@linxin666/dsh-remote-web-ui 0.2.7 → 0.2.8

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: dac3fd0ab51d68ce43474d04407c10ff67596b64
-README.zh.md: 035d14c5d69ff95c86fc5f5540df9cf5ec547b4f
+README.md: dc31fab1b49b32fe325ead616d52846435fa1180
+README.zh.md: e5ccaf0f52d01e9b8f92e265947c22dff68e2a97

package/README.md

@@ -476,6 +476,10 @@ opens at `http://127.0.0.1`.
   unpair one at a time. Credential-bearing device ids and raw User-Agent
   values are not rendered. `/api/pair/status` never returns the device id
   list, even to a paired phone.
+- **The desktop gate policy is public**: `/api/pair/status` exposes only the
+  boolean `requirePairingForLan` policy so a remote desktop can choose the
+  correct transport before its settings scope is available. This field is
+  not a credential and does not expose tokens, devices, counts, or tunnel URLs.
 - **Quick-tunnel hostnames change per run**: a `trycloudflare.com` URL is
   random on every `cloudflared` start, so `publicBaseUrl` must be updated
   whenever the tunnel restarts. A named tunnel (fixed hostname) avoids the

package/README.zh.md

@@ -173,6 +173,7 @@ pnpm run build
 - **撤销是逐请求的**：已配对手机请求已在 停止 落地时在途，完成该请求；下一个 403。
 - **已配对设备会话默认落盘**：设备会话（不含一次性二维码 token）写入 `$DSH_HOME/remote-web-ui-devices.json`（0600，临时文件加原子 rename）。已配对 cookie 在重启 `dsh web` 后仍然有效。刷新二维码仍会签发新 token；重启不会恢复当前二维码。点「停止」或单台「取消配对」会立即撤销并同步落盘。超过 `idleExpireMs`（默认 7 天，无心跳或门控请求）的会话会被删除，必须重新扫码。设备 id 即会话凭证（网关凭 cookie 中的设备 id 放行请求）。需要时可用 `devicesFile` 覆盖为其他绝对路径。变更 `cookieName` 会使旧设备失效（预期行为）。
 - **设备名单仅本机可见**：配对面板根据 User-Agent 显示精简设备名称（例如 `Windows · Chrome`）、在线/离线状态与最近活动时间，并可单台取消配对。界面不渲染作为会话凭据的设备 id 或原始 User-Agent。`/api/pair/status` 即使对已配对手机也不返回设备 id 名单。
+- **桌面门控策略是公开字段**：`/api/pair/status` 只公开布尔值 `requirePairingForLan`，让远程桌面在设置作用域不可用前选择正确传输通道。该字段不是凭据，也不暴露令牌、设备、计数或隧道 URL。
 - **Quick-tunnel hostname 每次运行变化**：`trycloudflare.com` URL 每次 `cloudflared` 启动随机，所以隧道重启时 `publicBaseUrl` 必须随之更新。named tunnel（固定 hostname）避免这种抖动，也是持久安装 PWA 地址所必需的。
 - **PWA 为在线优先**：只缓存静态壳和离线页。全部移动端远程控制能力仍要求运行中的 DSH host；离线时不提供会话、API 响应或命令。
 - **开发 HMR**：`dsh web --dev` 按路径轮询每个 roster bundle，因此重建本包（其自己的 `tsdown --watch`）会热重载 client bundle；无 harness 侧 watcher。

package/lib/client.js

@@ -1230,6 +1230,14 @@ window.__ModuleLoader__.load({
 		QRCodeSVG.displayName = "QRCodeSVG";
 		//#endregion
 		//#region src/client/pair-api.ts
+		/** Read the host-authoritative desktop pairing policy. */
+		async function readPairGatePolicy() {
+			const response = await fetch("/api/pair/status");
+			if (!response.ok) throw new Error(`remote-web-ui: status failed with ${String(response.status)}`);
+			const value = await response.json();
+			if (typeof value.requirePairingForLan !== "boolean") throw new Error("remote-web-ui: status omitted requirePairingForLan");
+			return { requirePairingForLan: value.requirePairingForLan };
+		}
 		/**
 		* Mint a fresh pairing token (one active token at a time — this invalidates
 		* any previous link).
@@ -2162,6 +2170,7 @@ window.__ModuleLoader__.load({
 				"data-wide": wide ? void 0 : "rail",
 				"data-update-available": updateAvailable ? "true" : void 0,
 				"aria-label": updateLabel,
+				"aria-expanded": open,
 				title: updateLabel,
 				onClick: openPanel,
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconDownloadOutline16, { size: wide ? 16 : 18 })
@@ -2358,7 +2367,8 @@ window.__ModuleLoader__.load({
 				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(TooltipAnchor, {
 					wide,
 					label: t("entry.label"),
-					onClick: openPanel
+					onClick: openPanel,
+					expanded: open
 				})]
 			}), open && (0, react_dom.createPortal)(/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: remote_module_css_default.overlay,
@@ -2382,12 +2392,13 @@ window.__ModuleLoader__.load({
 			}), document.body)] });
 		}
 		/** The trigger: an icon-only control with a persistent accessible label. */
-		function TooltipAnchor({ wide, label, onClick }) {
+		function TooltipAnchor({ wide, label, onClick, expanded }) {
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 				type: "button",
 				className: remote_module_css_default.trigger,
 				"data-wide": wide ? "wide" : "rail",
 				"aria-label": label,
+				"aria-expanded": expanded,
 				title: label,
 				onClick,
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PhoneIcon, { size: wide ? 16 : 18 })
@@ -3813,6 +3824,12 @@ window.__ModuleLoader__.load({
 			"/sidebar/ws/agent-terminals",
 			"/api/dsh-ssh/terminal"
 		]);
+		/** Decide whether a remote desktop channel is required from local or host policy. */
+		function remoteChannelRequired(hostname, snapshot, hostPairingPolicy) {
+			if (isLoopbackHostname(hostname)) return false;
+			if (snapshot.status === "ready") return (snapshot.value?.enabled ?? true) && (snapshot.value?.requirePairingForLan ?? true);
+			return hostPairingPolicy !== false;
+		}
 		/**
 		* Browser-safe loopback classification for the page origin (the SDK client
 		* exports its own; this copy keeps the module dependency-free).
@@ -4165,6 +4182,8 @@ window.__ModuleLoader__.load({
 			settingsScope.subscribe(syncRuntime);
 			syncRuntime();
 			let disposeChannel;
+			let hostPairingPolicy;
+			let unpairedWhilePolicyPending = false;
 			let fenceNotice;
 			const showFenceNotice = () => {
 				if (fenceNotice !== void 0) return;
@@ -4189,17 +4208,19 @@ window.__ModuleLoader__.load({
 				fenceNotice?.unmount();
 				fenceNotice = void 0;
 			};
-			const channelActive = () => {
-				if (isLoopbackHostname(window.location.hostname)) return false;
-				const snapshot = settingsScope.getSnapshot();
-				const value = snapshot.status === "ready" ? snapshot.value : void 0;
-				return (value?.enabled ?? true) && (value?.requirePairingForLan ?? true);
+			const handleUnpaired = () => {
+				if (settingsScope.getSnapshot().status !== "ready" && hostPairingPolicy === void 0) {
+					unpairedWhilePolicyPending = true;
+					return;
+				}
+				showFenceNotice();
 			};
+			const channelActive = () => remoteChannelRequired(window.location.hostname, settingsScope.getSnapshot(), hostPairingPolicy);
 			const syncChannel = () => {
 				const transition = channelTransition(channelActive(), disposeChannel !== void 0);
 				if (transition === "install") disposeChannel = ctx.effect(() => {
 					return installRemoteChannel(window, {
-						onUnpaired: showFenceNotice,
+						onUnpaired: handleUnpaired,
 						onPaired: hideFenceNotice
 					});
 				}, "remote-web-ui: remote desktop channel");
@@ -4211,6 +4232,17 @@ window.__ModuleLoader__.load({
 			};
 			settingsScope.subscribe(syncChannel);
 			syncChannel();
+			if (!isLoopbackHostname(window.location.hostname) && settingsScope.getSnapshot().status !== "ready") readPairGatePolicy().then((policy) => {
+				hostPairingPolicy = policy.requirePairingForLan;
+				syncChannel();
+				if (hostPairingPolicy && unpairedWhilePolicyPending) showFenceNotice();
+				unpairedWhilePolicyPending = false;
+			}).catch(() => {
+				hostPairingPolicy = true;
+				syncChannel();
+				if (unpairedWhilePolicyPending) showFenceNotice();
+				unpairedWhilePolicyPending = false;
+			});
 			ctx.effect(() => {
 				const timer = window.setTimeout(() => {
 					if (sessionStorage.getItem("dsh-remote-pair-failed") === null) return;