@linxin666/dsh-remote-web-ui 0.1.19 → 0.2.0

package/lib/index.js

@@ -3,16 +3,16 @@ import { setInterval as setInterval$1 } from "node:timers";
 import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { z as z$1 } from "zod";
 import { readFile } from "node:fs/promises";
-import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { RpcId } from "@deepseek-ai/dsh-host-apiproxy/api/rpc";
 import { networkInterfaces } from "node:os";
 import { Tunnel, bin, install } from "cloudflared";
-import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@0.1.0-rc.6_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-brand@0_52495af71738a1095726249ceff4fd7b/node_modules/@deepseek-ai/dsh-settings/lib/index.js
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@0.1.0-rc.7_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-brand@0_6b0eb868fb92d854799855c05c5fa43c/node_modules/@deepseek-ai/dsh-settings/lib/index.js
 /**
 * Structural secret redaction for settings values. `role('secret')` fields are
 * removed from a value before it crosses a wire boundary; a sidecar records
@@ -271,6 +271,61 @@ var PairingService = class {
 	constructor(config, clock = defaultClock) {
 		this.config = config;
 		this.clock = clock;
+		this.loadPersisted();
+	}
+	/**
+	* Restore device sessions persisted by a previous process run. A corrupt
+	* or missing file is tolerated (an empty device table, never a throw) —
+	* persistence is an availability convenience, not a security boundary.
+	*/
+	loadPersisted() {
+		const file = this.config.devicesFile;
+		if (file === void 0) return;
+		try {
+			const saved = JSON.parse(readFileSync(file, "utf8"));
+			if (typeof saved !== "object" || saved === null) return;
+			for (const [deviceId, session] of Object.entries(saved)) {
+				if (typeof deviceId !== "string") continue;
+				if (typeof session !== "object" || session === null) continue;
+				const { createdAt, lastSeenAt } = session;
+				if (typeof createdAt !== "number" || typeof lastSeenAt !== "number") continue;
+				this.devices.set(deviceId, {
+					createdAt,
+					lastSeenAt
+				});
+			}
+			this.clampToMaxDevices();
+		} catch {}
+	}
+	/** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+	clampToMaxDevices() {
+		if (this.devices.size <= this.config.maxDevices) return;
+		const overflow = this.devices.size - this.config.maxDevices;
+		const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+		for (const [id] of ordered.slice(0, overflow)) this.devices.delete(id);
+	}
+	/**
+	* Write the current device table to the configured file. Called on the
+	* mutation boundaries that change the set of live sessions (accept and
+	* stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+	* per-request write storm is avoided — after a restart the phone's first
+	* heartbeat re-warms its own session.
+	*
+	* Device ids are session credentials (the gate authorizes requests by the
+	* cookie's device id), so the file is written 0600 via a temp file and
+	* atomic rename; a crash mid-write can never leave a half-written store.
+	*/
+	persist() {
+		const file = this.config.devicesFile;
+		if (file === void 0) return;
+		try {
+			mkdirSync(dirname(file), { recursive: true });
+			const temp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+			writeFileSync(temp, JSON.stringify(Object.fromEntries(this.devices)), { mode: 384 });
+			renameSync(temp, file);
+		} catch (error) {
+			console.error("remote-web-ui: failed to persist paired devices", error);
+		}
 	}
 	/** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
 	get lanBaseUrl() {
@@ -365,6 +420,7 @@ var PairingService = class {
 			createdAt: now,
 			lastSeenAt: now
 		});
+		this.persist();
 		this.notify();
 		return {
 			ok: true,
@@ -379,6 +435,7 @@ var PairingService = class {
 	stop() {
 		this.tokens.clear();
 		this.devices.clear();
+		this.persist();
 		this.stopped = true;
 		this.notify();
 	}
@@ -566,11 +623,75 @@ function makeGateListener(service, requirePairingForLan = true, enabled = true)
 		if (isLoopbackClient(request)) return next();
 		if (!(typeof enabled === "function" ? enabled() : enabled)) return false;
 		if (!(typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan)) return next();
-		const deviceId = readCookie(request.headers.cookie, service.config.cookieName);
-		if (deviceId === void 0) return false;
-		return service.touchDevice(deviceId) ? next() : false;
+		return isPairedDeviceRequest(service, request) ? next() : false;
 	};
 }
+/**
+* Whether a request carries a live, non-revoked paired-device cookie for
+* this service. Sibling host routes outside /api (aionui-panel, etc.) use
+* the same check via the remoteWebUiPairing service.
+* @param service - the pairing service that owns the device table.
+* @param request - the incoming HTTP request.
+* @returns true when the cookie names a live session (and lastSeenAt was refreshed).
+*/
+function isPairedDeviceRequest(service, request) {
+	const deviceId = readCookie(request.headers.cookie, service.config.cookieName);
+	if (deviceId === void 0) return false;
+	return service.touchDevice(deviceId);
+}
+//#endregion
+//#region src/pairing-access.ts
+/** Named lookup key sibling plugins pass to ctx.get. */
+const REMOTE_WEB_UI_PAIRING = "remoteWebUiPairing";
+/**
+* Pairing identity for one HTTP request. Structural: consumers must not
+* import this class, only the method shape.
+*/
+var RemoteWebUiPairing = class extends Service {
+	check;
+	/**
+	* @param ctx - host plugin context.
+	* @param check - live cookie + session predicate (re-read per request).
+	*/
+	constructor(ctx, check) {
+		super(ctx, REMOTE_WEB_UI_PAIRING);
+		this.check = check;
+	}
+	/**
+	* Whether the request carries a live paired-device cookie.
+	* @param request - the incoming HTTP request.
+	* @returns true when the session is live and was refreshed.
+	*/
+	isPairedDevice(request) {
+		return this.check(request);
+	}
+};
+//#endregion
+//#region src/http.ts
+/** One JSON response. */
+function writeJson(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"referrer-policy": "no-referrer"
+	});
+	res.end(payload);
+}
+/**
+* Read a request body up to maxBytes and parse it as JSON.
+* @throws 'body too large' beyond the cap, or the JSON.parse error.
+*/
+async function readBoundedJson(req, maxBytes) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buffer = chunk;
+		size += buffer.length;
+		if (size > maxBytes) throw new Error("body too large");
+		chunks.push(buffer);
+	}
+	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
 //#endregion
 //#region src/routes.ts
 /**
@@ -663,27 +784,10 @@ function parsePairPayload(schema, body) {
 	const result = schema.safeParse(body ?? {});
 	return result.success ? result.data : void 0;
 }
-/** One JSON response. */
-function writeJson$1(res, status, body) {
-	const payload = JSON.stringify(body);
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		"referrer-policy": "no-referrer"
-	});
-	res.end(payload);
-}
-/** Read a request body up to MAX_BODY_BYTES and parse it as JSON. */
+/** Read a request body up to MAX_BODY_BYTES and parse it as JSON (undefined on failure). */
 async function readJsonBody$1(req) {
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = chunk;
-		size += buffer.length;
-		if (size > MAX_BODY_BYTES) return void 0;
-		chunks.push(buffer);
-	}
 	try {
-		const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		const parsed = await readBoundedJson(req, MAX_BODY_BYTES);
 		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
 	} catch {
 		return;
@@ -766,6 +870,9 @@ function makeRoutes(deps) {
 	const rateLimitAccept = (req) => {
 		const ip = req.socket?.remoteAddress ?? "unknown";
 		const nowMs = Date.now();
+		if (acceptAttempts.size > 256) {
+			for (const [key, attempt] of acceptAttempts) if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key);
+		}
 		const entry = acceptAttempts.get(ip);
 		if (entry === void 0 || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
 			acceptAttempts.set(ip, {
@@ -780,7 +887,7 @@ function makeRoutes(deps) {
 	const handleIssue = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
 		if (!loopbackFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
@@ -789,7 +896,7 @@ function makeRoutes(deps) {
 		const body = await readJsonBody$1(req);
 		const payload = parsePairPayload(issuePayloadSchema, body);
 		if (payload === void 0) {
-			writeJson$1(res, 400, {
+			writeJson(res, 400, {
 				ok: false,
 				code: "bad-payload"
 			});
@@ -800,9 +907,9 @@ function makeRoutes(deps) {
 			const { token, expiresAt } = service.issue(workspaceId, address);
 			const base = address === void 0 ? service.publicBaseUrl ?? service.lanBaseUrl : service.lanBaseUrlFor(address);
 			if (base === void 0) throw new Error("remote-web-ui: base unavailable");
-			writeJson$1(res, 200, {
+			writeJson(res, 200, {
 				ok: true,
-				url: `${base}/?pair=${token}${workspaceId === void 0 ? "" : `&workspace=${encodeURIComponent(workspaceId)}`}`,
+				url: `${base}/m/?pair=${token}${workspaceId === void 0 ? "" : `&workspace=${encodeURIComponent(workspaceId)}`}`,
 				token,
 				expiresAt,
 				lanAddresses: service.lanAddresses,
@@ -810,7 +917,7 @@ function makeRoutes(deps) {
 			});
 		} catch (error) {
 			const unknownAddress = error instanceof UnknownLanAddressError;
-			writeJson$1(res, unknownAddress ? 400 : 409, {
+			writeJson(res, unknownAddress ? 400 : 409, {
 				ok: false,
 				code: unknownAddress ? "unknown-address" : "lan-required"
 			});
@@ -819,14 +926,14 @@ function makeRoutes(deps) {
 	const handleAccept = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
 		if (!lanFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
 			return;
 		}
 		if (rateLimitAccept(req)) {
-			writeJson$1(res, 429, {
+			writeJson(res, 429, {
 				ok: false,
 				code: "rate-limited"
 			});
@@ -835,7 +942,7 @@ function makeRoutes(deps) {
 		const body = await readJsonBody$1(req);
 		const payload = parsePairPayload(acceptPayloadSchema, body);
 		if (payload === void 0) {
-			writeJson$1(res, 400, {
+			writeJson(res, 400, {
 				ok: false,
 				code: "bad-payload"
 			});
@@ -843,7 +950,7 @@ function makeRoutes(deps) {
 		}
 		const result = service.accept(payload.token);
 		if (!result.ok) {
-			writeJson$1(res, result.code === "used" ? 409 : 404, {
+			writeJson(res, result.code === "used" ? 409 : 404, {
 				ok: false,
 				code: result.code
 			});
@@ -861,7 +968,7 @@ function makeRoutes(deps) {
 	const handleStop = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
 		if (!loopbackFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
@@ -869,19 +976,19 @@ function makeRoutes(deps) {
 		}
 		const body = await readJsonBody$1(req);
 		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
-			writeJson$1(res, 400, {
+			writeJson(res, 400, {
 				ok: false,
 				code: "bad-payload"
 			});
 			return;
 		}
 		service.stop();
-		writeJson$1(res, 200, { ok: true });
+		writeJson(res, 200, { ok: true });
 	};
 	const handleHeartbeat = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
 		if (!lanFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
@@ -889,7 +996,7 @@ function makeRoutes(deps) {
 		}
 		const body = await readJsonBody$1(req);
 		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
-			writeJson$1(res, 400, {
+			writeJson(res, 400, {
 				ok: false,
 				code: "bad-payload"
 			});
@@ -897,25 +1004,25 @@ function makeRoutes(deps) {
 		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 		if (deviceId === void 0 || !service.heartbeat(deviceId)) {
-			writeJson$1(res, 401, {
+			writeJson(res, 401, {
 				ok: false,
 				code: "unpaired"
 			});
 			return;
 		}
-		writeJson$1(res, 200, { ok: true });
+		writeJson(res, 200, { ok: true });
 	};
 	const handleStatus = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
 		if (!lanFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
 			return;
 		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-		writeJson$1(res, 200, {
+		writeJson(res, 200, {
 			ok: true,
 			paired: deviceId !== void 0 && service.hasDevice(deviceId),
 			...service.snapshot()
@@ -924,7 +1031,7 @@ function makeRoutes(deps) {
 	const handleEvents = (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
 		if (!loopbackFence(req)) {
-			writeJson$1(res, 403, {
+			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
 			});
@@ -969,23 +1076,25 @@ function makeRoutes(deps) {
 //#endregion
 //#region src/mobile-routes.ts
 /**
-* The mobile surface's page routes: `/m` serves the standalone phone UI
-* (an independent bundle, built to lib/mobile.js by the mobile tsdown
-* entry), `/m/mobile.js` serves the bundle itself. The page talks to the
-* host exclusively through the shared /api transport (paired-device cookie
-* already crosses the api/gate fence), so no host-side data plumbing is
-* needed here — only static serving, loopback+paired-fence via the normal
-* webserver route registration.
+* The mobile surface's page routes: /m canonicalizes to /m/, which serves the
+* standalone phone UI. The page and worker live in the /m/ scope so the PWA
+* can cache only its static shell; the paired-device data channel remains at
+* /m/api and is never handled by the worker.
 */
+const MOBILE_ROOT = "/m/";
+const MOBILE_BUNDLE_URL = "/m/mobile.js";
+const MOBILE_MANIFEST_URL = "/m/manifest.webmanifest";
+const MOBILE_WORKER_URL = "/m/service-worker.js";
+const MOBILE_OFFLINE_URL = "/m/offline.html";
 /** The standalone mobile bundle (built artifact, next to this file's own lib output). */
 function mobileBundlePath() {
 	return fileURLToPath(new URL("../lib/mobile.js", import.meta.url));
 }
-/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
-function appleTouchIconPath() {
-	return fileURLToPath(new URL("../assets/apple-touch-icon.png", import.meta.url));
+/** A package asset available to the host after a registry or git install. */
+function mobileAssetPath(name) {
+	return fileURLToPath(new URL("../assets/" + name, import.meta.url));
 }
-/** The mobile page shell: minimal, offline-safe, no external assets. */
+/** The mobile page shell: self-contained, with no document-level user data. */
 function pageHtml(bundleUrl) {
 	return [
 		"<!doctype html>",
@@ -995,26 +1104,80 @@ function pageHtml(bundleUrl) {
 		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover\">",
 		"<meta name=\"theme-color\" content=\"#f3f5f9\">",
 		"<meta name=\"referrer\" content=\"no-referrer\">",
+		"<meta name=\"mobile-web-app-capable\" content=\"yes\">",
+		"<meta name=\"apple-mobile-web-app-capable\" content=\"yes\">",
+		"<meta name=\"apple-mobile-web-app-title\" content=\"DSH Remote\">",
+		"<link rel=\"manifest\" href=\"/m/manifest.webmanifest\">",
 		"<link rel=\"apple-touch-icon\" href=\"/m/apple-touch-icon.png\">",
 		"<title>移动端远程控制</title>",
 		"</head>",
 		"<body>",
 		"<div id=\"root\"></div>",
-		`<script type="module" src="${bundleUrl}"><\/script>`,
+		"<script type=\"module\" src=\"" + bundleUrl + "\"><\/script>",
 		"</body>",
 		"</html>"
 	].join("");
 }
-/** Send a small static body with cache headers (the bundle is content-hashed by rebuild). */
+/** The installable app identity and icon declarations for the /m scope. */
+function manifestJson() {
+	return JSON.stringify({
+		id: MOBILE_ROOT,
+		name: "DSH Remote",
+		short_name: "DSH Remote",
+		start_url: MOBILE_ROOT,
+		scope: MOBILE_ROOT,
+		display: "standalone",
+		background_color: "#151424",
+		theme_color: "#f3f5f9",
+		icons: [{
+			src: "/m/icon-192.png",
+			sizes: "192x192",
+			type: "image/png",
+			purpose: "any"
+		}, {
+			src: "/m/icon-512.png",
+			sizes: "512x512",
+			type: "image/png",
+			purpose: "any maskable"
+		}]
+	}, null, 2);
+}
+/** A static fallback that contains no paired-device, session, or workspace data. */
+function offlineHtml() {
+	return [
+		"<!doctype html>",
+		"<html lang=\"zh-CN\">",
+		"<head>",
+		"<meta charset=\"utf-8\">",
+		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, viewport-fit=cover\">",
+		"<meta name=\"theme-color\" content=\"#151424\">",
+		"<title>DSH Remote</title>",
+		"<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>",
+		"</head>",
+		"<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>",
+		"</html>"
+	].join("");
+}
+/** Send a small static UTF-8 body with revalidation headers. */
 function writeStatic(res, status, type, body) {
 	res.writeHead(status, {
-		"content-type": `${type}; charset=utf-8`,
+		"content-type": type + "; charset=utf-8",
 		"cache-control": "no-cache",
 		"referrer-policy": "no-referrer"
 	});
 	res.end(body);
 }
-/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+/** Send the worker with the same scope it registers for, without HTTP caching. */
+function writeServiceWorker(res, body) {
+	res.writeHead(200, {
+		"content-type": "text/javascript; charset=utf-8",
+		"cache-control": "no-cache",
+		"referrer-policy": "no-referrer",
+		"service-worker-allowed": MOBILE_ROOT
+	});
+	res.end(body);
+}
+/** Send a PNG body without decoding it to UTF-8. */
 function writePng(res, status, body) {
 	res.writeHead(status, {
 		"content-type": "image/png",
@@ -1023,53 +1186,121 @@ function writePng(res, status, body) {
 	});
 	res.end(body);
 }
+/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
+function redirectToMobileRoot(req, res) {
+	const url = new URL(req.url ?? "/m", "http://x");
+	res.writeHead(308, {
+		location: MOBILE_ROOT + url.search,
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer"
+	});
+	res.end();
+}
 /**
 * Build the mobile page routes.
-* @returns the two exact routes to register on webServer.
+* @returns Exact routes for the canonical page, static shell, and PWA assets.
 */
 function makeMobileRoutes() {
 	const handlePage = (_req, res) => {
-		writeStatic(res, 200, "text/html", pageHtml("/m/mobile.js"));
+		writeStatic(res, 200, "text/html", pageHtml(MOBILE_BUNDLE_URL));
+	};
+	const handleManifest = (_req, res) => {
+		writeStatic(res, 200, "application/manifest+json", manifestJson());
 	};
+	const handleOffline = (_req, res) => {
+		writeStatic(res, 200, "text/html", offlineHtml());
+	};
+	let bundleBody;
 	const handleBundle = async (_req, res) => {
-		const path = mobileBundlePath();
-		if (!existsSync(path)) {
-			writeStatic(res, 503, "text/plain", "mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build");
-			return;
+		if (bundleBody === void 0) {
+			const path = mobileBundlePath();
+			if (!existsSync(path)) {
+				writeStatic(res, 503, "text/plain", "mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build");
+				return;
+			}
+			try {
+				bundleBody = await readFile(path, "utf8");
+			} catch {
+				writeStatic(res, 500, "text/plain", "failed to read the mobile bundle");
+				return;
+			}
 		}
-		try {
-			writeStatic(res, 200, "text/javascript", await readFile(path, "utf8"));
-		} catch {
-			writeStatic(res, 500, "text/plain", "failed to read the mobile bundle");
+		writeStatic(res, 200, "text/javascript", bundleBody);
+	};
+	let workerBody;
+	const handleWorker = async (_req, res) => {
+		if (workerBody === void 0) {
+			const path = mobileAssetPath("mobile-service-worker.js");
+			if (!existsSync(path)) {
+				writeStatic(res, 503, "text/plain", "mobile service worker not found");
+				return;
+			}
+			try {
+				workerBody = await readFile(path, "utf8");
+			} catch {
+				writeStatic(res, 500, "text/plain", "failed to read the mobile service worker");
+				return;
+			}
 		}
+		writeServiceWorker(res, workerBody);
 	};
-	const handleIcon = async (_req, res) => {
-		const path = appleTouchIconPath();
+	const makeIconHandler = (asset) => async (_req, res) => {
+		const path = mobileAssetPath(asset);
 		if (!existsSync(path)) {
-			writeStatic(res, 404, "text/plain", "apple-touch-icon not found");
+			writeStatic(res, 404, "text/plain", asset + " not found");
 			return;
 		}
 		try {
 			writePng(res, 200, await readFile(path));
 		} catch {
-			writeStatic(res, 500, "text/plain", "failed to read the apple-touch-icon");
+			writeStatic(res, 500, "text/plain", "failed to read " + asset);
 		}
 	};
 	return [
 		{
 			kind: "exact",
 			path: "/m",
+			handler: redirectToMobileRoot
+		},
+		{
+			kind: "exact",
+			path: MOBILE_ROOT,
 			handler: handlePage
 		},
 		{
 			kind: "exact",
-			path: "/m/mobile.js",
+			path: MOBILE_BUNDLE_URL,
 			handler: handleBundle
 		},
+		{
+			kind: "exact",
+			path: MOBILE_MANIFEST_URL,
+			handler: handleManifest
+		},
+		{
+			kind: "exact",
+			path: MOBILE_WORKER_URL,
+			handler: handleWorker
+		},
+		{
+			kind: "exact",
+			path: MOBILE_OFFLINE_URL,
+			handler: handleOffline
+		},
 		{
 			kind: "exact",
 			path: "/m/apple-touch-icon.png",
-			handler: handleIcon
+			handler: makeIconHandler("apple-touch-icon.png")
+		},
+		{
+			kind: "exact",
+			path: "/m/icon-192.png",
+			handler: makeIconHandler("mobile-icon-192.png")
+		},
+		{
+			kind: "exact",
+			path: "/m/icon-512.png",
+			handler: makeIconHandler("mobile-icon-512.png")
 		}
 	];
 }
@@ -1147,10 +1378,6 @@ function makeMobileApiRoutes(deps) {
 	const gateOk = (req) => {
 		return touchDeviceFor(req);
 	};
-	const writeJson = (res, status, body) => {
-		res.writeHead(status, { "content-type": "application/json; charset=utf-8" });
-		res.end(JSON.stringify(body));
-	};
 	const handleMethod = async (req, res) => {
 		if (req.method !== "POST") {
 			res.writeHead(405);
@@ -1227,10 +1454,12 @@ function makeMobileApiRoutes(deps) {
 			return;
 		}
 		try {
-			const response = await dispatch(apiProxy, method, parsed?.payload, rpcId);
-			writeJson(res, 200, response);
+			const abort = new AbortController();
+			res.on("close", () => {
+				if (!res.writableEnded) abort.abort();
+			});
+			writeJson(res, 200, await dispatch(apiProxy, method, parsed?.payload, rpcId, abort.signal));
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
 			writeJson(res, 200, {
 				type: "server-response",
 				rpcId,
@@ -1238,7 +1467,7 @@ function makeMobileApiRoutes(deps) {
 					ok: false,
 					error: {
 						code: "internal",
-						message
+						message: error instanceof Error ? error.message : String(error)
 					}
 				}
 			});
@@ -1305,18 +1534,10 @@ function makeMobileApiRoutes(deps) {
 }
 /** Read a request body as JSON (bounded). */
 async function readJsonBody(req) {
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = chunk;
-		size += buffer.length;
-		if (size > 64 * 1024) throw new Error("body too large");
-		chunks.push(buffer);
-	}
-	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	return readBoundedJson(req, 64 * 1024);
 }
 /** Dispatch one allowlisted method through the host ApiProxy. */
-async function dispatch(apiProxy, method, payload, rpcId) {
+async function dispatch(apiProxy, method, payload, rpcId, signal) {
 	const request = {
 		rpcId: RpcId(rpcId),
 		payload
@@ -1354,7 +1575,7 @@ async function dispatch(apiProxy, method, payload, rpcId) {
 	if (method === "workspace.list") return wrap(await apiProxy.workspace.list(request));
 	if (method === "session.create") return wrap(await apiProxy.sessions.create(request));
 	if (method === "session.history") return wrap(await apiProxy.sessions.history(request));
-	if (method === "session.search") return wrap(await apiProxy.sessions.search(request, new AbortController().signal));
+	if (method === "session.search") return wrap(await apiProxy.sessions.search(request, signal ?? new AbortController().signal));
 	if (method === "session.prompt") return wrap(await apiProxy.sessions.prompt(request));
 	if (method === "session.models") return wrap(await apiProxy.sessions.models(request));
 	if (method === "session.selectModel") return wrap(await apiProxy.sessions.selectModel(request));
@@ -1708,12 +1929,13 @@ function resolveUpdateTarget(deps) {
 	if (anchor === void 0) return { error: "not-found" };
 	const profile = findProfile(manifestPath);
 	if (profile === void 0) return { error: "link" };
-	const spec = (readManifest(join(profile.dir, "package.json"))?.dependencies)?.[anchor];
+	const profileManifest = readManifest(join(profile.dir, "package.json"));
+	const spec = (profileManifest?.dependencies)?.[anchor];
 	if (isLinkedSpec(spec)) return { error: "link" };
 	return {
 		profileName: profile.name,
 		profileDir: profile.dir,
-		packages: [anchor, ...familyChildren(manifest)]
+		packages: familyUpdatePackages(anchor, manifest, profileManifest)
 	};
 }
 /** Family children of the anchor: its dependencies under the family scope. */
@@ -1724,6 +1946,14 @@ function familyChildren(anchorManifest) {
 	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string") names.push(name);
 	return names;
 }
+/** Registry-managed family packages covered by one update operation. */
+function familyUpdatePackages(anchor, anchorManifest, profileManifest) {
+	const names = /* @__PURE__ */ new Set([anchor, ...familyChildren(anchorManifest)]);
+	const dependencies = profileManifest?.dependencies;
+	if (typeof dependencies !== "object" || dependencies === null) return [...names];
+	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string" && !isLinkedSpec(spec)) names.add(name);
+	return [...names];
+}
 /**
 * Probe the npm registry for one package's latest release.
 * @param name - the package name (scope slash URL-encoded).
@@ -1759,14 +1989,15 @@ async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
 */
 const VERSION_UNKNOWN = "0.0.0";
 /** The resolved current version of one family package (probe failure tolerated). */
-function readInstalledVersion(resolve, name) {
+function readInstalledVersion(resolve, name, profileDir) {
 	try {
 		const path = resolve(name + "/package.json");
 		const version = path === void 0 ? void 0 : readManifest(path)?.version;
-		return typeof version === "string" ? version : VERSION_UNKNOWN;
-	} catch {
-		return VERSION_UNKNOWN;
-	}
+		if (typeof version === "string") return version;
+	} catch {}
+	if (profileDir === void 0 || !/^@linxin666\/[a-z0-9][a-z0-9._-]*$/.test(name)) return VERSION_UNKNOWN;
+	const version = readManifest(join(profileDir, "node_modules", ...name.split("/"), "package.json"))?.version;
+	return typeof version === "string" ? version : VERSION_UNKNOWN;
 }
 /**
 * Build the update status: locate the anchor, detect the install mode, and
@@ -1801,20 +2032,21 @@ async function checkUpdates(deps) {
 		packages: [],
 		outdated: false
 	};
-	const names = [anchor, ...familyChildren(manifest)];
+	const names = familyUpdatePackages(anchor, manifest, profileManifest);
+	const latestList = await Promise.all(names.map((name) => deps.fetchLatest(name)));
 	const packages = [];
 	let probeFailures = 0;
-	for (const name of names) {
-		const latest = await deps.fetchLatest(name);
+	names.forEach((name, index) => {
+		const latest = latestList[index];
 		if (latest === void 0) probeFailures++;
-		const current = readInstalledVersion(deps.resolve, name);
+		const current = readInstalledVersion(deps.resolve, name, profile.dir);
 		packages.push({
 			name,
 			current,
 			latest,
 			outdated: latest !== void 0 && latest !== current && compareVersions(latest, current) > 0
 		});
-	}
+	});
 	const error = probeFailures === names.length && names.length > 0 ? "registry-unreachable" : void 0;
 	return {
 		mode: linked ? "link" : "npm",
@@ -2019,7 +2251,7 @@ function runUpdate(deps) {
 async function runUpdateVerified(deps) {
 	const before = /* @__PURE__ */ new Map();
 	for (const name of deps.run.packages) {
-		const version = readInstalledVersion(deps.check.resolve, name);
+		const version = readInstalledVersion(deps.check.resolve, name, deps.run.profileDir);
 		if (version !== VERSION_UNKNOWN) before.set(name, version);
 	}
 	const result = await runUpdate(deps.run);
@@ -2061,15 +2293,6 @@ const UPDATE_PATHS = {
 	status: "/api/update/status",
 	run: "/api/update/run"
 };
-/** One JSON response. */
-function writeJson(res, status, body) {
-	const payload = JSON.stringify(body);
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		"referrer-policy": "no-referrer"
-	});
-	res.end(payload);
-}
 /**
 * Build the /api/update route family.
 * @param deps - fence + check/run seams.
@@ -2117,6 +2340,47 @@ function makeUpdateRoutes(deps) {
 	}];
 }
 //#endregion
+//#region src/mount-once.ts
+/**
+* Host single-instance guard shared by the plugin family. The family bundle
+* (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+* the loader accepts a standalone install of the same package side by side;
+* without this guard the second instance would still re-register the same
+* webserver routes, tools, settings namespaces, and system-prompt sections
+* and fail the boot. mountOnce makes the second host apply a no-op for the
+* lifetime of the first instance (the browser half is already deduped by
+* package name in the client module host).
+*
+* The registry rides a global symbol so two module instances of the same
+* package (npm copy vs repository link) still share one verdict. cordis
+* `ctx.effect` runs its callback immediately and treats the callback's
+* return value as the fiber disposer, so the unmarker is returned, not run.
+*/
+const MOUNTED = Symbol.for("dsh-web-ui.mounted-plugins");
+function mountedSet() {
+	const registry = globalThis;
+	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
+}
+/**
+* Wrap a cordis plugin apply so the package runs at most once per process.
+* The first mount registers normally and unmarks when its fiber disposes;
+* any later mount of the same package name is a no-op.
+* @param packageName - npm package identity shared by every install source.
+* @param fn - the original plugin apply.
+* @returns an apply of the same shape.
+*/
+function mountOnce(packageName, fn) {
+	return ((...args) => {
+		const mounted = mountedSet();
+		if (mounted.has(packageName)) return;
+		mounted.add(packageName);
+		args[0]?.effect?.(() => () => {
+			mounted.delete(packageName);
+		});
+		return fn(...args);
+	});
+}
+//#endregion
 //#region src/index.ts
 /**
 * Mobile remote control for the dsh web GUI — host half. Mounts the pairing
@@ -2144,12 +2408,28 @@ const Config = z.object({
 	cookieName: z.string().min(1).default("dsh_pair"),
 	requirePairingForLan: z.boolean().default(true),
 	publicBaseUrl: z.string(),
+	devicesFile: z.string(),
 	autoTunnel: z.boolean().default(false),
 	mobileEnterToSend: z.boolean().default(true),
 	enabled: z.boolean().default(true)
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 1e4;
+/**
+* The single mapping from resolved plugin config to the pairing service
+* config. Both the constructed service and every live settings sync reuse
+* it, so no field can be silently dropped when the web settings surface
+* pushes a new value into the running service.
+*/
+function pairingConfigOf(resolved) {
+	return {
+		tokenTtlMs: resolved.tokenTtlMs,
+		offlineAfterMs: resolved.offlineAfterMs,
+		maxDevices: resolved.maxDevices,
+		cookieName: resolved.cookieName,
+		devicesFile: resolved.devicesFile
+	};
+}
 /** Schema defaults, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULTS = {
 	tokenTtlMs: 10 * 6e4,
@@ -2158,6 +2438,7 @@ const DEFAULTS = {
 	cookieName: "dsh_pair",
 	requirePairingForLan: true,
 	publicBaseUrl: void 0,
+	devicesFile: void 0,
 	autoTunnel: false,
 	mobileEnterToSend: true,
 	enabled: true
@@ -2167,7 +2448,8 @@ const DEFAULTS = {
 * @param ctx - host plugin context carrying webServer.
 * @param config - resolved plugin config (schema defaults applied by the loader).
 */
-function apply(ctx, config) {
+const apply = mountOnce("@linxin666/dsh-remote-web-ui", applyImpl);
+function applyImpl(ctx, config) {
 	const resolved = {
 		tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
 		offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
@@ -2175,6 +2457,7 @@ function apply(ctx, config) {
 		cookieName: config?.cookieName ?? DEFAULTS.cookieName,
 		requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
 		publicBaseUrl: config?.publicBaseUrl,
+		devicesFile: config?.devicesFile,
 		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
 		mobileEnterToSend: config?.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
 		enabled: config?.enabled ?? DEFAULTS.enabled
@@ -2189,17 +2472,13 @@ function apply(ctx, config) {
 			cookieName: value.cookieName ?? DEFAULTS.cookieName,
 			requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
 			publicBaseUrl: value.publicBaseUrl,
+			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
 			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
 			mobileEnterToSend: value.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
 			enabled: value.enabled ?? DEFAULTS.enabled
 		};
 	};
-	const service = new PairingService({
-		tokenTtlMs: resolved.tokenTtlMs,
-		offlineAfterMs: resolved.offlineAfterMs,
-		maxDevices: resolved.maxDevices,
-		cookieName: resolved.cookieName
-	});
+	const service = new PairingService(pairingConfigOf(resolved));
 	const tunnel = new TunnelManager();
 	let autoTunnel = resolved.autoTunnel;
 	tunnel.onPhase((info) => {
@@ -2301,14 +2580,13 @@ function apply(ctx, config) {
 	];
 	const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
 	ctx.effect(() => ctx.on("api/gate", gate), "remote-web-ui: api gate");
+	new RemoteWebUiPairing(ctx, (request) => {
+		if (!resolve().enabled) return false;
+		return isPairedDeviceRequest(service, request);
+	});
 	const sync = () => {
 		const value = resolve();
-		service.config = {
-			tokenTtlMs: value.tokenTtlMs,
-			offlineAfterMs: value.offlineAfterMs,
-			maxDevices: value.maxDevices,
-			cookieName: value.cookieName
-		};
+		service.config = pairingConfigOf(value);
 		autoTunnel = value.autoTunnel === true;
 		if (autoTunnel) {
 			if (value.publicBaseUrl !== void 0) console.warn("remote-web-ui: autoTunnel is on — ignoring the manually configured publicBaseUrl");
@@ -2365,4 +2643,4 @@ function isHttpUrl(value) {
 	}
 }
 //#endregion
-export { Config, REMOTE_WEB_UI_SETTINGS_NAMESPACE, apply, inject, name };
+export { Config, REMOTE_WEB_UI_SETTINGS_NAMESPACE, apply, inject, name, pairingConfigOf };