@linxin666/dsh-remote-web-ui 0.1.19 → 0.2.0

package/lib/types/mobile-routes.js

@@ -1,24 +1,26 @@
 /**
- * The mobile surface's page routes: `/m` serves the standalone phone UI
- * (an independent bundle, built to lib/mobile.js by the mobile tsdown
- * entry), `/m/mobile.js` serves the bundle itself. The page talks to the
- * host exclusively through the shared /api transport (paired-device cookie
- * already crosses the api/gate fence), so no host-side data plumbing is
- * needed here — only static serving, loopback+paired-fence via the normal
- * webserver route registration.
+ * The mobile surface's page routes: /m canonicalizes to /m/, which serves the
+ * standalone phone UI. The page and worker live in the /m/ scope so the PWA
+ * can cache only its static shell; the paired-device data channel remains at
+ * /m/api and is never handled by the worker.
  */
 import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+const MOBILE_ROOT = '/m/';
+const MOBILE_BUNDLE_URL = '/m/mobile.js';
+const MOBILE_MANIFEST_URL = '/m/manifest.webmanifest';
+const MOBILE_WORKER_URL = '/m/service-worker.js';
+const MOBILE_OFFLINE_URL = '/m/offline.html';
 /** The standalone mobile bundle (built artifact, next to this file's own lib output). */
 function mobileBundlePath() {
     return fileURLToPath(new URL('../lib/mobile.js', import.meta.url));
 }
-/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
-function appleTouchIconPath() {
-    return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url));
+/** A package asset available to the host after a registry or git install. */
+function mobileAssetPath(name) {
+    return fileURLToPath(new URL('../assets/' + name, import.meta.url));
 }
-/** The mobile page shell: minimal, offline-safe, no external assets. */
+/** The mobile page shell: self-contained, with no document-level user data. */
 function pageHtml(bundleUrl) {
     return [
         '<!doctype html>',
@@ -28,29 +30,73 @@ function pageHtml(bundleUrl) {
         '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
         '<meta name="theme-color" content="#f3f5f9">',
         '<meta name="referrer" content="no-referrer">',
-        // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
-        // the PNG ships with the package (opaque background — iOS composites
-        // transparency onto black, so the icon avoids transparent regions).
+        '<meta name="mobile-web-app-capable" content="yes">',
+        '<meta name="apple-mobile-web-app-capable" content="yes">',
+        '<meta name="apple-mobile-web-app-title" content="DSH Remote">',
+        '<link rel="manifest" href="/m/manifest.webmanifest">',
         '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
         '<title>移动端远程控制</title>',
         '</head>',
         '<body>',
         '<div id="root"></div>',
-        `<script type="module" src="${bundleUrl}"></script>`,
+        '<script type="module" src="' + bundleUrl + '"></script>',
         '</body>',
         '</html>',
     ].join('');
 }
-/** Send a small static body with cache headers (the bundle is content-hashed by rebuild). */
+/** The installable app identity and icon declarations for the /m scope. */
+function manifestJson() {
+    return JSON.stringify({
+        id: MOBILE_ROOT,
+        name: 'DSH Remote',
+        short_name: 'DSH Remote',
+        start_url: MOBILE_ROOT,
+        scope: MOBILE_ROOT,
+        display: 'standalone',
+        background_color: '#151424',
+        theme_color: '#f3f5f9',
+        icons: [
+            { src: '/m/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
+            { src: '/m/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any maskable' },
+        ],
+    }, null, 2);
+}
+/** A static fallback that contains no paired-device, session, or workspace data. */
+function offlineHtml() {
+    return [
+        '<!doctype html>',
+        '<html lang="zh-CN">',
+        '<head>',
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">',
+        '<meta name="theme-color" content="#151424">',
+        '<title>DSH Remote</title>',
+        '<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>',
+        '</head>',
+        '<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>',
+        '</html>',
+    ].join('');
+}
+/** Send a small static UTF-8 body with revalidation headers. */
 function writeStatic(res, status, type, body) {
     res.writeHead(status, {
-        'content-type': `${type}; charset=utf-8`,
+        'content-type': type + '; charset=utf-8',
+        'cache-control': 'no-cache',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end(body);
+}
+/** Send the worker with the same scope it registers for, without HTTP caching. */
+function writeServiceWorker(res, body) {
+    res.writeHead(200, {
+        'content-type': 'text/javascript; charset=utf-8',
         'cache-control': 'no-cache',
         'referrer-policy': 'no-referrer',
+        'service-worker-allowed': MOBILE_ROOT,
     });
     res.end(body);
 }
-/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+/** Send a PNG body without decoding it to UTF-8. */
 function writePng(res, status, body) {
     res.writeHead(status, {
         'content-type': 'image/png',
@@ -59,45 +105,90 @@ function writePng(res, status, body) {
     });
     res.end(body);
 }
+/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
+function redirectToMobileRoot(req, res) {
+    const url = new URL(req.url ?? '/m', 'http://x');
+    res.writeHead(308, {
+        location: MOBILE_ROOT + url.search,
+        'cache-control': 'no-store',
+        'referrer-policy': 'no-referrer',
+    });
+    res.end();
+}
 /**
  * Build the mobile page routes.
- * @returns the two exact routes to register on webServer.
+ * @returns Exact routes for the canonical page, static shell, and PWA assets.
  */
 export function makeMobileRoutes() {
     const handlePage = (_req, res) => {
-        writeStatic(res, 200, 'text/html', pageHtml('/m/mobile.js'));
+        writeStatic(res, 200, 'text/html', pageHtml(MOBILE_BUNDLE_URL));
+    };
+    const handleManifest = (_req, res) => {
+        writeStatic(res, 200, 'application/manifest+json', manifestJson());
+    };
+    const handleOffline = (_req, res) => {
+        writeStatic(res, 200, 'text/html', offlineHtml());
     };
+    // The bundle is immutable for the process lifetime (a rebuild requires a
+    // host restart), so the body is read from disk once, not per phone.
+    let bundleBody;
     const handleBundle = async (_req, res) => {
-        const path = mobileBundlePath();
-        if (!existsSync(path)) {
-            writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build');
-            return;
-        }
-        try {
-            const body = await readFile(path, 'utf8');
-            writeStatic(res, 200, 'text/javascript', body);
+        if (bundleBody === undefined) {
+            const path = mobileBundlePath();
+            if (!existsSync(path)) {
+                writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build');
+                return;
+            }
+            try {
+                bundleBody = await readFile(path, 'utf8');
+            }
+            catch {
+                writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
+                return;
+            }
         }
-        catch {
-            writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle');
+        writeStatic(res, 200, 'text/javascript', bundleBody);
+    };
+    let workerBody;
+    const handleWorker = async (_req, res) => {
+        if (workerBody === undefined) {
+            const path = mobileAssetPath('mobile-service-worker.js');
+            if (!existsSync(path)) {
+                writeStatic(res, 503, 'text/plain', 'mobile service worker not found');
+                return;
+            }
+            try {
+                workerBody = await readFile(path, 'utf8');
+            }
+            catch {
+                writeStatic(res, 500, 'text/plain', 'failed to read the mobile service worker');
+                return;
+            }
         }
+        writeServiceWorker(res, workerBody);
     };
-    const handleIcon = async (_req, res) => {
-        const path = appleTouchIconPath();
+    const makeIconHandler = (asset) => async (_req, res) => {
+        const path = mobileAssetPath(asset);
         if (!existsSync(path)) {
-            writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found');
+            writeStatic(res, 404, 'text/plain', asset + ' not found');
             return;
         }
         try {
-            const body = await readFile(path);
-            writePng(res, 200, body);
+            writePng(res, 200, await readFile(path));
         }
         catch {
-            writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon');
+            writeStatic(res, 500, 'text/plain', 'failed to read ' + asset);
         }
     };
     return [
-        { kind: 'exact', path: '/m', handler: handlePage },
-        { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
-        { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
+        { kind: 'exact', path: '/m', handler: redirectToMobileRoot },
+        { kind: 'exact', path: MOBILE_ROOT, handler: handlePage },
+        { kind: 'exact', path: MOBILE_BUNDLE_URL, handler: handleBundle },
+        { kind: 'exact', path: MOBILE_MANIFEST_URL, handler: handleManifest },
+        { kind: 'exact', path: MOBILE_WORKER_URL, handler: handleWorker },
+        { kind: 'exact', path: MOBILE_OFFLINE_URL, handler: handleOffline },
+        { kind: 'exact', path: '/m/apple-touch-icon.png', handler: makeIconHandler('apple-touch-icon.png') },
+        { kind: 'exact', path: '/m/icon-192.png', handler: makeIconHandler('mobile-icon-192.png') },
+        { kind: 'exact', path: '/m/icon-512.png', handler: makeIconHandler('mobile-icon-512.png') },
     ];
 }

package/lib/types/mount-once.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export declare function mountOnce<T extends (...args: any[]) => unknown>(packageName: string, fn: T): T;
+//# sourceMappingURL=mount-once.d.ts.map

package/lib/types/mount-once.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-once.d.ts","sourceRoot":"","sources":["../../src/mount-once.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;GAcG;AAaH;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAW9F"}

package/lib/types/mount-once.js

@@ -0,0 +1,42 @@
+// Generated by scripts/sync-shared.mjs from shared/host/mount-once.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Host single-instance guard shared by the plugin family. The family bundle
+ * (dsh-web-ui-all / dsh-skins) namespaces every child row id (web-ui-*), so
+ * the loader accepts a standalone install of the same package side by side;
+ * without this guard the second instance would still re-register the same
+ * webserver routes, tools, settings namespaces, and system-prompt sections
+ * and fail the boot. mountOnce makes the second host apply a no-op for the
+ * lifetime of the first instance (the browser half is already deduped by
+ * package name in the client module host).
+ *
+ * The registry rides a global symbol so two module instances of the same
+ * package (npm copy vs repository link) still share one verdict. cordis
+ * `ctx.effect` runs its callback immediately and treats the callback's
+ * return value as the fiber disposer, so the unmarker is returned, not run.
+ */
+const MOUNTED = Symbol.for('dsh-web-ui.mounted-plugins');
+function mountedSet() {
+    const registry = globalThis;
+    return (registry[MOUNTED] ??= new Set());
+}
+/**
+ * Wrap a cordis plugin apply so the package runs at most once per process.
+ * The first mount registers normally and unmarks when its fiber disposes;
+ * any later mount of the same package name is a no-op.
+ * @param packageName - npm package identity shared by every install source.
+ * @param fn - the original plugin apply.
+ * @returns an apply of the same shape.
+ */
+export function mountOnce(packageName, fn) {
+    return ((...args) => {
+        const mounted = mountedSet();
+        if (mounted.has(packageName))
+            return;
+        mounted.add(packageName);
+        const ctx = args[0];
+        ctx?.effect?.(() => () => {
+            mounted.delete(packageName);
+        });
+        return fn(...args);
+    });
+}

package/lib/types/pairing-access.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Optional cordis service other host plugins can ctx.get without taking a
+ * package dependency: a live paired-device cookie is an allow path on
+ * routes that sit outside /api (and therefore outside api/gate).
+ */
+import type { IncomingMessage } from 'node:http';
+import { Service, type Context } from '@deepseek-ai/cordis';
+/** Named lookup key sibling plugins pass to ctx.get. */
+export declare const REMOTE_WEB_UI_PAIRING = "remoteWebUiPairing";
+/**
+ * Pairing identity for one HTTP request. Structural: consumers must not
+ * import this class, only the method shape.
+ */
+export declare class RemoteWebUiPairing extends Service {
+    private readonly check;
+    /**
+     * @param ctx - host plugin context.
+     * @param check - live cookie + session predicate (re-read per request).
+     */
+    constructor(ctx: Context, check: (request: IncomingMessage) => boolean);
+    /**
+     * Whether the request carries a live paired-device cookie.
+     * @param request - the incoming HTTP request.
+     * @returns true when the session is live and was refreshed.
+     */
+    isPairedDevice(request: IncomingMessage): boolean;
+}
+//# sourceMappingURL=pairing-access.d.ts.map

package/lib/types/pairing-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-access.d.ts","sourceRoot":"","sources":["../../src/pairing-access.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE3D,wDAAwD;AACxD,eAAO,MAAM,qBAAqB,uBAAuB,CAAA;AAEzD;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,OAAO;IAO3C,OAAO,CAAC,QAAQ,CAAC,KAAK;IANxB;;;OAGG;IACH,YACE,GAAG,EAAE,OAAO,EACK,KAAK,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,EAG9D;IAED;;;;OAIG;IACH,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAEhD;CACF"}

package/lib/types/pairing-access.js

@@ -0,0 +1,26 @@
+import { Service } from '@deepseek-ai/cordis';
+/** Named lookup key sibling plugins pass to ctx.get. */
+export const REMOTE_WEB_UI_PAIRING = 'remoteWebUiPairing';
+/**
+ * Pairing identity for one HTTP request. Structural: consumers must not
+ * import this class, only the method shape.
+ */
+export class RemoteWebUiPairing extends Service {
+    check;
+    /**
+     * @param ctx - host plugin context.
+     * @param check - live cookie + session predicate (re-read per request).
+     */
+    constructor(ctx, check) {
+        super(ctx, REMOTE_WEB_UI_PAIRING);
+        this.check = check;
+    }
+    /**
+     * Whether the request carries a live paired-device cookie.
+     * @param request - the incoming HTTP request.
+     * @returns true when the session is live and was refreshed.
+     */
+    isPairedDevice(request) {
+        return this.check(request);
+    }
+}

package/lib/types/pairing.d.ts

@@ -87,6 +87,13 @@ export interface PairingConfig {
     maxDevices: number;
     /** Cookie name carrying the device id. */
     cookieName: string;
+    /**
+     * Path to a JSON file where paired device sessions are persisted. When
+     * set, sessions survive process restarts (the phone keeps its 365-day
+     * cookie), so re-pairing after a dsh web restart is not required. When
+     * unset (default), sessions stay memory-only — the previous behavior.
+     */
+    devicesFile?: string;
 }
 /** Result of one accept() attempt. */
 export type AcceptResult = {
@@ -138,6 +145,26 @@ export declare class PairingService {
      * @param clock - clock/entropy source (injectable for tests).
      */
     constructor(config: PairingConfig, clock?: PairingClock);
+    /**
+     * Restore device sessions persisted by a previous process run. A corrupt
+     * or missing file is tolerated (an empty device table, never a throw) —
+     * persistence is an availability convenience, not a security boundary.
+     */
+    private loadPersisted;
+    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+    private clampToMaxDevices;
+    /**
+     * Write the current device table to the configured file. Called on the
+     * mutation boundaries that change the set of live sessions (accept and
+     * stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+     * per-request write storm is avoided — after a restart the phone's first
+     * heartbeat re-warms its own session.
+     *
+     * Device ids are session credentials (the gate authorizes requests by the
+     * cookie's device id), so the file is written 0600 via a temp file and
+     * atomic rename; a crash mid-write can never leave a half-written store.
+     */
+    private persist;
     /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
     get lanBaseUrl(): string | undefined;
     /** The LAN base URL for one specific literal (undefined when not constructible). */

package/lib/types/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;GAKG;AACH,qBAAa,cAAc;IAqBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IArBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAE9C;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B;IAGrD,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwBnF;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY;IAqBnC;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAOZ;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAIb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAgB3B,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;IACH,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;GAKG;AACH,qBAAa,cAAc;IAqBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IArBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAE9C;;;;;OAKG;IACH,YACS,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAGpD;IAED;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAmBrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,OAAO;IAaf,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEjD;IAED,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI,CAGvE;IAED,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAG9C;IAED,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAGtD;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAsBlF;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAoBlC;IAED;;;;OAIG;IACH,IAAI,IAAI,IAAI,CAMX;IAED;;;;;;OAMG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMrC;IAED,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEnC;IAED;;;;OAIG;IACH,KAAK,IAAI,IAAI,CAEZ;IAED,2EAA2E;IAC3E,QAAQ,IAAI,eAAe,CAc1B;IAED,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGnC;IAED,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI,CAGjE;IAED,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf"}

package/lib/types/pairing.js

@@ -15,6 +15,8 @@
  *   devices are cut off on their next gated request.
  */
 import { randomBytes } from 'node:crypto';
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
 /** Thrown by issue() for an address outside the sampled LAN literals. */
 export class UnknownLanAddressError extends Error {
     /**
@@ -60,6 +62,70 @@ export class PairingService {
     constructor(config, clock = defaultClock) {
         this.config = config;
         this.clock = clock;
+        this.loadPersisted();
+    }
+    /**
+     * Restore device sessions persisted by a previous process run. A corrupt
+     * or missing file is tolerated (an empty device table, never a throw) —
+     * persistence is an availability convenience, not a security boundary.
+     */
+    loadPersisted() {
+        const file = this.config.devicesFile;
+        if (file === undefined)
+            return;
+        try {
+            const saved = JSON.parse(readFileSync(file, 'utf8'));
+            if (typeof saved !== 'object' || saved === null)
+                return;
+            for (const [deviceId, session] of Object.entries(saved)) {
+                if (typeof deviceId !== 'string')
+                    continue;
+                if (typeof session !== 'object' || session === null)
+                    continue;
+                const { createdAt, lastSeenAt } = session;
+                if (typeof createdAt !== 'number' || typeof lastSeenAt !== 'number')
+                    continue;
+                this.devices.set(deviceId, { createdAt, lastSeenAt });
+            }
+            this.clampToMaxDevices();
+        }
+        catch {
+            // Unreadable/corrupt: start empty rather than refusing to boot.
+        }
+    }
+    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+    clampToMaxDevices() {
+        if (this.devices.size <= this.config.maxDevices)
+            return;
+        const overflow = this.devices.size - this.config.maxDevices;
+        const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+        for (const [id] of ordered.slice(0, overflow))
+            this.devices.delete(id);
+    }
+    /**
+     * Write the current device table to the configured file. Called on the
+     * mutation boundaries that change the set of live sessions (accept and
+     * stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+     * per-request write storm is avoided — after a restart the phone's first
+     * heartbeat re-warms its own session.
+     *
+     * Device ids are session credentials (the gate authorizes requests by the
+     * cookie's device id), so the file is written 0600 via a temp file and
+     * atomic rename; a crash mid-write can never leave a half-written store.
+     */
+    persist() {
+        const file = this.config.devicesFile;
+        if (file === undefined)
+            return;
+        try {
+            mkdirSync(dirname(file), { recursive: true });
+            const temp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+            writeFileSync(temp, JSON.stringify(Object.fromEntries(this.devices)), { mode: 0o600 });
+            renameSync(temp, file);
+        }
+        catch (error) {
+            console.error('remote-web-ui: failed to persist paired devices', error);
+        }
     }
     /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
     get lanBaseUrl() {
@@ -153,6 +219,7 @@ export class PairingService {
                 this.devices.delete(oldest.id);
         }
         this.devices.set(deviceId, { createdAt: now, lastSeenAt: now });
+        this.persist();
         this.notify();
         return { ok: true, deviceId };
     }
@@ -164,6 +231,7 @@ export class PairingService {
     stop() {
         this.tokens.clear();
         this.devices.clear();
+        this.persist();
         this.stopped = true;
         this.notify();
     }

package/lib/types/pairing.persist.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pairing.persist.test.d.ts.map

package/lib/types/pairing.persist.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.persist.test.d.ts","sourceRoot":"","sources":["../../src/pairing.persist.test.ts"],"names":[],"mappings":""}