@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/src/mobile-pending.ts

@@ -1,88 +0,0 @@
-import type { MuxFrame } from '@deepseek-ai/dsh-host-apiproxy/api/events'
-import type { RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
-
-export interface PendingApproval {
-  rpcId: string
-  approvalId: string
-  toolName: string
-  callId?: string
-  reason?: string
-}
-
-export interface PendingQuestion {
-  rpcId: string
-  questions: Array<{
-    id: string
-    question: string
-    detail?: string
-    header?: string
-    options?: Array<{ label: string; description?: string }>
-    multiSelect?: boolean
-  }>
-}
-
-export interface PendingState {
-  approvals: PendingApproval[]
-  questions: PendingQuestion[]
-}
-
-export class PendingTracker {
-  private readonly sessions = new Map<string, { approvals: Map<string, PendingApproval>; questions: PendingQuestion[] }>()
-
-  /** Process one mux frame and update the pending state. */
-  onFrame(frame: RpcRequest<MuxFrame>): void {
-    const payload = frame.payload
-    if (payload.type === 'approval/requested') {
-      const state = this._getOrInit(payload.sessionId)
-      state.approvals.set(payload.approvalId, {
-        rpcId: frame.rpcId,
-        approvalId: payload.approvalId,
-        toolName: payload.toolName,
-        callId: payload.callId,
-        reason: payload.reason,
-      })
-    } else if (payload.type === 'approval/resolved') {
-      const state = this.sessions.get(payload.sessionId)
-      if (state) {
-        state.approvals.delete(payload.approvalId)
-      }
-    } else if (payload.type === 'question/requested') {
-      const state = this._getOrInit(payload.sessionId)
-      state.questions.push({
-        rpcId: frame.rpcId,
-        questions: payload.questions as any,
-      })
-    } else if (payload.type === 'question/resolved') {
-      const state = this.sessions.get(payload.sessionId)
-      if (state) {
-        state.questions = state.questions.filter(q => q.rpcId !== payload.questionRpcId)
-      }
-    }
-  }
-
-  private _getOrInit(sessionId: string) {
-    let state = this.sessions.get(sessionId)
-    if (!state) {
-      state = { approvals: new Map(), questions: [] }
-      this.sessions.set(sessionId, state)
-    }
-    return state
-  }
-
-  /** Query pending items for a session. */
-  pending(sessionId: string): PendingState {
-    const state = this.sessions.get(sessionId)
-    if (!state) {
-      return { approvals: [], questions: [] }
-    }
-    return {
-      approvals: Array.from(state.approvals.values()),
-      questions: state.questions,
-    }
-  }
-
-  /** Clear all pending state for a session. */
-  clear(sessionId: string): void {
-    this.sessions.delete(sessionId)
-  }
-}

package/src/mobile-pwa.ts

@@ -1,19 +0,0 @@
-/** PWA registration for the standalone /m mobile surface. */
-export const MOBILE_PWA_SCOPE = '/m/'
-export const MOBILE_SERVICE_WORKER_URL = '/m/service-worker.js'
-
-/** Register the mobile shell worker when the current browser supports it. */
-export async function registerMobilePwa(
-  serviceWorker: Pick<ServiceWorkerContainer, 'register'> | undefined = typeof navigator === 'undefined' ? undefined : navigator.serviceWorker,
-): Promise<void> {
-  if (serviceWorker === undefined) return
-
-  try {
-    await serviceWorker.register(MOBILE_SERVICE_WORKER_URL, {
-      scope: MOBILE_PWA_SCOPE,
-      updateViaCache: 'none',
-    })
-  } catch {
-    // HTTP LAN origins cannot register workers; the online mobile UI still works.
-  }
-}

package/src/mobile-routes.ts

@@ -1,231 +0,0 @@
-/**
- * The mobile surface's page routes: /m canonicalizes to /m/, which serves the
- * standalone phone UI. The page and worker live in the /m/ scope so the PWA
- * can cache only its static shell; the paired-device data channel remains at
- * /m/api and is never handled by the worker.
- */
-
-import { readFile } from 'node:fs/promises'
-import { existsSync } from 'node:fs'
-import { fileURLToPath } from 'node:url'
-import { gzipSync } from 'node:zlib'
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
-
-const MOBILE_ROOT = '/m/'
-const MOBILE_BUNDLE_URL = '/m/mobile.js'
-const MOBILE_MANIFEST_URL = '/m/manifest.webmanifest'
-const MOBILE_WORKER_URL = '/m/service-worker.js'
-const MOBILE_OFFLINE_URL = '/m/offline.html'
-
-/** The standalone mobile bundle (built artifact, next to this file's own lib output). */
-function mobileBundlePath(): string {
-  return fileURLToPath(new URL('../lib/mobile.js', import.meta.url))
-}
-
-/** A package asset available to the host after a registry or git install. */
-function mobileAssetPath(name: string): string {
-  return fileURLToPath(new URL('../assets/' + name, import.meta.url))
-}
-
-/** The mobile page shell: self-contained, with no document-level user data. */
-function pageHtml(bundleUrl: string): string {
-  return [
-    '<!doctype html>',
-    '<html lang="zh-CN">',
-    '<head>',
-    '<meta charset="utf-8">',
-    '<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover">',
-    '<meta name="theme-color" content="#f3f5f9">',
-    '<meta name="referrer" content="no-referrer">',
-    '<meta name="mobile-web-app-capable" content="yes">',
-    '<meta name="apple-mobile-web-app-capable" content="yes">',
-    '<meta name="apple-mobile-web-app-title" content="DSH Remote">',
-    '<link rel="manifest" href="/m/manifest.webmanifest">',
-    '<link rel="apple-touch-icon" href="/m/apple-touch-icon.png">',
-    '<title>远程访问</title>',
-    '</head>',
-    '<body>',
-    '<div id="root"></div>',
-    '<script type="module" src="' + bundleUrl + '"></script>',
-    '</body>',
-    '</html>',
-  ].join('')
-}
-
-/** The installable app identity and icon declarations for the /m scope. */
-function manifestJson(): string {
-  return JSON.stringify({
-    id: MOBILE_ROOT,
-    name: 'DSH Remote',
-    short_name: 'DSH Remote',
-    start_url: MOBILE_ROOT,
-    scope: MOBILE_ROOT,
-    display: 'standalone',
-    background_color: '#151424',
-    theme_color: '#f3f5f9',
-    icons: [
-      { src: '/m/icon-192.png', sizes: '192x192', type: 'image/png', purpose: 'any' },
-      { src: '/m/icon-512.png', sizes: '512x512', type: 'image/png', purpose: 'any maskable' },
-    ],
-  }, null, 2)
-}
-
-/** A static fallback that contains no paired-device, session, or workspace data. */
-function offlineHtml(): string {
-  return [
-    '<!doctype html>',
-    '<html lang="zh-CN">',
-    '<head>',
-    '<meta charset="utf-8">',
-    '<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">',
-    '<meta name="theme-color" content="#151424">',
-    '<title>DSH Remote</title>',
-    '<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>',
-    '</head>',
-    '<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>',
-    '</html>',
-  ].join('')
-}
-
-/** Send a small static UTF-8 body with revalidation headers. */
-function writeStatic(res: ServerResponse, status: number, type: string, body: string): void {
-  res.writeHead(status, {
-    'content-type': type + '; charset=utf-8',
-    'cache-control': 'no-cache',
-    'referrer-policy': 'no-referrer',
-  })
-  res.end(body)
-}
-
-/** Send the worker with the same scope it registers for, without HTTP caching. */
-function writeServiceWorker(res: ServerResponse, body: string): void {
-  res.writeHead(200, {
-    'content-type': 'text/javascript; charset=utf-8',
-    'cache-control': 'no-cache',
-    'referrer-policy': 'no-referrer',
-    'service-worker-allowed': MOBILE_ROOT,
-  })
-  res.end(body)
-}
-
-/** Send a PNG body without decoding it to UTF-8. */
-function writePng(res: ServerResponse, status: number, body: Buffer): void {
-  res.writeHead(status, {
-    'content-type': 'image/png',
-    'cache-control': 'public, max-age=31536000, immutable',
-    'referrer-policy': 'no-referrer',
-  })
-  res.end(body)
-}
-
-/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
-function redirectToMobileRoot(req: IncomingMessage, res: ServerResponse): void {
-  const url = new URL(req.url ?? '/m', 'http://x')
-  res.writeHead(308, {
-    location: MOBILE_ROOT + url.search,
-    'cache-control': 'no-store',
-    'referrer-policy': 'no-referrer',
-  })
-  res.end()
-}
-
-/**
- * Build the mobile page routes.
- * @returns Exact routes for the canonical page, static shell, and PWA assets.
- */
-export function makeMobileRoutes(): WebRoute[] {
-  const handlePage = (_req: IncomingMessage, res: ServerResponse): void => {
-    writeStatic(res, 200, 'text/html', pageHtml(MOBILE_BUNDLE_URL))
-  }
-  const handleManifest = (_req: IncomingMessage, res: ServerResponse): void => {
-    writeStatic(res, 200, 'application/manifest+json', manifestJson())
-  }
-  const handleOffline = (_req: IncomingMessage, res: ServerResponse): void => {
-    writeStatic(res, 200, 'text/html', offlineHtml())
-  }
-
-  // The bundle is immutable for the process lifetime (a rebuild requires a
-  // host restart), so the body is read from disk once, not per phone.
-  let bundleBody: string | undefined
-  let bundleGzip: Buffer | undefined
-  const handleBundle = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    if (bundleBody === undefined) {
-      const path = mobileBundlePath()
-      if (!existsSync(path)) {
-        writeStatic(res, 503, 'text/plain', 'mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build')
-        return
-      }
-      try {
-        bundleBody = await readFile(path, 'utf8')
-        bundleGzip = gzipSync(Buffer.from(bundleBody, 'utf8'))
-      } catch {
-        writeStatic(res, 500, 'text/plain', 'failed to read the mobile bundle')
-        return
-      }
-    }
-    const acceptEncoding = req.headers['accept-encoding'] ?? ''
-    const acceptsGzip = typeof acceptEncoding === 'string' && acceptEncoding.includes('gzip') && bundleGzip !== undefined
-    if (acceptsGzip) {
-      res.writeHead(200, {
-        'content-type': 'text/javascript; charset=utf-8',
-        'content-encoding': 'gzip',
-        'cache-control': 'no-cache',
-        vary: 'Accept-Encoding',
-        'referrer-policy': 'no-referrer',
-      })
-      res.end(bundleGzip)
-    } else {
-      res.writeHead(200, {
-        'content-type': 'text/javascript; charset=utf-8',
-        'cache-control': 'no-cache',
-        vary: 'Accept-Encoding',
-        'referrer-policy': 'no-referrer',
-      })
-      res.end(bundleBody)
-    }
-  }
-
-  let workerBody: string | undefined
-  const handleWorker = async (_req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    if (workerBody === undefined) {
-      const path = mobileAssetPath('mobile-service-worker.js')
-      if (!existsSync(path)) {
-        writeStatic(res, 503, 'text/plain', 'mobile service worker not found')
-        return
-      }
-      try {
-        workerBody = await readFile(path, 'utf8')
-      } catch {
-        writeStatic(res, 500, 'text/plain', 'failed to read the mobile service worker')
-        return
-      }
-    }
-    writeServiceWorker(res, workerBody)
-  }
-
-  const makeIconHandler = (asset: string): WebRoute['handler'] => async (_req, res) => {
-    const path = mobileAssetPath(asset)
-    if (!existsSync(path)) {
-      writeStatic(res, 404, 'text/plain', asset + ' not found')
-      return
-    }
-    try {
-      writePng(res, 200, await readFile(path))
-    } catch {
-      writeStatic(res, 500, 'text/plain', 'failed to read ' + asset)
-    }
-  }
-
-  return [
-    { kind: 'exact', path: '/m', handler: redirectToMobileRoot },
-    { kind: 'exact', path: MOBILE_ROOT, handler: handlePage },
-    { kind: 'exact', path: MOBILE_BUNDLE_URL, handler: handleBundle },
-    { kind: 'exact', path: MOBILE_MANIFEST_URL, handler: handleManifest },
-    { kind: 'exact', path: MOBILE_WORKER_URL, handler: handleWorker },
-    { kind: 'exact', path: MOBILE_OFFLINE_URL, handler: handleOffline },
-    { kind: 'exact', path: '/m/apple-touch-icon.png', handler: makeIconHandler('apple-touch-icon.png') },
-    { kind: 'exact', path: '/m/icon-192.png', handler: makeIconHandler('mobile-icon-192.png') },
-    { kind: 'exact', path: '/m/icon-512.png', handler: makeIconHandler('mobile-icon-512.png') },
-  ]
-}

package/src/paired-model-catalog.ts

@@ -1,272 +0,0 @@
-/** Paired-only model discovery and adoption routes; generic privileged RPCs stay loopback-only. */
-import type { IncomingMessage, ServerResponse } from 'node:http'
-import type { ApiProxy, ModelProviderGroup, RpcId, RpcResponse, SettingsNamespaceView, SettingsPathOpView } from '@deepseek-ai/dsh-host-apiproxy/api'
-import type { WebRoute } from '@deepseek-ai/dsh-host-webserver'
-import { z } from 'zod'
-import type { PairingService } from './pairing.ts'
-import { readCookie } from './gate.ts'
-import { readBoundedJson, writeJson } from './http.ts'
-import { isTrustedApiRequest, publicHostOf } from './routes.ts'
-
-const MAX_BODY_BYTES = 16 * 1024
-const MAX_IDENTIFIER_LENGTH = 160
-const MAX_DISPLAY_NAME_LENGTH = 240
-const MAX_TOKEN_LIMIT = 10_000_000
-const REASONING_EFFORTS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'] as const
-type ReasoningEffort = typeof REASONING_EFFORTS[number]
-const stringField = (max: number) => z.string().trim().min(1).max(max).refine(value => !/[\r\n\0]/.test(value), 'must not contain a newline or NUL')
-const providerSchema = z.object({ provider: stringField(MAX_IDENTIFIER_LENGTH) }).strict()
-const modelSchema = z.object({
-  id: stringField(MAX_IDENTIFIER_LENGTH),
-  name: stringField(MAX_DISPLAY_NAME_LENGTH).optional(),
-  contextWindow: z.number().int().safe().positive().max(MAX_TOKEN_LIMIT).optional(),
-  maxTokens: z.number().int().safe().positive().max(MAX_TOKEN_LIMIT).optional(),
-  reasoningEfforts: z.array(z.enum(REASONING_EFFORTS)).min(1).refine(
-    efforts => efforts.every((effort, index) => index === 0 || REASONING_EFFORTS.indexOf(efforts[index - 1]!) < REASONING_EFFORTS.indexOf(effort)),
-    'reasoning efforts must be unique and in canonical order',
-  ).optional(),
-}).strict()
-const upsertSchema = z.object({ provider: stringField(MAX_IDENTIFIER_LENGTH), model: modelSchema }).strict()
-
-interface ModelProfile { id: string, name?: string, contextWindow?: number, maxTokens?: number, reasoningEfforts?: ReasoningEffort[] }
-interface EligibleProvider { provider: string, displayName: string, namespace: SettingsNamespaceView, profile: Record<string, unknown> }
-interface CatalogValue { groups: ModelProviderGroup[], failures: Array<{ id: string, name: string, message: string }> }
-
-export const PAIRED_MODEL_CATALOG_PATHS = {
-  catalog: '/api/pair/model-catalog',
-  discover: '/api/pair/model-catalog/discover',
-  upsert: '/api/pair/model-catalog/upsert',
-} as const
-
-export interface PairedModelCatalogDeps {
-  service: PairingService
-  apiProxy: ApiProxy
-  /** The LAN IP literals the host fence accepts, mirroring the /api/pair fence. */
-  lanAddresses: readonly string[]
-}
-
-let rpcSequence = 0
-function request<T>(payload: T): { rpcId: RpcId, payload: T } {
-  rpcSequence += 1
-  return { rpcId: `paired-model-catalog-${Date.now().toString(36)}-${rpcSequence.toString(36)}` as RpcId, payload }
-}
-function isRecord(value: unknown): value is Record<string, unknown> { return typeof value === 'object' && value !== null && !Array.isArray(value) }
-function valueOf<T>(response: RpcResponse<T>): T | undefined { return response.result.ok ? response.result.value : undefined }
-function errorCode(response: RpcResponse<unknown>): string | undefined { return response.result.ok ? undefined : response.result.error.code }
-function reject(res: ServerResponse, status: number, error: string): void { writeJson(res, status, { error }) }
-function publicProviderId(value: string): string {
-  const normalized = value.replace(/[\r\n\0]/g, ' ').trim().slice(0, MAX_IDENTIFIER_LENGTH)
-  return normalized === '' ? 'unknown' : normalized
-}
-
-function publicCatalog(value: CatalogValue): CatalogValue {
-  return {
-    groups: value.groups.map(group => ({ id: group.id, name: group.name, models: group.models.map(model => ({
-      id: model.id, name: model.name,
-      ...model.description === undefined ? {} : { description: model.description },
-      ...model.reasoning === undefined ? {} : { reasoning: model.reasoning },
-    })) })),
-    failures: value.failures.map(failure => ({
-      id: failure.id,
-      name: failure.name,
-      message: `model catalog unavailable for provider ${publicProviderId(failure.id)}`,
-    })),
-  }
-}
-function publicCandidates(models: Array<{ id: string, name?: string, contextWindow?: number, maxTokens?: number }>): unknown[] {
-  return models.map(model => ({ id: model.id,
-    ...model.name === undefined ? {} : { name: model.name },
-    ...model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow },
-    ...model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens },
-  }))
-}
-function fieldsOf(model: ModelProfile, includeId: boolean): Record<string, unknown> {
-  const fields: Record<string, unknown> = {
-    ...includeId ? { id: model.id } : {},
-    ...model.name === undefined ? {} : { name: model.name },
-    ...model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow },
-    ...model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens },
-  }
-  if (model.reasoningEfforts !== undefined) fields.reasoningEfforts = Object.fromEntries(model.reasoningEfforts.map(effort => [effort, effort === 'off' ? null : effort]))
-  return fields
-}
-function groupFor(catalog: CatalogValue, provider: string): ModelProviderGroup | undefined {
-  if (catalog.failures.some(failure => failure.id === provider)) return undefined
-  return catalog.groups.find(group => group.id === provider)
-}
-async function readCatalog(apiProxy: ApiProxy): Promise<CatalogValue | undefined> {
-  try { return valueOf(await apiProxy.llm.models(request({}))) } catch { return undefined }
-}
-
-/** Resolve one exact active llm-pi-ai provider address, never an input-supplied path. */
-async function eligibleProvider(apiProxy: ApiProxy, requested: string): Promise<{ provider?: EligibleProvider, status?: number, error?: string }> {
-  let providersResponse: Awaited<ReturnType<ApiProxy['llm']['providers']>>
-  let settingsResponse: Awaited<ReturnType<ApiProxy['settings']['describe']>>
-  try {
-    providersResponse = await apiProxy.llm.providers(request({}))
-    settingsResponse = await apiProxy.settings.describe(request({}))
-  } catch { return { status: 502, error: 'model catalog capability is unavailable' } }
-  const providers = valueOf(providersResponse)
-  const settings = valueOf(settingsResponse)
-  if (providers === undefined || settings === undefined) return { status: 502, error: 'model catalog capability is unavailable' }
-  const route = providers.providers.find(candidate => candidate.provider === requested)
-  if (route === undefined) return { status: 404, error: `unknown provider ${requested}` }
-  if (!settings.writable || !route.active || route.settingsNs !== 'llm-pi-ai' || route.settingsPath.length !== 2
-    || route.settingsPath[0] !== 'providers' || route.settingsPath[1] !== requested) return { status: 403, error: `provider ${requested} is not eligible for the paired model catalog` }
-  const namespace = settings.namespaces.find(candidate => candidate.ns === 'llm-pi-ai')
-  const root = namespace !== undefined && isRecord(namespace.value) ? namespace.value : undefined
-  const providersValue = root !== undefined && isRecord(root.providers) ? root.providers : undefined
-  const profile = providersValue !== undefined && isRecord(providersValue[requested]) ? providersValue[requested] : undefined
-  if (namespace === undefined || profile === undefined) return { status: 403, error: `provider ${requested} is not eligible for the paired model catalog` }
-  return { provider: { provider: requested, displayName: route.displayName, namespace, profile } }
-}
-function validIdentifier(value: unknown): value is string {
-  const parsed = stringField(MAX_IDENTIFIER_LENGTH).safeParse(value)
-  return parsed.success && parsed.data === value
-}
-function configuredModels(profile: Record<string, unknown>): { inherited: true } | { inherited: false, values: Record<string, unknown>[] } | undefined {
-  if (!Object.hasOwn(profile, 'models')) return { inherited: true }
-  if (!Array.isArray(profile.models)) return undefined
-  if (profile.models.length === 0) return { inherited: true }
-  const values: Record<string, unknown>[] = []
-  for (const entry of profile.models) {
-    if (!isRecord(entry) || !validIdentifier(entry.id)) return undefined
-    values.push({ ...entry })
-  }
-  return { inherited: false, values }
-}
-function configuredOverrides(profile: Record<string, unknown>): { present: boolean, values: Map<string, Record<string, unknown>> } | undefined {
-  if (!Object.hasOwn(profile, 'modelOverrides')) return { present: false, values: new Map() }
-  if (!isRecord(profile.modelOverrides)) return undefined
-  const values = new Map<string, Record<string, unknown>>()
-  for (const [id, value] of Object.entries(profile.modelOverrides)) {
-    if (!validIdentifier(id) || !isRecord(value)) return undefined
-    values.set(id, { ...value })
-  }
-  return { present: true, values }
-}
-function updatedModels(existing: Record<string, unknown>[], model: ModelProfile): Record<string, unknown>[] {
-  const next = existing.map(entry => ({ ...entry }))
-  const index = next.findIndex(entry => entry.id === model.id)
-  const patch = fieldsOf(model, true)
-  if (index >= 0) next[index] = { ...next[index], ...patch }
-  else next.push(patch)
-  return next
-}
-function mutationPlan(profile: Record<string, unknown>, provider: string, model: ModelProfile, catalog: CatalogValue): { ops: SettingsPathOpView[] } | undefined {
-  const configured = configuredModels(profile)
-  const overrides = configuredOverrides(profile)
-  if (configured === undefined || overrides === undefined) return undefined
-  const modelsPath = ['providers', provider, 'models']
-  const overridesPath = ['providers', provider, 'modelOverrides']
-  if (!configured.inherited) {
-    if (overrides.values.size > 0) return undefined
-    const ops: SettingsPathOpView[] = [{ op: 'set', path: modelsPath, value: updatedModels(configured.values, model) }]
-    if (overrides.present) ops.push({ op: 'unset', path: overridesPath })
-    return { ops }
-  }
-
-  const group = groupFor(catalog, provider)
-  if (group?.models.some(entry => entry.id === model.id) === true) {
-    const existing = overrides.values.get(model.id) ?? {}
-    return { ops: [{ op: 'set', path: [...overridesPath, model.id], value: { ...existing, ...fieldsOf(model, false) } }] }
-  }
-  if (group === undefined) return undefined
-  const materialized: Record<string, unknown>[] = []
-  const materializedIds = new Set<string>()
-  for (const installed of group.models) {
-    materialized.push({ ...overrides.values.get(installed.id), id: installed.id })
-    materializedIds.add(installed.id)
-  }
-  for (const [id, override] of overrides.values) {
-    if (!materializedIds.has(id)) materialized.push({ ...override, id })
-  }
-  const ops: SettingsPathOpView[] = [{ op: 'set', path: modelsPath, value: updatedModels(materialized, model) }]
-  if (overrides.present) ops.push({ op: 'unset', path: overridesPath })
-  return { ops }
-}
-function paired(req: IncomingMessage, service: PairingService): boolean {
-  const deviceId = readCookie(req.headers.cookie, service.config.cookieName)
-  return deviceId !== undefined && service.touchDevice(deviceId)
-}
-async function bodyOf<T>(req: IncomingMessage, schema: z.ZodType<T>): Promise<T | undefined> {
-  try { return schema.parse(await readBoundedJson(req, MAX_BODY_BYTES)) } catch { return undefined }
-}
-
-/** Build the narrow paired-device model catalog routes. */
-export function makePairedModelCatalogRoutes(deps: PairedModelCatalogDeps): WebRoute[] {
-  const { service, apiProxy, lanAddresses } = deps
-  /** Same fence as the /api/pair family: loopback, the advertised LAN literals, or the configured public host. */
-  const fence = (req: IncomingMessage): boolean => {
-    const publicHost = publicHostOf(service.publicBaseUrl)
-    return isTrustedApiRequest(req, publicHost === undefined ? lanAddresses : [...lanAddresses, publicHost])
-  }
-  const gate = (req: IncomingMessage, res: ServerResponse): boolean => {
-    if (!fence(req)) {
-      req.resume()
-      reject(res, 403, 'paired model catalog is not reachable for this origin')
-      return false
-    }
-    if (!paired(req, service)) {
-      req.resume()
-      reject(res, 403, 'paired model catalog requires a live paired device')
-      return false
-    }
-    return true
-  }
-  const catalog = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    if (!gate(req, res)) return
-    if (req.method !== 'GET') return reject(res, 405, 'method not allowed')
-    let providersResponse: Awaited<ReturnType<ApiProxy['llm']['providers']>>
-    let settingsResponse: Awaited<ReturnType<ApiProxy['settings']['describe']>>
-    try { providersResponse = await apiProxy.llm.providers(request({})); settingsResponse = await apiProxy.settings.describe(request({})) } catch { return reject(res, 502, 'model catalog capability is unavailable') }
-    const providers = valueOf(providersResponse)
-    const settings = valueOf(settingsResponse)
-    if (providers === undefined || settings === undefined) return reject(res, 502, 'model catalog capability is unavailable')
-    const namespace = settings.namespaces.find(candidate => candidate.ns === 'llm-pi-ai')
-    const providerMap = namespace !== undefined && isRecord(namespace.value) && isRecord(namespace.value.providers) ? namespace.value.providers : undefined
-    const eligible = settings.writable && providerMap !== undefined ? providers.providers.filter(candidate => candidate.active && candidate.settingsNs === 'llm-pi-ai'
-      && candidate.settingsPath.length === 2 && candidate.settingsPath[0] === 'providers' && candidate.settingsPath[1] === candidate.provider && isRecord(providerMap[candidate.provider]))
-      .map(candidate => ({ provider: candidate.provider, displayName: candidate.displayName })) : []
-    writeJson(res, 200, { capability: 'paired-model-catalog', providers: eligible })
-  }
-  const discover = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    if (!gate(req, res)) return
-    if (req.method !== 'POST') return reject(res, 405, 'method not allowed')
-    const body = await bodyOf(req, providerSchema)
-    if (body === undefined) return reject(res, 400, 'invalid model catalog request')
-    const eligible = await eligibleProvider(apiProxy, body.provider)
-    if (eligible.provider === undefined) return reject(res, eligible.status ?? 502, eligible.error ?? 'model catalog capability is unavailable')
-    try {
-      const result = valueOf(await apiProxy.llm.discoverModels(request({ settingsNs: 'llm-pi-ai', provider: eligible.provider.provider })))
-      if (result === undefined) return reject(res, 502, `model discovery failed for provider ${eligible.provider.provider}`)
-      writeJson(res, 200, { models: publicCandidates(result.models) })
-    } catch { reject(res, 502, `model discovery failed for provider ${eligible.provider.provider}`) }
-  }
-  const upsert = async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    if (!gate(req, res)) return
-    if (req.method !== 'POST') return reject(res, 405, 'method not allowed')
-    const body = await bodyOf(req, upsertSchema)
-    if (body === undefined) return reject(res, 400, 'invalid model catalog request')
-    const eligible = await eligibleProvider(apiProxy, body.provider)
-    if (eligible.provider === undefined) return reject(res, eligible.status ?? 502, eligible.error ?? 'model catalog capability is unavailable')
-    const before = await readCatalog(apiProxy)
-    if (before === undefined) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`)
-    const plan = mutationPlan(eligible.provider.profile, body.provider, body.model, before)
-    if (plan === undefined) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`)
-    let mutation: Awaited<ReturnType<ApiProxy['settings']['mutate']>>
-    try { mutation = await apiProxy.settings.mutate(request({ ns: 'llm-pi-ai', expectedRevision: eligible.provider.namespace.revision, ops: plan.ops })) } catch { return reject(res, 502, `model update failed for provider ${body.provider}`) }
-    const code = errorCode(mutation)
-    if (code === 'settings-conflict') return reject(res, 409, `model update conflicted for provider ${body.provider}`)
-    if (code === 'settings-rejected') return reject(res, 422, `model update was rejected for provider ${body.provider}`)
-    if (code !== undefined) return reject(res, 502, `model update failed for provider ${body.provider}`)
-    const after = await readCatalog(apiProxy)
-    if (after === undefined) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`)
-    writeJson(res, 200, publicCatalog(after))
-  }
-  return [
-    { kind: 'exact', path: PAIRED_MODEL_CATALOG_PATHS.catalog, handler: catalog },
-    { kind: 'exact', path: PAIRED_MODEL_CATALOG_PATHS.discover, handler: discover },
-    { kind: 'exact', path: PAIRED_MODEL_CATALOG_PATHS.upsert, handler: upsert },
-  ]
-}