dsh-relay-phone 0.11.2 → 0.11.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-relay-phone",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -165,6 +165,23 @@ export default class RelayBridgeService extends Service {
     }
   }
 
+  /**
+   * The root token DSH 0.2 wants on the index exchange. A browser that opens the
+   * desktop UI locally already has it in its URL; one arriving through the relay
+   * does not, which is why that shell used to come back unauthenticated.
+   */
+  upstreamIndexToken() {
+    const connection = this.ctx.get('connection')
+    if (!connection || typeof connection.authenticatedUrl !== 'function') return null
+    try {
+      const target = this.upstreamTarget()
+      const url = new URL(connection.authenticatedUrl(`${target.protocol}//${target.authority}/`))
+      return url.searchParams.get('token')
+    } catch {
+      return null
+    }
+  }
+
   mergeConfig(base, stored) {
     return {
       relayScheme: stored.relayScheme ?? base.relayScheme ?? 'http',
@@ -219,6 +236,7 @@ export default class RelayBridgeService extends Service {
       dshPort: this.config.dshPort,
       resolveTarget: () => this.upstreamTarget(),
       resolveAuthCookie: () => this.upstreamAuthCookie(),
+      resolveIndexToken: () => this.upstreamIndexToken(),
       pairing: this.pairing,
       cryptoBox: this.cryptoBox,
       mobile: this.mobile,

package/src/pump.js

@@ -59,6 +59,8 @@ export class PumpManager {
       protocol: 'http:',
     }))
     this.resolveAuthCookie = options.resolveAuthCookie ?? (() => null)
+    // Root token for DSH 0.2's index exchange; null on older hosts.
+    this.resolveIndexToken = options.resolveIndexToken ?? (() => null)
     this.pairing = options.pairing // PairingService
     this.cryptoBox = options.cryptoBox
     this.client = options.client
@@ -641,7 +643,21 @@ export class PumpManager {
     // Any inbound copy was dropped in the loop above, so a client cannot forge it.
     rewritten.push('x-dsh-relay: 1')
     if (authCookie) rewritten.push(`Cookie: ${authCookie}`)
-    const out = `${lines[0]}\r\n${rewritten.join('\r\n')}\r\n\r\n`
+
+    // DSH 0.2 guards the index exchange with a root token, and the pump already
+    // uses that token to mint the API cookie. A browser arriving through the
+    // relay has no token of its own, so the desktop shell it received came back
+    // unauthenticated even though every later API call would have worked.
+    let requestLine = lines[0]
+    if (stream.relay && isDocument && !isUpgrade && info.path === '/') {
+      const token = this.resolveIndexToken()
+      if (token) {
+        const query = new URLSearchParams(info.query)
+        query.set('token', token)
+        requestLine = `${info.method} /?${query.toString()} ${info.version}`
+      }
+    }
+    const out = `${requestLine}\r\n${rewritten.join('\r\n')}\r\n\r\n`
 
     if (isUpgrade) {
       const upstream = net.connect({ host: target.host, port: target.port })