@linxin666/dsh-remote-web-ui 0.3.15 → 0.3.17

package/lib/index.js

@@ -2428,7 +2428,9 @@ function writeLanBind(host, port, profile, home = dshHome()) {
 	const file = profilePatchFile(profile, home);
 	const stripped = stripManagedBlock(readPatchContent(file));
 	const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN);
-	const content = `${(orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()}\n\n${managedBlock(host, port)}`;
+	const base = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd().replace(/\[\s*\]\s*$/, "").trimEnd();
+	const block = managedBlock(host, port);
+	const content = base.length > 0 ? `${base}\n\n${block}` : block;
 	const mode = existsSync(file) ? statSync(file).mode & 511 : 384;
 	mkdirSync(dirname(file), { recursive: true });
 	const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
@@ -2753,7 +2755,9 @@ function createInnerAuth(launchUrl, fetchImpl = fetch) {
 //#region src/tunnel.ts
 /**
 * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
-* npm package — its postinstall downloads the platform binary, so no
+* npm package — its postinstall downloads the platform binary and the
+* readiness policy below validates it and re-fetches when it cannot run (the
+* desktop payload stages one tree for every shipped OS/arch), so no
 * user-side tooling is involved — surfaces the public URL, and restarts the
 * process after unexpected exits with exponential backoff. Two modes: the
 * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
@@ -2808,10 +2812,59 @@ function namedTunnelHandle(inner, publicUrl) {
 	};
 	return handle;
 }
-/** Default binary readiness: download the platform binary on first use. */
+/** Time box for the `--version` probe that validates a staged binary. */
+const BINARY_PROBE_TIMEOUT_MS = 1e4;
+/**
+* Probe whether the binary at `path` actually executes on this machine. The
+* desktop payload stages one dependency tree for every shipped OS/arch, so a
+* binary can exist with the wrong architecture (the arm64 darwin
+* `bin/cloudflared` on an x64 mac); existence alone must not skip the
+* reinstall.
+*/
+function binaryRuns(executable) {
+	return new Promise((resolvePromise) => {
+		const child = spawn(executable, ["--version"], { stdio: "ignore" });
+		const timer = setTimeout(() => {
+			child.kill("SIGKILL");
+			resolvePromise(false);
+		}, BINARY_PROBE_TIMEOUT_MS);
+		child.once("error", () => {
+			clearTimeout(timer);
+			resolvePromise(false);
+		});
+		child.once("exit", (code) => {
+			clearTimeout(timer);
+			resolvePromise(code === 0);
+		});
+	});
+}
+/**
+* Build the default readiness policy over a binary path: skip when the
+* binary has already proven runnable in this process, validate an existing
+* file before trusting it (a stale or wrong-arch binary must not disable
+* the reinstall), and re-fetch the current platform binary otherwise.
+*/
+function createBinaryReadiness(executable, seams = {}) {
+	const exists = seams.exists ?? existsSync;
+	const runs = seams.runs ?? binaryRuns;
+	const installBinary = seams.install ?? install;
+	const validated = /* @__PURE__ */ new Set();
+	return async () => {
+		if (validated.has(executable)) return;
+		if (exists(executable) && await runs(executable)) {
+			validated.add(executable);
+			return;
+		}
+		await installBinary(executable);
+		if (!await runs(executable)) throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+		validated.add(executable);
+	};
+}
+/** The readiness policy the manager uses by default: the package's real binary path. */
+const defaultBinaryReadiness = createBinaryReadiness(bin);
+/** Default binary readiness: keep a working platform binary at `bin`. */
 async function defaultEnsureBinary() {
-	if (existsSync(bin)) return;
-	await install(bin);
+	await defaultBinaryReadiness();
 }
 /** The flags every tunnel mode shares (see the quick factory comment). */
 const SHARED_TUNNEL_FLAGS = {

package/lib/types/client/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAA;AAelG,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAqBrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC/F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAErE,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf;;;;WAIG;QACH,aAAa,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;SAAE,CAAA;KAC1E;CACF;AAYD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAyQ9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/index.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAA;AAelG,OAAO,EAAU,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAmBrD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACrE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAC/F,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAErE,OAAO,QAAQ,kCAAkC,CAAC;IAChD,UAAU,kBAAkB;QAC1B,0CAA0C;QAC1C,MAAM,EAAE,SAAS,CAAA;KAClB;IAED,UAAU,OAAO;QACf;;;;WAIG;QACH;;;;;WAKG;QACH,oBAAoB,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,4BAA4B,CAAA;SAAE,CAAA;KAC3F;CACF;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,oEAAoE;IACpE,IAAI,EAAE,OAAO,CAAA;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,4BAA4B;IAC3C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,KAAK,CAAA;CACjB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf;;;;WAIG;QACH,aAAa,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;SAAE,CAAA;KAC1E;CACF;AAYD,wCAAwC;AACxC,eAAO,MAAM,MAAM,UAA+D,CAAA;AAElF;;;GAGG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAiR9C"}

package/lib/types/client/index.js

@@ -3,8 +3,8 @@
  * sidebar-foot entry (phone trigger + pairing panel + update trigger), and
  * the pair boot flow (accept + presence heartbeats) plus the one-time
  * failed-pair notice. The portrait-touch adaptation of the official UI
- * starts at module scope (startMobileAdapt) so its focus guard is installed
- * before the app boots. Export discipline: packages/client/AGENTS.md — the
+ * starts under the plugin lifecycle (startMobileAdapt inside apply) and reverts
+ * on dispose, so disabled plugin entries stay inert. Export discipline: packages/client/AGENTS.md — the
  * /client surface carries only what cordis loading needs plus types.
  */
 import { createElement } from 'react';
@@ -19,11 +19,6 @@ import { channelTransition, installRemoteChannel, isLoopbackHostname, remoteChan
 import { FenceNotice } from "./FenceNotice.js";
 import { reportDailyHeartbeat } from "./telemetry.js";
 import { startMobileAdapt } from "./mobile-adapt.js";
-// Portrait-touch adaptation of the official UI: installed at module scope so
-// the composer focus guard exists before any app entry mounts React. The
-// layer self-evaluates and reverts with the viewport; the plugin apply below
-// wires its toggleSidebar onto the official layout service.
-startMobileAdapt();
 /** Dictionary namespace owned by this plugin. */
 const NS = 'remote';
 /** Settings namespace the remote-control card edits (the Host plugin registers it). */
@@ -37,6 +32,14 @@ export const inject = ['slots', 'locale', 'connection', 'settingsScope', 'remote
  * @param ctx - client root context.
  */
 export function apply(ctx) {
+    // Portrait-touch adaptation of the official UI: installed under the plugin
+    // lifecycle so disabling the plugin in cordis patch (disabled: true) never
+    // injects mobile CSS, gesture hooks, or the whale floating button.
+    startMobileAdapt();
+    ctx.effect(() => () => {
+        ;
+        window.__dshRemoteAdapt?.setEnabled?.(false);
+    }, 'remote-web-ui: mobile-adapt');
     // Anonymous install heartbeat (docs/telemetry.md): one beat per browser per
     // UTC day, package name only, silent failure.
     reportDailyHeartbeat([{ name: '@linxin666/dsh-remote-web-ui' }]);

package/lib/types/lan-bind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lan-bind.d.ts","sourceRoot":"","sources":["../../src/lan-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,eAAO,MAAM,oBAAoB,mEAAmE,CAAA;AACpG,eAAO,MAAM,kBAAkB,+CAA+C,CAAA;AAE9E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAA;AAEjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAUlF;AAYD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAcpE;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW3E;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAI/H;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAW7G"}
+{"version":3,"file":"lan-bind.d.ts","sourceRoot":"","sources":["../../src/lan-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,eAAO,MAAM,oBAAoB,mEAAmE,CAAA;AACpG,eAAO,MAAM,kBAAkB,+CAA+C,CAAA;AAE9E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAA;AAEjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAUlF;AAYD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAcpE;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW3E;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAI/H;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAa7G"}

package/lib/types/lan-bind.js

@@ -118,8 +118,10 @@ export function writeLanBind(host, port, profile, home = dshHome()) {
     const file = profilePatchFile(profile, home);
     const stripped = stripManagedBlock(readPatchContent(file));
     const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN);
-    const base = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd();
-    const content = `${base}\n\n${managedBlock(host, port)}`;
+    const rawBase = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd();
+    const base = rawBase.replace(/\[\s*\]\s*$/, '').trimEnd();
+    const block = managedBlock(host, port);
+    const content = base.length > 0 ? `${base}\n\n${block}` : block;
     const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
     mkdirSync(dirname(file), { recursive: true });
     const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;

package/lib/types/tunnel.d.ts

@@ -1,6 +1,8 @@
 /**
  * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
- * npm package — its postinstall downloads the platform binary, so no
+ * npm package — its postinstall downloads the platform binary and the
+ * readiness policy below validates it and re-fetches when it cannot run (the
+ * desktop payload stages one tree for every shipped OS/arch), so no
  * user-side tooling is involved — surfaces the public URL, and restarts the
  * process after unexpected exits with exponential backoff. Two modes: the
  * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
@@ -84,6 +86,27 @@ export interface TunnelManagerOptions {
         clearTimeout(t: unknown): void;
     };
 }
+/**
+ * Probe whether the binary at `path` actually executes on this machine. The
+ * desktop payload stages one dependency tree for every shipped OS/arch, so a
+ * binary can exist with the wrong architecture (the arm64 darwin
+ * `bin/cloudflared` on an x64 mac); existence alone must not skip the
+ * reinstall.
+ */
+export declare function binaryRuns(executable: string): Promise<boolean>;
+/** Injectable seams of the default binary readiness (tests swap them all). */
+export interface BinaryReadinessSeams {
+    exists?: (path: string) => boolean;
+    runs?: (executable: string) => Promise<boolean>;
+    install?: (path: string) => Promise<unknown>;
+}
+/**
+ * Build the default readiness policy over a binary path: skip when the
+ * binary has already proven runnable in this process, validate an existing
+ * file before trusting it (a stale or wrong-arch binary must not disable
+ * the reinstall), and re-fetch the current platform binary otherwise.
+ */
+export declare function createBinaryReadiness(executable: string, seams?: BinaryReadinessSeams): () => Promise<void>;
 /**
  * Spawn flags for one quick target. `originHostHeader` stamps the Host the
  * local webserver sees: the plugin's phone-facing fence trusts the configured

package/lib/types/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAWD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAqBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,0EAA0E;AAC1E,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEvE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAA;AAQvD,6EAA6E;AAC7E,UAAU,kBAAkB;IAC1B,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAA;IACrD,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAA;IAClG,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAA;IAC7D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CA4B5F;AAED,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAA;IAClB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC9D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAA;IAC/D,IAAI,IAAI,OAAO,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,YAAY,CAAA;IAChD,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,KAAK,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU/D;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,GAAE,oBAAyB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAiB/G;AAaD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAI5F;AAqBD;;;GAGG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqF;IAE3G,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAI;IAGpB,OAAO,CAAC,UAAU,CAAI;IACtB,OAAO,CAAC,QAAQ,CAAQ;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwC;IAEvE;;OAEG;gBACS,OAAO,GAAE,oBAAyB;IAS9C,gCAAgC;IAChC,IAAI,IAAI,IAAI,UAAU,CAMrB;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI;IAW1C,uDAAuD;IACvD,IAAI,IAAI,IAAI;IAOZ,wDAAwD;IACxD,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKzD,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,IAAI;IAqBZ,iFAAiF;IACjF,OAAO,CAAC,QAAQ;IAgBhB,OAAO,CAAC,QAAQ;CAWjB"}

package/lib/types/tunnel.js

@@ -1,6 +1,8 @@
 /**
  * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
- * npm package — its postinstall downloads the platform binary, so no
+ * npm package — its postinstall downloads the platform binary and the
+ * readiness policy below validates it and re-fetches when it cannot run (the
+ * desktop payload stages one tree for every shipped OS/arch), so no
  * user-side tooling is involved — surfaces the public URL, and restarts the
  * process after unexpected exits with exponential backoff. Two modes: the
  * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
@@ -15,6 +17,7 @@
  * a real binary or network.
  */
 import { existsSync } from 'node:fs';
+import { spawn } from 'node:child_process';
 import { EventEmitter } from 'node:events';
 import { bin, install, Tunnel } from 'cloudflared';
 /** Compare two targets for the start idempotence check. */
@@ -62,11 +65,56 @@ export function namedTunnelHandle(inner, publicUrl) {
     };
     return handle;
 }
-/** Default binary readiness: download the platform binary on first use. */
+/** Time box for the `--version` probe that validates a staged binary. */
+const BINARY_PROBE_TIMEOUT_MS = 10_000;
+/**
+ * Probe whether the binary at `path` actually executes on this machine. The
+ * desktop payload stages one dependency tree for every shipped OS/arch, so a
+ * binary can exist with the wrong architecture (the arm64 darwin
+ * `bin/cloudflared` on an x64 mac); existence alone must not skip the
+ * reinstall.
+ */
+export function binaryRuns(executable) {
+    return new Promise((resolvePromise) => {
+        const child = spawn(executable, ['--version'], { stdio: 'ignore' });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            resolvePromise(false);
+        }, BINARY_PROBE_TIMEOUT_MS);
+        child.once('error', () => { clearTimeout(timer); resolvePromise(false); });
+        child.once('exit', (code) => { clearTimeout(timer); resolvePromise(code === 0); });
+    });
+}
+/**
+ * Build the default readiness policy over a binary path: skip when the
+ * binary has already proven runnable in this process, validate an existing
+ * file before trusting it (a stale or wrong-arch binary must not disable
+ * the reinstall), and re-fetch the current platform binary otherwise.
+ */
+export function createBinaryReadiness(executable, seams = {}) {
+    const exists = seams.exists ?? existsSync;
+    const runs = seams.runs ?? binaryRuns;
+    const installBinary = seams.install ?? install;
+    const validated = new Set();
+    return async () => {
+        if (validated.has(executable))
+            return;
+        if (exists(executable) && await runs(executable)) {
+            validated.add(executable);
+            return;
+        }
+        await installBinary(executable);
+        if (!(await runs(executable))) {
+            throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+        }
+        validated.add(executable);
+    };
+}
+/** The readiness policy the manager uses by default: the package's real binary path. */
+const defaultBinaryReadiness = createBinaryReadiness(bin);
+/** Default binary readiness: keep a working platform binary at `bin`. */
 async function defaultEnsureBinary() {
-    if (existsSync(bin))
-        return;
-    await install(bin);
+    await defaultBinaryReadiness();
 }
 /** The flags every tunnel mode shares (see the quick factory comment). */
 const SHARED_TUNNEL_FLAGS = { '--no-autoupdate': true, '--protocol': 'http2' };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.3.15",
+  "version": "0.3.17",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/index.ts

@@ -3,8 +3,8 @@
  * sidebar-foot entry (phone trigger + pairing panel + update trigger), and
  * the pair boot flow (accept + presence heartbeats) plus the one-time
  * failed-pair notice. The portrait-touch adaptation of the official UI
- * starts at module scope (startMobileAdapt) so its focus guard is installed
- * before the app boots. Export discipline: packages/client/AGENTS.md — the
+ * starts under the plugin lifecycle (startMobileAdapt inside apply) and reverts
+ * on dispose, so disabled plugin entries stay inert. Export discipline: packages/client/AGENTS.md — the
  * /client surface carries only what cordis loading needs plus types.
  */
 import { createElement } from 'react'
@@ -40,11 +40,9 @@ import { FenceNotice } from './FenceNotice.tsx'
 import { reportDailyHeartbeat } from './telemetry.ts'
 import { startMobileAdapt, type RemoteAdaptGlobal } from './mobile-adapt.ts'
 
-// Portrait-touch adaptation of the official UI: installed at module scope so
-// the composer focus guard exists before any app entry mounts React. The
-// layer self-evaluates and reverts with the viewport; the plugin apply below
-// wires its toggleSidebar onto the official layout service.
-startMobileAdapt()
+// Portrait-touch adaptation of the official UI: installed under the plugin
+// lifecycle (apply) so disabling the plugin in cordis patch (disabled: true)
+// leaves the DOM untouched.
 
 export type { RemoteEntryProps } from './RemoteEntry.tsx'
 export type { PanelState, RemotePanelProps } from './RemotePanel.tsx'
@@ -117,6 +115,14 @@ export const inject = ['slots', 'locale', 'connection', 'settingsScope', 'remote
  * @param ctx - client root context.
  */
 export function apply(ctx: ClientContext): void {
+  // Portrait-touch adaptation of the official UI: installed under the plugin
+  // lifecycle so disabling the plugin in cordis patch (disabled: true) never
+  // injects mobile CSS, gesture hooks, or the whale floating button.
+  startMobileAdapt()
+  ctx.effect(() => () => {
+    ;(window as unknown as { __dshRemoteAdapt?: RemoteAdaptGlobal }).__dshRemoteAdapt?.setEnabled?.(false)
+  }, 'remote-web-ui: mobile-adapt')
+
   // Anonymous install heartbeat (docs/telemetry.md): one beat per browser per
   // UTC day, package name only, silent failure.
   reportDailyHeartbeat([{ name: '@linxin666/dsh-remote-web-ui' }])

package/src/lan-bind.ts

@@ -135,8 +135,10 @@ export function writeLanBind(host: LanBindHost, port: number, profile: string, h
   const file = profilePatchFile(profile, home)
   const stripped = stripManagedBlock(readPatchContent(file))
   const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN)
-  const base = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()
-  const content = `${base}\n\n${managedBlock(host, port)}`
+  const rawBase = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()
+  const base = rawBase.replace(/\[\s*\]\s*$/, '').trimEnd()
+  const block = managedBlock(host, port)
+  const content = base.length > 0 ? `${base}\n\n${block}` : block
   const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600
   mkdirSync(dirname(file), { recursive: true })
   const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`

package/src/tunnel.ts

@@ -1,6 +1,8 @@
 /**
  * Auto-tunnel manager: spawns a Cloudflare tunnel through the `cloudflared`
- * npm package — its postinstall downloads the platform binary, so no
+ * npm package — its postinstall downloads the platform binary and the
+ * readiness policy below validates it and re-fetches when it cannot run (the
+ * desktop payload stages one tree for every shipped OS/arch), so no
  * user-side tooling is involved — surfaces the public URL, and restarts the
  * process after unexpected exits with exponential backoff. Two modes: the
  * accountless quick tunnel (`https://xxx.trycloudflare.com`, hostname minted
@@ -16,6 +18,7 @@
  */
 
 import { existsSync } from 'node:fs'
+import { spawn } from 'node:child_process'
 import { EventEmitter } from 'node:events'
 import { bin, install, Tunnel } from 'cloudflared'
 
@@ -121,10 +124,66 @@ export interface TunnelManagerOptions {
   timer?: { setTimeout(fn: () => void, ms: number): unknown; clearTimeout(t: unknown): void }
 }
 
-/** Default binary readiness: download the platform binary on first use. */
+/** Time box for the `--version` probe that validates a staged binary. */
+const BINARY_PROBE_TIMEOUT_MS = 10_000
+
+/**
+ * Probe whether the binary at `path` actually executes on this machine. The
+ * desktop payload stages one dependency tree for every shipped OS/arch, so a
+ * binary can exist with the wrong architecture (the arm64 darwin
+ * `bin/cloudflared` on an x64 mac); existence alone must not skip the
+ * reinstall.
+ */
+export function binaryRuns(executable: string): Promise<boolean> {
+  return new Promise((resolvePromise) => {
+    const child = spawn(executable, ['--version'], { stdio: 'ignore' })
+    const timer = setTimeout(() => {
+      child.kill('SIGKILL')
+      resolvePromise(false)
+    }, BINARY_PROBE_TIMEOUT_MS)
+    child.once('error', () => { clearTimeout(timer); resolvePromise(false) })
+    child.once('exit', (code) => { clearTimeout(timer); resolvePromise(code === 0) })
+  })
+}
+
+/** Injectable seams of the default binary readiness (tests swap them all). */
+export interface BinaryReadinessSeams {
+  exists?: (path: string) => boolean
+  runs?: (executable: string) => Promise<boolean>
+  install?: (path: string) => Promise<unknown>
+}
+
+/**
+ * Build the default readiness policy over a binary path: skip when the
+ * binary has already proven runnable in this process, validate an existing
+ * file before trusting it (a stale or wrong-arch binary must not disable
+ * the reinstall), and re-fetch the current platform binary otherwise.
+ */
+export function createBinaryReadiness(executable: string, seams: BinaryReadinessSeams = {}): () => Promise<void> {
+  const exists = seams.exists ?? existsSync
+  const runs = seams.runs ?? binaryRuns
+  const installBinary = seams.install ?? install
+  const validated = new Set<string>()
+  return async () => {
+    if (validated.has(executable)) return
+    if (exists(executable) && await runs(executable)) {
+      validated.add(executable)
+      return
+    }
+    await installBinary(executable)
+    if (!(await runs(executable))) {
+      throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`)
+    }
+    validated.add(executable)
+  }
+}
+
+/** The readiness policy the manager uses by default: the package's real binary path. */
+const defaultBinaryReadiness = createBinaryReadiness(bin)
+
+/** Default binary readiness: keep a working platform binary at `bin`. */
 async function defaultEnsureBinary(): Promise<void> {
-  if (existsSync(bin)) return
-  await install(bin)
+  await defaultBinaryReadiness()
 }
 
 /** The flags every tunnel mode shares (see the quick factory comment). */