@linxin666/dsh-remote-web-ui 0.4.2 → 0.4.4

package/lib/index.js

@@ -1,7 +1,6 @@
-import { createRequire } from "node:module";
 import { dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { setInterval, setTimeout as setTimeout$1 } from "node:timers";
-import z from "schemastery";
+import z from "@deepseek-ai/schemastery";
 import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir, networkInterfaces } from "node:os";
@@ -480,7 +479,7 @@ var PairingService = class {
 };
 /** Structural equality over the snapshot's wire fields. */
 function snapshotsEqual(a, b) {
-	return a.phase === b.phase && a.lanAvailable === b.lanAvailable && sameStrings(a.lanAddresses, b.lanAddresses) && a.publicUrl === b.publicUrl && tunnelEqual(a.tunnel, b.tunnel) && relayEqual(a.relay, b.relay) && a.tokenId === b.tokenId && a.tokenExpiresAt === b.tokenExpiresAt && a.deviceCount === b.deviceCount && a.onlineCount === b.onlineCount && devicesEqual(a.devices, b.devices);
+	return a.phase === b.phase && a.lanAvailable === b.lanAvailable && sameStrings(a.lanAddresses, b.lanAddresses) && a.publicUrl === b.publicUrl && tunnelEqual(a.tunnel, b.tunnel) && relayEqual(a.relay, b.relay) && postureEqual(a.posture, b.posture) && a.tokenId === b.tokenId && a.tokenExpiresAt === b.tokenExpiresAt && a.deviceCount === b.deviceCount && a.onlineCount === b.onlineCount && devicesEqual(a.devices, b.devices);
 }
 /** Per-device roster equality (order is pairing time). */
 function devicesEqual(a, b) {
@@ -497,6 +496,42 @@ function tunnelEqual(a, b) {
 function relayEqual(a, b) {
 	return a === b || a !== void 0 && b !== void 0 && a.state === b.state && a.url === b.url && a.error === b.error;
 }
+/**
+* Posture equality. A probe round can change this frame while every other field
+* stays put — the common case, since the probe re-runs on a settings change and
+* on a tunnel reaching running, and a quick-tunnel restart churns the probed
+* host set. Leaving the frame out of the comparison suppressed those emits, so
+* the loopback SSE stream and the desktop panel could sit on a stale "exposed"
+* (or stale "clean") verdict for as long as the phase and roster stayed put.
+*/
+function postureEqual(a, b) {
+	if (a === b) return true;
+	if (!isPostureFrame(a) || !isPostureFrame(b)) return false;
+	return a.checkedAt === b.checkedAt && hostsEqual(a.hosts, b.hosts);
+}
+/** Whether a value has the shape a posture frame is compared on. */
+function isPostureFrame(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* Per-host posture equality (a round's verdicts, in probe order). Tolerates a
+* frame that is not the expected shape: this runs inside the emit path, outside
+* the listener error containment, so a malformed snapshot handed in by another
+* host-fiber caller must degrade to "changed" instead of throwing out of the
+* setter that produced it.
+*/
+function hostsEqual(a, b) {
+	if (a === b) return true;
+	if (!Array.isArray(a) || !Array.isArray(b)) return false;
+	return a.length === b.length && a.every((host, index) => {
+		const other = b[index];
+		return isPostureHost(host) && isPostureHost(other) && host.host === other.host && host.exposed === other.exposed;
+	});
+}
+/** Whether a value has the shape one probed host is compared on. */
+function isPostureHost(value) {
+	return typeof value === "object" && value !== null;
+}
 /** Element-wise string list equality (interface order is meaningful). */
 function sameStrings(a, b) {
 	return a.length === b.length && a.every((value, index) => value === b[index]);
@@ -2185,7 +2220,19 @@ function makeRemoteApiRoutes(deps) {
 	}];
 }
 /**
-* Map one outer upgrade URL onto the loopback path (query string included).
+* Map one outer upgrade URL onto the loopback path, dropping the cookieless
+* device credential on the way in.
+*
+* The outer handshake carries the device id as `?device=<id>` because WebSocket
+* handshakes cannot carry headers from the Web API. That id is a live session
+* credential — it opens the full host API through this same channel — and the
+* inner leg is a request the rest of the loopback origin sees (on a WebSocket
+* leg, a raw handshake request line written to a loopback socket), so forwarding
+* it handed a working credential to every other observer of the local port for
+* no benefit: the gate above has already authenticated the caller, and no
+* upstream route reads the parameter (the gateway mux matches on path alone).
+* The rest of the query rides through unchanged, so a caller's own parameters
+* still reach the upstream.
 */
 function upgradeInnerPath(reqUrl, fallbackPath) {
 	if (reqUrl === void 0 || reqUrl === "") return fallbackPath;
@@ -2197,6 +2244,7 @@ function upgradeInnerPath(reqUrl, fallbackPath) {
 	}
 	const inner = innerPathOf(url.pathname);
 	if (inner === void 0) return fallbackPath;
+	url.searchParams.delete(REMOTE_DEVICE_QUERY);
 	return `${inner}${url.search}`;
 }
 /**
@@ -2682,7 +2730,7 @@ const LAN_BIND_BLOCK_BEGIN = "# --- remote-web-ui lan-bind block (managed - do n
 const LAN_BIND_BLOCK_END = "# --- end remote-web-ui lan-bind block ---";
 /**
 * The absolute path of the profile patch file this toggle manages. The value
-* is config-controlled (and the DSH_PROFILE env fallback bypasses schema
+* is config-controlled (and the runtime/environment fallbacks bypass schema
 * validation entirely), so the path is guarded twice: the profile must be a
 * single safe path segment, and the resolved file must stay under the
 * profiles directory.
@@ -3080,6 +3128,20 @@ function pendingRestartOf(lanBind, desiredHost, liveHost) {
 	return liveHost !== desiredHost;
 }
 /**
+* The profile whose `cordis.patch.yml` the LAN bind toggle manages. An
+* explicit `profile` config wins; otherwise the launched profile the Host
+* publishes is authoritative, because the DSH Desktop client boots the
+* `desktop` profile without exporting `DSH_PROFILE` — an environment-only
+* fallback edited `profiles/web` there, so the toggle looked applied while
+* the running host never followed the block.
+* @param configured - the explicit `profile` plugin config, when set.
+* @param launched - the launched profile name the Host published, when available.
+* @param env - the DSH_PROFILE environment value, when set.
+*/
+function resolveManagedProfile(configured, launched, env) {
+	return configured ?? launched ?? env ?? "web";
+}
+/**
 * Whether the firewall rule must be (re)applied: only when the toggle or the
 * bound port moved since the last application. Keeps unrelated settings
 * saves from spawning netsh/firewall-cmd delete+add churn.
@@ -3152,9 +3214,16 @@ function createInnerAuth(launchUrl, fetchImpl = fetch) {
 *
 * The cloudflared package's Tunnel is a thin spawn wrapper; this manager
 * owns the lifecycle policy (binary readiness, URL timeout, restart
-* backoff) around it. All seams — the tunnel factory, binary readiness,
-* timers — are injectable so the whole lifecycle is unit-testable without
-* a real binary or network.
+* backoff, and the public-URL readiness watchdog) around it. All seams — the
+* tunnel factory, binary readiness, the URL probe, timers — are injectable
+* so the whole lifecycle is unit-testable without a real binary or network.
+*
+* 'running' is not a terminal state: the connector can lose its edge
+* registration while the process keeps living, which leaves a hostname that
+* no longer resolves. The watchdog below probes the public URL of a running
+* tunnel and reuses the crash-restart path when it stops answering, so the
+* relay is re-registered against a freshly minted URL instead of proxying a
+* dead one (issue #1723).
 */
 /** Compare two targets for the start idempotence check. */
 function sameTarget(left, right) {
@@ -3197,6 +3266,44 @@ function namedTunnelHandle(inner, publicUrl) {
 	};
 	return handle;
 }
+/**
+* Probe one public tunnel URL from the host. Resolves true when the URL is
+* served (any HTTP answer below 500 — a harness without credentials answers
+* 401/403, which is a healthy round trip), false for a DNS failure, a refused
+* connection, a timeout, or a Cloudflare 5xx (530 "Origin DNS error" / 1033)
+* — the shapes a tunnel that lost its edge registration produces.
+*
+* The probe must never reject: the watchdog reads a rejection as a dead
+* tunnel and restarts on it, so a local programming error would otherwise
+* recycle working tunnels forever.
+* @param url - the tunnel's public URL.
+* @param timeoutMs - how long one probe may take.
+* @returns whether the URL answered as a live origin.
+*/
+async function probeTunnelUrl(url, timeoutMs) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => {
+		controller.abort();
+	}, timeoutMs);
+	try {
+		const response = await fetch(url, {
+			method: "GET",
+			redirect: "manual",
+			cache: "no-store",
+			signal: controller.signal
+		});
+		await response.body?.cancel().catch(() => void 0);
+		return response.status < 500;
+	} catch {
+		return false;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/** Default probe: the real network round trip. */
+async function defaultProbe(url, timeoutMs) {
+	return await probeTunnelUrl(url, timeoutMs);
+}
 /** Time box for the `--version` probe that validates a staged binary. */
 const BINARY_PROBE_TIMEOUT_MS = 1e4;
 /**
@@ -3342,6 +3449,10 @@ var TunnelManager = class {
 	restartBaseMs;
 	restartMaxMs;
 	timer;
+	probe;
+	healthCheckIntervalMs;
+	healthCheckFailures;
+	probeTimeoutMs;
 	phase = "stopped";
 	url;
 	error;
@@ -3349,6 +3460,8 @@ var TunnelManager = class {
 	handle;
 	urlTimer;
 	restartTimer;
+	healthTimer;
+	healthFailures = 0;
 	attempts = 0;
 	generation = 0;
 	stopping = false;
@@ -3364,6 +3477,10 @@ var TunnelManager = class {
 		this.restartBaseMs = options.restartBaseMs ?? 5e3;
 		this.restartMaxMs = options.restartMaxMs ?? 6e4;
 		this.timer = options.timer ?? nodeTimer;
+		this.probe = options.probe ?? defaultProbe;
+		this.healthCheckIntervalMs = options.healthCheckIntervalMs ?? 6e4;
+		this.healthCheckFailures = options.healthCheckFailures ?? 2;
+		this.probeTimeoutMs = options.probeTimeoutMs ?? 1e4;
 	}
 	/** The current status frame. */
 	get info() {
@@ -3462,10 +3579,65 @@ var TunnelManager = class {
 		this.error = void 0;
 		this.attempts = 0;
 		this.setPhase("running");
+		this.startHealthWatch(value);
 		for (const listener of this.urlListeners) try {
 			listener(value);
 		} catch {}
 	}
+	/**
+	* Watch the readiness of a running tunnel. cloudflared can keep its process
+	* (and its metrics port) alive while every edge connection is gone, leaving
+	* a minted hostname that no longer resolves: the manager used to report
+	* 'running' forever and the relay kept forwarding to that dead address, so
+	* the phone hit Cloudflare 1016 instead of the relay's offline page
+	* (issue #1723). A bounded number of consecutive probe failures ends the
+	* attempt through the ordinary fail/backoff path, which mints a new URL and
+	* re-announces the relay.
+	*/
+	startHealthWatch(url) {
+		this.stopHealthWatch();
+		if (this.stopping || this.phase !== "running") return;
+		if (this.healthCheckIntervalMs <= 0 || this.healthCheckFailures <= 0) return;
+		this.healthFailures = 0;
+		const schedule = () => {
+			this.healthTimer = this.timer.setTimeout(() => {
+				this.healthTimer = void 0;
+				this.healthCheck(url);
+			}, this.healthCheckIntervalMs);
+		};
+		schedule();
+	}
+	/** One probe round of the running tunnel's public URL. */
+	async healthCheck(url) {
+		if (this.stopping || this.phase !== "running" || this.url !== url) return;
+		let alive = false;
+		try {
+			alive = await this.probe(url, this.probeTimeoutMs);
+		} catch {
+			alive = false;
+		}
+		if (this.stopping || this.phase !== "running" || this.url !== url) return;
+		if (alive) this.healthFailures = 0;
+		else {
+			this.healthFailures += 1;
+			if (this.healthFailures >= this.healthCheckFailures) {
+				this.fail("the tunnel stopped answering on its public URL");
+				return;
+			}
+		}
+		this.healthTimer = this.timer.setTimeout(() => {
+			this.healthTimer = void 0;
+			this.healthCheck(url);
+		}, this.healthCheckIntervalMs);
+	}
+	/** Cancel the readiness watchdog (teardown, restart, stop). */
+	stopHealthWatch() {
+		if (this.healthTimer !== void 0) {
+			this.timer.clearTimeout(this.healthTimer);
+			this.healthTimer = void 0;
+		}
+		this.healthFailures = 0;
+	}
 	handleExit() {
 		if (this.stopping) return;
 		this.fail("the tunnel process exited unexpectedly");
@@ -3482,6 +3654,7 @@ var TunnelManager = class {
 			this.timer.clearTimeout(this.urlTimer);
 			this.urlTimer = void 0;
 		}
+		this.stopHealthWatch();
 		this.setPhase("failed");
 		this.attempts += 1;
 		const delay = Math.min(this.restartBaseMs * 2 ** (this.attempts - 1), this.restartMaxMs);
@@ -3493,6 +3666,7 @@ var TunnelManager = class {
 	/** Stop the current process and cancel every pending timer (no phase change). */
 	teardown() {
 		this.stopping = true;
+		this.stopHealthWatch();
 		if (this.urlTimer !== void 0) {
 			this.timer.clearTimeout(this.urlTimer);
 			this.urlTimer = void 0;
@@ -3623,759 +3797,6 @@ var PublicBaseKeeper = class {
 	}
 };
 //#endregion
-//#region src/console-output.ts
-/** Count the U+FFFD replacement characters one candidate decode produced. */
-function replacementCount(text) {
-	let count = 0;
-	for (const character of text) if (character === "�") count += 1;
-	return count;
-}
-/**
-* Decode one console byte buffer. Strict UTF-8 wins whenever it is valid;
-* otherwise the bytes are not UTF-8 at all and the console wrote its own code
-* page, so the candidate that loses the least text is taken.
-* @param bytes - the captured bytes.
-* @returns the decoded text.
-*/
-function decodeConsoleBytes(bytes) {
-	try {
-		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-	} catch {
-		let best;
-		let bestLoss = Number.POSITIVE_INFINITY;
-		for (const label of ["gbk", "utf-8"]) {
-			let text;
-			try {
-				text = new TextDecoder(label).decode(bytes);
-			} catch {
-				continue;
-			}
-			const loss = replacementCount(text);
-			if (loss < bestLoss) {
-				best = text;
-				bestLoss = loss;
-			}
-		}
-		/* v8 ignore next 3 -- reachable only without the legacy code page AND without the lenient pass */
-		if (best === void 0) return Buffer.from(bytes).toString("utf8");
-		return best;
-	}
-}
-/**
-* Create a capture bounded to a byte budget. Overflow drops from the FRONT
-* (the tail is what carries a failure reason), and the cut never lands inside
-* a character: leading UTF-8 continuation bytes are dropped with it, and a
-* legacy code page's dangling lead byte — indistinguishable from a real byte
-* without knowing the encoding until the whole buffer is decoded — is removed
-* with the one replacement character it produced, so an over-long stream still
-* reads cleanly at the seam.
-* @param maxBytes - maximum retained bytes.
-* @returns the capture.
-*/
-function createOutputCapture(maxBytes) {
-	let buffer = Buffer.alloc(0);
-	let trimmed = false;
-	return {
-		push(chunk) {
-			buffer = buffer.length === 0 ? Buffer.from(chunk) : Buffer.concat([buffer, Buffer.from(chunk)]);
-			if (buffer.length <= maxBytes) return;
-			let start = buffer.length - maxBytes;
-			while (start < buffer.length && (buffer[start] & 192) === 128) start += 1;
-			buffer = Buffer.from(buffer.subarray(start));
-			trimmed = true;
-		},
-		read() {
-			const text = decodeConsoleBytes(buffer);
-			return trimmed && text.startsWith("�") ? text.slice(1) : text;
-		}
-	};
-}
-/** The aggregate package that is the canonical update entry point. */
-const AGGREGATE_PACKAGE = "@linxin666/dsh-web-all";
-/** Fallback anchor: this plugin's own package when the aggregate is absent. */
-const SELF_PACKAGE = "@linxin666/dsh-remote-web-ui";
-/** GitHub repository used to surface human-readable release notes. */
-const UPDATE_RELEASE_REPO = "zhu1090093659/dsh-web";
-/** A profile manifest `name` prefix (e.g. `dsh-profile-web`). */
-const PROFILE_NAME_PREFIX = "dsh-profile-";
-/** How many ancestor directories a profile search walks before giving up. */
-const PROFILE_WALK_DEPTH = 12;
-/**
-* Parse a semantic version string (leading `v` tolerated, build metadata
-* ignored). Returns undefined for unparseable input.
-* @param value - the version string, e.g. `0.1.10` or `0.1.11-rc.1`.
-* @returns the parsed parts, or undefined.
-*/
-function parseSemver(value) {
-	const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value.trim());
-	if (match === null) return void 0;
-	return {
-		major: Number(match[1]),
-		minor: Number(match[2]),
-		patch: Number(match[3]),
-		prerelease: match[4] === void 0 ? [] : match[4].split(".")
-	};
-}
-/**
-* Compare two semantic versions per the semver precedence rules (a release
-* outranks any of its prereleases; numeric prerelease identifiers compare
-* numerically and sort below alphanumeric ones). An unparseable version sorts
-* below every parseable one; two unparseable versions compare equal.
-* @param a - first version.
-* @param b - second version.
-* @returns negative when a < b, 0 when equal, positive when a > b.
-*/
-function compareVersions(a, b) {
-	const pa = parseSemver(a);
-	const pb = parseSemver(b);
-	if (pa === void 0 && pb === void 0) return 0;
-	if (pa === void 0) return -1;
-	if (pb === void 0) return 1;
-	for (const key of [
-		"major",
-		"minor",
-		"patch"
-	]) if (pa[key] !== pb[key]) return pa[key] < pb[key] ? -1 : 1;
-	if (pa.prerelease.length === 0 && pb.prerelease.length === 0) return 0;
-	if (pa.prerelease.length === 0) return 1;
-	if (pb.prerelease.length === 0) return -1;
-	for (let index = 0; index < Math.max(pa.prerelease.length, pb.prerelease.length); index++) {
-		const ra = pa.prerelease[index];
-		const rb = pb.prerelease[index];
-		if (ra === void 0) return -1;
-		if (rb === void 0) return 1;
-		if (ra === rb) continue;
-		const numericA = /^\d+$/.test(ra);
-		const numericB = /^\d+$/.test(rb);
-		if (numericA && numericB) return Number(ra) < Number(rb) ? -1 : 1;
-		if (numericA) return -1;
-		if (numericB) return 1;
-		return ra < rb ? -1 : 1;
-	}
-	return 0;
-}
-/** Read a package.json at a path, tolerating any parse/IO failure. */
-function readManifest(path) {
-	try {
-		const parsed = JSON.parse(readFileSync(path, "utf8"));
-		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* Locate the owning dsh profile by walking up from an installed package's
-* manifest until a manifest named `dsh-profile-*` appears (the profile
-* directory is the first ancestor whose package.json carries that name).
-* @param anchorManifestPath - absolute path of the anchor package.json.
-* @returns the profile name/dir, or undefined when not profile-installed.
-*/
-function findProfile(anchorManifestPath) {
-	let dir = dirname(anchorManifestPath);
-	for (let depth = 0; depth < PROFILE_WALK_DEPTH; depth++) {
-		const name = readManifest(join(dir, "package.json"))?.name;
-		if (typeof name === "string" && name.startsWith(PROFILE_NAME_PREFIX)) return {
-			name: name.slice(12),
-			dir
-		};
-		const parent = dirname(dir);
-		if (parent === dir) return void 0;
-		dir = parent;
-	}
-}
-/** Whether a dependency spec is a local link/file/dev-mode install. */
-function isLinkedSpec(spec) {
-	if (typeof spec !== "string") return false;
-	return /^(?:link|file):|^\.{1,2}(?:[/\\]|$)/.test(spec);
-}
-/** Whether a direct local dependency overrides one of the aggregate's children. */
-function hasLinkedFamilyOverride(anchorManifest, profileManifest) {
-	const dependencies = profileManifest?.dependencies;
-	if (typeof dependencies !== "object" || dependencies === null) return false;
-	return familyChildren(anchorManifest).some((name) => isLinkedSpec(dependencies[name]));
-}
-/**
-* Resolve the anchor package's manifest path. The aggregate package is the
-* canonical entry point; this plugin's own package is the fallback. Both a
-* throwing resolve and an undefined return mean "not installed" and move on
-* to the next candidate.
-* @param resolve - a Node resolve implementation scoped to the host process.
-* @returns the absolute manifest path, or undefined when neither is installed.
-*/
-function resolveAnchorManifest(resolve) {
-	for (const name of [AGGREGATE_PACKAGE, SELF_PACKAGE]) try {
-		const path = resolve(name + "/package.json");
-		if (path !== void 0) return path;
-	} catch {}
-}
-/**
-* Resolve what an update would touch: the owning profile directory and the
-* family package list. Fails with an error code when the anchor is missing
-* ('not-found') or is a local dev install ('link').
-* @param deps - the anchor manifest path (resolveAnchorManifest output).
-* @returns the target, or the failure code.
-*/
-function resolveUpdateTarget(deps) {
-	const manifestPath = deps.anchorManifestPath;
-	if (manifestPath === void 0) return { error: "not-found" };
-	const manifest = readManifest(manifestPath);
-	if (manifest === void 0) return { error: "not-found" };
-	const anchor = typeof manifest.name === "string" ? manifest.name : void 0;
-	if (anchor === void 0) return { error: "not-found" };
-	const profile = findProfile(manifestPath);
-	if (profile === void 0) return { error: "link" };
-	const profileManifest = readManifest(join(profile.dir, "package.json"));
-	const spec = (profileManifest?.dependencies)?.[anchor];
-	if (isLinkedSpec(spec) || hasLinkedFamilyOverride(manifest, profileManifest)) return { error: "link" };
-	return {
-		profileName: profile.name,
-		profileDir: profile.dir,
-		packages: familyUpdatePackages(anchor, manifest, profileManifest)
-	};
-}
-/** Family children of the anchor: its dependencies under the family scope. */
-function familyChildren(anchorManifest) {
-	const dependencies = anchorManifest.dependencies;
-	if (typeof dependencies !== "object" || dependencies === null) return [];
-	const names = [];
-	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string") names.push(name);
-	return names;
-}
-/** Registry-managed family packages covered by one update operation. */
-function familyUpdatePackages(anchor, anchorManifest, profileManifest) {
-	const names = /* @__PURE__ */ new Set([anchor, ...familyChildren(anchorManifest)]);
-	const dependencies = profileManifest?.dependencies;
-	if (typeof dependencies !== "object" || dependencies === null) return [...names];
-	for (const [name, spec] of Object.entries(dependencies)) if (name.startsWith("@linxin666/") && typeof spec === "string" && !isLinkedSpec(spec)) names.add(name);
-	return [...names];
-}
-/**
-* Probe every package's latest version with a bounded number of requests in
-* flight, preserving the caller's order in the result.
-* @param names - package names to probe.
-* @param fetchLatest - the probe for one package (returns undefined on failure).
-* @returns one result per name, in the input order.
-*/
-async function probeLatestVersions(names, fetchLatest) {
-	const results = new Array(names.length);
-	let next = 0;
-	const worker = async () => {
-		for (;;) {
-			const index = next++;
-			if (index >= names.length) return;
-			results[index] = await fetchLatest(names[index]);
-		}
-	};
-	const workers = Math.min(4, names.length);
-	await Promise.all(Array.from({ length: workers }, () => worker()));
-	return results;
-}
-/**
-* Probe the npm registry for one package's latest release.
-* @param name - the package name (scope slash URL-encoded).
-* @param fetchImpl - the fetch implementation (global fetch in the host).
-* @param timeoutMs - probe timeout.
-* @returns the latest version string, or undefined on any failure.
-*/
-async function fetchLatestVersion(name, fetchImpl, timeoutMs = 1e4) {
-	try {
-		const controller = new AbortController();
-		const timer = setTimeout(() => {
-			controller.abort();
-		}, timeoutMs);
-		try {
-			const response = await fetchImpl("https://registry.npmjs.org/" + name.replace("/", "%2F") + "/latest", withIdentityEncoding({ signal: controller.signal }));
-			if (!response.ok) return void 0;
-			const body = await response.json();
-			if (typeof body !== "object" || body === null) return void 0;
-			const version = body.version;
-			return typeof version === "string" ? version : void 0;
-		} finally {
-			clearTimeout(timer);
-		}
-	} catch {
-		return;
-	}
-}
-/** Normalize one release-note bullet. */
-function cleanNoteItem(text) {
-	return text.replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/^[-*]\s+/, "").trim();
-}
-/** Determine the section kind for a Markdown heading line. */
-function noteSectionOf(line) {
-	const heading = /^#{1,6}\s+(.+)$/.exec(line.trim());
-	if (heading === null) return void 0;
-	const title = heading[1].replace(/[:：].*$/, "").trim().toLowerCase();
-	if (title === "新功能" || title === "new features") return "features";
-	if (title === "修复" || title === "bug fixes" || title === "bugfixes") return "fixes";
-	if (title === "其他改动" || title === "other changes") return "other";
-}
-/**
-* Parse the GitHub Release body into the three conventional sections.
-*
-* The committed release notes are bilingual: Chinese is the default view and
-* English lives inside a `<details>` block. Prefer the Chinese sections when
-* present and fall back to the whole body for English-only releases. Bullets
-* are escaped as plain text for the panel (no Markdown renderer).
-*/
-function parseReleaseNotesSource(version, source) {
-	const notes = {
-		version,
-		features: [],
-		fixes: [],
-		other: []
-	};
-	let current;
-	for (const rawLine of source.split(/\r?\n/)) {
-		const line = rawLine.trim();
-		const section = noteSectionOf(line);
-		if (section !== void 0) {
-			current = section;
-			continue;
-		}
-		if (current === void 0 || !/^-\s+/.test(line)) continue;
-		const item = cleanNoteItem(line);
-		if (item !== "") notes[current].push(item);
-	}
-	if (notes.features.length === 0 && notes.fixes.length === 0 && notes.other.length === 0) return void 0;
-	return notes;
-}
-function parseReleaseNotesBody(version, body) {
-	return parseReleaseNotesSource(version, body.split("<details>")[0] ?? body) ?? parseReleaseNotesSource(version, body);
-}
-/**
-* Fetch and parse the GitHub Release for one `dsh-web` version.
-* @param version - the npm release version (without the `v` prefix).
-* @param fetchImpl - injected fetch; global `fetch` in the host.
-* @param timeoutMs - hard timeout for the GitHub API probe.
-* @returns structured notes, or undefined when unavailable.
-*/
-async function fetchGitHubReleaseNotes(version, fetchImpl = fetch, timeoutMs = 1e4) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => {
-		controller.abort();
-	}, timeoutMs);
-	try {
-		const response = await fetchImpl(`https://api.github.com/repos/${UPDATE_RELEASE_REPO}/releases/tags/v${version}`, withIdentityEncoding({
-			headers: {
-				accept: "application/vnd.github+json",
-				"user-agent": "dsh-web-update"
-			},
-			signal: controller.signal
-		}));
-		if (!response.ok) return void 0;
-		const body = await response.json();
-		if (typeof body !== "object" || body === null) return void 0;
-		const text = body.body;
-		return typeof text === "string" ? parseReleaseNotesBody(version, text) : void 0;
-	} catch {
-		return;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/**
-* Sentinel for an installed version that could not be read (missing manifest
-* or resolve failure). It is a real-looking version so `checkUpdates` can
-* render the affected row, but the verified-update comparison must never
-* treat it as evidence — a read failure is not a version that "moved".
-*/
-const VERSION_UNKNOWN = "0.0.0";
-/** The resolved current version of one family package (probe failure tolerated). */
-function readInstalledVersion(resolve, name, profileDir) {
-	try {
-		const path = resolve(name + "/package.json");
-		const version = path === void 0 ? void 0 : readManifest(path)?.version;
-		if (typeof version === "string") return version;
-	} catch {}
-	if (profileDir === void 0 || !/^@linxin666\/[a-z0-9][a-z0-9._-]*$/.test(name)) return VERSION_UNKNOWN;
-	const version = readManifest(join(profileDir, "node_modules", ...name.split("/"), "package.json"))?.version;
-	return typeof version === "string" ? version : VERSION_UNKNOWN;
-}
-/**
-* Build the update status: locate the anchor, detect the install mode, and
-* compare every family package against the npm registry.
-* @param deps - manifest resolution + registry probe seams.
-* @returns the status snapshot.
-*/
-async function checkUpdates(deps) {
-	const manifestPath = deps.anchorManifestPath;
-	if (manifestPath === void 0) return {
-		mode: "missing",
-		packages: [],
-		outdated: false
-	};
-	const manifest = readManifest(manifestPath);
-	if (manifest === void 0) return {
-		mode: "missing",
-		packages: [],
-		outdated: false
-	};
-	const anchor = typeof manifest.name === "string" ? manifest.name : void 0;
-	if (anchor === void 0) return {
-		mode: "missing",
-		packages: [],
-		outdated: false
-	};
-	const profile = findProfile(manifestPath);
-	const profileManifest = profile === void 0 ? void 0 : readManifest(join(profile.dir, "package.json"));
-	const linked = profile === void 0 || isLinkedSpec((profileManifest?.dependencies)?.[anchor]) || hasLinkedFamilyOverride(manifest, profileManifest);
-	if (profile === void 0) return {
-		mode: "link",
-		packages: [],
-		outdated: false
-	};
-	const names = familyUpdatePackages(anchor, manifest, profileManifest);
-	const latestList = await probeLatestVersions(names, deps.fetchLatest);
-	const packages = [];
-	let probeFailures = 0;
-	names.forEach((name, index) => {
-		const latest = latestList[index];
-		if (latest === void 0) probeFailures++;
-		const current = readInstalledVersion(deps.resolve, name, profile.dir);
-		packages.push({
-			name,
-			current,
-			latest,
-			outdated: latest !== void 0 && latest !== current && compareVersions(latest, current) > 0
-		});
-	});
-	const error = probeFailures === names.length && names.length > 0 ? "registry-unreachable" : void 0;
-	const targetVersion = packages.find((packageStatus) => packageStatus.latest !== void 0)?.latest;
-	const notes = targetVersion !== void 0 && deps.fetchReleaseNotes !== void 0 ? await deps.fetchReleaseNotes(targetVersion).catch(() => void 0) : void 0;
-	return {
-		mode: linked ? "link" : "npm",
-		profileName: profile.name,
-		anchor,
-		packages,
-		outdated: packages.some((packageStatus) => packageStatus.outdated),
-		...notes !== void 0 ? { notes } : {},
-		...error !== void 0 ? { error } : {}
-	};
-}
-/** Cap on captured pnpm output (keeps error payloads bounded). */
-const OUTPUT_CAP = 16 * 1024;
-/**
-* Characters a package name may contain before it is handed to the update
-* command line. Deliberately looser than the strict family shape (the tests
-* and future callers use short names) but it admits no whitespace, quotes,
-* shell metacharacters, or path separators beyond the scope slash.
-*/
-const SHELL_SAFE_PACKAGE_RE = /^@?[A-Za-z0-9][A-Za-z0-9._/-]*$/;
-/**
-* Windows cmd command-not-found stderr. With shell:true a missing shim
-* exits with code 1 or 9009 (cmd cannot report ENOENT), so the fallback chain
-* detects this message instead of the spawn error event. Supports both English
-* and localized (e.g. Chinese) cmd error messages.
-*/
-const WIN_CMD_MISSING_RE = /not recognized as an internal or external command|不是内部或外部命令/i;
-/**
-* Fold one decoded candidate output into the running total under the display
-* cap (the tail carries the failure reason).
-* @param output - the accumulated text.
-* @param text - the candidate's decoded text.
-*/
-function capOutput(output, text) {
-	const combined = output + text;
-	return combined.length > OUTPUT_CAP ? combined.slice(combined.length - OUTPUT_CAP) : combined;
-}
-/**
-* Bypass for pnpm 11's supply-chain gate: `minimumReleaseAge` (default 24 h)
-* silently skips same-day releases — `pnpm update --latest` then exits 0
-* without moving anything and the post-run verification would misreport a
-* stale no-op. The update here is explicitly user-initiated and the panel
-* shows exactly which versions are being installed, so the gate only adds a
-* confusing silent no-op; override it per-invocation instead of asking every
-* user to edit the profile's pnpm-workspace.yaml.
-*/
-const MIN_RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
-/**
-* Run the update inside the profile directory. Tries pnpm first, falls back
-* to corepack and then npx when the previous command is missing (ENOENT);
-* all candidates share one hard timeout and keep accumulating output.
-* @param deps - profile dir, package list, and spawn/timeout seams.
-* @returns the outcome with captured output.
-*/
-function runUpdate(deps) {
-	return new Promise((resolve) => {
-		const spawnImpl = deps.spawnImpl ?? spawn;
-		const platform = deps.platform ?? process.platform;
-		const packages = deps.packages.filter((name) => SHELL_SAFE_PACKAGE_RE.test(name));
-		const spawnOptions = {
-			cwd: deps.profileDir,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			...platform === "win32" ? { shell: true } : { detached: true }
-		};
-		const killImpl = deps.killImpl ?? process.kill;
-		const candidates = [
-			{
-				command: "pnpm",
-				args: [
-					"update",
-					"--latest",
-					MIN_RELEASE_AGE_OVERRIDE,
-					...packages
-				]
-			},
-			{
-				command: "corepack",
-				args: [
-					"pnpm",
-					"update",
-					"--latest",
-					MIN_RELEASE_AGE_OVERRIDE,
-					...packages
-				]
-			},
-			{
-				command: "npx",
-				args: [
-					"--yes",
-					"pnpm",
-					"update",
-					"--latest",
-					MIN_RELEASE_AGE_OVERRIDE,
-					...packages
-				]
-			}
-		];
-		let output = "";
-		let capture = createOutputCapture(OUTPUT_CAP);
-		let candidateFolded = false;
-		const append = (chunk) => {
-			capture.push(chunk);
-		};
-		/** This candidate's decoded text (idempotent). */
-		const candidateText = () => capture.read();
-		/** Fold this candidate's text into the running output exactly once. */
-		const foldCandidate = () => {
-			if (candidateFolded) return;
-			candidateFolded = true;
-			output = capOutput(output, capture.read());
-		};
-		let currentChild;
-		let finished = false;
-		const finish = (result) => {
-			if (finished) return;
-			finished = true;
-			clearTimeout(timer);
-			resolve(result);
-		};
-		const timer = setTimeout(() => {
-			if (finished) return;
-			if (platform === "win32") {
-				const pid = currentChild?.pid;
-				if (pid !== void 0 && pid > 0) try {
-					spawnImpl("taskkill", [
-						"/pid",
-						String(pid),
-						"/t",
-						"/f"
-					], { stdio: "ignore" }).on?.("error", () => {});
-				} catch {}
-			} else {
-				const pid = currentChild?.pid;
-				if (pid !== void 0 && pid > 0) try {
-					killImpl(-pid, "SIGTERM");
-				} catch {
-					try {
-						currentChild?.kill("SIGTERM");
-					} catch {}
-				}
-				else currentChild?.kill("SIGTERM");
-			}
-			foldCandidate();
-			finish({
-				ok: false,
-				exitCode: null,
-				output,
-				error: "update timed out; install process killed",
-				errorCode: "timeout"
-			});
-		}, deps.timeoutMs ?? 10 * 6e4);
-		const runCandidate = (index) => {
-			if (finished) return;
-			if (index >= candidates.length) {
-				finish({
-					ok: false,
-					exitCode: null,
-					output,
-					error: "pnpm not found on PATH (tried pnpm, corepack, npx); install pnpm and restart the app",
-					errorCode: "pnpm-missing"
-				});
-				return;
-			}
-			const candidate = candidates[index];
-			capture = createOutputCapture(OUTPUT_CAP);
-			candidateFolded = false;
-			const child = spawnImpl(candidate.command, candidate.args, spawnOptions);
-			currentChild = child;
-			let settled = false;
-			const once = (fn) => {
-				if (settled) return;
-				settled = true;
-				fn();
-			};
-			child.stdout?.on("data", append);
-			child.stderr?.on("data", append);
-			child.on("error", (error) => {
-				once(() => {
-					foldCandidate();
-					if (error.code === "ENOENT") runCandidate(index + 1);
-					else finish({
-						ok: false,
-						exitCode: null,
-						output,
-						error: error.message,
-						errorCode: void 0
-					});
-				});
-			});
-			child.on("close", (code) => {
-				if (settled || finished) return;
-				if (platform === "win32" && (code === 9009 || code !== 0 && WIN_CMD_MISSING_RE.test(candidateText()))) {
-					foldCandidate();
-					runCandidate(index + 1);
-					return;
-				}
-				settled = true;
-				foldCandidate();
-				finish({
-					ok: code === 0,
-					exitCode: code,
-					output,
-					error: code === 0 ? void 0 : `${candidate.command} exited with code ` + String(code),
-					...code === 0 ? {} : { errorCode: "pnpm-failed" }
-				});
-			});
-		};
-		runCandidate(0);
-	});
-}
-/**
-* Run the update, then verify the installed versions actually moved. pnpm
-* exits 0 even when it silently kept the installed versions — runUpdate
-* overrides pnpm 11's `minimumReleaseAge` gate (default 24 h) with
-* `--config.minimumReleaseAge=0`, but an older pnpm without the override or
-* another silent no-op can still keep versions in place — so a green exit
-* alone must not report a misleading "update complete". Re-read the
-* installed versions afterwards and surface a `stale` failure (with the
-* captured pnpm output) when nothing moved, so the panel can tell the user
-* how to unblock the gate instead of claiming success.
-*
-* The stale decision anchors on the pre-run installed versions, not on the
-* registry latest: under a lenient gate pnpm may move 0.1.12 -> 0.1.13 while
-* latest stays 0.1.15 — that is a real update, not stale. The post-run anchor
-* path is re-resolved rather than reused from boot time: pnpm removes the old
-* version's .pnpm directory on update, so a boot-time captured path would
-* fail to read and collapse a successful update into a bogus 'missing'.
-*
-* A green exit whose verification has nothing to compare (registry probe
-* outage, missing anchor, non-npm mode) is reported as `verify-failed` — it
-* must never read as success. A green exit where no package moved but the
-* post-run check could not prove the install is fully current (a partial
-* probe failure hides whether a gate kept something back) is also
-* `verify-failed`: it must not collapse into a success either.
-* @param deps - the run and check seams.
-* @returns the run result; `stale` when exit 0 left every version in place,
-* `verify-failed` when the post-run check could not verify anything.
-*/
-async function runUpdateVerified(deps) {
-	const before = /* @__PURE__ */ new Map();
-	for (const name of deps.run.packages) {
-		const version = readInstalledVersion(deps.check.resolve, name, deps.run.profileDir);
-		if (version !== VERSION_UNKNOWN) before.set(name, version);
-	}
-	const result = await runUpdate(deps.run);
-	if (!result.ok) return result;
-	const anchorManifestPath = resolveAnchorManifest(deps.check.resolve) ?? deps.check.anchorManifestPath;
-	const status = await checkUpdates({
-		...deps.check,
-		anchorManifestPath
-	});
-	if (status.error !== void 0 || status.mode !== "npm") return {
-		...result,
-		ok: false,
-		errorCode: "verify-failed",
-		error: "pnpm exited 0 but the post-run version check could not verify the install"
-	};
-	if (status.packages.some((packageStatus) => {
-		const beforeVersion = before.get(packageStatus.name);
-		if (beforeVersion === void 0 || packageStatus.current === VERSION_UNKNOWN) return false;
-		return packageStatus.current !== beforeVersion;
-	})) return result;
-	if (status.outdated) return {
-		...result,
-		ok: false,
-		errorCode: "stale",
-		error: "pnpm exited 0 but the installed versions did not change"
-	};
-	if (status.packages.some((packageStatus) => packageStatus.latest === void 0)) return {
-		...result,
-		ok: false,
-		errorCode: "verify-failed",
-		error: "pnpm exited 0 but the post-run version check could not verify the install"
-	};
-	return result;
-}
-//#endregion
-//#region src/update-routes.ts
-/** Route paths (exact matches under /api). */
-const UPDATE_PATHS = {
-	status: "/api/update/status",
-	run: "/api/update/run"
-};
-/**
-* Build the /api/update route family.
-* @param deps - fence + check/run seams.
-* @returns the exact routes to register on webServer.
-*/
-function makeUpdateRoutes(deps) {
-	const handleStatus = async (req, res) => {
-		if (req.method !== "GET") {
-			res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
-			res.end("method not allowed");
-			return;
-		}
-		if (!deps.fence(req)) {
-			writeJson(res, 403, {
-				ok: false,
-				code: "forbidden"
-			});
-			return;
-		}
-		writeJson(res, 200, await deps.check());
-	};
-	const handleRun = async (req, res) => {
-		if (req.method !== "POST") {
-			res.writeHead(405, { "content-type": "text/plain; charset=utf-8" });
-			res.end("method not allowed");
-			return;
-		}
-		if (!deps.fence(req)) {
-			writeJson(res, 403, {
-				ok: false,
-				code: "forbidden"
-			});
-			return;
-		}
-		writeJson(res, 200, await deps.run());
-	};
-	return [{
-		kind: "exact",
-		path: UPDATE_PATHS.status,
-		handler: handleStatus
-	}, {
-		kind: "exact",
-		path: UPDATE_PATHS.run,
-		handler: handleRun
-	}];
-}
-//#endregion
 //#region src/mount-once.ts
 /**
 * Host single-instance guard shared by the plugin family. The family bundle
@@ -4383,38 +3804,111 @@ function makeUpdateRoutes(deps) {
 * the loader accepts a standalone install of the same package side by side;
 * without this guard the second instance would still re-register the same
 * webserver routes, tools, settings namespaces, and system-prompt sections
-* and fail the boot. mountOnce makes the second host apply a no-op for the
-* lifetime of the first instance (the browser half is already deduped by
-* package name in the client module host).
+* and fail the boot. mountOnce makes a mount of an already-mounted package a
+* no-op for as long as the first instance lives (the browser half is already
+* deduped by package name in the client module host).
+*
+* A no-op is only safe while the holder is ALIVE. The holder can be disposed
+* long after the refused mount ran its course: the Host reloads a profile by
+* creating the new loader entries before the old ones are torn down (a
+* plugin-manager enable/disable/install write, a settings-driven row reload,
+* HMR), so the new aggregate shell entry mounts its family plugin while the
+* previous entry still owns the name. Dropping that refused mount lost the
+* plugin for good - the previous entry then disposed its own mount, releasing
+* the name with nobody left to take it, and the family row stayed listed as
+* active while its host routes 404ed (the task-board panel showed
+* "board.hostError.notMounted", no degraded record appeared, and only a Host
+* restart recovered it).
+*
+* The refused mount is therefore QUEUED, not dropped, and replayed the moment
+* the holder releases the name - if the waiting fiber is still alive then. The
+* single-instance guarantee is unchanged: exactly one mount is live per
+* package name, and the replay re-enters the guard so a later mount still
+* dedupes against it.
 *
 * The registry rides a global symbol so two module instances of the same
-* package (npm copy vs repository link) still share one verdict. cordis
-* `ctx.effect` runs its callback immediately and treats the callback's
+* package (npm copy vs repository link) still share one verdict. That symbol
+* is a CROSS-REPOSITORY contract, not this file's private state: the four
+* satellite packages (dsh-skins / dsh-pet / dsh-presets /
+* dsh-community-plugins) are separate repositories carrying their own copy of
+* this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+* must keep the shape every published copy reads (a `Set` of package names
+* with `has`/`add`/`delete`). The wait queues this guard added therefore live
+* under their own additive key, and the registry reads back a `Set` even when
+* some other build left a different value there. Changing `MOUNTED`'s shape
+* in place broke that contract once: a satellite's legacy copy created a
+* `Set`, the family's new copy read it as a `Map`, and every family row
+* mounted after it failed with "claims.get is not a function".
+*
+* cordis `ctx.effect` runs its callback immediately and treats the callback's
 * return value as the fiber disposer, so the unmarker is returned, not run.
 */
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for("dsh-web.mounted-plugins");
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for("dsh-web.mounted-plugins.waiters");
+/**
+* The shared name registry, always a `Set` whatever another build stored here:
+* a foreign value (an interim shape, a hand-written global) must not take every
+* family plugin down with it.
+* @returns the process-wide set of mounted package names.
+*/
 function mountedSet() {
 	const registry = globalThis;
-	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
+	const existing = registry[MOUNTED];
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	registry[MOUNTED] = created;
+	return created;
+}
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters() {
+	const registry = globalThis;
+	return registry[WAITERS] ??= /* @__PURE__ */ new Map();
 }
 /**
 * Wrap a cordis plugin apply so the package runs at most once per process.
-* The first mount registers normally and unmarks when its fiber disposes;
-* any later mount of the same package name is a no-op.
+* The first mount registers normally and releases the name when its fiber
+* disposes; a mount refused while that name is held waits for the release and
+* then runs, unless its own fiber disposes first.
 * @param packageName - npm package identity shared by every install source.
 * @param fn - the original plugin apply.
 * @returns an apply of the same shape.
 */
 function mountOnce(packageName, fn) {
-	return ((...args) => {
+	const mount = (...args) => {
 		const mounted = mountedSet();
-		if (mounted.has(packageName)) return;
+		const ctx = args[0];
+		if (mounted.has(packageName)) {
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName) ?? [];
+			let alive = true;
+			const pending = { run: () => {
+				if (alive) mount(...args);
+			} };
+			ctx?.effect?.(() => () => {
+				alive = false;
+				const index = queue.indexOf(pending);
+				if (index >= 0) queue.splice(index, 1);
+			});
+			queue.push(pending);
+			waiters.set(packageName, queue);
+			return;
+		}
 		mounted.add(packageName);
-		args[0]?.effect?.(() => () => {
+		ctx?.effect?.(() => () => {
 			mounted.delete(packageName);
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName);
+			if (queue === void 0) return;
+			waiters.delete(packageName);
+			for (const waiter of queue.splice(0)) queueMicrotask(() => {
+				waiter.run();
+			});
 		});
 		return fn(...args);
-	});
+	};
+	return mount;
 }
 //#endregion
 //#region src/remote-channel-boot.ts
@@ -4537,31 +4031,64 @@ const inject = [
 * Host package.
 */
 const REMOTE_WEB_UI_SETTINGS_NAMESPACE = "remote-web-ui";
+/**
+* Plugin config schema. Under the 0.1.7 settings model this schema IS the
+* entry's settings page: the Host derives one form per profile entry from it
+* and serves that form only when at least one field is `volatile()`. The marker
+* is also what admits a write and what keeps the edit on the live path — the
+* Loader commits the new value into the field's reference and announces
+* `loader/volatile-update` on this fiber instead of remounting the row, so the
+* pairing service, its device sessions, the tunnel and the route registrations
+* survive a settings save (see {@link applyImpl}'s sync).
+*
+* The schema is left to inference rather than annotated with `z<Config>`: a
+* volatile field's parsed output is a live reference while its accepted input
+* stays the plain value, so the two sides no longer share one shape and the
+* annotation would reject the schema the Host must be given.
+*
+* The deployment-level fields (`trustedHosts`, `devicesFile`, `profile`) are
+* deliberately NOT volatile: they belong in the profile patch, so the form
+* leaves them to the operator instead of offering a card control that a
+* document write could not honor.
+*/
 const Config = z.object({
-	tokenTtlMs: z.number().step(1).min(6e4).default(10 * 6e4),
-	offlineAfterMs: z.number().step(1).min(5e3).default(25e3),
-	maxDevices: z.number().step(1).min(1).max(64).default(4),
-	idleExpireMs: z.number().step(1).min(6e4).default(DEFAULT_IDLE_EXPIRE_MS),
-	cookieName: z.string().min(1).default("dsh_pair"),
-	requirePairingForLan: z.boolean().default(true),
-	publicBaseUrl: z.string(),
+	tokenTtlMs: z.number().step(1).min(6e4).default(10 * 6e4).volatile(),
+	offlineAfterMs: z.number().step(1).min(5e3).default(25e3).volatile(),
+	maxDevices: z.number().step(1).min(1).max(64).default(4).volatile(),
+	idleExpireMs: z.number().step(1).min(6e4).default(DEFAULT_IDLE_EXPIRE_MS).volatile(),
+	cookieName: z.string().min(1).default("dsh_pair").volatile(),
+	requirePairingForLan: z.boolean().default(true).volatile(),
+	publicBaseUrl: z.string().volatile(),
 	trustedHosts: z.array(z.string()),
 	devicesFile: z.string(),
-	autoTunnel: z.boolean().default(false),
-	tunnelToken: z.string().role("secret"),
-	relay: z.boolean().default(true),
-	lanBind: z.boolean(),
+	autoTunnel: z.boolean().default(false).volatile(),
+	tunnelToken: z.string().role("secret").volatile(),
+	relay: z.boolean().default(true).volatile(),
+	lanBind: z.boolean().volatile(),
 	profile: z.string().pattern(/^[A-Za-z0-9][A-Za-z0-9._-]*$/),
-	enabled: z.boolean().default(true)
+	enabled: z.boolean().default(true).volatile()
 });
 /** Presence sweep cadence (a stale device flips to disconnected within two sweeps). */
 const SWEEP_INTERVAL_MS = 1e4;
+/** Read one resolved config field, following the live reference the schema produces. */
+function readConfigField(field, fallback) {
+	if (field === void 0) return fallback;
+	if (typeof field === "object" && field !== null && typeof field.get === "function") {
+		const value = field.get();
+		return value === void 0 ? fallback : value;
+	}
+	return field;
+}
 /**
-* How long one update-status probe answer is reused. The probe fans out one
-* registry GET per family package plus a GitHub call, and the sidebar update
-* entry asks for the status on every GUI page load.
+* Read one optional resolved config field. A volatile reference is read at
+* call time, so an unset field stays `undefined` rather than falling back to a
+* schema default (the distinction the LAN toggle and the tunnel plan depend on).
 */
-const UPDATE_STATUS_TTL_MS = 6e4;
+function readOptionalConfigField(field) {
+	if (field === void 0) return void 0;
+	if (typeof field === "object" && field !== null && typeof field.get === "function") return field.get();
+	return field;
+}
 /**
 * The single mapping from resolved plugin config to the pairing service
 * config. Both the constructed service and every later apply of this row
@@ -4596,10 +4123,23 @@ const DEFAULTS = {
 	tunnelToken: void 0,
 	relay: true,
 	lanBind: void 0,
-	profile: process.env.DSH_PROFILE ?? "web",
+	profile: resolveManagedProfile(void 0, void 0, process.env.DSH_PROFILE),
 	enabled: true
 };
 /**
+* The launched profile the Host publishes on its `profileContext` service
+* (`{ name, dir, patchPath, … }`). The Desktop client boots the "desktop"
+* profile without exporting DSH_PROFILE, so the environment alone resolves
+* the wrong profile there and the LAN bind toggle would edit a profile that
+* is not running.
+* @param ctx - host plugin context.
+* @returns the profile name when the Host publishes one; undefined otherwise.
+*/
+function launchedProfileName(ctx) {
+	const fact = ctx.get("profileContext");
+	return typeof fact?.name === "string" && fact.name.length > 0 ? fact.name : void 0;
+}
+/**
 * Mount the pairing service, routes, gate listener, and presence sweep.
 * @param ctx - host plugin context carrying webServer.
 * @param config - resolved plugin config (schema defaults applied by the loader).
@@ -4607,25 +4147,24 @@ const DEFAULTS = {
 const apply = mountOnce("@linxin666/dsh-remote-web-ui", applyImpl);
 function applyImpl(ctx, config) {
 	const envPublicBase = process.env.DSH_REMOTE_PUBLIC_BASE_URL?.trim() || void 0;
-	const resolved = {
-		tokenTtlMs: config?.tokenTtlMs ?? DEFAULTS.tokenTtlMs,
-		offlineAfterMs: config?.offlineAfterMs ?? DEFAULTS.offlineAfterMs,
-		maxDevices: config?.maxDevices ?? DEFAULTS.maxDevices,
-		idleExpireMs: config?.idleExpireMs ?? DEFAULTS.idleExpireMs,
-		cookieName: config?.cookieName ?? DEFAULTS.cookieName,
-		requirePairingForLan: config?.requirePairingForLan ?? DEFAULTS.requirePairingForLan,
-		publicBaseUrl: config?.publicBaseUrl ?? envPublicBase,
-		trustedHosts: config?.trustedHosts,
-		devicesFile: config?.devicesFile ?? DEFAULTS.devicesFile,
-		autoTunnel: config?.autoTunnel ?? DEFAULTS.autoTunnel,
-		tunnelToken: config?.tunnelToken,
-		relay: config?.relay ?? DEFAULTS.relay,
-		lanBind: config?.lanBind,
-		profile: config?.profile ?? process.env.DSH_PROFILE ?? DEFAULTS.profile,
-		enabled: config?.enabled ?? DEFAULTS.enabled
-	};
-	const resolve = () => resolved;
-	const service = new PairingService(pairingConfigOf(resolved));
+	const resolve = () => ({
+		tokenTtlMs: readConfigField(config?.tokenTtlMs, DEFAULTS.tokenTtlMs),
+		offlineAfterMs: readConfigField(config?.offlineAfterMs, DEFAULTS.offlineAfterMs),
+		maxDevices: readConfigField(config?.maxDevices, DEFAULTS.maxDevices),
+		idleExpireMs: readConfigField(config?.idleExpireMs, DEFAULTS.idleExpireMs),
+		cookieName: readConfigField(config?.cookieName, DEFAULTS.cookieName),
+		requirePairingForLan: readConfigField(config?.requirePairingForLan, DEFAULTS.requirePairingForLan),
+		publicBaseUrl: readOptionalConfigField(config?.publicBaseUrl) ?? envPublicBase,
+		trustedHosts: readOptionalConfigField(config?.trustedHosts),
+		devicesFile: readConfigField(config?.devicesFile, DEFAULTS.devicesFile),
+		autoTunnel: readConfigField(config?.autoTunnel, DEFAULTS.autoTunnel),
+		tunnelToken: readOptionalConfigField(config?.tunnelToken),
+		relay: readConfigField(config?.relay, DEFAULTS.relay),
+		lanBind: readOptionalConfigField(config?.lanBind),
+		profile: resolveManagedProfile(readOptionalConfigField(config?.profile), launchedProfileName(ctx), process.env.DSH_PROFILE),
+		enabled: readConfigField(config?.enabled, DEFAULTS.enabled)
+	});
+	const service = new PairingService(pairingConfigOf(resolve()));
 	const tunnel = new TunnelManager();
 	let relayRegistrar;
 	/**
@@ -4666,7 +4205,7 @@ function applyImpl(ctx, config) {
 		relayAnnouncedFor = target;
 		registrar.announce(target);
 	};
-	let tunnelMode = resolved.autoTunnel ? "quick" : "off";
+	let tunnelMode = resolve().autoTunnel ? "quick" : "off";
 	tunnel.onPhase((info) => {
 		if (tunnelMode === "off") return;
 		if (info.phase === "running" && info.url !== void 0) {
@@ -4703,80 +4242,6 @@ function applyImpl(ctx, config) {
 	}
 	let disposeRoutes;
 	let disposeSweep;
-	const requireFromHost = createRequire(import.meta.url);
-	/** Host-process resolve that degrades to "not installed" (undefined) instead of throwing. */
-	const hostResolve = (specifier) => {
-		try {
-			return requireFromHost.resolve(specifier);
-		} catch {
-			return;
-		}
-	};
-	const resolveAnchorPath = () => resolveAnchorManifest(hostResolve);
-	const releaseNotesCache = /* @__PURE__ */ new Map();
-	const fetchReleaseNotesCached = async (version) => {
-		const cached = releaseNotesCache.get(version);
-		if (cached !== void 0 && Date.now() - cached.at < 6e5) return cached.notes;
-		const notes = await fetchGitHubReleaseNotes(version, fetch);
-		releaseNotesCache.set(version, {
-			at: Date.now(),
-			notes
-		});
-		return notes;
-	};
-	let updateStatusCache;
-	let updateStatusInFlight;
-	const checkStatusCached = () => {
-		const cached = updateStatusCache;
-		if (cached !== void 0 && Date.now() - cached.at < UPDATE_STATUS_TTL_MS) return Promise.resolve(cached.value);
-		if (updateStatusInFlight !== void 0) return updateStatusInFlight;
-		updateStatusInFlight = checkUpdates({
-			anchorManifestPath: resolveAnchorPath(),
-			resolve: hostResolve,
-			fetchLatest: (name) => fetchLatestVersion(name, fetch),
-			fetchReleaseNotes: fetchReleaseNotesCached
-		}).then((value) => {
-			updateStatusCache = {
-				at: Date.now(),
-				value
-			};
-			return value;
-		}).finally(() => {
-			updateStatusInFlight = void 0;
-		});
-		return updateStatusInFlight;
-	};
-	const updateRoutes = makeUpdateRoutes({
-		fence: (request) => isTrustedApiRequest(request, []),
-		check: () => checkStatusCached(),
-		run: async () => {
-			const target = resolveUpdateTarget({ anchorManifestPath: resolveAnchorPath() });
-			if ("error" in target) {
-				const code = target.error;
-				return {
-					ok: false,
-					exitCode: null,
-					output: "",
-					error: code === "not-found" ? "dsh-web aggregate not installed" : "local link install — update unavailable",
-					errorCode: code
-				};
-			}
-			const result = await runUpdateVerified({
-				run: {
-					profileDir: target.profileDir,
-					packages: target.packages
-				},
-				check: {
-					anchorManifestPath: resolveAnchorPath(),
-					resolve: hostResolve,
-					fetchLatest: (name) => fetchLatestVersion(name, fetch),
-					fetchReleaseNotes: fetchReleaseNotesCached
-				}
-			});
-			updateStatusCache = void 0;
-			return result;
-		}
-	});
 	let lastKnownPort;
 	let lastFirewallApplied;
 	const lanBindStatus = () => {
@@ -4837,36 +4302,32 @@ function applyImpl(ctx, config) {
 			return;
 		}
 	};
-	const routes = [
-		...makeRoutes({
-			service,
-			requirePairingForLan: () => resolve().requirePairingForLan,
-			lanBindStatus,
-			indexDocument: fetchAppShell,
-			trustedHosts: () => {
-				const list = [];
-				const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS;
-				if (typeof envHosts === "string" && envHosts.trim() !== "") for (const item of envHosts.split(",")) {
+	const routes = [...makeRoutes({
+		service,
+		requirePairingForLan: () => resolve().requirePairingForLan,
+		lanBindStatus,
+		indexDocument: fetchAppShell,
+		trustedHosts: () => {
+			const list = [];
+			const envHosts = process.env.DSH_REMOTE_TRUSTED_HOSTS;
+			if (typeof envHosts === "string" && envHosts.trim() !== "") for (const item of envHosts.split(",")) {
+				const trimmed = item.trim();
+				if (trimmed !== "") list.push(trimmed);
+			}
+			const cfgHosts = resolve().trustedHosts;
+			if (Array.isArray(cfgHosts)) {
+				for (const item of cfgHosts) if (typeof item === "string") {
 					const trimmed = item.trim();
 					if (trimmed !== "") list.push(trimmed);
 				}
-				const cfgHosts = resolve().trustedHosts;
-				if (Array.isArray(cfgHosts)) {
-					for (const item of cfgHosts) if (typeof item === "string") {
-						const trimmed = item.trim();
-						if (trimmed !== "") list.push(trimmed);
-					}
-				}
-				return list;
 			}
-		}),
-		...makeRemoteApiRoutes({
-			service,
-			port: ctx.webServer.port,
-			auth: innerAuth
-		}),
-		...updateRoutes
-	];
+			return list;
+		}
+	}), ...makeRemoteApiRoutes({
+		service,
+		port: ctx.webServer.port,
+		auth: innerAuth
+	})];
 	const upgrades = makeRemoteApiUpgradeRoutes({
 		service,
 		port: ctx.webServer.port,
@@ -4929,9 +4390,7 @@ function applyImpl(ctx, config) {
 		console.log(`remote-web-ui: the paired Web GUI is reachable on LAN at ${urls}`);
 	}
 	if (ctx.webServer.host === "0.0.0.0") console.warn("remote-web-ui: LAN-exposed bind — pairing gates the /remote channel; direct /api stays under the harness fence + browser auth (stop() does not revoke an already-redeemed browser credential)");
-	const sync = () => {
-		const value = resolve();
-		service.config = pairingConfigOf(value);
+	const applyLanBindWork = (value) => {
 		if (value.lanBind !== void 0) {
 			const startup = ctx.get("webStartup");
 			const desiredHost = desiredBindHost(value.lanBind === true, startup?.host);
@@ -4957,6 +4416,27 @@ function applyImpl(ctx, config) {
 				else console.error("remote-web-ui: the host firewall rule could not be updated (admin rights required on managed platforms)");
 			}
 		}
+	};
+	let lanBindWorkPending = false;
+	const scheduleLanBindWork = () => {
+		if (lanBindWorkPending) return;
+		lanBindWorkPending = true;
+		setImmediate(() => {
+			lanBindWorkPending = false;
+			try {
+				applyLanBindWork(resolve());
+			} catch (error) {
+				console.error(`remote-web-ui: the deferred lan-bind assertion failed: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		});
+	};
+	ctx.effect(() => () => {
+		lanBindWorkPending = false;
+	}, "remote-web-ui: lan-bind work");
+	const sync = () => {
+		const value = resolve();
+		service.config = pairingConfigOf(value);
+		scheduleLanBindWork();
 		const plan = tunnelPlanOf(value, ctx.webServer.port);
 		tunnelMode = plan.mode;
 		publicBase.setMode(plan.mode);
@@ -5043,6 +4523,9 @@ function applyImpl(ctx, config) {
 			text: REMOTE_CHANNEL_BOOT_SCRIPT
 		});
 	}), "remote-web-ui: remote channel boot patch");
+	ctx.on("loader/volatile-update", () => {
+		sync();
+	});
 	sync();
 }
 //#endregion