@linxin666/dsh-remote-web-ui 0.3.14 → 0.3.15

package/lib/types/index.js

@@ -50,6 +50,7 @@ export const Config = z.object({
     cookieName: z.string().min(1).default('dsh_pair'),
     requirePairingForLan: z.boolean().default(true),
     publicBaseUrl: z.string(),
+    trustedHosts: z.array(z.string()),
     devicesFile: z.string(),
     autoTunnel: z.boolean().default(false),
     tunnelToken: z.string().role('secret'),
@@ -89,6 +90,7 @@ const DEFAULTS = {
     cookieName: 'dsh_pair',
     requirePairingForLan: true,
     publicBaseUrl: undefined,
+    trustedHosts: undefined,
     devicesFile: defaultDevicesFile(),
     autoTunnel: false,
     tunnelToken: undefined,
@@ -104,6 +106,7 @@ const DEFAULTS = {
  */
 export const apply = mountOnce('@linxin666/dsh-remote-web-ui', applyImpl);
 function applyImpl(ctx, config) {
+    const envPublicBase = process.env.DSH_REMOTE_PUBLIC_BASE_URL?.trim() || undefined;
     const resolved = {
         tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
         offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
@@ -111,7 +114,8 @@ function applyImpl(ctx, config) {
         idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
         cookieName: config?.cookieName ?? DEFAULTS.cookieName,
         requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-        publicBaseUrl: config?.publicBaseUrl,
+        publicBaseUrl: config?.publicBaseUrl ?? envPublicBase,
+        trustedHosts: config?.trustedHosts,
         devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
         autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
         tunnelToken: config?.tunnelToken,
@@ -133,7 +137,8 @@ function applyImpl(ctx, config) {
             idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
             cookieName: value.cookieName ?? DEFAULTS.cookieName,
             requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-            publicBaseUrl: value.publicBaseUrl,
+            publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
+            trustedHosts: value.trustedHosts,
             devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
             autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
             tunnelToken: value.tunnelToken,
@@ -282,14 +287,16 @@ function applyImpl(ctx, config) {
     // directory on update, so a boot-time captured path would fail to read
     // after a successful update; versions are re-read from disk per check.
     const requireFromHost = createRequire(import.meta.url);
-    const resolveAnchorPath = () => resolveAnchorManifest(specifier => {
+    /** Host-process resolve that degrades to "not installed" (undefined) instead of throwing. */
+    const hostResolve = (specifier) => {
         try {
             return requireFromHost.resolve(specifier);
         }
         catch {
             return undefined;
         }
-    });
+    };
+    const resolveAnchorPath = () => resolveAnchorManifest(hostResolve);
     const releaseNotesCache = new Map();
     const fetchReleaseNotesCached = async (version) => {
         const cached = releaseNotesCache.get(version);
@@ -305,14 +312,7 @@ function applyImpl(ctx, config) {
         fence: request => isTrustedApiRequest(request, []),
         check: () => checkUpdates({
             anchorManifestPath: resolveAnchorPath(),
-            resolve: specifier => {
-                try {
-                    return requireFromHost.resolve(specifier);
-                }
-                catch {
-                    return undefined;
-                }
-            },
+            resolve: hostResolve,
             fetchLatest: name => fetchLatestVersion(name, fetch),
             fetchReleaseNotes: fetchReleaseNotesCached,
         }),
@@ -336,14 +336,7 @@ function applyImpl(ctx, config) {
                 run: { profileDir: target.profileDir, packages: target.packages },
                 check: {
                     anchorManifestPath: resolveAnchorPath(),
-                    resolve: specifier => {
-                        try {
-                            return requireFromHost.resolve(specifier);
-                        }
-                        catch {
-                            return undefined;
-                        }
-                    },
+                    resolve: hostResolve,
                     fetchLatest: name => fetchLatestVersion(name, fetch),
                     fetchReleaseNotes: fetchReleaseNotesCached,
                 },
@@ -437,10 +430,31 @@ function applyImpl(ctx, config) {
     const routes = [
         ...makeRoutes({
             service,
-            lanAddresses: service.lanAddresses,
             requirePairingForLan: () => resolve().requirePairingForLan,
             lanBindStatus,
             indexDocument: fetchAppShell,
+            trustedHosts: () => {
+                const list = [];
+                const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS;
+                if (typeof envHosts === 'string' && envHosts.trim() !== '') {
+                    for (const item of envHosts.split(',')) {
+                        const trimmed = item.trim();
+                        if (trimmed !== '')
+                            list.push(trimmed);
+                    }
+                }
+                const cfgHosts = resolve().trustedHosts;
+                if (Array.isArray(cfgHosts)) {
+                    for (const item of cfgHosts) {
+                        if (typeof item === 'string') {
+                            const trimmed = item.trim();
+                            if (trimmed !== '')
+                                list.push(trimmed);
+                        }
+                    }
+                }
+                return list;
+            },
         }),
         // The remote desktop channel: policy-gated `/remote` prefix that
         // re-issues fenced paths to loopback (see remote-api.ts). The live
@@ -709,13 +723,26 @@ function applyImpl(ctx, config) {
         table.push({ kind: 'script', placement: 'head', text: REMOTE_CHANNEL_BOOT_SCRIPT });
     }), 'remote-web-ui: remote channel boot patch');
     ctx.inject(['settings'], (settingsCtx) => {
-        settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-            setSource: (source) => {
-                current = source;
+        try {
+            if (typeof settingsCtx.settings?.installSection === 'function') {
+                settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+                    setSource: (source) => {
+                        current = source;
+                        sync();
+                    },
+                    onChange: sync,
+                });
+            }
+            else if (typeof settingsCtx.settings?.register === 'function') {
+                const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} });
+                current = () => scope?.get?.() ?? (config ?? {});
+                scope?.watch?.(() => { sync(); });
                 sync();
-            },
-            onChange: sync,
-        });
+            }
+        }
+        catch {
+            // Defensive fallback against settings registration differences
+        }
     });
     sync();
 }

package/lib/types/loopback-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-proxy.d.ts","sourceRoot":"","sources":["../../src/loopback-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAGrF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAoBhD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,SAAS,GACf,IAAI,CAIN;AAmDD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoCN"}
+{"version":3,"file":"loopback-proxy.d.ts","sourceRoot":"","sources":["../../src/loopback-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAGrF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAoBhD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,SAAS,GACf,IAAI,CAIN;AAkED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoCN"}

package/lib/types/loopback-proxy.js

@@ -77,6 +77,18 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
         }
         res.writeHead(upstreamRes.statusCode ?? 502, out);
         upstreamRes.pipe(res);
+        // Inner leg died mid-response (reset, truncation): tear the outer leg
+        // down instead of letting the truncated response raise an unhandled
+        // 'error' with no listener.
+        upstreamRes.on('error', () => { res.destroy(); });
+        // Outer leg died before the response finished (phone left mid-request):
+        // reset the inner request so the loopback server stops working on a call
+        // nobody will read. Guarded so a normal completion never destroys a
+        // keep-alive socket the agent would reuse.
+        res.on('close', () => {
+            if (!upstreamRes.readableEnded)
+                upstream.destroy();
+        });
     });
     upstream.on('error', () => {
         if (!res.headersSent) {
@@ -85,6 +97,10 @@ function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
         }
         res.destroy();
     });
+    // The outer request aborted mid-body: reset the inner request instead of
+    // feeding it a truncated body that still gets processed (mirror of the
+    // upgrade path's two-leg teardown).
+    req.on('error', () => { upstream.destroy(); });
     req.pipe(upstream);
 }
 /**

package/lib/types/routes.d.ts

@@ -31,6 +31,17 @@ import { type PairingService, type PairingSnapshot } from './pairing.ts';
  * browser markers are same-origin.
  */
 export declare function isTrustedApiRequest(request: IncomingMessage, trustedHosts: readonly string[]): boolean;
+/**
+ * Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+ * Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+ * machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+ */
+export declare function isPrivateOrLocalHostname(hostname: string): boolean;
+/**
+ * Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+ * and ensures Origin matches Host when present).
+ */
+export declare function isNonCrossSite(request: IncomingMessage): boolean;
 /**
  * The rate-limit bucket key for one accept attempt (pure; unit-tested).
  * The first client-visible XFF hop separates buckets behind the auto-tunnel
@@ -41,6 +52,19 @@ export declare function isTrustedApiRequest(request: IncomingMessage, trustedHos
  * @param bucket - page (GET /pair-accept) vs api (POST /api/pair/accept).
  */
 export declare function acceptLimitKey(socketIp: string, forwarded: string | undefined, bucket: 'page' | 'api'): string;
+/**
+ * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
+ * every legitimate router/proxy aliasing shape, small enough that a flood of
+ * distinct private Host headers cannot grow the table unboundedly.
+ */
+export declare const MAX_DYNAMIC_TRUSTED_HOSTS = 64;
+/**
+ * FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+ * (a Set iterates in insertion order). The dynamic trusted-host table is fed
+ * by caller-controlled Host headers, so it must stay bounded; an evicted
+ * legitimate host re-adds itself on that device's next gated request.
+ */
+export declare function addBounded(set: Set<string>, value: string, max: number): void;
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
@@ -138,8 +162,6 @@ export declare class PairingEventsStream {
 export interface PairRoutesDeps {
     /** The pairing service. */
     service: PairingService;
-    /** The LAN IP literals the fence accepts (derived from the bind host). */
-    lanAddresses: readonly string[];
     /** Current desktop gate policy, re-read for every status response. */
     requirePairingForLan?: boolean | (() => boolean);
     /**
@@ -158,6 +180,8 @@ export interface PairRoutesDeps {
      * cookieless header/query credential). Undefined drops the route (tests).
      */
     indexDocument?: (deviceId: string) => Promise<string | undefined>;
+    /** Extra trusted non-loopback hosts (from config or environment). */
+    trustedHosts?: readonly string[] | (() => readonly string[]);
 }
 /**
  * Build the /api/pair route family.

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAKhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAKD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAK9G;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AAEzD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAoD/C;AA4BD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;;IASrB,iEAAiE;;IAEjE,iFAAiF;;IAEjF;;;OAGG;;CAEK,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AAoBjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,0EAA0E;IAC1E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IAC/B,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAClE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAmY3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAKhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CA6BtG;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyBlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAahE;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAK9G;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAO7E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AAEzD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAoD/C;AA4BD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;;IASrB,iEAAiE;;IAEjE,iFAAiF;;IAEjF;;;OAGG;;CAEK,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AAoBjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACjE,qEAAqE;IACrE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,CAAA;CAC7D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CA4a3D"}

package/lib/types/routes.js

@@ -67,6 +67,87 @@ export function isTrustedApiRequest(request, trustedHosts) {
         return false;
     }
 }
+/**
+ * Test whether a hostname represents a private local-area network (RFC 1918 / ULA / mDNS / loopback).
+ * Supports pairing in container-bridged (Docker) or NAT-proxied topologies where the host
+ * machine's LAN IP or proxy domain differs from the container's internal sampled network interface.
+ */
+export function isPrivateOrLocalHostname(hostname) {
+    const normalized = hostname.toLowerCase().trim();
+    if (normalized === 'localhost' ||
+        normalized.endsWith('.local') ||
+        normalized.endsWith('.lan') ||
+        normalized.endsWith('.internal') ||
+        normalized.endsWith('.home.arpa')) {
+        return true;
+    }
+    let ip = normalized;
+    if (ip.startsWith('[') && ip.endsWith(']'))
+        ip = ip.slice(1, -1);
+    if (ip === '::1' || ip === '127.0.0.1')
+        return true;
+    if (ip.startsWith('fc') || ip.startsWith('fd') || ip.startsWith('fe80'))
+        return true;
+    const parts = ip.split('.').map(Number);
+    if (parts.length === 4 && parts.every(n => Number.isInteger(n) && n >= 0 && n <= 255)) {
+        const [a, b] = parts;
+        if (a === 10)
+            return true;
+        if (a === 127)
+            return true;
+        if (a === 169 && b === 254)
+            return true;
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+    }
+    return false;
+}
+/**
+ * Validates that an incoming request is non-cross-site (rejects cross-site fetch metadata
+ * and ensures Origin matches Host when present).
+ */
+export function isNonCrossSite(request) {
+    if (request.headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return false;
+    const origin = request.headers.origin;
+    if (origin === undefined)
+        return true;
+    try {
+        const originUrl = new URL(origin);
+        const hostUrl = new URL(`http://${host}`);
+        return originUrl.host === hostUrl.host;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The private-LAN fallback authority of a request: its Host header when the
+ * hostname is private/local (RFC 1918 / ULA / mDNS / loopback) and the
+ * browser markers are non-cross-site, else undefined. The accept paths and
+ * the lanFence fallback use this to serve container-bridged and reverse-proxy
+ * topologies whose Host is not among the advertised or configured authorities.
+ */
+function privateLanHostOf(request) {
+    const host = request.headers.host;
+    if (typeof host !== 'string')
+        return undefined;
+    let hostName = '';
+    try {
+        hostName = new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return undefined;
+    }
+    if (hostName === '' || !isPrivateOrLocalHostname(hostName) || !isNonCrossSite(request))
+        return undefined;
+    return host;
+}
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
 const MAX_BODY_BYTES = 4096;
 /**
@@ -84,6 +165,28 @@ export function acceptLimitKey(socketIp, forwarded, bucket) {
     }
     return `${bucket}|${socketIp}`;
 }
+/**
+ * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
+ * every legitimate router/proxy aliasing shape, small enough that a flood of
+ * distinct private Host headers cannot grow the table unboundedly.
+ */
+export const MAX_DYNAMIC_TRUSTED_HOSTS = 64;
+/**
+ * FIFO-bounded Set insert: past `max` entries the oldest one is evicted
+ * (a Set iterates in insertion order). The dynamic trusted-host table is fed
+ * by caller-controlled Host headers, so it must stay bounded; an evicted
+ * legitimate host re-adds itself on that device's next gated request.
+ */
+export function addBounded(set, value, max) {
+    if (set.has(value))
+        return;
+    if (set.size >= max) {
+        const oldest = set.values().next().value;
+        if (oldest !== undefined)
+            set.delete(oldest);
+    }
+    set.add(value);
+}
 /**
  * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
  * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
@@ -324,20 +427,45 @@ export class PairingEventsStream {
  * @returns the exact routes to register on webServer.
  */
 export function makeRoutes(deps) {
-    const { service, lanAddresses, requirePairingForLan = true } = deps;
+    const { service, requirePairingForLan = true } = deps;
     const pairingRequired = () => typeof requirePairingForLan === 'function'
         ? requirePairingForLan()
         : requirePairingForLan;
     const events = new PairingEventsStream(service);
+    const dynamicTrustedHosts = new Set();
     /** Loopback-only fence: the desktop panel's control endpoints. */
     const loopbackFence = (req) => isTrustedApiRequest(req, []);
-    /** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
+    /** Phone-facing fence: loopback, the service's live LAN literals, configured public host, extra trusted hosts, or dynamically paired hosts. */
     const lanFence = (req) => {
         const publicHost = publicHostOf(service.publicBaseUrl);
         // The service's LAN bases re-read per request: a hot rebind (the lan-bind
         // toggle) updates them mid-process, and the fence must follow.
         const bases = service.lanAddresses;
-        return isTrustedApiRequest(req, publicHost === undefined ? bases : [...bases, publicHost]);
+        const extraHosts = typeof deps.trustedHosts === 'function' ? deps.trustedHosts() : (deps.trustedHosts ?? []);
+        const combined = [
+            ...bases,
+            ...(publicHost !== undefined ? [publicHost] : []),
+            ...extraHosts,
+            ...dynamicTrustedHosts,
+        ];
+        if (isTrustedApiRequest(req, combined))
+            return true;
+        // If request carries a valid paired device cookie from a private LAN host (e.g. after service restart), trust and remember it
+        const privateLanHost = privateLanHostOf(req);
+        if (privateLanHost !== undefined) {
+            const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
+            let queryDeviceId = null;
+            try {
+                queryDeviceId = new URL(req.url ?? '/', 'http://pair.invalid').searchParams.get('device');
+            }
+            catch { }
+            const deviceId = cookieDeviceId ?? queryDeviceId ?? undefined;
+            if (deviceId !== undefined && service.hasDevice(deviceId)) {
+                addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
+                return true;
+            }
+        }
+        return false;
     };
     const requireMethod = (req, res, method) => {
         if (req.method === method)
@@ -434,7 +562,8 @@ export function makeRoutes(deps) {
     const handleAccept = async (req, res) => {
         if (!requireMethod(req, res, 'POST'))
             return;
-        if (!lanFence(req)) {
+        const privateLanHost = privateLanHostOf(req);
+        if (!lanFence(req) && privateLanHost === undefined) {
             writeJson(res, 403, { ok: false, code: 'forbidden' });
             return;
         }
@@ -451,9 +580,16 @@ export function makeRoutes(deps) {
         const ua = req.headers['user-agent'];
         const result = service.accept(payload.token, typeof ua === 'string' ? ua : undefined);
         if (!result.ok) {
+            if (!lanFence(req)) {
+                writeJson(res, 403, { ok: false, code: 'forbidden' });
+                return;
+            }
             writeJson(res, result.code === 'used' ? 409 : 404, { ok: false, code: result.code });
             return;
         }
+        if (privateLanHost !== undefined) {
+            addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
+        }
         // No Secure attribute: LAN pairing runs over plain HTTP (the cookie must
         // work there), and the same cookie rides HTTPS on the tunnel. Lax keeps
         // top-level navigations working while blocking cross-site subrequests.
@@ -570,7 +706,8 @@ export function makeRoutes(deps) {
     const handleAcceptPage = async (req, res) => {
         if (!requireMethod(req, res, 'GET'))
             return;
-        if (!lanFence(req)) {
+        const privateLanHost = privateLanHostOf(req);
+        if (!lanFence(req) && privateLanHost === undefined) {
             res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
             res.end('forbidden');
             return;
@@ -585,6 +722,11 @@ export function makeRoutes(deps) {
         const ua = req.headers['user-agent'];
         const result = token === '' ? { ok: false, code: 'invalid' } : service.accept(token, typeof ua === 'string' ? ua : undefined);
         if (!result.ok) {
+            if (!lanFence(req)) {
+                res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
+                res.end('forbidden');
+                return;
+            }
             // accept() now refuses only expired/unknown/stopped tokens: a consumed
             // token stays re-usable until its expiry or replacement, so a mobile
             // flow that split across cookie contexts (camera preview, in-app
@@ -604,6 +746,9 @@ export function makeRoutes(deps) {
             res.end(pairingFailurePage());
             return;
         }
+        if (privateLanHost !== undefined) {
+            addBounded(dynamicTrustedHosts, privateLanHost, MAX_DYNAMIC_TRUSTED_HOSTS);
+        }
         // Land the paired device on the cookieless app page: the official shell
         // served by this plugin, with the device id in the URL. No harness index
         // gate, no browser-auth cookie hop - the channel gate accepts the device

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.3.14",
+  "version": "0.3.15",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/RemoteEntry.tsx

@@ -62,6 +62,7 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
   const stateRef = useRef(state)
   useEffect(() => { stateRef.current = state }, [state])
   const [copied, setCopied] = useState<boolean>(false)
+  const [copiedToken, setCopiedToken] = useState<boolean>(false)
   const eventSource = useRef<EventSource | undefined>(undefined)
   // Generation counter for the open flow: closing (or re-opening) the panel
   // bumps it, so an in-flight issue() that resolves after a close does not
@@ -94,6 +95,7 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
     return {
       kind: 'ready',
       url: result.url,
+      token: result.token,
       expiresAt: result.expiresAt,
       expired: Date.now() > result.expiresAt,
       phase: 'waiting',
@@ -215,6 +217,14 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
     })
   }, [])
 
+  const handleCopyToken = useCallback((token: string) => {
+    void copyText(token).then((ok) => {
+      if (!ok) return
+      setCopiedToken(true)
+      window.setTimeout(() => { setCopiedToken(false) }, 1500)
+    })
+  }, [])
+
   return (
     <>
       <div className={css.entryRow} data-rail={wide ? undefined : 'rail'}>
@@ -228,10 +238,12 @@ export function RemoteEntry({ wide, t }: RemoteEntryProps) {
             t={t}
             state={state}
             copied={copied}
+            copiedToken={copiedToken}
             onClose={closePanel}
             onStop={handleStop}
             onRefresh={handleRefresh}
             onCopy={handleCopy}
+            onCopyToken={handleCopyToken}
             onPickAddress={handlePickAddress}
             onPickPublic={handlePickPublic}
             onRevoke={handleRevoke}

package/src/client/RemotePanel.tsx

@@ -41,6 +41,8 @@ export type PanelState =
       address: string
       /** Every constructible LAN literal (interface order). */
       lanAddresses: string[]
+      /** The active pairing token itself (useful in Docker/reverse proxy topologies). */
+      token?: string
       /** Whether this QR is built on the configured public (tunneled) base. */
       public: boolean
       /** The configured public (tunneled) base URL, when present. */
@@ -58,10 +60,12 @@ export interface RemotePanelProps {
   t: TranslateNS<'remote'>
   state: PanelState
   copied: boolean
+  copiedToken?: boolean
   onClose(): void
   onStop(): void
   onRefresh(): void
   onCopy(url: string): void
+  onCopyToken?(token: string): void
   /** Re-mint the QR against a different LAN address. */
   onPickAddress(address: string): void
   /** Re-mint the QR against the configured public (tunneled) base. */
@@ -89,7 +93,20 @@ function statusOf(
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCopy, onPickAddress, onPickPublic, onRevoke }: RemotePanelProps) {
+export function RemotePanel({
+  t,
+  state,
+  copied,
+  copiedToken,
+  onClose,
+  onStop,
+  onRefresh,
+  onCopy,
+  onCopyToken,
+  onPickAddress,
+  onPickPublic,
+  onRevoke,
+}: RemotePanelProps) {
   return (
     <div className={css.panel} role="dialog" aria-modal="true" aria-label={t('title')}>
       <div className={css.header}>
@@ -157,8 +174,26 @@ export function RemotePanel({ t, state, copied, onClose, onStop, onRefresh, onCo
                 {copied ? t('action.copied') : t('action.copyLink')}
               </button>
             </div>
+            {state.token !== undefined && state.token !== '' && (
+              <div className={css.pairLinkRow}>
+                <div className={css.pairLinkText}>
+                  <span className={css.pairLinkLabel}>{t('pair.tokenLabel')}</span>
+                  <code className={css.link} title={state.token}>{state.token}</code>
+                </div>
+                <button
+                  type="button"
+                  className={css.copyLink}
+                  onClick={() => onCopyToken ? onCopyToken(state.token!) : onCopy(state.token!)}
+                >
+                  <IconCopyOutline16 size={14} />
+                  {copiedToken ? t('action.copiedToken') : t('action.copyToken')}
+                </button>
+              </div>
+            )}
           </div>
-          <p className={css.oneTimeHint}>{t('pair.oneTimeHint')}</p>
+          <p className={css.oneTimeHint}>
+            {t('pair.oneTimeHint')} {t('pair.dockerHint')}
+          </p>
           {state.phase === 'stopped' && <p className={css.stoppedHint}>{t('stopped.hint')}</p>}
           {state.tunnel !== undefined && state.tunnel.state !== 'running' && (
             <p className={state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote} role="status">

package/src/client/locales.ts

@@ -29,6 +29,8 @@ export const zh = {
   'pair.expires': '二维码有效至 {time}',
   'pair.expired': '二维码已过期，请刷新',
   'pair.linkLabel': '配对链接',
+  'pair.tokenLabel': '配对令牌',
+  'pair.dockerHint': 'Docker 或反向代理环境下，可直接复制此令牌并在目标设备配对页面输入。',
   'pair.oneTimeHint': '链接含一次性令牌；任一设备配对成功后立即失效，配对下一台设备请刷新二维码。',
   'pair.failed.title': '配对失败',
   'pair.failed.detail': '链接无效或已使用，请回到电脑端刷新二维码后重新扫码。',
@@ -52,7 +54,9 @@ export const zh = {
   'action.refresh': '刷新二维码',
   'action.copy': '复制链接',
   'action.copyLink': '复制链接',
+  'action.copyToken': '复制令牌',
   'action.copied': '已复制',
+  'action.copiedToken': '已复制令牌',
   'devices.title': '已授权设备',
   'devices.empty': '还没有已配对的设备。扫码或打开链接后会出现在这里。',
   'devices.unknown': '未知设备',
@@ -199,6 +203,8 @@ export const en = {
   'pair.expires': 'QR code valid until {time}',
   'pair.expired': 'QR code expired — refresh it',
   'pair.linkLabel': 'Pairing link',
+  'pair.tokenLabel': 'Pairing token',
+  'pair.dockerHint': 'In Docker or reverse proxy environments, copy this token to pair directly on the target device.',
   'pair.oneTimeHint': 'The link carries one single-use token; it dies as soon as any device pairs. Refresh the QR to pair the next device.',
   'pair.failed.title': 'Pairing failed',
   'pair.failed.detail': 'The link is invalid or was already used. Refresh the QR code on your computer and scan again.',
@@ -222,7 +228,9 @@ export const en = {
   'action.refresh': 'Refresh QR',
   'action.copy': 'Copy link',
   'action.copyLink': 'Copy link',
+  'action.copyToken': 'Copy token',
   'action.copied': 'Copied',
+  'action.copiedToken': 'Token copied',
   'devices.title': 'Authorized devices',
   'devices.empty': 'No paired devices yet. Scan the QR or open the link to add one.',
   'devices.unknown': 'Unknown device',