@linxin666/dsh-remote-web-ui 0.3.22 → 0.3.24

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   node scripts/verify-docs.mjs --write <dir>
-README.md: 8e93c9e36c4c1cb042df29d494419347181142b0
-README.zh.md: fb6955a0be096fe3d04cff2600484409c8b62df9
+README.md: 0b2dd290c6a1f829ffc74c5fb465b4afe860f34a
+README.zh.md: 174d0ccc8b1c5d7ff5d98f9301b6b9a016180577

package/README.md

@@ -66,6 +66,8 @@ Restart the profile (`dsh web`), then open the phone icon in the sidebar foot. T
 
 ## Remote access over the internet (tunnels)
 
+A tunnel process restart — most often a mobile network dropping and reconnecting — used to drop the public host from the pairing fence the moment the tunnel left `running`, so the address still printed in the QR code answered 403, including on the deliberately public `/api/pair/status` (issue #1547). A named tunnel's fixed hostname and a registered relay origin never change, so both now stay trusted throughout the reconnect; a quick tunnel's previous host stays trusted for a 60 s grace window, because the edge may still be delivering a connection the phone already opened, and is dropped only if the tunnel has not come back by then.
+
 ### One-click public tunnel (recommended)
 
 Set **自动公网隧道** (autoTunnel) in the settings card. The plugin runs its own Cloudflare quick tunnel (`cloudflared` ships with the package), feeds the minted public URL into the QR base and the pairing fence dynamically, and keeps the posture probe informed — a phone anywhere can pair at any time. The manual public address and the named-tunnel token below are ignored while this is on. The minted hostname is ephemeral and changes on every `dsh web` restart — the stable-hostname relay below keeps the phone's origin fixed across those restarts.
@@ -134,6 +136,7 @@ Pinned to the 0.1.2-alpha.2 line; the seams this build relies on:
 - **`sidebar.footer.action` foot seat** (the 0.1.2 shell composition): the sidebar declares and renders the seat the remote entry occupies.
 - **`ctx.layout.toggleSidebar()`** (packages/client/ui-layout): the whale button expands the collapsed sidebar through the official panel-action face.
 - **`ctx.connection.authenticatedUrl()`** (packages/client/connection): the sanctioned launch-token seam the proxy redeems once for its inner credential (`src/inner-auth.ts`), so re-issued `/api` calls satisfy the harness browser-auth check.
+- **`__DSH_FILE_UPLOAD__`** (file-upload client hooks): the optional pre-Cordis transport the upload service reads once at construction. The remote boot patch publishes it so background uploads stay on the rewritten main-thread fetch instead of a Web Worker that escapes the channel (issue #1580).
 - **`__DSH_TRANSPORT__.ownsHost`** (client-connection transport hooks): the host-mode flip for paired remote desktops. There is no host-side per-method privilege pin on this line — the configuration plane branches on `connection.isLoopback` in the client — and no `api/gate` waterfall either (the gate listener stays mounted for deployments that gain the seam; pairing enforcement lives on this plugin's own `/remote` channel).
 - **User-patch bind semantics**: same-id patch rows replace the row config wholesale, and the user patch layer cannot evaluate `webStartup`-dependent `!!js` expressions reliably — the LAN bind block therefore materializes static values and the plugin re-asserts it every boot.
 
@@ -158,6 +161,7 @@ The public path is the same round trip through a tunnel (see "Remote access over
 - **Cohort reality: pairing does not gate direct `/api`.** On the pinned 0.1.2-alpha.2 line nothing emits the `api/gate` seam, so a direct `/api` call from a LAN origin is governed solely by the harness fence (which auto-trusts LAN literals under a `0.0.0.0` bind) plus the harness browser-auth cookie. A browser credential a device has already redeemed therefore survives 停止/取消配对 until its natural expiry (30 days) — revocation binds the `/remote` channel and the pairing cookie, not that credential. The plugin probes the `/api` posture and warns loudly; treat a LAN-exposed bind as a deliberate decision, and prefer loopback plus tunnels when the machine is shared.
 - **A paired device is a full-control credential.** With host mode active it reaches the complete host API — chat, sessions, settings, credentials, agent presets, deliverables — mirroring the SDK's own stance that a loopback desktop is trusted. Only the three control planes (pairing, self-update, plugin install/remove) stay physically local. Only pair devices you control; 停止 or per-device 取消配对 revokes immediately.
 - **Control endpoints stay loopback-only**: mint/stop/revoke, the device roster, the lan-bind status, and the update endpoints answer only to loopback. A LAN-origin browser sees the "配对面板仅限本机使用" banner.
+- **Background file uploads ride the channel too.** The official upload service prefers a Web Worker carrier whose own globals no main-thread patch reaches, so the boot patch (and the browser patch as a fallback) publishes the official pre-Cordis hook `__DSH_FILE_UPLOAD__` and hands it the patched `fetch`: the raw `/api/session/uploadFileBinary` POST is rewritten onto `/remote` and carries the device credential exactly like every other gated call. Without the hook a paired browser's uploads bypass the channel and the harness browser-auth fence answers 401 (issue #1580). The hook is only published on non-loopback origins, only while the channel is installed, and never overwrites a hook the page already owns.
 - **The app landing is cookieless-optional.** After pairing, the QR lands the device on `/pair-app`, served by this plugin: the official shell is delivered without passing the harness index gate, and the device credential rides a `x-dsh-remote-device` header (fetch) / `device` query (WebSocket upgrades) that the boot patch attaches from sessionStorage. The flow therefore works when the device browser blocks all cookies; the pairing cookie remains the primary credential where the browser stores it, and the harness browser-auth cookie is no longer required on the phone path at all.
 - **Reopens are owned by a service worker (https origins).** A paired phone returning from history, a bookmark, or tab restore navigates to bare `/` — a path the plugin does not own, where the harness fallback seat answers with its browser-auth 401 (the cookieless flow never holds that credential). The app shell therefore registers `/pair-app.sw.js` (fenced like `/pair-app`; the script is inert logic with no secrets): it intercepts navigations to `/` only, re-serves the shell network-first through `/pair-app` — which re-validates the device cookie and refreshes its presence, so every reopen also keeps the session alive — falls back to the cached shell offline, and passes the navigation through when the plugin no longer answers (a revoked device then sees the harness response or the bilingual re-scan page). Plain-HTTP LAN origins are not secure contexts and never register the worker; there a reopen means scanning a fresh QR.
 - **Revocation is per-request**: a paired device whose request is already in flight when 停止 lands completes that request; the next one 403s.

package/README.zh.md

@@ -66,6 +66,8 @@ dsh plugin --profile web add link:$(pwd)/packages/dsh-remote-web-ui
 
 ## 通过互联网远程访问（隧道）
 
+隧道进程重启（最常见的原因是移动网络闪断重连）过去会让插件在隧道离开 `running` 的瞬间把公网主机移出配对栅栏，于是二维码上仍显示着的地址会返回 403——连有意公开的 `/api/pair/status` 也不例外（issue #1547）。命名隧道的固定主机名与已注册的中继源本来就不会变，现在在整个重连期间保持受信任；快速隧道的上一个地址保留 60 秒宽限期（边缘可能仍在投递手机已经建立的连接），只有到期仍未恢复才彻底失效。
+
 ### 一键公网隧道（推荐）
 
 在设置卡片打开**自动公网隧道**（autoTunnel）。插件运行自己的 Cloudflare 快速隧道（`cloudflared` 随包分发），把铸造的公网 URL 动态喂给二维码与配对栅栏，并同步姿态探测——手机随时随地都能配对。开启期间忽略下方手动公网地址与命名隧道令牌。铸造的域名是临时的，每次 `dsh web` 重启都会变化——下方的固定域名中继会把手机的访问源钉在固定地址上，重启不再需要重新扫码。
@@ -134,6 +136,7 @@ pnpm run build
 - **`sidebar.footer.action` 底部席位**（0.1.2 shell 组合）：侧栏声明并渲染远程入口占据的席位。
 - **`ctx.layout.toggleSidebar()`**（packages/client/ui-layout）：鲸鱼按钮经官方面板动作面展开折叠侧栏。
 - **`ctx.connection.authenticatedUrl()`**（packages/client/connection）：代理为内部凭据一次性兑换启动令牌的官方接缝（`src/inner-auth.ts`），使再发起的 `/api` 调用满足 harness 浏览器认证校验。
+- **`__DSH_FILE_UPLOAD__`**（file-upload 客户端钩子）：上传服务在构造时读取一次的可选启动前传输。远程引导补丁会发布它，使后台上传留在被改写的主线程 fetch 上，而不是逃出通道的 Web Worker（issue #1580）。
 - **`__DSH_TRANSPORT__.ownsHost`**（client-connection 传输钩子）：配对远程桌面的 host 模式翻转。本线没有 host 侧按方法特权锁定——配置面在客户端按 `connection.isLoopback` 分支——也没有 `api/gate` 瀑布（gate 监听器保持挂载，待未来部署获得该接缝；配对强制在插件自己的 `/remote` 通道上）。
 - **用户补丁绑定语义**：同 id 补丁行整行替换 config，且用户补丁层无法可靠求值依赖 `webStartup` 的 `!!js` 表达式——局域网绑定块因此落静态值，插件每次启动重断言。
 
@@ -158,6 +161,7 @@ pnpm run build
 - **本 cohort 的现实：配对不门控直连 `/api`。** 在锚定的 0.1.2-alpha.2 线上，没有任何组件发出 `api/gate` seam，因此来自局域网源头的直连 `/api` 仅由 harness 围栏（`0.0.0.0` 绑定下自动信任局域网字面量）加 harness 浏览器认证 cookie 约束。设备已经兑换过的浏览器凭据在停止/取消配对后仍然有效，直到其自然过期（30 天）——撤销约束的是 `/remote` 通道与配对 cookie，而不是那个凭据。插件会对 `/api` 姿态做探测并大声告警；请把局域网绑定当作深思熟虑的决定，在共享机器上优先回环加隧道。
 - **配对设备是完全控制凭据。** host 模式下它可达完整 host API——聊天、会话、设置、凭据、Agent 预设、产出物——与 SDK 对回环桌面的信任一致。只有三个控制面（配对、自更新、插件安装/卸载）保持物理本地。只配对你控制的设备；停止或逐设备取消配对立即撤销。
 - **控制端点仅限回环**：铸造/停止/撤销、设备列表、lan-bind 状态与更新端点只应答回环。局域网源浏览器看到「配对面板仅限本机使用」横幅。
+- **后台文件上传同样走通道。** 官方上传服务优先使用 Web Worker 载体，其独立全局对象不受主线程补丁影响；因此引导补丁（以及作为兜底的浏览器补丁）会发布官方启动前钩子 `__DSH_FILE_UPLOAD__`，并把打过补丁的 `fetch` 交给它：原始 `/api/session/uploadFileBinary` POST 会被改写到 `/remote`，并像其他受门控调用一样携带设备凭据。没有该钩子时，配对浏览器的上传会绕过通道，被 harness 浏览器认证围栏拒为 401（issue #1580）。该钩子仅在非回环源、且通道安装期间发布，且永不覆盖页面已有的钩子。
 - **应用落地页不依赖 cookie。** 配对后二维码把设备带到 `/pair-app`——由本插件直接交付官方应用壳，不经过 harness 索引认证门；设备凭据经 `x-dsh-remote-device` 请求头（fetch）与 `device` 查询参数（WebSocket 升级）由引导补丁从 sessionStorage 挂载。因此手机浏览器完全禁用 cookie 时链路依然成立；有 cookie 时配对 cookie 仍是主凭据，手机路径不再需要 harness 浏览器认证 cookie。
 - **重开由 service worker 接管（仅 https 源）。** 配对过的手机从历史、书签或标签恢复回来时导航到裸 `/`——插件不拥有的路径，harness 兜底座会用浏览器认证 401 应答（不依赖 cookie 的流程永远拿不到那份凭据）。应用壳因此注册 `/pair-app.sw.js`（与 `/pair-app` 同一栅栏；脚本是不含任何秘密的惰性逻辑）：只拦截对 `/` 的导航，经 `/pair-app` 网络优先地重发应用壳——同时校验设备 cookie 并刷新其活跃时间，每次重开也在为会话续期——离线时回退缓存的壳，插件不再应答时把导航原样放行（被撤销的设备随后看到 harness 应答或双语重扫页）。纯 HTTP 的局域网源不是安全上下文，永远不会注册该 worker；那里的重开意味着重新扫码。
 - **撤销按请求生效**：停止落地时已在途的请求会完成；下一个请求 403。

package/lib/client.js

@@ -4070,7 +4070,9 @@ window.__ModuleLoader__.load({
 			],
 			deviceHeader: REMOTE_DEVICE_HEADER,
 			deviceKey: "dsh-remote-device",
-			deviceQuery: REMOTE_DEVICE_QUERY
+			deviceQuery: REMOTE_DEVICE_QUERY,
+			uploadPath: "/api/session/uploadFileBinary",
+			uploadHookGlobal: "__DSH_FILE_UPLOAD__"
 		};
 		/** The window global the boot patch publishes its seat under. */
 		const REMOTE_CHANNEL_BOOT_GLOBAL = "__DSH_REMOTE_CHANNEL_BOOT__";
@@ -4218,6 +4220,7 @@ window.__ModuleLoader__.load({
 			const originalFetch = window.fetch;
 			const OriginalWebSocket = window.WebSocket;
 			const OriginalEventSource = window.EventSource;
+			const restoreUploadHook = installFileUploadHook(window);
 			const sameOrigin = (url) => url.origin === window.location.origin;
 			const rewrite = (raw) => rewriteRawUrl(raw, window.location.href, window.location.origin);
 			const device = (() => {
@@ -4303,6 +4306,46 @@ window.__ModuleLoader__.load({
 				window.WebSocket = OriginalWebSocket;
 				if (OriginalEventSource !== void 0) window.EventSource = OriginalEventSource;
 				for (const restore of restoreSrc) restore();
+				restoreUploadHook();
+			};
+		}
+		/**
+		* Publish the official pre-Cordis upload hook so background uploads keep
+		* riding the patched main-thread fetch (issue #1580).
+		*
+		* `@deepseek-ai/dsh-client-file-upload` reads `globalThis.__DSH_FILE_UPLOAD__`
+		* once when its runtime is constructed; without it the carrier is a Web
+		* Worker, whose own globals no main-thread patch reaches. That worker's XHR
+		* goes straight to `<origin>/api/session/uploadFileBinary` with neither the
+		* `/remote` rewrite nor the cookieless device credential, so the harness
+		* browser-auth fence answers 401 and every upload from a paired browser
+		* fails. Rewriting the worker URL cannot fix it: a worker context carries
+		* neither the pairing cookie nor the device header.
+		*
+		* The hook hands the runtime the same transport the rest of the page uses -
+		* the boot script publishes an identical one (remote-channel-boot.ts), and
+		* this is the fallback for pages served without it.
+		*
+		* @param window - the browser window (or a test double), BEFORE the channel patch.
+		* @returns a function retiring the hook (a pre-existing one is left alone).
+		*/
+		function installFileUploadHook(window) {
+			if (window.__DSH_FILE_UPLOAD__ !== void 0) return () => {};
+			const originalFetch = window.fetch;
+			const hook = { fetch: (input, init) => {
+				const raw = typeof input === "string" ? input : input.href;
+				let url;
+				try {
+					url = new URL(raw, window.location.href);
+				} catch {
+					return originalFetch.call(window, input, init);
+				}
+				if (url.origin === window.location.origin && url.pathname === RULES.uploadPath) return window.fetch.call(window, raw, init);
+				return originalFetch.call(window, input, init);
+			} };
+			window.__DSH_FILE_UPLOAD__ = hook;
+			return () => {
+				if (window.__DSH_FILE_UPLOAD__ === hook) delete window.__DSH_FILE_UPLOAD__;
 			};
 		}
 		/**
@@ -4453,7 +4496,7 @@ window.__ModuleLoader__.load({
 		/** The building package's version, when the bundle carries it. */
 		function bakedVersion() {
 			try {
-				return "0.3.22";
+				return "0.3.24";
 			} catch {
 				return;
 			}
@@ -4537,6 +4580,12 @@ window.__ModuleLoader__.load({
 		const COMPACT_CLASS = "dsh-remote-compact-picker";
 		/** Body class while the header actions are seated in the tabs row. */
 		const HEADER_SEATED_CLASS = "dsh-remote-header-seated";
+		/**
+		* Width the seated header actions paint over the tabs row, as a CSS variable
+		* on <html>. The row caps its own width with it (see the v80 rules) instead of
+		* reserving the space with padding.
+		*/
+		const HEADER_RESERVE_VAR = "--dsh-remote-header-actions-reserve";
 		/** Locale-dependent fast path for the official picker cells (zh/en). */
 		const PICKER_CELL_PATTERN = {
 			model: /模型|Model/,
@@ -4635,6 +4684,9 @@ window.__ModuleLoader__.load({
 			"[class$=\"_composerSeat\"] [class$=\"_frame\"] [class$=\"_card\"]{max-width:none;width:100%}",
 			`body.${HEADER_SEATED_CLASS} [class$="_header"] [class$="_titleCluster"] [class$="_headerActions"]{position:absolute;left:0;top:0;margin:0;display:flex;align-items:center;gap:6px;flex:none;z-index:2}`,
 			"[class$=\"_header\"] [class$=\"_tabs\"] [class*=\"_tab\"]{font-size:12px;white-space:nowrap}",
+			`body.${HEADER_SEATED_CLASS} [class$="_header"] [class$="_tabs"]{max-width:max(0px,calc(100% - var(${HEADER_RESERVE_VAR},0px)));overflow-x:auto;overflow-y:hidden;scrollbar-width:none;-webkit-overflow-scrolling:touch;padding-bottom:2px;margin-bottom:-2px}`,
+			`body.${HEADER_SEATED_CLASS} [class$="_header"] [class$="_tabs"]::-webkit-scrollbar{display:none}`,
+			`body.${HEADER_SEATED_CLASS} [class$="_header"] [class$="_tabs"] > [class*="_tab"]{flex:0 0 auto}`,
 			`body.${ACTIVE_CLASS} [class$=\"_detailsCol\"]{display:none !important}`,
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"ssh\"],`,
 			`body.${ACTIVE_CLASS} [data-dsh-plugin=\"skill-explorer\"],`,
@@ -5053,7 +5105,9 @@ window.__ModuleLoader__.load({
 				let dx = translate !== null ? parseFloat(translate[1] ?? "0") : 0;
 				let dy = translate !== null ? parseFloat(translate[2] ?? "0") : 0;
 				const actionsRect = actions.getBoundingClientRect();
-				const rightDiff = tabs.getBoundingClientRect().right - actionsRect.right;
+				const headerRect = header.getBoundingClientRect();
+				const headerStyle = getComputedStyle(header);
+				const rightDiff = headerRect.right - (parseFloat(headerStyle.paddingRight) || 0) - (parseFloat(headerStyle.borderRightWidth) || 0) - actionsRect.right;
 				if (Math.abs(rightDiff) >= .5) dx = Math.round((dx + rightDiff) * 10) / 10;
 				const tabBottom = textBottom(tabBtn);
 				if (tabBottom !== null) {
@@ -5070,10 +5124,12 @@ window.__ModuleLoader__.load({
 				const next = `translate(${dx}px, ${dy}px)`;
 				if (actions.style.transform !== next) actions.style.transform = next;
 				const reserve = `${Math.ceil(actionsRect.width) + 8}px`;
-				if (tabs.style.paddingRight !== reserve) tabs.style.paddingRight = reserve;
+				const rootStyle = document.documentElement.style;
+				if (rootStyle.getPropertyValue(HEADER_RESERVE_VAR) !== reserve) rootStyle.setProperty(HEADER_RESERVE_VAR, reserve);
 			}
 			function unseatHeaderActions() {
 				document.body.classList.remove(HEADER_SEATED_CLASS);
+				document.documentElement.style.removeProperty(HEADER_RESERVE_VAR);
 				const header = document.querySelector("[class$=\"_header\"]");
 				const tabs = header !== null ? header.querySelector("[class$=\"_tabs\"]") : null;
 				const actions = header !== null ? header.querySelector("[class$=\"_titleCluster\"] [class$=\"_headerActions\"]") : null;
@@ -5382,6 +5438,129 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/client/plugin-card-seat.ts
+		/**
+		* Family plugin-card seat.
+		*
+		* A family plugin contributes its settings card to whichever plugin-card seat
+		* the running host actually renders:
+		*
+		* - `web-ui.plugin.item` — the list seat declared by the dsh-web-settings
+		*   group section (this family's own first-level "Web UI plugins" section);
+		* - `settings.plugin.item` — the official keyed seat of the harness's
+		*   `ui-settings-plugins` tab, keyed by the settings namespace the card edits.
+		*
+		* SEAT SELECTION IS NOT A DECLARATION PROBE. The official `ui-settings-plugins`
+		* row belongs to the harness bundle and its `configurable` tab always declares
+		* `settings.plugin.item` before any external plugin's `apply()` runs, so
+		* "is the official seat declared?" answers yes even in the deployment whose
+		* whole point is the family group. Choosing on that probe sends every family
+		* card to the official Plugins tab and leaves the group's own section
+		* permanently empty — the family of reports where the section renders its
+		* heading and zero cards.
+		*
+		* The signal that actually distinguishes the two deployments is whether
+		* dsh-web-settings is loaded: it is the package that owns the group section and
+		* it publishes the `webUiSettings` service during `apply()`, which every
+		* family plugin already reads for its settings scope. Group loaded -> the family
+		* seat; group absent -> the official seat.
+		*
+		* The decision is re-evaluated on every `slots/changed` because the group may
+		* apply after this plugin (the family aggregate orders it first, a profile that
+		* installs the group separately need not): the initial contribution goes to the
+		* official seat, then moves to the family seat the moment the group's section
+		* registers. The entry is disposed before the replacement is registered, so a
+		* card is never in two seats at once.
+		*
+		* The shared tree has no client-SDK dependency, so this module reads its
+		* context through the structural shape below; callers pass the plugin's own
+		* `ctx`.
+		*/
+		/** The family list seat key. */
+		const FAMILY_PLUGIN_CARD_SEAT = "web-ui.plugin.item";
+		/** The official keyed plugin-card seat key. */
+		const OFFICIAL_PLUGIN_CARD_SEAT = "settings.plugin.item";
+		/** The service dsh-web-settings publishes while it is loaded. */
+		const FAMILY_GROUP_SERVICE = "webUiSettings";
+		/**
+		* Whether the family group (dsh-web-settings) is loaded in this page. The
+		* service is the group package's own contract, so the probe cannot be fooled
+		* by a harness release that starts declaring the official seat differently.
+		*/
+		function familyGroupLoaded(ctx) {
+			const get = ctx.get;
+			if (typeof get !== "function") return false;
+			try {
+				return get.call(ctx, FAMILY_GROUP_SERVICE) !== void 0;
+			} catch {
+				return false;
+			}
+		}
+		/** Report a refused registration instead of leaving the user with no card. */
+		function warnRefusedSeat(seat, error) {
+			try {
+				console.warn(`[dsh-web] plugin card registration into "${seat}" was refused; the card will not render`, error);
+			} catch {}
+		}
+		/**
+		* Contribute one family plugin card to the seat this host renders, following
+		* the group if it loads later. The entry is disposed and re-registered on a
+		* seat change, never duplicated.
+		* @param ctx - client context (its slot registry decides the seat).
+		* @param seat - the card contribution.
+		*/
+		function installPluginCard(ctx, seat) {
+			const slots = ctx.slots;
+			const component = seat.component;
+			const inject = seat.inject;
+			let dispose;
+			let current;
+			/**
+			* Re-entrancy latch. The registry emits a change event synchronously from
+			* inside both `register` and the previous entry's disposer, so an unguarded
+			* reconcile would re-enter itself mid-move and register the card twice into
+			* the seat it is leaving ("already has an entry for key ...").
+			*/
+			let reconciling = false;
+			/** Reconcile the contribution with the currently live seat (no-op when unchanged). */
+			const reconcile = () => {
+				if (reconciling) return;
+				const target = familyGroupLoaded(ctx) ? FAMILY_PLUGIN_CARD_SEAT : OFFICIAL_PLUGIN_CARD_SEAT;
+				if (current === target) return;
+				reconciling = true;
+				const previous = dispose;
+				dispose = void 0;
+				current = void 0;
+				previous?.();
+				try {
+					dispose = slots.register(target === "web-ui.plugin.item" ? {
+						name: FAMILY_PLUGIN_CARD_SEAT,
+						id: seat.id,
+						...seat.order === void 0 ? {} : { order: seat.order },
+						...seat.label === void 0 ? {} : { label: seat.label },
+						locale: seat.locale,
+						...seat.inject === void 0 ? {} : { inject }
+					} : {
+						name: OFFICIAL_PLUGIN_CARD_SEAT,
+						key: seat.namespace,
+						locale: seat.locale,
+						...seat.inject === void 0 ? {} : { inject }
+					}, component);
+					current = target;
+				} catch (error) {
+					warnRefusedSeat(target, error);
+				} finally {
+					reconciling = false;
+				}
+			};
+			if (typeof ctx.on === "function") try {
+				ctx.on("slots/changed", () => {
+					reconcile();
+				});
+			} catch {}
+			reconcile();
+		}
+		//#endregion
 		//#region src/client/index.ts
 		/**
 		* Remote control — browser half. Registers the `remote` dictionaries, the
@@ -5482,23 +5661,17 @@ window.__ModuleLoader__.load({
 				};
 			});
 			const remoteSettings = new RemoteSettingsCardController(settingsScope);
-			ctx.slots.inject("web-ui.plugin.item", () => {
-				try {
-					const unregister = ctx.slots.register({
-						name: "web-ui.plugin.item",
-						id: "remote-web-ui",
-						order: 90,
-						locale: NS,
-						inject: () => remoteSettings.inject()
-					}, RemoteSettingsCard);
-					return () => {
-						remoteSettings.dispose();
-						unregister();
-					};
-				} catch {
-					return () => {};
-				}
+			installPluginCard(ctx, {
+				namespace: REMOTE_WEB_UI_NS,
+				id: "remote-web-ui",
+				order: 90,
+				locale: NS,
+				inject: () => remoteSettings.inject(),
+				component: RemoteSettingsCard
 			});
+			ctx.effect(() => () => {
+				remoteSettings.dispose();
+			}, "remote-web-ui: settings card");
 			let disposeRuntime;
 			const syncRuntime = () => {
 				if (enabled() && disposeRuntime === void 0) disposeRuntime = ctx.effect(() => {