dsh-deeppilot 0.6.0-alpha.3 → 0.6.0

package/lib/index.js

@@ -1,7 +1,6 @@
 import { createRequire } from "node:module";
-import { createServer } from "node:http";
 import { createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, sign, timingSafeEqual, verify } from "node:crypto";
-import { access, chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, mkdir, readFile, readdir, rename, rm, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { WebSocketServer } from "ws";
 import { homedir, networkInterfaces } from "node:os";
@@ -15,8 +14,11 @@ import { fileURLToPath } from "node:url";
 import { request } from "node:https";
 import z from "@deepseek-ai/schemastery";
 import { isIP } from "node:net";
+import { createServer } from "node:http";
 //#region src/device-auth.ts
-const PAIRING_CODE_TTL_MS = 3e5;
+function getPairingCodeTtlMs() {
+	return Number(process.env.DEEPPILOT_PAIRING_TTL_MS) || 3e5;
+}
 const AUTH_CHALLENGE_TTL_MS = 3e4;
 const DEVICE_SCOPES = [
 	"sessions.read",
@@ -106,7 +108,7 @@ var PairingCodeManager = class {
 	issue(now = Date.now()) {
 		const grant = {
 			code: randomBytes(24).toString("base64url"),
-			expiresAt: now + PAIRING_CODE_TTL_MS
+			expiresAt: now + getPairingCodeTtlMs()
 		};
 		this.active = grant;
 		return { ...grant };
@@ -3197,6 +3199,28 @@ function parseRemote(value) {
 		updatedAt: int(s, "updatedAt", "remote.updatedAt")
 	};
 }
+function parseLocal(value) {
+	const s = rec(value, "local");
+	const phase = str(s, "phase", "local.phase");
+	if (![
+		"disabled",
+		"starting",
+		"online",
+		"error",
+		"stopped"
+	].includes(phase)) reject("local.phase");
+	const endpoints = s.endpoints;
+	if (!Array.isArray(endpoints) || endpoints.some((entry) => typeof entry !== "string")) reject("local.endpoints");
+	const message = s.message;
+	if (message !== void 0 && typeof message !== "string") reject("local.message");
+	return {
+		phase,
+		port: int(s, "port", "local.port"),
+		endpoints,
+		...typeof message === "string" ? { message } : {},
+		updatedAt: int(s, "updatedAt", "local.updatedAt")
+	};
+}
 function parseRelayTestStep(value) {
 	const st = rec(value, "step");
 	const id = str(st, "id", "step.id");
@@ -3278,6 +3302,7 @@ function parseReport(value) {
 		historyBufferMax: int(s, "historyBufferMax", "historyBufferMax"),
 		debug: bool(s, "debug", "debug"),
 		lanAddresses,
+		local: parseLocal(s.local),
 		remote: parseRemote(s.remote),
 		devices: devices.map(parseDevice)
 	};
@@ -3437,7 +3462,32 @@ function applyReportRemote(ctx, snapshot, pairingStarter, deviceRevoker, deviceS
 	});
 }
 //#endregion
+//#region src/relay-url.ts
+/**
+* Normalize an operator-configured relay URL without a backtracking regular
+* expression. Scanning from the end keeps even pathological inputs linear.
+*/
+function normalizeRelayBaseUrl(value) {
+	const trimmed = value.trim();
+	let end = trimmed.length;
+	while (end > 0 && trimmed.charCodeAt(end - 1) === 47) end -= 1;
+	return end === trimmed.length ? trimmed : trimmed.slice(0, end);
+}
+//#endregion
 //#region src/relay-test.ts
+/**
+* Relay connectivity self-test used by the settings page "测试中继" button.
+*
+* Two steps mirror what zero-touch enrollment actually does:
+*   1. health  — GET {url}/healthz        → is the relay reachable?
+*   2. enroll  — POST {url}/v1/enroll     → does the shared key grant a token?
+*
+* The enroll step doubles as a repair path: a token it issues is handed back
+* via `onEnrolled` so the bridge caches it and flips push readiness without
+* waiting for the next app registration.
+*
+* Transport is injectable (`fetchImpl`) so tests never touch the network.
+*/
 const DEFAULT_TIMEOUT_MS = 6e3;
 async function requestJson(fetchImpl, url, init, timeoutMs) {
 	const response = await fetchImpl(url, {
@@ -3454,7 +3504,7 @@ async function requestJson(fetchImpl, url, init, timeoutMs) {
 	};
 }
 async function runRelayProbe(options) {
-	const base = options.url.trim().replace(/\/+$/, "");
+	const base = normalizeRelayBaseUrl(options.url);
 	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
 	const fetchImpl = options.fetchImpl ?? fetch;
 	const steps = [];
@@ -3764,7 +3814,7 @@ var RelayClient = class {
 	debug;
 	log;
 	constructor(opts) {
-		this.base = opts.url.trim().replace(/\/+$/, "");
+		this.base = normalizeRelayBaseUrl(opts.url);
 		this.token = (opts.token ?? "").trim();
 		this.timeoutMs = opts.timeoutMs ?? 1e4;
 		this.debug = opts.debug === true;
@@ -3895,6 +3945,137 @@ function tunnelHelperArguments(originURL, statePath, options) {
 		String(normalizeFunnelConnectionLimit(options.maxConnectionsPerSource))
 	];
 }
+/**
+* Summarize a fatal helper crash from its stderr tail. Go panics dump the
+* actual reason on the `panic:` line while the trailing stack frames are
+* `file.go:NN +0xOFF` noise — the old behavior of reporting only the final
+* line surfaced exactly that noise (e.g. `.../singleflight.go:194 +0x45c`)
+* and hid the real panic message. Keep the crash header line (a raw
+* `panic:`, a runtime `fatal error:`, or net/http's `http: panic serving`),
+* plus an optional `[signal ...]` continuation and the first non-runtime
+* stack frame's symbol + `file.go:NN` as a location hint. Pointer offsets
+* are not architecture stable, so they are deliberately dropped.
+*
+* The frame symbol sits on the line just above the indented source line in a
+* Go dump, e.g.:
+*   tailscale.com/net/dnscache.(*Resolver).lookupIP(0x1400012c000, {...})
+*       tailscale.com@v1.102.3/net/dnscache/dnscache.go:604 +0x25c
+* The first symbol (shortened) is used because a bare `file.go:NN` is not
+* unique across tailscale (singleflight.go is one example).
+*/
+function helperCrashSummary(stderr) {
+	const lines = stderr.split(/\r?\n/);
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i].trim();
+		if (line === "") continue;
+		const logTimestamp = /^(\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2} )/.exec(line)?.[1] ?? "";
+		if (!/^(panic:|fatal error:|http: panic serving)/.test(logTimestamp.length > 0 ? line.slice(logTimestamp.length) : line)) continue;
+		let summary = logTimestamp.length > 0 ? line.slice(logTimestamp.length) : line;
+		const next = lines[i + 1]?.trim();
+		if (next?.startsWith("[signal")) summary += " " + next;
+		let lastSymbol;
+		for (let j = i + 1; j < lines.length; j++) {
+			const frame = lines[j];
+			const trimmed = frame.trim();
+			if (trimmed === "") continue;
+			const sourceMatch = /^\s+(\S+\.go:\d+)/.exec(frame);
+			if (sourceMatch !== null) {
+				const source = sourceMatch[1];
+				if (source.startsWith("runtime/") || source.startsWith("runtime\\")) {
+					lastSymbol = void 0;
+					continue;
+				}
+				const slash = Math.max(source.lastIndexOf("/"), source.lastIndexOf("\\"));
+				const file = slash >= 0 ? source.slice(slash + 1) : source;
+				const symbol = lastSymbol !== void 0 ? shortenSymbol(lastSymbol) : void 0;
+				summary += " @ " + (symbol !== void 0 ? `${symbol} (${file})` : file);
+				break;
+			}
+			if (trimmed.includes("(") || trimmed.endsWith(")")) lastSymbol = trimmed;
+		}
+		return summary.replace(/\s+/g, " ").trim();
+	}
+	for (let i = lines.length - 1; i >= 0; i--) {
+		const line = lines[i].trim();
+		if (line !== "") return line;
+	}
+	return "";
+}
+/** Shrink a Go frame symbol to `pkg.Receiver.method` form (drop module-root
+*  path, generic type arguments and the trailing call arguments), so the
+*  summary hint stays readable. Keeps a `.funcN` closure suffix when present
+*  (e.g. `doCall.func2`), since it identifies the exact closure.
+*
+*  A symbol looks like:
+*    tailscale.com/util/singleflight.(*Group[...]).doCall.func2(0x…, …)
+*  The trailing call arguments form a balanced paren group that starts at
+*  the function name — that group is stripped first; generics appear only
+*  inside `(*Group[...])` receiver brackets before the final method dot, so
+*  they are removed by trimming from the first `[` to the matching `]`.
+*/
+function shortenSymbol(symbol) {
+	const trimmed = symbol.trim();
+	let end = trimmed.length;
+	if (trimmed.endsWith(")")) {
+		let depth = 0;
+		for (let i = trimmed.length - 1; i >= 0; i--) {
+			const ch = trimmed[i];
+			if (ch === ")") depth++;
+			else if (ch === "(") {
+				depth--;
+				if (depth === 0) {
+					end = i;
+					break;
+				}
+			}
+		}
+	}
+	let name = trimmed.slice(0, end).trim();
+	const bracketOpen = name.indexOf("[");
+	if (bracketOpen >= 0) {
+		const bracketClose = name.indexOf("]", bracketOpen);
+		if (bracketClose > bracketOpen) name = name.slice(0, bracketOpen) + name.slice(bracketClose + 1);
+	}
+	const slash = Math.max(name.lastIndexOf("/"), name.lastIndexOf("\\"));
+	return slash >= 0 ? name.slice(slash + 1) : name;
+}
+/** Shared by crash summary and dump: whether the stderr looks like a Go
+*  panic/fatal-error crash (vs. an ordinary exit). */
+function looksLikeCrash(stderr) {
+	return /(?:^|\n)\s*(?:\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2} )?(?:panic:|fatal error:|http: panic serving)/.test(stderr);
+}
+/** Turn a crash stderr tail into a status message and optionally persist the
+*  full dump under the state dir. Keeps at most MAX_CRASH_DUMPS dump files. */
+async function analyzeCrashExit(stderr, statePath) {
+	const summary = helperCrashSummary(stderr) || "helper exited";
+	if (!looksLikeCrash(stderr) || stderr.trim() === "") return { summary };
+	const target = statePath.trim();
+	if (target === "") return { summary };
+	try {
+		const file = join(target, `crash-${Date.now()}.log`);
+		await writeFile(file, stderr, { mode: 384 });
+		await trimCrashDumps(target);
+		return {
+			summary,
+			dumpPath: file
+		};
+	} catch {
+		return { summary };
+	}
+}
+/** Remove oldest crash-*.log files beyond MAX_CRASH_DUMPS. */
+async function trimCrashDumps(dir) {
+	let names;
+	try {
+		names = (await readdir(dir)).filter((name) => name.startsWith("crash-") && name.endsWith(".log"));
+	} catch {
+		return;
+	}
+	if (names.length <= 6) return;
+	names.sort();
+	const excess = names.length - 6;
+	await Promise.all(names.slice(0, excess).map((name) => rm(join(dir, name), { force: true }).catch(() => {})));
+}
 /** Parse one helper IPC line without ever evaluating or interpolating it. */
 function parseHelperEvent(line) {
 	try {
@@ -4049,7 +4230,7 @@ var RemoteSupervisor = class {
 		let stderrBuffer = "";
 		child.stderr.setEncoding("utf8");
 		child.stderr.on("data", (chunk) => {
-			stderrBuffer = (stderrBuffer + chunk).slice(-2e3);
+			stderrBuffer = (stderrBuffer + chunk).slice(-16e3);
 		});
 		child.once("error", (error) => {
 			this.setStatus({
@@ -4057,7 +4238,7 @@ var RemoteSupervisor = class {
 				message: `helper launch failed: ${String(error)}`
 			});
 		});
-		child.once("exit", (code, signal) => {
+		child.once("exit", () => {
 			if (this.child === child) this.child = void 0;
 			if (this.stopping) {
 				this.setStatus({
@@ -4066,12 +4247,15 @@ var RemoteSupervisor = class {
 				});
 				return;
 			}
-			const detail = stderrBuffer.trim().split("\n").at(-1);
-			this.setStatus({
-				phase: "error",
-				message: detail || `helper exited (${signal ?? String(code)})`
+			analyzeCrashExit(stderrBuffer, this.options.statePath).then((analysis) => {
+				if (this.stopping) return;
+				const message = analysis.summary + (analysis.dumpPath !== void 0 ? ` (full dump: ${analysis.dumpPath})` : "");
+				this.setStatus({
+					phase: "error",
+					message
+				});
+				this.scheduleRestart(originURL, "crash");
 			});
-			this.scheduleRestart(originURL, "crash");
 		});
 	}
 	async dispose() {
@@ -4364,6 +4548,24 @@ var UpdateChecker = class {
 	dispose() {}
 };
 //#endregion
+//#region src/local-policy.ts
+const DEFAULT_LOCAL_PORT = 3098;
+const MIN_LOCAL_PORT = 1024;
+const MAX_LOCAL_PORT = 65535;
+function normalizeLocalPort(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1024 && value <= 65535 ? value : DEFAULT_LOCAL_PORT;
+}
+function localEndpointURLs(addresses, port) {
+	const normalizedPort = normalizeLocalPort(port);
+	return [...new Set(addresses)].map((address) => `http://${address}:${normalizedPort}`);
+}
+function localListenError(error, port) {
+	const code = error?.code;
+	if (code === "EADDRINUSE") return `local port ${port} is already in use`;
+	if (code === "EACCES") return `permission denied while opening local port ${port}`;
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
 //#region src/config.ts
 /** Operator-run relay used by distributed builds; overridable via config. */
 const DEFAULT_RELAY_URL = "https://pilot.hailab.dev";
@@ -4372,6 +4574,13 @@ const Config = z.object({
 	devicesPath: z.string().default(join(bridgeDataDir(), "devices-v2.json")),
 	historyBufferMax: z.natural().min(100).default(2e3),
 	debug: z.boolean().default(false),
+	local: z.object({
+		enabled: z.boolean().default(true),
+		port: z.natural().min(MIN_LOCAL_PORT).max(MAX_LOCAL_PORT).default(DEFAULT_LOCAL_PORT).description("DeepPilot 局域网独立端口（默认 3098，修改后本地连接会短暂重连）")
+	}).default({
+		enabled: true,
+		port: DEFAULT_LOCAL_PORT
+	}),
 	remote: z.object({
 		enabled: z.boolean().default(false),
 		provider: z.union(["tailscale-funnel"]).default("tailscale-funnel"),
@@ -4594,12 +4803,64 @@ function shouldReEnrollRelayToken(transport, outcome, reason, opts) {
 	return transport === "relay" && outcome === "failed" && reason === "HTTP 401" && opts.hasEnrollKey && opts.usedCellToken && opts.tokenStillCurrent;
 }
 //#endregion
+//#region src/phone-server.ts
+/**
+* A deliberately narrow transport listener. Both the LAN endpoint and the
+* loopback-only Funnel origin use this factory, so neither can accidentally
+* inherit DSH's wider web/API route surface.
+*/
+function createPhoneServer(handlers) {
+	const server = createServer((req, res) => {
+		const path = requestPath(req);
+		if (path === "/phone/health") handlers.health(req, res);
+		else if (path === "/phone/pair") handlers.pair(req, res);
+		else {
+			res.statusCode = 404;
+			res.end("not found");
+		}
+	});
+	server.on("upgrade", (req, socket, head) => {
+		if (requestPath(req) !== "/phone") {
+			socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+			return;
+		}
+		handlers.upgrade(req, socket, head);
+	});
+	return server;
+}
+function requestPath(req) {
+	try {
+		return new URL(req.url ?? "/", "http://phone.local").pathname;
+	} catch {
+		return "/";
+	}
+}
+function listen(server, port, host) {
+	return new Promise((resolve, reject) => {
+		const onError = (error) => {
+			server.off("listening", onListening);
+			reject(error);
+		};
+		const onListening = () => {
+			server.off("error", onError);
+			resolve();
+		};
+		server.once("error", onError);
+		server.once("listening", onListening);
+		server.listen(port, host);
+	});
+}
+function closeServer(server) {
+	if (server === void 0 || !server.listening) return Promise.resolve();
+	return new Promise((resolve) => server.close(() => resolve()));
+}
+//#endregion
 //#region src/index.ts
 /**
 * dsh-deeppilot — data bridge between the DSH host and DeepPilot
-* clients. Registers exactly one WebSocket upgrade route (/phone) plus an
-* optional health probe (/phone/health) on the existing web server. The web
-* UI is never touched.
+* clients. Owns independent, narrowly routed LAN and Funnel-origin listeners;
+* temporary compatibility routes remain on the existing DSH web server. The
+* web UI and the rest of DSH's API are never exposed by these listeners.
 *
 * Data plane: an in-process HostBridge consumes a local compatibility façade
 * over DSH 0.1.2 Session/Workspace controllers, mirrors session summaries,
@@ -4610,7 +4871,7 @@ function shouldReEnrollRelayToken(transport, outcome, reason, opts) {
 * Swift models mirror that v2 contract.
 */
 const name = "deeppilot";
-/** No eager service requirement: profiles without a web stack simply skip. */
+/** No eager web-service requirement: independent transports start on their own. */
 const inject = [];
 const SERVER_VERSION = readOwnPackageVersion();
 const MAX_CLIENT_CONNECTIONS = 16;
@@ -4650,6 +4911,7 @@ function apply(ctx, options) {
 	*/
 	let liveSource;
 	let scheduleRemoteReconcile;
+	let scheduleLocalReconcile;
 	const currentConfig = () => {
 		if (liveSource !== void 0) return normalizeOptions(liveSource());
 		return normalizeOptions(options);
@@ -4658,9 +4920,15 @@ function apply(ctx, options) {
 	const settingsHooks = {
 		setSource: (source) => {
 			liveSource = source;
-			queueMicrotask(() => scheduleRemoteReconcile?.());
+			queueMicrotask(() => {
+				scheduleLocalReconcile?.();
+				scheduleRemoteReconcile?.();
+			});
 		},
-		onChange: () => queueMicrotask(() => scheduleRemoteReconcile?.())
+		onChange: () => queueMicrotask(() => {
+			scheduleLocalReconcile?.();
+			scheduleRemoteReconcile?.();
+		})
 	};
 	ctx.inject(["settings"], (settingsCtx) => {
 		settingsCtx.settings.installSection(ctx, "deeppilot", Config, normalizeOptions(void 0), settingsHooks);
@@ -5066,6 +5334,16 @@ function apply(ctx, options) {
 		maxPayload: MAX_FRAME_BYTES
 	});
 	let remoteSupervisor;
+	let localState = {
+		phase: currentConfig().enabled === true && currentConfig().local?.enabled !== false ? "starting" : "disabled",
+		port: normalizeLocalPort(currentConfig().local?.port),
+		endpoints: [],
+		updatedAt: Date.now()
+	};
+	const localStatus = (addresses) => ({
+		...localState,
+		endpoints: localState.phase === "online" ? localEndpointURLs(addresses, localState.port) : []
+	});
 	const remoteStatus = () => remoteSupervisor?.status() ?? {
 		provider: "tailscale-funnel",
 		phase: currentConfig().remote?.enabled === true ? "stopped" : "disabled",
@@ -5099,6 +5377,7 @@ function apply(ctx, options) {
 			}));
 		} catch {}
 		const update = updateInfo();
+		const lanAddresses = localLANIPv4Addresses();
 		return {
 			protocolVersion: 2,
 			serverVersion: SERVER_VERSION,
@@ -5111,7 +5390,8 @@ function apply(ctx, options) {
 			activeConnections: connections.size,
 			historyBufferMax: currentConfig().historyBufferMax ?? 2e3,
 			debug: currentConfig().debug === true,
-			lanAddresses: localLANIPv4Addresses(),
+			lanAddresses,
+			local: localStatus(lanAddresses),
 			remote: remoteStatus(),
 			devices
 		};
@@ -5381,6 +5661,158 @@ function apply(ctx, options) {
 			res.end(JSON.stringify({ ok: false }));
 		}
 	};
+	const phoneHandlers = {
+		health: handleHealth,
+		pair: handlePair,
+		upgrade: handleUpgrade
+	};
+	let localServer;
+	let appliedLocalKey;
+	let localDisposed = false;
+	let localTail = Promise.resolve();
+	const reconcileLocal = async () => {
+		if (localDisposed) return;
+		const config = currentConfig();
+		const localConfig = config.local ?? {};
+		const next = {
+			enabled: config.enabled === true && localConfig.enabled !== false,
+			port: normalizeLocalPort(localConfig.port)
+		};
+		const nextKey = JSON.stringify(next);
+		if (nextKey === appliedLocalKey) return;
+		appliedLocalKey = nextKey;
+		const previous = localServer;
+		localServer = void 0;
+		await closeServer(previous);
+		if (localDisposed) return;
+		if (!next.enabled) {
+			localState = {
+				phase: "disabled",
+				port: next.port,
+				endpoints: [],
+				updatedAt: Date.now()
+			};
+			log("local transport disabled");
+			return;
+		}
+		localState = {
+			phase: "starting",
+			port: next.port,
+			endpoints: [],
+			updatedAt: Date.now()
+		};
+		const server = createPhoneServer(phoneHandlers);
+		localServer = server;
+		try {
+			await listen(server, next.port, "0.0.0.0");
+			if (localDisposed || localServer !== server) {
+				await closeServer(server);
+				return;
+			}
+			localState = {
+				phase: "online",
+				port: next.port,
+				endpoints: [],
+				updatedAt: Date.now()
+			};
+			log(`local transport listening on 0.0.0.0:${next.port}`);
+		} catch (error) {
+			if (localServer === server) localServer = void 0;
+			await closeServer(server);
+			const message = localListenError(error, next.port);
+			localState = {
+				phase: "error",
+				port: next.port,
+				endpoints: [],
+				message,
+				updatedAt: Date.now()
+			};
+			log("local transport failed: " + message);
+		}
+	};
+	scheduleLocalReconcile = () => {
+		localTail = localTail.then(reconcileLocal).catch((error) => log("local reconcile failed: " + String(error)));
+	};
+	const originServer = createPhoneServer(phoneHandlers);
+	let originURL;
+	let appliedRemoteKey;
+	let remoteDisposed = false;
+	let remoteTail = Promise.resolve();
+	const reconcileRemote = async () => {
+		if (remoteDisposed || originURL === void 0) return;
+		const config = currentConfig();
+		const remoteConfig = config.remote ?? {};
+		const remotePort = remoteConfig.funnelPort === 8443 || remoteConfig.funnelPort === 1e4 ? remoteConfig.funnelPort : 443;
+		const helperPath = remoteConfig.helperPath?.trim() || void 0;
+		const next = {
+			enabled: config.enabled === true && remoteConfig.enabled === true && remoteConfig.provider === "tailscale-funnel",
+			hostname: normalizeRemoteHostname(remoteConfig.hostname),
+			statePath: remoteConfig.statePath?.trim() || join(dataDir, "tailscale"),
+			helperPath,
+			funnelPort: remotePort,
+			maxConnectionsPerSource: normalizeFunnelConnectionLimit(remoteConfig.maxConnectionsPerSource)
+		};
+		const nextKey = JSON.stringify(next);
+		if (nextKey === appliedRemoteKey) return;
+		const previous = remoteSupervisor;
+		remoteSupervisor = void 0;
+		if (previous !== void 0) await previous.dispose();
+		if (remoteDisposed) return;
+		const supervisor = new RemoteSupervisor({
+			enabled: next.enabled,
+			hostname: next.hostname,
+			statePath: next.statePath,
+			...next.helperPath ? { helperPath: next.helperPath } : {},
+			funnelPort: next.funnelPort,
+			maxConnectionsPerSource: next.maxConnectionsPerSource,
+			log
+		});
+		remoteSupervisor = supervisor;
+		appliedRemoteKey = nextKey;
+		await supervisor.start(originURL);
+	};
+	scheduleRemoteReconcile = () => {
+		remoteTail = remoteTail.then(reconcileRemote).catch((error) => log("remote reconcile failed: " + String(error)));
+	};
+	ctx.effect(() => {
+		scheduleLocalReconcile?.();
+		listen(originServer, 0, "127.0.0.1").then(() => {
+			const address = originServer.address();
+			if (address && typeof address === "object") {
+				originURL = `http://127.0.0.1:${address.port}`;
+				scheduleRemoteReconcile?.();
+			}
+		}, (error) => log("remote origin failed: " + String(error)));
+		return async () => {
+			localDisposed = true;
+			remoteDisposed = true;
+			scheduleLocalReconcile = void 0;
+			scheduleRemoteReconcile = void 0;
+			const activeLocal = localServer;
+			localServer = void 0;
+			await Promise.allSettled([closeServer(activeLocal), closeServer(originServer)]);
+			localState = {
+				phase: "stopped",
+				port: localState.port,
+				endpoints: [],
+				updatedAt: Date.now()
+			};
+			await Promise.allSettled([localTail, remoteTail.then(async () => {
+				const supervisor = remoteSupervisor;
+				remoteSupervisor = void 0;
+				if (supervisor !== void 0) await supervisor.dispose();
+			})]);
+		};
+	}, "deeppilot: independent transports");
+	const sweep = setInterval(() => {
+		const now = Date.now();
+		for (const connection of connections) if (connection.isStale(now, 6e4)) {
+			log("dropping stale connection");
+			connection.closeIdle();
+			connections.delete(connection);
+		}
+	}, 3e4);
+	ctx.effect(() => () => clearInterval(sweep), "deeppilot: stale sweep");
 	/**
 	* Whether the resident Gateway Client represents a real phone surface. A
 	* paired device remains answerable even while offline: HostBridge retains an
@@ -5423,7 +5855,7 @@ function apply(ctx, options) {
 		const webCtx = sub;
 		const web = webCtx.webServer;
 		if (!web) {
-			log("webServer service absent in this profile; bridge stays inactive");
+			log("webServer service absent; 3080 compatibility routes unavailable (independent transports remain active)");
 			return;
 		}
 		webCtx.effect(() => web.registerUpgrade({
@@ -5440,98 +5872,8 @@ function apply(ctx, options) {
 			path: "/phone/pair",
 			handler: handlePair
 		}), "deeppilot: /phone/pair");
-		const sweep = setInterval(() => {
-			const now = Date.now();
-			for (const connection of connections) if (connection.isStale(now, 6e4)) {
-				log("dropping stale connection");
-				connection.closeIdle();
-				connections.delete(connection);
-			}
-		}, 3e4);
-		webCtx.effect(() => () => clearInterval(sweep), "deeppilot: stale sweep");
-		const originServer = createServer((req, res) => {
-			let path = "/";
-			try {
-				path = new URL(req.url ?? "/", "http://phone.local").pathname;
-			} catch {}
-			if (path === "/phone/health") handleHealth(req, res);
-			else if (path === "/phone/pair") handlePair(req, res);
-			else {
-				res.statusCode = 404;
-				res.end("not found");
-			}
-		});
-		originServer.on("upgrade", (req, socket, head) => {
-			let path = "/";
-			try {
-				path = new URL(req.url ?? "/", "http://phone.local").pathname;
-			} catch {}
-			if (path !== "/phone") {
-				socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
-				return;
-			}
-			handleUpgrade(req, socket, head);
-		});
-		let originURL;
-		let appliedRemoteKey;
-		let remoteDisposed = false;
-		let reconcileTail = Promise.resolve();
-		const reconcileRemote = async () => {
-			if (remoteDisposed || originURL === void 0) return;
-			const config = currentConfig();
-			const remoteConfig = config.remote ?? {};
-			const remotePort = remoteConfig.funnelPort === 8443 || remoteConfig.funnelPort === 1e4 ? remoteConfig.funnelPort : 443;
-			const helperPath = remoteConfig.helperPath?.trim() || void 0;
-			const next = {
-				enabled: config.enabled === true && remoteConfig.enabled === true && remoteConfig.provider === "tailscale-funnel",
-				hostname: normalizeRemoteHostname(remoteConfig.hostname),
-				statePath: remoteConfig.statePath?.trim() || join(dataDir, "tailscale"),
-				helperPath,
-				funnelPort: remotePort,
-				maxConnectionsPerSource: normalizeFunnelConnectionLimit(remoteConfig.maxConnectionsPerSource)
-			};
-			const nextKey = JSON.stringify(next);
-			if (nextKey === appliedRemoteKey) return;
-			const previous = remoteSupervisor;
-			remoteSupervisor = void 0;
-			if (previous !== void 0) await previous.dispose();
-			if (remoteDisposed) return;
-			const supervisor = new RemoteSupervisor({
-				enabled: next.enabled,
-				hostname: next.hostname,
-				statePath: next.statePath,
-				...next.helperPath ? { helperPath: next.helperPath } : {},
-				funnelPort: next.funnelPort,
-				maxConnectionsPerSource: next.maxConnectionsPerSource,
-				log
-			});
-			remoteSupervisor = supervisor;
-			appliedRemoteKey = nextKey;
-			await supervisor.start(originURL);
-		};
-		scheduleRemoteReconcile = () => {
-			reconcileTail = reconcileTail.then(reconcileRemote).catch((error) => log("remote reconcile failed: " + String(error)));
-		};
-		originServer.listen(0, "127.0.0.1", () => {
-			const address = originServer.address();
-			if (address && typeof address === "object") {
-				originURL = `http://127.0.0.1:${address.port}`;
-				scheduleRemoteReconcile?.();
-			}
-		});
-		originServer.on("error", (error) => log("remote origin failed: " + String(error)));
-		webCtx.effect(() => () => {
-			remoteDisposed = true;
-			scheduleRemoteReconcile = void 0;
-			originServer.close();
-			reconcileTail = reconcileTail.then(async () => {
-				const supervisor = remoteSupervisor;
-				remoteSupervisor = void 0;
-				if (supervisor !== void 0) await supervisor.dispose();
-			});
-		}, "deeppilot: embedded Funnel");
-		if (enabledNow()) log("/phone WebSocket registered");
-		else log("bridge disabled; /phone refuses connections until re-enabled and restarted");
+		if (enabledNow()) log("/phone compatibility routes registered on DSH web server");
+		else log("bridge disabled; /phone refuses connections until re-enabled");
 	});
 	ctx.effect(() => async () => {
 		closeAllConnections();