@linxin666/dsh-remote-web-ui 0.2.7 → 0.2.9

package/lib/types/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAclD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;CACb;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CAsCnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CAwBjF"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAclD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;CACjD;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA2CnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CA2BjF"}

package/lib/types/remote-api.js

@@ -7,8 +7,10 @@
  * and no per-plugin pairing consult.
  *
  * Security model:
- * - Every request must carry a live paired-device cookie, enforced before
- *   any bytes are forwarded and before any host call.
+ * - While `requirePairingForLan` is on (default), every request must carry a
+ *   live paired-device cookie, enforced before any bytes are forwarded and
+ *   before any host call. With the policy off, the cookie gate is skipped
+ *   (the loopback-only denials below still apply).
  * - The SDK's loopback-only privileged methods (native dialogs, the settings
  *   plane, credentials — the `PRIVILEGED_METHODS` set of client-connection)
  *   are denied here. The set is pinned by tests/remote-contract.spec.ts.
@@ -95,19 +97,24 @@ export function loopbackOnlyDenial(innerPath) {
 }
 /**
  * Build the remote desktop channel HTTP routes.
- * @param deps - pairing service + local port.
+ * @param deps - pairing service + local port + live pairing policy.
  * @returns the routes to register on webServer.
  */
 export function makeRemoteApiRoutes(deps) {
-    const { service, port } = deps;
+    const { service, port, requirePairingForLan = true } = deps;
     const handler = (req, res) => {
         // Cookie gate first — same order as /m/api. Do not buffer an unpaired body.
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        const paired = deviceId !== undefined && service.touchDevice(deviceId);
-        if (!paired) {
-            req.resume();
-            envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
-            return;
+        // With the live policy off, untrusted-but-policy-open callers are proxied
+        // (a stale client rewrite must not 403); loopback-only denials stay below.
+        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
+        if (require) {
+            const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+            const paired = deviceId !== undefined && service.touchDevice(deviceId);
+            if (!paired) {
+                req.resume();
+                envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
+                return;
+            }
         }
         const method = req.method ?? 'GET';
         if (!ALLOWED_METHODS.has(method)) {
@@ -153,17 +160,20 @@ export function upgradeInnerPath(reqUrl, fallbackPath) {
 /**
  * Build the WebSocket upgrade routes for the event streams and known plugin
  * sockets. webServer matches upgrades by exact path.
- * @param deps - pairing service + local port.
+ * @param deps - pairing service + local port + live pairing policy.
  * @returns the upgrade routes to register on webServer.
  */
 export function makeRemoteApiUpgradeRoutes(deps) {
-    const { service, port } = deps;
+    const { service, port, requirePairingForLan = true } = deps;
     const handlerFor = (fallbackPath) => (req, socket, head) => {
-        const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-        if (deviceId === undefined || !service.touchDevice(deviceId)) {
-            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-            socket.destroy();
-            return;
+        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
+        if (require) {
+            const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+            if (deviceId === undefined || !service.touchDevice(deviceId)) {
+                socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+                socket.destroy();
+                return;
+            }
         }
         const inner = upgradeInnerPath(req.url, fallbackPath);
         const denied = loopbackOnlyDenial(inner.split('?')[0] ?? inner);

package/lib/types/routes.d.ts

@@ -84,6 +84,8 @@ export interface PairRoutesDeps {
     service: PairingService;
     /** The LAN IP literals the fence accepts (derived from the bind host). */
     lanAddresses: readonly string[];
+    /** Current desktop gate policy, re-read for every status response. */
+    requirePairingForLan?: boolean | (() => boolean);
 }
 /**
  * Build the /api/pair route family.

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;CAQb,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA6BjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAiO3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;CAQb,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA6BjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;CACjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAoO3D"}

package/lib/types/routes.js

@@ -183,7 +183,10 @@ export class PairingEventsStream {
  * @returns the exact routes to register on webServer.
  */
 export function makeRoutes(deps) {
-    const { service, lanAddresses } = deps;
+    const { service, lanAddresses, requirePairingForLan = true } = deps;
+    const pairingRequired = () => typeof requirePairingForLan === 'function'
+        ? requirePairingForLan()
+        : requirePairingForLan;
     const events = new PairingEventsStream(service);
     /** Loopback-only fence: the desktop panel's control endpoints. */
     const loopbackFence = (req) => isTrustedApiRequest(req, []);
@@ -385,7 +388,7 @@ export function makeRoutes(deps) {
         const visible = paired
             ? rest
             : { phase: snapshot.phase, lanAvailable: snapshot.lanAvailable, lanAddresses: snapshot.lanAddresses };
-        writeJson(res, 200, { ok: true, paired, ...visible });
+        writeJson(res, 200, { ok: true, paired, requirePairingForLan: pairingRequired(), ...visible });
     };
     const handleEvents = (req, res) => {
         if (!requireMethod(req, res, 'GET'))

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair mobile and PC remote control for the dsh web GUI: QR entry beside the settings button, one-time pairing tokens, a gated /remote/api desktop channel, live device status, and revocable sessions",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -35,6 +35,9 @@
   ],
   "license": "Apache-2.0",
   "dsh": {
+    "engines": {
+      "dsh": ">=0.1.1-rc.1"
+    },
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
@@ -61,17 +64,17 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-apiproxy": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",

package/src/client/RemoteEntry.tsx

@@ -219,7 +219,7 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
     <>
       <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
         <UpdateEntry wide={wide} t={t} />
-        <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} />
+        <TooltipAnchor wide={wide} label={t('entry.label')} onClick={openPanel} expanded={open} />
       </div>
       {open && createPortal((
         <div className={css.overlay} role="presentation">
@@ -243,13 +243,14 @@ export function RemoteEntry({ wide, useWorkspaces, t }: RemoteEntryProps) {
 }
 
 /** The trigger: an icon-only control with a persistent accessible label. */
-function TooltipAnchor({ wide, label, onClick }: { wide: boolean; label: string; onClick: () => void }) {
+function TooltipAnchor({ wide, label, onClick, expanded }: { wide: boolean; label: string; onClick: () => void; expanded: boolean }) {
   return (
     <button
       type="button"
       className={css.trigger}
       data-wide={wide ? 'wide' : 'rail'}
       aria-label={label}
+      aria-expanded={expanded}
       title={label}
       onClick={onClick}
     >

package/src/client/UpdateEntry.tsx

@@ -124,6 +124,7 @@ export function UpdateEntry({ wide, t }: UpdateEntryProps) {
         data-wide={wide ? undefined : "rail"}
         data-update-available={updateAvailable ? "true" : undefined}
         aria-label={updateLabel}
+        aria-expanded={open}
         title={updateLabel}
         onClick={openPanel}
       >

package/src/client/index.ts

@@ -23,8 +23,8 @@ import { PairFailedNotice } from './PairFailedNotice.tsx'
 import { RemoteSettingsCard, RemoteSettingsCardController, type RemoteSettings } from './RemoteSettingsCard.tsx'
 import { en, zh, type RemoteKey } from './locales.ts'
 import { PAIR_FAILED_MARKER, runPairBootFlow } from './deep-link.ts'
-import { sendHeartbeat } from './pair-api.ts'
-import { channelTransition, installRemoteChannel, isLoopbackHostname } from './remote-channel.ts'
+import { readPairGatePolicy, sendHeartbeat } from './pair-api.ts'
+import { channelTransition, installRemoteChannel, isLoopbackHostname, remoteChannelRequired } from './remote-channel.ts'
 import { FenceNotice } from './FenceNotice.tsx'
 
 export type { RemoteEntryProps } from './RemoteEntry.tsx'
@@ -201,6 +201,8 @@ export function apply(ctx: ClientContext): void {
   // rewritten onto this plugin's gated /remote/api prefix (remote-channel.ts)
   // while the fence setting demands it. Loopback origins are untouched.
   let disposeChannel: (() => void) | undefined
+  let hostPairingPolicy: boolean | undefined
+  let unpairedWhilePolicyPending = false
   let fenceNotice: { unmount: () => void; node: HTMLElement } | undefined
   const showFenceNotice = (): void => {
     if (fenceNotice !== undefined) return
@@ -214,22 +216,23 @@ export function apply(ctx: ClientContext): void {
     fenceNotice?.unmount()
     fenceNotice = undefined
   }
-  const channelActive = (): boolean => {
-    if (isLoopbackHostname(window.location.hostname)) return false
-    // A not-yet-loaded (or unavailable) settings snapshot falls back to the
-    // schema defaults — enabled and requirePairingForLan are both true, and
-    // on a remote origin the snapshot may never load (its own transport is
-    // what the channel gates), so waiting for 'ready' here would deadlock
-    // the channel off exactly where it is needed most.
-    const snapshot = settingsScope.getSnapshot()
-    const value = snapshot.status === 'ready' ? snapshot.value : undefined
-    return (value?.enabled ?? true) && (value?.requirePairingForLan ?? true)
+  const handleUnpaired = (): void => {
+    if (settingsScope.getSnapshot().status !== 'ready' && hostPairingPolicy === undefined) {
+      unpairedWhilePolicyPending = true
+      return
+    }
+    showFenceNotice()
   }
+  const channelActive = (): boolean => remoteChannelRequired(
+    window.location.hostname,
+    settingsScope.getSnapshot(),
+    hostPairingPolicy,
+  )
   const syncChannel = (): void => {
     const transition = channelTransition(channelActive(), disposeChannel !== undefined)
     if (transition === 'install') {
       disposeChannel = ctx.effect(() => {
-        const restore = installRemoteChannel(window, { onUnpaired: showFenceNotice, onPaired: hideFenceNotice })
+        const restore = installRemoteChannel(window, { onUnpaired: handleUnpaired, onPaired: hideFenceNotice })
         return restore
       }, 'remote-web-ui: remote desktop channel')
     } else if (transition === 'retire' && disposeChannel !== undefined) {
@@ -246,6 +249,20 @@ export function apply(ctx: ClientContext): void {
   }
   settingsScope.subscribe(syncChannel)
   syncChannel()
+  if (!isLoopbackHostname(window.location.hostname) && settingsScope.getSnapshot().status !== 'ready') {
+    void readPairGatePolicy().then((policy) => {
+      hostPairingPolicy = policy.requirePairingForLan
+      syncChannel()
+      if (hostPairingPolicy && unpairedWhilePolicyPending) showFenceNotice()
+      unpairedWhilePolicyPending = false
+    }).catch(() => {
+      // Fail closed when the policy endpoint is unavailable or malformed.
+      hostPairingPolicy = true
+      syncChannel()
+      if (unpairedWhilePolicyPending) showFenceNotice()
+      unpairedWhilePolicyPending = false
+    })
+  }
 
   // One-time failed-pair toast. The accept result lands asynchronously, so
   // the marker check is deferred past the accept round trip.

package/src/client/pair-api.ts

@@ -36,6 +36,22 @@ export interface IssueLoopbackRequired {
 
 export type IssueResponse = IssueResult | IssueLanRequired | IssueUnknownAddress | IssueLoopbackRequired
 
+/** Public policy fields returned by the pairing status endpoint. */
+export interface PairGatePolicy {
+  requirePairingForLan: boolean
+}
+
+/** Read the host-authoritative desktop pairing policy. */
+export async function readPairGatePolicy(): Promise<PairGatePolicy> {
+  const response = await fetch('/api/pair/status')
+  if (!response.ok) throw new Error(`remote-web-ui: status failed with ${String(response.status)}`)
+  const value = await response.json() as { requirePairingForLan?: unknown }
+  if (typeof value.requirePairingForLan !== 'boolean') {
+    throw new Error('remote-web-ui: status omitted requirePairingForLan')
+  }
+  return { requirePairingForLan: value.requirePairingForLan }
+}
+
 /** accept() refusal codes. */
 export type AcceptFailure = { ok: false; code: 'invalid' | 'used' | 'forbidden' }
 

package/src/client/remote-channel.ts

@@ -46,6 +46,27 @@ const WS_PATHS = new Set([
   '/api/dsh-ssh/terminal',
 ])
 
+/** Minimal settings snapshot used by the remote channel decision. */
+export interface RemoteChannelSettingsSnapshot {
+  status: 'ready' | 'loading' | 'unavailable' | string
+  value?: { enabled?: boolean; requirePairingForLan?: boolean }
+}
+
+/** Decide whether a remote desktop channel is required from local or host policy. */
+export function remoteChannelRequired(
+  hostname: string,
+  snapshot: RemoteChannelSettingsSnapshot,
+  hostPairingPolicy: boolean | undefined,
+): boolean {
+  if (isLoopbackHostname(hostname)) return false
+  if (snapshot.status === 'ready') {
+    return (snapshot.value?.enabled ?? true) && (snapshot.value?.requirePairingForLan ?? true)
+  }
+  // Install provisionally while the host probe is pending so early SDK calls
+  // cannot escape onto the plain remote origin. A confirmed false retires it.
+  return hostPairingPolicy !== false
+}
+
 /**
  * Browser-safe loopback classification for the page origin (the SDK client
  * exports its own; this copy keeps the module dependency-free).

package/src/index.ts

@@ -353,17 +353,28 @@ function applyImpl(ctx: Context, config?: Config): void {
     },
   })
   const routes = [
-    ...makeRoutes({ service, lanAddresses }),
+    ...makeRoutes({ service, lanAddresses, requirePairingForLan: () => resolve().requirePairingForLan }),
     ...makeMobileRoutes(),
     ...(apiProxy !== undefined
       ? makeMobileApiRoutes({ service, apiProxy, mobileEnterToSend: () => resolve().mobileEnterToSend })
       : []),
-    // The remote desktop channel: paired-cookie-gated `/remote` prefix that
-    // re-issues fenced paths to loopback (see remote-api.ts).
-    ...makeRemoteApiRoutes({ service, port: ctx.webServer.port }),
+    // The remote desktop channel: policy-gated `/remote` prefix that
+    // re-issues fenced paths to loopback (see remote-api.ts). The live
+    // requirePairingForLan is re-read per request, same as the gate listener
+    // and routes above, so a stale client rewrite on an open-LAN deployment
+    // proxies instead of 403ing.
+    ...makeRemoteApiRoutes({
+      service,
+      port: ctx.webServer.port,
+      requirePairingForLan: () => resolve().requirePairingForLan,
+    }),
     ...updateRoutes,
   ]
-  const upgrades = makeRemoteApiUpgradeRoutes({ service, port: ctx.webServer.port })
+  const upgrades = makeRemoteApiUpgradeRoutes({
+    service,
+    port: ctx.webServer.port,
+    requirePairingForLan: () => resolve().requirePairingForLan,
+  })
   const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled)
   ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate')
 

package/src/mobile/messages.test.ts

@@ -183,6 +183,29 @@ describe('foldEvents', () => {
     expect(assistant?.pending).toBeFalsy()
   })
 
+  it('keeps same-turn steps in final-event order after turn/end', () => {
+    const result = foldEvents([
+      makeEvent('user/message', userMessageData('u-1', 'multi-step'), 0),
+      makeEvent('assistant/message', assistantMessageData('step-z', 0, 0, 'first'), 2),
+      makeEvent('assistant/message', assistantMessageData('step-a', 0, 1, 'second'), 4),
+      makeEvent('assistant/message', assistantMessageData('step-m', 0, 2, 'third'), 6),
+      makeEvent('turn/end', { turn: 0, reason: { kind: 'completed' } }, 7),
+    ])
+
+    const assistants = result.filter(message => message.kind === 'assistant')
+    expect(assistants.map(message => message.id)).toEqual(['step-z', 'step-a', 'step-m'])
+    expect(assistants.map(message => message.seq)).toEqual([2, 4, 6])
+    expect(assistants.every(message => message.pending !== true)).toBe(true)
+  })
+
+  it('keeps stable insertion order when legacy rows share a seq', () => {
+    const folder = new EventFolder([
+      { id: 'z-last-lexically', kind: 'assistant', text: 'first', seq: 5, time: 5_000 },
+      { id: 'a-first-lexically', kind: 'assistant', text: 'second', seq: 5, time: 5_000 },
+    ])
+    expect(folder.snapshot().map(message => message.id)).toEqual(['z-last-lexically', 'a-first-lexically'])
+  })
+
   it('is idempotent: applying the same batch twice yields an identical list', () => {
     const events: WireEvent[] = [
       makeEvent('user/message', userMessageData('u-1', 'hi'), 0),

package/src/mobile/messages.ts

@@ -589,7 +589,8 @@ function applyTurnEnd(state: FoldState, event: WireEvent): void {
       ...message,
       ...(wasPending ? { pending: false } : {}),
       ...(failed ? { failed: true } : {}),
-      seq: Math.max(message.seq, event.seq),
+      // Preserve each step's own final-event seq. Collapsing every message
+      // onto turn/end makes same-turn ordering depend on arbitrary ids.
       time: event.time,
     })
   }
@@ -666,10 +667,11 @@ function snapshotOf(state: FoldState): RenderMessage[] {
   for (let index = 1; index < out.length; index += 1) {
     const prev = out[index - 1]!
     const current = out[index]!
-    if (prev.seq > current.seq || (prev.seq === current.seq && prev.id >= current.id)) {
+    if (prev.seq > current.seq) {
       ordered = false
       break
     }
   }
-  return ordered ? out : out.sort((a, b) => a.seq - b.seq || (a.id < b.id ? -1 : 1))
+  // Array.sort is stable: equal-seq rows keep their event insertion order.
+  return ordered ? out : out.sort((a, b) => a.seq - b.seq)
 }

package/src/mobile/mux.test.ts

@@ -95,6 +95,22 @@ describe('MuxClient polling fallback', () => {
     client.stop()
   })
 
+  it('sorts an out-of-order history page before advancing the watermark', async () => {
+    const { factory } = makeSources()
+    const pollLatest = vi.fn(async (_sessionId: string) => pageOf([2, 1, 3]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    const seqs: number[] = []
+    client.onFrame((frame) => {
+      if (frame.type === 'session/event' && typeof frame.event.seq === 'number') seqs.push(frame.event.seq)
+    })
+    client.start()
+    client.observe('s1')
+
+    await vi.advanceTimersByTimeAsync(1200)
+    expect(seqs).toEqual([1, 2, 3])
+    client.stop()
+  })
+
   it('keeps the watermark so a repeated page never re-emits old events', async () => {
     const { factory } = makeSources()
     // Two calls return the same page: the second must emit nothing.
@@ -171,6 +187,54 @@ describe('MuxClient polling fallback', () => {
     client.stop()
   })
 
+  it('recovers when a previously-live SSE stream becomes silently stalled', async () => {
+    const { factory, sources } = makeSources()
+    const pollLatest = vi.fn(async (_sessionId: string) => pageOf([5]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    const frames: Array<{ type: string; event?: { seq: number } }> = []
+    client.onFrame(frame => { frames.push(frame as never) })
+    client.start()
+    client.observe('s1')
+
+    sources[0]?.onmessage?.({ data: envelopeWith({ type: 'session/subscribed', sessionId: 's1', lastSeq: 4 }) })
+    await vi.advanceTimersByTimeAsync(2400)
+    expect(pollLatest).not.toHaveBeenCalled()
+
+    // A once-live stream gets three stall windows; the next scheduler tick
+    // crosses that boundary and starts the ordinary-HTTP recovery path.
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    expect(frames.at(-1)?.event).toMatchObject({ seq: 5 })
+    client.stop()
+  })
+
+  it('backs empty polls off and resets to the base cadence after progress', async () => {
+    const { factory } = makeSources()
+    const pages = [pageOf([]), pageOf([1]), pageOf([1, 2])]
+    const pollLatest = vi.fn(async (_sessionId: string) => pages.shift() ?? pageOf([]))
+    const client = new MuxClient('/m/api/events.mux', baseOptions(pollLatest, factory))
+    client.start()
+    client.observe('s1')
+
+    await vi.advanceTimersByTimeAsync(1200)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(1)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(2)
+
+    // The productive second poll resets the next delay from 800 ms to 400 ms.
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(3)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(4)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(4)
+    await vi.advanceTimersByTimeAsync(400)
+    expect(pollLatest).toHaveBeenCalledTimes(5)
+    client.stop()
+  })
+
   it('drives the whole lifecycle on a single scheduler tick (one interval)', async () => {
     const { factory } = makeSources()
     const setIntervalSpy = vi.spyOn(globalThis, 'setInterval')

package/src/mobile/mux.ts

@@ -39,9 +39,9 @@ export interface MuxClientOptions {
    * the ordinary HTTP channel (unaffected by SSE-impairing tunnels).
    */
   pollLatest?: (sessionId: string) => Promise<HistoryPage>
-  /** Poll cadence while SSE is stalled (default 3000 ms). */
+  /** Initial poll cadence while SSE is stalled (default 3000 ms). Empty polls back off to 60000 ms. */
   pollIntervalMs?: number
-  /** How long SSE must go without a frame before fallback kicks in (default 12000 ms). */
+  /** Initial SSE stall window (default 12000 ms); a previously-live stream gets three windows before fallback. */
   stallThresholdMs?: number
   /** Clock seam for tests (defaults to Date.now). */
   now?: () => number
@@ -66,6 +66,8 @@ type SessionEventFrame = Extract<MuxFrame, { type: 'session/event' }>
 
 const DEFAULT_POLL_INTERVAL_MS = 3000
 const DEFAULT_STALL_THRESHOLD_MS = 12000
+const LIVE_SSE_STALL_MULTIPLIER = 3
+const MAX_POLL_BACKOFF_MS = 60000
 /**
  * Stall-check granularity: the single scheduler tick runs at least this
  * often so fallback arms within a second of the stall threshold passing,
@@ -98,8 +100,8 @@ export class MuxClient {
   private lastDataAt = 0
   /**
    * Whether the SSE channel has ever delivered a frame in this stream (a
-   * delivered frame proves the tunnel forwards SSE; silence alone then means
-   * the agent idle, not a dead channel — only an onerror re-arms fallback).
+   * delivered frame proves the tunnel can forward SSE; sustained silence may
+   * still mean a suspended mobile tunnel, so polling re-arms after 3 windows).
    */
   private sseAlive = false
   /** Per-session highest event seq already emitted, for poll dedup. */
@@ -109,6 +111,8 @@ export class MuxClient {
   private polling = false
   /** Epoch ms of the next due poll while polling (kept on the same tick timer). */
   private nextPollAt = 0
+  /** Adaptive delay: productive polls reset it; empty/error polls add one base interval up to one minute. */
+  private pollDelayMs: number
 
   /**
    * @param url - the mobile events endpoint (browser-relative).
@@ -119,6 +123,7 @@ export class MuxClient {
     this.sourceFactory = options.sourceFactory ?? browserSource
     this.pollLatest = options.pollLatest ?? ((sessionId) => fetchHistory(sessionId, undefined, DEFAULT_POLL_PAGE_SIZE))
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS
+    this.pollDelayMs = this.pollIntervalMs
     this.stallThresholdMs = options.stallThresholdMs ?? DEFAULT_STALL_THRESHOLD_MS
     this.now = options.now ?? (() => Date.now())
   }
@@ -159,9 +164,7 @@ export class MuxClient {
       return
     }
     // If SSE is already stalled for this session, start patching right away.
-    if (!this.polling && !this.stopped && !this.sseAlive && (this.now() - this.lastDataAt) > this.stallThresholdMs) {
-      this.startPolling()
-    }
+    if (!this.polling && !this.stopped && this.isSseStalled()) this.startPolling()
   }
 
   private connect(): void {
@@ -208,29 +211,37 @@ export class MuxClient {
     if (this.stopped) return
     if (this.observeSessionId === undefined) return
     if (this.polling) {
-      // The stall phase has ended; the same tick now paces the polls.
+      // The stall phase has ended; the same tick now paces the adaptive polls.
       if (this.now() >= this.nextPollAt) {
-        this.nextPollAt = this.now() + this.pollIntervalMs
+        // pollTick schedules the next run after it settles, so slow requests
+        // cannot overlap with another scheduler tick.
+        this.nextPollAt = Number.POSITIVE_INFINITY
         void this.pollTick()
       }
       return
     }
-    // A live SSE channel only goes silent while the agent idles; never poll
-    // against it. Fallback arms again only via onerror or a stream that has
-    // never delivered.
-    if (this.sseAlive) return
-    if ((this.now() - this.lastDataAt) > this.stallThresholdMs) this.startPolling()
+    if (this.isSseStalled()) this.startPolling()
+  }
+
+  private isSseStalled(): boolean {
+    const windowMs = this.sseAlive
+      ? this.stallThresholdMs * LIVE_SSE_STALL_MULTIPLIER
+      : this.stallThresholdMs
+    return (this.now() - this.lastDataAt) > windowMs
   }
 
   private startPolling(): void {
     if (this.polling || this.stopped) return
     this.polling = true
-    this.nextPollAt = this.now() + this.pollIntervalMs
+    this.pollDelayMs = this.pollIntervalMs
+    this.nextPollAt = Number.POSITIVE_INFINITY
     void this.pollTick()
   }
 
   private stopPolling(): void {
     this.polling = false
+    this.pollDelayMs = this.pollIntervalMs
+    this.nextPollAt = 0
   }
 
   /**
@@ -244,19 +255,35 @@ export class MuxClient {
       this.stopPolling()
       return
     }
+    let emitted = 0
     try {
       const page = await this.pollLatest(sessionId)
       let maxSeq = this.pollWatermark.get(sessionId) ?? -1
-      for (const entry of page.events) {
+      const ordered = [...page.events].sort((left, right) => {
+        const leftSeq = typeof left.event?.seq === 'number' ? left.event.seq : -1
+        const rightSeq = typeof right.event?.seq === 'number' ? right.event.seq : -1
+        return leftSeq - rightSeq
+      })
+      for (const entry of ordered) {
         const event = entry.event
         const seq = typeof event?.seq === 'number' ? event.seq : -1
         if (seq <= maxSeq) continue
         maxSeq = seq
+        emitted += 1
         this.emit({ type: 'session/event', sessionId: sessionId as SessionEventFrame['sessionId'], event } as SessionEventFrame)
       }
       this.pollWatermark.set(sessionId, maxSeq)
     } catch {
-      // Transient (network, pairing, history paging); the next tick retries.
+      // Transient (network, pairing, history paging); retry with backoff.
+    } finally {
+      if (emitted > 0) {
+        this.pollDelayMs = this.pollIntervalMs
+      } else {
+        this.pollDelayMs = Math.min(MAX_POLL_BACKOFF_MS, this.pollDelayMs + this.pollIntervalMs)
+      }
+      if (this.polling && this.observeSessionId === sessionId) {
+        this.nextPollAt = this.now() + this.pollDelayMs
+      }
     }
   }