@linxin666/dsh-remote-web-ui 0.4.0 → 0.4.2

package/lib/types/lan-bind.js

@@ -20,6 +20,7 @@
  */
 import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve, sep } from 'node:path';
+import { parseDocument } from 'yaml';
 import { dshHome } from "./dsh-home.js";
 /** Profile names safe to interpolate into the patch path: one path segment, no traversal. */
 const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -59,6 +60,64 @@ export function stripManagedBlock(content) {
     const pattern = new RegExp(`\\r?\\n?${begin}[\\s\\S]*?${end}\\r?\\n?`, 'g');
     return content.replace(pattern, '\n');
 }
+/**
+ * Render the managed block for one bind state. The values are static: the
+ * user patch layer has no reliable lazy service evaluation, and the plugin
+ * re-asserts the block at every boot so CLI flags (--port, --host) win by
+ * rewriting it before the next start.
+ */
+/**
+ * Whether the base opens a flow collection at the root. That is the shape the
+ * plugin manager's YAML document round-trip leaves behind when it appends rows
+ * to the profile's placeholder `[]`: `[ { id: … }, … ]`. Every other base
+ * (empty, block sequence, comment-only prefix) keeps the historical string
+ * concatenation, so the common paths stay byte-identical.
+ */
+function isFlowRoot(base) {
+    return base.trimStart().startsWith('[');
+}
+/** Force one parsed collection (and its item collections) into block style. */
+function toBlockStyle(node) {
+    if (typeof node !== 'object' || node === null)
+        return;
+    const collection = node;
+    if (!Array.isArray(collection.items) && typeof collection.flow !== 'boolean')
+        return;
+    collection.flow = false;
+    for (const item of collection.items ?? [])
+        toBlockStyle(item);
+}
+/** Plain-value view of one parsed node (YAML nodes keep their own accessors). */
+function plainOf(node) {
+    if (typeof node !== 'object' || node === null)
+        return node;
+    const json = node.toJSON;
+    return typeof json === 'function' ? json.call(node) : node;
+}
+/**
+ * Produce the file text for one bind state. A flow-style base is re-emitted as
+ * a block sequence before the managed block is appended, so the file stays
+ * exactly one valid YAML document; concatenating the block onto a non-empty
+ * flow array produced two root documents and the profile failed to parse at
+ * `dsh web` startup (#1675). A base that cannot be parsed is refused with the
+ * file path rather than written half-valid.
+ */
+function mergePatchContent(base, block, file) {
+    if (base.length === 0)
+        return block;
+    if (!isFlowRoot(base))
+        return `${base}\n\n${block}`;
+    const doc = parseDocument(base, { uniqueKeys: false });
+    if (doc.errors.length > 0 || doc.contents === null) {
+        throw new Error(`remote-web-ui: cannot update the lan-bind block in ${file}: ${doc.errors[0]?.message ?? 'the patch file is not a YAML document'}`);
+    }
+    if (!('items' in doc.contents)) {
+        throw new Error(`remote-web-ui: cannot update the lan-bind block in ${file}: the patch file is not a top-level patch list`);
+    }
+    toBlockStyle(doc.contents);
+    const rendered = doc.toString({ lineWidth: 0 }).trimEnd();
+    return `${rendered}\n\n${block}`;
+}
 /**
  * Render the managed block for one bind state. The values are static: the
  * user patch layer has no reliable lazy service evaluation, and the plugin
@@ -113,6 +172,10 @@ export function lanBindState(profile, home = dshHome()) {
  * unterminated block (BEGIN marker without END, which stripManagedBlock
  * cannot match) is truncated at its BEGIN marker first so the rewrite can
  * never stack a second webserver row onto the orphan.
+ *
+ * The written file is always exactly one valid YAML document: a base the
+ * plugin manager left in flow style is re-emitted as a block sequence before
+ * the managed block is appended (see mergePatchContent).
  */
 export function writeLanBind(host, port, profile, home = dshHome()) {
     const file = profilePatchFile(profile, home);
@@ -121,7 +184,7 @@ export function writeLanBind(host, port, profile, home = dshHome()) {
     const rawBase = (orphanBegin === -1 ? stripped : stripped.slice(0, orphanBegin)).trimEnd();
     const base = rawBase.replace(/\[\s*\]\s*$/, '').trimEnd();
     const block = managedBlock(host, port);
-    const content = base.length > 0 ? `${base}\n\n${block}` : block;
+    const content = mergePatchContent(base, block, file);
     const mode = existsSync(file) ? statSync(file).mode & 0o777 : 0o600;
     mkdirSync(dirname(file), { recursive: true });
     const temp = `${file}.remote-web-ui-tmp-${process.pid.toString(36)}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;

package/lib/types/pairing.d.ts

@@ -219,10 +219,16 @@ export declare class PairingService {
      * Restore device sessions persisted by a previous process run. A corrupt
      * or missing file is tolerated (an empty device table, never a throw) —
      * persistence is an availability convenience, not a security boundary.
+     *
+     * Every still-valid session is restored, deliberately without applying
+     * `maxDevices`: the constructor runs with whatever cap the configuration
+     * layer has delivered so far (the schema default until the saved settings
+     * row is applied), and trimming here would permanently drop authorizations
+     * the user never revoked — the trimmed table reaches disk on the next
+     * heartbeat/sweep write. The cap is enforced where a device is admitted
+     * (see `accept`), against the configuration in force at that moment.
      */
     private loadPersisted;
-    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
-    private clampToMaxDevices;
     /** Drop sessions whose lastSeenAt is older than idleExpireMs. */
     private evictIdle;
     /**
@@ -339,6 +345,13 @@ export declare class PairingService {
     snapshot(): PairingSnapshot;
     /** Whether a cookie value names a currently live (non-idle) device session. */
     hasDevice(deviceId: string): boolean;
+    /**
+     * Number of device sessions in the table, including idle ones whose idle
+     * window has not been swept yet. Restore keeps every persisted session
+     * (see `loadPersisted`), so this can exceed the configured cap until the
+     * next `accept` trims the excess.
+     */
+    deviceCount(): number;
     /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
     onState(listener: (snapshot: PairingSnapshot) => void): () => void;
     private activeToken;

package/lib/types/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAElC,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IA1BrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAClC,EAAE,GAAE,cAAmB;IAK1C;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAkBf;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAazB,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnF;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA0BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAOb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAElC,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IA1BrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAClC,EAAE,GAAE,cAAmB;IAK1C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,aAAa;IA4BrB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAkBf;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAazB,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnF;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA+BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAOb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,WAAW,IAAI,MAAM;IAIrB,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}

package/lib/types/pairing.js

@@ -95,6 +95,14 @@ export class PairingService {
      * Restore device sessions persisted by a previous process run. A corrupt
      * or missing file is tolerated (an empty device table, never a throw) —
      * persistence is an availability convenience, not a security boundary.
+     *
+     * Every still-valid session is restored, deliberately without applying
+     * `maxDevices`: the constructor runs with whatever cap the configuration
+     * layer has delivered so far (the schema default until the saved settings
+     * row is applied), and trimming here would permanently drop authorizations
+     * the user never revoked — the trimmed table reaches disk on the next
+     * heartbeat/sweep write. The cap is enforced where a device is admitted
+     * (see `accept`), against the configuration in force at that moment.
      */
     loadPersisted() {
         const file = this.config.devicesFile;
@@ -119,7 +127,6 @@ export class PairingService {
                     ...(label !== undefined ? { userAgent: label } : {}),
                 });
             }
-            this.clampToMaxDevices();
             if (this.evictIdle())
                 this.persistRevocation();
         }
@@ -127,15 +134,6 @@ export class PairingService {
             // Unreadable/corrupt: start empty rather than refusing to boot.
         }
     }
-    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
-    clampToMaxDevices() {
-        if (this.devices.size <= this.config.maxDevices)
-            return;
-        const overflow = this.devices.size - this.config.maxDevices;
-        const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-        for (const [id] of ordered.slice(0, overflow))
-            this.devices.delete(id);
-    }
     /** Drop sessions whose lastSeenAt is older than idleExpireMs. */
     evictIdle() {
         const now = this.clock.now();
@@ -302,15 +300,20 @@ export class PairingService {
         }
         const deviceId = this.clock.randomToken();
         const now = this.clock.now();
-        if (this.devices.size >= this.config.maxDevices) {
-            // Evict the oldest session (FIFO) before binding a new device.
+        // FIFO-evict until a slot is free. The loop (not a single delete) covers a
+        // table that is already over the cap: restore keeps every persisted session
+        // (see loadPersisted), so the excess is collected here, once the store is
+        // actually asked to admit a new device, rather than at startup on a cap the
+        // configuration may not have delivered yet.
+        while (this.devices.size >= this.config.maxDevices) {
             let oldest;
             for (const [id, session] of this.devices) {
                 if (oldest === undefined || session.createdAt < oldest.createdAt)
                     oldest = { id, createdAt: session.createdAt };
             }
-            if (oldest !== undefined)
-                this.devices.delete(oldest.id);
+            if (oldest === undefined)
+                break;
+            this.devices.delete(oldest.id);
         }
         const label = sanitizeUserAgent(userAgent);
         this.devices.set(deviceId, {
@@ -414,6 +417,15 @@ export class PairingService {
     hasDevice(deviceId) {
         return this.liveSession(deviceId) !== undefined;
     }
+    /**
+     * Number of device sessions in the table, including idle ones whose idle
+     * window has not been swept yet. Restore keeps every persisted session
+     * (see `loadPersisted`), so this can exceed the configured cap until the
+     * next `accept` trims the excess.
+     */
+    deviceCount() {
+        return this.devices.size;
+    }
     /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
     onState(listener) {
         this.listeners.add(listener);

package/lib/types/pairing.persist.test.js

@@ -86,17 +86,57 @@ describe('PairingService device persistence', () => {
         const restarted = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock());
         expect(restarted.hasDevice(deviceId)).toBe(true);
     });
-    it('clamps a persisted table to maxDevices when the file holds more sessions', () => {
+    // #1696: the constructor runs before the saved settings row is applied, so
+    // its cap can still be the schema default. Restoring must not enforce it —
+    // trimming there silently revokes authorizations the user never revoked,
+    // and the trimmed table reaches disk on the next heartbeat/sweep write.
+    it('operator: every valid persisted session survives a restart under the startup cap', () => {
         const file = join(dir, 'devices.json');
+        // Given a store holding three devices while the startup cap reads 4
+        // (the schema default) and the saved settings value is 12.
         writeFileSync(file, JSON.stringify({
             dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
             dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
             dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
         }));
-        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock());
-        expect(service.hasDevice('dev3')).toBe(true);
+        // When a new process restores the store.
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 4, devicesFile: file }, makeClock());
+        // Then no paired device lost its authorization to the transient cap.
+        expect(service.hasDevice('dev1')).toBe(true);
         expect(service.hasDevice('dev2')).toBe(true);
+        expect(service.hasDevice('dev3')).toBe(true);
+    });
+    it('operator: a restored over-cap table is not trimmed by a heartbeat and sweep', () => {
+        const file = join(dir, 'devices.json');
+        // Given twelve persisted devices restored under the default cap of 4.
+        const rows = Object.fromEntries(Array.from({ length: 12 }, (_, i) => [`dev${i}`, { createdAt: 1_000 + i, lastSeenAt: 1_000 + i }]));
+        writeFileSync(file, JSON.stringify(rows));
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 4, devicesFile: file }, makeClock());
+        // When the saved cap of 12 arrives and normal traffic writes the store.
+        service.config = { ...service.config, maxDevices: 12 };
+        service.heartbeat('dev0');
+        service.sweep();
+        // Then the file still names all twelve devices.
+        const persisted = JSON.parse(readFileSync(file, 'utf8'));
+        expect(Object.keys(persisted)).toHaveLength(12);
+        expect(service.deviceCount()).toBe(12);
+    });
+    it('operator: the cap is enforced when a device is admitted, not before', () => {
+        const file = join(dir, 'devices.json');
+        // Given three persisted devices restored under a cap of 2.
+        writeFileSync(file, JSON.stringify({
+            dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
+            dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
+            dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
+        }));
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock());
+        expect(service.deviceCount()).toBe(3);
+        // When one more device pairs.
+        const paired = pairDevice(service);
+        // Then the table is trimmed to the cap, oldest first, keeping the newcomer.
+        expect(service.deviceCount()).toBe(2);
         expect(service.hasDevice('dev1')).toBe(false);
+        expect(service.hasDevice(paired)).toBe(true);
     });
     it('keeps sessions memory-only when devicesFile is unset', () => {
         const first = new PairingService({ ...BASE_CONFIG }, makeClock());

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAwJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAkKrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -43,10 +43,20 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
     return '(function(){' +
         'try{' +
         'var w=window,loc=w.location,h=loc.hostname;' +
-        // Loopback origins (including the bracketed IPv6 literal WHATWG returns)
-        // keep the original paths (mirrors isLoopbackHostname).
-        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
         'var R=' + json + ';' +
+        // A page the machine itself serves keeps the original paths and no
+        // channel: loopback names (including the bracketed IPv6 literal WHATWG
+        // returns), any scheme no web transport carries (an application on this
+        // machine delivered it - the desktop shell's own scheme, a file page, a
+        // scheme a newer shell introduces), or a shell the official transport
+        // already declared the host owner. This mirrors isLocalPage in
+        // remote-channel-rules.ts, which owns the decision.
+        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
+        'var pr=loc.protocol;' +
+        'if(typeof pr==="string"&&pr!==""&&R.webProtocols.indexOf(pr)===-1)return;' +
+        // ownsHost alone does not lift the fence: the plugin's own device-gated
+        // landing grants it to a paired LAN/tunnel page, which must stay gated.
+        'try{if(w.__DSH_TRANSPORT__&&w.__DSH_TRANSPORT__.ownsHost===true&&h.indexOf(".")===-1&&h.indexOf(":")===-1)return}catch(e){}' +
         // Host mode is server-granted: only the device-gated app landing
         // publishes the grant marker (in a capture script that runs ahead of
         // this one), so a shell that merely sits on a non-loopback origin - an

package/lib/types/remote-channel-rules.d.ts

@@ -8,6 +8,73 @@
 /** The gated mirror prefix (must match src/remote-methods.ts). */
 export declare const REMOTE_PREFIX = "/remote";
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from './remote-methods.ts';
+/**
+ * The schemes that can deliver a page a remote party controls: the network
+ * transports, plus the documents a network page can mint. Every other scheme
+ * is registered and served by an application on this machine, so its page is
+ * the machine's own page whatever the application calls the scheme.
+ *
+ * The list is deliberately the *web* side rather than an allowlist of known
+ * desktop shells. The official DSH Desktop shell serves its Web GUI from
+ * `dsh-app://app/` (`location.hostname === 'app'`), which no hostname
+ * predicate can recognise; a scheme allowlist fixed that instance (#1682) but
+ * left the next shell — or a `file:` page — fenced behind a pairing page it
+ * can never complete, because a pairing link is reachable only over the
+ * network. Naming the web side instead makes an unknown application scheme
+ * local by construction.
+ *
+ * `blob:`, `data:`, `about:` and `filesystem:` stay on the web side: a
+ * network page mints those documents, so they must keep the fence.
+ */
+export declare const WEB_PAGE_PROTOCOLS: readonly string[];
+/**
+ * Whether one page scheme can carry a document a remote party controls.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @returns true for the network transports and the documents they mint.
+ */
+export declare function isWebPageProtocol(protocol: string): boolean;
+/**
+ * Hostname-only loopback classification: localhost, the IPv6 loopback literal
+ * (WHATWG keeps its brackets) and any 127/8 IPv4 literal. Kept string-in,
+ * boolean-out and dependency-free so the browser half and the inlined boot
+ * script can both run it verbatim.
+ * @param hostname - a page/cookie hostname, IPv6 literals bracketed.
+ * @returns true for a loopback name or literal.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether the current page is served from the machine running the host, so
+ * its same-origin traffic must NOT be fenced behind the pairing channel.
+ * Three independent facts all describe the page itself and any one is enough:
+ *
+ * - the page's own hostname is loopback;
+ * - the page's protocol is not a {@link WEB_PAGE_PROTOCOLS} web scheme, so an
+ *   application on this machine delivered it — the desktop shell's
+ *   `dsh-app://app/` is one such page, and a scheme this build has never
+ *   heard of is another;
+ * - the official connection transport already declared this shell the host
+ *   owner (`__DSH_TRANSPORT__.ownsHost === true`) AND the page is not a
+ *   network origin. The official client reads the same hook to derive
+ *   `connection.isLoopback`, and the desktop shell sets it before any boot
+ *   entry — without this term the plugin's predicate contradicts the host's
+ *   own conclusion (#1682). The network-origin guard is deliberate: this
+ *   plugin's own device-gated landing (a LAN or tunnel page) publishes the
+ *   same hook to grant a paired remote the full UI, and that page must keep
+ *   riding the gated channel — `ownsHost` buys the presentation, never an
+ *   exemption from the pairing fence.
+ *
+ * The order matters: loopback is checked first so a loopback page keeps its
+ * exemption even on a scheme no list carries, and the scheme test runs before
+ * the hook test so a web page always reaches the network-origin guard. A
+ * missing or empty scheme is not evidence of a local page - the fence stays
+ * up - because a real document always reports its own scheme.
+ *
+ * @param hostname - `location.hostname` of the page.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @param transportOwnsHost - `__DSH_TRANSPORT__?.ownsHost` as read by the caller.
+ * @returns true when the page is local and needs no remote channel.
+ */
+export declare function isLocalPage(hostname: string, protocol?: string, transportOwnsHost?: boolean): boolean;
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export declare const REMOTE_API_PREFIX = "/remote/api";
@@ -38,6 +105,13 @@ export interface RemoteChannelRules {
     readonly uploadPath: string;
     /** Page global the pre-Cordis upload hook is published under. */
     readonly uploadHookGlobal: string;
+    /**
+     * Schemes that can carry a remotely controlled document (see
+     * WEB_PAGE_PROTOCOLS): a page on any other scheme is delivered by an
+     * application on this machine. Carried in the rules so the inlined boot
+     * script applies the same list.
+     */
+    readonly webProtocols: readonly string[];
     /**
      * Page global carrying the server-issued host-mode grant. Only the plugin's
      * own device-gated app landing (/pair-app) publishes it; the boot patch

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAyBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,OAAO,GAAG,OAAO,CAQrG;AAeD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBA0BlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -8,6 +8,109 @@
 /** The gated mirror prefix (must match src/remote-methods.ts). */
 export const REMOTE_PREFIX = '/remote';
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from "./remote-methods.js";
+/**
+ * The schemes that can deliver a page a remote party controls: the network
+ * transports, plus the documents a network page can mint. Every other scheme
+ * is registered and served by an application on this machine, so its page is
+ * the machine's own page whatever the application calls the scheme.
+ *
+ * The list is deliberately the *web* side rather than an allowlist of known
+ * desktop shells. The official DSH Desktop shell serves its Web GUI from
+ * `dsh-app://app/` (`location.hostname === 'app'`), which no hostname
+ * predicate can recognise; a scheme allowlist fixed that instance (#1682) but
+ * left the next shell — or a `file:` page — fenced behind a pairing page it
+ * can never complete, because a pairing link is reachable only over the
+ * network. Naming the web side instead makes an unknown application scheme
+ * local by construction.
+ *
+ * `blob:`, `data:`, `about:` and `filesystem:` stay on the web side: a
+ * network page mints those documents, so they must keep the fence.
+ */
+export const WEB_PAGE_PROTOCOLS = [
+    'http:',
+    'https:',
+    'blob:',
+    'data:',
+    'about:',
+    'filesystem:',
+];
+/**
+ * Whether one page scheme can carry a document a remote party controls.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @returns true for the network transports and the documents they mint.
+ */
+export function isWebPageProtocol(protocol) {
+    return WEB_PAGE_PROTOCOLS.includes(protocol);
+}
+/**
+ * Hostname-only loopback classification: localhost, the IPv6 loopback literal
+ * (WHATWG keeps its brackets) and any 127/8 IPv4 literal. Kept string-in,
+ * boolean-out and dependency-free so the browser half and the inlined boot
+ * script can both run it verbatim.
+ * @param hostname - a page/cookie hostname, IPv6 literals bracketed.
+ * @returns true for a loopback name or literal.
+ */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '::1' || hostname === '[::1]')
+        return true;
+    const parts = hostname.split('.');
+    return parts.length === 4 && parts[0] === '127' && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/**
+ * Whether the current page is served from the machine running the host, so
+ * its same-origin traffic must NOT be fenced behind the pairing channel.
+ * Three independent facts all describe the page itself and any one is enough:
+ *
+ * - the page's own hostname is loopback;
+ * - the page's protocol is not a {@link WEB_PAGE_PROTOCOLS} web scheme, so an
+ *   application on this machine delivered it — the desktop shell's
+ *   `dsh-app://app/` is one such page, and a scheme this build has never
+ *   heard of is another;
+ * - the official connection transport already declared this shell the host
+ *   owner (`__DSH_TRANSPORT__.ownsHost === true`) AND the page is not a
+ *   network origin. The official client reads the same hook to derive
+ *   `connection.isLoopback`, and the desktop shell sets it before any boot
+ *   entry — without this term the plugin's predicate contradicts the host's
+ *   own conclusion (#1682). The network-origin guard is deliberate: this
+ *   plugin's own device-gated landing (a LAN or tunnel page) publishes the
+ *   same hook to grant a paired remote the full UI, and that page must keep
+ *   riding the gated channel — `ownsHost` buys the presentation, never an
+ *   exemption from the pairing fence.
+ *
+ * The order matters: loopback is checked first so a loopback page keeps its
+ * exemption even on a scheme no list carries, and the scheme test runs before
+ * the hook test so a web page always reaches the network-origin guard. A
+ * missing or empty scheme is not evidence of a local page - the fence stays
+ * up - because a real document always reports its own scheme.
+ *
+ * @param hostname - `location.hostname` of the page.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @param transportOwnsHost - `__DSH_TRANSPORT__?.ownsHost` as read by the caller.
+ * @returns true when the page is local and needs no remote channel.
+ */
+export function isLocalPage(hostname, protocol, transportOwnsHost) {
+    if (isLoopbackHostname(hostname))
+        return true;
+    // A missing or empty scheme is not evidence of a local page: a real
+    // document always reports one, so the fence stays up when it is unreadable.
+    if (protocol !== undefined && protocol !== '' && !isWebPageProtocol(protocol))
+        return true;
+    // A granted remote also sets ownsHost; only a page whose own origin is
+    // otherwise local may treat the hook as proof of a local page.
+    return transportOwnsHost === true && !isNetworkOrigin(hostname);
+}
+/**
+ * Whether a hostname can only be reached across a network, so a page on it is
+ * remote whatever transport hook it carries: any IPv4/IPv6 literal (a dot or a
+ * colon) or any dotted DNS name. A hostname with no dot and no colon is a
+ * scheme-local authority (the desktop shell's `app`), which is why this test,
+ * not a loopback test, is what the `ownsHost` term is gated on.
+ * @param hostname - the page hostname.
+ * @returns true when the page cannot be the machine's own local page.
+ */
+function isNetworkOrigin(hostname) {
+    return hostname.includes('.') || hostname.includes(':');
+}
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
@@ -42,6 +145,7 @@ export const REMOTE_CHANNEL_RULES = {
     deviceQuery: REMOTE_DEVICE_QUERY,
     uploadPath: '/api/session/uploadFileBinary',
     uploadHookGlobal: '__DSH_FILE_UPLOAD__',
+    webProtocols: WEB_PAGE_PROTOCOLS,
     hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL,
 };
 /** The window global the boot patch publishes its seat under. */

package/lib/types/update.d.ts

@@ -149,6 +149,16 @@ export declare function resolveUpdateTarget(deps: {
 };
 /** Family children of the anchor: its dependencies under the family scope. */
 export declare function familyChildren(anchorManifest: Record<string, unknown>): string[];
+/** Concurrent registry probes in flight for one update-status call. */
+export declare const UPDATE_PROBE_CONCURRENCY = 4;
+/**
+ * Probe every package's latest version with a bounded number of requests in
+ * flight, preserving the caller's order in the result.
+ * @param names - package names to probe.
+ * @param fetchLatest - the probe for one package (returns undefined on failure).
+ * @returns one result per name, in the input order.
+ */
+export declare function probeLatestVersions(names: readonly string[], fetchLatest: (name: string) => Promise<string | undefined>): Promise<(string | undefined)[]>;
 /**
  * Probe the npm registry for one package's latest release.
  * @param name - the package name (scope slash URL-encoded).

package/lib/types/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAI1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,iEAAiE;AACjE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAE1D,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAQrD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAcD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,6EAA6E;IAC7E,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAoBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAiBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAClG,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AA8CD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAMnG;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAS,EAC1G,SAAS,SAAS,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqBzC;AA4BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CA4D/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;AAaD,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;AAgCpE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmKvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAI1C,iDAAiD;AACjD,eAAO,MAAM,YAAY,+BAA+B,CAAA;AAExD,iEAAiE;AACjE,eAAO,MAAM,YAAY,gBAAgB,CAAA;AAEzC,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAEzD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,iCAAiC,CAAA;AAE1D,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAQrD,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,2DAA2D;IAC3D,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CASlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA2B5D;AAYD,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,kBAAkB,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAahF;AAED,6DAA6D;AAC7D,KAAK,cAAc,GAAG,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAA;AAE9D,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAG1D;AAcD,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,kBAAkB;IACjC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uBAAuB;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,4BAA4B;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IAChC,sCAAsC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qDAAqD;IACrD,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAA;IACjB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC9C,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACtD,6EAA6E;IAC7E,iBAAiB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;CAC7E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpC,YAAY,GAAG;IAAE,KAAK,EAAE,WAAW,GAAG,MAAM,CAAA;CAAE,CAoBhD;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAQhF;AAiBD,uEAAuE;AACvE,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GACzD,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAajC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,EAClG,SAAS,SAAS,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AA8CD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAMnG;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAS,EAC1G,SAAS,SAAS,GACjB,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAqBzC;AA4BD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAiE/E;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe;AACzB,2BAA2B;AACzB,cAAc;AAChB,6CAA6C;GAC3C,SAAS;AACX,2CAA2C;GACzC,WAAW;AACb,iEAAiE;GAC/D,MAAM;AACR,4BAA4B;GAC1B,aAAa;AACf,6DAA6D;GAC3D,OAAO;AACT,iFAAiF;GAC/E,eAAe,CAAA;AAEnB,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAA;IACd,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,eAAe,CAAA;CAC5B;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,sCAAsC;IACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACpB;AAaD,iEAAiE;AACjE,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,KAAK,IAAI,CAAA;AAgCpE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmKvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,GAAG,EAAE,aAAa,CAAA;IAClB,8DAA8D;IAC9D,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgE7F"}

package/lib/types/update.js

@@ -219,6 +219,30 @@ function familyUpdatePackages(anchor, anchorManifest, profileManifest) {
     }
     return [...names];
 }
+/** Concurrent registry probes in flight for one update-status call. */
+export const UPDATE_PROBE_CONCURRENCY = 4;
+/**
+ * Probe every package's latest version with a bounded number of requests in
+ * flight, preserving the caller's order in the result.
+ * @param names - package names to probe.
+ * @param fetchLatest - the probe for one package (returns undefined on failure).
+ * @returns one result per name, in the input order.
+ */
+export async function probeLatestVersions(names, fetchLatest) {
+    const results = new Array(names.length);
+    let next = 0;
+    const worker = async () => {
+        for (;;) {
+            const index = next++;
+            if (index >= names.length)
+                return;
+            results[index] = await fetchLatest(names[index]);
+        }
+    };
+    const workers = Math.min(UPDATE_PROBE_CONCURRENCY, names.length);
+    await Promise.all(Array.from({ length: workers }, () => worker()));
+    return results;
+}
 /**
  * Probe the npm registry for one package's latest release.
  * @param name - the package name (scope slash URL-encoded).
@@ -390,9 +414,14 @@ export async function checkUpdates(deps) {
     // aggregate) still check every installed @linxin666/* plugin (#377);
     // familyUpdatePackages skips link:/file: development dependencies.
     const names = familyUpdatePackages(anchor, manifest, profileManifest);
-    // The registry probes are independent: run them together instead of
-    // serializing up to N x 10s of registry latency behind one status call.
-    const latestList = await Promise.all(names.map(name => deps.fetchLatest(name)));
+    // The registry probes are independent, so they run concurrently — but with a
+    // small ceiling rather than all at once. A full install fans out ~20 probes,
+    // and on hosts behind an application-aware security middlebox that burst is
+    // what gets the node process's outbound connections throttled (the update
+    // check itself only ever loses latency: one probe is 10s-bounded and a
+    // failure is shown as a probe failure). Four keeps the status call quick
+    // while staying inside the concurrency such a middlebox tolerates (#1677).
+    const latestList = await probeLatestVersions(names, deps.fetchLatest);
     const packages = [];
     let probeFailures = 0;
     names.forEach((name, index) => {