@linxin666/dsh-remote-web-ui 0.3.23 → 0.4.0

package/lib/types/remote-api.js

@@ -7,10 +7,14 @@
  * consult.
  *
  * Security model:
- * - While `requirePairingForLan` is on (default), every request must carry a
- *   live paired-device cookie, enforced before any bytes are forwarded and
- *   before any host call. With the policy off, the cookie gate is skipped
- *   (the local-only denials below still apply).
+ * - Every request must carry a live paired-device credential, enforced before
+ *   any bytes are forwarded and before any host call. This gate is
+ *   unconditional and does NOT follow `requirePairingForLan`: the channel
+ *   re-issues traffic with the process's own browser-auth credential, so it is
+ *   an authentication amplifier — an unpaired caller admitted here would reach
+ *   the full host API without ever holding that credential. The LAN policy
+ *   governs the plain `/api` surface only (whether the harness fence's LAN
+ *   auto-trust stands on its own); it can never widen this channel.
  * - A paired remote desktop is a full-control credential: the browser half
  *   flips the official UI into host mode (the transport ownsHost hook), so
  *   the configuration plane (settings, credentials, presets, deliverables)
@@ -93,23 +97,21 @@ export function pairedDeviceIdOf(req, service) {
 }
 /**
  * Build the remote desktop channel HTTP routes.
- * @param deps - pairing service + local port + live pairing policy.
+ * @param deps - pairing service + local port + inner credential.
  * @returns the routes to register on webServer.
  */
 export function makeRemoteApiRoutes(deps) {
-    const { service, port, requirePairingForLan = true } = deps;
+    const { service, port } = deps;
     const handler = (req, res) => {
-        // Cookie gate first — same order as /m/api. Do not buffer an unpaired body.
-        // With the live policy off, untrusted-but-policy-open callers are proxied
-        // (a stale client rewrite must not 403); loopback-only denials stay below.
-        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
-        if (require) {
-            const paired = pairedDeviceIdOf(req, service);
-            if (paired === undefined) {
-                req.resume();
-                envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
-                return;
-            }
+        // Paired credential first — before any bytes are buffered or forwarded.
+        // Unconditional by design: this channel attaches the process's own
+        // browser-auth cookie to every re-issued call, so admitting an unpaired
+        // caller would hand out that credential's authority (issue #1665).
+        const paired = pairedDeviceIdOf(req, service);
+        if (paired === undefined) {
+            req.resume();
+            envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
+            return;
         }
         const method = req.method ?? 'GET';
         if (!ALLOWED_METHODS.has(method)) {
@@ -159,24 +161,22 @@ export function upgradeInnerPath(reqUrl, fallbackPath) {
  * @returns the upgrade routes to register on webServer.
  */
 export function makeRemoteApiUpgradeRoutes(deps) {
-    const { service, port, requirePairingForLan = true } = deps;
+    const { service, port } = deps;
     const handlerFor = (fallbackPath) => (req, socket, head) => {
-        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
-        if (require) {
-            // WebSocket handshakes cannot carry headers from the Web API, so the
-            // cookieless credential rides the query; the cookie stays the primary.
-            let queryDevice;
-            try {
-                queryDevice = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams.get(REMOTE_DEVICE_QUERY) ?? undefined;
-            }
-            catch { /* fall through to the cookie */ }
-            const deviceId = pairedDeviceIdOf(req, service);
-            const paired = deviceId ?? (queryDevice !== undefined && service.touchDevice(queryDevice) ? queryDevice : undefined);
-            if (paired === undefined) {
-                socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-                socket.destroy();
-                return;
-            }
+        // WebSocket handshakes cannot carry headers from the Web API, so the
+        // cookieless credential rides the query; the cookie stays the primary.
+        // The gate is unconditional here too (issue #1665).
+        let queryDevice;
+        try {
+            queryDevice = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams.get(REMOTE_DEVICE_QUERY) ?? undefined;
+        }
+        catch { /* fall through to the cookie */ }
+        const deviceId = pairedDeviceIdOf(req, service);
+        const paired = deviceId ?? (queryDevice !== undefined && service.touchDevice(queryDevice) ? queryDevice : undefined);
+        if (paired === undefined) {
+            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
         }
         const inner = upgradeInnerPath(req.url, fallbackPath);
         const denied = loopbackOnlyDenial(inner.split('?')[0] ?? inner);

package/lib/types/remote-channel-boot.d.ts

@@ -17,7 +17,12 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. It finally publishes the official pre-Cordis
+ * gated /remote channel. Host mode is server-granted, not origin-asserted:
+ * the hook is installed only when the device-gated app landing (/pair-app)
+ * published the grant marker (REMOTE_HOST_GRANT_GLOBAL) ahead of this
+ * script, so a shell served to an unpaired browser - a fence-open
+ * deployment - never presents itself as the machine owner. It finally
+ * publishes the official pre-Cordis
  * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
  * transport otherwise runs inside a Web Worker whose own globals the
  * main-thread rewrite cannot reach (issue #1580). The script self-skips on

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAqJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAwJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -17,7 +17,12 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. It finally publishes the official pre-Cordis
+ * gated /remote channel. Host mode is server-granted, not origin-asserted:
+ * the hook is installed only when the device-gated app landing (/pair-app)
+ * published the grant marker (REMOTE_HOST_GRANT_GLOBAL) ahead of this
+ * script, so a shell served to an unpaired browser - a fence-open
+ * deployment - never presents itself as the machine owner. It finally
+ * publishes the official pre-Cordis
  * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
  * transport otherwise runs inside a Web Worker whose own globals the
  * main-thread rewrite cannot reach (issue #1580). The script self-skips on
@@ -38,14 +43,17 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
     return '(function(){' +
         'try{' +
         'var w=window,loc=w.location,h=loc.hostname;' +
-        // Loopback origins keep the original paths (mirrors isLoopbackHostname).
-        "if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
-        // Host mode: the paired remote desktop presents itself as the machine
-        // owner, so the official UI keeps its full configuration surface (the
-        // settings mirror, document controller, and deliverables open actions
-        // all branch on connection.isLoopback). Must run before any boot entry.
-        'try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}' +
+        // Loopback origins (including the bracketed IPv6 literal WHATWG returns)
+        // keep the original paths (mirrors isLoopbackHostname).
+        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
         'var R=' + json + ';' +
+        // Host mode is server-granted: only the device-gated app landing
+        // publishes the grant marker (in a capture script that runs ahead of
+        // this one), so a shell that merely sits on a non-loopback origin - an
+        // unpaired browser reaching a fence-open deployment - keeps the official
+        // UI's memory-scope presentation instead of posing as the machine owner.
+        // Must run before any boot entry.
+        'try{if(w[R.hostGrantGlobal]===true){if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}}catch(e){}' +
         // The cookieless device credential: read lazily per call - the
         // /pair-app capture script sets it in head AFTER this boot script ran,
         // so a parse-time read would always see null.

package/lib/types/remote-channel-rules.d.ts

@@ -11,6 +11,12 @@ import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from './remote-methods.ts';
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export declare const REMOTE_API_PREFIX = "/remote/api";
+/**
+ * The window global the device-gated app landing publishes to grant host mode.
+ * Set by the /pair-app capture script, read by the parse-time boot patch: the
+ * transport hook (ownsHost) is server-granted, not asserted from the origin.
+ */
+export declare const REMOTE_HOST_GRANT_GLOBAL = "__DSH_REMOTE_HOST_GRANT__";
 /** Every decision input of the remote-channel rewrite, JSON-serializable. */
 export interface RemoteChannelRules {
     readonly remotePrefix: string;
@@ -32,6 +38,14 @@ export interface RemoteChannelRules {
     readonly uploadPath: string;
     /** Page global the pre-Cordis upload hook is published under. */
     readonly uploadHookGlobal: string;
+    /**
+     * Page global carrying the server-issued host-mode grant. Only the plugin's
+     * own device-gated app landing (/pair-app) publishes it; the boot patch
+     * therefore enables the official UI's host mode only for a shell the server
+     * actually granted, never for one that merely happens to sit on a
+     * non-loopback origin.
+     */
+    readonly hostGrantGlobal: string;
 }
 /** The live rule set. */
 export declare const REMOTE_CHANNEL_RULES: RemoteChannelRules;

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAuBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAyBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -11,6 +11,12 @@ import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from "./remote-methods.js";
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
+/**
+ * The window global the device-gated app landing publishes to grant host mode.
+ * Set by the /pair-app capture script, read by the parse-time boot patch: the
+ * transport hook (ownsHost) is server-granted, not asserted from the origin.
+ */
+export const REMOTE_HOST_GRANT_GLOBAL = '__DSH_REMOTE_HOST_GRANT__';
 /** The live rule set. */
 export const REMOTE_CHANNEL_RULES = {
     remotePrefix: REMOTE_PREFIX,
@@ -28,6 +34,7 @@ export const REMOTE_CHANNEL_RULES = {
         '/api/remote.mux',
         '/sidebar/ws/terminal',
         '/sidebar/ws/agent-terminals',
+        '/sidebar/ws/agent-opens',
         '/api/dsh-ssh/terminal',
     ],
     deviceHeader: REMOTE_DEVICE_HEADER,
@@ -35,6 +42,7 @@ export const REMOTE_CHANNEL_RULES = {
     deviceQuery: REMOTE_DEVICE_QUERY,
     uploadPath: '/api/session/uploadFileBinary',
     uploadHookGlobal: '__DSH_FILE_UPLOAD__',
+    hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL,
 };
 /** The window global the boot patch publishes its seat under. */
 export const REMOTE_CHANNEL_BOOT_GLOBAL = '__DSH_REMOTE_CHANNEL_BOOT__';

package/lib/types/remote-methods.d.ts

@@ -31,7 +31,7 @@ export declare const REMOTE_API_PATHS: {
  * Exact upgrade paths registered on webServer (the SDK matches upgrades by
  * exact path, not prefix). Query strings ride on the request URL.
  */
-export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/remote.mux", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/api/dsh-ssh/terminal"];
+export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/remote.mux", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/sidebar/ws/agent-opens", "/remote/api/dsh-ssh/terminal"];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 export declare const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
 /** Family settings-bridge HTTP prefix — re-exposed to paired devices (plain settings parity). */

package/lib/types/remote-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0IAKvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}
+{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,4KAMvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}

package/lib/types/remote-methods.js

@@ -35,6 +35,7 @@ export const REMOTE_UPGRADE_PATHS = [
     REMOTE_API_PATHS.mux,
     `${REMOTE_PREFIX}/sidebar/ws/terminal`,
     `${REMOTE_PREFIX}/sidebar/ws/agent-terminals`,
+    `${REMOTE_PREFIX}/sidebar/ws/agent-opens`,
     `${REMOTE_API_PREFIX}/dsh-ssh/terminal`,
 ];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */

package/lib/types/routes.d.ts

@@ -11,11 +11,19 @@
  * on the 0.1.2-alpha.2 cohort nothing emits api/gate — direct /api is
  * governed by the harness fence + browser auth — while the /remote channel
  * always enforces the pairing cookie itself.
+ *
+ * The app landing is reached with a one-time grant, never with the device id
+ * itself: /pair-accept mints a short-lived, single-consume grant
+ * (pair-grant.ts) and redirects to /pair-app?grant=<g>, and only the landing's
+ * own response carries the device credential into the shell. The device cookie
+ * stays the primary credential; the grant only keeps a live session credential
+ * out of the URL, the address bar, and every log on the redirect path.
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { WebRoute } from '@deepseek-ai/dsh-host-webserver';
 import { z } from 'zod';
 import { type PairingService, type PairingSnapshot } from './pairing.ts';
+import { type PairGrantStore } from './pair-grant.ts';
 /**
  * Browser-trust fence for the /api/pair routes, mirroring the connection
  * package's internal fence semantics (Host/Origin based, DNS-rebinding and
@@ -67,14 +75,24 @@ export declare function isPrivateOrLocalHostname(hostname: string): boolean;
 export declare function isNonCrossSite(request: IncomingMessage): boolean;
 /**
  * The rate-limit bucket key for one accept attempt (pure; unit-tested).
- * The first client-visible XFF hop separates buckets behind the auto-tunnel
- * (every internet client arrives from 127.0.0.1 there) — but only for
- * loopback peers, since a direct LAN client can rotate the header freely.
+ * A forwarded hop separates buckets behind the auto-tunnel (every internet
+ * client arrives from 127.0.0.1 there) — but only for loopback peers, since a
+ * direct LAN client can rotate the header freely. The caller passes the hop it
+ * trusts (the edge-appended LAST one; see rateLimitAccept), and the hop is
+ * truncated so one oversized header cannot mint a huge key.
  * @param socketIp - the socket peer address.
- * @param forwarded - the first XFF hop, already trimmed, if any.
+ * @param forwarded - the trusted XFF hop, already trimmed, if any.
  * @param bucket - page (GET /pair-accept) vs api (POST /api/pair/accept).
  */
 export declare function acceptLimitKey(socketIp: string, forwarded: string | undefined, bucket: 'page' | 'api'): string;
+/**
+ * Hard cap on live accept buckets. The key is caller-influenced (a forwarded
+ * hop), so a rotating flood must not grow the table without bound: past the
+ * cap the oldest bucket is evicted, the same FIFO stance as
+ * {@link addBounded}. A legitimate client that loses its bucket merely starts
+ * a fresh window.
+ */
+export declare const MAX_ACCEPT_BUCKETS = 1024;
 /**
  * Cap on the dynamically trusted hosts (see {@link addBounded}): room for
  * every legitimate router/proxy aliasing shape, small enough that a flood of
@@ -109,7 +127,14 @@ export declare function publicHostOf(url: string | undefined): string | undefine
  */
 export declare const APP_DEVICE_STORAGE_KEY = "dsh-remote-device";
 export declare function appShellCaptureScript(deviceId: string): string;
-/** Patch the official index document with the device-capture script. */
+/**
+ * Patch the official index document with the device-capture script. The script
+ * goes immediately after the opening <head> tag, ahead of the harness-injected
+ * parse-time channel boot patch: that patch installs the transport host-mode
+ * hook only when this server-served marker is already set (see
+ * remote-channel-boot.ts), so host mode is granted by the device-gated landing
+ * instead of being asserted from the origin.
+ */
 export declare function patchAppShell(html: string, deviceId: string): string;
 /**
  * The reopen service worker served at PAIR_PATHS.appServiceWorker. A paired
@@ -205,6 +230,11 @@ export interface PairRoutesDeps {
     indexDocument?: (deviceId: string) => Promise<string | undefined>;
     /** Extra trusted non-loopback hosts (from config or environment). */
     trustedHosts?: readonly string[] | (() => readonly string[]);
+    /**
+     * The one-time grant table behind the /pair-accept → /pair-app redirect.
+     * Defaults to a fresh store; tests inject one with a fixed clock/entropy.
+     */
+    grants?: PairGrantStore;
 }
 /**
  * Build the /api/pair route family.
@@ -212,4 +242,16 @@ export interface PairRoutesDeps {
  * @returns the exact routes to register on webServer.
  */
 export declare function makeRoutes(deps: PairRoutesDeps): WebRoute[];
+/**
+ * Whether the request reached this process over TLS. The harness itself serves
+ * plain HTTP; a tunnel edge terminates TLS and stamps `x-forwarded-proto`
+ * (the same signal {@link appOrigin} trusts when it rebuilds a redirect).
+ */
+export declare function isHttpsRequest(req: IncomingMessage): boolean;
+/**
+ * The device cookie for one request. `Secure` is added only when the request
+ * arrived over TLS: LAN pairing runs on plain HTTP, where a Secure cookie is
+ * simply dropped by the browser and the phone would silently lose its session.
+ */
+export declare function deviceCookie(req: IncomingMessage, cookieName: string, deviceId: string): string;
 //# sourceMappingURL=routes.d.ts.map

package/lib/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAKhG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CActG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAgBhG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyBlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAahE;AA6BD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAK9G;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAA;AA6B3C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAO7E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AAEzD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI9D;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAoD/C;AA4BD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;;IASrB,iEAAiE;;IAEjE,iFAAiF;;IAEjF;;;OAGG;;CAEK,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AAoBjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACjE,qEAAqE;IACrE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,CAAA;CAC7D;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CAob3D"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC/D,OAAO,EAAE,CAAC,EAAgB,MAAM,KAAK,CAAA;AACrC,OAAO,EAA0B,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAA;AAIhG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAG3E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CActG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAyBhG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAyBlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAahE;AA6BD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAK9G;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAA;AAEtC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAA;AA6B3C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAO7E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOxE;AAKD;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AAEzD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAoD/C;AA4BD,8CAA8C;AAC9C,eAAO,MAAM,UAAU;;;;;;;;;IASrB,iEAAiE;;IAEjE,iFAAiF;;IAEjF;;;OAGG;;CAEK,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,mBAAmB;;iBAE9B,CAAA;AACF,eAAO,MAAM,uBAAuB,gCAA6B,CAAA;AAoBjE,gDAAgD;AAChD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAElD;;OAEG;gBACS,OAAO,EAAE,cAAc;IAInC,4DAA4D;IAC5D,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI;IAiBrD,kEAAkE;IAClE,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAYrC,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,2BAA2B;IAC3B,OAAO,EAAE,cAAc,CAAA;IACvB,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACjE,qEAAqE;IACrE,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,CAAC,CAAA;IAC5D;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACxB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,EAAE,CA4d3D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAG/F"}