@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/lib/types/lan-bind.d.ts

@@ -0,0 +1,69 @@
+/**
+ * LAN bind toggle: the managed cordis patch block that pins the web
+ * server's bind. On = a block binding 0.0.0.0; off = the same block binding
+ * 127.0.0.1. The block takes effect on the next `dsh web` start (the live
+ * patch watcher cannot rebind a running listener, and on this harness line
+ * the user patch layer cannot evaluate webStartup-dependent expressions
+ * reliably - static values are the only dependable form), so the plugin
+ * re-asserts the block at every boot and the settings card reports the
+ * running bind honestly.
+ *
+ * Same-id patch rows REPLACE the row config wholesale, so the block carries
+ * the official web-app webserver row's full config (bind + compression)
+ * with the bind values materialized. The CLI's --host 0.0.0.0 guard stays
+ * intact: deliberate LAN exposure happens through this configuration layer
+ * only. Until the user flips the toggle once, the plugin never touches the
+ * patch file.
+ *
+ * The block discipline (markers, atomic write, strip-and-rewrite) follows
+ * the dsh-LAN reference implementation (MIT).
+ */
+export declare const LAN_BIND_BLOCK_BEGIN = "# --- remote-web-ui lan-bind block (managed - do not edit) ---";
+export declare const LAN_BIND_BLOCK_END = "# --- end remote-web-ui lan-bind block ---";
+/** The two bind hosts the managed block pins. */
+export type LanBindHost = '0.0.0.0' | '127.0.0.1';
+/**
+ * The absolute path of the profile patch file this toggle manages. The value
+ * is config-controlled (and the DSH_PROFILE env fallback bypasses schema
+ * validation entirely), so the path is guarded twice: the profile must be a
+ * single safe path segment, and the resolved file must stay under the
+ * profiles directory.
+ */
+export declare function profilePatchFile(profile: string, home?: string): string;
+/** Remove the managed block (and its markers) from patch content. */
+export declare function stripManagedBlock(content: string): string;
+/**
+ * Render the managed block for one bind state. The values are static: the
+ * user patch layer has no reliable lazy service evaluation, and the plugin
+ * re-asserts the block at every boot so CLI flags (--port, --host) win by
+ * rewriting it before the next start.
+ */
+export declare function managedBlock(host: LanBindHost, port: number): string;
+/** The bind state a managed block pins (undefined when there is no block). */
+export interface ManagedBindState {
+    host: LanBindHost | (string & {});
+    port: number | undefined;
+}
+/**
+ * Parse the block's pinned bind out of patch content. A block whose values
+ * were hand-edited reports the literals as-is so the card can surface them
+ * instead of silently claiming one of the two known states.
+ */
+export declare function managedBindOf(content: string): ManagedBindState | undefined;
+/** Full file-level state for the settings card and the boot re-assert. */
+export declare function lanBindState(profile: string, home?: string): {
+    blockPresent: boolean;
+    host?: string;
+    port?: number;
+};
+/**
+ * Write (or rewrite) the managed block with the given bind. The rest of the
+ * patch file is preserved; the block is rewritten atomically (unique temp
+ * file + rename, so concurrent writers can never rename a half-written
+ * file) with the original file's permissions preserved. A hand-truncated
+ * unterminated block (BEGIN marker without END, which stripManagedBlock
+ * cannot match) is truncated at its BEGIN marker first so the rewrite can
+ * never stack a second webserver row onto the orphan.
+ */
+export declare function writeLanBind(host: LanBindHost, port: number, profile: string, home?: string): void;
+//# sourceMappingURL=lan-bind.d.ts.map

package/lib/types/lan-bind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-bind.d.ts","sourceRoot":"","sources":["../../src/lan-bind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,eAAO,MAAM,oBAAoB,mEAAmE,CAAA;AACpG,eAAO,MAAM,kBAAkB,+CAA+C,CAAA;AAE9E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAA;AAEjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAUlF;AAYD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAcpE;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;IACjC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAW3E;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG;IAAE,YAAY,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAI/H;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,IAAI,CAW7G"}

package/lib/types/lan-bind.js

@@ -0,0 +1,128 @@
+/**
+ * LAN bind toggle: the managed cordis patch block that pins the web
+ * server's bind. On = a block binding 0.0.0.0; off = the same block binding
+ * 127.0.0.1. The block takes effect on the next `dsh web` start (the live
+ * patch watcher cannot rebind a running listener, and on this harness line
+ * the user patch layer cannot evaluate webStartup-dependent expressions
+ * reliably - static values are the only dependable form), so the plugin
+ * re-asserts the block at every boot and the settings card reports the
+ * running bind honestly.
+ *
+ * Same-id patch rows REPLACE the row config wholesale, so the block carries
+ * the official web-app webserver row's full config (bind + compression)
+ * with the bind values materialized. The CLI's --host 0.0.0.0 guard stays
+ * intact: deliberate LAN exposure happens through this configuration layer
+ * only. Until the user flips the toggle once, the plugin never touches the
+ * patch file.
+ *
+ * The block discipline (markers, atomic write, strip-and-rewrite) follows
+ * the dsh-LAN reference implementation (MIT).
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve, sep } from 'node:path';
+import { dshHome } from "./dsh-home.js";
+/** Profile names safe to interpolate into the patch path: one path segment, no traversal. */
+const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+export const LAN_BIND_BLOCK_BEGIN = '# --- remote-web-ui lan-bind block (managed - do not edit) ---';
+export const LAN_BIND_BLOCK_END = '# --- end remote-web-ui lan-bind block ---';
+/**
+ * The absolute path of the profile patch file this toggle manages. The value
+ * is config-controlled (and the DSH_PROFILE env fallback bypasses schema
+ * validation entirely), so the path is guarded twice: the profile must be a
+ * single safe path segment, and the resolved file must stay under the
+ * profiles directory.
+ */
+export function profilePatchFile(profile, home = dshHome()) {
+    if (!PROFILE_PATTERN.test(profile)) {
+        throw new Error(`remote-web-ui: unsafe lan-bind profile ${JSON.stringify(profile)}`);
+    }
+    const file = resolve(join(home, 'profiles', profile, 'cordis.patch.yml'));
+    const root = resolve(join(home, 'profiles')) + sep;
+    if (!file.startsWith(root)) {
+        throw new Error(`remote-web-ui: lan-bind profile ${JSON.stringify(profile)} escapes the profiles directory`);
+    }
+    return file;
+}
+function readPatchContent(file) {
+    if (!existsSync(file))
+        return '';
+    return readFileSync(file, 'utf8');
+}
+/** Escape one literal string for embedding into a RegExp pattern. */
+function escapeRegex(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** Remove the managed block (and its markers) from patch content. */
+export function stripManagedBlock(content) {
+    const begin = escapeRegex(LAN_BIND_BLOCK_BEGIN);
+    const end = escapeRegex(LAN_BIND_BLOCK_END);
+    const pattern = new RegExp(`\\r?\\n?${begin}[\\s\\S]*?${end}\\r?\\n?`, 'g');
+    return content.replace(pattern, '\n');
+}
+/**
+ * Render the managed block for one bind state. The values are static: the
+ * user patch layer has no reliable lazy service evaluation, and the plugin
+ * re-asserts the block at every boot so CLI flags (--port, --host) win by
+ * rewriting it before the next start.
+ */
+export function managedBlock(host, port) {
+    return [
+        LAN_BIND_BLOCK_BEGIN,
+        '- id: webserver',
+        "  name: '@deepseek-ai/dsh-host-webserver'",
+        '  config:',
+        `    host: '${host}'`,
+        `    port: ${String(port)}`,
+        '    compression: gzip',
+        '    compressionLevel: 1',
+        '    compressionThresholdBytes: 1024',
+        LAN_BIND_BLOCK_END,
+        '',
+    ].join('\n');
+}
+/**
+ * Parse the block's pinned bind out of patch content. A block whose values
+ * were hand-edited reports the literals as-is so the card can surface them
+ * instead of silently claiming one of the two known states.
+ */
+export function managedBindOf(content) {
+    const begin = content.indexOf(LAN_BIND_BLOCK_BEGIN);
+    if (begin === -1)
+        return undefined;
+    const end = content.indexOf(LAN_BIND_BLOCK_END, begin);
+    const block = end === -1 ? content.slice(begin) : content.slice(begin, end);
+    const hostMatch = /host:\s*'([^']+)'/.exec(block);
+    const portMatch = /port:\s*(\d+)/.exec(block);
+    return {
+        host: hostMatch?.[1] ?? '',
+        port: portMatch !== null ? Number(portMatch[1]) : undefined,
+    };
+}
+/** Full file-level state for the settings card and the boot re-assert. */
+export function lanBindState(profile, home = dshHome()) {
+    const state = managedBindOf(readPatchContent(profilePatchFile(profile, home)));
+    if (state === undefined)
+        return { blockPresent: false };
+    return { blockPresent: true, host: state.host, port: state.port };
+}
+/**
+ * Write (or rewrite) the managed block with the given bind. The rest of the
+ * patch file is preserved; the block is rewritten atomically (unique temp
+ * file + rename, so concurrent writers can never rename a half-written
+ * file) with the original file's permissions preserved. A hand-truncated
+ * unterminated block (BEGIN marker without END, which stripManagedBlock
+ * cannot match) is truncated at its BEGIN marker first so the rewrite can
+ * never stack a second webserver row onto the orphan.
+ */
+export function writeLanBind(host, port, profile, home = dshHome()) {
+    const file = profilePatchFile(profile, home);
+    const stripped = stripManagedBlock(readPatchContent(file));
+    const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN);
+    const base = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd();
+    const content = `${base}\n\n${managedBlock(host, port)}`;
+    const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
+    mkdirSync(dirname(file), { recursive: true });
+    const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    writeFileSync(temp, content, { mode });
+    renameSync(temp, file);
+}

package/lib/types/loopback-proxy.d.ts

@@ -8,14 +8,19 @@
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Duplex } from 'node:stream';
+import type { InnerAuth } from './inner-auth.ts';
 /**
  * Pipe one HTTP request to loopback and stream the response back.
  * @param req - the already-gated outer request.
  * @param res - the outer response.
  * @param port - local webServer port.
  * @param upstreamPath - path + query on 127.0.0.1 (must start with `/`).
+ * @param auth - when given, the process's inner browser-auth credential is
+ *   attached so the connection plugin's /api route (fence + browser auth,
+ *   authority-bound cookie, no loopback exemption on this cohort) accepts
+ *   the re-issued request; a 401 answer invalidates the cached credential.
  */
-export declare function proxyLoopbackHttp(req: IncomingMessage, res: ServerResponse, port: number, upstreamPath: string): void;
+export declare function proxyLoopbackHttp(req: IncomingMessage, res: ServerResponse, port: number, upstreamPath: string, auth?: InnerAuth): void;
 /**
  * Rebuild a WebSocket handshake as loopback-shaped and pipe both directions.
  * @param req - the already-gated upgrade request.
@@ -23,6 +28,8 @@ export declare function proxyLoopbackHttp(req: IncomingMessage, res: ServerRespo
  * @param head - bytes already read past the handshake.
  * @param port - local webServer port.
  * @param upstreamPath - path + query on 127.0.0.1.
+ * @param cookie - the inner browser-auth credential for the handshake, when
+ *   the upstream route enforces it (the gateway event-stream mux does).
  */
-export declare function proxyLoopbackUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, port: number, upstreamPath: string): void;
+export declare function proxyLoopbackUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, port: number, upstreamPath: string, cookie?: string): void;
 //# sourceMappingURL=loopback-proxy.d.ts.map

package/lib/types/loopback-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loopback-proxy.d.ts","sourceRoot":"","sources":["../../src/loopback-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAGrF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAqBzC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,IAAI,CAmCN;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,IAAI,CA6BN"}
+{"version":3,"file":"loopback-proxy.d.ts","sourceRoot":"","sources":["../../src/loopback-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAuB,cAAc,EAAE,MAAM,WAAW,CAAA;AAGrF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAoBhD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,SAAS,GACf,IAAI,CAIN;AAmDD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAoCN"}

package/lib/types/loopback-proxy.js

@@ -31,8 +31,17 @@ const HTTP_FORWARD_RESPONSE_HEADERS = [
  * @param res - the outer response.
  * @param port - local webServer port.
  * @param upstreamPath - path + query on 127.0.0.1 (must start with `/`).
+ * @param auth - when given, the process's inner browser-auth credential is
+ *   attached so the connection plugin's /api route (fence + browser auth,
+ *   authority-bound cookie, no loopback exemption on this cohort) accepts
+ *   the re-issued request; a 401 answer invalidates the cached credential.
  */
-export function proxyLoopbackHttp(req, res, port, upstreamPath) {
+export function proxyLoopbackHttp(req, res, port, upstreamPath, auth) {
+    void Promise.resolve(auth?.ready())
+        .catch(() => undefined)
+        .then((cookie) => { pipeLoopbackHttp(req, res, port, upstreamPath, auth, typeof cookie === 'string' ? cookie : undefined); });
+}
+function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
     const headers = {
         host: `127.0.0.1:${String(port)}`,
         'sec-fetch-site': 'same-origin',
@@ -46,6 +55,8 @@ export function proxyLoopbackHttp(req, res, port, upstreamPath) {
     const accept = req.headers.accept;
     if (typeof accept === 'string')
         headers.accept = accept;
+    if (cookie !== undefined)
+        headers.cookie = cookie;
     const upstream = httpRequest({
         host: '127.0.0.1',
         port,
@@ -53,6 +64,11 @@ export function proxyLoopbackHttp(req, res, port, upstreamPath) {
         method: req.method,
         headers,
     }, (upstreamRes) => {
+        // The cached credential went stale (secret rotation, credential store
+        // reset): drop it so the next request re-redeems. The in-flight response
+        // still pipes through untouched.
+        if (upstreamRes.statusCode === 401 && cookie !== undefined)
+            auth?.invalidate();
         const out = {};
         for (const name of HTTP_FORWARD_RESPONSE_HEADERS) {
             const value = upstreamRes.headers[name];
@@ -78,14 +94,18 @@ export function proxyLoopbackHttp(req, res, port, upstreamPath) {
  * @param head - bytes already read past the handshake.
  * @param port - local webServer port.
  * @param upstreamPath - path + query on 127.0.0.1.
+ * @param cookie - the inner browser-auth credential for the handshake, when
+ *   the upstream route enforces it (the gateway event-stream mux does).
  */
-export function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath) {
+export function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath, cookie) {
     const lines = [
         `GET ${upstreamPath} HTTP/1.1`,
         `Host: 127.0.0.1:${String(port)}`,
         'Upgrade: websocket',
         'Connection: Upgrade',
     ];
+    if (cookie !== undefined)
+        lines.push(`Cookie: ${cookie}`);
     for (const name of WS_FORWARD_HEADERS) {
         const value = req.headers[name];
         if (value === undefined)
@@ -94,6 +114,8 @@ export function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath) {
     }
     const handshake = `${lines.join('\r\n')}\r\n\r\n`;
     const upstream = connect(port, '127.0.0.1');
+    socket.setKeepAlive(true, 20_000);
+    upstream.setKeepAlive(true, 20_000);
     const tearDown = () => {
         upstream.destroy();
         socket.destroy();

package/lib/types/pairing.d.ts

@@ -7,8 +7,12 @@
  * Security invariants:
  * - One active token at a time; `issue()` replaces it, so a refreshed QR
  *   immediately invalidates the previous link.
- * - A token is consumed by the first successful `accept()` — reuse is
- *   refused with `'used'`.
+ * - A token stays re-usable until it expires or is replaced: the first
+ *   successful `accept()` marks it consumed, but the same link may pair
+ *   again within the window (each re-accept mints a fresh device session).
+ *   Mobile flows routinely split across cookie contexts (camera preview to
+ *   in-app browser to the system browser), and the later context must be
+ *   able to complete its own pairing from the same link.
  * - Tokens expire; `accept()` on an expired token is refused like an
  *   unknown one (no oracle for validity).
  * - `stop()` revokes every device session and clears the token, so paired
@@ -44,7 +48,15 @@ export interface TokenRecord {
     /** LAN IP literal the QR link was built from (optional; default first). */
     address?: string;
 }
-/** Default idle-expiry window: 7 days without heartbeat or a gated request. */
+/**
+ * Default idle-expiry window: 30 days without a heartbeat or a gated
+ * request. The reopen service worker refreshes lastSeenAt on every
+ * navigation it serves, so the window only runs out through genuine
+ * disuse; 30 days matches the browser-credential lifetimes the surrounding
+ * flow was built around, while the effective device lifetime stays shorter
+ * than the 365-day cookie because of this sweep. Override per deployment
+ * through the idleExpireMs config.
+ */
 export declare const DEFAULT_IDLE_EXPIRE_MS: number;
 /** One paired device session, keyed by the device id stored in its cookie. */
 export interface DeviceSession {

package/lib/types/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,QAA0B,CAAA;AAK7D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAwBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAxBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B;IAKrD;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAgBf,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwBnF;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA2BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAMb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAqB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AAwCD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,QAAQ,EAAE,OAAO,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,sCAAsC;AACtC,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,CAAA;AAE3C,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAwBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAxBxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B;IAKrD;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAgBf,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAwBnF;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA6BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAMb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAqB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AAwCD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}

package/lib/types/pairing.js

@@ -7,8 +7,12 @@
  * Security invariants:
  * - One active token at a time; `issue()` replaces it, so a refreshed QR
  *   immediately invalidates the previous link.
- * - A token is consumed by the first successful `accept()` — reuse is
- *   refused with `'used'`.
+ * - A token stays re-usable until it expires or is replaced: the first
+ *   successful `accept()` marks it consumed, but the same link may pair
+ *   again within the window (each re-accept mints a fresh device session).
+ *   Mobile flows routinely split across cookie contexts (camera preview to
+ *   in-app browser to the system browser), and the later context must be
+ *   able to complete its own pairing from the same link.
  * - Tokens expire; `accept()` on an expired token is refused like an
  *   unknown one (no oracle for validity).
  * - `stop()` revokes every device session and clears the token, so paired
@@ -19,8 +23,16 @@
 import { randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
-/** Default idle-expiry window: 7 days without heartbeat or a gated request. */
-export const DEFAULT_IDLE_EXPIRE_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * Default idle-expiry window: 30 days without a heartbeat or a gated
+ * request. The reopen service worker refreshes lastSeenAt on every
+ * navigation it serves, so the window only runs out through genuine
+ * disuse; 30 days matches the browser-credential lifetimes the surrounding
+ * flow was built around, while the effective device lifetime stays shorter
+ * than the 365-day cookie because of this sweep. Override per deployment
+ * through the idleExpireMs config.
+ */
+export const DEFAULT_IDLE_EXPIRE_MS = 30 * 24 * 60 * 60 * 1000;
 /** Cap on the persisted/displayed User-Agent string. */
 const MAX_USER_AGENT_CHARS = 180;
 /** Thrown by issue() for an address outside the sampled LAN literals. */
@@ -243,8 +255,10 @@ export class PairingService {
      */
     accept(token, userAgent) {
         const record = this.tokens.get(token);
-        if (record === undefined || record.consumed || this.stopped || this.clock.now() > record.expiresAt) {
-            return { ok: false, code: record?.consumed === true ? 'used' : 'invalid' };
+        // A consumed token stays a valid bearer credential until expiry or
+        // replacement (see the module doc): re-accept mints a fresh device.
+        if (record === undefined || this.stopped || this.clock.now() > record.expiresAt) {
+            return { ok: false, code: 'invalid' };
         }
         record.consumed = true;
         const deviceId = this.clock.randomToken();

package/lib/types/remote-api.d.ts

@@ -1,29 +1,31 @@
 /**
  * The remote desktop data channel: `/remote` is this plugin's own prefix, so
- * the paired-device cookie is the access control (exactly like `/m/api`).
- * After that gate, every fenced same-origin path the browser rewrote here is
- * re-issued to 127.0.0.1 as a loopback-shaped request so sibling plugin
- * fences (and the connection plugin's `/api`) accept it — no `--trusted-host`
- * and no per-plugin pairing consult.
+ * the paired-device cookie is the access control. After that gate, every
+ * fenced same-origin path the browser rewrote here is re-issued to 127.0.0.1
+ * as a loopback-shaped request so sibling plugin fences (and the connection
+ * plugin's `/api`) accept it — no `--trusted-host` and no per-plugin pairing
+ * consult.
  *
  * Security model:
  * - While `requirePairingForLan` is on (default), every request must carry a
  *   live paired-device cookie, enforced before any bytes are forwarded and
  *   before any host call. With the policy off, the cookie gate is skipped
- *   (the loopback-only denials below still apply).
- * - The SDK's loopback-only privileged methods (native dialogs, the settings
- *   plane, credentials — the `PRIVILEGED_METHODS` set of client-connection)
- *   are denied here. The set is pinned by tests/remote-contract.spec.ts.
- * - `/api/pair/*`, `/api/update/*`, `/api/plugin-manager/*`,
- *   `/api/dsh-desktop-launcher/*` and `/api/dsh-web-ui-settings/*` stay physically local.
+ *   (the local-only denials below still apply).
+ * - A paired remote desktop is a full-control credential: the browser half
+ *   flips the official UI into host mode (the transport ownsHost hook), so
+ *   the configuration plane (settings, credentials, presets, deliverables)
+ *   rides this channel like every other call. The four control planes in
+ *   LOCAL_ONLY_PREFIXES stay physically local.
  * - Everything else is HTTP- or WebSocket-proxied to the local port with
  *   Host rewritten, Origin and cookies dropped, and a synthetic same-origin
  *   browser marker added after authentication. Plugin loopback fences then
  *   pass. The pairing cookie never leaves this process.
  */
+import type { IncomingMessage } from 'node:http';
 import type { WebRoute, WebUpgradeRoute } from '@deepseek-ai/dsh-host-webserver';
 import type { PairingService } from './pairing.ts';
-export { DESKTOP_LAUNCHER_PATH, LOOPBACK_ONLY_METHODS, PLUGIN_MANAGER_PATH, REMOTE_API_PATHS, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, } from './remote-methods.ts';
+import type { InnerAuth } from './inner-auth.ts';
+export { DESKTOP_LAUNCHER_PATH, LOCAL_ONLY_PREFIXES, PLUGIN_MANAGER_PATH, REMOTE_API_PATHS, REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY, REMOTE_PREFIX, REMOTE_UPGRADE_PATHS, WEB_UI_SETTINGS_BRIDGE_PATH, localOnlyDenial, } from './remote-methods.ts';
 export { REMOTE_API_PREFIX } from './remote-methods.ts';
 /** Route-family dependencies. */
 export interface RemoteApiDeps {
@@ -38,6 +40,13 @@ export interface RemoteApiDeps {
      * edit takes effect without a restart. Defaults to true.
      */
     requirePairingForLan?: boolean | (() => boolean);
+    /**
+     * The process's inner browser-auth credential attached to re-issued
+     * requests (the connection plugin's /api route enforces that cookie and
+     * the pairing gate above already ran). Undefined keeps the previous
+     * cookie-less behavior — the inner route then answers 401 on this cohort.
+     */
+    auth?: InnerAuth;
 }
 /**
  * Map `/remote/...` to the inner path, or undefined when the outer path is
@@ -45,10 +54,18 @@ export interface RemoteApiDeps {
  */
 export declare function innerPathOf(pathname: string): string | undefined;
 /**
- * Whether a paired inner path must stay physically local.
+ * Whether a paired inner path must stay physically local (delegates to the
+ * shared LOCAL_ONLY_PREFIXES table).
  * @returns a denial message, or undefined when the path may be proxied.
  */
 export declare function loopbackOnlyDenial(innerPath: string): string | undefined;
+/**
+ * Resolve a live device credential for a gated HTTP request: the pairing
+ * cookie first, then the cookieless header the boot patch attaches. Unknown
+ * or revoked ids are a no-op - a stale id never re-arms a device.
+ * @returns the touched device id, or undefined when neither credential is live.
+ */
+export declare function pairedDeviceIdOf(req: IncomingMessage, service: PairingService): string | undefined;
 /**
  * Build the remote desktop channel HTTP routes.
  * @param deps - pairing service + local port + live pairing policy.

package/lib/types/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAalD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;CACjD;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA2CnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CA2BjF"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/remote-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAUhD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAgBvD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,OAAO,EAAE,cAAc,CAAA;IACvB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,CAAA;IAChD;;;;;OAKG;IACH,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB;AAWD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAQlG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,EAAE,CA0CnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,EAAE,CA2CjF"}