@dsh-sup/dsh-core-linux-x64 0.1.6-BETA.10 → 0.1.6-BETA.12

package/core.cjs

@@ -947,7 +947,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.1.6-BETA.10");
+      if (true) return String("0.1.6-BETA.12");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -4634,6 +4634,58 @@ var require_watchdog = __commonJS({
   }
 });
 
+// src/platform/os/desktop.js
+var require_desktop = __commonJS({
+  "src/platform/os/desktop.js"(exports2, module2) {
+    "use strict";
+    var fs2 = require("node:fs");
+    var PLATFORM = process.platform;
+    function hasX11Socket() {
+      try {
+        return fs2.readdirSync("/tmp/.X11-unix").some((f) => /^X\d+$/.test(f));
+      } catch {
+        return false;
+      }
+    }
+    function hasWaylandSocket() {
+      const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+      const rt = process.env.XDG_RUNTIME_DIR || "/run/user/" + uid;
+      try {
+        return fs2.readdirSync(rt).some((f) => /^wayland-\d+$/.test(f));
+      } catch {
+        return false;
+      }
+    }
+    function sessionAvailable() {
+      if (PLATFORM === "linux") {
+        if (process.env.DISPLAY || process.env.WAYLAND_DISPLAY) return true;
+        return hasX11Socket() || hasWaylandSocket();
+      }
+      return PLATFORM === "darwin" || PLATFORM === "win32";
+    }
+    function describe() {
+      if (PLATFORM === "linux") {
+        const byEnv = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
+        const byX = hasX11Socket();
+        const byWl = hasWaylandSocket();
+        return {
+          platform: PLATFORM,
+          available: byEnv || byX || byWl,
+          reason: byEnv ? "env(DISPLAY/WAYLAND_DISPLAY)" : byX ? "x11-socket" : byWl ? "wayland-socket" : "none",
+          display: process.env.DISPLAY || null,
+          waylandDisplay: process.env.WAYLAND_DISPLAY || null
+        };
+      }
+      return {
+        platform: PLATFORM,
+        available: sessionAvailable(),
+        reason: "session-scoped-by-launcher"
+      };
+    }
+    module2.exports = { sessionAvailable, describe, PLATFORM };
+  }
+});
+
 // src/platform/os/capability-profile.js
 var require_capability_profile = __commonJS({
   "src/platform/os/capability-profile.js"(exports2, module2) {
@@ -4651,6 +4703,8 @@ var require_capability_profile = __commonJS({
       autostart: true,
       // 期望 systemctl（实测覆写）
       frpExpose: true,
+      openBrowser: true,
+      // xdg-open / 解析到的默认浏览器；无图形会话时实测覆写成 false
       hostService: "systemd",
       guardAutostart: true,
       // systemd --user enable + linger
@@ -4674,6 +4728,8 @@ var require_capability_profile = __commonJS({
       autostart: true,
       // launchctl/LaunchAgent 恒在
       frpExpose: true,
+      openBrowser: true,
+      // LaunchServices 解析 + open 直启
       hostService: "launchd",
       guardAutostart: true,
       // LaunchAgent RunAtLoad + KeepAlive
@@ -4699,6 +4755,9 @@ var require_capability_profile = __commonJS({
       autostart: true,
       // 期望 schtasks（实测覆写）
       frpExpose: true,
+      // 可打开，但 win32 的两种启动形态（explorer.exe 调度器 / 裸 URL 直启解析到的浏览器）退出码都不携带
+      // 窗口是否出现的信息，故每次调用最多到 handedOff（见 browser.js#ownsItsWindow）。能力位只声明「能交出去」。
+      openBrowser: true,
       hostService: "windows-service",
       guardAutostart: true,
       // schtasks DSH-Supervisor（ONLOGON，由壳建立）
@@ -4717,6 +4776,7 @@ var require_capability_profile = __commonJS({
       desktopNotify: false,
       autostart: false,
       frpExpose: false,
+      openBrowser: false,
       hostService: "none",
       guardAutostart: false,
       guardSelfHeal: false,
@@ -5400,6 +5460,8 @@ var require_browser = __commonJS({
     var path2 = require("node:path");
     var os2 = require("node:os");
     var spawnOS = require_spawn();
+    var desktop = require_desktop();
+    var CAPABILITY_PROFILES = require_capability_profile();
     var { resolveExecutable, isExecutableFile } = require_exec_path();
     var exec = require_exec();
     function isSafeHttpUrl(url) {
@@ -5416,17 +5478,126 @@ var require_browser = __commonJS({
       if (pl === "win32") return { cmd: "explorer.exe", args: [url] };
       return { cmd: "xdg-open", args: [url] };
     }
-    function open(url) {
-      if (!isSafeHttpUrl(url)) return false;
+    var SUPPORTED_OPEN_PLATFORMS = Object.keys(CAPABILITY_PROFILES).filter((k) => CAPABILITY_PROFILES[k].openBrowser === true);
+    function outcome(p) {
+      const ok = !!p.ok;
+      const confirmed = ok && p.confirmed === true;
+      const handedOff = ok && !confirmed;
+      const reason = ok ? null : p.reason || "failed";
+      return {
+        ok,
+        confirmed,
+        handedOff,
+        reason,
+        error: ok ? null : p.error || FAILURE_TEXT[reason] || "\u6253\u5F00\u5931\u8D25\uFF08" + reason + "\uFF09",
+        message: ok ? confirmed ? CONFIRMED_TEXT : p.message || HANDEDOFF_TEXT : null,
+        url: p.url === void 0 ? null : p.url,
+        evidence: p.evidence || null
+      };
+    }
+    var CONFIRMED_TEXT = "\u5DF2\u5728\u7CFB\u7EDF\u6D4F\u89C8\u5668\u6253\u5F00";
+    var HANDEDOFF_TEXT = "\u5DF2\u628A\u5730\u5740\u4EA4\u7ED9\u7CFB\u7EDF\uFF0C\u4F46\u8FD9\u6B21\u542F\u52A8\u62FF\u4E0D\u5230\u7A97\u53E3\u662F\u5426\u51FA\u73B0\u7684\u8BC1\u636E";
+    var FAILURE_TEXT = {
+      "unsafe-url": "\u5730\u5740\u4E0D\u662F http(s) \u7EDD\u5BF9 URL\uFF0C\u5DF2\u62D2\u7EDD\u4EA4\u7ED9\u6D4F\u89C8\u5668",
+      "no-launcher": "\u672A\u627E\u5230\u53EF\u7528\u7684\u6D4F\u89C8\u5668\u542F\u52A8\u547D\u4EE4\uFF0C\u8BF7\u624B\u52A8\u6253\u5F00\u8BE5\u5730\u5740",
+      "spawn-failed": "\u6D4F\u89C8\u5668\u542F\u52A8\u5931\u8D25\uFF08\u7CFB\u7EDF\u62D2\u7EDD\u4E86\u8BE5\u547D\u4EE4\uFF09",
+      "exit-nonzero": "\u7CFB\u7EDF\u62D2\u7EDD\u4E86\u8FD9\u4E2A\u5730\u5740\uFF08\u542F\u52A8\u547D\u4EE4\u975E 0 \u9000\u51FA\uFF09\uFF0C\u7A97\u53E3\u672A\u51FA\u73B0",
+      "killed-by-signal": "\u6D4F\u89C8\u5668\u542F\u52A8\u547D\u4EE4\u88AB\u7CFB\u7EDF\u7EC8\u6B62\uFF0C\u7A97\u53E3\u672A\u51FA\u73B0",
+      "no-desktop-session": "\u5F53\u524D\u6CA1\u6709\u56FE\u5F62\u4F1A\u8BDD\uFF0C\u65E0\u6CD5\u8C03\u8D77\u6D4F\u89C8\u5668",
+      "unsupported-platform": "\u5F53\u524D\u5E73\u53F0\u4E0D\u5728\u4EA7\u54C1\u652F\u6301\u7684\u684C\u9762\u5E73\u53F0\u5185\uFF0C\u8BF7\u624B\u52A8\u6253\u5F00\u8BE5\u5730\u5740"
+    };
+    function ownsItsWindow(via, platform) {
+      if (via !== "dispatcher") return false;
+      return platform !== "win32";
+    }
+    function openPlan(platform, url, opts) {
+      const o = opts || {};
+      const pl = platform || process.platform;
+      const db = o.defaultBrowser;
+      const engine = db && db.bin ? engineOf(db.bin) : "other";
+      if (engine === "chromium" || engine === "firefox") {
+        return { bin: db.bin, engine, via: "browser", baseArgs: (db.baseArgs || []).concat([url]), exitIsEvidence: ownsItsWindow("browser", pl) };
+      }
+      const c = openCommand(pl, url);
+      return { bin: c.cmd, engine: "other", via: "dispatcher", baseArgs: c.args, exitIsEvidence: ownsItsWindow("dispatcher", pl) };
+    }
+    function observeSpawn(child, windowMs, setTimeoutFn) {
+      return new Promise((resolve) => {
+        let settled = false;
+        let timer;
+        const done = (r) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          resolve(r);
+        };
+        timer = (setTimeoutFn || setTimeout)(() => done({ stage: "alive" }), windowMs);
+        if (timer && timer.unref) timer.unref();
+        child.on("error", (e) => done({ stage: "error", code: e && e.code || String(e) }));
+        child.on("exit", (code, signal) => done({ stage: "exit", code, signal }));
+      });
+    }
+    var OPEN_OBSERVE_MS = 1500;
+    async function openBrowser(url, o) {
+      const opts = o || {};
+      const pl = opts.platform || process.platform;
+      if (!isSafeHttpUrl(url)) {
+        return outcome({ ok: false, reason: "unsafe-url", url: String(url || ""), evidence: null });
+      }
+      if (!SUPPORTED_OPEN_PLATFORMS.includes(pl)) {
+        return outcome({ ok: false, reason: "unsupported-platform", url, evidence: { platform: pl } });
+      }
+      const observeMs = opts.observeMs === void 0 ? OPEN_OBSERVE_MS : opts.observeMs;
+      const spawnWith = typeof opts.spawn === "function" ? opts.spawn : _spawnDetachedIgnored;
+      const avail = typeof opts.binAvailable === "function" ? opts.binAvailable : binAvailable;
+      const observe = typeof opts.observe === "function" ? opts.observe : observeSpawn;
+      let db;
+      if ("defaultBrowser" in opts) db = opts.defaultBrowser;
+      else if (typeof opts.resolveDefault === "function") db = opts.resolveDefault(pl, opts.resolveDeps || {});
+      else db = resolveDefaultBrowser(pl, opts.resolveDeps || {});
+      const plan = openPlan(pl, url, { defaultBrowser: db });
+      const evidence = { bin: plan.bin, engine: plan.engine, via: plan.via, ownsWindow: plan.exitIsEvidence === true, exitCode: null, exitSignal: null, error: null };
+      const desktopAvailable = typeof opts.desktopAvailable === "function" ? opts.desktopAvailable : desktop.sessionAvailable;
+      if (pl === "linux" && !desktopAvailable()) {
+        return outcome({ ok: false, reason: "no-desktop-session", url, evidence });
+      }
+      if (!avail(plan.bin)) {
+        return outcome({ ok: false, reason: "no-launcher", url, evidence });
+      }
+      let child;
+      try {
+        child = spawnWith(plan.bin, plan.baseArgs);
+      } catch (e) {
+        evidence.error = e && e.code || String(e);
+        return outcome({ ok: false, reason: "spawn-failed", url, evidence });
+      }
+      if (!child) return outcome({ ok: false, reason: "spawn-failed", url, evidence });
+      const seen = await observe(child, observeMs, opts.setTimeout);
+      evidence.error = seen.stage === "error" ? String(seen.code) : null;
+      evidence.exitCode = seen.code === void 0 ? null : seen.code;
+      evidence.exitSignal = seen.signal === void 0 ? null : seen.signal;
+      if (seen.stage === "error") return outcome({ ok: false, reason: "spawn-failed", url, evidence });
+      const exitDecides = seen.stage === "exit" && plan.exitIsEvidence === true;
+      if (exitDecides && (seen.code !== 0 || seen.signal)) {
+        return outcome({
+          ok: false,
+          reason: seen.signal ? "killed-by-signal" : "exit-nonzero",
+          url,
+          evidence,
+          error: FAILURE_TEXT[seen.signal ? "killed-by-signal" : "exit-nonzero"] + "\uFF08" + (seen.signal || seen.code) + "\uFF09"
+        });
+      }
+      return outcome({ ok: true, confirmed: exitDecides, handedOff: !exitDecides, url, evidence });
+    }
+    function _spawnDetachedIgnored(bin, args) {
       try {
-        const c = openCommand(process.platform, url);
-        const p = spawnOS.detachedIgnored(c.cmd, c.args);
+        const p = spawnOS.detachedIgnored(bin, args);
         p.on("error", () => {
         });
         p.unref();
-        return true;
+        return p;
       } catch {
-        return false;
+        return null;
       }
     }
     function _spawnDetached(bin, args, env, onExit) {
@@ -5546,8 +5717,8 @@ var require_browser = __commonJS({
     }
     function resolveDefaultLinux(runOut, readFile, exists, env, home) {
       const id = runOut("xdg-settings", ["get", "default-web-browser"]);
-      const desktop = id && id.trim();
-      if (!desktop || !/^[A-Za-z0-9._-]+\.desktop$/.test(desktop)) return null;
+      const desktop2 = id && id.trim();
+      if (!desktop2 || !/^[A-Za-z0-9._-]+\.desktop$/.test(desktop2)) return null;
       const dirs = [
         env.XDG_DATA_HOME || path2.join(home, ".local", "share"),
         "/usr/local/share",
@@ -5555,7 +5726,7 @@ var require_browser = __commonJS({
         "/var/lib/snapd/desktop"
       ].map((d) => path2.join(d, "applications"));
       for (const dir of dirs) {
-        const p = path2.join(dir, desktop);
+        const p = path2.join(dir, desktop2);
         let text = null;
         try {
           if (exists(p)) text = readFile(p);
@@ -5627,12 +5798,13 @@ var require_browser = __commonJS({
     }
     function launchIsolated(url, o) {
       const opts = o || {};
-      if (!isSafeHttpUrl(url)) return { ok: false, bin: null, isolated: false };
+      if (!isSafeHttpUrl(url)) return Object.assign(outcome({ ok: false, reason: "unsafe-url", url: String(url || "") }), { bin: null, isolated: false });
       const antiEnv = opts.antiEnv || opts.sysEnv || process.env;
       const sysEnv = opts.sysEnv || process.env;
       const onExit = opts.onExit;
       const avail = typeof opts.binAvailable === "function" ? opts.binAvailable : binAvailable;
       const spawnWith = typeof opts.spawn === "function" ? opts.spawn : _spawnDetached;
+      const fail = (reason, extra) => Object.assign(outcome(Object.assign({ ok: false, reason, url }, extra)), { bin: null, isolated: false });
       try {
         let db;
         if ("defaultBrowser" in opts) db = opts.defaultBrowser;
@@ -5644,19 +5816,23 @@ var require_browser = __commonJS({
           size: opts.size,
           lang: opts.lang
         });
-        if (!avail(plan.bin)) return { ok: false, bin: null, isolated: false };
+        if (!avail(plan.bin)) return fail("no-launcher", { evidence: { bin: plan.bin, engine: plan.label, via: plan.isolated ? "browser" : "dispatcher" } });
         const env = plan.envKind === "anti" ? antiEnv : sysEnv;
         const p = spawnWith(plan.bin, plan.args, env, plan.watch ? onExit : void 0);
-        return { ok: !!p, bin: p ? plan.label : null, isolated: plan.isolated };
-      } catch {
-        return { ok: false, bin: null, isolated: false };
+        if (!p) return fail("spawn-failed");
+        return Object.assign(outcome({ ok: true, confirmed: false, handedOff: true, url }), { bin: plan.label, isolated: plan.isolated });
+      } catch (e) {
+        return fail("spawn-failed", { error: FAILURE_TEXT["spawn-failed"] + "\uFF08" + (e && e.code || e) + "\uFF09" });
       }
     }
     module2.exports = {
-      open,
+      openBrowser,
       launchIsolated,
       openCommand,
+      openPlan,
+      ownsItsWindow,
       isolatedPlan,
+      observeSpawn,
       isSafeHttpUrl,
       resolveDefaultBrowser,
       resolveDefaultWin,
@@ -5672,58 +5848,6 @@ var require_browser = __commonJS({
   }
 });
 
-// src/platform/os/desktop.js
-var require_desktop = __commonJS({
-  "src/platform/os/desktop.js"(exports2, module2) {
-    "use strict";
-    var fs2 = require("node:fs");
-    var PLATFORM = process.platform;
-    function hasX11Socket() {
-      try {
-        return fs2.readdirSync("/tmp/.X11-unix").some((f) => /^X\d+$/.test(f));
-      } catch {
-        return false;
-      }
-    }
-    function hasWaylandSocket() {
-      const uid = typeof process.getuid === "function" ? process.getuid() : 0;
-      const rt = process.env.XDG_RUNTIME_DIR || "/run/user/" + uid;
-      try {
-        return fs2.readdirSync(rt).some((f) => /^wayland-\d+$/.test(f));
-      } catch {
-        return false;
-      }
-    }
-    function sessionAvailable() {
-      if (PLATFORM === "linux") {
-        if (process.env.DISPLAY || process.env.WAYLAND_DISPLAY) return true;
-        return hasX11Socket() || hasWaylandSocket();
-      }
-      return PLATFORM === "darwin" || PLATFORM === "win32";
-    }
-    function describe() {
-      if (PLATFORM === "linux") {
-        const byEnv = !!(process.env.DISPLAY || process.env.WAYLAND_DISPLAY);
-        const byX = hasX11Socket();
-        const byWl = hasWaylandSocket();
-        return {
-          platform: PLATFORM,
-          available: byEnv || byX || byWl,
-          reason: byEnv ? "env(DISPLAY/WAYLAND_DISPLAY)" : byX ? "x11-socket" : byWl ? "wayland-socket" : "none",
-          display: process.env.DISPLAY || null,
-          waylandDisplay: process.env.WAYLAND_DISPLAY || null
-        };
-      }
-      return {
-        platform: PLATFORM,
-        available: sessionAvailable(),
-        reason: "session-scoped-by-launcher"
-      };
-    }
-    module2.exports = { sessionAvailable, describe, PLATFORM };
-  }
-});
-
 // src/platform/os/autostart/win32.js
 var require_win32 = __commonJS({
   "src/platform/os/autostart/win32.js"(exports2, module2) {
@@ -6070,6 +6194,7 @@ var require_os = __commonJS({
     var path2 = require("node:path");
     var ex2 = require_exec();
     var execPath = require_exec_path();
+    var desktop = require_desktop();
     var CAPABILITY_PROFILES = require_capability_profile();
     var PLATFORM = process.platform;
     var ARCH = process.arch;
@@ -6115,6 +6240,7 @@ var require_os = __commonJS({
         p.sandboxEnforcement = hasTool("systemd-run") ? "cgroup" : "supervise";
         p.desktopNotify = hasTool("notify-send");
         p.autostart = hasTool("systemctl");
+        p.openBrowser = desktop.sessionAvailable();
       } else if (pl === "darwin") {
         p.desktopNotify = hasTool("osascript");
       } else if (pl === "win32") {
@@ -6147,7 +6273,7 @@ var require_os = __commonJS({
       // 导出模块对象会抛 platform.notify is not a function，把升级终态误判成失败。
       notify: require_notify().notify,
       browser: require_browser(),
-      desktop: require_desktop(),
+      desktop,
       // 图形会话可用性（Linux 需实测 socket）
       autostart: require_autostart()
     };
@@ -10916,6 +11042,7 @@ var require_lan = __commonJS({
     module2.exports = { methods: {
       // 远程控制委托：全部转发给 LanManager；daemon 监督模式经 43108 ctl 委托（异步），本地模式走 LanManager（同步）。
       // 令牌收敛：listLan 输出必须剔除 token/dshToken —— /lan-access 允许 LAN/私网 Host 访问，直出会把 DSH 会话令牌泄漏给局域网，权威仍在 DshTokenService。
+      // 远程访问令牌的明文也不在此下发：它是实例意图字段，只随 /instances 的回环分支交给本机面板（api/domains/instances.js#decorate）。
       // remote（projectRemoteView 产物）为后端单一推导视图 {mode,ready,accessUrl,reasons}，不含机密，整段放行给 UI。返回形如 {items,addresses}。
       listLan() {
         const d = depsOf(this);
@@ -10928,7 +11055,7 @@ var require_lan = __commonJS({
               dshPort: it.dshPort,
               wanPort: it.wanPort,
               running: !!it.running,
-              // 令牌状态（布尔，不泄明文）：wan 模式的安全闸要求已设令牌，UI 据此引导。
+              // 令牌状态（布尔，不泄明文）：UI 据此引导，明文的查看/修改走 /instances 的回环分支。
               tokenSet: !!String(it.token || "").trim(),
               remote: it.remote || null
             };
@@ -11097,7 +11224,7 @@ var require_main = __commonJS({
           guardian: m.guardian,
           remoteMode: m.remoteMode,
           remoteToken: m.remoteToken,
-          // 进程内消费（LanManager mainOf）；API 边界由 api/domains/instances.js 剔除
+          // 进程内消费（LanManager mainOf）；API 边界按回环判据决定去留（api/domains/instances.js#decorate）
           unitName: null,
           // systemd 托管已废弃：main 由守卫 spawn/观测
           // 实时运行态：native 条目缺 state 会导致远程控制页误判「实例已停止」
@@ -11463,6 +11590,9 @@ if (typeof crypto.randomUUID !== 'function') {
       }
       return { ok: true };
     }
+    function generateRemoteToken() {
+      return crypto.randomBytes(12).toString("base64url");
+    }
     function normalizeRemoteMode(v) {
       return v === "lan" || v === "wan" ? v : "off";
     }
@@ -11472,9 +11602,9 @@ if (typeof crypto.randomUUID !== 'function') {
       if (mode === "off") return { mode, ready: false, accessUrl: null, reasons: [] };
       const reasons = [];
       if (!x.relayListening) reasons.push("\u8FDC\u7A0B\u670D\u52A1\u672A\u5C31\u7EEA\uFF08relay \u672A\u76D1\u542C\uFF09");
-      if (!x.tokenSet) reasons.push("\u672A\u8BBE\u8BBF\u95EE\u4EE4\u724C");
       else if (!x.cookieReady) reasons.push("\u6B63\u5728\u6CE8\u5165 DSH \u4F1A\u8BDD\u2026");
       if (mode === "wan") {
+        if (!x.tokenSet) reasons.push("\u672A\u8BBE\u8BBF\u95EE\u4EE4\u724C");
         if (!String(x.serverAddr || "").trim()) reasons.push("\u672A\u914D\u7F6E frps \u670D\u52A1\u5668\u5730\u5740");
         if (!x.frpcRunning) reasons.push("\u516C\u7F51\u96A7\u9053\u672A\u5EFA\u7ACB\uFF08frpc \u672A\u8FD0\u884C\uFF09");
       }
@@ -11498,6 +11628,7 @@ if (typeof crypto.randomUUID !== 'function') {
       buildFrpcToml,
       normalizeFrpSettings,
       normalizeRemoteMode,
+      generateRemoteToken,
       validateFrpServerSettings,
       validateWanAccess,
       projectRemoteView
@@ -11509,7 +11640,7 @@ if (typeof crypto.randomUUID !== 'function') {
 var require_lan2 = __commonJS({
   "src/app/domain-actions/lan.js"(exports2, module2) {
     "use strict";
-    var { validateWanAccess } = require_core4();
+    var { validateWanAccess, generateRemoteToken } = require_core4();
     var { remoteTokenStrength } = require_credential();
     function lanModule(deps) {
       const lm = typeof deps.getLifecycleManager === "function" ? deps.getLifecycleManager() : null;
@@ -11563,26 +11694,49 @@ var require_lan2 = __commonJS({
       }
       return {
         /** 远程控制模式唯一写入口（off|lan|wan）。mode 必须显式给出——缺省归 'off' 会让
-         *  漏字段的请求静默关闭远程控制。wan 前置闸：必须先有合规访问令牌。 */
+         *  漏字段的请求静默关闭远程控制。
+         *  开启（lan|wan）时若该实例压根没有访问令牌，就在这里分配一个并随模式一次落盘：
+         *  「开启远程控制」是用户唯一的开远程动作，把「先去别处设令牌」留在流程里，产出的是开关已开、
+         *  屏幕无二维码、用户也不知凭据为何的半截状态。已有令牌（含过弱的）一律不覆盖——静默改写
+         *  用户自设凭据是另一类事故，弱令牌交给 wan 闸显式拒绝并把用户引到令牌框。
+         *  wan 前置闸按**补齐后**的令牌复判：分配在复判之前完成、落盘在复判之后发生，被拒仍零写入。 */
         setRemoteMode(id, mode) {
           if (mode !== "off" && mode !== "lan" && mode !== "wan") {
             return { ok: false, error: "mode \u5FC5\u987B\u663E\u5F0F\u7ED9\u51FA\uFF08off|lan|wan\uFF09" };
           }
           const target = resolveTarget(id);
           if (!target) return { ok: false, error: "\u5B9E\u4F8B\u4E0D\u5B58\u5728" };
+          const allocate = mode !== "off" && !String(target.remoteToken || "").trim();
+          const nextToken = allocate ? generateRemoteToken() : target.remoteToken;
           if (mode === "wan") {
-            const v = validateWanAccess({ remoteToken: target.remoteToken });
+            const v = validateWanAccess({ remoteToken: nextToken });
             if (!v.ok) return { ok: false, error: v.error };
           }
           if (target.kind === "main") {
-            if (target.mode !== mode) applyMainIntent({ remoteMode: mode }, { id: "main", name: "\u539F\u751F DSH", mode });
-            return { ok: true };
+            const patch = { remoteMode: mode };
+            if (allocate) patch.remoteToken = nextToken;
+            if (allocate || target.mode !== mode) {
+              applyMainIntent(patch, { id: "main", name: "\u539F\u751F DSH", mode });
+              if (allocate) {
+                const events = g.getEvents();
+                if (events) {
+                  try {
+                    events.append("dsh_remote_token_changed", { id: "main", tokenSet: true, autoAllocated: true });
+                  } catch {
+                  }
+                }
+              }
+            }
+            return { ok: true, tokenAutoAllocated: allocate };
           }
-          return g.getInstances().updateInstance(id, { remoteMode: mode });
+          const r = allocate ? g.getInstances().updateInstance(id, { remoteMode: mode, remoteToken: nextToken }) : g.getInstances().updateInstance(id, { remoteMode: mode });
+          if (r && r.ok !== false) r.tokenAutoAllocated = allocate;
+          return r;
         },
-        /** 访问令牌唯一写入口。token 必须是字符串：空串=显式清除；缺字段/非字符串=请求方缺陷，
-         *  拒绝而非当作清除（漏 token 字段清掉访问凭据是事故，不是语义）。lan 模式可无令牌，
-         *  wan 模式的守门由执行边界闸兜住。 */
+        /** 访问令牌唯一显式写入口。token 必须是字符串：空串=显式清除；缺字段/非字符串=请求方缺陷，
+         *  拒绝而非当作清除（漏 token 字段清掉访问凭据是事故，不是语义）。
+         *  lan 模式清除后仍然可用（relay 空令牌放行），但下一次写入远程控制模式会由 setRemoteMode 重新分配；
+         *  wan 模式的守门由执行边界闸兜住（令牌清空后 syncFrpc 复判不过闸即停隧道）。 */
         setRemoteToken(id, token) {
           if (typeof token !== "string") {
             return { ok: false, error: "token \u5FC5\u987B\u663E\u5F0F\u7ED9\u51FA\uFF08\u7A7A\u4E32=\u6E05\u9664\uFF09" };
@@ -17587,7 +17741,7 @@ var require_browser2 = __commonJS({
         const tz = pick(TZ_POOL);
         const antiEnv = Object.assign({}, sysEnv, { TZ: tz, LANG: lang });
         const r = platform.browser.launchIsolated(url, { profileDir: tmpProfile, size, lang, antiEnv, sysEnv, onExit });
-        if (!r || !r.ok) return null;
+        if (!r || !r.ok) return { profile: null, result: r || { ok: false, reason: "spawn-failed" } };
         if (r.isolated) {
           const t30 = setTimeout(() => {
             try {
@@ -17597,9 +17751,9 @@ var require_browser2 = __commonJS({
           }, 30 * 60 * 1e3);
           if (t30.unref) t30.unref();
         }
-        return tmpProfile;
-      } catch {
-        return null;
+        return { profile: tmpProfile, result: r };
+      } catch (e) {
+        return { profile: null, result: { ok: false, reason: "spawn-failed", error: "\u6D4F\u89C8\u5668\u542F\u52A8\u5931\u8D25\uFF1A" + (e && e.message || e) } };
       }
     }
     module2.exports = { graphicalEnv, openInBrowser };
@@ -17777,7 +17931,7 @@ var require_oauth = __commonJS({
         promise.catch(() => {
         });
         st._ccLoginPromise = promise;
-        const tmpProfile = openInBrowser(authUrl, () => {
+        const opened = openInBrowser(authUrl, () => {
           if (st._ccLoginRound !== roundId) return;
           if (st._ccLoginReject) {
             const r = st._ccLoginReject;
@@ -17789,7 +17943,8 @@ var require_oauth = __commonJS({
             }
           }
         });
-        if (!tmpProfile) {
+        const evidence = opened.result || {};
+        if (!opened.profile) {
           st._ccLoginPromise = null;
           st._ccLoginResolve = null;
           st._ccLoginReject = null;
@@ -17802,10 +17957,29 @@ var require_oauth = __commonJS({
           } catch {
           }
           st._ccLogin = null;
-          return { ok: false, error: "\u65E0\u6CD5\u8C03\u8D77\u6D4F\u89C8\u5668\uFF08\u672A\u627E\u5230\u53EF\u7528\u6D4F\u89C8\u5668\uFF09\uFF0C\u8BF7\u624B\u52A8\u6253\u5F00: " + authUrl };
+          return {
+            ok: false,
+            authUrl,
+            url: authUrl,
+            opened: false,
+            confirmed: false,
+            handedOff: false,
+            reason: evidence.reason || "no-launcher",
+            error: (evidence.error || "\u65E0\u6CD5\u8C03\u8D77\u7CFB\u7EDF\u6D4F\u89C8\u5668") + "\uFF0C\u8BF7\u624B\u52A8\u6253\u5F00\u4E0B\u65B9\u5730\u5740\u5B8C\u6210\u6388\u6743"
+          };
         }
-        st._ccLogin = { state, port, server, tmpProfile };
-        return { ok: true, authUrl, state, port, waitMs: 18e4 };
+        st._ccLogin = { state, port, server, tmpProfile: opened.profile };
+        return Object.assign({}, evidence, {
+          ok: true,
+          authUrl,
+          url: authUrl,
+          state,
+          port,
+          waitMs: 18e4,
+          opened: true,
+          // 非隔离引擎（Safari/snap 包装器）由平台层降级：账号隔离不成立，换账号只能靠超时重发或手动窗口。
+          isolated: evidence.isolated === true
+        });
       }
       async function commandcodeLoginWait(timeoutMs) {
         const p = st._ccLoginPromise;
@@ -21545,6 +21719,9 @@ var require_market = __commonJS({
         this._cache = null;
         this._ts = 0;
         this._inFlight = null;
+        this._lastError = null;
+        this._nextAllowAt = 0;
+        this.retryBackoffMs = opts.retryBackoffMs || 6e4;
         this.buildBudgetMs = opts.buildBudgetMs || 24e4;
         this.loadFromDisk();
       }
@@ -21558,38 +21735,51 @@ var require_market = __commonJS({
       saveToDisk() {
         marketCache.saveIndex(this.cacheDir, this.indexFile, this._cache, this.logger);
       }
-      /** 读取插件列表（带 TTL 缓存 + 并发去重）。 */
-      async getIndex(force = false) {
-        if (this._cache && !force) {
-          this._refreshIfStale();
-          return this._cache;
-        }
-        if (this._inFlight) return this._inFlight;
-        return this._startBuild();
+      /** 索引快照，耗时上限必须是「读内存」：构建（默认预算 4 分钟）交 _requestBuild 在后台跑。
+       *  挂到请求上等构建，面板 15s 计时会先放弃而服务端仍在跑 —— 用户见失败、结论却是好的。
+       *  无缓存且上次构建刚失败时按 retryBackoffMs 退避，免得每次读都点燃一轮 4 分钟构建；force 不受退避约束。 */
+      getIndex(force = false) {
+        const need = !this._cache || force || Date.now() - this._ts >= this.ttl;
+        if (need && (force || Date.now() >= this._nextAllowAt)) this._requestBuild();
+        return Promise.resolve(this._view());
+      }
+      /** 快照视图（无缓存也返回合法空索引，绝不为取数据而触网）。 */
+      _view() {
+        const c = this._cache;
+        return {
+          ok: true,
+          indexedAt: c ? c.indexedAt : 0,
+          sources: c ? c.sources : { npm: 0, github: 0, community: 0 },
+          total: c ? c.total : 0,
+          plugins: c ? c.plugins : [],
+          building: !!this._inFlight,
+          error: this._lastError
+        };
       }
-      /** 启动一次构建并登记为并发去重引用，返回原始 promise。两条不变量必须同时成立：
-       *  (a) 无消费者的后台刷新失败不得成为进程级 unhandledRejection —— 靠给 raw 挂 no-op handler「标记已处理」实现，而不是把 promise 消化掉；
-       *  (b) 被消费者取走时仍须如实失败 —— raw 的 reject 语义不变（api/domains/plugins.js 的 GET /plugins/market 据此回答 500）。
-       *  若改成「消化后存回 _inFlight」，force 请求会取到它并在失败时 resolve 成 undefined -> 200 + 空体。 */
-      _startBuild() {
+      /** 启动一次构建（无消费者 await）并登记为在飞引用；两条不变量：
+       *  (a) 无人等待的失败不得成为进程级 unhandledRejection —— 给 raw 挂 no-op handler「标记已处理」；
+       *  (b) 去重：已有在飞构建就直接复用，force 连点不得叠加并发构建（M-i）。
+       *  失败原因记入 _lastError 并由快照如实上报 —— 取不到不能显示成「没有插件」。 */
+      _requestBuild() {
+        if (this._inFlight) return this._inFlight;
         const raw = this.buildIndex();
         raw.catch(() => {
         });
         this._inFlight = raw;
-        raw.then(() => {
-        }, () => {
-        }).then(() => {
+        raw.then(
+          () => {
+            this._lastError = null;
+          },
+          (e) => {
+            this._lastError = e && e.message || String(e);
+            if (!this._cache) this._nextAllowAt = Date.now() + this.retryBackoffMs;
+            this.logger.warn && this.logger.warn("market: \u7D22\u5F15\u6784\u5EFA\u5931\u8D25\uFF08\u6CBF\u7528\u65E7\u7F13\u5B58\uFF09: " + this._lastError);
+          }
+        ).then(() => {
           if (this._inFlight === raw) this._inFlight = null;
         });
         return raw;
       }
-      _refreshIfStale() {
-        if (Date.now() - this._ts < this.ttl) return;
-        if (this._inFlight) return;
-        this._startBuild().catch((e) => {
-          this.logger.warn && this.logger.warn("market: \u540E\u53F0\u5237\u65B0\u7D22\u5F15\u5931\u8D25\uFF08\u6CBF\u7528\u65E7\u7F13\u5B58\uFF09: " + (e && e.message || e));
-        });
-      }
       async buildIndex() {
         const start = Date.now();
         const bctx = { deadline: start + this.buildBudgetMs, truncated: /* @__PURE__ */ new Set() };
@@ -22753,22 +22943,57 @@ var require_updater = __commonJS({
       if (latest !== null) ctx._updCache[name] = { latest, at: Date.now() };
       return { latest, error };
     }
-    async function checkUpdates(ctx, force) {
+    function checkUpdates(ctx, force) {
+      if (!ctx._updSnapshot || force) _requestCheck(ctx, force);
+      const s = ctx._updSnapshot;
+      return Promise.resolve({
+        ok: true,
+        checkedAt: s ? s.checkedAt : 0,
+        plugins: s ? s.plugins : [],
+        refreshing: !!ctx._updInFlight,
+        error: s ? s.error : null
+      });
+    }
+    function _requestCheck(ctx, force) {
+      if (ctx._updInFlight) return ctx._updInFlight;
+      const raw = refreshUpdates(ctx, force);
+      raw.catch(() => {
+      });
+      ctx._updInFlight = raw;
+      raw.catch((e) => {
+        const msg = e && e.message || String(e);
+        if (ctx.logger && ctx.logger.warn) ctx.logger.warn("plugin check-updates \u5931\u8D25: " + msg);
+        if (!ctx._updSnapshot) ctx._updSnapshot = { checkedAt: 0, plugins: [], error: msg };
+      }).then(() => {
+        if (ctx._updInFlight === raw) ctx._updInFlight = null;
+      });
+      return raw;
+    }
+    async function refreshUpdates(ctx, force) {
       const targets = [ctx._nativeTarget(), ...ctx._allSandboxTargets()];
       const meta = /* @__PURE__ */ new Map();
       for (const t of targets) {
         for (const p of ctx.installedOn(t)) {
           if (meta.has(p.name)) continue;
-          const st = specType(p.source);
-          let latest = null;
-          if (st === "npm" && ctx.dist) latest = (await latestCached(ctx, p.name, force)).latest;
-          meta.set(p.name, { specType: st, latest });
+          meta.set(p.name, { specType: specType(p.source), latest: null, error: null });
         }
       }
+      const npmNames = [...meta.entries()].filter(([, m]) => m.specType === "npm" && ctx.dist).map(([name]) => name);
+      const errors = [];
+      for (let i = 0; i < npmNames.length; i += 6) {
+        const slice = npmNames.slice(i, i + 6);
+        await Promise.all(slice.map(async (name) => {
+          const r = await latestCached(ctx, name, force);
+          const m = meta.get(name);
+          m.latest = r.latest;
+          m.error = r.error;
+          if (r.error) errors.push(name + ": " + r.error);
+        }));
+      }
       const rows = [];
       for (const t of targets) {
         for (const p of ctx.installedOn(t)) {
-          const m = meta.get(p.name) || { specType: "npm", latest: null };
+          const m = meta.get(p.name) || { specType: "npm", latest: null, error: null };
           const updateAvailable = m.specType === "npm" && isUpdateAvailable(m.latest, p.version);
           rows.push({ name: p.name, target: t.id, targetName: t.name, installed: p.version || null, latest: m.latest || null, updateAvailable, specType: m.specType, bundle: p.bundle });
         }
@@ -22777,13 +23002,15 @@ var require_updater = __commonJS({
       for (const row of rows) {
         let rec = byName.get(row.name);
         if (!rec) {
-          byName.set(row.name, { name: row.name, specType: row.specType, targets: [] });
+          byName.set(row.name, { name: row.name, specType: row.specType, error: meta.get(row.name) ? meta.get(row.name).error : null, targets: [] });
           rec = byName.get(row.name);
         }
         rec.targets.push({ id: row.target, name: row.targetName, installed: row.installed, latest: row.latest, updateAvailable: row.updateAvailable });
       }
-      const plugins = [...byName.values()].map((x) => ({ name: x.name, specType: x.specType, updateAvailable: x.targets.some((t) => t.updateAvailable), targets: x.targets })).sort((a, b) => a.name.localeCompare(b.name));
-      return { ok: true, checkedAt: Date.now(), plugins };
+      const plugins = [...byName.values()].map((x) => ({ name: x.name, specType: x.specType, error: x.error, updateAvailable: x.targets.some((t) => t.updateAvailable), targets: x.targets })).sort((a, b) => a.name.localeCompare(b.name));
+      const snap = { checkedAt: Date.now(), plugins, error: errors.length ? errors.join("; ") : null };
+      ctx._updSnapshot = snap;
+      return snap;
     }
     async function update(ctx, name, targetStr) {
       if (!name) return { ok: false, error: "missing plugin name" };
@@ -22885,6 +23112,8 @@ var require_plugin = __commonJS({
         this.tasks = opts.tasks || null;
         this._updCache = {};
         this._updTTL = 6 * 3600 * 1e3;
+        this._updSnapshot = null;
+        this._updInFlight = null;
         this.jobs = createJobs({ tasks: this.tasks });
         this.layers = createLayers({ overlayFile: this.overlayFile, logger: this.logger });
         this.store = new store.PluginStore({ getInventory: () => this.inventory() });
@@ -25283,7 +25512,7 @@ var require_guard = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function owns(pathname) {
-      return pathname === "/changelog" || pathname.startsWith("/guard/") || pathname === "/autostart" || pathname.startsWith("/settings/") || pathname.startsWith("/self-update/") || pathname === "/env/dsh" || pathname === "/env/status" || pathname === "/env/node-lts" || pathname === "/ports" || pathname === "/shutdown";
+      return pathname === "/changelog" || pathname.startsWith("/guard/") || pathname === "/autostart" || pathname.startsWith("/settings/") || pathname.startsWith("/self-update/") || pathname === "/env/dsh" || pathname === "/env/status" || pathname === "/env/node-lts" || pathname === "/env/open-url" || pathname === "/ports" || pathname === "/shutdown";
     }
     function fetchDshChangelog(res, sup) {
       const v = sup && sup.nativeManager ? sup.nativeManager.versionInfo() : {};
@@ -25295,7 +25524,7 @@ var require_guard = __commonJS({
       return res.end(md);
     }
     function handle(ctx) {
-      const { sup, req, res, pathname, send, collectBody, originAllowed } = ctx;
+      const { sup, req, res, pathname, identity, send, collectBody, originAllowed, browser } = ctx;
       if (req.method === "GET" && pathname === "/changelog") {
         return fetchDshChangelog(res, sup);
       }
@@ -25459,6 +25688,27 @@ var require_guard = __commonJS({
       if (req.method === "GET" && pathname === "/env/node-lts") {
         return sup.nodeLtsStatus().then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
+      if (req.method === "POST" && pathname === "/env/open-url") {
+        if (!identity.loopback) {
+          req.resume();
+          return send(403, { ok: false, error: "\u4EC5\u5185\u6838\u6240\u5728\u673A\u5668\u53EF\u8BF7\u5185\u6838\u8C03\u8D77\u6D4F\u89C8\u5668\uFF0C\u8BF7\u590D\u5236\u6216\u81EA\u884C\u6253\u5F00\u8BE5\u5730\u5740" });
+        }
+        if (!originAllowed(req, sup.config.apiPort)) {
+          req.resume();
+          return send(403, { ok: false, error: "cross-origin request rejected" });
+        }
+        collectBody(req, res, 4096, (body) => {
+          let url = null;
+          try {
+            const j = body ? JSON.parse(body) : {};
+            if (typeof j.url === "string") url = j.url;
+          } catch {
+          }
+          if (!url) return send(400, { ok: false, error: '\u9700\u8981 {"url":"http(s)://\u2026"}' });
+          return Promise.resolve(browser.openBrowser(url)).then((r) => send(r.ok ? 200 : 500, r)).catch((e) => send(500, { ok: false, reason: "spawn-failed", error: "\u6253\u5F00\u6D4F\u89C8\u5668\u5931\u8D25\uFF1A" + (e && e.message || e), url }));
+        });
+        return;
+      }
       if (req.method === "GET" && pathname === "/ports") {
         return Promise.resolve(sup.listPorts()).then((r) => send(200, r)).catch((e) => send(500, { error: e && e.message }));
       }
@@ -25953,7 +26203,6 @@ var require_exchange = __commonJS({
 var require_instances = __commonJS({
   "src/api/domains/instances.js"(exports2, module2) {
     "use strict";
-    var platform = require_os();
     var execPath = require_exec_path();
     var crypto = require("node:crypto");
     var { bootstrapDshCookie } = require_exchange();
@@ -26055,17 +26304,18 @@ var require_instances = __commonJS({
       return sharedErr + "\uFF1B" + FORMS + "\uFF1B\u9700\u8981\u5176\u5B83\u53EF\u6267\u884C\u8BF7\u8D70\u63D2\u4EF6\u5B89\u88C5\u901A\u9053";
     }
     function handle(ctx) {
-      const { sup, req, res, pathname, identity, send, collectBody, originAllowed, tokOf } = ctx;
+      const { sup, req, res, pathname, identity, send, collectBody, originAllowed, tokOf, browser } = ctx;
       function openInSystemBrowser(url) {
-        return platform.browser.open(url);
+        return browser.openBrowser(url);
       }
       if (req.method === "GET" && pathname === "/open") return handleOpen(ctx);
       if (req.method === "GET" && pathname === "/instances") {
         const decorate = (it) => {
           const tok = tokOf(it.id);
           const out = Object.assign({}, it);
-          delete out.remoteToken;
           const loopback = identity.loopback;
+          out.tokenSet = !!String(it.remoteToken || "").trim();
+          if (!loopback) delete out.remoteToken;
           out.authUrl = tok && loopback ? "http://127.0.0.1:" + it.port + "/?token=" + encodeURIComponent(tok) : "http://127.0.0.1:" + it.port + "/";
           out.tokenPresent = loopback && !!tok;
           return out;
@@ -26121,9 +26371,13 @@ var require_instances = __commonJS({
                 if (!(Number(it.port) > 0)) return send(400, { ok: false, error: "\u975E\u6CD5\u7AEF\u53E3" });
                 const code = issueOpenWebCode(j.id);
                 const url = "http://127.0.0.1:" + sup.config.apiPort + "/open?code=" + code;
-                const ok = openInSystemBrowser(url);
-                if (!ok) dropOpenWebCode(code);
-                return send(ok ? 200 : 500, { ok, url });
+                return Promise.resolve(openInSystemBrowser(url)).then((r) => {
+                  if (!r.ok) dropOpenWebCode(code);
+                  return send(r.ok ? 200 : 500, r);
+                }).catch((e) => {
+                  dropOpenWebCode(code);
+                  return send(500, { ok: false, reason: "spawn-failed", error: "\u6253\u5F00\u6D4F\u89C8\u5668\u5931\u8D25\uFF1A" + (e && e.message || e), url });
+                });
               } catch (e) {
                 return send(500, { ok: false, error: e.message });
               }
@@ -26568,6 +26822,7 @@ var require_server = __commonJS({
     var { serveStatic } = require_static();
     var { identify } = require_identity3();
     var { originAllowed, requestHasAccessKey, isShellOrigin } = require_security();
+    var browserExit = require_browser();
     function safeFail(res, err, where) {
       try {
         const body = JSON.stringify({ ok: false, error: err && err.message || String(err) });
@@ -26585,7 +26840,8 @@ var require_server = __commonJS({
       } catch {
       }
     }
-    function createServer(sup) {
+    function createServer(sup, deps) {
+      const browser = deps && deps.browser || browserExit;
       return http2.createServer((req, res) => {
         const shellOrigin = (() => {
           const o = req.headers.origin;
@@ -26653,7 +26909,7 @@ var require_server = __commonJS({
         } catch (e) {
           return send(400, { error: "bad request encoding" });
         }
-        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed, tokOf };
+        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed, tokOf, browser };
         for (const d of API_DOMAINS) {
           if (d.owns(pathname)) {
             try {