@linxin666/dsh-remote-web-ui 0.3.12 → 0.3.14

package/lib/types/remote-api.js

@@ -25,7 +25,7 @@ import { readCookie } from "./gate.js";
 import { writeJson } from "./http.js";
 import { proxyLoopbackHttp, proxyLoopbackUpgrade } from "./loopback-proxy.js";
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, localOnlyDenial, } from "./remote-methods.js";
-export { DESKTOP_LAUNCHER_PATH, LOCAL_ONLY_PREFIXES, PLUGIN_MANAGER_PATH, REMOTE_API_PATHS, REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, localOnlyDenial, } from "./remote-methods.js";
+export { LOCAL_ONLY_PREFIXES, PLUGIN_MANAGER_PATH, REMOTE_API_PATHS, REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, localOnlyDenial, } from "./remote-methods.js";
 export { REMOTE_API_PREFIX } from "./remote-methods.js";
 const ALLOWED_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);
 /** Reject traversal and empty segments; allow plugin file-path characters. */

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CA+HrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CA8HrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -57,7 +57,6 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
         'function sf(p){' +
         'if(p.indexOf(R.pairPrefix)===0)return false;' +
         'if(p.indexOf(R.updatePrefix)===0)return false;' +
-        'if(p===R.desktopLauncherPrefix||p.indexOf(R.desktopLauncherPrefix+"/")===0)return false;' +
         'if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+"/")===0)return false;' +
         'if(p.indexOf(R.apiPrefix)===0)return true;' +
         'if(p.indexOf(R.sidebarPrefix)===0||p==="/sidebar")return true;' +

package/lib/types/remote-channel-rules.d.ts

@@ -17,7 +17,6 @@ export interface RemoteChannelRules {
     readonly apiPrefix: string;
     readonly pairPrefix: string;
     readonly updatePrefix: string;
-    readonly desktopLauncherPrefix: string;
     readonly settingsBridgePrefix: string;
     readonly sidebarPrefix: string;
     readonly gitPrefix: string;

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAsBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAqBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -17,7 +17,6 @@ export const REMOTE_CHANNEL_RULES = {
     apiPrefix: '/api/',
     pairPrefix: '/api/pair/',
     updatePrefix: '/api/update/',
-    desktopLauncherPrefix: '/api/dsh-desktop-launcher',
     settingsBridgePrefix: '/api/dsh-web-ui-settings',
     sidebarPrefix: '/sidebar/',
     gitPrefix: '/git/',

package/lib/types/remote-methods.d.ts

@@ -34,8 +34,6 @@ export declare const REMOTE_API_PATHS: {
 export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/remote.mux", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/api/dsh-ssh/terminal"];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 export declare const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
-/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
-export declare const DESKTOP_LAUNCHER_PATH = "/api/dsh-desktop-launcher";
 /** Family settings-bridge HTTP prefix — re-exposed to paired devices (plain settings parity). */
 export declare const WEB_UI_SETTINGS_BRIDGE_PATH = "/api/dsh-web-ui-settings";
 /**
@@ -54,8 +52,7 @@ export declare const REMOTE_DEVICE_QUERY = "device";
  * paired remote desktop may use the full host API (chat, sessions,
  * settings, credentials, presets — it is a full-control credential), but it
  * must not reach the machine-control planes: pairing control itself, the
- * dsh-web self-update installer, plugin install/remove, and desktop
- * launcher actions (host shutdown, shortcuts).
+ * dsh-web self-update installer, and plugin install/remove.
  */
 export declare const LOCAL_ONLY_PREFIXES: readonly string[];
 /**

package/lib/types/remote-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0IAKvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,6FAA6F;AAC7F,eAAO,MAAM,qBAAqB,8BAA8B,CAAA;AAEhE,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAKvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}
+{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0IAKvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}

package/lib/types/remote-methods.js

@@ -39,8 +39,6 @@ export const REMOTE_UPGRADE_PATHS = [
 ];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 export const PLUGIN_MANAGER_PATH = '/api/plugin-manager';
-/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
-export const DESKTOP_LAUNCHER_PATH = '/api/dsh-desktop-launcher';
 /** Family settings-bridge HTTP prefix — re-exposed to paired devices (plain settings parity). */
 export const WEB_UI_SETTINGS_BRIDGE_PATH = '/api/dsh-web-ui-settings';
 /**
@@ -59,14 +57,12 @@ export const REMOTE_DEVICE_QUERY = 'device';
  * paired remote desktop may use the full host API (chat, sessions,
  * settings, credentials, presets — it is a full-control credential), but it
  * must not reach the machine-control planes: pairing control itself, the
- * dsh-web self-update installer, plugin install/remove, and desktop
- * launcher actions (host shutdown, shortcuts).
+ * dsh-web self-update installer, and plugin install/remove.
  */
 export const LOCAL_ONLY_PREFIXES = [
     '/api/pair',
     '/api/update',
     PLUGIN_MANAGER_PATH,
-    DESKTOP_LAUNCHER_PATH,
 ];
 /**
  * Whether a paired inner path must stay physically local.

package/lib/types/tunnel-plan.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Pure planner for the settings-sync tunnel branch: given the resolved
+ * settings slice, decide which tunnel mode runs and with what target. Kept
+ * free of cordis types so the precedence matrix is unit-testable without a
+ * host context.
+ */
+/** Whether a configured public base is a parseable http(s) URL with a host. */
+export declare function isHttpUrl(value: string): boolean;
+/** How the settings sync should drive the tunnel for one resolved value. */
+export type TunnelPlan = {
+    mode: 'off';
+} | {
+    mode: 'quick';
+    targetUrl: string;
+    ignored: Array<'tunnelToken' | 'publicBaseUrl'>;
+} | {
+    mode: 'named';
+    token: string;
+    publicUrl: string;
+};
+/**
+ * Decide the tunnel mode and target from one resolved settings value.
+ * Precedence: the quick tunnel wins when `autoTunnel` is on (anything else
+ * configured is reported as ignored); the named tunnel runs only with a
+ * token AND a valid public hostname (the token does not carry the hostname,
+ * so the QR base and the fence trust would have no source without it);
+ * otherwise no tunnel and the manual public base applies.
+ * @param value - the resolved settings slice that drives the tunnel.
+ * @param port - the local webServer port the tunnel forwards to.
+ */
+export declare function tunnelPlanOf(value: {
+    autoTunnel?: boolean;
+    tunnelToken?: string;
+    publicBaseUrl?: string;
+}, port: number): TunnelPlan;
+//# sourceMappingURL=tunnel-plan.d.ts.map

package/lib/types/tunnel-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel-plan.d.ts","sourceRoot":"","sources":["../../src/tunnel-plan.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOhD;AAED,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,aAAa,GAAG,eAAe,CAAC,CAAA;CAAE,GACrF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAEvD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7E,IAAI,EAAE,MAAM,GACX,UAAU,CAcZ"}

package/lib/types/tunnel-plan.js

@@ -0,0 +1,43 @@
+/**
+ * Pure planner for the settings-sync tunnel branch: given the resolved
+ * settings slice, decide which tunnel mode runs and with what target. Kept
+ * free of cordis types so the precedence matrix is unit-testable without a
+ * host context.
+ */
+/** Whether a configured public base is a parseable http(s) URL with a host. */
+export function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'http:' || url.protocol === 'https:') && url.hostname !== '';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Decide the tunnel mode and target from one resolved settings value.
+ * Precedence: the quick tunnel wins when `autoTunnel` is on (anything else
+ * configured is reported as ignored); the named tunnel runs only with a
+ * token AND a valid public hostname (the token does not carry the hostname,
+ * so the QR base and the fence trust would have no source without it);
+ * otherwise no tunnel and the manual public base applies.
+ * @param value - the resolved settings slice that drives the tunnel.
+ * @param port - the local webServer port the tunnel forwards to.
+ */
+export function tunnelPlanOf(value, port) {
+    if (value.autoTunnel === true) {
+        const ignored = [];
+        if (value.tunnelToken !== undefined && value.tunnelToken !== '')
+            ignored.push('tunnelToken');
+        if (value.publicBaseUrl !== undefined && value.publicBaseUrl !== '')
+            ignored.push('publicBaseUrl');
+        return { mode: 'quick', targetUrl: `http://127.0.0.1:${String(port)}`, ignored };
+    }
+    if (value.tunnelToken !== undefined && value.tunnelToken !== '') {
+        if (value.publicBaseUrl !== undefined && isHttpUrl(value.publicBaseUrl)) {
+            return { mode: 'named', token: value.tunnelToken, publicUrl: value.publicBaseUrl };
+        }
+        return { mode: 'off' };
+    }
+    return { mode: 'off' };
+}

package/lib/types/tunnel.d.ts

@@ -1,9 +1,12 @@
 /**
- * Auto-tunnel manager: spawns a Cloudflare quick tunnel (`cloudflared
- * tunnel --url <local>`) through the `cloudflared` npm package — its
- * postinstall downloads the platform binary, so no user-side tooling is
- * involved — surfaces the minted `https://xxx.trycloudflare.com` URL, and
- * restarts the process after unexpected exits with exponential backoff.
+ * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
+ * npm package — its postinstall downloads the platform binary, so no
+ * user-side tooling is involved — surfaces the public URL, and restarts the
+ * process after unexpected exits with exponential backoff. Two modes: the
+ * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
+ * per start) and an account named tunnel (`cloudflared tunnel run --token`,
+ * fixed public hostname — the mode that lets a paired phone keep its
+ * bookmark and pairing cookie across restarts).
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
@@ -13,6 +16,42 @@
  */
 /** The observable tunnel lifecycle the settings/panel surfaces render. */
 export type TunnelPhase = 'stopped' | 'starting' | 'running' | 'failed';
+/**
+ * What the manager should run. `quick` is the accountless trycloudflare
+ * tunnel whose hostname is minted per start (and dies with the process);
+ * `named` is an account tunnel whose public hostname is fixed — the point
+ * of the named mode is that a paired phone keeps its bookmark and its
+ * pairing cookie across restarts.
+ */
+export type TunnelTarget = {
+    kind: 'quick';
+    targetUrl: string;
+    originHostHeader?: string;
+} | {
+    kind: 'named';
+    token: string;
+    publicUrl: string;
+};
+/** The event face the named adapter wraps (a cloudflared package Tunnel). */
+interface NamedTunnelProcess {
+    on(event: 'connected', listener: () => void): unknown;
+    on(event: 'exit', listener: (code: number | null, signal: NodeJS.Signals | null) => void): unknown;
+    on(event: 'error', listener: (value: Error) => void): unknown;
+    off(event: string, listener: (...args: any[]) => void): unknown;
+    stop(): boolean;
+}
+/**
+ * Wrap a named-tunnel process so it fits the quick-tunnel handle shape: the
+ * fixed public URL is reported through the same `url` event once the first
+ * edge connection registers (cloudflared fires `connected` per connection,
+ * so only the first is taken), and exit/error pass through. The manager's
+ * URL timeout, crash-restart backoff, and stop semantics then stay fully
+ * mode-agnostic.
+ * @param inner - the running named-tunnel process.
+ * @param publicUrl - the fixed public hostname ingress maps to this server.
+ * @returns a handle emitting `url` once the tunnel is reachable.
+ */
+export declare function namedTunnelHandle(inner: NamedTunnelProcess, publicUrl: string): TunnelHandle;
 /** One tunnel status frame. */
 export interface TunnelInfo {
     phase: TunnelPhase;
@@ -29,8 +68,8 @@ export interface TunnelHandle {
 }
 /** Injectable seams (defaults are the real cloudflared package + node timers). */
 export interface TunnelManagerOptions {
-    /** Spawn one quick tunnel toward the local target URL. */
-    factory?: (targetUrl: string) => TunnelHandle;
+    /** Spawn one tunnel process for the target (quick or named). */
+    factory?: (target: TunnelTarget) => TunnelHandle;
     /** Make sure the cloudflared binary exists, downloading it when absent. */
     ensureBinary?: () => Promise<void>;
     /** Wait up to this long for the tunnel URL before failing the attempt. */
@@ -45,6 +84,15 @@ export interface TunnelManagerOptions {
         clearTimeout(t: unknown): void;
     };
 }
+/**
+ * Spawn flags for one quick target. `originHostHeader` stamps the Host the
+ * local webserver sees: the plugin's phone-facing fence trusts the configured
+ * public host (the stable relay origin, Host-bound) and the harness
+ * browser-auth binds cookies to the Host authority, while the Workers relay
+ * cannot control the origin-side Host at all (fetch forces it to the URL
+ * authority) — so the connector must restamp it with the stable origin.
+ */
+export declare function quickTunnelFlags(originHostHeader?: string): Record<string, string | boolean>;
 /**
  * Own the lifecycle of one auto-tunnel: start/stop, URL surfacing, and
  * crash-restart backoff.
@@ -59,7 +107,7 @@ export declare class TunnelManager {
     private phase;
     private url;
     private error;
-    private targetUrl;
+    private target;
     private handle;
     private urlTimer;
     private restartTimer;
@@ -75,12 +123,16 @@ export declare class TunnelManager {
     /** The current status frame. */
     get info(): TunnelInfo;
     /**
-     * Start (or keep) a quick tunnel toward `targetUrl`. Restarting with a
-     * different target tears the old tunnel down first; restarting with the
-     * same target while running is a no-op.
-     * @param targetUrl - the local URL to expose, e.g. `http://127.0.0.1:3080`.
+     * Start (or keep) a tunnel toward `target`. Restarting with a different
+     * target tears the old tunnel down first; restarting with the same target
+     * while running is a no-op. A string is the quick mode's local target URL.
+     *
+     * In quick mode the URL surfaces when cloudflared mints the ephemeral
+     * trycloudflare hostname; in named mode the fixed `publicUrl` surfaces
+     * once the first edge connection registers (see {@link namedTunnelHandle}).
+     * @param target - what to run (a string means quick toward that local URL).
      */
-    start(targetUrl: string): void;
+    start(target: TunnelTarget | string): void;
     /** Stop the tunnel for good: no restarts, no state. */
     stop(): void;
     /** Alias of {@link stop} for plugin-effect disposal. */
@@ -97,4 +149,5 @@ export declare class TunnelManager {
     private teardown;
     private setPhase;
 }
+export {};
 //# sourceMappingURL=tunnel.d.ts.map

package/lib/types/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,YAAY,CAAA;IAC7C,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAwBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAU9B,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAWD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAqBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}

package/lib/types/tunnel.js

@@ -1,9 +1,12 @@
 /**
- * Auto-tunnel manager: spawns a Cloudflare quick tunnel (`cloudflared
- * tunnel --url <local>`) through the `cloudflared` npm package — its
- * postinstall downloads the platform binary, so no user-side tooling is
- * involved — surfaces the minted `https://xxx.trycloudflare.com` URL, and
- * restarts the process after unexpected exits with exponential backoff.
+ * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
+ * npm package — its postinstall downloads the platform binary, so no
+ * user-side tooling is involved — surfaces the public URL, and restarts the
+ * process after unexpected exits with exponential backoff. Two modes: the
+ * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
+ * per start) and an account named tunnel (`cloudflared tunnel run --token`,
+ * fixed public hostname — the mode that lets a paired phone keep its
+ * bookmark and pairing cookie across restarts).
  *
  * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
  * owns the lifecycle policy (binary readiness, URL timeout, restart
@@ -12,15 +15,76 @@
  * a real binary or network.
  */
 import { existsSync } from 'node:fs';
+import { EventEmitter } from 'node:events';
 import { bin, install, Tunnel } from 'cloudflared';
+/** Compare two targets for the start idempotence check. */
+function sameTarget(left, right) {
+    if (left === undefined)
+        return false;
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * Wrap a named-tunnel process so it fits the quick-tunnel handle shape: the
+ * fixed public URL is reported through the same `url` event once the first
+ * edge connection registers (cloudflared fires `connected` per connection,
+ * so only the first is taken), and exit/error pass through. The manager's
+ * URL timeout, crash-restart backoff, and stop semantics then stay fully
+ * mode-agnostic.
+ * @param inner - the running named-tunnel process.
+ * @param publicUrl - the fixed public hostname ingress maps to this server.
+ * @returns a handle emitting `url` once the tunnel is reachable.
+ */
+export function namedTunnelHandle(inner, publicUrl) {
+    const handle = new EventEmitter();
+    let registered = false;
+    const onConnected = () => {
+        // cloudflared fires `connected` per edge connection (four on a healthy
+        // registration); the fixed URL only needs reporting once.
+        if (registered)
+            return;
+        registered = true;
+        handle.emit('url', publicUrl);
+    };
+    const onExit = (code, signal) => {
+        handle.emit('exit', code, signal);
+    };
+    const onError = (value) => {
+        handle.emit('error', value);
+    };
+    inner.on('connected', onConnected);
+    inner.on('exit', onExit);
+    inner.on('error', onError);
+    handle.stop = () => {
+        inner.off('connected', onConnected);
+        inner.off('exit', onExit);
+        inner.off('error', onError);
+        return inner.stop();
+    };
+    return handle;
+}
 /** Default binary readiness: download the platform binary on first use. */
 async function defaultEnsureBinary() {
     if (existsSync(bin))
         return;
     await install(bin);
 }
-/** Default factory: the cloudflared package's quick tunnel (no account). */
-function defaultFactory(targetUrl) {
+/** The flags every tunnel mode shares (see the quick factory comment). */
+const SHARED_TUNNEL_FLAGS = { '--no-autoupdate': true, '--protocol': 'http2' };
+/**
+ * Spawn flags for one quick target. `originHostHeader` stamps the Host the
+ * local webserver sees: the plugin's phone-facing fence trusts the configured
+ * public host (the stable relay origin, Host-bound) and the harness
+ * browser-auth binds cookies to the Host authority, while the Workers relay
+ * cannot control the origin-side Host at all (fetch forces it to the URL
+ * authority) — so the connector must restamp it with the stable origin.
+ */
+export function quickTunnelFlags(originHostHeader) {
+    return originHostHeader === undefined
+        ? { ...SHARED_TUNNEL_FLAGS }
+        : { ...SHARED_TUNNEL_FLAGS, '--http-host-header': originHostHeader };
+}
+/** Default factory: the cloudflared package's quick and named tunnels. */
+function defaultFactory(target) {
     // `--no-autoupdate`: the binary must never upgrade itself out from under
     // the manager (a self-updated binary would break the pinned lifecycle).
     // `--protocol http2`: the default `auto` prefers QUIC (UDP 7844), which
@@ -29,7 +93,10 @@ function defaultFactory(targetUrl) {
     // and the auto fallback never fires on a half-open QUIC handshake. http2
     // rides TCP through the same paths reliably (verified live: auto stuck at
     // ready 0 on two fresh registrations; http2 ready immediately).
-    return Tunnel.quick(targetUrl, { '--no-autoupdate': true, '--protocol': 'http2' });
+    if (target.kind === 'quick') {
+        return Tunnel.quick(target.targetUrl, quickTunnelFlags(target.originHostHeader));
+    }
+    return namedTunnelHandle(Tunnel.withToken(target.token, { ...SHARED_TUNNEL_FLAGS }), target.publicUrl);
 }
 /** Node timers. */
 const nodeTimer = { setTimeout, clearTimeout };
@@ -47,7 +114,7 @@ export class TunnelManager {
     phase = 'stopped';
     url;
     error;
-    targetUrl;
+    target;
     handle;
     urlTimer;
     restartTimer;
@@ -78,17 +145,22 @@ export class TunnelManager {
         };
     }
     /**
-     * Start (or keep) a quick tunnel toward `targetUrl`. Restarting with a
-     * different target tears the old tunnel down first; restarting with the
-     * same target while running is a no-op.
-     * @param targetUrl - the local URL to expose, e.g. `http://127.0.0.1:3080`.
+     * Start (or keep) a tunnel toward `target`. Restarting with a different
+     * target tears the old tunnel down first; restarting with the same target
+     * while running is a no-op. A string is the quick mode's local target URL.
+     *
+     * In quick mode the URL surfaces when cloudflared mints the ephemeral
+     * trycloudflare hostname; in named mode the fixed `publicUrl` surfaces
+     * once the first edge connection registers (see {@link namedTunnelHandle}).
+     * @param target - what to run (a string means quick toward that local URL).
      */
-    start(targetUrl) {
-        if (this.targetUrl === targetUrl && (this.phase === 'starting' || this.phase === 'running'))
+    start(target) {
+        const resolved = typeof target === 'string' ? { kind: 'quick', targetUrl: target } : target;
+        if (sameTarget(this.target, resolved) && (this.phase === 'starting' || this.phase === 'running'))
             return;
         this.teardown();
         this.stopping = false;
-        this.targetUrl = targetUrl;
+        this.target = resolved;
         this.attempts = 0;
         this.generation += 1;
         this.attempt();
@@ -97,7 +169,7 @@ export class TunnelManager {
     stop() {
         this.teardown();
         this.stopping = false;
-        this.targetUrl = undefined;
+        this.target = undefined;
         this.setPhase('stopped');
     }
     /** Alias of {@link stop} for plugin-effect disposal. */
@@ -115,7 +187,7 @@ export class TunnelManager {
         return () => { this.phaseListeners.delete(listener); };
     }
     attempt() {
-        if (this.stopping || this.targetUrl === undefined)
+        if (this.stopping || this.target === undefined)
             return;
         const gen = this.generation;
         this.setPhase('starting');
@@ -123,9 +195,9 @@ export class TunnelManager {
         this.url = undefined;
         this.error = undefined;
         void this.ensureBinary().then(() => {
-            if (this.stopping || this.targetUrl === undefined || gen !== this.generation)
+            if (this.stopping || this.target === undefined || gen !== this.generation)
                 return;
-            const handle = this.factory(this.targetUrl);
+            const handle = this.factory(this.target);
             this.handle = handle;
             this.urlTimer = this.timer.setTimeout(() => {
                 // The tunnel never reported a URL: kill it and retry with backoff.
@@ -150,7 +222,7 @@ export class TunnelManager {
             });
         }).catch((value) => {
             // Binary install failed (no network, no platform build): report it.
-            if (this.stopping || this.targetUrl === undefined || gen !== this.generation)
+            if (this.stopping || this.target === undefined || gen !== this.generation)
                 return;
             const message = value instanceof Error ? value.message : String(value);
             this.fail(`could not obtain the cloudflared binary: ${message}`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"
@@ -36,7 +36,7 @@
   "license": "Apache-2.0",
   "dsh": {
     "engines": {
-      "dsh": ">=0.1.2-alpha.4"
+      "dsh": ">=0.1.2-rc.1"
     },
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -63,22 +63,22 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-connection": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-locale": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-store": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-commands": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.4",
-    "@deepseek-ai/dsh-settings": "^0.1.2-alpha.4",
+    "@deepseek-ai/dsh-agent": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-workspace-controller": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-store": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.2-rc.1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.20.0",

package/src/client/RemoteEntry.tsx

@@ -12,7 +12,7 @@ import { createPortal } from 'react-dom'
 import type { PropsLocale } from '@deepseek-ai/dsh-client-ui-slots'
 import type { PairingPhase } from '../pairing.ts'
 import { RemotePanel, type PanelState } from './RemotePanel.tsx'
-import { copyText, issuePair, revokePair, stopPair, type DeviceFrame, type IssueResponse, type PairStateFrame, type TunnelStatusFrame } from './pair-api.ts'
+import { copyText, issuePair, revokePair, stopPair, type DeviceFrame, type IssueResponse, type PairStateFrame, type RelayStatusFrame, type TunnelStatusFrame } from './pair-api.ts'
 import { PhoneIcon } from './PhoneIcon.tsx'
 import { UpdateEntry } from './UpdateEntry.tsx'
 import css from './remote.module.css'
@@ -43,6 +43,7 @@ function mergeFrame(state: PanelState, frame: PairStateFrame): PanelState {
     onlineCount: frame.onlineCount,
     devices: frame.devices ?? [],
     ...(frame.tunnel !== undefined ? { tunnel: frame.tunnel as TunnelStatusFrame } : {}),
+    ...(frame.relay !== undefined ? { relay: frame.relay } : {}),
     ...(frame.posture !== undefined ? { posture: frame.posture } : {}),
   }
 }

package/src/client/RemotePanel.tsx

@@ -16,6 +16,7 @@ import {
   formatLastSeen,
   type DeviceFrame,
   type PostureFrame,
+  type RelayStatusFrame,
   type TunnelStatusFrame,
 } from './pair-api.ts'
 import { deviceNameFromUserAgent } from './device-name.ts'
@@ -46,6 +47,8 @@ export type PanelState =
       publicBaseUrl?: string
       /** Auto-tunnel status, while the auto-tunnel feature is active. */
       tunnel?: TunnelStatusFrame
+      /** Relay-registry status, while the stable-origin relay is in play. */
+      relay?: RelayStatusFrame
       /** Latest /api posture probe, once a round has completed. */
       posture?: PostureFrame
     }
@@ -164,6 +167,14 @@ export function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCo
                 : t('tunnel.starting')}
             </p>
           )}
+          {state.relay?.state === 'registering' && (
+            <p className={css.tunnelNote} role="status">{t('relay.registering')}</p>
+          )}
+          {state.relay?.state === 'failed' && (
+            <p className={css.tunnelFailed} role="status">
+              {t('relay.failed', { error: state.relay.error ?? t('tunnel.unknownError') })}
+            </p>
+          )}
 
           {(state.publicBaseUrl !== undefined || state.lanAddresses.length > 1) && (
             <fieldset className={css.addresses}>