@linxin666/dsh-remote-web-ui 0.2.4 → 0.2.5

package/lib/types/client/locales.js

@@ -1,44 +1,67 @@
-/** `remote` namespace dictionaries: the mobile remote-control surface copy. */
+/** `remote` namespace dictionaries: the remote-access surface copy. */
 /** Simplified Chinese dictionary (the key-set source of truth). */
 export const zh = {
-    'entry.label': '移动端远程控制',
-    'title': '移动端远程控制',
-    'subtitle': '扫码或在手机上打开链接，即可远程控制当前工作区',
-    'card.title': '手机扫码连接',
+    'entry.label': '远程访问',
+    'title': '远程访问',
+    'subtitle': '通过手机或另一台电脑配对，远程访问当前工作区',
+    'card.title': '设备配对',
     'public.badge': '公网',
-    'status.waiting': '等待手机连接',
+    'status.waiting': '等待设备连接',
     'status.connected': '已连接 {n} 台设备',
     'status.disconnected': '已配对设备离线',
-    'status.stopped': '已停止移动端访问',
+    'status.stopped': '已停止远程访问',
     'status.lanRequired': '此功能需要以 --host 0.0.0.0 启动 dsh web，或配置公网地址才能使用',
     'status.lanRequiredHint': '当前服务仅绑定在 127.0.0.1 且未配置公网地址，手机无法访问。请用 dsh web --host 0.0.0.0 重新启动，或在设置中填写内网穿透的公网地址。',
     'status.loopbackRequired': '配对面板仅限本机使用',
     'status.loopbackRequiredHint': '请通过 http://127.0.0.1 打开此页面后重试；手机请使用配对链接访问。',
     'status.unreachable': '无法连接配对服务',
     'status.unreachableHint': '请刷新页面后重试。',
-    'pair.hint': '无法扫码？可以在手机上打开链接',
-    'pair.publicHint': '公网链接：手机无需与电脑在同一网络',
+    'pair.hint': '无法扫码？可直接打开下方配对链接',
+    'pair.publicHint': '公网链接：设备无需与本机处于同一网络',
     'address.label': '选择二维码指向的网络',
     'address.public': '公网地址',
     'address.lan': '局域网',
-    'address.hint': '公网地址适合手机不在同一网络时使用；局域网地址仅在手机与电脑同一网络时可用。',
+    'address.hint': '远程设备不在同一网络时请使用公网地址；局域网地址仅限同一网络内使用。',
     'pair.expires': '二维码有效至 {time}',
     'pair.expired': '二维码已过期，请刷新',
+    'pair.phoneLabel': '手机配对链接',
+    'pair.desktopLabel': '电脑配对链接',
+    'pair.oneTimeHint': '两条链接共用同一枚一次性令牌；任意设备配对成功后，另一条链接立即失效。',
     'pair.failed.title': '配对失败',
     'pair.failed.detail': '链接无效或已使用，请回到电脑端刷新二维码后重新扫码。',
+    'fence.unpaired.title': '此设备未配对，无法访问工作区数据',
+    'fence.unpaired.eyebrow': '需要设备配对',
+    'fence.unpaired.hint': '为保护工作区、会话与插件数据，远程电脑必须先通过主电脑授权。',
+    'fence.unpaired.stepDesktop': '在主电脑打开 http://127.0.0.1:3080，进入“远程访问”。',
+    'fence.unpaired.stepLink': '在“设备配对”中复制电脑配对链接。',
+    'fence.unpaired.stepOpen': '在当前浏览器打开该链接，完成授权后即可进入。',
+    'fence.unpaired.retry': '重新检测',
+    'fence.unpaired.footnote': '请勿使用他人提供的配对链接；管理员可随时取消此设备的授权。',
+    'posture.exposed': '/api 通道对未配对设备敞开',
+    'posture.exposedHint': '以下来源的请求未经配对即可访问完整桌面 API：{hosts}。请移除对应来源的 --trusted-host（配对机制已覆盖远程访问），或改为仅绑定 127.0.0.1 并使用隧道。',
     'action.stop': '停止',
     'action.refresh': '刷新二维码',
     'action.copy': '复制链接',
+    'action.copyPhone': '复制手机链接',
+    'action.copyDesktop': '复制电脑链接',
     'action.copied': '已复制',
-    'stopped.hint': '已停止移动端访问。点击"刷新二维码"重新开启。',
+    'devices.title': '已授权设备',
+    'devices.empty': '还没有已配对的设备。扫码或打开链接后会出现在这里。',
+    'devices.unknown': '未知设备',
+    'devices.online': '在线',
+    'devices.offline': '离线',
+    'devices.lastSeen': '最近活动 {time}',
+    'devices.revoke': '取消配对',
+    'devices.revoke.label': '取消配对此设备',
+    'stopped.hint': '已停止远程访问。点击"刷新二维码"重新开启。',
     'tunnel.starting': '公网隧道启动中，二维码将自动变为公网链接…',
     'tunnel.failed': '公网隧道启动失败：{error}',
     'tunnel.unknownError': '未知错误',
-    'close.label': '关闭移动端远程控制面板',
+    'close.label': '关闭远程访问面板',
     // 插件设置卡片（settings.plugin.item 席位）。
-    'settings.title': '移动端远程控制',
+    'settings.title': '远程访问设置',
     'settings.description': '配对安全与设备限额。',
-    'settings.enabled': '启用移动端远程控制',
+    'settings.enabled': '启用远程访问',
     'settings.enabledHint': '关闭后移除侧边栏入口并停用配对路由与局域网栅栏。',
     'settings.tokenTtlMs': '配对令牌有效期（毫秒）',
     'settings.tokenTtlMsHint': '新生成的二维码链接在此时间后失效。',
@@ -46,10 +69,12 @@ export const zh = {
     'settings.offlineAfterMsHint': '配对设备超过该时长未上报心跳即视为离线。',
     'settings.maxDevices': '已配对设备上限',
     'settings.maxDevicesHint': '超过上限时淘汰最旧的设备会话。',
+    'settings.idleExpireMs': '空闲过期（毫秒）',
+    'settings.idleExpireMsHint': '超过该时长没有任何心跳或请求的已配对设备会被删除，必须重新扫码。默认 7 天。',
     'settings.cookieName': '设备 Cookie 名',
     'settings.cookieNameHint': '携带已配对设备标识的 Cookie 名称。',
     'settings.requirePairingForLan': '局域网访问要求配对',
-    'settings.requirePairingForLanHint': '开启：所有非本机回环的 /api 请求必须携带有效配对 Cookie；关闭：局域网栅栏放开，配对仅用于令牌与状态管理。',
+    'settings.requirePairingForLanHint': '开启：非本机回环的桌面 Web GUI 改走门控的 /remote，必须携带有效配对 Cookie；关闭：桌面继续走普通路径（仅在该来源已被 SDK 信任时有意义），配对只管理令牌与状态。',
     'settings.publicBaseUrl': '公网地址（可选）',
     'settings.publicBaseUrlHint': '内网穿透的公网地址，如 Cloudflare Tunnel：https://xxx.trycloudflare.com。填写后二维码将生成公网链接，手机不在同一网络也能配对；留空则仅局域网可用。',
     'settings.autoTunnel': '自动公网隧道',
@@ -110,44 +135,67 @@ export const zh = {
 };
 /** English dictionary, checked complete against the zh key set. */
 export const en = {
-    'entry.label': 'Mobile remote control',
-    'title': 'Mobile remote control',
-    'subtitle': 'Scan the QR code or open the link on your phone to control this workspace remotely',
-    'card.title': 'Scan to connect',
+    'entry.label': 'Remote access',
+    'title': 'Remote access',
+    'subtitle': 'Pair a phone or another computer to access this workspace remotely',
+    'card.title': 'Pair a device',
     'public.badge': 'Public',
-    'status.waiting': 'Waiting for a phone',
+    'status.waiting': 'Waiting for a device',
     'status.connected': '{n} device(s) connected',
     'status.disconnected': 'Paired devices offline',
-    'status.stopped': 'Mobile access stopped',
+    'status.stopped': 'Remote access stopped',
     'status.lanRequired': 'This feature needs dsh web started with --host 0.0.0.0, or a configured public address',
     'status.lanRequiredHint': 'The server is bound to 127.0.0.1 and no public address is configured, so a phone cannot reach it. Restart with dsh web --host 0.0.0.0, or set the tunneled public address in settings.',
     'status.loopbackRequired': 'The pairing panel works on this machine only',
     'status.loopbackRequiredHint': 'Open this page at http://127.0.0.1 to mint a QR code; phones use the paired link.',
     'status.unreachable': 'Cannot reach the pairing service',
     'status.unreachableHint': 'Refresh the page and try again.',
-    'pair.hint': 'Cannot scan? Open the link on your phone',
-    'pair.publicHint': 'Public link: the phone does not need to be on the same network',
+    'pair.hint': 'Cannot scan? Open one of the pairing links below',
+    'pair.publicHint': 'Public links work when the device is not on the same network',
     'address.label': 'Network the QR code points to',
     'address.public': 'Public',
     'address.lan': 'LAN',
-    'address.hint': 'Use the public address when the phone is not on the same network; LAN addresses only work on the same network.',
+    'address.hint': 'Use the public address when the remote device is on another network; LAN addresses only work on the same network.',
     'pair.expires': 'QR code valid until {time}',
     'pair.expired': 'QR code expired — refresh it',
+    'pair.phoneLabel': 'Phone pairing link',
+    'pair.desktopLabel': 'Computer pairing link',
+    'pair.oneTimeHint': 'Both links share one single-use token. Pairing either device invalidates the other link immediately.',
     'pair.failed.title': 'Pairing failed',
     'pair.failed.detail': 'The link is invalid or was already used. Refresh the QR code on your computer and scan again.',
+    'fence.unpaired.title': 'This device is not paired and cannot reach workspace data',
+    'fence.unpaired.eyebrow': 'Device pairing required',
+    'fence.unpaired.hint': 'To protect workspace, session, and plugin data, a remote computer must first be authorized by the primary computer.',
+    'fence.unpaired.stepDesktop': 'On the primary computer, open http://127.0.0.1:3080 and go to Remote access.',
+    'fence.unpaired.stepLink': 'Copy the computer pairing link under Pair a device.',
+    'fence.unpaired.stepOpen': 'Open that link in this browser. After authorization, the workspace will become available.',
+    'fence.unpaired.retry': 'Check again',
+    'fence.unpaired.footnote': 'Do not use pairing links from people you do not trust. An administrator can revoke this device at any time.',
+    'posture.exposed': 'The /api channel is open to unpaired devices',
+    'posture.exposedHint': 'Requests from {hosts} reach the full desktop API without pairing. Remove --trusted-host for them (pairing already covers remote access), or bind loopback only and use the tunnel.',
     'action.stop': 'Stop',
     'action.refresh': 'Refresh QR',
     'action.copy': 'Copy link',
+    'action.copyPhone': 'Copy phone link',
+    'action.copyDesktop': 'Copy computer link',
     'action.copied': 'Copied',
-    'stopped.hint': 'Mobile access is stopped. Click "Refresh QR" to re-enable it.',
+    'devices.title': 'Authorized devices',
+    'devices.empty': 'No paired devices yet. Scan the QR or open the link to add one.',
+    'devices.unknown': 'Unknown device',
+    'devices.online': 'Online',
+    'devices.offline': 'Offline',
+    'devices.lastSeen': 'Last active {time}',
+    'devices.revoke': 'Unpair',
+    'devices.revoke.label': 'Unpair this device',
+    'stopped.hint': 'Remote access is stopped. Click "Refresh QR" to re-enable it.',
     'tunnel.starting': 'The public tunnel is starting; the QR code will switch to a public link shortly…',
     'tunnel.failed': 'The public tunnel failed to start: {error}',
     'tunnel.unknownError': 'unknown error',
-    'close.label': 'Close mobile remote control panel',
+    'close.label': 'Close remote access panel',
     // Plugin settings card (the `settings.plugin.item` seat).
-    'settings.title': 'Mobile remote control',
+    'settings.title': 'Remote access settings',
     'settings.description': 'Pairing security and device limits.',
-    'settings.enabled': 'Enable mobile remote control',
+    'settings.enabled': 'Enable remote access',
     'settings.enabledHint': 'When off, the sidebar entry is removed and pairing routes plus the LAN fence stop.',
     'settings.tokenTtlMs': 'Pairing token lifetime (ms)',
     'settings.tokenTtlMsHint': 'How long a minted QR link stays valid before it dies.',
@@ -155,10 +203,12 @@ export const en = {
     'settings.offlineAfterMsHint': 'A paired device flips to offline when it has not been seen for this long.',
     'settings.maxDevices': 'Paired device cap',
     'settings.maxDevicesHint': 'Hard cap on paired device sessions; the oldest is evicted when full.',
+    'settings.idleExpireMs': 'Idle expiry (ms)',
+    'settings.idleExpireMsHint': 'A paired device with no heartbeat or request for this long is deleted and must scan again. Default is 7 days.',
     'settings.cookieName': 'Device cookie name',
     'settings.cookieNameHint': 'Cookie that carries the paired device id.',
     'settings.requirePairingForLan': 'Require pairing for LAN access',
-    'settings.requirePairingForLanHint': 'On: every non-loopback /api request must carry a live paired-device cookie. Off: the LAN fence is open and pairing only manages tokens/status.',
+    'settings.requirePairingForLanHint': 'On: a desktop Web GUI at a non-loopback origin rides the gated /remote channel and must carry a live paired-device cookie. Off: the desktop stays on its original paths (only useful when that origin is already trusted) and pairing only manages tokens/status.',
     'settings.publicBaseUrl': 'Public address (optional)',
     'settings.publicBaseUrlHint': 'The public URL of a tunnel in front of this server, e.g. a Cloudflare Tunnel: https://xxx.trycloudflare.com. When set, the QR link is built from it so a phone anywhere can pair; leave blank for LAN-only usage.',
     'settings.autoTunnel': 'Auto public tunnel',

package/lib/types/client/pair-api.d.ts

@@ -41,6 +41,14 @@ export interface TunnelStatusFrame {
     url?: string;
     error?: string;
 }
+/** One /api posture frame (host half probe; see src/posture.ts). */
+export interface PostureFrame {
+    checkedAt: number;
+    hosts: {
+        host: string;
+        exposed: boolean;
+    }[];
+}
 /** One /api/pair/events frame. */
 export interface PairStateFrame {
     type: 'state';
@@ -50,8 +58,20 @@ export interface PairStateFrame {
     tokenExpiresAt?: number;
     deviceCount: number;
     onlineCount: number;
+    /** Per-device roster (loopback events only). */
+    devices?: DeviceFrame[];
     /** Auto-tunnel status, while the auto-tunnel feature is active. */
     tunnel?: TunnelStatusFrame;
+    /** Latest /api fence posture probe, once a round has completed. */
+    posture?: PostureFrame;
+}
+/** One authorized-device row from the loopback status stream. */
+export interface DeviceFrame {
+    id: string;
+    createdAt: number;
+    lastSeenAt: number;
+    online: boolean;
+    userAgent?: string;
 }
 /**
  * Mint a fresh pairing token (one active token at a time — this invalidates
@@ -76,6 +96,11 @@ export declare function acceptPair(token: string): Promise<{
 } | AcceptFailure>;
 /** Revoke mobile access (paired devices + the current token). */
 export declare function stopPair(): Promise<void>;
+/**
+ * Revoke one paired device from the loopback panel.
+ * @param deviceId - the session id of the row to drop.
+ */
+export declare function revokePair(deviceId: string): Promise<void>;
 /** Presence heartbeat from a paired phone (unpaired heartbeats 401 harmlessly). */
 export declare function sendHeartbeat(): Promise<void>;
 /** Whether the current page URL carries a pairing token / workspace target. */
@@ -83,8 +108,18 @@ export declare function readPairParams(search: string): {
     pair?: string;
     workspace?: string;
 };
+/**
+ * Strip one query parameter from the current URL without reloading.
+ * @param name - the parameter to remove.
+ * @returns the new search string ('' when empty).
+ */
+export declare function stripParam(name: string): string;
+/** Convert an issued `/m/` link into the desktop pairing form. */
+export declare function desktopPairUrl(mobileUrl: string): string;
 /** Human-readable expiry clock, e.g. "10:35". */
 export declare function formatClock(epochMs: number): string;
+/** Calendar + clock for last-seen timestamps, e.g. "2026-08-19 10:35". */
+export declare function formatLastSeen(epochMs: number): string;
 /**
  * Copy text to the clipboard with a fallback for insecure contexts
  * (plain-HTTP LAN origins lack navigator.clipboard).

package/lib/types/client/pair-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pair-api.d.ts","sourceRoot":"","sources":["../../../src/client/pair-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAwB;AACxB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAExG,8BAA8B;AAC9B,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAA;AAEjF,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;IAC5E,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB9F;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC,CAUrF;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAG9C;AAED,mFAAmF;AACnF,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpF;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7D"}
+{"version":3,"file":"pair-api.d.ts","sourceRoot":"","sources":["../../../src/client/pair-api.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,wBAAwB;AACxB,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAA;IACR,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,iBAAiB,CAAA;CACxB;AAED,qEAAqE;AACrE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,KAAK,CAAA;IACT,IAAI,EAAE,WAAW,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAExG,8BAA8B;AAC9B,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,CAAA;CAAE,CAAA;AAEjF,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CAC5C;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;IAC5E,YAAY,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,mEAAmE;IACnE,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAgB9F;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,aAAa,CAAC,CAUrF;AAED,iEAAiE;AACjE,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAG9C;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhE;AAED,mFAAmF;AACnF,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAQpF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIxD;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMtD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsB7D"}

package/lib/types/client/pair-api.js

@@ -60,6 +60,21 @@ export async function stopPair() {
     if (!response.ok)
         throw new Error(`remote-web-ui: stop failed with ${String(response.status)}`);
 }
+/**
+ * Revoke one paired device from the loopback panel.
+ * @param deviceId - the session id of the row to drop.
+ */
+export async function revokePair(deviceId) {
+    const response = await fetch('/api/pair/revoke', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ deviceId }),
+    });
+    if (response.status === 404)
+        return;
+    if (!response.ok)
+        throw new Error(`remote-web-ui: revoke failed with ${String(response.status)}`);
+}
 /** Presence heartbeat from a paired phone (unpaired heartbeats 401 harmlessly). */
 export async function sendHeartbeat() {
     await fetch('/api/pair/heartbeat', { method: 'POST' });
@@ -74,6 +89,22 @@ export function readPairParams(search) {
         ...(workspace !== null && workspace !== '' ? { workspace } : {}),
     };
 }
+/**
+ * Strip one query parameter from the current URL without reloading.
+ * @param name - the parameter to remove.
+ * @returns the new search string ('' when empty).
+ */
+export function stripParam(name) {
+    const url = new URL(window.location.href);
+    url.searchParams.delete(name);
+    return url.search;
+}
+/** Convert an issued `/m/` link into the desktop pairing form. */
+export function desktopPairUrl(mobileUrl) {
+    const url = new URL(mobileUrl);
+    url.pathname = '/';
+    return url.href;
+}
 /** Human-readable expiry clock, e.g. "10:35". */
 export function formatClock(epochMs) {
     const date = new Date(epochMs);
@@ -81,6 +112,14 @@ export function formatClock(epochMs) {
     const minutes = String(date.getMinutes()).padStart(2, '0');
     return `${hours}:${minutes}`;
 }
+/** Calendar + clock for last-seen timestamps, e.g. "2026-08-19 10:35". */
+export function formatLastSeen(epochMs) {
+    const date = new Date(epochMs);
+    const year = String(date.getFullYear());
+    const month = String(date.getMonth() + 1).padStart(2, '0');
+    const day = String(date.getDate()).padStart(2, '0');
+    return `${year}-${month}-${day} ${formatClock(epochMs)}`;
+}
 /**
  * Copy text to the clipboard with a fallback for insecure contexts
  * (plain-HTTP LAN origins lack navigator.clipboard).

package/lib/types/client/remote-channel.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The remote desktop channel — browser half. On a non-loopback origin (LAN
+ * address or public tunnel) fenced host routes refuse the request, and
+ * pairing is the real access control — so same-origin traffic the desktop
+ * issues is rewritten onto this plugin's gated `/remote` prefix (host half
+ * in src/remote-api.ts). The host then re-issues the call to 127.0.0.1 so
+ * plugin loopback fences pass.
+ *
+ * The rewrite is deliberately narrow:
+ * - loopback origins are untouched (the desktop at 127.0.0.1 keeps original paths);
+ * - the pairing routes (`/api/pair/*`) stay where they are — accept must
+ *   work BEFORE a device is paired;
+ * - the update endpoints (`/api/update/*`) stay loopback-only;
+ * - desktop-launcher create/shutdown (`/api/dsh-desktop-launcher/*`) stay
+ *   loopback-only (host-local files and process exit);
+ * - the family settings bridge (`/api/dsh-web-ui-settings/*`) stays
+ *   loopback-only (same plane as SDK settings.*);
+ * - `/api/*` (SDK methods and `/api/<plugin>/...` plugin namespaces),
+ *   `/sidebar/*`, `/git/*`, and `/pet/*` ride the channel;
+ * - fetch, EventSource, WebSocket, and img/script/iframe `src` are patched;
+ *   everything else calls the original unchanged.
+ *
+ * Pure helpers are exported for unit tests; `installRemoteChannel` patches
+ * the given window and returns their restore.
+ */
+/** The gated mirror prefix (must match src/remote-methods.ts). */
+export declare const REMOTE_PREFIX = "/remote";
+/** Connection-plugin method prefix under the gated channel. */
+export declare const REMOTE_API_PREFIX = "/remote/api";
+/**
+ * Browser-safe loopback classification for the page origin (the SDK client
+ * exports its own; this copy keeps the module dependency-free).
+ * @param hostname - a location hostname (IPv6 without brackets).
+ * @returns true for localhost, IPv6 loopback, or any 127/8 literal.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether one same-origin path must ride the gated channel (fetch, EventSource,
+ * img/script/iframe src).
+ * @param pathname - the request URL pathname.
+ */
+export declare function shouldRewriteFetchPath(pathname: string): boolean;
+/**
+ * Whether one WebSocket path must ride the gated channel.
+ * @param pathname - the WebSocket URL pathname.
+ */
+export declare function shouldRewriteWsPath(pathname: string): boolean;
+/** The gated twin of one fenced path (`/remote` + original pathname). */
+export declare function rewritePath(pathname: string): string;
+/**
+ * Rewrite one raw URL string when it is same-origin and fenced. Relative
+ * inputs stay relative so resource loaders do not unexpectedly absolutize.
+ */
+export declare function rewriteRawUrl(raw: string, baseHref: string, origin: string): string;
+/** A constructor that exposes a configurable `src` on its prototype. */
+interface SrcConstructor {
+    prototype: object;
+}
+/** The subset of window the channel needs (injectable for tests). */
+export interface ChannelWindow {
+    fetch: typeof globalThis.fetch;
+    WebSocket: typeof WebSocket;
+    EventSource?: typeof EventSource;
+    HTMLImageElement?: SrcConstructor;
+    HTMLScriptElement?: SrcConstructor;
+    HTMLIFrameElement?: SrcConstructor;
+    location: {
+        origin: string;
+        href: string;
+    };
+}
+/** Options for {@link installRemoteChannel}. */
+export interface RemoteChannelOptions {
+    /** Called when a gated call came back unpaired (code `unpaired`). */
+    onUnpaired?: () => void;
+    /** Called when a gated call succeeded (an unpaired banner can retire). */
+    onPaired?: () => void;
+}
+/**
+ * Whether a gated 403 is the unpaired-device fence (not a loopback-only
+ * method denial, which uses the same status with code `forbidden`).
+ */
+export declare function isUnpairedDenied(response: Response): Promise<boolean>;
+/**
+ * Patch `fetch`, `EventSource`, `WebSocket`, and resource `src` accessors on
+ * one window to route fenced traffic through the gated channel.
+ * @param window - the browser window (or a test double).
+ * @param options - the unpaired callback.
+ * @returns a function restoring the originals.
+ */
+export declare function installRemoteChannel(window: ChannelWindow, options?: RemoteChannelOptions): () => void;
+export {};
+//# sourceMappingURL=remote-channel.d.ts.map

package/lib/types/client/remote-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-channel.d.ts","sourceRoot":"","sources":["../../../src/client/remote-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAkBvD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcnF;AAED,wEAAwE;AACxE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAA;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAoBD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAwE1G"}