@linxin666/dsh-remote-web-ui 0.3.22 → 0.3.23

package/lib/types/public-base.js

@@ -0,0 +1,110 @@
+/**
+ * The public base the pairing fence trusts while a tunnel is not running
+ * (issue #1547).
+ *
+ * The fence reads exactly one public host: `service.publicBaseUrl`. Dropping
+ * it the instant the tunnel leaves `running` makes every public request from
+ * the address still printed in the QR code answer 403 — including
+ * `/api/pair/status`, which exists to be callable before pairing. Two of the
+ * three tunnel modes never lose their host: a named tunnel keeps its fixed
+ * dashboard hostname, and a registered relay keeps its stable subdomain. A
+ * quick tunnel does mint a new hostname on restart, so its previous host is
+ * kept only for a bounded grace window: Cloudflare's edge can still deliver a
+ * connection the phone already opened, and a mobile network reconnects
+ * constantly, so an instant drop turns the phone's retry into a silent 403.
+ * @module @linxin666/dsh-remote-web-ui/public-base
+ */
+/** How long a quick-tunnel host stays trusted after the tunnel stops running. */
+export const PUBLIC_BASE_GRACE_MS = 60_000;
+/**
+ * Owns the trusted public base across tunnel and relay transitions.
+ *
+ * The keeper never decides on its own to widen trust: it only postpones
+ * dropping an address the operator (named/relay) or the tunnel (quick) had
+ * already published, and it forgets it once the tunnel comes back with the
+ * address that actually serves the QR.
+ */
+export class PublicBaseKeeper {
+    onChange;
+    graceMs;
+    mode = 'off';
+    tunnelUrl;
+    relayUrl;
+    graceTimer;
+    /**
+     * @param onChange - receives the base the fence should trust from now on.
+     * @param graceMs - how long a quick-tunnel host outlives its tunnel.
+     */
+    constructor(onChange, graceMs = PUBLIC_BASE_GRACE_MS) {
+        this.onChange = onChange;
+        this.graceMs = graceMs;
+    }
+    /** The base a fresh fence read should trust: the stable relay origin wins. */
+    current() {
+        return this.relayUrl ?? this.tunnelUrl;
+    }
+    /** The mode that currently owns the public base. */
+    setMode(mode) {
+        this.mode = mode;
+    }
+    /** The last quick-tunnel URL, for callers that must announce it downstream. */
+    quickUrl() {
+        return this.tunnelUrl;
+    }
+    /** A relay registration result; undefined withdraws the stable origin. */
+    setRelay(url) {
+        this.relayUrl = url;
+        this.emit();
+    }
+    /** The tunnel reported a live URL: it supersedes any pending grace. */
+    markRunning(url) {
+        this.cancelGrace();
+        this.tunnelUrl = url;
+        this.emit();
+    }
+    /**
+     * The tunnel left `running` (starting again, or failed). A named tunnel's
+     * fixed hostname stays trusted; a quick tunnel's previous host stays
+     * trusted for the grace window, then is dropped if nothing replaced it.
+     */
+    markReconnecting() {
+        if (this.mode === 'named')
+            return;
+        this.startGrace();
+    }
+    /** Re-publish the current base after a branch change that did not move it. */
+    refresh() {
+        this.emit();
+    }
+    /** Forget everything (teardown, or a mode change that stops the tunnel). */
+    reset() {
+        this.cancelGrace();
+        this.tunnelUrl = undefined;
+        this.relayUrl = undefined;
+        this.emit();
+    }
+    /** Cancel the pending grace timer; the keeper keeps its last base. */
+    dispose() {
+        this.cancelGrace();
+    }
+    startGrace() {
+        if (this.tunnelUrl === undefined)
+            return;
+        if (this.graceTimer !== undefined)
+            return;
+        this.graceTimer = setTimeout(() => {
+            this.graceTimer = undefined;
+            this.tunnelUrl = undefined;
+            this.emit();
+        }, this.graceMs);
+    }
+    cancelGrace() {
+        if (this.graceTimer === undefined)
+            return;
+        clearTimeout(this.graceTimer);
+        this.graceTimer = undefined;
+    }
+    emit() {
+        this.onChange(this.current());
+    }
+}

package/lib/types/remote-channel-boot.d.ts

@@ -17,8 +17,11 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. The script self-skips on loopback origins and
- * never throws.
+ * gated /remote channel. It finally publishes the official pre-Cordis
+ * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
+ * transport otherwise runs inside a Web Worker whose own globals the
+ * main-thread rewrite cannot reach (issue #1580). The script self-skips on
+ * loopback origins and never throws.
  * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
  */
 import { type RemoteChannelRules } from './remote-channel-rules.ts';

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CA8HrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAqJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -17,8 +17,11 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. The script self-skips on loopback origins and
- * never throws.
+ * gated /remote channel. It finally publishes the official pre-Cordis
+ * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
+ * transport otherwise runs inside a Web Worker whose own globals the
+ * main-thread rewrite cannot reach (issue #1580). The script self-skips on
+ * loopback origins and never throws.
  * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
  */
 import { REMOTE_CHANNEL_BOOT_GLOBAL, REMOTE_CHANNEL_RULES } from "./remote-channel-rules.js";
@@ -140,6 +143,29 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
         'Object.defineProperty(C.prototype,"src",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});' +
         'restores.push(function(){Object.defineProperty(C.prototype,"src",d)})}' +
         'patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);' +
+        // Background uploads must stay on the patched main-thread fetch
+        // (issue #1580). Without this hook @deepseek-ai/dsh-client-file-upload
+        // runs its carrier in a Web Worker, whose own globals no main-thread
+        // patch reaches: the worker's XHR goes straight to <origin>/api/...
+        // without the /remote rewrite and without the device credential, so the
+        // harness browser-auth fence answers 401 and every upload from a paired
+        // browser fails. The hook is the official pre-Cordis seam (the runtime
+        // reads it once in its constructor) and rewriting the worker URL is
+        // provably insufficient - a worker context carries neither the pairing
+        // cookie nor the device header. Hand the runtime the patched fetch
+        // instead: it takes the absolute route URL and a RequestInit, and hands
+        // both to the patched w.fetch, which owns the /remote rewrite AND the
+        // cookieless device header. Delegating the whole decision is deliberate:
+        // rewriting the path here first would make w.fetch see an already-gated
+        // /remote/api path, skip its own rewrite branch, and drop the device
+        // credential that the fence requires.
+        'function uf(u,init){' +
+        'var raw=typeof u==="string"?u:u.href;' +
+        'if(typeof raw!=="string")return of.call(w,u,init||{});' +
+        'var q=new URL(raw,loc.href);' +
+        'if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});' +
+        'return of.call(w,u,init||{})}' +
+        'try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}' +
         'seat.restore=function(){' +
         'w.fetch=of;' +
         'w.WebSocket=OW;' +

package/lib/types/remote-channel-rules.d.ts

@@ -28,6 +28,10 @@ export interface RemoteChannelRules {
     readonly deviceKey: string;
     /** Query parameter carrying it on WebSocket upgrades. */
     readonly deviceQuery: string;
+    /** Raw upload route the boot hook keeps on the gated channel. */
+    readonly uploadPath: string;
+    /** Page global the pre-Cordis upload hook is published under. */
+    readonly uploadHookGlobal: string;
 }
 /** The live rule set. */
 export declare const REMOTE_CHANNEL_RULES: RemoteChannelRules;

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAqBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAuBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -33,6 +33,8 @@ export const REMOTE_CHANNEL_RULES = {
     deviceHeader: REMOTE_DEVICE_HEADER,
     deviceKey: 'dsh-remote-device',
     deviceQuery: REMOTE_DEVICE_QUERY,
+    uploadPath: '/api/session/uploadFileBinary',
+    uploadHookGlobal: '__DSH_FILE_UPLOAD__',
 };
 /** The window global the boot patch publishes its seat under. */
 export const REMOTE_CHANNEL_BOOT_GLOBAL = '__DSH_REMOTE_CHANNEL_BOOT__';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-remote-web-ui",
   "description": "Scan-to-pair remote access for the dsh web GUI that shares one official interface: a QR beside the settings button pairs phones and PCs into the same Web GUI (a portrait-touch adaptation layer for phones, full desktop on PCs) through one-time tokens and revocable device sessions, with a LAN bind toggle, optional Cloudflare tunnel, and one-click family self-update",
-  "version": "0.3.22",
+  "version": "0.3.23",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/remote-channel.ts

@@ -207,6 +207,9 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
   const originalFetch = window.fetch
   const OriginalWebSocket = window.WebSocket
   const OriginalEventSource = window.EventSource
+  // Publish the official upload hook before the file-upload service reads it
+  // (issue #1580); removed again by the restore below.
+  const restoreUploadHook = installFileUploadHook(window as unknown as UploadHookWindow)
 
   const sameOrigin = (url: URL): boolean => url.origin === window.location.origin
   const rewrite = (raw: string): string => rewriteRawUrl(raw, window.location.href, window.location.origin)
@@ -301,6 +304,67 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
     window.WebSocket = OriginalWebSocket
     if (OriginalEventSource !== undefined) window.EventSource = OriginalEventSource
     for (const restore of restoreSrc) restore()
+    restoreUploadHook()
+  }
+}
+
+/** Page global the official pre-Cordis upload hook is published under. */
+export const FILE_UPLOAD_HOOK_GLOBAL = '__DSH_FILE_UPLOAD__'
+
+/** The subset of window the upload hook needs (injectable for tests). */
+export interface UploadHookWindow {
+  fetch: typeof globalThis.fetch
+  location: { href: string; origin: string }
+  /** Pre-existing hook owner; left untouched when present. */
+  __DSH_FILE_UPLOAD__?: {
+    fetch: (input: string | URL, init?: RequestInit) => Promise<Response>
+  }
+}
+
+/**
+ * Publish the official pre-Cordis upload hook so background uploads keep
+ * riding the patched main-thread fetch (issue #1580).
+ *
+ * `@deepseek-ai/dsh-client-file-upload` reads `globalThis.__DSH_FILE_UPLOAD__`
+ * once when its runtime is constructed; without it the carrier is a Web
+ * Worker, whose own globals no main-thread patch reaches. That worker's XHR
+ * goes straight to `<origin>/api/session/uploadFileBinary` with neither the
+ * `/remote` rewrite nor the cookieless device credential, so the harness
+ * browser-auth fence answers 401 and every upload from a paired browser
+ * fails. Rewriting the worker URL cannot fix it: a worker context carries
+ * neither the pairing cookie nor the device header.
+ *
+ * The hook hands the runtime the same transport the rest of the page uses -
+ * the boot script publishes an identical one (remote-channel-boot.ts), and
+ * this is the fallback for pages served without it.
+ *
+ * @param window - the browser window (or a test double), BEFORE the channel patch.
+ * @returns a function retiring the hook (a pre-existing one is left alone).
+ */
+export function installFileUploadHook(window: UploadHookWindow): () => void {
+  if (window.__DSH_FILE_UPLOAD__ !== undefined) return () => {}
+  const originalFetch = window.fetch
+  const hook = {
+    fetch: (input: string | URL, init?: RequestInit): Promise<Response> => {
+      const raw = typeof input === 'string' ? input : input.href
+      let url: URL
+      try {
+        url = new URL(raw, window.location.href)
+      } catch {
+        return originalFetch.call(window, input, init)
+      }
+      // Delegate the whole decision to the patched fetch: rewriting the path
+      // here first would make it skip its own rewrite branch and drop the
+      // device credential the fence requires.
+      if (url.origin === window.location.origin && url.pathname === RULES.uploadPath) {
+        return window.fetch.call(window, raw, init)
+      }
+      return originalFetch.call(window, input, init)
+    },
+  }
+  window.__DSH_FILE_UPLOAD__ = hook
+  return () => {
+    if (window.__DSH_FILE_UPLOAD__ === hook) delete window.__DSH_FILE_UPLOAD__
   }
 }
 

package/src/index.ts

@@ -37,6 +37,7 @@ import { loadRelayIdentity, RelayRegistrar, type RelayState } from './relay-regi
 import { desiredBindHost, desiredBindPort, firewallActionNeeded, pendingRestartOf, type AppliedFirewallState, type StartupFacts } from './lan-bind-plan.ts'
 import { createInnerAuth } from './inner-auth.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
+import { PublicBaseKeeper } from './public-base.ts'
 import {
   checkUpdates,
   fetchGitHubReleaseNotes,
@@ -343,17 +344,18 @@ function applyImpl(ctx: Context, config?: Config): void {
   // raw quick URL is used, exactly as before. Named tunnels keep their fixed
   // dashboard hostname and never touch the relay.
   let relayRegistrar: RelayRegistrar | undefined
-  let relayUrl: string | undefined
-  let rawTunnelUrl: string | undefined
+  /**
+   * The public base the pairing fence trusts. A tunnel reconnect must not
+   * strip the host the QR still shows: named and relay hosts never change,
+   * and a quick tunnel's host survives a bounded grace window (issue #1547).
+   */
+  const publicBase = new PublicBaseKeeper((base) => { service.setPublicBaseUrl(base) })
   /** The tunnel target the registrar last announced (dedupes sync re-runs). */
   let relayAnnouncedFor: string | undefined
-  const setPublicBase = (): void => {
-    service.setPublicBaseUrl(relayUrl ?? rawTunnelUrl)
-  }
   const disposeRelayRegistrar = (unregister: boolean = false): void => {
     const registrar = relayRegistrar
     relayRegistrar = undefined
-    relayUrl = undefined
+    publicBase.setRelay(undefined)
     relayAnnouncedFor = undefined
     if (registrar === undefined) return
     // Toggle-off removes the registry row so the stable origin stops
@@ -371,16 +373,15 @@ function applyImpl(ctx: Context, config?: Config): void {
         relayRegistrar = new RelayRegistrar(identity, (state: RelayState) => {
           service.setRelayStatus(state.state === 'off' ? undefined : state)
           if (state.state === 'running') {
-            relayUrl = state.url
+            publicBase.setRelay(state.url)
           } else if (state.state === 'off') {
-            relayUrl = undefined
+            publicBase.setRelay(undefined)
           } else if (state.state === 'failed') {
             // Keep the last relay URL on failures: the phone origin only
             // breaks when the mapping itself goes stale, not when one
             // refresh call fails. The registrar retries with backoff.
             console.warn(`remote-web-ui: relay registration failed (${state.error}) — the stable origin may serve its offline page until the retry lands`)
           }
-          setPublicBase()
         })
       } catch (error) {
         console.warn(`remote-web-ui: relay registry unavailable (${error instanceof Error ? error.message : String(error)}) — the quick URL is the QR base`)
@@ -399,27 +400,28 @@ function applyImpl(ctx: Context, config?: Config): void {
   tunnel.onPhase((info: TunnelInfo) => {
     if (tunnelMode === 'off') return
     if (info.phase === 'running' && info.url !== undefined) {
-      rawTunnelUrl = info.url
-      setPublicBase()
+      publicBase.markRunning(info.url)
       service.setTunnelStatus({ state: 'running', url: info.url })
       const registrar = tunnelMode === 'quick' ? ensureRelayRegistrar() : undefined
       if (registrar !== undefined) announceRelay(registrar, info.url)
       runPostureProbe()
     } else if (info.phase === 'starting') {
-      // A restart mints a NEW hostname: the previous URL dies with the old
-      // process, so clear it now rather than advertising a dead link.
-      rawTunnelUrl = undefined
-      relayUrl = undefined
-      setPublicBase()
+      // A quick-tunnel restart mints a new hostname, but the old one is not
+      // dropped at once: the edge may still deliver a connection the phone
+      // already opened, and the reconnect usually lands inside the grace
+      // window (issue #1547). A named tunnel keeps its fixed hostname, and a
+      // registered relay its stable subdomain, so neither is ever dropped
+      // here — the previous code cleared the relay base on every restart.
+      publicBase.markReconnecting()
       service.setTunnelStatus({ state: 'starting' })
     } else if (info.phase === 'failed') {
-      rawTunnelUrl = undefined
-      setPublicBase()
+      publicBase.markReconnecting()
       service.setTunnelStatus(info.error === undefined ? { state: 'failed' } : { state: 'failed', error: info.error })
     }
   })
   ctx.effect(() => () => {
     disposeRelayRegistrar()
+    publicBase.dispose()
     tunnel.dispose()
   }, 'remote-web-ui: auto tunnel')
   // The bind facts are known by now (webServer is an inject edge): the LAN
@@ -768,22 +770,24 @@ function applyImpl(ctx: Context, config?: Config): void {
     // publicBaseUrl applies only when no tunnel runs.
     const plan = tunnelPlanOf(value, ctx.webServer.port)
     tunnelMode = plan.mode
+    publicBase.setMode(plan.mode)
+    const liveTunnelUrl = publicBase.quickUrl()
     if (plan.mode !== 'quick') {
       // The relay only fronts the quick tunnel; named mode owns its fixed
       // dashboard hostname and the off mode has no public base at all.
       disposeRelayRegistrar()
-      if (plan.mode !== 'named') setPublicBase()
+      if (plan.mode !== 'named') publicBase.refresh()
     } else if (value.relay === false) {
       // The relay toggle is off: no stable origin, the raw quick URL is the
       // QR base exactly as before the relay existed.
       disposeRelayRegistrar(true)
-      setPublicBase()
-    } else if (rawTunnelUrl !== undefined) {
+      publicBase.refresh()
+    } else if (liveTunnelUrl !== undefined) {
       // The relay just turned on (or the registrar is new) while the tunnel
       // already runs: announce now — no phase event will fire for an
       // unchanged target.
       const registrar = ensureRelayRegistrar()
-      if (registrar !== undefined) announceRelay(registrar, rawTunnelUrl)
+      if (registrar !== undefined) announceRelay(registrar, liveTunnelUrl)
     }
     if (plan.mode === 'quick') {
       for (const ignored of plan.ignored) {

package/src/public-base.ts

@@ -0,0 +1,122 @@
+/**
+ * The public base the pairing fence trusts while a tunnel is not running
+ * (issue #1547).
+ *
+ * The fence reads exactly one public host: `service.publicBaseUrl`. Dropping
+ * it the instant the tunnel leaves `running` makes every public request from
+ * the address still printed in the QR code answer 403 — including
+ * `/api/pair/status`, which exists to be callable before pairing. Two of the
+ * three tunnel modes never lose their host: a named tunnel keeps its fixed
+ * dashboard hostname, and a registered relay keeps its stable subdomain. A
+ * quick tunnel does mint a new hostname on restart, so its previous host is
+ * kept only for a bounded grace window: Cloudflare's edge can still deliver a
+ * connection the phone already opened, and a mobile network reconnects
+ * constantly, so an instant drop turns the phone's retry into a silent 403.
+ * @module @linxin666/dsh-remote-web-ui/public-base
+ */
+
+/** How long a quick-tunnel host stays trusted after the tunnel stops running. */
+export const PUBLIC_BASE_GRACE_MS = 60_000
+
+/** Tunnel ownership of the public base, as resolved from the settings document. */
+export type TunnelBaseMode = 'off' | 'quick' | 'named'
+
+/**
+ * Owns the trusted public base across tunnel and relay transitions.
+ *
+ * The keeper never decides on its own to widen trust: it only postpones
+ * dropping an address the operator (named/relay) or the tunnel (quick) had
+ * already published, and it forgets it once the tunnel comes back with the
+ * address that actually serves the QR.
+ */
+export class PublicBaseKeeper {
+  private mode: TunnelBaseMode = 'off'
+  private tunnelUrl: string | undefined
+  private relayUrl: string | undefined
+  private graceTimer: ReturnType<typeof setTimeout> | undefined
+
+  /**
+   * @param onChange - receives the base the fence should trust from now on.
+   * @param graceMs - how long a quick-tunnel host outlives its tunnel.
+   */
+  constructor(
+    private readonly onChange: (base: string | undefined) => void,
+    private readonly graceMs: number = PUBLIC_BASE_GRACE_MS,
+  ) {}
+
+  /** The base a fresh fence read should trust: the stable relay origin wins. */
+  current(): string | undefined {
+    return this.relayUrl ?? this.tunnelUrl
+  }
+
+  /** The mode that currently owns the public base. */
+  setMode(mode: TunnelBaseMode): void {
+    this.mode = mode
+  }
+
+  /** The last quick-tunnel URL, for callers that must announce it downstream. */
+  quickUrl(): string | undefined {
+    return this.tunnelUrl
+  }
+
+  /** A relay registration result; undefined withdraws the stable origin. */
+  setRelay(url: string | undefined): void {
+    this.relayUrl = url
+    this.emit()
+  }
+
+  /** The tunnel reported a live URL: it supersedes any pending grace. */
+  markRunning(url: string): void {
+    this.cancelGrace()
+    this.tunnelUrl = url
+    this.emit()
+  }
+
+  /**
+   * The tunnel left `running` (starting again, or failed). A named tunnel's
+   * fixed hostname stays trusted; a quick tunnel's previous host stays
+   * trusted for the grace window, then is dropped if nothing replaced it.
+   */
+  markReconnecting(): void {
+    if (this.mode === 'named') return
+    this.startGrace()
+  }
+
+  /** Re-publish the current base after a branch change that did not move it. */
+  refresh(): void {
+    this.emit()
+  }
+
+  /** Forget everything (teardown, or a mode change that stops the tunnel). */
+  reset(): void {
+    this.cancelGrace()
+    this.tunnelUrl = undefined
+    this.relayUrl = undefined
+    this.emit()
+  }
+
+  /** Cancel the pending grace timer; the keeper keeps its last base. */
+  dispose(): void {
+    this.cancelGrace()
+  }
+
+  private startGrace(): void {
+    if (this.tunnelUrl === undefined) return
+    if (this.graceTimer !== undefined) return
+    this.graceTimer = setTimeout(() => {
+      this.graceTimer = undefined
+      this.tunnelUrl = undefined
+      this.emit()
+    }, this.graceMs)
+  }
+
+  private cancelGrace(): void {
+    if (this.graceTimer === undefined) return
+    clearTimeout(this.graceTimer)
+    this.graceTimer = undefined
+  }
+
+  private emit(): void {
+    this.onChange(this.current())
+  }
+}

package/src/remote-channel-boot.ts

@@ -17,8 +17,11 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. The script self-skips on loopback origins and
- * never throws.
+ * gated /remote channel. It finally publishes the official pre-Cordis
+ * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
+ * transport otherwise runs inside a Web Worker whose own globals the
+ * main-thread rewrite cannot reach (issue #1580). The script self-skips on
+ * loopback origins and never throws.
  * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
  */
 
@@ -142,6 +145,29 @@ export function buildRemoteChannelBootScript(rules: RemoteChannelRules = REMOTE_
     'Object.defineProperty(C.prototype,"src",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});' +
     'restores.push(function(){Object.defineProperty(C.prototype,"src",d)})}' +
     'patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);' +
+    // Background uploads must stay on the patched main-thread fetch
+    // (issue #1580). Without this hook @deepseek-ai/dsh-client-file-upload
+    // runs its carrier in a Web Worker, whose own globals no main-thread
+    // patch reaches: the worker's XHR goes straight to <origin>/api/...
+    // without the /remote rewrite and without the device credential, so the
+    // harness browser-auth fence answers 401 and every upload from a paired
+    // browser fails. The hook is the official pre-Cordis seam (the runtime
+    // reads it once in its constructor) and rewriting the worker URL is
+    // provably insufficient - a worker context carries neither the pairing
+    // cookie nor the device header. Hand the runtime the patched fetch
+    // instead: it takes the absolute route URL and a RequestInit, and hands
+    // both to the patched w.fetch, which owns the /remote rewrite AND the
+    // cookieless device header. Delegating the whole decision is deliberate:
+    // rewriting the path here first would make w.fetch see an already-gated
+    // /remote/api path, skip its own rewrite branch, and drop the device
+    // credential that the fence requires.
+    'function uf(u,init){' +
+    'var raw=typeof u==="string"?u:u.href;' +
+    'if(typeof raw!=="string")return of.call(w,u,init||{});' +
+    'var q=new URL(raw,loc.href);' +
+    'if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});' +
+    'return of.call(w,u,init||{})}' +
+    'try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}' +
     'seat.restore=function(){' +
     'w.fetch=of;' +
     'w.WebSocket=OW;' +

package/src/remote-channel-rules.ts

@@ -33,6 +33,10 @@ export interface RemoteChannelRules {
   readonly deviceKey: string
   /** Query parameter carrying it on WebSocket upgrades. */
   readonly deviceQuery: string
+  /** Raw upload route the boot hook keeps on the gated channel. */
+  readonly uploadPath: string
+  /** Page global the pre-Cordis upload hook is published under. */
+  readonly uploadHookGlobal: string
 }
 
 /** The live rule set. */
@@ -57,6 +61,8 @@ export const REMOTE_CHANNEL_RULES: RemoteChannelRules = {
   deviceHeader: REMOTE_DEVICE_HEADER,
   deviceKey: 'dsh-remote-device',
   deviceQuery: REMOTE_DEVICE_QUERY,
+  uploadPath: '/api/session/uploadFileBinary',
+  uploadHookGlobal: '__DSH_FILE_UPLOAD__',
 }
 
 /** The window global the boot patch publishes its seat under. */