@linxin666/dsh-remote-web-ui 0.1.20 → 0.2.1

package/src/mobile-routes.ts

@@ -1,11 +1,8 @@
 /**
- * The mobile surface's page routes: `/m` serves the standalone phone UI
- * (an independent bundle, built to lib/mobile.js by the mobile tsdown
- * entry), `/m/mobile.js` serves the bundle itself. The page talks to the
- * host exclusively through the shared /api transport (paired-device cookie
- * already crosses the api/gate fence), so no host-side data plumbing is
- * needed here — only static serving, loopback+paired-fence via the normal
- * webserver route registration.
+ * The mobile surface's page routes: /m canonicalizes to /m/, which serves the
+ * standalone phone UI. The page and worker live in the /m/ scope so the PWA
+ * can cache only its static shell; the paired-device data channel remains at
+ * /m/api and is never handled by the worker.
  */
 
 import { readFile } from 'node:fs/promises'
@@ -14,17 +11,23 @@ import { fileURLToPath } from 'node:url'
 import type { IncomingMessage, ServerResponse } from 'node:http'
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
 
+const MOBILE_ROOT = '/m/'
+const MOBILE_BUNDLE_URL = '/m/mobile.js'
+const MOBILE_MANIFEST_URL = '/m/manifest.webmanifest'
+const MOBILE_WORKER_URL = '/m/service-worker.js'
+const MOBILE_OFFLINE_URL = '/m/offline.html'
+
 /** The standalone mobile bundle (built artifact, next to this file's own lib output). */
 function mobileBundlePath(): string {
   return fileURLToPath(new URL('../lib/mobile.js', import.meta.url))
 }
 
-/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
-function appleTouchIconPath(): string {
-  return fileURLToPath(new URL('../assets/apple-touch-icon.png', import.meta.url))
+/** A package asset available to the host after a registry or git install. */
+function mobileAssetPath(name: string): string {
+  return fileURLToPath(new URL('../assets/' + name, import.meta.url))
 }
 
-/** The mobile page shell: minimal, offline-safe, no external assets. */
+/** The mobile page shell: self-contained, with no document-level user data. */
 function pageHtml(bundleUrl: string): string {
   return [
     '<!doctype html>',
@@ -34,31 +37,78 @@ function pageHtml(bundleUrl: string): string {
     '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
     '<meta name="theme-color" content="#f3f5f9">',
     '<meta name="referrer" content="no-referrer">',
-    // iOS "Add to Home Screen" uses apple-touch-icon for the tile icon;
-    // the PNG ships with the package (opaque background — iOS composites
-    // transparency onto black, so the icon avoids transparent regions).
+    '<meta name="mobile-web-app-capable" content="yes">',
+    '<meta name="apple-mobile-web-app-capable" content="yes">',
+    '<meta name="apple-mobile-web-app-title" content="DSH Remote">',
+    '<link rel="manifest" href="/m/manifest.webmanifest">',
     '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
     '<title>移动端远程控制</title>',
     '</head>',
     '<body>',
     '<div id="root"></div>',
-    `<script type="module" src="${bundleUrl}"></script>`,
+    '<script type="module" src="' + bundleUrl + '"></script>',
     '</body>',
     '</html>',
   ].join('')
 }
 
-/** Send a small static body with cache headers (the bundle is content-hashed by rebuild). */
+/** The installable app identity and icon declarations for the /m scope. */
+function manifestJson(): string {
+  return JSON.stringify({
+    id: MOBILE_ROOT,
+    name: 'DSH Remote',
+    short_name: 'DSH Remote',
+    start_url: MOBILE_ROOT,
+    scope: MOBILE_ROOT,
+    display: 'standalone',
+    background_color: '#151424',
+    theme_color: '#f3f5f9',
+    icons: [
+      { src: '/m/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
+      { src: '/m/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any maskable' },
+    ],
+  }, null, 2)
+}
+
+/** A static fallback that contains no paired-device, session, or workspace data. */
+function offlineHtml(): string {
+  return [
+    '<!doctype html>',
+    '<html lang="zh-CN">',
+    '<head>',
+    '<meta charset="utf-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">',
+    '<meta name="theme-color" content="#151424">',
+    '<title>DSH Remote</title>',
+    '<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>',
+    '</head>',
+    '<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>',
+    '</html>',
+  ].join('')
+}
+
+/** Send a small static UTF-8 body with revalidation headers. */
 function writeStatic(res: ServerResponse, status: number, type: string, body: string): void {
   res.writeHead(status, {
-    'content-type': `${type}; charset=utf-8`,
+    'content-type': type + '; charset=utf-8',
+    'cache-control': 'no-cache',
+    'referrer-policy': 'no-referrer',
+  })
+  res.end(body)
+}
+
+/** Send the worker with the same scope it registers for, without HTTP caching. */
+function writeServiceWorker(res: ServerResponse, body: string): void {
+  res.writeHead(200, {
+    'content-type': 'text/javascript; charset=utf-8',
     'cache-control': 'no-cache',
     'referrer-policy': 'no-referrer',
+    'service-worker-allowed': MOBILE_ROOT,
   })
   res.end(body)
 }
 
-/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+/** Send a PNG body without decoding it to UTF-8. */
 function writePng(res: ServerResponse, status: number, body: Buffer): void {
   res.writeHead(status, {
     'content-type': 'image/png',
@@ -68,16 +118,34 @@ function writePng(res: ServerResponse, status: number, body: Buffer): void {
   res.end(body)
 }
 
+/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
+function redirectToMobileRoot(req: IncomingMessage, res: ServerResponse): void {
+  const url = new URL(req.url ?? '/m', 'http://x')
+  res.writeHead(308, {
+    location: MOBILE_ROOT + url.search,
+    'cache-control': 'no-store',
+    'referrer-policy': 'no-referrer',
+  })
+  res.end()
+}
+
 /**
  * Build the mobile page routes.
- * @returns the two exact routes to register on webServer.
+ * @returns Exact routes for the canonical page, static shell, and PWA assets.
  */
 export function makeMobileRoutes(): WebRoute[] {
   const handlePage = (_req: IncomingMessage, res: ServerResponse): void => {
-    writeStatic(res, 200, 'text/html', pageHtml('/m/mobile.js'))
+    writeStatic(res, 200, 'text/html', pageHtml(MOBILE_BUNDLE_URL))
+  }
+  const handleManifest = (_req: IncomingMessage, res: ServerResponse): void => {
+    writeStatic(res, 200, 'application/manifest+json', manifestJson())
   }
+  const handleOffline = (_req: IncomingMessage, res: ServerResponse): void => {
+    writeStatic(res, 200, 'text/html', offlineHtml())
+  }
+
   // The bundle is immutable for the process lifetime (a rebuild requires a
-  // host restart), so the ~456KB body is read from disk once, not per phone.
+  // host restart), so the body is read from disk once, not per phone.
   let bundleBody: string | undefined
   const handleBundle = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
     if (bundleBody === undefined) {
@@ -95,22 +163,47 @@ export function makeMobileRoutes(): WebRoute[] {
     }
     writeStatic(res, 200, 'text/javascript', bundleBody)
   }
-  const handleIcon = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    const path = appleTouchIconPath()
+
+  let workerBody: string | undefined
+  const handleWorker = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
+    if (workerBody === undefined) {
+      const path = mobileAssetPath('mobile-service-worker.js')
+      if (!existsSync(path)) {
+        writeStatic(res, 503, 'text/plain', 'mobile service worker not found')
+        return
+      }
+      try {
+        workerBody = await readFile(path, 'utf8')
+      } catch {
+        writeStatic(res, 500, 'text/plain', 'failed to read the mobile service worker')
+        return
+      }
+    }
+    writeServiceWorker(res, workerBody)
+  }
+
+  const makeIconHandler = (asset: string): WebRoute['handler'] => async (_req, res) => {
+    const path = mobileAssetPath(asset)
     if (!existsSync(path)) {
-      writeStatic(res, 404, 'text/plain', 'apple-touch-icon not found')
+      writeStatic(res, 404, 'text/plain', asset + ' not found')
       return
     }
     try {
-      const body = await readFile(path)
-      writePng(res, 200, body)
+      writePng(res, 200, await readFile(path))
     } catch {
-      writeStatic(res, 500, 'text/plain', 'failed to read the apple-touch-icon')
+      writeStatic(res, 500, 'text/plain', 'failed to read ' + asset)
     }
   }
+
   return [
-    { kind: 'exact', path: '/m', handler: handlePage },
-    { kind: 'exact', path: '/m/mobile.js', handler: handleBundle },
-    { kind: 'exact', path: '/m/apple-touch-icon.png', handler: handleIcon },
+    { kind: 'exact', path: '/m', handler: redirectToMobileRoot },
+    { kind: 'exact', path: MOBILE_ROOT, handler: handlePage },
+    { kind: 'exact', path: MOBILE_BUNDLE_URL, handler: handleBundle },
+    { kind: 'exact', path: MOBILE_MANIFEST_URL, handler: handleManifest },
+    { kind: 'exact', path: MOBILE_WORKER_URL, handler: handleWorker },
+    { kind: 'exact', path: MOBILE_OFFLINE_URL, handler: handleOffline },
+    { kind: 'exact', path: '/m/apple-touch-icon.png', handler: makeIconHandler('apple-touch-icon.png') },
+    { kind: 'exact', path: '/m/icon-192.png', handler: makeIconHandler('mobile-icon-192.png') },
+    { kind: 'exact', path: '/m/icon-512.png', handler: makeIconHandler('mobile-icon-512.png') },
   ]
 }

package/src/pairing-access.ts

@@ -0,0 +1,36 @@
+/**
+ * Optional cordis service other host plugins can ctx.get without taking a
+ * package dependency: a live paired-device cookie is an allow path on
+ * routes that sit outside /api (and therefore outside api/gate).
+ */
+import type { IncomingMessage } from 'node:http'
+import { Service, type Context } from '@deepseek-ai/cordis'
+
+/** Named lookup key sibling plugins pass to ctx.get. */
+export const REMOTE_WEB_UI_PAIRING = 'remoteWebUiPairing'
+
+/**
+ * Pairing identity for one HTTP request. Structural: consumers must not
+ * import this class, only the method shape.
+ */
+export class RemoteWebUiPairing extends Service {
+  /**
+   * @param ctx - host plugin context.
+   * @param check - live cookie + session predicate (re-read per request).
+   */
+  constructor(
+    ctx: Context,
+    private readonly check: (request: IncomingMessage) => boolean,
+  ) {
+    super(ctx, REMOTE_WEB_UI_PAIRING)
+  }
+
+  /**
+   * Whether the request carries a live paired-device cookie.
+   * @param request - the incoming HTTP request.
+   * @returns true when the session is live and was refreshed.
+   */
+  isPairedDevice(request: IncomingMessage): boolean {
+    return this.check(request)
+  }
+}

package/src/pairing.persist.test.ts

@@ -0,0 +1,145 @@
+/**
+ * PairingService device-session persistence: with `devicesFile` set, sessions
+ * written on accept/stop survive a process restart (a new PairingService
+ * instance), so a previously paired phone — whose cookie already lives 365
+ * days — never needs to re-scan the QR after `dsh web` restarts.
+ */
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { pairingConfigOf } from './index.ts'
+import { PairingService, type PairingClock, type PairingConfig } from './pairing.ts'
+
+const BASE_CONFIG: Omit<PairingConfig, 'devicesFile'> = {
+  tokenTtlMs: 60_000,
+  offlineAfterMs: 25_000,
+  maxDevices: 4,
+  cookieName: 'dsh_pair',
+}
+
+/** Deterministic clock: tokens are issued in a fixed, readable sequence. */
+function makeClock(): PairingClock {
+  let n = 0
+  return {
+    now: () => 1_000_000 + n,
+    randomToken: () => `tok${(n++).toString().padStart(6, '0')}`,
+  }
+}
+
+/** Pair a device on a service: issue a token and immediately accept it. */
+function pairDevice(service: PairingService): string {
+  service.setPublicBaseUrl('https://pairing.example.trycloudflare.com')
+  const { token } = service.issue()
+  const result = service.accept(token)
+  if (!result.ok) throw new Error(`pair failed: ${result.code}`)
+  return result.deviceId
+}
+
+describe('PairingService device persistence', () => {
+  let dir: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'remote-web-ui-persist-'))
+  })
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('restores paired sessions across a process restart', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    const deviceId = pairDevice(first)
+    expect(readFileSync(file, 'utf8')).toContain(deviceId)
+    // Device ids are session credentials: the persisted file is 0600.
+    expect(statSync(file).mode & 0o777).toBe(0o600)
+
+    // Simulated restart: a brand-new service instance reading the same file.
+    const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(true)
+  })
+
+  it('carries devicesFile through the config mapping used by sync() (regression)', () => {
+    const file = join(dir, 'devices.json')
+    const mapped = pairingConfigOf({
+      tokenTtlMs: 60_000,
+      offlineAfterMs: 25_000,
+      maxDevices: 4,
+      cookieName: 'dsh_pair',
+      devicesFile: file,
+    })
+    expect(mapped.devicesFile).toBe(file)
+  })
+
+  it('keeps persisting after a sync-style service.config rebuild', () => {
+    const file = join(dir, 'devices.json')
+    const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    // applyImpl/sync() reassigns service.config from the resolved config on
+    // mount and on every settings change; the rebuild must not drop devicesFile.
+    service.config = pairingConfigOf({
+      tokenTtlMs: 60_000,
+      offlineAfterMs: 25_000,
+      maxDevices: 4,
+      cookieName: 'dsh_pair',
+      devicesFile: file,
+    })
+    const deviceId = pairDevice(service)
+    const restarted = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(restarted.hasDevice(deviceId)).toBe(true)
+  })
+
+  it('clamps a persisted table to maxDevices when the file holds more sessions', () => {
+    const file = join(dir, 'devices.json')
+    writeFileSync(file, JSON.stringify({
+      dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
+      dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
+      dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
+    }))
+    const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    expect(service.hasDevice('dev3')).toBe(true)
+    expect(service.hasDevice('dev2')).toBe(true)
+    expect(service.hasDevice('dev1')).toBe(false)
+  })
+
+  it('keeps sessions memory-only when devicesFile is unset', () => {
+    const first = new PairingService({ ...BASE_CONFIG }, makeClock())
+    const deviceId = pairDevice(first)
+    // No file was written; a fresh instance without the option knows nothing.
+    const second = new PairingService({ ...BASE_CONFIG }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(false)
+  })
+
+  it('persists revocation by stop() across a restart', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    const deviceId = pairDevice(first)
+    first.stop()
+
+    const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    expect(second.hasDevice(deviceId)).toBe(false)
+  })
+
+  it('persists FIFO eviction when the device cap is reached', () => {
+    const file = join(dir, 'devices.json')
+    const first = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    const firstDevice = pairDevice(first)
+    const secondDevice = pairDevice(first)
+    const thirdDevice = pairDevice(first) // evicts firstDevice
+    expect(first.hasDevice(firstDevice)).toBe(false)
+
+    const second = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock())
+    expect(second.hasDevice(secondDevice)).toBe(true)
+    expect(second.hasDevice(thirdDevice)).toBe(true)
+    expect(second.hasDevice(firstDevice)).toBe(false)
+  })
+
+  it('tolerates a corrupt or missing file instead of refusing to boot', () => {
+    const file = join(dir, 'devices.json')
+    writeFileSync(file, '{ this is not json !!!')
+    expect(() => new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())).not.toThrow()
+
+    const ghost = join(dir, 'does-not-exist.json')
+    expect(() => new PairingService({ ...BASE_CONFIG, devicesFile: ghost }, makeClock())).not.toThrow()
+  })
+})

package/src/pairing.ts

@@ -16,6 +16,8 @@
  */
 
 import { randomBytes } from 'node:crypto'
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
 
 /** The observable pairing phases the panel renders. */
 export type PairingPhase =
@@ -95,6 +97,13 @@ export interface PairingConfig {
   maxDevices: number
   /** Cookie name carrying the device id. */
   cookieName: string
+  /**
+   * Path to a JSON file where paired device sessions are persisted. When
+   * set, sessions survive process restarts (the phone keeps its 365-day
+   * cookie), so re-pairing after a dsh web restart is not required. When
+   * unset (default), sessions stay memory-only — the previous behavior.
+   */
+  devicesFile?: string
 }
 
 /** Result of one accept() attempt. */
@@ -154,7 +163,65 @@ export class PairingService {
   constructor(
     public config: PairingConfig,
     private readonly clock: PairingClock = defaultClock,
-  ) {}
+  ) {
+    this.loadPersisted()
+  }
+
+  /**
+   * Restore device sessions persisted by a previous process run. A corrupt
+   * or missing file is tolerated (an empty device table, never a throw) —
+   * persistence is an availability convenience, not a security boundary.
+   */
+  private loadPersisted(): void {
+    const file = this.config.devicesFile
+    if (file === undefined) return
+    try {
+      const saved = JSON.parse(readFileSync(file, 'utf8')) as unknown
+      if (typeof saved !== 'object' || saved === null) return
+      for (const [deviceId, session] of Object.entries(saved)) {
+        if (typeof deviceId !== 'string') continue
+        if (typeof session !== 'object' || session === null) continue
+        const { createdAt, lastSeenAt } = session as { createdAt?: unknown; lastSeenAt?: unknown }
+        if (typeof createdAt !== 'number' || typeof lastSeenAt !== 'number') continue
+        this.devices.set(deviceId, { createdAt, lastSeenAt })
+      }
+      this.clampToMaxDevices()
+    } catch {
+      // Unreadable/corrupt: start empty rather than refusing to boot.
+    }
+  }
+
+  /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+  private clampToMaxDevices(): void {
+    if (this.devices.size <= this.config.maxDevices) return
+    const overflow = this.devices.size - this.config.maxDevices
+    const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt)
+    for (const [id] of ordered.slice(0, overflow)) this.devices.delete(id)
+  }
+
+  /**
+   * Write the current device table to the configured file. Called on the
+   * mutation boundaries that change the set of live sessions (accept and
+   * stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+   * per-request write storm is avoided — after a restart the phone's first
+   * heartbeat re-warms its own session.
+   *
+   * Device ids are session credentials (the gate authorizes requests by the
+   * cookie's device id), so the file is written 0600 via a temp file and
+   * atomic rename; a crash mid-write can never leave a half-written store.
+   */
+  private persist(): void {
+    const file = this.config.devicesFile
+    if (file === undefined) return
+    try {
+      mkdirSync(dirname(file), { recursive: true })
+      const temp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`
+      writeFileSync(temp, JSON.stringify(Object.fromEntries(this.devices)), { mode: 0o600 })
+      renameSync(temp, file)
+    } catch (error) {
+      console.error('remote-web-ui: failed to persist paired devices', error)
+    }
+  }
 
   /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
   get lanBaseUrl(): string | undefined {
@@ -254,6 +321,7 @@ export class PairingService {
       if (oldest !== undefined) this.devices.delete(oldest.id)
     }
     this.devices.set(deviceId, { createdAt: now, lastSeenAt: now })
+    this.persist()
     this.notify()
     return { ok: true, deviceId }
   }
@@ -266,6 +334,7 @@ export class PairingService {
   stop(): void {
     this.tokens.clear()
     this.devices.clear()
+    this.persist()
     this.stopped = true
     this.notify()
   }

package/src/routes.ts

@@ -222,7 +222,16 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
   const ACCEPT_MAX_ATTEMPTS = 10
   const ACCEPT_WINDOW_MS = 30_000
   const rateLimitAccept = (req: IncomingMessage): boolean => {
-    const ip = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
+    const socketIp = (req.socket as { remoteAddress?: string } | undefined)?.remoteAddress ?? 'unknown'
+    // Behind the auto-tunnel every internet client arrives from 127.0.0.1,
+    // so a single shared bucket would let one attacker keep the legitimate
+    // owner rate-limited. Partition the availability bucket by the first
+    // client-visible XFF hop (set by the tunnel edge): XFF is untrusted for
+    // authentication and only separates buckets, it never grants access.
+    const forwarded = typeof req.headers['x-forwarded-for'] === 'string'
+      ? (req.headers['x-forwarded-for'].split(',')[0] ?? '').trim()
+      : undefined
+    const ip = forwarded === undefined || forwarded === '' ? socketIp : socketIp + '|' + forwarded
     const nowMs = Date.now()
     // The map lives as long as the plugin: prune expired windows once the
     // table grows past a modest size so distinct source IPs (LAN clients,
@@ -264,7 +273,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       const workspaceQuery = workspaceId === undefined ? '' : `&workspace=${encodeURIComponent(workspaceId)}`
       writeJson(res, 200, {
         ok: true,
-        url: `${base}/?pair=${token}${workspaceQuery}`,
+        url: `${base}/m/?pair=${token}${workspaceQuery}`,
         token,
         expiresAt,
         // Every constructible base, so a multi-homed panel can switch the
@@ -306,6 +315,9 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code })
       return
     }
+    // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
+    // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
+    // top-level navigations working while blocking cross-site subrequests.
     res.writeHead(200, {
       'content-type': 'application/json; charset=utf-8',
       'set-cookie': [
@@ -356,7 +368,15 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
       return
     }
     const deviceId = readCookie(req.headers.cookie, service.config.cookieName)
-    writeJson(res, 200, { ok: true, paired: deviceId !== undefined && service.hasDevice(deviceId), ...service.snapshot() })
+    const paired = deviceId !== undefined && service.hasDevice(deviceId)
+    const snapshot = service.snapshot()
+    // Unpaired LAN/tunnel clients get only the pairing-relevant fields; the
+    // token expiry, device roster, and public tunnel URL are an oracle for
+    // targeting and timing and stay behind a live device cookie.
+    const visible = paired
+      ? snapshot
+      : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses }
+    writeJson(res, 200, { ok: true, paired, ...visible })
   }
 
   const handleEvents = (req: IncomingMessage, res: ServerResponse): void => {

package/src/tunnel.ts

@@ -86,6 +86,9 @@ export class TunnelManager {
   private urlTimer: unknown | undefined
   private restartTimer: unknown | undefined
   private attempts = 0
+  // Generation counter: a stale ensureBinary resolution from an earlier
+  // start() must not spawn a second handle after a stop/start cycle.
+  private generation = 0
   private stopping = false
   private readonly urlListeners = new Set<(url: string) => void>()
   private readonly phaseListeners = new Set<(info: TunnelInfo) => void>()
@@ -123,6 +126,7 @@ export class TunnelManager {
     this.stopping = false
     this.targetUrl = targetUrl
     this.attempts = 0
+    this.generation += 1
     this.attempt()
   }
 
@@ -153,12 +157,13 @@ export class TunnelManager {
 
   private attempt(): void {
     if (this.stopping || this.targetUrl === undefined) return
+    const gen = this.generation
     this.setPhase('starting')
     this.handle = undefined
     this.url = undefined
     this.error = undefined
     void this.ensureBinary().then(() => {
-      if (this.stopping || this.targetUrl === undefined) return
+      if (this.stopping || this.targetUrl === undefined || gen !== this.generation) return
       const handle = this.factory(this.targetUrl)
       this.handle = handle
       this.urlTimer = this.timer.setTimeout(() => {
@@ -181,7 +186,7 @@ export class TunnelManager {
       })
     }).catch((value: unknown) => {
       // Binary install failed (no network, no platform build): report it.
-      if (this.stopping || this.targetUrl === undefined) return
+      if (this.stopping || this.targetUrl === undefined || gen !== this.generation) return
       const message = value instanceof Error ? value.message : String(value)
       this.fail(`could not obtain the cloudflared binary: ${message}`)
     })