@linxin666/dsh-remote-web-ui 0.1.20 → 0.2.1

package/lib/index.js

@@ -3,16 +3,16 @@ import { setInterval as setInterval$1 } from "node:timers";
 import { Service } from "@deepseek-ai/cordis";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { z as z$1 } from "zod";
 import { readFile } from "node:fs/promises";
-import { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { RpcId } from "@deepseek-ai/dsh-host-apiproxy/api/rpc";
 import { networkInterfaces } from "node:os";
 import { Tunnel, bin, install } from "cloudflared";
-import { dirname, join } from "node:path";
 import { spawn } from "node:child_process";
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@0.1.0-rc.6_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-brand@0_52495af71738a1095726249ceff4fd7b/node_modules/@deepseek-ai/dsh-settings/lib/index.js
+//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@0.1.0-rc.7_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-brand@0_6b0eb868fb92d854799855c05c5fa43c/node_modules/@deepseek-ai/dsh-settings/lib/index.js
 /**
 * Structural secret redaction for settings values. `role('secret')` fields are
 * removed from a value before it crosses a wire boundary; a sidecar records
@@ -271,6 +271,61 @@ var PairingService = class {
 	constructor(config, clock = defaultClock) {
 		this.config = config;
 		this.clock = clock;
+		this.loadPersisted();
+	}
+	/**
+	* Restore device sessions persisted by a previous process run. A corrupt
+	* or missing file is tolerated (an empty device table, never a throw) —
+	* persistence is an availability convenience, not a security boundary.
+	*/
+	loadPersisted() {
+		const file = this.config.devicesFile;
+		if (file === void 0) return;
+		try {
+			const saved = JSON.parse(readFileSync(file, "utf8"));
+			if (typeof saved !== "object" || saved === null) return;
+			for (const [deviceId, session] of Object.entries(saved)) {
+				if (typeof deviceId !== "string") continue;
+				if (typeof session !== "object" || session === null) continue;
+				const { createdAt, lastSeenAt } = session;
+				if (typeof createdAt !== "number" || typeof lastSeenAt !== "number") continue;
+				this.devices.set(deviceId, {
+					createdAt,
+					lastSeenAt
+				});
+			}
+			this.clampToMaxDevices();
+		} catch {}
+	}
+	/** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
+	clampToMaxDevices() {
+		if (this.devices.size <= this.config.maxDevices) return;
+		const overflow = this.devices.size - this.config.maxDevices;
+		const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
+		for (const [id] of ordered.slice(0, overflow)) this.devices.delete(id);
+	}
+	/**
+	* Write the current device table to the configured file. Called on the
+	* mutation boundaries that change the set of live sessions (accept and
+	* stop); `lastSeenAt` refreshes are deliberately not persisted here so a
+	* per-request write storm is avoided — after a restart the phone's first
+	* heartbeat re-warms its own session.
+	*
+	* Device ids are session credentials (the gate authorizes requests by the
+	* cookie's device id), so the file is written 0600 via a temp file and
+	* atomic rename; a crash mid-write can never leave a half-written store.
+	*/
+	persist() {
+		const file = this.config.devicesFile;
+		if (file === void 0) return;
+		try {
+			mkdirSync(dirname(file), { recursive: true });
+			const temp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+			writeFileSync(temp, JSON.stringify(Object.fromEntries(this.devices)), { mode: 384 });
+			renameSync(temp, file);
+		} catch (error) {
+			console.error("remote-web-ui: failed to persist paired devices", error);
+		}
 	}
 	/** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
 	get lanBaseUrl() {
@@ -365,6 +420,7 @@ var PairingService = class {
 			createdAt: now,
 			lastSeenAt: now
 		});
+		this.persist();
 		this.notify();
 		return {
 			ok: true,
@@ -379,6 +435,7 @@ var PairingService = class {
 	stop() {
 		this.tokens.clear();
 		this.devices.clear();
+		this.persist();
 		this.stopped = true;
 		this.notify();
 	}
@@ -566,11 +623,49 @@ function makeGateListener(service, requirePairingForLan = true, enabled = true)
 		if (isLoopbackClient(request)) return next();
 		if (!(typeof enabled === "function" ? enabled() : enabled)) return false;
 		if (!(typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan)) return next();
-		const deviceId = readCookie(request.headers.cookie, service.config.cookieName);
-		if (deviceId === void 0) return false;
-		return service.touchDevice(deviceId) ? next() : false;
+		return isPairedDeviceRequest(service, request) ? next() : false;
 	};
 }
+/**
+* Whether a request carries a live, non-revoked paired-device cookie for
+* this service. Sibling host routes outside /api (aionui-panel, etc.) use
+* the same check via the remoteWebUiPairing service.
+* @param service - the pairing service that owns the device table.
+* @param request - the incoming HTTP request.
+* @returns true when the cookie names a live session (and lastSeenAt was refreshed).
+*/
+function isPairedDeviceRequest(service, request) {
+	const deviceId = readCookie(request.headers.cookie, service.config.cookieName);
+	if (deviceId === void 0) return false;
+	return service.touchDevice(deviceId);
+}
+//#endregion
+//#region src/pairing-access.ts
+/** Named lookup key sibling plugins pass to ctx.get. */
+const REMOTE_WEB_UI_PAIRING = "remoteWebUiPairing";
+/**
+* Pairing identity for one HTTP request. Structural: consumers must not
+* import this class, only the method shape.
+*/
+var RemoteWebUiPairing = class extends Service {
+	check;
+	/**
+	* @param ctx - host plugin context.
+	* @param check - live cookie + session predicate (re-read per request).
+	*/
+	constructor(ctx, check) {
+		super(ctx, REMOTE_WEB_UI_PAIRING);
+		this.check = check;
+	}
+	/**
+	* Whether the request carries a live paired-device cookie.
+	* @param request - the incoming HTTP request.
+	* @returns true when the session is live and was refreshed.
+	*/
+	isPairedDevice(request) {
+		return this.check(request);
+	}
+};
 //#endregion
 //#region src/http.ts
 /** One JSON response. */
@@ -773,7 +868,9 @@ function makeRoutes(deps) {
 	const ACCEPT_MAX_ATTEMPTS = 10;
 	const ACCEPT_WINDOW_MS = 3e4;
 	const rateLimitAccept = (req) => {
-		const ip = req.socket?.remoteAddress ?? "unknown";
+		const socketIp = req.socket?.remoteAddress ?? "unknown";
+		const forwarded = typeof req.headers["x-forwarded-for"] === "string" ? (req.headers["x-forwarded-for"].split(",")[0] ?? "").trim() : void 0;
+		const ip = forwarded === void 0 || forwarded === "" ? socketIp : socketIp + "|" + forwarded;
 		const nowMs = Date.now();
 		if (acceptAttempts.size > 256) {
 			for (const [key, attempt] of acceptAttempts) if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key);
@@ -814,7 +911,7 @@ function makeRoutes(deps) {
 			if (base === void 0) throw new Error("remote-web-ui: base unavailable");
 			writeJson(res, 200, {
 				ok: true,
-				url: `${base}/?pair=${token}${workspaceId === void 0 ? "" : `&workspace=${encodeURIComponent(workspaceId)}`}`,
+				url: `${base}/m/?pair=${token}${workspaceId === void 0 ? "" : `&workspace=${encodeURIComponent(workspaceId)}`}`,
 				token,
 				expiresAt,
 				lanAddresses: service.lanAddresses,
@@ -927,10 +1024,16 @@ function makeRoutes(deps) {
 			return;
 		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+		const paired = deviceId !== void 0 && service.hasDevice(deviceId);
+		const snapshot = service.snapshot();
 		writeJson(res, 200, {
 			ok: true,
-			paired: deviceId !== void 0 && service.hasDevice(deviceId),
-			...service.snapshot()
+			paired,
+			...paired ? snapshot : {
+				phase: snapshot.phase,
+				lanAvailable: snapshot.lanAvailable,
+				lanAddresses: snapshot.lanAddresses
+			}
 		});
 	};
 	const handleEvents = (req, res) => {
@@ -981,23 +1084,25 @@ function makeRoutes(deps) {
 //#endregion
 //#region src/mobile-routes.ts
 /**
-* The mobile surface's page routes: `/m` serves the standalone phone UI
-* (an independent bundle, built to lib/mobile.js by the mobile tsdown
-* entry), `/m/mobile.js` serves the bundle itself. The page talks to the
-* host exclusively through the shared /api transport (paired-device cookie
-* already crosses the api/gate fence), so no host-side data plumbing is
-* needed here — only static serving, loopback+paired-fence via the normal
-* webserver route registration.
+* The mobile surface's page routes: /m canonicalizes to /m/, which serves the
+* standalone phone UI. The page and worker live in the /m/ scope so the PWA
+* can cache only its static shell; the paired-device data channel remains at
+* /m/api and is never handled by the worker.
 */
+const MOBILE_ROOT = "/m/";
+const MOBILE_BUNDLE_URL = "/m/mobile.js";
+const MOBILE_MANIFEST_URL = "/m/manifest.webmanifest";
+const MOBILE_WORKER_URL = "/m/service-worker.js";
+const MOBILE_OFFLINE_URL = "/m/offline.html";
 /** The standalone mobile bundle (built artifact, next to this file's own lib output). */
 function mobileBundlePath() {
 	return fileURLToPath(new URL("../lib/mobile.js", import.meta.url));
 }
-/** The apple-touch-icon shipped with the package (iOS home-screen icon, 180x180 PNG). */
-function appleTouchIconPath() {
-	return fileURLToPath(new URL("../assets/apple-touch-icon.png", import.meta.url));
+/** A package asset available to the host after a registry or git install. */
+function mobileAssetPath(name) {
+	return fileURLToPath(new URL("../assets/" + name, import.meta.url));
 }
-/** The mobile page shell: minimal, offline-safe, no external assets. */
+/** The mobile page shell: self-contained, with no document-level user data. */
 function pageHtml(bundleUrl) {
 	return [
 		"<!doctype html>",
@@ -1007,26 +1112,80 @@ function pageHtml(bundleUrl) {
 		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover\">",
 		"<meta name=\"theme-color\" content=\"#f3f5f9\">",
 		"<meta name=\"referrer\" content=\"no-referrer\">",
+		"<meta name=\"mobile-web-app-capable\" content=\"yes\">",
+		"<meta name=\"apple-mobile-web-app-capable\" content=\"yes\">",
+		"<meta name=\"apple-mobile-web-app-title\" content=\"DSH Remote\">",
+		"<link rel=\"manifest\" href=\"/m/manifest.webmanifest\">",
 		"<link rel=\"apple-touch-icon\" href=\"/m/apple-touch-icon.png\">",
 		"<title>移动端远程控制</title>",
 		"</head>",
 		"<body>",
 		"<div id=\"root\"></div>",
-		`<script type="module" src="${bundleUrl}"><\/script>`,
+		"<script type=\"module\" src=\"" + bundleUrl + "\"><\/script>",
 		"</body>",
 		"</html>"
 	].join("");
 }
-/** Send a small static body with cache headers (the bundle is content-hashed by rebuild). */
+/** The installable app identity and icon declarations for the /m scope. */
+function manifestJson() {
+	return JSON.stringify({
+		id: MOBILE_ROOT,
+		name: "DSH Remote",
+		short_name: "DSH Remote",
+		start_url: MOBILE_ROOT,
+		scope: MOBILE_ROOT,
+		display: "standalone",
+		background_color: "#151424",
+		theme_color: "#f3f5f9",
+		icons: [{
+			src: "/m/icon-192.png",
+			sizes: "192x192",
+			type: "image/png",
+			purpose: "any"
+		}, {
+			src: "/m/icon-512.png",
+			sizes: "512x512",
+			type: "image/png",
+			purpose: "any maskable"
+		}]
+	}, null, 2);
+}
+/** A static fallback that contains no paired-device, session, or workspace data. */
+function offlineHtml() {
+	return [
+		"<!doctype html>",
+		"<html lang=\"zh-CN\">",
+		"<head>",
+		"<meta charset=\"utf-8\">",
+		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, viewport-fit=cover\">",
+		"<meta name=\"theme-color\" content=\"#151424\">",
+		"<title>DSH Remote</title>",
+		"<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>",
+		"</head>",
+		"<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>",
+		"</html>"
+	].join("");
+}
+/** Send a small static UTF-8 body with revalidation headers. */
 function writeStatic(res, status, type, body) {
 	res.writeHead(status, {
-		"content-type": `${type}; charset=utf-8`,
+		"content-type": type + "; charset=utf-8",
 		"cache-control": "no-cache",
 		"referrer-policy": "no-referrer"
 	});
 	res.end(body);
 }
-/** Send the PNG icon as a binary body (unlike text assets, the PNG must not be decoded to utf-8). */
+/** Send the worker with the same scope it registers for, without HTTP caching. */
+function writeServiceWorker(res, body) {
+	res.writeHead(200, {
+		"content-type": "text/javascript; charset=utf-8",
+		"cache-control": "no-cache",
+		"referrer-policy": "no-referrer",
+		"service-worker-allowed": MOBILE_ROOT
+	});
+	res.end(body);
+}
+/** Send a PNG body without decoding it to UTF-8. */
 function writePng(res, status, body) {
 	res.writeHead(status, {
 		"content-type": "image/png",
@@ -1035,13 +1194,29 @@ function writePng(res, status, body) {
 	});
 	res.end(body);
 }
+/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
+function redirectToMobileRoot(req, res) {
+	const url = new URL(req.url ?? "/m", "http://x");
+	res.writeHead(308, {
+		location: MOBILE_ROOT + url.search,
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer"
+	});
+	res.end();
+}
 /**
 * Build the mobile page routes.
-* @returns the two exact routes to register on webServer.
+* @returns Exact routes for the canonical page, static shell, and PWA assets.
 */
 function makeMobileRoutes() {
 	const handlePage = (_req, res) => {
-		writeStatic(res, 200, "text/html", pageHtml("/m/mobile.js"));
+		writeStatic(res, 200, "text/html", pageHtml(MOBILE_BUNDLE_URL));
+	};
+	const handleManifest = (_req, res) => {
+		writeStatic(res, 200, "application/manifest+json", manifestJson());
+	};
+	const handleOffline = (_req, res) => {
+		writeStatic(res, 200, "text/html", offlineHtml());
 	};
 	let bundleBody;
 	const handleBundle = async (_req, res) => {
@@ -1060,41 +1235,95 @@ function makeMobileRoutes() {
 		}
 		writeStatic(res, 200, "text/javascript", bundleBody);
 	};
-	const handleIcon = async (_req, res) => {
-		const path = appleTouchIconPath();
+	let workerBody;
+	const handleWorker = async (_req, res) => {
+		if (workerBody === void 0) {
+			const path = mobileAssetPath("mobile-service-worker.js");
+			if (!existsSync(path)) {
+				writeStatic(res, 503, "text/plain", "mobile service worker not found");
+				return;
+			}
+			try {
+				workerBody = await readFile(path, "utf8");
+			} catch {
+				writeStatic(res, 500, "text/plain", "failed to read the mobile service worker");
+				return;
+			}
+		}
+		writeServiceWorker(res, workerBody);
+	};
+	const makeIconHandler = (asset) => async (_req, res) => {
+		const path = mobileAssetPath(asset);
 		if (!existsSync(path)) {
-			writeStatic(res, 404, "text/plain", "apple-touch-icon not found");
+			writeStatic(res, 404, "text/plain", asset + " not found");
 			return;
 		}
 		try {
 			writePng(res, 200, await readFile(path));
 		} catch {
-			writeStatic(res, 500, "text/plain", "failed to read the apple-touch-icon");
+			writeStatic(res, 500, "text/plain", "failed to read " + asset);
 		}
 	};
 	return [
 		{
 			kind: "exact",
 			path: "/m",
+			handler: redirectToMobileRoot
+		},
+		{
+			kind: "exact",
+			path: MOBILE_ROOT,
 			handler: handlePage
 		},
 		{
 			kind: "exact",
-			path: "/m/mobile.js",
+			path: MOBILE_BUNDLE_URL,
 			handler: handleBundle
 		},
+		{
+			kind: "exact",
+			path: MOBILE_MANIFEST_URL,
+			handler: handleManifest
+		},
+		{
+			kind: "exact",
+			path: MOBILE_WORKER_URL,
+			handler: handleWorker
+		},
+		{
+			kind: "exact",
+			path: MOBILE_OFFLINE_URL,
+			handler: handleOffline
+		},
 		{
 			kind: "exact",
 			path: "/m/apple-touch-icon.png",
-			handler: handleIcon
+			handler: makeIconHandler("apple-touch-icon.png")
+		},
+		{
+			kind: "exact",
+			path: "/m/icon-192.png",
+			handler: makeIconHandler("mobile-icon-192.png")
+		},
+		{
+			kind: "exact",
+			path: "/m/icon-512.png",
+			handler: makeIconHandler("mobile-icon-512.png")
 		}
 	];
 }
 //#endregion
 //#region src/mobile-api.ts
-/** Methods the phone surface may call. Everything else is refused. */
+/**
+* Methods the phone surface may call. Everything else is refused HERE — but
+* note the paired-device cookie also passes the global api/gate for the full
+* ApiProxy surface (gate.ts), so a paired phone is a full-control credential:
+* the allowlist only constrains this /m/api proxy, not the cookie's reach.
+* stop() revokes every device; there is no per-device revocation yet.
+*/
 const MOBILE_ALLOWLIST = /* @__PURE__ */ new Set([
 	"workspace.list",
+	"agentPreset.list",
 	"session.create",
 	"session.list",
 	"session.history",
@@ -1359,6 +1588,7 @@ async function dispatch(apiProxy, method, payload, rpcId, signal) {
 		result: response.result
 	});
 	if (method === "workspace.list") return wrap(await apiProxy.workspace.list(request));
+	if (method === "agentPreset.list") return wrap(await apiProxy.agentPresets.list(request));
 	if (method === "session.create") return wrap(await apiProxy.sessions.create(request));
 	if (method === "session.history") return wrap(await apiProxy.sessions.history(request));
 	if (method === "session.search") return wrap(await apiProxy.sessions.search(request, signal ?? new AbortController().signal));
@@ -1436,6 +1666,7 @@ var TunnelManager = class {
 	urlTimer;
 	restartTimer;
 	attempts = 0;
+	generation = 0;
 	stopping = false;
 	urlListeners = /* @__PURE__ */ new Set();
 	phaseListeners = /* @__PURE__ */ new Set();
@@ -1470,6 +1701,7 @@ var TunnelManager = class {
 		this.stopping = false;
 		this.targetUrl = targetUrl;
 		this.attempts = 0;
+		this.generation += 1;
 		this.attempt();
 	}
 	/** Stop the tunnel for good: no restarts, no state. */
@@ -1499,12 +1731,13 @@ var TunnelManager = class {
 	}
 	attempt() {
 		if (this.stopping || this.targetUrl === void 0) return;
+		const gen = this.generation;
 		this.setPhase("starting");
 		this.handle = void 0;
 		this.url = void 0;
 		this.error = void 0;
 		this.ensureBinary().then(() => {
-			if (this.stopping || this.targetUrl === void 0) return;
+			if (this.stopping || this.targetUrl === void 0 || gen !== this.generation) return;
 			const handle = this.factory(this.targetUrl);
 			this.handle = handle;
 			this.urlTimer = this.timer.setTimeout(() => {
@@ -1523,7 +1756,7 @@ var TunnelManager = class {
 				this.error = value instanceof Error ? value.message : String(value);
 			});
 		}).catch((value) => {
-			if (this.stopping || this.targetUrl === void 0) return;
+			if (this.stopping || this.targetUrl === void 0 || gen !== this.generation) return;
 			const message = value instanceof Error ? value.message : String(value);
 			this.fail(`could not obtain the cloudflared binary: ${message}`);
 		});
@@ -1715,12 +1948,13 @@ function resolveUpdateTarget(deps) {
 	if (anchor === void 0) return { error: "not-found" };
 	const profile = findProfile(manifestPath);
 	if (profile === void 0) return { error: "link" };
-	const spec = (readManifest(join(profile.dir, "package.json"))?.dependencies)?.[anchor];
+	const profileManifest = readManifest(join(profile.dir, "package.json"));
+	const spec = (profileManifest?.dependencies)?.[anchor];
 	if (isLinkedSpec(spec)) return { error: "link" };
 	return {
 		profileName: profile.name,
 		profileDir: profile.dir,
-		packages: [anchor, ...familyChildren(manifest)]
+		packages: familyUpdatePackages(anchor, manifest, profileManifest)
 	};
 }
 /** Family children of the anchor: its dependencies under the family scope. */
@@ -1731,6 +1965,14 @@ function familyChildren(anchorManifest) {
 	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string") names.push(name);
 	return names;
 }
+/** Registry-managed family packages covered by one update operation. */
+function familyUpdatePackages(anchor, anchorManifest, profileManifest) {
+	const names = /* @__PURE__ */ new Set([anchor, ...familyChildren(anchorManifest)]);
+	const dependencies = profileManifest?.dependencies;
+	if (typeof dependencies !== "object" || dependencies === null) return [...names];
+	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string" && !isLinkedSpec(spec)) names.add(name);
+	return [...names];
+}
 /**
 * Probe the npm registry for one package's latest release.
 * @param name - the package name (scope slash URL-encoded).
@@ -1745,7 +1987,7 @@ async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
 			controller.abort();
 		}, timeoutMs);
 		try {
-			const response = await fetchImpl("https://registry.npmjs.org/" + name.replace("/", "%2F") + "/latest");
+			const response = await fetchImpl("https://registry.npmjs.org/" + name.replace("/", "%2F") + "/latest", { signal: controller.signal });
 			if (!response.ok) return void 0;
 			const body = await response.json();
 			if (typeof body !== "object" || body === null) return void 0;
@@ -1766,14 +2008,15 @@ async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
 */
 const VERSION_UNKNOWN = "0.0.0";
 /** The resolved current version of one family package (probe failure tolerated). */
-function readInstalledVersion(resolve, name) {
+function readInstalledVersion(resolve, name, profileDir) {
 	try {
 		const path = resolve(name + "/package.json");
 		const version = path === void 0 ? void 0 : readManifest(path)?.version;
-		return typeof version === "string" ? version : VERSION_UNKNOWN;
-	} catch {
-		return VERSION_UNKNOWN;
-	}
+		if (typeof version === "string") return version;
+	} catch {}
+	if (profileDir === void 0 || !/^@linxin666\/[a-z0-9][a-z0-9._-]*$/.test(name)) return VERSION_UNKNOWN;
+	const version = readManifest(join(profileDir, "node_modules", ...name.split("/"), "package.json"))?.version;
+	return typeof version === "string" ? version : VERSION_UNKNOWN;
 }
 /**
 * Build the update status: locate the anchor, detect the install mode, and
@@ -1808,14 +2051,14 @@ async function checkUpdates(deps) {
 		packages: [],
 		outdated: false
 	};
-	const names = [anchor, ...familyChildren(manifest)];
+	const names = familyUpdatePackages(anchor, manifest, profileManifest);
 	const latestList = await Promise.all(names.map((name) => deps.fetchLatest(name)));
 	const packages = [];
 	let probeFailures = 0;
 	names.forEach((name, index) => {
 		const latest = latestList[index];
 		if (latest === void 0) probeFailures++;
-		const current = readInstalledVersion(deps.resolve, name);
+		const current = readInstalledVersion(deps.resolve, name, profile.dir);
 		packages.push({
 			name,
 			current,
@@ -2027,7 +2270,7 @@ function runUpdate(deps) {
 async function runUpdateVerified(deps) {
 	const before = /* @__PURE__ */ new Map();
 	for (const name of deps.run.packages) {
-		const version = readInstalledVersion(deps.check.resolve, name);
+		const version = readInstalledVersion(deps.check.resolve, name, deps.run.profileDir);
 		if (version !== VERSION_UNKNOWN) before.set(name, version);
 	}
 	const result = await runUpdate(deps.run);
@@ -2184,12 +2427,28 @@ const Config = z.object({
 	cookieName: z.string().min(1).default("dsh_pair"),
 	requirePairingForLan: z.boolean().default(true),
 	publicBaseUrl: z.string(),
+	devicesFile: z.string(),
 	autoTunnel: z.boolean().default(false),
 	mobileEnterToSend: z.boolean().default(true),
 	enabled: z.boolean().default(true)
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 1e4;
+/**
+* The single mapping from resolved plugin config to the pairing service
+* config. Both the constructed service and every live settings sync reuse
+* it, so no field can be silently dropped when the web settings surface
+* pushes a new value into the running service.
+*/
+function pairingConfigOf(resolved) {
+	return {
+		tokenTtlMs: resolved.tokenTtlMs,
+		offlineAfterMs: resolved.offlineAfterMs,
+		maxDevices: resolved.maxDevices,
+		cookieName: resolved.cookieName,
+		devicesFile: resolved.devicesFile
+	};
+}
 /** Schema defaults, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULTS = {
 	tokenTtlMs: 10 * 6e4,
@@ -2198,6 +2457,7 @@ const DEFAULTS = {
 	cookieName: "dsh_pair",
 	requirePairingForLan: true,
 	publicBaseUrl: void 0,
+	devicesFile: void 0,
 	autoTunnel: false,
 	mobileEnterToSend: true,
 	enabled: true
@@ -2216,6 +2476,7 @@ function applyImpl(ctx, config) {
 		cookieName: config?.cookieName ?? DEFAULTS.cookieName,
 		requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
 		publicBaseUrl: config?.publicBaseUrl,
+		devicesFile: config?.devicesFile,
 		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
 		mobileEnterToSend: config?.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
 		enabled: config?.enabled ?? DEFAULTS.enabled
@@ -2230,17 +2491,13 @@ function applyImpl(ctx, config) {
 			cookieName: value.cookieName ?? DEFAULTS.cookieName,
 			requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
 			publicBaseUrl: value.publicBaseUrl,
+			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
 			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
 			mobileEnterToSend: value.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
 			enabled: value.enabled ?? DEFAULTS.enabled
 		};
 	};
-	const service = new PairingService({
-		tokenTtlMs: resolved.tokenTtlMs,
-		offlineAfterMs: resolved.offlineAfterMs,
-		maxDevices: resolved.maxDevices,
-		cookieName: resolved.cookieName
-	});
+	const service = new PairingService(pairingConfigOf(resolved));
 	const tunnel = new TunnelManager();
 	let autoTunnel = resolved.autoTunnel;
 	tunnel.onPhase((info) => {
@@ -2342,14 +2599,13 @@ function applyImpl(ctx, config) {
 	];
 	const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
 	ctx.effect(() => ctx.on("api/gate", gate), "remote-web-ui: api gate");
+	new RemoteWebUiPairing(ctx, (request) => {
+		if (!resolve().enabled) return false;
+		return isPairedDeviceRequest(service, request);
+	});
 	const sync = () => {
 		const value = resolve();
-		service.config = {
-			tokenTtlMs: value.tokenTtlMs,
-			offlineAfterMs: value.offlineAfterMs,
-			maxDevices: value.maxDevices,
-			cookieName: value.cookieName
-		};
+		service.config = pairingConfigOf(value);
 		autoTunnel = value.autoTunnel === true;
 		if (autoTunnel) {
 			if (value.publicBaseUrl !== void 0) console.warn("remote-web-ui: autoTunnel is on — ignoring the manually configured publicBaseUrl");
@@ -2406,4 +2662,4 @@ function isHttpUrl(value) {
 	}
 }
 //#endregion
-export { Config, REMOTE_WEB_UI_SETTINGS_NAMESPACE, apply, inject, name };
+export { Config, REMOTE_WEB_UI_SETTINGS_NAMESPACE, apply, inject, name, pairingConfigOf };