@linxin666/dsh-remote-web-ui 0.3.24 → 0.4.1

package/src/client/remote-channel.ts

@@ -62,7 +62,11 @@ export function remoteChannelRequired(
  * @returns true for localhost, IPv6 loopback, or any 127/8 literal.
  */
 export function isLoopbackHostname(hostname: string): boolean {
-  if (hostname === 'localhost' || hostname === '::1') return true
+  // WHATWG location.hostname keeps IPv6 literals bracketed ("[::1]"); the
+  // host-side shared predicate accepts that spelling, so this browser copy must
+  // too, or an IPv6-loopback origin is judged remote and rewrites every call
+  // onto the gated channel where it can never pair.
+  if (hostname === 'localhost' || hostname === '::1' || hostname === '[::1]') return true
   const parts = hostname.split('.')
   return parts.length === 4 && parts[0] === '127' && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
 }
@@ -228,8 +232,16 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
     if (device === null) return init
     const headers = init?.headers
     if (typeof Headers !== 'undefined' && headers instanceof Headers) {
-      try { headers.set(RULES.deviceHeader, device) } catch { /* ignore */ }
-      return init
+      // Copy instead of mutating: the instance belongs to the caller, which may
+      // reuse it for a request this channel does not rewrite (the device
+      // credential must not ride along there).
+      try {
+        const copy = new Headers(headers)
+        copy.set(RULES.deviceHeader, device)
+        return { ...init, headers: copy }
+      } catch {
+        return init
+      }
     }
     if (typeof headers === 'object' && headers !== null) {
       return { ...init, headers: { ...(headers as Record<string, string>), [RULES.deviceHeader]: device } } as RequestInit
@@ -253,7 +265,10 @@ export function installRemoteChannel(window: ChannelWindow, options: RemoteChann
         ? rewritten.toString()
         : new Request(rewritten, input)
       return Promise.resolve(originalFetch.call(window, next, attach(init))).then(async (response) => {
-        if (await isUnpairedDenied(response.clone())) options.onUnpaired?.()
+        // The clone tees the response body; only the 403 branch inspects it, so
+        // every other status skips the copy (a large upload or session dump
+        // would otherwise be duplicated per gated request).
+        if (response.status === 403 && await isUnpairedDenied(response.clone())) options.onUnpaired?.()
         else options.onPaired?.()
         return response
       })

package/src/client/remote.module.css

@@ -784,6 +784,44 @@
   gap: 4px;
 }
 
+/* ── Wide foot row ─────────────────────────────────────────────────────────
+
+   The official Settings trigger owns a whole row while the footer actions
+   stack above it, so the trigger's right half sits empty. On the wide column
+   the two share one line (the Settings trigger, then the update and remote
+   triggers) and every other foot
+   child (the usage glance card, another plugin's block) keeps a full row of
+   its own above them. The rail (data-sidebar-collapsed on the frame) keeps
+   the shell's stacked foot, where the circles stack by design. The shell owns
+   the container classes; the semantic suffixes survive its rebuilds. */
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footArea'] {
+  flex-direction: row;
+  flex-wrap: wrap;
+  align-items: center;
+}
+
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footArea'] > :not([class*='settingsArea']):not([class*='footerActions']) {
+  flex: 1 1 100%;
+  min-width: 0;
+}
+
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='settingsArea'] {
+  order: 1;
+  /* Content-sized basis: the trigger's own width forces it onto the line after
+     a full-width sibling, then flex-shrink gives the actions their space. */
+  flex: 1 1 auto;
+  width: auto;
+  min-width: 0;
+}
+
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footerActions'] {
+  order: 2;
+  flex: none;
+  width: auto;
+  min-width: 0;
+  align-items: center;
+}
+
 /* ── update panel extras ─────────────────────────────────────────────── */
 
 .updateStatus {

package/src/client/settings-form.ts

@@ -8,7 +8,7 @@
  * card-store pattern.
  */
 
-import type { SettingsScope, SettingsScopeSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 
@@ -114,7 +114,7 @@ interface PlannedWrite {
   judge: (() => boolean) | undefined
 }
 
-/** One durable write inside the save's atomic scope mutation. */
+/** One durable write inside the save's atomic form mutation. */
 export interface BatchedWrite {
   /** Field this entry writes. */
   field: string
@@ -211,34 +211,34 @@ export class CardForm<T> {
   private readonly specs: Map<string, FieldSpec>
   private readonly staged = new Map<string, StagedEdit>()
   private readonly listeners = new Set<() => void>()
-  /** The scope subscription installed in the constructor; released by dispose(). */
-  private readonly disposeScope: () => void
+  /** The form subscription installed in the constructor; released by dispose(). */
+  private readonly disposeForm: () => void
   private disposed = false
   private saving = false
   private failed = false
   private failedReason: string | undefined
 
-  /** @param scope - the bound settings scope for this card's namespace. */
+  /** @param scope - the bound configuration form for this card's namespace. */
   constructor(
-    private readonly scope: SettingsScope<T>,
+    private readonly scope: ConfigForm<T>,
     specs: FieldSpec[],
   ) {
     this.specs = new Map(specs.map(spec => [spec.field, spec]))
-    this.disposeScope = scope.subscribe(() => { this.publish() })
+    this.disposeForm = scope.subscribe(() => { this.publish() })
   }
 
   /**
-   * Release the scope subscription and every bound store listener. The card
+   * Release the form subscription and every bound store listener. The card
    * must call this on teardown; later calls are no-ops.
    */
   dispose(): void {
     if (this.disposed) return
     this.disposed = true
-    this.disposeScope()
+    this.disposeForm()
     this.listeners.clear()
   }
 
-  /** Publish a projection of this form, rebuilt whenever the scope or a draft changes. */
+  /** Publish a projection of this form, rebuilt whenever the form or a draft changes. */
   bind<S>(project: () => S): SnapshotStore<S> {
     const store = createSnapshotStore(project())
     this.listeners.add(() => { store.set(project()) })
@@ -295,19 +295,19 @@ export class CardForm<T> {
   }
 
   /**
-   * Write every staged edit in one atomic scope mutation, then re-seed from
+   * Write every staged edit in one atomic form mutation, then re-seed from
    * what the Host accepted.
    *
    * The whole batch rides one mutate, so cross-field validate hooks
    * (baseURL+model) judge it as a unit: the Host either applies every write
-   * or refuses the batch. The 0.1.2 scope contract never rejects a refused
-   * mutation — the scope recovers with a fresh Host view and resolves — so
-   * resolution alone proves nothing: the outcome is judged by reading the
-   * settled snapshot back, one planned write at a time, and one missed write
-   * fails the whole save. A scope that still rejects on refusal (the dsh-web
-   * bridge scope) reports through the same failure path with its rejection
-   * message. A save that did not land keeps its drafts, so the user can
-   * correct them instead of retyping.
+   * or refuses the batch. The form contract answers a refusal or a skipped
+   * write with `false` (it recovers with a fresh Host view instead of
+   * throwing), so the outcome is judged twice: the answer itself, and then the
+   * settled snapshot read back one planned write at a time. One missed write
+   * fails the whole save. A transport that rejects instead (the dsh-web bridge
+   * controller on a dead connection) reports through the same failure path
+   * with its rejection message. A save that did not land keeps its drafts, so
+   * the user can correct them instead of retyping.
    * @returns settlement after the mutation and the read-back.
    */
   async save(): Promise<void> {
@@ -323,30 +323,33 @@ export class CardForm<T> {
     this.failed = false
     this.failedReason = undefined
     this.publish()
-    // One atomic namespace mutation: the 0.1.2 scope contract takes ordered
-    // path operations, so the whole staged batch is validated, persisted, and
+    // One atomic namespace mutation: the form contract takes ordered path
+    // operations, so the whole staged batch is validated, persisted, and
     // recovered together — either every write lands or none does.
     const ops: Array<{ op: 'set'; path: string[]; value: string | number | boolean } | { op: 'unset'; path: string[] }> = valid.map(item => item.op.op === 'set'
       ? { op: 'set', path: [item.field], value: (item.op as { value: string | number | boolean }).value }
       : { op: 'unset', path: [item.field] })
     let failedReason: string | undefined
+    let accepted = false
     try {
-      await this.scope.mutate(ops)
+      accepted = await this.scope.mutate(ops)
     } catch (error) {
       failedReason = error instanceof Error ? error.message : String(error)
     }
-    // The 0.1.2 scope resolves even a refused mutation (it recovers with a
-    // fresh view instead of throwing), so resolution alone proves nothing:
-    // judge every planned write against the settled snapshot. The mutation is
-    // atomic, so one missed write fails the whole save and keeps the drafts.
-    const landed = failedReason === undefined && valid.every(item => item.judge())
+    // `false` is the contract's refusal/skip answer, and the form still
+    // resolves after a refusal (it recovers with a fresh view), so the answer
+    // alone is not enough: judge every planned write against the settled
+    // snapshot as well. The mutation is atomic, so one missed write fails the
+    // whole save and keeps the drafts.
+    const landed = accepted && failedReason === undefined && valid.every(item => item.judge())
     for (const [field, before] of pending) {
       if (landed && this.staged.get(field) === before) this.staged.delete(field)
     }
     this.saving = false
     this.failed = !landed
-    // A read-back failure carries no server reason: the card surfaces its
-    // generic failure copy; a rejecting scope (the bridge) adds its message.
+    // A refused or unlanded batch carries no server reason: the card surfaces
+    // its generic failure copy; a rejecting transport (the bridge) adds its
+    // message.
     this.failedReason = failedReason
     this.publish()
   }
@@ -381,7 +384,7 @@ export class CardForm<T> {
    */
   private landedSet(field: string, value: unknown): boolean {
     // A redacted secret never appears in any wire view layer: the Host strips
-    // role('secret') fields and reports them through a sidecar the scope
+    // role('secret') fields and reports them through a sidecar the form
     // snapshot does not expose, so there is nothing to compare the draft
     // against. Settling is the only signal the form has; the rest of the
     // batch, when one exists, still carries the atomic verdict by read-back.
@@ -412,7 +415,7 @@ export class CardForm<T> {
     return spec
   }
 
-  private snapshotOf(): SettingsScopeSnapshot<T> {
+  private snapshotOf(): ConfigFormSnapshot<T> {
     return this.scope.getSnapshot()
   }
 

package/src/http.ts

@@ -2,7 +2,9 @@
 /**
  * Shared JSON body/response helpers for the host route families: one strict
  * bounded body reader, one lenient bounded body reader, one JSON object
- * narrow, and one JSON writer. Previously these were copy-pasted across the
+ * narrow, one JSON writer, and the outbound request-init helper that keeps a
+ * host fetch body decodable (withIdentityEncoding). Previously the readers
+ * were copy-pasted across the
  * package route files (routes.ts, update-routes.ts, mobile-api.ts, and each
  * family's route module) with drifting contracts: body caps ranging 4 KiB to
  * 1 MiB and four distinct overflow behaviors (reject, undefined, null, throw).
@@ -88,6 +90,26 @@ export function asJsonObject(value: unknown): Record<string, unknown> | undefine
   return isJsonObject(value) ? value : undefined
 }
 
+/**
+ * Request init that asks a remote origin for an uncompressed body.
+ *
+ * The DSH host boots `@deepseek-ai/dsh-http-proxy`, whose top-level import of
+ * the npm `undici` copy replaces the legacy `undici.globalDispatcher.1` slot
+ * Node's built-in `fetch()` reads. That cross-major wrapper drops the
+ * `content-encoding` header and automatic decompression, so a plain fetch
+ * resolves to raw gzip/brotli/zstd bytes — compressed noise no JSON or text
+ * consumer can read. Every host fetch that parses a remote body must request
+ * identity encoding. Caller headers survive; `accept-encoding` is forced to
+ * `identity` because a caller value has no decoder behind it in this host.
+ * @param init - the caller's request init (signal, headers, method, ...).
+ * @returns a copy with `accept-encoding: identity` merged in.
+ */
+export function withIdentityEncoding(init: RequestInit = {}): RequestInit {
+  const headers = new Headers(init.headers)
+  headers.set('accept-encoding', 'identity')
+  return { ...init, headers }
+}
+
 /**
  * Write one JSON response. Default headers are the family defaults
  * (content-type and referrer-policy); caller headers are appended or

package/src/index.ts

@@ -36,6 +36,7 @@ import { isHttpUrl, tunnelPlanOf } from './tunnel-plan.ts'
 import { loadRelayIdentity, RelayRegistrar, type RelayState } from './relay-registry.ts'
 import { desiredBindHost, desiredBindPort, firewallActionNeeded, pendingRestartOf, type AppliedFirewallState, type StartupFacts } from './lan-bind-plan.ts'
 import { createInnerAuth } from './inner-auth.ts'
+import { withIdentityEncoding } from './http.ts'
 import { TunnelManager, type TunnelInfo } from './tunnel.ts'
 import { PublicBaseKeeper } from './public-base.ts'
 import {
@@ -84,9 +85,12 @@ export const name = 'remote-web-ui'
 export const inject = ['webServer', 'typertGateway', 'connection']
 
 /**
- * Settings namespace of the remote-control capability — the section the web
- * settings surface edits. Spelled here rather than imported: the browser
- * half spells the same value and must not depend on a Host package.
+ * Settings namespace of the remote-control capability. Under the 0.1.7
+ * settings model the namespace IS the Host profile entry id, so this is also
+ * the id the browser half asks `ctx.configForms` for (the family binder
+ * resolves the same value to the owning entry). Spelled here rather than
+ * imported: the browser half spells the same value and must not depend on a
+ * Host package.
  */
 export const REMOTE_WEB_UI_SETTINGS_NAMESPACE = 'remote-web-ui' as SettingsNamespace
 
@@ -100,22 +104,28 @@ export interface Config {
   maxDevices?: number
   /**
    * Idle sessions older than this (ms) are deleted from memory and disk.
-   * Default is 7 days; a leftover cookie no longer authorizes after expiry.
+   * Default is 30 days; a leftover cookie no longer authorizes after expiry.
    */
   idleExpireMs?: number
   /** Cookie name carrying the paired device id. */
   cookieName?: string
   /**
    * When true (default), a desktop Web GUI opened at a non-loopback origin
-   * rides the gated `/remote/api` channel and must carry a live paired-device
-   * cookie — the QR is the only way into remote desktop, and stop()/revoke()
-   * cut the /remote channel and the pairing cookie off immediately. Scope
+   * rides the gated `/remote/api` channel, whose requests must carry a live
+   * paired-device cookie — the QR is the only way into remote desktop, and
+   * stop()/revoke() cut the channel and the pairing cookie off immediately.
+   * This policy selects the transport; it never loosens the channel, whose
+   * gate is unconditional (issue #1665). Scope
    * note for this cohort: direct /api is governed by the harness fence +
    * browser-auth cookie (the api/gate seam has no emitter on 0.1.2-alpha.2),
    * so a harness browser credential a device has already redeemed is not
    * invalidated by stop() — see the README security model. Set false to keep
    * the desktop on plain `/api` (only useful when that origin is already
-   * trusted for `/api`).
+   * trusted for `/api`). Turning the policy off does NOT open the channel:
+   * the /remote proxy attaches the process's own browser-auth credential only
+   * when the request itself presents a live paired-device credential, so an
+   * unpaired LAN/tunnel caller is forwarded without it and the inner route
+   * answers 401.
    */
   requirePairingForLan?: boolean
   /**
@@ -220,6 +230,13 @@ export const Config: z<Config> = z.object({
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 10_000
 
+/**
+ * How long one update-status probe answer is reused. The probe fans out one
+ * registry GET per family package plus a GitHub call, and the sidebar update
+ * entry asks for the status on every GUI page load.
+ */
+const UPDATE_STATUS_TTL_MS = 60_000
+
 /**
  * Fully resolved config: every field non-optional except `publicBaseUrl`,
  * which legitimately resolves to `undefined` when unset (the schema keeps it
@@ -237,9 +254,8 @@ type ResolvedConfig = Required<Omit<Config, 'publicBaseUrl' | 'trustedHosts' | '
 
 /**
  * The single mapping from resolved plugin config to the pairing service
- * config. Both the constructed service and every live settings sync reuse
- * it, so no field can be silently dropped when the web settings surface
- * pushes a new value into the running service.
+ * config. Both the constructed service and every later apply of this row
+ * reuse it, so no field can be silently dropped.
  */
 export function pairingConfigOf(resolved: Pick<
   ResolvedConfig,
@@ -305,30 +321,12 @@ function applyImpl(ctx: Context, config?: Config): void {
     profile: config?.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
     enabled: config?.enabled ?? DEFAULTS.enabled,
   }
-  // The live source the pairing service and the gate read: the settings
-  // section once the web settings surface is served, the composition entry
-  // otherwise (installSection swaps it when the namespace registers).
-  let current: () => Config = () => config ?? {}
-  const resolve = (): ResolvedConfig => {
-    const value = current()
-    return {
-      tokenTtlMs: value.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
-      offlineAfterMs: value.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
-      maxDevices: value.maxDevices ?? DEFAULTS.maxDevices,
-      idleExpireMs: value.idleExpireMs ?? DEFAULTS.idleExpireMs,
-      cookieName: value.cookieName ?? DEFAULTS.cookieName,
-      requirePairingForLan: value.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-      publicBaseUrl: value.publicBaseUrl ?? envPublicBase,
-      trustedHosts: value.trustedHosts,
-      devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
-      autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
-      tunnelToken: value.tunnelToken,
-      relay: value.relay ?? DEFAULTS.relay,
-      lanBind: value.lanBind,
-      profile: value.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
-      enabled: value.enabled ?? DEFAULTS.enabled,
-    }
-  }
+  // The effective configuration this activation runs on: under the 0.1.7
+  // settings model the plugin's own Config IS its settings document, so the
+  // Host serves the settings page from this schema and reloads the row after a
+  // save — a live edit re-enters apply() with the new value instead of being
+  // pushed into a running instance.
+  const resolve = (): ResolvedConfig => resolved
   const service = new PairingService(pairingConfigOf(resolved))
 
   // ── auto tunnel ─────────────────────────────────────────────────────────
@@ -442,13 +440,14 @@ function applyImpl(ctx: Context, config?: Config): void {
     service.setLanBases(lanBases)
   }
 
-  // Push a committed settings section into the service and gate. The service
+  // Push the effective configuration into the service and gate. The service
   // config object is read per operation (token mint, touch, sweep), and the
-  // gate re-reads its fence flag per request, so a live edit takes effect
-  // without a restart. When `enabled` turns off, the pairing routes and
-  // sweep timer are dropped and all device/token state is revoked, but the
-  // gate listener stays mounted so a LAN-exposed /api stays behind pairing
-  // (now vetoing every non-loopback request) instead of opening the fence.
+  // gate re-reads its fence flag per request, so a saved edit takes effect
+  // without a restart (the Host reloads this row, and apply re-runs). When
+  // `enabled` is off, the pairing routes and sweep timer are dropped and all
+  // device/token state is revoked, but the gate listener stays mounted so a
+  // LAN-exposed /api stays behind pairing (now vetoing every non-loopback
+  // request) instead of opening the fence.
   let disposeRoutes: (() => void) | undefined
   let disposeSweep: (() => void) | undefined
   // ── remote update ────────────────────────────────────────────────────────
@@ -478,16 +477,32 @@ function applyImpl(ctx: Context, config?: Config): void {
     releaseNotesCache.set(version, { at: Date.now(), notes })
     return notes
   }
-  const updateRoutes = makeUpdateRoutes({
-    // Control endpoints are host-surface only: a LAN/phone origin must never
-    // trigger a real install on this machine.
-    fence: request => isTrustedApiRequest(request, []),
-    check: () => checkUpdates({
+  // The status probe fans out one registry GET per family package (plus a
+  // GitHub release-notes call), and the sidebar update entry asks for it on
+  // every GUI page load — so the answer is memoized briefly and concurrent
+  // callers share one probe. A completed update invalidates it.
+  let updateStatusCache: { at: number; value: Awaited<ReturnType<typeof checkUpdates>> } | undefined
+  let updateStatusInFlight: Promise<Awaited<ReturnType<typeof checkUpdates>>> | undefined
+  const checkStatusCached = (): Promise<Awaited<ReturnType<typeof checkUpdates>>> => {
+    const cached = updateStatusCache
+    if (cached !== undefined && Date.now() - cached.at < UPDATE_STATUS_TTL_MS) return Promise.resolve(cached.value)
+    if (updateStatusInFlight !== undefined) return updateStatusInFlight
+    updateStatusInFlight = checkUpdates({
       anchorManifestPath: resolveAnchorPath(),
       resolve: hostResolve,
       fetchLatest: name => fetchLatestVersion(name, fetch),
       fetchReleaseNotes: fetchReleaseNotesCached,
-    }),
+    }).then((value) => {
+      updateStatusCache = { at: Date.now(), value }
+      return value
+    }).finally(() => { updateStatusInFlight = undefined })
+    return updateStatusInFlight
+  }
+  const updateRoutes = makeUpdateRoutes({
+    // Control endpoints are host-surface only: a LAN/phone origin must never
+    // trigger a real install on this machine.
+    fence: request => isTrustedApiRequest(request, []),
+    check: () => checkStatusCached(),
     run: async (): Promise<UpdateRunResult> => {
       const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() })
       if ('error' in target) {
@@ -504,7 +519,7 @@ function applyImpl(ctx: Context, config?: Config): void {
       // 11 minimumReleaseAge gate can silently keep the installed versions
       // (same-day releases), which a plain exit-0 check would report as
       // success — the user then restarts and nothing changed.
-      return runUpdateVerified({
+      const result = await runUpdateVerified({
         run: { profileDir: target.profileDir, packages: target.packages },
         check: {
           anchorManifestPath: resolveAnchorPath(),
@@ -513,6 +528,9 @@ function applyImpl(ctx: Context, config?: Config): void {
           fetchReleaseNotes: fetchReleaseNotesCached,
         },
       })
+      // The install moved (or failed) the versions the cached status reported.
+      updateStatusCache = undefined
+      return result
     },
   })
   // LAN-bind facts for the settings card, re-read per request so a hot
@@ -580,10 +598,16 @@ function applyImpl(ctx: Context, config?: Config): void {
     if (appShellCache !== undefined && Date.now() - appShellCache.at < APP_SHELL_TTL_MS) return appShellCache.html
     const cookie = await innerAuth.ready()
     try {
-      const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, {
+      const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, withIdentityEncoding({
         headers: cookie !== undefined ? { cookie } : undefined,
-      })
-      if (!response.ok) return undefined
+      }))
+      if (!response.ok) {
+        // A stale credential (secret rotation, 30-day TTL) must not wedge every
+        // later landing: drop it so the next attempt re-redeems, exactly as the
+        // proxy path does on an upstream 401.
+        if (response.status === 401 || response.status === 403) innerAuth.invalidate()
+        return undefined
+      }
       const html = await response.text()
       appShellCache = { at: Date.now(), html }
       return html
@@ -618,15 +642,15 @@ function applyImpl(ctx: Context, config?: Config): void {
         return list
       },
     }),
-    // The remote desktop channel: policy-gated `/remote` prefix that
-    // re-issues fenced paths to loopback (see remote-api.ts). The live
-    // requirePairingForLan is re-read per request, same as the gate listener
-    // and routes above, so a stale client rewrite on an open-LAN deployment
-    // proxies instead of 403ing.
+    // The remote desktop channel: a paired-credential-gated `/remote` prefix
+    // that re-issues fenced paths to loopback (see remote-api.ts). The gate is
+    // unconditional — requirePairingForLan governs the plain /api surface and
+    // the desktop's client-side rewrite only; it is never an authorization
+    // input here, because this channel attaches the process's own browser
+    // credential to everything it forwards (issue #1665).
     ...makeRemoteApiRoutes({
       service,
       port: ctx.webServer.port,
-      requirePairingForLan: () => resolve().requirePairingForLan,
       auth: innerAuth,
     }),
     ...updateRoutes,
@@ -634,7 +658,6 @@ function applyImpl(ctx: Context, config?: Config): void {
   const upgrades = makeRemoteApiUpgradeRoutes({
     service,
     port: ctx.webServer.port,
-    requirePairingForLan: () => resolve().requirePairingForLan,
     auth: innerAuth,
   })
   const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled)
@@ -718,6 +741,9 @@ function applyImpl(ctx: Context, config?: Config): void {
     console.warn('remote-web-ui: LAN-exposed bind — pairing gates the /remote channel; direct /api stays under the harness fence + browser auth (stop() does not revoke an already-redeemed browser credential)')
   }
 
+  // Apply the effective configuration to the running surfaces once per
+  // activation: the service tunables, the LAN-bind block/firewall, the tunnel
+  // plan, the pairing routes, the presence sweep, and the posture probe.
   const sync = (): void => {
     const value = resolve()
     service.config = pairingConfigOf(value)
@@ -805,6 +831,10 @@ function applyImpl(ctx: Context, config?: Config): void {
         ? plan.targetUrl
         : { kind: 'quick', targetUrl: plan.targetUrl, originHostHeader })
     } else if (plan.mode === 'named') {
+      // The hostname is fixed and known before the process runs, so publish it
+      // now: a named tunnel that fails to start must not leave the previous
+      // mode's ephemeral host as the QR and fence base.
+      publicBase.markRunning(plan.publicUrl)
       tunnel.start({ kind: 'named', token: plan.token, publicUrl: plan.publicUrl })
     } else {
       tunnel.stop()
@@ -824,7 +854,17 @@ function applyImpl(ctx: Context, config?: Config): void {
       }
     }
     const enabled = value.enabled
-    if (!enabled) service.stop()
+    if (!enabled) {
+      service.stop()
+      // The tunnel branch above follows the plan, not the master switch, so an
+      // explicit "off" must also drop the public ingress it started: otherwise
+      // the cloudflared child keeps a live public URL (and the relay keeps its
+      // stable row) while the panel says remote control is stopped. The relay
+      // row is deliberately kept so re-enabling reuses the same origin.
+      tunnel.stop()
+      disposeRelayRegistrar()
+      publicBase.reset()
+    }
     if (disposeRoutes === undefined && enabled) {
       disposeRoutes = ctx.effect(
         () => {
@@ -877,25 +917,8 @@ function applyImpl(ctx: Context, config?: Config): void {
     table.push({ kind: 'script', placement: 'head', text: REMOTE_CHANNEL_BOOT_SCRIPT })
   }), 'remote-web-ui: remote channel boot patch')
 
-  ctx.inject(['settings'], (settingsCtx) => {
-    try {
-      if (typeof settingsCtx.settings?.installSection === 'function') {
-        settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-          setSource: (source) => {
-            current = source
-            sync()
-          },
-          onChange: sync,
-        })
-      } else if (typeof settingsCtx.settings?.register === 'function') {
-        const scope = settingsCtx.settings.register(REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, { base: config ?? {} })
-        current = () => scope?.get?.() ?? (config ?? {})
-        scope?.watch?.(() => { sync() })
-        sync()
-      }
-    } catch {
-      // Defensive fallback against settings registration differences
-    }
-  })
+  // No settings registration: the Host derives this plugin's settings page
+  // from the exported `Config` schema and reloads the row after a save, so
+  // every write re-enters apply() with the new config (see `resolve`).
   sync()
 }

package/src/inner-auth.ts

@@ -7,8 +7,9 @@
  * therefore redeems its own launch token (the same one-time exchange every
  * paired device's first navigation performs) and attaches the resulting
  * cookie to inner requests. The credential is only ever exercised behind the
- * pairing gate: while requirePairingForLan is on, every proxied call already
- * carried a live paired-device cookie before this module is consulted.
+ * pairing gate: the `/remote` channel always requires a live paired-device
+ * credential before this module is consulted, regardless of the
+ * requirePairingForLan LAN policy (issue #1665).
  */
 
 /** Browser-auth credential the proxy attaches to loopback-bound requests. */