dsh-mobile-pairing

If you run DSH on a daily :3080 or lab :3082 web profile, pairing a phone has always been the hardest part: there is no off-the-shelf secure channel and no unified device-management surface. dsh-mobile-pairing plugs in as a Host plugin and gives every DSH process its own complete mobile-pairing stack, with no TURN server, no runtime CDN, and no maintainer-domain dependency.

The data path stays bounded by design. A Host Gateway binds to loopback only and serves as the signaling and encrypted-tunnel entry point. Pairing offers are five-minute, single-use codes delivered via an Android deep-link QR code. On connect the Automatic strategy opens an encrypted tunnel first; a same-network WebRTC direct path can win only inside a short grace window and can never hijack an already-open tunnel. The Device Token issued at first pairing remains valid until the Host explicitly revokes it. Tunnel fallback routes through your own public endpoint or an explicit official or self-hosted encrypted relay that forwards only ciphertext, with transparent frame fragmenting and reassembly for oversized sealed frames.

Built for developers and operators who have at least one DSH Host reachable from the public internet and use an Android device on the mobile side. The one-Host-one-Gateway model keeps the mental model simple, and a handful of YAML lines is all it takes to go live in either a lab or a production daily profile.