dsh-relay-phone 0.12.1 → 0.12.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/src/pump.js +9 -2
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-relay-phone",
3
- "version": "0.12.1",
3
+ "version": "0.12.2",
4
4
  "description": "Remote-control your local DeepSeek Harness from a phone through your own zero-knowledge relay: phone-first page, QR pairing, end-to-end encryption, approvals, full desktop UI fallback.",
5
5
  "type": "module",
6
6
  "main": "src/index.js",
package/src/pump.js CHANGED
@@ -451,10 +451,17 @@ export class PumpManager {
451
451
 
452
452
  /**
453
453
  * True for the GET/HEAD document + asset traffic a phone browser issues by
454
- * itself. Explicitly excludes `/api/`, the mobile RPC path and upgrades.
454
+ * itself, and for WebSocket handshakes.
455
+ *
456
+ * A WebSocket handshake is an HTTP GET with an Upgrade header: there is no
457
+ * body, so an envelope cannot ride along. Sealing happens per frame instead,
458
+ * and `pumpPhoneWs` refuses any data frame that does not open — which is why
459
+ * the handshake may pass while the payload stays mandatory-sealed. (DSH's own
460
+ * event mux, `/api/remote.mux`, is such a WebSocket; blocking the handshake
461
+ * broke the desktop UI with "Reconnecting".)
455
462
  */
456
463
  isPlaintextDocument(info, isUpgrade) {
457
- if (isUpgrade) return false
464
+ if (isUpgrade) return info.method === 'GET'
458
465
  if (info.method !== 'GET' && info.method !== 'HEAD') return false
459
466
  if (info.path.startsWith('/api/')) return false
460
467
  return PLAINTEXT_DOCUMENT.test(info.path)