@linxin666/dsh-remote-web-ui 0.3.6 → 0.3.9

package/lib/index.js

@@ -1,218 +1,17 @@
 import { createRequire } from "node:module";
-import { dirname, isAbsolute, join } from "node:path";
-import { setInterval as setInterval$1, setTimeout as setTimeout$1 } from "node:timers";
-import { Service } from "@deepseek-ai/cordis";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { setInterval, setTimeout as setTimeout$1 } from "node:timers";
 import z from "schemastery";
 import { randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces } from "node:os";
 import { isAbsolute as isAbsolute$1, join as join$1 } from "node:path/posix";
+import { Service } from "@deepseek-ai/cordis";
 import { z as z$1 } from "zod";
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { gzipSync } from "node:zlib";
-import { RpcId } from "@deepseek-ai/dsh-host-apiproxy/api/rpc";
 import http, { request } from "node:http";
 import { connect } from "node:net";
+import { spawn, spawnSync } from "node:child_process";
 import { Tunnel, bin, install } from "cloudflared";
-import { spawn } from "node:child_process";
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-settings@0.1.1-rc.2_@deepseek-ai+cordis@4.0.1_@deepseek-ai+dsh-brand@0_02aaf429ec98c58247037e2222c17a8f/node_modules/@deepseek-ai/dsh-settings/lib/index.js
-/**
-* Structural secret redaction for settings values. `role('secret')` fields are
-* removed from a value before it crosses a wire boundary; a sidecar records
-* each schema-declared secret position and whether it currently holds a value,
-* so a configuration surface can render a write-only input without ever
-* receiving the secret itself.
-* @module @deepseek-ai/dsh-settings/redact
-*/
-/** Whether a value is a plain data object the walker may recurse into. */
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function walk(node, value, path, secrets) {
-	if (node === void 0) return value;
-	if (node.meta?.role === "secret") {
-		secrets.push({
-			path,
-			set: value !== void 0
-		});
-		return;
-	}
-	switch (node.type) {
-		case "object": {
-			const properties = node.dict ?? {};
-			const source = isRecord$1(value) ? value : void 0;
-			const rebuilt = {};
-			if (source !== void 0) for (const [key, entry] of Object.entries(source)) {
-				if (key in properties) continue;
-				rebuilt[key] = entry;
-			}
-			for (const [key, child] of Object.entries(properties)) {
-				const stripped = walk(child, source?.[key], [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return source === void 0 && Object.keys(rebuilt).length === 0 ? value : rebuilt;
-		}
-		case "dict": {
-			if (!isRecord$1(value)) return value;
-			const rebuilt = {};
-			for (const [key, entry] of Object.entries(value)) {
-				const stripped = walk(node.inner, entry, [...path, key], secrets);
-				if (stripped !== void 0) rebuilt[key] = stripped;
-			}
-			return rebuilt;
-		}
-		case "array":
-			if (!Array.isArray(value)) return value;
-			return value.map((entry, index) => walk(node.inner, entry, [...path, String(index)], secrets));
-		default: return value;
-	}
-}
-/**
-* Service Definition for the user-settings capability seam (`ctx.settings`). Providers store one raw document of
-* per-namespace sections; plugins register a namespace schema and read the
-* resolved value, which layers schema defaults, the registrant's composition
-* `base`, and the user document section, in that order.
-* @module @deepseek-ai/dsh-settings
-*/
-const NAMESPACE_PATTERN = /^[a-z][a-z0-9-]*$/;
-/**
-* Brand a raw string as a {@link SettingsNamespace}.
-* @param value - candidate namespace; lowercase kebab-case, as in plugin short names.
-* @returns the branded namespace.
-*/
-function settingsNamespace(value) {
-	if (!NAMESPACE_PATTERN.test(value)) throw new TypeError(`settings namespace "${value}" must match ${String(NAMESPACE_PATTERN)}`);
-	return value;
-}
-/**
-* Deep equality over JSON-compatible data (objects, arrays, primitives) — the
-* Service Definition's single change-detection predicate, exported so the invariant
-* companion checks exactly the implementation's relation.
-* @param a - one JSON-compatible value.
-* @param b - the other JSON-compatible value.
-* @returns whether the two values are structurally equal.
-*/
-function deepEqualJson(a, b) {
-	if (a === b) return true;
-	if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
-	if (Array.isArray(a) || Array.isArray(b)) {
-		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
-		return a.every((entry, index) => deepEqualJson(entry, b[index]));
-	}
-	const left = a;
-	const right = b;
-	const keys = Object.keys(left);
-	if (keys.length !== Object.keys(right).length) return false;
-	return keys.every((key) => key in right && deepEqualJson(left[key], right[key]));
-}
-/** Whether a value is a plain data object (not an array, null, or class instance). */
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-/** Apply one path op to a detached section, returning the next section. */
-function applyPathOp(section, op) {
-	const [head, ...rest] = op.path;
-	if (head === void 0) {
-		if (op.op === "unset") return {};
-		if (!isPlainObject(op.value)) throw new TypeError("settings mutate: setting the section root requires a plain object");
-		return { ...op.value };
-	}
-	if (rest.length === 0) {
-		if (op.op === "set") return {
-			...section,
-			[head]: op.value
-		};
-		const { [head]: _removed, ...kept } = section;
-		return kept;
-	}
-	const child = section[head];
-	if (!isPlainObject(child)) {
-		if (op.op === "unset") return section;
-		return {
-			...section,
-			[head]: applyPathOp({}, {
-				...op,
-				path: rest
-			})
-		};
-	}
-	return {
-		...section,
-		[head]: applyPathOp(child, {
-			...op,
-			path: rest
-		})
-	};
-}
-/**
-* Layer `over` onto `under`: plain objects merge recursively, every other
-* value (arrays included) replaces the lower layer wholesale. `over` never
-* carries `undefined` entries — sections come from parsed documents and write
-* snapshots pass {@link cloneJsonShaped}, which strips them so a sparse patch
-* cannot erase lower keys.
-*/
-function mergeLayers(under, over) {
-	if (over === void 0) return under;
-	if (!isPlainObject(under) || !isPlainObject(over)) return over;
-	const merged = { ...under };
-	for (const [key, value] of Object.entries(over)) merged[key] = key in merged ? mergeLayers(merged[key], value) : value;
-	return merged;
-}
-/** Recursively freeze one resolved value so handed-out snapshots stay immutable. */
-function deepFreeze(value) {
-	if (typeof value !== "object" || value === null || Object.isFrozen(value)) return value;
-	for (const entry of Object.values(value)) deepFreeze(entry);
-	return Object.freeze(value);
-}
-Service.init;
-/**
-* Value mirror of the `FiberState` members {@link isUnloading} compares
-* against: a const enum has no runtime object to import, and the value is
-* needed at runtime (same rationale as the CLI boot driver's mirror).
-*/
-const FIBER_DISPOSED = 4;
-const FIBER_UNLOADING = 5;
-/** Whether the consumer's own fiber is tearing down (not just losing the settings service). */
-function isUnloading(ctx) {
-	const state = ctx.fiber.state;
-	return state === FIBER_UNLOADING || state === FIBER_DISPOSED;
-}
-/**
-* Install the canonical optional-settings consumer wiring: while a settings
-* service exists, register `ns` with the consumer's composition entry as the
-* `base` layer and point the source thunk at the resolved scope; when the
-* service goes away (disposal, provider reload), fall back to the entry so
-* the consumer keeps working exactly as composed. The registration rides the
-* scoped fiber, so no settings service ever mounted means none of this runs.
-* @param ctx - consumer plugin context owning the wiring.
-* @param ns - the consumer-owned settings namespace.
-* @param schema - schema resolving the namespace (typically the plugin Config).
-* @param entry - the consumer's composition entry config, used as `base`.
-* @param hooks - source sink and change notification.
-*/
-function installSettingsSection(ctx, ns, schema, entry, hooks) {
-	ctx.inject(["settings"], (sctx) => {
-		const scope = sctx.settings.register(ns, schema, {
-			base: entry,
-			...hooks.validate === void 0 ? {} : { validate: hooks.validate }
-		});
-		hooks.setSource(() => scope.get());
-		sctx.effect(() => () => {
-			if (isUnloading(ctx)) return;
-			hooks.setSource(() => entry);
-			hooks.onChange();
-		});
-		hooks.onChange();
-		scope.watch(() => {
-			if (isUnloading(ctx)) return;
-			hooks.onChange();
-		});
-	});
-}
-//#endregion
 //#region src/pairing.ts
 /**
 * Pairing state machine: one active one-time token, a device-session table,
@@ -223,8 +22,12 @@ function installSettingsSection(ctx, ns, schema, entry, hooks) {
 * Security invariants:
 * - One active token at a time; `issue()` replaces it, so a refreshed QR
 *   immediately invalidates the previous link.
-* - A token is consumed by the first successful `accept()` — reuse is
-*   refused with `'used'`.
+* - A token stays re-usable until it expires or is replaced: the first
+*   successful `accept()` marks it consumed, but the same link may pair
+*   again within the window (each re-accept mints a fresh device session).
+*   Mobile flows routinely split across cookie contexts (camera preview to
+*   in-app browser to the system browser), and the later context must be
+*   able to complete its own pairing from the same link.
 * - Tokens expire; `accept()` on an expired token is refused like an
 *   unknown one (no oracle for validity).
 * - `stop()` revokes every device session and clears the token, so paired
@@ -232,8 +35,16 @@ function installSettingsSection(ctx, ns, schema, entry, hooks) {
 * - `revoke()` drops one device session; idle sessions older than
 *   `idleExpireMs` are deleted on sweep, load, and the next gated request.
 */
-/** Default idle-expiry window: 7 days without heartbeat or a gated request. */
-const DEFAULT_IDLE_EXPIRE_MS = 10080 * 60 * 1e3;
+/**
+* Default idle-expiry window: 30 days without a heartbeat or a gated
+* request. The reopen service worker refreshes lastSeenAt on every
+* navigation it serves, so the window only runs out through genuine
+* disuse; 30 days matches the browser-credential lifetimes the surrounding
+* flow was built around, while the effective device lifetime stays shorter
+* than the 365-day cookie because of this sweep. Override per deployment
+* through the idleExpireMs config.
+*/
+const DEFAULT_IDLE_EXPIRE_MS = 720 * 60 * 60 * 1e3;
 /** Cap on the persisted/displayed User-Agent string. */
 const MAX_USER_AGENT_CHARS = 180;
 /** Thrown by issue() for an address outside the sampled LAN literals. */
@@ -326,7 +137,7 @@ var PairingService = class {
 	/** Drop sessions whose lastSeenAt is older than idleExpireMs. */
 	evictIdle() {
 		const now = this.clock.now();
-		const limit = this.config.idleExpireMs ?? 6048e5;
+		const limit = this.config.idleExpireMs ?? 2592e6;
 		let removed = false;
 		for (const [id, session] of [...this.devices]) if (now - session.lastSeenAt > limit) {
 			this.devices.delete(id);
@@ -439,9 +250,9 @@ var PairingService = class {
 	*/
 	accept(token, userAgent) {
 		const record = this.tokens.get(token);
-		if (record === void 0 || record.consumed || this.stopped || this.clock.now() > record.expiresAt) return {
+		if (record === void 0 || this.stopped || this.clock.now() > record.expiresAt) return {
 			ok: false,
-			code: record?.consumed === true ? "used" : "invalid"
+			code: "invalid"
 		};
 		record.consumed = true;
 		const deviceId = this.clock.randomToken();
@@ -577,7 +388,7 @@ var PairingService = class {
 		if (this.stopped) return void 0;
 		const session = this.devices.get(deviceId);
 		if (session === void 0) return void 0;
-		const limit = this.config.idleExpireMs ?? 6048e5;
+		const limit = this.config.idleExpireMs ?? 2592e6;
 		if (this.clock.now() - session.lastSeenAt > limit) {
 			this.devices.delete(deviceId);
 			this.persist();
@@ -767,8 +578,8 @@ function makeGateListener(service, requirePairingForLan = true, enabled = true)
 }
 /**
 * Whether a request carries a live, non-revoked paired-device cookie for
-* this service. Sibling host routes outside /api (aionui-panel, etc.) use
-* the same check via the remoteWebUiPairing service.
+* this service. Sibling host routes outside /api (the right-panel
+* /sidebar/* routes, etc.) use the same check via the remoteWebUiPairing service.
 * @param service - the pairing service that owns the device table.
 * @param request - the incoming HTTP request.
 * @returns true when the cookie names a live session (and lastSeenAt was refreshed).
@@ -815,23 +626,6 @@ const JSON_HEADERS = {
 	"referrer-policy": "no-referrer"
 };
 /**
-* Strict bounded body reader: parse a request body of at most maxBytes as
-* JSON.
-* @throws 'body too large' past the cap, or the JSON.parse error for an
-*   invalid or empty payload.
-*/
-async function readBoundedJson(req, maxBytes) {
-	const chunks = [];
-	let size = 0;
-	for await (const chunk of req) {
-		const buffer = chunk;
-		size += buffer.length;
-		if (size > maxBytes) throw new Error("body too large");
-		chunks.push(buffer);
-	}
-	return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-}
-/**
 * Lenient bounded body reader: parse a request body as JSON, or null on an
 * empty body, invalid JSON, or a body past maxBytes (default 64 KiB).
 * Overflow destroys the request instead of draining the remainder (no drain
@@ -919,7 +713,20 @@ function isTrustedApiRequest(request, trustedHosts) {
 	}
 }
 /** Cap on pairing request bodies (tokens and workspace ids are tiny). */
-const MAX_BODY_BYTES$1 = 4096;
+const MAX_BODY_BYTES = 4096;
+/**
+* The rate-limit bucket key for one accept attempt (pure; unit-tested).
+* The first client-visible XFF hop separates buckets behind the auto-tunnel
+* (every internet client arrives from 127.0.0.1 there) — but only for
+* loopback peers, since a direct LAN client can rotate the header freely.
+* @param socketIp - the socket peer address.
+* @param forwarded - the first XFF hop, already trimmed, if any.
+* @param bucket - page (GET /pair-accept) vs api (POST /api/pair/accept).
+*/
+function acceptLimitKey(socketIp, forwarded, bucket) {
+	if (isLoopbackAddress(socketIp) && forwarded !== void 0 && forwarded !== "") return `${bucket}|${socketIp}|${forwarded}`;
+	return `${bucket}|${socketIp}`;
+}
 /**
 * The host authority of a configured public base URL, e.g. `foo.trycloudflare.com`
 * from `https://foo.trycloudflare.com`. Undefined when the URL does not parse —
@@ -938,6 +745,124 @@ function publicHostOf(url) {
 }
 /** Cookie lifetime: one year; revoked sessions die at the gate regardless. */
 const COOKIE_MAX_AGE_SEC = 365 * 24 * 60 * 60;
+/**
+* The cookieless device credential: pass the device id from the /pair-app
+* URL into sessionStorage (and localStorage for tab reloads) before any app
+* script runs - same key the boot patch and the channel gate read. The
+* replaceState to '/' hides the credential URL from the address bar and
+* leaves the SPA at its canonical root path. The reopen service worker is
+* registered in the same breath: later navigations to '/' (history,
+* bookmark, tab restore) must not fall through to the harness index gate,
+* which the cookieless flow can never satisfy.
+*/
+const APP_DEVICE_STORAGE_KEY = "dsh-remote-device";
+function appShellCaptureScript(deviceId) {
+	const safeId = JSON.stringify(deviceId);
+	const register = `try{if('serviceWorker' in navigator){navigator.serviceWorker.register(${JSON.stringify(PAIR_PATHS.appServiceWorker)},{scope:'/'}).catch(function(e){})}}catch(e){}`;
+	return `<script>(function(){try{sessionStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});localStorage.setItem(${JSON.stringify(APP_DEVICE_STORAGE_KEY)},${safeId});}catch(e){}try{history.replaceState(null,'','/')}catch(e){}${register}})()<\/script>`;
+}
+/** Patch the official index document with the device-capture script. */
+function patchAppShell(html, deviceId) {
+	const script = appShellCaptureScript(deviceId);
+	const at = html.indexOf("</head>");
+	if (at === -1) return script + html;
+	return html.slice(0, at) + script + html.slice(at);
+}
+/**
+* The reopen service worker served at PAIR_PATHS.appServiceWorker. A paired
+* phone comes back to `/` from history, bookmarks, or tab restore; the
+* harness fallback seat answers that navigation with its browser-auth 401,
+* and the cookieless mobile flow never holds a browser-auth cookie. The
+* worker owns navigations to `/` instead: network-first through /pair-app
+* (which validates the device cookie and refreshes its presence), the
+* cached shell for offline opens, and a pass-through of the original
+* request when the plugin no longer answers. Plain-HTTP LAN origins are not
+* secure contexts, so the worker never registers there — the LAN reopen
+* path stays "scan a fresh QR", which is cheap in-network.
+*
+* Kept as a plain string (same pattern as the capture script): it must load
+* with no build step, run on every JS engine that ships service workers,
+* and be assertable as source in tests. Bump SHELL_CACHE when the storage
+* layout changes so old caches are pruned on activate.
+*/
+function appServiceWorkerScript() {
+	return `'use strict';
+var SHELL_CACHE = 'dsh-remote-shell-v1';
+var SHELL_KEY = '/dsh-remote-shell';
+var APP_URL = '/pair-app';
+self.addEventListener('install', function (event) {
+  event.waitUntil(refreshShell().then(function () { return self.skipWaiting(); }));
+});
+self.addEventListener('activate', function (event) {
+  event.waitUntil(self.caches.keys().then(function (names) {
+    return Promise.all(names.map(function (name) {
+      return name === SHELL_CACHE ? Promise.resolve() : self.caches.delete(name);
+    }));
+  }).then(function () { return self.clients.claim(); }));
+});
+self.addEventListener('fetch', function (event) {
+  var request = event.request;
+  if (request.method !== 'GET' || request.mode !== 'navigate') return;
+  var path;
+  try { path = new URL(request.url).pathname; } catch (error) { return; }
+  if (path !== '/') return;
+  event.respondWith(reopen(event));
+});
+/* Network-first: a live pairing gets the current shell (the /pair-app check
+   refreshes lastSeenAt, so every reopen also keeps the session alive); a
+   refused shell passes the original navigation through for the harness's
+   own response; an unreachable server falls back to the cached shell. */
+function reopen(event) {
+  var request = event.request;
+  return fetch(APP_URL, { credentials: 'same-origin', cache: 'no-store' }).then(function (response) {
+    if (!response.ok) return fetch(request);
+    var copy = response.clone();
+    event.waitUntil(self.caches.open(SHELL_CACHE).then(function (cache) {
+      return cache.put(SHELL_KEY, copy);
+    }));
+    return response;
+  }, function () {
+    return self.caches.match(SHELL_KEY).then(function (cached) {
+      return cached !== undefined ? cached : fetch(request);
+    });
+  });
+}
+/* Best-effort shell warm-up and refresh; never rejects. */
+function refreshShell() {
+  return fetch(APP_URL, { credentials: 'same-origin', cache: 'no-store' }).then(function (response) {
+    if (!response.ok) return undefined;
+    var copy = response.clone();
+    return self.caches.open(SHELL_CACHE).then(function (cache) {
+      return cache.put(SHELL_KEY, copy);
+    });
+  }, function () { return undefined; });
+}`;
+}
+/**
+* The dead-end guard for a failed /pair-accept and for a dead reopen (the
+* reopen service worker serves this page at `/` when the pairing no longer
+* passes): a device without a live pairing has no harness browser-auth
+* cookie, so a redirect to bare `/` would land on the harness browser-auth
+* 401 page ("authentication required"), which reads like a broken server.
+* Serve a plain bilingual explanation instead; an already-paired device (live
+* device cookie, browser credential redeemed during its first scan) keeps
+* the old behavior and is sent on to the app.
+*/
+function pairingFailurePage() {
+	return [
+		"<!doctype html><html><head><meta charset=\"utf-8\">",
+		"<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">",
+		"<meta name=\"referrer\" content=\"no-referrer\">",
+		"<title>Pairing link invalid</title></head>",
+		"<body style=\"font-family:system-ui,sans-serif;padding:24px;max-width:32em;margin:0 auto;line-height:1.6\">",
+		"<p><strong>配对已失效，或配对链接已过期。</strong></p>",
+		"<p>请在桌面端打开远程控制面板，刷新二维码后重新扫码；重新配对后本机即可恢复访问。</p>",
+		"<hr style=\"border:none;border-top:1px solid #ccc;margin:16px 0\">",
+		"<p><strong>This pairing has expired or the link is no longer valid.</strong></p>",
+		"<p>Open the remote panel on the desktop, refresh the QR code, and scan again — re-pairing restores access on this device.</p>",
+		"</body></html>"
+	].join("");
+}
 /** Route paths (exact matches under /api). */
 const PAIR_PATHS = {
 	issue: "/api/pair/issue",
@@ -946,7 +871,17 @@ const PAIR_PATHS = {
 	revoke: "/api/pair/revoke",
 	heartbeat: "/api/pair/heartbeat",
 	status: "/api/pair/status",
-	events: "/api/pair/events"
+	events: "/api/pair/events",
+	lanBind: "/api/pair/lan-bind",
+	/** Top-level accept-and-redirect entry the QR link points at. */
+	acceptPage: "/pair-accept",
+	/** The cookieless app landing: serves the official shell for a paired device. */
+	appPage: "/pair-app",
+	/**
+	* The reopen service worker (registered by the capture script). Root-level
+	* path so its default script-directory scope already covers `/`.
+	*/
+	appServiceWorker: "/pair-app.sw.js"
 };
 /**
 * /api/pair request payload contracts. Each POST endpoint validates its body
@@ -956,10 +891,7 @@ const PAIR_PATHS = {
 * issue/accept enforce their optional/required fields. Unknown (extra) keys
 * are tolerated exactly as the previous manual reads ignored them.
 */
-const issuePayloadSchema = z$1.object({
-	workspaceId: z$1.string().min(1).optional(),
-	address: z$1.string().min(1).optional()
-});
+const issuePayloadSchema = z$1.object({ address: z$1.string().min(1).optional() });
 const acceptPayloadSchema = z$1.object({ token: z$1.string().default("") });
 const revokePayloadSchema = z$1.object({ deviceId: z$1.string().min(1) });
 const pairActionPayloadSchema = z$1.object({}).passthrough();
@@ -1034,10 +966,11 @@ function makeRoutes(deps) {
 	const events = new PairingEventsStream(service);
 	/** Loopback-only fence: the desktop panel's control endpoints. */
 	const loopbackFence = (req) => isTrustedApiRequest(req, []);
-	/** Phone-facing fence: loopback, the derived LAN literals, or the configured public host. */
+	/** Phone-facing fence: loopback, the service's live LAN literals, or the configured public host. */
 	const lanFence = (req) => {
 		const publicHost = publicHostOf(service.publicBaseUrl);
-		return isTrustedApiRequest(req, publicHost === void 0 ? lanAddresses : [...lanAddresses, publicHost]);
+		const bases = service.lanAddresses;
+		return isTrustedApiRequest(req, publicHost === void 0 ? bases : [...bases, publicHost]);
 	};
 	const requireMethod = (req, res, method) => {
 		if (req.method === method) return true;
@@ -1049,10 +982,13 @@ function makeRoutes(deps) {
 	const acceptAttempts = /* @__PURE__ */ new Map();
 	const ACCEPT_MAX_ATTEMPTS = 10;
 	const ACCEPT_WINDOW_MS = 3e4;
-	const rateLimitAccept = (req) => {
-		const socketIp = req.socket?.remoteAddress ?? "unknown";
-		const forwarded = typeof req.headers["x-forwarded-for"] === "string" ? (req.headers["x-forwarded-for"].split(",")[0] ?? "").trim() : void 0;
-		const ip = forwarded === void 0 || forwarded === "" ? socketIp : socketIp + "|" + forwarded;
+	/**
+	* @param bucket - the POST /api/pair/accept and the GET /pair-accept flows
+	*   count separately: a QR re-scan (page navigation) must not consume a
+	*   brute-force budget that belongs to token guessing (and vice versa).
+	*/
+	const rateLimitAccept = (req, bucket) => {
+		const ip = acceptLimitKey(req.socket?.remoteAddress ?? "unknown", typeof req.headers["x-forwarded-for"] === "string" ? (req.headers["x-forwarded-for"].split(",")[0] ?? "").trim() : void 0, bucket);
 		const nowMs = Date.now();
 		if (acceptAttempts.size > 256) {
 			for (const [key, attempt] of acceptAttempts) if (nowMs - attempt.windowStart > ACCEPT_WINDOW_MS) acceptAttempts.delete(key);
@@ -1078,7 +1014,7 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody(req, {
-			maxBytes: MAX_BODY_BYTES$1,
+			maxBytes: MAX_BODY_BYTES,
 			objectOnly: true
 		});
 		const payload = parsePairPayload(issuePayloadSchema, body);
@@ -1089,14 +1025,14 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		const { workspaceId, address } = payload;
+		const { address } = payload;
 		try {
-			const { token, expiresAt } = service.issue(workspaceId, address);
+			const { token, expiresAt } = service.issue(void 0, address);
 			const base = address === void 0 ? service.publicBaseUrl ?? service.lanBaseUrl : service.lanBaseUrlFor(address);
 			if (base === void 0) throw new Error("remote-web-ui: base unavailable");
 			writeJson(res, 200, {
 				ok: true,
-				url: `${base}/m/?pair=${token}${workspaceId === void 0 ? "" : `&workspace=${encodeURIComponent(workspaceId)}`}`,
+				url: `${base}/pair-accept?pair=${token}`,
 				token,
 				expiresAt,
 				lanAddresses: service.lanAddresses,
@@ -1119,7 +1055,7 @@ function makeRoutes(deps) {
 			});
 			return;
 		}
-		if (rateLimitAccept(req)) {
+		if (rateLimitAccept(req, "api")) {
 			writeJson(res, 429, {
 				ok: false,
 				code: "rate-limited"
@@ -1127,7 +1063,7 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody(req, {
-			maxBytes: MAX_BODY_BYTES$1,
+			maxBytes: MAX_BODY_BYTES,
 			objectOnly: true
 		});
 		const payload = parsePairPayload(acceptPayloadSchema, body);
@@ -1162,7 +1098,7 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody(req, {
-			maxBytes: MAX_BODY_BYTES$1,
+			maxBytes: MAX_BODY_BYTES,
 			objectOnly: true
 		});
 		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
@@ -1185,7 +1121,7 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody(req, {
-			maxBytes: MAX_BODY_BYTES$1,
+			maxBytes: MAX_BODY_BYTES,
 			objectOnly: true
 		});
 		const payload = parsePairPayload(revokePayloadSchema, body);
@@ -1215,7 +1151,7 @@ function makeRoutes(deps) {
 			return;
 		}
 		const body = await readJsonBody(req, {
-			maxBytes: MAX_BODY_BYTES$1,
+			maxBytes: MAX_BODY_BYTES,
 			objectOnly: true
 		});
 		if (parsePairPayload(pairActionPayloadSchema, body) === void 0) {
@@ -1272,1138 +1208,208 @@ function makeRoutes(deps) {
 		events.open(req, res);
 		events.push(service.snapshot());
 	};
-	return [
-		{
-			kind: "exact",
-			path: PAIR_PATHS.issue,
-			handler: handleIssue
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.accept,
-			handler: handleAccept
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.stop,
-			handler: handleStop
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.revoke,
-			handler: handleRevoke
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.heartbeat,
-			handler: handleHeartbeat
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.status,
-			handler: handleStatus
-		},
-		{
-			kind: "exact",
-			path: PAIR_PATHS.events,
-			handler: handleEvents
-		}
-	];
-}
-//#endregion
-//#region src/mobile-routes.ts
-/**
-* The mobile surface's page routes: /m canonicalizes to /m/, which serves the
-* standalone phone UI. The page and worker live in the /m/ scope so the PWA
-* can cache only its static shell; the paired-device data channel remains at
-* /m/api and is never handled by the worker.
-*/
-const MOBILE_ROOT = "/m/";
-const MOBILE_BUNDLE_URL = "/m/mobile.js";
-const MOBILE_MANIFEST_URL = "/m/manifest.webmanifest";
-const MOBILE_WORKER_URL = "/m/service-worker.js";
-const MOBILE_OFFLINE_URL = "/m/offline.html";
-/** The standalone mobile bundle (built artifact, next to this file's own lib output). */
-function mobileBundlePath() {
-	return fileURLToPath(new URL("../lib/mobile.js", import.meta.url));
-}
-/** A package asset available to the host after a registry or git install. */
-function mobileAssetPath(name) {
-	return fileURLToPath(new URL("../assets/" + name, import.meta.url));
-}
-/** The mobile page shell: self-contained, with no document-level user data. */
-function pageHtml(bundleUrl) {
-	return [
-		"<!doctype html>",
-		"<html lang=\"zh-CN\">",
-		"<head>",
-		"<meta charset=\"utf-8\">",
-		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no, viewport-fit=cover\">",
-		"<meta name=\"theme-color\" content=\"#f3f5f9\">",
-		"<meta name=\"referrer\" content=\"no-referrer\">",
-		"<meta name=\"mobile-web-app-capable\" content=\"yes\">",
-		"<meta name=\"apple-mobile-web-app-capable\" content=\"yes\">",
-		"<meta name=\"apple-mobile-web-app-title\" content=\"DSH Remote\">",
-		"<link rel=\"manifest\" href=\"/m/manifest.webmanifest\">",
-		"<link rel=\"apple-touch-icon\" href=\"/m/apple-touch-icon.png\">",
-		"<title>远程访问</title>",
-		"</head>",
-		"<body>",
-		"<div id=\"root\"></div>",
-		"<script type=\"module\" src=\"" + bundleUrl + "\"><\/script>",
-		"</body>",
-		"</html>"
-	].join("");
-}
-/** The installable app identity and icon declarations for the /m scope. */
-function manifestJson() {
-	return JSON.stringify({
-		id: MOBILE_ROOT,
-		name: "DSH Remote",
-		short_name: "DSH Remote",
-		start_url: MOBILE_ROOT,
-		scope: MOBILE_ROOT,
-		display: "standalone",
-		background_color: "#151424",
-		theme_color: "#f3f5f9",
-		icons: [{
-			src: "/m/icon-192.png",
-			sizes: "192x192",
-			type: "image/png",
-			purpose: "any"
-		}, {
-			src: "/m/icon-512.png",
-			sizes: "512x512",
-			type: "image/png",
-			purpose: "any maskable"
-		}]
-	}, null, 2);
-}
-/** A static fallback that contains no paired-device, session, or workspace data. */
-function offlineHtml() {
-	return [
-		"<!doctype html>",
-		"<html lang=\"zh-CN\">",
-		"<head>",
-		"<meta charset=\"utf-8\">",
-		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, viewport-fit=cover\">",
-		"<meta name=\"theme-color\" content=\"#151424\">",
-		"<title>DSH Remote</title>",
-		"<style>body{margin:0;background:#151424;color:#f3f5f9;font:16px system-ui,sans-serif}main{box-sizing:border-box;display:grid;min-height:100vh;place-content:center;padding:32px;text-align:center}h1{margin:0 0 12px;font-size:24px}p{margin:0;color:#c4c7d8;line-height:1.5}</style>",
-		"</head>",
-		"<body><main><h1>DSH Remote</h1><p>Cannot reach the running DSH host. Restore the connection and reopen the app.</p></main></body>",
-		"</html>"
-	].join("");
-}
-/** Send a small static UTF-8 body with revalidation headers. */
-function writeStatic(res, status, type, body) {
-	res.writeHead(status, {
-		"content-type": type + "; charset=utf-8",
-		"cache-control": "no-cache",
-		"referrer-policy": "no-referrer"
-	});
-	res.end(body);
-}
-/** Send the worker with the same scope it registers for, without HTTP caching. */
-function writeServiceWorker(res, body) {
-	res.writeHead(200, {
-		"content-type": "text/javascript; charset=utf-8",
-		"cache-control": "no-cache",
-		"referrer-policy": "no-referrer",
-		"service-worker-allowed": MOBILE_ROOT
-	});
-	res.end(body);
-}
-/** Send a PNG body without decoding it to UTF-8. */
-function writePng(res, status, body) {
-	res.writeHead(status, {
-		"content-type": "image/png",
-		"cache-control": "public, max-age=31536000, immutable",
-		"referrer-policy": "no-referrer"
-	});
-	res.end(body);
-}
-/** Canonicalize the old /m route while retaining pair and workspace query parameters. */
-function redirectToMobileRoot(req, res) {
-	const url = new URL(req.url ?? "/m", "http://x");
-	res.writeHead(308, {
-		location: MOBILE_ROOT + url.search,
-		"cache-control": "no-store",
-		"referrer-policy": "no-referrer"
-	});
-	res.end();
-}
-/**
-* Build the mobile page routes.
-* @returns Exact routes for the canonical page, static shell, and PWA assets.
-*/
-function makeMobileRoutes() {
-	const handlePage = (_req, res) => {
-		writeStatic(res, 200, "text/html", pageHtml(MOBILE_BUNDLE_URL));
-	};
-	const handleManifest = (_req, res) => {
-		writeStatic(res, 200, "application/manifest+json", manifestJson());
-	};
-	const handleOffline = (_req, res) => {
-		writeStatic(res, 200, "text/html", offlineHtml());
-	};
-	let bundleBody;
-	let bundleGzip;
-	const handleBundle = async (req, res) => {
-		if (bundleBody === void 0) {
-			const path = mobileBundlePath();
-			if (!existsSync(path)) {
-				writeStatic(res, 503, "text/plain", "mobile bundle not built: run pnpm --filter @linxin666/dsh-remote-web-ui build");
-				return;
-			}
-			try {
-				bundleBody = await readFile(path, "utf8");
-				bundleGzip = gzipSync(Buffer.from(bundleBody, "utf8"));
-			} catch {
-				writeStatic(res, 500, "text/plain", "failed to read the mobile bundle");
-				return;
-			}
-		}
-		const acceptEncoding = req.headers["accept-encoding"] ?? "";
-		if (typeof acceptEncoding === "string" && acceptEncoding.includes("gzip") && bundleGzip !== void 0) {
-			res.writeHead(200, {
-				"content-type": "text/javascript; charset=utf-8",
-				"content-encoding": "gzip",
-				"cache-control": "no-cache",
-				vary: "Accept-Encoding",
-				"referrer-policy": "no-referrer"
-			});
-			res.end(bundleGzip);
-		} else {
-			res.writeHead(200, {
-				"content-type": "text/javascript; charset=utf-8",
-				"cache-control": "no-cache",
-				vary: "Accept-Encoding",
-				"referrer-policy": "no-referrer"
-			});
-			res.end(bundleBody);
-		}
-	};
-	let workerBody;
-	const handleWorker = async (_req, res) => {
-		if (workerBody === void 0) {
-			const path = mobileAssetPath("mobile-service-worker.js");
-			if (!existsSync(path)) {
-				writeStatic(res, 503, "text/plain", "mobile service worker not found");
-				return;
-			}
-			try {
-				workerBody = await readFile(path, "utf8");
-			} catch {
-				writeStatic(res, 500, "text/plain", "failed to read the mobile service worker");
-				return;
-			}
-		}
-		writeServiceWorker(res, workerBody);
-	};
-	const makeIconHandler = (asset) => async (_req, res) => {
-		const path = mobileAssetPath(asset);
-		if (!existsSync(path)) {
-			writeStatic(res, 404, "text/plain", asset + " not found");
-			return;
-		}
-		try {
-			writePng(res, 200, await readFile(path));
-		} catch {
-			writeStatic(res, 500, "text/plain", "failed to read " + asset);
-		}
-	};
-	return [
-		{
-			kind: "exact",
-			path: "/m",
-			handler: redirectToMobileRoot
-		},
-		{
-			kind: "exact",
-			path: MOBILE_ROOT,
-			handler: handlePage
-		},
-		{
-			kind: "exact",
-			path: MOBILE_BUNDLE_URL,
-			handler: handleBundle
-		},
-		{
-			kind: "exact",
-			path: MOBILE_MANIFEST_URL,
-			handler: handleManifest
-		},
-		{
-			kind: "exact",
-			path: MOBILE_WORKER_URL,
-			handler: handleWorker
-		},
-		{
-			kind: "exact",
-			path: MOBILE_OFFLINE_URL,
-			handler: handleOffline
-		},
-		{
-			kind: "exact",
-			path: "/m/apple-touch-icon.png",
-			handler: makeIconHandler("apple-touch-icon.png")
-		},
-		{
-			kind: "exact",
-			path: "/m/icon-192.png",
-			handler: makeIconHandler("mobile-icon-192.png")
-		},
-		{
-			kind: "exact",
-			path: "/m/icon-512.png",
-			handler: makeIconHandler("mobile-icon-512.png")
-		}
-	];
-}
-//#endregion
-//#region src/mobile-api.ts
-/**
-* Methods the phone surface may call. Everything else is refused HERE — but
-* note the paired-device cookie also passes the global api/gate for the full
-* ApiProxy surface (gate.ts), so a paired phone is a full-control credential:
-* the allowlist only constrains this /m/api proxy, not the cookie's reach.
-* stop() revokes every device; the loopback panel can also revoke one
-* device at a time.
-*/
-const MOBILE_ALLOWLIST = /* @__PURE__ */ new Set([
-	"host.listDirectory",
-	"workspace.create",
-	"workspace.list",
-	"agentPreset.list",
-	"session.create",
-	"session.list",
-	"session.history",
-	"session.search",
-	"session.prompt",
-	"session.models",
-	"session.selectModel",
-	"session.rename",
-	"session.cancel"
-]);
-/**
-* Locally answered display-preference method (the phone's read-only
-* surface preferences; never proxied to the host ApiProxy and never a
-* settings-domain write).
-*/
-const MOBILE_PREFERENCES_METHOD = "mobile.preferences";
-const MOBILE_PENDING_METHOD = "mobile.pending";
-const MOBILE_RESPOND_METHOD = "mobile.respond";
-/** Execute a slash command through the host command registry (#1125). */
-const MOBILE_COMMAND_METHOD = "mobile.command";
-/** One session.list page (thin phones load incrementally). */
-const SESSION_PAGE_SIZE = 20;
-/** SSE keep-alive ping cadence for the live mux stream (single connection). */
-const DEFAULT_EVENTS_HEARTBEAT_MS = 15e3;
-/** Encode one list position as an opaque continuation cursor. */
-function sessionListCursor(updatedAt, sessionId) {
-	return `${updatedAt}:${sessionId}`;
-}
-/** Parse a cursor; malformed cursors mean "start over" (safe failure mode). */
-function parseSessionListCursor(cursor) {
-	const separator = cursor.indexOf(":");
-	if (separator < 0) return void 0;
-	const updatedAt = Number(cursor.slice(0, separator));
-	if (!Number.isFinite(updatedAt)) return void 0;
-	return {
-		updatedAt,
-		sessionId: cursor.slice(separator + 1)
-	};
-}
-/** Whether a row comes strictly after the cursor position. */
-function afterCursor(row, position) {
-	return row.updatedAt < position.updatedAt || row.updatedAt === position.updatedAt && row.sessionId > position.sessionId;
-}
-/** Mobile API route paths. */
-const MOBILE_API_PATHS = { events: "/m/api/events.mux" };
-/** The mobile-api prefix (every other path under it is a method name). */
-const MOBILE_API_PREFIX = "/m/api";
-/** Method extraction: the prefix plus one slash. */
-const MOBILE_API_METHOD_PREFIX = `${MOBILE_API_PREFIX}/`;
-/**
-* Build the mobile data-channel routes.
-* @param deps - pairing service + apiProxy.
-* @returns the routes to register on webServer.
-*/
-function makeMobileApiRoutes(deps) {
-	const { service, apiProxy, mobileEnterToSend } = deps;
-	const eventsHeartbeatMs = deps.eventsHeartbeatMs ?? DEFAULT_EVENTS_HEARTBEAT_MS;
-	/**
-	* Refresh the paired device's presence and report whether it is live.
-	* The mobile surface (unlike the desktop Web UI) has no `/api/pair/heartbeat`
-	* sender, so any activity on the mobile channel — a gated RPC, or the live
-	* SSE stream staying open — must count as presence. Without this, an
-	* idle-but-connected phone ages past `offlineAfterMs` and the desktop panel
-	* wrongly reports it as disconnected.
-	*/
-	const touchDeviceFor = (req) => {
-		const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-		if (deviceId === void 0) return false;
-		return service.touchDevice(deviceId);
-	};
-	/** The phone gate: a live paired-device cookie, or nothing else proceeds. */
-	const gateOk = (req) => {
-		return touchDeviceFor(req);
-	};
-	const handleMethod = async (req, res) => {
-		if (req.method !== "POST") {
-			res.writeHead(405);
-			res.end();
-			return;
-		}
-		if (!gateOk(req)) {
-			writeJson(res, 403, {
-				ok: false,
-				error: {
-					code: "unpaired",
-					message: "mobile session is not paired"
-				}
-			});
-			return;
-		}
-		const pathname = new URL(req.url ?? "/", "http://x").pathname;
-		if (!pathname.startsWith(MOBILE_API_METHOD_PREFIX)) {
-			writeJson(res, 404, {
-				ok: false,
-				error: {
-					code: "not-found",
-					message: "unknown mobile api path"
-				}
-			});
-			return;
-		}
-		const method = pathname.slice(MOBILE_API_METHOD_PREFIX.length);
-		const local = method === MOBILE_PREFERENCES_METHOD || method === MOBILE_PENDING_METHOD || method === MOBILE_RESPOND_METHOD || method === MOBILE_COMMAND_METHOD;
-		if (!MOBILE_ALLOWLIST.has(method) && !local) {
-			writeJson(res, 403, {
-				ok: false,
-				error: {
-					code: "forbidden",
-					message: `method ${method} is not exposed to the mobile surface`
-				}
-			});
-			return;
-		}
-		let envelope;
-		try {
-			envelope = await readBoundedJson(req, 64 * 1024);
-		} catch {
-			writeJson(res, 400, {
-				ok: false,
-				error: {
-					code: "bad-request",
-					message: "invalid json body"
-				}
-			});
-			return;
-		}
-		const parsed = envelope;
-		const rpcId = typeof parsed?.rpcId === "string" ? parsed.rpcId : "";
-		if (rpcId === "") {
-			writeJson(res, 400, {
-				ok: false,
-				error: {
-					code: "bad-request",
-					message: "missing rpcId"
-				}
-			});
-			return;
-		}
-		if (local) {
-			if (method === MOBILE_PREFERENCES_METHOD) writeJson(res, 200, {
-				type: "server-response",
-				rpcId,
-				result: {
-					ok: true,
-					value: { mobileEnterToSend: mobileEnterToSend() }
-				}
-			});
-			else if (method === MOBILE_PENDING_METHOD) {
-				const payload = parsed.payload;
-				writeJson(res, 200, {
-					type: "server-response",
-					rpcId,
-					result: {
-						ok: true,
-						value: deps.pendingTracker.pending(payload?.sessionId)
-					}
-				});
-			} else if (method === MOBILE_RESPOND_METHOD) {
-				const payload = parsed.payload;
-				try {
-					writeJson(res, 200, {
-						type: "server-response",
-						rpcId,
-						result: {
-							ok: true,
-							value: await apiProxy.respond({
-								type: "client-response",
-								rpcId: RpcId(payload.rpcId),
-								result: {
-									ok: true,
-									value: payload.response
-								}
-							})
-						}
-					});
-				} catch (error) {
-					writeJson(res, 200, {
-						type: "server-response",
-						rpcId,
-						result: {
-							ok: false,
-							error: {
-								code: "internal",
-								message: error instanceof Error ? error.message : String(error)
-							}
-						}
-					});
-				}
-			} else if (method === MOBILE_COMMAND_METHOD) {
-				const payload = parsed.payload;
-				const sessionId = payload?.sessionId;
-				const line = payload?.line;
-				if (typeof sessionId !== "string" || typeof line !== "string") writeJson(res, 200, {
-					type: "server-response",
-					rpcId,
-					result: {
-						ok: false,
-						error: {
-							code: "bad-request",
-							message: "missing sessionId or line"
-						}
-					}
-				});
-				else if (deps.commandDispatcher === void 0) writeJson(res, 200, {
-					type: "server-response",
-					rpcId,
-					result: {
-						ok: false,
-						error: {
-							code: "unavailable",
-							message: "command dispatcher is not available"
-						}
-					}
-				});
-				else try {
-					const abort = new AbortController();
-					res.on("close", () => {
-						if (!res.writableEnded) abort.abort();
-					});
-					const outcome = await deps.commandDispatcher.execute(sessionId, line, abort.signal);
-					if ("error" in outcome) writeJson(res, 200, {
-						type: "server-response",
-						rpcId,
-						result: {
-							ok: false,
-							error: {
-								code: outcome.error,
-								message: outcome.error
-							}
-						}
-					});
-					else writeJson(res, 200, {
-						type: "server-response",
-						rpcId,
-						result: {
-							ok: true,
-							value: {
-								matched: true,
-								result: outcome.result
-							}
-						}
-					});
-				} catch (error) {
-					writeJson(res, 200, {
-						type: "server-response",
-						rpcId,
-						result: {
-							ok: false,
-							error: {
-								code: "internal",
-								message: error instanceof Error ? error.message : String(error)
-							}
-						}
-					});
-				}
-			}
-			return;
-		}
-		try {
-			const abort = new AbortController();
-			res.on("close", () => {
-				if (!res.writableEnded) abort.abort();
-			});
-			writeJson(res, 200, await dispatch(apiProxy, method, parsed?.payload, rpcId, abort.signal));
-		} catch (error) {
-			writeJson(res, 200, {
-				type: "server-response",
-				rpcId,
-				result: {
-					ok: false,
-					error: {
-						code: "internal",
-						message: error instanceof Error ? error.message : String(error)
-					}
-				}
-			});
-		}
-	};
-	/** Bridge the host mux stream over SSE: one `data:` frame per mux frame. */
-	const handleEvents = async (req, res) => {
-		if (req.method !== "GET") {
-			res.writeHead(405);
-			res.end();
-			return;
-		}
-		if (!gateOk(req)) {
+	/** LAN-bind facts for the settings card; loopback-only, read per request. */
+	const handleLanBind = (req, res) => {
+		if (!requireMethod(req, res, "GET")) return;
+		if (!loopbackFence(req)) {
 			writeJson(res, 403, {
 				ok: false,
-				error: {
-					code: "unpaired",
-					message: "mobile session is not paired"
-				}
+				code: "forbidden"
 			});
 			return;
 		}
-		res.writeHead(200, {
-			"content-type": "text/event-stream; charset=utf-8",
-			"cache-control": "no-cache",
-			connection: "keep-alive"
-		});
-		const controller = new AbortController();
-		let closed = false;
-		const heartbeat = setInterval(() => {
-			if (closed) return;
-			touchDeviceFor(req);
-			try {
-				res.write(": ping\n\n");
-			} catch {}
-		}, eventsHeartbeatMs);
-		const onClose = () => {
-			if (closed) return;
-			closed = true;
-			controller.abort();
-			clearInterval(heartbeat);
-		};
-		res.on("close", onClose);
-		req.on("close", onClose);
-		try {
-			const frames = apiProxy.events.mux({
-				rpcId: RpcId(`mobile-mux-${Date.now().toString(36)}`),
-				payload: {}
-			}, controller.signal);
-			for await (const frame of frames) {
-				if (closed) break;
-				deps.pendingTracker.onFrame(frame);
-				res.write(`data: ${JSON.stringify(frame)}\n\n`);
-			}
-		} catch {} finally {
-			controller.abort();
-			clearInterval(heartbeat);
-		}
-		if (!closed) res.end();
-	};
-	return [{
-		kind: "prefix",
-		path: MOBILE_API_PREFIX,
-		handler: handleMethod
-	}, {
-		kind: "exact",
-		path: MOBILE_API_PATHS.events,
-		handler: handleEvents
-	}];
-}
-/** Dispatch one allowlisted method through the host ApiProxy. */
-async function dispatch(apiProxy, method, payload, rpcId, signal) {
-	const request = {
-		rpcId: RpcId(rpcId),
-		payload
-	};
-	if (method === "session.list") {
-		const full = await apiProxy.sessions.list(request);
-		if (!full.result.ok) return {
-			type: "server-response",
-			rpcId,
-			result: full.result
-		};
-		const items = full.result.value.items;
-		const cursor = payload?.cursor;
-		items.sort((a, b) => b.updatedAt - a.updatedAt || (a.sessionId < b.sessionId ? -1 : a.sessionId > b.sessionId ? 1 : 0));
-		const position = cursor === void 0 ? void 0 : parseSessionListCursor(cursor);
-		const from = position === void 0 ? 0 : items.findIndex((row) => afterCursor(row, position));
-		const start = from < 0 ? items.length : from;
-		const page = items.slice(start, start + SESSION_PAGE_SIZE);
-		const last = page[page.length - 1];
-		const nextCursor = last !== void 0 && start + page.length < items.length ? sessionListCursor(last.updatedAt, last.sessionId) : void 0;
-		return {
-			type: "server-response",
-			rpcId,
-			result: {
-				ok: true,
-				value: {
-					items: page,
-					hasMore: nextCursor !== void 0,
-					...nextCursor !== void 0 ? { nextCursor } : {}
-				}
-			}
-		};
-	}
-	const wrap = (response) => ({
-		type: "server-response",
-		rpcId,
-		result: response.result
-	});
-	if (method === "workspace.list") return wrap(await apiProxy.workspace.list(request));
-	if (method === "workspace.create") return wrap(await apiProxy.workspace.create(request));
-	if (method === "host.listDirectory") return wrap(await apiProxy.host.listDirectory(request, signal ?? new AbortController().signal));
-	if (method === "agentPreset.list") return wrap(await apiProxy.agentPresets.list(request));
-	if (method === "session.create") return wrap(await apiProxy.sessions.create(request));
-	if (method === "session.history") return wrap(await apiProxy.sessions.history(request));
-	if (method === "session.search") return wrap(await apiProxy.sessions.search(request, signal ?? new AbortController().signal));
-	if (method === "session.prompt") return wrap(await apiProxy.sessions.prompt(request));
-	if (method === "session.models") return wrap(await apiProxy.sessions.models(request));
-	if (method === "session.selectModel") return wrap(await apiProxy.sessions.selectModel(request));
-	if (method === "session.rename") return wrap(await apiProxy.sessions.rename(request));
-	if (method === "session.cancel") return wrap(await apiProxy.sessions.cancel(request));
-	throw new Error(`unhandled allowlisted method ${method}`);
-}
-//#endregion
-//#region src/mobile-pending.ts
-var PendingTracker = class {
-	sessions = /* @__PURE__ */ new Map();
-	/** Process one mux frame and update the pending state. */
-	onFrame(frame) {
-		const payload = frame.payload;
-		if (payload.type === "approval/requested") this._getOrInit(payload.sessionId).approvals.set(payload.approvalId, {
-			rpcId: frame.rpcId,
-			approvalId: payload.approvalId,
-			toolName: payload.toolName,
-			callId: payload.callId,
-			reason: payload.reason
-		});
-		else if (payload.type === "approval/resolved") {
-			const state = this.sessions.get(payload.sessionId);
-			if (state) state.approvals.delete(payload.approvalId);
-		} else if (payload.type === "question/requested") this._getOrInit(payload.sessionId).questions.push({
-			rpcId: frame.rpcId,
-			questions: payload.questions
-		});
-		else if (payload.type === "question/resolved") {
-			const state = this.sessions.get(payload.sessionId);
-			if (state) state.questions = state.questions.filter((q) => q.rpcId !== payload.questionRpcId);
-		}
-	}
-	_getOrInit(sessionId) {
-		let state = this.sessions.get(sessionId);
-		if (!state) {
-			state = {
-				approvals: /* @__PURE__ */ new Map(),
-				questions: []
-			};
-			this.sessions.set(sessionId, state);
-		}
-		return state;
-	}
-	/** Query pending items for a session. */
-	pending(sessionId) {
-		const state = this.sessions.get(sessionId);
-		if (!state) return {
-			approvals: [],
-			questions: []
-		};
-		return {
-			approvals: Array.from(state.approvals.values()),
-			questions: state.questions
-		};
-	}
-	/** Clear all pending state for a session. */
-	clear(sessionId) {
-		this.sessions.delete(sessionId);
-	}
-};
-//#endregion
-//#region src/paired-model-catalog.ts
-const MAX_BODY_BYTES = 16 * 1024;
-const MAX_IDENTIFIER_LENGTH = 160;
-const MAX_DISPLAY_NAME_LENGTH = 240;
-const MAX_TOKEN_LIMIT = 1e7;
-const REASONING_EFFORTS = [
-	"off",
-	"minimal",
-	"low",
-	"medium",
-	"high",
-	"xhigh",
-	"max"
-];
-const stringField = (max) => z$1.string().trim().min(1).max(max).refine((value) => !/[\r\n\0]/.test(value), "must not contain a newline or NUL");
-const providerSchema = z$1.object({ provider: stringField(MAX_IDENTIFIER_LENGTH) }).strict();
-const modelSchema = z$1.object({
-	id: stringField(MAX_IDENTIFIER_LENGTH),
-	name: stringField(MAX_DISPLAY_NAME_LENGTH).optional(),
-	contextWindow: z$1.number().int().safe().positive().max(MAX_TOKEN_LIMIT).optional(),
-	maxTokens: z$1.number().int().safe().positive().max(MAX_TOKEN_LIMIT).optional(),
-	reasoningEfforts: z$1.array(z$1.enum(REASONING_EFFORTS)).min(1).refine((efforts) => efforts.every((effort, index) => index === 0 || REASONING_EFFORTS.indexOf(efforts[index - 1]) < REASONING_EFFORTS.indexOf(effort)), "reasoning efforts must be unique and in canonical order").optional()
-}).strict();
-const upsertSchema = z$1.object({
-	provider: stringField(MAX_IDENTIFIER_LENGTH),
-	model: modelSchema
-}).strict();
-const PAIRED_MODEL_CATALOG_PATHS = {
-	catalog: "/api/pair/model-catalog",
-	discover: "/api/pair/model-catalog/discover",
-	upsert: "/api/pair/model-catalog/upsert"
-};
-let rpcSequence = 0;
-function request$1(payload) {
-	rpcSequence += 1;
-	return {
-		rpcId: `paired-model-catalog-${Date.now().toString(36)}-${rpcSequence.toString(36)}`,
-		payload
-	};
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function valueOf(response) {
-	return response.result.ok ? response.result.value : void 0;
-}
-function errorCode(response) {
-	return response.result.ok ? void 0 : response.result.error.code;
-}
-function reject(res, status, error) {
-	writeJson(res, status, { error });
-}
-function publicProviderId(value) {
-	const normalized = value.replace(/[\r\n\0]/g, " ").trim().slice(0, MAX_IDENTIFIER_LENGTH);
-	return normalized === "" ? "unknown" : normalized;
-}
-function publicCatalog(value) {
-	return {
-		groups: value.groups.map((group) => ({
-			id: group.id,
-			name: group.name,
-			models: group.models.map((model) => ({
-				id: model.id,
-				name: model.name,
-				...model.description === void 0 ? {} : { description: model.description },
-				...model.reasoning === void 0 ? {} : { reasoning: model.reasoning }
-			}))
-		})),
-		failures: value.failures.map((failure) => ({
-			id: failure.id,
-			name: failure.name,
-			message: `model catalog unavailable for provider ${publicProviderId(failure.id)}`
-		}))
-	};
-}
-function publicCandidates(models) {
-	return models.map((model) => ({
-		id: model.id,
-		...model.name === void 0 ? {} : { name: model.name },
-		...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
-		...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens }
-	}));
-}
-function fieldsOf(model, includeId) {
-	const fields = {
-		...includeId ? { id: model.id } : {},
-		...model.name === void 0 ? {} : { name: model.name },
-		...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
-		...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens }
-	};
-	if (model.reasoningEfforts !== void 0) fields.reasoningEfforts = Object.fromEntries(model.reasoningEfforts.map((effort) => [effort, effort === "off" ? null : effort]));
-	return fields;
-}
-function groupFor(catalog, provider) {
-	if (catalog.failures.some((failure) => failure.id === provider)) return void 0;
-	return catalog.groups.find((group) => group.id === provider);
-}
-async function readCatalog(apiProxy) {
-	try {
-		return valueOf(await apiProxy.llm.models(request$1({})));
-	} catch {
-		return;
-	}
-}
-/** Resolve one exact active llm-pi-ai provider address, never an input-supplied path. */
-async function eligibleProvider(apiProxy, requested) {
-	let providersResponse;
-	let settingsResponse;
-	try {
-		providersResponse = await apiProxy.llm.providers(request$1({}));
-		settingsResponse = await apiProxy.settings.describe(request$1({}));
-	} catch {
-		return {
-			status: 502,
-			error: "model catalog capability is unavailable"
-		};
-	}
-	const providers = valueOf(providersResponse);
-	const settings = valueOf(settingsResponse);
-	if (providers === void 0 || settings === void 0) return {
-		status: 502,
-		error: "model catalog capability is unavailable"
-	};
-	const route = providers.providers.find((candidate) => candidate.provider === requested);
-	if (route === void 0) return {
-		status: 404,
-		error: `unknown provider ${requested}`
-	};
-	if (!settings.writable || !route.active || route.settingsNs !== "llm-pi-ai" || route.settingsPath.length !== 2 || route.settingsPath[0] !== "providers" || route.settingsPath[1] !== requested) return {
-		status: 403,
-		error: `provider ${requested} is not eligible for the paired model catalog`
-	};
-	const namespace = settings.namespaces.find((candidate) => candidate.ns === "llm-pi-ai");
-	const root = namespace !== void 0 && isRecord(namespace.value) ? namespace.value : void 0;
-	const providersValue = root !== void 0 && isRecord(root.providers) ? root.providers : void 0;
-	const profile = providersValue !== void 0 && isRecord(providersValue[requested]) ? providersValue[requested] : void 0;
-	if (namespace === void 0 || profile === void 0) return {
-		status: 403,
-		error: `provider ${requested} is not eligible for the paired model catalog`
-	};
-	return { provider: {
-		provider: requested,
-		displayName: route.displayName,
-		namespace,
-		profile
-	} };
-}
-function validIdentifier(value) {
-	const parsed = stringField(MAX_IDENTIFIER_LENGTH).safeParse(value);
-	return parsed.success && parsed.data === value;
-}
-function configuredModels(profile) {
-	if (!Object.hasOwn(profile, "models")) return { inherited: true };
-	if (!Array.isArray(profile.models)) return void 0;
-	if (profile.models.length === 0) return { inherited: true };
-	const values = [];
-	for (const entry of profile.models) {
-		if (!isRecord(entry) || !validIdentifier(entry.id)) return void 0;
-		values.push({ ...entry });
-	}
-	return {
-		inherited: false,
-		values
-	};
-}
-function configuredOverrides(profile) {
-	if (!Object.hasOwn(profile, "modelOverrides")) return {
-		present: false,
-		values: /* @__PURE__ */ new Map()
-	};
-	if (!isRecord(profile.modelOverrides)) return void 0;
-	const values = /* @__PURE__ */ new Map();
-	for (const [id, value] of Object.entries(profile.modelOverrides)) {
-		if (!validIdentifier(id) || !isRecord(value)) return void 0;
-		values.set(id, { ...value });
-	}
-	return {
-		present: true,
-		values
-	};
-}
-function updatedModels(existing, model) {
-	const next = existing.map((entry) => ({ ...entry }));
-	const index = next.findIndex((entry) => entry.id === model.id);
-	const patch = fieldsOf(model, true);
-	if (index >= 0) next[index] = {
-		...next[index],
-		...patch
-	};
-	else next.push(patch);
-	return next;
-}
-function mutationPlan(profile, provider, model, catalog) {
-	const configured = configuredModels(profile);
-	const overrides = configuredOverrides(profile);
-	if (configured === void 0 || overrides === void 0) return void 0;
-	const modelsPath = [
-		"providers",
-		provider,
-		"models"
-	];
-	const overridesPath = [
-		"providers",
-		provider,
-		"modelOverrides"
-	];
-	if (!configured.inherited) {
-		if (overrides.values.size > 0) return void 0;
-		const ops = [{
-			op: "set",
-			path: modelsPath,
-			value: updatedModels(configured.values, model)
-		}];
-		if (overrides.present) ops.push({
-			op: "unset",
-			path: overridesPath
-		});
-		return { ops };
-	}
-	const group = groupFor(catalog, provider);
-	if (group?.models.some((entry) => entry.id === model.id) === true) {
-		const existing = overrides.values.get(model.id) ?? {};
-		return { ops: [{
-			op: "set",
-			path: [...overridesPath, model.id],
-			value: {
-				...existing,
-				...fieldsOf(model, false)
-			}
-		}] };
-	}
-	if (group === void 0) return void 0;
-	const materialized = [];
-	const materializedIds = /* @__PURE__ */ new Set();
-	for (const installed of group.models) {
-		materialized.push({
-			...overrides.values.get(installed.id),
-			id: installed.id
+		writeJson(res, 200, {
+			ok: true,
+			...deps.lanBindStatus?.() ?? {}
 		});
-		materializedIds.add(installed.id);
-	}
-	for (const [id, override] of overrides.values) if (!materializedIds.has(id)) materialized.push({
-		...override,
-		id
-	});
-	const ops = [{
-		op: "set",
-		path: modelsPath,
-		value: updatedModels(materialized, model)
-	}];
-	if (overrides.present) ops.push({
-		op: "unset",
-		path: overridesPath
-	});
-	return { ops };
-}
-function paired(req, service) {
-	const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-	return deviceId !== void 0 && service.touchDevice(deviceId);
-}
-async function bodyOf(req, schema) {
-	try {
-		return schema.parse(await readBoundedJson(req, MAX_BODY_BYTES));
-	} catch {
-		return;
-	}
-}
-/** Build the narrow paired-device model catalog routes. */
-function makePairedModelCatalogRoutes(deps) {
-	const { service, apiProxy, lanAddresses } = deps;
-	/** Same fence as the /api/pair family: loopback, the advertised LAN literals, or the configured public host. */
-	const fence = (req) => {
-		const publicHost = publicHostOf(service.publicBaseUrl);
-		return isTrustedApiRequest(req, publicHost === void 0 ? lanAddresses : [...lanAddresses, publicHost]);
 	};
-	const gate = (req, res) => {
-		if (!fence(req)) {
-			req.resume();
-			reject(res, 403, "paired model catalog is not reachable for this origin");
-			return false;
+	/**
+	* The QR entry: navigate here with ?pair=<token>. Sets the device cookie,
+	* then redirects to the authenticated home (the connection service's
+	* launch-token URL), so a LAN device that has never seen this authority
+	* clears the browser-auth gate and boots the paired official UI in one
+	* chain: /pair-accept → /?token=<launch> → /. A device that is already
+	* authenticated (or loopback) skips straight through the same way.
+	*/
+	const handleAcceptPage = async (req, res) => {
+		if (!requireMethod(req, res, "GET")) return;
+		if (!lanFence(req)) {
+			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+			res.end("forbidden");
+			return;
 		}
-		if (!paired(req, service)) {
-			req.resume();
-			reject(res, 403, "paired model catalog requires a live paired device");
-			return false;
+		if (rateLimitAccept(req, "page")) {
+			res.writeHead(429, { "content-type": "text/plain; charset=utf-8" });
+			res.end("rate limited");
+			return;
 		}
-		return true;
-	};
-	const catalog = async (req, res) => {
-		if (!gate(req, res)) return;
-		if (req.method !== "GET") return reject(res, 405, "method not allowed");
-		let providersResponse;
-		let settingsResponse;
-		try {
-			providersResponse = await apiProxy.llm.providers(request$1({}));
-			settingsResponse = await apiProxy.settings.describe(request$1({}));
-		} catch {
-			return reject(res, 502, "model catalog capability is unavailable");
+		const token = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("pair") ?? "";
+		const ua = req.headers["user-agent"];
+		const result = token === "" ? {
+			ok: false,
+			code: "invalid"
+		} : service.accept(token, typeof ua === "string" ? ua : void 0);
+		if (!result.ok) {
+			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
+			if (deviceId !== void 0 && service.hasDevice(deviceId)) {
+				res.writeHead(303, {
+					location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(deviceId)}`,
+					"cache-control": "no-store",
+					"referrer-policy": "no-referrer"
+				});
+				res.end();
+				return;
+			}
+			res.writeHead(200, {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+				"referrer-policy": "no-referrer"
+			});
+			res.end(pairingFailurePage());
+			return;
 		}
-		const providers = valueOf(providersResponse);
-		const settings = valueOf(settingsResponse);
-		if (providers === void 0 || settings === void 0) return reject(res, 502, "model catalog capability is unavailable");
-		const namespace = settings.namespaces.find((candidate) => candidate.ns === "llm-pi-ai");
-		const providerMap = namespace !== void 0 && isRecord(namespace.value) && isRecord(namespace.value.providers) ? namespace.value.providers : void 0;
-		writeJson(res, 200, {
-			capability: "paired-model-catalog",
-			providers: settings.writable && providerMap !== void 0 ? providers.providers.filter((candidate) => candidate.active && candidate.settingsNs === "llm-pi-ai" && candidate.settingsPath.length === 2 && candidate.settingsPath[0] === "providers" && candidate.settingsPath[1] === candidate.provider && isRecord(providerMap[candidate.provider])).map((candidate) => ({
-				provider: candidate.provider,
-				displayName: candidate.displayName
-			})) : []
+		res.writeHead(303, {
+			location: `${appOrigin(req)}/pair-app?device=${encodeURIComponent(result.deviceId)}`,
+			"cache-control": "no-store",
+			"referrer-policy": "no-referrer",
+			"set-cookie": [`${service.config.cookieName}=${result.deviceId}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`]
 		});
+		res.end();
 	};
-	const discover = async (req, res) => {
-		if (!gate(req, res)) return;
-		if (req.method !== "POST") return reject(res, 405, "method not allowed");
-		const body = await bodyOf(req, providerSchema);
-		if (body === void 0) return reject(res, 400, "invalid model catalog request");
-		const eligible = await eligibleProvider(apiProxy, body.provider);
-		if (eligible.provider === void 0) return reject(res, eligible.status ?? 502, eligible.error ?? "model catalog capability is unavailable");
-		try {
-			const result = valueOf(await apiProxy.llm.discoverModels(request$1({
-				settingsNs: "llm-pi-ai",
-				provider: eligible.provider.provider
-			})));
-			if (result === void 0) return reject(res, 502, `model discovery failed for provider ${eligible.provider.provider}`);
-			writeJson(res, 200, { models: publicCandidates(result.models) });
-		} catch {
-			reject(res, 502, `model discovery failed for provider ${eligible.provider.provider}`);
+	/**
+	* The cookieless app landing. A paired device (device query or live
+	* pairing cookie) receives the official index shell patched with the
+	* device-capture script; the shell itself is the official document and
+	* carries no data, so serving it needs only the device credential.
+	*/
+	const handleAppPage = async (req, res) => {
+		if (!requireMethod(req, res, "GET")) return;
+		if (!lanFence(req)) {
+			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+			res.end("forbidden");
+			return;
+		}
+		if (rateLimitAccept(req, "page")) {
+			res.writeHead(429, { "content-type": "text/plain; charset=utf-8" });
+			res.end("rate limited");
+			return;
 		}
+		const device = new URL(req.url ?? "/", "http://pair.invalid").searchParams.get("device") ?? "";
+		const cookieDevice = readCookie(req.headers.cookie, service.config.cookieName);
+		const id = device !== "" && service.touchDevice(device) ? device : cookieDevice !== void 0 && service.touchDevice(cookieDevice) ? cookieDevice : void 0;
+		if (id === void 0) {
+			res.writeHead(200, {
+				"content-type": "text/html; charset=utf-8",
+				"cache-control": "no-store",
+				"referrer-policy": "no-referrer"
+			});
+			res.end(pairingFailurePage());
+			return;
+		}
+		const html = await deps.indexDocument?.(id).catch(() => void 0);
+		if (html === void 0) {
+			res.writeHead(502, {
+				"content-type": "text/plain; charset=utf-8",
+				"cache-control": "no-store"
+			});
+			res.end("remote device app unavailable");
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"referrer-policy": "no-referrer",
+			"set-cookie": [`${service.config.cookieName}=${id}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${String(COOKIE_MAX_AGE_SEC)}`]
+		});
+		res.end(patchAppShell(html, id));
 	};
-	const upsert = async (req, res) => {
-		if (!gate(req, res)) return;
-		if (req.method !== "POST") return reject(res, 405, "method not allowed");
-		const body = await bodyOf(req, upsertSchema);
-		if (body === void 0) return reject(res, 400, "invalid model catalog request");
-		const eligible = await eligibleProvider(apiProxy, body.provider);
-		if (eligible.provider === void 0) return reject(res, eligible.status ?? 502, eligible.error ?? "model catalog capability is unavailable");
-		const before = await readCatalog(apiProxy);
-		if (before === void 0) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`);
-		const plan = mutationPlan(eligible.provider.profile, body.provider, body.model, before);
-		if (plan === void 0) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`);
-		let mutation;
-		try {
-			mutation = await apiProxy.settings.mutate(request$1({
-				ns: "llm-pi-ai",
-				expectedRevision: eligible.provider.namespace.revision,
-				ops: plan.ops
-			}));
-		} catch {
-			return reject(res, 502, `model update failed for provider ${body.provider}`);
+	/**
+	* The reopen service worker script. Same phone-facing fence as the app
+	* page but no rate limit and no device check: the script is inert logic
+	* (no secrets, no data), and browsers re-fetch it on navigations for
+	* update checks, which must not trip a brute-force budget. no-store keeps
+	* the update check meaningful across deploys.
+	*/
+	const handleAppServiceWorker = (req, res) => {
+		if (!requireMethod(req, res, "GET")) return;
+		if (!lanFence(req)) {
+			res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+			res.end("forbidden");
+			return;
 		}
-		const code = errorCode(mutation);
-		if (code === "settings-conflict") return reject(res, 409, `model update conflicted for provider ${body.provider}`);
-		if (code === "settings-rejected") return reject(res, 422, `model update was rejected for provider ${body.provider}`);
-		if (code !== void 0) return reject(res, 502, `model update failed for provider ${body.provider}`);
-		const after = await readCatalog(apiProxy);
-		if (after === void 0) return reject(res, 502, `model catalog is unavailable for provider ${body.provider}`);
-		writeJson(res, 200, publicCatalog(after));
+		res.writeHead(200, {
+			"content-type": "text/javascript; charset=utf-8",
+			"cache-control": "no-store",
+			"service-worker-allowed": "/"
+		});
+		res.end(appServiceWorkerScript());
 	};
-	return [
+	const routes = [
+		{
+			kind: "exact",
+			path: PAIR_PATHS.issue,
+			handler: handleIssue
+		},
+		{
+			kind: "exact",
+			path: PAIR_PATHS.accept,
+			handler: handleAccept
+		},
+		{
+			kind: "exact",
+			path: PAIR_PATHS.stop,
+			handler: handleStop
+		},
+		{
+			kind: "exact",
+			path: PAIR_PATHS.revoke,
+			handler: handleRevoke
+		},
 		{
 			kind: "exact",
-			path: PAIRED_MODEL_CATALOG_PATHS.catalog,
-			handler: catalog
+			path: PAIR_PATHS.heartbeat,
+			handler: handleHeartbeat
 		},
 		{
 			kind: "exact",
-			path: PAIRED_MODEL_CATALOG_PATHS.discover,
-			handler: discover
+			path: PAIR_PATHS.status,
+			handler: handleStatus
 		},
 		{
 			kind: "exact",
-			path: PAIRED_MODEL_CATALOG_PATHS.upsert,
-			handler: upsert
+			path: PAIR_PATHS.events,
+			handler: handleEvents
 		}
 	];
+	if (deps.lanBindStatus !== void 0) routes.push({
+		kind: "exact",
+		path: PAIR_PATHS.lanBind,
+		handler: handleLanBind
+	});
+	routes.push({
+		kind: "exact",
+		path: PAIR_PATHS.acceptPage,
+		handler: handleAcceptPage
+	});
+	if (deps.indexDocument !== void 0) {
+		routes.push({
+			kind: "exact",
+			path: PAIR_PATHS.appPage,
+			handler: handleAppPage
+		});
+		routes.push({
+			kind: "exact",
+			path: PAIR_PATHS.appServiceWorker,
+			handler: handleAppServiceWorker
+		});
+	}
+	return routes;
+}
+/** The request origin (https when a tunnel edge says so). */
+function appOrigin(req) {
+	const proto = req.headers["x-forwarded-proto"] === "https" ? "https" : "http";
+	const origin = `http://${req.headers.host ?? "127.0.0.1"}`;
+	return proto === "https" ? origin.replace("http://", "https://") : origin;
 }
 //#endregion
 //#region src/loopback-proxy.ts
@@ -2429,8 +1435,17 @@ const HTTP_FORWARD_RESPONSE_HEADERS = [
 * @param res - the outer response.
 * @param port - local webServer port.
 * @param upstreamPath - path + query on 127.0.0.1 (must start with `/`).
-*/
-function proxyLoopbackHttp(req, res, port, upstreamPath) {
+* @param auth - when given, the process's inner browser-auth credential is
+*   attached so the connection plugin's /api route (fence + browser auth,
+*   authority-bound cookie, no loopback exemption on this cohort) accepts
+*   the re-issued request; a 401 answer invalidates the cached credential.
+*/
+function proxyLoopbackHttp(req, res, port, upstreamPath, auth) {
+	Promise.resolve(auth?.ready()).catch(() => void 0).then((cookie) => {
+		pipeLoopbackHttp(req, res, port, upstreamPath, auth, typeof cookie === "string" ? cookie : void 0);
+	});
+}
+function pipeLoopbackHttp(req, res, port, upstreamPath, auth, cookie) {
 	const headers = {
 		host: `127.0.0.1:${String(port)}`,
 		"sec-fetch-site": "same-origin"
@@ -2441,6 +1456,7 @@ function proxyLoopbackHttp(req, res, port, upstreamPath) {
 	if (typeof contentLength === "string") headers["content-length"] = contentLength;
 	const accept = req.headers.accept;
 	if (typeof accept === "string") headers.accept = accept;
+	if (cookie !== void 0) headers.cookie = cookie;
 	const upstream = request({
 		host: "127.0.0.1",
 		port,
@@ -2448,6 +1464,7 @@ function proxyLoopbackHttp(req, res, port, upstreamPath) {
 		method: req.method,
 		headers
 	}, (upstreamRes) => {
+		if (upstreamRes.statusCode === 401 && cookie !== void 0) auth?.invalidate();
 		const out = {};
 		for (const name of HTTP_FORWARD_RESPONSE_HEADERS) {
 			const value = upstreamRes.headers[name];
@@ -2478,14 +1495,17 @@ function proxyLoopbackHttp(req, res, port, upstreamPath) {
 * @param head - bytes already read past the handshake.
 * @param port - local webServer port.
 * @param upstreamPath - path + query on 127.0.0.1.
+* @param cookie - the inner browser-auth credential for the handshake, when
+*   the upstream route enforces it (the gateway event-stream mux does).
 */
-function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath) {
+function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath, cookie) {
 	const lines = [
 		`GET ${upstreamPath} HTTP/1.1`,
 		`Host: 127.0.0.1:${String(port)}`,
 		"Upgrade: websocket",
 		"Connection: Upgrade"
 	];
+	if (cookie !== void 0) lines.push(`Cookie: ${cookie}`);
 	for (const name of WS_FORWARD_HEADERS) {
 		const value = req.headers[name];
 		if (value === void 0) continue;
@@ -2493,6 +1513,8 @@ function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath) {
 	}
 	const handshake = `${lines.join("\r\n")}\r\n\r\n`;
 	const upstream = connect(port, "127.0.0.1");
+	socket.setKeepAlive(true, 2e4);
+	upstream.setKeepAlive(true, 2e4);
 	const tearDown = () => {
 		upstream.destroy();
 		socket.destroy();
@@ -2517,51 +1539,67 @@ function proxyLoopbackUpgrade(req, socket, head, port, upstreamPath) {
 /**
 * Remote desktop channel constants — SDK-independent so tests and the
 * client half can pin them without importing the host SDK graph.
+*
+* Access model on the 0.1.2-alpha.2 line: the host /api surface has no
+* per-method privilege pin — the "configuration plane is local" behavior
+* lives in the browser (client plugins branch on connection.isLoopback), and
+* the paired remote desktop flips into host mode via the transport hook
+* (ownsHost) while every call rides this gated channel as a loopback-shaped
+* request. A paired device is therefore a full-control credential by
+* design; the only paths that stay physically local are the control planes
+* below (pairing control, self-update, plugin install/remove, host power).
 */
 /** Gated mirror of same-origin fenced paths (`/remote` + original pathname). */
 const REMOTE_PREFIX$1 = "/remote";
 /** Connection-plugin method prefix under the gated channel. */
 const REMOTE_API_PREFIX$1 = `${REMOTE_PREFIX$1}/api`;
-/** WebSocket event-stream paths served by the channel (client rewrites to these). */
-const REMOTE_API_PATHS = {
-	mux: `${REMOTE_API_PREFIX$1}/events.mux`,
-	host: `${REMOTE_API_PREFIX$1}/events.host`
-};
 /**
 * Exact upgrade paths registered on webServer (the SDK matches upgrades by
 * exact path, not prefix). Query strings ride on the request URL.
 */
 const REMOTE_UPGRADE_PATHS = [
-	REMOTE_API_PATHS.mux,
-	REMOTE_API_PATHS.host,
+	{ mux: `${REMOTE_API_PREFIX$1}/remote.mux` }.mux,
 	`${REMOTE_PREFIX$1}/sidebar/ws/terminal`,
 	`${REMOTE_PREFIX$1}/sidebar/ws/agent-terminals`,
 	`${REMOTE_API_PREFIX$1}/dsh-ssh/terminal`
 ];
+/** Plugin-manager HTTP prefix: install/remove stay physically local. */
+const PLUGIN_MANAGER_PATH = "/api/plugin-manager";
+/** Desktop-launcher HTTP prefix: shortcut create and host shutdown stay physically local. */
+const DESKTOP_LAUNCHER_PATH = "/api/dsh-desktop-launcher";
+/**
+* The cookieless device credential: the boot patch reads the device id from
+* the /pair-app URL, keeps it in sessionStorage, and attaches it to every
+* gated HTTP call as this header (and to WebSocket upgrades as the `device`
+* query parameter - WS handshakes cannot carry headers from the Web API).
+* The channel gate accepts it exactly like the device cookie, so the mobile
+* flow works even with browser cookies fully blocked; the cookie remains the
+* primary credential on normal browsers.
+*/
+const REMOTE_DEVICE_HEADER = "x-dsh-remote-device";
+const REMOTE_DEVICE_QUERY = "device";
+/**
+* Path prefixes that stay physically local even for a paired device. A
+* paired remote desktop may use the full host API (chat, sessions,
+* settings, credentials, presets — it is a full-control credential), but it
+* must not reach the machine-control planes: pairing control itself, the
+* dsh-web self-update installer, plugin install/remove, and desktop
+* launcher actions (host shutdown, shortcuts).
+*/
+const LOCAL_ONLY_PREFIXES = [
+	"/api/pair",
+	"/api/update",
+	PLUGIN_MANAGER_PATH,
+	DESKTOP_LAUNCHER_PATH
+];
 /**
-* Loopback-only methods of the host API surface, mirrored from
-* client-connection's `PRIVILEGED_METHODS` (pinned by
-* tests/remote-contract.spec.ts against the installed SDK). They stay
-* unreachable from a paired remote desktop, matching the SDK's own stance
-* that the configuration plane is loopback-same-origin only.
+* Whether a paired inner path must stay physically local.
+* @param innerPath - the rewritten inner path (e.g. `/api/session.list`).
+* @returns a denial message, or undefined when the path may be proxied.
 */
-const LOOPBACK_ONLY_METHODS = /* @__PURE__ */ new Set([
-	"agentPreset.read",
-	"agentPreset.copy",
-	"agentPreset.openDocument",
-	"agentPreset.remove",
-	"host.pickDirectory",
-	"host.openPath",
-	"settings.describe",
-	"settings.openDocument",
-	"settings.update",
-	"settings.replace",
-	"settings.mutate",
-	"credentials.describe",
-	"credentials.set",
-	"credentials.unset",
-	"llm.discoverModels"
-]);
+function localOnlyDenial(innerPath) {
+	for (const prefix of LOCAL_ONLY_PREFIXES) if (innerPath === prefix || innerPath.startsWith(`${prefix}/`)) return `${prefix.slice(1)} stays physically local and stays unreachable from a paired remote desktop`;
+}
 //#endregion
 //#region src/remote-api.ts
 const ALLOWED_METHODS = /* @__PURE__ */ new Set([
@@ -2612,18 +1650,25 @@ function innerPathOf(pathname) {
 	return rest;
 }
 /**
-* Whether a paired inner path must stay physically local.
+* Whether a paired inner path must stay physically local (delegates to the
+* shared LOCAL_ONLY_PREFIXES table).
 * @returns a denial message, or undefined when the path may be proxied.
 */
 function loopbackOnlyDenial(innerPath) {
-	if (innerPath === "/api/pair" || innerPath.startsWith("/api/pair/")) return "pairing endpoints stay loopback-only and stay unreachable from a paired remote desktop";
-	if (innerPath === "/api/update" || innerPath.startsWith("/api/update/")) return "update endpoints stay loopback-only and stay unreachable from a paired remote desktop";
-	if (innerPath === "/api/plugin-manager" || innerPath.startsWith(`/api/plugin-manager/`)) return "plugin-manager stays loopback-only and stays unreachable from a paired remote desktop";
-	if (innerPath === "/api/dsh-desktop-launcher" || innerPath.startsWith(`/api/dsh-desktop-launcher/`)) return "desktop-launcher endpoints stay loopback-only and stay unreachable from a paired remote desktop";
-	if (innerPath === "/api/dsh-web-ui-settings" || innerPath.startsWith(`/api/dsh-web-ui-settings/`)) return "settings-bridge endpoints stay loopback-only and stay unreachable from a paired remote desktop";
-	if (!innerPath.startsWith("/api/")) return void 0;
-	const method = innerPath.slice(5);
-	if (method !== "" && !method.includes("/") && LOOPBACK_ONLY_METHODS.has(method)) return `${method} is loopback-only and stays unreachable from a paired remote desktop`;
+	return localOnlyDenial(innerPath);
+}
+/**
+* Resolve a live device credential for a gated HTTP request: the pairing
+* cookie first, then the cookieless header the boot patch attaches. Unknown
+* or revoked ids are a no-op - a stale id never re-arms a device.
+* @returns the touched device id, or undefined when neither credential is live.
+*/
+function pairedDeviceIdOf(req, service) {
+	const cookieDevice = readCookie(req.headers.cookie, service.config.cookieName);
+	const headerDevice = typeof req.headers["x-dsh-remote-device"] === "string" ? req.headers[REMOTE_DEVICE_HEADER] : void 0;
+	const id = cookieDevice ?? headerDevice;
+	if (id === void 0) return void 0;
+	return service.touchDevice(id) ? id : void 0;
 }
 /**
 * Build the remote desktop channel HTTP routes.
@@ -2634,8 +1679,7 @@ function makeRemoteApiRoutes(deps) {
 	const { service, port, requirePairingForLan = true } = deps;
 	const handler = (req, res) => {
 		if (typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan) {
-			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-			if (!(deviceId !== void 0 && service.touchDevice(deviceId))) {
+			if (pairedDeviceIdOf(req, service) === void 0) {
 				req.resume();
 				envelopeError(res, 403, "invalid-request", "unpaired", "this device is not paired with the desktop");
 				return;
@@ -2660,7 +1704,7 @@ function makeRemoteApiRoutes(deps) {
 			envelopeError(res, 403, "invalid-request", "forbidden", denied);
 			return;
 		}
-		proxyLoopbackHttp(req, res, port, `${inner}${url.search}`);
+		proxyLoopbackHttp(req, res, port, `${inner}${url.search}`, deps.auth);
 	};
 	return [{
 		kind: "prefix",
@@ -2693,8 +1737,11 @@ function makeRemoteApiUpgradeRoutes(deps) {
 	const { service, port, requirePairingForLan = true } = deps;
 	const handlerFor = (fallbackPath) => (req, socket, head) => {
 		if (typeof requirePairingForLan === "function" ? requirePairingForLan() : requirePairingForLan) {
-			const deviceId = readCookie(req.headers.cookie, service.config.cookieName);
-			if (deviceId === void 0 || !service.touchDevice(deviceId)) {
+			let queryDevice;
+			try {
+				queryDevice = new URL(req.url ?? "/", "http://127.0.0.1").searchParams.get("device") ?? void 0;
+			} catch {}
+			if ((pairedDeviceIdOf(req, service) ?? (queryDevice !== void 0 && service.touchDevice(queryDevice) ? queryDevice : void 0)) === void 0) {
 				socket.write("HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n");
 				socket.destroy();
 				return;
@@ -2706,7 +1753,10 @@ function makeRemoteApiUpgradeRoutes(deps) {
 			socket.destroy();
 			return;
 		}
-		proxyLoopbackUpgrade(req, socket, head, port, inner);
+		Promise.resolve(deps.auth?.ready()).catch(() => void 0).then((cookie) => {
+			if (socket.destroyed) return;
+			proxyLoopbackUpgrade(req, socket, head, port, inner, typeof cookie === "string" ? cookie : void 0);
+		});
 	};
 	return REMOTE_UPGRADE_PATHS.map((path) => ({
 		path,
@@ -2714,6 +1764,79 @@ function makeRemoteApiUpgradeRoutes(deps) {
 	}));
 }
 //#endregion
+//#region src/remote-presence-pet.ts
+/** Default restore grace: the presence sweep flips a device offline after
+* ~25 s, and a phone that was briefly backgrounded should not flicker the
+* pet; 2 minutes keeps the restore stable. */
+const DEFAULT_RESTORE_AFTER_MS = 12e4;
+const nodeTimers = {
+	setTimeout,
+	clearTimeout
+};
+/**
+* Start the presence link. Returns the disposer (withdraws the state
+* subscription and cancels a pending restore).
+* @param deps - pairing stream + pet seam (+ test seams).
+*/
+function startRemotePresencePet(deps) {
+	const restoreAfterMs = deps.restoreAfterMs ?? DEFAULT_RESTORE_AFTER_MS;
+	const timers = deps.timers ?? nodeTimers;
+	let previousOnline = false;
+	let hiddenByRemote = false;
+	let restoreTimer;
+	let disposed = false;
+	const clearRestore = () => {
+		if (restoreTimer !== void 0) {
+			timers.clearTimeout(restoreTimer);
+			restoreTimer = void 0;
+		}
+	};
+	const scheduleRestore = () => {
+		clearRestore();
+		restoreTimer = timers.setTimeout(() => {
+			restoreTimer = void 0;
+			restoreAfterTick();
+		}, restoreAfterMs);
+	};
+	const restoreAfterTick = () => {
+		if (disposed || !hiddenByRemote) return;
+		const pet = deps.pet();
+		if (pet === void 0) return;
+		hiddenByRemote = false;
+		pet.setVisible(true).catch(() => {});
+	};
+	const hideForRemote = () => {
+		if (hiddenByRemote) return;
+		const pet = deps.pet();
+		if (pet === void 0) return;
+		pet.state().then((value) => {
+			if (disposed || hiddenByRemote) return;
+			if (value.display?.visible !== true) return;
+			hiddenByRemote = true;
+			return pet.setVisible(false).catch(() => {
+				hiddenByRemote = false;
+			});
+		}, () => {});
+	};
+	const handle = (snapshot) => {
+		const online = snapshot.phase === "connected" && snapshot.onlineCount > 0;
+		if (online && !previousOnline) {
+			cancelRestoreAndClear();
+			hideForRemote();
+		} else if (!online && previousOnline) scheduleRestore();
+		previousOnline = online;
+	};
+	const cancelRestoreAndClear = () => {
+		clearRestore();
+	};
+	const unsubscribe = deps.onState(handle);
+	return () => {
+		disposed = true;
+		unsubscribe();
+		clearRestore();
+	};
+}
+//#endregion
 //#region src/posture.ts
 /**
 * Build the forged Host values to probe: the public base authority (host or
@@ -2845,6 +1968,442 @@ function lanIPv4Addresses() {
 	}).map((iface) => iface.address);
 }
 //#endregion
+//#region src/firewall.ts
+/**
+* Host firewall management for the LAN bind toggle: while LAN access is on,
+* keep one inbound allow rule for the bound port; when it turns off, remove
+* the rule. Windows manages the Windows Defender Firewall rule via netsh;
+* Linux uses the first available manager among firewalld / ufw / iptables.
+* On every other platform (macOS included) the plugin reports the firewall
+* as unmanaged: the port usually needs no rule there, and managing pf or the
+* application firewall is out of scope for a distributable plugin.
+*
+* Ported from the dsh-LAN reference implementation (MIT), adapted to this
+* package's structure and test seams.
+*/
+/** Rule name shared by every backend so re-runs recreate the same rule. */
+const FIREWALL_RULE_NAME = "remote-web-ui (auto)";
+/** Production runner: spawn without a shell, capture text, 20s timeout. */
+const spawnRunner = (cmd, args) => {
+	const result = spawnSync(cmd, args, {
+		shell: false,
+		encoding: "utf8",
+		windowsHide: process.platform === "win32",
+		timeout: 2e4
+	});
+	return {
+		ok: result.status === 0,
+		out: result.stdout ?? "",
+		err: result.stderr ?? "",
+		missing: result.error !== void 0
+	};
+};
+function netshBackend(run) {
+	const show = () => {
+		const result = run("netsh", [
+			"advfirewall",
+			"firewall",
+			"show",
+			"rule",
+			`name=${FIREWALL_RULE_NAME}`,
+			"verbose"
+		]);
+		return result.ok && result.out.includes("remote-web-ui (auto)");
+	};
+	return {
+		label: "netsh",
+		ruleExists: show,
+		addRule: (port) => run("netsh", [
+			"advfirewall",
+			"firewall",
+			"add",
+			"rule",
+			`name=${FIREWALL_RULE_NAME}`,
+			"dir=in",
+			"action=allow",
+			"protocol=TCP",
+			`localport=${String(port)}`,
+			"profile=private,domain"
+		]).ok,
+		removeRule: () => {
+			if (!show()) return true;
+			return run("netsh", [
+				"advfirewall",
+				"firewall",
+				"delete",
+				"rule",
+				`name=${FIREWALL_RULE_NAME}`
+			]).ok;
+		}
+	};
+}
+function firewalldBackend(run) {
+	return {
+		label: "firewalld",
+		ruleExists: (port) => run("firewall-cmd", [
+			"--permanent",
+			"--query-port",
+			`${String(port)}/tcp`
+		]).ok,
+		addRule: (port) => {
+			const add = run("firewall-cmd", [
+				"--permanent",
+				"--add-port",
+				`${String(port)}/tcp`
+			]);
+			const reload = run("firewall-cmd", ["--reload"]);
+			return add.ok && reload.ok;
+		},
+		removeRule: (port) => {
+			const del = run("firewall-cmd", [
+				"--permanent",
+				"--remove-port",
+				`${String(port)}/tcp`
+			]);
+			const reload = run("firewall-cmd", ["--reload"]);
+			return del.ok && reload.ok;
+		}
+	};
+}
+function ufwBackend(run) {
+	return {
+		label: "ufw",
+		ruleExists: (port) => {
+			const result = run("ufw", ["status"]);
+			return result.ok && new RegExp(`(^|\\s)${String(port)}/tcp\\s+ALLOW`, "i").test(result.out);
+		},
+		addRule: (port) => run("ufw", ["allow", `${String(port)}/tcp`]).ok,
+		removeRule: (port) => run("ufw", [
+			"delete",
+			"allow",
+			`${String(port)}/tcp`
+		]).ok
+	};
+}
+function iptablesBackend(run) {
+	const rule = (port) => [
+		"INPUT",
+		"-p",
+		"tcp",
+		"--dport",
+		String(port),
+		"-j",
+		"ACCEPT"
+	];
+	return {
+		label: "iptables",
+		ruleExists: (port) => run("iptables", ["-C", ...rule(port)]).ok,
+		addRule: (port) => run("iptables", ["-A", ...rule(port)]).ok,
+		removeRule: (port) => run("iptables", ["-D", ...rule(port)]).ok
+	};
+}
+function toolAvailable(run, cmd) {
+	try {
+		return run(cmd, ["--version"]).missing !== true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Detect the platform firewall manager. Returns undefined when the platform
+* has no supported manager (macOS, unknown Linux without tools): the port
+* then usually needs no rule and the UI reports "unmanaged".
+*/
+function detectFirewallBackend(platform, run = spawnRunner) {
+	if (platform === "win32") return netshBackend(run);
+	if (platform !== "linux") return void 0;
+	if (toolAvailable(run, "firewall-cmd")) {
+		if (run("firewall-cmd", ["--state"]).ok) return firewalldBackend(run);
+	}
+	if (toolAvailable(run, "ufw")) return ufwBackend(run);
+	if (toolAvailable(run, "iptables")) return iptablesBackend(run);
+}
+let cachedBackend;
+/** Cached detection for the running platform (per process). */
+function firewallBackend() {
+	const platform = process.platform;
+	if (cachedBackend === void 0 || cachedBackend.platform !== platform) cachedBackend = {
+		platform,
+		backend: detectFirewallBackend(platform)
+	};
+	return cachedBackend.backend;
+}
+/**
+* Delete-and-add: recreating the rule is idempotent and locale-proof (netsh
+* output is localized, so parsing the live rule's port is fragile; the Linux
+* backends follow the same recreate pattern).
+*/
+function ensureFirewallRule(port) {
+	invalidateFirewallSummary();
+	const backend = firewallBackend();
+	if (backend === void 0) return true;
+	backend.removeRule(port);
+	return backend.addRule(port);
+}
+function removeFirewallRule(port) {
+	invalidateFirewallSummary();
+	const backend = firewallBackend();
+	if (backend === void 0) return true;
+	return backend.removeRule(port);
+}
+/**
+* Human-readable firewall state for the status endpoint. A missing backend
+* means the platform has nothing to manage; detection stays at the call site
+* so an explicit undefined cannot silently re-probe the real OS mid-test.
+*/
+function computeFirewallSummary(port, lanEnabled, backend) {
+	if (backend === void 0) return {
+		ok: true,
+		managed: false
+	};
+	return {
+		ok: lanEnabled ? backend.ruleExists(port) : !backend.ruleExists(port),
+		managed: true,
+		note: backend.label
+	};
+}
+let summaryCache;
+/** Forget the cached summary (rule mutations call this). */
+function invalidateFirewallSummary() {
+	summaryCache = void 0;
+}
+/**
+* The settings card polls this every ten seconds; the probes are blocking
+* spawnSync subprocesses on managed platforms, so short-TTL memoization
+* keeps one poll from freezing the host event loop per request.
+*/
+function firewallSummary(port, lanEnabled) {
+	const key = `${String(port)}|${lanEnabled ? "1" : "0"}`;
+	const now = Date.now();
+	if (summaryCache !== void 0 && summaryCache.key === key && now - summaryCache.at < 3e4) return summaryCache.value;
+	const value = computeFirewallSummary(port, lanEnabled, firewallBackend());
+	summaryCache = {
+		key,
+		at: now,
+		value
+	};
+	return value;
+}
+//#endregion
+//#region src/lan-bind.ts
+/**
+* LAN bind toggle: the managed cordis patch block that pins the web
+* server's bind. On = a block binding 0.0.0.0; off = the same block binding
+* 127.0.0.1. The block takes effect on the next `dsh web` start (the live
+* patch watcher cannot rebind a running listener, and on this harness line
+* the user patch layer cannot evaluate webStartup-dependent expressions
+* reliably - static values are the only dependable form), so the plugin
+* re-asserts the block at every boot and the settings card reports the
+* running bind honestly.
+*
+* Same-id patch rows REPLACE the row config wholesale, so the block carries
+* the official web-app webserver row's full config (bind + compression)
+* with the bind values materialized. The CLI's --host 0.0.0.0 guard stays
+* intact: deliberate LAN exposure happens through this configuration layer
+* only. Until the user flips the toggle once, the plugin never touches the
+* patch file.
+*
+* The block discipline (markers, atomic write, strip-and-rewrite) follows
+* the dsh-LAN reference implementation (MIT).
+*/
+/** Profile names safe to interpolate into the patch path: one path segment, no traversal. */
+const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const LAN_BIND_BLOCK_BEGIN = "# --- remote-web-ui lan-bind block (managed - do not edit) ---";
+const LAN_BIND_BLOCK_END = "# --- end remote-web-ui lan-bind block ---";
+/**
+* The absolute path of the profile patch file this toggle manages. The value
+* is config-controlled (and the DSH_PROFILE env fallback bypasses schema
+* validation entirely), so the path is guarded twice: the profile must be a
+* single safe path segment, and the resolved file must stay under the
+* profiles directory.
+*/
+function profilePatchFile(profile, home = dshHome()) {
+	if (!PROFILE_PATTERN.test(profile)) throw new Error(`remote-web-ui: unsafe lan-bind profile ${JSON.stringify(profile)}`);
+	const file = resolve(join(home, "profiles", profile, "cordis.patch.yml"));
+	const root = resolve(join(home, "profiles")) + sep;
+	if (!file.startsWith(root)) throw new Error(`remote-web-ui: lan-bind profile ${JSON.stringify(profile)} escapes the profiles directory`);
+	return file;
+}
+function readPatchContent(file) {
+	if (!existsSync(file)) return "";
+	return readFileSync(file, "utf8");
+}
+/** Escape one literal string for embedding into a RegExp pattern. */
+function escapeRegex(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Remove the managed block (and its markers) from patch content. */
+function stripManagedBlock(content) {
+	const begin = escapeRegex(LAN_BIND_BLOCK_BEGIN);
+	const end = escapeRegex(LAN_BIND_BLOCK_END);
+	const pattern = new RegExp(`\\r?\\n?${begin}[\\s\\S]*?${end}\\r?\\n?`, "g");
+	return content.replace(pattern, "\n");
+}
+/**
+* Render the managed block for one bind state. The values are static: the
+* user patch layer has no reliable lazy service evaluation, and the plugin
+* re-asserts the block at every boot so CLI flags (--port, --host) win by
+* rewriting it before the next start.
+*/
+function managedBlock(host, port) {
+	return [
+		LAN_BIND_BLOCK_BEGIN,
+		"- id: webserver",
+		"  name: '@deepseek-ai/dsh-host-webserver'",
+		"  config:",
+		`    host: '${host}'`,
+		`    port: ${String(port)}`,
+		"    compression: gzip",
+		"    compressionLevel: 1",
+		"    compressionThresholdBytes: 1024",
+		LAN_BIND_BLOCK_END,
+		""
+	].join("\n");
+}
+/**
+* Parse the block's pinned bind out of patch content. A block whose values
+* were hand-edited reports the literals as-is so the card can surface them
+* instead of silently claiming one of the two known states.
+*/
+function managedBindOf(content) {
+	const begin = content.indexOf(LAN_BIND_BLOCK_BEGIN);
+	if (begin === -1) return void 0;
+	const end = content.indexOf(LAN_BIND_BLOCK_END, begin);
+	const block = end === -1 ? content.slice(begin) : content.slice(begin, end);
+	const hostMatch = /host:\s*'([^']+)'/.exec(block);
+	const portMatch = /port:\s*(\d+)/.exec(block);
+	return {
+		host: hostMatch?.[1] ?? "",
+		port: portMatch !== null ? Number(portMatch[1]) : void 0
+	};
+}
+/** Full file-level state for the settings card and the boot re-assert. */
+function lanBindState(profile, home = dshHome()) {
+	const state = managedBindOf(readPatchContent(profilePatchFile(profile, home)));
+	if (state === void 0) return { blockPresent: false };
+	return {
+		blockPresent: true,
+		host: state.host,
+		port: state.port
+	};
+}
+/**
+* Write (or rewrite) the managed block with the given bind. The rest of the
+* patch file is preserved; the block is rewritten atomically (unique temp
+* file + rename, so concurrent writers can never rename a half-written
+* file) with the original file's permissions preserved. A hand-truncated
+* unterminated block (BEGIN marker without END, which stripManagedBlock
+* cannot match) is truncated at its BEGIN marker first so the rewrite can
+* never stack a second webserver row onto the orphan.
+*/
+function writeLanBind(host, port, profile, home = dshHome()) {
+	const file = profilePatchFile(profile, home);
+	const stripped = stripManagedBlock(readPatchContent(file));
+	const orphanBegin = stripped.indexOf(LAN_BIND_BLOCK_BEGIN);
+	const content = `${(orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd()}\n\n${managedBlock(host, port)}`;
+	const mode = existsSync(file) ? statSync(file).mode & 511 : 384;
+	mkdirSync(dirname(file), { recursive: true });
+	const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+	writeFileSync(temp, content, { mode });
+	renameSync(temp, file);
+}
+//#endregion
+//#region src/lan-bind-plan.ts
+/**
+* The bind host the managed block should pin: an explicit CLI --host wins,
+* otherwise the toggle decides. CLI hosts outside the two managed literals
+* (a pinned specific IP) are not a state the toggle manages — the toggle
+* decides, and the card surfaces the divergence honestly.
+* @param lanBind - the toggle value.
+* @param startupHost - the CLI-provided bind host, when given.
+* @returns the desired bind host literal.
+*/
+function desiredBindHost(lanBind, startupHost) {
+	if (startupHost === "0.0.0.0" || startupHost === "127.0.0.1") return startupHost;
+	return lanBind ? "0.0.0.0" : "127.0.0.1";
+}
+/**
+* The port the managed block should pin: the CLI port when given, else the
+* currently bound port. Undefined when neither is readable yet (the caller
+* skips the write and reports why).
+* @param startupPort - the CLI-provided port, when given.
+* @param livePort - the currently bound port, when finite.
+*/
+function desiredBindPort(startupPort, livePort) {
+	if (typeof startupPort === "number" && Number.isFinite(startupPort)) return startupPort;
+	return typeof livePort === "number" && Number.isFinite(livePort) ? livePort : void 0;
+}
+/**
+* Whether the running bind has not caught up with what the toggle (plus a
+* possibly overriding CLI host) will pin. Compared against the effective
+* desired host — not the raw toggle — so a flag-managed bind is not reported
+* as pending forever.
+* @param lanBind - the toggle value (undefined = untouched, never pending).
+* @param desiredHost - the effective desired host, or undefined when untouched.
+* @param liveHost - the currently bound host.
+*/
+function pendingRestartOf(lanBind, desiredHost, liveHost) {
+	if (lanBind === void 0 || desiredHost === void 0) return false;
+	return liveHost !== desiredHost;
+}
+/**
+* Whether the firewall rule must be (re)applied: only when the toggle or the
+* bound port moved since the last application. Keeps unrelated settings
+* saves from spawning netsh/firewall-cmd delete+add churn.
+* @param previous - the state applied earlier by this process, if any.
+* @param next - the state the settings now ask for, if derivable.
+*/
+function firewallActionNeeded(previous, next) {
+	if (next === void 0) return false;
+	if (previous === void 0) return true;
+	return previous.enabled !== next.enabled || previous.port !== next.port;
+}
+//#endregion
+//#region src/inner-auth.ts
+/** The harness browser-auth cookie name prefix (see dsh-client-connection). */
+const BROWSER_AUTH_COOKIE_PREFIX = "dsh-auth-";
+/**
+* Build the inner-auth handle.
+* @param launchUrl - the launch-token URL for the inner loopback authority
+*   (the connection service's authenticatedUrl of `http://127.0.0.1:<port>/`),
+*   or undefined when the connection service or port is unavailable.
+* @param fetchImpl - injectable fetch (tests).
+*/
+function createInnerAuth(launchUrl, fetchImpl = fetch) {
+	let cached;
+	let inflight;
+	const redeem = async () => {
+		const url = launchUrl();
+		if (url === void 0) return void 0;
+		try {
+			const raw = (await fetchImpl(url, { redirect: "manual" })).headers.get("set-cookie");
+			if (raw === null) return void 0;
+			const entry = raw.split(",").map((part) => part.trim()).find((part) => part.startsWith(BROWSER_AUTH_COOKIE_PREFIX));
+			if (entry === void 0) return void 0;
+			const pair = entry.split(";")[0]?.trim();
+			return pair !== void 0 && pair.includes("=") ? pair : void 0;
+		} catch {
+			return;
+		}
+	};
+	return {
+		ready() {
+			if (cached !== void 0) return Promise.resolve(cached);
+			inflight ??= redeem().then((value) => {
+				if (value !== void 0) cached = value;
+				inflight = void 0;
+				return value;
+			}, () => {
+				inflight = void 0;
+			});
+			return inflight;
+		},
+		invalidate() {
+			cached = void 0;
+		}
+	};
+}
+//#endregion
 //#region src/tunnel.ts
 /**
 * Auto-tunnel manager: spawns a Cloudflare quick tunnel (`cloudflared
@@ -2866,7 +2425,10 @@ async function defaultEnsureBinary() {
 }
 /** Default factory: the cloudflared package's quick tunnel (no account). */
 function defaultFactory(targetUrl) {
-	return Tunnel.quick(targetUrl, { "--no-autoupdate": true });
+	return Tunnel.quick(targetUrl, {
+		"--no-autoupdate": true,
+		"--protocol": "http2"
+	});
 }
 /** Node timers. */
 const nodeTimer = {
@@ -3725,12 +3287,14 @@ const REMOTE_CHANNEL_RULES = {
 	gitPrefix: "/git/",
 	petPrefix: "/pet/",
 	wsPaths: [
-		"/api/events.mux",
-		"/api/events.host",
+		"/api/remote.mux",
 		"/sidebar/ws/terminal",
 		"/sidebar/ws/agent-terminals",
 		"/api/dsh-ssh/terminal"
-	]
+	],
+	deviceHeader: REMOTE_DEVICE_HEADER,
+	deviceKey: "dsh-remote-device",
+	deviceQuery: REMOTE_DEVICE_QUERY
 };
 /** The window global the boot patch publishes its seat under. */
 const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
@@ -3748,8 +3312,15 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 * (hooks + pending unpaired signal) instead of patching twice.
 *
 * The rewrite decisions are generated from REMOTE_CHANNEL_RULES, the same
-* data the browser patch consumes — the two cannot drift apart. The script
-* self-skips on loopback origins and never throws.
+* data the browser patch consumes — the two cannot drift apart. On this
+* 0.1.2-alpha.2 line the "configuration plane is local" behavior lives in
+* the browser (client plugins branch on connection.isLoopback), so the
+* script also flips the official UI into host mode by installing the
+* transport hook `__DSH_TRANSPORT__ = { ownsHost: true }` before the
+* connection plugin reads it: the paired remote desktop gets the full
+* settings/credentials/presets surface, and every call still rides the
+* gated /remote channel. The script self-skips on loopback origins and
+* never throws.
 * @module @linxin666/dsh-remote-web-ui/remote-channel-boot
 */
 /**
@@ -3760,7 +3331,26 @@ const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
 function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
 	const json = JSON.stringify(rules);
 	const seat = JSON.stringify(REMOTE_CHANNEL_BOOT_GLOBAL);
-	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;var R=" + json + ";function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.desktopLauncherPrefix||p.indexOf(R.desktopLauncherPrefix+\"/\")===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,init)).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat}catch(e){}})();";
+	return "(function(){try{var w=window,loc=w.location,h=loc.hostname;if(h==='localhost'||h==='::1'||/^127(\\.\\d{1,3}){3}$/.test(h))return;try{if(w.__DSH_TRANSPORT__===undefined)w.__DSH_TRANSPORT__={};w.__DSH_TRANSPORT__.ownsHost=true}catch(e){}var R=" + json + ";function rdv(){try{return w.sessionStorage.getItem(R.deviceKey)}catch(e){return null}}function att(init){var dv=rdv();if(dv===null)return init;var h=init&&init.headers;if(typeof Headers!==\"undefined\"&&h instanceof Headers){try{h.set(R.deviceHeader,dv)}catch(e){}return init}if(typeof h===\"object\"&&h!==null){var o={};for(var k in h)o[k]=h[k];o[R.deviceHeader]=dv;return Object.assign({},init,{headers:o})}return init}function sf(p){if(p.indexOf(R.pairPrefix)===0)return false;if(p.indexOf(R.updatePrefix)===0)return false;if(p===R.desktopLauncherPrefix||p.indexOf(R.desktopLauncherPrefix+\"/\")===0)return false;if(p===R.settingsBridgePrefix||p.indexOf(R.settingsBridgePrefix+\"/\")===0)return false;if(p.indexOf(R.apiPrefix)===0)return true;if(p.indexOf(R.sidebarPrefix)===0||p===\"/sidebar\")return true;if(p.indexOf(R.gitPrefix)===0||p===\"/git\")return true;if(p.indexOf(R.petPrefix)===0||p===\"/pet\")return true;return false}function sw(p){return R.wsPaths.indexOf(p)!==-1}function rp(p){return R.remotePrefix+p}function so(u){return u.origin===loc.origin}function rr(raw){var u;try{u=new URL(raw,loc.href)}catch(e){return raw}if(u.origin!==loc.origin)return raw;if(!sf(u.pathname))return raw;u.pathname=rp(u.pathname);if(raw.charAt(0)===\"/\"&&raw.charAt(1)!==\"/\")return u.pathname+u.search+u.hash;return u.href}function uc(v){if(typeof v!==\"object\"||v===null)return undefined;var n=v.result;if(typeof n===\"object\"&&n!==null){var e=n.error;if(typeof e===\"object\"&&e!==null&&typeof e.code===\"string\")return e.code}var t=v.error;if(typeof t===\"object\"&&t!==null&&typeof t.code===\"string\")return t.code;return undefined}var seat={onUnpaired:null,onPaired:null,pendingUnpaired:false,restore:function(){}};function denied(res){if(res.status!==403)return false;return res.clone().json().then(function(b){return uc(b)===\"unpaired\"}).catch(function(){return false})}function signal(unpaired){if(unpaired){if(seat.onUnpaired)seat.onUnpaired();else seat.pendingUnpaired=true}else{seat.pendingUnpaired=false;if(seat.onPaired)seat.onPaired()}}var of=w.fetch;w.fetch=function(input,init){var raw=typeof input===\"string\"||input instanceof URL?input.toString():input.url;var url=new URL(raw,loc.href);if(so(url)&&sf(url.pathname)){var next=new URL(url);next.pathname=rp(url.pathname);var target=typeof input===\"string\"||input instanceof URL?next.toString():new Request(next,input);return Promise.resolve(of.call(w,target,att(init))).then(function(res){void Promise.resolve(denied(res)).then(signal);return res})}return of.call(w,input,init)};var OW=w.WebSocket;w.WebSocket=function(url,protocols){var p=new URL(url.toString(),loc.href);var o=p.protocol===\"wss:\"?\"https://\"+p.host:p.protocol===\"ws:\"?\"http://\"+p.host:\"\";if(o!==\"\"&&o===loc.origin&&sw(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return protocols!==undefined?new OW(nx,protocols):new OW(nx)}return protocols!==undefined?new OW(url,protocols):new OW(url)};w.WebSocket.prototype=OW.prototype;w.WebSocket.CONNECTING=OW.CONNECTING;w.WebSocket.OPEN=OW.OPEN;w.WebSocket.CLOSING=OW.CLOSING;w.WebSocket.CLOSED=OW.CLOSED;var OE=w.EventSource;if(OE!==undefined){w.EventSource=function(url,cfg){var p=new URL(url.toString(),loc.href);if(so(p)&&sf(p.pathname)){var nx=new URL(p);nx.pathname=rp(p.pathname);var dvv=rdv();if(dvv!==null)nx.searchParams.set(R.deviceQuery,dvv);return new OE(nx,cfg)}return new OE(url,cfg)};w.EventSource.prototype=OE.prototype}var restores=[];function patchSrc(C){if(C===undefined)return;var d=Object.getOwnPropertyDescriptor(C.prototype,\"src\");if(d===undefined||d.configurable===false||d.set===undefined)return;var os=d.set;Object.defineProperty(C.prototype,\"src\",{configurable:true,enumerable:d.enumerable!==false,get:d.get,set:function(v){os.call(this,rr(String(v)))}});restores.push(function(){Object.defineProperty(C.prototype,\"src\",d)})}patchSrc(w.HTMLImageElement);patchSrc(w.HTMLScriptElement);patchSrc(w.HTMLIFrameElement);seat.restore=function(){w.fetch=of;w.WebSocket=OW;if(OE!==undefined)w.EventSource=OE;for(var i=0;i<restores.length;i++)restores[i]();try{delete w[" + seat + "]}catch(e){w[" + seat + "]=undefined}};w[" + seat + "]=seat" + buildBootWatchdogScript() + "}catch(e){}})();";
+}
+/** Boot-watchdog latch: one self-reload per session while the boot is broken. */
+const BOOT_WATCHDOG_KEY = "dsh-remote-boot-reload";
+/** Total wait for the app's first conversation surface before the reload. */
+const BOOT_WATCHDOG_WAIT_MS = 15e3;
+/** Watchdog poll cadence. */
+const BOOT_WATCHDOG_POLL_MS = 1e3;
+/**
+* Build the boot-watchdog script fragment. A remote boot has no recovery
+* path of its own: the SPA mounts nothing when a boot-critical request dies
+* (a tunnel-edge 429 under burst, a dropped stream, a boot-order race), and
+* the phone then shows a permanently blank shell. The watchdog polls for the
+* app's conversation surface and reloads once when it never appears; the
+* sessionStorage latch keeps a genuinely broken deployment from looping,
+* and a successful boot clears the latch so a later failure can recover.
+*/
+function buildBootWatchdogScript(waitMs = BOOT_WATCHDOG_WAIT_MS, pollMs = BOOT_WATCHDOG_POLL_MS) {
+	const key = JSON.stringify(BOOT_WATCHDOG_KEY);
+	return ";function wBoot(){try{return !!(w.document&&w.document.querySelector&&(w.document.querySelector(\"[data-conversation-scroll]\")||w.document.querySelector(\"[data-slot=\\\"conversation\\\"]\")))}catch(e){return false}}function wTick(n){try{if(wBoot()){try{w.sessionStorage.removeItem(" + key + ")}catch(e){}return}if(n<" + waitMs + "){w.setTimeout(function(){wTick(n+" + pollMs + ")}," + pollMs + ");return}var done=false;try{done=w.sessionStorage.getItem(" + key + ")===\"1\"}catch(e){}if(done)return;try{w.sessionStorage.setItem(" + key + ",\"1\")}catch(e){}w.location.reload()}catch(e){}}if(typeof w.setTimeout===\"function\")w.setTimeout(function(){wTick(0)}," + pollMs + ");";
 }
 /** The script this plugin contributes; built once from the live rules. */
 const REMOTE_CHANNEL_BOOT_SCRIPT = buildRemoteChannelBootScript();
@@ -3809,16 +3399,15 @@ const name = "remote-web-ui";
 /** Services required before the pairing surfaces can mount. */
 const inject = [
 	"webServer",
-	"apiProxy",
-	"commands",
-	"agents"
+	"typertGateway",
+	"connection"
 ];
 /**
 * Settings namespace of the remote-control capability — the section the web
 * settings surface edits. Spelled here rather than imported: the browser
 * half spells the same value and must not depend on a Host package.
 */
-const REMOTE_WEB_UI_SETTINGS_NAMESPACE = settingsNamespace("remote-web-ui");
+const REMOTE_WEB_UI_SETTINGS_NAMESPACE = "remote-web-ui";
 const Config = z.object({
 	tokenTtlMs: z.number().step(1).min(6e4).default(10 * 6e4),
 	offlineAfterMs: z.number().step(1).min(5e3).default(25e3),
@@ -3829,7 +3418,8 @@ const Config = z.object({
 	publicBaseUrl: z.string(),
 	devicesFile: z.string(),
 	autoTunnel: z.boolean().default(false),
-	mobileEnterToSend: z.boolean().default(true),
+	lanBind: z.boolean(),
+	profile: z.string().pattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$/),
 	enabled: z.boolean().default(true)
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
@@ -3865,7 +3455,8 @@ const DEFAULTS = {
 	publicBaseUrl: void 0,
 	devicesFile: defaultDevicesFile(),
 	autoTunnel: false,
-	mobileEnterToSend: true,
+	lanBind: void 0,
+	profile: process.env.DSH_PROFILE ?? "web",
 	enabled: true
 };
 /**
@@ -3885,7 +3476,8 @@ function applyImpl(ctx, config) {
 		publicBaseUrl: config?.publicBaseUrl,
 		devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
 		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
-		mobileEnterToSend: config?.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
+		lanBind: config?.lanBind,
+		profile: config?.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
 		enabled: config?.enabled ?? DEFAULTS.enabled
 	};
 	let current = () => config ?? {};
@@ -3901,7 +3493,8 @@ function applyImpl(ctx, config) {
 			publicBaseUrl: value.publicBaseUrl,
 			devicesFile: value.devicesFile ?? DEFAULTS.devicesFile,
 			autoTunnel: value.autoTunnel ?? DEFAULTS.autoTunnel,
-			mobileEnterToSend: value.mobileEnterToSend ?? DEFAULTS.mobileEnterToSend,
+			lanBind: value.lanBind,
+			profile: value.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
 			enabled: value.enabled ?? DEFAULTS.enabled
 		};
 	};
@@ -3931,16 +3524,15 @@ function applyImpl(ctx, config) {
 	ctx.effect(() => () => {
 		tunnel.dispose();
 	}, "remote-web-ui: auto tunnel");
-	const lanBases = ctx.webServer.host === "0.0.0.0" ? lanIPv4Addresses().map((address) => ({
-		address,
-		base: `http://${address}:${String(ctx.webServer.port)}`
-	})) : [];
-	service.setLanBases(lanBases);
-	const lanAddresses = lanBases.map((entry) => entry.address);
+	if ((ctx.webServer.host === "0.0.0.0" || ctx.webServer.host === "127.0.0.1") && Number.isFinite(ctx.webServer.port)) {
+		const lanBases = ctx.webServer.host === "0.0.0.0" ? lanIPv4Addresses().map((address) => ({
+			address,
+			base: `http://${address}:${String(ctx.webServer.port)}`
+		})) : [];
+		service.setLanBases(lanBases);
+	}
 	let disposeRoutes;
 	let disposeSweep;
-	const apiProxy = ctx.get("apiProxy");
-	if (apiProxy === void 0) console.warn("remote-web-ui: apiProxy service unavailable — the mobile data channel is disabled");
 	const requireFromHost = createRequire(import.meta.url);
 	const resolveAnchorPath = () => resolveAnchorManifest((specifier) => {
 		try {
@@ -4006,45 +3598,84 @@ function applyImpl(ctx, config) {
 			});
 		}
 	});
+	let lastKnownPort;
+	let lastFirewallApplied;
+	const lanBindStatus = () => {
+		const resolvedNow = resolve();
+		let state;
+		try {
+			state = lanBindState(resolvedNow.profile);
+		} catch {
+			state = { blockPresent: false };
+		}
+		const lanOn = state.host === "0.0.0.0";
+		const port = Number.isFinite(ctx.webServer.port) ? ctx.webServer.port : lastKnownPort;
+		if (Number.isFinite(ctx.webServer.port)) lastKnownPort = ctx.webServer.port;
+		const startup = ctx.get("webStartup");
+		const desiredHost = resolvedNow.lanBind === void 0 ? void 0 : desiredBindHost(resolvedNow.lanBind === true, startup?.host);
+		return {
+			profile: resolvedNow.profile,
+			setting: resolvedNow.lanBind ?? null,
+			blockHost: state.host ?? null,
+			bindHost: ctx.webServer.host,
+			port,
+			lanUrls: ctx.webServer.host === "0.0.0.0" && port !== void 0 ? lanIPv4Addresses().map((address) => `http://${address}:${String(port)}`) : [],
+			firewall: port !== void 0 ? firewallSummary(port, lanOn) : {
+				ok: true,
+				managed: false
+			},
+			platform: process.platform,
+			pendingRestart: pendingRestartOf(resolvedNow.lanBind, desiredHost, ctx.webServer.host)
+		};
+	};
+	const innerAuth = createInnerAuth(() => {
+		if (!Number.isFinite(ctx.webServer.port)) return void 0;
+		try {
+			return ctx.connection.authenticatedUrl?.(`http://127.0.0.1:${String(ctx.webServer.port)}/`);
+		} catch {
+			return;
+		}
+	});
+	const APP_SHELL_TTL_MS = 3e4;
+	let appShellCache;
+	const fetchAppShell = async () => {
+		if (!Number.isFinite(ctx.webServer.port)) return void 0;
+		if (appShellCache !== void 0 && Date.now() - appShellCache.at < APP_SHELL_TTL_MS) return appShellCache.html;
+		const cookie = await innerAuth.ready();
+		try {
+			const response = await fetch(`http://127.0.0.1:${String(ctx.webServer.port)}/`, { headers: cookie !== void 0 ? { cookie } : void 0 });
+			if (!response.ok) return void 0;
+			const html = await response.text();
+			appShellCache = {
+				at: Date.now(),
+				html
+			};
+			return html;
+		} catch {
+			return;
+		}
+	};
 	const routes = [
 		...makeRoutes({
 			service,
-			lanAddresses,
-			requirePairingForLan: () => resolve().requirePairingForLan
+			lanAddresses: service.lanAddresses,
+			requirePairingForLan: () => resolve().requirePairingForLan,
+			lanBindStatus,
+			indexDocument: fetchAppShell
 		}),
-		...makeMobileRoutes(),
-		...apiProxy !== void 0 ? makeMobileApiRoutes({
-			service,
-			apiProxy,
-			pendingTracker: new PendingTracker(),
-			mobileEnterToSend: () => resolve().mobileEnterToSend,
-			commandDispatcher: ctx.commands !== void 0 && ctx.agents !== void 0 ? { async execute(sessionId, line, signal) {
-				const agent = ctx.agents.get(sessionId);
-				if (agent === void 0) return { error: "session-not-found" };
-				const execution = await ctx.commands.execute(agent, line, [], signal);
-				if (execution === void 0) return { error: "unknown-command" };
-				return {
-					ok: true,
-					result: execution.result
-				};
-			} } : void 0
-		}) : [],
-		...apiProxy !== void 0 ? makePairedModelCatalogRoutes({
-			service,
-			apiProxy,
-			lanAddresses
-		}) : [],
 		...makeRemoteApiRoutes({
 			service,
 			port: ctx.webServer.port,
-			requirePairingForLan: () => resolve().requirePairingForLan
+			requirePairingForLan: () => resolve().requirePairingForLan,
+			auth: innerAuth
 		}),
 		...updateRoutes
 	];
 	const upgrades = makeRemoteApiUpgradeRoutes({
 		service,
 		port: ctx.webServer.port,
-		requirePairingForLan: () => resolve().requirePairingForLan
+		requirePairingForLan: () => resolve().requirePairingForLan,
+		auth: innerAuth
 	});
 	const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
 	ctx.effect(() => ctx.on("api/gate", gate), "remote-web-ui: api gate");
@@ -4087,13 +3718,50 @@ function applyImpl(ctx, config) {
 		if (!resolve().enabled) return false;
 		return isPairedDeviceRequest(service, request);
 	});
-	if (lanAddresses.length > 0) {
-		const urls = lanAddresses.map((ip) => `http://${ip}:${String(ctx.webServer.port)}/m/`).join(" , ");
-		console.log(`remote-web-ui: mobile UI reachable on LAN at ${urls}`);
+	const presencePet = startRemotePresencePet({
+		onState: (listener) => service.onState(listener),
+		pet: () => {
+			try {
+				return ctx.get("pet");
+			} catch {
+				return;
+			}
+		}
+	});
+	ctx.effect(() => presencePet, "remote-web-ui: remote-presence pet visibility");
+	if (service.lanAddresses.length > 0) {
+		const urls = service.lanAddresses.map((ip) => `http://${ip}:${String(ctx.webServer.port)}`).join(" , ");
+		console.log(`remote-web-ui: the paired Web GUI is reachable on LAN at ${urls}`);
 	}
+	if (ctx.webServer.host === "0.0.0.0") console.warn("remote-web-ui: LAN-exposed bind — pairing gates the /remote channel; direct /api stays under the harness fence + browser auth (stop() does not revoke an already-redeemed browser credential)");
 	const sync = () => {
 		const value = resolve();
 		service.config = pairingConfigOf(value);
+		if (value.lanBind !== void 0) {
+			const startup = ctx.get("webStartup");
+			const desiredHost = desiredBindHost(value.lanBind === true, startup?.host);
+			const desiredPort = desiredBindPort(startup?.port, Number.isFinite(ctx.webServer.port) ? ctx.webServer.port : void 0);
+			if (desiredPort === void 0) console.error("remote-web-ui: cannot assert the lan-bind block — the web server port is not known yet");
+			else try {
+				const current = lanBindState(value.profile);
+				if (current.host !== desiredHost || current.port !== desiredPort) {
+					writeLanBind(desiredHost, desiredPort, value.profile);
+					console.log(`remote-web-ui: lan-bind block written for profile ${value.profile} (${desiredHost}:${String(desiredPort)}); it takes effect when the profile next applies (the card reports pendingRestart until the running bind follows)`);
+				}
+			} catch (error) {
+				console.error(`remote-web-ui: failed to write the lan-bind block: ${error instanceof Error ? error.message : String(error)}`);
+			}
+			const livePort = Number.isFinite(ctx.webServer.port) ? ctx.webServer.port : void 0;
+			if (livePort === void 0) console.error("remote-web-ui: cannot align the host firewall rule — the web server port is not known yet");
+			else {
+				const nextFirewall = {
+					enabled: value.lanBind === true,
+					port: livePort
+				};
+				if (firewallActionNeeded(lastFirewallApplied, nextFirewall)) if (nextFirewall.enabled ? ensureFirewallRule(nextFirewall.port) : removeFirewallRule(nextFirewall.port)) lastFirewallApplied = nextFirewall;
+				else console.error("remote-web-ui: the host firewall rule could not be updated (admin rights required on managed platforms)");
+			}
+		}
 		autoTunnel = value.autoTunnel === true;
 		if (autoTunnel) {
 			if (value.publicBaseUrl !== void 0) console.warn("remote-web-ui: autoTunnel is on — ignoring the manually configured publicBaseUrl");
@@ -4118,7 +3786,7 @@ function applyImpl(ctx, config) {
 			disposeRoutes = void 0;
 		}
 		if (disposeSweep === void 0 && enabled) disposeSweep = ctx.effect(() => {
-			const timer = setInterval$1(() => {
+			const timer = setInterval(() => {
 				service.sweep();
 			}, SWEEP_INTERVAL_MS);
 			timer.unref();
@@ -4148,12 +3816,14 @@ function applyImpl(ctx, config) {
 			text: REMOTE_CHANNEL_BOOT_SCRIPT
 		});
 	}), "remote-web-ui: remote channel boot patch");
-	installSettingsSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
-		setSource: (source) => {
-			current = source;
-			sync();
-		},
-		onChange: sync
+	ctx.inject(["settings"], (settingsCtx) => {
+		settingsCtx.settings.installSection(ctx, REMOTE_WEB_UI_SETTINGS_NAMESPACE, Config, config ?? {}, {
+			setSource: (source) => {
+				current = source;
+				sync();
+			},
+			onChange: sync
+		});
 	});
 	sync();
 }