@linxin666/dsh-remote-web-ui 0.4.1 → 0.4.3

package/src/client/locales.ts

@@ -15,7 +15,7 @@ export const zh = {
   'status.disconnected': '已配对设备离线',
   'status.stopped': '已停止远程访问',
   'status.lanRequired': '此功能需要局域网绑定或公网地址才能使用',
-  'status.lanRequiredHint': '当前服务仅绑定在 127.0.0.1 且未配置公网地址，手机无法访问。请在「设置 → Web 插件 → 远程访问设置」卡片中打开“局域网访问”，或用 dsh web --host 0.0.0.0 重新启动，或填写内网穿透的公网地址。',
+  'status.lanRequiredHint': '当前服务仅绑定在 127.0.0.1 且未配置公网地址，手机无法访问。请在本插件的设置卡片中打开“局域网访问”（装在全家桶里时在「设置 → Web 插件 → 远程访问设置」，单独安装时在设置 → 插件 → 本插件行），或用 dsh web --host 0.0.0.0 重新启动，或填写内网穿透的公网地址。',
   'status.loopbackRequired': '配对面板仅限本机使用',
   'status.loopbackRequiredHint': '请通过 http://127.0.0.1 打开此页面后重试；手机请使用配对链接访问。',
   'status.unreachable': '无法连接配对服务',
@@ -123,48 +123,6 @@ export const zh = {
   'settings.saveFailed': '部署未接受这些值，已保留供你修改。',
   'settings.invalidNumber': '请输入数字，留空则使用默认值。',
   // 更新面板（侧边栏更新按钮）。
-  'update.label': '检查更新',
-  'update.badge': '有更新',
-  'update.availableLabel': '发现新版本，检查更新',
-  'update.title': '检查更新',
-  'update.checking': '正在检查远程仓库中的新版本…',
-  'update.upToDate': '当前已是最新版本',
-  'update.upToDateDetail': '{name} 已是最新版本 v{version}。',
-  'update.found': '发现新版本',
-  'update.foundDetail': '{name} 有新版本 v{version}。确认后开始更新。',
-  'update.start': '开始更新',
-  'update.updating': '正在更新 {name} 至 v{version}，可能需要 1-2 分钟…',
-  'update.cooldownNotice': '本次更新由你主动触发，将跳过 pnpm 的 24 小时发布冷却期（供应链保护）直接安装所选版本。',
-  'update.updatingTitle': '正在更新…',
-  'update.done': '更新完成',
-  'update.doneDetail': '所有组件已更新到最新版本。',
-  'update.restartHint': '请重启 dsh web 使新版本生效：在终端按 Ctrl+C 停止后重新运行 dsh web。',
-  'update.linkMode': '当前为本地开发模式',
-  'update.linkModeDetail': 'dsh-web 或其组件通过本地链接安装（开发模式），无法自动更新。npm 上最新版本：{version}。请同步本地仓库，或移除与全家桶重复的独立链接。',
-  'update.missing': '未找到 dsh-web 安装',
-  'update.missingDetail': '无法定位已安装的 dsh-web 聚合包。请先运行 dsh plugin --profile <profile> add @linxin666/dsh-web-all。',
-  'update.offline': '无法连接更新源',
-  'update.offlineDetail': '网络不可用或更新服务异常，请稍后重试。',
-  'update.unmounted': '更新服务未加载',
-  'update.unmountedDetail': '当前 dsh web 进程运行的插件版本不含更新服务，请重启 dsh web（Ctrl+C 后重新运行）后再试。',
-  'update.error': '更新失败',
-  'update.packages': '组件版本',
-  'update.releaseNotes': 'v{version} 更新说明',
-  'update.releaseFeatures': '新增功能',
-  'update.releaseFixes': '修复',
-  'update.releaseOther': '其他变动',
-  'update.releaseUnavailable': '本次发布说明暂不可用，可前往 GitHub Release 查看。',
-  'update.componentVersions': '查看组件版本',
-  'update.retry': '重新检查',
-  'update.close': '关闭更新面板',
-  'update.error.pnpmMissing': '未找到 pnpm，已尝试 pnpm / corepack / npx 仍不可用。请安装 pnpm 后重启应用（Windows: npm install -g pnpm 或 corepack enable；macOS: brew install pnpm 或 corepack enable）。',
-  'update.error.timeout': '更新超时，已终止安装进程，请重试。',
-  'update.error.notFound': '未找到 dsh-web 聚合包安装，无法更新。',
-  'update.error.link': 'dsh-web 或其组件使用本地链接，无法自动更新；请同步本地仓库，或移除与全家桶重复的独立链接。',
-  'update.error.pnpmFailed': '更新执行失败（pnpm 退出码 {code}），详见下方输出。',
-  'update.error.stale': '更新命令已执行，但安装版本未变化。常见原因：pnpm 11 的 minimumReleaseAge 门禁会静默跳过发布不足 24 小时的新版本。请在 profile 目录（~/.dsh/profiles/<profile>）的 pnpm-workspace.yaml 中配置 minimumReleaseAgeExclude（例如 "@linxin666/*"）或 minimumReleaseAge: 0 后重新点击更新。',
-  'update.error.verifyFailed': '更新命令已执行，但无法核对安装后的版本（可能是 registry 探测失败或安装路径变化）。请查看下方输出，或稍后重试。',
-  'update.error.unknown': '更新失败，请重试。',
 } satisfies Record<string, string>
 
 /** The remote namespace key union. */
@@ -188,7 +146,7 @@ export const en = {
   'status.disconnected': 'Paired devices offline',
   'status.stopped': 'Remote access stopped',
   'status.lanRequired': 'This feature needs a LAN bind or a public address',
-  'status.lanRequiredHint': 'The server is bound to 127.0.0.1 and no public address is configured, so a phone cannot reach it. Turn on LAN access in the settings card under Settings → Web Plugins → Remote access, or restart with dsh web --host 0.0.0.0, or set the tunneled public address.',
+  'status.lanRequiredHint': 'The server is bound to 127.0.0.1 and no public address is configured, so a phone cannot reach it. Turn on LAN access in this plugin settings card (under Settings → Web Plugins → Remote access when the full family is installed, or on this plugin row under Settings → Plugins for a standalone install), or restart with dsh web --host 0.0.0.0, or set the tunneled public address.',
   'status.loopbackRequired': 'The pairing panel works on this machine only',
   'status.loopbackRequiredHint': 'Open this page at http://127.0.0.1 to mint a QR code; phones use the paired link.',
   'status.unreachable': 'Cannot reach the pairing service',
@@ -296,46 +254,4 @@ export const en = {
   'settings.saveFailed': 'The deployment did not accept these values; they were left for you to correct.',
   'settings.invalidNumber': 'Enter a number, or leave blank to use the default.',
   // Update panel (the sidebar update trigger).
-  'update.label': 'Check for updates',
-  'update.badge': 'Update available',
-  'update.availableLabel': 'New version available. Check for updates',
-  'update.title': 'Check for updates',
-  'update.checking': 'Checking the remote repository for newer releases…',
-  'update.upToDate': 'Everything is up to date',
-  'update.upToDateDetail': '{name} is at the latest version v{version}.',
-  'update.found': 'A new version is available',
-  'update.foundDetail': '{name} has a newer release v{version}. Confirm to start the update.',
-  'update.start': 'Update now',
-  'update.updating': 'Updating {name} to v{version}; this may take 1-2 minutes…',
-  'update.cooldownNotice': 'This user-initiated update bypasses pnpm\'s 24-hour release cooldown (supply-chain protection) and installs the selected version immediately.',
-  'update.updatingTitle': 'Updating…',
-  'update.done': 'Update complete',
-  'update.doneDetail': 'All components are up to date.',
-  'update.restartHint': 'Restart dsh web for the new version to take effect: stop it with Ctrl+C in the terminal, then run dsh web again.',
-  'update.linkMode': 'Local development mode',
-  'update.linkModeDetail': 'dsh-web or one of its components is installed via a local link and cannot be updated remotely. Latest npm release: {version}. Sync the local checkout, or remove a standalone link duplicated by the aggregate.',
-  'update.missing': 'dsh-web not found',
-  'update.missingDetail': 'Could not locate the installed dsh-web aggregate package. Install it with: dsh plugin --profile <profile> add @linxin666/dsh-web-all',
-  'update.offline': 'Cannot reach the update source',
-  'update.offlineDetail': 'The network is unavailable or the update service is failing; try again later.',
-  'update.unmounted': 'The update service is not loaded',
-  'update.unmountedDetail': 'The running dsh web process loads a plugin build without the update service; restart dsh web (Ctrl+C, then run dsh web again) and retry.',
-  'update.error': 'Update failed',
-  'update.packages': 'Component versions',
-  'update.releaseNotes': 'v{version} release notes',
-  'update.releaseFeatures': 'New Features',
-  'update.releaseFixes': 'Bug Fixes',
-  'update.releaseOther': 'Other Changes',
-  'update.releaseUnavailable': 'Release notes are unavailable for this version; see the GitHub release instead.',
-  'update.componentVersions': 'View component versions',
-  'update.retry': 'Check again',
-  'update.close': 'Close update panel',
-  'update.error.pnpmMissing': 'pnpm was not found (tried pnpm / corepack / npx). Install pnpm and restart the app (Windows: npm install -g pnpm or corepack enable; macOS: brew install pnpm or corepack enable).',
-  'update.error.timeout': 'The update timed out and the install process was killed; try again.',
-  'update.error.notFound': 'The dsh-web aggregate package is not installed; nothing to update.',
-  'update.error.link': 'dsh-web or one of its components uses a local link. Sync the checkout, or remove a standalone link duplicated by the aggregate.',
-  'update.error.pnpmFailed': 'The update failed (pnpm exited with code {code}); see the output below.',
-  'update.error.stale': 'The update command ran but the installed versions did not change. Likely cause: the pnpm 11 minimumReleaseAge gate silently skips releases published less than 24 hours ago. Add minimumReleaseAgeExclude (e.g. "@linxin666/*") or set minimumReleaseAge: 0 in pnpm-workspace.yaml under the profile directory (~/.dsh/profiles/<profile>), then run the update again.',
-  'update.error.verifyFailed': 'The update command ran but the installed versions could not be verified afterwards (registry probe failed or the install path changed). Inspect the output below, or retry later.',
-  'update.error.unknown': 'Update failed; try again.',
 } satisfies Record<RemoteKey, string>

package/src/client/pair-api.ts

@@ -2,6 +2,10 @@
  * Browser-side wire helpers for the /api/pair surface. Plain fetch over
  * same-origin /api (like the connection client); JSON bodies, string
  * responses for the error codes.
+ *
+ * The paths are DOCUMENT-RELATIVE (issue #1707): the GUI is served with
+ * `<base href="./">`, so a sub-path deployment resolves them against its entry
+ * directory instead of escaping to the origin root.
  */
 
 /** issue() response. */
@@ -43,7 +47,7 @@ export interface PairGatePolicy {
 
 /** Read the host-authoritative desktop pairing policy. */
 export async function readPairGatePolicy(): Promise<PairGatePolicy> {
-  const response = await fetch('/api/pair/status')
+  const response = await fetch('api/pair/status')
   if (!response.ok) throw new Error(`remote-web-ui: status failed with ${String(response.status)}`)
   const value = await response.json() as { requirePairingForLan?: unknown }
   if (typeof value.requirePairingForLan !== 'boolean') {
@@ -116,7 +120,7 @@ export interface DeviceFrame {
  * origin — the panel is a desktop control endpoint).
  */
 export async function issuePair(address?: string): Promise<IssueResponse> {
-  const response = await fetch('/api/pair/issue', {
+  const response = await fetch('api/pair/issue', {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({
@@ -139,7 +143,7 @@ export async function issuePair(address?: string): Promise<IssueResponse> {
  * @returns the wire result.
  */
 export async function acceptPair(token: string): Promise<{ ok: true } | AcceptFailure> {
-  const response = await fetch('/api/pair/accept', {
+  const response = await fetch('api/pair/accept', {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ token }),
@@ -153,7 +157,7 @@ export async function acceptPair(token: string): Promise<{ ok: true } | AcceptFa
 
 /** Revoke mobile access (paired devices + the current token). */
 export async function stopPair(): Promise<void> {
-  const response = await fetch('/api/pair/stop', { method: 'POST' })
+  const response = await fetch('api/pair/stop', { method: 'POST' })
   if (!response.ok) throw new Error(`remote-web-ui: stop failed with ${String(response.status)}`)
 }
 
@@ -162,7 +166,7 @@ export async function stopPair(): Promise<void> {
  * @param deviceId - the session id of the row to drop.
  */
 export async function revokePair(deviceId: string): Promise<void> {
-  const response = await fetch('/api/pair/revoke', {
+  const response = await fetch('api/pair/revoke', {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ deviceId }),
@@ -177,7 +181,7 @@ export async function revokePair(deviceId: string): Promise<void> {
  *   proves this page is not paired (see {@link shouldStopHeartbeat}).
  */
 export async function sendHeartbeat(): Promise<number> {
-  const response = await fetch('/api/pair/heartbeat', { method: 'POST' })
+  const response = await fetch('api/pair/heartbeat', { method: 'POST' })
   return response.status
 }
 
@@ -242,7 +246,7 @@ export class LanBindStatusError extends Error {
 
 /** Read the LAN-bind facts (loopback-only endpoint). */
 export async function readLanBindStatus(): Promise<LanBindFrame> {
-  const response = await fetch('/api/pair/lan-bind')
+  const response = await fetch('api/pair/lan-bind')
   if (!response.ok) throw new LanBindStatusError(response.status, `remote-web-ui: lan-bind status failed with ${String(response.status)}`)
   return await response.json() as LanBindFrame
 }

package/src/client/remote-channel.ts

@@ -23,6 +23,8 @@
  */
 
 import {
+  isLoopbackHostname as isLoopbackName,
+  isLocalPage,
   REMOTE_API_PREFIX,
   REMOTE_CHANNEL_RULES,
   REMOTE_PREFIX,
@@ -40,13 +42,41 @@ export interface RemoteChannelSettingsSnapshot {
   value?: { enabled?: boolean; requirePairingForLan?: boolean }
 }
 
+/**
+ * Facts about the live page that decide whether it is local. Defaults come
+ * from `window` so ordinary call sites stay argument-free; tests pass them
+ * explicitly.
+ */
+export interface PageOriginFacts {
+  hostname: string
+  protocol?: string
+  transportOwnsHost?: boolean
+}
+
+/**
+ * Read the page-origin facts from a window-like object: the hostname and
+ * protocol of the page itself plus the official transport's host-owner flag
+ * (`__DSH_TRANSPORT__.ownsHost`, set by the desktop shell before any boot
+ * entry, and by this plugin's own paired landing).
+ * @param win - the window to read (defaults to the real one).
+ * @returns the facts `isLocalPage`/`remoteChannelRequired` decide from.
+ */
+export function pageOriginFacts(win: Pick<Window, 'location'> & Partial<Pick<Window, 'navigator'>> = window): PageOriginFacts {
+  const transport = (win as unknown as { __DSH_TRANSPORT__?: { ownsHost?: unknown } }).__DSH_TRANSPORT__
+  return {
+    hostname: win.location.hostname,
+    protocol: win.location.protocol,
+    ...(transport?.ownsHost === true ? { transportOwnsHost: true } : {}),
+  }
+}
+
 /** Decide whether a remote desktop channel is required from local or host policy. */
 export function remoteChannelRequired(
-  hostname: string,
+  origin: PageOriginFacts,
   snapshot: RemoteChannelSettingsSnapshot,
   hostPairingPolicy: boolean | undefined,
 ): boolean {
-  if (isLoopbackHostname(hostname)) return false
+  if (isLocalPage(origin.hostname, origin.protocol, origin.transportOwnsHost)) return false
   if (snapshot.status === 'ready') {
     return (snapshot.value?.enabled ?? true) && (snapshot.value?.requirePairingForLan ?? true)
   }
@@ -56,20 +86,13 @@ export function remoteChannelRequired(
 }
 
 /**
- * Browser-safe loopback classification for the page origin (the SDK client
- * exports its own; this copy keeps the module dependency-free).
- * @param hostname - a location hostname (IPv6 without brackets).
- * @returns true for localhost, IPv6 loopback, or any 127/8 literal.
+ * Browser-safe loopback classification for the page origin. The definition
+ * lives once in the rules module, which the inlined boot script mirrors
+ * verbatim, so the browser half and the parse-time patch can never disagree
+ * (an IPv6-loopback origin judged remote would rewrite every call onto a
+ * channel it can never pair on).
  */
-export function isLoopbackHostname(hostname: string): boolean {
-  // WHATWG location.hostname keeps IPv6 literals bracketed ("[::1]"); the
-  // host-side shared predicate accepts that spelling, so this browser copy must
-  // too, or an IPv6-loopback origin is judged remote and rewrites every call
-  // onto the gated channel where it can never pair.
-  if (hostname === 'localhost' || hostname === '::1' || hostname === '[::1]') return true
-  const parts = hostname.split('.')
-  return parts.length === 4 && parts[0] === '127' && parts.every(part => /^\d{1,3}$/.test(part) && Number(part) <= 255)
-}
+export const isLoopbackHostname = isLoopbackName
 
 /**
  * Whether one same-origin path must ride the gated channel (fetch, EventSource,

package/src/client/remote.module.css

@@ -19,9 +19,9 @@
 }
 
 /* Trigger: the 36px rail circle, or a fully rounded (pill) full-row button
-   in wide mode — both maximally rounded so the footer action pair shares one
-   shape family (#1035); the seat's owner (ui-sidebar) lays out the
-   geometry. */
+   in wide mode — both maximally rounded so the seat's occupants (this
+   trigger, the dsh-update trigger, the usage card) share one shape family
+   (#1035); the seat's owner (ui-sidebar) lays out the geometry. */
 .trigger {
   position: relative;
   flex: none;
@@ -40,52 +40,18 @@
   transition: background-color 120ms ease, color 120ms ease, box-shadow 120ms ease;
 }
 
-.trigger[data-update-available] {
-  color: var(--dsw-alias-brand-primary);
-}
-
-.trigger[data-update-available]::after {
-  position: absolute;
-  top: 4px;
-  right: 4px;
-  width: 8px;
-  height: 8px;
-  box-sizing: border-box;
-  border: 2px solid var(--dsw-alias-bg-layer-1);
-  border-radius: 50%;
-  background: var(--dsw-alias-brand-primary);
-  content: '';
-  pointer-events: none;
-}
-
 .trigger[data-wide='wide'] {
   flex: 1 1 auto;
   justify-content: flex-start;
   width: auto;
   min-width: 0;
-  /* Pill: maximal rounding, same shape family as the 36px rail circle next
-     to it (the update trigger) — one consistent footer-action look (#1035). */
+  /* Pill: maximal rounding, the same shape family as the 36px rail circle
+     beside it — one consistent footer-action look (#1035). */
   border-radius: 999px;
   gap: 8px;
   padding: 0 10px;
 }
 
-.trigger[data-update-available][data-wide='wide'] {
-  flex: none;
-  gap: 6px;
-}
-
-.trigger[data-update-available][data-wide='wide']::after {
-  display: none;
-}
-
-.updateBadgeText {
-  font-size: 13px;
-  font-weight: 500;
-  line-height: 1;
-  white-space: nowrap;
-}
-
 .trigger:hover:not(:disabled) {
   background: var(--dsw-alias-interactive-bg-hover);
   color: var(--dsw-alias-label-primary);
@@ -768,9 +734,9 @@
   }
 }
 
-/* Footer seat row: the update trigger sits LEFT of the remote trigger in wide
-   mode; the rail stacks them with the update circle below the remote circle
-   (mirroring the settings circle keeping its bottom anchor). */
+/* Footer seat row: this plugin's own occupant (the remote trigger) sits in
+   the shared sidebar.footer.action seat; the rail marker lets the seat stack
+   its occupants in the 56px icon column (see the rail rule below). */
 .entryRow {
   flex: none;
   display: flex;
@@ -788,12 +754,13 @@
 
    The official Settings trigger owns a whole row while the footer actions
    stack above it, so the trigger's right half sits empty. On the wide column
-   the two share one line (the Settings trigger, then the update and remote
-   triggers) and every other foot
-   child (the usage glance card, another plugin's block) keeps a full row of
-   its own above them. The rail (data-sidebar-collapsed on the frame) keeps
-   the shell's stacked foot, where the circles stack by design. The shell owns
-   the container classes; the semantic suffixes survive its rebuilds. */
+   the two share one line (the Settings trigger, then the footer-action
+   occupants — this trigger, the dsh-update trigger, another plugin's control)
+   and every other foot child (the usage glance card, another plugin's block)
+   keeps a full row of its own above them. The rail (data-sidebar-collapsed on
+   the frame) keeps the shell's stacked foot, where the circles stack by
+   design. The shell owns the container classes; the semantic suffixes survive
+   its rebuilds. */
 :global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footArea'] {
   flex-direction: row;
   flex-wrap: wrap;
@@ -805,162 +772,63 @@
   min-width: 0;
 }
 
-:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='settingsArea'] {
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footArea'] > [class*='footerActions'] {
+  /* The seat's own slot host is already `display: contents`, so the seat's box
+     is what decided its occupants' layout. That made this plugin's rule fatal
+     to a SHARED container (issue #1710): the moment any other plugin registered
+     into `sidebar.footer.action` — the reporter had a 339px balance stack and a
+     context panel — the seat became a tall column, and the settings trigger,
+     which is a shell element this plugin does not own, was squeezed to 102px and
+     vertically centred inside it (`y534 = 351 + (417-50)/2`).
+     Dropping the box hands every occupant back to the foot's own wrapping
+     layout, where each one is sized on its own merits. */
+  display: contents;
+}
+
+/* A registrant that is not one of the family's own footer entries (an
+   icon-sized row) takes a full line of its own above the bottom row. This is
+   the shell's own intent for the seat, and it is what keeps a tall third-party
+   block from displacing the settings trigger. */
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footerActions'] > [data-slot='sidebar.footer.action'] > :not([data-dsh-part='entry']):not([class*='entryRow']) {
+  flex: 1 1 100%;
   order: 1;
-  /* Content-sized basis: the trigger's own width forces it onto the line after
-     a full-width sibling, then flex-shrink gives the actions their space. */
-  flex: 1 1 auto;
-  width: auto;
   min-width: 0;
 }
 
-:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footerActions'] {
-  order: 2;
-  flex: none;
-  width: auto;
+/* The family's own footer entries keep their intrinsic width and close the
+   bottom row, sharing it with the settings trigger. `data-dsh-part="entry"` is
+   the family contract for these triggers (dsh-update, dsh-session-id); the
+   remote trigger marks its row with its own class. */
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footerActions'] > [data-slot='sidebar.footer.action'] > [data-dsh-part='entry'],
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='footerActions'] > [data-slot='sidebar.footer.action'] > [class*='entryRow'] {
+  flex: 0 0 auto;
+  order: 4;
   min-width: 0;
-  align-items: center;
-}
-
-/* ── update panel extras ─────────────────────────────────────────────── */
-
-.updateStatus {
-  margin: 0;
-  font-weight: 600;
-}
-
-.updateDetail {
-  margin: 6px 0 0;
-  color: var(--dsw-alias-label-secondary);
-  font-size: 13px;
-}
-
-.updateError {
-  margin: 0;
-  color: var(--dsw-alias-text-danger, var(--dsw-alias-label-primary));
-  font-weight: 600;
-}
-
-.updateOutput {
-  max-height: 180px;
-  margin: 10px 0 0;
-  overflow: auto;
-  padding: 10px 12px;
-  border-radius: 10px;
-  background: var(--dsw-alias-bg-layer-1);
-  color: var(--dsw-alias-label-secondary);
-  font-size: 12px;
-  line-height: 18px;
-  white-space: pre-wrap;
-  word-break: break-all;
-}
-
-.updateList {
-  margin: 12px 0 0;
-  padding: 0;
-  list-style: none;
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-}
-
-.updateListItem {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 12px;
-  font-size: 13px;
 }
 
-.updateListName {
+:global([data-dsh-frame]:not([data-sidebar-collapsed])) [class*='settingsArea'] {
+  order: 3;
+  /* Content-sized basis: the trigger's own width forces it onto the line after
+     a full-width sibling, then flex-shrink gives the actions their space. */
+  flex: 1 1 auto;
+  width: auto;
   min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  color: var(--dsw-alias-label-primary);
 }
 
-.updateListVersions {
-  flex: none;
-  color: var(--dsw-alias-label-secondary);
-  font-variant-numeric: tabular-nums;
-}
+/* ── Collapsed rail foot seat ────────────────────────────────────────────
 
-.updateNotes {
-  margin-top: 14px;
-}
-
-.updateNotesTitle {
-  margin: 0 0 8px;
-  font-size: 14px;
-  font-weight: 600;
-}
-
-.updateNoteSection {
-  display: flex;
+   The shell renders `sidebar.footer.action` as a centered horizontal row
+   in both column states. In the 56px rail that row is only as wide as its
+   occupants, so a second registrar overflows the icon column on both sides:
+   with two 36px circles the seat measures 78px against a 35px column, and
+   the outer buttons land at x=-11 and x=31 while every other rail row sits
+   at x=10 (issue #1678). Stack the seat vertically whenever a rail-marked
+   occupant is inside it, so each circle keeps the 36px rail column the
+   shell uses elsewhere; the wide column never matches this rule. The anchor
+   is this plugin's own `data-rail` marker, so the rule is an equal-value
+   no-op for a shell that already stacks its foot. */
+:global([data-dsh-frame][data-sidebar-collapsed]) [class*='footerActions']:has([data-rail='rail']) {
   flex-direction: column;
-  gap: 4px;
-  margin-top: 10px;
-}
-
-.updateNoteHeading {
-  margin: 0;
-  font-size: 13px;
-  font-weight: 600;
-  color: var(--dsw-alias-label-secondary);
-}
-
-.updateNoteList {
-  margin: 0;
-  padding-left: 18px;
-  display: flex;
-  flex-direction: column;
-  gap: 4px;
-  font-size: 13px;
-}
-
-.updateNoteItem {
-  color: var(--dsw-alias-label-primary);
-  overflow-wrap: anywhere;
-}
-
-.updateVersions {
-  margin-top: 12px;
-}
-
-.updateVersionsSummary {
-  cursor: pointer;
-  color: var(--dsw-alias-label-secondary);
-  font-size: 12px;
-  user-select: none;
-}
-
-.updateActions {
-  display: flex;
-  justify-content: flex-end;
-  margin-top: 16px;
-}
-
-.updateRetry {
-  display: inline-flex;
   align-items: center;
-  gap: 6px;
-  border: none;
-  border-radius: 10px;
-  padding: 8px 14px;
-  background: var(--dsw-alias-interactive-bg-hover);
-  color: var(--dsw-alias-label-primary);
-  font-size: 13px;
-  cursor: pointer;
-  transition: background-color 120ms ease, color 120ms ease;
-}
-
-.updateRetry:hover {
-  background: var(--dsw-alias-interactive-bg-active);
-}
-
-@media (prefers-reduced-motion: reduce) {
-  .updateRetry {
-    transition: none;
-  }
+  gap: 4px;
 }