@linxin666/dsh-remote-web-ui 0.3.22 → 0.3.23

package/lib/index.js

@@ -3158,6 +3158,114 @@ var TunnelManager = class {
 		} catch {}
 	}
 };
+//#endregion
+//#region src/public-base.ts
+/**
+* The public base the pairing fence trusts while a tunnel is not running
+* (issue #1547).
+*
+* The fence reads exactly one public host: `service.publicBaseUrl`. Dropping
+* it the instant the tunnel leaves `running` makes every public request from
+* the address still printed in the QR code answer 403 — including
+* `/api/pair/status`, which exists to be callable before pairing. Two of the
+* three tunnel modes never lose their host: a named tunnel keeps its fixed
+* dashboard hostname, and a registered relay keeps its stable subdomain. A
+* quick tunnel does mint a new hostname on restart, so its previous host is
+* kept only for a bounded grace window: Cloudflare's edge can still deliver a
+* connection the phone already opened, and a mobile network reconnects
+* constantly, so an instant drop turns the phone's retry into a silent 403.
+* @module @linxin666/dsh-remote-web-ui/public-base
+*/
+/** How long a quick-tunnel host stays trusted after the tunnel stops running. */
+const PUBLIC_BASE_GRACE_MS = 6e4;
+/**
+* Owns the trusted public base across tunnel and relay transitions.
+*
+* The keeper never decides on its own to widen trust: it only postpones
+* dropping an address the operator (named/relay) or the tunnel (quick) had
+* already published, and it forgets it once the tunnel comes back with the
+* address that actually serves the QR.
+*/
+var PublicBaseKeeper = class {
+	onChange;
+	graceMs;
+	mode = "off";
+	tunnelUrl;
+	relayUrl;
+	graceTimer;
+	/**
+	* @param onChange - receives the base the fence should trust from now on.
+	* @param graceMs - how long a quick-tunnel host outlives its tunnel.
+	*/
+	constructor(onChange, graceMs = PUBLIC_BASE_GRACE_MS) {
+		this.onChange = onChange;
+		this.graceMs = graceMs;
+	}
+	/** The base a fresh fence read should trust: the stable relay origin wins. */
+	current() {
+		return this.relayUrl ?? this.tunnelUrl;
+	}
+	/** The mode that currently owns the public base. */
+	setMode(mode) {
+		this.mode = mode;
+	}
+	/** The last quick-tunnel URL, for callers that must announce it downstream. */
+	quickUrl() {
+		return this.tunnelUrl;
+	}
+	/** A relay registration result; undefined withdraws the stable origin. */
+	setRelay(url) {
+		this.relayUrl = url;
+		this.emit();
+	}
+	/** The tunnel reported a live URL: it supersedes any pending grace. */
+	markRunning(url) {
+		this.cancelGrace();
+		this.tunnelUrl = url;
+		this.emit();
+	}
+	/**
+	* The tunnel left `running` (starting again, or failed). A named tunnel's
+	* fixed hostname stays trusted; a quick tunnel's previous host stays
+	* trusted for the grace window, then is dropped if nothing replaced it.
+	*/
+	markReconnecting() {
+		if (this.mode === "named") return;
+		this.startGrace();
+	}
+	/** Re-publish the current base after a branch change that did not move it. */
+	refresh() {
+		this.emit();
+	}
+	/** Forget everything (teardown, or a mode change that stops the tunnel). */
+	reset() {
+		this.cancelGrace();
+		this.tunnelUrl = void 0;
+		this.relayUrl = void 0;
+		this.emit();
+	}
+	/** Cancel the pending grace timer; the keeper keeps its last base. */
+	dispose() {
+		this.cancelGrace();
+	}
+	startGrace() {
+		if (this.tunnelUrl === void 0) return;
+		if (this.graceTimer !== void 0) return;
+		this.graceTimer = setTimeout(() => {
+			this.graceTimer = void 0;
+			this.tunnelUrl = void 0;
+			this.emit();
+		}, this.graceMs);
+	}
+	cancelGrace() {
+		if (this.graceTimer === void 0) return;
+		clearTimeout(this.graceTimer);
+		this.graceTimer = void 0;
+	}
+	emit() {
+		this.onChange(this.current());
+	}
+};
 /** The aggregate package that is the canonical update entry point. */
 const AGGREGATE_PACKAGE = "@linxin666/dsh-web-all";
 /** Fallback anchor: this plugin's own package when the aggregate is absent. */
@@ -3859,7 +3967,9 @@ const REMOTE_CHANNEL_RULES = {
 	],
 	deviceHeader: REMOTE_DEVICE_HEADER,
 	deviceKey: "dsh-remote-device",
-	deviceQuery: REMOTE_DEVICE_QUERY
+	deviceQuery: REMOTE_DEVICE_QUERY,
+	uploadPath: "/api/session/uploadFileBinary",
+	uploadHookGlobal: "__DSH_FILE_UPLOAD__"
 };
 /** The window global the boot patch publishes its seat under. */
 const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
@@ -3884,8 +3994,11 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
 * connection plugin reads it: the paired remote desktop gets the full
 * settings/credentials/presets surface, and every call still rides the
-* gated /remote channel. The script self-skips on loopback origins and
-* never throws.
+* gated /remote channel. It finally publishes the official pre-Cordis
+* upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
+* transport otherwise runs inside a Web Worker whose own globals the
+* main-thread rewrite cannot reach (issue #1580). The script self-skips on
+* loopback origins and never throws.
 * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
 */
 /**
@@ -3896,7 +4009,7 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
 	const json = JSON.stringify(rules);
 	const seat = JSON.stringify(REMOTE_CHANNEL_BOOT_GLOBAL);
-	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
+	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);function uf(u,init){var raw=typeof u===\"string\"?u:u.href;if(typeof raw!==\"string\")return of.call(w,u,init||{});var q=new URL(raw,loc.href);if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});return of.call(w,u,init||{})}try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
 }
 /** Boot-watchdog latch: one self-reload per session while the boot is broken. */
 const BOOT_WATCHDOG_KEY = "dsh-remote-boot-reload";
@@ -4079,17 +4192,20 @@ function applyImpl(ctx, config) {
 	const service = new PairingService(pairingConfigOf(resolved));
 	const tunnel = new TunnelManager();
 	let relayRegistrar;
-	let relayUrl;
-	let rawTunnelUrl;
+	/**
+	* The public base the pairing fence trusts. A tunnel reconnect must not
+	* strip the host the QR still shows: named and relay hosts never change,
+	* and a quick tunnel's host survives a bounded grace window (issue #1547).
+	*/
+	const publicBase = new PublicBaseKeeper((base) => {
+		service.setPublicBaseUrl(base);
+	});
 	/** The tunnel target the registrar last announced (dedupes sync re-runs). */
 	let relayAnnouncedFor;
-	const setPublicBase = () => {
-		service.setPublicBaseUrl(relayUrl ?? rawTunnelUrl);
-	};
 	const disposeRelayRegistrar = (unregister = false) => {
 		const registrar = relayRegistrar;
 		relayRegistrar = void 0;
-		relayUrl = void 0;
+		publicBase.setRelay(void 0);
 		relayAnnouncedFor = void 0;
 		if (registrar === void 0) return;
 		if (unregister) registrar.unregister().catch(() => void 0);
@@ -4100,10 +4216,9 @@ function applyImpl(ctx, config) {
 		if (relayRegistrar === void 0) try {
 			relayRegistrar = new RelayRegistrar(loadRelayIdentity(resolve().profile), (state) => {
 				service.setRelayStatus(state.state === "off" ? void 0 : state);
-				if (state.state === "running") relayUrl = state.url;
-				else if (state.state === "off") relayUrl = void 0;
+				if (state.state === "running") publicBase.setRelay(state.url);
+				else if (state.state === "off") publicBase.setRelay(void 0);
 				else if (state.state === "failed") console.warn(`remote-web-ui: relay registration failed (${state.error}) — the stable origin may serve its offline page until the retry lands`);
-				setPublicBase();
 			});
 		} catch (error) {
 			console.warn(`remote-web-ui: relay registry unavailable (${error instanceof Error ? error.message : String(error)}) — the quick URL is the QR base`);
@@ -4119,8 +4234,7 @@ function applyImpl(ctx, config) {
 	tunnel.onPhase((info) => {
 		if (tunnelMode === "off") return;
 		if (info.phase === "running" && info.url !== void 0) {
-			rawTunnelUrl = info.url;
-			setPublicBase();
+			publicBase.markRunning(info.url);
 			service.setTunnelStatus({
 				state: "running",
 				url: info.url
@@ -4129,13 +4243,10 @@ function applyImpl(ctx, config) {
 			if (registrar !== void 0) announceRelay(registrar, info.url);
 			runPostureProbe();
 		} else if (info.phase === "starting") {
-			rawTunnelUrl = void 0;
-			relayUrl = void 0;
-			setPublicBase();
+			publicBase.markReconnecting();
 			service.setTunnelStatus({ state: "starting" });
 		} else if (info.phase === "failed") {
-			rawTunnelUrl = void 0;
-			setPublicBase();
+			publicBase.markReconnecting();
 			service.setTunnelStatus(info.error === void 0 ? { state: "failed" } : {
 				state: "failed",
 				error: info.error
@@ -4144,6 +4255,7 @@ function applyImpl(ctx, config) {
 	});
 	ctx.effect(() => () => {
 		disposeRelayRegistrar();
+		publicBase.dispose();
 		tunnel.dispose();
 	}, "remote-web-ui: auto tunnel");
 	if ((ctx.webServer.host === "0.0.0.0" || ctx.webServer.host === "127.0.0.1") && Number.isFinite(ctx.webServer.port)) {
@@ -4391,15 +4503,17 @@ function applyImpl(ctx, config) {
 		}
 		const plan = tunnelPlanOf(value, ctx.webServer.port);
 		tunnelMode = plan.mode;
+		publicBase.setMode(plan.mode);
+		const liveTunnelUrl = publicBase.quickUrl();
 		if (plan.mode !== "quick") {
 			disposeRelayRegistrar();
-			if (plan.mode !== "named") setPublicBase();
+			if (plan.mode !== "named") publicBase.refresh();
 		} else if (value.relay === false) {
 			disposeRelayRegistrar(true);
-			setPublicBase();
-		} else if (rawTunnelUrl !== void 0) {
+			publicBase.refresh();
+		} else if (liveTunnelUrl !== void 0) {
 			const registrar = ensureRelayRegistrar();
-			if (registrar !== void 0) announceRelay(registrar, rawTunnelUrl);
+			if (registrar !== void 0) announceRelay(registrar, liveTunnelUrl);
 		}
 		if (plan.mode === "quick") {
 			for (const ignored of plan.ignored) console.warn(`remote-web-ui: autoTunnel is on — ignoring the configured ${ignored}`);

package/lib/types/client/remote-channel.d.ts

@@ -100,6 +100,41 @@ export declare function isUnpairedDenied(response: Response): Promise<boolean>;
  * @returns a function restoring the originals.
  */
 export declare function installRemoteChannel(window: ChannelWindow, options?: RemoteChannelOptions): () => void;
+/** Page global the official pre-Cordis upload hook is published under. */
+export declare const FILE_UPLOAD_HOOK_GLOBAL = "__DSH_FILE_UPLOAD__";
+/** The subset of window the upload hook needs (injectable for tests). */
+export interface UploadHookWindow {
+    fetch: typeof globalThis.fetch;
+    location: {
+        href: string;
+        origin: string;
+    };
+    /** Pre-existing hook owner; left untouched when present. */
+    __DSH_FILE_UPLOAD__?: {
+        fetch: (input: string | URL, init?: RequestInit) => Promise<Response>;
+    };
+}
+/**
+ * Publish the official pre-Cordis upload hook so background uploads keep
+ * riding the patched main-thread fetch (issue #1580).
+ *
+ * `@deepseek-ai/dsh-client-file-upload` reads `globalThis.__DSH_FILE_UPLOAD__`
+ * once when its runtime is constructed; without it the carrier is a Web
+ * Worker, whose own globals no main-thread patch reaches. That worker's XHR
+ * goes straight to `<origin>/api/session/uploadFileBinary` with neither the
+ * `/remote` rewrite nor the cookieless device credential, so the harness
+ * browser-auth fence answers 401 and every upload from a paired browser
+ * fails. Rewriting the worker URL cannot fix it: a worker context carries
+ * neither the pairing cookie nor the device header.
+ *
+ * The hook hands the runtime the same transport the rest of the page uses -
+ * the boot script publishes an identical one (remote-channel-boot.ts), and
+ * this is the fallback for pages served without it.
+ *
+ * @param window - the browser window (or a test double), BEFORE the channel patch.
+ * @returns a function retiring the hook (a pre-existing one is left alone).
+ */
+export declare function installFileUploadHook(window: UploadHookWindow): () => void;
 /**
  * The remote-channel lifecycle transition between two steady states:
  * running (active + installed) and retired (inactive + not installed).

package/lib/types/client/remote-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel.d.ts","sourceRoot":"","sources":["../../../src/client/remote-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,iBAAiB,EAEjB,aAAa,EACd,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAIvE,qEAAqE;AACrE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAA;IACpD,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC9D;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,6BAA6B,EACvC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcnF;AAED,wEAAwE;AACxE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAA;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACzD;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAoBD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAmG1G;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE7D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAIxF"}
+{"version":3,"file":"remote-channel.d.ts","sourceRoot":"","sources":["../../../src/client/remote-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,iBAAiB,EAEjB,aAAa,EACd,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAIvE,qEAAqE;AACrE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,MAAM,CAAA;IACpD,KAAK,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC9D;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,6BAA6B,EACvC,iBAAiB,EAAE,OAAO,GAAG,SAAS,GACrC,OAAO,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAShE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAcnF;AAED,wEAAwE;AACxE,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,SAAS,EAAE,OAAO,SAAS,CAAA;IAC3B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAA;IAChC,gBAAgB,CAAC,EAAE,cAAc,CAAA;IACjC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,cAAc,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CACzD;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAoB;IACnC,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,IAAI,CAAA;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAA;CACtB;AAoBD;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAO3E;AA0BD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAuG1G;AAED,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,wBAAwB,CAAA;AAE5D,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;IAC9B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE;QACpB,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;KACtE,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,IAAI,CAyB1E;AAED;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAA;AAE7D;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAIxF"}

package/lib/types/client/remote-channel.js

@@ -172,6 +172,9 @@ export function installRemoteChannel(window, options = {}) {
     const originalFetch = window.fetch;
     const OriginalWebSocket = window.WebSocket;
     const OriginalEventSource = window.EventSource;
+    // Publish the official upload hook before the file-upload service reads it
+    // (issue #1580); removed again by the restore below.
+    const restoreUploadHook = installFileUploadHook(window);
     const sameOrigin = (url) => url.origin === window.location.origin;
     const rewrite = (raw) => rewriteRawUrl(raw, window.location.href, window.location.origin);
     // The cookieless device credential (set by the /pair-app capture script):
@@ -266,6 +269,58 @@ export function installRemoteChannel(window, options = {}) {
             window.EventSource = OriginalEventSource;
         for (const restore of restoreSrc)
             restore();
+        restoreUploadHook();
+    };
+}
+/** Page global the official pre-Cordis upload hook is published under. */
+export const FILE_UPLOAD_HOOK_GLOBAL = '__DSH_FILE_UPLOAD__';
+/**
+ * Publish the official pre-Cordis upload hook so background uploads keep
+ * riding the patched main-thread fetch (issue #1580).
+ *
+ * `@deepseek-ai/dsh-client-file-upload` reads `globalThis.__DSH_FILE_UPLOAD__`
+ * once when its runtime is constructed; without it the carrier is a Web
+ * Worker, whose own globals no main-thread patch reaches. That worker's XHR
+ * goes straight to `<origin>/api/session/uploadFileBinary` with neither the
+ * `/remote` rewrite nor the cookieless device credential, so the harness
+ * browser-auth fence answers 401 and every upload from a paired browser
+ * fails. Rewriting the worker URL cannot fix it: a worker context carries
+ * neither the pairing cookie nor the device header.
+ *
+ * The hook hands the runtime the same transport the rest of the page uses -
+ * the boot script publishes an identical one (remote-channel-boot.ts), and
+ * this is the fallback for pages served without it.
+ *
+ * @param window - the browser window (or a test double), BEFORE the channel patch.
+ * @returns a function retiring the hook (a pre-existing one is left alone).
+ */
+export function installFileUploadHook(window) {
+    if (window.__DSH_FILE_UPLOAD__ !== undefined)
+        return () => { };
+    const originalFetch = window.fetch;
+    const hook = {
+        fetch: (input, init) => {
+            const raw = typeof input === 'string' ? input : input.href;
+            let url;
+            try {
+                url = new URL(raw, window.location.href);
+            }
+            catch {
+                return originalFetch.call(window, input, init);
+            }
+            // Delegate the whole decision to the patched fetch: rewriting the path
+            // here first would make it skip its own rewrite branch and drop the
+            // device credential the fence requires.
+            if (url.origin === window.location.origin && url.pathname === RULES.uploadPath) {
+                return window.fetch.call(window, raw, init);
+            }
+            return originalFetch.call(window, input, init);
+        },
+    };
+    window.__DSH_FILE_UPLOAD__ = hook;
+    return () => {
+        if (window.__DSH_FILE_UPLOAD__ === hook)
+            delete window.__DSH_FILE_UPLOAD__;
     };
 }
 /**

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,aAAa,CAAA;AAO3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAgCzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAgB3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACvI,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAqBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAimBtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,aAAa,CAAA;AAO3B,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAiCzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAgB3B,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACvI,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAqBD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAomBtD"}

package/lib/types/index.js

@@ -27,6 +27,7 @@ import { loadRelayIdentity, RelayRegistrar } from "./relay-registry.js";
 import { desiredBindHost, desiredBindPort, firewallActionNeeded, pendingRestartOf } from "./lan-bind-plan.js";
 import { createInnerAuth } from "./inner-auth.js";
 import { TunnelManager } from "./tunnel.js";
+import { PublicBaseKeeper } from "./public-base.js";
 import { checkUpdates, fetchGitHubReleaseNotes, fetchLatestVersion, RELEASE_NOTES_CACHE_TTL_MS, resolveAnchorManifest, resolveUpdateTarget, runUpdateVerified, } from "./update.js";
 import { makeUpdateRoutes } from "./update-routes.js";
 import { mountOnce } from "./mount-once.js";
@@ -162,17 +163,18 @@ function applyImpl(ctx, config) {
     // raw quick URL is used, exactly as before. Named tunnels keep their fixed
     // dashboard hostname and never touch the relay.
     let relayRegistrar;
-    let relayUrl;
-    let rawTunnelUrl;
+    /**
+     * The public base the pairing fence trusts. A tunnel reconnect must not
+     * strip the host the QR still shows: named and relay hosts never change,
+     * and a quick tunnel's host survives a bounded grace window (issue #1547).
+     */
+    const publicBase = new PublicBaseKeeper((base) => { service.setPublicBaseUrl(base); });
     /** The tunnel target the registrar last announced (dedupes sync re-runs). */
     let relayAnnouncedFor;
-    const setPublicBase = () => {
-        service.setPublicBaseUrl(relayUrl ?? rawTunnelUrl);
-    };
     const disposeRelayRegistrar = (unregister = false) => {
         const registrar = relayRegistrar;
         relayRegistrar = undefined;
-        relayUrl = undefined;
+        publicBase.setRelay(undefined);
         relayAnnouncedFor = undefined;
         if (registrar === undefined)
             return;
@@ -193,10 +195,10 @@ function applyImpl(ctx, config) {
                 relayRegistrar = new RelayRegistrar(identity, (state) => {
                     service.setRelayStatus(state.state === 'off' ? undefined : state);
                     if (state.state === 'running') {
-                        relayUrl = state.url;
+                        publicBase.setRelay(state.url);
                     }
                     else if (state.state === 'off') {
-                        relayUrl = undefined;
+                        publicBase.setRelay(undefined);
                     }
                     else if (state.state === 'failed') {
                         // Keep the last relay URL on failures: the phone origin only
@@ -204,7 +206,6 @@ function applyImpl(ctx, config) {
                         // refresh call fails. The registrar retries with backoff.
                         console.warn(`remote-web-ui: relay registration failed (${state.error}) — the stable origin may serve its offline page until the retry lands`);
                     }
-                    setPublicBase();
                 });
             }
             catch (error) {
@@ -226,8 +227,7 @@ function applyImpl(ctx, config) {
         if (tunnelMode === 'off')
             return;
         if (info.phase === 'running' && info.url !== undefined) {
-            rawTunnelUrl = info.url;
-            setPublicBase();
+            publicBase.markRunning(info.url);
             service.setTunnelStatus({ state: 'running', url: info.url });
             const registrar = tunnelMode === 'quick' ? ensureRelayRegistrar() : undefined;
             if (registrar !== undefined)
@@ -235,21 +235,23 @@ function applyImpl(ctx, config) {
             runPostureProbe();
         }
         else if (info.phase === 'starting') {
-            // A restart mints a NEW hostname: the previous URL dies with the old
-            // process, so clear it now rather than advertising a dead link.
-            rawTunnelUrl = undefined;
-            relayUrl = undefined;
-            setPublicBase();
+            // A quick-tunnel restart mints a new hostname, but the old one is not
+            // dropped at once: the edge may still deliver a connection the phone
+            // already opened, and the reconnect usually lands inside the grace
+            // window (issue #1547). A named tunnel keeps its fixed hostname, and a
+            // registered relay its stable subdomain, so neither is ever dropped
+            // here — the previous code cleared the relay base on every restart.
+            publicBase.markReconnecting();
             service.setTunnelStatus({ state: 'starting' });
         }
         else if (info.phase === 'failed') {
-            rawTunnelUrl = undefined;
-            setPublicBase();
+            publicBase.markReconnecting();
             service.setTunnelStatus(info.error === undefined ? { state: 'failed' } : { state: 'failed', error: info.error });
         }
     });
     ctx.effect(() => () => {
         disposeRelayRegistrar();
+        publicBase.dispose();
         tunnel.dispose();
     }, 'remote-web-ui: auto tunnel');
     // The bind facts are known by now (webServer is an inject edge): the LAN
@@ -613,26 +615,28 @@ function applyImpl(ctx, config) {
         // publicBaseUrl applies only when no tunnel runs.
         const plan = tunnelPlanOf(value, ctx.webServer.port);
         tunnelMode = plan.mode;
+        publicBase.setMode(plan.mode);
+        const liveTunnelUrl = publicBase.quickUrl();
         if (plan.mode !== 'quick') {
             // The relay only fronts the quick tunnel; named mode owns its fixed
             // dashboard hostname and the off mode has no public base at all.
             disposeRelayRegistrar();
             if (plan.mode !== 'named')
-                setPublicBase();
+                publicBase.refresh();
         }
         else if (value.relay === false) {
             // The relay toggle is off: no stable origin, the raw quick URL is the
             // QR base exactly as before the relay existed.
             disposeRelayRegistrar(true);
-            setPublicBase();
+            publicBase.refresh();
         }
-        else if (rawTunnelUrl !== undefined) {
+        else if (liveTunnelUrl !== undefined) {
             // The relay just turned on (or the registrar is new) while the tunnel
             // already runs: announce now — no phase event will fire for an
             // unchanged target.
             const registrar = ensureRelayRegistrar();
             if (registrar !== undefined)
-                announceRelay(registrar, rawTunnelUrl);
+                announceRelay(registrar, liveTunnelUrl);
         }
         if (plan.mode === 'quick') {
             for (const ignored of plan.ignored) {

package/lib/types/public-base.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The public base the pairing fence trusts while a tunnel is not running
+ * (issue #1547).
+ *
+ * The fence reads exactly one public host: `service.publicBaseUrl`. Dropping
+ * it the instant the tunnel leaves `running` makes every public request from
+ * the address still printed in the QR code answer 403 — including
+ * `/api/pair/status`, which exists to be callable before pairing. Two of the
+ * three tunnel modes never lose their host: a named tunnel keeps its fixed
+ * dashboard hostname, and a registered relay keeps its stable subdomain. A
+ * quick tunnel does mint a new hostname on restart, so its previous host is
+ * kept only for a bounded grace window: Cloudflare's edge can still deliver a
+ * connection the phone already opened, and a mobile network reconnects
+ * constantly, so an instant drop turns the phone's retry into a silent 403.
+ * @module @linxin666/dsh-remote-web-ui/public-base
+ */
+/** How long a quick-tunnel host stays trusted after the tunnel stops running. */
+export declare const PUBLIC_BASE_GRACE_MS = 60000;
+/** Tunnel ownership of the public base, as resolved from the settings document. */
+export type TunnelBaseMode = 'off' | 'quick' | 'named';
+/**
+ * Owns the trusted public base across tunnel and relay transitions.
+ *
+ * The keeper never decides on its own to widen trust: it only postpones
+ * dropping an address the operator (named/relay) or the tunnel (quick) had
+ * already published, and it forgets it once the tunnel comes back with the
+ * address that actually serves the QR.
+ */
+export declare class PublicBaseKeeper {
+    private readonly onChange;
+    private readonly graceMs;
+    private mode;
+    private tunnelUrl;
+    private relayUrl;
+    private graceTimer;
+    /**
+     * @param onChange - receives the base the fence should trust from now on.
+     * @param graceMs - how long a quick-tunnel host outlives its tunnel.
+     */
+    constructor(onChange: (base: string | undefined) => void, graceMs?: number);
+    /** The base a fresh fence read should trust: the stable relay origin wins. */
+    current(): string | undefined;
+    /** The mode that currently owns the public base. */
+    setMode(mode: TunnelBaseMode): void;
+    /** The last quick-tunnel URL, for callers that must announce it downstream. */
+    quickUrl(): string | undefined;
+    /** A relay registration result; undefined withdraws the stable origin. */
+    setRelay(url: string | undefined): void;
+    /** The tunnel reported a live URL: it supersedes any pending grace. */
+    markRunning(url: string): void;
+    /**
+     * The tunnel left `running` (starting again, or failed). A named tunnel's
+     * fixed hostname stays trusted; a quick tunnel's previous host stays
+     * trusted for the grace window, then is dropped if nothing replaced it.
+     */
+    markReconnecting(): void;
+    /** Re-publish the current base after a branch change that did not move it. */
+    refresh(): void;
+    /** Forget everything (teardown, or a mode change that stops the tunnel). */
+    reset(): void;
+    /** Cancel the pending grace timer; the keeper keeps its last base. */
+    dispose(): void;
+    private startGrace;
+    private cancelGrace;
+    private emit;
+}
+//# sourceMappingURL=public-base.d.ts.map

package/lib/types/public-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-base.d.ts","sourceRoot":"","sources":["../../src/public-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAE1C,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;AAEtD;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAWzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAX1B,OAAO,CAAC,IAAI,CAAwB;IACpC,OAAO,CAAC,SAAS,CAAoB;IACrC,OAAO,CAAC,QAAQ,CAAoB;IACpC,OAAO,CAAC,UAAU,CAA2C;IAE7D;;;OAGG;gBAEgB,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,EAC5C,OAAO,GAAE,MAA6B;IAGzD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,GAAG,SAAS;IAI7B,oDAAoD;IACpD,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IAInC,+EAA+E;IAC/E,QAAQ,IAAI,MAAM,GAAG,SAAS;IAI9B,0EAA0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAKvC,uEAAuE;IACvE,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM9B;;;;OAIG;IACH,gBAAgB,IAAI,IAAI;IAKxB,8EAA8E;IAC9E,OAAO,IAAI,IAAI;IAIf,4EAA4E;IAC5E,KAAK,IAAI,IAAI;IAOb,sEAAsE;IACtE,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,UAAU;IAUlB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,IAAI;CAGb"}