@dsh-sup/dsh-core-linux-x64 0.1.6-BETA.14 → 0.1.6-BETA.15

package/core.cjs

@@ -951,7 +951,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.1.6-BETA.14");
+      if (true) return String("0.1.6-BETA.15");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -4855,6 +4855,106 @@ var require_capability_profile = __commonJS({
   }
 });
 
+// src/platform/util/redact.js
+var require_redact = __commonJS({
+  "src/platform/util/redact.js"(exports2, module2) {
+    "use strict";
+    function maskProxyServer(server) {
+      return server ? String(server).replace(/(\/\/)?([^\s/@:]+):([^\s/@]*)@/, "$1$2:***@") : null;
+    }
+    function maskProxySecrets(text) {
+      return String(text == null ? "" : text).replace(/(\/\/)?([^\s/@:]+):([^\s/@]*)@/g, "$1$2:***@");
+    }
+    module2.exports = { maskProxyServer, maskProxySecrets };
+  }
+});
+
+// src/platform/os/registry.js
+var require_registry = __commonJS({
+  "src/platform/os/registry.js"(exports2, module2) {
+    "use strict";
+    function regValueOf(out) {
+      const m = String(out || "").match(/REG_(?:EXPAND_SZ|SZ)\s+(.*)/);
+      if (!m) return null;
+      return m[1].trim() || null;
+    }
+    function regDwordOf(out) {
+      const m = String(out || "").match(/REG_DWORD\s+(0x[0-9a-fA-F]+|\d+)\b/);
+      if (!m) return null;
+      const n = Number.parseInt(m[1], m[1].startsWith("0x") ? 16 : 10);
+      return Number.isNaN(n) ? null : n;
+    }
+    function expandEnvVars(value, env) {
+      const e = env || process.env;
+      return String(value).replace(/%([^%]+)%/g, (all, name) => e[name] === void 0 ? all : e[name]);
+    }
+    function safeRegKeyPart(s) {
+      return typeof s === "string" && s.length > 0 && s.length <= 200 && /^[\x20-\x7e]+$/.test(s) && !/[;|&`$()<>^"'\r\n]/.test(s);
+    }
+    var REG_HIVE_ALIAS = { HKLM: "HKEY_LOCAL_MACHINE", HKCU: "HKEY_CURRENT_USER", HKCR: "HKEY_CLASSES_ROOT", HKU: "HKEY_USERS", HKCC: "HKEY_CURRENT_CONFIG" };
+    function regKeyFull(key) {
+      const s = String(key || "");
+      const i = s.indexOf("\\");
+      const root = i < 0 ? s : s.slice(0, i);
+      return (REG_HIVE_ALIAS[root.toUpperCase()] || root) + (i < 0 ? "" : s.slice(i));
+    }
+    function regValue(runner, note, key, name) {
+      const args = name ? ["query", key, "/v", name] : ["query", key, "/ve"];
+      const out = runner("reg.exe", args);
+      const v = regValueOf(out);
+      note(name ? key + " /v " + name : key, v ? "ok" : "empty");
+      return v;
+    }
+    function regSubkeys(runner, note, key) {
+      const out = runner("reg.exe", ["query", key]);
+      if (!out) {
+        note(key, "unreadable");
+        return [];
+      }
+      const prefix = regKeyFull(key) + "\\";
+      const names = [];
+      for (const line of String(out).split(/\r?\n/)) {
+        const l = line.trim();
+        if (!/^HKEY_/i.test(l) || l.length <= prefix.length) continue;
+        if (l.slice(0, prefix.length).toUpperCase() !== prefix.toUpperCase()) continue;
+        const rest = l.slice(prefix.length);
+        if (rest && !rest.includes("\\") && safeRegKeyPart(rest)) names.push(rest);
+      }
+      note(key, names.length ? names.length + " \u9879" : "\u65E0\u5B50\u952E");
+      return names;
+    }
+    function regValueTargets(runner, note, key) {
+      const out = runner("reg.exe", ["query", key]);
+      if (!out) {
+        note(key, "unreadable");
+        return [];
+      }
+      const paths = [];
+      for (const line of String(out).split(/\r?\n/)) {
+        const m = line.trim().match(/REG_SZ\s+(.*)/);
+        if (!m) continue;
+        const rel = m[1].trim();
+        if (!safeRegKeyPart(rel)) continue;
+        const root = key.slice(0, key.indexOf("\\"));
+        paths.push(root + "\\" + rel);
+      }
+      note(key, paths.length ? paths.length + " \u4E2A\u80FD\u529B\u8DEF\u5F84" : "\u65E0\u503C");
+      return paths;
+    }
+    module2.exports = {
+      regValueOf,
+      regDwordOf,
+      expandEnvVars,
+      safeRegKeyPart,
+      REG_HIVE_ALIAS,
+      regKeyFull,
+      regValue,
+      regSubkeys,
+      regValueTargets
+    };
+  }
+});
+
 // src/platform/os/browser-inventory.js
 var require_browser_inventory = __commonJS({
   "src/platform/os/browser-inventory.js"(exports2, module2) {
@@ -4864,6 +4964,8 @@ var require_browser_inventory = __commonJS({
     var os2 = require("node:os");
     var exec = require_exec();
     var { isExecutableFile } = require_exec_path();
+    var registry = require_registry();
+    var { expandEnvVars, safeRegKeyPart, regValue, regSubkeys, regValueTargets } = registry;
     var PROBE_TIMEOUT_MS = 1500;
     function engineOf(bin) {
       const base = String(bin || "").toLowerCase().split(/[\\/]/).pop();
@@ -4922,15 +5024,6 @@ var require_browser_inventory = __commonJS({
       if (!toks.length) return null;
       return { bin: toks[0], baseArgs: toks.slice(1) };
     }
-    function regValueOf(out) {
-      const m = String(out || "").match(/REG_(?:EXPAND_SZ|SZ)\s+(.*)/);
-      if (!m) return null;
-      return m[1].trim() || null;
-    }
-    function expandEnvVars(value, env) {
-      const e = env || process.env;
-      return String(value).replace(/%([^%]+)%/g, (all, name) => e[name] === void 0 ? all : e[name]);
-    }
     function exeFromCmdLine(cmdLine) {
       const s = String(cmdLine || "");
       let m = s.match(/^\s*"([^"]+\.exe)"/i);
@@ -4938,41 +5031,6 @@ var require_browser_inventory = __commonJS({
       m = s.match(/^\s*(.*?\.exe)/i);
       return m ? m[1] : null;
     }
-    function safeRegKeyPart(s) {
-      return typeof s === "string" && s.length > 0 && s.length <= 200 && /^[\x20-\x7e]+$/.test(s) && !/[;|&`$()<>^"'\r\n]/.test(s);
-    }
-    function regValue(runner, note, key, name) {
-      const args = name ? ["query", key, "/v", name] : ["query", key, "/ve"];
-      const out = runner("reg.exe", args);
-      const v = regValueOf(out);
-      note(name ? key + " /v " + name : key, v ? "ok" : "empty");
-      return v;
-    }
-    var REG_HIVE_ALIAS = { HKLM: "HKEY_LOCAL_MACHINE", HKCU: "HKEY_CURRENT_USER", HKCR: "HKEY_CLASSES_ROOT", HKU: "HKEY_USERS", HKCC: "HKEY_CURRENT_CONFIG" };
-    function regKeyFull(key) {
-      const s = String(key || "");
-      const i = s.indexOf("\\");
-      const root = i < 0 ? s : s.slice(0, i);
-      return (REG_HIVE_ALIAS[root.toUpperCase()] || root) + (i < 0 ? "" : s.slice(i));
-    }
-    function regSubkeys(runner, note, key) {
-      const out = runner("reg.exe", ["query", key]);
-      if (!out) {
-        note(key, "unreadable");
-        return [];
-      }
-      const prefix = regKeyFull(key) + "\\";
-      const names = [];
-      for (const line of String(out).split(/\r?\n/)) {
-        const l = line.trim();
-        if (!/^HKEY_/i.test(l) || l.length <= prefix.length) continue;
-        if (l.slice(0, prefix.length).toUpperCase() !== prefix.toUpperCase()) continue;
-        const rest = l.slice(prefix.length);
-        if (rest && !rest.includes("\\") && safeRegKeyPart(rest)) names.push(rest);
-      }
-      note(key, names.length ? names.length + " \u9879" : "\u65E0\u5B50\u952E");
-      return names;
-    }
     var WIN_APP_PATHS = ["msedge.exe", "chrome.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe", "chromium.exe", "thorium.exe", "librewolf.exe"];
     function winExeOfProgId(runner, note, progId, env) {
       if (!safeRegKeyPart(progId)) return null;
@@ -5068,24 +5126,6 @@ var require_browser_inventory = __commonJS({
       if (found.size === 1) setDefault([...found.values()][0], "only-installed");
       return { browsers: [...found.values()], defaultId, defaultSource, probed: notes };
     }
-    function regValueTargets(runOut, note, key) {
-      const out = runOut("reg.exe", ["query", key]);
-      if (!out) {
-        note(key, "unreadable");
-        return [];
-      }
-      const paths = [];
-      for (const line of String(out).split(/\r?\n/)) {
-        const m = line.trim().match(/REG_SZ\s+(.*)/);
-        if (!m) continue;
-        const rel = m[1].trim();
-        if (!safeRegKeyPart(rel)) continue;
-        const root = key.slice(0, key.indexOf("\\"));
-        paths.push(root + "\\" + rel);
-      }
-      note(key, paths.length ? paths.length + " \u4E2A\u80FD\u529B\u8DEF\u5F84" : "\u65E0\u503C");
-      return paths;
-    }
     var MAC_JXA_LIST = [
       "ObjC.import('Foundation');",
       "var ws=$.NSWorkspace.sharedWorkspace;",
@@ -5387,13 +5427,15 @@ var require_browser_inventory = __commonJS({
       engineOf,
       tokenizeExec,
       parseExecLine,
-      regValueOf,
-      expandEnvVars,
       exeFromCmdLine,
+      // 注册表原语住在 ./registry.js（单一实现），此处原样转出：既有门禁与消费方的取用口不变。
+      regValueOf: registry.regValueOf,
+      expandEnvVars,
+      safeRegKeyPart,
+      regKeyFull: registry.regKeyFull,
+      regValue,
       regSubkeys,
-      regKeyFull,
       regValueTargets,
-      safeRegKeyPart,
       browserFromDesktop,
       desktopDirs,
       resolveLinuxBin,
@@ -5405,6 +5447,317 @@ var require_browser_inventory = __commonJS({
   }
 });
 
+// src/platform/os/egress.js
+var require_egress = __commonJS({
+  "src/platform/os/egress.js"(exports2, module2) {
+    "use strict";
+    var tls = require("node:tls");
+    var dns = require("node:dns");
+    var exec = require_exec();
+    var registry = require_registry();
+    var PROBE_TIMEOUT_MS = 2500;
+    var READ_TTL_MS = 6e4;
+    function hostOf(url) {
+      try {
+        return new URL(String(url)).hostname.toLowerCase() || null;
+      } catch {
+        return null;
+      }
+    }
+    function proxyWin(runner, note) {
+      const KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings";
+      const read = (args) => Promise.resolve(runner("reg.exe", args));
+      return Promise.all([
+        read(["query", KEY, "/v", "ProxyEnable"]),
+        read(["query", KEY, "/v", "ProxyServer"]),
+        read(["query", KEY, "/v", "AutoConfigURL"])
+      ]).then(([en, sv, pc]) => {
+        const on = registry.regDwordOf(en);
+        const server = registry.regValueOf(sv);
+        const pac = registry.regValueOf(pc);
+        const state = on === 1 ? "on" : on === 0 ? pac ? "on" : "off" : "unknown";
+        note("registry:Internet Settings", "ProxyEnable=" + (on === null ? "unreadable" : on) + " server=" + (server || "-") + " pac=" + (pac ? "set" : "-"));
+        return { state, server: server || null, pac: pac || null, source: "registry:Internet Settings" };
+      });
+    }
+    function proxyMac(runOut, note) {
+      return Promise.resolve(runOut("scutil", ["--proxy"])).then((out) => {
+        if (!out) {
+          note("scutil --proxy", "unreadable");
+          return { state: "unknown", server: null, pac: null, source: "scutil" };
+        }
+        const kv = {};
+        for (const line of String(out).split(/\r?\n/)) {
+          const m = line.match(/^\s*([A-Za-z]+)\s*:\s*(.+?)\s*$/);
+          if (m) kv[m[1]] = m[2];
+        }
+        const flagOn = (k) => kv[k] === "1";
+        const anyManual = kv.HTTPEnable !== void 0 || kv.HTTPSEnable !== void 0 || kv.SOCKSEnable !== void 0 || kv.ProxyAutoConfigEnable !== void 0;
+        const state = flagOn("HTTPEnable") || flagOn("HTTPSEnable") || flagOn("SOCKSEnable") || flagOn("ProxyAutoConfigEnable") ? "on" : anyManual ? "off" : "unknown";
+        note("scutil --proxy", "state=" + state);
+        return {
+          state,
+          server: kv.HTTPProxy || kv.HTTPSProxy || kv.SOCKSProxy || null,
+          pac: kv.ProxyAutoConfigURLString || kv.ProxyAutoConfigURL || null,
+          source: "scutil"
+        };
+      });
+    }
+    function proxyLinux(env, note) {
+      const pick = (k) => typeof env[k] === "string" && env[k].trim() ? env[k].trim() : null;
+      const server = pick("https_proxy") || pick("HTTPS_PROXY") || pick("http_proxy") || pick("HTTP_PROXY") || pick("ALL_PROXY") || pick("all_proxy");
+      const noProxy = pick("no_proxy") || pick("NO_PROXY");
+      const state = server ? "on" : "unknown";
+      note("env proxy", "state=" + state);
+      return { state, server, pac: pick("PAC_FILE") || null, noProxy, source: "env" };
+    }
+    function proxyUnknown(reason) {
+      return { state: "unknown", server: null, pac: null, source: reason };
+    }
+    var _proxyCache = /* @__PURE__ */ new Map();
+    function proxy(o) {
+      const ov = o || {};
+      const pl = ov.platform || process.platform;
+      const now = typeof ov.now === "function" ? ov.now : Date.now;
+      const ttl = ov.ttlMs === void 0 ? READ_TTL_MS : ov.ttlMs;
+      const hit = _proxyCache.get(pl);
+      if (!ov.force && ttl > 0 && hit && now() - hit.value.at < ttl) {
+        return Promise.resolve(Object.assign({}, hit.value, { cached: true }));
+      }
+      const notes = [];
+      const note = (source, detail) => {
+        notes.push({ source, detail });
+      };
+      const runOut = ov.runOut || ((bin, args) => exec.runOutAsync(bin, args, { timeoutMs: PROBE_TIMEOUT_MS }));
+      const out = Promise.resolve().then(() => {
+        if (pl === "win32") return proxyWin(runOut, note);
+        if (pl === "darwin") return proxyMac(runOut, note);
+        if (pl === "linux") return proxyLinux(ov.env || process.env, note);
+        return proxyUnknown("unsupported-platform");
+      }).catch((e) => {
+        note(pl + " proxy probe", "error: " + String(e && (e.code || e.message) || e));
+        return proxyUnknown("probe-failed");
+      }).then((v) => {
+        const value = Object.assign({ platform: pl, at: now(), probed: notes }, v);
+        _proxyCache.set(pl, { value });
+        return value;
+      });
+      return out;
+    }
+    function proxyRead() {
+      const hit = _proxyCache.get(process.platform);
+      return hit ? hit.value : null;
+    }
+    function reachWith(deps, host2, port, timeoutMs) {
+      const d = deps || {};
+      const ms = timeoutMs || PROBE_TIMEOUT_MS;
+      const lookup = d.lookup || ((h) => new Promise((resolve, reject) => dns.lookup(h, (err, addr) => err ? reject(err) : resolve(addr))));
+      const connect = d.connect || ((opts) => new Promise((resolve, reject) => {
+        let settled = false;
+        const sock = tls.connect(opts);
+        const fail = (e) => {
+          if (settled) return;
+          settled = true;
+          try {
+            sock.destroy();
+          } catch {
+          }
+          reject(e);
+        };
+        sock.once("secureConnect", () => {
+          if (settled) return;
+          settled = true;
+          try {
+            sock.destroy();
+          } catch {
+          }
+          resolve(true);
+        });
+        sock.once("error", fail);
+        sock.setTimeout(ms, () => fail(Object.assign(new Error("tls-timeout"), { code: "ETIMEDOUT" })));
+      }));
+      const started = Date.now();
+      const verdict = (ok, stage, detail) => ({ ok, stage, host: host2, port, detail, at: started });
+      return lookup(host2).then((addr) => connect({ host: addr, port, servername: host2, timeout: ms })).then(() => verdict(true, "tls", "TLS \u63E1\u624B\u5B8C\u6210")).catch((e) => {
+        const code = String(e && (e.code || e.message) || e);
+        if (/ENOTFOUND/i.test(code)) return verdict(false, "dns", code);
+        if (/ECONNREFUSED/i.test(code)) return verdict(false, "tcp", code);
+        if (/EPROTO|handshake|ALPR|CERT|UNEXPECTED/i.test(code)) return verdict(false, "tls", code);
+        if (/EAI_AGAIN|getaddrinfo|ESERVFAIL|ENODATA/i.test(code)) return verdict(null, "dns", code);
+        if (/ETIMEDOUT|ECONNRESET|EHOSTUNREACH|ENETUNREACH|timeout/i.test(code)) return verdict(null, "tcp", code);
+        return verdict(null, "tcp", code);
+      });
+    }
+    var _reachCache = /* @__PURE__ */ new Map();
+    function reach(host2, o) {
+      const ov = o || {};
+      const h = String(host2 || "").toLowerCase();
+      if (!h) return Promise.resolve({ ok: null, stage: "not-attempted", host: host2 || null, port: null, detail: "\u6CA1\u6709\u53EF\u5224\u5B9A\u7684\u4E3B\u673A", at: Date.now() });
+      const ttl = ov.ttlMs === void 0 ? READ_TTL_MS : ov.ttlMs;
+      const hit = _reachCache.get(h);
+      if (!ov.force && ttl > 0 && hit && Date.now() - hit.value.at < ttl) {
+        return Promise.resolve(Object.assign({}, hit.value, { cached: true }));
+      }
+      const port = ov.port || 443;
+      return reachWith(ov, h, port, ov.timeoutMs).then((v) => {
+        _reachCache.set(h, { value: v });
+        return v;
+      });
+    }
+    function reachRead(host2) {
+      const h = String(host2 || "").toLowerCase();
+      const hit = _reachCache.get(h);
+      return hit ? hit.value : null;
+    }
+    function hosts() {
+      return [..._reachCache.keys()];
+    }
+    function invalidate(host2) {
+      if (host2 === void 0 || host2 === null) {
+        const n = _reachCache.size + _proxyCache.size;
+        _reachCache.clear();
+        _proxyCache.clear();
+        return n;
+      }
+      return _reachCache.delete(String(host2).toLowerCase()) ? 1 : 0;
+    }
+    module2.exports = {
+      PROBE_TIMEOUT_MS,
+      READ_TTL_MS,
+      hostOf,
+      proxy,
+      proxyRead,
+      proxyWin,
+      proxyMac,
+      proxyLinux,
+      reach,
+      reachRead,
+      reachWith,
+      hosts,
+      invalidate
+    };
+  }
+});
+
+// src/platform/contract/shell-report.js
+var require_shell_report = __commonJS({
+  "src/platform/contract/shell-report.js"(exports2, module2) {
+    "use strict";
+    var fs2 = require("node:fs");
+    var path2 = require("node:path");
+    var stateRoot2 = require_state_root();
+    var { maskProxyServer, maskProxySecrets } = require_redact();
+    var SUPPORTED_SCHEMA = 1;
+    var FILE_NAME = "shell-report.json";
+    var MAX_BYTES = 256 * 1024;
+    var MAX_ROWS = 64;
+    function file() {
+      return path2.join(stateRoot2.supervisorDir(), FILE_NAME);
+    }
+    var str = (v) => typeof v === "string" && v.trim() ? maskProxySecrets(v.trim()) : null;
+    var raw = (v) => typeof v === "string" && v.trim() ? v.trim() : null;
+    var num = (v) => typeof v === "number" && Number.isFinite(v) ? v : null;
+    var tri = (v) => v === true || v === false ? v : null;
+    var list = (v) => Array.isArray(v) ? v : [];
+    function nodeView(n) {
+      const o = n && typeof n === "object" ? n : null;
+      if (!o) return null;
+      return { path: str(o.path), binDir: str(o.binDir), version: raw(o.version), min: raw(o.min), ok: tri(o.ok) };
+    }
+    function npmView(n) {
+      const o = n && typeof n === "object" ? n : null;
+      if (!o) return null;
+      return { path: str(o.path), args: list(o.args).map(String), version: raw(o.version), ok: tri(o.ok) };
+    }
+    function prefixView(n) {
+      const o = n && typeof n === "object" ? n : null;
+      if (!o) return null;
+      return { dir: str(o.dir), writable: tri(o.writable), why: str(o.why) };
+    }
+    function registryView(n) {
+      const o = n && typeof n === "object" ? n : null;
+      if (!o) return null;
+      const rows = list(o.probes).slice(0, MAX_ROWS).map((p) => ({
+        url: p && typeof p === "object" ? maskProxyServer(raw(p.url)) : null,
+        ok: p && typeof p === "object" ? tri(p.ok) : null,
+        latencyMs: p && typeof p === "object" ? num(p.latencyMs) : null
+      }));
+      return { best: maskProxyServer(raw(o.best)), latencyMs: num(o.latencyMs), probes: rows, probesTotal: list(o.probes).length };
+    }
+    function recordsView(recs) {
+      const all = list(recs);
+      const rows = all.slice(0, MAX_ROWS).map((r) => {
+        const o = r && typeof r === "object" ? r : {};
+        return {
+          probe: raw(o.probe) || "unknown",
+          source: str(o.source) || "",
+          target: str(o.target) || "",
+          ms: num(o.ms),
+          ok: tri(o.ok),
+          note: str(o.note) || ""
+        };
+      });
+      return { rows, truncated: all.length > MAX_ROWS ? all.length - MAX_ROWS : 0 };
+    }
+    function bodyOf(j) {
+      const recs = recordsView(j.records);
+      const body = {
+        writtenBy: raw(j.writtenBy),
+        schema: num(j.schema),
+        node: nodeView(j.node),
+        npm: npmView(j.npm),
+        prefix: prefixView(j.prefix),
+        registry: registryView(j.registry),
+        records: recs.rows,
+        droppedRecords: recs.truncated
+      };
+      const seen = [body.node, body.npm, body.prefix, body.registry].some((x) => !!x) || body.records.length > 0;
+      return seen ? body : null;
+    }
+    function envelope(p, at, ageMs, reason, body) {
+      return Object.assign({ available: reason === "ok", path: p, at, ageMs, reason }, body || {
+        writtenBy: null,
+        schema: null,
+        node: null,
+        npm: null,
+        prefix: null,
+        registry: null,
+        records: [],
+        droppedRecords: 0
+      });
+    }
+    function read(o) {
+      const now = o && typeof o.now === "function" ? o.now : Date.now;
+      const p = file();
+      let text;
+      try {
+        const st = fs2.statSync(p);
+        if (st.size > MAX_BYTES) return envelope(p, null, null, "unreadable-or-schema-mismatch", null);
+        text = fs2.readFileSync(p, "utf8");
+      } catch (e) {
+        if (e && e.code === "ENOENT") return envelope(p, null, null, "never-written", null);
+        return envelope(p, null, null, "unreadable-or-schema-mismatch", null);
+      }
+      let j;
+      try {
+        j = JSON.parse(text);
+      } catch {
+        return envelope(p, null, null, "unreadable-or-schema-mismatch", null);
+      }
+      if (!j || typeof j !== "object" || Array.isArray(j) || num(j.schema) !== SUPPORTED_SCHEMA) {
+        return envelope(p, null, null, "unreadable-or-schema-mismatch", null);
+      }
+      const at = num(j.at);
+      if (at === null) return envelope(p, null, null, "unreadable-or-schema-mismatch", null);
+      const ageMs = Math.max(0, now() - at);
+      const body = bodyOf(j);
+      if (!body) return envelope(p, at, null, "unreadable-or-schema-mismatch", null);
+      return envelope(p, at, ageMs, "ok", body);
+    }
+    module2.exports = { SUPPORTED_SCHEMA, FILE_NAME, MAX_BYTES, MAX_ROWS, file, read };
+  }
+});
+
 // src/platform/os/environment.js
 var require_environment = __commonJS({
   "src/platform/os/environment.js"(exports2, module2) {
@@ -5414,12 +5767,17 @@ var require_environment = __commonJS({
     var path2 = require("node:path");
     var stateRoot2 = require_state_root();
     var { writeAtomic } = require_fs();
+    var { maskProxyServer, maskProxySecrets } = require_redact();
     var desktop = require_desktop();
     var detector = require_browser_inventory();
+    var egress = require_egress();
+    var shellReport = require_shell_report();
     var { engineOf } = detector;
-    var SCHEMA = 1;
+    var SCHEMA = 2;
     var FILE_NAME = "environment.json";
     var FORM_TTL_MS = 6e4;
+    var SECTION_TTL_MS = 6e4;
+    var SHELL_REPORT_TTL_MS = 1e4;
     var _sources = {};
     function bind(sources) {
       _sources = Object.assign({}, _sources, sources || {});
@@ -5510,6 +5868,148 @@ var require_environment = __commonJS({
       if (list.length > 1) return out(rankCandidates(list)[0], "candidate-rank");
       return out(null, "none-found");
     }
+    var _sections = /* @__PURE__ */ new Map();
+    var _reads = /* @__PURE__ */ new Map();
+    var SECTION_ORDER = ["runtime", "shell", "dsh", "browsers", "session", "egress", "capabilities", "preference", "pick", "startup"];
+    var SYNC_DIMS = ["browsers", "session", "capabilities", "preference", "pick"];
+    function registerSection(id, def) {
+      if (!id || !def || typeof def.probe !== "function") throw new Error("registerSection(" + id + ") \u9700\u8981 probe \u51FD\u6570");
+      if (SYNC_DIMS.includes(id)) throw new Error("\u7EF4\u5EA6 " + id + " \u7531\u8868\u5355\u6BCF\u62CD\u81EA\u88C5\uFF0C\u4E0D\u63A5\u6CE8\u518C");
+      const d = { id, label: def.label || id, probe: def.probe, ttlMs: def.ttlMs === void 0 ? SECTION_TTL_MS : def.ttlMs, source: def.source || "registered" };
+      _sections.set(id, d);
+      _reads.delete(id);
+      return d;
+    }
+    function unregisterSection(id) {
+      _sections.delete(id);
+      _reads.delete(id);
+    }
+    function section(id) {
+      return _reads.get(id) || null;
+    }
+    function sectionData(id) {
+      const r = _reads.get(id);
+      return r ? r.data || null : null;
+    }
+    function proxyDataOf(p) {
+      return p ? { state: p.state, server: maskProxyServer(p.server), pac: p.pac || null, source: p.source, cached: p.cached === true } : null;
+    }
+    function egressData(proxyReading) {
+      const targets = {};
+      for (const h of egress.hosts()) {
+        const r = egress.reachRead(h);
+        if (r) targets[h] = { ok: r.ok === null ? null : r.ok === true, stage: r.stage, detail: r.detail, at: r.at };
+      }
+      const p = proxyReading || egress.proxyRead();
+      const probed = [];
+      if (p) {
+        for (const row of p.probed || []) probed.push({ source: row.source, detail: maskProxySecrets(String(row.detail || "")) });
+        probed.push({ source: p.source, detail: "proxy=" + p.state + (p.server ? " (" + maskProxyServer(p.server) + ")" : "") + (p.cached ? " \u590D\u7528" : "") });
+      } else {
+        probed.push({ source: "egress", detail: "\u7CFB\u7EDF\u4EE3\u7406\u672A\u8BFB\uFF08\u672C\u7EF4\u5EA6\u5C1A\u672A\u5237\u65B0\uFF09" });
+      }
+      for (const h of Object.keys(targets)) {
+        const t = targets[h];
+        probed.push({ source: "reach:" + h, detail: (t.ok === null ? "unknown" : t.ok ? "ok" : "no-route") + "@" + t.stage + " " + t.detail });
+      }
+      return {
+        at: p ? p.at : null,
+        proxy: proxyDataOf(p),
+        targets,
+        probed
+      };
+    }
+    registerSection("egress", {
+      label: "\u51FA\u7F51\u6761\u4EF6",
+      source: "self",
+      probe: (o) => {
+        const ov = o || {};
+        const force = ov.force === true;
+        const hosts = Array.isArray(ov.hosts) ? ov.hosts : egress.hosts();
+        const reachOpts = { force, timeoutMs: ov.timeoutMs, lookup: ov.lookup, connect: ov.connect, ttlMs: ov.ttlMs };
+        return Promise.all([egress.proxy(Object.assign({}, ov, { force }))].concat(hosts.map((h) => egress.reach(h, reachOpts)))).then(([p]) => egressData(p));
+      }
+    });
+    registerSection("shell", {
+      label: "\u684C\u9762\u58F3\u6240\u89C1\uFF08Node/npm/\u955C\u50CF\u6E90/\u5168\u5C40\u524D\u7F00\uFF09",
+      source: "shell",
+      ttlMs: SHELL_REPORT_TTL_MS,
+      probe: () => shellReport.read()
+    });
+    async function probeSection(id, o) {
+      const def = _sections.get(id);
+      if (!def) return null;
+      const ov = o || {};
+      const now = typeof ov.now === "function" ? ov.now : Date.now;
+      try {
+        const data = await def.probe(ov);
+        _reads.set(id, { at: now(), source: def.source, label: def.label, state: data ? "ok" : "empty", data: data || null, error: null });
+      } catch (e) {
+        _reads.set(id, { at: now(), source: def.source, label: def.label, state: "error", data: null, error: String(e && (e.code || e.message) || e) });
+      }
+      return _reads.get(id);
+    }
+    function staleOf(id, now, force) {
+      if (force) return true;
+      const def = _sections.get(id);
+      const read = _reads.get(id);
+      if (!def || !read) return true;
+      return now - read.at >= def.ttlMs;
+    }
+    async function refresh(o) {
+      const ov = o || {};
+      const now = typeof ov.now === "function" ? ov.now : Date.now;
+      const ids = Array.isArray(ov.only) && ov.only.length ? ov.only : [..._sections.keys()];
+      await Promise.all(ids.filter((id) => _sections.has(id) && staleOf(id, now(), ov.force)).map((id) => probeSection(id, ov)));
+      return form(Object.assign({}, ov, { force: true }));
+    }
+    async function checkEgress(url, o) {
+      const ov = o || {};
+      const host2 = egress.hostOf(url);
+      let data = ov.egress === void 0 ? null : ov.egress;
+      if (!data) {
+        try {
+          const hosts = new Set(egress.hosts());
+          if (host2) {
+            await egress.reach(host2, ov);
+            hosts.add(host2);
+          }
+          const read = await probeSection("egress", Object.assign({}, ov, { hosts: [...hosts] }));
+          data = read && read.data || sectionData("egress");
+        } catch {
+          data = sectionData("egress");
+        }
+      }
+      const v = coldProfileViable(data, host2);
+      return Object.assign({}, v, {
+        host: host2,
+        proxy: data && data.proxy ? data.proxy.state : "unknown",
+        at: data ? data.at || null : null
+      });
+    }
+    function coldProfileViable(eg, host2) {
+      if (!eg) return { viable: null, basis: "egress-unprobed", detail: "\u51FA\u7F51\u6761\u4EF6\u5C1A\u672A\u63A2\u6D4B\uFF0C\u9694\u79BB\u7A97\u53E3\u6309\u539F\u6863\u6253\u5F00" };
+      const t = host2 && eg.targets ? eg.targets[host2] : null;
+      const reached = t ? t.ok : null;
+      const proxyState = eg.proxy ? eg.proxy.state : "unknown";
+      if (reached === true) {
+        return { viable: true, basis: "target-reachable", detail: host2 + " \u76F4\u8FDE\u53EF\u8FBE\uFF08" + t.stage + "\uFF09" };
+      }
+      if (reached === null) {
+        return { viable: null, basis: "egress-undetermined", detail: host2 + " \u7684\u901A\u8DEF\u5224\u5B9A\u6CA1\u6709\u7ED9\u51FA\u7B54\u6848\uFF08" + (t ? t.stage + " " + t.detail : "\u65E0\u8BFB\u6570") + "\uFF09" };
+      }
+      if (proxyState === "on") {
+        return { viable: true, basis: "cold-profile-inherits-proxy", detail: host2 + " \u76F4\u8FDE\u4E0D\u901A\uFF08" + t.stage + "\uFF09\uFF0C\u7CFB\u7EDF\u7EA7\u4EE3\u7406\u5728\u7528\uFF0C\u51B7\u6863\u6848\u540C\u4E00\u6761\u8DEF" };
+      }
+      if (proxyState === "unknown") {
+        return { viable: null, basis: "proxy-unreadable", detail: host2 + " \u76F4\u8FDE\u4E0D\u901A\uFF08" + t.stage + "\uFF09\uFF0C\u4F46\u4EE3\u7406\u8BFB\u6570\u53D6\u4E0D\u5230\uFF0C\u6309\u5224\u4E0D\u51FA\u5904\u7406" };
+      }
+      return {
+        viable: false,
+        basis: "cold-profile-blocked",
+        detail: host2 + " \u76F4\u8FDE\u4E0D\u901A\uFF08" + t.stage + " " + t.detail + "\uFF09\u4E14\u7CFB\u7EDF\u6CA1\u6709\u5728\u7528\u4EE3\u7406\uFF0C\u51B7\u6863\u6848\u7A97\u53E3\u5FC5\u7136\u7A7A\u767D"
+      };
+    }
     function snapshotPath() {
       return path2.join(stateRoot2.supervisorDir(), FILE_NAME);
     }
@@ -5521,6 +6021,23 @@ var require_environment = __commonJS({
         return null;
       }
     }
+    function lastSnapshot(o) {
+      const now = o && typeof o.now === "function" ? o.now : Date.now;
+      const p = snapshotPath();
+      const doc = readSnapshot();
+      if (doc) {
+        const at = typeof doc.at === "number" ? doc.at : null;
+        return { available: true, path: p, at, ageMs: at === null ? null : Math.max(0, now() - at), reason: "ok", data: doc };
+      }
+      return {
+        available: false,
+        path: p,
+        at: null,
+        ageMs: null,
+        reason: fs2.existsSync(p) ? "unreadable-or-schema-mismatch" : "never-written",
+        data: null
+      };
+    }
     var _formCache = null;
     function form(o) {
       const ov = o || {};
@@ -5560,6 +6077,45 @@ var require_environment = __commonJS({
         source: "form",
         detail: pick.how + (pick.browser ? "\uFF08" + pick.browser.name + "\uFF09" : "\uFF08\u65E0\u5019\u9009\uFF09") + (pick.stale ? "\uFF0C\u504F\u597D\u5DF2\u5931\u6548\u9700\u91CD\u9009" : "")
       });
+      const sections = {};
+      const syncDims = {
+        browsers: { at: stamp, state: inv.browsers.length ? "ok" : "empty", count: inv.browsers.length, defaultSource: inv.defaultSource },
+        session: { at: stamp, state: session.available ? "ok" : "missing", reason: session.reason },
+        capabilities: { at: stamp, state: caps ? "ok" : "unbound", openBrowser: caps ? caps.openBrowser === true : null },
+        preference: { at: stamp, state: preference.reason === "matched" ? "ok" : preference.configured ? "stale" : "unset", id: preference.id },
+        pick: { at: stamp, state: pick.browser ? "ok" : "empty", how: pick.how, id: pick.browser ? pick.browser.id : null }
+      };
+      const dimOf = (id) => {
+        const def = _sections.get(id);
+        const read = _reads.get(id);
+        if (read && !syncDims[id]) {
+          return { label: def ? def.label : id, at: read.at, source: read.source, state: read.state, data: read.data, error: read.error || null };
+        }
+        const s = syncDims[id];
+        if (s) return Object.assign({ label: id, source: "self" }, s);
+        return { label: def ? def.label : id, at: null, source: def ? def.source : "registered", state: "pending", data: null, error: null };
+      };
+      const ids = SECTION_ORDER.concat([..._sections.keys()].filter((id) => !SECTION_ORDER.includes(id)));
+      for (const id of ids) {
+        if (sections[id]) continue;
+        const entry = dimOf(id);
+        sections[id] = entry;
+        if (entry.state === "pending") {
+          probed.push({ section: id, source: "form", detail: "\u672A\u5237\u65B0\uFF08\u7B49\u542F\u52A8\u88C5\u914D\u6216\u9762\u677F force \u5237\u65B0\u8865\u62CD\uFF09" });
+        } else if (entry.state === "error") {
+          probed.push({ section: id, source: "probe", detail: id + " \u63A2\u6D4B\u5931\u8D25: " + entry.error });
+        }
+      }
+      const egressRows = ((sections.egress || {}).data || {}).probed || [];
+      for (const row of egressRows) probed.push({ section: "egress", source: row.source, detail: row.detail });
+      const sh = (sections.shell || {}).data;
+      if (sh) {
+        probed.push({
+          section: "shell",
+          source: "shell-report:" + (sh.reason || "?"),
+          detail: sh.available === true ? "\u58F3\u5DF2\u4E0A\u62A5\uFF08\u5199\u5165\u8005 " + (sh.writtenBy || "\u672A\u7F72\u540D") + "\uFF0Cschema " + sh.schema + "\uFF0C\u8DDD\u4ECA " + (sh.ageMs === null ? "\u672A\u8BFB\u51FA" : sh.ageMs) + " \u6BEB\u79D2\uFF0C\u660E\u7EC6 " + (sh.records || []).length + " \u6761" + (sh.droppedRecords ? "\uFF0C\u622A\u65AD " + sh.droppedRecords + " \u6761" : "") + "\uFF09" : sh.reason === "never-written" ? "\u8FD9\u53F0\u673A\u5668\u7684\u58F3\u8FD8\u6CA1\u62A5\u8FC7\uFF08\u5185\u6838\u72EC\u7ACB\u8DD1\u6216\u8001\u7248\u672C\u58F3\u65F6\u662F\u5E38\u6001\uFF0C\u4E0D\u662F\u6545\u969C\uFF09" : "\u58F3\u62A5\u7684\u6587\u4EF6\u8BFB\u4E0D\u51FA\u6216\u7248\u672C\u4E0D\u7B26\uFF0C\u5F97\u67E5\uFF1A" + (sh.path || "?")
+        });
+      }
       const value = {
         schema: SCHEMA,
         at: stamp,
@@ -5572,6 +6128,7 @@ var require_environment = __commonJS({
         default: inv.defaultId ? { id: inv.defaultId, source: inv.defaultSource } : null,
         browsers: inv.browsers,
         pick: { how: pick.how, id: pick.browser ? pick.browser.id : null, name: pick.browser ? pick.browser.name : null, wanted: pick.wanted, stale: pick.stale },
+        sections,
         probed
       };
       const snapshot = { path: snapshotPath(), written: false, error: null };
@@ -5592,8 +6149,14 @@ var require_environment = __commonJS({
       _formCache = { at: stamp, value };
       return Object.assign({ cached: false }, value);
     }
-    function invalidate(platform) {
+    function invalidate(platform, only) {
       _formCache = null;
+      const list = only === void 0 ? null : Array.isArray(only) ? only : [only];
+      if (!list || list.includes("egress")) egress.invalidate();
+      for (const id of list || [..._reads.keys()]) {
+        const r = _reads.get(id);
+        if (r) r.at = 0;
+      }
       return detector.invalidate(platform);
     }
     function checkPreference(value, form2) {
@@ -5615,6 +6178,9 @@ var require_environment = __commonJS({
       SCHEMA,
       FILE_NAME,
       FORM_TTL_MS,
+      SECTION_TTL_MS,
+      SECTION_ORDER,
+      SYNC_DIMS,
       bind,
       preferenceId,
       capabilities,
@@ -5625,9 +6191,17 @@ var require_environment = __commonJS({
       rankCandidates,
       pickLauncher,
       checkPreference,
+      registerSection,
+      unregisterSection,
+      section,
+      sectionData,
+      refresh,
+      coldProfileViable,
+      checkEgress,
       form,
       snapshotPath,
       readSnapshot,
+      lastSnapshot,
       invalidate
     };
   }
@@ -6513,9 +7087,7 @@ var require_browser = __commonJS({
       }));
       const pk = picked || {};
       return {
-        platform: inv && inv.platform || null,
         pick: pk.how || plan && plan.pick || "none",
-        bin: plan && plan.bin || null,
         default: inv && inv.defaultId ? { id: inv.defaultId, source: inv.defaultSource || null } : null,
         preference: pk.wanted ? { id: pk.wanted, matched: pk.stale !== true } : null,
         found,
@@ -6577,8 +7149,10 @@ var require_browser = __commonJS({
       const picked = opts.pick || environment.pickLauncher(pl, inv, pref);
       const form = formOfBin(pl, picked.browser);
       const canIsolate = intent === "isolated-login" && form.direct && (form.engine === "chromium" || form.engine === "firefox");
+      const cold = canIsolate ? await environment.checkEgress(url, opts) : null;
+      const isolate = canIsolate && (!cold || cold.viable !== false);
       let profile = null;
-      if (canIsolate) {
+      if (isolate) {
         const alloc = typeof opts.allocProfile === "function" ? opts.allocProfile : (() => allocTempDir("dsh-login-"));
         try {
           profile = opts.profileDir || alloc();
@@ -6599,8 +7173,11 @@ var require_browser = __commonJS({
         exitCode: null,
         exitSignal: null,
         error: null,
-        diagnostics
+        diagnostics,
+        egress: cold
       };
+      const downgraded = cold && cold.viable === false;
+      const downgradeText = downgraded ? "\u672C\u673A\u76F4\u8FDE " + cold.host + " \u4E0D\u901A\u4E14\u6CA1\u6709\u5728\u7528\u7CFB\u7EDF\u4EE3\u7406\uFF0C\u9694\u79BB\u7A97\u53E3\u4F1A\u662F\u7A7A\u767D\u9875\uFF1B\u5DF2\u5728\u73B0\u6709\u6D4F\u89C8\u5668\u7A97\u53E3\u6253\u5F00\u8BE5\u5730\u5740\uFF08\u767B\u5F55\u5B8C\u6210\u540E\u8BF7\u624B\u52A8\u6E05\u7406\u8D26\u53F7\uFF0C\u6216\u5148\u5728\u7CFB\u7EDF\u91CC\u914D\u597D\u4EE3\u7406\uFF09" : null;
       const deferredRemove = typeof opts.rmTree === "function" ? opts.rmTree : removeTreeDeferred;
       const fail = (reason, patch) => {
         if (profile) deferredRemove(profile, 0);
@@ -6612,7 +7189,7 @@ var require_browser = __commonJS({
       }
       if (!plan.bin) return fail("no-launcher");
       if (!avail(plan.bin)) return fail("no-launcher");
-      if (canIsolate && !profile) {
+      if (isolate && !profile) {
         evidence.error = "\u4E34\u65F6 profile \u76EE\u5F55\u5206\u914D\u5931\u8D25";
         return fail("spawn-failed");
       }
@@ -6640,7 +7217,14 @@ var require_browser = __commonJS({
           error: FAILURE_TEXT[seen.signal ? "killed-by-signal" : "exit-nonzero"] + "\uFF08" + (seen.signal || seen.code) + "\uFF09"
         });
       }
-      return outcome({ ok: true, confirmed: exitDecides, handedOff: !exitDecides, url, evidence });
+      return outcome({
+        ok: true,
+        confirmed: exitDecides,
+        handedOff: !exitDecides,
+        url,
+        evidence,
+        message: downgradeText || void 0
+      });
     }
     module2.exports = {
       openBrowser,
@@ -7108,6 +7692,7 @@ var require_bootstrap = __commonJS({
     var { createShellWatchdog } = require_watchdog();
     var pidlook = require_pidlookup();
     var platform = require_os();
+    var ENV_FORM_STARTUP_DELAY_MS = 3e3;
     function _bootstrap(host2) {
       try {
         host2.events.append("guard_started", {
@@ -7123,6 +7708,15 @@ var require_bootstrap = __commonJS({
       } catch {
       }
       host2.logger.info("guard started v" + host2.guardVersion + " pid=" + process.pid);
+      host2._startupFacts = {
+        bootAt: Date.now(),
+        envDelayMs: ENV_FORM_STARTUP_DELAY_MS,
+        routerAutostart: host2.config.routerAutostart === true,
+        routerMode: null,
+        updateCheck: null,
+        shellWatchdog: null,
+        lastRefresh: null
+      };
       host2.tick();
       host2._timer = host2.managedObjects ? null : setInterval(() => host2.tick(), host2.config.probeIntervalMs);
       host2._lastHeartbeatAt = Date.now();
@@ -7178,6 +7772,7 @@ var require_bootstrap = __commonJS({
         }
         if (host2._routerDaemonActive()) host2._writeRouterDaemonLock();
         const rt = host2._ensureRouterRuntime(true);
+        host2._startupFacts.routerMode = rt.mode;
         if (rt.mode === "daemon") {
           host2._disableRouterPersist();
           if (rt.spawned) {
@@ -7218,13 +7813,20 @@ var require_bootstrap = __commonJS({
           rlc._monitoring = false;
         }
       }
+      const checkDelayMs = host2.config.initialCheckDelayMs || 2e4;
+      const checkIntervalMs = host2.config.updateCheckIntervalMs || 36e5;
+      host2._startupFacts.updateCheck = {
+        enabled: host2.config.updateCheckEnabled !== false,
+        initialDelayMs: checkDelayMs,
+        intervalMs: checkIntervalMs
+      };
       if (host2.config.updateCheckEnabled !== false) {
         host2._initialCheckTimer = setTimeout(() => {
           host2.nativeManager.checkUpdate();
-        }, host2.config.initialCheckDelayMs || 2e4);
+        }, checkDelayMs);
         host2._upgradeTimer = setInterval(() => {
           host2.nativeManager.checkUpdate();
-        }, host2.config.updateCheckIntervalMs || 36e5);
+        }, checkIntervalMs);
       }
       try {
         host2._startShellWatchdog();
@@ -7233,6 +7835,50 @@ var require_bootstrap = __commonJS({
           host2.logger.warn("[shell-watchdog] \u542F\u52A8\u5F02\u5E38\uFF08\u4E0D\u5F71\u54CD\u5B88\u536B\u4E3B\u5FAA\u73AF\uFF09: " + (e && e.message || e));
         }
       }
+      host2._startupFacts.shellWatchdog = !!host2.shellWatchdog;
+      const envTimer = setTimeout(() => {
+        try {
+          host2._refreshEnvironmentForm();
+        } catch (e) {
+          host2.logger.warn && host2.logger.warn("[environment] \u542F\u52A8\u5237\u65B0\u5F02\u5E38\uFF08\u4E0D\u5F71\u54CD\u5B88\u536B\u4E3B\u5FAA\u73AF\uFF09: " + (e && e.message || e));
+        }
+      }, ENV_FORM_STARTUP_DELAY_MS);
+      if (envTimer && envTimer.unref) envTimer.unref();
+    }
+    function _refreshEnvironmentForm(host2) {
+      const startedAt = Date.now();
+      return platform.environment.refresh({ persist: true }).then((f) => {
+        const secs = f && f.sections || {};
+        const pending = Object.keys(secs).filter((id) => secs[id] && secs[id].state === "pending");
+        const failed = Object.keys(secs).filter((id) => secs[id] && secs[id].state === "error");
+        const snap = f && f.snapshot ? f.snapshot : {};
+        if (host2._startupFacts) {
+          const states = {};
+          for (const id of Object.keys(secs)) states[id] = secs[id] ? secs[id].state : "missing";
+          host2._startupFacts.lastRefresh = {
+            at: f && f.at || null,
+            tookMs: Date.now() - startedAt,
+            dims: states,
+            browsers: f && f.browsers && f.browsers.length || 0,
+            pick: f && f.pick && f.pick.how || null,
+            snapshotWritten: snap.written === true
+          };
+        }
+        if (snap.written === false && snap.error) {
+          host2.logger.warn && host2.logger.warn("[environment] \u5FEB\u7167\u672A\u843D\u76D8: " + snap.error);
+        }
+        if (failed.length) {
+          host2.logger.warn && host2.logger.warn("[environment] \u7EF4\u5EA6\u63A2\u6D4B\u5931\u8D25: " + failed.map((id) => id + "(" + secs[id].error + ")").join("; "));
+        }
+        if (pending.length) {
+          host2.logger.warn && host2.logger.warn("[environment] \u7EF4\u5EA6\u65E0\u63A2\u9488\uFF0C\u672C\u673A\u8BE5\u9879\u4E0D\u53EF\u5224: " + pending.join(","));
+        }
+        host2.logger.info && host2.logger.info("[environment] \u5DF2\u5237\u65B0\uFF1A" + Object.keys(secs).length + " \u4E2A\u7EF4\u5EA6\uFF0C\u6D4F\u89C8\u5668\u5019\u9009 " + (f && f.browsers && f.browsers.length || 0) + " \u4E2A\uFF0C\u5206\u53D1\u4F9D\u636E " + (f && f.pick && f.pick.how || "?"));
+        return f;
+      }).catch((e) => {
+        host2.logger.warn && host2.logger.warn("[environment] \u5237\u65B0\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u5B88\u536B\u4E3B\u5FAA\u73AF\uFF09: " + (e && e.message || e));
+        return null;
+      });
     }
     function _startShellWatchdog(host2) {
       if (host2.config.shellWatchdog === false) {
@@ -7302,7 +7948,7 @@ var require_bootstrap = __commonJS({
         }
       }
     }
-    module2.exports = { _bootstrap, _startShellWatchdog, _registerFixedPorts, _bindNativeDshCommand };
+    module2.exports = { _bootstrap, _startShellWatchdog, _registerFixedPorts, _bindNativeDshCommand, _refreshEnvironmentForm };
   }
 });
 
@@ -7832,7 +8478,7 @@ var require_release = __commonJS({
 });
 
 // src/platform/contract/registry.js
-var require_registry = __commonJS({
+var require_registry2 = __commonJS({
   "src/platform/contract/registry.js"(exports2, module2) {
     "use strict";
     var fs2 = require("node:fs");
@@ -7948,7 +8594,7 @@ var require_registry_config = __commonJS({
     "use strict";
     var fs2 = require("node:fs");
     var path2 = require("node:path");
-    var registryContract = require_registry();
+    var registryContract = require_registry2();
     var { writeAtomic } = require_fs();
     var policies = require_policies();
     var CONTRACT_TTL_MS = 60 * 1e3;
@@ -8106,7 +8752,7 @@ var require_matrix = __commonJS({
 });
 
 // src/platform/distribution/registry.js
-var require_registry2 = __commonJS({
+var require_registry3 = __commonJS({
   "src/platform/distribution/registry.js"(exports2, module2) {
     "use strict";
     var matrix = require_matrix();
@@ -8327,7 +8973,7 @@ var require_version_check = __commonJS({
     var { VERSION_RE } = require_version2();
     var input = require_input();
     var policies = require_policies();
-    var registry = require_registry2();
+    var registry = require_registry3();
     var ref = require_registry_ref();
     var release = require_release();
     var PKG_NAME_RE = input.PKG_NAME_RE;
@@ -8694,7 +9340,7 @@ var require_distribution = __commonJS({
     var policies = require_policies();
     var release = require_release();
     var registryConfig = require_registry_config();
-    var registry = require_registry2();
+    var registry = require_registry3();
     var versionCheck = require_version_check();
     var install = require_install();
     var { semverCompare, VERSION_RE } = require_version2();
@@ -14361,6 +15007,77 @@ var require_token = __commonJS({
   }
 });
 
+// src/app/native/npm.js
+var require_npm = __commonJS({
+  "src/app/native/npm.js"(exports2, module2) {
+    "use strict";
+    var ex2 = require_exec();
+    var runtimeContract = require_runtime();
+    function npmLaunch(host2) {
+      const h = host2 || {};
+      if (h._npmBin) {
+        return { program: h._npmBin, args: Array.isArray(h._npmBinArgs) ? h._npmBinArgs.slice() : [] };
+      }
+      const l = runtimeContract.npmLauncher();
+      return { program: l.program, args: l.args };
+    }
+    async function resolveNpmRoot(host2, opts) {
+      if (host2.npmRoot) return host2.npmRoot;
+      const l = npmLaunch(host2);
+      const r = await ex2.runOutAsync(l.program, l.args.concat(["root", "-g"]), opts || void 0);
+      return r ? r.trim() : null;
+    }
+    async function checkEnvironment(host2) {
+      const errors = [];
+      const l = npmLaunch(host2);
+      const [nv, npmv, npmRoot] = await Promise.all([
+        ex2.runOutAsync("node", ["--version"]),
+        ex2.runOutAsync(l.program, l.args.concat(["--version"])),
+        resolveNpmRoot(host2)
+      ]);
+      if (!nv || !nv.trim()) errors.push("node \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
+      if (!npmv || !npmv.trim()) errors.push("npm \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
+      return { ok: errors.length === 0, errors, npmRoot };
+    }
+    async function latestVersion(host2) {
+      if (!host2.dist || !host2.config.packageName) throw new Error("\u5206\u53D1\u670D\u52A1\u672A\u521D\u59CB\u5316\uFF0C\u65E0\u6CD5\u67E5\u8BE2\u6700\u65B0\u7248\u672C");
+      const channel = host2.config.releaseChannel || "npm";
+      return host2.dist.fetchVersionInfo(host2.config.packageName, channel);
+    }
+    async function selectRegistry(host2) {
+      if (!host2.dist) return null;
+      try {
+        return await host2.dist.registryOrigin(true);
+      } catch {
+        return null;
+      }
+    }
+    function runNpm(host2, opts) {
+      const a = opts && opts.action || "install";
+      const verb = a === "uninstall" ? "\u5378\u8F7D" : "\u5B89\u88C5";
+      if (!host2.dist) return Promise.resolve({ ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528\uFF0C\u65E0\u6CD5" + verb, output: [] });
+      const tpl = a === "install" ? host2.config.installCommandTemplate : null;
+      return host2.dist.runNpmInstall({
+        action: a,
+        pkg: host2.config.packageName || "@deepseek-ai/dsh",
+        version: opts && opts.version,
+        // 前缀单源：装与卸必须落在同一个全局前缀，否则「卸载成功」而包还在原地。
+        prefix: host2.npmRoot || null,
+        registry: opts && opts.registry,
+        // 只在显式注入过 npm 形态时接管启动形态；生产留空，由执行器按运行期契约解析一次。
+        launcher: host2._npmBin ? npmLaunch(host2) : null,
+        commandTemplate: Array.isArray(tpl) && tpl.length ? tpl : null,
+        timeoutMs: a === "uninstall" ? host2.config.uninstallTimeoutMs : host2.config.upgradeTimeoutMs,
+        onLine: (l) => {
+          host2._appendUpgradeLog(l);
+          if (host2.installing) host2._appendInstallLog(l);
+        }
+      });
+    }
+    module2.exports = { npmLaunch, resolveNpmRoot, checkEnvironment, latestVersion, selectRegistry, runNpm };
+  }
+});
+
 // src/domains/shell/journal.js
 var require_journal = __commonJS({
   "src/domains/shell/journal.js"(exports2, module2) {
@@ -15013,6 +15730,9 @@ var require_core5 = __commonJS({
     var { extension: domainConfigExtension2 } = require_domain_config();
     var logcore = require_logcore();
     var { DshTokenService } = require_token();
+    var { EnvCatalog } = require_env_catalog();
+    var npm = require_npm();
+    var FORM_NPM_ROOT_TIMEOUT_MS = 4e3;
     var { DistributionManager } = require_distribution();
     var shellDomain = require_shell();
     var { TaskRegistry } = require_tasks();
@@ -15023,6 +15743,68 @@ var require_core5 = __commonJS({
       host2.config = normalize(rawConfig, domainConfigExtension2());
       host2.configPath = typeof configPath === "string" ? configPath : null;
       platform.environment.bind({ preference: () => host2.config && host2.config.externalBrowser || null });
+      platform.environment.registerSection("runtime", {
+        label: "\u8FD0\u884C\u65F6\uFF08Node/npm/git/\u955C\u50CF\u6E90/\u5168\u5C40\u524D\u7F00\uFF09",
+        probe: async () => {
+          const cat = await new EnvCatalog(host2.config).probeAsync();
+          const m = host2.nativeManager;
+          const [reg, prefix] = await Promise.all([
+            m && m.dist && typeof m.dist.registryInfo === "function" ? Promise.resolve(m.dist.registryInfo()).catch(() => null) : Promise.resolve(null),
+            // 前缀实测就是安装/卸载用的那同一个解析口，只把超时收到表单预算内（默认 15s 会吃掉面板刷新）。
+            m ? npm.resolveNpmRoot(m, { timeoutMs: FORM_NPM_ROOT_TIMEOUT_MS }).catch(() => null) : Promise.resolve(null)
+          ]);
+          return {
+            node: cat.node,
+            npm: cat.npm,
+            git: cat.git,
+            registry: reg ? {
+              origin: reg.origin || null,
+              mode: reg.mode || null,
+              source: reg.source || null,
+              manualOrigin: reg.manualOrigin || null,
+              candidates: (reg.registries || []).map((r) => ({
+                base: r.base,
+                reachable: r.reachable === void 0 ? null : r.reachable,
+                latencyMs: r.latencyMs === void 0 ? null : r.latencyMs,
+                error: r.error || null
+              }))
+            } : null,
+            // 全局前缀只来自 `npm root -g` 的实测，拿不到就是 null：装/卸落在哪个前缀是排障第一问，
+            //   猜一个只会指错地方（壳侧的同名读数在 E4 上报接通后进这一维）。
+            prefix: prefix || null
+          };
+        }
+      });
+      platform.environment.registerSection("dsh", {
+        label: "DSH \u672C\u4F53\u4E0E\u5185\u6838\u66F4\u65B0",
+        probe: async () => {
+          const cat = new EnvCatalog(host2.config);
+          const d = typeof host2.dshenvStatus === "function" ? host2.dshenvStatus() : null;
+          if (!d) return null;
+          return {
+            dsh: cat.dshEntry(d.binOk, d.installed, d.bin),
+            selfUpdate: cat.selfUpdateEntry(),
+            managed: d.managed === true,
+            phase: d.phase || null
+          };
+        }
+      });
+      platform.environment.registerSection("startup", {
+        label: "\u542F\u52A8\u65E2\u6210\u4E8B\u5B9E\uFF08\u5B88\u536B\u8FD9\u4E00\u62CD\u8DD1\u8FC7\u4EC0\u4E48\uFF09",
+        probe: () => {
+          const s = host2._startupFacts;
+          if (!s) return null;
+          return {
+            bootAt: s.bootAt,
+            envDelayMs: s.envDelayMs,
+            routerAutostart: s.routerAutostart,
+            routerMode: s.routerMode,
+            updateCheck: s.updateCheck,
+            shellWatchdog: s.shellWatchdog,
+            lastRefresh: s.lastRefresh
+          };
+        }
+      });
       host2._fileProtectStatus = null;
       try {
         const fp = platform.fileProtect;
@@ -18777,7 +19559,12 @@ var require_oauth = __commonJS({
           waitMs: 18e4,
           opened: true,
           // 非隔离引擎（Safari/打包器包装）由平台层降级：账号隔离不成立，换账号只能靠超时重发或手动窗口。
-          isolated: ev.isolated === true
+          isolated: ev.isolated === true,
+          // 为什么隔离成立/不成立必须一起交出：面板上一句「未隔离」既没说原因也没法处置。
+          //   basis 来自环境表单的出网条件维度（cold-profile-blocked 即冷档案注定空白），
+          //   与「引擎不支持隔离」是两种不同原因，分开才谈得上分开修（配代理 vs 换浏览器）。
+          isolatedBasis: ev.egress ? ev.egress.basis : ev.isolated === true ? "isolated" : "engine-not-isolatable",
+          isolatedDetail: ev.egress ? ev.egress.detail || null : null
         });
       }
       async function commandcodeLoginWait(timeoutMs) {
@@ -24138,7 +24925,7 @@ var require_heartbeat = __commonJS({
 });
 
 // src/app/control/registry.js
-var require_registry3 = __commonJS({
+var require_registry4 = __commonJS({
   "src/app/control/registry.js"(exports2, module2) {
     "use strict";
     var fs2 = require("node:fs");
@@ -24709,77 +25496,6 @@ var require_manifest = __commonJS({
   }
 });
 
-// src/app/native/npm.js
-var require_npm = __commonJS({
-  "src/app/native/npm.js"(exports2, module2) {
-    "use strict";
-    var ex2 = require_exec();
-    var runtimeContract = require_runtime();
-    function npmLaunch(host2) {
-      const h = host2 || {};
-      if (h._npmBin) {
-        return { program: h._npmBin, args: Array.isArray(h._npmBinArgs) ? h._npmBinArgs.slice() : [] };
-      }
-      const l = runtimeContract.npmLauncher();
-      return { program: l.program, args: l.args };
-    }
-    async function resolveNpmRoot(host2) {
-      if (host2.npmRoot) return host2.npmRoot;
-      const l = npmLaunch(host2);
-      const r = await ex2.runOutAsync(l.program, l.args.concat(["root", "-g"]));
-      return r ? r.trim() : null;
-    }
-    async function checkEnvironment(host2) {
-      const errors = [];
-      const l = npmLaunch(host2);
-      const [nv, npmv, npmRoot] = await Promise.all([
-        ex2.runOutAsync("node", ["--version"]),
-        ex2.runOutAsync(l.program, l.args.concat(["--version"])),
-        resolveNpmRoot(host2)
-      ]);
-      if (!nv || !nv.trim()) errors.push("node \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
-      if (!npmv || !npmv.trim()) errors.push("npm \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
-      return { ok: errors.length === 0, errors, npmRoot };
-    }
-    async function latestVersion(host2) {
-      if (!host2.dist || !host2.config.packageName) throw new Error("\u5206\u53D1\u670D\u52A1\u672A\u521D\u59CB\u5316\uFF0C\u65E0\u6CD5\u67E5\u8BE2\u6700\u65B0\u7248\u672C");
-      const channel = host2.config.releaseChannel || "npm";
-      return host2.dist.fetchVersionInfo(host2.config.packageName, channel);
-    }
-    async function selectRegistry(host2) {
-      if (!host2.dist) return null;
-      try {
-        return await host2.dist.registryOrigin(true);
-      } catch {
-        return null;
-      }
-    }
-    function runNpm(host2, opts) {
-      const a = opts && opts.action || "install";
-      const verb = a === "uninstall" ? "\u5378\u8F7D" : "\u5B89\u88C5";
-      if (!host2.dist) return Promise.resolve({ ok: false, error: "dist \u5206\u53D1\u670D\u52A1\u4E0D\u53EF\u7528\uFF0C\u65E0\u6CD5" + verb, output: [] });
-      const tpl = a === "install" ? host2.config.installCommandTemplate : null;
-      return host2.dist.runNpmInstall({
-        action: a,
-        pkg: host2.config.packageName || "@deepseek-ai/dsh",
-        version: opts && opts.version,
-        // 前缀单源：装与卸必须落在同一个全局前缀，否则「卸载成功」而包还在原地。
-        prefix: host2.npmRoot || null,
-        registry: opts && opts.registry,
-        // 只在显式注入过 npm 形态时接管启动形态；生产留空，由执行器按运行期契约解析一次。
-        launcher: host2._npmBin ? npmLaunch(host2) : null,
-        commandTemplate: Array.isArray(tpl) && tpl.length ? tpl : null,
-        timeoutMs: a === "uninstall" ? host2.config.uninstallTimeoutMs : host2.config.upgradeTimeoutMs,
-        onLine: (l) => {
-          host2._appendUpgradeLog(l);
-          if (host2.installing) host2._appendInstallLog(l);
-        }
-      });
-    }
-    module2.exports = { npmLaunch, resolveNpmRoot, checkEnvironment, latestVersion, selectRegistry, runNpm };
-  }
-});
-
 // src/app/native/ops.js
 var require_ops4 = __commonJS({
   "src/app/native/ops.js"(exports2, module2) {
@@ -25424,7 +26140,7 @@ var require_installer = __commonJS({
 var require_entry = __commonJS({
   "src/app/control/entry.js"(exports2, module2) {
     "use strict";
-    var { PHASES } = require_registry3();
+    var { PHASES } = require_registry4();
     var ManagedLifecycle = class {
       constructor(opts) {
         this.id = opts.id || "lc-" + Math.random().toString(36).slice(2, 8);
@@ -25678,7 +26394,7 @@ var require_domains = __commonJS({
     var { InstanceManager } = require_instance();
     var { PluginMarket } = require_market();
     var { PluginManager } = require_plugin();
-    var { ManagedRegistry } = require_registry3();
+    var { ManagedRegistry } = require_registry4();
     var { guardVersion } = require_version();
     var { Lifecycle } = require_lifecycle2();
     var { Health } = require_health();
@@ -25805,7 +26521,7 @@ var require_adapters = __commonJS({
   "src/app/control/adapters.js"(exports2, module2) {
     "use strict";
     var { ManagedLifecycle } = require_entry();
-    var { kindMeta } = require_registry3();
+    var { kindMeta } = require_registry4();
     function capsOf(objectKind) {
       const m = kindMeta(objectKind);
       if (!m) return { startable: true, guardable: true };
@@ -26304,7 +27020,7 @@ var require_guard = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function owns(pathname) {
-      return pathname === "/changelog" || pathname.startsWith("/guard/") || pathname === "/autostart" || pathname.startsWith("/settings/") || pathname.startsWith("/self-update/") || pathname === "/env/dsh" || pathname === "/env/status" || pathname === "/env/node-lts" || pathname === "/env/open-url" || pathname === "/env/environment" || pathname === "/ports" || pathname === "/shutdown";
+      return pathname === "/changelog" || pathname.startsWith("/guard/") || pathname === "/autostart" || pathname.startsWith("/settings/") || pathname.startsWith("/self-update/") || pathname === "/env/dsh" || pathname === "/env/status" || pathname === "/env/node-lts" || pathname === "/env/open-url" || pathname === "/env/environment" || pathname === "/env/environment/last" || pathname === "/ports" || pathname === "/shutdown";
     }
     function fetchDshChangelog(res, sup) {
       const v = sup && sup.nativeManager ? sup.nativeManager.versionInfo() : {};
@@ -26511,7 +27227,14 @@ var require_guard = __commonJS({
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
         const force = /[?&]force=1/.test(String(req.url || ""));
-        return Promise.resolve(environment.form({ force, persist: force })).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: "\u73AF\u5883\u8868\u5355\u88C5\u914D\u5931\u8D25\uFF1A" + (e && e.message || e) }));
+        return Promise.resolve(force ? environment.refresh({ persist: true, force: true }) : environment.form()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: "\u73AF\u5883\u8868\u5355\u88C5\u914D\u5931\u8D25\uFF1A" + (e && e.message || e) }));
+      }
+      if (req.method === "GET" && pathname === "/env/environment/last") {
+        if (!originAllowed(req, sup.config.apiPort)) {
+          req.resume();
+          return send(403, { ok: false, error: "cross-origin request rejected" });
+        }
+        return send(200, environment.lastSnapshot());
       }
       if (req.method === "POST" && pathname === "/env/open-url") {
         if (!identity.loopback) {