@linxin666/dsh-remote-web-ui 0.4.1 → 0.4.3

package/lib/types/mount-once.js

@@ -5,38 +5,122 @@
  * the loader accepts a standalone install of the same package side by side;
  * without this guard the second instance would still re-register the same
  * webserver routes, tools, settings namespaces, and system-prompt sections
- * and fail the boot. mountOnce makes the second host apply a no-op for the
- * lifetime of the first instance (the browser half is already deduped by
- * package name in the client module host).
+ * and fail the boot. mountOnce makes a mount of an already-mounted package a
+ * no-op for as long as the first instance lives (the browser half is already
+ * deduped by package name in the client module host).
+ *
+ * A no-op is only safe while the holder is ALIVE. The holder can be disposed
+ * long after the refused mount ran its course: the Host reloads a profile by
+ * creating the new loader entries before the old ones are torn down (a
+ * plugin-manager enable/disable/install write, a settings-driven row reload,
+ * HMR), so the new aggregate shell entry mounts its family plugin while the
+ * previous entry still owns the name. Dropping that refused mount lost the
+ * plugin for good - the previous entry then disposed its own mount, releasing
+ * the name with nobody left to take it, and the family row stayed listed as
+ * active while its host routes 404ed (the task-board panel showed
+ * "board.hostError.notMounted", no degraded record appeared, and only a Host
+ * restart recovered it).
+ *
+ * The refused mount is therefore QUEUED, not dropped, and replayed the moment
+ * the holder releases the name - if the waiting fiber is still alive then. The
+ * single-instance guarantee is unchanged: exactly one mount is live per
+ * package name, and the replay re-enters the guard so a later mount still
+ * dedupes against it.
  *
  * The registry rides a global symbol so two module instances of the same
- * package (npm copy vs repository link) still share one verdict. cordis
- * `ctx.effect` runs its callback immediately and treats the callback's
+ * package (npm copy vs repository link) still share one verdict. That symbol
+ * is a CROSS-REPOSITORY contract, not this file's private state: the four
+ * satellite packages (dsh-skins / dsh-pet / dsh-presets /
+ * dsh-community-plugins) are separate repositories carrying their own copy of
+ * this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+ * must keep the shape every published copy reads (a `Set` of package names
+ * with `has`/`add`/`delete`). The wait queues this guard added therefore live
+ * under their own additive key, and the registry reads back a `Set` even when
+ * some other build left a different value there. Changing `MOUNTED`'s shape
+ * in place broke that contract once: a satellite's legacy copy created a
+ * `Set`, the family's new copy read it as a `Map`, and every family row
+ * mounted after it failed with "claims.get is not a function".
+ *
+ * cordis `ctx.effect` runs its callback immediately and treats the callback's
  * return value as the fiber disposer, so the unmarker is returned, not run.
  */
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for('dsh-web.mounted-plugins');
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for('dsh-web.mounted-plugins.waiters');
+/**
+ * The shared name registry, always a `Set` whatever another build stored here:
+ * a foreign value (an interim shape, a hand-written global) must not take every
+ * family plugin down with it.
+ * @returns the process-wide set of mounted package names.
+ */
 function mountedSet() {
     const registry = globalThis;
-    return (registry[MOUNTED] ??= new Set());
+    const existing = registry[MOUNTED];
+    if (existing instanceof Set)
+        return existing;
+    const created = new Set();
+    registry[MOUNTED] = created;
+    return created;
+}
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters() {
+    const registry = globalThis;
+    return (registry[WAITERS] ??= new Map());
 }
 /**
  * Wrap a cordis plugin apply so the package runs at most once per process.
- * The first mount registers normally and unmarks when its fiber disposes;
- * any later mount of the same package name is a no-op.
+ * The first mount registers normally and releases the name when its fiber
+ * disposes; a mount refused while that name is held waits for the release and
+ * then runs, unless its own fiber disposes first.
  * @param packageName - npm package identity shared by every install source.
  * @param fn - the original plugin apply.
  * @returns an apply of the same shape.
  */
 export function mountOnce(packageName, fn) {
-    return ((...args) => {
+    const mount = (...args) => {
         const mounted = mountedSet();
-        if (mounted.has(packageName))
+        const ctx = args[0];
+        if (mounted.has(packageName)) {
+            // Another fiber (the aggregate row, a standalone install, or a copy built
+            // from an older revision of this guard) owns the name. Queue instead of
+            // dropping: dropping lost the plugin for the rest of the process when the
+            // holder was disposed by a reload.
+            const waiters = mountWaiters();
+            const queue = waiters.get(packageName) ?? [];
+            let alive = true;
+            const pending = {
+                run: () => {
+                    if (alive)
+                        mount(...args);
+                },
+            };
+            // A fiber that dies while it waits must not be replayed afterwards: its
+            // context is disposed and registering effects on it would throw.
+            ctx?.effect?.(() => () => {
+                alive = false;
+                const index = queue.indexOf(pending);
+                if (index >= 0)
+                    queue.splice(index, 1);
+            });
+            queue.push(pending);
+            waiters.set(packageName, queue);
             return;
+        }
         mounted.add(packageName);
-        const ctx = args[0];
         ctx?.effect?.(() => () => {
             mounted.delete(packageName);
+            const waiters = mountWaiters();
+            const queue = waiters.get(packageName);
+            if (queue === undefined)
+                return;
+            waiters.delete(packageName);
+            // Defer the handover one microtask so the disposing mount's own effects
+            // (routes, ledger, timers) are torn down before the next one registers.
+            for (const waiter of queue.splice(0))
+                queueMicrotask(() => { waiter.run(); });
         });
         return fn(...args);
-    });
+    };
+    return mount;
 }

package/lib/types/pairing.d.ts

@@ -219,10 +219,16 @@ export declare class PairingService {
      * Restore device sessions persisted by a previous process run. A corrupt
      * or missing file is tolerated (an empty device table, never a throw) —
      * persistence is an availability convenience, not a security boundary.
+     *
+     * Every still-valid session is restored, deliberately without applying
+     * `maxDevices`: the constructor runs with whatever cap the configuration
+     * layer has delivered so far (the schema default until the saved settings
+     * row is applied), and trimming here would permanently drop authorizations
+     * the user never revoked — the trimmed table reaches disk on the next
+     * heartbeat/sweep write. The cap is enforced where a device is admitted
+     * (see `accept`), against the configuration in force at that moment.
      */
     private loadPersisted;
-    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
-    private clampToMaxDevices;
     /** Drop sessions whose lastSeenAt is older than idleExpireMs. */
     private evictIdle;
     /**
@@ -339,6 +345,13 @@ export declare class PairingService {
     snapshot(): PairingSnapshot;
     /** Whether a cookie value names a currently live (non-idle) device session. */
     hasDevice(deviceId: string): boolean;
+    /**
+     * Number of device sessions in the table, including idle ones whose idle
+     * window has not been swept yet. Restore keeps every persisted session
+     * (see `loadPersisted`), so this can exceed the configured cap until the
+     * next `accept` trims the excess.
+     */
+    deviceCount(): number;
     /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
     onState(listener: (snapshot: PairingSnapshot) => void): () => void;
     private activeToken;

package/lib/types/pairing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAElC,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IA1BrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAClC,EAAE,GAAE,cAAmB;IAK1C;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA6BrB,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;IAOzB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAkBf;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAazB,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnF;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA0BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAOb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,uDAAuD;AACvD,MAAM,MAAM,YAAY;AACtB,mEAAmE;AACjE,cAAc;AAChB,oEAAoE;GAClE,SAAS;AACX,4DAA4D;GAC1D,SAAS;AACX,sDAAsD;GACpD,WAAW;AACb,6EAA6E;GAC3E,cAAc,CAAA;AAElB,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAA;IACV,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,QAA2B,CAAA;AAK9D,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAA;IACV,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,MAAM,EAAE,OAAO,CAAA;IACf,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAA;IACxC,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAA;IACnD,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAA;IACnB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAA;IACrB,oEAAoE;IACpE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,uEAAuE;IACvE,KAAK,CAAC,EAAE,WAAW,CAAA;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,eAAe,CAAA;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,OAAO,EAAE,cAAc,EAAE,CAAA;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAElC,yEAAyE;AACzE,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C;;OAEG;gBACS,OAAO,EAAE,MAAM;CAI5B;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,GAAG,IAAI,MAAM,CAAA;IACb,WAAW,IAAI,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,yDAAyD;AACzD,eAAO,MAAM,YAAY,EAAE,YAG1B,CAAA;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IAyBhB,MAAM,EAAE,aAAa;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IA1BrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiD;IAC3E,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAA4B;IAC5C,sEAAsE;IACtE,OAAO,CAAC,UAAU,CAAoB;IACtC,mEAAmE;IACnE,OAAO,CAAC,YAAY,CAA0B;IAC9C,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,OAAO,CAA6B;IAC5C,8EAA8E;IAC9E,OAAO,CAAC,KAAK,CAAQ;IAErB;;;;;OAKG;gBAEM,MAAM,EAAE,aAAa,EACX,KAAK,GAAE,YAA2B,EAClC,EAAE,GAAE,cAAmB;IAK1C;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,aAAa;IA4BrB,iEAAiE;IACjE,OAAO,CAAC,SAAS;IAajB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;IAkBf;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAazB,wFAAwF;IACxF,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,oFAAoF;IACpF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIlD,wEAAwE;IACxE,IAAI,YAAY,IAAI,MAAM,EAAE,CAE3B;IAED,6EAA6E;IAC7E,WAAW,CAAC,OAAO,EAAE,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,IAAI;IAKxE,+DAA+D;IAC/D,IAAI,aAAa,IAAI,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI;IAK/C,qFAAqF;IACrF,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI;IAKvD,iFAAiF;IACjF,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI;IAKrD,iEAAiE;IACjE,UAAU,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAKvD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnF;;;;;;;;;OASG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY;IA+BvD;;;;OAIG;IACH,IAAI,IAAI,IAAI;IAQZ;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQjC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAQtC,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,KAAK,IAAI,IAAI;IAOb,2EAA2E;IAC3E,QAAQ,IAAI,eAAe;IAsB3B,+EAA+E;IAC/E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;OAKG;IACH,WAAW,IAAI,MAAM;IAIrB,yEAAyE;IACzE,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,IAAI,GAAG,MAAM,IAAI;IAKlE,OAAO,CAAC,WAAW;IASnB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,MAAM;CAaf;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK7E"}

package/lib/types/pairing.js

@@ -95,6 +95,14 @@ export class PairingService {
      * Restore device sessions persisted by a previous process run. A corrupt
      * or missing file is tolerated (an empty device table, never a throw) —
      * persistence is an availability convenience, not a security boundary.
+     *
+     * Every still-valid session is restored, deliberately without applying
+     * `maxDevices`: the constructor runs with whatever cap the configuration
+     * layer has delivered so far (the schema default until the saved settings
+     * row is applied), and trimming here would permanently drop authorizations
+     * the user never revoked — the trimmed table reaches disk on the next
+     * heartbeat/sweep write. The cap is enforced where a device is admitted
+     * (see `accept`), against the configuration in force at that moment.
      */
     loadPersisted() {
         const file = this.config.devicesFile;
@@ -119,7 +127,6 @@ export class PairingService {
                     ...(label !== undefined ? { userAgent: label } : {}),
                 });
             }
-            this.clampToMaxDevices();
             if (this.evictIdle())
                 this.persistRevocation();
         }
@@ -127,15 +134,6 @@ export class PairingService {
             // Unreadable/corrupt: start empty rather than refusing to boot.
         }
     }
-    /** FIFO-cap the device table (a persisted file may outlive a lowered cap). */
-    clampToMaxDevices() {
-        if (this.devices.size <= this.config.maxDevices)
-            return;
-        const overflow = this.devices.size - this.config.maxDevices;
-        const ordered = [...this.devices.entries()].sort((a, b) => a[1].createdAt - b[1].createdAt);
-        for (const [id] of ordered.slice(0, overflow))
-            this.devices.delete(id);
-    }
     /** Drop sessions whose lastSeenAt is older than idleExpireMs. */
     evictIdle() {
         const now = this.clock.now();
@@ -302,15 +300,20 @@ export class PairingService {
         }
         const deviceId = this.clock.randomToken();
         const now = this.clock.now();
-        if (this.devices.size >= this.config.maxDevices) {
-            // Evict the oldest session (FIFO) before binding a new device.
+        // FIFO-evict until a slot is free. The loop (not a single delete) covers a
+        // table that is already over the cap: restore keeps every persisted session
+        // (see loadPersisted), so the excess is collected here, once the store is
+        // actually asked to admit a new device, rather than at startup on a cap the
+        // configuration may not have delivered yet.
+        while (this.devices.size >= this.config.maxDevices) {
             let oldest;
             for (const [id, session] of this.devices) {
                 if (oldest === undefined || session.createdAt < oldest.createdAt)
                     oldest = { id, createdAt: session.createdAt };
             }
-            if (oldest !== undefined)
-                this.devices.delete(oldest.id);
+            if (oldest === undefined)
+                break;
+            this.devices.delete(oldest.id);
         }
         const label = sanitizeUserAgent(userAgent);
         this.devices.set(deviceId, {
@@ -414,6 +417,15 @@ export class PairingService {
     hasDevice(deviceId) {
         return this.liveSession(deviceId) !== undefined;
     }
+    /**
+     * Number of device sessions in the table, including idle ones whose idle
+     * window has not been swept yet. Restore keeps every persisted session
+     * (see `loadPersisted`), so this can exceed the configured cap until the
+     * next `accept` trims the excess.
+     */
+    deviceCount() {
+        return this.devices.size;
+    }
     /** Subscribe to snapshot changes (each emit passes a fresh snapshot). */
     onState(listener) {
         this.listeners.add(listener);

package/lib/types/pairing.persist.test.js

@@ -86,17 +86,57 @@ describe('PairingService device persistence', () => {
         const restarted = new PairingService({ ...BASE_CONFIG, devicesFile: file }, makeClock());
         expect(restarted.hasDevice(deviceId)).toBe(true);
     });
-    it('clamps a persisted table to maxDevices when the file holds more sessions', () => {
+    // #1696: the constructor runs before the saved settings row is applied, so
+    // its cap can still be the schema default. Restoring must not enforce it —
+    // trimming there silently revokes authorizations the user never revoked,
+    // and the trimmed table reaches disk on the next heartbeat/sweep write.
+    it('operator: every valid persisted session survives a restart under the startup cap', () => {
         const file = join(dir, 'devices.json');
+        // Given a store holding three devices while the startup cap reads 4
+        // (the schema default) and the saved settings value is 12.
         writeFileSync(file, JSON.stringify({
             dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
             dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
             dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
         }));
-        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock());
-        expect(service.hasDevice('dev3')).toBe(true);
+        // When a new process restores the store.
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 4, devicesFile: file }, makeClock());
+        // Then no paired device lost its authorization to the transient cap.
+        expect(service.hasDevice('dev1')).toBe(true);
         expect(service.hasDevice('dev2')).toBe(true);
+        expect(service.hasDevice('dev3')).toBe(true);
+    });
+    it('operator: a restored over-cap table is not trimmed by a heartbeat and sweep', () => {
+        const file = join(dir, 'devices.json');
+        // Given twelve persisted devices restored under the default cap of 4.
+        const rows = Object.fromEntries(Array.from({ length: 12 }, (_, i) => [`dev${i}`, { createdAt: 1_000 + i, lastSeenAt: 1_000 + i }]));
+        writeFileSync(file, JSON.stringify(rows));
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 4, devicesFile: file }, makeClock());
+        // When the saved cap of 12 arrives and normal traffic writes the store.
+        service.config = { ...service.config, maxDevices: 12 };
+        service.heartbeat('dev0');
+        service.sweep();
+        // Then the file still names all twelve devices.
+        const persisted = JSON.parse(readFileSync(file, 'utf8'));
+        expect(Object.keys(persisted)).toHaveLength(12);
+        expect(service.deviceCount()).toBe(12);
+    });
+    it('operator: the cap is enforced when a device is admitted, not before', () => {
+        const file = join(dir, 'devices.json');
+        // Given three persisted devices restored under a cap of 2.
+        writeFileSync(file, JSON.stringify({
+            dev1: { createdAt: 1_000, lastSeenAt: 1_000 },
+            dev2: { createdAt: 2_000, lastSeenAt: 2_000 },
+            dev3: { createdAt: 3_000, lastSeenAt: 3_000 },
+        }));
+        const service = new PairingService({ ...BASE_CONFIG, maxDevices: 2, devicesFile: file }, makeClock());
+        expect(service.deviceCount()).toBe(3);
+        // When one more device pairs.
+        const paired = pairDevice(service);
+        // Then the table is trimmed to the cap, oldest first, keeping the newcomer.
+        expect(service.deviceCount()).toBe(2);
         expect(service.hasDevice('dev1')).toBe(false);
+        expect(service.hasDevice(paired)).toBe(true);
     });
     it('keeps sessions memory-only when devicesFile is unset', () => {
         const first = new PairingService({ ...BASE_CONFIG }, makeClock());

package/lib/types/remote-channel-boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAwJrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}
+{"version":3,"file":"remote-channel-boot.d.ts","sourceRoot":"","sources":["../../src/remote-channel-boot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAErH;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,GAAE,kBAAyC,GAAG,MAAM,CAkKrG;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAA;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAwB,EAAE,MAAM,SAAwB,GAAG,MAAM,CAgB9G;AAED,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,MAAuC,CAAA"}

package/lib/types/remote-channel-boot.js

@@ -43,10 +43,20 @@ export function buildRemoteChannelBootScript(rules = REMOTE_CHANNEL_RULES) {
     return '(function(){' +
         'try{' +
         'var w=window,loc=w.location,h=loc.hostname;' +
-        // Loopback origins (including the bracketed IPv6 literal WHATWG returns)
-        // keep the original paths (mirrors isLoopbackHostname).
-        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
         'var R=' + json + ';' +
+        // A page the machine itself serves keeps the original paths and no
+        // channel: loopback names (including the bracketed IPv6 literal WHATWG
+        // returns), any scheme no web transport carries (an application on this
+        // machine delivered it - the desktop shell's own scheme, a file page, a
+        // scheme a newer shell introduces), or a shell the official transport
+        // already declared the host owner. This mirrors isLocalPage in
+        // remote-channel-rules.ts, which owns the decision.
+        "if(h==='localhost'||h==='::1'||h==='[::1]'||/^127(\\.\\d{1,3}){3}$/.test(h))return;" +
+        'var pr=loc.protocol;' +
+        'if(typeof pr==="string"&&pr!==""&&R.webProtocols.indexOf(pr)===-1)return;' +
+        // ownsHost alone does not lift the fence: the plugin's own device-gated
+        // landing grants it to a paired LAN/tunnel page, which must stay gated.
+        'try{if(w.__DSH_TRANSPORT__&&w.__DSH_TRANSPORT__.ownsHost===true&&h.indexOf(".")===-1&&h.indexOf(":")===-1)return}catch(e){}' +
         // Host mode is server-granted: only the device-gated app landing
         // publishes the grant marker (in a capture script that runs ahead of
         // this one), so a shell that merely sits on a non-loopback origin - an

package/lib/types/remote-channel-rules.d.ts

@@ -8,6 +8,73 @@
 /** The gated mirror prefix (must match src/remote-methods.ts). */
 export declare const REMOTE_PREFIX = "/remote";
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from './remote-methods.ts';
+/**
+ * The schemes that can deliver a page a remote party controls: the network
+ * transports, plus the documents a network page can mint. Every other scheme
+ * is registered and served by an application on this machine, so its page is
+ * the machine's own page whatever the application calls the scheme.
+ *
+ * The list is deliberately the *web* side rather than an allowlist of known
+ * desktop shells. The official DSH Desktop shell serves its Web GUI from
+ * `dsh-app://app/` (`location.hostname === 'app'`), which no hostname
+ * predicate can recognise; a scheme allowlist fixed that instance (#1682) but
+ * left the next shell — or a `file:` page — fenced behind a pairing page it
+ * can never complete, because a pairing link is reachable only over the
+ * network. Naming the web side instead makes an unknown application scheme
+ * local by construction.
+ *
+ * `blob:`, `data:`, `about:` and `filesystem:` stay on the web side: a
+ * network page mints those documents, so they must keep the fence.
+ */
+export declare const WEB_PAGE_PROTOCOLS: readonly string[];
+/**
+ * Whether one page scheme can carry a document a remote party controls.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @returns true for the network transports and the documents they mint.
+ */
+export declare function isWebPageProtocol(protocol: string): boolean;
+/**
+ * Hostname-only loopback classification: localhost, the IPv6 loopback literal
+ * (WHATWG keeps its brackets) and any 127/8 IPv4 literal. Kept string-in,
+ * boolean-out and dependency-free so the browser half and the inlined boot
+ * script can both run it verbatim.
+ * @param hostname - a page/cookie hostname, IPv6 literals bracketed.
+ * @returns true for a loopback name or literal.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Whether the current page is served from the machine running the host, so
+ * its same-origin traffic must NOT be fenced behind the pairing channel.
+ * Three independent facts all describe the page itself and any one is enough:
+ *
+ * - the page's own hostname is loopback;
+ * - the page's protocol is not a {@link WEB_PAGE_PROTOCOLS} web scheme, so an
+ *   application on this machine delivered it — the desktop shell's
+ *   `dsh-app://app/` is one such page, and a scheme this build has never
+ *   heard of is another;
+ * - the official connection transport already declared this shell the host
+ *   owner (`__DSH_TRANSPORT__.ownsHost === true`) AND the page is not a
+ *   network origin. The official client reads the same hook to derive
+ *   `connection.isLoopback`, and the desktop shell sets it before any boot
+ *   entry — without this term the plugin's predicate contradicts the host's
+ *   own conclusion (#1682). The network-origin guard is deliberate: this
+ *   plugin's own device-gated landing (a LAN or tunnel page) publishes the
+ *   same hook to grant a paired remote the full UI, and that page must keep
+ *   riding the gated channel — `ownsHost` buys the presentation, never an
+ *   exemption from the pairing fence.
+ *
+ * The order matters: loopback is checked first so a loopback page keeps its
+ * exemption even on a scheme no list carries, and the scheme test runs before
+ * the hook test so a web page always reaches the network-origin guard. A
+ * missing or empty scheme is not evidence of a local page - the fence stays
+ * up - because a real document always reports its own scheme.
+ *
+ * @param hostname - `location.hostname` of the page.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @param transportOwnsHost - `__DSH_TRANSPORT__?.ownsHost` as read by the caller.
+ * @returns true when the page is local and needs no remote channel.
+ */
+export declare function isLocalPage(hostname: string, protocol?: string, transportOwnsHost?: boolean): boolean;
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export declare const REMOTE_API_PREFIX = "/remote/api";
@@ -38,6 +105,13 @@ export interface RemoteChannelRules {
     readonly uploadPath: string;
     /** Page global the pre-Cordis upload hook is published under. */
     readonly uploadHookGlobal: string;
+    /**
+     * Schemes that can carry a remotely controlled document (see
+     * WEB_PAGE_PROTOCOLS): a page on any other scheme is delivered by an
+     * application on this machine. Carried in the rules so the inlined boot
+     * script applies the same list.
+     */
+    readonly webProtocols: readonly string[];
     /**
      * Page global carrying the server-issued host-mode grant. Only the plugin's
      * own device-gated app landing (/pair-app) publishes it; the boot patch

package/lib/types/remote-channel-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBAyBlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}
+{"version":3,"file":"remote-channel-rules.d.ts","sourceRoot":"","sources":["../../src/remote-channel-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,kEAAkE;AAClE,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,OAAO,GAAG,OAAO,CAQrG;AAeD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAA;AAEpD,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,gBAAyB,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED,yBAAyB;AACzB,eAAO,MAAM,oBAAoB,EAAE,kBA0BlC,CAAA;AAED,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,gCAAgC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC/B,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAA;IAC7B,eAAe,EAAE,OAAO,CAAA;IACxB,OAAO,IAAI,IAAI,CAAA;CAChB"}

package/lib/types/remote-channel-rules.js

@@ -8,6 +8,109 @@
 /** The gated mirror prefix (must match src/remote-methods.ts). */
 export const REMOTE_PREFIX = '/remote';
 import { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY } from "./remote-methods.js";
+/**
+ * The schemes that can deliver a page a remote party controls: the network
+ * transports, plus the documents a network page can mint. Every other scheme
+ * is registered and served by an application on this machine, so its page is
+ * the machine's own page whatever the application calls the scheme.
+ *
+ * The list is deliberately the *web* side rather than an allowlist of known
+ * desktop shells. The official DSH Desktop shell serves its Web GUI from
+ * `dsh-app://app/` (`location.hostname === 'app'`), which no hostname
+ * predicate can recognise; a scheme allowlist fixed that instance (#1682) but
+ * left the next shell — or a `file:` page — fenced behind a pairing page it
+ * can never complete, because a pairing link is reachable only over the
+ * network. Naming the web side instead makes an unknown application scheme
+ * local by construction.
+ *
+ * `blob:`, `data:`, `about:` and `filesystem:` stay on the web side: a
+ * network page mints those documents, so they must keep the fence.
+ */
+export const WEB_PAGE_PROTOCOLS = [
+    'http:',
+    'https:',
+    'blob:',
+    'data:',
+    'about:',
+    'filesystem:',
+];
+/**
+ * Whether one page scheme can carry a document a remote party controls.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @returns true for the network transports and the documents they mint.
+ */
+export function isWebPageProtocol(protocol) {
+    return WEB_PAGE_PROTOCOLS.includes(protocol);
+}
+/**
+ * Hostname-only loopback classification: localhost, the IPv6 loopback literal
+ * (WHATWG keeps its brackets) and any 127/8 IPv4 literal. Kept string-in,
+ * boolean-out and dependency-free so the browser half and the inlined boot
+ * script can both run it verbatim.
+ * @param hostname - a page/cookie hostname, IPv6 literals bracketed.
+ * @returns true for a loopback name or literal.
+ */
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname === '::1' || hostname === '[::1]')
+        return true;
+    const parts = hostname.split('.');
+    return parts.length === 4 && parts[0] === '127' && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255);
+}
+/**
+ * Whether the current page is served from the machine running the host, so
+ * its same-origin traffic must NOT be fenced behind the pairing channel.
+ * Three independent facts all describe the page itself and any one is enough:
+ *
+ * - the page's own hostname is loopback;
+ * - the page's protocol is not a {@link WEB_PAGE_PROTOCOLS} web scheme, so an
+ *   application on this machine delivered it — the desktop shell's
+ *   `dsh-app://app/` is one such page, and a scheme this build has never
+ *   heard of is another;
+ * - the official connection transport already declared this shell the host
+ *   owner (`__DSH_TRANSPORT__.ownsHost === true`) AND the page is not a
+ *   network origin. The official client reads the same hook to derive
+ *   `connection.isLoopback`, and the desktop shell sets it before any boot
+ *   entry — without this term the plugin's predicate contradicts the host's
+ *   own conclusion (#1682). The network-origin guard is deliberate: this
+ *   plugin's own device-gated landing (a LAN or tunnel page) publishes the
+ *   same hook to grant a paired remote the full UI, and that page must keep
+ *   riding the gated channel — `ownsHost` buys the presentation, never an
+ *   exemption from the pairing fence.
+ *
+ * The order matters: loopback is checked first so a loopback page keeps its
+ * exemption even on a scheme no list carries, and the scheme test runs before
+ * the hook test so a web page always reaches the network-origin guard. A
+ * missing or empty scheme is not evidence of a local page - the fence stays
+ * up - because a real document always reports its own scheme.
+ *
+ * @param hostname - `location.hostname` of the page.
+ * @param protocol - `location.protocol` of the page (for example `https:`).
+ * @param transportOwnsHost - `__DSH_TRANSPORT__?.ownsHost` as read by the caller.
+ * @returns true when the page is local and needs no remote channel.
+ */
+export function isLocalPage(hostname, protocol, transportOwnsHost) {
+    if (isLoopbackHostname(hostname))
+        return true;
+    // A missing or empty scheme is not evidence of a local page: a real
+    // document always reports one, so the fence stays up when it is unreadable.
+    if (protocol !== undefined && protocol !== '' && !isWebPageProtocol(protocol))
+        return true;
+    // A granted remote also sets ownsHost; only a page whose own origin is
+    // otherwise local may treat the hook as proof of a local page.
+    return transportOwnsHost === true && !isNetworkOrigin(hostname);
+}
+/**
+ * Whether a hostname can only be reached across a network, so a page on it is
+ * remote whatever transport hook it carries: any IPv4/IPv6 literal (a dot or a
+ * colon) or any dotted DNS name. A hostname with no dot and no colon is a
+ * scheme-local authority (the desktop shell's `app`), which is why this test,
+ * not a loopback test, is what the `ownsHost` term is gated on.
+ * @param hostname - the page hostname.
+ * @returns true when the page cannot be the machine's own local page.
+ */
+function isNetworkOrigin(hostname) {
+    return hostname.includes('.') || hostname.includes(':');
+}
 export { REMOTE_DEVICE_HEADER, REMOTE_DEVICE_QUERY };
 /** Connection-plugin method prefix under the gated channel. */
 export const REMOTE_API_PREFIX = `${REMOTE_PREFIX}/api`;
@@ -42,6 +145,7 @@ export const REMOTE_CHANNEL_RULES = {
     deviceQuery: REMOTE_DEVICE_QUERY,
     uploadPath: '/api/session/uploadFileBinary',
     uploadHookGlobal: '__DSH_FILE_UPLOAD__',
+    webProtocols: WEB_PAGE_PROTOCOLS,
     hostGrantGlobal: REMOTE_HOST_GRANT_GLOBAL,
 };
 /** The window global the boot patch publishes its seat under. */