@linxin666/dsh-remote-web-ui 0.3.24 → 0.4.1

package/src/client/index.ts

@@ -10,12 +10,12 @@
 import { createElement } from 'react'
 import { createRoot } from 'react-dom/client'
 import type { Context as ClientContext } from '@deepseek-ai/cordis'
-import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm, ConfigForms } from '@deepseek-ai/dsh-client-ui-settings/client'
 // Type-only: pulls the locale plugin's Context merge (ctx.locale) and the
 // ui-sidebar SlotMap merge (the 'sidebar.footer.action' hole).
 import type {} from '@deepseek-ai/dsh-client-locale/client'
 // Type-only: pulls the settings-surface SlotMap merge (the 'settings.section'
-// entry) and the ctx.settingsScope Context merge.
+// entry) and the ctx.configForms Context merge.
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar/client'
 // Type-only: pulls the ctx.slots merge (the renderer owns the slot registry since 0.1.2).
@@ -27,7 +27,7 @@ import { PairFailedNotice } from './PairFailedNotice.tsx'
 import { RemoteSettingsCard, RemoteSettingsCardController, type RemoteSettings } from './RemoteSettingsCard.tsx'
 import { en, zh, type RemoteKey } from './locales.ts'
 import { PAIR_FAILED_MARKER, runPairBootFlow } from './deep-link.ts'
-import { readPairGatePolicy, sendHeartbeat } from './pair-api.ts'
+import { readPairGatePolicy, sendHeartbeat, shouldStopHeartbeat } from './pair-api.ts'
 import {
   channelTransition,
   installRemoteChannel,
@@ -67,9 +67,9 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
      */
     /**
      * The child slot the Web UI plugin group declares; this card registers
-     * into the group instead of the top-level `settings.plugin.item` list.
-     * Spelled here with the same shape so this package can register without
-     * depending on the sibling UI package.
+     * into the group's list seat rather than the official
+     * bundle-configuration seat. Spelled here with the same shape so this
+     * package can register without depending on the sibling UI package.
      */
     'web-ui.plugin.item': { kind: 'list'; scope: 'root'; owner: SettingsPluginItemOwnerProps }
   }
@@ -90,11 +90,18 @@ export interface SettingsPluginItemOwnerProps {
 declare module '@deepseek-ai/cordis' {
   interface Context {
     /**
-     * Optional rc.6 compatibility binder provided by dsh-web-settings;
-     * absent when that group plugin is not installed, so callers fall back to
-     * the official settings scope.
+     * Optional family settings binder provided by dsh-web-settings; absent
+     * when that group plugin is not installed, so callers fall back to the
+     * official `ctx.configForms` service.
+     *
+     * The 0.1.7 client addresses one form per active profile entry id and
+     * carries no package identity, so the family binder resolves a family
+     * settings namespace to the entry that owns it and hands back that entry's
+     * shared form; the official service is addressed by the entry id directly.
      */
-    webUiSettings?: { bind<S>(spec: SettingsScopeSpec<S>): SettingsScope<S> }
+    webUiSettings?: {
+      bind<S>(spec: { namespace: string; decode?: (section: unknown) => S | undefined }): ConfigForm<S>
+    }
   }
 }
 
@@ -104,12 +111,25 @@ const NS = 'remote'
 
 /** Settings namespace the remote-control card edits (the Host plugin registers it). */
 const REMOTE_WEB_UI_NS = 'remote-web-ui'
+const AGGREGATE_ENTRY_ID = 'web-ui-remote-web-ui'
+const REMOTE_WEB_UI_ENTRY_IDS: readonly string[] = [AGGREGATE_ENTRY_ID, 'ui-remote-web-ui', REMOTE_WEB_UI_NS]
+
+function servedEntryId(forms: ConfigForms): string {
+  let served: readonly string[] | undefined
+  try {
+    served = forms.describe().getSnapshot().view?.namespaces.map(view => view.ns)
+  } catch {
+    served = undefined
+  }
+  if (!served || served.length === 0) return REMOTE_WEB_UI_NS
+  return REMOTE_WEB_UI_ENTRY_IDS.find(id => served.includes(id)) ?? REMOTE_WEB_UI_NS
+}
 
 /** Heartbeat cadence from a paired phone (presence + revocation liveness). */
 const HEARTBEAT_INTERVAL_MS = 10_000
 
 /** Services required by this plugin. */
-export const inject = ['slots', 'locale', 'connection', 'settingsScope', 'remote']
+export const inject = ['slots', 'locale', 'connection', 'configForms', 'remote']
 
 /**
  * Register the remote-control surface.
@@ -178,10 +198,17 @@ export function apply(ctx: ClientContext): void {
   // before any dictionary existed; the wiring plus the layer's own sync tick
   // re-render them in the active locale.
   if (adapt !== undefined) adapt.translate = t
-  const binder = ctx.get('webUiSettings') ?? ctx.settingsScope
-  const settingsScope = binder.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
+  // The settings form this card edits. The family group's binder resolves a
+  // family namespace to the profile entry that owns it and binds that entry's
+  // shared form (natively, or over its loopback bridge); without that group the
+  // namespace IS the owning entry id, so the official service is addressed
+  // directly.
+  const family = ctx.get('webUiSettings')
+  const settingsForm: ConfigForm<RemoteSettings> = family !== undefined && typeof family.bind === 'function'
+    ? family.bind<RemoteSettings>({ namespace: REMOTE_WEB_UI_NS })
+    : ctx.configForms.get<RemoteSettings>(servedEntryId(ctx.configForms))
   const enabled = (): boolean => {
-    const snapshot = settingsScope.getSnapshot()
+    const snapshot = settingsForm.getSnapshot()
     return snapshot.status === 'ready'
       ? snapshot.value?.enabled ?? true
       : snapshot.status === 'unavailable'
@@ -196,7 +223,7 @@ export function apply(ctx: ClientContext): void {
   const syncAdaptEnabled = (): void => {
     ;(window as unknown as { __dshRemoteAdapt?: RemoteAdaptGlobal }).__dshRemoteAdapt?.setEnabled?.(enabled())
   }
-  settingsScope.subscribe(syncAdaptEnabled)
+  settingsForm.subscribe(syncAdaptEnabled)
   syncAdaptEnabled()
   // The replay closes a details panel restored before the wiring; the
   // layout face throws while the root entry has not mounted yet (a real
@@ -224,7 +251,7 @@ export function apply(ctx: ClientContext): void {
         disposeEntry = undefined
       }
     }
-    const unsubscribe = settingsScope.subscribe(syncEntry)
+    const unsubscribe = settingsForm.subscribe(syncEntry)
     syncEntry()
     return () => {
       unsubscribe()
@@ -234,12 +261,12 @@ export function apply(ctx: ClientContext): void {
 
   // Plugin configuration card: one staged form over the `remote-web-ui`
   // settings namespace, contributed to whichever plugin-card seat the running
-  // host declares (the family group's list seat, or the official keyed seat of
-  // the plugin-configuration tab when dsh-web-settings is not installed —
-  // issue #1589).
-  const remoteSettings = new RemoteSettingsCardController(settingsScope)
+  // host declares (the family group's list seat, or the official
+  // bundle-configuration seat on the plugin manager page when dsh-web-settings
+  // is not installed).
+  const remoteSettings = new RemoteSettingsCardController(settingsForm)
   installPluginCard(ctx, {
-    namespace: REMOTE_WEB_UI_NS,
+    bundle: '@linxin666/dsh-remote-web-ui',
     id: 'remote-web-ui',
     order: 90,
     locale: NS,
@@ -259,7 +286,14 @@ export function apply(ctx: ClientContext): void {
         const loopback = connection?.isLoopback ?? true
         runPairBootFlow(ctx, window.location.search)
         if (loopback) return () => {}
-        const timer = window.setInterval(() => { void sendHeartbeat().catch(() => {}) }, HEARTBEAT_INTERVAL_MS)
+        const timer = window.setInterval(() => {
+          void sendHeartbeat().then((status) => {
+            // A revoked (401) or fenced-off (403) page can never be accepted
+            // again without re-pairing, so the 10 s wake source stops instead of
+            // polling a refusal for the lifetime of the tab.
+            if (shouldStopHeartbeat(status)) window.clearInterval(timer)
+          }).catch(() => {})
+        }, HEARTBEAT_INTERVAL_MS)
         return () => { window.clearInterval(timer) }
       }, 'remote-web-ui: pair flow + heartbeats')
     } else if (!enabled() && disposeRuntime !== undefined) {
@@ -267,7 +301,7 @@ export function apply(ctx: ClientContext): void {
       disposeRuntime = undefined
     }
   }
-  settingsScope.subscribe(syncRuntime)
+  settingsForm.subscribe(syncRuntime)
   syncRuntime()
 
   // Remote desktop channel: on a non-loopback origin (LAN address or public
@@ -292,7 +326,7 @@ export function apply(ctx: ClientContext): void {
     fenceNotice = undefined
   }
   const handleUnpaired = (): void => {
-    if (settingsScope.getSnapshot().status !== 'ready' && hostPairingPolicy === undefined) {
+    if (settingsForm.getSnapshot().status !== 'ready' && hostPairingPolicy === undefined) {
       unpairedWhilePolicyPending = true
       return
     }
@@ -300,7 +334,7 @@ export function apply(ctx: ClientContext): void {
   }
   const channelActive = (): boolean => remoteChannelRequired(
     window.location.hostname,
-    settingsScope.getSnapshot(),
+    settingsForm.getSnapshot(),
     hostPairingPolicy,
   )
   // The parse-time boot patch (issue #987), when the served index carried
@@ -351,9 +385,9 @@ export function apply(ctx: ClientContext): void {
       bootSeat()?.restore()
     }
   }
-  settingsScope.subscribe(syncChannel)
+  settingsForm.subscribe(syncChannel)
   syncChannel()
-  if (!isLoopbackHostname(window.location.hostname) && settingsScope.getSnapshot().status !== 'ready') {
+  if (!isLoopbackHostname(window.location.hostname) && settingsForm.getSnapshot().status !== 'ready') {
     void readPairGatePolicy().then((policy) => {
       hostPairingPolicy = policy.requirePairingForLan
       syncChannel()

package/src/client/locales.ts

@@ -31,9 +31,9 @@ export const zh = {
   'pair.linkLabel': '配对链接',
   'pair.tokenLabel': '配对令牌',
   'pair.dockerHint': 'Docker 或反向代理环境下，可直接复制此令牌并在目标设备配对页面输入。',
-  'pair.oneTimeHint': '链接含一次性令牌；任一设备配对成功后立即失效，配对下一台设备请刷新二维码。',
+  'pair.oneTimeHint': '链接含限时令牌；在令牌过期或刷新二维码之前，同一链接可为多台设备完成配对（每次配对各自生成独立设备会话）。',
   'pair.failed.title': '配对失败',
-  'pair.failed.detail': '链接无效或已使用，请回到电脑端刷新二维码后重新扫码。',
+  'pair.failed.detail': '链接无效或已过期，请回到电脑端刷新二维码后重新扫码。',
   'fence.unpaired.title': '此设备未配对，无法访问工作区数据',
   'fence.unpaired.eyebrow': '需要设备配对',
   'fence.unpaired.hint': '为保护工作区、会话与插件数据，远程电脑必须先通过主电脑授权。',
@@ -45,7 +45,6 @@ export const zh = {
   'fence.unpaired.pairAction': '立即配对',
   'fence.unpaired.pairing': '配对中…',
   'fence.unpaired.tokenInvalid': '配对链接或 Token 无效已过期',
-  'fence.unpaired.tokenUsed': '该配对链接已被使用',
   'fence.unpaired.tokenFailed': '配对失败，请检查网络或重新获取链接',
   'fence.unpaired.footnote': '请勿使用他人提供的配对链接；管理员可随时取消此设备的授权。',
   'posture.exposed': '/api 通道对未配对设备敞开',
@@ -72,7 +71,7 @@ export const zh = {
   'relay.registering': '正在把临时隧道同步到固定域名（<id>.dsh-market.com）…',
   'relay.failed': '固定域名同步失败：{error}。正在自动重试，期间二维码可能使用临时地址。',
   'close.label': '关闭远程访问面板',
-  // 插件设置卡片（settings.plugin.item 席位）。
+  // 插件设置卡片（家族 list 席位，或官方 plugins.bundle.config 席位）。
   'settings.title': '远程访问设置',
   'settings.description': '配对安全与设备限额。',
   'settings.enabled': '启用远程访问',
@@ -205,9 +204,9 @@ export const en = {
   'pair.linkLabel': 'Pairing link',
   'pair.tokenLabel': 'Pairing token',
   'pair.dockerHint': 'In Docker or reverse proxy environments, copy this token to pair directly on the target device.',
-  'pair.oneTimeHint': 'The link carries one single-use token; it dies as soon as any device pairs. Refresh the QR to pair the next device.',
+  'pair.oneTimeHint': 'The link carries a time-limited token: until it expires or the QR is refreshed, the same link can pair several devices, each with its own device session.',
   'pair.failed.title': 'Pairing failed',
-  'pair.failed.detail': 'The link is invalid or was already used. Refresh the QR code on your computer and scan again.',
+  'pair.failed.detail': 'The link is invalid or has expired. Refresh the QR code on your computer and scan again.',
   'fence.unpaired.title': 'This device is not paired and cannot reach workspace data',
   'fence.unpaired.eyebrow': 'Device pairing required',
   'fence.unpaired.hint': 'To protect workspace, session, and plugin data, a remote computer must first be authorized by the primary computer.',
@@ -219,7 +218,6 @@ export const en = {
   'fence.unpaired.pairAction': 'Pair Now',
   'fence.unpaired.pairing': 'Pairing…',
   'fence.unpaired.tokenInvalid': 'Pairing link or token is invalid or expired',
-  'fence.unpaired.tokenUsed': 'This pairing link has already been used',
   'fence.unpaired.tokenFailed': 'Pairing failed, please check network or issue a new link',
   'fence.unpaired.footnote': 'Do not use pairing links from people you do not trust. An administrator can revoke this device at any time.',
   'posture.exposed': 'The /api channel is open to unpaired devices',
@@ -246,7 +244,7 @@ export const en = {
   'relay.registering': 'Syncing the ephemeral tunnel to the stable hostname (<id>.dsh-market.com)…',
   'relay.failed': 'Stable-hostname sync failed: {error}. Retrying automatically; the QR may use the ephemeral address meanwhile.',
   'close.label': 'Close remote access panel',
-  // Plugin settings card (the `settings.plugin.item` seat).
+  // Plugin settings card (the family list seat, or the official bundle-config seat).
   'settings.title': 'Remote access settings',
   'settings.description': 'Pairing security and device limits.',
   'settings.enabled': 'Enable remote access',

package/src/client/mobile-adapt.ts

@@ -353,7 +353,7 @@ export function startMobileAdapt(): void {
   let whaleSuppressClick = false
   let whaleShown = false
   let drag: { x: number; y: number; left: number; top: number; moved: boolean } | null = null
-  let swipeTouch: { x: number; y: number; id: number } | null = null
+  let swipeTouch: { x: number; y: number; id: number; el: Element | null } | null = null
   let lastComposerTap = 0
   // Plugin master switch: the module-scope layer installs before any config
   // is readable, so the plugin apply() flips this through setEnabled() once
@@ -368,7 +368,7 @@ export function startMobileAdapt(): void {
    * rail compaction) while the body class stays.
    */
   function ensureAdaptStyle(): void {
-    if (document.querySelector(`style[data-plugin-css="${ADAPT_CSS_ID}"]`) !== null) return
+    if (nodeOf(`style[data-plugin-css="${ADAPT_CSS_ID}"]`) !== null) return
     const tag = document.createElement('style')
     tag.dataset.plugin = 'remote-web-ui'
     tag.dataset.pluginCss = ADAPT_CSS_ID
@@ -421,6 +421,9 @@ export function startMobileAdapt(): void {
       savedViewportContent = null
     }
     if (whaleEl !== null) whaleEl.style.display = 'none'
+    // The next apply() is a hidden-to-shown transition again: without this the
+    // whale would keep its pre-revert position state and skip the clamp.
+    whaleShown = false
     setWhaleTimer(false)
     if (whaleObserver !== null) {
       whaleObserver.disconnect()
@@ -492,7 +495,7 @@ export function startMobileAdapt(): void {
 
   function syncCompactPicker(): void {
     if (!active) return
-    const tools = document.querySelector('[class$="_composerSeat"] [class$="_tools"]')
+    const tools = nodeOf('[class$="_composerSeat"] [class$="_tools"]')
     const trigger = tools?.parentElement?.querySelector('[class$="_triggerEffort"]')?.parentElement
     if (tools === null || trigger === null) {
       removeCompactPicker()
@@ -651,18 +654,25 @@ export function startMobileAdapt(): void {
     document.body.appendChild(whale)
   }
 
+  /**
+   * Write one row's recorded official draggable state back onto it.
+   * @param row - the tracked row element.
+   * @param original - the recorded attribute value, or null when it was absent.
+   */
+  function restoreRowDragState(row: Element, original: string | null): void {
+    if (original === null) row.removeAttribute('draggable')
+    else row.setAttribute('draggable', original)
+  }
+
   /**
    * Restore the official draggable state this layer overrode while active.
    * Rows are React-owned and may have been re-created meanwhile, so only the
-   * tracked elements are touched; a detached element is skipped.
+   * tracked elements are touched; a detached element is written back too
+   * (harmless, and it keeps the entry prunable at every tick).
    */
   function restoreRowDrag(): void {
     if (dragOverridden.size === 0) return
-    for (const [row, original] of dragOverridden) {
-      if (!row.isConnected) continue
-      if (original === null) row.removeAttribute('draggable')
-      else row.setAttribute('draggable', original)
-    }
+    for (const [row, original] of dragOverridden) restoreRowDragState(row, original)
     dragOverridden.clear()
   }
 
@@ -699,6 +709,41 @@ export function startMobileAdapt(): void {
         row.setAttribute('draggable', 'false')
       }
     }
+    // React replaces rows as the session list re-renders; a detached row can
+    // never be restored by a later revert, so keeping it here would retain the
+    // whole detached subtree (and its children) for the page lifetime. Its
+    // official state goes back on the node itself and the entry is dropped:
+    // a node React re-attaches is recorded again on the next tick.
+    if (dragOverridden.size === 0) return
+    for (const [row, original] of dragOverridden) {
+      if (row.isConnected) continue
+      restoreRowDragState(row, original)
+      dragOverridden.delete(row)
+    }
+  }
+
+  /**
+   * Official nodes resolved through the document and cached while they stay
+   * connected. The sync tick runs every 600ms for the page lifetime, and these
+   * selectors (suffix class matches, :has()) cannot use Blink's fast paths, so
+   * every miss walks the whole mounted DOM — the official chat keeps the whole
+   * conversation mounted, i.e. tens of thousands of elements. React replaces a
+   * node on a major re-render, which the isConnected guard detects.
+   */
+  const nodeCache = new Map<string, Element>()
+  function nodeOf(selector: string): Element | null {
+    const cached = nodeCache.get(selector)
+    if (cached !== undefined && cached.isConnected) return cached
+    const found = document.querySelector(selector)
+    if (found === null) nodeCache.delete(selector)
+    else nodeCache.set(selector, found)
+    return found
+  }
+
+  /** The official application frame, through the same cached lookup. */
+  function frameEl(): HTMLElement | null {
+    const frame = nodeOf(APP_FRAME_SELECTOR)
+    return frame instanceof HTMLElement ? frame : null
   }
 
   function syncWhale(): void {
@@ -710,8 +755,8 @@ export function startMobileAdapt(): void {
       whaleEl.style.display = 'none'
       return
     }
-    const collapsed = appFrame()?.hasAttribute('data-sidebar-collapsed') === true
-    const overlayUp = document.querySelector('[class$="_overlay"]') !== null
+    const collapsed = frameEl()?.hasAttribute('data-sidebar-collapsed') === true
+    const overlayUp = nodeOf('[class$="_overlay"]') !== null
     const show = collapsed && !overlayUp
     // Restore on every hidden-to-shown transition — including the very
     // first show on a fresh page load, where the inline display is still
@@ -738,7 +783,7 @@ export function startMobileAdapt(): void {
   // sessions, and hiding the actions without a seat target made them vanish.
   function seatHeaderActions(): void {
     if (!active) return
-    const header = document.querySelector('[class$="_header"]')
+    const header = nodeOf('[class$="_header"]')
     const tabs = header !== null ? header.querySelector('[class$="_tabs"]') : null
     const actions = header !== null ? header.querySelector('[class$="_titleCluster"] [class$="_headerActions"]') : null
     // The actions node is NOT moved: it is a React-owned host node whose badge
@@ -760,7 +805,7 @@ export function startMobileAdapt(): void {
   // and converged each time the header geometry is dirty.
   function alignActionsText(): void {
     if (!active) return
-    const header = document.querySelector('[class$="_header"]')
+    const header = nodeOf('[class$="_header"]')
     if (header === null) return
     const tabs = header.querySelector('[class$="_tabs"]')
     const actions = header.querySelector('[class$="_titleCluster"] [class$="_headerActions"]')
@@ -872,6 +917,11 @@ export function startMobileAdapt(): void {
     if (isMobilePortrait()) {
       apply()
       ensureWhaleObserver()
+      // A viewport shrink (split-screen, foldable, rotation) can leave the
+      // whale — the only portrait sidebar entry — parked beyond the new right
+      // edge while it stays visible; re-clamp it here. Skipped mid-drag so a
+      // resize cannot yank the button away from the finger.
+      if (active && drag === null) applyWhalePos()
     } else {
       revert()
     }
@@ -970,13 +1020,17 @@ export function startMobileAdapt(): void {
     }
     const t = e.target
     const editable = t instanceof HTMLElement && t.isContentEditable
-    if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT' || editable || t.closest(`#${WHALE_ID}`) !== null || insideHScrollable(t) || t.closest('table, [class$="_table"], [class$="_tablePane"]') !== null)) {
+    if (t instanceof Element && (t.tagName === 'TEXTAREA' || t.tagName === 'INPUT' || editable || t.closest(`#${WHALE_ID}`) !== null || t.closest('table, [class$="_table"], [class$="_tablePane"]') !== null)) {
       swipeTouch = null
       return
     }
     const ct = e.changedTouches[0]
     if (ct === undefined) return
-    swipeTouch = { x: ct.clientX, y: ct.clientY, id: ct.identifier }
+    // The horizontally-scrollable veto is judged at release (see touchend):
+    // evaluating it here forced a style recalc plus a synchronous layout on
+    // every tap and scroll-start while the page was dirty, for a gesture that
+    // mostly never becomes a swipe.
+    swipeTouch = { x: ct.clientX, y: ct.clientY, id: ct.identifier, el: t instanceof Element ? t : null }
   }, { capture: true, passive: true })
   document.addEventListener('touchend', (e) => {
     if (swipeTouch === null) return
@@ -986,12 +1040,17 @@ export function startMobileAdapt(): void {
     if (ct === undefined || ct.identifier !== swipeTouch.id) return
     const dx = ct.clientX - swipeTouch.x
     const dy = ct.clientY - swipeTouch.y
+    const start = swipeTouch
     swipeTouch = null
     if (!active) return
     if (Math.abs(dx) < 60 || Math.abs(dx) < Math.abs(dy) * 1.5) return
-    const frame = appFrame()
+    // A gesture that started inside a horizontally scrollable container belongs
+    // to that container, not to the sidebar. Judged now, only for a gesture
+    // that already qualified as a swipe.
+    if (start.el !== null && insideHScrollable(start.el)) return
+    const frame = frameEl()
     if (frame === null) return
-    if (document.querySelector('[class$="_overlay"], [class$="_dialog"], [class$="_menu"], [class*="_portal"]') !== null) return
+    if (nodeOf('[class$="_overlay"], [class$="_dialog"], [class$="_menu"], [class*="_portal"]') !== null) return
     const collapsed = frame.hasAttribute('data-sidebar-collapsed')
     if (dx < 0 && !collapsed) collapseSidebar()
     else if (dx > 0 && collapsed) toggleSidebarVerified()
@@ -1132,10 +1191,23 @@ export function startMobileAdapt(): void {
     return isComposerField(el) ? el : null
   }
   const lanOrigFocus = HTMLElement.prototype.focus
-  HTMLElement.prototype.focus = function (this: HTMLElement, options?: FocusOptions): void {
+  const patchedFocus = function (this: HTMLElement, options?: FocusOptions): void {
     if (active && isComposerField(this) && Date.now() - lastComposerTap >= 800) return
     lanOrigFocus.call(this, options)
   }
+  /** (Re-)install the composer-focus guard (see setEnabled). */
+  const installFocusPatch = (): void => {
+    HTMLElement.prototype.focus = patchedFocus
+  }
+  /**
+   * Remove the guard when the layer is disabled. A patch another plugin
+   * installed after ours is left alone (identity check), so disabling this
+   * layer never removes someone else's behavior.
+   */
+  const restoreFocusPatch = (): void => {
+    if (HTMLElement.prototype.focus === patchedFocus) HTMLElement.prototype.focus = lanOrigFocus
+  }
+  installFocusPatch()
   document.addEventListener('pointerdown', (e) => {
     if (!active) return
     if (composerFieldOf(e.target) !== null) lastComposerTap = Date.now()
@@ -1151,8 +1223,13 @@ export function startMobileAdapt(): void {
     translate: null,
     setEnabled(on: boolean): void {
       adaptEnabled = on
-      if (on) evaluate()
-      else revert()
+      if (on) {
+        installFocusPatch()
+        evaluate()
+      } else {
+        revert()
+        restoreFocusPatch()
+      }
     },
     flushCloseDetails(): void {
       // The first apply() ran before any wiring existed, so its

package/src/client/pair-api.ts

@@ -53,7 +53,7 @@ export async function readPairGatePolicy(): Promise<PairGatePolicy> {
 }
 
 /** accept() refusal codes. */
-export type AcceptFailure = { ok: false; code: 'invalid' | 'used' | 'forbidden' }
+export type AcceptFailure = { ok: false; code: 'invalid' | 'forbidden' }
 
 /** One auto-tunnel status frame (absent while the feature is off). */
 export interface TunnelStatusFrame {
@@ -145,8 +145,9 @@ export async function acceptPair(token: string): Promise<{ ok: true } | AcceptFa
     body: JSON.stringify({ token }),
   })
   if (response.ok) return { ok: true }
-  if (response.status === 404) return { ok: false, code: 'invalid' }
-  if (response.status === 409) return { ok: false, code: 'used' }
+  // 409 is the legacy "already used" answer a pre-bearer-token host could send;
+  // it means the same thing to the caller as a 404.
+  if (response.status === 404 || response.status === 409) return { ok: false, code: 'invalid' }
   return { ok: false, code: 'forbidden' }
 }
 
@@ -170,9 +171,25 @@ export async function revokePair(deviceId: string): Promise<void> {
   if (!response.ok) throw new Error(`remote-web-ui: revoke failed with ${String(response.status)}`)
 }
 
-/** Presence heartbeat from a paired phone (unpaired heartbeats 401 harmlessly). */
-export async function sendHeartbeat(): Promise<void> {
-  await fetch('/api/pair/heartbeat', { method: 'POST' })
+/**
+ * Presence heartbeat from a paired phone.
+ * @returns the response status, so the caller can stop polling once the server
+ *   proves this page is not paired (see {@link shouldStopHeartbeat}).
+ */
+export async function sendHeartbeat(): Promise<number> {
+  const response = await fetch('/api/pair/heartbeat', { method: 'POST' })
+  return response.status
+}
+
+/**
+ * Whether a heartbeat answer means "this page can never be accepted again" and
+ * the 10 s wake source should stop: 401 (unpaired, or the device was revoked)
+ * and 403 (the fence refused it) are permanent for this page, while a network
+ * error or a 5xx is transient and keeps the cadence.
+ * @param status - the heartbeat response status.
+ */
+export function shouldStopHeartbeat(status: number): boolean {
+  return status === 401 || status === 403
 }
 
 /** Whether the current page URL carries a pairing token. */
@@ -210,13 +227,36 @@ export interface LanBindFrame {
   pendingRestart?: boolean
 }
 
+/** A failed LAN-bind read, carrying the HTTP status when the server answered. */
+export class LanBindStatusError extends Error {
+  /**
+   * @param status - the response status, or undefined when the request failed
+   *   before a response (network error).
+   * @param message - the diagnostic message.
+   */
+  constructor(public readonly status: number | undefined, message: string) {
+    super(message)
+    this.name = 'LanBindStatusError'
+  }
+}
+
 /** Read the LAN-bind facts (loopback-only endpoint). */
 export async function readLanBindStatus(): Promise<LanBindFrame> {
   const response = await fetch('/api/pair/lan-bind')
-  if (!response.ok) throw new Error(`remote-web-ui: lan-bind status failed with ${String(response.status)}`)
+  if (!response.ok) throw new LanBindStatusError(response.status, `remote-web-ui: lan-bind status failed with ${String(response.status)}`)
   return await response.json() as LanBindFrame
 }
 
+/**
+ * Whether a LAN-bind status failure means this origin can never read the
+ * endpoint (401/403 from the loopback-only fence), so a poll should stop
+ * instead of retrying a known refusal; a transient error keeps the cadence.
+ * @param status - the response status, or undefined for a network failure.
+ */
+export function shouldStopLanBindPoll(status: number | undefined): boolean {
+  return status === 401 || status === 403
+}
+
 /** Human-readable expiry clock, e.g. "10:35". */
 export function formatClock(epochMs: number): string {
   const date = new Date(epochMs)

package/src/client/plugin-card-seat.ts

@@ -7,22 +7,24 @@
  *
  * - `web-ui.plugin.item` — the list seat declared by the dsh-web-settings
  *   group section (this family's own first-level "Web UI plugins" section);
- * - `settings.plugin.item` — the official keyed seat of the harness's
- *   `ui-settings-plugins` tab, keyed by the settings namespace the card edits.
+ * - `plugins.bundle.config` — the official keyed seat of the harness's plugin
+ *   manager page, keyed by the bundle's package name and rendered on that
+ *   bundle's page. alpha.2 removed the `settings.plugin.item` keyed seat of the
+ *   `ui-settings-plugins` tab that this helper used before, so a card keyed by
+ *   its settings namespace has no seat to land in any more.
  *
- * SEAT SELECTION IS NOT A DECLARATION PROBE. The official `ui-settings-plugins`
- * row belongs to the harness bundle and its `configurable` tab always declares
- * `settings.plugin.item` before any external plugin's `apply()` runs, so
- * "is the official seat declared?" answers yes even in the deployment whose
- * whole point is the family group. Choosing on that probe sends every family
- * card to the official Plugins tab and leaves the group's own section
- * permanently empty — the family of reports where the section renders its
- * heading and zero cards.
+ * SEAT SELECTION IS NOT A DECLARATION PROBE. The official plugin surface
+ * belongs to the harness bundle and declares its seats before any external
+ * plugin's `apply()` runs, so "is the official seat declared?" answers yes even
+ * in the deployment whose whole point is the family group. Choosing on that
+ * probe sends every family card to the official page and leaves the group's own
+ * section permanently empty — the family of reports where the section renders
+ * its heading and zero cards.
  *
  * The signal that actually distinguishes the two deployments is whether
  * dsh-web-settings is loaded: it is the package that owns the group section and
  * it publishes the `webUiSettings` service during `apply()`, which every
- * family plugin already reads for its settings scope. Group loaded -> the family
+ * family plugin already reads for its settings form. Group loaded -> the family
  * seat; group absent -> the official seat.
  *
  * The decision is re-evaluated on every `slots/changed` because the group may
@@ -40,8 +42,8 @@
 /** The family list seat key. */
 export const FAMILY_PLUGIN_CARD_SEAT = 'web-ui.plugin.item'
 
-/** The official keyed plugin-card seat key. */
-export const OFFICIAL_PLUGIN_CARD_SEAT = 'settings.plugin.item'
+/** The official keyed plugin-card seat key (the alpha.2 bundle-configuration seat). */
+export const OFFICIAL_PLUGIN_CARD_SEAT = 'plugins.bundle.config'
 
 /** The service dsh-web-settings publishes while it is loaded. */
 export const FAMILY_GROUP_SERVICE = 'webUiSettings'
@@ -61,7 +63,7 @@ export interface PluginCardContext {
   on?(event: string, listener: (...args: never[]) => void): unknown
 }
 
-/** Owner share of a plugin card (both seats supply nothing). */
+/** Owner share of a family list-seat card (that seat supplies nothing). */
 export interface SettingsPluginItemOwnerProps {
   /** Marker field: card owner props are intentionally empty. */
   children?: never
@@ -69,8 +71,13 @@ export interface SettingsPluginItemOwnerProps {
 
 /** One family plugin's card contribution. */
 export interface PluginCardSeat {
-  /** Settings namespace the card edits (the official seat's dispatch key). */
-  namespace: string
+  /**
+   * Npm package name of the bundle this card configures; the official keyed
+   * seat dispatches on it. Every family package ships its own bundle patch, so
+   * a standalone install lists that package as the bundle whose page renders
+   * this card.
+   */
+  bundle: string
   /** Family list-seat entry id. */
   id: string
   /** Family list-seat sort order. */
@@ -159,7 +166,7 @@ export function installPluginCard(ctx: PluginCardContext, seat: PluginCardSeat):
         }
         : {
           name: OFFICIAL_PLUGIN_CARD_SEAT,
-          key: seat.namespace,
+          key: seat.bundle,
           locale: seat.locale,
           ...(seat.inject === undefined ? {} : { inject }),
         }) as never, component) as () => void