npm - dsh-mobile - Versions diffs - 0.1.0-alpha.1 → 0.1.0-alpha.3 - Mend

dsh-mobile 0.1.0-alpha.1 → 0.1.0-alpha.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +56 -62
package/README.zh.md +55 -62
package/SECURITY.md +1 -0
package/assets/brand/app-icon-master.png +0 -0
package/cordis.patch.yml +1 -0
package/lib/cli.js +202 -80
package/lib/client.js +124 -4
package/lib/client.js.map +1 -1
package/lib/index.d.mts +4 -1
package/lib/index.mjs +206 -9
package/package.json +4 -4

package/README.md CHANGED Viewed

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.1/assets/brand/repository-hero.png" alt="A lively whale girl using a phone beside a desktop running DSH" width="100%">
+  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.2/assets/brand/repository-hero.png" alt="A lively whale girl using a phone beside a desktop running DSH" width="100%">
 </p>
 <h1 align="center">DSH Mobile</h1>
@@ -26,6 +26,8 @@
 DSH Mobile reuses DSH's own Web application, sessions, and plugin slots. It adds an authenticated HTTPS gateway, device pairing, session revocation, and a small responsive Client face. Use the Android shell without browser chrome, or open the same LAN address directly in any mobile browser.
+The mobile client is self-editable: ask DSH in an ordinary conversation to change `mobile.css` for presentation or `mobile.js` for behavior, keep the phone open, and watch the Android app or mobile browser apply the result automatically within about one second.
 ## Features
 | Capability | Android app | Mobile browser |
@@ -33,7 +35,7 @@ DSH Mobile reuses DSH's own Web application, sessions, and plugin slots. It adds
 | Live DSH Web UI | Yes | Yes |
 | Authenticated HTTPS LAN access | Yes | Yes |
 | One-time device pairing | Yes | Yes |
-| Custom mobile CSS | Yes | Yes |
+| Extend mobile UI and Web functions through a DSH conversation with live preview | Yes | Yes |
 | File selection and downloads | Yes | Browser-dependent |
 | iOS native app | Not yet | Safari can use the Web UI |
@@ -41,75 +43,27 @@ Host-native actions such as opening desktop files remain subject to stock DSH an
 ## Quick start
-Prerequisites: stock DSH can run through either an installed `dsh` command or the source checkout's `pnpm dsh` script, and the computer and Android device share a trusted private LAN. DSH requires Node.js 22.19.x or Node.js 24 or later.
-### Choose the DSH command
-If `dsh` is available in the terminal, use the commands below as written.
-If you cloned the DSH source and do not have a global `dsh` command, first install its workspace dependencies from the DSH repository root:
+Use the first block when `dsh` is available globally:
 ```powershell
-corepack enable
-pnpm install
+dsh plugin --profile web add dsh-mobile
+dsh plugin --profile web exec dsh-mobile setup
+dsh --profile web
 ```
-Then replace `dsh` in every example with `pnpm dsh`. The complete source-checkout flow is:
+If you cloned the DSH source, run the second block from its repository root:
 ```powershell
+corepack enable
+pnpm install
 pnpm dsh plugin --profile web add dsh-mobile
 pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
-You may also invoke the source checkout from another directory without creating a global command:
-```powershell
-pnpm --dir "<path-to-deepseek-harness>" dsh --profile web
-```
-### 1. Install
-Install the public package directly from npm:
-```powershell
-dsh plugin --profile web add dsh-mobile
-```
-Repository collaborators and offline installations may instead install an exact tarball:
-```powershell
-dsh plugin --profile web add "<path-to-dsh-mobile.tgz>"
-```
-No DSH source patch or custom DSH build is required.
-### 2. Run setup once
-```powershell
-dsh plugin --profile web exec dsh-mobile setup
-```
-The setup command selects a private LAN address, creates a local TLS certificate, and stores all plugin-owned configuration under `$DSH_HOME/mobile-access/`. If more than one LAN address is available, select one explicitly:
-```powershell
-dsh plugin --profile web exec dsh-mobile setup --address 192.168.1.20
-```
-For a non-default DSH Web port:
+Both paths install the public npm package into stock DSH without patching its source. Setup remembers the selected LAN interface, creates one local CA, and stores plugin data under `$DSH_HOME/mobile-access/`; run `dsh-mobile setup --help` through the same `plugin exec` command for manual network options. When DHCP changes that interface's IP, the plugin follows the new address and signs a matching server certificate from the same CA on the next DSH start.
-```powershell
-dsh plugin --profile web exec dsh-mobile setup --dsh-port 39080
-dsh --profile web --port 39080
-```
-### 3. Start and pair
-```powershell
-dsh --profile web
-```
-1. Copy the generated `dsh-mobile-ca.cer` to Android and install it as a user CA certificate.
+1. Copy the generated `dsh-mobile-ca.cer` to Android and install it once as a user CA certificate.
 2. Open the Mobile card in the lower-left corner of the desktop DSH UI.
 3. Start access and create a pairing link. The link is copied to the clipboard.
 4. Paste the link into the Android app, or open it directly in a mobile browser.
@@ -127,13 +81,52 @@ The two access modes are equivalent:
 ## Customize the mobile Web UI
+This is a same-origin Web extension surface, not a fixed theme editor. DSH can edit two files on the computer:
+- `mobile.css` controls layout, visual hierarchy, safe areas, typography, and responsive behavior.
+- `mobile.js` mounts mobile-only DOM and behavior, can use browser capabilities, and can call the same-origin DSH Web API as the paired page.
+That is enough to build a one-handed command dock, a gesture command palette, a session dashboard, terminal shortcut keys, a floating context panel, voice input, a camera or QR workflow, or a completely different mobile navigation model. Camera, microphone, notifications, and similar capabilities still require browser or Android permission.
+The easiest workflow stays entirely inside DSH. In a conversation with filesystem write access, try a broad request:
+```text
+Turn DSH Mobile into a one-handed field console by editing
+$DSH_HOME/mobile-access/mobile.css and mobile.js.
+Add a bottom command dock, swipe shortcuts for switching conversations,
+a push-to-talk button when the browser supports speech input, and a collapsible
+session monitor. Keep every feature mobile-only. Register JavaScript through
+window.dshMobile.register(), return a cleanup function, and do not modify DSH source.
+```
+Keep the phone page open while DSH edits. The Android app and mobile browser check both authenticated files once per second and apply saved changes automatically—no DSH restart, new pairing, or manual page refresh. Invalid JavaScript does not replace the last successfully mounted extension.
 Setup creates:
 ```text
 $DSH_HOME/mobile-access/mobile.css
+$DSH_HOME/mobile-access/mobile.js
+```
+The files load only through the authenticated mobile gateway. They do not modify the DSH installation and survive DSH upgrades. Continue the same conversation with requests such as “turn the dock into a radial menu,” “add a full-screen monitoring view,” or “use the camera to prepare an attachment,” and inspect each revision directly on the phone.
+`mobile.js` uses a small lifecycle entry point:
+```js
+window.dshMobile.register(({ root, document, request }) => {
+  const workspace = document.createElement('section')
+  workspace.ariaLabel = 'My mobile workspace'
+  root.append(workspace)
+  // Build any mobile Web UI and behavior inside workspace. Use request()
+  // for same-origin DSH API calls with the paired Session and CSRF protection.
+  return () => workspace.remove()
+})
 ```
-This file loads only through the authenticated mobile gateway. It does not modify the DSH installation and survives DSH upgrades.
+The supplied `root` isolates mobile-only DOM, while `request()` rejects cross-origin targets and carries the paired session plus the gateway's CSRF header. An extension may still use ordinary secure-context browser APIs directly when the device grants permission.
 Basic theme controls:
@@ -154,7 +147,7 @@ Narrow-screen adjustments:
 }
 ```
-Prefer CSS variables, spacing, typography, and touch sizes. Do not depend on generated class names. Delete `mobile.css` and refresh to return to the built-in defaults.
+Prefer stable Web APIs and DSH extension points over generated class names. Delete `mobile.css` to restore the visual defaults and replace `mobile.js` with an empty registered mount to remove custom behavior; the open phone page updates automatically.
 ## A native DSH plugin
@@ -169,10 +162,11 @@ flowchart LR
 ## Security model
 - The gateway accepts only the selected private LAN CIDR, exact Host, and same-origin browser requests.
-- The Android app never bypasses TLS validation. The certificate must cover the LAN address in use.
+- The Android app never bypasses TLS validation. The stable local CA signs a server certificate for the selected interface's current LAN address at each DSH start.
 - Pairing creates an HttpOnly session; devices and active sessions can be revoked from the computer.
 - Control and device-management routes are loopback-only.
 - Authentication happens before any request reaches the stock DSH loopback server. DSH itself is never rebound to `0.0.0.0`.
+- `mobile.js` runs as application code inside the paired DSH page. Only let trusted DSH conversations edit it, and review generated integrations before keeping them.
 Do not expose this gateway through public Wi-Fi, port forwarding, a public IP, or an untrusted VPN. See [SECURITY.md](SECURITY.md).

package/README.zh.md CHANGED Viewed

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.1/assets/brand/repository-hero.png" alt="鲸鱼娘拿着手机连接桌面上的 DSH" width="100%">
+  <img src="https://unpkg.com/dsh-mobile@0.1.0-alpha.2/assets/brand/repository-hero.png" alt="鲸鱼娘拿着手机连接桌面上的 DSH" width="100%">
 </p>
 <h1 align="center">DSH Mobile</h1>
@@ -26,6 +26,8 @@
 DSH Mobile 不是另一套远程控制面板。插件直接复用 DSH 自己的 Web 应用、会话和插件槽位，在外层增加 HTTPS、设备配对、会话撤销和移动端样式。你可以用 Android App 获得无浏览器栏的体验，也可以直接用手机浏览器访问同一个局域网地址。
+移动端客户端可以“自己改自己”：直接在普通 DSH 对话中要求 DSH 修改负责外观的 `mobile.css` 或负责功能的 `mobile.js`，手机页面保持打开，Android App 和手机浏览器通常会在一秒内自动应用结果。
 ## 主要能力
 | 能力 | Android App | 手机浏览器 |
@@ -33,7 +35,7 @@ DSH Mobile 不是另一套远程控制面板。插件直接复用 DSH 自己的
 | 实时访问 DSH Web UI | 支持 | 支持 |
 | HTTPS 局域网入口 | 支持 | 支持 |
 | 一次性设备配对 | 支持 | 支持 |
-| 自定义移动端 CSS | 支持 | 支持 |
+| 在 DSH 对话中扩展移动 UI与网页功能并实时预览 | 支持 | 支持 |
 | 文件选择与下载 | 支持 | 由浏览器决定 |
 | iOS | 暂不支持 | 可用 Safari 访问网页 |
@@ -41,75 +43,27 @@ DSH Mobile 不是另一套远程控制面板。插件直接复用 DSH 自己的
 ## 快速开始
-前置条件：能够通过已经安装的 `dsh` 命令或源码仓库中的 `pnpm dsh` 启动原生 DSH，电脑和 Android 手机位于同一可信局域网。DSH 需要 Node.js 22.19.x，或 Node.js 24 以上版本。
-### 选择 DSH 命令
-如果终端中能够直接运行 `dsh`，后续命令保持原样即可。
-如果你直接克隆了 DSH 源码，没有全局 `dsh` 命令，请先在 DSH 源码根目录安装工作区依赖：
+终端中可以直接运行 `dsh` 时，使用第一组命令：
 ```powershell
-corepack enable
-pnpm install
+dsh plugin --profile web add dsh-mobile
+dsh plugin --profile web exec dsh-mobile setup
+dsh --profile web
 ```
-然后把后续示例中的 `dsh` 全部替换为 `pnpm dsh`。源码版的完整快速启动命令如下：
+如果你直接克隆了 DSH 源码，则在 DSH 源码根目录使用第二组命令：
 ```powershell
+corepack enable
+pnpm install
 pnpm dsh plugin --profile web add dsh-mobile
 pnpm dsh plugin --profile web exec dsh-mobile setup
 pnpm dsh --profile web
 ```
-如果当前终端不在 DSH 源码目录，也不需要创建全局命令：
-```powershell
-pnpm --dir "<DSH源码目录>" dsh --profile web
-```
-### 1. 安装插件
-直接从公开 npm 安装：
-```powershell
-dsh plugin --profile web add dsh-mobile
-```
-仓库协作者或离线环境也可以安装指定 tarball：
-```powershell
-dsh plugin --profile web add "<插件安装包路径>"
-```
-这两种方式都使用 DSH 官方插件命令，不需要修改或替换 DSH 源码。
-### 2. 运行一次设置向导
-```powershell
-dsh plugin --profile web exec dsh-mobile setup
-```
-向导会自动选择唯一的私有局域网地址，生成本地 TLS 证书，并把配置保存到 `$DSH_HOME/mobile-access/`。如果电脑有多个可用网卡，向导会列出候选地址并要求明确选择：
-```powershell
-dsh plugin --profile web exec dsh-mobile setup --address 192.168.1.20
-```
-如果 DSH Web 使用非默认端口，也可以一次指定：
+两种方式都会把公开 npm 包安装到原生 DSH，不修改 DSH 源码。设置向导会记住所选局域网网卡、生成一份稳定的本地 CA，并把插件数据保存到 `$DSH_HOME/mobile-access/`；需要手动指定网卡或端口时，通过同一个 `plugin exec` 命令运行 `dsh-mobile setup --help`。DHCP 改变该网卡的 IP 后，插件会在下次启动 DSH 时跟随新地址，并用同一 CA 自动签发匹配的服务器证书。
-```powershell
-dsh plugin --profile web exec dsh-mobile setup --dsh-port 39080
-dsh --profile web --port 39080
-```
-### 3. 启动、配对与连接
-```powershell
-dsh --profile web
-```
-1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中安装为用户 CA 证书。
+1. 将向导输出的 `dsh-mobile-ca.cer` 复制到 Android，并在系统设置中一次性安装为用户 CA 证书。
 2. 在电脑 DSH 左下角打开“移动端”卡片。
 3. 确认服务已开启，点击“生成配对链接”。链接会复制到剪贴板。
 4. 在 Android App 中粘贴链接，或直接在手机浏览器中打开链接。
@@ -127,13 +81,51 @@ dsh --profile web
 ## 自定义移动端 Web UI
+这不是一个只能换颜色的主题编辑器，而是与 DSH 页面同源的 Web 扩展面。电脑上的 DSH 可以编辑两个文件：
+- `mobile.css` 控制布局、视觉层级、安全区、字体和响应式行为。
+- `mobile.js` 挂载移动端专属 DOM 与交互，可以使用浏览器能力，也可以用已配对页面的身份调用同源 DSH Web API。
+自由度并不限于几个预设组件。你可以让 DSH 创建单手指令坞、手势命令面板、会话仪表盘、终端快捷键、悬浮上下文面板、语音输入、相机或二维码工作流，乃至完全不同的移动端导航。相机、麦克风、通知等能力仍需要浏览器或 Android 授权。
+最简单的方式是不离开 DSH。打开一个具备文件写入权限的 DSH 对话，给它一个更大胆的目标：
+```text
+请编辑 $DSH_HOME/mobile-access/mobile.css 和 mobile.js，
+把 DSH Mobile 改造成适合单手操作的现场工作台。
+增加底部指令坞、左右滑动切换会话、浏览器支持时可用的按住说话按钮，
+以及可折叠的会话监控面板。所有功能只在移动端出现；JavaScript 通过
+window.dshMobile.register() 注册并返回清理函数，不要修改 DSH 源码。
+```
+DSH 修改文件时让手机页面保持打开。Android App 和手机浏览器每秒检查一次这两个已认证文件，保存后的变化会自动应用，不需要重启 DSH、重新配对或手动刷新页面。JavaScript 写错时会保留上一次成功挂载的功能。
 设置向导会创建：
 ```text
 $DSH_HOME/mobile-access/mobile.css
+$DSH_HOME/mobile-access/mobile.js
+```
+它们只通过已认证的移动网关加载，不修改 DSH 安装目录，升级或卸载 DSH 时也不会覆盖。你可以继续在同一个对话中说“把指令坞改成环形菜单”“增加全屏监控视图”或“用相机准备附件”，并直接在手机上观察每次修改。
+`mobile.js` 只有一个很小的生命周期入口：
+```js
+window.dshMobile.register(({ root, document, request }) => {
+  const workspace = document.createElement('section')
+  workspace.ariaLabel = '我的移动工作台'
+  root.append(workspace)
+  // 在 workspace 中构建任意移动 Web UI 和交互。调用同源 DSH API 时使用
+  // request()，它会携带已配对 Session 和 CSRF 防护信息。
+  return () => workspace.remove()
+})
 ```
-它只在通过移动网关访问时加载，不修改 DSH 安装目录，升级或卸载 DSH 时也不会覆盖它。修改后刷新手机页面即可看到效果。
+传入的 `root` 用来承载移动端专属 DOM；`request()` 会拒绝跨源目标，并自动携带已配对会话和网关 CSRF 请求头。需要设备权限的能力仍可直接使用安全上下文中的标准浏览器 API。
 ### 最简单的主题调整
@@ -160,7 +152,7 @@ $DSH_HOME/mobile-access/mobile.css
 }
 ```
-建议优先调整 CSS 变量、字体比例、间距和触控尺寸，不要依赖构建后生成的类名。写错样式不会影响 Host 网关；删除 `mobile.css` 后刷新即可恢复插件默认样式。
+建议优先使用稳定的 Web API 和 DSH 扩展点，不要依赖构建后生成的类名。删除 `mobile.css` 可恢复默认外观；将 `mobile.js` 替换为空的注册函数即可移除自定义功能，打开的手机页面会自动更新。
 ## 为什么符合 DSH 的插件理念
@@ -175,10 +167,11 @@ flowchart LR
 ## 安全模型
 - 网关只接受设置向导选定的私有局域网 CIDR、精确 Host 和同源浏览器请求。
-- Android App 不跳过 TLS 校验；证书必须覆盖实际访问的局域网 IP。
+- Android App 不跳过 TLS 校验；稳定的本地 CA 会在每次 DSH 启动时为所选网卡的当前局域网地址签发服务器证书。
 - 配对设备获得短期 HttpOnly Session，设备和会话都可在电脑端撤销。
 - 管理接口只允许从电脑回环地址访问，移动端无法打开、关闭网关或管理其他设备。
 - 外层网关在认证后才代理到原生 DSH 的回环端口，不会把 DSH 自身绑定到 `0.0.0.0`。
+- `mobile.js` 会作为应用代码在已配对的 DSH 页面中运行。只允许可信的 DSH 对话编辑它，并在长期保留前检查生成的集成。
 不要在公共 Wi-Fi、端口转发、公网 IP 或不可信 VPN 中开放本插件。更多说明见 [SECURITY.md](SECURITY.md)。

package/SECURITY.md CHANGED Viewed

@@ -21,6 +21,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 - Revoke a lost device immediately and rotate the device registry if credential theft is suspected.
 - Do not expose the gateway directly to the public Internet.
 - Treat every paired device as a fully trusted operator. Stock DSH methods reached through the authenticated loopback proxy may read configuration or run tools with the desktop user's authority.
+- Treat `mobile.js` as application code with the paired page's same-origin authority. Restrict write access to trusted host-side DSH sessions and review generated API calls or browser-permission use.
 ## Known alpha limitation

package/assets/brand/app-icon-master.png CHANGED Viewed

Binary file

package/cordis.patch.yml CHANGED Viewed

@@ -9,6 +9,7 @@
         stateFile: !!js dshHomePath('mobile-access/devices.json')
         controlFile: !!js dshHomePath('mobile-access/control.json')
         customCssFile: !!js dshHomePath('mobile-access/mobile.css')
+        customScriptFile: !!js dshHomePath('mobile-access/mobile.js')
         initiallyEnabled: false
         listenHost: 127.0.0.1
         listenPort: 3443

package/lib/cli.js CHANGED Viewed

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { X509Certificate } from "node:crypto";
-import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { homedir, networkInterfaces } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
+import { X509Certificate, createPrivateKey, createPublicKey } from "node:crypto";
 import { generate } from "selfsigned";
-//#region src/cli.ts
+//#region src/managed-setup.ts
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -19,13 +19,157 @@ function networkCidr(address, cidr) {
 		0
 	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
 }
-function availableAddresses() {
-	const candidates = Object.values(networkInterfaces()).flatMap((entries) => entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
 		address: entry.address,
 		cidr: networkCidr(entry.address, entry.cidr)
-	}));
-	return [...new Map(candidates.map((entry) => [entry.address, entry])).values()];
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
+async function ensureManagedCa(setup, legacy) {
+	let certPem;
+	let keyPem;
+	try {
+		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		let migrated = false;
+		if (legacy !== void 0) try {
+			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
+			assertMatchingCa(certPem, keyPem);
+			migrated = true;
+		} catch (legacyError) {
+			if (legacyError.code !== "ENOENT") throw legacyError;
+		}
+		if (!migrated) {
+			const now = /* @__PURE__ */ new Date();
+			const notAfter = new Date(now);
+			notAfter.setFullYear(notAfter.getFullYear() + 5);
+			const generated = await generate([{
+				name: "commonName",
+				value: "DeepSeek Harness Mobile CA"
+			}], {
+				keyType: "ec",
+				curve: "P-256",
+				algorithm: "sha256",
+				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+				notAfterDate: notAfter,
+				extensions: [{
+					name: "basicConstraints",
+					cA: true,
+					critical: true
+				}, {
+					name: "keyUsage",
+					digitalSignature: true,
+					keyCertSign: true,
+					cRLSign: true,
+					critical: true
+				}]
+			});
+			certPem = generated.cert;
+			keyPem = generated.private;
+		}
+		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	}
+	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	return assertMatchingCa(certPem, keyPem);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
 }
+//#endregion
+//#region src/cli.ts
 function parseOptions(args) {
 	let address;
 	let port = 3443;
@@ -52,30 +196,18 @@ function parseOptions(args) {
 	}
 	if (!Number.isSafeInteger(port) || port < 1024 || port > 65535) throw new Error("--port must be from 1024 through 65535");
 	if (!Number.isSafeInteger(dshPort) || dshPort < 1024 || dshPort > 65535) throw new Error("--dsh-port must be from 1024 through 65535");
-	if (address !== void 0 && !privateIpv4(address)) throw new Error("--address must be a private IPv4 address");
 	return {
 		...address === void 0 ? {} : { address },
 		port,
 		dshPort
 	};
 }
-function selectNetwork(requested) {
-	const candidates = availableAddresses();
-	if (requested !== void 0) {
-		const match = candidates.find((candidate) => candidate.address === requested);
-		if (match === void 0) throw new Error(`--address ${requested} is not an active private LAN address`);
-		return match;
-	}
-	if (candidates.length === 1) return candidates[0];
-	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
-	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
-}
 function dshHome() {
 	return resolve(process.env.DSH_HOME ?? join(homedir(), ".dsh"));
 }
 async function setup(args) {
 	const options = parseOptions(args);
-	const network = selectNetwork(options.address);
+	const network = selectLanNetwork(options.address);
 	const home = dshHome();
 	const directory = join(home, "mobile-access");
 	const tls = join(directory, "tls");
@@ -83,53 +215,36 @@ async function setup(args) {
 		recursive: true,
 		mode: 448
 	});
-	const now = /* @__PURE__ */ new Date();
-	const notAfter = new Date(now);
-	notAfter.setDate(notAfter.getDate() + 397);
-	const certificate = await generate([{
-		name: "commonName",
-		value: network.address
-	}], {
-		keyType: "ec",
-		curve: "P-256",
-		algorithm: "sha256",
-		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
-		notAfterDate: notAfter,
-		extensions: [
-			{
-				name: "basicConstraints",
-				cA: true,
-				critical: true
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				keyCertSign: true,
-				cRLSign: true,
-				critical: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: [{
-					type: 7,
-					ip: network.address
-				}]
-			}
-		]
-	});
-	const certFile = join(tls, "cert.pem");
-	const keyFile = join(tls, "key.pem");
+	const legacyCertFile = join(tls, "cert.pem");
+	const legacyKeyFile = join(tls, "key.pem");
+	const certFile = join(tls, "server-cert.pem");
+	const keyFile = join(tls, "server-key.pem");
+	const caCertFile = join(tls, "ca.pem");
+	const caKeyFile = join(tls, "ca-key.pem");
 	const androidCertificate = join(tls, "dsh-mobile-ca.cer");
+	const managedTls = {
+		mode: "managed",
+		caCertFile,
+		caKeyFile,
+		certFile,
+		keyFile
+	};
+	const ca = await ensureManagedCa(managedTls, {
+		certFile: legacyCertFile,
+		keyFile: legacyKeyFile
+	});
+	const managedSetup = {
+		version: 2,
+		networkInterface: network.name,
+		listenPort: options.port,
+		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
+		tls: managedTls
+	};
+	await refreshManagedServerCertificate(managedSetup, network.address);
+	await writeFile(androidCertificate, ca.raw, { mode: 384 });
 	await Promise.all([
-		writeFile(certFile, certificate.cert, { mode: 384 }),
-		writeFile(keyFile, certificate.private, { mode: 384 }),
-		writeFile(androidCertificate, new X509Certificate(certificate.cert).raw, { mode: 384 })
-	]);
-	await Promise.all([
+		chmod(caCertFile, 384),
+		chmod(caKeyFile, 384),
 		chmod(certFile, 384),
 		chmod(keyFile, 384),
 		chmod(androidCertificate, 384)
@@ -140,7 +255,7 @@ async function setup(args) {
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
 		await writeFile(customCss, [
-			"/* Safe mobile overrides. Edit these values, then refresh the phone. */",
+			"/* Safe mobile overrides. DSH Mobile applies saved changes on the phone automatically. */",
 			":root {",
 			"  --dsh-mobile-accent: #2563eb;",
 			"  --dsh-mobile-font-scale: 1;",
@@ -149,21 +264,28 @@ async function setup(args) {
 			""
 		].join("\n"), { mode: 384 });
 	}
+	const customScript = join(directory, "mobile.js");
+	try {
+		await readFile(customScript);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		await writeFile(customScript, [
+			"/* Mount mobile-only Web features here. Saved changes are applied automatically. */",
+			"window.dshMobile.register(({ root }) => {",
+			"  root.replaceChildren()",
+			"  return () => root.replaceChildren()",
+			"})",
+			""
+		].join("\n"), { mode: 384 });
+	}
 	const origin = `https://${network.address}:${String(options.port)}`;
 	await Promise.all([writeFile(join(directory, "setup.json"), `${JSON.stringify({
-		version: 1,
-		publicOrigin: origin,
-		listenHost: network.address,
-		upstreamOrigin: `http://127.0.0.1:${String(options.dshPort)}`,
-		allowedCidrs: [network.cidr],
-		tls: {
-			mode: "provided",
-			certFile: certFile.replaceAll("\\", "/"),
-			keyFile: keyFile.replaceAll("\\", "/")
-		}
+		...managedSetup,
+		tls: Object.fromEntries(Object.entries(managedSetup.tls).map(([key, value]) => [key, typeof value === "string" ? value.replaceAll("\\", "/") : value]))
 	}, null, 2)}\n`, { mode: 384 }), writeFile(join(directory, "control.json"), "{\"version\":1,\"enabled\":true}\n", { mode: 384 })]);
-	console.log(`DSH Mobile is configured for ${origin}`);
-	console.log(`Install this certificate on Android before connecting: ${androidCertificate}`);
+	console.log(`DSH Mobile follows ${network.name} and is currently configured for ${origin}`);
+	console.log(`Install this CA certificate on Android once: ${androidCertificate}`);
+	console.log(`Ask DSH to customize the mobile Web UI and features in: ${customCss} and ${customScript}`);
 	console.log("Start DSH with: dsh --profile web");
 	console.log("Then open the Mobile card in the lower-left corner and create a pairing link.");
 }
@@ -174,7 +296,7 @@ async function purge(args) {
 		recursive: true,
 		force: true
 	});
-	console.log("Removed DSH Mobile certificates, devices, preferences, and custom CSS.");
+	console.log("Removed DSH Mobile certificates, devices, preferences, and custom Web files.");
 }
 function help() {
 	console.log([

package/lib/client.js CHANGED Viewed

@@ -92,9 +92,38 @@ window.__ModuleLoader__.load({
 				}
 			});
 			const body = await response.json();
-			if (!response.ok) throw new Error(typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`);
+			if (!response.ok) {
+				const code = typeof body.error === "string" ? body.error : `HTTP ${String(response.status)}`;
+				throw new Error(controlErrorMessage(code));
+			}
 			return body;
 		}
+		function controlErrorMessage(code) {
+			const zh = navigator.language.toLowerCase().startsWith("zh");
+			const message = {
+				network_address_changed: ["局域网地址已变化，请重启 DSH 后重试。", "The LAN address changed. Restart DSH and try again."],
+				network_interface_unavailable: ["保存的局域网网卡未连接，请连接网络后重启 DSH。", "The saved LAN interface is disconnected. Connect it and restart DSH."],
+				listen_port_in_use: ["移动访问端口已被占用。", "The mobile-access port is already in use."]
+			}[code];
+			return message === void 0 ? code : message[zh ? 0 : 1];
+		}
+		function mobileExtensionRequest(path, init = {}) {
+			const target = new URL(path, location.href);
+			if (target.origin !== location.origin) throw new TypeError("mobile extension requests must stay on the DSH origin");
+			const headers = new Headers(init.headers);
+			const method = (init.method ?? "GET").toUpperCase();
+			if (method !== "GET" && method !== "HEAD" && !headers.has("x-dsh-mobile-csrf")) {
+				const csrf = document.cookie.split(";").map((entry) => entry.trim()).find((entry) => entry.startsWith("dsh_ma_csrf="))?.slice(12);
+				if (csrf !== void 0) headers.set("x-dsh-mobile-csrf", csrf);
+			}
+			return fetch(target, {
+				...init,
+				cache: "no-store",
+				credentials: "same-origin",
+				headers,
+				redirect: "error"
+			});
+		}
 		function installControl() {
 			const zh = navigator.language.toLowerCase().startsWith("zh");
 			const root = element("div", "dsh-mobile-control");
@@ -164,6 +193,74 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
+		function installCustomExtension() {
+			let activeRoot;
+			let activeDispose;
+			let observedSource = "";
+			let loading = false;
+			let pendingMount;
+			const previousRegistry = window.dshMobile;
+			const registry = Object.freeze({ register: (mount) => {
+				if (typeof mount !== "function") throw new TypeError("dshMobile.register requires a mount function");
+				pendingMount = mount;
+			} });
+			const registeredMount = () => pendingMount;
+			window.dshMobile = registry;
+			const refresh = async () => {
+				if (loading || document.visibilityState === "hidden") return;
+				loading = true;
+				try {
+					const response = await fetch("/mobile-access/custom.js", {
+						cache: "no-store",
+						credentials: "same-origin",
+						redirect: "error"
+					});
+					if (!response.ok || !response.headers.get("content-type")?.startsWith("text/javascript")) return;
+					const source = await response.text();
+					if (source === observedSource) return;
+					observedSource = source;
+					pendingMount = void 0;
+					const script = document.createElement("script");
+					script.textContent = `${source}\n//# sourceURL=dsh-mobile-custom.js`;
+					document.head.append(script);
+					script.remove();
+					const mount = registeredMount();
+					if (mount === void 0) return;
+					const nextRoot = document.createElement("div");
+					nextRoot.dataset.dshMobileExtension = "true";
+					document.body.append(nextRoot);
+					try {
+						const nextDispose = mount(Object.freeze({
+							document,
+							request: mobileExtensionRequest,
+							root: nextRoot,
+							window
+						}));
+						if (nextDispose !== void 0 && typeof nextDispose !== "function") throw new TypeError("the mobile extension mount function must return a disposer or undefined");
+						activeDispose?.();
+						activeRoot?.remove();
+						activeRoot = nextRoot;
+						activeDispose = typeof nextDispose === "function" ? nextDispose : void 0;
+					} catch (error) {
+						nextRoot.remove();
+						console.error("DSH Mobile custom extension failed to mount", error);
+					}
+				} catch {} finally {
+					loading = false;
+				}
+			};
+			refresh();
+			const timer = setInterval(() => {
+				refresh();
+			}, 1e3);
+			return () => {
+				clearInterval(timer);
+				activeDispose?.();
+				activeRoot?.remove();
+				if (previousRegistry === void 0) delete window.dshMobile;
+				else window.dshMobile = previousRegistry;
+			};
+		}
 		/** Install the responsive mobile layer and the loopback-only control card. */
 		function apply(ctx) {
 			ctx.effect(() => {
@@ -172,13 +269,34 @@ window.__ModuleLoader__.load({
 				style.textContent = BASE_STYLES;
 				document.head.append(style);
 				const loopback = isLoopbackHost(location.hostname);
-				const custom = loopback ? void 0 : document.createElement("link");
+				const custom = loopback ? void 0 : document.createElement("style");
+				let customRefresh;
+				let customLoading = false;
 				if (custom !== void 0) {
-					custom.rel = "stylesheet";
-					custom.href = "/mobile-access/custom.css";
 					custom.dataset.plugin = "dsh-mobile";
 					document.head.append(custom);
+					const refreshCustomCss = async () => {
+						if (customLoading || document.visibilityState === "hidden") return;
+						customLoading = true;
+						try {
+							const response = await fetch("/mobile-access/custom.css", {
+								cache: "no-store",
+								credentials: "same-origin",
+								redirect: "error"
+							});
+							if (!response.ok || !response.headers.get("content-type")?.startsWith("text/css")) return;
+							const css = await response.text();
+							if (custom.textContent !== css) custom.textContent = css;
+						} catch {} finally {
+							customLoading = false;
+						}
+					};
+					refreshCustomCss();
+					customRefresh = setInterval(() => {
+						refreshCustomCss();
+					}, 1e3);
 				}
+				const removeCustomExtension = loopback ? void 0 : installCustomExtension();
 				const control = loopback ? installControl() : void 0;
 				const disposeSlot = control === void 0 ? void 0 : ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
 					name: "sidebar.footer.action",
@@ -190,8 +308,10 @@ window.__ModuleLoader__.load({
 					onClick: control.toggle
 				}, wide ? controlLabel() : "M")));
 				return () => {
+					if (customRefresh !== void 0) clearInterval(customRefresh);
 					disposeSlot?.();
 					control?.remove();
+					removeCustomExtension?.();
 					custom?.remove();
 					style.remove();
 				};

package/lib/client.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n effect(effect: () => void \| (() => void), label?: string): void\n slots: {\n inject(key: string, callback: () => (() => void)): () => void\n register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n :root {\n --dsh-mobile-accent: #2563eb;\n --dsh-mobile-font-scale: 1;\n --dsh-mobile-radius: 14px;\n }\n html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n body { overscroll-behavior: none; }\n button, [role='button'], input, textarea, select { min-height: 44px; }\n input, textarea, select { font-size: 16px !important; }\n [data-sidebar-collapsed] {\n padding-top: env(safe-area-inset-top);\n padding-right: env(safe-area-inset-right);\n padding-bottom: env(safe-area-inset-bottom);\n padding-left: env(safe-area-inset-left);\n }\n [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n , ::before, ::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n position: fixed;\n left: 68px;\n bottom: 12px;\n z-index: 90;\n color: #172554;\n font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n min-width: 44px;\n min-height: 44px;\n border: 1px solid #bfdbfe;\n border-radius: 12px;\n background: #fff;\n color: #1e3a8a;\n cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n width: 100%;\n min-width: 44px;\n min-height: 44px;\n padding: 0 12px;\n border: 0;\n border-radius: 10px;\n background: transparent;\n color: inherit;\n font: inherit;\n font-weight: 700;\n cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n width: min(320px, calc(100vw - 24px));\n margin-bottom: 8px;\n padding: 16px;\n border: 1px solid #dbeafe;\n border-radius: 16px;\n background: #fff;\n box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n return hostname === 'localhost' \|\| hostname === '127.0.0.1' \|\| hostname === '[::1]' \|\| hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n const node = document.createElement(name)\n if (className !== undefined) node.className = className\n return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n const response = await fetch(path, {\n ...init,\n headers: { 'content-type': 'application/json', ...init?.headers },\n })\n const body = await response.json() as Record<string, unknown>\n if (!response.ok) throw new Error(typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`)\n return body\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n const zh = navigator.language.toLowerCase().startsWith('zh')\n const root = element('div', 'dsh-mobile-control')\n const panel = element('section', 'dsh-mobile-control__panel')\n panel.hidden = true\n const title = element('h2', 'dsh-mobile-control__title')\n title.textContent = zh ? '移动访问' : 'Mobile access'\n const status = element('p', 'dsh-mobile-control__status')\n status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n const actions = element('div', 'dsh-mobile-control__actions')\n const toggle = element('button')\n toggle.dataset.primary = 'true'\n const pair = element('button')\n pair.textContent = zh ? '生成配对链接' : 'Create pairing link'\n actions.append(toggle, pair)\n panel.append(title, status, actions)\n root.append(panel)\n document.body.append(root)\n\n let running = false\n const render = (data: Record<string, unknown>): void => {\n running = data.running === true\n const origin = typeof data.origin === 'string' ? data.origin : undefined\n status.textContent = running\n ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n pair.disabled = !running\n }\n const refresh = async (): Promise<void> => {\n try { render(await requestJson('/api/mobile-access/control')) }\n catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n }\n toggle.addEventListener('click', () => {\n toggle.disabled = true\n void requestJson('/api/mobile-access/control', {\n method: 'POST',\n body: JSON.stringify({ running: !running }),\n }).then(render, (error: unknown) => {\n status.textContent = error instanceof Error ? error.message : String(error)\n }).finally(() => { toggle.disabled = false })\n })\n pair.addEventListener('click', () => {\n pair.disabled = true\n void requestJson('/api/mobile-access/pairing/open', {\n method: 'POST',\n body: '{}',\n }).then(async (data) => {\n const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n if (url !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(url)\n status.textContent = url === '' ? (zh ? '无法生成链接' : 'Could not create link')\n : (zh ? `链接已复制：${url}` : `Copied: ${url}`)\n }, (error: unknown) => {\n status.textContent = error instanceof Error ? error.message : String(error)\n }).finally(() => { pair.disabled = !running })\n })\n void refresh()\n return {\n remove: () => { root.remove() },\n toggle: () => { panel.hidden = !panel.hidden },\n }\n}\n\n/* Install the responsive mobile layer and the loopback-only control card. /\nexport function apply(ctx: ClientContext): void {\n ctx.effect(() => {\n const style = document.createElement('style')\n style.dataset.plugin = 'dsh-mobile'\n style.textContent = BASE_STYLES\n document.head.append(style)\n\n const loopback = isLoopbackHost(location.hostname)\n const custom = loopback ? undefined : document.createElement('link')\n if (custom !== undefined) {\n custom.rel = 'stylesheet'\n custom.href = '/mobile-access/custom.css'\n custom.dataset.plugin = 'dsh-mobile'\n document.head.append(custom)\n }\n const control = loopback ? installControl() : undefined\n const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n name: 'sidebar.footer.action',\n id: 'dsh-mobile',\n }, ({ wide }) => createElement('button', {\n className: 'dsh-mobile-control__trigger',\n type: 'button',\n title: controlLabel(),\n onClick: control.toggle,\n }, wide ? controlLabel() : 'M')))\n return () => {\n disposeSlot?.()\n control?.remove()\n custom?.remove()\n style.remove()\n }\n }, 'dsh-mobile: responsive UI and local control')\n}\n\n/* Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EAYA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM,GAAG;GACjH,OAAO;EACT;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,IAAI,QAAQ,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,GAAG;KAC5F,OAAO,cAAc,QAAQ,KAAM,KAAK,WAAW,0BAC9C,KAAK,SAAS,QAAQ,WAAW;IACxC,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,MAAM;IACnE,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,MAAM;KACb,OAAO,OAAO;KACd,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;IAC7B;IACA,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,cAAc;KACd,SAAS,OAAO;KAChB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}
1	+ {"version":3,"file":"client.js","names":["createElement"],"sources":["../src/client.ts"],"sourcesContent":["import { createElement } from 'react'\n\ninterface ClientContext {\n effect(effect: () => void \| (() => void), label?: string): void\n slots: {\n inject(key: string, callback: () => (() => void)): () => void\n register(options: { name: string; id: string }, component: (props: { wide: boolean }) => unknown): () => void\n }\n}\n\ninterface MobileExtensionContext {\n readonly document: Document\n readonly request: (path: string, init?: RequestInit) => Promise<Response>\n readonly root: HTMLElement\n readonly window: Window\n}\n\ntype MobileExtensionMount = (context: MobileExtensionContext) => void \| (() => void)\n\ninterface MobileExtensionRegistry {\n register(mount: MobileExtensionMount): void\n}\n\ndeclare global {\n interface Window {\n dshMobile?: MobileExtensionRegistry\n }\n}\n\nconst MOBILE_QUERY = '(max-width: 720px)'\n\nconst BASE_STYLES = `\n@media ${MOBILE_QUERY} {\n :root {\n --dsh-mobile-accent: #2563eb;\n --dsh-mobile-font-scale: 1;\n --dsh-mobile-radius: 14px;\n }\n html { font-size: calc(16px * var(--dsh-mobile-font-scale)); }\n body { overscroll-behavior: none; }\n button, [role='button'], input, textarea, select { min-height: 44px; }\n input, textarea, select { font-size: 16px !important; }\n [data-sidebar-collapsed] {\n padding-top: env(safe-area-inset-top);\n padding-right: env(safe-area-inset-right);\n padding-bottom: env(safe-area-inset-bottom);\n padding-left: env(safe-area-inset-left);\n }\n [data-shell-overlay] { inset: env(safe-area-inset-top) env(safe-area-inset-right) env(safe-area-inset-bottom) env(safe-area-inset-left); }\n * { -webkit-tap-highlight-color: transparent; }\n}\n@media (prefers-reduced-motion: reduce) {\n , ::before, ::after { scroll-behavior: auto !important; animation-duration: 0.01ms !important; transition-duration: 0.01ms !important; }\n}\n.dsh-mobile-control {\n position: fixed;\n left: 68px;\n bottom: 12px;\n z-index: 90;\n color: #172554;\n font: 14px/1.45 system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;\n}\n.dsh-mobile-control button {\n min-width: 44px;\n min-height: 44px;\n border: 1px solid #bfdbfe;\n border-radius: 12px;\n background: #fff;\n color: #1e3a8a;\n cursor: pointer;\n}\n.dsh-mobile-control__trigger {\n width: 100%;\n min-width: 44px;\n min-height: 44px;\n padding: 0 12px;\n border: 0;\n border-radius: 10px;\n background: transparent;\n color: inherit;\n font: inherit;\n font-weight: 700;\n cursor: pointer;\n}\n.dsh-mobile-control__trigger:hover { background: rgb(37 99 235 / 8%); }\n.dsh-mobile-control__panel {\n width: min(320px, calc(100vw - 24px));\n margin-bottom: 8px;\n padding: 16px;\n border: 1px solid #dbeafe;\n border-radius: 16px;\n background: #fff;\n box-shadow: 0 10px 30px rgb(15 23 42 / 12%);\n}\n.dsh-mobile-control__title { margin: 0 0 4px; font-size: 16px; font-weight: 800; }\n.dsh-mobile-control__status { margin: 0 0 14px; color: #475569; overflow-wrap: anywhere; }\n.dsh-mobile-control__actions { display: grid; grid-template-columns: 1fr 1fr; gap: 8px; }\n.dsh-mobile-control__actions button[data-primary='true'] { background: #2563eb; border-color: #2563eb; color: #fff; }\n.dsh-mobile-control[hidden], .dsh-mobile-control__panel[hidden] { display: none; }\n`\n\nfunction isLoopbackHost(hostname: string): boolean {\n return hostname === 'localhost' \|\| hostname === '127.0.0.1' \|\| hostname === '[::1]' \|\| hostname === '::1'\n}\n\nfunction element<K extends keyof HTMLElementTagNameMap>(name: K, className?: string): HTMLElementTagNameMap[K] {\n const node = document.createElement(name)\n if (className !== undefined) node.className = className\n return node\n}\n\nasync function requestJson(path: string, init?: RequestInit): Promise<Record<string, unknown>> {\n const response = await fetch(path, {\n ...init,\n headers: { 'content-type': 'application/json', ...init?.headers },\n })\n const body = await response.json() as Record<string, unknown>\n if (!response.ok) {\n const code = typeof body.error === 'string' ? body.error : `HTTP ${String(response.status)}`\n throw new Error(controlErrorMessage(code))\n }\n return body\n}\n\nfunction controlErrorMessage(code: string): string {\n const zh = navigator.language.toLowerCase().startsWith('zh')\n const messages: Record<string, readonly [string, string]> = {\n network_address_changed: ['局域网地址已变化，请重启 DSH 后重试。', 'The LAN address changed. Restart DSH and try again.'],\n network_interface_unavailable: ['保存的局域网网卡未连接，请连接网络后重启 DSH。', 'The saved LAN interface is disconnected. Connect it and restart DSH.'],\n listen_port_in_use: ['移动访问端口已被占用。', 'The mobile-access port is already in use.'],\n }\n const message = messages[code]\n return message === undefined ? code : message[zh ? 0 : 1]\n}\n\nfunction mobileExtensionRequest(path: string, init: RequestInit = {}): Promise<Response> {\n const target = new URL(path, location.href)\n if (target.origin !== location.origin) throw new TypeError('mobile extension requests must stay on the DSH origin')\n const headers = new Headers(init.headers)\n const method = (init.method ?? 'GET').toUpperCase()\n if (method !== 'GET' && method !== 'HEAD' && !headers.has('x-dsh-mobile-csrf')) {\n const csrf = document.cookie.split(';').map(entry => entry.trim())\n .find(entry => entry.startsWith('dsh_ma_csrf='))?.slice('dsh_ma_csrf='.length)\n if (csrf !== undefined) headers.set('x-dsh-mobile-csrf', csrf)\n }\n return fetch(target, {\n ...init,\n cache: 'no-store',\n credentials: 'same-origin',\n headers,\n redirect: 'error',\n })\n}\n\nfunction installControl(): { remove: () => void; toggle: () => void } {\n const zh = navigator.language.toLowerCase().startsWith('zh')\n const root = element('div', 'dsh-mobile-control')\n const panel = element('section', 'dsh-mobile-control__panel')\n panel.hidden = true\n const title = element('h2', 'dsh-mobile-control__title')\n title.textContent = zh ? '移动访问' : 'Mobile access'\n const status = element('p', 'dsh-mobile-control__status')\n status.textContent = zh ? '正在读取状态…' : 'Reading status…'\n const actions = element('div', 'dsh-mobile-control__actions')\n const toggle = element('button')\n toggle.dataset.primary = 'true'\n const pair = element('button')\n pair.textContent = zh ? '生成配对链接' : 'Create pairing link'\n actions.append(toggle, pair)\n panel.append(title, status, actions)\n root.append(panel)\n document.body.append(root)\n\n let running = false\n const render = (data: Record<string, unknown>): void => {\n running = data.running === true\n const origin = typeof data.origin === 'string' ? data.origin : undefined\n status.textContent = running\n ? (zh ? `已开启：${origin ?? ''}` : `Running: ${origin ?? ''}`)\n : (zh ? '已关闭。DSH 仍只在本机可用。' : 'Stopped. DSH remains local-only.')\n toggle.textContent = running ? (zh ? '关闭' : 'Stop') : (zh ? '开启' : 'Start')\n pair.disabled = !running\n }\n const refresh = async (): Promise<void> => {\n try { render(await requestJson('/api/mobile-access/control')) }\n catch (error) { status.textContent = error instanceof Error ? error.message : String(error) }\n }\n toggle.addEventListener('click', () => {\n toggle.disabled = true\n void requestJson('/api/mobile-access/control', {\n method: 'POST',\n body: JSON.stringify({ running: !running }),\n }).then(render, (error: unknown) => {\n status.textContent = error instanceof Error ? error.message : String(error)\n }).finally(() => { toggle.disabled = false })\n })\n pair.addEventListener('click', () => {\n pair.disabled = true\n void requestJson('/api/mobile-access/pairing/open', {\n method: 'POST',\n body: '{}',\n }).then(async (data) => {\n const url = typeof data.pairUrl === 'string' ? data.pairUrl : ''\n if (url !== '' && navigator.clipboard !== undefined) await navigator.clipboard.writeText(url)\n status.textContent = url === '' ? (zh ? '无法生成链接' : 'Could not create link')\n : (zh ? `链接已复制：${url}` : `Copied: ${url}`)\n }, (error: unknown) => {\n status.textContent = error instanceof Error ? error.message : String(error)\n }).finally(() => { pair.disabled = !running })\n })\n void refresh()\n return {\n remove: () => { root.remove() },\n toggle: () => { panel.hidden = !panel.hidden },\n }\n}\n\nfunction installCustomExtension(): () => void {\n let activeRoot: HTMLElement \| undefined\n let activeDispose: (() => void) \| undefined\n let observedSource = ''\n let loading = false\n let pendingMount: MobileExtensionMount \| undefined\n const previousRegistry = window.dshMobile\n const registry: MobileExtensionRegistry = Object.freeze({\n register: (mount: MobileExtensionMount): void => {\n if (typeof mount !== 'function') throw new TypeError('dshMobile.register requires a mount function')\n pendingMount = mount\n },\n })\n const registeredMount = (): MobileExtensionMount \| undefined => pendingMount\n window.dshMobile = registry\n\n const refresh = async (): Promise<void> => {\n if (loading \|\| document.visibilityState === 'hidden') return\n loading = true\n try {\n const response = await fetch('/mobile-access/custom.js', {\n cache: 'no-store',\n credentials: 'same-origin',\n redirect: 'error',\n })\n if (!response.ok \|\| !response.headers.get('content-type')?.startsWith('text/javascript')) return\n const source = await response.text()\n if (source === observedSource) return\n observedSource = source\n pendingMount = undefined\n const script = document.createElement('script')\n script.textContent = `${source}\\n//# sourceURL=dsh-mobile-custom.js`\n document.head.append(script)\n script.remove()\n const mount = registeredMount()\n if (mount === undefined) return\n\n const nextRoot = document.createElement('div')\n nextRoot.dataset.dshMobileExtension = 'true'\n document.body.append(nextRoot)\n try {\n const nextDispose = mount(Object.freeze({\n document,\n request: mobileExtensionRequest,\n root: nextRoot,\n window,\n }))\n if (nextDispose !== undefined && typeof nextDispose !== 'function') {\n throw new TypeError('the mobile extension mount function must return a disposer or undefined')\n }\n activeDispose?.()\n activeRoot?.remove()\n activeRoot = nextRoot\n activeDispose = typeof nextDispose === 'function' ? nextDispose : undefined\n } catch (error) {\n nextRoot.remove()\n console.error('DSH Mobile custom extension failed to mount', error)\n }\n } catch {\n // A transient LAN disconnect keeps the last successfully mounted extension.\n } finally {\n loading = false\n }\n }\n void refresh()\n const timer = setInterval(() => { void refresh() }, 1_000)\n return () => {\n clearInterval(timer)\n activeDispose?.()\n activeRoot?.remove()\n if (previousRegistry === undefined) delete window.dshMobile\n else window.dshMobile = previousRegistry\n }\n}\n\n/* Install the responsive mobile layer and the loopback-only control card. /\nexport function apply(ctx: ClientContext): void {\n ctx.effect(() => {\n const style = document.createElement('style')\n style.dataset.plugin = 'dsh-mobile'\n style.textContent = BASE_STYLES\n document.head.append(style)\n\n const loopback = isLoopbackHost(location.hostname)\n const custom = loopback ? undefined : document.createElement('style')\n let customRefresh: ReturnType<typeof setInterval> \| undefined\n let customLoading = false\n if (custom !== undefined) {\n custom.dataset.plugin = 'dsh-mobile'\n document.head.append(custom)\n const refreshCustomCss = async (): Promise<void> => {\n if (customLoading \|\| document.visibilityState === 'hidden') return\n customLoading = true\n try {\n const response = await fetch('/mobile-access/custom.css', {\n cache: 'no-store',\n credentials: 'same-origin',\n redirect: 'error',\n })\n if (!response.ok \|\| !response.headers.get('content-type')?.startsWith('text/css')) return\n const css = await response.text()\n if (custom.textContent !== css) custom.textContent = css\n } catch {\n // A transient LAN disconnect keeps the last successfully applied stylesheet.\n } finally {\n customLoading = false\n }\n }\n void refreshCustomCss()\n customRefresh = setInterval(() => { void refreshCustomCss() }, 1_000)\n }\n const removeCustomExtension = loopback ? undefined : installCustomExtension()\n const control = loopback ? installControl() : undefined\n const disposeSlot = control === undefined ? undefined : ctx.slots.inject('sidebar.footer.action', () => ctx.slots.register({\n name: 'sidebar.footer.action',\n id: 'dsh-mobile',\n }, ({ wide }) => createElement('button', {\n className: 'dsh-mobile-control__trigger',\n type: 'button',\n title: controlLabel(),\n onClick: control.toggle,\n }, wide ? controlLabel() : 'M')))\n return () => {\n if (customRefresh !== undefined) clearInterval(customRefresh)\n disposeSlot?.()\n control?.remove()\n removeCustomExtension?.()\n custom?.remove()\n style.remove()\n }\n }, 'dsh-mobile: responsive UI and local control')\n}\n\n/* Client face has no service prerequisites. */\nexport const inject: readonly string[] = ['slots']\n\nfunction controlLabel(): string {\n return navigator.language.toLowerCase().startsWith('zh') ? '移动端' : 'Mobile access'\n}\n"],"mappings":";;;;;;;;EA+BA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEpB,SAAS,eAAe,UAA2B;GACjD,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;EACtG;EAEA,SAAS,QAA+C,MAAS,WAA8C;GAC7G,MAAM,OAAO,SAAS,cAAc,IAAI;GACxC,IAAI,cAAc,KAAA,GAAW,KAAK,YAAY;GAC9C,OAAO;EACT;EAEA,eAAe,YAAY,MAAc,MAAsD;GAC7F,MAAM,WAAW,MAAM,MAAM,MAAM;IACjC,GAAG;IACH,SAAS;KAAE,gBAAgB;KAAoB,GAAG,MAAM;IAAQ;GAClE,CAAC;GACD,MAAM,OAAO,MAAM,SAAS,KAAK;GACjC,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,OAAO,SAAS,MAAM;IACzF,MAAM,IAAI,MAAM,oBAAoB,IAAI,CAAC;GAC3C;GACA,OAAO;EACT;EAEA,SAAS,oBAAoB,MAAsB;GACjD,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAM3D,MAAM,UAAU;IAJd,yBAAyB,CAAC,yBAAyB,qDAAqD;IACxG,+BAA+B,CAAC,6BAA6B,sEAAsE;IACnI,oBAAoB,CAAC,eAAe,2CAA2C;GAE1D,EAAE;GACzB,OAAO,YAAY,KAAA,IAAY,OAAO,QAAQ,KAAK,IAAI;EACzD;EAEA,SAAS,uBAAuB,MAAc,OAAoB,CAAC,GAAsB;GACvF,MAAM,SAAS,IAAI,IAAI,MAAM,SAAS,IAAI;GAC1C,IAAI,OAAO,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,uDAAuD;GAClH,MAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;GACxC,MAAM,UAAU,KAAK,UAAU,MAAA,CAAO,YAAY;GAClD,IAAI,WAAW,SAAS,WAAW,UAAU,CAAC,QAAQ,IAAI,mBAAmB,GAAG;IAC9E,MAAM,OAAO,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS,MAAM,KAAK,CAAC,CAAC,CAC/D,MAAK,UAAS,MAAM,WAAW,cAAc,CAAC,CAAC,EAAE,MAAM,EAAqB;IAC/E,IAAI,SAAS,KAAA,GAAW,QAAQ,IAAI,qBAAqB,IAAI;GAC/D;GACA,OAAO,MAAM,QAAQ;IACnB,GAAG;IACH,OAAO;IACP,aAAa;IACb;IACA,UAAU;GACZ,CAAC;EACH;EAEA,SAAS,iBAA6D;GACpE,MAAM,KAAK,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI;GAC3D,MAAM,OAAO,QAAQ,OAAO,oBAAoB;GAChD,MAAM,QAAQ,QAAQ,WAAW,2BAA2B;GAC5D,MAAM,SAAS;GACf,MAAM,QAAQ,QAAQ,MAAM,2BAA2B;GACvD,MAAM,cAAc,KAAK,SAAS;GAClC,MAAM,SAAS,QAAQ,KAAK,4BAA4B;GACxD,OAAO,cAAc,KAAK,YAAY;GACtC,MAAM,UAAU,QAAQ,OAAO,6BAA6B;GAC5D,MAAM,SAAS,QAAQ,QAAQ;GAC/B,OAAO,QAAQ,UAAU;GACzB,MAAM,OAAO,QAAQ,QAAQ;GAC7B,KAAK,cAAc,KAAK,WAAW;GACnC,QAAQ,OAAO,QAAQ,IAAI;GAC3B,MAAM,OAAO,OAAO,QAAQ,OAAO;GACnC,KAAK,OAAO,KAAK;GACjB,SAAS,KAAK,OAAO,IAAI;GAEzB,IAAI,UAAU;GACd,MAAM,UAAU,SAAwC;IACtD,UAAU,KAAK,YAAY;IAC3B,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS,KAAA;IAC/D,OAAO,cAAc,UAChB,KAAK,OAAO,UAAU,OAAO,YAAY,UAAU,OACnD,KAAK,qBAAqB;IAC/B,OAAO,cAAc,UAAW,KAAK,OAAO,SAAW,KAAK,OAAO;IACnE,KAAK,WAAW,CAAC;GACnB;GACA,MAAM,UAAU,YAA2B;IACzC,IAAI;KAAE,OAAO,MAAM,YAAY,4BAA4B,CAAC;IAAE,SACvD,OAAO;KAAE,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAAE;GAC9F;GACA,OAAO,iBAAiB,eAAe;IACrC,OAAO,WAAW;IAClB,YAAiB,8BAA8B;KAC7C,QAAQ;KACR,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;IAC5C,CAAC,CAAC,CAAC,KAAK,SAAS,UAAmB;KAClC,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,OAAO,WAAW;IAAM,CAAC;GAC9C,CAAC;GACD,KAAK,iBAAiB,eAAe;IACnC,KAAK,WAAW;IAChB,YAAiB,mCAAmC;KAClD,QAAQ;KACR,MAAM;IACR,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS;KACtB,MAAM,MAAM,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;KAC9D,IAAI,QAAQ,MAAM,UAAU,cAAc,KAAA,GAAW,MAAM,UAAU,UAAU,UAAU,GAAG;KAC5F,OAAO,cAAc,QAAQ,KAAM,KAAK,WAAW,0BAC9C,KAAK,SAAS,QAAQ,WAAW;IACxC,IAAI,UAAmB;KACrB,OAAO,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAC5E,CAAC,CAAC,CAAC,cAAc;KAAE,KAAK,WAAW,CAAC;IAAQ,CAAC;GAC/C,CAAC;GACD,QAAa;GACb,OAAO;IACL,cAAc;KAAE,KAAK,OAAO;IAAE;IAC9B,cAAc;KAAE,MAAM,SAAS,CAAC,MAAM;IAAO;GAC/C;EACF;EAEA,SAAS,yBAAqC;GAC5C,IAAI;GACJ,IAAI;GACJ,IAAI,iBAAiB;GACrB,IAAI,UAAU;GACd,IAAI;GACJ,MAAM,mBAAmB,OAAO;GAChC,MAAM,WAAoC,OAAO,OAAO,EACtD,WAAW,UAAsC;IAC/C,IAAI,OAAO,UAAU,YAAY,MAAM,IAAI,UAAU,8CAA8C;IACnG,eAAe;GACjB,EACF,CAAC;GACD,MAAM,wBAA0D;GAChE,OAAO,YAAY;GAEnB,MAAM,UAAU,YAA2B;IACzC,IAAI,WAAW,SAAS,oBAAoB,UAAU;IACtD,UAAU;IACV,IAAI;KACF,MAAM,WAAW,MAAM,MAAM,4BAA4B;MACvD,OAAO;MACP,aAAa;MACb,UAAU;KACZ,CAAC;KACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,iBAAiB,GAAG;KAC1F,MAAM,SAAS,MAAM,SAAS,KAAK;KACnC,IAAI,WAAW,gBAAgB;KAC/B,iBAAiB;KACjB,eAAe,KAAA;KACf,MAAM,SAAS,SAAS,cAAc,QAAQ;KAC9C,OAAO,cAAc,GAAG,OAAO;KAC/B,SAAS,KAAK,OAAO,MAAM;KAC3B,OAAO,OAAO;KACd,MAAM,QAAQ,gBAAgB;KAC9B,IAAI,UAAU,KAAA,GAAW;KAEzB,MAAM,WAAW,SAAS,cAAc,KAAK;KAC7C,SAAS,QAAQ,qBAAqB;KACtC,SAAS,KAAK,OAAO,QAAQ;KAC7B,IAAI;MACF,MAAM,cAAc,MAAM,OAAO,OAAO;OACtC;OACA,SAAS;OACT,MAAM;OACN;MACF,CAAC,CAAC;MACF,IAAI,gBAAgB,KAAA,KAAa,OAAO,gBAAgB,YACtD,MAAM,IAAI,UAAU,yEAAyE;MAE/F,gBAAgB;MAChB,YAAY,OAAO;MACnB,aAAa;MACb,gBAAgB,OAAO,gBAAgB,aAAa,cAAc,KAAA;KACpE,SAAS,OAAO;MACd,SAAS,OAAO;MAChB,QAAQ,MAAM,+CAA+C,KAAK;KACpE;IACF,QAAQ,CAER,UAAU;KACR,UAAU;IACZ;GACF;GACA,QAAa;GACb,MAAM,QAAQ,kBAAkB;IAAE,QAAa;GAAE,GAAG,GAAK;GACzD,aAAa;IACX,cAAc,KAAK;IACnB,gBAAgB;IAChB,YAAY,OAAO;IACnB,IAAI,qBAAqB,KAAA,GAAW,OAAO,OAAO;SAC7C,OAAO,YAAY;GAC1B;EACF;;EAGA,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa;IACf,MAAM,QAAQ,SAAS,cAAc,OAAO;IAC5C,MAAM,QAAQ,SAAS;IACvB,MAAM,cAAc;IACpB,SAAS,KAAK,OAAO,KAAK;IAE1B,MAAM,WAAW,eAAe,SAAS,QAAQ;IACjD,MAAM,SAAS,WAAW,KAAA,IAAY,SAAS,cAAc,OAAO;IACpE,IAAI;IACJ,IAAI,gBAAgB;IACpB,IAAI,WAAW,KAAA,GAAW;KACxB,OAAO,QAAQ,SAAS;KACxB,SAAS,KAAK,OAAO,MAAM;KAC3B,MAAM,mBAAmB,YAA2B;MAClD,IAAI,iBAAiB,SAAS,oBAAoB,UAAU;MAC5D,gBAAgB;MAChB,IAAI;OACF,MAAM,WAAW,MAAM,MAAM,6BAA6B;QACxD,OAAO;QACP,aAAa;QACb,UAAU;OACZ,CAAC;OACD,IAAI,CAAC,SAAS,MAAM,CAAC,SAAS,QAAQ,IAAI,cAAc,CAAC,EAAE,WAAW,UAAU,GAAG;OACnF,MAAM,MAAM,MAAM,SAAS,KAAK;OAChC,IAAI,OAAO,gBAAgB,KAAK,OAAO,cAAc;MACvD,QAAQ,CAER,UAAU;OACR,gBAAgB;MAClB;KACF;KACA,iBAAsB;KACtB,gBAAgB,kBAAkB;MAAE,iBAAsB;KAAE,GAAG,GAAK;IACtE;IACA,MAAM,wBAAwB,WAAW,KAAA,IAAY,uBAAuB;IAC5E,MAAM,UAAU,WAAW,eAAe,IAAI,KAAA;IAC9C,MAAM,cAAc,YAAY,KAAA,IAAY,KAAA,IAAY,IAAI,MAAM,OAAO,+BAA+B,IAAI,MAAM,SAAS;KACzH,MAAM;KACN,IAAI;IACN,IAAI,EAAE,YAAA,GAAWA,MAAAA,cAAAA,CAAc,UAAU;KACvC,WAAW;KACX,MAAM;KACN,OAAO,aAAa;KACpB,SAAS,QAAQ;IACnB,GAAG,OAAO,aAAa,IAAI,GAAG,CAAC,CAAC;IAChC,aAAa;KACX,IAAI,kBAAkB,KAAA,GAAW,cAAc,aAAa;KAC5D,cAAc;KACd,SAAS,OAAO;KAChB,wBAAwB;KACxB,QAAQ,OAAO;KACf,MAAM,OAAO;IACf;GACF,GAAG,6CAA6C;EAClD;;EAGA,MAAa,SAA4B,CAAC,OAAO;EAEjD,SAAS,eAAuB;GAC9B,OAAO,UAAU,SAAS,YAAY,CAAC,CAAC,WAAW,IAAI,IAAI,QAAQ;EACrE"}

package/lib/index.d.mts CHANGED Viewed

@@ -235,8 +235,10 @@ interface PluginConfig {
   stateFile: string;
   /** Internal persisted on/off preference managed by the DSH plugin card. */
   controlFile: string;
-  /** Optional user stylesheet served to both the desktop and authenticated mobile UI. */
+  /** Optional user stylesheet served to the authenticated mobile UI. */
   customCssFile?: string;
+  /** Optional user script that mounts authenticated mobile-only Web features. */
+  customScriptFile?: string;
   /** First-run state used only while the control file does not exist. */
   initiallyEnabled: boolean;
   tls?: {
@@ -268,6 +270,7 @@ interface ResolvedGatewayConfig {
   readonly allowedCidrs: readonly ParsedCidr[];
   readonly stateFile: string;
   readonly customCssFile: string;
+  readonly customScriptFile: string;
   readonly tls: TlsConfig;
   readonly pairingTtlMs: number;
   readonly deviceTtlMs: number;

package/lib/index.mjs CHANGED Viewed

@@ -1,4 +1,4 @@
-import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { connect, isIP } from "node:net";
@@ -7,6 +7,8 @@ import { createServer, request } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { networkInterfaces } from "node:os";
+import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -540,6 +542,7 @@ const Config = z.object({
 	stateFile: String,
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
+	customScriptFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
 	tls: z.object({
 		mode: z.union([z.const("provided"), z.const("disabled")]),
@@ -660,6 +663,7 @@ function parseGatewayConfig(raw) {
 		allowedCidrs: Object.freeze(allowedCidrs),
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
+		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
 		tls,
 		pairingTtlMs: integer(value.pairingTtlMs, "pairingTtlMs", 12e4, 1e4, 6e5),
 		deviceTtlMs,
@@ -1526,8 +1530,16 @@ var MobileAccessGateway = class {
 			await this.handleLogout(request, response);
 			return;
 		}
-		const customCss = target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/custom.css`;
-		if (!customCss && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		const customAsset = request.method === "GET" ? target.decodedPathname === `/mobile-access/custom.css` ? {
+			file: this.config.customCssFile,
+			contentType: "text/css; charset=utf-8",
+			fallback: "/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n"
+		} : target.decodedPathname === `/mobile-access/custom.js` ? {
+			file: this.config.customScriptFile,
+			contentType: "text/javascript; charset=utf-8",
+			fallback: "window.dshMobile?.register(() => undefined)\n"
+		} : void 0 : void 0;
+		if (customAsset === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 		if (request.method === "POST" && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/")) throw new HttpError(405, "method_not_allowed");
 		let authorization;
@@ -1549,19 +1561,20 @@ var MobileAccessGateway = class {
 			}
 			throw error;
 		}
-		if (customCss) {
+		if (customAsset !== void 0) {
 			let body;
 			try {
-				body = await readFile(this.config.customCssFile);
+				body = await readFile(customAsset.file);
 			} catch (error) {
 				if (error.code !== "ENOENT") throw error;
-				body = Buffer.from("/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n");
+				body = Buffer.from(customAsset.fallback);
 			}
 			if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
 			setSecurityHeaders(response, this.tlsEnabled);
 			response.writeHead(200, {
-				"Content-Type": "text/css; charset=utf-8",
-				"Content-Length": body.byteLength
+				"Content-Type": customAsset.contentType,
+				"Content-Length": body.byteLength,
+				"Cache-Control": "no-store"
 			});
 			response.end(body);
 			return;
@@ -2005,13 +2018,188 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
+//#region src/managed-setup.ts
+function requiredString(value, name) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
+	return value;
+}
+/** Validate the durable managed setup before it controls network and filesystem operations. */
+function parseManagedSetup(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
+	const record = value;
+	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
+		"version",
+		"networkInterface",
+		"listenPort",
+		"upstreamOrigin",
+		"tls"
+	].includes(key))) throw new Error("mobile setup file has an unsupported format");
+	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
+	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
+	const tls = record.tls;
+	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
+		"mode",
+		"caCertFile",
+		"caKeyFile",
+		"certFile",
+		"keyFile"
+	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
+	return Object.freeze({
+		version: 2,
+		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
+		listenPort: record.listenPort,
+		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		tls: Object.freeze({
+			mode: "managed",
+			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
+			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
+			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
+			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
+		})
+	});
+}
+function privateIpv4(value) {
+	const parts = value.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+}
+function networkCidr(address, cidr) {
+	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
+	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
+	return `${[
+		24,
+		16,
+		8,
+		0
+	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
+}
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
+		address: entry.address,
+		cidr: networkCidr(entry.address, entry.cidr)
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => entry.address).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+}
+/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
+async function materializeManagedSetup(setup, table) {
+	const network = selectLanNetwork(void 0, setup.networkInterface, table);
+	await refreshManagedServerCertificate(setup, network.address);
+	return {
+		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
+		listenHost: network.address,
+		upstreamOrigin: setup.upstreamOrigin,
+		allowedCidrs: [network.cidr],
+		tls: {
+			mode: "provided",
+			certFile: setup.tls.certFile,
+			keyFile: setup.tls.keyFile
+		}
+	};
+}
+//#endregion
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer is the only DSH Host service this plugin requires. */
 const inject = ["webServer"];
 function mapAdminError(error) {
-	return error instanceof HttpError ? error : new HttpError(500, "internal_error");
+	if (error instanceof HttpError) return error;
+	const code = error.code;
+	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
+	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
+	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
+	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"version",
@@ -2041,6 +2229,15 @@ async function loadSetup(config) {
 	}
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
 	const record = parsed;
+	if (record.version === 2) {
+		const setup = await materializeManagedSetup(parseManagedSetup(record));
+		const merged = { ...config };
+		for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+		return {
+			...merged,
+			...setup
+		};
+	}
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
 	const merged = { ...config };

package/package.json CHANGED Viewed

@@ -1,11 +1,11 @@
 {
   "name": "dsh-mobile",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.3",
   "private": false,
   "description": "Authenticated Android and mobile-browser access for the stock DeepSeek Harness Web UI",
   "type": "module",
   "bin": {
-    "dsh-mobile": "lib/cli.js"
+    "dsh-mobile": "lib/cli.js"
   },
   "main": "./lib/index.mjs",
   "types": "./lib/index.d.mts",
@@ -20,8 +20,8 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "lib/**/*.mjs",
-    "lib/cli.js",
+    "lib/**/*.mjs",
+    "lib/cli.js",
     "lib/**/*.d.mts",
     "lib/client.js",
     "lib/client.js.map",