@lob-ox/core-darwin-x64 0.0.15 → 0.0.17

package/core.cjs

@@ -917,29 +917,29 @@ var require_brand = __commonJS({
   "src/shared/brand.js"(exports2, module2) {
     "use strict";
     var path2 = require("node:path");
-    var SHARED = require_shared_constants2();
-    var PRODUCT_NAME = SHARED.product.name;
-    var CLI_NAME = SHARED.product.cliName;
-    var GUI_BIN_NAME = SHARED.product.guiBinName;
-    var GUI_CRATE_NAME = SHARED.product.guiCrateName;
+    var SHARED2 = require_shared_constants2();
+    var PRODUCT_NAME = SHARED2.product.name;
+    var CLI_NAME = SHARED2.product.cliName;
+    var GUI_BIN_NAME = SHARED2.product.guiBinName;
+    var GUI_CRATE_NAME = SHARED2.product.guiCrateName;
     var NPM_SCOPE = "@lob-ox";
     var CORE_PKG_PREFIX = "core-";
     var CORE_PKG_TAGS = ["linux-x64", "darwin-arm64", "darwin-x64", "win-x64"];
     var SHELL_RELEASE_PKG = "@lob-ox/shell-release";
     var TAURI_IDENTIFIER = "dev.bowen.lobox";
     var TAURI_PRODUCT_NAME = "lobox";
-    var STATE_DIR_NAME = SHARED.state.dirName;
-    var STATE_SUPERVISOR_SUBDIR = SHARED.state.supervisorSubdir;
-    var STATE_SHELL_SUBDIR = SHARED.state.shellSubdir;
+    var STATE_DIR_NAME = SHARED2.state.dirName;
+    var STATE_SUPERVISOR_SUBDIR = SHARED2.state.supervisorSubdir;
+    var STATE_SHELL_SUBDIR = SHARED2.state.shellSubdir;
     var LEGACY_PRODUCT_NAME = "dsh-supervisor";
-    var STATE_ROOT_WIN_BASE_ENV = SHARED.state.winBaseEnv;
+    var STATE_ROOT_WIN_BASE_ENV = SHARED2.state.winBaseEnv;
     var STATE_ROOT_WIN_BASE_FALLBACK_SEGMENTS = ["AppData", "Local"];
     var STATE_ROOT_MACOS_SEGMENTS = ["Library", "Application Support"];
-    var STATE_ROOT_LINUX_XDG_ENV = SHARED.state.linuxXdgEnv;
+    var STATE_ROOT_LINUX_XDG_ENV = SHARED2.state.linuxXdgEnv;
     var STATE_ROOT_LINUX_FALLBACK_SEGMENTS = [".local", "state"];
-    var LEGACY_HARNESS_DIR = SHARED.state.legacyHarnessDir;
-    var ENV_STATE_ROOT = SHARED.env.stateRoot;
-    var ENV_CONFIG = SHARED.env.config;
+    var LEGACY_HARNESS_DIR = SHARED2.state.legacyHarnessDir;
+    var ENV_STATE_ROOT = SHARED2.env.stateRoot;
+    var ENV_CONFIG = SHARED2.env.config;
     var ENV_LOCK_FILE = "DSH_SUPERVISOR_LOCK_FILE";
     var ENV_DAEMON = "DSH_SUPERVISOR_DAEMON";
     var ENV_TRAY_PORT = "DSH_SUPERVISOR_TRAY_PORT";
@@ -972,8 +972,6 @@ var require_brand = __commonJS({
     var ENV_PLATFORM_OVERRIDE = "DSH_PLATFORM_OVERRIDE";
     var ENV_ESBUILD_VERSION = "DSH_ESBUILD_VERSION";
     var ENV_VERSION_LIB = "DSH_VERSION_LIB";
-    var WINDOWS_GUARD_TASK = "Lobox";
-    var WINDOWS_WATCHDOG_TASK = "Lobox-Watchdog";
     var WINDOWS_GUI_TASK = "Lobox-Shell";
     var WINDOWS_RUN_VALUE = "Lobox";
     var SYSTEMD_UNIT_NAME = "lobox";
@@ -997,10 +995,10 @@ var require_brand = __commonJS({
     var CLI_BIN_NAMES = ["lobox.exe", "lobox.cmd", "lobox"];
     var CLI_SHIM_NAMES = ["lobox", "lobox.cmd", "lobox.ps1"];
     var GUI_BIN_NAMES = ["lobox-shell", "lobox-shell.exe"];
-    var PROC_MATCH_GUARD = SHARED.proc.matchGuard;
-    var BRIDGE_MSG_KERNEL_UPDATE_REQUEST = SHARED.bridge.msgKernelUpdateRequest;
-    var BRIDGE_MSG_KERNEL_UPDATE_RESULT = SHARED.bridge.msgKernelUpdateResult;
-    var BRIDGE_MSG_KERNEL_UPDATE_PROGRESS = SHARED.bridge.msgKernelUpdateProgress;
+    var PROC_MATCH_GUARD = SHARED2.proc.matchGuard;
+    var BRIDGE_MSG_KERNEL_UPDATE_REQUEST = SHARED2.bridge.msgKernelUpdateRequest;
+    var BRIDGE_MSG_KERNEL_UPDATE_RESULT = SHARED2.bridge.msgKernelUpdateResult;
+    var BRIDGE_MSG_KERNEL_UPDATE_PROGRESS = SHARED2.bridge.msgKernelUpdateProgress;
     var STORE_KEY_API_ACCESS = "lobox.apiAccessKey";
     var COOKIE_LAN_TOKEN = "lobox_lan_token";
     var EVENT_HARNESS_EXITED = "harness_exited";
@@ -1094,8 +1092,6 @@ var require_brand = __commonJS({
       ENV_PLATFORM_OVERRIDE,
       ENV_ESBUILD_VERSION,
       ENV_VERSION_LIB,
-      WINDOWS_GUARD_TASK,
-      WINDOWS_WATCHDOG_TASK,
       WINDOWS_GUI_TASK,
       WINDOWS_RUN_VALUE,
       SYSTEMD_UNIT_NAME,
@@ -1287,7 +1283,7 @@ var require_config = __commonJS({
     "use strict";
     var os2 = require("node:os");
     var path2 = require("node:path");
-    var SHARED = require_shared_constants2();
+    var SHARED2 = require_shared_constants2();
     function expandHome(p) {
       if (typeof p !== "string") return p;
       if (p === "~") return os2.homedir();
@@ -1312,7 +1308,7 @@ var require_config = __commonJS({
       stopGraceMs: 1e4,
       portReleaseWaitMs: 1e4,
       apiHost: "127.0.0.1",
-      apiPort: SHARED.net.apiPort,
+      apiPort: SHARED2.net.apiPort,
       portPools: null,
       stateFile: path2.join(SUP, "state.json"),
       logFile: path2.join(SUP, "events", "guard.events.log"),
@@ -1359,7 +1355,7 @@ var require_config = __commonJS({
       return out;
     }
     var DEFAULTS = buildDefaults2(null);
-    var DEPRECATED_API_PORTS = SHARED.net.deprecatedApiPorts.slice();
+    var DEPRECATED_API_PORTS = SHARED2.net.deprecatedApiPorts.slice();
     function isDeprecatedApiPort(v) {
       const n = Number(v);
       return Number.isInteger(n) && DEPRECATED_API_PORTS.includes(n);
@@ -1435,13 +1431,13 @@ var require_config = __commonJS({
 var require_domain_config = __commonJS({
   "src/app/settings/domain-config.js"(exports2, module2) {
     "use strict";
-    var SHARED = require_shared_constants2();
+    var SHARED2 = require_shared_constants2();
     var defaults = [
       {
         at: "portPools",
         values: {
-          routerCtlPort: SHARED.net.routerCtlPort,
-          lanCtlPort: SHARED.net.lanCtlPort
+          routerCtlPort: SHARED2.net.routerCtlPort,
+          lanCtlPort: SHARED2.net.lanCtlPort
         }
       },
       {
@@ -1471,7 +1467,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.0.15");
+      if (true) return String("0.0.17");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -3362,15 +3358,15 @@ var require_client = __commonJS({
   "src/app/ctl/client.js"(exports2, module2) {
     "use strict";
     var hub = require_hub();
-    var SHARED = require_shared_constants2();
+    var SHARED2 = require_shared_constants2();
     function ctlCall(port, method, args, timeoutMs) {
       return hub.ctlCall(port, method, args, timeoutMs || 12e4, { withErrorFields: true });
     }
     function routerCtlPort(config) {
-      return Number(config && config.routerCtlPort) || SHARED.net.routerCtlPort;
+      return Number(config && config.routerCtlPort) || SHARED2.net.routerCtlPort;
     }
     function lanCtlPort(config) {
-      return Number(config && config.lanCtlPort) || SHARED.net.lanCtlPort;
+      return Number(config && config.lanCtlPort) || SHARED2.net.lanCtlPort;
     }
     function createCtlClient(deps) {
       const g = deps || {};
@@ -3922,8 +3918,7 @@ var require_alloc = __commonJS({
           await new Promise((res) => setTimeout(res, 10));
           waited += 10;
           if (waited >= XLOCK_TIMEOUT_MS) {
-            r._allocLock = true;
-            break;
+            throw new Error("ports.claimSlot: \u8FDB\u7A0B\u5185\u5206\u914D\u9501\u7B49\u5F85\u8D85\u65F6\uFF08" + XLOCK_TIMEOUT_MS + "ms\uFF09\uFF0C\u62D2\u7EDD\u5728\u65E0\u9501\u72B6\u6001\u4E0B\u5206\u914D");
           }
         }
         this._xrel = await this._acquireXLock();
@@ -3983,9 +3978,9 @@ var require_alloc = __commonJS({
                 await new Promise((res) => setTimeout(res, 25));
                 continue;
               }
-              return null;
+              throw new Error("ports.claimSlot: \u8DE8\u8FDB\u7A0B\u5206\u914D\u9501\u7B49\u5F85\u8D85\u65F6\uFF08" + XLOCK_TIMEOUT_MS + "ms\uFF09\uFF0C\u62D2\u7EDD\u5728\u65E0\u9501\u72B6\u6001\u4E0B\u5206\u914D");
             }
-            return null;
+            throw new Error("ports.claimSlot: \u8DE8\u8FDB\u7A0B\u5206\u914D\u9501\u83B7\u53D6\u5931\u8D25\uFF08" + (e && e.code ? e.code : e) + "\uFF09\uFF0C\u62D2\u7EDD\u5728\u65E0\u9501\u72B6\u6001\u4E0B\u5206\u914D");
           }
         }
       }
@@ -4512,6 +4507,19 @@ var require_collaborators = __commonJS({
       ui: { notify: "notify" }
     };
     var THIN_NAMES = Object.keys(THIN_SPEC);
+    function collaboratorSurface(host, name) {
+      const obj = host[name];
+      if (!obj || typeof obj !== "object") return [];
+      return Object.keys(obj).sort();
+    }
+    function requireThin(host, name, prop) {
+      const obj = host[name];
+      if (!obj || typeof obj[prop] !== "function") {
+        const have = collaboratorSurface(host, name);
+        throw new Error("app/assembly/collaborators: " + name + "." + prop + " \u4E0D\u5B58\u5728\uFF08\u5F53\u524D\u63A5\u53E3\u9762: " + (have.join(", ") || "\u7A7A") + "\uFF09");
+      }
+      return obj[prop];
+    }
     function assertCollaboratorTargets(host) {
       const missing = [];
       for (const name of THIN_NAMES) {
@@ -4520,6 +4528,8 @@ var require_collaborators = __commonJS({
         }
       }
       if (missing.length) throw new Error("app/assembly/collaborators: \u63A5\u53E3\u8868\u6307\u5411\u7F3A\u5931\u65B9\u6CD5: " + missing.join(", "));
+      const empty = THIN_NAMES.filter((n) => collaboratorSurface(host, n).length === 0);
+      if (empty.length) throw new Error("app/assembly/collaborators: \u63A5\u53E3\u9762\u4E3A\u7A7A: " + empty.join(", "));
     }
     function installFieldHelpers(host, state) {
       for (const [suf, field] of ENTRY_FIELDS) {
@@ -4685,7 +4695,7 @@ var require_collaborators = __commonJS({
       if (options && options.validate) assertCollaboratorTargets(host);
       return host;
     }
-    module2.exports = { THIN_SPEC, assertCollaboratorTargets, installCollaborators };
+    module2.exports = { THIN_SPEC, assertCollaboratorTargets, installCollaborators, collaboratorSurface, requireThin };
   }
 });
 
@@ -6604,6 +6614,71 @@ var require_file_protect = __commonJS({
   }
 });
 
+// src/platform/os/liveness.js
+var require_liveness = __commonJS({
+  "src/platform/os/liveness.js"(exports2, module2) {
+    "use strict";
+    var fs2 = require("node:fs");
+    var pidlook = require_pidlookup();
+    function readPidFile(f) {
+      if (!f) return null;
+      try {
+        const t = fs2.readFileSync(f, "utf8").trim();
+        const n = Number.parseInt(t, 10);
+        return Number.isInteger(n) && n > 0 ? n : null;
+      } catch {
+        return null;
+      }
+    }
+    function anchorsHit(pid, anchors) {
+      if (!Array.isArray(anchors) || !anchors.length) return null;
+      const cmd2 = pidlook.readCmdline(pid);
+      if (!cmd2) return null;
+      return anchors.every((a) => a && cmd2.indexOf(String(a)) !== -1);
+    }
+    function judge(identity) {
+      const q = identity || {};
+      const anchors = Array.isArray(q.anchors) ? q.anchors : [];
+      const evidence = [];
+      let pid = Number.isInteger(q.pid) && q.pid > 0 ? q.pid : null;
+      let via = null;
+      if (!pid) {
+        pid = readPidFile(q.pidFile);
+        if (pid) {
+          via = "pidfile";
+          evidence.push("pid \u6765\u81EA pid \u6587\u4EF6");
+        }
+      }
+      const port = Number.isInteger(q.port) && q.port > 0 ? q.port : null;
+      if (!pid && port) {
+        pid = pidlook.findListeningPid(port);
+        if (pid) {
+          via = "port";
+          evidence.push("pid \u6765\u81EA\u7AEF\u53E3\u76D1\u542C\u8005");
+        }
+      }
+      if (!pid) return { state: "dead", pid: null, via: null, evidence: ["\u65E0 pid \u8BC1\u636E"] };
+      const alive = pidlook.probeAlive(pid);
+      if (alive === "dead") return { state: "dead", pid, via, evidence: evidence.concat(["pid \u5DF2\u9000\u51FA"]) };
+      if (alive === "unknown") return { state: "unknown", pid, via, evidence: evidence.concat(["pid \u5B58\u6D3B\u4E0D\u53EF\u5224\u5B9A"]) };
+      const cmd2 = pidlook.readCmdline(pid);
+      if (anchors.length) {
+        if (!cmd2) return { state: "unknown", pid, via, evidence: evidence.concat(["cmdline \u4E0D\u53EF\u8BFB\uFF0C\u951A\u70B9\u65E0\u6CD5\u6821\u9A8C"]) };
+        const hit = anchorsHit(pid, anchors);
+        if (hit === true) return { state: "ours", pid, via, evidence: evidence.concat(["\u951A\u70B9\u5168\u90E8\u547D\u4E2D"]) };
+        return { state: "foreign", pid, via, evidence: evidence.concat(["\u951A\u70B9\u672A\u5168\u90E8\u547D\u4E2D"]) };
+      }
+      if (cmd2) {
+        const known = pidlook.isDshCmdlineText(cmd2);
+        if (known) return { state: "ours", pid, via, evidence: evidence.concat(["cmdline \u547D\u4E2D dsh"]) };
+        return { state: "foreign", pid, via, evidence: evidence.concat(["cmdline \u975E dsh"]) };
+      }
+      return { state: "unknown", pid, via, evidence: evidence.concat(["cmdline \u4E0D\u53EF\u8BFB\uFF0C\u8EAB\u4EFD\u4E0D\u53EF\u5224\u5B9A"]) };
+    }
+    module2.exports = { judge, readPidFile, anchorsHit };
+  }
+});
+
 // src/platform/os/spawn.js
 var require_spawn = __commonJS({
   "src/platform/os/spawn.js"(exports2, module2) {
@@ -6643,6 +6718,7 @@ var require_portable = __commonJS({
     "use strict";
     var fs2 = require("node:fs");
     var pidlookup = require_pidlookup();
+    var { judge: judgeIdentity } = require_liveness();
     var spawner = require_spawn();
     var procOS = require_process();
     var OUTCOME = require_outcome();
@@ -6658,10 +6734,7 @@ var require_portable = __commonJS({
       }
     }
     function matchesAnchors(pid, anchors) {
-      if (!pid || !Array.isArray(anchors) || !anchors.length) return false;
-      const cmd2 = pidlookup.readCmdline(pid);
-      if (!cmd2) return false;
-      return anchors.some((a) => a && cmd2.indexOf(String(a)) !== -1);
+      return judgeIdentity({ pid, anchors }).state === "ours";
     }
     var portOf = (o) => {
       const p = Number(o && o.port);
@@ -7362,10 +7435,8 @@ var require_win32 = __commonJS({
       }
     }
     function status() {
-      const guard = hasTask(BRAND2.WINDOWS_GUARD_TASK);
       const gui = hasTask(BRAND2.WINDOWS_GUI_TASK);
-      const watchdog = hasTask(BRAND2.WINDOWS_WATCHDOG_TASK);
-      return { kind: "schtasks", on: guard || gui || watchdog, gui, watchdog, guard };
+      return { kind: "schtasks", on: gui, gui };
     }
     function setAutostart(on, deps) {
       const errors = [];
@@ -7658,13 +7729,7 @@ var require_autostart = __commonJS({
     var isLinux = process.platform === "linux";
     var isMac = process.platform === "darwin";
     var isWindows = process.platform === "win32";
-    var CLI_EXE = isWindows ? BRAND2.CLI_NAME + ".exe" : BRAND2.CLI_NAME;
     var GUI_EXE = isWindows ? BRAND2.GUI_BIN_NAME + ".exe" : BRAND2.GUI_BIN_NAME;
-    function daemonCommand() {
-      const hit = resolveExecutable(BRAND2.CLI_NAME, { envVar: BRAND2.ENV_DAEMON });
-      if (hit) return hit;
-      return path2.join(os2.homedir(), ".local", "bin", CLI_EXE);
-    }
     function guiCommand() {
       const hit = resolveExecutable(BRAND2.GUI_BIN_NAME, { envVar: BRAND2.ENV_SHELL_EXE });
       if (hit) return hit;
@@ -7702,7 +7767,7 @@ var require_autostart = __commonJS({
       if (pl !== "linux") return { ok: false, unsupported: true, platform: pl, enabled: false, error: "\u672A\u77E5\u5E73\u53F0" };
       return linux.setGuiAutostart(on, DEPS);
     }
-    module2.exports = { status, setAutostart, setGuiAutostart, daemonCommand, guiCommand };
+    module2.exports = { status, setAutostart, setGuiAutostart, guiCommand };
   }
 });
 
@@ -8917,6 +8982,39 @@ var require_registry3 = __commonJS({
       }
       return info;
     }
+    var http2 = require("node:http");
+    var https = require("node:https");
+    function probeOriginHttp(origin, timeoutMs) {
+      return new Promise((resolve) => {
+        let u;
+        try {
+          u = new URL(origin);
+        } catch {
+          return resolve({ ok: false, latencyMs: null, error: "origin \u975E\u6CD5" });
+        }
+        const mod = u.protocol === "https:" ? https : http2;
+        const t0 = Date.now();
+        const req = mod.get(u, (res) => {
+          res.resume();
+          resolve({ ok: res.statusCode < 500, latencyMs: Date.now() - t0, status: res.statusCode });
+        });
+        req.setTimeout(Math.max(200, Number(timeoutMs) || 5e3), () => {
+          try {
+            req.destroy();
+          } catch {
+          }
+          resolve({ ok: false, latencyMs: null, error: "\u8D85\u65F6" });
+        });
+        req.on("error", (e) => resolve({ ok: false, latencyMs: null, error: e.message }));
+      });
+    }
+    function probeRegistry(state, origin, opts) {
+      const o = opts || {};
+      return probeOriginHttp(origin, o.timeoutMs);
+    }
+    function probeOrigin(state, origin, opts) {
+      return probeRegistry(state, origin, opts);
+    }
     module2.exports = {
       platformTag,
       registryOrigins,
@@ -8924,7 +9022,9 @@ var require_registry3 = __commonJS({
       selectRegistry,
       registryOrigin,
       registryInfo,
-      setRegistryConfig
+      setRegistryConfig,
+      probeOrigin,
+      probeRegistry
     };
   }
 });
@@ -9870,6 +9970,7 @@ var require_monitor = __commonJS({
   "src/platform/service/monitor.js"(exports2, module2) {
     "use strict";
     var pidlook = require_pidlookup();
+    var { judge: judgeIdentity } = require_liveness();
     var probeModule = require_probe2();
     function isPortListening(host, port, timeoutMs) {
       return probeModule.portListening(host, port, timeoutMs || 1e3);
@@ -9889,10 +9990,7 @@ var require_monitor = __commonJS({
       return { up: pid !== null, pid, isDsh };
     }
     function matchesAnchors(pid, anchors) {
-      if (!pid || !Array.isArray(anchors) || !anchors.length) return false;
-      const cmd2 = pidlook.readCmdline(pid);
-      if (!cmd2) return false;
-      return anchors.every((a) => a && cmd2.indexOf(String(a)) !== -1);
+      return judgeIdentity({ pid, anchors }).state === "ours";
     }
     function probeInstance(inst, opts) {
       const o = opts || {};
@@ -10377,6 +10475,58 @@ var require_command = __commonJS({
   }
 });
 
+// src/shared/guardian.js
+var require_guardian = __commonJS({
+  "src/shared/guardian.js"(exports2, module2) {
+    "use strict";
+    function shouldGuard(inst) {
+      return !!(inst && inst.guardian === true);
+    }
+    function bumpStartupFailure(w, now, cfg) {
+      const windowMs = cfg && Number(cfg.windowMs) > 0 ? Number(cfg.windowMs) : 6e4;
+      const burst = cfg && Number(cfg.burst) >= 1 ? Number(cfg.burst) : 5;
+      let start = w.start;
+      let count = w.count;
+      if (start === null || start === void 0 || now - start > windowMs) {
+        start = now;
+        count = 1;
+      } else {
+        count += 1;
+      }
+      return { start, count, tripped: count >= burst };
+    }
+    function makeBudget(cfg) {
+      const windowMs = cfg && Number(cfg.windowMs) > 0 ? Number(cfg.windowMs) : 6e4;
+      const burst = cfg && Number(cfg.burst) >= 1 ? Number(cfg.burst) : 5;
+      let state = { start: null, count: 0 };
+      const self = {
+        windowMs,
+        burst,
+        get count() {
+          return state.count;
+        },
+        get tripped() {
+          return state.count >= burst;
+        },
+        note(startupFailure) {
+          if (startupFailure === false || startupFailure == null) {
+            return { tripped: false, count: state.count, halted: false };
+          }
+          const dec = bumpStartupFailure(state, Date.now(), { windowMs, burst });
+          state.start = dec.start;
+          state.count = dec.count;
+          return { tripped: dec.tripped, count: state.count, halted: dec.tripped };
+        },
+        reset() {
+          state = { start: null, count: 0 };
+        }
+      };
+      return self;
+    }
+    module2.exports = { shouldGuard, bumpStartupFailure, makeBudget };
+  }
+});
+
 // src/app/main/port-rederive.js
 var require_port_rederive = __commonJS({
   "src/app/main/port-rederive.js"(exports2, module2) {
@@ -10468,6 +10618,7 @@ var require_process2 = __commonJS({
     var { LineBuffer } = require_log();
     var native = require_command();
     var BRAND2 = require_brand();
+    var guardian = require_guardian();
     var { findManagedDshPort, applyMainPort } = require_port_rederive();
     var DEPS = /* @__PURE__ */ new WeakMap();
     var HELPERS = [
@@ -10482,7 +10633,9 @@ var require_process2 = __commonJS({
       "SetObservedOnly",
       "StartDeadline",
       "SetStartDeadline",
+      "StartupFailWindowStart",
       "SetStartupFailWindowStart",
+      "StartupFailCount",
       "SetStartupFailCount",
       "SetLastFailure",
       "SetLastRestartAt",
@@ -10513,6 +10666,10 @@ var require_process2 = __commonJS({
           beginRestart: (reason, opts) => host._beginRestart(reason, opts),
           writeMainOwner: (pid, port) => host._writeMainOwner(pid, port)
         };
+        const unresolved = HELPERS.filter((n) => typeof host["_m" + n] !== "function");
+        if (unresolved.length) {
+          throw new Error("app/main/process: HELPERS \u6307\u5411\u4E0D\u5B58\u5728\u7684\u65B9\u6CD5: " + unresolved.map((n) => "_m" + n).join(", "));
+        }
         for (const n of HELPERS) d["m" + n] = (...a) => host["_m" + n](...a);
         DEPS.set(host, d);
       }
@@ -10700,13 +10857,31 @@ var require_process2 = __commonJS({
           d.logger().warn("restart triggered: " + reason + (startupFailure ? "\uFF08\u542F\u52A8\u7A97\u53E3\u5185\u9000\u51FA\uFF0C\u8BA1\u4E00\u6B21\u542F\u52A8\u5931\u8D25\uFF09" : "\uFF08\u6B63\u5E38\u91CD\u542F\uFF09"));
           d.tokenService().clear("main");
           if (!manual) d.mSetRestartCount(d.mRestartCount() + 1);
-          const throttle = null;
-          if (throttle && throttle.failed) {
+          let throttle = null;
+          if (startupFailure) {
+            throttle = guardian.bumpStartupFailure(
+              { start: d.mStartupFailWindowStart(), count: d.mStartupFailCount() },
+              Date.now(),
+              {
+                windowMs: d.config().startupFailWindowMs || 6e4,
+                burst: d.config().startupFailBurst || 5
+              }
+            );
+            d.mSetStartupFailWindowStart(throttle.start);
+            d.mSetStartupFailCount(throttle.count);
+          }
+          if (throttle && throttle.tripped) {
+            d.state().setPhase("FAILED");
+            d.mSetStartDeadline(null);
             d.mSetRestartAt(null);
-          } else {
-            d.state().setPhase("STARTING");
-            d.mSetRestartAt(Date.now() + d.config().portReleaseWaitMs);
+            d.writeCrashHalted(true);
+            d.events().append("main_startup_failed", { reason, count: throttle.count });
+            d.logger().error("\u4E3B\u8FDB\u7A0B\u542F\u52A8\u53CD\u590D\u5931\u8D25\uFF08" + throttle.count + " \u6B21\uFF09\uFF0C\u5DF2\u505C\u6B62\u81EA\u52A8\u91CD\u542F");
+            d.state().write();
+            return;
           }
+          d.state().setPhase("STARTING");
+          d.mSetRestartAt(Date.now() + d.config().portReleaseWaitMs);
           d.mSetStartDeadline(null);
           const child = d.mChild();
           if (child && child.exitCode === null) d.main().killSequence(child);
@@ -12638,7 +12813,7 @@ var require_env_catalog = __commonJS({
   "src/platform/service/env-catalog.js"(exports2, module2) {
     "use strict";
     var runtime = require_runtime();
-    var SHARED = require_shared_constants2();
+    var SHARED2 = require_shared_constants2();
     var ex2 = require_exec();
     var BRAND2 = require_brand();
     function whichVersion(bin, args) {
@@ -12676,7 +12851,7 @@ var require_env_catalog = __commonJS({
       if (hit && Date.now() - hit.at < CACHE_TTL) return Promise.resolve(hit.v);
       return whichVersionAsync(bin, args).then((v) => cacheSet(key, v));
     }
-    var MIN_NODE_DEFAULT = SHARED.runtime.minNode;
+    var MIN_NODE_DEFAULT = SHARED2.runtime.minNode;
     var _runtimeMetaCache = null;
     var _runtimeMetaAt = 0;
     function runtimeMeta() {
@@ -16253,58 +16428,6 @@ var require_instance_lifecycle = __commonJS({
   }
 });
 
-// src/shared/guardian.js
-var require_guardian = __commonJS({
-  "src/shared/guardian.js"(exports2, module2) {
-    "use strict";
-    function shouldGuard(inst) {
-      return !!(inst && inst.guardian === true);
-    }
-    function bumpStartupFailure(w, now, cfg) {
-      const windowMs = cfg && Number(cfg.windowMs) > 0 ? Number(cfg.windowMs) : 6e4;
-      const burst = cfg && Number(cfg.burst) >= 1 ? Number(cfg.burst) : 5;
-      let start = w.start;
-      let count = w.count;
-      if (start === null || start === void 0 || now - start > windowMs) {
-        start = now;
-        count = 1;
-      } else {
-        count += 1;
-      }
-      return { start, count, tripped: count >= burst };
-    }
-    function makeBudget(cfg) {
-      const windowMs = cfg && Number(cfg.windowMs) > 0 ? Number(cfg.windowMs) : 6e4;
-      const burst = cfg && Number(cfg.burst) >= 1 ? Number(cfg.burst) : 5;
-      let state = { start: null, count: 0 };
-      const self = {
-        windowMs,
-        burst,
-        get count() {
-          return state.count;
-        },
-        get tripped() {
-          return state.count >= burst;
-        },
-        note(startupFailure) {
-          if (startupFailure === false || startupFailure == null) {
-            return { tripped: false, count: state.count, halted: false };
-          }
-          const dec = bumpStartupFailure(state, Date.now(), { windowMs, burst });
-          state.start = dec.start;
-          state.count = dec.count;
-          return { tripped: dec.tripped, count: state.count, halted: dec.tripped };
-        },
-        reset() {
-          state = { start: null, count: 0 };
-        }
-      };
-      return self;
-    }
-    module2.exports = { shouldGuard, bumpStartupFailure, makeBudget };
-  }
-});
-
 // src/domains/router/providers/restart.js
 var require_restart = __commonJS({
   "src/domains/router/providers/restart.js"(exports2, module2) {
@@ -16454,9 +16577,9 @@ var require_restart = __commonJS({
   }
 });
 
-// src/app/control/process-lifecycle.js
+// src/platform/os/process-lifecycle.js
 var require_process_lifecycle = __commonJS({
-  "src/app/control/process-lifecycle.js"(exports2, module2) {
+  "src/platform/os/process-lifecycle.js"(exports2, module2) {
     "use strict";
     var procOS = require_process();
     var pidlook = require_pidlookup();
@@ -24233,7 +24356,9 @@ var require_pm_client = __commonJS({
       const port = Number(j.port);
       if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
       if (!pidAlive2(Number(j.pid))) return null;
-      return { port, host: typeof j.host === "string" && j.host ? j.host : HOST };
+      const token = typeof j.token === "string" ? j.token : "";
+      if (!token) return null;
+      return { port, host: typeof j.host === "string" && j.host ? j.host : HOST, token };
     }
     function post(route, payload) {
       const ep = endpoint();
@@ -24258,7 +24383,7 @@ var require_pm_client = __commonJS({
           port: ep.port,
           path: route,
           method: "POST",
-          headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
+          headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body), "x-lobox-mgmt-token": ep.token },
           timeout: TIMEOUT_MS
         },
         (res) => {
@@ -25133,7 +25258,7 @@ var require_upgrade2 = __commonJS({
       host._activeTaskId = null;
       return { ok: true, result: "up-to-date", from: oldV, to: target };
     }
-    function finishStopped(host, oldV, target, task) {
+    async function finishStopped(host, oldV, target, task) {
       host.upgradeState = "done";
       host.upgradeFinishedAt = (/* @__PURE__ */ new Date()).toISOString();
       log(host, "DSH \u671F\u671B\u72B6\u6001\u4E3A stopped\uFF1B\u4E0B\u6B21 start \u5C06\u4F7F\u7528\u65B0\u7248\u672C\u3002");
@@ -25143,7 +25268,7 @@ var require_upgrade2 = __commonJS({
         host.tasks.succeed(task.id);
       }
       host._activeTaskId = null;
-      if (host.hooks.resumeAfterUpgrade) host.hooks.resumeAfterUpgrade();
+      if (host.hooks.resumeAfterUpgrade) await host.hooks.resumeAfterUpgrade();
       return { ok: true, result: "installed", from: oldV, to: target };
     }
     function finishVerified(host, oldV, target, task) {
@@ -25164,7 +25289,7 @@ var require_upgrade2 = __commonJS({
       markStep(host, task, "\u62C9\u8D77\u5E76\u9A8C\u8BC1");
       log(host, "\u91CD\u65B0\u62C9\u8D77 DSH\uFF0C\u7B49\u5F85\u5065\u5EB7\u9A8C\u8BC1\u2026");
       taskLog(host, task, "\u91CD\u65B0\u62C9\u8D77 DSH\uFF0C\u7B49\u5F85\u5065\u5EB7\u9A8C\u8BC1\u2026");
-      if (host.hooks.resumeAfterUpgrade) host.hooks.resumeAfterUpgrade();
+      if (host.hooks.resumeAfterUpgrade) await host.hooks.resumeAfterUpgrade();
       const port = host._targetPort();
       if (!port) {
         const msg = "\u65E0\u6CD5\u786E\u5B9A\u539F\u751F DSH \u7AEF\u53E3\uFF08healthUrl \u7F3A\u5931\uFF09";
@@ -25220,7 +25345,7 @@ var require_upgrade2 = __commonJS({
       } catch (e2) {
         tlog("manifest \u66F4\u65B0\u5931\u8D25: " + e2.message);
       }
-      if (host.hooks.resumeAfterUpgrade) host.hooks.resumeAfterUpgrade();
+      if (host.hooks.resumeAfterUpgrade) await host.hooks.resumeAfterUpgrade();
       const port = host._targetPort();
       if (port) {
         const healthy = await host._waitNativeHealthy(port, host._mainUnit(), 6e4);
@@ -25288,7 +25413,7 @@ var require_upgrade2 = __commonJS({
         if (taskId && host.tasks) host.tasks.fail(taskId, err.message, { meta: { rolledBack: false } });
       }
       if (host.hooks.desiredRunning && host.hooks.desiredRunning()) log(host, "\u6062\u590D\u542F\u52A8 DSH\uFF08\u5F53\u524D\u78C1\u76D8\u7248\u672C\uFF09\u3002");
-      if (host.hooks.resumeAfterUpgrade) host.hooks.resumeAfterUpgrade();
+      if (host.hooks.resumeAfterUpgrade) await host.hooks.resumeAfterUpgrade();
       host._activeTaskId = null;
     }
     async function upgrade(host, requestedVersion) {
@@ -25803,7 +25928,25 @@ var require_domains = __commonJS({
           isDshActive: () => ["STARTING", "RUNNING"].includes(host._mPhase()),
           desiredRunning: () => host._mDesired() === "running",
           verifyDeadlineMs: () => Math.max(2 * host.config.startsecs * 1e3, 12e4),
-          notify: (t, b) => host.notify(t, b)
+          notify: (t, b) => host.notify(t, b),
+          stopForUpgrade: async () => {
+            const want = host._mDesired();
+            if (want !== "stopped") host.setDesired("stopped");
+            host.stopProcess("upgrade-stop");
+            const deadline = Date.now() + Math.max(2 * host.config.startsecs * 1e3, 12e4);
+            while (Date.now() < deadline) {
+              const child = host._mChild();
+              const alive = !!child && child.exitCode === null;
+              if (!alive) return { ok: true, stopped: true };
+              await new Promise((r) => setTimeout(r, 250));
+            }
+            return { ok: false, error: "upgrade-stop-timeout" };
+          },
+          resumeAfterUpgrade: async () => {
+            if (host._mDesired() !== "running") host.setDesired("running");
+            await host.startProcess();
+            return { ok: true };
+          }
         }
       });
       host._registerFixedPorts();
@@ -26097,10 +26240,7 @@ var require_lifecycle3 = __commonJS({
         return send(200, { sessionState: sup.sessionState ? sup.sessionState() : "unknown" });
       }
       if (req.method === "POST" && pathname === "/session/stop") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         req.resume();
         return Promise.resolve(sup.shutdownAll()).then((r) => send(r && r.ok === false ? 400 : 200, r || { ok: true })).catch((e) => send(500, { ok: false, error: e.message }));
       }
@@ -26120,10 +26260,7 @@ var require_lifecycle3 = __commonJS({
           return lc ? send(200, lc.snapshot()) : send(404, { error: "\u6A21\u5757\u672A\u6CE8\u518C: " + id });
         }
         if (req.method === "POST" && action) {
-          if (!originAllowed(req)) {
-            req.resume();
-            return send(403, { ok: false, error: "cross-origin request rejected" });
-          }
+          if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
           const lc = lm.get(id);
           if (!lc) return send(404, { error: "\u6A21\u5757\u672A\u6CE8\u518C: " + id });
           if (id === "dsh" && sup && (action === "start" || action === "stop" || action === "restart")) {
@@ -26225,18 +26362,12 @@ var require_native = __commonJS({
         });
       }
       if (req.method === "POST" && pathname === "/native/check-update") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         sup.nativeManager.checkUpdate().then((r) => send(200, { ok: true, ...r })).catch((e) => send(500, { ok: false, error: e.message }));
         return;
       }
       if (req.method === "POST" && pathname === "/native/install") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 1024, (body) => {
           let version = null;
           try {
@@ -26251,10 +26382,7 @@ var require_native = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/native/upgrade") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           let requested = null;
           try {
@@ -26272,19 +26400,13 @@ var require_native = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/native/uninstall") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const r = sup.nativeManager.startUninstall();
         if (r && r.ok === false) return send(400, r);
         return send(202, { ok: true, accepted: true, state: "uninstalling" });
       }
       if (req.method === "POST" && pathname === "/native/settings") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26350,10 +26472,7 @@ var require_guard = __commonJS({
         return send(200, sup.autostartStatus());
       }
       if (req.method === "POST" && pathname === "/autostart") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 1024, (body) => {
           let enabled = null;
           try {
@@ -26371,10 +26490,7 @@ var require_guard = __commonJS({
         return send(200, sup.lanPanelStatus());
       }
       if (req.method === "POST" && pathname === "/settings/lan") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 1024, (body) => {
           let enabled = null;
           try {
@@ -26392,10 +26508,7 @@ var require_guard = __commonJS({
         return send(200, sup.accessKeyStatus());
       }
       if (req.method === "POST" && pathname === "/settings/access-key") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           let key = null;
           try {
@@ -26414,10 +26527,7 @@ var require_guard = __commonJS({
         return send(200, sup.closeActionStatus());
       }
       if (req.method === "POST" && pathname === "/settings/close-action") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 1024, (body) => {
           let v = null;
           try {
@@ -26435,10 +26545,7 @@ var require_guard = __commonJS({
         return send(200, sup.externalBrowserStatus());
       }
       if (req.method === "POST" && pathname === "/settings/external-browser") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 2048, (body) => {
           let id = null;
           let given = false;
@@ -26457,10 +26564,7 @@ var require_guard = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/shutdown") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         req.resume();
         Promise.resolve(sup.shutdownAll()).then((r) => {
           try {
@@ -26472,10 +26576,7 @@ var require_guard = __commonJS({
         return;
       }
       if (req.method === "GET" && pathname === "/self-update/status") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         Promise.resolve(sup.guardSelfUpdateStatus()).then((r) => send(r.ok ? 200 : 400, r));
         return;
       }
@@ -26498,35 +26599,23 @@ var require_guard = __commonJS({
         });
       }
       if (req.method === "GET" && pathname === "/env/dsh") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         return send(200, sup.dshenvStatus());
       }
       if (req.method === "GET" && pathname === "/env/status") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         return Promise.resolve(sup.envStatus()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "GET" && pathname === "/env/node-lts") {
         return sup.nodeLtsStatus().then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "GET" && pathname === "/env/environment") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const force = /[?&]force=1/.test(String(req.url || ""));
         return Promise.resolve(force ? environment.refresh({ persist: true, force: true }) : environment.form()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: "\u73AF\u5883\u8868\u5355\u88C5\u914D\u5931\u8D25\uFF1A" + (e && e.message || e) }));
       }
       if (req.method === "GET" && pathname === "/env/environment/last") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         return send(200, environment.lastSnapshot());
       }
       if (req.method === "POST" && pathname === "/env/open-url") {
@@ -26534,10 +26623,7 @@ var require_guard = __commonJS({
           req.resume();
           return send(403, { ok: false, error: "\u4EC5\u5185\u6838\u6240\u5728\u673A\u5668\u53EF\u8BF7\u5185\u6838\u8C03\u8D77\u6D4F\u89C8\u5668\uFF0C\u8BF7\u590D\u5236\u6216\u81EA\u884C\u6253\u5F00\u8BE5\u5730\u5740" });
         }
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           let url = null;
           try {
@@ -26579,10 +26665,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerStatusView()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, running: false, error: e && e.message || String(e) }));
       }
       if (req.method === "POST" && pathname.startsWith("/router/")) {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const action = pathname.slice("/router/".length);
         req.resume();
         if (action === "start") {
@@ -26596,10 +26679,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerProviders()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname === "/router/providers/add") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 65536, (body) => {
           let j = {};
           try {
@@ -26615,18 +26695,12 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/login/start") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         Promise.resolve(sup.routerApi().commandcodeLoginStart()).then((r) => send(r.ok ? 200 : 400, r)).catch((e) => send(500, { ok: false, error: e && e.message || String(e) }));
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/login/wait") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           const j = {};
           try {
@@ -26640,18 +26714,12 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/update/check") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         Promise.resolve(sup.routerApi().refreshProxyUpdateInfo(true)).then((r) => send(200, { ok: true, versions: r })).catch((e) => send(500, { ok: false, error: e.message }));
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/update/apply") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26667,10 +26735,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerApi().proxyUpdateStatus(u.searchParams.get("appId") || "")).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/key") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 65536, (body) => {
           try {
             const j = JSON.parse(body);
@@ -26682,10 +26747,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/select") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = JSON.parse(body);
@@ -26697,10 +26759,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/key/remove") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = JSON.parse(body);
@@ -26712,10 +26771,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/keys/set") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 65536, (body) => {
           try {
             const j = JSON.parse(body);
@@ -26728,10 +26784,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/remove") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26743,10 +26796,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/key/use") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26759,10 +26809,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/account/discard") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = JSON.parse(body);
@@ -26774,10 +26821,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/refresh") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26790,10 +26834,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/activate") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26806,10 +26847,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/deactivate") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 4096, (body) => {
           try {
             const j = body ? JSON.parse(body) : {};
@@ -26856,10 +26894,7 @@ var require_plugins = __commonJS({
         return send(200, sup.pluginManager.installStatus(u.searchParams.get("job")));
       }
       if (req.method === "POST" && pathname.startsWith("/plugins/")) {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, { ok: false, error: "cross-origin request rejected" });
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const action = pathname.slice("/plugins/".length);
         collectBody(req, res, 65536, (body) => {
           let name = null;
@@ -26932,10 +26967,7 @@ var require_dist = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/set") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         collectBody(req, res, 8192, (body) => {
           let j = {};
           try {
@@ -26951,18 +26983,12 @@ var require_dist = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/refresh") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         sup.dist.selectRegistry(true).then(() => sup.dist.registryInfo()).then((r) => send(200, { ok: true, ...r })).catch((e) => send(500, { ok: false, error: e.message }));
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/probe") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         return collectBody(req, res, 4096, (body) => {
           let j = {};
           try {
@@ -27279,10 +27305,7 @@ var require_instances = __commonJS({
         return render();
       }
       if (req.method === "POST" && pathname.startsWith("/instances/")) {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const act = pathname.slice("/instances/".length);
         collectBody(req, res, 65536, (body) => {
           try {
@@ -27361,10 +27384,7 @@ var require_relay = __commonJS({
         return Promise.resolve(sup.listLan()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname.startsWith("/remote/")) {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         const act = pathname.slice("/remote/".length);
         collectBody(req, res, 65536, (body) => {
           let j = {};
@@ -27424,10 +27444,7 @@ var require_shell2 = __commonJS({
         }
       }
       if (req.method === "POST" && pathname === "/shell/health") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         return collectBody(req, res, 8192, (body) => {
           let j = {};
           try {
@@ -27442,10 +27459,7 @@ var require_shell2 = __commonJS({
         });
       }
       if (req.method === "POST" && pathname === "/shell/check-update") {
-        if (!originAllowed(req)) {
-          req.resume();
-          return send(403, {});
-        }
+        if (!originAllowed(req)) return ctx.rejectCrossOrigin(ctx);
         req.resume();
         return Promise.resolve(shell.checkUpdate(sup.dist, { authoritative: true })).then((r) => {
           if (sup.events) {
@@ -27461,6 +27475,107 @@ var require_shell2 = __commonJS({
   }
 });
 
+// src/api/contract.js
+var require_contract = __commonJS({
+  "src/api/contract.js"(exports2, module2) {
+    "use strict";
+    var CATEGORIES = ["public", "operational", "internal", "deprecated"];
+    var SURFACE = [
+      { path: "/status", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["UI(polling)", "CLI(status)"], note: "\u72B6\u6001\u6458\u8981" },
+      { path: "/events", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["UI(timeline)"], note: "\u589E\u91CF\u4E8B\u4EF6" },
+      { path: "/healthz", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["\u58F3(\u63E1\u624B\u63A2\u9488)"], note: "\u5B58\u6D3B\u63A2\u9488" },
+      { path: "/readyz", methods: ["GET"], domain: "lifecycle", category: "operational", consumers: ["\u76D1\u63A7/\u7F16\u6392\u63A2\u9488"], note: "\u5C31\u7EEA\u63A2\u9488\uFF08\u5B88\u536B\u5DF2\u521D\u59CB\u5316\u4E14\u672A\u505C\u673A\uFF09" },
+      { path: "/session/status", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["\u58F3(get_session_state)"], note: "\u4F1A\u8BDD\u6001\u8BFB\u53D6\u53E3" },
+      { path: "/session/stop", methods: ["POST"], domain: "lifecycle", category: "public", consumers: ["\u58F3(\u9000\u51FA\u63E1\u624B)"], note: "\u505C\u5168\u90E8\u88AB\u7BA1\u5BF9\u8C61 + \u56DE\u6267\uFF08\u5B88\u536B\u4E0D\u81EA\u505C\uFF09" },
+      { path: "/metrics", methods: ["GET"], domain: "lifecycle", category: "operational", consumers: ["\u76D1\u63A7\u63A5\u5165"], note: "\u76D1\u63A7\uFF1A\u4E8B\u4EF6\u6D41\u6D3E\u751F\u9065\u6D4B\uFF08bySource/topTypes/\u4E8B\u4EF6\u7387\uFF09" },
+      { path: "/logs/tail", methods: ["GET"], domain: "lifecycle", category: "operational", consumers: ["\u8FDC\u7A0B\u8BCA\u65AD"], note: "\u8BCA\u65AD\uFF1A\u5404 stream \u65E5\u5FD7\u5C3E\u90E8\uFF08\u8DE8\u673A\u6392\u969C\uFF1B\u672C\u673A CLI \u76F4\u8BFB\u6587\u4EF6\uFF09" },
+      { path: "/logs/export", methods: ["GET"], domain: "lifecycle", category: "operational", consumers: ["\u5BA1\u8BA1/\u79BB\u7EBF\u5907\u4EFD"], note: "\u5BA1\u8BA1\uFF1A\u805A\u5408\u6D41 JSONL \u5BFC\u51FA\uFF08\u79BB\u7EBF\u5907\u4EFD/\u5408\u89C4\u7559\u75D5\uFF09" },
+      { path: "/lifecycle", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["UI"], note: "\u6A21\u5757\u751F\u547D\u5468\u671F\u4E00\u89C8\uFF08=/lifecycle/status\uFF09" },
+      { path: "/lifecycle/status", methods: ["GET"], domain: "lifecycle", category: "public", consumers: ["UI"], note: "\u540C\u4E0A\uFF08\u663E\u5F0F\u522B\u540D\uFF09" },
+      { path: "/changelog", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(AboutCard)"], note: "DSH \u66F4\u65B0\u65E5\u5FD7\uFF08text/plain\uFF09" },
+      { path: "/guard/changelog", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(AboutCard)"], note: "\u7BA1\u5BB6\u66F4\u65B0\u65E5\u5FD7\uFF08CHANGELOG.md\uFF09" },
+      { path: "/guard/version", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(AboutCard)"], note: "\u672C\u5730\u7248\u672C\uFF08\u65E0\u7F51\u7EDC I/O\uFF09" },
+      { path: "/guard/version/check", methods: ["POST"], domain: "guard", category: "public", consumers: ["UI(AboutCard, \u6E90\u7801\u5F62\u6001)"], note: "git \u4E0A\u6E38\u68C0\u67E5\uFF08\u6E90\u7801\u90E8\u7F72\u5F62\u6001\u66F4\u65B0\u901A\u9053\uFF09" },
+      { path: "/autostart", methods: ["GET", "POST"], domain: "guard", category: "public", consumers: ["UI(StartupCard)"], note: "\u6574\u6761\u670D\u52A1\u94FE\u5F00\u673A\u81EA\u542F" },
+      { path: "/shutdown", methods: ["POST"], domain: "guard", category: "deprecated", consumers: ["\u65E7\u7248\u58F3\u517C\u5BB9"], note: "\u66FF\u4EE3 = POST /session/stop\uFF1B\u4FDD\u7559\u4F9B\u65E7\u58F3\u9000\u51FA\uFF08\u79FB\u9664\u6761\u4EF6\uFF1A\u58F3\u6700\u4F4E\u7248\u672C >= \u4F7F\u7528 /session/stop \u7684\u7248\u672C\uFF09" },
+      { path: "/ports", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(PortPanel)"], note: "\u7AEF\u53E3\u89C6\u56FE\uFF08\u805A\u5408\u4E09\u6CE8\u518C\u8868\uFF09" },
+      { path: "/env/dsh", methods: ["GET"], domain: "guard", category: "public", consumers: ["README \u6587\u6863\u5316\uFF08\u5916\u90E8\u811A\u672C\uFF09"], note: "DSH \u672C\u4F53\u5B89\u88C5/\u7EB3\u7BA1\u5224\u5B9A\uFF08bin/binOk/managed/phase\uFF09" },
+      { path: "/env/status", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(InstancesPage \u80FD\u529B\u77E9\u9635)"], note: "\u73AF\u5883 + \u5E73\u53F0\u80FD\u529B\u77E9\u9635 + catalog" },
+      { path: "/env/node-lts", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(OverviewPage)"], note: "Node \u5F53\u524D vs \u5B98\u65B9\u6700\u65B0 LTS" },
+      { path: "/env/open-url", methods: ["POST"], domain: "guard", category: "public", consumers: ["UI(externalOpen \u5730\u5740\u884C)"], note: "\u8BF7\u5185\u6838\u7528\u7CFB\u7EDF\u9ED8\u8BA4\u6D4F\u89C8\u5668\u6253\u5F00 http(s) \u5730\u5740\uFF08\u4E09\u6863\u7ED3\u679C\u539F\u6837\u56DE\u4F20\uFF0C\u5931\u8D25\u5E26 evidence.diagnostics \u63A2\u6D4B\u7559\u75D5\uFF1B\u4EC5\u56DE\u73AF\u6765\u6E90\uFF0C\u58F3\u5185 webview \u4E22\u5F03 window.open \u65F6\u4EE3\u7684\u552F\u4E00\u4EE3\u5F00\u65B9\uFF09" },
+      { path: "/env/environment", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(OverviewPage \u73AF\u5883\u8868\u5355)", "README \u6587\u6863\u5316\uFF08\u4EBA\u5DE5/\u652F\u6301\u6392\u969C\u76F4\u8BFB\uFF1B\u6253\u5F00\u52A8\u4F5C\u7684\u8BCA\u65AD\u8D70 evidence.diagnostics\uFF09"], note: "\u73AF\u5883\u8868\u5355\uFF08\u53EA\u8BFB\u88C5\u914D\u9762\uFF0Cschema 2 \u7EF4\u5EA6\u53F0\u8D26\uFF09\uFF1A\u5019\u9009\u6D4F\u89C8\u5668 + \u7CFB\u7EDF\u9ED8\u8BA4\u53CA\u5176\u6765\u6E90 + \u56FE\u5F62\u4F1A\u8BDD + \u80FD\u529B\u6863\u4F4D + \u7528\u6237\u504F\u597D + \u8FD9\u4E00\u62CD\u7684\u5206\u53D1\u4F9D\u636E + \u8FD0\u884C\u65F6\uFF08Node/npm/\u955C\u50CF\u6E90/\u5168\u5C40\u524D\u7F00\uFF09+ \u51FA\u7F51\u6761\u4EF6\uFF08\u7CFB\u7EDF\u4EE3\u7406\u4E0E\u76EE\u6807\u57DF\u901A\u8DEF\uFF09+ \u6BCF\u6761\u7CFB\u7EDF\u67E5\u8BE2\u7559\u75D5\uFF1B?force=1 \u5F02\u6B65\u8865\u9F50\u5404\u7EF4\u5EA6\u5E76\u843D\u5FEB\u7167" },
+      { path: "/env/environment/last", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(OverviewPage \u73AF\u5883\u8868\u5355\u7684\u4E0A\u4E00\u62CD\u7559\u75D5)", "README \u6587\u6863\u5316\uFF08\u4EBA\u5DE5/\u652F\u6301\u6392\u969C\u76F4\u8BFB\uFF09"], note: "\u4E0A\u4E00\u62CD\u73AF\u5883\u5FEB\u7167\u7684\u53EA\u8BFB\u56DE\u770B\u53E3\uFF08\u96F6\u6478\u7F51\u96F6\u5199\u76D8\uFF0C\u7EDD\u4E0D\u53C2\u4E0E\u5206\u53D1\u5224\u5B9A\uFF09\uFF1Aavailable/at/ageMs/path + \u6574\u4EFD\u4E0A\u4E00\u62CD\u8868\u5355\uFF1B\u6CA1\u5199\u8FC7\uFF08never-written\uFF09\u4E0E\u8BFB\u4E0D\u51FA\uFF08unreadable-or-schema-mismatch\uFF09\u5206\u5F00\u6807" },
+      { path: "/settings/external-browser", methods: ["GET", "POST"], domain: "guard", category: "public", consumers: ["UI(OverviewPage \u73AF\u5883\u8868\u5355)"], note: "\u5916\u90E8\u6253\u5F00\u7684\u6D4F\u89C8\u5668\u504F\u597D\uFF08id \u5FC5\u987B\u662F\u672C\u673A\u5019\u9009\uFF1B\u7A7A\u4E32\u6E05\u9664\uFF09" },
+      { path: "/settings/access-key", methods: ["GET", "POST"], domain: "guard", category: "public", consumers: ["UI(StartupCard)"], note: "\u8BBF\u95EE\u5BC6\u94A5" },
+      { path: "/settings/close-action", methods: ["GET", "POST"], domain: "guard", category: "public", consumers: ["UI(StartupCard)", "\u58F3(\u8BFB\u53D6\u6267\u884C)"], note: "\u5173\u7A97\u884C\u4E3A\uFF08hide/exit\uFF09" },
+      { path: "/settings/lan", methods: ["GET", "POST"], domain: "guard", category: "public", consumers: ["UI(StartupCard)"], note: "\u9762\u677F\u5C40\u57DF\u7F51\u8BBF\u95EE\u5F00\u5173" },
+      { path: "/self-update/status", methods: ["GET"], domain: "guard", category: "public", consumers: ["UI(AboutCard)"], note: "\u5185\u6838\u66F4\u65B0\u72B6\u6001\uFF08\u53EA\u8BFB\uFF1B\u5B89\u88C5\u5F52\u684C\u9762\u58F3\uFF09" },
+      { path: "/self-update/apply", methods: ["POST"], domain: "guard", category: "deprecated", consumers: ["\u65E0"], note: "\u5355\u5199\u5165\u8005=\u58F3\uFF1A\u8FD4\u56DE 410 KERNEL_UPDATE_SINGLE_WRITER\uFF1B\u66FF\u4EE3 = \u684C\u9762\u58F3 kernel_update_apply" },
+      { path: "/self-update/restart-guard", methods: ["POST"], domain: "guard", category: "deprecated", consumers: ["\u65E0"], note: "\u5B88\u536B\u4E0D\u81EA\u91CD\u542F\uFF1A\u8FD4\u56DE 410\uFF1B\u66FF\u4EE3 = \u58F3\u5728\u5B89\u88C5\u540E\u7ECF\u670D\u52A1\u7BA1\u7406\u5668\u91CD\u542F\u5B88\u536B" },
+      { path: "/native/status", methods: ["GET"], domain: "native", category: "public", consumers: ["UI(OverviewPage)", "CLI(status)"], note: "\u5B89\u88C5\u72B6\u6001 + \u7248\u672C + \u5347\u7EA7\u72B6\u6001\u673A" },
+      { path: "/native/check-update", methods: ["POST"], domain: "native", category: "public", consumers: ["UI(OverviewPage)"], note: "\u89E6\u53D1\u7248\u672C\u68C0\u67E5" },
+      { path: "/native/install", methods: ["POST"], domain: "native", category: "public", consumers: ["UI(OverviewPage)", "CLI"], note: "\u5F02\u6B65\u5B89\u88C5\uFF08202\uFF09" },
+      { path: "/native/uninstall", methods: ["POST"], domain: "native", category: "public", consumers: ["UI(OverviewPage)"], note: "\u5F02\u6B65\u5378\u8F7D\uFF08202\uFF09" },
+      { path: "/native/upgrade", methods: ["POST"], domain: "native", category: "public", consumers: ["UI(OverviewPage)", "CLI(upgrade)"], note: "\u4E00\u952E\u5347\u7EA7\uFF08\u5931\u8D25\u56DE\u6EDA\uFF09" },
+      { path: "/native/settings", methods: ["POST"], domain: "native", category: "public", consumers: ["UI(OverviewPage)"], note: "main \u5143\u6570\u636E\u8865\u4E01\uFF08\u4EC5 guardian\uFF1B\u8FDC\u7A0B\u610F\u56FE\u552F\u4E00\u5165\u53E3\u5728 /remote/*\uFF09" },
+      { path: "/instances", methods: ["GET"], domain: "instances", category: "public", consumers: ["UI(InstancesPage)"], note: "\u5B9E\u4F8B\u5217\u8868\uFF08+ POST /instances/{action}\uFF09\uFF1B\u8FDC\u7A0B\u8BBF\u95EE\u4EE4\u724C\u660E\u6587\u4EC5\u56DE\u73AF\u6765\u6E90\u4E0B\u53D1\uFF08\u5176\u4F59\u53EA\u89C1 tokenSet \u5E03\u5C14\uFF09\uFF0CauthUrl \u7684 ?token= \u540C\u5224\u636E" },
+      { path: "/open", methods: ["GET"], domain: "instances", category: "public", consumers: ["UI(open-web \u2192 \u672C\u673A\u7CFB\u7EDF\u6D4F\u89C8\u5668\u4E00\u6B21\u6027\u7801\u8DF3\u8F6C)"], note: "\u4E00\u6B21\u6027\u7801\u6362\u53D6 dsh-auth cookie \u5E76\u56DE\u8DF3\u5B9E\u4F8B DSH \u9875\u9762\uFF08\u4EE4\u724C\u4E0D\u8FDB URL/argv\uFF09" },
+      { path: "/plugins/market", methods: ["GET"], domain: "plugins", category: "public", consumers: ["UI(PluginsPage)"], note: "\u5E02\u573A\u7D22\u5F15\uFF08TTL \u7F13\u5B58\uFF09" },
+      { path: "/plugins/installed", methods: ["GET"], domain: "plugins", category: "public", consumers: ["UI(PluginsPage)"], note: "\u5DF2\u88C5\u7B2C\u4E09\u65B9\u63D2\u4EF6" },
+      { path: "/plugins/check-updates", methods: ["GET"], domain: "plugins", category: "public", consumers: ["UI(PluginsPage)"], note: "\u5DF2\u88C5\u63D2\u4EF6\u66F4\u65B0\u68C0\u6D4B" },
+      { path: "/plugins/install-status", methods: ["GET"], domain: "plugins", category: "public", consumers: ["UI(PluginsPage, job \u8F6E\u8BE2)"], note: "\u63D2\u4EF6\u4EFB\u52A1\u8FDB\u5EA6" },
+      { path: "/router/status", methods: ["GET"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u4E2D\u8F6C\u72B6\u6001 + \u7528\u91CF" },
+      { path: "/router/providers", methods: ["GET"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u4F9B\u5E94\u5546 + \u8D26\u53F7 + \u5B9E\u4F8B\u89C6\u56FE" },
+      { path: "/router/ports", methods: ["GET"], domain: "router", category: "internal", consumers: ["p2p-api \u5951\u7EA6\u6D4B\u8BD5\uFF08\u57DF\u5206\u79BB\u9A8C\u8BC1\uFF09"], note: "router \u81EA\u6CBB\u6BB5\u7AEF\u53E3\u89C6\u56FE\uFF08daemon \u6A21\u5F0F\u7269\u7406\u5206\u79BB\uFF09" },
+      { path: "/router/domain-summary", methods: ["GET"], domain: "router", category: "internal", consumers: ["\u5B88\u536B\u76D1\u7763\u62CD\u81EA\u6D88\u8D39\uFF08\u5199\u76EE\u5F55 domainSummary\uFF09"], note: "\u57DF\u6458\u8981\u53EA\u8BFB\u7F13\u5B58" },
+      { path: "/router/providers/account/discard", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u8D26\u53F7\u4E22\u5F03" },
+      { path: "/router/providers/activate", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u6FC0\u6D3B\u4F9B\u5E94\u5546" },
+      { path: "/router/providers/add", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u65B0\u589E\u4F9B\u5E94\u5546" },
+      { path: "/router/providers/deactivate", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u505C\u7528\u4F9B\u5E94\u5546" },
+      { path: "/router/providers/key/use", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u5207\u6362\u4F7F\u7528\u4E2D\u7684 Key" },
+      { path: "/router/providers/keys/set", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u8BBE\u7F6E\u4F9B\u5E94\u5546 Key" },
+      { path: "/router/providers/proxy/key", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u53CD\u4EE3 Key \u5199\u5165" },
+      { path: "/router/providers/proxy/key/remove", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u53CD\u4EE3 Key \u79FB\u9664" },
+      { path: "/router/providers/proxy/select", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u9009\u62E9\u53CD\u4EE3" },
+      { path: "/router/providers/refresh", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u5237\u65B0\u4F9B\u5E94\u5546" },
+      { path: "/router/providers/remove", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u5220\u9664\u4F9B\u5E94\u5546" },
+      { path: "/router/proxy/login/start", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "Command Code \u4E00\u952E\u767B\u5F55\uFF08\u53D1\u8D77\uFF09" },
+      { path: "/router/proxy/login/wait", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u767B\u5F55\u7B49\u5F85" },
+      { path: "/router/proxy/update/apply", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u53CD\u4EE3\u66F4\u65B0\uFF08job\uFF09" },
+      { path: "/router/proxy/update/check", methods: ["POST"], domain: "router", category: "public", consumers: ["UI(RouterPage)"], note: "\u53CD\u4EE3\u7248\u672C\u68C0\u6D4B" },
+      { path: "/router/proxy/update/status", methods: ["GET"], domain: "router", category: "public", consumers: ["UI(RouterPage, job \u8F6E\u8BE2)"], note: "\u53CD\u4EE3\u66F4\u65B0\u8FDB\u5EA6" },
+      { path: "/dist/registry", methods: ["GET"], domain: "dist", category: "public", consumers: ["UI(RegistryCard)"], note: "\u955C\u50CF\u6E90\u72B6\u6001" },
+      { path: "/dist/registry/refresh", methods: ["POST"], domain: "dist", category: "public", consumers: ["UI(RegistryCard)"], note: "\u955C\u50CF\u6E90\u6D4B\u901F\u5237\u65B0" },
+      { path: "/dist/registry/set", methods: ["POST"], domain: "dist", category: "public", consumers: ["UI(RegistryCard)"], note: "\u955C\u50CF\u6E90\u624B\u52A8\u56FA\u5B9A" },
+      { path: "/dist/registry/probe", methods: ["POST"], domain: "dist", category: "public", consumers: ["UI(RegistryCard \u6D4B\u8BD5\u6309\u94AE)"], note: "\u540C\u6E90\u5355\u6E90\u63A2\u6D3B\uFF08\u670D\u52A1\u7AEF\uFF0C\u4E0D\u53D7\u9875\u9762 CSP \u9650\u5236\uFF09" },
+      { path: "/lan-access", methods: ["GET"], domain: "relay", category: "public", consumers: ["UI(LanPage)"], note: "\u8FDC\u7A0B\u4EE3\u7406\u5217\u8868\uFF08\u8131\u654F\uFF1A\u4EFB\u4F55\u4EE4\u724C\u5B57\u6BB5\u90FD\u4E0D\u5916\u4F20\uFF1Bremote \u89C6\u56FE\u4E3A\u8BBF\u95EE URL/\u5C31\u7EEA\u5224\u5B9A\u7684\u5355\u4E00\u6765\u6E90\uFF09" },
+      { path: "/remote/frp", methods: ["GET"], domain: "relay", category: "public", consumers: ["UI(LanPage)"], note: "frpc \u72B6\u6001\uFF08\u8BBE\u7F6E + \u8FD0\u884C\u6001 + wan \u66B4\u9732\u6E05\u5355\uFF09" },
+      { path: "/tasks", methods: ["GET"], domain: "tasks", category: "public", consumers: ["UI(TasksPage)"], note: "\u7EDF\u4E00\u4EFB\u52A1\u5217\u8868\uFF08+ /tasks/{id}\uFF09" },
+      { path: "/shell/status", methods: ["GET"], domain: "shell", category: "public", consumers: ["UI(\u58F3\u72B6\u6001\u5361)", "CLI"], note: "\u58F3\u8EAB\u4EFD + \u66F4\u65B0\u8D26\u672C + \u5224\u5B9A\u7ED3\u8BBA" },
+      { path: "/shell/health", methods: ["POST"], domain: "shell", category: "operational", consumers: ["\u8FD0\u7EF4\uFF1A\u6392\u969C\u65F6\u624B\u5DE5\u4E0A\u62A5\u58F3\u9636\u6BB5\uFF08\u58F3\u672A\u63A5\u7EBF\uFF0C\u5B9E\u6D4B\u96F6\u8C03\u7528\uFF09"], note: "\u8BCA\u65AD\u7528\u9014\uFF1Aphase=ready \u5373\u66F4\u65B0\u786E\u8BA4\u4FE1\u53F7\uFF0C\u4F9B\u6392\u969C\u624B\u5DE5\u9A71\u52A8\u5B89\u5168\u7F51\uFF1B\u5F53\u524D evaluate() \u56E0\u7F3A\u8F93\u5165\u6052 idle" },
+      { path: "/shell/update-pending", methods: ["POST"], domain: "shell", category: "operational", consumers: ["\u8FD0\u7EF4\uFF1A\u6392\u969C\u65F6\u624B\u5DE5\u5EFA\u7ACB\u66F4\u65B0\u8D26\u672C\uFF08\u58F3\u672A\u63A5\u7EBF\uFF0C\u5B9E\u6D4B\u96F6\u8C03\u7528\uFF09"], note: "\u8BCA\u65AD\u7528\u9014\uFF1A\u5EFA\u7ACB\u66F4\u65B0\u8D26\u672C\uFF08\u5F85\u91CD\u542F\u786E\u8BA4\uFF09\uFF0C\u4F9B\u6392\u969C\u624B\u5DE5\u9A71\u52A8\u5185\u6838\u4FA7\u5B89\u5168\u7F51" },
+      { path: "/shell/check-update", methods: ["POST"], domain: "shell", category: "public", consumers: ["UI(\u5173\u4E8E\u5361)"], note: "\u58F3\u7248\u672C\u68C0\u6D4B\uFF08\u4E0E\u5185\u6838\u81EA\u66F4\u65B0\u540C\u6E90\uFF1Anpm registry + \u955C\u50CF\u56DE\u9000\uFF09" }
+    ];
+    var PREFIXES = [
+      { prefix: "/dist/", domain: "dist", category: "public", consumers: ["UI"], note: "/dist/registry/{refresh|set}" },
+      { prefix: "/guard/", domain: "guard", category: "public", consumers: ["UI"], note: "/guard/version|changelog \u7B49" },
+      { prefix: "/instances/", domain: "instances", category: "public", consumers: ["UI"], note: "/instances/{add|remove|update|start|stop|check-update|open-web|upgrade}\uFF1Bopen-web \u56DE platform.browser.openBrowser \u7684\u4E09\u6863\u7ED3\u679C {ok,confirmed,handedOff,reason,error,url,evidence}\uFF0Curl \u6052\u5728\u573A\u4F9B\u9762\u677F\u590D\u5236/\u624B\u52A8\u6253\u5F00" },
+      { prefix: "/lifecycle", domain: "lifecycle", category: "public", consumers: ["UI", "CLI"], note: "/lifecycle/{id}[/{action}]\uFF08\u552F\u4E00\u542F\u505C\u5165\u53E3\uFF09" },
+      { prefix: "/lifecycle/", domain: "lifecycle", category: "public", consumers: ["UI", "CLI"], note: "\u540C\u4E0A\uFF08\u663E\u5F0F\u524D\u7F00\uFF09" },
+      { prefix: "/logs", domain: "lifecycle", category: "operational", consumers: ["\u8BCA\u65AD/\u5BA1\u8BA1"], note: "/logs/{tail|export}\uFF08\u65E0 events-tail\uFF1A\u4E0E /events \u8BED\u4E49\u91CD\u590D\uFF09" },
+      { prefix: "/native/", domain: "native", category: "public", consumers: ["UI", "CLI"], note: "/native/{status|install|uninstall|upgrade|...}" },
+      { prefix: "/plugins/", domain: "plugins", category: "public", consumers: ["UI"], note: "/plugins/{install|enable|disable|uninstall|update}" },
+      { prefix: "/remote/", domain: "relay", category: "public", consumers: ["UI"], note: "/remote/{set-mode|set-token|frp-server|frp-install}\uFF08\u610F\u56FE\u552F\u4E00\u5165\u53E3\uFF1Bset-mode \u5F00\u542F\u65F6\u65E0\u4EE4\u724C\u5373\u81EA\u52A8\u5206\u914D\u5E76\u56DE\u6267 tokenAutoAllocated\uFF0Cwan \u524D\u7F6E\u95F8=\u8BBF\u95EE\u4EE4\u724C \u22658 \u4F4D\uFF1Bset-token \u7A7A\u4E32=\u663E\u5F0F\u6E05\u9664\uFF09" },
+      { prefix: "/router/", domain: "router", category: "public", consumers: ["UI"], note: "/router/... \uFF08ports/domain-summary \u4E3A internal\uFF0C\u89C1 SURFACE\uFF09" },
+      { prefix: "/shell/", domain: "shell", category: "public", consumers: ["\u58F3", "UI"], note: "/shell/{status|health|update-pending|check-update|restart}\uFF08\u58F3\u66F4\u65B0\u5F3A\u5236\uFF0C\u65E0\u56DE\u9000\uFF09\uFF1B\u26A0 health/update-pending \u5B9E\u4E3A\u58F3\u96F6\u8C03\u7528\u7684\u6392\u969C\u5165\u53E3\uFF0C\u89C1\u4E0A\u65B9\u6761\u76EE" },
+      { prefix: "/self-update/", domain: "guard", category: "public", consumers: ["UI"], note: "/self-update/status\uFF08\u53EA\u8BFB\uFF09\uFF1Bapply|restart-guard \u8FD4\u56DE 410" },
+      { prefix: "/settings/", domain: "guard", category: "public", consumers: ["UI"], note: "/settings/{lan|access-key|close-action}" },
+      { prefix: "/tasks/", domain: "tasks", category: "public", consumers: ["UI"], note: "/tasks/{id}" }
+    ];
+    module2.exports = { SURFACE, PREFIXES, CATEGORIES };
+  }
+});
+
 // src/api/router-table.js
 var require_router_table = __commonJS({
   "src/api/router-table.js"(exports2, module2) {
@@ -27477,7 +27592,19 @@ var require_router_table = __commonJS({
       require_relay(),
       require_shell2()
     ];
-    module2.exports = { API_DOMAINS };
+    var { SURFACE } = require_contract();
+    function assertSurfaceOwned(domains) {
+      const orphans = [];
+      for (const entry of SURFACE || []) {
+        const path2 = typeof entry === "string" ? entry : entry && entry.path;
+        if (!path2) continue;
+        const owned = domains.some((d) => typeof d.owns === "function" && d.owns(path2));
+        if (!owned) orphans.push(path2);
+      }
+      return orphans;
+    }
+    var API_DOMAINS_ORPHANS = assertSurfaceOwned(API_DOMAINS);
+    module2.exports = { API_DOMAINS, API_DOMAINS_ORPHANS };
   }
 });
 
@@ -27646,6 +27773,14 @@ var require_server = __commonJS({
       } catch {
       }
     }
+    function rejectCrossOrigin(ctx) {
+      const { req, send } = ctx;
+      try {
+        req.resume();
+      } catch {
+      }
+      return send(403, { ok: false, error: "cross-origin request rejected" });
+    }
     function createServer(sup, deps) {
       const browser = deps && deps.browser || browserExit;
       const environment = deps && deps.environment || environmentExit;
@@ -27717,7 +27852,7 @@ var require_server = __commonJS({
         } catch (e) {
           return send(400, { error: "bad request encoding" });
         }
-        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed: originAllowedLive, tokOf, browser, environment, server };
+        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed: originAllowedLive, rejectCrossOrigin, tokOf, browser, environment, server };
         for (const d of API_DOMAINS) {
           if (d.owns(pathname)) {
             try {
@@ -28288,15 +28423,19 @@ var require_ports3 = __commonJS({
     async function claim(segment, owner, opts) {
       const o = opts || {};
       const reservedPorts = o.reservedPorts || _reservedByOtherLedger(owner);
-      return registry.claimSlot(segment, owner, {
-        preferred: o.preferred,
-        bindingPreferred: !!o.bindingPreferred,
-        reservedPorts: reservedPorts || void 0,
-        onBindingLost: o.onBindingLost,
-        reclaimCmdMark: "domains/relay/daemon.js",
-        reclaimCfg: o.configPath || "",
-        waitMs: 8e3
-      });
+      try {
+        return await registry.claimSlot(segment, owner, {
+          preferred: o.preferred,
+          bindingPreferred: !!o.bindingPreferred,
+          reservedPorts: reservedPorts || void 0,
+          onBindingLost: o.onBindingLost,
+          reclaimCmdMark: "domains/relay/daemon.js",
+          reclaimCfg: o.configPath || "",
+          waitMs: 8e3
+        });
+      } catch (e) {
+        return { conflict: true, reason: "alloc-lock-unavailable", error: e && e.message || String(e) };
+      }
     }
     function releaseOwner(owner) {
       try {
@@ -29306,6 +29445,7 @@ function findPackageRoot(start) {
 var ROOT = findPackageRoot(__dirname);
 var stateRoot = require_state_root();
 var BRAND = require_brand();
+var SHARED = require_shared_constants2();
 var SUPERVISOR_DIR = stateRoot.supervisorDir();
 var USER_CONFIG = path.join(SUPERVISOR_DIR, "config.json");
 var { buildDefaults } = require_config();
@@ -29351,9 +29491,9 @@ function readApiAddress() {
     const cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8"));
     let host = cfg.apiHost || "127.0.0.1";
     if (host === "0.0.0.0" || host === "::") host = "127.0.0.1";
-    return { host, port: cfg.apiPort || 36360 };
+    return { host, port: cfg.apiPort || SHARED.net.apiPort };
   } catch {
-    return { host: "127.0.0.1", port: 36360 };
+    return { host: "127.0.0.1", port: SHARED.net.apiPort };
   }
 }
 function logFilePaths() {