@linxin666/dsh-remote-web-ui 0.4.6 → 0.4.7

package/lib/types/client/RemoteEntry.js

@@ -63,10 +63,10 @@ export function RemoteEntry({ wide, t }) {
         eventSource.current?.close();
         eventSource.current = undefined;
     }, []);
-    const mint = useCallback(async (address) => {
+    const mint = useCallback(async () => {
         let result;
         try {
-            result = await issuePair(address);
+            result = await issuePair();
         }
         catch {
             // Fetch/network failure: show an explicit state instead of silently
@@ -97,10 +97,6 @@ export function RemoteEntry({ wide, t }) {
             // Whether this QR is built on the configured public (tunneled) base.
             public: publicBaseUrl !== undefined && result.url.startsWith(publicBaseUrl),
             ...(publicBaseUrl !== undefined ? { publicBaseUrl } : {}),
-            // The issued URL names the requested (or default first) literal; the
-            // public link has no LAN literal, so no radio row is selected then.
-            address: address ?? result.lanAddresses[0] ?? '',
-            lanAddresses: result.lanAddresses,
         };
     }, []);
     const openPanel = useCallback(async () => {
@@ -192,14 +188,6 @@ export function RemoteEntry({ wide, t }) {
     const handleRefresh = useCallback(() => {
         void mint().then(setState);
     }, [mint]);
-    /** Re-mint against another LAN literal (multi-homed machines). */
-    const handlePickAddress = useCallback((address) => {
-        void mint(address).then(setState);
-    }, [mint]);
-    /** Re-mint against the configured public (tunneled) base. */
-    const handlePickPublic = useCallback(() => {
-        void mint().then(setState);
-    }, [mint]);
     const handleCopy = useCallback((url) => {
         void copyText(url).then((ok) => {
             if (!ok)
@@ -216,7 +204,7 @@ export function RemoteEntry({ wide, t }) {
             window.setTimeout(() => { setCopiedToken(false); }, 1500);
         });
     }, []);
-    return (_jsxs(_Fragment, { children: [_jsx("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open }) }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, copiedToken: copiedToken, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onCopyToken: handleCopyToken, onPickAddress: handlePickAddress, onPickPublic: handlePickPublic, onRevoke: handleRevoke })] })), document.body)] }));
+    return (_jsxs(_Fragment, { children: [_jsx("div", { className: css.entryRow, "data-rail": wide ? undefined : 'rail', children: _jsx(TooltipAnchor, { wide: wide, label: t('entry.label'), onClick: openPanel, expanded: open }) }), open && createPortal((_jsxs("div", { className: css.overlay, role: "presentation", children: [_jsx("div", { className: css.mask, "aria-hidden": "true", onClick: closePanel }), _jsx(RemotePanel, { t: t, state: state, copied: copied, copiedToken: copiedToken, onClose: closePanel, onStop: handleStop, onRefresh: handleRefresh, onCopy: handleCopy, onCopyToken: handleCopyToken, onRevoke: handleRevoke })] })), document.body)] }));
 }
 /** The trigger: an icon-only control with a persistent accessible label. */
 function TooltipAnchor({ wide, label, onClick, expanded }) {

package/lib/types/client/RemotePanel.d.ts

@@ -19,10 +19,6 @@ export type PanelState = {
     onlineCount: number;
     /** Authorized devices for the roster under the QR card. */
     devices: DeviceFrame[];
-    /** The LAN literal the current QR was built from. */
-    address: string;
-    /** Every constructible LAN literal (interface order). */
-    lanAddresses: string[];
     /** The active pairing token itself (useful in Docker/reverse proxy topologies). */
     token?: string;
     /** Whether this QR is built on the configured public (tunneled) base. */
@@ -47,10 +43,6 @@ export interface RemotePanelProps {
     onRefresh(): void;
     onCopy(url: string): void;
     onCopyToken?(token: string): void;
-    /** Re-mint the QR against a different LAN address. */
-    onPickAddress(address: string): void;
-    /** Re-mint the QR against the configured public (tunneled) base. */
-    onPickPublic(): void;
     /** Revoke one paired device. */
     onRevoke(deviceId: string): void;
 }
@@ -59,5 +51,5 @@ export interface RemotePanelProps {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export declare function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }: RemotePanelProps): import("react").JSX.Element;
+export declare function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onRevoke, }: RemotePanelProps): import("react").JSX.Element;
 //# sourceMappingURL=RemotePanel.d.ts.map

package/lib/types/client/RemotePanel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAatB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,oEAAoE;IACpE,YAAY,IAAI,IAAI,CAAA;IACpB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAC1B,CAAC,EACD,KAAK,EACL,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,WAAW,EACX,aAAa,EACb,YAAY,EACZ,QAAQ,GACT,EAAE,gBAAgB,+BAyLlB"}
+{"version":3,"file":"RemotePanel.d.ts","sourceRoot":"","sources":["../../../src/client/RemotePanel.tsx"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAA;AAatB,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,GACvB;IACE,IAAI,EAAE,OAAO,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,MAAM,EAAE,OAAO,CAAA;IACf,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mEAAmE;IACnE,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,uEAAuE;IACvE,KAAK,CAAC,EAAE,gBAAgB,CAAA;IACxB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB,CAAA;AAEL,qDAAqD;AACrD,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;IACxB,KAAK,EAAE,UAAU,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,IAAI,IAAI,CAAA;IACf,MAAM,IAAI,IAAI,CAAA;IACd,SAAS,IAAI,IAAI,CAAA;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAgBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAC1B,CAAC,EACD,KAAK,EACL,MAAM,EACN,WAAW,EACX,OAAO,EACP,MAAM,EACN,SAAS,EACT,MAAM,EACN,WAAW,EACX,QAAQ,GACT,EAAE,gBAAgB,+BA8JlB"}

package/lib/types/client/RemotePanel.js

@@ -1,8 +1,11 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 /**
  * The mobile remote-control panel body: status card (state text + badge),
- * the QR code, the open-on-phone hint with the link text, and the three
- * actions (stop / refresh / copy). Pure presentation — all state and
+ * the QR code, the open-on-phone hint with the link text, and the two
+ * actions (stop / refresh / copy). The advertised network is not a choice:
+ * the QR names the public base and the landing page decides at connect time
+ * whether to move to a LAN origin (lan-source.ts), so the panel only states
+ * which source the current link carries. Pure presentation — all state and
  * actions arrive through props from the entry's behavior component.
  */
 import clsx from 'clsx';
@@ -35,10 +38,10 @@ function statusOf(t, state) {
  * @param props - copy, state, and actions.
  * @returns the panel element tree.
  */
-export function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onPickAddress, onPickPublic, onRevoke, }) {
+export function RemotePanel({ t, state, copied, copiedToken, onClose, onStop, onRefresh, onCopy, onCopyToken, onRevoke, }) {
     return (_jsxs("div", { className: css.panel, role: "dialog", "aria-modal": "true", "aria-label": t('title'), children: [_jsxs("div", { className: css.header, children: [_jsxs("div", { className: css.heading, children: [_jsx("h2", { className: css.title, children: t('title') }), _jsx("p", { className: css.subtitle, children: t('subtitle') })] }), _jsx("button", { type: "button", className: css.close, "aria-label": t('close.label'), onClick: onClose, children: _jsx(IconCloseOutlineRegular, { size: 14 }) })] }), state.kind === 'lan-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.lanRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.lanRequiredHint') })] })) : state.kind === 'loopback-required' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.loopbackRequired') }), _jsx("p", { className: css.bannerHint, children: t('status.loopbackRequiredHint') })] })) : state.kind === 'unreachable' ? (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('status.unreachable') }), _jsx("p", { className: css.bannerHint, children: t('status.unreachableHint') })] })) : (_jsxs(_Fragment, { children: [state.posture !== undefined && state.posture.hosts.some(host => host.exposed) && (_jsxs("div", { className: css.banner, role: "alert", children: [_jsx("p", { className: css.bannerTitle, children: t('posture.exposed') }), _jsx("p", { className: css.bannerHint, children: t('posture.exposedHint', { hosts: state.posture.hosts.filter(host => host.exposed).map(host => host.host).join(', ') }) })] })), _jsxs("div", { className: css.card, children: [_jsxs("div", { className: css.cardHeader, children: [_jsx("span", { className: css.cardTitle, children: t('card.title') }), _jsxs("span", { className: css.badges, children: [state.public && _jsx("span", { className: clsx(css.badge, css.badgePublic), children: t('public.badge') }), _jsx("span", { className: clsx(css.badge, css[`badge-${statusOf(t, state).tone}`]), children: statusOf(t, state).text })] })] }), _jsx("div", { className: css.qrWrap, "data-testid": "remote-qr", children: _jsx(PairQrCode, { url: state.url, className: css.qr }) }), state.expired
                                 ? _jsx("p", { className: css.expired, children: t('pair.expired') })
                                 : _jsx("p", { className: css.expiry, children: t('pair.expires', { time: formatClock(state.expiresAt) }) })] }), _jsx("p", { className: css.hint, children: state.public ? t('pair.publicHint') : t('pair.hint') }), _jsxs("div", { className: css.pairLinks, children: [_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.linkLabel') }), _jsx("code", { className: css.link, title: state.url, children: state.url })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopy(state.url), children: [_jsx(IconCopyOutlineRegular, { size: 14 }), copied ? t('action.copied') : t('action.copyLink')] })] }), state.token !== undefined && state.token !== '' && (_jsxs("div", { className: css.pairLinkRow, children: [_jsxs("div", { className: css.pairLinkText, children: [_jsx("span", { className: css.pairLinkLabel, children: t('pair.tokenLabel') }), _jsx("code", { className: css.link, title: state.token, children: state.token })] }), _jsxs("button", { type: "button", className: css.copyLink, onClick: () => onCopyToken ? onCopyToken(state.token) : onCopy(state.token), children: [_jsx(IconCopyOutlineRegular, { size: 14 }), copiedToken ? t('action.copiedToken') : t('action.copyToken')] })] }))] }), _jsxs("p", { className: css.oneTimeHint, children: [t('pair.oneTimeHint'), " ", t('pair.dockerHint')] }), state.phase === 'stopped' && _jsx("p", { className: css.stoppedHint, children: t('stopped.hint') }), state.tunnel !== undefined && state.tunnel.state !== 'running' && (_jsx("p", { className: state.tunnel.state === 'failed' ? css.tunnelFailed : css.tunnelNote, role: "status", children: state.tunnel.state === 'failed'
                             ? t('tunnel.failed', { error: state.tunnel.error ?? t('tunnel.unknownError') })
-                            : t('tunnel.starting') })), state.relay?.state === 'registering' && (_jsx("p", { className: css.tunnelNote, role: "status", children: t('relay.registering') })), state.relay?.state === 'failed' && (_jsx("p", { className: css.tunnelFailed, role: "status", children: t('relay.failed', { error: state.relay.error ?? t('tunnel.unknownError') }) })), (state.publicBaseUrl !== undefined || state.lanAddresses.length > 1) && (_jsxs("fieldset", { className: css.addresses, children: [_jsx("legend", { children: t('address.label') }), state.publicBaseUrl !== undefined && (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": t('address.public'), checked: state.public, onChange: onPickPublic }), _jsx("span", { children: t('address.public') }), _jsx("code", { className: css.addressValue, children: state.publicBaseUrl })] }, "public")), state.lanAddresses.map(address => (_jsxs("label", { className: css.address, children: [_jsx("input", { type: "radio", name: "lan-address", "aria-label": address, checked: !state.public && address === state.address, onChange: () => onPickAddress(address) }), _jsx("span", { children: t('address.lan') }), _jsx("code", { className: css.addressValue, children: address })] }, address))), _jsx("p", { className: css.addressHint, children: t('address.hint') })] })), _jsxs("div", { className: css.actions, children: [_jsxs("button", { type: "button", className: css.action, onClick: onStop, children: [_jsx(IconStopFillRegular, { size: 14 }), t('action.stop')] }), _jsxs("button", { type: "button", className: css.action, onClick: onRefresh, children: [_jsx(IconRefreshOutlineRegular, { size: 14 }), t('action.refresh')] })] }), _jsxs("section", { className: css.devices, "data-testid": "remote-devices", "aria-label": t('devices.title'), children: [_jsx("h3", { className: css.devicesTitle, children: t('devices.title') }), state.devices.length === 0 ? (_jsx("p", { className: css.devicesEmpty, children: t('devices.empty') })) : (_jsx("ul", { className: css.deviceList, children: state.devices.map(device => (_jsxs("li", { className: css.deviceRow, children: [_jsxs("div", { className: css.deviceMeta, children: [_jsx("span", { className: css.deviceName, children: deviceNameFromUserAgent(device.userAgent) ?? t('devices.unknown') }), _jsx("span", { className: clsx(css.devicePresence, device.online ? css.deviceOnline : css.deviceOffline), children: device.online ? t('devices.online') : t('devices.offline') }), _jsx("span", { className: css.deviceSeen, children: t('devices.lastSeen', { time: formatLastSeen(device.lastSeenAt) }) })] }), _jsx("button", { type: "button", className: css.deviceRevoke, "aria-label": t('devices.revoke.label'), onClick: () => { onRevoke(device.id); }, children: t('devices.revoke') })] }, device.id))) }))] })] }))] }));
+                            : t('tunnel.starting') })), state.relay?.state === 'registering' && (_jsx("p", { className: css.tunnelNote, role: "status", children: t('relay.registering') })), state.relay?.state === 'failed' && (_jsx("p", { className: css.tunnelFailed, role: "status", children: t('relay.failed', { error: state.relay.error ?? t('tunnel.unknownError') }) })), (state.publicBaseUrl !== undefined || !state.public) && (_jsx("p", { className: css.addressHint, children: state.public ? t('address.auto') : t('address.pinnedLan') })), _jsxs("div", { className: css.actions, children: [_jsxs("button", { type: "button", className: css.action, onClick: onStop, children: [_jsx(IconStopFillRegular, { size: 14 }), t('action.stop')] }), _jsxs("button", { type: "button", className: css.action, onClick: onRefresh, children: [_jsx(IconRefreshOutlineRegular, { size: 14 }), t('action.refresh')] })] }), _jsxs("section", { className: css.devices, "data-testid": "remote-devices", "aria-label": t('devices.title'), children: [_jsx("h3", { className: css.devicesTitle, children: t('devices.title') }), state.devices.length === 0 ? (_jsx("p", { className: css.devicesEmpty, children: t('devices.empty') })) : (_jsx("ul", { className: css.deviceList, children: state.devices.map(device => (_jsxs("li", { className: css.deviceRow, children: [_jsxs("div", { className: css.deviceMeta, children: [_jsx("span", { className: css.deviceName, children: deviceNameFromUserAgent(device.userAgent) ?? t('devices.unknown') }), _jsx("span", { className: clsx(css.devicePresence, device.online ? css.deviceOnline : css.deviceOffline), children: device.online ? t('devices.online') : t('devices.offline') }), _jsx("span", { className: css.deviceSeen, children: t('devices.lastSeen', { time: formatLastSeen(device.lastSeenAt) }) })] }), _jsx("button", { type: "button", className: css.deviceRevoke, "aria-label": t('devices.revoke.label'), onClick: () => { onRevoke(device.id); }, children: t('devices.revoke') })] }, device.id))) }))] })] }))] }));
 }

package/lib/types/client/locales.d.ts

@@ -19,10 +19,8 @@ export declare const zh: {
     'status.unreachableHint': string;
     'pair.hint': string;
     'pair.publicHint': string;
-    'address.label': string;
-    'address.public': string;
-    'address.lan': string;
-    'address.hint': string;
+    'address.auto': string;
+    'address.pinnedLan': string;
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;
@@ -143,10 +141,8 @@ export declare const en: {
     'status.unreachableHint': string;
     'pair.hint': string;
     'pair.publicHint': string;
-    'address.label': string;
-    'address.public': string;
-    'address.lan': string;
-    'address.hint': string;
+    'address.auto': string;
+    'address.pinnedLan': string;
     'pair.expires': string;
     'pair.expired': string;
     'pair.linkLabel': string;

package/lib/types/client/locales.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwHmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwHsB,CAAA"}
+{"version":3,"file":"locales.d.ts","sourceRoot":"","sources":["../../../src/client/locales.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsHmB,CAAA;AAElC,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAA;AAEvC,wDAAwD;AACxD,MAAM,MAAM,eAAe,GAAG,SAAS,CAAA;AAEvC,mEAAmE;AACnE,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsHsB,CAAA"}

package/lib/types/client/locales.js

@@ -19,10 +19,8 @@ export const zh = {
     'status.unreachableHint': '请刷新页面后重试。',
     'pair.hint': '无法扫码？可直接打开下方配对链接',
     'pair.publicHint': '公网链接：设备无需与本机处于同一网络',
-    'address.label': '选择二维码指向的网络',
-    'address.public': '公网地址',
-    'address.lan': '局域网',
-    'address.hint': '远程设备不在同一网络时请使用公网地址；局域网地址仅限同一网络内使用。',
+    'address.auto': '二维码固定指向公网地址；手机与本机处于同一网络时会自动切换到局域网地址。',
+    'address.pinnedLan': '二维码固定指向局域网地址。',
     'pair.expires': '二维码有效至 {time}',
     'pair.expired': '二维码已过期，请刷新',
     'pair.linkLabel': '配对链接',
@@ -141,10 +139,8 @@ export const en = {
     'status.unreachableHint': 'Refresh the page and try again.',
     'pair.hint': 'Cannot scan? Open one of the pairing links below',
     'pair.publicHint': 'Public links work when the device is not on the same network',
-    'address.label': 'Network the QR code points to',
-    'address.public': 'Public',
-    'address.lan': 'LAN',
-    'address.hint': 'Use the public address when the remote device is on another network; LAN addresses only work on the same network.',
+    'address.auto': 'The QR code always points at the public address; a phone on the same network switches to the LAN address by itself.',
+    'address.pinnedLan': 'The QR code points at a LAN address.',
     'pair.expires': 'QR code valid until {time}',
     'pair.expired': 'QR code expired — refresh it',
     'pair.linkLabel': 'Pairing link',

package/lib/types/client/settings-entry-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-entry-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-entry-form.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAsB,WAAW,EAAE,MAAM,4CAA4C,CAAA;AAE7G,gDAAgD;AAChD,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,kEAAkE;IAClE,KAAK,EAAE,WAAW,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5B;AAeD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CA4E1F"}
+{"version":3,"file":"settings-entry-form.d.ts","sourceRoot":"","sources":["../../../src/client/settings-entry-form.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAsB,WAAW,EAAE,MAAM,4CAA4C,CAAA;AAE7G,gDAAgD;AAChD,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,kEAAkE;IAClE,KAAK,EAAE,WAAW,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAC5B;AAcD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CA4E1F"}

package/lib/types/client/settings-entry-form.js

@@ -7,7 +7,6 @@ function pendingSnapshot() {
         user: undefined,
         revision: undefined,
         writable: false,
-        mode: 'host',
     };
 }
 /**

package/lib/types/index.d.ts

@@ -12,6 +12,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
 import z from '@deepseek-ai/schemastery';
 import { type PairingConfig } from './pairing.ts';
+import { type PairingSourcePreference } from './routes.ts';
 declare module '@deepseek-ai/cordis' {
     interface Events {
         /**
@@ -167,6 +168,16 @@ export interface Config {
     profile?: string;
     /** Master switch for the plugin (browser half + host pairing surfaces). */
     enabled?: boolean;
+    /**
+     * The manual override of the automatic pairing-network choice, for the case
+     * where the phone's own probe misjudges (see `PairingSourcePreference` in
+     * routes.ts). `auto` (default) names the public base in the QR link and lets
+     * the landing page switch to a LAN origin when one answers; `public` pins the
+     * public base and disables the probe; `lan` pins the first LAN literal and
+     * skips the public hop entirely. Set through the profile patch — the settings
+     * card carries no control for it, so a save from that card leaves it alone.
+     */
+    pairingSource?: PairingSourcePreference;
 }
 /**
  * Plugin config schema. Under the 0.1.7 settings model this schema IS the
@@ -204,6 +215,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     lanBind: z<boolean, boolean, "volatile">;
     profile: z<string, string, "plain">;
     enabled: z<boolean, boolean, "volatile-defined">;
+    pairingSource: z<"auto" | "public" | "lan", "auto" | "public" | "lan", "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     tokenTtlMs: z<number, number, "volatile-defined">;
     offlineAfterMs: z<number, number, "volatile-defined">;
@@ -220,6 +232,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     lanBind: z<boolean, boolean, "volatile">;
     profile: z<string, string, "plain">;
     enabled: z<boolean, boolean, "volatile-defined">;
+    pairingSource: z<"auto" | "public" | "lan", "auto" | "public" | "lan", "volatile-defined">;
 }>>, "plain">;
 /**
  * Fully resolved config: every field non-optional except `publicBaseUrl`,
@@ -262,6 +275,7 @@ export interface ResolvedConfigFields {
     lanBind?: ConfigField<boolean>;
     profile?: ConfigField<string>;
     enabled?: ConfigField<boolean>;
+    pairingSource?: ConfigField<PairingSourcePreference>;
 }
 /**
  * The single mapping from resolved plugin config to the pairing service

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAOxC,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAuBzF,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;WAOG;QACH,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,CAAA;QACrE;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAgBjB,CAAA;AAKF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACvI,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,UAAU,SAAS,CAAC,CAAC;IACnB,uEAAuE;IACvE,GAAG,IAAI,CAAC,CAAA;CACT;AAED,+FAA+F;AAC/F,KAAK,WAAW,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAEtC,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC3C,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IACjC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;CAC/B;AAyBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAmCD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAqlBpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAClE,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAOxC,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAIzF,OAAO,EAA2D,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAmBnH,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd;;;;;;;WAOG;QACH,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,CAAA;QACrE;;;;;;;;;;;WAWG;QACH,UAAU,CACR,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC9B;CACF;AAED,iCAAiC;AACjC,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,+DAA+D;AAC/D,eAAO,MAAM,MAAM,UAA+C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,EAAsB,iBAAiB,CAAA;AAEpF,qEAAqE;AACrE,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAA;CACxC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAiBjB,CAAA;AAWF;;;;GAIG;AACH,KAAK,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC,CAAC,GAAG;IACvI,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,OAAO,EAAE,OAAO,GAAG,SAAS,CAAA;IAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;GAGG;AACH,UAAU,SAAS,CAAC,CAAC;IACnB,uEAAuE;IACvE,GAAG,IAAI,CAAC,CAAA;CACT;AAED,+FAA+F;AAC/F,KAAK,WAAW,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;AAEtC,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACpC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAChC,oBAAoB,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC3C,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,UAAU,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IACjC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC5B,OAAO,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;IAC9B,aAAa,CAAC,EAAE,WAAW,CAAC,uBAAuB,CAAC,CAAA;CACrD;AAyBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,CAC5C,cAAc,EACd,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,aAAa,CAC/F,GAAG,aAAa,CAShB;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEnE;AAoCD;;;;GAIG;AACH,eAAO,MAAM,KAAK,kBAAuD,CAAA;AAEzE,iBAAS,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,IAAI,CA8nBpE"}

package/lib/types/index.js

@@ -14,7 +14,7 @@ import { DEFAULT_IDLE_EXPIRE_MS, PairingService } from "./pairing.js";
 import { dshHome } from "./dsh-home.js";
 import { isPairedDeviceRequest, makeGateListener } from "./gate.js";
 import { RemoteWebUiPairing } from "./pairing-access.js";
-import { makeRoutes } from "./routes.js";
+import { makeRoutes, PAIRING_SOURCE_OPTIONS } from "./routes.js";
 import { makeRemoteApiRoutes, makeRemoteApiUpgradeRoutes } from "./remote-api.js";
 import { startRemotePresencePet } from "./remote-presence-pet.js";
 import { claimPostureKey, postureTargets, probePosture, releasePostureKey } from "./posture.js";
@@ -81,9 +81,15 @@ export const Config = z.object({
     lanBind: z.boolean().volatile(),
     profile: z.string().pattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$/),
     enabled: z.boolean().default(true).volatile(),
+    pairingSource: z.union([...PAIRING_SOURCE_OPTIONS]).default('auto').volatile(),
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 10_000;
+/**
+ * Re-plan retry while the quick tunnel waits for the webServer port to bind
+ * (a recompose pass can run this apply ahead of the listener's bind).
+ */
+const PORT_SETTLE_RETRY_MS = 1_000;
 /** Read one resolved config field, following the live reference the schema produces. */
 function readConfigField(field, fallback) {
     if (field === undefined)
@@ -143,6 +149,7 @@ const DEFAULTS = {
     lanBind: undefined,
     profile: resolveManagedProfile(undefined, undefined, process.env.DSH_PROFILE),
     enabled: true,
+    pairingSource: 'auto',
 };
 /**
  * The launched profile the Host publishes on its `profileContext` service
@@ -186,6 +193,7 @@ function applyImpl(ctx, config) {
         lanBind: readOptionalConfigField(config?.lanBind),
         profile: resolveManagedProfile(readOptionalConfigField(config?.profile), launchedProfileName(ctx), process.env.DSH_PROFILE),
         enabled: readConfigField(config?.enabled, DEFAULTS.enabled),
+        pairingSource: readConfigField(config?.pairingSource, DEFAULTS.pairingSource),
     });
     const service = new PairingService(pairingConfigOf(resolve()));
     // ── auto tunnel ─────────────────────────────────────────────────────────
@@ -261,6 +269,14 @@ function applyImpl(ctx, config) {
     // 'off' until a sync pass turns a mode on; the phase listener only feeds
     // the public base while a plugin-managed tunnel (quick or named) runs.
     let tunnelMode = resolve().autoTunnel ? 'quick' : 'off';
+    /**
+     * Retry timer while the quick tunnel waits for the webServer port to bind
+     * (undefined when no deferral is pending). Unref'd: never keeps the
+     * process alive on its own.
+     */
+    let portSettleTimer;
+    /** Dedupes the unbound-port warning to one line per unsettled episode. */
+    let portSettleWarned = false;
     tunnel.onPhase((info) => {
         if (tunnelMode === 'off')
             return;
@@ -291,6 +307,8 @@ function applyImpl(ctx, config) {
         disposeRelayRegistrar();
         publicBase.dispose();
         tunnel.dispose();
+        if (portSettleTimer !== undefined)
+            clearTimeout(portSettleTimer);
     }, 'remote-web-ui: auto tunnel');
     // The bind facts are known by now (webServer is an inject edge): the LAN
     // bases are frozen per process, matching the CLI's once-per-invocation
@@ -413,6 +431,7 @@ function applyImpl(ctx, config) {
         ...makeRoutes({
             service,
             requirePairingForLan: () => resolve().requirePairingForLan,
+            pairingSource: () => resolve().pairingSource,
             lanBindStatus,
             indexDocument: fetchAppShell,
             trustedHosts: () => {
@@ -446,13 +465,13 @@ function applyImpl(ctx, config) {
         // credential to everything it forwards (issue #1665).
         ...makeRemoteApiRoutes({
             service,
-            port: ctx.webServer.port,
+            port: () => ctx.webServer.port,
             auth: innerAuth,
         }),
     ];
     const upgrades = makeRemoteApiUpgradeRoutes({
         service,
-        port: ctx.webServer.port,
+        port: () => ctx.webServer.port,
         auth: innerAuth,
     });
     const gate = makeGateListener(service, () => resolve().requirePairingForLan, () => resolve().enabled);
@@ -468,7 +487,13 @@ function applyImpl(ctx, config) {
     const runPostureProbe = () => {
         if (!resolve().enabled)
             return;
-        const targets = postureTargets(service.publicBaseUrl, service.lanAddresses, ctx.webServer.port);
+        // The probe and the LAN targets need the bound port; before it settles
+        // (a recompose pass) there is nothing honest to probe — keep the previous
+        // snapshot and let the next trigger retry.
+        const port = ctx.webServer.port;
+        if (port === undefined)
+            return;
+        const targets = postureTargets(service.publicBaseUrl, service.lanAddresses, port);
         if (targets.length === 0) {
             postureKey = undefined;
             service.setPosture(undefined);
@@ -479,7 +504,7 @@ function applyImpl(ctx, config) {
         if (!claim.run)
             return;
         postureKey = claim.next;
-        void probePosture({ port: ctx.webServer.port, targets }).then((snapshot) => {
+        void probePosture({ port, targets }).then((snapshot) => {
             service.setPosture(snapshot);
             const exposedHosts = snapshot.hosts.filter(host => host.exposed).map(host => host.host);
             const exposed = exposedHosts.length > 0;
@@ -637,18 +662,13 @@ function applyImpl(ctx, config) {
         }));
     };
     ctx.effect(() => () => { lanBindWorkPending = false; }, 'remote-web-ui: lan-bind work');
-    // Apply the effective configuration to the running surfaces once per
-    // activation: the service tunables, the LAN-bind block/firewall, the tunnel
-    // plan, the pairing routes, the presence sweep, and the posture probe.
-    const sync = () => {
-        const value = resolve();
-        service.config = pairingConfigOf(value);
-        scheduleLanBindWork();
-        // The plugin-managed tunnels own the public base while one runs: the URL
-        // lands in the service through the tunnel's phase listener (the minted
-        // quick URL, or the named tunnel's fixed public hostname). The manual
-        // publicBaseUrl applies only when no tunnel runs.
-        const plan = tunnelPlanOf(value, ctx.webServer.port);
+    // Apply one tunnel plan to the running surfaces. The plugin-managed tunnels
+    // own the public base while one runs: the URL lands in the service through
+    // the tunnel's phase listener (the minted quick URL, or the named tunnel's
+    // fixed public hostname). The manual publicBaseUrl applies only when no
+    // tunnel runs.
+    const applyTunnelPlan = (value, port) => {
+        const plan = tunnelPlanOf(value, port);
         tunnelMode = plan.mode;
         publicBase.setMode(plan.mode);
         const liveTunnelUrl = publicBase.quickUrl();
@@ -714,6 +734,36 @@ function applyImpl(ctx, config) {
                 service.setPublicBaseUrl(value.publicBaseUrl);
             }
         }
+    };
+    // Apply the effective configuration to the running surfaces once per
+    // activation: the service tunables, the LAN-bind block/firewall, the tunnel
+    // plan, the pairing routes, the presence sweep, and the posture probe.
+    const sync = () => {
+        const value = resolve();
+        service.config = pairingConfigOf(value);
+        scheduleLanBindWork();
+        // The quick tunnel's loopback target URL needs the bound port. A recompose
+        // pass can run this apply before the listener binds: defer the tunnel
+        // branch (and re-plan on a short timer) instead of minting an
+        // http://127.0.0.1:undefined target; everything else in sync applies.
+        const livePort = ctx.webServer.port;
+        if (livePort === undefined && value.autoTunnel === true) {
+            if (!portSettleWarned) {
+                portSettleWarned = true;
+                console.warn('remote-web-ui: autoTunnel is on but the web server port is not bound yet — the quick tunnel starts once the port settles');
+            }
+            if (portSettleTimer === undefined) {
+                portSettleTimer = nodeSetTimeout(() => {
+                    portSettleTimer = undefined;
+                    sync();
+                }, PORT_SETTLE_RETRY_MS);
+                portSettleTimer.unref();
+            }
+        }
+        else {
+            portSettleWarned = false;
+            applyTunnelPlan(value, livePort);
+        }
         const enabled = value.enabled;
         if (!enabled) {
             service.stop();

package/lib/types/lan-source.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The landing page's network-source decision: which origin a paired phone
+ * should keep using.
+ *
+ * The QR link can only name one base, and the server cannot know whether the
+ * scanning phone sits on this machine's own network: the public (relayed)
+ * base is the only one that is always reachable, so the QR names it and the
+ * phone decides at connect time. The device-gated landing (/pair-app) is the
+ * plugin's own page already rendered ahead of the official shell's boot, so it
+ * is the natural place to probe: after the page is served, a short
+ * cross-origin `fetch` per LAN candidate (a no-cors GET at
+ * {@link LAN_PING_PATH}) tells the browser whether that LAN origin answers,
+ * and the first one that does becomes the new origin. A probe that finds
+ * nothing, or that runs out of budget, changes nothing — the page the phone
+ * already holds stays paired and usable, so the probe can never block pairing.
+ *
+ * Browsers do not block this probe. An https page may not normally fetch
+ * `http://` subresources, but a host that is an IP literal is exempt from both
+ * the block and the automatic upgrade (verified against Chrome: the console
+ * reports "This request was not upgraded to HTTPS because its URL's host is an
+ * IP address" and delivers the response), which is exactly the shape every LAN
+ * candidate has.
+ *
+ * @module @linxin666/dsh-remote-web-ui/lan-source
+ */
+/** sessionStorage key holding this session's source decision. */
+export declare const LAN_SOURCE_STORAGE_KEY = "dsh-remote-lan-source";
+/**
+ * Probe budget for the whole candidate set. Long enough for a LAN round trip,
+ * short enough that a phone on another network never waits on it — the probe
+ * is fire-and-forget and the page it runs on is already usable.
+ */
+export declare const LAN_SOURCE_PROBE_TIMEOUT_MS = 800;
+/**
+ * How recently a LAN hop must have been taken for a return to a non-LAN origin
+ * to read as "the hop did not stick". A phone that fails to load the LAN page
+ * re-scans the QR (which always names the public base) within seconds, and the
+ * landing then has to choose the public source instead of hopping again into
+ * the same black hole; a deliberate return much later is a fresh decision and
+ * re-probes.
+ */
+export declare const LAN_SOURCE_RETRY_WINDOW_MS = 120000;
+/** One probe payload: everything the injected script needs, JSON-serializable. */
+export interface LanSourceHop {
+    /**
+     * The LAN origins the probe may hop to, normalized (`https://host:port` with
+     * a default port dropped) so they compare equal to `location.origin`.
+     */
+    candidates: readonly string[];
+    /** The path the hop targets on the winning origin. */
+    path: string;
+    /** The path the probe itself requests, on each candidate. */
+    pingPath: string;
+    /** The one-time grant the hop consumes on the winning origin. */
+    grant: string;
+}
+/**
+ * Build the inline script that runs the source decision on the landing page.
+ * Reads every browser global through `window`, so a test can run it against
+ * one fake object (the same seam the parse-time boot patch uses).
+ * @param hop - the probe payload for this landing render.
+ * @returns the `<script>` element to splice into the landing's head.
+ */
+export declare function appShellLanSwitchScript(hop: LanSourceHop): string;
+//# sourceMappingURL=lan-source.d.ts.map

package/lib/types/lan-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-source.d.ts","sourceRoot":"","sources":["../../src/lan-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,0BAA0B,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAA;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,SAAU,CAAA;AAEjD,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAA;IAChB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CA+DjE"}

package/lib/types/lan-source.js

@@ -0,0 +1,113 @@
+/**
+ * The landing page's network-source decision: which origin a paired phone
+ * should keep using.
+ *
+ * The QR link can only name one base, and the server cannot know whether the
+ * scanning phone sits on this machine's own network: the public (relayed)
+ * base is the only one that is always reachable, so the QR names it and the
+ * phone decides at connect time. The device-gated landing (/pair-app) is the
+ * plugin's own page already rendered ahead of the official shell's boot, so it
+ * is the natural place to probe: after the page is served, a short
+ * cross-origin `fetch` per LAN candidate (a no-cors GET at
+ * {@link LAN_PING_PATH}) tells the browser whether that LAN origin answers,
+ * and the first one that does becomes the new origin. A probe that finds
+ * nothing, or that runs out of budget, changes nothing — the page the phone
+ * already holds stays paired and usable, so the probe can never block pairing.
+ *
+ * Browsers do not block this probe. An https page may not normally fetch
+ * `http://` subresources, but a host that is an IP literal is exempt from both
+ * the block and the automatic upgrade (verified against Chrome: the console
+ * reports "This request was not upgraded to HTTPS because its URL's host is an
+ * IP address" and delivers the response), which is exactly the shape every LAN
+ * candidate has.
+ *
+ * @module @linxin666/dsh-remote-web-ui/lan-source
+ */
+/** sessionStorage key holding this session's source decision. */
+export const LAN_SOURCE_STORAGE_KEY = 'dsh-remote-lan-source';
+/**
+ * Probe budget for the whole candidate set. Long enough for a LAN round trip,
+ * short enough that a phone on another network never waits on it — the probe
+ * is fire-and-forget and the page it runs on is already usable.
+ */
+export const LAN_SOURCE_PROBE_TIMEOUT_MS = 800;
+/**
+ * How recently a LAN hop must have been taken for a return to a non-LAN origin
+ * to read as "the hop did not stick". A phone that fails to load the LAN page
+ * re-scans the QR (which always names the public base) within seconds, and the
+ * landing then has to choose the public source instead of hopping again into
+ * the same black hole; a deliberate return much later is a fresh decision and
+ * re-probes.
+ */
+export const LAN_SOURCE_RETRY_WINDOW_MS = 120_000;
+/**
+ * Build the inline script that runs the source decision on the landing page.
+ * Reads every browser global through `window`, so a test can run it against
+ * one fake object (the same seam the parse-time boot patch uses).
+ * @param hop - the probe payload for this landing render.
+ * @returns the `<script>` element to splice into the landing's head.
+ */
+export function appShellLanSwitchScript(hop) {
+    const payload = JSON.stringify({
+        key: LAN_SOURCE_STORAGE_KEY,
+        candidates: hop.candidates,
+        path: hop.path,
+        ping: hop.pingPath,
+        grant: hop.grant,
+        timeout: LAN_SOURCE_PROBE_TIMEOUT_MS,
+        retry: LAN_SOURCE_RETRY_WINDOW_MS,
+    });
+    const body = '(function(){try{' +
+        'var w=window,loc=w.location;' +
+        'var P=' + payload + ';' +
+        'var S=w.sessionStorage;' +
+        // The candidate set is the decision's identity: a host whose interfaces
+        // changed hands the landing a different signature, which forces a re-probe.
+        'P.sig=P.candidates.join(",");' +
+        // The stored decision: which source this session settled on, the candidate
+        // set it was made against (so a host whose interfaces changed re-decides),
+        // and when. Anything unreadable is treated as "no decision".
+        'function rd(){try{' +
+        'var raw=S.getItem(P.key);' +
+        'if(typeof raw!=="string"||raw==="")return undefined;' +
+        'var d=JSON.parse(raw);' +
+        'if(typeof d!=="object"||d===null)return undefined;' +
+        'if(d.src!=="lan"&&d.src!=="public")return undefined;' +
+        'if(typeof d.sig!=="string"||typeof d.at!=="number")return undefined;' +
+        'return d' +
+        '}catch(e){return undefined}}' +
+        'function wr(d){try{S.setItem(P.key,JSON.stringify(d))}catch(e){}}' +
+        // Already on a LAN candidate: nothing to decide, and a hop back to it
+        // would be the same origin. Recording the fact keeps a reload from probing.
+        'function own(){for(var i=0;i<P.candidates.length;i++){if(P.candidates[i]===loc.origin)return true}return false}' +
+        'function go(base){try{loc.replace(base+P.path+"?grant="+encodeURIComponent(P.grant))}catch(e){}}' +
+        'function probe(){' +
+        'if(typeof w.fetch!=="function")return;' +
+        'var settled=false;' +
+        'var timer=w.setTimeout(function(){finish(undefined)},P.timeout);' +
+        'function finish(base){' +
+        'if(settled)return;' +
+        'settled=true;' +
+        'try{w.clearTimeout(timer)}catch(e){}' +
+        // The first answer wins: one reachable candidate is all the hop needs, and
+        // the losers keep running their own no-cors GETs harmlessly.
+        'if(base===undefined){wr({src:"public",sig:P.sig,at:Date.now()});return}' +
+        'wr({src:"lan",sig:P.sig,base:base,at:Date.now()});' +
+        'go(base)}' +
+        'for(var i=0;i<P.candidates.length;i++){(function(base){' +
+        'var sent;' +
+        'try{sent=w.fetch(base+P.ping,{mode:"no-cors",cache:"no-store",credentials:"omit",referrerPolicy:"no-referrer"})}catch(e){sent=undefined}' +
+        'if(sent===undefined||typeof sent.then!=="function")return;' +
+        'sent.then(function(){finish(base)},function(){})' +
+        '})(P.candidates[i])}}' +
+        'var d=rd();' +
+        'if(own()){if(d===undefined||d.sig!==P.sig)wr({src:"lan",sig:P.sig,base:loc.origin,at:Date.now()});return}' +
+        'if(d!==undefined&&d.sig===P.sig){' +
+        'if(d.src==="public")return;' +
+        // A LAN decision taken moments ago, on a page that is not a LAN candidate,
+        // is a hop that did not stick. Fall back rather than hop again.
+        'if(Date.now()-d.at<P.retry){wr({src:"public",sig:P.sig,at:Date.now()});return}}' +
+        'probe()' +
+        '}catch(e){}})();';
+    return `<script>${body}</script>`;
+}