10 @@ function pageHtml(bundleUrl: string): string {
     '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
     '<meta name="theme-color" content="#f3f5f9">',
     '<meta name="referrer" content="no-referrer">',
+    // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
+    // the PNG ships with the package (opaque background — iOS composites
+    // transparency onto black, so the icon avoids transparent regions).
+    '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
     '<title>移动端远程控制</title>',
     '</head>',
     '<body>',
@@ -49,6 +58,16 @@ function writeStatic(res: ServerResponse, status: number, type: string, body: st
   res.end(body)
 }
 
+/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+function writePng(res: ServerResponse, status: number, body: Buffer): void {
+  res.writeHead(status, {
+    'content-type': 'image/png',
+    'cache-control': 'public, max-age=31536000, immutable',
+    'referrer-policy': 'no-referrer',
+  })
+  res.end(body)
+}
+
 /**
  * Build the mobile page routes.
  * @returns the two exact routes to register on webServer.
@@ -70,8 +89,22 @@ export function makeMobileRoutes(): WebRoute[] {
       writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle')
     }
   }
+  const handleIcon = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    const path = appleTouchIconPath()
+    if (!existsSync(path)) {
+      writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found')
+      return
+    }
+    try {
+      const body = await readFile(path)
+      writePng(res, 200, body)
+    } catch {
+      writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon')
+    }
+  }
   return [
     { kind: 'exact', path: '/m', handler: handlePage },
     { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
+    { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
   ]
 }

package/src/update.ts

@@ -412,6 +412,17 @@ const OUTPUT_CAP = 16 * 1024
  */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command/i
 
+/**
+ * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
+ * silently skips same-day releases — `pnpm update --latest` then exits 0
+ * without moving anything and the post-run verification would misreport a
+ * stale no-op. The update here is explicitly user-initiated and the panel
+ * shows exactly which versions are being installed, so the gate only adds a
+ * confusing silent no-op; override it per-invocation instead of asking every
+ * user to edit the profile's pnpm-workspace.yaml.
+ */
+const MIN_RELEASE_AGE_OVERRIDE = '--config.minimumReleaseAge=0'
+
 /**
  * Run the update inside the profile directory. Tries pnpm first, falls back
  * to corepack and then npx when the previous command is missing (ENOENT);
@@ -438,10 +449,14 @@ export function runUpdate(deps: UpdateRunDeps): Promise<UpdateRunResult> {
     // "0.1.12" without a range), and plain `pnpm update` treats an exact spec
     // as pinned — it prints "Already up to date" and exits 0 without moving
     // the installed version, so the panel would report a false success.
+    // `MIN_RELEASE_AGE_OVERRIDE` rides along every candidate: without it the
+    // pnpm 11 minimumReleaseAge gate (default 24 h) silently keeps same-day
+    // releases in place, which the post-run verification would then have to
+    // surface as `stale` even though the update is legitimate.
     const candidates: ReadonlyArray<{ command: string; args: string[] }> = [
-      { command: 'pnpm', args: ['update', '--latest', ...packages] },
-      { command: 'corepack', args: ['pnpm', 'update', '--latest', ...packages] },
-      { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', ...packages] },
+      { command: 'pnpm', args: ['update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+      { command: 'corepack', args: ['pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
+      { command: 'npx', args: ['--yes', 'pnpm', 'update', '--latest', MIN_RELEASE_AGE_OVERRIDE, ...packages] },
     ]
     // `output` accumulates across candidates for UI display; `currentOutput`
     // is reset per candidate and carries only that candidate's own diagnostics
@@ -553,9 +568,11 @@ export interface UpdateRunVerifiedDeps {
 
 /**
  * Run the update, then verify the installed versions actually moved. pnpm
- * exits 0 even when it silently kept the installed versions — the pnpm 11
- * `minimumReleaseAge` gate refuses same-day releases by default — so a green
- * exit alone would report a misleading "update complete". Re-read the
+ * exits 0 even when it silently kept the installed versions — runUpdate
+ * overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
+ * `--config.minimumReleaseAge=0`, but an older pnpm without the override or
+ * another silent no-op can still keep versions in place — so a green exit
+ * alone must not report a misleading "update complete". Re-read the
  * installed versions afterwards and surface a `stale` failure (with the
  * captured pnpm output) when nothing moved, so the panel can tell the user
  * how to unblock the gate instead of claiming success.