@linxin666/dsh-remote-web-ui 0.2.3 → 0.2.5

package/src/index.ts

@@ -9,18 +9,22 @@
  */
 
 import { createRequire } from 'node:module'
-import { setInterval as nodeSetInterval } from 'node:timers'
+import { join } from 'node:path'
+import { setInterval as nodeSetInterval, setTimeout as nodeSetTimeout } from 'node:timers'
 import type { IncomingMessage } from 'node:http'
 import type { Context } from '@deepseek-ai/cordis'
 import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings'
 import z from 'schemastery'
 import type {} from '@deepseek-ai/dsh-host-webserver'
-import { PairingService, type PairingConfig } from './pairing.ts'
+import { DEFAULT_IDLE_EXPIRE_MS, PairingService, type PairingConfig } from './pairing.ts'
+import { dshHome } from './dsh-home.ts'
 import { isPairedDeviceRequest, makeGateListener } from './gate.ts'
 import { RemoteWebUiPairing } from './pairing-access.ts'
 import { isTrustedApiRequest, makeRoutes } from './routes.ts'
 import { makeMobileRoutes } from './mobile-routes.ts'
 import { makeMobileApiRoutes } from './mobile-api.ts'
+import { makeRemoteApiRoutes, makeRemoteApiUpgradeRoutes } from './remote-api.ts'
+import { anyExposed, claimPostureKey, postureTargets, probePosture, releasePostureKey } from './posture.ts'
 import { lanIPv4Addresses } from './lan.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
 import {
@@ -72,13 +76,19 @@ export interface Config {
   offlineAfterMs?: number
   /** Hard cap on paired device sessions (oldest evicted when full). */
   maxDevices?: number
+  /**
+   * Idle sessions older than this (ms) are deleted from memory and disk.
+   * Default is 7 days; a leftover cookie no longer authorizes after expiry.
+   */
+  idleExpireMs?: number
   /** Cookie name carrying the paired device id. */
   cookieName?: string
   /**
-   * When true (default), every non-loopback /api request must carry a live
-   * paired-device cookie — the QR is the only way into a LAN-exposed dsh
-   * web, and stop() genuinely cuts paired devices off. Set false to keep
-   * the fence's open-LAN behavior and use pairing only for tokens/status.
+   * When true (default), a desktop Web GUI opened at a non-loopback origin
+   * rides the gated `/remote/api` channel and must carry a live paired-device
+   * cookie — the QR is the only way into remote desktop, and stop() cuts
+   * paired devices off. Set false to keep the desktop on plain `/api`
+   * (only useful when that origin is already trusted for `/api`).
    */
   requirePairingForLan?: boolean
   /**
@@ -92,17 +102,16 @@ export interface Config {
   publicBaseUrl?: string
   /**
    * Absolute path to a JSON file where paired device sessions are persisted.
-   * When set, a paired phone keeps its session across `dsh web` restarts
-   * (the phone-side cookie already lives 365 days), so re-scanning the QR
-   * after each restart is unnecessary. Unset keeps sessions memory-only
-   * (previous behavior).
+   * Defaults to `$DSH_HOME/remote-web-ui-devices.json` so a paired device
+   * keeps its session across `dsh web` restarts (the cookie already lives
+   * 365 days). Override to another absolute path when needed.
    */
   devicesFile?: string
   /**
    * When true, the plugin runs its own Cloudflare quick tunnel (the
    * cloudflared binary ships with the package — no user-side install) and
-   * feeds the minted public URL into both the QR base and the /api trust
-   * fence dynamically, so phones anywhere can pair without any manual
+   * feeds the minted public URL into the QR base and the phone-facing
+   * pairing fence dynamically, so phones anywhere can pair without any manual
    * tunnel setup. The manual `publicBaseUrl` is ignored while this is on.
    */
   autoTunnel?: boolean
@@ -121,6 +130,7 @@ export const Config: z<Config> = z.object({
   tokenTtlMs: z.number().step(1).min(60_000).default(10 * 60_000),
   offlineAfterMs: z.number().step(1).min(5_000).default(25_000),
   maxDevices: z.number().step(1).min(1).max(64).default(4),
+  idleExpireMs: z.number().step(1).min(60_000).default(DEFAULT_IDLE_EXPIRE_MS),
   cookieName: z.string().min(1).default('dsh_pair'),
   requirePairingForLan: z.boolean().default(true),
   publicBaseUrl: z.string(),
@@ -140,7 +150,7 @@ const SWEEP_INTERVAL_MS = 10_000
  */
 type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile'>> & {
   publicBaseUrl: string | undefined
-  devicesFile: string | undefined
+  devicesFile: string
 }
 
 /**
@@ -151,26 +161,33 @@ type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile'>> &
  */
 export function pairingConfigOf(resolved: Pick<
   ResolvedConfig,
-  'tokenTtlMs' | 'offlineAfterMs' | 'maxDevices' | 'cookieName' | 'devicesFile'
+  'tokenTtlMs' | 'offlineAfterMs' | 'maxDevices' | 'idleExpireMs' | 'cookieName' | 'devicesFile'
 >): PairingConfig {
   return {
     tokenTtlMs: resolved.tokenTtlMs,
     offlineAfterMs: resolved.offlineAfterMs,
     maxDevices: resolved.maxDevices,
+    idleExpireMs: resolved.idleExpireMs,
     cookieName: resolved.cookieName,
     devicesFile: resolved.devicesFile,
   }
 }
 
+/** Default paired-session store: `$DSH_HOME/remote-web-ui-devices.json`. */
+export function defaultDevicesFile(home: string = dshHome()): string {
+  return join(home, 'remote-web-ui-devices.json')
+}
+
 /** Schema defaults, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULTS: ResolvedConfig = {
   tokenTtlMs: 10 * 60_000,
   offlineAfterMs: 25_000,
   maxDevices: 4,
+  idleExpireMs: DEFAULT_IDLE_EXPIRE_MS,
   cookieName: 'dsh_pair',
   requirePairingForLan: true,
   publicBaseUrl: undefined,
-  devicesFile: undefined,
+  devicesFile: defaultDevicesFile(),
   autoTunnel: false,
   mobileEnterToSend: true,
   enabled: true,
@@ -188,10 +205,11 @@ function applyImpl(ctx: Context, config?: Config): void {
     tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
     offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
     maxDevices: config?.maxDevices ?? DEFAULTS.maxDevices,
+    idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
     cookieName: config?.cookieName ?? DEFAULTS.cookieName,
     requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
     publicBaseUrl: config?.publicBaseUrl,
-    devicesFile: config?.devicesFile,
+    devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
     autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
     mobileEnterToSend: config?.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
     enabled: config?.enabled ?? DEFAULTS.enabled,
@@ -206,6 +224,7 @@ function applyImpl(ctx: Context, config?: Config): void {
       tokenTtlMs: value.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
       offlineAfterMs: value.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
       maxDevices: value.maxDevices ?? DEFAULTS.maxDevices,
+      idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
       cookieName: value.cookieName ?? DEFAULTS.cookieName,
       requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
       publicBaseUrl: value.publicBaseUrl,
@@ -230,6 +249,7 @@ function applyImpl(ctx: Context, config?: Config): void {
     if (info.phase === 'running' && info.url !== undefined) {
       service.setPublicBaseUrl(info.url)
       service.setTunnelStatus({ state: 'running', url: info.url })
+      runPostureProbe()
     } else if (info.phase === 'starting') {
       // A restart mints a NEW hostname: the previous URL dies with the old
       // process, so clear it now rather than advertising a dead link.
@@ -338,10 +358,56 @@ function applyImpl(ctx: Context, config?: Config): void {
     ...(apiProxy !== undefined
       ? makeMobileApiRoutes({ service, apiProxy, mobileEnterToSend: () => resolve().mobileEnterToSend })
       : []),
+    // The remote desktop channel: paired-cookie-gated `/remote` prefix that
+    // re-issues fenced paths to loopback (see remote-api.ts).
+    ...makeRemoteApiRoutes({ service, port: ctx.webServer.port }),
     ...updateRoutes,
   ]
+  const upgrades = makeRemoteApiUpgradeRoutes({ service, port: ctx.webServer.port })
   const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled)
   ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate')
+
+  // ── posture probe ─────────────────────────────────────────────────────────
+  // Guardrail for the one seam this plugin cannot mount a gate into: the
+  // connection plugin's /api Host fence. Forged-Host probes against every
+  // advertised origin (public base + LAN bases) make a re-opened /api (a
+  // re-added --trusted-host, or the SDK's LAN auto-trust under 0.0.0.0)
+  // visible on the panel and the log instead of silently trusted.
+  let postureKey: string | undefined
+  let postureWasExposed = false
+  const runPostureProbe = (): void => {
+    if (!resolve().enabled) return
+    const targets = postureTargets(service.publicBaseUrl, service.lanAddresses, ctx.webServer.port)
+    if (targets.length === 0) {
+      postureKey = undefined
+      service.setPosture(undefined)
+      return
+    }
+    const key = targets.join('|')
+    const claim = claimPostureKey(postureKey, key)
+    if (!claim.run) return
+    postureKey = claim.next
+    void probePosture({ port: ctx.webServer.port, targets }).then((snapshot) => {
+      service.setPosture(snapshot)
+      const exposedHosts = snapshot.hosts.filter(host => host.exposed).map(host => host.host)
+      const exposed = exposedHosts.length > 0
+      if (exposed && !postureWasExposed) {
+        console.error(`remote-web-ui: CRITICAL — the /api fence is OPEN for [${exposedHosts.join(', ')}]: unpaired clients reach the full host API. Remove --trusted-host for these hosts (pairing covers them) or bind loopback.`)
+      } else if (!exposed && postureWasExposed) {
+        console.log('remote-web-ui: the /api posture probe is clean again (every advertised origin refused with 403).')
+      }
+      postureWasExposed = exposed
+    }).catch(() => {
+      // Keep the previous snapshot; drop the in-flight key so the same
+      // targets retry instead of sticking on a failed round.
+      postureKey = releasePostureKey(postureKey, key)
+    })
+  }
+  // The first round waits for the connection plugin's /api route: a probe
+  // before it mounts would read the SPA fallback and false-positive.
+  const initialPostureTimer = nodeSetTimeout(() => { runPostureProbe() }, 5_000)
+  initialPostureTimer.unref()
+  ctx.effect(() => () => { clearTimeout(initialPostureTimer) }, 'remote-web-ui: posture probe boot')
   // Sibling plugins (aionui-panel, …) look this up by name. Absent when this
   // plugin is not installed; stop() / enabled=false still refuse cookies.
   new RemoteWebUiPairing(ctx, (request) => {
@@ -376,7 +442,10 @@ function applyImpl(ctx: Context, config?: Config): void {
     if (disposeRoutes === undefined && enabled) {
       disposeRoutes = ctx.effect(
         () => {
-          const disposers = routes.map(route => ctx.webServer.register(route))
+          const disposers = [
+            ...routes.map(route => ctx.webServer.register(route)),
+            ...upgrades.map(route => ctx.webServer.registerUpgrade(route)),
+          ]
           return () => { for (const dispose of disposers) dispose() }
         },
         'remote-web-ui: pairing routes',
@@ -398,6 +467,9 @@ function applyImpl(ctx: Context, config?: Config): void {
       disposeSweep()
       disposeSweep = undefined
     }
+    // Settings changed the reachable posture (manual publicBaseUrl, bind):
+    // re-probe unless the target set is unchanged.
+    runPostureProbe()
   }
   installSettingsSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
     setSource: (source) => {

package/src/loopback-proxy.ts

@@ -0,0 +1,126 @@
+/**
+ * Loopback-shaped reverse proxy used by the remote desktop channel: after
+ * the pairing cookie gate, traffic is re-issued to 127.0.0.1 so sibling
+ * plugin fences (socket + Host loopback) accept it. Origin, cookies, and
+ * caller-controlled Sec-Fetch markers are dropped. HTTP requests receive a
+ * synthetic same-origin marker after the pairing gate so sibling loopback
+ * routes that require a browser tripwire accept the authenticated proxy.
+ */
+
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http'
+import { request as httpRequest } from 'node:http'
+import { connect } from 'node:net'
+import type { Duplex } from 'node:stream'
+import { writeJson } from './http.ts'
+
+/** WebSocket handshake headers forwarded to the loopback upstream. */
+const WS_FORWARD_HEADERS = [
+  'sec-websocket-key',
+  'sec-websocket-version',
+  'sec-websocket-extensions',
+  'sec-websocket-protocol',
+] as const
+
+/** Response headers copied from the loopback upstream (no hop-by-hop). */
+const HTTP_FORWARD_RESPONSE_HEADERS = [
+  'content-type',
+  'content-length',
+  'content-disposition',
+  'cache-control',
+  'etag',
+  'last-modified',
+] as const
+
+/**
+ * Pipe one HTTP request to loopback and stream the response back.
+ * @param req - the already-gated outer request.
+ * @param res - the outer response.
+ * @param port - local webServer port.
+ * @param upstreamPath - path + query on 127.0.0.1 (must start with `/`).
+ */
+export function proxyLoopbackHttp(
+  req: IncomingMessage,
+  res: ServerResponse,
+  port: number,
+  upstreamPath: string,
+): void {
+  const headers: Record<string, string> = {
+    host: `127.0.0.1:${String(port)}`,
+    'sec-fetch-site': 'same-origin',
+  }
+  const contentType = req.headers['content-type']
+  if (typeof contentType === 'string') headers['content-type'] = contentType
+  const contentLength = req.headers['content-length']
+  if (typeof contentLength === 'string') headers['content-length'] = contentLength
+  const accept = req.headers.accept
+  if (typeof accept === 'string') headers.accept = accept
+
+  const upstream = httpRequest({
+    host: '127.0.0.1',
+    port,
+    path: upstreamPath,
+    method: req.method,
+    headers,
+  }, (upstreamRes) => {
+    const out: OutgoingHttpHeaders = {}
+    for (const name of HTTP_FORWARD_RESPONSE_HEADERS) {
+      const value = upstreamRes.headers[name]
+      if (value !== undefined) out[name] = value
+    }
+    res.writeHead(upstreamRes.statusCode ?? 502, out)
+    upstreamRes.pipe(res)
+  })
+  upstream.on('error', () => {
+    if (!res.headersSent) {
+      writeJson(res, 502, { ok: false, error: { code: 'upstream-failure', message: 'upstream request failed' } })
+      return
+    }
+    res.destroy()
+  })
+  req.pipe(upstream)
+}
+
+/**
+ * Rebuild a WebSocket handshake as loopback-shaped and pipe both directions.
+ * @param req - the already-gated upgrade request.
+ * @param socket - the client duplex.
+ * @param head - bytes already read past the handshake.
+ * @param port - local webServer port.
+ * @param upstreamPath - path + query on 127.0.0.1.
+ */
+export function proxyLoopbackUpgrade(
+  req: IncomingMessage,
+  socket: Duplex,
+  head: Buffer,
+  port: number,
+  upstreamPath: string,
+): void {
+  const lines = [
+    `GET ${upstreamPath} HTTP/1.1`,
+    `Host: 127.0.0.1:${String(port)}`,
+    'Upgrade: websocket',
+    'Connection: Upgrade',
+  ]
+  for (const name of WS_FORWARD_HEADERS) {
+    const value = req.headers[name]
+    if (value === undefined) continue
+    lines.push(`${name}: ${Array.isArray(value) ? value.join(', ') : value}`)
+  }
+  const handshake = `${lines.join('\r\n')}\r\n\r\n`
+
+  const upstream = connect(port, '127.0.0.1')
+  const tearDown = (): void => {
+    upstream.destroy()
+    socket.destroy()
+  }
+  upstream.on('error', tearDown)
+  socket.on('error', tearDown)
+  upstream.on('close', () => { socket.destroy() })
+  socket.on('close', () => { upstream.destroy() })
+  upstream.on('connect', () => {
+    upstream.write(handshake)
+    if (head.length > 0) upstream.write(head)
+    socket.pipe(upstream)
+    upstream.pipe(socket)
+  })
+}

package/src/mobile/views/SessionListView.tsx

@@ -51,6 +51,10 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
   const [presetsLoading, setPresetsLoading] = useState(true)
   const cursorRef = useRef<string | undefined>(undefined)
   const busyRef = useRef(false)
+  // The freshest owned-id set: the mount effect re-reads the workspace roster
+  // so a session created since this row was captured still shows; loadMore
+  // filters later pages through this ref instead of the stale prop.
+  const workspaceRef = useRef(workspace)
 
   // First page on mount. The workspace roster is re-read alongside so the
   // owned-id set is fresh: a session created (or attached) since this
@@ -64,6 +68,7 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
         if (cancelled) return
         const fresh = workspaces.find(candidate => candidate.workspaceId === workspace.workspaceId)
         const current = fresh ?? workspace
+        workspaceRef.current = current
         setRows(ownedItems(page.items, current))
         cursorRef.current = page.nextCursor
         setHasMore(page.hasMore)
@@ -112,7 +117,7 @@ export function SessionListView({ workspace, onBack, onPick }: SessionListViewPr
         setLoading(false)
         cursorRef.current = page.nextCursor
         setHasMore(page.hasMore)
-        setRows(previous => [...previous, ...ownedItems(page.items, workspace)])
+        setRows(previous => [...previous, ...ownedItems(page.items, workspaceRef.current)])
       },
       (reason: unknown) => {
         busyRef.current = false

package/src/mobile-api.ts

@@ -33,7 +33,8 @@ import { readCookie } from './gate.ts'
  * note the paired-device cookie also passes the global api/gate for the full
  * ApiProxy surface (gate.ts), so a paired phone is a full-control credential:
  * the allowlist only constrains this /m/api proxy, not the cookie's reach.
- * stop() revokes every device; there is no per-device revocation yet.
+ * stop() revokes every device; the loopback panel can also revoke one
+ * device at a time.
  */
 const MOBILE_ALLOWLIST = new Set([
   'workspace.list',
@@ -259,7 +260,10 @@ async function dispatch(apiProxy: ApiProxy, method: string, payload: unknown, rp
   const request: RpcRequest<unknown> = { rpcId: RpcId(rpcId), payload }
   if (method === 'session.list') {
     const full = await apiProxy.sessions.list(request as never)
-    if (!full.result.ok) return full
+    // The error path must carry the same 'server-response' envelope the
+    // success path builds, or the phone's callUnary throws a transport error
+    // and masks the real business error.
+    if (!full.result.ok) return { type: 'server-response' as const, rpcId, result: full.result }
     const items = full.result.value.items as Array<{ updatedAt: number; sessionId: string }>
     const cursor = (payload as { cursor?: string } | undefined)?.cursor
     // Every call pages (the first call with no cursor IS the first page):

package/src/mobile-routes.ts

@@ -42,7 +42,7 @@ function pageHtml(bundleUrl: string): string {
     '<meta name="apple-mobile-web-app-title" content="DSH Remote">',
     '<link rel="manifest" href="/m/manifest.webmanifest">',
     '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
-    '<title>移动端远程控制</title>',
+    '<title>远程访问</title>',
     '</head>',
     '<body>',
     '<div id="root"></div>',

package/src/pairing.persist.test.ts

@@ -1,20 +1,21 @@
 /**
  * PairingService device-session persistence: with `devicesFile` set, sessions
- * written on accept/stop survive a process restart (a new PairingService
- * instance), so a previously paired phone — whose cookie already lives 365
- * days — never needs to re-scan the QR after `dsh web` restarts.
+ * written on accept/stop/revoke/sweep survive a process restart (a new
+ * PairingService instance). lastSeenAt is flushed on sweep, not on every
+ * touch; idle sessions older than idleExpireMs are dropped on load.
  */
 import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 import { pairingConfigOf } from './index.ts'
-import { PairingService, type PairingClock, type PairingConfig } from './pairing.ts'
+import { DEFAULT_IDLE_EXPIRE_MS, PairingService, type PairingClock, type PairingConfig } from './pairing.ts'
 
 const BASE_CONFIG: Omit<PairingConfig, 'devicesFile'> = {
   tokenTtlMs: 60_000,
   offlineAfterMs: 25_000,
   maxDevices: 4,
+  idleExpireMs: DEFAULT_IDLE_EXPIRE_MS,
   cookieName: 'dsh_pair',
 }
 
@@ -53,7 +54,11 @@ describe('PairingService device persistence', () => {
     const deviceId = pairDevice(first)
     expect(readFileSync(file, 'utf8')).toContain(deviceId)
     // Device ids are session credentials: the persisted file is 0600.
-    expect(statSync(file).mode & 0o777).toBe(0o600)
+    // win32: NTFS has no POSIX mode bits and Node ignores the writeFileSync
+    // mode option there, so the mode assertion only applies on POSIX (#772).
+    if (process.platform !== 'win32') {
+      expect(statSync(file).mode & 0o777).toBe(0o600)
+    }
 
     // Simulated restart: a brand-new service instance reading the same file.
     const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
@@ -66,6 +71,7 @@ describe('PairingService device persistence', () => {
       tokenTtlMs: 60_000,
       offlineAfterMs: 25_000,
       maxDevices: 4,
+      idleExpireMs: DEFAULT_IDLE_EXPIRE_MS,
       cookieName: 'dsh_pair',
       devicesFile: file,
     })
@@ -81,6 +87,7 @@ describe('PairingService device persistence', () => {
       tokenTtlMs: 60_000,
       offlineAfterMs: 25_000,
       maxDevices: 4,
+      idleExpireMs: DEFAULT_IDLE_EXPIRE_MS,
       cookieName: 'dsh_pair',
       devicesFile: file,
     })
@@ -142,4 +149,56 @@ describe('PairingService device persistence', () => {
     const ghost = join(dir, 'does-not-exist.json')
     expect(() => new PairingService({ ...BASE_CONFIG, devicesFile: ghost }, makeClock())).not.toThrow()
   })
+
+  it('does not persist lastSeenAt on touch; sweep flushes it', () => {
+    const file = join(dir, 'devices.json')
+    const now = { value: 1_000_000 }
+    let n = 0
+    const clock: PairingClock = {
+      now: () => now.value,
+      randomToken: () => `tok${(n++).toString().padStart(6, '0')}`,
+    }
+    const first = new PairingService({ ...BASE_CONFIG, devicesFile: file }, clock)
+    const deviceId = pairDevice(first)
+    const afterAccept = JSON.parse(readFileSync(file, 'utf8')) as Record<string, { lastSeenAt: number }>
+    expect(afterAccept[deviceId]?.lastSeenAt).toBe(1_000_000)
+    now.value = 1_500_000
+    expect(first.touchDevice(deviceId)).toBe(true)
+    const afterTouch = JSON.parse(readFileSync(file, 'utf8')) as Record<string, { lastSeenAt: number }>
+    expect(afterTouch[deviceId]?.lastSeenAt).toBe(1_000_000)
+    first.sweep()
+    const afterSweep = JSON.parse(readFileSync(file, 'utf8')) as Record<string, { lastSeenAt: number }>
+    expect(afterSweep[deviceId]?.lastSeenAt).toBe(1_500_000)
+
+    const second = new PairingService({ ...BASE_CONFIG, devicesFile: file }, clock)
+    expect(second.hasDevice(deviceId)).toBe(true)
+    expect(second.snapshot().devices[0]?.lastSeenAt).toBe(1_500_000)
+  })
+
+  it('drops idle sessions on load instead of restoring them', () => {
+    const file = join(dir, 'devices.json')
+    writeFileSync(file, JSON.stringify({
+      stale: { createdAt: 1, lastSeenAt: 1 },
+    }))
+    const clock: PairingClock = {
+      now: () => 1 + DEFAULT_IDLE_EXPIRE_MS + 1,
+      randomToken: () => 'tok',
+    }
+    const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, clock)
+    expect(service.hasDevice('stale')).toBe(false)
+    const saved = JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown>
+    expect(saved).toEqual({})
+  })
+
+  it('persists a User-Agent captured at accept', () => {
+    const file = join(dir, 'devices.json')
+    const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock())
+    service.setPublicBaseUrl('https://pairing.example.trycloudflare.com')
+    const { token } = service.issue()
+    const result = service.accept(token, 'Mozilla/5.0 TestPhone')
+    expect(result.ok).toBe(true)
+    const saved = JSON.parse(readFileSync(file, 'utf8')) as Record<string, { userAgent?: string }>
+    const deviceId = result.ok ? result.deviceId : ''
+    expect(saved[deviceId]?.userAgent).toBe('Mozilla/5.0 TestPhone')
+  })
 })