@linxin666/dsh-remote-web-ui 0.2.7 → 0.2.8

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair mobile and PC remote control for the dsh web GUI: QR entry beside the settings button, one-time pairing tokens, a gated /remote/api desktop channel, live device status, and revocable sessions",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -35,6 +35,9 @@
   ],
   "license": "Apache-2.0",
   "dsh": {
+    "engines": {
+      "dsh": ">=0.1.1-rc.1"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
@@ -61,17 +64,17 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",

package/src/client/RemoteEntry.tsx

@@ -219,7 +219,7 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
     <>
       <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
         <UpdateEntry wide={wide} t={t} />
-        <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} />
+        <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} expanded={open} />
       </div>
       {open && createPortal((
         <div className={css.overlay} role="presentation">
@@ -243,13 +243,14 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
 }
 
 /** The trigger: an icon-only control with a persistent accessible label. */
-function TooltipAnchor({ wide, label, onClick }: { wide: boolean; label: string; onClick: () => void }) {
+function TooltipAnchor({ wide, label, onClick, expanded }: { wide: boolean; label: string; onClick: () => void; expanded: boolean }) {
   return (
     <button
       type="button"
       className={css.trigger}
       data-wide={wide ? 'wide' : 'rail'}
       aria-label={label}
+      aria-expanded={expanded}
       title={label}
       onClick={onClick}
     >

package/src/client/UpdateEntry.tsx

@@ -124,6 +124,7 @@ export function UpdateEntry({ wide, t }: UpdateEntryProps) {
         data-wide={wide ? undefined : "rail"}
         data-update-available={updateAvailable ? "true" : undefined}
         aria-label={updateLabel}
+        aria-expanded={open}
         title={updateLabel}
         onClick={openPanel}
       >

package/src/client/index.ts

@@ -23,8 +23,8 @@ import { PairFailedNotice } from './PairFailedNotice.tsx'
 import { RemoteSettingsCard, RemoteSettingsCardController, type RemoteSettings } from './RemoteSettingsCard.tsx'
 import { en, zh, type RemoteKey } from './locales.ts'
 import { PAIR_FAILED_MARKER, runPairBootFlow } from './deep-link.ts'
-import { sendHeartbeat } from './pair-api.ts'
-import { channelTransition, installRemoteChannel, isLoopbackHostname } from './remote-channel.ts'
+import { readPairGatePolicy, sendHeartbeat } from './pair-api.ts'
+import { channelTransition, installRemoteChannel, isLoopbackHostname, remoteChannelRequired } from './remote-channel.ts'
 import { FenceNotice } from './FenceNotice.tsx'
 
 export type { RemoteEntryProps } from './RemoteEntry.tsx'
@@ -201,6 +201,8 @@ export function apply(ctx: ClientContext): void {
   // rewritten onto this plugin's gated /remote/api prefix (remote-channel.ts)
   // while the fence setting demands it. Loopback origins are untouched.
   let disposeChannel: (() => void) | undefined
+  let hostPairingPolicy: boolean | undefined
+  let unpairedWhilePolicyPending = false
   let fenceNotice: { unmount: () => void; node: HTMLElement } | undefined
   const showFenceNotice = (): void => {
     if (fenceNotice !== undefined) return
@@ -214,22 +216,23 @@ export function apply(ctx: ClientContext): void {
     fenceNotice?.unmount()
     fenceNotice = undefined
   }
-  const channelActive = (): boolean => {
-    if (isLoopbackHostname(window.location.hostname)) return false
-    // A not-yet-loaded (or unavailable) settings snapshot falls back to the
-    // schema defaults — enabled and requirePairingForLan are both true, and
-    // on a remote origin the snapshot may never load (its own transport is
-    // what the channel gates), so waiting for 'ready' here would deadlock
-    // the channel off exactly where it is needed most.
-    const snapshot = settingsScope.getSnapshot()
-    const value = snapshot.status === 'ready' ? snapshot.value : undefined
-    return (value?.enabled ?? true) && (value?.requirePairingForLan ?? true)
+  const handleUnpaired = (): void => {
+    if (settingsScope.getSnapshot().status !== 'ready' && hostPairingPolicy === undefined) {
+      unpairedWhilePolicyPending = true
+      return
+    }
+    showFenceNotice()
   }
+  const channelActive = (): boolean => remoteChannelRequired(
+    window.location.hostname,
+    settingsScope.getSnapshot(),
+    hostPairingPolicy,
+  )
   const syncChannel = (): void => {
     const transition = channelTransition(channelActive(), disposeChannel !== undefined)
     if (transition === 'install') {
       disposeChannel = ctx.effect(() => {
-        const restore = installRemoteChannel(window, { onUnpaired: showFenceNotice, onPaired: hideFenceNotice })
+        const restore = installRemoteChannel(window, { onUnpaired: handleUnpaired, onPaired: hideFenceNotice })
         return restore
       }, 'remote-web-ui: remote desktop channel')
     } else if (transition === 'retire' && disposeChannel !== undefined) {
@@ -246,6 +249,20 @@ export function apply(ctx: ClientContext): void {
   }
   settingsScope.subscribe(syncChannel)
   syncChannel()
+  if (!isLoopbackHostname(window.location.hostname) && settingsScope.getSnapshot().status !== 'ready') {
+    void readPairGatePolicy().then((policy) => {
+      hostPairingPolicy = policy.requirePairingForLan
+      syncChannel()
+      if (hostPairingPolicy && unpairedWhilePolicyPending) showFenceNotice()
+      unpairedWhilePolicyPending = false
+    }).catch(() => {
+      // Fail closed when the policy endpoint is unavailable or malformed.
+      hostPairingPolicy = true
+      syncChannel()
+      if (unpairedWhilePolicyPending) showFenceNotice()
+      unpairedWhilePolicyPending = false
+    })
+  }
 
   // One-time failed-pair toast. The accept result lands asynchronously, so
   // the marker check is deferred past the accept round trip.

package/src/client/pair-api.ts

@@ -36,6 +36,22 @@ export interface IssueLoopbackRequired {
 
 export type IssueResponse = IssueResult | IssueLanRequired | IssueUnknownAddress | IssueLoopbackRequired
 
+/** Public policy fields returned by the pairing status endpoint. */
+export interface PairGatePolicy {
+  requirePairingForLan: boolean
+}
+
+/** Read the host-authoritative desktop pairing policy. */
+export async function readPairGatePolicy(): Promise<PairGatePolicy> {
+  const response = await fetch('/api/pair/status')
+  if (!response.ok) throw new Error(`remote-web-ui: status failed with ${String(response.status)}`)
+  const value = await response.json() as { requirePairingForLan?: unknown }
+  if (typeof value.requirePairingForLan !== 'boolean') {
+    throw new Error('remote-web-ui: status omitted requirePairingForLan')
+  }
+  return { requirePairingForLan: value.requirePairingForLan }
+}
+
 /** accept() refusal codes. */
 export type AcceptFailure = { ok: false; code: 'invalid' | 'used' | 'forbidden' }
 

package/src/client/remote-channel.ts

@@ -46,6 +46,27 @@ const WS_PATHS = new Set([
   '/api/dsh-ssh/terminal',
 ])
 
+/** Minimal settings snapshot used by the remote channel decision. */
+export interface RemoteChannelSettingsSnapshot {
+  status: 'ready' | 'loading' | 'unavailable' | string
+  value?: { enabled?: boolean; requirePairingForLan?: boolean }
+}
+
+/** Decide whether a remote desktop channel is required from local or host policy. */
+export function remoteChannelRequired(
+  hostname: string,
+  snapshot: RemoteChannelSettingsSnapshot,
+  hostPairingPolicy: boolean | undefined,
+): boolean {
+  if (isLoopbackHostname(hostname)) return false
+  if (snapshot.status === 'ready') {
+    return (snapshot.value?.enabled ?? true) && (snapshot.value?.requirePairingForLan ?? true)
+  }
+  // Install provisionally while the host probe is pending so early SDK calls
+  // cannot escape onto the plain remote origin. A confirmed false retires it.
+  return hostPairingPolicy !== false
+}
+
 /**
  * Browser-safe loopback classification for the page origin (the SDK client
  * exports its own; this copy keeps the module dependency-free).

package/src/index.ts

@@ -353,7 +353,7 @@ function applyImpl(ctx: Context, config?: Config): void {
     },
   })
   const routes = [
-    ...makeRoutes({ service, lanAddresses }),
+    ...makeRoutes({ service, lanAddresses, requirePairingForLan: () => resolve().requirePairingForLan }),
     ...makeMobileRoutes(),
     ...(apiProxy !== undefined
       ? makeMobileApiRoutes({ service, apiProxy, mobileEnterToSend: () => resolve().mobileEnterToSend })

package/src/mobile/messages.test.ts

@@ -183,6 +183,29 @@ describe('foldEvents', () => {
     expect(assistant?.pending).toBeFalsy()
   })
 
+  it('keeps same-turn steps in final-event order after turn/end', () => {
+    const result = foldEvents([
+      makeEvent('user/message', userMessageData('u-1', 'multi-step'), 0),
+      makeEvent('assistant/message', assistantMessageData('step-z', 0, 0, 'first'), 2),
+      makeEvent('assistant/message', assistantMessageData('step-a', 0, 1, 'second'), 4),
+      makeEvent('assistant/message', assistantMessageData('step-m', 0, 2, 'third'), 6),
+      makeEvent('turn/end', { turn: 0, reason: { kind: 'completed' } }, 7),
+    ])
+
+    const assistants = result.filter(message => message.kind === 'assistant')
+    expect(assistants.map(message => message.id)).toEqual(['step-z', 'step-a', 'step-m'])
+    expect(assistants.map(message => message.seq)).toEqual([2, 4, 6])
+    expect(assistants.every(message => message.pending !== true)).toBe(true)
+  })
+
+  it('keeps stable insertion order when legacy rows share a seq', () => {
+    const folder = new EventFolder([
+      { id: 'z-last-lexically', kind: 'assistant', text: 'first', seq: 5, time: 5_000 },
+      { id: 'a-first-lexically', kind: 'assistant', text: 'second', seq: 5, time: 5_000 },
+    ])
+    expect(folder.snapshot().map(message => message.id)).toEqual(['z-last-lexically', 'a-first-lexically'])
+  })
+
   it('is idempotent: applying the same batch twice yields an identical list', () => {
     const events: WireEvent[] = [
       makeEvent('user/message', userMessageData('u-1', 'hi'), 0),

package/src/mobile/messages.ts

@@ -589,7 +589,8 @@ function applyTurnEnd(state: FoldState, event: WireEvent): void {
       ...message,
       ...(wasPending ? { pending: false } : {}),
       ...(failed ? { failed: true } : {}),
-      seq: Math.max(message.seq, event.seq),
+      // Preserve each step's own final-event seq. Collapsing every message
+      // onto turn/end makes same-turn ordering depend on arbitrary ids.
       time: event.time,
     })
   }
@@ -666,10 +667,11 @@ function snapshotOf(state: FoldState): RenderMessage[] {
   for (let index = 1; index < out.length; index += 1) {
     const prev = out[index - 1]!
     const current = out[index]!
-    if (prev.seq > current.seq || (prev.seq === current.seq && prev.id >= current.id)) {
+    if (prev.seq > current.seq) {
       ordered = false
       break
     }
   }
-  return ordered ? out : out.sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1))
+  // Array.sort is stable: equal-seq rows keep their event insertion order.
+  return ordered ? out : out.sort((a, b) => a.seq - b.seq)
 }

package/src/mobile/mux.test.ts

@@ -95,6 +95,22 @@ describe('MuxClient polling fallback', () => {
     client.stop()
   })
 
+  it('sorts an out-of-order history page before advancing the watermark', async () => {
+    const { factory } = makeSources()
+    const pollLatest = vi.fn(async (_sessionId: string) => pageOf([2, 1, 3]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    const seqs: number[] = []
+    client.onFrame((frame) => {
+      if (frame.type === 'session/event' && typeof frame.event.seq === 'number') seqs.push(frame.event.seq)
+    })
+    client.start()
+    client.observe('s1')
+
+    await vi.advanceTimersByTimeAsync(1200)
+    expect(seqs).toEqual([1, 2, 3])
+    client.stop()
+  })
+
   it('keeps the watermark so a repeated page never re-emits old events', async () => {
     const { factory } = makeSources()
     // Two calls return the same page: the second must emit nothing.
@@ -171,6 +187,54 @@ describe('MuxClient polling fallback', () => {
     client.stop()
   })
 
+  it('recovers when a previously-live SSE stream becomes silently stalled', async () => {
+    const { factory, sources } = makeSources()
+    const pollLatest = vi.fn(async (_sessionId: string) => pageOf([5]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    const frames: Array<{ type: string; event?: { seq: number } }> = []
+    client.onFrame(frame => { frames.push(frame as never) })
+    client.start()
+    client.observe('s1')
+
+    sources[0]?.onmessage?.({ data: envelopeWith({ type: 'session/subscribed', sessionId: 's1', lastSeq: 4 }) })
+    await vi.advanceTimersByTimeAsync(2400)
+    expect(pollLatest).not.toHaveBeenCalled()
+
+    // A once-live stream gets three stall windows; the next scheduler tick
+    // crosses that boundary and starts the ordinary-HTTP recovery path.
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    expect(frames.at(-1)?.event).toMatchObject({ seq: 5 })
+    client.stop()
+  })
+
+  it('backs empty polls off and resets to the base cadence after progress', async () => {
+    const { factory } = makeSources()
+    const pages = [pageOf([]), pageOf([1]), pageOf([1, 2])]
+    const pollLatest = vi.fn(async (_sessionId: string) => pages.shift() ?? pageOf([]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    client.start()
+    client.observe('s1')
+
+    await vi.advanceTimersByTimeAsync(1200)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(2)
+
+    // The productive second poll resets the next delay from 800 ms to 400 ms.
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(3)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(4)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(4)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(5)
+    client.stop()
+  })
+
   it('drives the whole lifecycle on a single scheduler tick (one interval)', async () => {
     const { factory } = makeSources()
     const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')

package/src/mobile/mux.ts

@@ -39,9 +39,9 @@ export interface MuxClientOptions {
    * the ordinary HTTP channel (unaffected by SSE-impairing tunnels).
    */
   pollLatest?: (sessionId: string) => Promise<HistoryPage>
-  /** Poll cadence while SSE is stalled (default 3000 ms). */
+  /** Initial poll cadence while SSE is stalled (default 3000 ms). Empty polls back off to 60000 ms. */
   pollIntervalMs?: number
-  /** How long SSE must go without a frame before fallback kicks in (default 12000 ms). */
+  /** Initial SSE stall window (default 12000 ms); a previously-live stream gets three windows before fallback. */
   stallThresholdMs?: number
   /** Clock seam for tests (defaults to Date.now). */
   now?: () => number
@@ -66,6 +66,8 @@ type SessionEventFrame = Extract<MuxFrame, { type: 'session/event' }>
 
 const DEFAULT_POLL_INTERVAL_MS = 3000
 const DEFAULT_STALL_THRESHOLD_MS = 12000
+const LIVE_SSE_STALL_MULTIPLIER = 3
+const MAX_POLL_BACKOFF_MS = 60000
 /**
  * Stall-check granularity: the single scheduler tick runs at least this
  * often so fallback arms within a second of the stall threshold passing,
@@ -98,8 +100,8 @@ export class MuxClient {
   private lastDataAt = 0
   /**
    * Whether the SSE channel has ever delivered a frame in this stream (a
-   * delivered frame proves the tunnel forwards SSE; silence alone then means
-   * the agent idle, not a dead channel — only an onerror re-arms fallback).
+   * delivered frame proves the tunnel can forward SSE; sustained silence may
+   * still mean a suspended mobile tunnel, so polling re-arms after 3 windows).
    */
   private sseAlive = false
   /** Per-session highest event seq already emitted, for poll dedup. */
@@ -109,6 +111,8 @@ export class MuxClient {
   private polling = false
   /** Epoch ms of the next due poll while polling (kept on the same tick timer). */
   private nextPollAt = 0
+  /** Adaptive delay: productive polls reset it; empty/error polls add one base interval up to one minute. */
+  private pollDelayMs: number
 
   /**
    * @param url - the mobile events endpoint (browser-relative).
@@ -119,6 +123,7 @@ export class MuxClient {
     this.sourceFactory = options.sourceFactory ?? browserSource
     this.pollLatest = options.pollLatest ?? ((sessionId) => fetchHistory(sessionId, undefined, DEFAULT_POLL_PAGE_SIZE))
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+    this.pollDelayMs = this.pollIntervalMs
     this.stallThresholdMs = options.stallThresholdMs ?? DEFAULT_STALL_THRESHOLD_MS
     this.now = options.now ?? (() => Date.now())
   }
@@ -159,9 +164,7 @@ export class MuxClient {
       return
     }
     // If SSE is already stalled for this session, start patching right away.
-    if (!this.polling && !this.stopped && !this.sseAlive && (this.now() - this.lastDataAt) > this.stallThresholdMs) {
-      this.startPolling()
-    }
+    if (!this.polling && !this.stopped && this.isSseStalled()) this.startPolling()
   }
 
   private connect(): void {
@@ -208,29 +211,37 @@ export class MuxClient {
     if (this.stopped) return
     if (this.observeSessionId === undefined) return
     if (this.polling) {
-      // The stall phase has ended; the same tick now paces the polls.
+      // The stall phase has ended; the same tick now paces the adaptive polls.
       if (this.now() >= this.nextPollAt) {
-        this.nextPollAt = this.now() + this.pollIntervalMs
+        // pollTick schedules the next run after it settles, so slow requests
+        // cannot overlap with another scheduler tick.
+        this.nextPollAt = Number.POSITIVE_INFINITY
         void this.pollTick()
       }
       return
     }
-    // A live SSE channel only goes silent while the agent idles; never poll
-    // against it. Fallback arms again only via onerror or a stream that has
-    // never delivered.
-    if (this.sseAlive) return
-    if ((this.now() - this.lastDataAt) > this.stallThresholdMs) this.startPolling()
+    if (this.isSseStalled()) this.startPolling()
+  }
+
+  private isSseStalled(): boolean {
+    const windowMs = this.sseAlive
+      ? this.stallThresholdMs * LIVE_SSE_STALL_MULTIPLIER
+      : this.stallThresholdMs
+    return (this.now() - this.lastDataAt) > windowMs
   }
 
   private startPolling(): void {
     if (this.polling || this.stopped) return
     this.polling = true
-    this.nextPollAt = this.now() + this.pollIntervalMs
+    this.pollDelayMs = this.pollIntervalMs
+    this.nextPollAt = Number.POSITIVE_INFINITY
     void this.pollTick()
   }
 
   private stopPolling(): void {
     this.polling = false
+    this.pollDelayMs = this.pollIntervalMs
+    this.nextPollAt = 0
   }
 
   /**
@@ -244,19 +255,35 @@ export class MuxClient {
       this.stopPolling()
       return
     }
+    let emitted = 0
     try {
       const page = await this.pollLatest(sessionId)
       let maxSeq = this.pollWatermark.get(sessionId) ?? -1
-      for (const entry of page.events) {
+      const ordered = [...page.events].sort((left, right) => {
+        const leftSeq = typeof left.event?.seq === 'number' ? left.event.seq : -1
+        const rightSeq = typeof right.event?.seq === 'number' ? right.event.seq : -1
+        return leftSeq - rightSeq
+      })
+      for (const entry of ordered) {
         const event = entry.event
         const seq = typeof event?.seq === 'number' ? event.seq : -1
         if (seq <= maxSeq) continue
         maxSeq = seq
+        emitted += 1
         this.emit({ type: 'session/event', sessionId: sessionId as SessionEventFrame['sessionId'], event } as SessionEventFrame)
       }
       this.pollWatermark.set(sessionId, maxSeq)
     } catch {
-      // Transient (network, pairing, history paging); the next tick retries.
+      // Transient (network, pairing, history paging); retry with backoff.
+    } finally {
+      if (emitted > 0) {
+        this.pollDelayMs = this.pollIntervalMs
+      } else {
+        this.pollDelayMs = Math.min(MAX_POLL_BACKOFF_MS, this.pollDelayMs + this.pollIntervalMs)
+      }
+      if (this.polling && this.observeSessionId === sessionId) {
+        this.nextPollAt = this.now() + this.pollDelayMs
+      }
     }
   }
 

package/src/routes.ts

@@ -195,6 +195,8 @@ export interface PairRoutesDeps {
   service: PairingService
   /** The LAN IP literals the fence accepts (derived from the bind host). */
   lanAddresses: readonly string[]
+  /** Current desktop gate policy, re-read for every status response. */
+  requirePairingForLan?: boolean | (() => boolean)
 }
 
 /**
@@ -203,7 +205,10 @@ export interface PairRoutesDeps {
  * @returns the exact routes to register on webServer.
  */
 export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
-  const { service, lanAddresses } = deps
+  const { service, lanAddresses, requirePairingForLan = true } = deps
+  const pairingRequired = (): boolean => typeof requirePairingForLan === 'function'
+    ? requirePairingForLan()
+    : requirePairingForLan
   const events = new PairingEventsStream(service)
 
   /** Loopback-only fence: the desktop panel's control endpoints. */
@@ -404,7 +409,7 @@ export function makeRoutes(deps: PairRoutesDeps): WebRoute[] {
     const visible = paired
       ? rest
       : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses }
-    writeJson(res, 200, { ok: true, paired, ...visible })
+    writeJson(res, 200, { ok: true, paired, requirePairingForLan: pairingRequired(), ...visible })
   }
 
   const handleEvents = (req: IncomingMessage, res: ServerResponse): void => {