@linxin666/dsh-remote-web-ui 0.3.13 → 0.3.15

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: 7d90f10c871368091158e8db7f249785057c1f1c
-README.zh.md: 77e8e5ea595a9fcd8ddb10b41629cc8d20a522a5
+README.md: 8e93c9e36c4c1cb042df29d494419347181142b0
+README.zh.md: fb6955a0be096fe3d04cff2600484409c8b62df9

package/README.md

@@ -24,10 +24,10 @@ The official desktop layout already auto-collapses the sidebar below 1024px. On
 - a **draggable whale button** as the entry to the collapsed sidebar (position persisted; wired to the official `ctx.layout.toggleSidebar()`), hidden while the sidebar is expanded;
 - **gestures**: left-swipe collapses the sidebar, right-swipe in the conversation opens it; long-pressing a session row opens the same action menu as the desktop ellipsis; tapping a session row or anywhere outside the sidebar collapses it again;
 - **input behavior for touch**: Enter only inserts a newline (send goes through the send button), programmatic composer focus is suppressed (no spurious keyboards), and official tooltip bubbles are hidden because taps leave them stuck;
-- **mobile plugin scope**: while the layer is active, the right-hand details column and the desktop-oriented tool surfaces (SSH terminal, skill explorer, task board, git graph, pet, perf, usage) are hidden - keyed on the L2 semantic roots (`data-dsh-plugin`), so ownership stays with the declaring plugin and class churn cannot resurrect them. These are render suppressions; the client bundles still load. Activation also closes the details panel through the official `ctx.layout.closeDetails()`.
+- **mobile plugin scope**: while the layer is active, the right-hand details column and the desktop-oriented tool surfaces (SSH terminal, skill explorer, task board, git graph, pet, usage) are hidden - keyed on the L2 semantic roots (`data-dsh-plugin`), so ownership stays with the declaring plugin and class churn cannot resurrect them. These are render suppressions; the client bundles still load. Activation also closes the details panel through the official `ctx.layout.closeDetails()`.
 - a **manual opt-out**: `sessionStorage.dsh-remote-force-desktop = 1` disables the whole layer; landscape, desktop, and wide viewports are never touched.
 
-The paired remote desktop also runs in **host mode**: on this harness line the "configuration plane is local" behavior is a client-side branch on `connection.isLoopback`, and the channel boot script installs the transport hook (`__DSH_TRANSPORT__.ownsHost = true`) on non-loopback origins before any boot entry. Settings, credentials, agent presets, and deliverables therefore work on the phone exactly as on the desktop — every call still rides the gated `/remote` channel. Four control planes stay physically local: `/api/pair/*`, `/api/update/*`, `/api/plugin-manager/*`, and `/api/dsh-desktop-launcher/*`.
+The paired remote desktop also runs in **host mode**: on this harness line the "configuration plane is local" behavior is a client-side branch on `connection.isLoopback`, and the channel boot script installs the transport hook (`__DSH_TRANSPORT__.ownsHost = true`) on non-loopback origins before any boot entry. Settings, credentials, agent presets, and deliverables therefore work on the phone exactly as on the desktop — every call still rides the gated `/remote` channel. Three control planes stay physically local: `/api/pair/*`, `/api/update/*`, and `/api/plugin-manager/*`.
 
 ## Requirements
 
@@ -156,7 +156,7 @@ The public path is the same round trip through a tunnel (see "Remote access over
 - **Pairing is the access control for the `/remote` channel**: while `requirePairingForLan` is on (default), every request must carry a live paired-device cookie, enforced before any bytes are forwarded. A missing or revoked session receives HTTP 403 with a JSON rejection carrying `error.code: "unpaired"`; the browser's `EventSource` API exposes only the stream failure, not that response body.
 - **The channel carries the process's own inner credential.** The harness browser-auth cookie is authority-bound (minted for the exact `host:port` a browser visited) and has no loopback exemption, so a proxied re-issue to `127.0.0.1` cannot reuse a device's cookie. The plugin therefore redeems its own launch token once — the same exchange a first browser visit performs — and attaches that cookie to re-issued requests. The credential is only ever exercised behind the pairing gate above; 停止/取消配对 immediately stop exercising it.
 - **Cohort reality: pairing does not gate direct `/api`.** On the pinned 0.1.2-alpha.2 line nothing emits the `api/gate` seam, so a direct `/api` call from a LAN origin is governed solely by the harness fence (which auto-trusts LAN literals under a `0.0.0.0` bind) plus the harness browser-auth cookie. A browser credential a device has already redeemed therefore survives 停止/取消配对 until its natural expiry (30 days) — revocation binds the `/remote` channel and the pairing cookie, not that credential. The plugin probes the `/api` posture and warns loudly; treat a LAN-exposed bind as a deliberate decision, and prefer loopback plus tunnels when the machine is shared.
-- **A paired device is a full-control credential.** With host mode active it reaches the complete host API — chat, sessions, settings, credentials, agent presets, deliverables — mirroring the SDK's own stance that a loopback desktop is trusted. Only the four control planes (pairing, self-update, plugin install/remove, desktop launcher) stay physically local. Only pair devices you control; 停止 or per-device 取消配对 revokes immediately.
+- **A paired device is a full-control credential.** With host mode active it reaches the complete host API — chat, sessions, settings, credentials, agent presets, deliverables — mirroring the SDK's own stance that a loopback desktop is trusted. Only the three control planes (pairing, self-update, plugin install/remove) stay physically local. Only pair devices you control; 停止 or per-device 取消配对 revokes immediately.
 - **Control endpoints stay loopback-only**: mint/stop/revoke, the device roster, the lan-bind status, and the update endpoints answer only to loopback. A LAN-origin browser sees the "配对面板仅限本机使用" banner.
 - **The app landing is cookieless-optional.** After pairing, the QR lands the device on `/pair-app`, served by this plugin: the official shell is delivered without passing the harness index gate, and the device credential rides a `x-dsh-remote-device` header (fetch) / `device` query (WebSocket upgrades) that the boot patch attaches from sessionStorage. The flow therefore works when the device browser blocks all cookies; the pairing cookie remains the primary credential where the browser stores it, and the harness browser-auth cookie is no longer required on the phone path at all.
 - **Reopens are owned by a service worker (https origins).** A paired phone returning from history, a bookmark, or tab restore navigates to bare `/` — a path the plugin does not own, where the harness fallback seat answers with its browser-auth 401 (the cookieless flow never holds that credential). The app shell therefore registers `/pair-app.sw.js` (fenced like `/pair-app`; the script is inert logic with no secrets): it intercepts navigations to `/` only, re-serves the shell network-first through `/pair-app` — which re-validates the device cookie and refreshes its presence, so every reopen also keeps the session alive — falls back to the cached shell offline, and passes the navigation through when the plugin no longer answers (a revoked device then sees the harness response or the bilingual re-scan page). Plain-HTTP LAN origins are not secure contexts and never register the worker; there a reopen means scanning a fresh QR.

package/README.zh.md

@@ -24,10 +24,10 @@
 - **可拖拽小鲸鱼按钮**作为折叠侧栏的展开入口（位置记忆；接到官方 `ctx.layout.toggleSidebar()`），侧栏展开时隐藏；
 - **手势**：左滑收起侧栏、会话区右滑展开；长按会话行打开与桌面省略号相同的操作菜单；点会话行或侧栏外任意位置再次收起；
 - **触控输入行为**：Enter 只换行（发送走发送按钮）、抑制程序化 composer 聚焦（不乱弹键盘）、隐藏官方 tooltip 气泡（触屏上会残留）；
-- **移动端插件范围**：适配层激活时，右侧详情列与面向桌面的工具界面（SSH 终端、技能中心、任务看板、git graph、宠物、性能引擎、使用统计）一律隐藏——以 L2 语义根（`data-dsh-plugin`）为键，归属由声明方插件负责，官方类名变动也不会复活它们。这些是渲染抑制；客户端 bundle 仍会加载。激活时还会经官方 `ctx.layout.closeDetails()` 真正关闭详情面板。
+- **移动端插件范围**：适配层激活时，右侧详情列与面向桌面的工具界面（SSH 终端、技能中心、任务看板、git graph、宠物、使用统计）一律隐藏——以 L2 语义根（`data-dsh-plugin`）为键，归属由声明方插件负责，官方类名变动也不会复活它们。这些是渲染抑制；客户端 bundle 仍会加载。激活时还会经官方 `ctx.layout.closeDetails()` 真正关闭详情面板。
 - **手动退出**：`sessionStorage.dsh-remote-force-desktop = 1` 关闭整个适配层；横屏、桌面与宽视口永不触碰。
 
-配对远程桌面同时运行在 **host 模式**：在本 harness 线上，「配置面仅限本机」的行为是客户端分支（`connection.isLoopback`），通道 boot 脚本在一切 boot entry 之前对非回环源安装传输钩子（`__DSH_TRANSPORT__.ownsHost = true`）。设置、凭据、Agent 预设与产出物在手机上与桌面完全一致——所有调用仍走门控 `/remote` 通道。四个控制面保持物理本地：`/api/pair/*`、`/api/update/*`、`/api/plugin-manager/*` 与 `/api/dsh-desktop-launcher/*`。
+配对远程桌面同时运行在 **host 模式**：在本 harness 线上，「配置面仅限本机」的行为是客户端分支（`connection.isLoopback`），通道 boot 脚本在一切 boot entry 之前对非回环源安装传输钩子（`__DSH_TRANSPORT__.ownsHost = true`）。设置、凭据、Agent 预设与产出物在手机上与桌面完全一致——所有调用仍走门控 `/remote` 通道。三个控制面保持物理本地：`/api/pair/*`、`/api/update/*` 与 `/api/plugin-manager/*`。
 
 ## 环境要求
 
@@ -156,7 +156,7 @@ pnpm run build
 - **配对是 `/remote` 通道的访问控制**：`requirePairingForLan` 开启（默认）时，每个请求必须携带有效配对设备 cookie，在任何字节转发之前强制。缺失或被撤销的会话收到 HTTP 403，JSON 拒绝携带 `error.code: "unpaired"`；浏览器 `EventSource` API 只暴露流失败，不暴露响应体。
 - **通道携带进程自己的内部凭据。** harness 浏览器认证 cookie 与 authority 绑定（为浏览器访问过的确切 `host:port` 签发）且没有回环豁免，因此转发到 `127.0.0.1` 的再发起请求无法复用设备的 cookie。插件因此自行兑换一次自己的启动令牌——与浏览器首次访问执行的是同一次交换——并把所得 cookie 附到再发起请求上。该凭据只在上面的配对门之后被使用；停止/取消配对会立即停止对它的使用。
 - **本 cohort 的现实：配对不门控直连 `/api`。** 在锚定的 0.1.2-alpha.2 线上，没有任何组件发出 `api/gate` seam，因此来自局域网源头的直连 `/api` 仅由 harness 围栏（`0.0.0.0` 绑定下自动信任局域网字面量）加 harness 浏览器认证 cookie 约束。设备已经兑换过的浏览器凭据在停止/取消配对后仍然有效，直到其自然过期（30 天）——撤销约束的是 `/remote` 通道与配对 cookie，而不是那个凭据。插件会对 `/api` 姿态做探测并大声告警；请把局域网绑定当作深思熟虑的决定，在共享机器上优先回环加隧道。
-- **配对设备是完全控制凭据。** host 模式下它可达完整 host API——聊天、会话、设置、凭据、Agent 预设、产出物——与 SDK 对回环桌面的信任一致。只有四个控制面（配对、自更新、插件安装/卸载、桌面启动器）保持物理本地。只配对你控制的设备；停止或逐设备取消配对立即撤销。
+- **配对设备是完全控制凭据。** host 模式下它可达完整 host API——聊天、会话、设置、凭据、Agent 预设、产出物——与 SDK 对回环桌面的信任一致。只有三个控制面（配对、自更新、插件安装/卸载）保持物理本地。只配对你控制的设备；停止或逐设备取消配对立即撤销。
 - **控制端点仅限回环**：铸造/停止/撤销、设备列表、lan-bind 状态与更新端点只应答回环。局域网源浏览器看到「配对面板仅限本机使用」横幅。
 - **应用落地页不依赖 cookie。** 配对后二维码把设备带到 `/pair-app`——由本插件直接交付官方应用壳，不经过 harness 索引认证门；设备凭据经 `x-dsh-remote-device` 请求头（fetch）与 `device` 查询参数（WebSocket 升级）由引导补丁从 sessionStorage 挂载。因此手机浏览器完全禁用 cookie 时链路依然成立；有 cookie 时配对 cookie 仍是主凭据，手机路径不再需要 harness 浏览器认证 cookie。
 - **重开由 service worker 接管（仅 https 源）。** 配对过的手机从历史、书签或标签恢复回来时导航到裸 `/`——插件不拥有的路径，harness 兜底座会用浏览器认证 401 应答（不依赖 cookie 的流程永远拿不到那份凭据）。应用壳因此注册 `/pair-app.sw.js`（与 `/pair-app` 同一栅栏；脚本是不含任何秘密的惰性逻辑）：只拦截对 `/` 的导航，经 `/pair-app` 网络优先地重发应用壳——同时校验设备 cookie 并刷新其活跃时间，每次重开也在为会话续期——离线时回退缓存的壳，插件不再应答时把导航原样放行（被撤销的设备随后看到 harness 应答或双语重扫页）。纯 HTTP 的局域网源不是安全上下文，永远不会注册该 worker；那里的重开意味着重新扫码。

package/lib/client.js

@@ -1514,7 +1514,7 @@ window.__ModuleLoader__.load({
 		* @param props - copy, state, and actions.
 		* @returns the panel element tree.
 		*/
-		function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }) {
+		function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke }) {
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: remote_module_css_default.panel,
 				role: "dialog",
@@ -1623,9 +1623,9 @@ window.__ModuleLoader__.load({
 						className: remote_module_css_default.hint,
 						children: state.public ? t("pair.publicHint") : t("pair.hint")
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: remote_module_css_default.pairLinks,
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: remote_module_css_default.pairLinkRow,
 							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: remote_module_css_default.pairLinkText,
@@ -1643,11 +1643,33 @@ window.__ModuleLoader__.load({
 								onClick: () => onCopy(state.url),
 								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 }), copied ? t("action.copied") : t("action.copyLink")]
 							})]
-						})
+						}), state.token !== void 0 && state.token !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: remote_module_css_default.pairLinkRow,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: remote_module_css_default.pairLinkText,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: remote_module_css_default.pairLinkLabel,
+									children: t("pair.tokenLabel")
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", {
+									className: remote_module_css_default.link,
+									title: state.token,
+									children: state.token
+								})]
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+								type: "button",
+								className: remote_module_css_default.copyLink,
+								onClick: () => onCopyToken ? onCopyToken(state.token) : onCopy(state.token),
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.IconCopyOutline16, { size: 14 }), copiedToken ? t("action.copiedToken") : t("action.copyToken")]
+							})]
+						})]
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
 						className: remote_module_css_default.oneTimeHint,
-						children: t("pair.oneTimeHint")
+						children: [
+							t("pair.oneTimeHint"),
+							" ",
+							t("pair.dockerHint")
+						]
 					}),
 					state.phase === "stopped" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						className: remote_module_css_default.stoppedHint,
@@ -2306,6 +2328,7 @@ window.__ModuleLoader__.load({
 				stateRef.current = state;
 			}, [state]);
 			const [copied, setCopied] = (0, react.useState)(false);
+			const [copiedToken, setCopiedToken] = (0, react.useState)(false);
 			const eventSource = (0, react.useRef)(void 0);
 			const openSeq = (0, react.useRef)(0);
 			const closeEventSource = (0, react.useCallback)(() => {
@@ -2328,6 +2351,7 @@ window.__ModuleLoader__.load({
 				return {
 					kind: "ready",
 					url: result.url,
+					token: result.token,
 					expiresAt: result.expiresAt,
 					expired: Date.now() > result.expiresAt,
 					phase: "waiting",
@@ -2424,6 +2448,15 @@ window.__ModuleLoader__.load({
 					}, 1500);
 				});
 			}, []);
+			const handleCopyToken = (0, react.useCallback)((token) => {
+				copyText(token).then((ok) => {
+					if (!ok) return;
+					setCopiedToken(true);
+					window.setTimeout(() => {
+						setCopiedToken(false);
+					}, 1500);
+				});
+			}, []);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: remote_module_css_default.entryRow,
 				"data-rail": wide ? void 0 : "rail",
@@ -2447,10 +2480,12 @@ window.__ModuleLoader__.load({
 					t,
 					state,
 					copied,
+					copiedToken,
 					onClose: closePanel,
 					onStop: handleStop,
 					onRefresh: handleRefresh,
 					onCopy: handleCopy,
+					onCopyToken: handleCopyToken,
 					onPickAddress: handlePickAddress,
 					onPickPublic: handlePickPublic,
 					onRevoke: handleRevoke
@@ -3647,6 +3682,8 @@ window.__ModuleLoader__.load({
 			"pair.expires": "二维码有效至 {time}",
 			"pair.expired": "二维码已过期，请刷新",
 			"pair.linkLabel": "配对链接",
+			"pair.tokenLabel": "配对令牌",
+			"pair.dockerHint": "Docker 或反向代理环境下，可直接复制此令牌并在目标设备配对页面输入。",
 			"pair.oneTimeHint": "链接含一次性令牌；任一设备配对成功后立即失效，配对下一台设备请刷新二维码。",
 			"pair.failed.title": "配对失败",
 			"pair.failed.detail": "链接无效或已使用，请回到电脑端刷新二维码后重新扫码。",
@@ -3670,7 +3707,9 @@ window.__ModuleLoader__.load({
 			"action.refresh": "刷新二维码",
 			"action.copy": "复制链接",
 			"action.copyLink": "复制链接",
+			"action.copyToken": "复制令牌",
 			"action.copied": "已复制",
+			"action.copiedToken": "已复制令牌",
 			"devices.title": "已授权设备",
 			"devices.empty": "还没有已配对的设备。扫码或打开链接后会出现在这里。",
 			"devices.unknown": "未知设备",
@@ -3808,6 +3847,8 @@ window.__ModuleLoader__.load({
 			"pair.expires": "QR code valid until {time}",
 			"pair.expired": "QR code expired — refresh it",
 			"pair.linkLabel": "Pairing link",
+			"pair.tokenLabel": "Pairing token",
+			"pair.dockerHint": "In Docker or reverse proxy environments, copy this token to pair directly on the target device.",
 			"pair.oneTimeHint": "The link carries one single-use token; it dies as soon as any device pairs. Refresh the QR to pair the next device.",
 			"pair.failed.title": "Pairing failed",
 			"pair.failed.detail": "The link is invalid or was already used. Refresh the QR code on your computer and scan again.",
@@ -3831,7 +3872,9 @@ window.__ModuleLoader__.load({
 			"action.refresh": "Refresh QR",
 			"action.copy": "Copy link",
 			"action.copyLink": "Copy link",
+			"action.copyToken": "Copy token",
 			"action.copied": "Copied",
+			"action.copiedToken": "Token copied",
 			"devices.title": "Authorized devices",
 			"devices.empty": "No paired devices yet. Scan the QR or open the link to add one.",
 			"devices.unknown": "Unknown device",
@@ -4015,7 +4058,6 @@ window.__ModuleLoader__.load({
 			apiPrefix: "/api/",
 			pairPrefix: "/api/pair/",
 			updatePrefix: "/api/update/",
-			desktopLauncherPrefix: "/api/dsh-desktop-launcher",
 			settingsBridgePrefix: "/api/dsh-web-ui-settings",
 			sidebarPrefix: "/sidebar/",
 			gitPrefix: "/git/",
@@ -4047,8 +4089,6 @@ window.__ModuleLoader__.load({
 		* - the pairing routes (`/api/pair/*`) stay where they are — accept must
 		*   work BEFORE a device is paired;
 		* - the update endpoints (`/api/update/*`) stay loopback-only;
-		* - desktop-launcher create/shutdown (`/api/dsh-desktop-launcher/*`) stay
-		*   loopback-only (host-local files and process exit);
 		* - the family settings bridge (`/api/dsh-web-ui-settings/*`) stays
 		*   loopback-only (same plane as SDK settings.*);
 		* - `/api/*` (SDK methods and `/api/<plugin>/...` plugin namespaces),
@@ -4085,7 +4125,6 @@ window.__ModuleLoader__.load({
 		function shouldRewriteFetchPath(pathname) {
 			if (pathname.startsWith(RULES.pairPrefix)) return false;
 			if (pathname.startsWith(RULES.updatePrefix)) return false;
-			if (pathname === RULES.desktopLauncherPrefix || pathname.startsWith(`${RULES.desktopLauncherPrefix}/`)) return false;
 			if (pathname === RULES.settingsBridgePrefix || pathname.startsWith(`${RULES.settingsBridgePrefix}/`)) return false;
 			if (pathname.startsWith(RULES.apiPrefix)) return true;
 			if (pathname.startsWith(RULES.sidebarPrefix) || pathname === "/sidebar") return true;
@@ -4414,7 +4453,7 @@ window.__ModuleLoader__.load({
 		/** The building package's version, when the bundle carries it. */
 		function bakedVersion() {
 			try {
-				return "0.3.13";
+				return "0.3.15";
 			} catch {
 				return;
 			}
@@ -4573,7 +4612,6 @@ window.__ModuleLoader__.load({
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"task-board\"],`,
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"git-graph\"],`,
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"pet\"],`,
-			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"perf\"],`,
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"usage\"]{display:none !important}`,
 			`body.${ACTIVE_CLASS} [class$=\"_overlayLayer\"] [class$=\"_workbench\"]{display:none !important}`,
 			"[class$=\"_overlay\"] [class$=\"_panel\"]{flex-direction:column;max-height:calc(100dvh - 32px)}",
@@ -5164,15 +5202,11 @@ window.__ModuleLoader__.load({
 				if (active && (this.tagName === "TEXTAREA" || this.tagName === "INPUT") && this.closest("[class$=\"_composerSeat\"]") !== null && Date.now() - lastComposerTap >= 800) return;
 				lanOrigFocus.call(this, options);
 			};
-			let lastComposerTapRegistered = false;
-			if (!lastComposerTapRegistered) {
-				lastComposerTapRegistered = true;
-				document.addEventListener("pointerdown", (e) => {
-					if (!active) return;
-					const t = e.target;
-					if (t instanceof Element && (t.tagName === "TEXTAREA" || t.tagName === "INPUT") && t.closest("[class$=\"_composerSeat\"]") !== null) lastComposerTap = Date.now();
-				}, true);
-			}
+			document.addEventListener("pointerdown", (e) => {
+				if (!active) return;
+				const t = e.target;
+				if (t instanceof Element && (t.tagName === "TEXTAREA" || t.tagName === "INPUT") && t.closest("[class$=\"_composerSeat\"]") !== null) lastComposerTap = Date.now();
+			}, true);
 			w.__dshRemoteAdapt = {
 				evaluate,
 				toggleSidebar: null,