@linxin666/dsh-remote-web-ui 0.3.13 → 0.3.15

package/lib/index.js

@@ -724,6 +724,66 @@ function isTrustedApiRequest(request, trustedHosts) {
 		return false;
 	}
 }
+/**
+* Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+* Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+* machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+*/
+function isPrivateOrLocalHostname(hostname) {
+	const normalized = hostname.toLowerCase().trim();
+	if (normalized === "localhost" || normalized.endsWith(".local") || normalized.endsWith(".lan") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa")) return true;
+	let ip = normalized;
+	if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+	if (ip === "::1" || ip === "127.0.0.1") return true;
+	if (ip.startsWith("fc") || ip.startsWith("fd") || ip.startsWith("fe80")) return true;
+	const parts = ip.split(".").map(Number);
+	if (parts.length === 4 && parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255)) {
+		const [a, b] = parts;
+		if (a === 10) return true;
+		if (a === 127) return true;
+		if (a === 169 && b === 254) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 192 && b === 168) return true;
+	}
+	return false;
+}
+/**
+* Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+* and ensures Origin matches Host when present).
+*/
+function isNonCrossSite(request) {
+	if (request.headers["sec-fetch-site"] === "cross-site") return false;
+	const host = request.headers.host;
+	if (typeof host !== "string") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		const originUrl = new URL(origin);
+		const hostUrl = new URL(`http://${host}`);
+		return originUrl.host === hostUrl.host;
+	} catch {
+		return false;
+	}
+}
+/**
+* The private-LAN fallback authority of a request: its Host header when the
+* hostname is private/local (RFC 1918 / ULA / mDNS / loopback) and the
+* browser markers are non-cross-site, else undefined. The accept paths and
+* the lanFence fallback use this to serve container-bridged and reverse-proxy
+* topologies whose Host is not among the advertised or configured authorities.
+*/
+function privateLanHostOf(request) {
+	const host = request.headers.host;
+	if (typeof host !== "string") return void 0;
+	let hostName = "";
+	try {
+		hostName = new URL(`http://${host}`).hostname;
+	} catch {
+		return;
+	}
+	if (hostName === "" || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request)) return void 0;
+	return host;
+}
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
 const MAX_BODY_BYTES = 4096;
 /**
@@ -740,6 +800,20 @@ function acceptLimitKey(socketIp, forwarded, bucket) {
 	return `${bucket}|${socketIp}`;
 }
 /**
+* FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+* (a Set iterates in insertion order). The dynamic trusted-host table is fed
+* by caller-controlled Host headers, so it must stay bounded; an evicted
+* legitimate host re-adds itself on that device's next gated request.
+*/
+function addBounded(set, value, max) {
+	if (set.has(value)) return;
+	if (set.size >= max) {
+		const oldest = set.values().next().value;
+		if (oldest !== void 0) set.delete(oldest);
+	}
+	set.add(value);
+}
+/**
 * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
 * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
 * a malformed config then simply contributes no fence entry (and the panel
@@ -973,16 +1047,37 @@ var PairingEventsStream = class {
 * @returns the exact routes to register on webServer.
 */
 function makeRoutes(deps) {
-	const { service, lanAddresses, requirePairingForLan = true } = deps;
+	const { service, requirePairingForLan = true } = deps;
 	const pairingRequired = () => typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan;
 	const events = new PairingEventsStream(service);
+	const dynamicTrustedHosts = /* @__PURE__ */ new Set();
 	/** Loopback-only fence: the desktop panel's control endpoints. */
 	const loopbackFence = (req) => isTrustedApiRequest(req, []);
-	/** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
+	/** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
 	const lanFence = (req) => {
 		const publicHost = publicHostOf(service.publicBaseUrl);
 		const bases = service.lanAddresses;
-		return isTrustedApiRequest(req, publicHost === void 0 ? bases : [...bases, publicHost]);
+		const extraHosts = typeof deps.trustedHosts === "function" ? deps.trustedHosts() : deps.trustedHosts ?? [];
+		if (isTrustedApiRequest(req, [
+			...bases,
+			...publicHost !== void 0 ? [publicHost] : [],
+			...extraHosts,
+			...dynamicTrustedHosts
+		])) return true;
+		const privateLanHost = privateLanHostOf(req);
+		if (privateLanHost !== void 0) {
+			const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
+			let queryDeviceId = null;
+			try {
+				queryDeviceId = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("device");
+			} catch {}
+			const deviceId = cookieDeviceId ?? queryDeviceId ?? void 0;
+			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
+				addBounded(dynamicTrustedHosts, privateLanHost, 64);
+				return true;
+			}
+		}
+		return false;
 	};
 	const requireMethod = (req, res, method) => {
 		if (req.method === method) return true;
@@ -1060,7 +1155,8 @@ function makeRoutes(deps) {
 	};
 	const handleAccept = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
-		if (!lanFence(req)) {
+		const privateLanHost = privateLanHostOf(req);
+		if (!lanFence(req) && privateLanHost === void 0) {
 			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
@@ -1089,12 +1185,20 @@ function makeRoutes(deps) {
 		const ua = req.headers["user-agent"];
 		const result = service.accept(payload.token, typeof ua === "string" ? ua : void 0);
 		if (!result.ok) {
+			if (!lanFence(req)) {
+				writeJson(res, 403, {
+					ok: false,
+					code: "forbidden"
+				});
+				return;
+			}
 			writeJson(res, result.code === "used" ? 409 : 404, {
 				ok: false,
 				code: result.code
 			});
 			return;
 		}
+		if (privateLanHost !== void 0) addBounded(dynamicTrustedHosts, privateLanHost, 64);
 		writeJson(res, 200, {
 			ok: true,
 			deviceId: result.deviceId
@@ -1245,7 +1349,8 @@ function makeRoutes(deps) {
 	*/
 	const handleAcceptPage = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
-		if (!lanFence(req)) {
+		const privateLanHost = privateLanHostOf(req);
+		if (!lanFence(req) && privateLanHost === void 0) {
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 			res.end("forbidden");
 			return;
@@ -1262,6 +1367,11 @@ function makeRoutes(deps) {
 			code: "invalid"
 		} : service.accept(token, typeof ua === "string" ? ua : void 0);
 		if (!result.ok) {
+			if (!lanFence(req)) {
+				res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+				res.end("forbidden");
+				return;
+			}
 			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
 				res.writeHead(303, {
@@ -1280,6 +1390,7 @@ function makeRoutes(deps) {
 			res.end(pairingFailurePage());
 			return;
 		}
+		if (privateLanHost !== void 0) addBounded(dynamicTrustedHosts, privateLanHost, 64);
 		res.writeHead(303, {
 			location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(result.deviceId)}`,
 			"cache-control": "no-store",
@@ -1484,6 +1595,12 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
 		}
 		res.writeHead(upstreamRes.statusCode ?? 502, out);
 		upstreamRes.pipe(res);
+		upstreamRes.on("error", () => {
+			res.destroy();
+		});
+		res.on("close", () => {
+			if (!upstreamRes.readableEnded) upstream.destroy();
+		});
 	});
 	upstream.on("error", () => {
 		if (!res.headersSent) {
@@ -1498,6 +1615,9 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
 		}
 		res.destroy();
 	});
+	req.on("error", () => {
+		upstream.destroy();
+	});
 	req.pipe(upstream);
 }
 /**
@@ -1577,8 +1697,6 @@ const REMOTE_UPGRADE_PATHS = [
 ];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
-/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
-const DESKTOP_LAUNCHER_PATH = "/api/dsh-desktop-launcher";
 /**
 * The cookieless device credential: the boot patch reads the device id from
 * the /pair-app URL, keeps it in sessionStorage, and attaches it to every
@@ -1595,14 +1713,12 @@ const REMOTE_DEVICE_QUERY = "device";
 * paired remote desktop may use the full host API (chat, sessions,
 * settings, credentials, presets — it is a full-control credential), but it
 * must not reach the machine-control planes: pairing control itself, the
-* dsh-web self-update installer, plugin install/remove, and desktop
-* launcher actions (host shutdown, shortcuts).
+* dsh-web self-update installer, and plugin install/remove.
 */
 const LOCAL_ONLY_PREFIXES = [
 	"/api/pair",
 	"/api/update",
-	PLUGIN_MANAGER_PATH,
-	DESKTOP_LAUNCHER_PATH
+	PLUGIN_MANAGER_PATH
 ];
 /**
 * Whether a paired inner path must stay physically local.
@@ -3580,7 +3696,6 @@ const REMOTE_CHANNEL_RULES = {
 	apiPrefix: "/api/",
 	pairPrefix: "/api/pair/",
 	updatePrefix: "/api/update/",
-	desktopLauncherPrefix: "/api/dsh-desktop-launcher",
 	settingsBridgePrefix: "/api/dsh-web-ui-settings",
 	sidebarPrefix: "/sidebar/",
 	gitPrefix: "/git/",
@@ -3630,7 +3745,7 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
 	const json = JSON.stringify(rules);
 	const seat = JSON.stringify(REMOTE_CHANNEL_BOOT_GLOBAL);
-	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.desktopLauncherPrefix||p.indexOf(R.desktopLauncherPrefix+\"/\")===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
+	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
 }
 /** Boot-watchdog latch: one self-reload per session while the boot is broken. */
 const BOOT_WATCHDOG_KEY = "dsh-remote-boot-reload";
@@ -3715,6 +3830,7 @@ const Config = z.object({
 	cookieName: z.string().min(1).default("dsh_pair"),
 	requirePairingForLan: z.boolean().default(true),
 	publicBaseUrl: z.string(),
+	trustedHosts: z.array(z.string()),
 	devicesFile: z.string(),
 	autoTunnel: z.boolean().default(false),
 	tunnelToken: z.string().role("secret"),
@@ -3754,6 +3870,7 @@ const DEFAULTS = {
 	cookieName: "dsh_pair",
 	requirePairingForLan: true,
 	publicBaseUrl: void 0,
+	trustedHosts: void 0,
 	devicesFile: defaultDevicesFile(),
 	autoTunnel: false,
 	tunnelToken: void 0,
@@ -3769,6 +3886,7 @@ const DEFAULTS = {
 */
 const apply = mountOnce("@linxin666/dsh-remote-web-ui", applyImpl);
 function applyImpl(ctx, config) {
+	const envPublicBase = process.env.DSH_REMOTE_PUBLIC_BASE_URL?.trim() || void 0;
 	const resolved = {
 		tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
 		offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
@@ -3776,7 +3894,8 @@ function applyImpl(ctx, config) {
 		idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
 		cookieName: config?.cookieName ?? DEFAULTS.cookieName,
 		requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-		publicBaseUrl: config?.publicBaseUrl,
+		publicBaseUrl: config?.publicBaseUrl ?? envPublicBase,
+		trustedHosts: config?.trustedHosts,
 		devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
 		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
 		tunnelToken: config?.tunnelToken,
@@ -3795,7 +3914,8 @@ function applyImpl(ctx, config) {
 			idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
 			cookieName: value.cookieName ?? DEFAULTS.cookieName,
 			requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-			publicBaseUrl: value.publicBaseUrl,
+			publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
+			trustedHosts: value.trustedHosts,
 			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
 			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
 			tunnelToken: value.tunnelToken,
@@ -3885,13 +4005,15 @@ function applyImpl(ctx, config) {
 	let disposeRoutes;
 	let disposeSweep;
 	const requireFromHost = createRequire(import.meta.url);
-	const resolveAnchorPath = () => resolveAnchorManifest((specifier) => {
+	/** Host-process resolve that degrades to "not installed" (undefined) instead of throwing. */
+	const hostResolve = (specifier) => {
 		try {
 			return requireFromHost.resolve(specifier);
 		} catch {
 			return;
 		}
-	});
+	};
+	const resolveAnchorPath = () => resolveAnchorManifest(hostResolve);
 	const releaseNotesCache = /* @__PURE__ */ new Map();
 	const fetchReleaseNotesCached = async (version) => {
 		const cached = releaseNotesCache.get(version);
@@ -3907,13 +4029,7 @@ function applyImpl(ctx, config) {
 		fence: (request) => isTrustedApiRequest(request, []),
 		check: () => checkUpdates({
 			anchorManifestPath: resolveAnchorPath(),
-			resolve: (specifier) => {
-				try {
-					return requireFromHost.resolve(specifier);
-				} catch {
-					return;
-				}
-			},
+			resolve: hostResolve,
 			fetchLatest: (name) => fetchLatestVersion(name, fetch),
 			fetchReleaseNotes: fetchReleaseNotesCached
 		}),
@@ -3936,13 +4052,7 @@ function applyImpl(ctx, config) {
 				},
 				check: {
 					anchorManifestPath: resolveAnchorPath(),
-					resolve: (specifier) => {
-						try {
-							return requireFromHost.resolve(specifier);
-						} catch {
-							return;
-						}
-					},
+					resolve: hostResolve,
 					fetchLatest: (name) => fetchLatestVersion(name, fetch),
 					fetchReleaseNotes: fetchReleaseNotesCached
 				}
@@ -4009,10 +4119,25 @@ function applyImpl(ctx, config) {
 	const routes = [
 		...makeRoutes({
 			service,
-			lanAddresses: service.lanAddresses,
 			requirePairingForLan: () => resolve().requirePairingForLan,
 			lanBindStatus,
-			indexDocument: fetchAppShell
+			indexDocument: fetchAppShell,
+			trustedHosts: () => {
+				const list = [];
+				const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS;
+				if (typeof envHosts === "string" && envHosts.trim() !== "") for (const item of envHosts.split(",")) {
+					const trimmed = item.trim();
+					if (trimmed !== "") list.push(trimmed);
+				}
+				const cfgHosts = resolve().trustedHosts;
+				if (Array.isArray(cfgHosts)) {
+					for (const item of cfgHosts) if (typeof item === "string") {
+						const trimmed = item.trim();
+						if (trimmed !== "") list.push(trimmed);
+					}
+				}
+				return list;
+			}
 		}),
 		...makeRemoteApiRoutes({
 			service,
@@ -4191,13 +4316,23 @@ function applyImpl(ctx, config) {
 		});
 	}), "remote-web-ui: remote channel boot patch");
 	ctx.inject(["settings"], (settingsCtx) => {
-		settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-			setSource: (source) => {
-				current = source;
+		try {
+			if (typeof settingsCtx.settings?.installSection === "function") settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+				setSource: (source) => {
+					current = source;
+					sync();
+				},
+				onChange: sync
+			});
+			else if (typeof settingsCtx.settings?.register === "function") {
+				const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} });
+				current = () => scope?.get?.() ?? config ?? {};
+				scope?.watch?.(() => {
+					sync();
+				});
 				sync();
-			},
-			onChange: sync
-		});
+			}
+		} catch {}
 	});
 	sync();
 }

package/lib/types/client/RemoteEntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RemoteEntry.d.ts","sourceRoot":"","sources":["../../../src/client/RemoteEntry.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAQnE,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG;IACrD,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd,CAAA;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,gBAAgB,+BA2LxD"}
+{"version":3,"file":"RemoteEntry.d.ts","sourceRoot":"","sources":["../../../src/client/RemoteEntry.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAQnE,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG;IACrD,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd,CAAA;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,gBAAgB,+BAuMxD"}

package/lib/types/client/RemoteEntry.js

@@ -54,6 +54,7 @@ export function RemoteEntry({ wide, t }) {
     const stateRef = useRef(state);
     useEffect(() => { stateRef.current = state; }, [state]);
     const [copied, setCopied] = useState(false);
+    const [copiedToken, setCopiedToken] = useState(false);
     const eventSource = useRef(undefined);
     // Generation counter for the open flow: closing (or re-opening) the panel
     // bumps it, so an in-flight issue() that resolves after a close does not
@@ -87,6 +88,7 @@ export function RemoteEntry({ wide, t }) {
         return {
             kind: 'ready',
             url: result.url,
+            token: result.token,
             expiresAt: result.expiresAt,
             expired: Date.now() > result.expiresAt,
             phase: 'waiting',
@@ -202,7 +204,15 @@ export function RemoteEntry({ wide, t }) {
             window.setTimeout(() => { setCopied(false); }, 1500);
         });
     }, []);
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: [_jsx(UpdateEntry, { wide: wide, t: t }), _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open })] }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onPickAddress: handlePickAddress, onPickPublic: handlePickPublic, onRevoke: handleRevoke })] })), document.body)] }));
+    const handleCopyToken = useCallback((token) => {
+        void copyText(token).then((ok) => {
+            if (!ok)
+                return;
+            setCopiedToken(true);
+            window.setTimeout(() => { setCopiedToken(false); }, 1500);
+        });
+    }, []);
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: [_jsx(UpdateEntry, { wide: wide, t: t }), _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open })] }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, copiedToken: copiedToken, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onCopyToken: handleCopyToken, onPickAddress: handlePickAddress, onPickPublic: handlePickPublic, onRevoke: handleRevoke })] })), document.body)] }));
 }
 /** The trigger: an icon-only control with a persistent accessible label. */
 function TooltipAnchor({ wide, label, onClick, expanded }) {

package/lib/types/client/RemotePanel.d.ts

@@ -23,6 +23,8 @@ export type PanelState = {
     address: string;
     /** Every constructible LAN literal (interface order). */
     lanAddresses: string[];
+    /** The active pairing token itself (useful in Docker/reverse proxy topologies). */
+    token?: string;
     /** Whether this QR is built on the configured public (tunneled) base. */
     public: boolean;
     /** The configured public (tunneled) base URL, when present. */
@@ -39,10 +41,12 @@ export interface RemotePanelProps {
     t: TranslateNS<'remote'>;
     state: PanelState;
     copied: boolean;
+    copiedToken?: boolean;
     onClose(): void;
     onStop(): void;
     onRefresh(): void;
     onCopy(url: string): void;
+    onCopyToken?(token: string): void;
     /** Re-mint the QR against a different LAN address. */
     onPickAddress(address: string): void;
     /** Re-mint the QR against the configured public (tunneled) base. */
@@ -55,5 +59,5 @@ export interface RemotePanelProps {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export declare function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }: RemotePanelProps): import("react").JSX.Element;
+export declare function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }: RemotePanelProps): import("react").JSX.Element;
 //# sourceMappingURL=RemotePanel.d.ts.map

package/lib/types/client/RemotePanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAItB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,oEAAoE;IACpE,YAAY,IAAI,IAAI,CAAA;IACpB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,gBAAgB,+BAuK5I"}
+{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAItB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,oEAAoE;IACpE,YAAY,IAAI,IAAI,CAAA;IACpB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAC1B,CAAC,EACD,KAAK,EACL,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,GACT,EAAE,gBAAgB,+BAyLlB"}

package/lib/types/client/RemotePanel.js

@@ -26,10 +26,10 @@ function statusOf(t, state) {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }) {
+export function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }) {
     return (_jsxs("div", { className: css.panel, role: "dialog", "aria-modal": "true", "aria-label": t('title'), children: [_jsxs("div", { className: css.header, children: [_jsxs("div", { className: css.heading, children: [_jsx("h2", { className: css.title, children: t('title') }), _jsx("p", { className: css.subtitle, children: t('subtitle') })] }), _jsx("button", { type: "button", className: css.close, "aria-label": t('close.label'), onClick: onClose, children: _jsx(IconCloseOutline16, { size: 14 }) })] }), state.kind === 'lan-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.lanRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.lanRequiredHint') })] })) : state.kind === 'loopback-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.loopbackRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.loopbackRequiredHint') })] })) : state.kind === 'unreachable' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.unreachable') }), _jsx("p", { className: css.bannerHint, children: t('status.unreachableHint') })] })) : (_jsxs(_Fragment, { children: [state.posture !== undefined && state.posture.hosts.some(host => host.exposed) && (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('posture.exposed') }), _jsx("p", { className: css.bannerHint, children: t('posture.exposedHint', { hosts: state.posture.hosts.filter(host => host.exposed).map(host => host.host).join(', ') }) })] })), _jsxs("div", { className: css.card, children: [_jsxs("div", { className: css.cardHeader, children: [_jsx("span", { className: css.cardTitle, children: t('card.title') }), _jsxs("span", { className: css.badges, children: [state.public && _jsx("span", { className: clsx(css.badge, css.badgePublic), children: t('public.badge') }), _jsx("span", { className: clsx(css.badge, css[`badge-${statusOf(t, state).tone}`]), children: statusOf(t, state).text })] })] }), _jsx("div", { className: css.qrWrap, "data-testid": "remote-qr", children: _jsx(QRCodeSVG, { value: state.url, size: 184, level: "M", marginSize: 1, className: css.qr }) }), state.expired
                                 ? _jsx("p", { className: css.expired, children: t('pair.expired') })
-                                : _jsx("p", { className: css.expiry, children: t('pair.expires', { time: formatClock(state.expiresAt) }) })] }), _jsx("p", { className: css.hint, children: state.public ? t('pair.publicHint') : t('pair.hint') }), _jsx("div", { className: css.pairLinks, children: _jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.linkLabel') }), _jsx("code", { className: css.link, title: state.url, children: state.url })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopy(state.url), children: [_jsx(IconCopyOutline16, { size: 14 }), copied ? t('action.copied') : t('action.copyLink')] })] }) }), _jsx("p", { className: css.oneTimeHint, children: t('pair.oneTimeHint') }), state.phase === 'stopped' && _jsx("p", { className: css.stoppedHint, children: t('stopped.hint') }), state.tunnel !== undefined && state.tunnel.state !== 'running' && (_jsx("p", { className: state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote, role: "status", children: state.tunnel.state === 'failed'
+                                : _jsx("p", { className: css.expiry, children: t('pair.expires', { time: formatClock(state.expiresAt) }) })] }), _jsx("p", { className: css.hint, children: state.public ? t('pair.publicHint') : t('pair.hint') }), _jsxs("div", { className: css.pairLinks, children: [_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.linkLabel') }), _jsx("code", { className: css.link, title: state.url, children: state.url })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopy(state.url), children: [_jsx(IconCopyOutline16, { size: 14 }), copied ? t('action.copied') : t('action.copyLink')] })] }), state.token !== undefined && state.token !== '' && (_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.tokenLabel') }), _jsx("code", { className: css.link, title: state.token, children: state.token })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopyToken ? onCopyToken(state.token) : onCopy(state.token), children: [_jsx(IconCopyOutline16, { size: 14 }), copiedToken ? t('action.copiedToken') : t('action.copyToken')] })] }))] }), _jsxs("p", { className: css.oneTimeHint, children: [t('pair.oneTimeHint'), " ", t('pair.dockerHint')] }), state.phase === 'stopped' && _jsx("p", { className: css.stoppedHint, children: t('stopped.hint') }), state.tunnel !== undefined && state.tunnel.state !== 'running' && (_jsx("p", { className: state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote, role: "status", children: state.tunnel.state === 'failed'
                             ? t('tunnel.failed', { error: state.tunnel.error ?? t('tunnel.unknownError') })
                             : t('tunnel.starting') })), state.relay?.state === 'registering' && (_jsx("p", { className: css.tunnelNote, role: "status", children: t('relay.registering') })), state.relay?.state === 'failed' && (_jsx("p", { className: css.tunnelFailed, role: "status", children: t('relay.failed', { error: state.relay.error ?? t('tunnel.unknownError') }) })), (state.publicBaseUrl !== undefined || state.lanAddresses.length > 1) && (_jsxs("fieldset", { className: css.addresses, children: [_jsx("legend", { children: t('address.label') }), state.publicBaseUrl !== undefined && (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": t('address.public'), checked: state.public, onChange: onPickPublic }), _jsx("span", { children: t('address.public') }), _jsx("code", { className: css.addressValue, children: state.publicBaseUrl })] }, "public")), state.lanAddresses.map(address => (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": address, checked: !state.public && address === state.address, onChange: () => onPickAddress(address) }), _jsx("span", { children: t('address.lan') }), _jsx("code", { className: css.addressValue, children: address })] }, address))), _jsx("p", { className: css.addressHint, children: t('address.hint') })] })), _jsxs("div", { className: css.actions, children: [_jsxs("button", { type: "button", className: css.action, onClick: onStop, children: [_jsx(IconStopFill16, { size: 14 }), t('action.stop')] }), _jsxs("button", { type: "button", className: css.action, onClick: onRefresh, children: [_jsx(IconRefreshOutline16, { size: 14 }), t('action.refresh')] })] }), _jsxs("section", { className: css.devices, "data-testid": "remote-devices", "aria-label": t('devices.title'), children: [_jsx("h3", { className: css.devicesTitle, children: t('devices.title') }), state.devices.length === 0 ? (_jsx("p", { className: css.devicesEmpty, children: t('devices.empty') })) : (_jsx("ul", { className: css.deviceList, children: state.devices.map(device => (_jsxs("li", { className: css.deviceRow, children: [_jsxs("div", { className: css.deviceMeta, children: [_jsx("span", { className: css.deviceName, children: deviceNameFromUserAgent(device.userAgent) ?? t('devices.unknown') }), _jsx("span", { className: clsx(css.devicePresence, device.online ? css.deviceOnline : css.deviceOffline), children: device.online ? t('devices.online') : t('devices.offline') }), _jsx("span", { className: css.deviceSeen, children: t('devices.lastSeen', { time: formatLastSeen(device.lastSeenAt) }) })] }), _jsx("button", { type: "button", className: css.deviceRevoke, "aria-label": t('devices.revoke.label'), onClick: () => { onRevoke(device.id); }, children: t('devices.revoke') })] }, device.id))) }))] })] }))] }));
 }

package/lib/types/client/locales.d.ts

@@ -28,6 +28,8 @@ export declare const zh: {
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;
+    'pair.tokenLabel': string;
+    'pair.dockerHint': string;
     'pair.oneTimeHint': string;
     'pair.failed.title': string;
     'pair.failed.detail': string;
@@ -51,7 +53,9 @@ export declare const zh: {
     'action.refresh': string;
     'action.copy': string;
     'action.copyLink': string;
+    'action.copyToken': string;
     'action.copied': string;
+    'action.copiedToken': string;
     'devices.title': string;
     'devices.empty': string;
     'devices.unknown': string;
@@ -193,6 +197,8 @@ export declare const en: {
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;
+    'pair.tokenLabel': string;
+    'pair.dockerHint': string;
     'pair.oneTimeHint': string;
     'pair.failed.title': string;
     'pair.failed.detail': string;
@@ -216,7 +222,9 @@ export declare const en: {
     'action.refresh': string;
     'action.copy': string;
     'action.copyLink': string;
+    'action.copyToken': string;
     'action.copied': string;
+    'action.copiedToken': string;
     'devices.title': string;
     'devices.empty': string;
     'devices.unknown': string;

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKsB,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqKmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqKsB,CAAA"}

package/lib/types/client/locales.js

@@ -28,6 +28,8 @@ export const zh = {
     'pair.expires': '二维码有效至 {time}',
     'pair.expired': '二维码已过期，请刷新',
     'pair.linkLabel': '配对链接',
+    'pair.tokenLabel': '配对令牌',
+    'pair.dockerHint': 'Docker 或反向代理环境下，可直接复制此令牌并在目标设备配对页面输入。',
     'pair.oneTimeHint': '链接含一次性令牌；任一设备配对成功后立即失效，配对下一台设备请刷新二维码。',
     'pair.failed.title': '配对失败',
     'pair.failed.detail': '链接无效或已使用，请回到电脑端刷新二维码后重新扫码。',
@@ -51,7 +53,9 @@ export const zh = {
     'action.refresh': '刷新二维码',
     'action.copy': '复制链接',
     'action.copyLink': '复制链接',
+    'action.copyToken': '复制令牌',
     'action.copied': '已复制',
+    'action.copiedToken': '已复制令牌',
     'devices.title': '已授权设备',
     'devices.empty': '还没有已配对的设备。扫码或打开链接后会出现在这里。',
     'devices.unknown': '未知设备',
@@ -191,6 +195,8 @@ export const en = {
     'pair.expires': 'QR code valid until {time}',
     'pair.expired': 'QR code expired — refresh it',
     'pair.linkLabel': 'Pairing link',
+    'pair.tokenLabel': 'Pairing token',
+    'pair.dockerHint': 'In Docker or reverse proxy environments, copy this token to pair directly on the target device.',
     'pair.oneTimeHint': 'The link carries one single-use token; it dies as soon as any device pairs. Refresh the QR to pair the next device.',
     'pair.failed.title': 'Pairing failed',
     'pair.failed.detail': 'The link is invalid or was already used. Refresh the QR code on your computer and scan again.',
@@ -214,7 +220,9 @@ export const en = {
     'action.refresh': 'Refresh QR',
     'action.copy': 'Copy link',
     'action.copyLink': 'Copy link',
+    'action.copyToken': 'Copy token',
     'action.copied': 'Copied',
+    'action.copiedToken': 'Token copied',
     'devices.title': 'Authorized devices',
     'devices.empty': 'No paired devices yet. Scan the QR or open the link to add one.',
     'devices.unknown': 'Unknown device',

package/lib/types/client/mobile-adapt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AAgOD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAyqBvC"}
+{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AA+ND;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAqqBvC"}