dsh-mobile 0.1.0-alpha.2 → 0.1.0-alpha.21

package/lib/index.mjs

@@ -1,12 +1,20 @@
-import { X509Certificate, createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, isIP } from "node:net";
-import { chmod, lstat, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, lstat, mkdir, opendir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createSocket } from "node:dgram";
+import { homedir, hostname, networkInterfaces } from "node:os";
 import { createServer, request } from "node:http";
 import { createServer as createServer$1 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import Bonjour from "bonjour-service";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -541,6 +549,9 @@ const Config = z.object({
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
 	customScriptFile: z.string().hidden(),
+	mobileLayoutFile: z.string().hidden(),
+	instanceId: z.string().hidden(),
+	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
 	tls: z.object({
 		mode: z.union([z.const("provided"), z.const("disabled")]),
@@ -662,6 +673,11 @@ function parseGatewayConfig(raw) {
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
+		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
+		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
+			throw new Error("instanceId must be a lowercase SHA-256 value");
+		})(),
+		...value.pairingCaFile === void 0 ? {} : { pairingCaFile: absoluteFile(value.pairingCaFile, "pairingCaFile") },
 		tls,
 		pairingTtlMs: integer(value.pairingTtlMs, "pairingTtlMs", 12e4, 1e4, 6e5),
 		deviceTtlMs,
@@ -679,7 +695,73 @@ function parseGatewayConfig(raw) {
 	});
 }
 //#endregion
+//#region src/compatibility.ts
+/** DeepSeek Harness prereleases verified by this plugin release. */
+const SUPPORTED_DSH_VERSIONS = Object.freeze(["0.1.0-rc.5", "0.1.0-rc.6"]);
+/**
+* Reject an unverified DeepSeek Harness Host before opening the LAN listener.
+* @param version - Version reported by the installed DSH WebServer package.
+*/
+function assertSupportedDshVersion(version) {
+	if (typeof version === "string" && SUPPORTED_DSH_VERSIONS.some((candidate) => candidate === version)) return;
+	throw new Error(`unsupported DeepSeek Harness version ${typeof version === "string" ? version : "(unknown)"}; supported versions: ${SUPPORTED_DSH_VERSIONS.join(", ")}`);
+}
+//#endregion
 //#region src/control.ts
+/** Keeps one runtime aligned with a changing network selection. */
+var FollowingMobileAccessRuntime = class {
+	select;
+	onRefreshError;
+	runtime;
+	key;
+	queue = Promise.resolve();
+	closed = false;
+	timer;
+	constructor(select, onRefreshError) {
+		this.select = select;
+		this.onRefreshError = onRefreshError;
+	}
+	/** Start the current selection and optionally poll for later changes. */
+	async initialize(refreshIntervalMs) {
+		await this.refresh();
+		if (refreshIntervalMs === void 0) return;
+		this.timer = setInterval(() => {
+			this.refresh().catch(this.onRefreshError);
+		}, refreshIntervalMs);
+		this.timer.unref();
+	}
+	/** Reconcile the active runtime with the latest selection. */
+	refresh() {
+		return this.enqueue(async () => {
+			if (this.closed) return;
+			const selection = await this.select();
+			if (this.closed || this.runtime !== void 0 && this.key === selection.key) return;
+			const previous = this.runtime;
+			this.runtime = void 0;
+			this.key = void 0;
+			if (previous !== void 0) await previous.close();
+			this.runtime = await selection.start();
+			this.key = selection.key;
+		});
+	}
+	/** Stop polling and close the most recently selected runtime. */
+	close() {
+		if (this.closed) return this.queue;
+		this.closed = true;
+		if (this.timer !== void 0) clearInterval(this.timer);
+		return this.enqueue(async () => {
+			const runtime = this.runtime;
+			this.runtime = void 0;
+			this.key = void 0;
+			if (runtime !== void 0) await runtime.close();
+		});
+	}
+	enqueue(operation) {
+		const run = this.queue.then(operation, operation);
+		this.queue = run.then(() => {}, () => {});
+		return run;
+	}
+};
 /** Validate control state loaded across the filesystem boundary. */
 function parseMobileAccessControlState(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile-access control state must be an object");
@@ -889,7 +971,7 @@ function setSecurityHeaders(response, tls) {
 		"object-src 'none'",
 		"frame-ancestors 'none'",
 		"form-action 'self'",
-		"script-src 'self' 'unsafe-inline'",
+		"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
 		"style-src 'self' 'unsafe-inline'",
 		"img-src 'self' data: blob:",
 		"font-src 'self' data:",
@@ -1010,9 +1092,92 @@ function assertLocalAdminTrust(request, requireBrowserOrigin) {
 	if (requireBrowserOrigin && site !== void 0 && (origin === void 0 || site !== "same-origin")) throw new HttpError(403, "forbidden");
 }
 //#endregion
+//#region src/computer-images.ts
+const MAX_ENTRIES = 500;
+const MAX_IMAGE_BYTES = 20971520;
+const IMAGE_TYPES = Object.freeze({
+	".gif": "image/gif",
+	".jpeg": "image/jpeg",
+	".jpg": "image/jpeg",
+	".png": "image/png",
+	".webp": "image/webp"
+});
+/** Normalize an optional mobile-browser path without rebasing relative input. */
+function resolveComputerImagePath(path) {
+	if (path === null || path === "") return homedir();
+	if (!isAbsolute(path) || path.includes("\0")) throw new HttpError(400, "bad_path");
+	return resolve(path);
+}
+/** List folders and supported image files without following symbolic links. */
+async function listComputerImages(path) {
+	const target = resolveComputerImagePath(path);
+	const rows = [];
+	let truncated = false;
+	let directory;
+	try {
+		directory = await opendir(target);
+		for await (const entry of directory) {
+			if (entry.isSymbolicLink()) continue;
+			const kind = entry.isDirectory() ? "directory" : IMAGE_TYPES[extname(entry.name).toLowerCase()] === void 0 ? void 0 : "image";
+			if (kind === void 0) continue;
+			if (rows.length === MAX_ENTRIES) {
+				truncated = true;
+				break;
+			}
+			rows.push({
+				kind,
+				name: entry.name,
+				path: resolve(target, entry.name)
+			});
+		}
+	} catch {
+		throw new HttpError(404, "directory_unavailable");
+	} finally {
+		await directory?.close().catch(() => void 0);
+	}
+	rows.sort((left, right) => left.kind === right.kind ? left.name.localeCompare(right.name) : left.kind === "directory" ? -1 : 1);
+	const parent = dirname(target);
+	return Object.freeze({
+		path: target,
+		...parent === target ? {} : { parent },
+		entries: Object.freeze(rows),
+		truncated
+	});
+}
+/** Read one bounded regular image file selected by an authenticated device. */
+async function readComputerImage(path) {
+	const target = resolveComputerImagePath(path);
+	const contentType = IMAGE_TYPES[extname(target).toLowerCase()];
+	if (contentType === void 0) throw new HttpError(415, "unsupported_file_type");
+	let info;
+	try {
+		info = await lstat(target);
+	} catch {
+		throw new HttpError(404, "file_unavailable");
+	}
+	if (!info.isFile() || info.isSymbolicLink()) throw new HttpError(404, "file_unavailable");
+	if (info.size > MAX_IMAGE_BYTES) throw new HttpError(413, "file_too_large");
+	try {
+		return {
+			body: await readFile(target),
+			contentType,
+			name: basename(target)
+		};
+	} catch {
+		throw new HttpError(404, "file_unavailable");
+	}
+}
+//#endregion
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
+const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
+const DISCOVERY_PROTOCOL = 1;
+const DISCOVERY_INTERVAL_MS = 3e3;
+const MDNS_SERVICE_TYPE = "dsh-mobile";
+const MOBILE_LAYOUT_MODULE = "@deepseek-ai/dsh-client-ui-layout";
+const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
+const MOBILE_LAYOUT_DEPENDENCIES = Object.freeze(["@deepseek-ai/dsh-client-runtime", "@deepseek-ai/dsh-client-ui-theme"]);
 const PAIR_PAGE = `<!doctype html>
 <html lang="en">
 <meta charset="utf-8">
@@ -1030,6 +1195,25 @@ const PAIR_PAGE = `<!doctype html>
 <script src="/mobile-access/pair.js" defer><\/script>
 </html>
 `;
+/** Replace only DSH's layout client module while retaining its complete plugin graph. */
+function rewriteMobileIndex(html) {
+	const assignment = "window.__DSH_BOOT__ = ";
+	const start = html.indexOf(assignment);
+	if (start < 0) throw new Error("upstream DSH index has no boot manifest");
+	const valueStart = start + 22;
+	const scriptEnd = html.indexOf("<\/script>", valueStart);
+	if (scriptEnd < 0) throw new Error("upstream DSH boot manifest script is incomplete");
+	const source = html.slice(valueStart, scriptEnd).trim().replace(/;$/u, "");
+	const parsed = JSON.parse(source);
+	if (typeof parsed.rev !== "string" || !Array.isArray(parsed.entries)) throw new Error("upstream DSH boot manifest is malformed");
+	const layout = parsed.entries.filter((entry) => entry !== null && typeof entry === "object" && entry.id === MOBILE_LAYOUT_MODULE);
+	if (layout.length !== 1 || typeof layout[0]?.url !== "string" || typeof layout[0].rev !== "string") throw new Error("upstream DSH boot manifest has no unique layout module");
+	if (!Array.isArray(layout[0].inject) || MOBILE_LAYOUT_DEPENDENCIES.some((dependency) => !layout[0]?.inject?.includes(dependency))) throw new Error("upstream DSH layout module has unsupported dependencies");
+	layout[0].url = MOBILE_LAYOUT_PATH;
+	layout[0].rev = "dsh-mobile-layout-v1";
+	const replacement = `window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment}${JSON.stringify(parsed)};`;
+	return `${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`;
+}
 const PAIR_SCRIPT = `(() => {
   const form = document.getElementById('pair-form')
   const token = document.getElementById('pair-token')
@@ -1279,6 +1463,29 @@ function mapError(error) {
 	if (error instanceof AccessError) return new HttpError(error.status, error.code);
 	return new HttpError(500, "internal_error");
 }
+function discoveryDeviceName() {
+	const value = hostname().trim().replaceAll(/[\u0000-\u001f\u007f]/gu, "");
+	return (value === "" ? "DeepSeek Harness" : value).slice(0, 63);
+}
+function discoveryMdnsHost(instanceId) {
+	const label = hostname().toLowerCase().replaceAll(/[^a-z0-9-]/gu, "-").replaceAll(/^-+|-+$/gu, "").slice(0, 40);
+	return `${label === "" ? "dsh" : label}-${instanceId.slice(0, 8)}.local`;
+}
+function discoveryBroadcastTargets(cidrs) {
+	const targets = /* @__PURE__ */ new Set(["255.255.255.255"]);
+	for (const cidr of cidrs) {
+		if (cidr.bits !== 32 || cidr.prefix >= 32) continue;
+		const hostBits = BigInt(32 - cidr.prefix);
+		const broadcast = cidr.network | (1n << hostBits) - 1n;
+		targets.add([
+			24n,
+			16n,
+			8n,
+			0n
+		].map((shift) => Number(broadcast >> shift & 255n)).join("."));
+	}
+	return [...targets];
+}
 /** Authenticated TLS edge in front of the ordinary loopback-only DSH Web server. */
 var MobileAccessGateway = class {
 	config;
@@ -1286,6 +1493,10 @@ var MobileAccessGateway = class {
 	tlsEnabled;
 	policy;
 	server;
+	discoverySocket;
+	discoveryTimer;
+	bonjour;
+	pairingCaCertificate;
 	listenerPort;
 	connectedSockets = /* @__PURE__ */ new Set();
 	activeRequests = /* @__PURE__ */ new Map();
@@ -1320,6 +1531,12 @@ var MobileAccessGateway = class {
 		this.started = true;
 		await this.access.initialize();
 		try {
+			if (this.config.pairingCaFile !== void 0) {
+				const certificate = new X509Certificate(await readFile(this.config.pairingCaFile));
+				const fingerprint = certificate.fingerprint256.replaceAll(":", "").toLowerCase();
+				if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey) || fingerprint !== this.config.instanceId) throw new Error("pairingCaFile must be the self-signed CA identified by instanceId");
+				this.pairingCaCertificate = certificate.raw.toString("base64");
+			}
 			const handler = (request, response) => {
 				this.handleExternalRequest(request, response).catch((error) => {
 					const mapped = mapError(error);
@@ -1370,12 +1587,70 @@ var MobileAccessGateway = class {
 			if (address === null || typeof address === "string") throw new Error("gateway listener has no TCP address");
 			this.listenerPort = address.port;
 			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
+			await this.startDiscovery(address.port);
 		} catch (error) {
 			await this.closeFailedStart();
 			throw error;
 		}
 	}
+	async startDiscovery(port) {
+		const socket = createSocket("udp4");
+		this.discoverySocket = socket;
+		const announcement = this.discoveryAnnouncement(port);
+		socket.on("message", (message, remote) => {
+			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
+			socket.send(announcement, remote.port, remote.address, () => void 0);
+		});
+		await new Promise((resolve, reject) => {
+			const failed = (error) => {
+				reject(error);
+			};
+			socket.once("error", failed);
+			socket.bind(port, "0.0.0.0", () => {
+				socket.off("error", failed);
+				socket.setBroadcast(true);
+				resolve();
+			});
+		});
+		const announce = () => {
+			for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
+		};
+		announce();
+		this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
+		this.discoveryTimer.unref();
+		const deviceName = discoveryDeviceName();
+		const bonjour = new Bonjour({ disableIPv6: true });
+		this.bonjour = bonjour;
+		bonjour.publish({
+			name: `${deviceName} (${this.config.instanceId.slice(0, 8)})`,
+			type: MDNS_SERVICE_TYPE,
+			protocol: "tcp",
+			port,
+			host: discoveryMdnsHost(this.config.instanceId),
+			disableIPv6: true,
+			txt: {
+				deviceName,
+				origin: this.address().origin,
+				instanceId: this.config.instanceId,
+				protocol: String(DISCOVERY_PROTOCOL)
+			}
+		});
+	}
+	discoveryAnnouncement(port) {
+		return Buffer.from(JSON.stringify({
+			deviceName: discoveryDeviceName(),
+			origin: this.address().origin,
+			port,
+			protocol: DISCOVERY_PROTOCOL,
+			instanceId: this.config.instanceId
+		}), "utf8");
+	}
 	async closeFailedStart() {
+		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
+		this.discoveryTimer = void 0;
+		await this.closeBonjour();
+		this.discoverySocket?.close();
+		this.discoverySocket = void 0;
 		for (const socket of this.connectedSockets) socket.destroy();
 		const server = this.server;
 		this.server = void 0;
@@ -1384,6 +1659,16 @@ var MobileAccessGateway = class {
 		});
 		await this.access.close();
 	}
+	async closeBonjour() {
+		const bonjour = this.bonjour;
+		this.bonjour = void 0;
+		if (bonjour === void 0) return;
+		await new Promise((resolve) => {
+			bonjour.unpublishAll(() => {
+				bonjour.destroy(() => resolve());
+			});
+		});
+	}
 	/** Actual bound address, available after start and safe for loopback status output. */
 	address() {
 		if (this.listenerPort === void 0 || this.policy === void 0) throw new Error("gateway is not listening");
@@ -1467,6 +1752,33 @@ var MobileAccessGateway = class {
 			sessionExpiresAt: result.sessionExpiresAt
 		}, this.tlsEnabled);
 	}
+	async handleNativePair(request, response) {
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
+		const result = await this.access.pair(request.socket.remoteAddress ?? "unknown", body.token, body.label);
+		sendJson(response, 201, {
+			instanceId: this.config.instanceId,
+			deviceId: result.deviceId,
+			deviceToken: result.deviceToken,
+			deviceExpiresAt: result.deviceExpiresAt,
+			sessionToken: result.sessionToken,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
+	async handleNativeRenew(request, response) {
+		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
+		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+		const result = await this.access.renew(body.deviceToken);
+		sendJson(response, 200, {
+			instanceId: this.config.instanceId,
+			deviceId: result.deviceId,
+			sessionToken: result.sessionToken,
+			csrfToken: result.csrfToken,
+			sessionExpiresAt: result.sessionExpiresAt
+		}, this.tlsEnabled);
+	}
 	async handleLogout(request, response) {
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		const authorization = this.authorize(request);
@@ -1494,6 +1806,28 @@ var MobileAccessGateway = class {
 			sendJson(response, 200, { ok: true }, this.tlsEnabled);
 			return;
 		}
+		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/discovery`) {
+			sendJson(response, 200, {
+				deviceName: discoveryDeviceName(),
+				origin: this.address().origin,
+				port: this.address().port,
+				protocol: DISCOVERY_PROTOCOL,
+				instanceId: this.config.instanceId
+			}, this.tlsEnabled);
+			return;
+		}
+		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/ca.cer`) {
+			if (this.pairingCaCertificate === void 0) throw new HttpError(404, "not_found");
+			const body = Buffer.from(this.pairingCaCertificate, "base64");
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(200, {
+				"Content-Type": "application/pkix-cert",
+				"Content-Length": body.length,
+				"Cache-Control": "no-store"
+			});
+			response.end(body);
+			return;
+		}
 		if (target.search === "" && request.method === "GET" && (target.decodedPathname === `/mobile-access/pair` || target.decodedPathname === `/mobile-access/pair.js`)) {
 			if (!this.access.pairingStatus().open) throw new HttpError(404, "not_found");
 			setSecurityHeaders(response, this.tlsEnabled);
@@ -1524,10 +1858,20 @@ var MobileAccessGateway = class {
 			await this.handleRenew(request, response);
 			return;
 		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/native-pair`) {
+			await this.handleNativePair(request, response);
+			return;
+		}
+		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/native-renew`) {
+			await this.handleNativeRenew(request, response);
+			return;
+		}
 		if (target.search === "" && request.method === "POST" && target.decodedPathname === `/mobile-access/auth/logout`) {
 			await this.handleLogout(request, response);
 			return;
 		}
+		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
+		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
 		const customAsset = request.method === "GET" ? target.decodedPathname === `/mobile-access/custom.css` ? {
 			file: this.config.customCssFile,
 			contentType: "text/css; charset=utf-8",
@@ -1536,8 +1880,12 @@ var MobileAccessGateway = class {
 			file: this.config.customScriptFile,
 			contentType: "text/javascript; charset=utf-8",
 			fallback: "window.dshMobile?.register(() => undefined)\n"
+		} : target.decodedPathname === MOBILE_LAYOUT_PATH ? {
+			file: this.config.mobileLayoutFile,
+			contentType: "text/javascript; charset=utf-8",
+			fallback: void 0
 		} : void 0 : void 0;
-		if (customAsset === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (customAsset === void 0 && !computerImages && !computerImage && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 		if (request.method === "POST" && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/")) throw new HttpError(405, "method_not_allowed");
 		let authorization;
@@ -1565,6 +1913,7 @@ var MobileAccessGateway = class {
 				body = await readFile(customAsset.file);
 			} catch (error) {
 				if (error.code !== "ENOENT") throw error;
+				if (customAsset.fallback === void 0) throw new HttpError(503, "mobile_frontend_unavailable");
 				body = Buffer.from(customAsset.fallback);
 			}
 			if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
@@ -1577,8 +1926,91 @@ var MobileAccessGateway = class {
 			response.end(body);
 			return;
 		}
+		if (computerImages) {
+			const query = new URL(target.raw, this.address().origin).searchParams;
+			sendJson(response, 200, await listComputerImages(query.get("path")), this.tlsEnabled);
+			return;
+		}
+		if (computerImage) {
+			const query = new URL(target.raw, this.address().origin).searchParams;
+			const image = await readComputerImage(query.get("path"));
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(200, {
+				"Content-Type": image.contentType,
+				"Content-Length": image.body.byteLength,
+				"Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(image.name)}`
+			});
+			response.end(image.body);
+			return;
+		}
+		const stockFrontend = new URL(target.raw, this.address().origin).searchParams.get("frontend") === "stock";
+		const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
+		if (request.method === "GET" && target.decodedPathname === "/" && acceptsHtml && !stockFrontend) {
+			await this.proxyMobileIndex(request, response, authorization);
+			return;
+		}
+		if (stockFrontend && target.decodedPathname === "/") request.url = "/";
 		await this.proxyHttp(request, response, authorization);
 	}
+	async proxyMobileIndex(request$1, response, authorization) {
+		const holder = {};
+		const operation = this.allocateRequest(authorization, response, holder);
+		try {
+			const upstreamHeaders = sanitizeRequestHeaders(request$1, this.config.upstreamOrigin);
+			upstreamHeaders["accept-encoding"] = "identity";
+			const proxied = await new Promise((resolve, reject) => {
+				const upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: "/",
+					headers: upstreamHeaders,
+					agent: false
+				});
+				holder.request = upstreamRequest;
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if ((proxied.statusCode ?? 502) !== 200) throw new HttpError(502, "upstream_unavailable");
+			const chunks = [];
+			let bytes = 0;
+			for await (const chunk of proxied) {
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				bytes += buffer.byteLength;
+				if (bytes > 4194304) throw new HttpError(502, "upstream_unavailable");
+				chunks.push(buffer);
+			}
+			let body;
+			try {
+				body = Buffer.from(rewriteMobileIndex(Buffer.concat(chunks).toString("utf8")));
+			} catch {
+				throw new HttpError(502, "upstream_unavailable");
+			}
+			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			delete headers["content-length"];
+			delete headers["content-encoding"];
+			delete headers.etag;
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(200, {
+				...headers,
+				"Content-Type": "text/html; charset=utf-8",
+				"Content-Length": body.byteLength
+			});
+			response.end(body);
+		} catch (error) {
+			holder.request?.destroy();
+			if (error instanceof HttpError) throw error;
+			if (response.headersSent) response.destroy();
+			else throw new HttpError(502, "upstream_unavailable");
+		} finally {
+			operation.release();
+		}
+	}
 	allocateRequest(authorization, response, upstream) {
 		if (this.activeRequests.size >= this.config.maxActiveRequests) throw new HttpError(429, "busy");
 		const id = this.nextOperationId++;
@@ -1602,8 +2034,8 @@ var MobileAccessGateway = class {
 			}
 		};
 	}
-	async proxyHttp(request$1, response, authorization) {
-		const declared = request$1.headers["content-length"];
+	async proxyHttp(request$2, response, authorization) {
+		const declared = request$2.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
@@ -1614,9 +2046,9 @@ var MobileAccessGateway = class {
 					protocol: "http:",
 					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 					port: Number(this.config.upstreamOrigin.port),
-					method: request$1.method,
-					path: request$1.url,
-					headers: sanitizeRequestHeaders(request$1, this.config.upstreamOrigin),
+					method: request$2.method,
+					path: request$2.url,
+					headers: sanitizeRequestHeaders(request$2, this.config.upstreamOrigin),
 					agent: false
 				});
 				holder.request = upstreamRequest;
@@ -1625,7 +2057,7 @@ var MobileAccessGateway = class {
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
-				bodyDone = pipeline(request$1, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+				bodyDone = pipeline(request$2, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
 				bodyDone.catch(reject);
 			});
 			setSecurityHeaders(response, this.tlsEnabled);
@@ -1720,7 +2152,9 @@ var MobileAccessGateway = class {
 	}
 	async handleUpgrade(request, client, head) {
 		const target = parseRequestTarget(request.url);
-		assertExternalTrust(request, this.requirePolicy(), true);
+		const policy = this.requirePolicy();
+		assertExternalTrust(request, policy, false);
+		if (!policy.acceptsOrigin(request.headers.origin)) throw new HttpError(403, "forbidden");
 		if (target.search !== "" || !WS_PATHS.has(target.decodedPathname)) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" || headerValue(request.headers, "upgrade")?.toLowerCase() !== "websocket" || !hasToken(headerValue(request.headers, "connection"), "upgrade")) throw new HttpError(400, "bad_request");
 		const key = headerValue(request.headers, "sec-websocket-key");
@@ -1835,6 +2269,7 @@ var MobileAccessGateway = class {
 						const opened = await this.access.openPairing(body.ttlMs);
 						sendJson(response, 201, {
 							...opened,
+							appKey: `dsh1.${this.config.instanceId}.${opened.token}`,
 							pairUrl: `${this.address().origin}/mobile-access/pair#token=${opened.token}`
 						}, false);
 						return;
@@ -1877,6 +2312,14 @@ var MobileAccessGateway = class {
 			websocket.upstream.destroy();
 		}
 		for (const socket of this.connectedSockets) socket.destroy();
+		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
+		this.discoveryTimer = void 0;
+		await this.closeBonjour();
+		const discoverySocket = this.discoverySocket;
+		this.discoverySocket = void 0;
+		if (discoverySocket !== void 0) await new Promise((resolve) => {
+			discoverySocket.close(() => resolve());
+		});
 		const server = this.server;
 		this.server = void 0;
 		if (server !== void 0 && server.listening) {
@@ -2015,14 +2458,225 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 };
+promisify(execFile);
+const VIRTUAL_INTERFACE_MARKERS = [
+	"bridge",
+	"docker",
+	"hyper-v",
+	"mihomo",
+	"radmin",
+	"tailscale",
+	"tap",
+	"tun",
+	"utun",
+	"vbox",
+	"veth",
+	"virtual",
+	"vmware",
+	"vpn",
+	"vethernet",
+	"wsl",
+	"zerotier"
+];
+function requiredString(value, name) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
+	return value;
+}
+/** Validate the durable managed setup before it controls network and filesystem operations. */
+function parseManagedSetup(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
+	const record = value;
+	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
+		"version",
+		"networkInterface",
+		"listenPort",
+		"upstreamOrigin",
+		"tls"
+	].includes(key))) throw new Error("mobile setup file has an unsupported format");
+	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
+	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
+	const tls = record.tls;
+	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
+		"mode",
+		"caCertFile",
+		"caKeyFile",
+		"certFile",
+		"keyFile"
+	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
+	return Object.freeze({
+		version: 2,
+		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
+		listenPort: record.listenPort,
+		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		tls: Object.freeze({
+			mode: "managed",
+			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
+			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
+			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
+			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
+		})
+	});
+}
+function privateIpv4(value) {
+	const parts = value.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+}
+function networkCidr(address, cidr) {
+	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
+	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
+	return `${[
+		24,
+		16,
+		8,
+		0
+	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
+}
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
+		address: entry.address,
+		cidr: networkCidr(entry.address, entry.cidr)
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+function likelyVirtualInterface(name) {
+	const normalized = name.toLowerCase().replaceAll(/[^a-z0-9]+/gu, " ");
+	return VIRTUAL_INTERFACE_MARKERS.some((marker) => normalized.includes(marker.replaceAll("-", " "))) || /^(?:br|wg)\d*\b/u.test(normalized);
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table, preferredInterfaces = []) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	for (const name of preferredInterfaces) {
+		const matches = candidates.filter((candidate) => candidate.name === name);
+		if (matches.length === 1) return matches[0];
+	}
+	const physicalCandidates = candidates.filter((candidate) => !likelyVirtualInterface(candidate.name));
+	if (physicalCandidates.length === 1) return physicalCandidates[0];
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await chmod(temporary, 384);
+	await rename(temporary, file);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + 397);
+	const server = await generate([{
+		name: "commonName",
+		value: "DeepSeek Harness Mobile"
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames: [{
+					type: 7,
+					ip: address
+				}]
+			}
+		]
+	});
+	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
+}
+/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
+async function materializeManagedSetup(setup, table) {
+	const network = selectLanNetwork(void 0, setup.networkInterface, table);
+	await refreshManagedServerCertificate(setup, network.address);
+	const ca = new X509Certificate(await readFile(setup.tls.caCertFile, "utf8"));
+	return {
+		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
+		listenHost: network.address,
+		upstreamOrigin: setup.upstreamOrigin,
+		allowedCidrs: [network.cidr],
+		instanceId: ca.fingerprint256.replaceAll(":", "").toLowerCase(),
+		pairingCaFile: setup.tls.caCertFile,
+		tls: {
+			mode: "provided",
+			certFile: setup.tls.certFile,
+			keyFile: setup.tls.keyFile
+		}
+	};
+}
 //#endregion
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer is the only DSH Host service this plugin requires. */
 const inject = ["webServer"];
+function installedDshVersion() {
+	const manifest = createRequire(import.meta.url)("@deepseek-ai/dsh-host-webserver/package.json");
+	if (manifest === null || typeof manifest !== "object") return void 0;
+	return manifest.version;
+}
 function mapAdminError(error) {
-	return error instanceof HttpError ? error : new HttpError(500, "internal_error");
+	if (error instanceof HttpError) return error;
+	const code = error.code;
+	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
+	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
+	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
+	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"version",
@@ -2032,16 +2686,29 @@ const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"upstreamOrigin",
 	"publicAuthorities",
 	"allowedCidrs",
+	"instanceId",
+	"pairingCaFile",
 	"tls"
 ]);
+function withoutSetupKeys(config) {
+	const merged = { ...config };
+	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
+	return merged;
+}
 async function loadSetup(config) {
-	if (config.setupFile === void 0) return config;
+	if (config.setupFile === void 0) return {
+		kind: "fixed",
+		config
+	};
 	if (!isAbsolute(config.setupFile)) throw new Error("setupFile must be an absolute file path");
 	let source;
 	try {
 		source = await readFile(resolve(config.setupFile), "utf8");
 	} catch (error) {
-		if (error.code === "ENOENT") return config;
+		if (error.code === "ENOENT") return {
+			kind: "fixed",
+			config
+		};
 		throw error;
 	}
 	let parsed;
@@ -2052,20 +2719,28 @@ async function loadSetup(config) {
 	}
 	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("mobile setup file must be an object");
 	const record = parsed;
+	if (record.version === 2) return {
+		kind: "managed",
+		config: withoutSetupKeys(config),
+		setup: parseManagedSetup(record)
+	};
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
-	const merged = { ...config };
-	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
 	return {
-		...merged,
-		...setup
+		kind: "fixed",
+		config: {
+			...withoutSetupKeys(config),
+			...setup
+		}
 	};
 }
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 async function apply(ctx, config) {
-	const resolved = parseGatewayConfig(await loadSetup(config));
+	assertSupportedDshVersion(installedDshVersion());
+	const loaded = await loadSetup(config);
 	let gateway;
-	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), async () => {
+	const startGateway = async (candidateConfig) => {
+		const resolved = parseGatewayConfig(candidateConfig);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices));
 		await candidate.start();
 		gateway = candidate;
@@ -2073,7 +2748,25 @@ async function apply(ctx, config) {
 			if (gateway === candidate) gateway = void 0;
 			await candidate.close();
 		} };
-	});
+	};
+	const startRuntime = async () => {
+		if (loaded.kind === "fixed") return startGateway(loaded.config);
+		const following = new FollowingMobileAccessRuntime(async () => {
+			const network = selectLanNetwork(void 0, loaded.setup.networkInterface);
+			return {
+				key: `${network.name}\0${network.address}\0${network.cidr}`,
+				start: async () => startGateway({
+					...loaded.config,
+					...await materializeManagedSetup(loaded.setup)
+				})
+			};
+		}, (error) => {
+			process.emitWarning(`DSH Mobile could not follow the current LAN address: ${error instanceof Error ? error.message : String(error)}`, { code: "DSH_MOBILE_NETWORK_REFRESH" });
+		});
+		await following.initialize(2e3);
+		return following;
+	};
+	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
 	const adminRoute = {
 		kind: "prefix",
 		path: LOCAL_ADMIN_PREFIX,
@@ -2124,6 +2817,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: local control and authenticated LAN gateway");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, addressAllowed, apply, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority };
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertSupportedDshVersion, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority, rewriteMobileIndex };
 
 //# sourceMappingURL=index.mjs.map