@linxin666/dsh-remote-web-ui 0.3.23 → 0.4.0

package/lib/index.js

@@ -3,7 +3,7 @@ import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { setInterval, setTimeout as setTimeout$1 } from "node:timers";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces } from "node:os";
 import { isAbsolute as isAbsolute$1, join as join$1 } from "node:path/posix";
 import { Service } from "@deepseek-ai/cordis";
@@ -23,9 +23,9 @@ import { Tunnel, bin, install } from "cloudflared";
 * Security invariants:
 * - One active token at a time; `issue()` replaces it, so a refreshed QR
 *   immediately invalidates the previous link.
-* - A token stays re-usable until it expires or is replaced: the first
-*   successful `accept()` marks it consumed, but the same link may pair
-*   again within the window (each re-accept mints a fresh device session).
+* - A token is a bearer credential for its whole window: it is refused only
+*   when unknown, expired, or after `stop()`, and the same link may pair
+*   repeatedly within that window (each accept mints a fresh device session).
 *   Mobile flows routinely split across cookie contexts (camera preview to
 *   in-app browser to the system browser), and the later context must be
 *   able to complete its own pairing from the same link.
@@ -75,6 +75,7 @@ const defaultClock = {
 var PairingService = class {
 	config;
 	clock;
+	fs;
 	tokens = /* @__PURE__ */ new Map();
 	devices = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
@@ -97,9 +98,10 @@ var PairingService = class {
 	* the current one.
 	* @param clock - clock/entropy source (injectable for tests).
 	*/
-	constructor(config, clock = defaultClock) {
+	constructor(config, clock = defaultClock, fs = {}) {
 		this.config = config;
 		this.clock = clock;
+		this.fs = fs;
 		this.loadPersisted();
 	}
 	/**
@@ -126,7 +128,7 @@ var PairingService = class {
 				});
 			}
 			this.clampToMaxDevices();
-			if (this.evictIdle()) this.persist();
+			if (this.evictIdle()) this.persistRevocation();
 		} catch {}
 	}
 	/** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
@@ -159,7 +161,7 @@ var PairingService = class {
 	*/
 	persist() {
 		const file = this.config.devicesFile;
-		if (file === void 0) return;
+		if (file === void 0) return true;
 		try {
 			mkdirSync(dirname(file), { recursive: true });
 			const temp = `${file}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
@@ -168,8 +170,31 @@ var PairingService = class {
 			writeFileSync(temp, JSON.stringify(payload), { mode: 384 });
 			renameSync(temp, file);
 			this.dirty = false;
+			return true;
 		} catch (error) {
 			console.error("remote-web-ui: failed to persist paired devices", error);
+			return false;
+		}
+	}
+	/**
+	* Persist a table change that REVOKES access (stop, per-device revoke, idle
+	* eviction). A failed write would leave the revoked session on disk, and
+	* {@link loadPersisted} restores that file verbatim on the next start — the
+	* device's still-valid cookie would authorize again after an explicit
+	* revocation. When the write cannot be made durable, the stale store is
+	* removed instead (a missing file already loads as an empty table), so the
+	* failure costs a re-pair rather than silently undoing the revocation.
+	*/
+	persistRevocation() {
+		if (this.persist()) return;
+		const file = this.config.devicesFile;
+		if (file === void 0) return;
+		try {
+			if (this.fs.removeFile !== void 0) this.fs.removeFile(file);
+			else rmSync(file, { force: true });
+			console.error("remote-web-ui: the device revocation could not be persisted; removed the stale device store so a restart cannot restore it");
+		} catch (error) {
+			console.error("remote-web-ui: the device revocation could not be persisted and the stale device store could not be removed", error);
 		}
 	}
 	/** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
@@ -193,9 +218,14 @@ var PairingService = class {
 	get publicBaseUrl() {
 		return this.publicBase;
 	}
-	/** Set or clear the public base URL (a tunnel in front of this server). */
+	/**
+	* Set or clear the public base URL (a tunnel in front of this server). The
+	* value is canonicalized to its origin: a trailing slash (what a browser
+	* address-bar copy produces) or a path would mint a dead `//pair-accept`
+	* link, which WHATWG resolves as an authority rather than a path.
+	*/
 	setPublicBaseUrl(url) {
-		this.publicBase = url;
+		this.publicBase = url === void 0 ? void 0 : canonicalBaseUrl(url);
 		this.notify();
 	}
 	/** Set or clear the auto-tunnel status frame (undefined when the feature is off). */
@@ -237,7 +267,6 @@ var PairingService = class {
 			id: `t${this.tokenSerial}`,
 			issuedAt: now,
 			expiresAt: now + this.config.tokenTtlMs,
-			consumed: false,
 			...workspaceId !== void 0 ? { workspaceId } : {},
 			...address !== void 0 ? { address } : {}
 		});
@@ -248,9 +277,11 @@ var PairingService = class {
 		};
 	}
 	/**
-	* Consume a token and bind a device session. One-time: the second
-	* successful call for the same token is impossible because the first
-	* consumes it.
+	* Redeem a token and bind a device session. The token is a bearer
+	* credential for its whole window, not a single-use nonce: it is refused
+	* only when unknown, past its expiry, or after stop(), and every successful
+	* call — including a repeat within the same window — mints a fresh device
+	* session (see the module doc for the mobile cookie-context rationale).
 	* @param token - the token secret from the QR link.
 	* @param userAgent - optional User-Agent header captured at accept.
 	* @returns the new device id, or a refusal code.
@@ -261,7 +292,6 @@ var PairingService = class {
 			ok: false,
 			code: "invalid"
 		};
-		record.consumed = true;
 		const deviceId = this.clock.randomToken();
 		const now = this.clock.now();
 		if (this.devices.size >= this.config.maxDevices) {
@@ -293,7 +323,7 @@ var PairingService = class {
 	stop() {
 		this.tokens.clear();
 		this.devices.clear();
-		this.persist();
+		this.persistRevocation();
 		this.stopped = true;
 		this.notify();
 	}
@@ -306,7 +336,7 @@ var PairingService = class {
 	revoke(deviceId) {
 		if (this.stopped) return false;
 		if (!this.devices.delete(deviceId)) return false;
-		this.persist();
+		this.persistRevocation();
 		this.notify();
 		return true;
 	}
@@ -341,7 +371,8 @@ var PairingService = class {
 	* actually changed.
 	*/
 	sweep() {
-		if (this.evictIdle() || this.dirty) this.persist();
+		if (this.evictIdle()) this.persistRevocation();
+		else if (this.dirty) this.persist();
 		this.notify();
 	}
 	/** The current snapshot (fresh object per call — stable between emits). */
@@ -399,7 +430,7 @@ var PairingService = class {
 		const limit = this.config.idleExpireMs ?? 2592e6;
 		if (this.clock.now() - session.lastSeenAt > limit) {
 			this.devices.delete(deviceId);
-			this.persist();
+			this.persistRevocation();
 			this.notify();
 			return;
 		}
@@ -459,6 +490,19 @@ function relayEqual(a, b) {
 function sameStrings(a, b) {
 	return a.length === b.length && a.every((value, index) => value === b[index]);
 }
+/**
+* Canonical origin of a public base URL. An unparsable value is returned
+* verbatim so the caller's malformed-base warning stays the single owner of
+* that case.
+* @param url - the configured public base.
+*/
+function canonicalBaseUrl(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return url;
+	}
+}
 /** Strip control characters and cap the User-Agent stored with a session. */
 function sanitizeUserAgent(raw) {
 	if (raw === void 0) return void 0;
@@ -673,6 +717,28 @@ function isJsonObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /**
+* Request init that asks a remote origin for an uncompressed body.
+*
+* The DSH host boots `@deepseek-ai/dsh-http-proxy`, whose top-level import of
+* the npm `undici` copy replaces the legacy `undici.globalDispatcher.1` slot
+* Node's built-in `fetch()` reads. That cross-major wrapper drops the
+* `content-encoding` header and automatic decompression, so a plain fetch
+* resolves to raw gzip/brotli/zstd bytes — compressed noise no JSON or text
+* consumer can read. Every host fetch that parses a remote body must request
+* identity encoding. Caller headers survive; `accept-encoding` is forced to
+* `identity` because a caller value has no decoder behind it in this host.
+* @param init - the caller's request init (signal, headers, method, ...).
+* @returns a copy with `accept-encoding: identity` merged in.
+*/
+function withIdentityEncoding(init = {}) {
+	const headers = new Headers(init.headers);
+	headers.set("accept-encoding", "identity");
+	return {
+		...init,
+		headers
+	};
+}
+/**
 * Write one JSON response. Default headers are the family defaults
 * (content-type and referrer-policy); caller headers are appended or
 * override them.
@@ -685,6 +751,169 @@ function writeJson(res, status, body, headers = {}) {
 	});
 	res.end(payload);
 }
+/**
+* Build the grant table. Pure TypeScript with injected clock/randomness so the
+* whole one-time semantics are unit-testable without a server.
+*/
+function createPairGrantStore(options = {}) {
+	const ttlMs = options.ttlMs ?? 6e4;
+	const now = options.now ?? (() => Date.now());
+	const createGrant = options.createGrant ?? (() => randomBytes(32).toString("base64url"));
+	const entries = /* @__PURE__ */ new Map();
+	const purgeExpired = (at) => {
+		for (const [grant, entry] of entries) if (entry.expiresAt <= at) entries.delete(grant);
+	};
+	return {
+		issue(deviceId) {
+			const issuedAt = now();
+			purgeExpired(issuedAt);
+			while (entries.size >= 256) {
+				const oldest = entries.keys().next().value;
+				if (oldest === void 0) break;
+				entries.delete(oldest);
+			}
+			const grant = createGrant();
+			const expiresAt = issuedAt + ttlMs;
+			entries.set(grant, {
+				deviceId,
+				expiresAt
+			});
+			return {
+				grant,
+				expiresAt
+			};
+		},
+		consume(grant) {
+			if (grant === void 0 || grant === "") return void 0;
+			const consumedAt = now();
+			const entry = entries.get(grant);
+			entries.delete(grant);
+			purgeExpired(consumedAt);
+			if (entry === void 0 || entry.expiresAt <= consumedAt) return void 0;
+			return entry.deviceId;
+		},
+		peek(grant) {
+			if (grant === void 0 || grant === "") return void 0;
+			const at = now();
+			const entry = entries.get(grant);
+			if (entry === void 0) return void 0;
+			if (entry.expiresAt <= at) {
+				entries.delete(grant);
+				return;
+			}
+			return entry.deviceId;
+		},
+		get size() {
+			return entries.size;
+		}
+	};
+}
+//#endregion
+//#region src/remote-methods.ts
+/**
+* Remote desktop channel constants — SDK-independent so tests and the
+* client half can pin them without importing the host SDK graph.
+*
+* Access model on the 0.1.2-alpha.2 line: the host /api surface has no
+* per-method privilege pin — the "configuration plane is local" behavior
+* lives in the browser (client plugins branch on connection.isLoopback), and
+* the paired remote desktop flips into host mode via the transport hook
+* (ownsHost) while every call rides this gated channel as a loopback-shaped
+* request. A paired device is therefore a full-control credential by
+* design; the only paths that stay physically local are the control planes
+* below (pairing control, self-update, plugin install/remove, host power).
+*/
+/** Gated mirror of same-origin fenced paths (`/remote` + original pathname). */
+const REMOTE_PREFIX$1 = "/remote";
+/** Connection-plugin method prefix under the gated channel. */
+const REMOTE_API_PREFIX$1 = `${REMOTE_PREFIX$1}/api`;
+/**
+* Exact upgrade paths registered on webServer (the SDK matches upgrades by
+* exact path, not prefix). Query strings ride on the request URL.
+*/
+const REMOTE_UPGRADE_PATHS = [
+	{ mux: `${REMOTE_API_PREFIX$1}/remote.mux` }.mux,
+	`${REMOTE_PREFIX$1}/sidebar/ws/terminal`,
+	`${REMOTE_PREFIX$1}/sidebar/ws/agent-terminals`,
+	`${REMOTE_PREFIX$1}/sidebar/ws/agent-opens`,
+	`${REMOTE_API_PREFIX$1}/dsh-ssh/terminal`
+];
+/** Plugin-manager HTTP prefix: install/remove stay physically local. */
+const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
+/**
+* The cookieless device credential: the boot patch reads the device id from
+* the /pair-app URL, keeps it in sessionStorage, and attaches it to every
+* gated HTTP call as this header (and to WebSocket upgrades as the `device`
+* query parameter - WS handshakes cannot carry headers from the Web API).
+* The channel gate accepts it exactly like the device cookie, so the mobile
+* flow works even with browser cookies fully blocked; the cookie remains the
+* primary credential on normal browsers.
+*/
+const REMOTE_DEVICE_HEADER = "x-dsh-remote-device";
+const REMOTE_DEVICE_QUERY = "device";
+/**
+* Path prefixes that stay physically local even for a paired device. A
+* paired remote desktop may use the full host API (chat, sessions,
+* settings, credentials, presets — it is a full-control credential), but it
+* must not reach the machine-control planes: pairing control itself, the
+* dsh-web self-update installer, and plugin install/remove.
+*/
+const LOCAL_ONLY_PREFIXES = [
+	"/api/pair",
+	"/api/update",
+	PLUGIN_MANAGER_PATH
+];
+/**
+* Whether a paired inner path must stay physically local.
+* @param innerPath - the rewritten inner path (e.g. `/api/session.list`).
+* @returns a denial message, or undefined when the path may be proxied.
+*/
+function localOnlyDenial(innerPath) {
+	for (const prefix of LOCAL_ONLY_PREFIXES) if (innerPath === prefix || innerPath.startsWith(`${prefix}/`)) return `${prefix.slice(1)} stays physically local and stays unreachable from a paired remote desktop`;
+}
+//#endregion
+//#region src/remote-channel-rules.ts
+/**
+* The remote-channel rewrite contract as pure data (issue #987): both the
+* browser patch (client/remote-channel.ts) and the parse-time boot patch
+* (remote-channel-boot.ts, inlined into index.html by the host) decide from
+* these tables, so the two can never drift apart.
+* @module @linxin666/dsh-remote-web-ui/remote-channel-rules
+*/
+/** The gated mirror prefix (must match src/remote-methods.ts). */
+const REMOTE_PREFIX = "/remote";
+/**
+* The window global the device-gated app landing publishes to grant host mode.
+* Set by the /pair-app capture script, read by the parse-time boot patch: the
+* transport hook (ownsHost) is server-granted, not asserted from the origin.
+*/
+const REMOTE_HOST_GRANT_GLOBAL = "__DSH_REMOTE_HOST_GRANT__";
+/** The live rule set. */
+const REMOTE_CHANNEL_RULES = {
+	remotePrefix: REMOTE_PREFIX,
+	apiPrefix: "/api/",
+	pairPrefix: "/api/pair/",
+	updatePrefix: "/api/update/",
+	settingsBridgePrefix: "/api/dsh-web-ui-settings",
+	sidebarPrefix: "/sidebar/",
+	gitPrefix: "/git/",
+	petPrefix: "/pet/",
+	wsPaths: [
+		"/api/remote.mux",
+		"/sidebar/ws/terminal",
+		"/sidebar/ws/agent-terminals",
+		"/sidebar/ws/agent-opens",
+		"/api/dsh-ssh/terminal"
+	],
+	deviceHeader: REMOTE_DEVICE_HEADER,
+	deviceKey: "dsh-remote-device",
+	deviceQuery: REMOTE_DEVICE_QUERY,
+	uploadPath: "/api/session/uploadFileBinary",
+	uploadHookGlobal: "__DSH_FILE_UPLOAD__",
+	hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL
+};
+/** The window global the boot patch publishes its seat under. */
+const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 //#endregion
 //#region src/routes.ts
 /**
@@ -733,7 +962,12 @@ function isTrustedHost(request, trustedHosts) {
 	}
 	const hostname = hostUrl.hostname;
 	return isLoopbackClient(request) || trustedHosts.some((entry) => {
-		const entryUrl = new URL(`http://${entry}`);
+		let entryUrl;
+		try {
+			entryUrl = new URL(`http://${entry}`);
+		} catch {
+			return false;
+		}
 		return entryUrl.port === "" ? entryUrl.hostname === hostname : entryUrl.host === hostUrl.host;
 	});
 }
@@ -816,17 +1050,29 @@ function privateLanHostOf(request, navigation = false) {
 const MAX_BODY_BYTES = 4096;
 /**
 * The rate-limit bucket key for one accept attempt (pure; unit-tested).
-* The first client-visible XFF hop separates buckets behind the auto-tunnel
-* (every internet client arrives from 127.0.0.1 there) — but only for
-* loopback peers, since a direct LAN client can rotate the header freely.
+* A forwarded hop separates buckets behind the auto-tunnel (every internet
+* client arrives from 127.0.0.1 there) — but only for loopback peers, since a
+* direct LAN client can rotate the header freely. The caller passes the hop it
+* trusts (the edge-appended LAST one; see rateLimitAccept), and the hop is
+* truncated so one oversized header cannot mint a huge key.
 * @param socketIp - the socket peer address.
-* @param forwarded - the first XFF hop, already trimmed, if any.
+* @param forwarded - the trusted XFF hop, already trimmed, if any.
 * @param bucket - page (GET /pair-accept) vs api (POST /api/pair/accept).
 */
 function acceptLimitKey(socketIp, forwarded, bucket) {
-	if (isLoopbackAddress(socketIp) && forwarded !== void 0 && forwarded !== "") return `${bucket}|${socketIp}|${forwarded}`;
+	if (isLoopbackAddress(socketIp) && forwarded !== void 0 && forwarded !== "") return `${bucket}|${socketIp}|${forwarded.slice(0, MAX_FORWARDED_KEY_CHARS)}`;
 	return `${bucket}|${socketIp}`;
 }
+/** Longest forwarded hop kept in a bucket key (the header is caller-sized). */
+const MAX_FORWARDED_KEY_CHARS = 64;
+/**
+* Hard cap on live accept buckets. The key is caller-influenced (a forwarded
+* hop), so a rotating flood must not grow the table without bound: past the
+* cap the oldest bucket is evicted, the same FIFO stance as
+* {@link addBounded}. A legitimate client that loses its bucket merely starts
+* a fresh window.
+*/
+const MAX_ACCEPT_BUCKETS = 1024;
 /**
 * Reasons a phone-facing entry page refused a request, logged once per shape
 * so a real device failure is diagnosable from the host console without a
@@ -897,15 +1143,24 @@ const COOKIE_MAX_AGE_SEC = 365 * 24 * 60 * 60;
 const APP_DEVICE_STORAGE_KEY = "dsh-remote-device";
 function appShellCaptureScript(deviceId) {
 	const safeId = JSON.stringify(deviceId);
+	const grantGlobal = JSON.stringify(REMOTE_HOST_GRANT_GLOBAL);
 	const register = `try{if('serviceWorker' in navigator){navigator.serviceWorker.register(${JSON.stringify(PAIR_PATHS.appServiceWorker)},{scope:'/'}).catch(function(e){})}}catch(e){}`;
-	return `<script>(function(){try{sessionStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});localStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});}catch(e){}try{history.replaceState(null,'','/')}catch(e){}${register}})()<\/script>`;
+	return `<script>(function(){try{sessionStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});}catch(e){}try{history.replaceState(null,'','/')}catch(e){}try{window[${grantGlobal}]=true}catch(e){}${register}})()<\/script>`;
 }
-/** Patch the official index document with the device-capture script. */
+/**
+* Patch the official index document with the device-capture script. The script
+* goes immediately after the opening <head> tag, ahead of the harness-injected
+* parse-time channel boot patch: that patch installs the transport host-mode
+* hook only when this server-served marker is already set (see
+* remote-channel-boot.ts), so host mode is granted by the device-gated landing
+* instead of being asserted from the origin.
+*/
 function patchAppShell(html, deviceId) {
 	const script = appShellCaptureScript(deviceId);
-	const at = html.indexOf("</head>");
-	if (at === -1) return script + html;
-	return html.slice(0, at) + script + html.slice(at);
+	const head = /<head[^>]*>/i.exec(html);
+	if (head === null) return script + html;
+	const end = head.index + head[0].length;
+	return html.slice(0, end) + script + html.slice(end);
 }
 /**
 * The reopen service worker served at PAIR_PATHS.appServiceWorker. A paired
@@ -1102,6 +1357,7 @@ var PairingEventsStream = class {
 function makeRoutes(deps) {
 	const { service, requirePairingForLan = true } = deps;
 	const pairingRequired = () => typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan;
+	const grants = deps.grants ?? createPairGrantStore();
 	const events = new PairingEventsStream(service);
 	const dynamicTrustedHosts = /* @__PURE__ */ new Set();
 	/** Loopback-only fence: the desktop panel's control endpoints. */
@@ -1127,10 +1383,14 @@ function makeRoutes(deps) {
 		if (privateLanHost !== void 0) {
 			const cookieDeviceId = readCookie(req.headers.cookie, service.config.cookieName);
 			let queryDeviceId = null;
+			let queryGrant;
 			try {
-				queryDeviceId = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("device");
+				const params = new URL(req.url ?? "/", "http://pair.invalid").searchParams;
+				queryDeviceId = params.get("device");
+				queryGrant = params.get("grant") ?? void 0;
 			} catch {}
-			const deviceId = cookieDeviceId ?? queryDeviceId ?? void 0;
+			const granted = grants.peek(queryGrant);
+			const deviceId = cookieDeviceId ?? queryDeviceId ?? granted ?? void 0;
 			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
 				addBounded(dynamicTrustedHosts, privateLanHost, 64);
 				return true;
@@ -1153,14 +1413,38 @@ function makeRoutes(deps) {
 	*   count separately: a QR re-scan (page navigation) must not consume a
 	*   brute-force budget that belongs to token guessing (and vice versa).
 	*/
+	/**
+	* Drop expired buckets from the FRONT of the insertion-ordered table, then
+	* FIFO-evict past the hard cap. The front always holds the oldest window
+	* because a re-armed bucket is re-inserted at the tail, so this is amortized
+	* O(1) per request: every iteration deletes an entry that was inserted once.
+	* It replaces a full-table scan that ran on every pairing request once the
+	* table passed 256 entries (and deleted nothing while all windows were
+	* fresh).
+	*/
+	const pruneAcceptAttempts = (nowMs) => {
+		while (acceptAttempts.size > 0) {
+			const oldest = acceptAttempts.keys().next().value;
+			if (oldest === void 0) break;
+			const attempt = acceptAttempts.get(oldest);
+			if (attempt !== void 0 && nowMs - attempt.windowStart <= ACCEPT_WINDOW_MS) break;
+			acceptAttempts.delete(oldest);
+		}
+		while (acceptAttempts.size > MAX_ACCEPT_BUCKETS) {
+			const oldest = acceptAttempts.keys().next().value;
+			if (oldest === void 0) break;
+			acceptAttempts.delete(oldest);
+		}
+	};
 	const rateLimitAccept = (req, bucket) => {
-		const ip = acceptLimitKey(req.socket?.remoteAddress ?? "unknown", typeof req.headers["x-forwarded-for"] === "string" ? (req.headers["x-forwarded-for"].split(",")[0] ?? "").trim() : void 0, bucket);
+		const socketIp = req.socket?.remoteAddress ?? "unknown";
+		const hops = typeof req.headers["x-forwarded-for"] === "string" ? req.headers["x-forwarded-for"].split(",") : [];
+		const ip = acceptLimitKey(socketIp, (hops[hops.length - 1] ?? "").trim(), bucket);
 		const nowMs = Date.now();
-		if (acceptAttempts.size > 256) {
-			for (const [key, attempt] of acceptAttempts) if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key);
-		}
+		pruneAcceptAttempts(nowMs);
 		const entry = acceptAttempts.get(ip);
 		if (entry === void 0 || nowMs - entry.windowStart > ACCEPT_WINDOW_MS) {
+			acceptAttempts.delete(ip);
 			acceptAttempts.set(ip, {
 				count: 1,
 				windowStart: nowMs
@@ -1251,7 +1535,7 @@ function makeRoutes(deps) {
 				});
 				return;
 			}
-			writeJson(res, result.code === "used" ? 409 : 404, {
+			writeJson(res, 404, {
 				ok: false,
 				code: result.code
 			});
@@ -1261,7 +1545,7 @@ function makeRoutes(deps) {
 		writeJson(res, 200, {
 			ok: true,
 			deviceId: result.deviceId
-		}, { "set-cookie": [`${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`] });
+		}, { "set-cookie": [deviceCookie(req, service.config.cookieName, result.deviceId)] });
 	};
 	const handleStop = async (req, res) => {
 		if (!requireMethod(req, res, "POST")) return;
@@ -1357,12 +1641,12 @@ function makeRoutes(deps) {
 		}
 		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 		const paired = deviceId !== void 0 && service.hasDevice(deviceId);
+		const local = isLoopbackClient(req);
 		const snapshot = service.snapshot();
 		const { devices: _devices, ...rest } = snapshot;
-		const visible = paired ? rest : {
+		const visible = paired || local ? rest : {
 			phase: snapshot.phase,
-			lanAvailable: snapshot.lanAvailable,
-			lanAddresses: snapshot.lanAddresses
+			lanAvailable: snapshot.lanAvailable
 		};
 		writeJson(res, 200, {
 			ok: true,
@@ -1435,8 +1719,9 @@ function makeRoutes(deps) {
 			}
 			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
 			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
+				const { grant } = grants.issue(deviceId);
 				res.writeHead(303, {
-					location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(deviceId)}`,
+					location: `${appOrigin(req)}/pair-app?grant=${encodeURIComponent(grant)}`,
 					"cache-control": "no-store",
 					"referrer-policy": "no-referrer"
 				});
@@ -1452,19 +1737,21 @@ function makeRoutes(deps) {
 			return;
 		}
 		if (privateLanHost !== void 0) addBounded(dynamicTrustedHosts, privateLanHost, 64);
+		const { grant } = grants.issue(result.deviceId);
 		res.writeHead(303, {
-			location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(result.deviceId)}`,
+			location: `${appOrigin(req)}/pair-app?grant=${encodeURIComponent(grant)}`,
 			"cache-control": "no-store",
 			"referrer-policy": "no-referrer",
-			"set-cookie": [`${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`]
+			"set-cookie": [deviceCookie(req, service.config.cookieName, result.deviceId)]
 		});
 		res.end();
 	};
 	/**
-	* The cookieless app landing. A paired device (device query or live
-	* pairing cookie) receives the official index shell patched with the
-	* device-capture script; the shell itself is the official document and
-	* carries no data, so serving it needs only the device credential.
+	* The cookieless app landing. A paired device (a one-time grant minted by
+	* /pair-accept, or a live pairing cookie on a reopen) receives the official
+	* index shell patched with the device-capture script; the shell itself is
+	* the official document and carries no data, so serving it needs only the
+	* device credential.
 	*/
 	const handleAppPage = async (req, res) => {
 		if (!requireMethod(req, res, "GET")) return;
@@ -1479,9 +1766,10 @@ function makeRoutes(deps) {
 			res.end("rate limited");
 			return;
 		}
-		const device = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("device") ?? "";
+		const url = new URL(req.url ?? "/", "http://pair.invalid");
+		const grantedDevice = grants.consume(url.searchParams.get("grant") ?? void 0);
 		const cookieDevice = readCookie(req.headers.cookie, service.config.cookieName);
-		const id = device !== "" && service.touchDevice(device) ? device : cookieDevice !== void 0 && service.touchDevice(cookieDevice) ? cookieDevice : void 0;
+		const id = grantedDevice !== void 0 && service.touchDevice(grantedDevice) ? grantedDevice : cookieDevice !== void 0 && service.touchDevice(cookieDevice) ? cookieDevice : void 0;
 		if (id === void 0) {
 			res.writeHead(200, {
 				"content-type": "text/html; charset=utf-8",
@@ -1504,7 +1792,7 @@ function makeRoutes(deps) {
 			"content-type": "text/html; charset=utf-8",
 			"cache-control": "no-store",
 			"referrer-policy": "no-referrer",
-			"set-cookie": [`${service.config.cookieName}=${id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`]
+			"set-cookie": [deviceCookie(req, service.config.cookieName, id)]
 		});
 		res.end(patchAppShell(html, id));
 	};
@@ -1590,11 +1878,31 @@ function makeRoutes(deps) {
 	}
 	return routes;
 }
+/**
+* Whether the request reached this process over TLS. The harness itself serves
+* plain HTTP; a tunnel edge terminates TLS and stamps `x-forwarded-proto`
+* (the same signal {@link appOrigin} trusts when it rebuilds a redirect).
+*/
+function isHttpsRequest(req) {
+	const forwarded = req.headers["x-forwarded-proto"];
+	if (typeof forwarded === "string") {
+		if (forwarded.split(",")[0]?.trim().toLowerCase() === "https") return true;
+	}
+	return req.socket.encrypted === true;
+}
+/**
+* The device cookie for one request. `Secure` is added only when the request
+* arrived over TLS: LAN pairing runs on plain HTTP, where a Secure cookie is
+* simply dropped by the browser and the phone would silently lose its session.
+*/
+function deviceCookie(req, cookieName, deviceId) {
+	const secure = isHttpsRequest(req) ? "; Secure" : "";
+	return `${cookieName}=${deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}${secure}`;
+}
 /** The request origin (https when a tunnel edge says so). */
 function appOrigin(req) {
-	const proto = req.headers["x-forwarded-proto"] === "https" ? "https" : "http";
 	const origin = `http://${req.headers.host ?? "127.0.0.1"}`;
-	return proto === "https" ? origin.replace("http://", "https://") : origin;
+	return isHttpsRequest(req) ? origin.replace("http://", "https://") : origin;
 }
 //#endregion
 //#region src/loopback-proxy.ts
@@ -1729,68 +2037,6 @@ function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath, cookie) {
 	});
 }
 //#endregion
-//#region src/remote-methods.ts
-/**
-* Remote desktop channel constants — SDK-independent so tests and the
-* client half can pin them without importing the host SDK graph.
-*
-* Access model on the 0.1.2-alpha.2 line: the host /api surface has no
-* per-method privilege pin — the "configuration plane is local" behavior
-* lives in the browser (client plugins branch on connection.isLoopback), and
-* the paired remote desktop flips into host mode via the transport hook
-* (ownsHost) while every call rides this gated channel as a loopback-shaped
-* request. A paired device is therefore a full-control credential by
-* design; the only paths that stay physically local are the control planes
-* below (pairing control, self-update, plugin install/remove, host power).
-*/
-/** Gated mirror of same-origin fenced paths (`/remote` + original pathname). */
-const REMOTE_PREFIX$1 = "/remote";
-/** Connection-plugin method prefix under the gated channel. */
-const REMOTE_API_PREFIX$1 = `${REMOTE_PREFIX$1}/api`;
-/**
-* Exact upgrade paths registered on webServer (the SDK matches upgrades by
-* exact path, not prefix). Query strings ride on the request URL.
-*/
-const REMOTE_UPGRADE_PATHS = [
-	{ mux: `${REMOTE_API_PREFIX$1}/remote.mux` }.mux,
-	`${REMOTE_PREFIX$1}/sidebar/ws/terminal`,
-	`${REMOTE_PREFIX$1}/sidebar/ws/agent-terminals`,
-	`${REMOTE_API_PREFIX$1}/dsh-ssh/terminal`
-];
-/** Plugin-manager HTTP prefix: install/remove stay physically local. */
-const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
-/**
-* The cookieless device credential: the boot patch reads the device id from
-* the /pair-app URL, keeps it in sessionStorage, and attaches it to every
-* gated HTTP call as this header (and to WebSocket upgrades as the `device`
-* query parameter - WS handshakes cannot carry headers from the Web API).
-* The channel gate accepts it exactly like the device cookie, so the mobile
-* flow works even with browser cookies fully blocked; the cookie remains the
-* primary credential on normal browsers.
-*/
-const REMOTE_DEVICE_HEADER = "x-dsh-remote-device";
-const REMOTE_DEVICE_QUERY = "device";
-/**
-* Path prefixes that stay physically local even for a paired device. A
-* paired remote desktop may use the full host API (chat, sessions,
-* settings, credentials, presets — it is a full-control credential), but it
-* must not reach the machine-control planes: pairing control itself, the
-* dsh-web self-update installer, and plugin install/remove.
-*/
-const LOCAL_ONLY_PREFIXES = [
-	"/api/pair",
-	"/api/update",
-	PLUGIN_MANAGER_PATH
-];
-/**
-* Whether a paired inner path must stay physically local.
-* @param innerPath - the rewritten inner path (e.g. `/api/session.list`).
-* @returns a denial message, or undefined when the path may be proxied.
-*/
-function localOnlyDenial(innerPath) {
-	for (const prefix of LOCAL_ONLY_PREFIXES) if (innerPath === prefix || innerPath.startsWith(`${prefix}/`)) return `${prefix.slice(1)} stays physically local and stays unreachable from a paired remote desktop`;
-}
-//#endregion
 //#region src/remote-api.ts
 const ALLOWED_METHODS = /* @__PURE__ */ new Set([
 	"GET",
@@ -1862,18 +2108,16 @@ function pairedDeviceIdOf(req, service) {
 }
 /**
 * Build the remote desktop channel HTTP routes.
-* @param deps - pairing service + local port + live pairing policy.
+* @param deps - pairing service + local port + inner credential.
 * @returns the routes to register on webServer.
 */
 function makeRemoteApiRoutes(deps) {
-	const { service, port, requirePairingForLan = true } = deps;
+	const { service, port } = deps;
 	const handler = (req, res) => {
-		if (typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan) {
-			if (pairedDeviceIdOf(req, service) === void 0) {
-				req.resume();
-				envelopeError(res, 403, "invalid-request", "unpaired", "this device is not paired with the desktop");
-				return;
-			}
+		if (pairedDeviceIdOf(req, service) === void 0) {
+			req.resume();
+			envelopeError(res, 403, "invalid-request", "unpaired", "this device is not paired with the desktop");
+			return;
 		}
 		const method = req.method ?? "GET";
 		if (!ALLOWED_METHODS.has(method)) {
@@ -1924,18 +2168,16 @@ function upgradeInnerPath(reqUrl, fallbackPath) {
 * @returns the upgrade routes to register on webServer.
 */
 function makeRemoteApiUpgradeRoutes(deps) {
-	const { service, port, requirePairingForLan = true } = deps;
+	const { service, port } = deps;
 	const handlerFor = (fallbackPath) => (req, socket, head) => {
-		if (typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan) {
-			let queryDevice;
-			try {
-				queryDevice = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("device") ?? void 0;
-			} catch {}
-			if ((pairedDeviceIdOf(req, service) ?? (queryDevice !== void 0 && service.touchDevice(queryDevice) ? queryDevice : void 0)) === void 0) {
-				socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
-				socket.destroy();
-				return;
-			}
+		let queryDevice;
+		try {
+			queryDevice = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("device") ?? void 0;
+		} catch {}
+		if ((pairedDeviceIdOf(req, service) ?? (queryDevice !== void 0 && service.touchDevice(queryDevice) ? queryDevice : void 0)) === void 0) {
+			socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
+			socket.destroy();
+			return;
 		}
 		const inner = upgradeInnerPath(req.url, fallbackPath);
 		if (loopbackOnlyDenial(inner.split("?")[0] ?? inner) !== void 0) {
@@ -2085,7 +2327,7 @@ async function probeHost(port, hostHeader, request, timeoutMs) {
 			},
 			timeout: timeoutMs
 		}, (status) => {
-			finish(status !== 403);
+			finish(status !== 403 && status !== 401);
 		});
 		const timer = setTimeout(() => {
 			finish(false);
@@ -2911,14 +3153,23 @@ function createBinaryReadiness(executable, seams = {}) {
 	const runs = seams.runs ?? binaryRuns;
 	const installBinary = seams.install ?? install;
 	const validated = /* @__PURE__ */ new Set();
+	let installs = 0;
+	let lastFailure;
 	return async () => {
 		if (validated.has(executable)) return;
+		if (installs >= 3 && lastFailure !== void 0) throw lastFailure;
 		if (exists(executable) && await runs(executable)) {
 			validated.add(executable);
 			return;
 		}
-		await installBinary(executable);
-		if (!await runs(executable)) throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+		installs += 1;
+		try {
+			await installBinary(executable);
+			if (!await runs(executable)) throw new Error(`the cloudflared binary at ${executable} still does not run after the reinstall`);
+		} catch (error) {
+			lastFailure = error instanceof Error ? error : new Error(String(error));
+			throw lastFailure;
+		}
 		validated.add(executable);
 	};
 }
@@ -2948,27 +3199,51 @@ function quickTunnelFlags(originHostHeader) {
 	};
 }
 /**
-* Command-line arguments for a named tunnel with a persistent Cloudflare token.
-* Note: `--no-autoupdate` and `--protocol` are flags for the `tunnel` command
-* and must appear BEFORE the `run` subcommand. Putting them after `run` causes
-* cloudflared to exit immediately with "flag provided but not defined: -no-autoupdate"
-* (issues #1432, #1433).
+* Command-line arguments for a named tunnel. The account token is deliberately
+* NOT part of the argv: `--token <t>` would expose an account credential to any
+* local user through ps/proc for the whole tunnel lifetime, while the flag's own
+* environment variable (TUNNEL_TOKEN, see cloudflared's tunnel run flags) is not
+* readable that way. Note: `--no-autoupdate` and `--protocol` are flags for the
+* `tunnel` command and must appear BEFORE the `run` subcommand. Putting them
+* after `run` causes cloudflared to exit immediately with "flag provided but not
+* defined: -no-autoupdate" (issues #1432, #1433).
 */
-function namedTunnelArgs(token) {
+function namedTunnelArgs() {
 	return [
 		"tunnel",
 		"--no-autoupdate",
 		"--protocol",
 		"http2",
-		"run",
-		"--token",
-		token
+		"run"
 	];
 }
+/**
+* Run one spawn call with TUNNEL_TOKEN set, restoring the previous value
+* afterwards. The cloudflared package's Tunnel spawns with the inherited
+* environment inside its constructor, so the variable only has to exist for
+* that call; the child keeps its own copy of the environment.
+* @param token - the named-tunnel token.
+* @param spawnTunnel - the call that creates the child process.
+* @returns whatever the spawn call returns.
+*/
+function withTunnelTokenEnv(token, spawnTunnel) {
+	const previous = process.env.TUNNEL_TOKEN;
+	process.env.TUNNEL_TOKEN = token;
+	try {
+		return spawnTunnel();
+	} finally {
+		if (previous === void 0) delete process.env.TUNNEL_TOKEN;
+		else process.env.TUNNEL_TOKEN = previous;
+	}
+}
+/** Spawn one named tunnel without putting its token in the child's argv. */
+function spawnNamedTunnel(token) {
+	return withTunnelTokenEnv(token, () => new Tunnel(namedTunnelArgs()));
+}
 /** Default factory: the cloudflared package's quick and named tunnels. */
 function defaultFactory(target) {
 	if (target.kind === "quick") return Tunnel.quick(target.targetUrl, quickTunnelFlags(target.originHostHeader));
-	return namedTunnelHandle(new Tunnel(namedTunnelArgs(target.token)), target.publicUrl);
+	return namedTunnelHandle(spawnNamedTunnel(target.token), target.publicUrl);
 }
 /** Node timers. */
 const nodeTimer = {
@@ -3266,6 +3541,74 @@ var PublicBaseKeeper = class {
 		this.onChange(this.current());
 	}
 };
+//#endregion
+//#region src/console-output.ts
+/** Count the U+FFFD replacement characters one candidate decode produced. */
+function replacementCount(text) {
+	let count = 0;
+	for (const character of text) if (character === "�") count += 1;
+	return count;
+}
+/**
+* Decode one console byte buffer. Strict UTF-8 wins whenever it is valid;
+* otherwise the bytes are not UTF-8 at all and the console wrote its own code
+* page, so the candidate that loses the least text is taken.
+* @param bytes - the captured bytes.
+* @returns the decoded text.
+*/
+function decodeConsoleBytes(bytes) {
+	try {
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		let best;
+		let bestLoss = Number.POSITIVE_INFINITY;
+		for (const label of ["gbk", "utf-8"]) {
+			let text;
+			try {
+				text = new TextDecoder(label).decode(bytes);
+			} catch {
+				continue;
+			}
+			const loss = replacementCount(text);
+			if (loss < bestLoss) {
+				best = text;
+				bestLoss = loss;
+			}
+		}
+		/* v8 ignore next 3 -- reachable only without the legacy code page AND without the lenient pass */
+		if (best === void 0) return Buffer.from(bytes).toString("utf8");
+		return best;
+	}
+}
+/**
+* Create a capture bounded to a byte budget. Overflow drops from the FRONT
+* (the tail is what carries a failure reason), and the cut never lands inside
+* a character: leading UTF-8 continuation bytes are dropped with it, and a
+* legacy code page's dangling lead byte — indistinguishable from a real byte
+* without knowing the encoding until the whole buffer is decoded — is removed
+* with the one replacement character it produced, so an over-long stream still
+* reads cleanly at the seam.
+* @param maxBytes - maximum retained bytes.
+* @returns the capture.
+*/
+function createOutputCapture(maxBytes) {
+	let buffer = Buffer.alloc(0);
+	let trimmed = false;
+	return {
+		push(chunk) {
+			buffer = buffer.length === 0 ? Buffer.from(chunk) : Buffer.concat([buffer, Buffer.from(chunk)]);
+			if (buffer.length <= maxBytes) return;
+			let start = buffer.length - maxBytes;
+			while (start < buffer.length && (buffer[start] & 192) === 128) start += 1;
+			buffer = Buffer.from(buffer.subarray(start));
+			trimmed = true;
+		},
+		read() {
+			const text = decodeConsoleBytes(buffer);
+			return trimmed && text.startsWith("�") ? text.slice(1) : text;
+		}
+	};
+}
 /** The aggregate package that is the canonical update entry point. */
 const AGGREGATE_PACKAGE = "@linxin666/dsh-web-all";
 /** Fallback anchor: this plugin's own package when the aggregate is absent. */
@@ -3439,7 +3782,7 @@ async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
 			controller.abort();
 		}, timeoutMs);
 		try {
-			const response = await fetchImpl("https://registry.npmjs.org/" + name.replace("/", "%2F") + "/latest", { signal: controller.signal });
+			const response = await fetchImpl("https://registry.npmjs.org/" + name.replace("/", "%2F") + "/latest", withIdentityEncoding({ signal: controller.signal }));
 			if (!response.ok) return void 0;
 			const body = await response.json();
 			if (typeof body !== "object" || body === null) return void 0;
@@ -3511,13 +3854,13 @@ async function fetchGitHubReleaseNotes(version, fetchImpl = fetch, timeoutMs = 1
 		controller.abort();
 	}, timeoutMs);
 	try {
-		const response = await fetchImpl(`https://api.github.com/repos/${UPDATE_RELEASE_REPO}/releases/tags/v${version}`, {
+		const response = await fetchImpl(`https://api.github.com/repos/${UPDATE_RELEASE_REPO}/releases/tags/v${version}`, withIdentityEncoding({
 			headers: {
 				accept: "application/vnd.github+json",
 				"user-agent": "dsh-web-update"
 			},
 			signal: controller.signal
-		});
+		}));
 		if (!response.ok) return void 0;
 		const body = await response.json();
 		if (typeof body !== "object" || body === null) return void 0;
@@ -3611,6 +3954,13 @@ async function checkUpdates(deps) {
 /** Cap on captured pnpm output (keeps error payloads bounded). */
 const OUTPUT_CAP = 16 * 1024;
 /**
+* Characters a package name may contain before it is handed to the update
+* command line. Deliberately looser than the strict family shape (the tests
+* and future callers use short names) but it admits no whitespace, quotes,
+* shell metacharacters, or path separators beyond the scope slash.
+*/
+const SHELL_SAFE_PACKAGE_RE = /^@?[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+/**
 * Windows cmd command-not-found stderr. With shell:true a missing shim
 * exits with code 1 or 9009 (cmd cannot report ENOENT), so the fallback chain
 * detects this message instead of the spawn error event. Supports both English
@@ -3618,20 +3968,14 @@ const OUTPUT_CAP = 16 * 1024;
 */
 const WIN_CMD_MISSING_RE = /not recognized as an internal or external command|不是内部或外部命令/i;
 /**
-* Decode process output with tolerant decoding:
-* Defaults to UTF-8; if invalid byte sequences are encountered (common on
-* Windows consoles using code page 936/GBK), falls back to GBK via TextDecoder.
+* Fold one decoded candidate output into the running total under the display
+* cap (the tail carries the failure reason).
+* @param output - the accumulated text.
+* @param text - the candidate's decoded text.
 */
-function decodeProcessChunk(chunk) {
-	try {
-		return new TextDecoder("utf-8", { fatal: true }).decode(chunk);
-	} catch {
-		try {
-			return new TextDecoder("gbk").decode(chunk);
-		} catch {
-			return chunk.toString("utf8");
-		}
-	}
+function capOutput(output, text) {
+	const combined = output + text;
+	return combined.length > OUTPUT_CAP ? combined.slice(combined.length - OUTPUT_CAP) : combined;
 }
 /**
 * Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
@@ -3653,8 +3997,8 @@ const MIN_RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
 function runUpdate(deps) {
 	return new Promise((resolve) => {
 		const spawnImpl = deps.spawnImpl ?? spawn;
-		const packages = deps.packages;
 		const platform = deps.platform ?? process.platform;
+		const packages = deps.packages.filter((name) => SHELL_SAFE_PACKAGE_RE.test(name));
 		const spawnOptions = {
 			cwd: deps.profileDir,
 			stdio: [
@@ -3662,8 +4006,9 @@ function runUpdate(deps) {
 				"pipe",
 				"pipe"
 			],
-			...platform === "win32" ? { shell: true } : {}
+			...platform === "win32" ? { shell: true } : { detached: true }
 		};
+		const killImpl = deps.killImpl ?? process.kill;
 		const candidates = [
 			{
 				command: "pnpm",
@@ -3697,13 +4042,18 @@ function runUpdate(deps) {
 			}
 		];
 		let output = "";
-		let currentOutput = "";
+		let capture = createOutputCapture(OUTPUT_CAP);
+		let candidateFolded = false;
 		const append = (chunk) => {
-			const text = decodeProcessChunk(chunk);
-			output += text;
-			if (output.length > OUTPUT_CAP) output = output.slice(output.length - OUTPUT_CAP);
-			currentOutput += text;
-			if (currentOutput.length > OUTPUT_CAP) currentOutput = currentOutput.slice(currentOutput.length - OUTPUT_CAP);
+			capture.push(chunk);
+		};
+		/** This candidate's decoded text (idempotent). */
+		const candidateText = () => capture.read();
+		/** Fold this candidate's text into the running output exactly once. */
+		const foldCandidate = () => {
+			if (candidateFolded) return;
+			candidateFolded = true;
+			output = capOutput(output, capture.read());
 		};
 		let currentChild;
 		let finished = false;
@@ -3723,9 +4073,20 @@ function runUpdate(deps) {
 						String(pid),
 						"/t",
 						"/f"
-					], { stdio: "ignore" });
+					], { stdio: "ignore" }).on?.("error", () => {});
 				} catch {}
-			} else currentChild?.kill("SIGTERM");
+			} else {
+				const pid = currentChild?.pid;
+				if (pid !== void 0 && pid > 0) try {
+					killImpl(-pid, "SIGTERM");
+				} catch {
+					try {
+						currentChild?.kill("SIGTERM");
+					} catch {}
+				}
+				else currentChild?.kill("SIGTERM");
+			}
+			foldCandidate();
 			finish({
 				ok: false,
 				exitCode: null,
@@ -3747,7 +4108,8 @@ function runUpdate(deps) {
 				return;
 			}
 			const candidate = candidates[index];
-			currentOutput = "";
+			capture = createOutputCapture(OUTPUT_CAP);
+			candidateFolded = false;
 			const child = spawnImpl(candidate.command, candidate.args, spawnOptions);
 			currentChild = child;
 			let settled = false;
@@ -3760,6 +4122,7 @@ function runUpdate(deps) {
 			child.stderr?.on("data", append);
 			child.on("error", (error) => {
 				once(() => {
+					foldCandidate();
 					if (error.code === "ENOENT") runCandidate(index + 1);
 					else finish({
 						ok: false,
@@ -3772,11 +4135,13 @@ function runUpdate(deps) {
 			});
 			child.on("close", (code) => {
 				if (settled || finished) return;
-				if (platform === "win32" && (code === 9009 || code !== 0 && WIN_CMD_MISSING_RE.test(currentOutput))) {
+				if (platform === "win32" && (code === 9009 || code !== 0 && WIN_CMD_MISSING_RE.test(candidateText()))) {
+					foldCandidate();
 					runCandidate(index + 1);
 					return;
 				}
 				settled = true;
+				foldCandidate();
 				finish({
 					ok: code === 0,
 					exitCode: code,
@@ -3949,30 +4314,6 @@ function mountOnce(packageName, fn) {
 		return fn(...args);
 	});
 }
-/** The live rule set. */
-const REMOTE_CHANNEL_RULES = {
-	remotePrefix: "/remote",
-	apiPrefix: "/api/",
-	pairPrefix: "/api/pair/",
-	updatePrefix: "/api/update/",
-	settingsBridgePrefix: "/api/dsh-web-ui-settings",
-	sidebarPrefix: "/sidebar/",
-	gitPrefix: "/git/",
-	petPrefix: "/pet/",
-	wsPaths: [
-		"/api/remote.mux",
-		"/sidebar/ws/terminal",
-		"/sidebar/ws/agent-terminals",
-		"/api/dsh-ssh/terminal"
-	],
-	deviceHeader: REMOTE_DEVICE_HEADER,
-	deviceKey: "dsh-remote-device",
-	deviceQuery: REMOTE_DEVICE_QUERY,
-	uploadPath: "/api/session/uploadFileBinary",
-	uploadHookGlobal: "__DSH_FILE_UPLOAD__"
-};
-/** The window global the boot patch publishes its seat under. */
-const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 //#endregion
 //#region src/remote-channel-boot.ts
 /**
@@ -3994,7 +4335,12 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
 * connection plugin reads it: the paired remote desktop gets the full
 * settings/credentials/presets surface, and every call still rides the
-* gated /remote channel. It finally publishes the official pre-Cordis
+* gated /remote channel. Host mode is server-granted, not origin-asserted:
+* the hook is installed only when the device-gated app landing (/pair-app)
+* published the grant marker (REMOTE_HOST_GRANT_GLOBAL) ahead of this
+* script, so a shell served to an unpaired browser - a fence-open
+* deployment - never presents itself as the machine owner. It finally
+* publishes the official pre-Cordis
 * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
 * transport otherwise runs inside a Web Worker whose own globals the
 * main-thread rewrite cannot reach (issue #1580). The script self-skips on
@@ -4009,7 +4355,7 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
 	const json = JSON.stringify(rules);
 	const seat = JSON.stringify(REMOTE_CHANNEL_BOOT_GLOBAL);
-	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);function uf(u,init){var raw=typeof u===\"string\"?u:u.href;if(typeof raw!==\"string\")return of.call(w,u,init||{});var q=new URL(raw,loc.href);if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});return of.call(w,u,init||{})}try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
+	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;var R=" + json + ";try{if(w[R.hostGrantGlobal]===true){if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}}catch(e){}function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);function uf(u,init){var raw=typeof u===\"string\"?u:u.href;if(typeof raw!==\"string\")return of.call(w,u,init||{});var q=new URL(raw,loc.href);if(so(q)&&q.pathname===R.uploadPath)return w.fetch(raw,init||{});return of.call(w,u,init||{})}try{if(w[R.uploadHookGlobal]===undefined)w[R.uploadHookGlobal]={fetch:uf}}catch(e){}seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
 }
 /** Boot-watchdog latch: one self-reload per session while the boot is broken. */
 const BOOT_WATCHDOG_KEY = "dsh-remote-boot-reload";
@@ -4081,9 +4427,12 @@ const inject = [
 	"connection"
 ];
 /**
-* Settings namespace of the remote-control capability — the section the web
-* settings surface edits. Spelled here rather than imported: the browser
-* half spells the same value and must not depend on a Host package.
+* Settings namespace of the remote-control capability. Under the 0.1.7
+* settings model the namespace IS the Host profile entry id, so this is also
+* the id the browser half asks `ctx.configForms` for (the family binder
+* resolves the same value to the owning entry). Spelled here rather than
+* imported: the browser half spells the same value and must not depend on a
+* Host package.
 */
 const REMOTE_WEB_UI_SETTINGS_NAMESPACE = "remote-web-ui";
 const Config = z.object({
@@ -4106,10 +4455,15 @@ const Config = z.object({
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 1e4;
 /**
+* How long one update-status probe answer is reused. The probe fans out one
+* registry GET per family package plus a GitHub call, and the sidebar update
+* entry asks for the status on every GUI page load.
+*/
+const UPDATE_STATUS_TTL_MS = 6e4;
+/**
 * The single mapping from resolved plugin config to the pairing service
-* config. Both the constructed service and every live settings sync reuse
-* it, so no field can be silently dropped when the web settings surface
-* pushes a new value into the running service.
+* config. Both the constructed service and every later apply of this row
+* reuse it, so no field can be silently dropped.
 */
 function pairingConfigOf(resolved) {
 	return {
@@ -4168,27 +4522,7 @@ function applyImpl(ctx, config) {
 		profile: config?.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
 		enabled: config?.enabled ?? DEFAULTS.enabled
 	};
-	let current = () => config ?? {};
-	const resolve = () => {
-		const value = current();
-		return {
-			tokenTtlMs: value.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
-			offlineAfterMs: value.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
-			maxDevices: value.maxDevices ?? DEFAULTS.maxDevices,
-			idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
-			cookieName: value.cookieName ?? DEFAULTS.cookieName,
-			requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-			publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
-			trustedHosts: value.trustedHosts,
-			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
-			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
-			tunnelToken: value.tunnelToken,
-			relay: value.relay ?? DEFAULTS.relay,
-			lanBind: value.lanBind,
-			profile: value.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
-			enabled: value.enabled ?? DEFAULTS.enabled
-		};
-	};
+	const resolve = () => resolved;
 	const service = new PairingService(pairingConfigOf(resolved));
 	const tunnel = new TunnelManager();
 	let relayRegistrar;
@@ -4288,14 +4622,31 @@ function applyImpl(ctx, config) {
 		});
 		return notes;
 	};
-	const updateRoutes = makeUpdateRoutes({
-		fence: (request) => isTrustedApiRequest(request, []),
-		check: () => checkUpdates({
+	let updateStatusCache;
+	let updateStatusInFlight;
+	const checkStatusCached = () => {
+		const cached = updateStatusCache;
+		if (cached !== void 0 && Date.now() - cached.at < UPDATE_STATUS_TTL_MS) return Promise.resolve(cached.value);
+		if (updateStatusInFlight !== void 0) return updateStatusInFlight;
+		updateStatusInFlight = checkUpdates({
 			anchorManifestPath: resolveAnchorPath(),
 			resolve: hostResolve,
 			fetchLatest: (name) => fetchLatestVersion(name, fetch),
 			fetchReleaseNotes: fetchReleaseNotesCached
-		}),
+		}).then((value) => {
+			updateStatusCache = {
+				at: Date.now(),
+				value
+			};
+			return value;
+		}).finally(() => {
+			updateStatusInFlight = void 0;
+		});
+		return updateStatusInFlight;
+	};
+	const updateRoutes = makeUpdateRoutes({
+		fence: (request) => isTrustedApiRequest(request, []),
+		check: () => checkStatusCached(),
 		run: async () => {
 			const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() });
 			if ("error" in target) {
@@ -4308,7 +4659,7 @@ function applyImpl(ctx, config) {
 					errorCode: code
 				};
 			}
-			return runUpdateVerified({
+			const result = await runUpdateVerified({
 				run: {
 					profileDir: target.profileDir,
 					packages: target.packages
@@ -4320,6 +4671,8 @@ function applyImpl(ctx, config) {
 					fetchReleaseNotes: fetchReleaseNotesCached
 				}
 			});
+			updateStatusCache = void 0;
+			return result;
 		}
 	});
 	let lastKnownPort;
@@ -4367,8 +4720,11 @@ function applyImpl(ctx, config) {
 		if (appShellCache !== void 0 && Date.now() - appShellCache.at < APP_SHELL_TTL_MS) return appShellCache.html;
 		const cookie = await innerAuth.ready();
 		try {
-			const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, { headers: cookie !== void 0 ? { cookie } : void 0 });
-			if (!response.ok) return void 0;
+			const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, withIdentityEncoding({ headers: cookie !== void 0 ? { cookie } : void 0 }));
+			if (!response.ok) {
+				if (response.status === 401 || response.status === 403) innerAuth.invalidate();
+				return;
+			}
 			const html = await response.text();
 			appShellCache = {
 				at: Date.now(),
@@ -4405,7 +4761,6 @@ function applyImpl(ctx, config) {
 		...makeRemoteApiRoutes({
 			service,
 			port: ctx.webServer.port,
-			requirePairingForLan: () => resolve().requirePairingForLan,
 			auth: innerAuth
 		}),
 		...updateRoutes
@@ -4413,7 +4768,6 @@ function applyImpl(ctx, config) {
 	const upgrades = makeRemoteApiUpgradeRoutes({
 		service,
 		port: ctx.webServer.port,
-		requirePairingForLan: () => resolve().requirePairingForLan,
 		auth: innerAuth
 	});
 	const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
@@ -4524,12 +4878,14 @@ function applyImpl(ctx, config) {
 				targetUrl: plan.targetUrl,
 				originHostHeader
 			});
-		} else if (plan.mode === "named") tunnel.start({
-			kind: "named",
-			token: plan.token,
-			publicUrl: plan.publicUrl
-		});
-		else {
+		} else if (plan.mode === "named") {
+			publicBase.markRunning(plan.publicUrl);
+			tunnel.start({
+				kind: "named",
+				token: plan.token,
+				publicUrl: plan.publicUrl
+			});
+		} else {
 			tunnel.stop();
 			if (value.tunnelToken !== void 0 && value.tunnelToken !== "") console.warn("remote-web-ui: tunnelToken is set but publicBaseUrl is missing or not a valid URL — fill the fixed public hostname of the named tunnel (e.g. https://dsh.example.com) to run it");
 			if (value.publicBaseUrl !== void 0 && !isHttpUrl(value.publicBaseUrl)) {
@@ -4538,7 +4894,12 @@ function applyImpl(ctx, config) {
 			} else service.setPublicBaseUrl(value.publicBaseUrl);
 		}
 		const enabled = value.enabled;
-		if (!enabled) service.stop();
+		if (!enabled) {
+			service.stop();
+			tunnel.stop();
+			disposeRelayRegistrar();
+			publicBase.reset();
+		}
 		if (disposeRoutes === void 0 && enabled) disposeRoutes = ctx.effect(() => {
 			const disposers = [...routes.map((route) => ctx.webServer.register(route)), ...upgrades.map((route) => ctx.webServer.registerUpgrade(route))];
 			return () => {
@@ -4580,25 +4941,6 @@ function applyImpl(ctx, config) {
 			text: REMOTE_CHANNEL_BOOT_SCRIPT
 		});
 	}), "remote-web-ui: remote channel boot patch");
-	ctx.inject(["settings"], (settingsCtx) => {
-		try {
-			if (typeof settingsCtx.settings?.installSection === "function") settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-				setSource: (source) => {
-					current = source;
-					sync();
-				},
-				onChange: sync
-			});
-			else if (typeof settingsCtx.settings?.register === "function") {
-				const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} });
-				current = () => scope?.get?.() ?? config ?? {};
-				scope?.watch?.(() => {
-					sync();
-				});
-				sync();
-			}
-		} catch {}
-	});
 	sync();
 }
 //#endregion