dsh-mobile-access 0.0.0-stage → 1.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-mobile-access contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,196 @@
-# Temporary Holding Version
+# 手机访问（dsh-mobile-access）
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+一个独立的 TypeScript DSH bundle：让同一局域网内的 iPhone / iPad 用自带 Safari 安全打开 Mac 上的官方 DeepSeek Harness Web，并在左侧栏提供一个「手机访问」入口。
+
+它只增加三个精确路由和一个客户端面板，不修改 DSH 核心、不改认证、不替换页面根节点、不注册 Service Worker，也不拦截现有请求，因此 Mac 上原有的 DSH Web 使用方式保持不变。
+
+## 解决什么问题
+
+DSH Web 在局域网上打开裸地址时会返回 401：
+
+```text
+dsh web authentication required; reopen the URL printed by dsh web.
+```
+
+这是正常的认证保护，不是网络故障。手机无法输入终端里那条带 `?token=` 的长链接，本插件用「8 位配对码」完成一次安全配对：
+
+1. Mac 的 DSH 左侧栏打开「手机访问」。
+2. iPhone Safari 打开面板显示的短地址，例如 `http://192.168.71.37:3080/m`。
+3. 输入 Mac 面板上的 8 位数字。
+4. 服务器在响应中直接签发 HttpOnly 登录 Cookie，然后跳转到 `/` 进入完整 DSH Web。
+
+**启动令牌不会出现在手机地址栏、浏览器历史或 Referer 中。** 配对成功后，手机获得与 Mac 浏览器相同的登录 Cookie 生命周期（默认 30 天）。
+
+## 前置条件
+
+- Mac 与 iPhone 在同一局域网，且路由器未开启客户端隔离（AP isolation）。
+- DSH Web 监听的是具体局域网地址，而不是 `127.0.0.1`。
+  - 本机当前配置在 `/Users/open/.dsh/profiles/web/cordis.patch.yml` 的 `webserver` 行：`host: 192.168.71.37`、`port: 3080`。
+- 手机访问 `http://<Mac局域网IP>:3080/m`；若使用 HTTPS，必须是手机信任的证书，否则 Safari 会先拦截。
+
+## 安装
+
+推荐使用官方 DSH CLI 一次安装。已发布到 npm：
+
+```bash
+dsh plugin --profile web add dsh-mobile-access@latest
+```
+
+`dsh plugin` 会在 profile 目录执行 pnpm 安装，并自动把声明了 `dsh.bundle.patch` 的包追加到 `dsh.profile.bundles`；不需要手工编辑 `cordis.patch.yml` 或 bundle 列表。
+
+从本目录安装（开发机、未发布版本或离线环境）：
+
+```bash
+cd /Users/open/Documents/Stocks/plugins/dsh-mobile-access
+npm run verify
+dsh plugin --profile web add /Users/open/Documents/Stocks/plugins/dsh-mobile-access
+```
+
+也可以使用 `npm pack` 生成 tgz 后安装：
+
+```bash
+npm pack
+dsh plugin --profile web add /absolute/path/to/dsh-mobile-access-1.0.1.tgz
+```
+
+如果 DSH 正在运行，安装后的 host bundle 可能需要重启才能加载；插件管理器提示 `restart-required` 时，**不要自行重启**，按项目约定通知用户手工重启 DSH，用户确认「已重启」后再继续。已有环境也可以继续使用 DSH 插件管理入口的 `install_bundle`，目标为本目录的绝对路径；两种方式等价。
+
+## 使用
+
+### Mac 端
+
+1. 打开 DSH Web，左侧栏应出现手机图标「手机访问」。
+2. 面板会显示：
+   - 配对地址，例如 `http://192.168.71.37:3080/m`
+   - 8 位配对码，例如 `1234 5678`
+   - 剩余时间、最近配对时间、成功配对次数
+   - 「复制链接」「复制配对码」「刷新配对码」
+   - 手机兼容性自检
+3. 如果面板提示「当前绑定在回环地址」，说明 DSH 只监听了 `127.0.0.1`，手机无法连接；需要把 `webserver.host` 改为 Mac 的局域网 IP，再由用户手工重启 DSH。
+
+### iPhone 端
+
+1. 确认 iPhone 与 Mac 在同一 Wi-Fi。
+2. 打开 Safari，访问 Mac 面板上显示的 `/m` 地址。
+3. 输入 8 位配对码，点「连接 DSH」。
+4. 成功后进入完整 DSH Web。建议：
+   - 点 Safari 分享按钮 → 「添加到主屏幕」。
+   - 以后从主屏幕图标进入；如果登录过期，重新打开一次 `/m` 配对即可。
+5. 若面板显示 `window.isSecureContext === false`，这是 HTTP 局域网的正常现象；本插件只对 iOS/iPadOS 安装一个窄范围的剪贴板回退，其他平台不会改动全局对象。
+
+## 路由与权限
+
+| 方法 | 路径 | 权限 | 用途 |
+|---|---|---|---|
+| GET | `/m` | 公开（Host 固定 + 一次性 nonce） | 显示配对页；已有有效 v1 页面 Cookie 时跳转 `/` |
+| POST | `/m` | 公开（Host 固定 + 一次性 nonce） | 校验 nonce 与配对码，签发 v1 HttpOnly Cookie |
+| GET | `/api/mobile-access/state` | 仅 owner | 面板读取状态、配对码、绑定地址诊断 |
+| POST | `/api/mobile-access/rotate` | 仅 owner | 刷新配对码并清空失败计数 |
+
+所有路由都是 `kind: 'exact'`。没有前缀路由，没有 fallback 路由，不接管 SPA 的 index。
+
+## 安全设计
+
+- 8 位数字配对码，使用 `crypto.getRandomValues` 生成，服务端使用常量时间比较。
+- 默认 10 分钟过期；每次刷新配对码都会清空失败计数。
+- 单 IP 5 次失败锁定；全局 20 次失败锁定；单 IP 每分钟最多 10 次尝试。
+- 配对成功由服务端调用 `authorizeIndex` 签发 Cookie，**不把启动令牌放进 303 的 Location**。
+- 配对 POST 校验 Host（固定为监听地址）、一次性 nonce、`Content-Type`，请求体上限 2048 字节。
+- 配对页带 CSP、`X-Frame-Options: DENY`、`Referrer-Policy: no-referrer`、`Cache-Control: no-store`。
+- 状态与刷新接口走 Connection 的 owner-only Fetch 路由，不是公开接口。
+- 配对码和失败计数只在内存中，不写磁盘、不写日志。
+
+更完整的威胁模型见 `docs/security.md`。
+
+## 对 Mac 零影响的边界
+
+- 不修改 DSH 核心源码、profile 配置、认证密钥或 Cookie。
+- 不注册全局 CSS、字体、主题或布局补丁。
+- 不替换 `#root`，不挂载第二个应用。
+- 不注册 Service Worker，不缓存或改写现有请求。
+- 不启动后台轮询；面板只在挂载、窗口聚焦、页面可见时读取一次状态。
+- 全局剪贴板回退只在 **iOS/iPadOS 且非安全上下文** 时安装，并在插件销毁时恢复原 descriptor。
+- 插件注册失败只影响本插件自身；所有路由、slot、监听器和定时器都有清理路径。
+
+## 开发与验证
+
+```bash
+cd /Users/open/Documents/Stocks/plugins/dsh-mobile-access
+
+# 只做类型检查，不写文件
+node scripts/build.mjs --check
+
+# 构建根目录运行产物
+node scripts/build.mjs
+
+# 单元测试：配对服务 + HTTP 路由
+node --test tests/*.test.mjs
+
+# 完整门禁：类型检查、构建、测试、静态检查、npm pack 检查
+npm run verify
+```
+
+TypeScript 编译器默认使用当前环境的
+`/Users/open/deepseek-harness/node_modules/.bin/tsc`；也可通过 `DSH_TSC` 指定其他 `tsc`。
+
+### 产物结构
+
+```text
+index.js       host 入口（ESM）
+service.js     配对状态机
+routes.js      /m、/api/mobile-access/state、/api/mobile-access/rotate
+html.js        无依赖配对页
+types.js       结构性类型（编译后为空导出）
+client.js      浏览器端 bundle（单文件、无 import/export）
+cordis.patch.yml
+locale/*.json  meta 与 ui 文案
+icon.svg
+```
+
+`client.js` 由 `scripts/build.mjs` 把 `client-runtime.js` 与 `client.js` 两段拼接，并注入 `locale/*.json` 的 `ui` 字典和 `src/panel.css`，没有运行时依赖。
+
+## 常见问题
+
+### 手机打开 `/m` 一直是配对页，配对成功后仍回配对页
+
+- 检查 iPhone 是否允许 Cookie（Safari 设置 → 隐私与安全性 → 阻止所有 Cookie 必须关闭）。
+- 检查访问地址的 `Host` 是否与 Mac 面板上的地址完全一致（`192.168.71.37:3080` 与 `openmacbook-pro...` 是不同 authority，Cookie 不通用）。
+- 检查 DSH 是否在配对后被重启；启动令牌会随进程轮换，但已签发的 Cookie 仍然有效，除非签名密钥变化。
+
+### 配对码输入后提示「已锁定」
+
+在 Mac 面板点「刷新配对码」。锁定是安全设计，不会自动解锁。
+
+### 面板提示回环地址
+
+DSH 只绑定了 `127.0.0.1`，iPhone 无法访问。把 `webserver.host` 改为局域网 IP 后，**由用户手工重启 DSH**，不要让 agent 自行重启。
+
+### 复制按钮在 iPhone 上无反应
+
+本插件在 iOS 非安全上下文会安装剪贴板回退，并优先尝试 `navigator.clipboard`；若仍失败，请长按文本手动复制。Mac 不受此回退影响。
+
+### 是否支持 Android / 桌面浏览器
+
+配对页对现代浏览器通用；左侧栏面板在所有 DSH Web 客户端显示。剪贴板全局回退只在 iOS/iPadOS 生效。
+
+## 已知平台限制（不是插件缺陷）
+
+- iOS Safari 不支持桌面式拖放（Drag and Drop）；依赖该交互的桌面功能在 iPhone 上不可用。
+- iOS 会在后台挂起页面；长任务请保持 DSH 页面在前台。
+- Safari 的下载行为由 iOS 的「文件」App 接管，不能像 macOS 一样直接保存到任意目录。
+- 局域网 HTTP 不是安全上下文；依赖 `crypto.subtle`、Service Worker、Web Push 等安全上下文 API 的功能不可用。DSH 已对 UUID 和剪贴板做了回退，本插件再补一层 iOS 剪贴板回退。
+
+## 卸载
+
+通过 DSH 插件管理器移除 `dsh-mobile-access`。移除后：
+
+- 左侧栏入口消失；
+- `/m` 恢复为 SPA fallback（不再是配对页）；
+- `/api/mobile-access/*` 不再注册；
+- iOS 剪贴板回退被恢复。
+
+已签发的登录 Cookie 仍可能留在浏览器中，直到过期；这是 DSH 认证层的行为，不是插件写入的额外凭证。
+
+## 版本
+
+- `1.0.0` — 首个工程化版本：配对页、owner-only 状态/刷新、左侧栏面板、零 Mac 影响边界、单元/路由/静态门禁。

package/client.js

@@ -0,0 +1,396 @@
+"use strict";
+const STATE_PATH = '/api/mobile-access/state';
+const ROTATE_PATH = '/api/mobile-access/rotate';
+let React;
+const h = (type, props, ...children) => React.createElement(type, props, ...children);
+function useLocaleRevision(locale) {
+    const subscribe = React.useCallback((onChange) => {
+        if (locale === undefined)
+            return () => undefined;
+        return locale.subscribe(onChange);
+    }, [locale]);
+    const getSnapshot = React.useCallback(() => locale?.getSnapshot().revision ?? 0, [locale]);
+    React.useSyncExternalStore(subscribe, getSnapshot, getSnapshot);
+}
+function isAppleMobile() {
+    const navigatorLike = navigator;
+    return /iPad|iPhone|iPod/.test(navigatorLike.userAgent)
+        || (navigatorLike.platform === 'MacIntel' && (navigatorLike.maxTouchPoints ?? 0) > 1);
+}
+function legacyCopy(value) {
+    const area = document.createElement('textarea');
+    area.value = value;
+    area.setAttribute('readonly', '');
+    area.style.position = 'fixed';
+    area.style.top = '-1000px';
+    area.style.left = '-1000px';
+    area.style.opacity = '0';
+    area.style.fontSize = '16px';
+    document.body.appendChild(area);
+    let copied = false;
+    try {
+        area.select();
+        area.setSelectionRange(0, value.length);
+        copied = document.execCommand('copy');
+    }
+    catch {
+        copied = false;
+    }
+    finally {
+        area.remove();
+    }
+    return copied;
+}
+async function copyText(value) {
+    const clipboard = navigator.clipboard;
+    if (clipboard?.writeText !== undefined) {
+        try {
+            await clipboard.writeText(value);
+            return true;
+        }
+        catch {
+            return legacyCopy(value);
+        }
+    }
+    return legacyCopy(value);
+}
+/**
+ * On iOS an HTTP LAN page has no `navigator.clipboard`. A few existing DSH
+ * controls call it directly, so install a narrowly scoped fallback there only.
+ * The original descriptor is restored when the plugin is disposed.
+ */
+function installClipboardFallback() {
+    if (!isAppleMobile() || window.isSecureContext)
+        return () => undefined;
+    const navigatorLike = navigator;
+    if (navigatorLike.clipboard?.writeText !== undefined)
+        return () => undefined;
+    const fallback = {
+        writeText: async (value) => {
+            if (!legacyCopy(value))
+                throw new Error('clipboard fallback failed');
+        },
+    };
+    const prototype = Object.getPrototypeOf(navigator);
+    const targets = [prototype, navigator].filter((target) => target !== null);
+    for (const target of targets) {
+        let descriptor;
+        try {
+            descriptor = Object.getOwnPropertyDescriptor(target, 'clipboard');
+            if (descriptor?.configurable === false)
+                continue;
+            Object.defineProperty(target, 'clipboard', {
+                configurable: true,
+                enumerable: descriptor?.enumerable ?? true,
+                value: fallback,
+            });
+        }
+        catch {
+            continue;
+        }
+        return () => {
+            try {
+                if (descriptor === undefined) {
+                    delete target.clipboard;
+                }
+                else {
+                    Object.defineProperty(target, 'clipboard', descriptor);
+                }
+            }
+            catch {
+                // A host page that froze the descriptor wins; never throw during cleanup.
+            }
+        };
+    }
+    return () => undefined;
+}
+function useMobileAccessState() {
+    const [state, setState] = React.useState(null);
+    const [loading, setLoading] = React.useState(true);
+    const [error, setError] = React.useState(null);
+    const alive = React.useRef(true);
+    const reload = React.useCallback(async () => {
+        setLoading(true);
+        setError(null);
+        try {
+            const response = await fetch(STATE_PATH, {
+                cache: 'no-store',
+                credentials: 'same-origin',
+                headers: { accept: 'application/json' },
+            });
+            if (!response.ok)
+                throw new Error(`HTTP ${response.status}`);
+            const payload = await response.json();
+            if (payload?.ok !== true || typeof payload.expiresAt !== 'string')
+                throw new Error('invalid state payload');
+            if (alive.current)
+                setState(payload);
+        }
+        catch (caught) {
+            if (alive.current)
+                setError(caught instanceof Error ? caught.message : 'request failed');
+        }
+        finally {
+            if (alive.current)
+                setLoading(false);
+        }
+    }, []);
+    React.useEffect(() => {
+        alive.current = true;
+        void reload();
+        const onFocus = () => { void reload(); };
+        const onVisibility = () => {
+            if (document.visibilityState === 'visible')
+                void reload();
+        };
+        window.addEventListener('focus', onFocus);
+        document.addEventListener('visibilitychange', onVisibility);
+        return () => {
+            alive.current = false;
+            window.removeEventListener('focus', onFocus);
+            document.removeEventListener('visibilitychange', onVisibility);
+        };
+    }, [reload]);
+    return { state, loading, error, reload };
+}
+function useRemaining(expiresAt) {
+    const [now, setNow] = React.useState(() => Date.now());
+    React.useEffect(() => {
+        if (expiresAt === undefined)
+            return;
+        const expiry = new Date(expiresAt).getTime();
+        if (Number.isNaN(expiry) || Date.now() >= expiry)
+            return;
+        const timer = window.setInterval(() => {
+            const value = Date.now();
+            setNow(value);
+            if (value >= expiry)
+                window.clearInterval(timer);
+        }, 1000);
+        return () => window.clearInterval(timer);
+    }, [expiresAt]);
+    if (expiresAt === undefined)
+        return 0;
+    const expiry = new Date(expiresAt).getTime();
+    return Number.isNaN(expiry) ? 0 : Math.max(0, expiry - now);
+}
+function formatRemaining(milliseconds) {
+    const total = Math.max(0, Math.ceil(milliseconds / 1000));
+    const minutes = Math.floor(total / 60);
+    const seconds = total % 60;
+    return `${String(minutes).padStart(2, '0')}:${String(seconds).padStart(2, '0')}`;
+}
+async function runChecks() {
+    const checks = [];
+    checks.push(await copyText('D-SH-MOBILE-ACCESS-SELFTEST').then((ok) => ({ label: 'clipboard', status: ok ? 'pass' : 'fail', detail: ok ? 'writeText' : 'blocked' })));
+    const cryptoLike = globalThis.crypto;
+    checks.push({
+        label: 'crypto',
+        status: typeof cryptoLike?.getRandomValues === 'function' ? 'pass' : 'fail',
+        detail: typeof cryptoLike?.getRandomValues === 'function' ? 'getRandomValues' : 'missing',
+    });
+    try {
+        const key = '__dsh_mobile_access_probe__';
+        localStorage.setItem(key, '1');
+        localStorage.removeItem(key);
+        checks.push({ label: 'storage', status: 'pass', detail: 'localStorage' });
+    }
+    catch {
+        checks.push({ label: 'storage', status: 'warn', detail: 'unavailable or private mode' });
+    }
+    checks.push({
+        label: 'websocket',
+        status: typeof WebSocket === 'function' ? 'pass' : 'fail',
+        detail: typeof WebSocket === 'function' ? 'constructor' : 'missing',
+    });
+    checks.push({
+        label: 'viewport',
+        status: window.visualViewport != null ? 'pass' : 'warn',
+        detail: `${window.innerWidth}×${window.innerHeight}${window.visualViewport != null ? ` / vv ${Math.round(window.visualViewport.width)}` : ''}`,
+    });
+    checks.push({
+        label: 'network',
+        status: navigator.onLine ? 'pass' : 'warn',
+        detail: navigator.onLine ? 'online' : 'offline',
+    });
+    return checks;
+}
+function statusOf(state, loading, error, t) {
+    if (error !== null)
+        return { label: t('statusError'), tone: 'bad' };
+    if (state === null)
+        return { label: loading ? t('statusLoading') : t('statusError'), tone: 'muted' };
+    if (state.loopback)
+        return { label: t('statusLoopback'), tone: 'bad' };
+    if (state.locked)
+        return { label: t('statusLocked'), tone: 'bad' };
+    if (state.expired)
+        return { label: t('statusExpired'), tone: 'warn' };
+    return { label: t('statusReady'), tone: 'ok' };
+}
+
+"use strict";
+const NS = 'dsh-mobile-access';
+const PANEL_ID = 'mobile-access';
+const ZH = {"panel":"手机访问","title":"手机访问","subtitle":"在同一局域网内，用 iPhone 或 iPad 打开这台 Mac 上的官方 DSH。","statusLoading":"正在读取配对状态","statusReady":"已就绪","statusLoopback":"仅回环地址","statusLocked":"配对码已锁定","statusExpired":"配对码已过期","statusError":"暂时无法读取状态","errorTitle":"无法读取配对状态","retry":"重新加载","urlLabel":"iPhone 打开的地址","urlHint":"在 iPhone 的 Safari 地址栏输入这个地址。","codeLabel":"配对码","codeHint":"在 iPhone 的配对页输入这 8 位数字。","copyLink":"复制地址","copyCode":"复制配对码","copied":"已复制","copyFailed":"复制失败，请手动选择文本","rotate":"刷新配对码","rotating":"正在刷新…","toastRotated":"配对码已刷新","rotateFailed":"刷新失败，请重试","expiry":"有效至","expiresIn":"剩余","expired":"已过期","locked":"已锁定","never":"尚未配对","lastPaired":"最近配对","pairCount":"成功配对次数","stepsTitle":"在 iPhone 上连接","step1":"确认 iPhone 与 Mac 连接同一个 Wi-Fi，且没有开启会隔离设备的访客网络。","step2":"在 iPhone Safari 打开上面的地址，输入配对码并点「连接 DSH」。","step3":"配对成功后会自动进入 DSH；再点 Safari 分享按钮，选择「添加到主屏幕」。","diagnosticsTitle":"连接诊断","bindLabel":"Mac 监听地址","deviceLabel":"当前设备","deviceIOS":"iPhone / iPad","deviceOther":"电脑或其他设备","launchMode":"启动方式","standaloneYes":"已从主屏幕启动","standaloneNo":"浏览器标签页","secureYes":"安全上下文","secureNo":"HTTP 非安全上下文（剪贴板回退已启用）","loopbackTitle":"iPhone 现在无法连接","loopbackBody":"DSH 只监听了回环地址（localhost / 127.0.0.1）。请把 Host 的 webserver.host 改为这台 Mac 的局域网 IPv4 地址，然后由你手动重启 DSH。","httpTitle":"关于 HTTP 访问","httpBody":"当前是局域网 HTTP。DSH 已为 UUID 和多数复制按钮提供兼容实现；本插件会在 iPhone 上补齐直接调用 navigator.clipboard 的旧代码。","selftestTitle":"浏览器能力自检","selftestRun":"运行自检","selftestRunning":"正在自检…","selftestNote":"自检只读取浏览器能力，不修改 DSH 配置，也不影响 Mac。","checkClipboard":"剪贴板写入","checkCrypto":"安全随机数","checkStorage":"本地存储","checkWebSocket":"WebSocket","checkViewport":"移动端视口","checkOnline":"网络状态","checkPass":"通过","checkWarn":"注意","checkFail":"失败","limitsTitle":"平台边界（不是插件缺陷）","limit1":"iOS Safari 不支持桌面式拖放；文件请用系统选择器上传。","limit2":"iOS 会在后台挂起网页；长任务请保持 DSH 页面在前台。","limit3":"下载文件由 Safari 交给「文件」App，落点由 iOS 决定。","zeroImpactTitle":"对 Mac 的零影响设计","zeroImpactBody":"插件只增加三个精确路由、一个左侧栏入口和一个主面板；不修改核心代码、认证、配置、主题、布局或其他插件，也不在后台轮询。","mainAria":"手机访问面板","codeAria":"配对码","reload":"刷新","unknown":"未知"};
+const EN = {"panel":"Mobile Access","title":"Mobile Access","subtitle":"Open this Mac’s official DSH from an iPhone or iPad on the same LAN.","statusLoading":"Reading pairing state","statusReady":"Ready","statusLoopback":"Loopback only","statusLocked":"Code locked","statusExpired":"Code expired","statusError":"State unavailable","errorTitle":"Could not read pairing state","retry":"Reload","urlLabel":"Address for iPhone","urlHint":"Type this address into Safari on the iPhone.","codeLabel":"Pairing code","codeHint":"Enter these 8 digits on the iPhone pairing page.","copyLink":"Copy address","copyCode":"Copy code","copied":"Copied","copyFailed":"Copy failed; select the text manually","rotate":"New code","rotating":"Rotating…","toastRotated":"Pairing code rotated","rotateFailed":"Rotation failed; try again","expiry":"Valid until","expiresIn":"Remaining","expired":"Expired","locked":"Locked","never":"Never","lastPaired":"Last paired","pairCount":"Successful pairings","stepsTitle":"Connect from iPhone","step1":"Put the iPhone and the Mac on the same Wi-Fi, without client isolation.","step2":"Open the address in Safari, enter the code, and tap “Connect DSH”.","step3":"After pairing, use Safari Share → “Add to Home Screen”.","diagnosticsTitle":"Connection diagnostics","bindLabel":"Mac listener","deviceLabel":"This device","deviceIOS":"iPhone / iPad","deviceOther":"Computer or other device","launchMode":"Launch mode","standaloneYes":"Launched from Home Screen","standaloneNo":"Browser tab","secureYes":"Secure context","secureNo":"HTTP insecure context (clipboard fallback enabled)","loopbackTitle":"The iPhone cannot connect yet","loopbackBody":"DSH is listening on loopback only. Set Host webserver.host to this Mac’s LAN IPv4 address, then restart DSH manually.","httpTitle":"About HTTP","httpBody":"This is plain-HTTP LAN access. DSH already handles UUIDs and most copy buttons; this plugin adds a fallback for older direct navigator.clipboard calls on iPhone.","selftestTitle":"Browser capability self-test","selftestRun":"Run self-test","selftestRunning":"Testing…","selftestNote":"The self-test only reads browser capabilities; it does not change DSH or affect the Mac.","checkClipboard":"Clipboard write","checkCrypto":"Secure random","checkStorage":"Local storage","checkWebSocket":"WebSocket","checkViewport":"Mobile viewport","checkOnline":"Network status","checkPass":"Pass","checkWarn":"Note","checkFail":"Fail","limitsTitle":"Platform limits (not plugin defects)","limit1":"iOS Safari has no desktop drag-and-drop; use the system file picker.","limit2":"iOS suspends background pages; keep DSH in the foreground for long tasks.","limit3":"Safari hands downloads to the Files app; iOS chooses the location.","zeroImpactTitle":"Zero-impact design for the Mac","zeroImpactBody":"The plugin adds exactly three routes, one sidebar entry, and one main panel. It does not modify core code, auth, config, theme, layout, or other plugins, and it never polls in the background.","mainAria":"Mobile access panel","codeAria":"Pairing code","reload":"Reload","unknown":"Unknown"};
+function createPanel(t, locale) {
+    return function MobileAccessPanel() {
+        useLocaleRevision(locale);
+        const { state, loading, error, reload } = useMobileAccessState();
+        const [rotating, setRotating] = React.useState(false);
+        const [testing, setTesting] = React.useState(false);
+        const [checks, setChecks] = React.useState(null);
+        const [toast, setToast] = React.useState(null);
+        const toastTimer = React.useRef(undefined);
+        const remaining = useRemaining(state?.expiresAt);
+        const status = statusOf(state, loading, error, t);
+        const isIOS = isAppleMobile();
+        const standalone = navigator.standalone === true
+            || window.matchMedia('(display-mode: standalone)').matches;
+        const flash = (message) => {
+            setToast(message);
+            if (toastTimer.current !== undefined)
+                window.clearTimeout(toastTimer.current);
+            toastTimer.current = window.setTimeout(() => setToast(null), 2400);
+        };
+        React.useEffect(() => () => {
+            if (toastTimer.current !== undefined)
+                window.clearTimeout(toastTimer.current);
+        }, []);
+        const copy = async (value) => {
+            flash(await copyText(value) ? t('copied') : t('copyFailed'));
+        };
+        const rotate = async () => {
+            setRotating(true);
+            try {
+                const response = await fetch(ROTATE_PATH, {
+                    method: 'POST',
+                    cache: 'no-store',
+                    credentials: 'same-origin',
+                    headers: { accept: 'application/json' },
+                });
+                if (!response.ok)
+                    throw new Error(`HTTP ${response.status}`);
+                await reload();
+                flash(t('toastRotated'));
+            }
+            catch {
+                flash(t('rotateFailed'));
+            }
+            finally {
+                setRotating(false);
+            }
+        };
+        const selfTest = async () => {
+            setTesting(true);
+            try {
+                setChecks(await runChecks());
+            }
+            finally {
+                setTesting(false);
+            }
+        };
+        const labels = {
+            clipboard: t('checkClipboard'),
+            crypto: t('checkCrypto'),
+            storage: t('checkStorage'),
+            websocket: t('checkWebSocket'),
+            viewport: t('checkViewport'),
+            network: t('checkOnline'),
+        };
+        const statusText = {
+            pass: t('checkPass'),
+            warn: t('checkWarn'),
+            fail: t('checkFail'),
+        };
+        const codeBlock = state === null
+            ? null
+            : h('div', { className: 'dsh-ma-card dsh-ma-pair' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('p', { className: 'dsh-ma-label' }, t('codeLabel')), h('div', { className: 'dsh-ma-code', 'aria-label': t('codeAria') }, state.displayCode), h('p', { className: 'dsh-ma-hint' }, t('codeHint'))), h('div', { className: `dsh-ma-pill ${state.loopback || state.locked ? 'is-bad' : state.expired ? 'is-warn' : 'is-ok'}` }, h('span', { className: 'dsh-ma-dot' }), status.label)), h('div', { className: 'dsh-ma-actions' }, h('button', { type: 'button', className: 'dsh-ma-button primary', onClick: () => { void copy(state.pairUrl); }, disabled: state.loopback }, t('copyLink')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void copy(state.displayCode); } }, t('copyCode')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void rotate(); }, disabled: rotating }, rotating ? t('rotating') : t('rotate'))), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('expiry')), h('dd', null, new Date(state.expiresAt).toLocaleTimeString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('expiresIn')), h('dd', { className: remaining === 0 ? 'is-bad' : '' }, remaining === 0 ? t('expired') : formatRemaining(remaining))), h('div', null, h('dt', null, t('lastPaired')), h('dd', null, state.lastPairedAt === null ? t('never') : new Date(state.lastPairedAt).toLocaleString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('pairCount')), h('dd', null, String(state.pairingCount)))));
+        return h('div', { className: 'dsh-ma', 'data-testid': 'mobile-access-panel', 'data-state': status.tone }, h('style', null, STYLES), h('div', { className: 'dsh-ma-inner', role: 'region', 'aria-label': t('mainAria') }, h('header', { className: 'dsh-ma-head' }, h('div', { className: 'dsh-ma-mark' }, 'D'), h('div', null, h('h1', null, t('title')), h('p', null, t('subtitle')))), h('div', { className: 'dsh-ma-card dsh-ma-url' }, h('p', { className: 'dsh-ma-label' }, t('urlLabel')), state === null
+            ? h('p', { className: 'dsh-ma-hint' }, loading ? t('statusLoading') : t('statusError'))
+            : h('code', null, state.pairUrl), h('p', { className: 'dsh-ma-hint' }, t('urlHint')), state?.loopback ? h('div', { className: 'dsh-ma-alert' }, h('strong', null, t('loopbackTitle')), h('p', null, t('loopbackBody'))) : null), error !== null ? h('div', { className: 'dsh-ma-alert' }, h('strong', null, t('errorTitle')), h('p', null, error), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void reload(); } }, t('retry'))) : null, state === null && loading ? h('div', { className: 'dsh-ma-card dsh-ma-hint' }, t('statusLoading')) : null, codeBlock, h('div', { className: 'dsh-ma-card' }, h('h2', null, t('stepsTitle')), h('ol', { className: 'dsh-ma-steps' }, h('li', null, t('step1')), h('li', null, t('step2')), h('li', null, t('step3')))), h('div', { className: 'dsh-ma-card' }, h('h2', null, t('diagnosticsTitle')), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('bindLabel')), h('dd', null, state === null ? t('unknown') : `${state.bindHost}:${state.port}`)), h('div', null, h('dt', null, t('deviceLabel')), h('dd', null, isIOS ? t('deviceIOS') : t('deviceOther'))), h('div', null, h('dt', null, t('launchMode')), h('dd', null, standalone ? t('standaloneYes') : t('standaloneNo'))), h('div', null, h('dt', null, t('secureYes')), h('dd', null, window.isSecureContext ? t('secureYes') : t('secureNo'))))), h('div', { className: 'dsh-ma-card' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('h2', null, t('selftestTitle')), h('p', { className: 'dsh-ma-hint' }, t('selftestNote'))), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void selfTest(); }, disabled: testing }, testing ? t('selftestRunning') : t('selftestRun'))), checks === null ? null : h('ul', { className: 'dsh-ma-checks' }, ...checks.map((check, index) => h('li', { key: index, className: `is-${check.status}` }, h('span', { className: 'dsh-ma-dot' }), h('span', { className: 'dsh-ma-check-label' }, labels[check.label] ?? check.label), h('span', { className: 'dsh-ma-check-status' }, statusText[check.status]), h('span', { className: 'dsh-ma-check-detail' }, check.detail))))), h('div', { className: 'dsh-ma-card dsh-ma-note' }, h('h2', null, t('httpTitle')), h('p', null, t('httpBody')), h('h2', null, t('zeroImpactTitle')), h('p', null, t('zeroImpactBody'))), h('details', { className: 'dsh-ma-card dsh-ma-details' }, h('summary', null, t('limitsTitle')), h('ul', null, h('li', null, t('limit1')), h('li', null, t('limit2')), h('li', null, t('limit3')))), h('p', { className: 'dsh-ma-toast', 'aria-live': 'polite' }, toast ?? '')));
+    };
+}
+const STYLES = ".dsh-ma{height:100%;min-height:100%;overflow:auto;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827)}\n.dsh-ma *{box-sizing:border-box}\n.dsh-ma-inner{width:100%;max-width:860px;margin:0 auto;padding:clamp(18px,4vw,36px);display:flex;flex-direction:column;gap:14px}\n.dsh-ma-head{display:flex;align-items:center;gap:14px;margin-bottom:4px}\n.dsh-ma-mark{display:grid;place-items:center;flex:0 0 46px;width:46px;height:46px;border-radius:14px;background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff;font:800 21px/1 -apple-system,BlinkMacSystemFont,sans-serif}\n.dsh-ma-head h1{margin:0 0 3px;font-size:24px;line-height:1.2;letter-spacing:-.02em}\n.dsh-ma-head p{margin:0;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.5}\n.dsh-ma-card{padding:16px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}\n.dsh-ma-card h2{margin:0 0 8px;font-size:15px;line-height:1.35}\n.dsh-ma-card p{margin:0 0 8px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.6}\n.dsh-ma-card p:last-child{margin-bottom:0}\n.dsh-ma-row{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}\n.dsh-ma-label{margin:0 0 5px!important;color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important;font-weight:700;letter-spacing:.06em;text-transform:uppercase}\n.dsh-ma-url code{display:block;padding:12px 13px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:11px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:600 15px/1.45 ui-monospace,\"SF Mono\",Menlo,monospace;word-break:break-all}\n.dsh-ma-hint{color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important}\n.dsh-ma-code{margin:3px 0 6px;font:800 clamp(28px,6vw,40px)/1.1 ui-monospace,\"SF Mono\",Menlo,monospace;font-variant-numeric:tabular-nums;letter-spacing:.1em;color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-pill{display:inline-flex;align-items:center;gap:7px;min-height:28px;padding:4px 10px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:999px;font-size:12px;font-weight:700;white-space:nowrap}\n.dsh-ma-pill.is-ok{color:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn{color:#b45309}\n.dsh-ma-pill.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-dot{display:inline-block;flex:0 0 8px;width:8px;height:8px;border-radius:50%;background:currentColor}\n.dsh-ma-pill.is-ok .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-pill.is-bad .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-actions{display:flex;flex-wrap:wrap;gap:8px;margin:12px 0}\n.dsh-ma-button{display:inline-flex;align-items:center;justify-content:center;min-height:40px;padding:8px 13px;border:1px solid var(--dsw-alias-border-l2,#d5dbe5);border-radius:10px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:650 13px/1.2 -apple-system,BlinkMacSystemFont,sans-serif;cursor:pointer;-webkit-tap-highlight-color:transparent}\n.dsh-ma-button.primary{border-color:var(--dsw-alias-brand-primary,#2f5bea);background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff}\n.dsh-ma-button:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-button:disabled{opacity:.55;cursor:not-allowed}\n.dsh-ma-button:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#2f5bea);outline-offset:2px}\n.dsh-ma-meta{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:10px 16px;margin:8px 0 0}\n.dsh-ma-meta div{min-width:0}\n.dsh-ma-meta dt{margin:0 0 2px;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase}\n.dsh-ma-meta dd{margin:0;font-size:13px;line-height:1.45;word-break:break-word}\n.dsh-ma-meta dd.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert{margin:12px 0 0;padding:12px 13px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 35%,transparent);border-radius:12px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 8%,transparent);color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert strong{display:block;margin-bottom:4px;font-size:13px}\n.dsh-ma-alert p{color:inherit!important;font-size:13px!important;line-height:1.55!important}\n.dsh-ma-steps{margin:0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.65}\n.dsh-ma-steps li{margin:0 0 7px;padding-left:2px}\n.dsh-ma-steps li:last-child{margin-bottom:0}\n.dsh-ma-checks{display:flex;flex-direction:column;gap:7px;margin:10px 0 0;padding:0;list-style:none}\n.dsh-ma-checks li{display:flex;align-items:center;gap:8px;flex-wrap:wrap;font-size:13px;color:var(--dsw-alias-label-secondary,#5f6b7a)}\n.dsh-ma-checks li.is-pass .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-checks li.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-checks li.is-fail .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-check-label{color:var(--dsw-alias-label-primary,#111827);font-weight:650}\n.dsh-ma-check-status{font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.05em}\n.dsh-ma-check-detail{margin-left:auto;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:12px;word-break:break-word}\n.dsh-ma-note h2{font-size:13px;margin-top:4px}\n.dsh-ma-details summary{cursor:pointer;font-size:14px;font-weight:700}\n.dsh-ma-details ul{margin:10px 0 0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:13px;line-height:1.65}\n.dsh-ma-toast{min-height:20px;margin:0!important;text-align:center;color:var(--dsw-alias-brand-primary,#2f5bea)!important;font-size:13px!important;font-weight:650}\n@media (max-width:560px){\n.dsh-ma-inner{padding:max(14px,env(safe-area-inset-top)) max(14px,env(safe-area-inset-right)) max(18px,env(safe-area-inset-bottom)) max(14px,env(safe-area-inset-left));gap:11px}\n.dsh-ma-card{padding:14px;border-radius:14px}\n.dsh-ma-head h1{font-size:21px}\n.dsh-ma-mark{flex-basis:40px;width:40px;height:40px;border-radius:12px;font-size:18px}\n.dsh-ma-actions .dsh-ma-button{flex:1 1 140px;min-height:44px}\n.dsh-ma-check-detail{width:100%;margin-left:16px}\n}\n@media (prefers-reduced-motion:no-preference){\n.dsh-ma-button{transition:border-color .15s ease,background-color .15s ease,opacity .15s ease}\n}";
+function factory(require) {
+    React = require('react');
+    return {
+        inject: ['slots', 'locale'],
+        apply(ctx) {
+            ctx.effect(() => {
+                const cleanups = [];
+                let translate = (key) => ZH[key] ?? key;
+                try {
+                    if (ctx.locale !== undefined) {
+                        cleanups.push(ctx.locale.register(NS, { zh: ZH, en: EN }));
+                        translate = ctx.locale.bind(NS);
+                    }
+                }
+                catch (error) {
+                    ctx.logger?.error?.(`[mobile-access] locale registration failed: ${String(error)}`);
+                }
+                const t = (key) => translate(key);
+                const Panel = createPanel(t, ctx.locale);
+                const safe = (label, register) => {
+                    try {
+                        cleanups.push(register());
+                    }
+                    catch (error) {
+                        ctx.logger?.error?.(`[mobile-access] ${label} registration failed: ${String(error)}`);
+                    }
+                };
+                safe('main panel', () => ctx.slots.inject('main', () => ctx.slots.register({
+                    name: 'main',
+                    key: PANEL_ID,
+                    locale: NS,
+                }, Panel)));
+                safe('sidebar entry', () => ctx.slots.inject('sidebar.panellist', () => ctx.slots.register({
+                    name: 'sidebar.panellist',
+                    id: PANEL_ID,
+                    order: 15,
+                    locale: NS,
+                    label: () => t('panel'),
+                }, PhoneIcon)));
+                try {
+                    cleanups.push(installClipboardFallback());
+                }
+                catch (error) {
+                    ctx.logger?.warn?.(`[mobile-access] clipboard fallback unavailable: ${String(error)}`);
+                }
+                return () => {
+                    for (const cleanup of cleanups.reverse()) {
+                        try {
+                            cleanup();
+                        }
+                        catch {
+                            // Plugin cleanup must never break the host UI.
+                        }
+                    }
+                };
+            }, 'mobile-access client');
+        },
+    };
+}
+function PhoneIcon(props) {
+    const size = props.size ?? 24;
+    return h('svg', {
+        width: size,
+        height: size,
+        viewBox: '0 0 24 24',
+        fill: 'none',
+        stroke: 'currentColor',
+        strokeWidth: 1.8,
+        strokeLinecap: 'round',
+        strokeLinejoin: 'round',
+        'aria-hidden': 'true',
+        focusable: 'false',
+    }, h('rect', { x: 6.2, y: 2.4, width: 11.6, height: 19.2, rx: 2.8 }), h('path', { d: 'M10 5.2h4' }), h('path', { d: 'M9.6 18.8h4.8' }), props.active === true ? h('path', { d: 'M9.5 10.2c1.4-1.4 3.6-1.4 5 0M10.8 12.4c.8-.8 1.8-.8 2.4 0' }) : null);
+}
+const loader = window.__ModuleLoader__;
+if (loader === undefined) {
+    console.error('[mobile-access] window.__ModuleLoader__ is unavailable; the client half was not loaded.');
+}
+else {
+    loader.load({ id: 'dsh-mobile-access', factory });
+}

package/cordis.patch.yml

@@ -0,0 +1,13 @@
+# dsh-mobile-access bundle patch.
+#
+# One Host row. The Host half registers exactly three routes:
+#   GET  /m                       public pairing page
+#   GET  /api/mobile-access/state owner-only state snapshot
+#   POST /api/mobile-access/rotate owner-only code rotation
+#
+# The Web client half adds one sidebar entry and one main panel. No core row is
+# replaced, wrapped, or reconfigured. Removing the bundle removes the row.
+- insert:
+    - id: dsh-mobile-access
+      name: dsh-mobile-access
+      config: {}