@linxin666/dsh-remote-web-ui 0.3.14 → 0.3.15

package/lib/index.js

@@ -724,6 +724,66 @@ function isTrustedApiRequest(request, trustedHosts) {
 		return false;
 	}
 }
+/**
+* Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+* Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+* machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+*/
+function isPrivateOrLocalHostname(hostname) {
+	const normalized = hostname.toLowerCase().trim();
+	if (normalized === "localhost" || normalized.endsWith(".local") || normalized.endsWith(".lan") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa")) return true;
+	let ip = normalized;
+	if (ip.startsWith("[") && ip.endsWith("]")) ip = ip.slice(1, -1);
+	if (ip === "::1" || ip === "127.0.0.1") return true;
+	if (ip.startsWith("fc") || ip.startsWith("fd") || ip.startsWith("fe80")) return true;
+	const parts = ip.split(".").map(Number);
+	if (parts.length === 4 && parts.every((n) => Number.isInteger(n) && n >= 0 && n <= 255)) {
+		const [a, b] = parts;
+		if (a === 10) return true;
+		if (a === 127) return true;
+		if (a === 169 && b === 254) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 192 && b === 168) return true;
+	}
+	return false;
+}
+/**
+* Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+* and ensures Origin matches Host when present).
+*/
+function isNonCrossSite(request) {
+	if (request.headers["sec-fetch-site"] === "cross-site") return false;
+	const host = request.headers.host;
+	if (typeof host !== "string") return false;
+	const origin = request.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		const originUrl = new URL(origin);
+		const hostUrl = new URL(`http://${host}`);
+		return originUrl.host === hostUrl.host;
+	} catch {
+		return false;
+	}
+}
+/**
+* The private-LAN fallback authority of a request: its Host header when the
+* hostname is private/local (RFC 1918 / ULA / mDNS / loopback) and the
+* browser markers are non-cross-site, else undefined. The accept paths and
+* the lanFence fallback use this to serve container-bridged and reverse-proxy
+* topologies whose Host is not among the advertised or configured authorities.
+*/
+function privateLanHostOf(request) {
+	const host = request.headers.host;
+	if (typeof host !== "string") return void 0;
+	let hostName = "";
+	try {
+		hostName = new URL(`http://${host}`).hostname;
+	} catch {
+		return;
+	}
+	if (hostName === "" || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request)) return void 0;
+	return host;
+}
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
 const MAX_BODY_BYTES = 4096;
 /**
@@ -740,6 +800,20 @@ function acceptLimitKey(socketIp, forwarded, bucket) {
 	return `${bucket}|${socketIp}`;
 }
 /**
+* FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+* (a Set iterates in insertion order). The dynamic trusted-host table is fed
+* by caller-controlled Host headers, so it must stay bounded; an evicted
+* legitimate host re-adds itself on that device's next gated request.
+*/
+function addBounded(set, value, max) {
+	if (set.has(value)) return;
+	if (set.size >= max) {
+		const oldest = set.values().next().value;
+		if (oldest !== void 0) set.delete(oldest);
+	}
+	set.add(value);
+}
+/**
 * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
 * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
 * a malformed config then simply contributes no fence entry (and the panel
@@ -973,16 +1047,37 @@ var PairingEventsStream = class {
 * @returns the exact routes to register on webServer.
 */
 function makeRoutes(deps) {
-	const { service, lanAddresses, requirePairingForLan = true } = deps;
+	const { service, requirePairingForLan = true } = deps;
 	const pairingRequired = () => typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan;
 	const events = new PairingEventsStream(service);
+	const dynamicTrustedHosts = /* @__PURE__ */ new Set();
 	/** Loopback-only fence: the desktop panel's control endpoints. */
 	const loopbackFence = (req) => isTrustedApiRequest(req, []);
-	/** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
+	/** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
 	const lanFence = (req) => {
 		const publicHost = publicHostOf(service.publicBaseUrl);
 		const bases = service.lanAddresses;
-		return isTrustedApiRequest(req, publicHost === void 0 ? bases : [...bases, publicHost]);
+		const extraHosts = typeof deps.trustedHosts === "function" ? deps.trustedHosts() : deps.trustedHosts ?? [];
+		if (isTrustedApiRequest(req, [
+			...bases,
+			...publicHost !== void 0 ? [publicHost] : [],
+			...extraHosts,
+			...dynamicTrustedHosts
+		])) return true;
+		const privateLanHost = privateLanHostOf(req);
+		if (privateLanHost !== void 0) {
+			const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
+			let queryDeviceId = null;
+			try {
+				queryDeviceId = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("device");
+			} catch {}
+			const deviceId = cookieDeviceId ?? queryDeviceId ?? void 0;
+			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
+				addBounded(dynamicTrustedHosts, privateLanHost, 64);
+				return true;
+			}
+		}
+		return false;
 	};
 	const requireMethod = (req, res, method) => {
 		if (req.method === method) return true;
@@ -1060,7 +1155,8 @@ function makeRoutes(deps) {
 	};
 	const handleAccept = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
-		if (!lanFence(req)) {
+		const privateLanHost = privateLanHostOf(req);
+		if (!lanFence(req) && privateLanHost === void 0) {
 			writeJson(res, 403, {
 				ok: false,
 				code: "forbidden"
@@ -1089,12 +1185,20 @@ function makeRoutes(deps) {
 		const ua = req.headers["user-agent"];
 		const result = service.accept(payload.token, typeof ua === "string" ? ua : void 0);
 		if (!result.ok) {
+			if (!lanFence(req)) {
+				writeJson(res, 403, {
+					ok: false,
+					code: "forbidden"
+				});
+				return;
+			}
 			writeJson(res, result.code === "used" ? 409 : 404, {
 				ok: false,
 				code: result.code
 			});
 			return;
 		}
+		if (privateLanHost !== void 0) addBounded(dynamicTrustedHosts, privateLanHost, 64);
 		writeJson(res, 200, {
 			ok: true,
 			deviceId: result.deviceId
@@ -1245,7 +1349,8 @@ function makeRoutes(deps) {
 	*/
 	const handleAcceptPage = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
-		if (!lanFence(req)) {
+		const privateLanHost = privateLanHostOf(req);
+		if (!lanFence(req) && privateLanHost === void 0) {
 			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
 			res.end("forbidden");
 			return;
@@ -1262,6 +1367,11 @@ function makeRoutes(deps) {
 			code: "invalid"
 		} : service.accept(token, typeof ua === "string" ? ua : void 0);
 		if (!result.ok) {
+			if (!lanFence(req)) {
+				res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+				res.end("forbidden");
+				return;
+			}
 			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
 				res.writeHead(303, {
@@ -1280,6 +1390,7 @@ function makeRoutes(deps) {
 			res.end(pairingFailurePage());
 			return;
 		}
+		if (privateLanHost !== void 0) addBounded(dynamicTrustedHosts, privateLanHost, 64);
 		res.writeHead(303, {
 			location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(result.deviceId)}`,
 			"cache-control": "no-store",
@@ -1484,6 +1595,12 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
 		}
 		res.writeHead(upstreamRes.statusCode ?? 502, out);
 		upstreamRes.pipe(res);
+		upstreamRes.on("error", () => {
+			res.destroy();
+		});
+		res.on("close", () => {
+			if (!upstreamRes.readableEnded) upstream.destroy();
+		});
 	});
 	upstream.on("error", () => {
 		if (!res.headersSent) {
@@ -1498,6 +1615,9 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
 		}
 		res.destroy();
 	});
+	req.on("error", () => {
+		upstream.destroy();
+	});
 	req.pipe(upstream);
 }
 /**
@@ -3710,6 +3830,7 @@ const Config = z.object({
 	cookieName: z.string().min(1).default("dsh_pair"),
 	requirePairingForLan: z.boolean().default(true),
 	publicBaseUrl: z.string(),
+	trustedHosts: z.array(z.string()),
 	devicesFile: z.string(),
 	autoTunnel: z.boolean().default(false),
 	tunnelToken: z.string().role("secret"),
@@ -3749,6 +3870,7 @@ const DEFAULTS = {
 	cookieName: "dsh_pair",
 	requirePairingForLan: true,
 	publicBaseUrl: void 0,
+	trustedHosts: void 0,
 	devicesFile: defaultDevicesFile(),
 	autoTunnel: false,
 	tunnelToken: void 0,
@@ -3764,6 +3886,7 @@ const DEFAULTS = {
 */
 const apply = mountOnce("@linxin666/dsh-remote-web-ui", applyImpl);
 function applyImpl(ctx, config) {
+	const envPublicBase = process.env.DSH_REMOTE_PUBLIC_BASE_URL?.trim() || void 0;
 	const resolved = {
 		tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
 		offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
@@ -3771,7 +3894,8 @@ function applyImpl(ctx, config) {
 		idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
 		cookieName: config?.cookieName ?? DEFAULTS.cookieName,
 		requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-		publicBaseUrl: config?.publicBaseUrl,
+		publicBaseUrl: config?.publicBaseUrl ?? envPublicBase,
+		trustedHosts: config?.trustedHosts,
 		devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
 		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
 		tunnelToken: config?.tunnelToken,
@@ -3790,7 +3914,8 @@ function applyImpl(ctx, config) {
 			idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
 			cookieName: value.cookieName ?? DEFAULTS.cookieName,
 			requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-			publicBaseUrl: value.publicBaseUrl,
+			publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
+			trustedHosts: value.trustedHosts,
 			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
 			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
 			tunnelToken: value.tunnelToken,
@@ -3880,13 +4005,15 @@ function applyImpl(ctx, config) {
 	let disposeRoutes;
 	let disposeSweep;
 	const requireFromHost = createRequire(import.meta.url);
-	const resolveAnchorPath = () => resolveAnchorManifest((specifier) => {
+	/** Host-process resolve that degrades to "not installed" (undefined) instead of throwing. */
+	const hostResolve = (specifier) => {
 		try {
 			return requireFromHost.resolve(specifier);
 		} catch {
 			return;
 		}
-	});
+	};
+	const resolveAnchorPath = () => resolveAnchorManifest(hostResolve);
 	const releaseNotesCache = /* @__PURE__ */ new Map();
 	const fetchReleaseNotesCached = async (version) => {
 		const cached = releaseNotesCache.get(version);
@@ -3902,13 +4029,7 @@ function applyImpl(ctx, config) {
 		fence: (request) => isTrustedApiRequest(request, []),
 		check: () => checkUpdates({
 			anchorManifestPath: resolveAnchorPath(),
-			resolve: (specifier) => {
-				try {
-					return requireFromHost.resolve(specifier);
-				} catch {
-					return;
-				}
-			},
+			resolve: hostResolve,
 			fetchLatest: (name) => fetchLatestVersion(name, fetch),
 			fetchReleaseNotes: fetchReleaseNotesCached
 		}),
@@ -3931,13 +4052,7 @@ function applyImpl(ctx, config) {
 				},
 				check: {
 					anchorManifestPath: resolveAnchorPath(),
-					resolve: (specifier) => {
-						try {
-							return requireFromHost.resolve(specifier);
-						} catch {
-							return;
-						}
-					},
+					resolve: hostResolve,
 					fetchLatest: (name) => fetchLatestVersion(name, fetch),
 					fetchReleaseNotes: fetchReleaseNotesCached
 				}
@@ -4004,10 +4119,25 @@ function applyImpl(ctx, config) {
 	const routes = [
 		...makeRoutes({
 			service,
-			lanAddresses: service.lanAddresses,
 			requirePairingForLan: () => resolve().requirePairingForLan,
 			lanBindStatus,
-			indexDocument: fetchAppShell
+			indexDocument: fetchAppShell,
+			trustedHosts: () => {
+				const list = [];
+				const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS;
+				if (typeof envHosts === "string" && envHosts.trim() !== "") for (const item of envHosts.split(",")) {
+					const trimmed = item.trim();
+					if (trimmed !== "") list.push(trimmed);
+				}
+				const cfgHosts = resolve().trustedHosts;
+				if (Array.isArray(cfgHosts)) {
+					for (const item of cfgHosts) if (typeof item === "string") {
+						const trimmed = item.trim();
+						if (trimmed !== "") list.push(trimmed);
+					}
+				}
+				return list;
+			}
 		}),
 		...makeRemoteApiRoutes({
 			service,
@@ -4186,13 +4316,23 @@ function applyImpl(ctx, config) {
 		});
 	}), "remote-web-ui: remote channel boot patch");
 	ctx.inject(["settings"], (settingsCtx) => {
-		settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-			setSource: (source) => {
-				current = source;
+		try {
+			if (typeof settingsCtx.settings?.installSection === "function") settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+				setSource: (source) => {
+					current = source;
+					sync();
+				},
+				onChange: sync
+			});
+			else if (typeof settingsCtx.settings?.register === "function") {
+				const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} });
+				current = () => scope?.get?.() ?? config ?? {};
+				scope?.watch?.(() => {
+					sync();
+				});
 				sync();
-			},
-			onChange: sync
-		});
+			}
+		} catch {}
 	});
 	sync();
 }

package/lib/types/client/RemoteEntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RemoteEntry.d.ts","sourceRoot":"","sources":["../../../src/client/RemoteEntry.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAQnE,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG;IACrD,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd,CAAA;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,gBAAgB,+BA2LxD"}
+{"version":3,"file":"RemoteEntry.d.ts","sourceRoot":"","sources":["../../../src/client/RemoteEntry.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AAQnE,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG;IACrD,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd,CAAA;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,gBAAgB,+BAuMxD"}

package/lib/types/client/RemoteEntry.js

@@ -54,6 +54,7 @@ export function RemoteEntry({ wide, t }) {
     const stateRef = useRef(state);
     useEffect(() => { stateRef.current = state; }, [state]);
     const [copied, setCopied] = useState(false);
+    const [copiedToken, setCopiedToken] = useState(false);
     const eventSource = useRef(undefined);
     // Generation counter for the open flow: closing (or re-opening) the panel
     // bumps it, so an in-flight issue() that resolves after a close does not
@@ -87,6 +88,7 @@ export function RemoteEntry({ wide, t }) {
         return {
             kind: 'ready',
             url: result.url,
+            token: result.token,
             expiresAt: result.expiresAt,
             expired: Date.now() > result.expiresAt,
             phase: 'waiting',
@@ -202,7 +204,15 @@ export function RemoteEntry({ wide, t }) {
             window.setTimeout(() => { setCopied(false); }, 1500);
         });
     }, []);
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: [_jsx(UpdateEntry, { wide: wide, t: t }), _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open })] }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onPickAddress: handlePickAddress, onPickPublic: handlePickPublic, onRevoke: handleRevoke })] })), document.body)] }));
+    const handleCopyToken = useCallback((token) => {
+        void copyText(token).then((ok) => {
+            if (!ok)
+                return;
+            setCopiedToken(true);
+            window.setTimeout(() => { setCopiedToken(false); }, 1500);
+        });
+    }, []);
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: [_jsx(UpdateEntry, { wide: wide, t: t }), _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open })] }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, copiedToken: copiedToken, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onCopyToken: handleCopyToken, onPickAddress: handlePickAddress, onPickPublic: handlePickPublic, onRevoke: handleRevoke })] })), document.body)] }));
 }
 /** The trigger: an icon-only control with a persistent accessible label. */
 function TooltipAnchor({ wide, label, onClick, expanded }) {

package/lib/types/client/RemotePanel.d.ts

@@ -23,6 +23,8 @@ export type PanelState = {
     address: string;
     /** Every constructible LAN literal (interface order). */
     lanAddresses: string[];
+    /** The active pairing token itself (useful in Docker/reverse proxy topologies). */
+    token?: string;
     /** Whether this QR is built on the configured public (tunneled) base. */
     public: boolean;
     /** The configured public (tunneled) base URL, when present. */
@@ -39,10 +41,12 @@ export interface RemotePanelProps {
     t: TranslateNS<'remote'>;
     state: PanelState;
     copied: boolean;
+    copiedToken?: boolean;
     onClose(): void;
     onStop(): void;
     onRefresh(): void;
     onCopy(url: string): void;
+    onCopyToken?(token: string): void;
     /** Re-mint the QR against a different LAN address. */
     onPickAddress(address: string): void;
     /** Re-mint the QR against the configured public (tunneled) base. */
@@ -55,5 +59,5 @@ export interface RemotePanelProps {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export declare function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }: RemotePanelProps): import("react").JSX.Element;
+export declare function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }: RemotePanelProps): import("react").JSX.Element;
 //# sourceMappingURL=RemotePanel.d.ts.map

package/lib/types/client/RemotePanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAItB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,oEAAoE;IACpE,YAAY,IAAI,IAAI,CAAA;IACpB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,gBAAgB,+BAuK5I"}
+{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAItB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,oEAAoE;IACpE,YAAY,IAAI,IAAI,CAAA;IACpB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAC1B,CAAC,EACD,KAAK,EACL,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,GACT,EAAE,gBAAgB,+BAyLlB"}

package/lib/types/client/RemotePanel.js

@@ -26,10 +26,10 @@ function statusOf(t, state) {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }) {
+export function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }) {
     return (_jsxs("div", { className: css.panel, role: "dialog", "aria-modal": "true", "aria-label": t('title'), children: [_jsxs("div", { className: css.header, children: [_jsxs("div", { className: css.heading, children: [_jsx("h2", { className: css.title, children: t('title') }), _jsx("p", { className: css.subtitle, children: t('subtitle') })] }), _jsx("button", { type: "button", className: css.close, "aria-label": t('close.label'), onClick: onClose, children: _jsx(IconCloseOutline16, { size: 14 }) })] }), state.kind === 'lan-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.lanRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.lanRequiredHint') })] })) : state.kind === 'loopback-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.loopbackRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.loopbackRequiredHint') })] })) : state.kind === 'unreachable' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.unreachable') }), _jsx("p", { className: css.bannerHint, children: t('status.unreachableHint') })] })) : (_jsxs(_Fragment, { children: [state.posture !== undefined && state.posture.hosts.some(host => host.exposed) && (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('posture.exposed') }), _jsx("p", { className: css.bannerHint, children: t('posture.exposedHint', { hosts: state.posture.hosts.filter(host => host.exposed).map(host => host.host).join(', ') }) })] })), _jsxs("div", { className: css.card, children: [_jsxs("div", { className: css.cardHeader, children: [_jsx("span", { className: css.cardTitle, children: t('card.title') }), _jsxs("span", { className: css.badges, children: [state.public && _jsx("span", { className: clsx(css.badge, css.badgePublic), children: t('public.badge') }), _jsx("span", { className: clsx(css.badge, css[`badge-${statusOf(t, state).tone}`]), children: statusOf(t, state).text })] })] }), _jsx("div", { className: css.qrWrap, "data-testid": "remote-qr", children: _jsx(QRCodeSVG, { value: state.url, size: 184, level: "M", marginSize: 1, className: css.qr }) }), state.expired
                                 ? _jsx("p", { className: css.expired, children: t('pair.expired') })
-                                : _jsx("p", { className: css.expiry, children: t('pair.expires', { time: formatClock(state.expiresAt) }) })] }), _jsx("p", { className: css.hint, children: state.public ? t('pair.publicHint') : t('pair.hint') }), _jsx("div", { className: css.pairLinks, children: _jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.linkLabel') }), _jsx("code", { className: css.link, title: state.url, children: state.url })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopy(state.url), children: [_jsx(IconCopyOutline16, { size: 14 }), copied ? t('action.copied') : t('action.copyLink')] })] }) }), _jsx("p", { className: css.oneTimeHint, children: t('pair.oneTimeHint') }), state.phase === 'stopped' && _jsx("p", { className: css.stoppedHint, children: t('stopped.hint') }), state.tunnel !== undefined && state.tunnel.state !== 'running' && (_jsx("p", { className: state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote, role: "status", children: state.tunnel.state === 'failed'
+                                : _jsx("p", { className: css.expiry, children: t('pair.expires', { time: formatClock(state.expiresAt) }) })] }), _jsx("p", { className: css.hint, children: state.public ? t('pair.publicHint') : t('pair.hint') }), _jsxs("div", { className: css.pairLinks, children: [_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.linkLabel') }), _jsx("code", { className: css.link, title: state.url, children: state.url })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopy(state.url), children: [_jsx(IconCopyOutline16, { size: 14 }), copied ? t('action.copied') : t('action.copyLink')] })] }), state.token !== undefined && state.token !== '' && (_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.tokenLabel') }), _jsx("code", { className: css.link, title: state.token, children: state.token })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopyToken ? onCopyToken(state.token) : onCopy(state.token), children: [_jsx(IconCopyOutline16, { size: 14 }), copiedToken ? t('action.copiedToken') : t('action.copyToken')] })] }))] }), _jsxs("p", { className: css.oneTimeHint, children: [t('pair.oneTimeHint'), " ", t('pair.dockerHint')] }), state.phase === 'stopped' && _jsx("p", { className: css.stoppedHint, children: t('stopped.hint') }), state.tunnel !== undefined && state.tunnel.state !== 'running' && (_jsx("p", { className: state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote, role: "status", children: state.tunnel.state === 'failed'
                             ? t('tunnel.failed', { error: state.tunnel.error ?? t('tunnel.unknownError') })
                             : t('tunnel.starting') })), state.relay?.state === 'registering' && (_jsx("p", { className: css.tunnelNote, role: "status", children: t('relay.registering') })), state.relay?.state === 'failed' && (_jsx("p", { className: css.tunnelFailed, role: "status", children: t('relay.failed', { error: state.relay.error ?? t('tunnel.unknownError') }) })), (state.publicBaseUrl !== undefined || state.lanAddresses.length > 1) && (_jsxs("fieldset", { className: css.addresses, children: [_jsx("legend", { children: t('address.label') }), state.publicBaseUrl !== undefined && (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": t('address.public'), checked: state.public, onChange: onPickPublic }), _jsx("span", { children: t('address.public') }), _jsx("code", { className: css.addressValue, children: state.publicBaseUrl })] }, "public")), state.lanAddresses.map(address => (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": address, checked: !state.public && address === state.address, onChange: () => onPickAddress(address) }), _jsx("span", { children: t('address.lan') }), _jsx("code", { className: css.addressValue, children: address })] }, address))), _jsx("p", { className: css.addressHint, children: t('address.hint') })] })), _jsxs("div", { className: css.actions, children: [_jsxs("button", { type: "button", className: css.action, onClick: onStop, children: [_jsx(IconStopFill16, { size: 14 }), t('action.stop')] }), _jsxs("button", { type: "button", className: css.action, onClick: onRefresh, children: [_jsx(IconRefreshOutline16, { size: 14 }), t('action.refresh')] })] }), _jsxs("section", { className: css.devices, "data-testid": "remote-devices", "aria-label": t('devices.title'), children: [_jsx("h3", { className: css.devicesTitle, children: t('devices.title') }), state.devices.length === 0 ? (_jsx("p", { className: css.devicesEmpty, children: t('devices.empty') })) : (_jsx("ul", { className: css.deviceList, children: state.devices.map(device => (_jsxs("li", { className: css.deviceRow, children: [_jsxs("div", { className: css.deviceMeta, children: [_jsx("span", { className: css.deviceName, children: deviceNameFromUserAgent(device.userAgent) ?? t('devices.unknown') }), _jsx("span", { className: clsx(css.devicePresence, device.online ? css.deviceOnline : css.deviceOffline), children: device.online ? t('devices.online') : t('devices.offline') }), _jsx("span", { className: css.deviceSeen, children: t('devices.lastSeen', { time: formatLastSeen(device.lastSeenAt) }) })] }), _jsx("button", { type: "button", className: css.deviceRevoke, "aria-label": t('devices.revoke.label'), onClick: () => { onRevoke(device.id); }, children: t('devices.revoke') })] }, device.id))) }))] })] }))] }));
 }

package/lib/types/client/locales.d.ts

@@ -28,6 +28,8 @@ export declare const zh: {
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;
+    'pair.tokenLabel': string;
+    'pair.dockerHint': string;
     'pair.oneTimeHint': string;
     'pair.failed.title': string;
     'pair.failed.detail': string;
@@ -51,7 +53,9 @@ export declare const zh: {
     'action.refresh': string;
     'action.copy': string;
     'action.copyLink': string;
+    'action.copyToken': string;
     'action.copied': string;
+    'action.copiedToken': string;
     'devices.title': string;
     'devices.empty': string;
     'devices.unknown': string;
@@ -193,6 +197,8 @@ export declare const en: {
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;
+    'pair.tokenLabel': string;
+    'pair.dockerHint': string;
     'pair.oneTimeHint': string;
     'pair.failed.title': string;
     'pair.failed.detail': string;
@@ -216,7 +222,9 @@ export declare const en: {
     'action.refresh': string;
     'action.copy': string;
     'action.copyLink': string;
+    'action.copyToken': string;
     'action.copied': string;
+    'action.copiedToken': string;
     'devices.title': string;
     'devices.empty': string;
     'devices.unknown': string;

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKsB,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqKmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqKsB,CAAA"}

package/lib/types/client/locales.js

@@ -28,6 +28,8 @@ export const zh = {
     'pair.expires': '二维码有效至 {time}',
     'pair.expired': '二维码已过期，请刷新',
     'pair.linkLabel': '配对链接',
+    'pair.tokenLabel': '配对令牌',
+    'pair.dockerHint': 'Docker 或反向代理环境下，可直接复制此令牌并在目标设备配对页面输入。',
     'pair.oneTimeHint': '链接含一次性令牌；任一设备配对成功后立即失效，配对下一台设备请刷新二维码。',
     'pair.failed.title': '配对失败',
     'pair.failed.detail': '链接无效或已使用，请回到电脑端刷新二维码后重新扫码。',
@@ -51,7 +53,9 @@ export const zh = {
     'action.refresh': '刷新二维码',
     'action.copy': '复制链接',
     'action.copyLink': '复制链接',
+    'action.copyToken': '复制令牌',
     'action.copied': '已复制',
+    'action.copiedToken': '已复制令牌',
     'devices.title': '已授权设备',
     'devices.empty': '还没有已配对的设备。扫码或打开链接后会出现在这里。',
     'devices.unknown': '未知设备',
@@ -191,6 +195,8 @@ export const en = {
     'pair.expires': 'QR code valid until {time}',
     'pair.expired': 'QR code expired — refresh it',
     'pair.linkLabel': 'Pairing link',
+    'pair.tokenLabel': 'Pairing token',
+    'pair.dockerHint': 'In Docker or reverse proxy environments, copy this token to pair directly on the target device.',
     'pair.oneTimeHint': 'The link carries one single-use token; it dies as soon as any device pairs. Refresh the QR to pair the next device.',
     'pair.failed.title': 'Pairing failed',
     'pair.failed.detail': 'The link is invalid or was already used. Refresh the QR code on your computer and scan again.',
@@ -214,7 +220,9 @@ export const en = {
     'action.refresh': 'Refresh QR',
     'action.copy': 'Copy link',
     'action.copyLink': 'Copy link',
+    'action.copyToken': 'Copy token',
     'action.copied': 'Copied',
+    'action.copiedToken': 'Token copied',
     'devices.title': 'Authorized devices',
     'devices.empty': 'No paired devices yet. Scan the QR or open the link to add one.',
     'devices.unknown': 'Unknown device',

package/lib/types/client/mobile-adapt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AAgOD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAyqBvC"}
+{"version":3,"file":"mobile-adapt.d.ts","sourceRoot":"","sources":["../../../src/client/mobile-adapt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAE7C,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,IAAI,CAAA;IACpB,yDAAyD;IACzD,aAAa,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAClC,yDAAyD;IACzD,YAAY,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,KAAK,MAAM,CAAC,GAAG,IAAI,CAAA;IAC9C,wEAAwE;IACxE,UAAU,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,4GAA4G;IAC5G,iBAAiB,IAAI,IAAI,CAAA;CAC1B;AA+ND;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAqqBvC"}

package/lib/types/client/mobile-adapt.js

@@ -214,7 +214,6 @@ const ADAPT_CSS = [
     `body.${ACTIVE_CLASS} [data-dsh-plugin=\"task-board\"],`,
     `body.${ACTIVE_CLASS} [data-dsh-plugin=\"git-graph\"],`,
     `body.${ACTIVE_CLASS} [data-dsh-plugin=\"pet\"],`,
-    `body.${ACTIVE_CLASS} [data-dsh-plugin=\"perf\"],`,
     `body.${ACTIVE_CLASS} [data-dsh-plugin=\"usage\"]{display:none !important}`,
     // The official workbench (Files / source control) mounts into a
     // full-viewport portal layer with no data-dsh-plugin root, so the plugin
@@ -965,17 +964,13 @@ export function startMobileAdapt() {
         }
         lanOrigFocus.call(this, options);
     };
-    let lastComposerTapRegistered = false;
-    if (!lastComposerTapRegistered) {
-        lastComposerTapRegistered = true;
-        document.addEventListener('pointerdown', (e) => {
-            if (!active)
-                return;
-            const t = e.target;
-            if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT') && t.closest('[class$="_composerSeat"]') !== null)
-                lastComposerTap = Date.now();
-        }, true);
-    }
+    document.addEventListener('pointerdown', (e) => {
+        if (!active)
+            return;
+        const t = e.target;
+        if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT') && t.closest('[class$="_composerSeat"]') !== null)
+            lastComposerTap = Date.now();
+    }, true);
     // The plugin apply() wires toggleSidebar/closeDetails to ctx.layout once
     // it is live, and flips the master switch when the settings snapshot
     // settles.

package/lib/types/index.d.ts

@@ -76,6 +76,13 @@ export interface Config {
      * warning (LAN-only behavior preserved). Ignored while `autoTunnel` is on.
      */
     publicBaseUrl?: string;
+    /**
+     * Extra trusted host authorities (exact host:port or port-less host) allowed
+     * to access pairing endpoints and remote web services. Useful in Docker, reverse proxy,
+     * or NAT environments where incoming request Host headers differ from the container's
+     * internal network addresses. Can also be set via the DSH_REMOTE_TRUSTED_HOSTS env var.
+     */
+    trustedHosts?: string[];
     /**
      * Absolute path to a JSON file where paired device sessions are persisted.
      * Defaults to `$DSH_HOME/remote-web-ui-devices.json` so a paired device
@@ -146,8 +153,9 @@ export declare const Config: z<Config>;
  * which legitimately resolves to `undefined` when unset (the schema keeps it
  * optional, so `Required` alone would over-narrow it to `string`).
  */
-type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'devicesFile' | 'lanBind' | 'profile' | 'tunnelToken'>> & {
+type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'trustedHosts' | 'devicesFile' | 'lanBind' | 'profile' | 'tunnelToken'>> & {
     publicBaseUrl: string | undefined;
+    trustedHosts: string[] | undefined;
     devicesFile: string;
     /** undefined until the user flips the toggle once; undefined never writes the patch. */
     lanBind: boolean | undefined;

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,aAAa,CAAA;AAO3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAgCzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAe3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACtH,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAoBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CA0kBtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,aAAa,CAAA;AAO3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAgCzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAgB3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACvI,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAqBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAimBtD"}