dsh-plugin-mobile-gateway 0.1.17 → 0.4.0

package/lib/{index.js → index.mjs}

@@ -10,6 +10,11 @@
 //     so it enters the target session exactly like a browser-submitted prompt.
 //
 // Wire protocol (JSON text frames):
+//   first pair:       Sec-WebSocket-Protocol: dsh-mobile-v1, dsh-pair.<one-time-code>
+//                     X-DSH-Device-ID: <stable installation UUID>
+//                     -> { "kind": "paired", "token", "device" } (exactly once)
+//   later connects:   Authorization: Bearer <device-token>
+//                     or Sec-WebSocket-Protocol: dsh-mobile-v1, dsh-auth.<device-token>
 //   client -> server: { "type": "ping" }
 //                     { "type": "subscribe", "sessionId": "..." }  (optional filter)
 //                     { "type": "unsubscribe" }
@@ -43,24 +48,47 @@
 //                     { "type": "agent-presets" }                     -> preset roster (+ isDefault)
 //                     { "type": "defaults" }                          -> default agent preset + default permission
 //                     { "type": "set-default", "target": "agent-preset"|"permission", "value" }
-//   server -> client: { "kind": "hello", "protocol": 1, "port", "clients" }
+//   server -> client: { "kind": "hello", "protocol": 2, "authenticated", "device"?, "port", "clients" }
 //                     { "kind": "pong", "at" }
 //                     { "kind": "subscribed", "sessionId" }
 //                     { "kind": "sent", "sessionId", "mode", "command"? }
 //                     { "kind": "workspaces" | "sessions" | "history" | "search", ...data }
 //                     { "kind": "error", "code", "message", "requestType"?, "sessionId"? }
 //                     { "kind": "event", "sessionId", "seq", "time", "event": { ... } }
-'use strict'
+import fs from 'node:fs'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import Schema from '@deepseek-ai/schemastery'
+import { WebSocketServer } from 'ws'
+import devicesModule from './devices.js'
+import QRCode from 'qrcode'
 
-const fs = require('node:fs')
-const fsp = require('node:fs/promises')
-const os = require('node:os')
-const path = require('node:path')
-const crypto = require('node:crypto')
-const { WebSocketServer } = require('ws')
+const { createRegistry } = devicesModule
 
 const MAX_PREVIEW = 400
 const LOG_FILE = '/tmp/mobile-gateway.log'
+const DEFAULT_WS_PATH = '/ws/mobile'
+const DEFAULT_PAIRING_TTL_MS = 5 * 60 * 1000
+const DEFAULT_GATEWAY_WAIT_TIMEOUT_MS = 5 * 60 * 1000
+const MAX_MANAGEMENT_BODY_BYTES = 16 * 1024
+
+// Cordis validates this schema at plugin load and fills these defaults. Keep
+// the defaults conservative: installing the bundle must never create an
+// unauthenticated network control plane.
+const Config = Schema.object({
+  path: Schema.string().default(DEFAULT_WS_PATH),
+  requireAuth: Schema.boolean().default(true),
+  gatewayEnabled: Schema.boolean().default(false),
+  gatewayWaitTimeoutMs: Schema.natural().min(30_000).max(30 * 60 * 1000).default(DEFAULT_GATEWAY_WAIT_TIMEOUT_MS),
+  adminLoopbackOnly: Schema.boolean().default(true),
+  publicUrl: Schema.string().default(''),
+  deviceFile: Schema.string().default(''),
+  pairingTtlMs: Schema.natural().min(30_000).max(15 * 60 * 1000).default(DEFAULT_PAIRING_TTL_MS),
+  allowQueryToken: Schema.boolean().default(false),
+  publicUrlFile: Schema.string().default('/etc/dsh-mobile-gateway/public-url'),
+})
 
 function log(line) {
   const msg = `[${new Date().toISOString()}] ${line}`
@@ -590,8 +618,140 @@ async function handleQuery(api, typertGateway, agentDefaultModel, msg) {
   return null
 }
 
-module.exports = {
+// ---------------------------------------------------------------------------
+// Device auth: a QR carries a short-lived one-time pairing code. Claiming it
+// over WebSocket yields a long-lived bearer token exactly once. The registry
+// stores only the token digest. Management endpoints are local-machine only by
+// default and mutating requests also require a same-origin browser context.
+// ---------------------------------------------------------------------------
+function isLoopback(req) {
+  const addr = req.socket && req.socket.remoteAddress
+  return addr === '127.0.0.1' || addr === '::1' || addr === '::ffff:127.0.0.1'
+}
+
+function parseProtocols(req) {
+  const value = req.headers['sec-websocket-protocol']
+  if (typeof value !== 'string') return []
+  return value.split(',').map((entry) => entry.trim()).filter(Boolean)
+}
+
+function extractCredential(req, allowQueryToken) {
+  const authorization = req.headers.authorization
+  if (typeof authorization === 'string') {
+    const match = /^Bearer\s+([A-Za-z0-9_-]{43})$/i.exec(authorization.trim())
+    if (match) return { kind: 'token', value: match[1] }
+  }
+
+  for (const protocol of parseProtocols(req)) {
+    if (protocol.startsWith('dsh-auth.')) return { kind: 'token', value: protocol.slice('dsh-auth.'.length) }
+    if (protocol.startsWith('dsh-pair.')) return { kind: 'pairing', value: protocol.slice('dsh-pair.'.length) }
+  }
+
+  try {
+    const query = new URL(req.url || '/', 'http://localhost').searchParams
+    const pairing = query.get('pairingCode')
+    if (pairing) return { kind: 'pairing', value: pairing }
+    const token = allowQueryToken && query.get('token')
+    if (token) return { kind: 'token', value: token }
+  } catch (error) { /* ignore */ }
+  return undefined
+}
+
+function extractClientDeviceId(req) {
+  const value = req.headers['x-dsh-device-id']
+  if (typeof value !== 'string') return undefined
+  const normalized = value.trim()
+  return /^[A-Za-z0-9._:-]{8,128}$/.test(normalized) ? normalized : undefined
+}
+
+function rejectUpgrade(socket, status, message) {
+  const reason = status === 401 ? 'Unauthorized' : status === 503 ? 'Service Unavailable' : 'Bad Request'
+  socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: ${Buffer.byteLength(message)}\r\n\r\n${message}`)
+  socket.destroy()
+}
+
+function isLocalHostname(hostname) {
+  const normalized = hostname.replace(/^\[|\]$/g, '').toLowerCase()
+  return normalized === 'localhost' || normalized === '::1' || /^127(?:\.\d{1,3}){3}$/.test(normalized)
+}
+
+function badRequest(message) {
+  const error = new Error(message)
+  error.status = 400
+  return error
+}
+
+function normalizePublicUrl(value, req, wsPath) {
+  let raw = typeof value === 'string' ? value.trim() : ''
+  if (!raw) {
+    const host = req.headers.host || `127.0.0.1`
+    raw = `${req.socket && req.socket.encrypted ? 'wss' : 'ws'}://${host}${wsPath}`
+  }
+  const url = new URL(raw)
+  if (url.protocol === 'https:') url.protocol = 'wss:'
+  if (url.protocol === 'http:') url.protocol = 'ws:'
+  if (url.protocol !== 'ws:' && url.protocol !== 'wss:') throw badRequest('publicUrl must use wss:// (ws:// is allowed only for localhost)')
+  if (url.username || url.password || url.search || url.hash) throw badRequest('publicUrl must not contain credentials, query parameters, or a fragment')
+  if (url.protocol === 'ws:' && !isLocalHostname(url.hostname)) throw badRequest('publicUrl must use wss:// for non-localhost endpoints')
+  return url.toString()
+}
+
+function isSameOrigin(req) {
+  const origin = req.headers.origin
+  if (origin === undefined) return true
+  if (typeof origin !== 'string' || typeof req.headers.host !== 'string') return false
+  try {
+    return new URL(origin).host === req.headers.host
+  } catch (error) {
+    return false
+  }
+}
+
+function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = ''
+    let bytes = 0
+    let oversized = false
+    req.on('data', (chunk) => {
+      bytes += chunk.length
+      if (bytes > MAX_MANAGEMENT_BODY_BYTES) oversized = true
+      else data += chunk
+    })
+    req.on('end', () => {
+      if (oversized) {
+        const error = new Error('request body is too large')
+        error.status = 413
+        reject(error)
+        return
+      }
+      try { resolve(data === '' ? {} : JSON.parse(data)) } catch (cause) {
+        const error = new Error('request body must be valid JSON', { cause })
+        error.status = 400
+        reject(error)
+      }
+    })
+    req.on('error', reject)
+  })
+}
+
+function securityHeaders(contentType) {
+  return {
+    'Content-Type': contentType,
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+    'Referrer-Policy': 'no-referrer',
+  }
+}
+
+function sendJson(res, status, value) {
+  const body = JSON.stringify(value)
+  res.writeHead(status, { ...securityHeaders('application/json; charset=utf-8'), 'Content-Length': Buffer.byteLength(body) })
+  res.end(body)
+}
+
+const plugin = {
   name: 'mobile-gateway',
+  Config,
   // Hard dependencies: the gateway registers on the host web server and
   // admits mobile messages through the host API gateway. Cordis must not
   // activate this row before either service exists.
@@ -604,20 +764,249 @@ module.exports = {
     const api = ctx.apiProxy
     const typertGateway = ctx.typertGateway
     const agentDefaultModel = ctx.agentDefaultModel
-    const path = (config && config.path) || '/ws/mobile'
-    const wss = new WebSocketServer({ noServer: true })
+    const options = {
+      path: DEFAULT_WS_PATH,
+      requireAuth: true,
+      gatewayEnabled: false,
+      gatewayWaitTimeoutMs: DEFAULT_GATEWAY_WAIT_TIMEOUT_MS,
+      adminLoopbackOnly: true,
+      publicUrl: '',
+      deviceFile: '',
+      pairingTtlMs: DEFAULT_PAIRING_TTL_MS,
+      allowQueryToken: false,
+      publicUrlFile: '/etc/dsh-mobile-gateway/public-url',
+      ...(config || {}),
+    }
+    const wsPath = options.path
+    if (typeof wsPath !== 'string' || !wsPath.startsWith('/') || wsPath.endsWith('/') || wsPath.includes('?') || wsPath.includes('#')) {
+      throw new Error('mobile-gateway: path must be an absolute pathname without a trailing slash, query, or fragment')
+    }
+    let requireAuth = options.requireAuth !== false
+    const adminLoopbackOnly = options.adminLoopbackOnly !== false
+    const deviceFile = options.deviceFile || path.join(os.homedir(), '.dsh', 'mobile-gateway-devices.json')
+    const registry = createRegistry(deviceFile, { pairingTtlMs: options.pairingTtlMs })
+    const wss = new WebSocketServer({
+      noServer: true,
+      maxPayload: 1024 * 1024,
+      // Authentication data may ride in requested subprotocols, but a secret
+      // must never be echoed as the negotiated protocol.
+      handleProtocols(protocols) {
+        return protocols.has('dsh-mobile-v1') ? 'dsh-mobile-v1' : false
+      },
+    })
     const clients = new Set()
     let counter = 0
+    let gatewayEnabled = options.gatewayEnabled === true
+    let waitExpiresAt = null
+    let waitTimer = null
+    let connectedSinceEnabled = false
+    let lastAuthRejectLogAt = 0
+    let suppressedAuthRejects = 0
+    const configuredPublicUrl = () => {
+      if (typeof options.publicUrl === 'string' && options.publicUrl.trim()) return options.publicUrl.trim()
+      if (typeof options.publicUrlFile !== 'string' || !options.publicUrlFile.trim()) return ''
+      try {
+        return fs.readFileSync(options.publicUrlFile, 'utf8')
+          .split(/\r?\n/)
+          .map((line) => line.trim())
+          .find((line) => line && !line.startsWith('#')) || ''
+      } catch (error) {
+        if (!error || error.code !== 'ENOENT') log(`unable to read publicUrlFile: ${error && error.message ? error.message : String(error)}`)
+        return ''
+      }
+    }
+
+    const setGatewayEnabled = (enabled, reason) => {
+      if (waitTimer) clearTimeout(waitTimer)
+      waitTimer = null
+      gatewayEnabled = enabled
+      waitExpiresAt = null
+      connectedSinceEnabled = false
+      if (enabled) {
+        waitExpiresAt = Date.now() + options.gatewayWaitTimeoutMs
+        waitTimer = setTimeout(() => {
+          waitTimer = null
+          if (!gatewayEnabled || connectedSinceEnabled || clients.size > 0) return
+          gatewayEnabled = false
+          waitExpiresAt = null
+          log('mobile gateway automatically disabled: no device connected before timeout')
+        }, options.gatewayWaitTimeoutMs)
+      } else {
+        for (const client of clients) client.close(4004, 'mobile gateway disabled')
+      }
+      log(`mobile gateway ${enabled ? 'enabled' : 'disabled'}${reason ? `: ${reason}` : ''}`)
+    }
+
+    const logAuthRejected = (req) => {
+      const now = Date.now()
+      if (now - lastAuthRejectLogAt >= 30_000) {
+        const suffix = suppressedAuthRejects ? ` (${suppressedAuthRejects} repeated attempts suppressed)` : ''
+        const remote = (req.socket && req.socket.remoteAddress) || 'unknown'
+        const origin = typeof req.headers.origin === 'string' ? req.headers.origin.slice(0, 160) : '-'
+        const userAgent = typeof req.headers['user-agent'] === 'string' ? req.headers['user-agent'].slice(0, 160) : '-'
+        log(`auth rejected: missing or invalid device credential; remote=${remote}; origin=${origin}; user-agent=${userAgent}${suffix}`)
+        lastAuthRejectLogAt = now
+        suppressedAuthRejects = 0
+      } else {
+        suppressedAuthRejects += 1
+      }
+    }
+
+    if (gatewayEnabled) setGatewayEnabled(true, 'enabled by startup config')
 
-    log(`applying: path=${path}, webServer.port=${webServer.port}, apiProxy=${api ? 'present' : 'absent'}`)
+    log(`applying: path=${wsPath}, webServer.port=${webServer.port}, gatewayEnabled=${gatewayEnabled}, requireAuth=${requireAuth}, devices=${registry.count()}`)
+
+    // ---- device management routes (loopback-gated admin surface) ----
+    const disposeMgmt = webServer.register({
+      kind: 'prefix',
+      path: '/mgw',
+      handler: async (req, res) => {
+        try {
+          if (adminLoopbackOnly && !isLoopback(req)) {
+            sendJson(res, 403, { error: 'forbidden', message: 'management API is loopback-only' })
+            return
+          }
+          if (req.method !== 'GET' && req.method !== 'HEAD' && !isSameOrigin(req)) {
+            sendJson(res, 403, { error: 'forbidden', message: 'cross-origin management request rejected' })
+            return
+          }
+          const url = new URL(req.url || '/', 'http://x')
+          const p = url.pathname
+          if (req.method === 'GET' && p === '/mgw/status') {
+            sendJson(res, 200, {
+              requireAuth,
+              gatewayEnabled,
+              waitExpiresAt,
+              connectedClients: clients.size,
+              wsPath,
+              publicUrl: configuredPublicUrl() || null,
+              pairingTtlMs: options.pairingTtlMs,
+              queryTokenAllowed: !!options.allowQueryToken,
+            })
+          } else if (req.method === 'POST' && p === '/mgw/gateway') {
+            const body = await readBody(req)
+            if (typeof body.enabled !== 'boolean') throw badRequest('enabled must be a boolean')
+            setGatewayEnabled(body.enabled, 'changed from management UI')
+            sendJson(res, 200, { gatewayEnabled, waitExpiresAt, connectedClients: clients.size })
+          } else if (req.method === 'POST' && p === '/mgw/auth') {
+            const body = await readBody(req)
+            if (typeof body.enabled !== 'boolean') throw badRequest('enabled must be a boolean')
+            requireAuth = body.enabled
+            let disconnected = 0
+            if (requireAuth) {
+              for (const client of clients) {
+                if (!client.deviceId) {
+                  disconnected += 1
+                  client.close(4003, 'authentication enabled')
+                }
+              }
+            }
+            log(`device authentication ${requireAuth ? 'enabled' : 'disabled'} from management UI`)
+            sendJson(res, 200, { requireAuth, disconnected })
+          } else if (req.method === 'GET' && p === '/mgw/devices') {
+            sendJson(res, 200, { devices: registry.list() })
+          } else if (req.method === 'POST' && p === '/mgw/pair') {
+            if (!gatewayEnabled) {
+              const error = new Error('enable the mobile gateway before creating a pairing code')
+              error.status = 409
+              throw error
+            }
+            const body = await readBody(req)
+            const name = typeof body.name === 'string' ? body.name : undefined
+            const publicUrl = normalizePublicUrl(body.publicUrl || configuredPublicUrl(), req, wsPath)
+            const pairing = registry.createPairing(name)
+            const payload = {
+              version: 2,
+              publicUrl,
+              pairingCode: pairing.code,
+              expiresAt: pairing.expiresAt,
+            }
+            // QR/manual pairing has one canonical wire representation: the
+            // UTF-8 JSON payload encoded as unpadded Base64URL. Base64URL is
+            // copy-safe and QR-safe (`+`, `/`, and `=` never appear), but is
+            // encoding rather than encryption; secrecy still comes from the
+            // short TTL and single-use pairing code.
+            const qrPayload = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url')
+            const svg = await QRCode.toString(qrPayload, { type: 'svg', margin: 1, errorCorrectionLevel: 'M' })
+            log(`pairing created: ${pairing.name} (${pairing.id}), expires=${new Date(pairing.expiresAt).toISOString()}`)
+            sendJson(res, 201, {
+              pairing: { id: pairing.id, name: pairing.name, expiresAt: pairing.expiresAt },
+              payload,
+              qrPayload,
+              svg,
+            })
+          } else if (req.method === 'POST' && p.startsWith('/mgw/devices/') && p.endsWith('/revoke')) {
+            const id = decodeURIComponent(p.slice('/mgw/devices/'.length, -'/revoke'.length))
+            const revoked = registry.revoke(id)
+            if (revoked) {
+              for (const client of clients) {
+                if (client.deviceId === id) client.close(4003, 'device revoked')
+              }
+              log(`device revoked: ${id}`)
+            }
+            sendJson(res, revoked ? 200 : 404, { revoked })
+          } else if (req.method === 'GET' && p === '/mgw') {
+            res.writeHead(302, { ...securityHeaders('text/plain; charset=utf-8'), Location: '/' })
+            res.end('Open the device manager from the DSH sidebar.')
+          } else {
+            sendJson(res, 404, { error: 'not-found' })
+          }
+        } catch (error) {
+          log(`mgmt route failed: ${error && error.message ? error.message : String(error)}`)
+          const status = Number.isInteger(error && error.status) ? error.status : (error instanceof TypeError ? 400 : 500)
+          sendJson(res, status, { error: status < 500 ? 'bad-request' : 'internal', message: error && error.message ? error.message : String(error) })
+        }
+      },
+    })
+    log(`management routes registered: /mgw (loopbackOnly=${adminLoopbackOnly})`)
 
     const disposeUpgrade = webServer.registerUpgrade({
-      path,
+      path: wsPath,
       handler(req, socket, head) {
+        if (!gatewayEnabled) {
+          rejectUpgrade(socket, 503, 'mobile gateway is disabled')
+          return
+        }
+        let device
+        let paired
+        const credential = extractCredential(req, !!options.allowQueryToken)
+        if (credential && credential.kind === 'pairing') {
+          const clientDeviceId = extractClientDeviceId(req)
+          if (!clientDeviceId) {
+            log('pairing rejected: missing X-DSH-Device-ID (outdated client)')
+            rejectUpgrade(socket, 400, 'pairing requires X-DSH-Device-ID; update the iOS client')
+            return
+          }
+          paired = registry.claimPairing(credential.value, clientDeviceId)
+          device = paired && paired.device
+          if (!device) {
+            log('pairing rejected: invalid, expired, or already-used code')
+            rejectUpgrade(socket, 401, 'invalid or expired pairing code')
+            return
+          }
+        } else if (credential && credential.kind === 'token') {
+          device = registry.authenticate(credential.value, extractClientDeviceId(req))
+        }
+
+        if (requireAuth && !device) {
+          logAuthRejected(req)
+          rejectUpgrade(socket, 401, 'missing or invalid device credential')
+          return
+        }
+
         wss.handleUpgrade(req, socket, head, (ws) => {
           const id = ++counter
           ws.filterSessionId = undefined
+          ws.deviceId = device && device.id
           clients.add(ws)
+          if (device) registry.connected(device.id)
+          if (!connectedSinceEnabled) {
+            connectedSinceEnabled = true
+            waitExpiresAt = null
+            if (waitTimer) clearTimeout(waitTimer)
+            waitTimer = null
+            log('mobile gateway wait completed: device connected')
+          }
 
           ws.on('message', (data) => {
             let msg
@@ -639,7 +1028,7 @@ module.exports = {
               ws.send(JSON.stringify({ kind: 'subscribed', sessionId: null }))
             } else if (msg.type === 'message') {
               admitMessage(api, msg).then((frame) => {
-                if (frame) ws.send(JSON.stringify(frame))
+                if (frame && ws.readyState === 1) ws.send(JSON.stringify(frame))
               })
             } else if (msg.type === 'workspaces' || msg.type === 'sessions' || msg.type === 'history' ||
                        msg.type === 'search' || msg.type === 'host' || msg.type === 'directories' ||
@@ -649,7 +1038,7 @@ module.exports = {
                        msg.type === 'session-stats' || msg.type === 'default-model' ||
                        msg.type === 'save-default-model' || msg.type === 'fork' || msg.type === 'providers') {
               handleQuery(api, typertGateway, agentDefaultModel, msg).then((frame) => {
-                if (frame) ws.send(JSON.stringify(frame))
+                if (frame && ws.readyState === 1) ws.send(JSON.stringify(frame))
               })
             } else {
               ws.send(JSON.stringify({ kind: 'error', message: 'unknown message type: ' + msg.type }))
@@ -658,15 +1047,30 @@ module.exports = {
 
           ws.on('close', () => {
             clients.delete(ws)
+            if (ws.deviceId) registry.disconnected(ws.deviceId)
             log(`client disconnected (id=${id}, remaining=${clients.size})`)
           })
 
-          log(`client connected (id=${id}, total=${clients.size})`)
-          ws.send(JSON.stringify({ kind: 'hello', protocol: 1, port: webServer.port, clients: clients.size }))
+          log(`client connected (id=${id}, total=${clients.size})${device ? ' device=' + device.name : ''}`)
+          if (paired) {
+            ws.send(JSON.stringify({
+              kind: 'paired',
+              token: paired.token,
+              device: paired.device,
+            }))
+          }
+          ws.send(JSON.stringify({
+            kind: 'hello',
+            protocol: 2,
+            port: webServer.port,
+            clients: clients.size,
+            authenticated: !!device,
+            ...(device ? { device: { id: device.id, name: device.name } } : {}),
+          }))
         })
       },
     })
-    log(`upgrade route registered: ${path}`)
+    log(`upgrade route registered: ${wsPath}`)
 
     const disposeEvents = ctx.on('session/event', (session, event) => {
       if (clients.size === 0) return
@@ -681,7 +1085,9 @@ module.exports = {
     log('session/event listener attached')
 
     ctx.effect(() => () => {
+      if (waitTimer) clearTimeout(waitTimer)
       disposeUpgrade()
+      disposeMgmt()
       disposeEvents()
       for (const client of clients) client.terminate()
       clients.clear()
@@ -690,3 +1096,6 @@ module.exports = {
     })
   },
 }
+
+export { Config, admitMessage, handleQuery }
+export default plugin

package/package.json

@@ -1,20 +1,49 @@
 {
   "name": "dsh-plugin-mobile-gateway",
-  "version": "0.1.17",
+  "version": "0.4.0",
   "description": "Persistent WebSocket gateway for dsh: exposes /ws/mobile on the web server and forwards agent session output to connected mobile clients",
-  "main": "lib/index.js",
+  "main": "lib/index.mjs",
   "files": [
+    "bin",
     "lib",
+    "docs",
     "cordis.patch.yml",
     "PROTOCOL.md"
   ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Clarklevis1995/dsh-plugin-mobile-gateway.git"
+  },
+  "homepage": "https://github.com/Clarklevis1995/dsh-plugin-mobile-gateway#readme",
+  "bugs": {
+    "url": "https://github.com/Clarklevis1995/dsh-plugin-mobile-gateway/issues"
+  },
   "dependencies": {
-    "ws": "^8.18.0"
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "ws": "^8.18.0",
+    "qrcode": "^1.5.4"
+  },
+  "bin": "bin/setup-ip.mjs",
+  "scripts": {
+    "test": "node test/setup-ip.test.mjs && node test/gateway.test.mjs && node test/auth.test.mjs"
+  },
+  "exports": {
+    ".": "./lib/index.mjs",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
   },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
     }
   },
   "license": "MIT"
-}
+}