@linxin666/dsh-remote-web-ui 0.2.4 → 0.2.5

package/lib/types/remote-api.js

@@ -0,0 +1,181 @@
+/**
+ * The remote desktop data channel: `/remote` is this plugin's own prefix, so
+ * the paired-device cookie is the access control (exactly like `/m/api`).
+ * After that gate, every fenced same-origin path the browser rewrote here is
+ * re-issued to 127.0.0.1 as a loopback-shaped request so sibling plugin
+ * fences (and the connection plugin's `/api`) accept it — no `--trusted-host`
+ * and no per-plugin pairing consult.
+ *
+ * Security model:
+ * - Every request must carry a live paired-device cookie, enforced before
+ *   any bytes are forwarded and before any host call.
+ * - The SDK's loopback-only privileged methods (native dialogs, the settings
+ *   plane, credentials — the `PRIVILEGED_METHODS` set of client-connection)
+ *   are denied here. The set is pinned by tests/remote-contract.spec.ts.
+ * - `/api/pair/*`, `/api/update/*`, `/api/plugin-manager/*`,
+ *   `/api/dsh-desktop-launcher/*` and `/api/dsh-web-ui-settings/*` stay physically local.
+ * - Everything else is HTTP- or WebSocket-proxied to the local port with
+ *   Host rewritten, Origin and cookies dropped, and a synthetic same-origin
+ *   browser marker added after authentication. Plugin loopback fences then
+ *   pass. The pairing cookie never leaves this process.
+ */
+import { readCookie } from './gate.js';
+import { writeJson } from './http.js';
+import { proxyLoopbackHttp, proxyLoopbackUpgrade } from './loopback-proxy.js';
+import { DESKTOP_LAUNCHER_PATH, LOOPBACK_ONLY_METHODS, PLUGIN_MANAGER_PATH, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, } from './remote-methods.js';
+export { DESKTOP_LAUNCHER_PATH, LOOPBACK_ONLY_METHODS, PLUGIN_MANAGER_PATH, REMOTE_API_PATHS, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, } from './remote-methods.js';
+export { REMOTE_API_PREFIX } from './remote-methods.js';
+const ALLOWED_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);
+/** Reject traversal and empty segments; allow plugin file-path characters. */
+function isSafeSegment(segment) {
+    if (segment === '')
+        return false;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(segment);
+    }
+    catch {
+        return false;
+    }
+    return decoded !== '.' && decoded !== '..' && !decoded.includes('/') && !decoded.includes('\\') && !decoded.includes('\0');
+}
+/** One SDK-shaped error envelope (keeps the desktop client's parse path intact). */
+function envelopeError(res, status, rpcId, code, message) {
+    writeJson(res, status, {
+        type: 'server-response',
+        rpcId,
+        result: { ok: false, error: { code, message, details: { issues: [] } } },
+    });
+}
+/**
+ * Map `/remote/...` to the inner path, or undefined when the outer path is
+ * not a safe rewrite target.
+ */
+export function innerPathOf(pathname) {
+    if (pathname === REMOTE_PREFIX || pathname === `${REMOTE_PREFIX}/`)
+        return undefined;
+    if (!pathname.startsWith(`${REMOTE_PREFIX}/`))
+        return undefined;
+    const rest = pathname.slice(REMOTE_PREFIX.length);
+    if (!rest.startsWith('/'))
+        return undefined;
+    const segments = rest.slice(1).split('/');
+    if (segments.length === 0 || segments.some(segment => !isSafeSegment(segment))) {
+        return undefined;
+    }
+    return rest;
+}
+/**
+ * Whether a paired inner path must stay physically local.
+ * @returns a denial message, or undefined when the path may be proxied.
+ */
+export function loopbackOnlyDenial(innerPath) {
+    if (innerPath === '/api/pair' || innerPath.startsWith('/api/pair/')) {
+        return 'pairing endpoints stay loopback-only and stay unreachable from a paired remote desktop';
+    }
+    if (innerPath === '/api/update' || innerPath.startsWith('/api/update/')) {
+        return 'update endpoints stay loopback-only and stay unreachable from a paired remote desktop';
+    }
+    if (innerPath === PLUGIN_MANAGER_PATH || innerPath.startsWith(`${PLUGIN_MANAGER_PATH}/`)) {
+        return 'plugin-manager stays loopback-only and stays unreachable from a paired remote desktop';
+    }
+    if (innerPath === DESKTOP_LAUNCHER_PATH || innerPath.startsWith(`${DESKTOP_LAUNCHER_PATH}/`)) {
+        return 'desktop-launcher endpoints stay loopback-only and stay unreachable from a paired remote desktop';
+    }
+    if (innerPath === WEB_UI_SETTINGS_BRIDGE_PATH || innerPath.startsWith(`${WEB_UI_SETTINGS_BRIDGE_PATH}/`)) {
+        return 'settings-bridge endpoints stay loopback-only and stay unreachable from a paired remote desktop';
+    }
+    if (!innerPath.startsWith('/api/'))
+        return undefined;
+    const method = innerPath.slice('/api/'.length);
+    if (method !== '' && !method.includes('/') && LOOPBACK_ONLY_METHODS.has(method)) {
+        return `${method} is loopback-only and stays unreachable from a paired remote desktop`;
+    }
+    return undefined;
+}
+/**
+ * Build the remote desktop channel HTTP routes.
+ * @param deps - pairing service + local port.
+ * @returns the routes to register on webServer.
+ */
+export function makeRemoteApiRoutes(deps) {
+    const { service, port } = deps;
+    const handler = (req, res) => {
+        // Cookie gate first — same order as /m/api. Do not buffer an unpaired body.
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        const paired = deviceId !== undefined && service.touchDevice(deviceId);
+        if (!paired) {
+            req.resume();
+            envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
+            return;
+        }
+        const method = req.method ?? 'GET';
+        if (!ALLOWED_METHODS.has(method)) {
+            req.resume();
+            res.writeHead(405).end();
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        const inner = innerPathOf(url.pathname);
+        if (inner === undefined) {
+            req.resume();
+            res.writeHead(404).end();
+            return;
+        }
+        const denied = loopbackOnlyDenial(inner);
+        if (denied !== undefined) {
+            req.resume();
+            envelopeError(res, 403, 'invalid-request', 'forbidden', denied);
+            return;
+        }
+        proxyLoopbackHttp(req, res, port, `${inner}${url.search}`);
+    };
+    return [{ kind: 'prefix', path: REMOTE_PREFIX, handler }];
+}
+/**
+ * Map one outer upgrade URL onto the loopback path (query string included).
+ */
+export function upgradeInnerPath(reqUrl, fallbackPath) {
+    if (reqUrl === undefined || reqUrl === '')
+        return fallbackPath;
+    let url;
+    try {
+        url = new URL(reqUrl, 'http://127.0.0.1');
+    }
+    catch {
+        return fallbackPath;
+    }
+    const inner = innerPathOf(url.pathname);
+    if (inner === undefined)
+        return fallbackPath;
+    return `${inner}${url.search}`;
+}
+/**
+ * Build the WebSocket upgrade routes for the event streams and known plugin
+ * sockets. webServer matches upgrades by exact path.
+ * @param deps - pairing service + local port.
+ * @returns the upgrade routes to register on webServer.
+ */
+export function makeRemoteApiUpgradeRoutes(deps) {
+    const { service, port } = deps;
+    const handlerFor = (fallbackPath) => (req, socket, head) => {
+        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+        if (deviceId === undefined || !service.touchDevice(deviceId)) {
+            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        const inner = upgradeInnerPath(req.url, fallbackPath);
+        const denied = loopbackOnlyDenial(inner.split('?')[0] ?? inner);
+        if (denied !== undefined) {
+            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
+        }
+        proxyLoopbackUpgrade(req, socket, head, port, inner);
+    };
+    return REMOTE_UPGRADE_PATHS.map((path) => ({
+        path,
+        handler: handlerFor(path.slice(REMOTE_PREFIX.length)),
+    }));
+}

package/lib/types/remote-methods.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Remote desktop channel constants — SDK-independent so tests and the
+ * client half can pin them without importing the host SDK graph.
+ */
+/** Gated mirror of same-origin fenced paths (`/remote` + original pathname). */
+export declare const REMOTE_PREFIX = "/remote";
+/** Connection-plugin method prefix under the gated channel. */
+export declare const REMOTE_API_PREFIX = "/remote/api";
+/** WebSocket event-stream paths served by the channel (client rewrites to these). */
+export declare const REMOTE_API_PATHS: {
+    readonly mux: "/remote/api/events.mux";
+    readonly host: "/remote/api/events.host";
+};
+/**
+ * Exact upgrade paths registered on webServer (the SDK matches upgrades by
+ * exact path, not prefix). Query strings ride on the request URL.
+ */
+export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/events.mux", "/remote/api/events.host", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/api/dsh-ssh/terminal"];
+/** Plugin-manager HTTP prefix: install/remove stay physically local. */
+export declare const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
+/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
+export declare const DESKTOP_LAUNCHER_PATH = "/api/dsh-desktop-launcher";
+/** Family settings-bridge HTTP prefix: describe/mutate stay physically local. */
+export declare const WEB_UI_SETTINGS_BRIDGE_PATH = "/api/dsh-web-ui-settings";
+/**
+ * Loopback-only methods of the host API surface, mirrored from
+ * client-connection's `PRIVILEGED_METHODS` (pinned by
+ * tests/remote-contract.spec.ts against the installed SDK). They stay
+ * unreachable from a paired remote desktop, matching the SDK's own stance
+ * that the configuration plane is loopback-same-origin only.
+ */
+export declare const LOOPBACK_ONLY_METHODS: Set<string>;
+//# sourceMappingURL=remote-methods.d.ts.map

package/lib/types/remote-methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB;aAC3B,GAAG;aACH,IAAI;CACI,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,qKAMvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,8BAA8B,CAAA;AAEhE,iFAAiF;AACjF,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAgBhC,CAAA"}

package/lib/types/remote-methods.js

@@ -0,0 +1,54 @@
+/**
+ * Remote desktop channel constants — SDK-independent so tests and the
+ * client half can pin them without importing the host SDK graph.
+ */
+/** Gated mirror of same-origin fenced paths (`/remote` + original pathname). */
+export const REMOTE_PREFIX = '/remote';
+/** Connection-plugin method prefix under the gated channel. */
+export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
+/** WebSocket event-stream paths served by the channel (client rewrites to these). */
+export const REMOTE_API_PATHS = {
+    mux: `${REMOTE_API_PREFIX}/events.mux`,
+    host: `${REMOTE_API_PREFIX}/events.host`,
+};
+/**
+ * Exact upgrade paths registered on webServer (the SDK matches upgrades by
+ * exact path, not prefix). Query strings ride on the request URL.
+ */
+export const REMOTE_UPGRADE_PATHS = [
+    REMOTE_API_PATHS.mux,
+    REMOTE_API_PATHS.host,
+    `${REMOTE_PREFIX}/sidebar/ws/terminal`,
+    `${REMOTE_PREFIX}/sidebar/ws/agent-terminals`,
+    `${REMOTE_API_PREFIX}/dsh-ssh/terminal`,
+];
+/** Plugin-manager HTTP prefix: install/remove stay physically local. */
+export const PLUGIN_MANAGER_PATH = '/api/plugin-manager';
+/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
+export const DESKTOP_LAUNCHER_PATH = '/api/dsh-desktop-launcher';
+/** Family settings-bridge HTTP prefix: describe/mutate stay physically local. */
+export const WEB_UI_SETTINGS_BRIDGE_PATH = '/api/dsh-web-ui-settings';
+/**
+ * Loopback-only methods of the host API surface, mirrored from
+ * client-connection's `PRIVILEGED_METHODS` (pinned by
+ * tests/remote-contract.spec.ts against the installed SDK). They stay
+ * unreachable from a paired remote desktop, matching the SDK's own stance
+ * that the configuration plane is loopback-same-origin only.
+ */
+export const LOOPBACK_ONLY_METHODS = new Set([
+    'agentPreset.read',
+    'agentPreset.copy',
+    'agentPreset.openDocument',
+    'agentPreset.remove',
+    'host.pickDirectory',
+    'host.openPath',
+    'settings.describe',
+    'settings.openDocument',
+    'settings.update',
+    'settings.replace',
+    'settings.mutate',
+    'credentials.describe',
+    'credentials.set',
+    'credentials.unset',
+    'llm.discoverModels',
+]);

package/lib/types/routes.d.ts

@@ -40,6 +40,7 @@ export declare const PAIR_PATHS: {
     readonly issue: '/api/pair/issue';
     readonly accept: '/api/pair/accept';
     readonly stop: '/api/pair/stop';
+    readonly revoke: '/api/pair/revoke';
     readonly heartbeat: '/api/pair/heartbeat';
     readonly status: '/api/pair/status';
     readonly events: '/api/pair/events';
@@ -59,6 +60,9 @@ export declare const issuePayloadSchema: z.ZodObject<{
 export declare const acceptPayloadSchema: z.ZodObject<{
     token: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
+export declare const revokePayloadSchema: z.ZodObject<{
+    deviceId: z.ZodString;
+}, z.core.$strip>;
 export declare const pairActionPayloadSchema: z.ZodObject<{}, z.core.$loose>;
 /** The SSE fan-out for desktop panel status. */
 export declare class PairingEventsStream {

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;aACrB,KAAK,EAAE,iBAAiB;aACxB,MAAM,EAAE,kBAAkB;aAC1B,IAAI,EAAE,gBAAgB;aACtB,SAAS,EAAE,qBAAqB;aAChC,MAAM,EAAE,kBAAkB;aAC1B,MAAM,EAAE,kBAAkB;CAClB,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA6BjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;IACH,YAAY,OAAO,EAAE,cAAc,EAElC;IAED,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAepD;IAED,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAUpC;IAED,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAwM3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;aACrB,KAAK,EAAE,iBAAiB;aACxB,MAAM,EAAE,kBAAkB;aAC1B,IAAI,EAAE,gBAAgB;aACtB,MAAM,EAAE,kBAAkB;aAC1B,SAAS,EAAE,qBAAqB;aAChC,MAAM,EAAE,kBAAkB;aAC1B,MAAM,EAAE,kBAAkB;CAClB,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA6BjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;IACH,YAAY,OAAO,EAAE,cAAc,EAElC;IAED,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAepD;IAED,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAUpC;IAED,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAiO3D"}

package/lib/types/routes.js

@@ -88,6 +88,7 @@ export const PAIR_PATHS = {
     issue: '/api/pair/issue',
     accept: '/api/pair/accept',
     stop: '/api/pair/stop',
+    revoke: '/api/pair/revoke',
     heartbeat: '/api/pair/heartbeat',
     status: '/api/pair/status',
     events: '/api/pair/events',
@@ -107,6 +108,9 @@ export const issuePayloadSchema = z.object({
 export const acceptPayloadSchema = z.object({
     token: z.string().default(''),
 });
+export const revokePayloadSchema = z.object({
+    deviceId: z.string().min(1),
+});
 export const pairActionPayloadSchema = z.object({}).passthrough();
 /**
  * Parse a pair request body through schema. A missing/empty or non-object
@@ -291,7 +295,8 @@ export function makeRoutes(deps) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
             return;
         }
-        const result = service.accept(payload.token);
+        const ua = req.headers['user-agent'];
+        const result = service.accept(payload.token, typeof ua === 'string' ? ua : undefined);
         if (!result.ok) {
             writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code });
             return;
@@ -322,6 +327,26 @@ export function makeRoutes(deps) {
         service.stop();
         writeJson(res, 200, { ok: true });
     };
+    const handleRevoke = async (req, res) => {
+        if (!requireMethod(req, res, 'POST'))
+            return;
+        if (!loopbackFence(req)) {
+            writeJson(res, 403, { ok: false, code: 'forbidden' });
+            return;
+        }
+        const body = await readJsonBody(req);
+        const payload = parsePairPayload(revokePayloadSchema, body);
+        if (payload === undefined) {
+            writeJson(res, 400, { ok: false, code: 'bad-payload' });
+            return;
+        }
+        const revoked = service.revoke(payload.deviceId);
+        if (!revoked) {
+            writeJson(res, 404, { ok: false, code: 'unknown-device' });
+            return;
+        }
+        writeJson(res, 200, { ok: true });
+    };
     const handleHeartbeat = async (req, res) => {
         if (!requireMethod(req, res, 'POST'))
             return;
@@ -352,10 +377,13 @@ export function makeRoutes(deps) {
         const paired = deviceId !== undefined && service.hasDevice(deviceId);
         const snapshot = service.snapshot();
         // Unpaired LAN/tunnel clients get only the pairing-relevant fields; the
-        // token expiry, device roster, and public tunnel URL are an oracle for
-        // targeting and timing and stay behind a live device cookie.
+        // token expiry, public tunnel URL, and counts are an oracle for targeting
+        // and stay behind a live device cookie. The per-device roster (ids are
+        // session credentials) is never returned here — only the loopback events
+        // stream carries it to the desktop panel.
+        const { devices: _devices, ...rest } = snapshot;
         const visible = paired
-            ? snapshot
+            ? rest
             : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses };
         writeJson(res, 200, { ok: true, paired, ...visible });
     };
@@ -374,6 +402,7 @@ export function makeRoutes(deps) {
         { kind: 'exact', path: PAIR_PATHS.issue, handler: handleIssue },
         { kind: 'exact', path: PAIR_PATHS.accept, handler: handleAccept },
         { kind: 'exact', path: PAIR_PATHS.stop, handler: handleStop },
+        { kind: 'exact', path: PAIR_PATHS.revoke, handler: handleRevoke },
         { kind: 'exact', path: PAIR_PATHS.heartbeat, handler: handleHeartbeat },
         { kind: 'exact', path: PAIR_PATHS.status, handler: handleStatus },
         { kind: 'exact', path: PAIR_PATHS.events, handler: handleEvents },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
-  "description": "Mobile remote control for the dsh web GUI: scan-to-pair QR entry beside the settings button, one-time pairing tokens, live device status, and revocable mobile sessions",
-  "version": "0.2.4",
+  "description": "Scan-to-pair mobile and PC remote control for the dsh web GUI: QR entry beside the settings button, one-time pairing tokens, a gated /remote/api desktop channel, live device status, and revocable sessions",
+  "version": "0.2.5",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/FenceNotice.tsx

@@ -0,0 +1,43 @@
+/**
+ * Unpaired-desktop notice: a full-page blocking surface rendered when the remote channel
+ * (see remote-channel.ts) refuses a call because this desktop browser has no
+ * live paired-device cookie. Retires automatically once a gated call
+ * succeeds (the channel reports pairing), so it never outlives the
+ * unpaired state it describes.
+ */
+import type { TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'
+import css from './remote.module.css'
+
+/** Notice props: localized copy. */
+export interface FenceNoticeProps {
+  t: TranslateNS<'remote'>
+  /** Retry after the user has opened a freshly issued computer pairing link. */
+  onRetry: () => void
+}
+
+/**
+ * Render the unpaired blocking page.
+ * @param props - localized copy.
+ * @returns the notice element.
+ */
+export function FenceNotice({ t, onRetry }: FenceNoticeProps) {
+  return (
+    <div className={css.fencePage} role="dialog" aria-modal="true" aria-labelledby="remote-fence-title">
+      <main className={css.fenceCard} data-dsh-plugin="remote-web-ui">
+        <div className={css.fenceMark} aria-hidden="true">×</div>
+        <p className={css.fenceEyebrow}>{t('fence.unpaired.eyebrow')}</p>
+        <h1 id="remote-fence-title" className={css.fenceTitle}>{t('fence.unpaired.title')}</h1>
+        <p className={css.fenceDetail}>{t('fence.unpaired.hint')}</p>
+        <ol className={css.fenceSteps}>
+          <li>{t('fence.unpaired.stepDesktop')}</li>
+          <li>{t('fence.unpaired.stepLink')}</li>
+          <li>{t('fence.unpaired.stepOpen')}</li>
+        </ol>
+        <button className={css.fenceRetry} type="button" onClick={onRetry}>
+          {t('fence.unpaired.retry')}
+        </button>
+        <p className={css.fenceFootnote}>{t('fence.unpaired.footnote')}</p>
+      </main>
+    </div>
+  )
+}

package/src/client/RemoteEntry.tsx

@@ -12,7 +12,7 @@ import { createPortal } from 'react-dom'
 import type { PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type { PairingPhase } from '../pairing.ts'
 import { RemotePanel, type PanelState } from './RemotePanel.tsx'
-import { copyText, issuePair, stopPair, type IssueResponse, type PairStateFrame, type TunnelStatusFrame } from './pair-api.ts'
+import { copyText, issuePair, revokePair, stopPair, type DeviceFrame, type IssueResponse, type PairStateFrame, type TunnelStatusFrame } from './pair-api.ts'
 import { PhoneIcon } from './PhoneIcon.tsx'
 import { UpdateEntry } from './UpdateEntry.tsx'
 import css from './remote.module.css'
@@ -38,7 +38,9 @@ function mergeFrame(state: PanelState, frame: PairStateFrame): PanelState {
     phase: frame.phase,
     deviceCount: frame.deviceCount,
     onlineCount: frame.onlineCount,
+    devices: frame.devices ?? [],
     ...(frame.tunnel !== undefined ? { tunnel: frame.tunnel as TunnelStatusFrame } : {}),
+    ...(frame.posture !== undefined ? { posture: frame.posture } : {}),
   }
 }
 
@@ -55,7 +57,7 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
   // pure), so mint decisions read this ref instead.
   const stateRef = useRef(state)
   useEffect(() => { stateRef.current = state }, [state])
-  const [copied, setCopied] = useState(false)
+  const [copied, setCopied] = useState<'phone' | 'desktop' | undefined>(undefined)
   const eventSource = useRef<EventSource | undefined>(undefined)
   // Generation counter for the open flow: closing (or re-opening) the panel
   // bumps it, so an in-flight issue() that resolves after a close does not
@@ -97,6 +99,7 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
       phase: 'waiting',
       deviceCount: 0,
       onlineCount: 0,
+      devices: [] as DeviceFrame[],
       // Whether this QR is built on the configured public (tunneled) base.
       public: publicBaseUrl !== undefined && result.url.startsWith(publicBaseUrl),
       ...(publicBaseUrl !== undefined ? { publicBaseUrl } : {}),
@@ -180,7 +183,14 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
     // keeps the UI honest, and the status stream confirms the stopped phase.
     void stopPair().catch(() => {})
     // Optimistic fallback; the status stream confirms with the stopped phase.
-    setState(previous => previous.kind === 'ready' ? { ...previous, phase: 'stopped' as PairingPhase } : previous)
+    setState(previous => previous.kind === 'ready' ? { ...previous, phase: 'stopped' as PairingPhase, devices: [] } : previous)
+  }, [])
+
+  const handleRevoke = useCallback((deviceId: string) => {
+    void revokePair(deviceId).catch(() => {})
+    setState(previous => previous.kind === 'ready'
+      ? { ...previous, devices: previous.devices.filter(device => device.id !== deviceId) }
+      : previous)
   }, [])
 
   const handleRefresh = useCallback(() => {
@@ -197,14 +207,13 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
     void mint().then(setState)
   }, [mint])
 
-  const handleCopy = useCallback(() => {
-    if (state.kind !== 'ready') return
-    void copyText(state.url).then((ok) => {
+  const handleCopy = useCallback((target: 'phone' | 'desktop', url: string) => {
+    void copyText(url).then((ok) => {
       if (!ok) return
-      setCopied(true)
-      window.setTimeout(() => { setCopied(false) }, 1500)
+      setCopied(target)
+      window.setTimeout(() => { setCopied(undefined) }, 1500)
     })
-  }, [state])
+  }, [])
 
   return (
     <>
@@ -225,6 +234,7 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
             onCopy={handleCopy}
             onPickAddress={handlePickAddress}
             onPickPublic={handlePickPublic}
+            onRevoke={handleRevoke}
           />
         </div>
       ), document.body)}