@linxin666/dsh-remote-web-ui 0.3.24 → 0.4.0

package/lib/types/pairing.js

@@ -7,9 +7,9 @@
  * Security invariants:
  * - One active token at a time; `issue()` replaces it, so a refreshed QR
  *   immediately invalidates the previous link.
- * - A token stays re-usable until it expires or is replaced: the first
- *   successful `accept()` marks it consumed, but the same link may pair
- *   again within the window (each re-accept mints a fresh device session).
+ * - A token is a bearer credential for its whole window: it is refused only
+ *   when unknown, expired, or after `stop()`, and the same link may pair
+ *   repeatedly within that window (each accept mints a fresh device session).
  *   Mobile flows routinely split across cookie contexts (camera preview to
  *   in-app browser to the system browser), and the later context must be
  *   able to complete its own pairing from the same link.
@@ -21,7 +21,7 @@
  *   `idleExpireMs` are deleted on sweep, load, and the next gated request.
  */
 import { randomBytes } from 'node:crypto';
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 /**
  * Default idle-expiry window: 30 days without a heartbeat or a gated
@@ -62,6 +62,7 @@ export const defaultClock = {
 export class PairingService {
     config;
     clock;
+    fs;
     tokens = new Map();
     devices = new Map();
     listeners = new Set();
@@ -84,9 +85,10 @@ export class PairingService {
      * the current one.
      * @param clock - clock/entropy source (injectable for tests).
      */
-    constructor(config, clock = defaultClock) {
+    constructor(config, clock = defaultClock, fs = {}) {
         this.config = config;
         this.clock = clock;
+        this.fs = fs;
         this.loadPersisted();
     }
     /**
@@ -119,7 +121,7 @@ export class PairingService {
             }
             this.clampToMaxDevices();
             if (this.evictIdle())
-                this.persist();
+                this.persistRevocation();
         }
         catch {
             // Unreadable/corrupt: start empty rather than refusing to boot.
@@ -160,7 +162,7 @@ export class PairingService {
     persist() {
         const file = this.config.devicesFile;
         if (file === undefined)
-            return;
+            return true;
         try {
             mkdirSync(dirname(file), { recursive: true });
             const temp = `${file}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
@@ -170,9 +172,37 @@ export class PairingService {
             writeFileSync(temp, JSON.stringify(payload), { mode: 0o600 });
             renameSync(temp, file);
             this.dirty = false;
+            return true;
         }
         catch (error) {
             console.error('remote-web-ui: failed to persist paired devices', error);
+            return false;
+        }
+    }
+    /**
+     * Persist a table change that REVOKES access (stop, per-device revoke, idle
+     * eviction). A failed write would leave the revoked session on disk, and
+     * {@link loadPersisted} restores that file verbatim on the next start — the
+     * device's still-valid cookie would authorize again after an explicit
+     * revocation. When the write cannot be made durable, the stale store is
+     * removed instead (a missing file already loads as an empty table), so the
+     * failure costs a re-pair rather than silently undoing the revocation.
+     */
+    persistRevocation() {
+        if (this.persist())
+            return;
+        const file = this.config.devicesFile;
+        if (file === undefined)
+            return;
+        try {
+            if (this.fs.removeFile !== undefined)
+                this.fs.removeFile(file);
+            else
+                rmSync(file, { force: true });
+            console.error('remote-web-ui: the device revocation could not be persisted; removed the stale device store so a restart cannot restore it');
+        }
+        catch (error) {
+            console.error('remote-web-ui: the device revocation could not be persisted and the stale device store could not be removed', error);
         }
     }
     /** The default LAN base URL (the first interface; undefined when not LAN-reachable). */
@@ -196,9 +226,14 @@ export class PairingService {
     get publicBaseUrl() {
         return this.publicBase;
     }
-    /** Set or clear the public base URL (a tunnel in front of this server). */
+    /**
+     * Set or clear the public base URL (a tunnel in front of this server). The
+     * value is canonicalized to its origin: a trailing slash (what a browser
+     * address-bar copy produces) or a path would mint a dead `//pair-accept`
+     * link, which WHATWG resolves as an authority rather than a path.
+     */
     setPublicBaseUrl(url) {
-        this.publicBase = url;
+        this.publicBase = url === undefined ? undefined : canonicalBaseUrl(url);
         this.notify();
     }
     /** Set or clear the auto-tunnel status frame (undefined when the feature is off). */
@@ -244,7 +279,6 @@ export class PairingService {
             id: `t${this.tokenSerial}`,
             issuedAt: now,
             expiresAt: now + this.config.tokenTtlMs,
-            consumed: false,
             ...(workspaceId !== undefined ? { workspaceId } : {}),
             ...(address !== undefined ? { address } : {}),
         });
@@ -252,21 +286,20 @@ export class PairingService {
         return { token, expiresAt: now + this.config.tokenTtlMs };
     }
     /**
-     * Consume a token and bind a device session. One-time: the second
-     * successful call for the same token is impossible because the first
-     * consumes it.
+     * Redeem a token and bind a device session. The token is a bearer
+     * credential for its whole window, not a single-use nonce: it is refused
+     * only when unknown, past its expiry, or after stop(), and every successful
+     * call — including a repeat within the same window — mints a fresh device
+     * session (see the module doc for the mobile cookie-context rationale).
      * @param token - the token secret from the QR link.
      * @param userAgent - optional User-Agent header captured at accept.
      * @returns the new device id, or a refusal code.
      */
     accept(token, userAgent) {
         const record = this.tokens.get(token);
-        // A consumed token stays a valid bearer credential until expiry or
-        // replacement (see the module doc): re-accept mints a fresh device.
         if (record === undefined || this.stopped || this.clock.now() > record.expiresAt) {
             return { ok: false, code: 'invalid' };
         }
-        record.consumed = true;
         const deviceId = this.clock.randomToken();
         const now = this.clock.now();
         if (this.devices.size >= this.config.maxDevices) {
@@ -297,7 +330,7 @@ export class PairingService {
     stop() {
         this.tokens.clear();
         this.devices.clear();
-        this.persist();
+        this.persistRevocation();
         this.stopped = true;
         this.notify();
     }
@@ -312,7 +345,7 @@ export class PairingService {
             return false;
         if (!this.devices.delete(deviceId))
             return false;
-        this.persist();
+        this.persistRevocation();
         this.notify();
         return true;
     }
@@ -349,7 +382,9 @@ export class PairingService {
      */
     sweep() {
         const evicted = this.evictIdle();
-        if (evicted || this.dirty)
+        if (evicted)
+            this.persistRevocation();
+        else if (this.dirty)
             this.persist();
         this.notify();
     }
@@ -407,7 +442,7 @@ export class PairingService {
         const limit = this.config.idleExpireMs ?? DEFAULT_IDLE_EXPIRE_MS;
         if (this.clock.now() - session.lastSeenAt > limit) {
             this.devices.delete(deviceId);
-            this.persist();
+            this.persistRevocation();
             this.notify();
             return undefined;
         }
@@ -494,6 +529,20 @@ function relayEqual(a, b) {
 function sameStrings(a, b) {
     return a.length === b.length && a.every((value, index) => value === b[index]);
 }
+/**
+ * Canonical origin of a public base URL. An unparsable value is returned
+ * verbatim so the caller's malformed-base warning stays the single owner of
+ * that case.
+ * @param url - the configured public base.
+ */
+export function canonicalBaseUrl(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return url;
+    }
+}
 /** Strip control characters and cap the User-Agent stored with a session. */
 export function sanitizeUserAgent(raw) {
     if (raw === undefined)

package/lib/types/pairing.persist.test.js

@@ -180,4 +180,30 @@ describe('PairingService device persistence', () => {
         const deviceId = result.ok ? result.deviceId : '';
         expect(saved[deviceId]?.userAgent).toBe('Mozilla/5.0 TestPhone');
     });
+    it('operator is not left with a revocation that a restart silently undoes', () => {
+        // Given a device store that cannot be written (its parent path is a file)
+        // while a stale, readable store sits beside it.
+        const blocker = join(dir, 'blocker');
+        writeFileSync(blocker, 'not a directory');
+        const file = join(blocker, 'devices.json');
+        const removed = [];
+        const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock(), { removeFile: (path) => { removed.push(path); } });
+        // When the operator stops remote access and the write cannot be made durable.
+        service.stop();
+        // Then the stale store is handed to the removal step, so a restart cannot
+        // restore the revoked sessions from disk.
+        expect(removed).toEqual([file]);
+    });
+    it('operator keeps the device store when a revocation persist succeeds', () => {
+        // Given a writable device store with one paired device.
+        const file = join(dir, 'devices.json');
+        const removed = [];
+        const service = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock(), { removeFile: (path) => { removed.push(path); } });
+        const deviceId = pairDevice(service);
+        // When the device is revoked and the write lands.
+        expect(service.revoke(deviceId)).toBe(true);
+        // Then the store stays (with the row gone) and nothing is removed.
+        expect(removed).toEqual([]);
+        expect(JSON.parse(readFileSync(file, 'utf8'))).toEqual({});
+    });
 });

package/lib/types/posture.d.ts

@@ -9,15 +9,23 @@
  *
  * The probe issues loopback requests with a forged Host header — the exact
  * shape a tunnel or LAN client produces — and treats anything other than a
- * 403 as exposed: the fence is documented to refuse with 403, so any other
- * status means the request reached the RPC bridge.
+ * 403 or a 401 as exposed. The fence is documented to refuse with 403; the
+ * harness answers 401 when the Host fence PASSED but the browser-auth cookie
+ * is missing (the connection plugin checks the fence first and the cookie
+ * second). A 401 therefore means the /api surface is still gated — reporting
+ * it as open produced a false CRITICAL on exactly the supported LAN
+ * deployment (0.0.0.0 bind auto-trusts the LAN literals) and desensitized the
+ * one alarm that should mean a real exposure.
  */
 import type { ClientRequest, ClientRequestArgs } from 'node:http';
 /** One probed origin. */
 export interface PostureHost {
     /** The forged Host header value that was probed. */
     host: string;
-    /** True when the probe reached past the fence (anything but 403). */
+    /**
+     * True when the probe reached the RPC bridge without any gate refusing it
+     * (a status that is neither the fence's 403 nor the browser-auth 401).
+     */
     exposed: boolean;
 }
 /** One probe round. */

package/lib/types/posture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAGjE,yBAAyB;AACzB,MAAM,WAAW,WAAW;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,KAAK,EAAE,WAAW,EAAE,CAAA;CACrB;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAehH;AAED,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KAAK,aAAa,CAAA;AAyC5G,qBAAqB;AACrB,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAWzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAGxG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpG"}
+{"version":3,"file":"posture.d.ts","sourceRoot":"","sources":["../../src/posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAGjE,yBAAyB;AACzB,MAAM,WAAW,WAAW;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,uBAAuB;AACvB,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,KAAK,EAAE,WAAW,EAAE,CAAA;CACrB;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAehH;AAED,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,KAAK,aAAa,CAAA;AAyC5G,qBAAqB;AACrB,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAWzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAGxG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpG"}

package/lib/types/posture.js

@@ -9,8 +9,13 @@
  *
  * The probe issues loopback requests with a forged Host header — the exact
  * shape a tunnel or LAN client produces — and treats anything other than a
- * 403 as exposed: the fence is documented to refuse with 403, so any other
- * status means the request reached the RPC bridge.
+ * 403 or a 401 as exposed. The fence is documented to refuse with 403; the
+ * harness answers 401 when the Host fence PASSED but the browser-auth cookie
+ * is missing (the connection plugin checks the fence first and the cookie
+ * second). A 401 therefore means the /api surface is still gated — reporting
+ * it as open produced a false CRITICAL on exactly the supported LAN
+ * deployment (0.0.0.0 bind auto-trusts the LAN literals) and desensitized the
+ * one alarm that should mean a real exposure.
  */
 import http from 'node:http';
 /** Whether any probed origin is currently exposed. */
@@ -75,7 +80,7 @@ async function probeHost(port, hostHeader, request, timeoutMs) {
             path: '/api/session.list',
             headers: { host: hostHeader, 'content-type': 'application/json' },
             timeout: timeoutMs,
-        }, status => { finish(status !== 403); });
+        }, status => { finish(status !== 403 && status !== 401); });
         const timer = setTimeout(() => { finish(false); }, timeoutMs + 1_000);
         handle.on('error', () => { finish(false); });
         handle.end('{}');

package/lib/types/remote-api.d.ts

@@ -7,10 +7,14 @@
  * consult.
  *
  * Security model:
- * - While `requirePairingForLan` is on (default), every request must carry a
- *   live paired-device cookie, enforced before any bytes are forwarded and
- *   before any host call. With the policy off, the cookie gate is skipped
- *   (the local-only denials below still apply).
+ * - Every request must carry a live paired-device credential, enforced before
+ *   any bytes are forwarded and before any host call. This gate is
+ *   unconditional and does NOT follow `requirePairingForLan`: the channel
+ *   re-issues traffic with the process's own browser-auth credential, so it is
+ *   an authentication amplifier — an unpaired caller admitted here would reach
+ *   the full host API without ever holding that credential. The LAN policy
+ *   governs the plain `/api` surface only (whether the harness fence's LAN
+ *   auto-trust stands on its own); it can never widen this channel.
  * - A paired remote desktop is a full-control credential: the browser half
  *   flips the official UI into host mode (the transport ownsHost hook), so
  *   the configuration plane (settings, credentials, presets, deliverables)
@@ -31,15 +35,8 @@ export { REMOTE_API_PREFIX } from './remote-methods.ts';
 export interface RemoteApiDeps {
     /** The pairing service (device gate + cookie name). */
     service: PairingService;
-    /** The local webServer port the loopback proxy connects to. */
+    /** Local webServer port the loopback proxy connects to. */
     port: number;
-    /**
-     * Live policy: whether the paired-device cookie gates the /remote channel.
-     * When false, requests are proxied without a cookie (the loopback-only
-     * denials still apply). A function is re-read per request, so a settings
-     * edit takes effect without a restart. Defaults to true.
-     */
-    requirePairingForLan?: boolean | (() => boolean);
     /**
      * The process's inner browser-auth credential attached to re-issued
      * requests (the connection plugin's /api route enforces that cookie and
@@ -68,7 +65,7 @@ export declare function loopbackOnlyDenial(innerPath: string): string | undefine
 export declare function pairedDeviceIdOf(req: IncomingMessage, service: PairingService): string | undefined;
 /**
  * Build the remote desktop channel HTTP routes.
- * @param deps - pairing service + local port + live pairing policy.
+ * @param deps - pairing service + local port + inner credential.
  * @returns the routes to register on webServer.
  */
 export declare function makeRemoteApiRoutes(deps: RemoteApiDeps): WebRoute[];

package/lib/types/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAUhD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAQlG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA0CnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CA2CjF"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAUhD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAQlG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CAwCnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CAyCjF"}

package/lib/types/remote-api.js

@@ -7,10 +7,14 @@
  * consult.
  *
  * Security model:
- * - While `requirePairingForLan` is on (default), every request must carry a
- *   live paired-device cookie, enforced before any bytes are forwarded and
- *   before any host call. With the policy off, the cookie gate is skipped
- *   (the local-only denials below still apply).
+ * - Every request must carry a live paired-device credential, enforced before
+ *   any bytes are forwarded and before any host call. This gate is
+ *   unconditional and does NOT follow `requirePairingForLan`: the channel
+ *   re-issues traffic with the process's own browser-auth credential, so it is
+ *   an authentication amplifier — an unpaired caller admitted here would reach
+ *   the full host API without ever holding that credential. The LAN policy
+ *   governs the plain `/api` surface only (whether the harness fence's LAN
+ *   auto-trust stands on its own); it can never widen this channel.
  * - A paired remote desktop is a full-control credential: the browser half
  *   flips the official UI into host mode (the transport ownsHost hook), so
  *   the configuration plane (settings, credentials, presets, deliverables)
@@ -93,23 +97,21 @@ export function pairedDeviceIdOf(req, service) {
 }
 /**
  * Build the remote desktop channel HTTP routes.
- * @param deps - pairing service + local port + live pairing policy.
+ * @param deps - pairing service + local port + inner credential.
  * @returns the routes to register on webServer.
  */
 export function makeRemoteApiRoutes(deps) {
-    const { service, port, requirePairingForLan = true } = deps;
+    const { service, port } = deps;
     const handler = (req, res) => {
-        // Cookie gate first — same order as /m/api. Do not buffer an unpaired body.
-        // With the live policy off, untrusted-but-policy-open callers are proxied
-        // (a stale client rewrite must not 403); loopback-only denials stay below.
-        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
-        if (require) {
-            const paired = pairedDeviceIdOf(req, service);
-            if (paired === undefined) {
-                req.resume();
-                envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
-                return;
-            }
+        // Paired credential first — before any bytes are buffered or forwarded.
+        // Unconditional by design: this channel attaches the process's own
+        // browser-auth cookie to every re-issued call, so admitting an unpaired
+        // caller would hand out that credential's authority (issue #1665).
+        const paired = pairedDeviceIdOf(req, service);
+        if (paired === undefined) {
+            req.resume();
+            envelopeError(res, 403, 'invalid-request', 'unpaired', 'this device is not paired with the desktop');
+            return;
         }
         const method = req.method ?? 'GET';
         if (!ALLOWED_METHODS.has(method)) {
@@ -159,24 +161,22 @@ export function upgradeInnerPath(reqUrl, fallbackPath) {
  * @returns the upgrade routes to register on webServer.
  */
 export function makeRemoteApiUpgradeRoutes(deps) {
-    const { service, port, requirePairingForLan = true } = deps;
+    const { service, port } = deps;
     const handlerFor = (fallbackPath) => (req, socket, head) => {
-        const require = typeof requirePairingForLan === 'function' ? requirePairingForLan() : requirePairingForLan;
-        if (require) {
-            // WebSocket handshakes cannot carry headers from the Web API, so the
-            // cookieless credential rides the query; the cookie stays the primary.
-            let queryDevice;
-            try {
-                queryDevice = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams.get(REMOTE_DEVICE_QUERY) ?? undefined;
-            }
-            catch { /* fall through to the cookie */ }
-            const deviceId = pairedDeviceIdOf(req, service);
-            const paired = deviceId ?? (queryDevice !== undefined && service.touchDevice(queryDevice) ? queryDevice : undefined);
-            if (paired === undefined) {
-                socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-                socket.destroy();
-                return;
-            }
+        // WebSocket handshakes cannot carry headers from the Web API, so the
+        // cookieless credential rides the query; the cookie stays the primary.
+        // The gate is unconditional here too (issue #1665).
+        let queryDevice;
+        try {
+            queryDevice = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams.get(REMOTE_DEVICE_QUERY) ?? undefined;
+        }
+        catch { /* fall through to the cookie */ }
+        const deviceId = pairedDeviceIdOf(req, service);
+        const paired = deviceId ?? (queryDevice !== undefined && service.touchDevice(queryDevice) ? queryDevice : undefined);
+        if (paired === undefined) {
+            socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+            socket.destroy();
+            return;
         }
         const inner = upgradeInnerPath(req.url, fallbackPath);
         const denied = loopbackOnlyDenial(inner.split('?')[0] ?? inner);

package/lib/types/remote-channel-boot.d.ts

@@ -17,7 +17,12 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. It finally publishes the official pre-Cordis
+ * gated /remote channel. Host mode is server-granted, not origin-asserted:
+ * the hook is installed only when the device-gated app landing (/pair-app)
+ * published the grant marker (REMOTE_HOST_GRANT_GLOBAL) ahead of this
+ * script, so a shell served to an unpaired browser - a fence-open
+ * deployment - never presents itself as the machine owner. It finally
+ * publishes the official pre-Cordis
  * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
  * transport otherwise runs inside a Web Worker whose own globals the
  * main-thread rewrite cannot reach (issue #1580). The script self-skips on

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAqJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAwJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -17,7 +17,12 @@
  * transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
  * connection plugin reads it: the paired remote desktop gets the full
  * settings/credentials/presets surface, and every call still rides the
- * gated /remote channel. It finally publishes the official pre-Cordis
+ * gated /remote channel. Host mode is server-granted, not origin-asserted:
+ * the hook is installed only when the device-gated app landing (/pair-app)
+ * published the grant marker (REMOTE_HOST_GRANT_GLOBAL) ahead of this
+ * script, so a shell served to an unpaired browser - a fence-open
+ * deployment - never presents itself as the machine owner. It finally
+ * publishes the official pre-Cordis
  * upload hook (`__DSH_FILE_UPLOAD__`), because the background upload
  * transport otherwise runs inside a Web Worker whose own globals the
  * main-thread rewrite cannot reach (issue #1580). The script self-skips on
@@ -38,14 +43,17 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
     return '(function(){' +
         'try{' +
         'var w=window,loc=w.location,h=loc.hostname;' +
-        // Loopback origins keep the original paths (mirrors isLoopbackHostname).
-        "if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
-        // Host mode: the paired remote desktop presents itself as the machine
-        // owner, so the official UI keeps its full configuration surface (the
-        // settings mirror, document controller, and deliverables open actions
-        // all branch on connection.isLoopback). Must run before any boot entry.
-        'try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}' +
+        // Loopback origins (including the bracketed IPv6 literal WHATWG returns)
+        // keep the original paths (mirrors isLoopbackHostname).
+        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
         'var R=' + json + ';' +
+        // Host mode is server-granted: only the device-gated app landing
+        // publishes the grant marker (in a capture script that runs ahead of
+        // this one), so a shell that merely sits on a non-loopback origin - an
+        // unpaired browser reaching a fence-open deployment - keeps the official
+        // UI's memory-scope presentation instead of posing as the machine owner.
+        // Must run before any boot entry.
+        'try{if(w[R.hostGrantGlobal]===true){if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}}catch(e){}' +
         // The cookieless device credential: read lazily per call - the
         // /pair-app capture script sets it in head AFTER this boot script ran,
         // so a parse-time read would always see null.

package/lib/types/remote-channel-rules.d.ts

@@ -11,6 +11,12 @@ import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from './remote-methods.ts';
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export declare const REMOTE_API_PREFIX = "/remote/api";
+/**
+ * The window global the device-gated app landing publishes to grant host mode.
+ * Set by the /pair-app capture script, read by the parse-time boot patch: the
+ * transport hook (ownsHost) is server-granted, not asserted from the origin.
+ */
+export declare const REMOTE_HOST_GRANT_GLOBAL = "__DSH_REMOTE_HOST_GRANT__";
 /** Every decision input of the remote-channel rewrite, JSON-serializable. */
 export interface RemoteChannelRules {
     readonly remotePrefix: string;
@@ -32,6 +38,14 @@ export interface RemoteChannelRules {
     readonly uploadPath: string;
     /** Page global the pre-Cordis upload hook is published under. */
     readonly uploadHookGlobal: string;
+    /**
+     * Page global carrying the server-issued host-mode grant. Only the plugin's
+     * own device-gated app landing (/pair-app) publishes it; the boot patch
+     * therefore enables the official UI's host mode only for a shell the server
+     * actually granted, never for one that merely happens to sit on a
+     * non-loopback origin.
+     */
+    readonly hostGrantGlobal: string;
 }
 /** The live rule set. */
 export declare const REMOTE_CHANNEL_RULES: RemoteChannelRules;

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAuBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAyBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -11,6 +11,12 @@ import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from "./remote-methods.js";
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
+/**
+ * The window global the device-gated app landing publishes to grant host mode.
+ * Set by the /pair-app capture script, read by the parse-time boot patch: the
+ * transport hook (ownsHost) is server-granted, not asserted from the origin.
+ */
+export const REMOTE_HOST_GRANT_GLOBAL = '__DSH_REMOTE_HOST_GRANT__';
 /** The live rule set. */
 export const REMOTE_CHANNEL_RULES = {
     remotePrefix: REMOTE_PREFIX,
@@ -28,6 +34,7 @@ export const REMOTE_CHANNEL_RULES = {
         '/api/remote.mux',
         '/sidebar/ws/terminal',
         '/sidebar/ws/agent-terminals',
+        '/sidebar/ws/agent-opens',
         '/api/dsh-ssh/terminal',
     ],
     deviceHeader: REMOTE_DEVICE_HEADER,
@@ -35,6 +42,7 @@ export const REMOTE_CHANNEL_RULES = {
     deviceQuery: REMOTE_DEVICE_QUERY,
     uploadPath: '/api/session/uploadFileBinary',
     uploadHookGlobal: '__DSH_FILE_UPLOAD__',
+    hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL,
 };
 /** The window global the boot patch publishes its seat under. */
 export const REMOTE_CHANNEL_BOOT_GLOBAL = '__DSH_REMOTE_CHANNEL_BOOT__';

package/lib/types/remote-methods.d.ts

@@ -31,7 +31,7 @@ export declare const REMOTE_API_PATHS: {
  * Exact upgrade paths registered on webServer (the SDK matches upgrades by
  * exact path, not prefix). Query strings ride on the request URL.
  */
-export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/remote.mux", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/api/dsh-ssh/terminal"];
+export declare const REMOTE_UPGRADE_PATHS: readonly ["/remote/api/remote.mux", "/remote/sidebar/ws/terminal", "/remote/sidebar/ws/agent-terminals", "/remote/sidebar/ws/agent-opens", "/remote/api/dsh-ssh/terminal"];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */
 export declare const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
 /** Family settings-bridge HTTP prefix — re-exposed to paired devices (plain settings parity). */

package/lib/types/remote-methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,0IAKvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}
+{"version":3,"file":"remote-methods.d.ts","sourceRoot":"","sources":["../../src/remote-methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;CAEnB,CAAA;AAEV;;;GAGG;AACH,eAAO,MAAM,oBAAoB,4KAMvB,CAAA;AAEV,wEAAwE;AACxE,eAAO,MAAM,mBAAmB,wBAAwB,CAAA;AAExD,iGAAiG;AACjG,eAAO,MAAM,2BAA2B,6BAA6B,CAAA;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAA;AACzD,eAAO,MAAM,mBAAmB,WAAW,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIvC,CAAA;AAEV;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE"}

package/lib/types/remote-methods.js

@@ -35,6 +35,7 @@ export const REMOTE_UPGRADE_PATHS = [
     REMOTE_API_PATHS.mux,
     `${REMOTE_PREFIX}/sidebar/ws/terminal`,
     `${REMOTE_PREFIX}/sidebar/ws/agent-terminals`,
+    `${REMOTE_PREFIX}/sidebar/ws/agent-opens`,
     `${REMOTE_API_PREFIX}/dsh-ssh/terminal`,
 ];
 /** Plugin-manager HTTP prefix: install/remove stay physically local. */