@linxin666/dsh-remote-web-ui 0.2.8 → 0.3.0

package/lib/types/remote-channel-rules.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The remote-channel rewrite contract as pure data (issue #987): both the
+ * browser patch (client/remote-channel.ts) and the parse-time boot patch
+ * (remote-channel-boot.ts, inlined into index.html by the host) decide from
+ * these tables, so the two can never drift apart.
+ * @module @linxin666/dsh-remote-web-ui/remote-channel-rules
+ */
+/** The gated mirror prefix (must match src/remote-methods.ts). */
+export declare const REMOTE_PREFIX = "/remote";
+/** Connection-plugin method prefix under the gated channel. */
+export declare const REMOTE_API_PREFIX = "/remote/api";
+/** Every decision input of the remote-channel rewrite, JSON-serializable. */
+export interface RemoteChannelRules {
+    readonly remotePrefix: string;
+    readonly apiPrefix: string;
+    readonly pairPrefix: string;
+    readonly updatePrefix: string;
+    readonly desktopLauncherPrefix: string;
+    readonly settingsBridgePrefix: string;
+    readonly sidebarPrefix: string;
+    readonly gitPrefix: string;
+    readonly petPrefix: string;
+    readonly wsPaths: readonly string[];
+}
+/** The live rule set. */
+export declare const REMOTE_CHANNEL_RULES: RemoteChannelRules;
+/** The window global the boot patch publishes its seat under. */
+export declare const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
+/**
+ * The seat the parse-time boot patch installs: hook seats the plugin's
+ * client apply adopts, a pending-unpaired flag for signals raised before
+ * adoption, and restore() retiring the patch (also removes the global).
+ */
+export interface RemoteChannelBootSeat {
+    onUnpaired: (() => void) | null;
+    onPaired: (() => void) | null;
+    pendingUnpaired: boolean;
+    restore(): void;
+}
+//# sourceMappingURL=remote-channel-rules.d.ts.map

package/lib/types/remote-channel-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAiBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -0,0 +1,32 @@
+/**
+ * The remote-channel rewrite contract as pure data (issue #987): both the
+ * browser patch (client/remote-channel.ts) and the parse-time boot patch
+ * (remote-channel-boot.ts, inlined into index.html by the host) decide from
+ * these tables, so the two can never drift apart.
+ * @module @linxin666/dsh-remote-web-ui/remote-channel-rules
+ */
+/** The gated mirror prefix (must match src/remote-methods.ts). */
+export const REMOTE_PREFIX = '/remote';
+/** Connection-plugin method prefix under the gated channel. */
+export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
+/** The live rule set. */
+export const REMOTE_CHANNEL_RULES = {
+    remotePrefix: REMOTE_PREFIX,
+    apiPrefix: '/api/',
+    pairPrefix: '/api/pair/',
+    updatePrefix: '/api/update/',
+    desktopLauncherPrefix: '/api/dsh-desktop-launcher',
+    settingsBridgePrefix: '/api/dsh-web-ui-settings',
+    sidebarPrefix: '/sidebar/',
+    gitPrefix: '/git/',
+    petPrefix: '/pet/',
+    wsPaths: [
+        '/api/events.mux',
+        '/api/events.host',
+        '/sidebar/ws/terminal',
+        '/sidebar/ws/agent-terminals',
+        '/api/dsh-ssh/terminal',
+    ],
+};
+/** The window global the boot patch publishes its seat under. */
+export const REMOTE_CHANNEL_BOOT_GLOBAL = '__DSH_REMOTE_CHANNEL_BOOT__';

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;CAQb,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AA6BjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;CACjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAoO3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;CAQb,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AAoBjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;CACjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAkO3D"}

package/lib/types/routes.js

@@ -10,7 +10,7 @@
 import { z } from 'zod';
 import { UnknownLanAddressError } from "./pairing.js";
 import { isLoopbackClient, readCookie } from "./gate.js";
-import { readBoundedJson, writeJson } from "./http.js";
+import { readJsonBody, writeJson } from "./http.js";
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
  * package's internal fence semantics (Host/Origin based, DNS-rebinding and
@@ -113,25 +113,16 @@ export const revokePayloadSchema = z.object({
 });
 export const pairActionPayloadSchema = z.object({}).passthrough();
 /**
- * Parse a pair request body through schema. A missing/empty or non-object
- * body is treated as an empty object (the same way the previous manual reads
- * yielded absent fields), and a value that fails the schema returns
- * `undefined` so the caller can answer with the existing error shape.
+ * Parse a pair request body through schema. A missing/empty, unparseable
+ * or non-object body (shared readJsonBody with objectOnly yields null for
+ * all of them) is treated as an empty object — the desktop stop/heartbeat
+ * send no body — and a value that fails the schema returns `undefined` so
+ * the caller can answer with the existing error shape.
  */
 function parsePairPayload(schema, body) {
     const result = schema.safeParse(body ?? {});
     return result.success ? result.data : undefined;
 }
-/** Read a request body up to MAX_BODY_BYTES and parse it as JSON (undefined on failure). */
-async function readJsonBody(req) {
-    try {
-        const parsed = await readBoundedJson(req, MAX_BODY_BYTES);
-        return typeof parsed === 'object' && parsed !== null ? parsed : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /** The SSE fan-out for desktop panel status. */
 export class PairingEventsStream {
     streams = new Set();
@@ -242,7 +233,7 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        const body = await readJsonBody(req);
+        const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true });
         const payload = parsePairPayload(issuePayloadSchema, body);
         if (payload === undefined) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
@@ -292,7 +283,7 @@ export function makeRoutes(deps) {
             writeJson(res, 429, { ok: false, code: 'rate-limited' });
             return;
         }
-        const body = await readJsonBody(req);
+        const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true });
         const payload = parsePairPayload(acceptPayloadSchema, body);
         if (payload === undefined) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
@@ -307,13 +298,11 @@ export function makeRoutes(deps) {
         // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
         // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
         // top-level navigations working while blocking cross-site subrequests.
-        res.writeHead(200, {
-            'content-type': 'application/json; charset=utf-8',
+        writeJson(res, 200, { ok: true, deviceId: result.deviceId }, {
             'set-cookie': [
                 `${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`,
             ],
         });
-        res.end(JSON.stringify({ ok: true, deviceId: result.deviceId }));
     };
     const handleStop = async (req, res) => {
         if (!requireMethod(req, res, 'POST'))
@@ -322,7 +311,7 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        const body = await readJsonBody(req);
+        const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true });
         if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
             return;
@@ -337,7 +326,7 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        const body = await readJsonBody(req);
+        const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true });
         const payload = parsePairPayload(revokePayloadSchema, body);
         if (payload === undefined) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
@@ -357,7 +346,7 @@ export function makeRoutes(deps) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
-        const body = await readJsonBody(req);
+        const body = await readJsonBody(req, { maxBytes: MAX_BODY_BYTES, objectOnly: true });
         if (parsePairPayload(pairActionPayloadSchema, body) === undefined) {
             writeJson(res, 400, { ok: false, code: 'bad-payload' });
             return;

package/lib/types/uuid-polyfill.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Polyfill for crypto.randomUUID for non-secure contexts (LAN HTTP)
+ * where the browser does not expose crypto.randomUUID.
+ *
+ * The script string is injected as an inline <script> in the desktop HTML
+ * head so the SDK's mintRpcId() sees a working randomUUID even on plain
+ * http:// origins (#1024).
+ */
+export declare const UUID_POLYFILL_SCRIPT: string;
+//# sourceMappingURL=uuid-polyfill.d.ts.map

package/lib/types/uuid-polyfill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uuid-polyfill.d.ts","sourceRoot":"","sources":["../../src/uuid-polyfill.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,oBAAoB,QAkBvB,CAAA"}

package/lib/types/uuid-polyfill.js

@@ -0,0 +1,27 @@
+/**
+ * Polyfill for crypto.randomUUID for non-secure contexts (LAN HTTP)
+ * where the browser does not expose crypto.randomUUID.
+ *
+ * The script string is injected as an inline <script> in the desktop HTML
+ * head so the SDK's mintRpcId() sees a working randomUUID even on plain
+ * http:// origins (#1024).
+ */
+export const UUID_POLYFILL_SCRIPT = [
+    '(function(){',
+    'var g=typeof globalThis!=="undefined"?globalThis:typeof window!=="undefined"?window:self;',
+    'if(typeof g.crypto==="undefined"){g.crypto={};}',
+    'if(typeof g.crypto.randomUUID!=="function"){',
+    'g.crypto.randomUUID=function(){',
+    'var a=new Uint8Array(16);',
+    'if(g.crypto.getRandomValues){g.crypto.getRandomValues(a);}',
+    'else{for(var j=0;j<16;j++){a[j]=Math.random()*256|0;}}',
+    'a[6]=(a[6]&0x0f)|0x40;',
+    'a[8]=(a[8]&0x3f)|0x80;',
+    'var h="",x="0123456789abcdef";',
+    'for(var i=0;i<16;i++){h+=x[a[i]>>4]+x[a[i]&0x0f];',
+    'if(i===3||i===5||i===7||i===9)h+="-";}',
+    'return h;',
+    '};',
+    '}',
+    '})();',
+].join('');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair mobile and PC remote control for the dsh web GUI: QR entry beside the settings button, one-time pairing tokens, a gated /remote/api desktop channel, live device status, and revocable sessions",
-  "version": "0.2.8",
+  "version": "0.3.0",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/index.ts

@@ -24,7 +24,14 @@ import { RemoteSettingsCard, RemoteSettingsCardController, type RemoteSettings }
 import { en, zh, type RemoteKey } from './locales.ts'
 import { PAIR_FAILED_MARKER, runPairBootFlow } from './deep-link.ts'
 import { readPairGatePolicy, sendHeartbeat } from './pair-api.ts'
-import { channelTransition, installRemoteChannel, isLoopbackHostname, remoteChannelRequired } from './remote-channel.ts'
+import {
+  channelTransition,
+  installRemoteChannel,
+  isLoopbackHostname,
+  remoteChannelRequired,
+  REMOTE_CHANNEL_BOOT_GLOBAL,
+  type RemoteChannelBootSeat,
+} from './remote-channel.ts'
 import { FenceNotice } from './FenceNotice.tsx'
 
 export type { RemoteEntryProps } from './RemoteEntry.tsx'
@@ -228,16 +235,41 @@ export function apply(ctx: ClientContext): void {
     settingsScope.getSnapshot(),
     hostPairingPolicy,
   )
+  // The parse-time boot patch (issue #987), when the served index carried
+  // it: already installed before any boot entry ran, so adopting its seat
+  // beats patching a second time (which would double-rewrite onto
+  // /remote/remote/...).
+  const bootSeat = (): RemoteChannelBootSeat | undefined =>
+    (window as unknown as Record<string, RemoteChannelBootSeat | undefined>)[REMOTE_CHANNEL_BOOT_GLOBAL]
   const syncChannel = (): void => {
     const transition = channelTransition(channelActive(), disposeChannel !== undefined)
     if (transition === 'install') {
-      disposeChannel = ctx.effect(() => {
-        const restore = installRemoteChannel(window, { onUnpaired: handleUnpaired, onPaired: hideFenceNotice })
-        return restore
-      }, 'remote-web-ui: remote desktop channel')
+      const seat = bootSeat()
+      if (seat !== undefined) {
+        seat.onUnpaired = handleUnpaired
+        seat.onPaired = hideFenceNotice
+        // Replay a signal raised before adoption (early unpaired responses).
+        if (seat.pendingUnpaired) {
+          seat.pendingUnpaired = false
+          handleUnpaired()
+        }
+        disposeChannel = ctx.effect(() => () => {
+          seat.onUnpaired = null
+          seat.onPaired = null
+        }, 'remote-web-ui: remote desktop channel (boot patch)')
+      } else {
+        disposeChannel = ctx.effect(() => {
+          const restore = installRemoteChannel(window, { onUnpaired: handleUnpaired, onPaired: hideFenceNotice })
+          return restore
+        }, 'remote-web-ui: remote desktop channel')
+      }
     } else if (transition === 'retire' && disposeChannel !== undefined) {
       disposeChannel()
       disposeChannel = undefined
+      // Retire the provisional parse-time install with the channel: the
+      // desktop now rides plain /api, so the rewrite must go (its seat
+      // removes the global; a later re-activation patches afresh).
+      bootSeat()?.restore()
       // Retire the notice with the channel: once requirePairingForLan turns
       // off (or the plugin is disabled) the desktop rides plain /api again,
       // so an unpaired notice raised while the channel was briefly active
@@ -245,6 +277,10 @@ export function apply(ctx: ClientContext): void {
       // installed channel is the only path that raises the notice, so with
       // the channel gone nothing can re-raise it (issue #808).
       hideFenceNotice()
+    } else if (transition === 'none' && !channelActive()) {
+      // The channel was never adopted (policy settled to off before apply
+      // ran): the provisional boot patch still retires.
+      bootSeat()?.restore()
     }
   }
   settingsScope.subscribe(syncChannel)

package/src/client/remote-channel.ts

@@ -24,27 +24,17 @@
  * the given window and returns their restore.
  */
 
-/** The gated mirror prefix (must match src/remote-methods.ts). */
-export const REMOTE_PREFIX = '/remote'
+import {
+  REMOTE_API_PREFIX,
+  REMOTE_CHANNEL_RULES,
+  REMOTE_PREFIX,
+} from '../remote-channel-rules.ts'
 
-/** Connection-plugin method prefix under the gated channel. */
-export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`
+export { REMOTE_API_PREFIX, REMOTE_PREFIX }
+export type { RemoteChannelBootSeat } from '../remote-channel-rules.ts'
+export { REMOTE_CHANNEL_BOOT_GLOBAL } from '../remote-channel-rules.ts'
 
-const API_PREFIX = '/api/'
-const PAIR_PREFIX = '/api/pair/'
-const UPDATE_PREFIX = '/api/update/'
-const DESKTOP_LAUNCHER_PREFIX = '/api/dsh-desktop-launcher'
-const SETTINGS_BRIDGE_PREFIX = '/api/dsh-web-ui-settings'
-const SIDEBAR_PREFIX = '/sidebar/'
-const GIT_PREFIX = '/git/'
-const PET_PREFIX = '/pet/'
-const WS_PATHS = new Set([
-  '/api/events.mux',
-  '/api/events.host',
-  '/sidebar/ws/terminal',
-  '/sidebar/ws/agent-terminals',
-  '/api/dsh-ssh/terminal',
-])
+const RULES = REMOTE_CHANNEL_RULES
 
 /** Minimal settings snapshot used by the remote channel decision. */
 export interface RemoteChannelSettingsSnapshot {
@@ -85,14 +75,14 @@ export function isLoopbackHostname(hostname: string): boolean {
  * @param pathname - the request URL pathname.
  */
 export function shouldRewriteFetchPath(pathname: string): boolean {
-  if (pathname.startsWith(PAIR_PREFIX)) return false
-  if (pathname.startsWith(UPDATE_PREFIX)) return false
-  if (pathname === DESKTOP_LAUNCHER_PREFIX || pathname.startsWith(`${DESKTOP_LAUNCHER_PREFIX}/`)) return false
-  if (pathname === SETTINGS_BRIDGE_PREFIX || pathname.startsWith(`${SETTINGS_BRIDGE_PREFIX}/`)) return false
-  if (pathname.startsWith(API_PREFIX)) return true
-  if (pathname.startsWith(SIDEBAR_PREFIX) || pathname === '/sidebar') return true
-  if (pathname.startsWith(GIT_PREFIX) || pathname === '/git') return true
-  if (pathname.startsWith(PET_PREFIX) || pathname === '/pet') return true
+  if (pathname.startsWith(RULES.pairPrefix)) return false
+  if (pathname.startsWith(RULES.updatePrefix)) return false
+  if (pathname === RULES.desktopLauncherPrefix || pathname.startsWith(`${RULES.desktopLauncherPrefix}/`)) return false
+  if (pathname === RULES.settingsBridgePrefix || pathname.startsWith(`${RULES.settingsBridgePrefix}/`)) return false
+  if (pathname.startsWith(RULES.apiPrefix)) return true
+  if (pathname.startsWith(RULES.sidebarPrefix) || pathname === '/sidebar') return true
+  if (pathname.startsWith(RULES.gitPrefix) || pathname === '/git') return true
+  if (pathname.startsWith(RULES.petPrefix) || pathname === '/pet') return true
   return false
 }
 
@@ -101,7 +91,7 @@ export function shouldRewriteFetchPath(pathname: string): boolean {
  * @param pathname - the WebSocket URL pathname.
  */
 export function shouldRewriteWsPath(pathname: string): boolean {
-  return WS_PATHS.has(pathname)
+  return RULES.wsPaths.includes(pathname)
 }
 
 /** The gated twin of one fenced path (`/remote` + original pathname). */

package/src/http.ts

@@ -1,21 +1,35 @@
+// Generated by scripts/sync-shared.mjs from shared/host/http.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
 /**
- * Shared HTTP helpers for the route families: one JSON writer and one
- * bounded JSON body reader. Previously copy-pasted across routes.ts,
- * update-routes.ts, and mobile-api.ts with drifting failure contracts.
+ * Shared JSON body/response helpers for the host route families: one strict
+ * bounded body reader, one lenient bounded body reader, one JSON object
+ * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
+ * family's route module) with drifting contracts: body caps ranging 4 KiB to
+ * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
+ *
+ * Packages receive this file as a generated copy via scripts/sync-shared.mjs;
+ * edit this shared source and re-run the sync instead of editing a copy.
+ * Consumer code is migrated onto it in follow-up waves; no call site changes
+ * belong in the same change as its introduction.
+ * @module dsh-web-ui-shared/host/http
  */
 
-import type { IncomingMessage, ServerResponse } from 'node:http'
+import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'node:http'
 
-/** One JSON response. */
-export function writeJson(res: ServerResponse, status: number, body: unknown): void {
-  const payload = JSON.stringify(body)
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'referrer-policy': 'no-referrer' })
-  res.end(payload)
-}
+/** Default body cap for readJsonBody: 64 KiB. */
+const DEFAULT_JSON_BODY_MAX_BYTES = 64 * 1024
+
+/** Family-default JSON response headers; callers may append or override. */
+const JSON_HEADERS = {
+  'content-type': 'application/json; charset=utf-8',
+  'referrer-policy': 'no-referrer',
+} satisfies OutgoingHttpHeaders
 
 /**
- * Read a request body up to maxBytes and parse it as JSON.
- * @throws 'body too large' beyond the cap, or the JSON.parse error.
+ * Strict bounded body reader: parse a request body of at most maxBytes as
+ * JSON.
+ * @throws 'body too large' past the cap, or the JSON.parse error for an
+ *   invalid or empty payload.
  */
 export async function readBoundedJson(req: IncomingMessage, maxBytes: number): Promise<unknown> {
   const chunks: Buffer[] = []
@@ -28,3 +42,64 @@ export async function readBoundedJson(req: IncomingMessage, maxBytes: number): P
   }
   return JSON.parse(Buffer.concat(chunks).toString('utf8'))
 }
+
+/**
+ * Lenient bounded body reader: parse a request body as JSON, or null on an
+ * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
+ * Overflow destroys the request instead of draining the remainder (no drain
+ * call, matching the current repo-wide behavior); callers must not keep
+ * reading the request afterwards. With objectOnly, non-JSON-object payloads
+ * also yield null.
+ */
+export async function readJsonBody(
+  req: IncomingMessage,
+  opts: { maxBytes?: number; objectOnly?: boolean } = {},
+): Promise<unknown | null> {
+  const maxBytes = opts.maxBytes ?? DEFAULT_JSON_BODY_MAX_BYTES
+  const chunks: Buffer[] = []
+  let size = 0
+  for await (const chunk of req) {
+    const buffer = chunk as Buffer
+    size += buffer.length
+    if (size > maxBytes) {
+      req.destroy()
+      return null
+    }
+    chunks.push(buffer)
+  }
+  const text = Buffer.concat(chunks).toString('utf8')
+  if (text === '') return null
+  try {
+    const parsed: unknown = JSON.parse(text)
+    if (opts.objectOnly && !isJsonObject(parsed)) return null
+    return parsed
+  } catch {
+    return null
+  }
+}
+
+/** Whether a value is a JSON object: typeof object, not null, not an array. */
+function isJsonObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+/** Narrow a value to a JSON object, or undefined when it is not one. */
+export function asJsonObject(value: unknown): Record<string, unknown> | undefined {
+  return isJsonObject(value) ? value : undefined
+}
+
+/**
+ * Write one JSON response. Default headers are the family defaults
+ * (content-type and referrer-policy); caller headers are appended or
+ * override them.
+ */
+export function writeJson(
+  res: ServerResponse,
+  status: number,
+  body: unknown,
+  headers: OutgoingHttpHeaders = {},
+): void {
+  const payload = JSON.stringify(body)
+  res.writeHead(status, { ...JSON_HEADERS, ...headers })
+  res.end(payload)
+}

package/src/index.ts

@@ -23,8 +23,10 @@ import { RemoteWebUiPairing } from './pairing-access.ts'
 import { isTrustedApiRequest, makeRoutes } from './routes.ts'
 import { makeMobileRoutes } from './mobile-routes.ts'
 import { makeMobileApiRoutes } from './mobile-api.ts'
+import { PendingTracker } from './mobile-pending.ts'
+import { makePairedModelCatalogRoutes } from './paired-model-catalog.ts'
 import { makeRemoteApiRoutes, makeRemoteApiUpgradeRoutes } from './remote-api.ts'
-import { anyExposed, claimPostureKey, postureTargets, probePosture, releasePostureKey } from './posture.ts'
+import { claimPostureKey, postureTargets, probePosture, releasePostureKey } from './posture.ts'
 import { lanIPv4Addresses } from './lan.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
 import {
@@ -37,6 +39,8 @@ import {
 } from './update.ts'
 import { makeUpdateRoutes } from './update-routes.ts'
 import { mountOnce } from './mount-once.ts'
+import { REMOTE_CHANNEL_BOOT_SCRIPT } from './remote-channel-boot.ts'
+import { UUID_POLYFILL_SCRIPT } from './uuid-polyfill.ts'
 
 declare module '@deepseek-ai/cordis' {
   interface Events {
@@ -356,14 +360,26 @@ function applyImpl(ctx: Context, config?: Config): void {
     ...makeRoutes({ service, lanAddresses, requirePairingForLan: () => resolve().requirePairingForLan }),
     ...makeMobileRoutes(),
     ...(apiProxy !== undefined
-      ? makeMobileApiRoutes({ service, apiProxy, mobileEnterToSend: () => resolve().mobileEnterToSend })
+      ? makeMobileApiRoutes({ service, apiProxy, pendingTracker: new PendingTracker(), mobileEnterToSend: () => resolve().mobileEnterToSend })
       : []),
-    // The remote desktop channel: paired-cookie-gated `/remote` prefix that
-    // re-issues fenced paths to loopback (see remote-api.ts).
-    ...makeRemoteApiRoutes({ service, port: ctx.webServer.port }),
+    ...(apiProxy !== undefined ? makePairedModelCatalogRoutes({ service, apiProxy, lanAddresses }) : []),
+    // The remote desktop channel: policy-gated `/remote` prefix that
+    // re-issues fenced paths to loopback (see remote-api.ts). The live
+    // requirePairingForLan is re-read per request, same as the gate listener
+    // and routes above, so a stale client rewrite on an open-LAN deployment
+    // proxies instead of 403ing.
+    ...makeRemoteApiRoutes({
+      service,
+      port: ctx.webServer.port,
+      requirePairingForLan: () => resolve().requirePairingForLan,
+    }),
     ...updateRoutes,
   ]
-  const upgrades = makeRemoteApiUpgradeRoutes({ service, port: ctx.webServer.port })
+  const upgrades = makeRemoteApiUpgradeRoutes({
+    service,
+    port: ctx.webServer.port,
+    requirePairingForLan: () => resolve().requirePairingForLan,
+  })
   const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled)
   ctx.effect(() => ctx.on('api/gate', gate), 'remote-web-ui: api gate')
 
@@ -471,6 +487,26 @@ function applyImpl(ctx: Context, config?: Config): void {
     // re-probe unless the target set is unchanged.
     runPostureProbe()
   }
+  // Inject the crypto.randomUUID polyfill before any other script runs, so that
+  // the main bundle doesn't crash on non-secure contexts (LAN HTTP)
+  ctx.effect(() => ctx.on('webserver/index-inject', (table) => {
+    table.push({ kind: 'script', placement: 'head', text: UUID_POLYFILL_SCRIPT })
+  }), 'remote-web-ui: uuid polyfill')
+
+  // Issue #987: the browser-half channel patch installs at this plugin's
+  // boot entry, but dsh-client-connection boots earlier and opens its event
+  // streams unrewritten — on a non-loopback origin the SDK fence rejects
+  // them and the workspace list never loads. Contribute the rewrite as a
+  // parse-time head script so it is active before ANY boot entry runs; the
+  // client apply adopts the installed seat instead of patching twice. The
+  // row follows the live steady-state decision (enabled + pairing gate); the
+  // script itself skips loopback origins.
+  ctx.effect(() => ctx.on('webserver/index-inject', (table) => {
+    const value = resolve()
+    if (!value.enabled || !value.requirePairingForLan) return
+    table.push({ kind: 'script', placement: 'head', text: REMOTE_CHANNEL_BOOT_SCRIPT })
+  }), 'remote-web-ui: remote channel boot patch')
+
   installSettingsSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
     setSource: (source) => {
       current = source