kk99668/dsh-mobile-access

Install

The tunnel is an `ssh -N -R` child owned by the plugin: it reconnects with exponential backoff, resets the backoff after a stable uptime, and dies with its fiber. The gate is the authentication layer the fence deliberately is not: every request and WebSocket upgrade must present the token (a cookie set by the login form, or Basic/Bearer credentials) before it is forwarded to the webserver. The public authority reaches the fence through the `mobileAccess` service, which the patch injects into the `connection` row so the fence's config expression can never resolve before the authority exists.

## Weak-network behavior

The phone link is the constrained hop (a subway commute, for example); the tunnel and the relay sit on the two stable ends. Three mechanisms keep the GUI usable when that link degrades:

- **The event streams compress when the host supports it.** The WebSocket downlinks negotiate `permessage-deflate` (shipped in dsh `web` builds), so the session event stream (repetitive JSON) shrinks several-fold on the phone's link. The browser negotiates the extension automatically.
- **The browser reconnects.** The web client's connection controller re-establishes both event streams with exponential backoff (500 ms doubling to a 10 s cap) whenever the signal drops, so a tunnel outage or a dead zone recovers without a page reload.
- **The tunnel heals itself.** `keepAliveIntervalSec` / `keepAliveCountMax` make ssh notice a dead relay fast (default 30 s × 3 probes), and the supervisor restarts the child with jittered backoff (`backoffBaseMs`..`backoffMaxMs`). On a flaky home uplink, lowering `keepAliveIntervalSec` to 10 and `backoffBaseMs` to 1000 shortens the blackout window at the cost of a few extra probe packets.

## Install

The bundle is opt-in, on top of the shipped `web` profile. Install from this repository (a `prepare` script builds the plugin from source; pnpm ≥10 asks you to allow the build the first time — copy the package key pnpm prints into the profile's `pnpm-workspace.yaml` under `allowBuilds` and re-run), or from npm when published:

Add kk99668/dsh-mobile-access to your DSH config (web profile) to enable.