@riceawa/dsh-lan-gateway 0.5.5 → 0.6.1

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/DeepSeek%20Harness-4d6bfe?logo=deepseek&logoColor=fff&style=flat-square" alt="DeepSeek Harness" />
-  <img src="https://img.shields.io/badge/version-0.5.5-2b7fff?style=flat-square" alt="version 0.5.5" />
+  <img src="https://img.shields.io/badge/version-0.6.1-2b7fff?style=flat-square" alt="version 0.6.1" />
   <img src="https://img.shields.io/badge/TLS-8b5cf6?logo=lock&logoColor=fff&style=flat-square" alt="TLS" />
   <img src="https://img.shields.io/github/license/rice-awa/dsh-lan-gateway?style=flat-square" alt="MIT license" />
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
@@ -14,7 +14,7 @@
 
 `dsh web` 明确拒绝 `--host 0.0.0.0`，以免把远程代码执行暴露到网络。本插件的做法是让 dsh 继续只绑 `127.0.0.1`，另起一个反向代理监听未指定地址（双栈，IPv4 与 IPv6 客户端都可接入），转发到 loopback 端口并改写 `Host` / `Origin`。
 
-默认拒绝：loopback、LAN、公网三种来源都要先在网关登录页取得 HMAC 会话 cookie，LAN 免密需要显式打开 `lanPasswordless`，默认关闭。底座为 dsh ≥ 0.1.2-rc.1 时（含 QVD-2026-57410 的上游修复），网关在进程内中继一条共享上游会话，上游自身的授权仍然把关每个请求，网关只决定谁可以使用这条会话。
+默认拒绝：loopback、LAN、公网三种来源都要先在网关登录页取得 HMAC 会话 cookie，LAN 免密需要显式打开 `lanPasswordless`，默认关闭。底座要求 dsh ≥ 0.1.7（本插件按该版本的 settings API 写入配置；含 QVD-2026-57410 的上游修复），网关在进程内中继一条共享上游会话，上游自身的授权仍然把关每个请求，网关只决定谁可以使用这条会话。
 
 插件另外提供两项功能：
 
@@ -44,10 +44,10 @@ cd dsh-lan-gateway
 pnpm install
 pnpm build          # host → lib/index.js
 pnpm build:client   # client → lib/client.js
-pnpm test           # 117 项
+pnpm test           # 204 项
 ```
 
-仓库里还有一个 [lan-gateway](skills/lan-gateway.md) 技能，安装后可直接在 dsh 对话里说「设置网关密码为 …」「开启远程访问」，agent 会调用 `lan_gateway` 工具完成，密码以参数传入，不写入配置，也不回显。安装方式见 [INSTALL.md](INSTALL.md#for-agents完整安装流程)。
+仓库里还有一个 [lan-gateway](skills/lan-gateway.md) 技能，安装后可直接在 dsh 对话里说「设置网关密码为 …」「开启远程访问」，agent 会调用 `lan_gateway` 工具完成，密码以参数传入，不写入配置，也不回显。改密码也可以不走模型：在本机打开 **Plugins** 页的「LAN 网关」卡片，直接填两次新密码覆盖（见下「登录密码」）。安装方式见 [INSTALL.md](INSTALL.md#for-agents完整安装流程)。
 
 如需在手机 / 平板上访问，可另外安装 [dsh-web-mobile](https://github.com/mexiaosqwq/dsh-web-mobile) 做移动端 UI 适配：
 
@@ -66,11 +66,11 @@ lan_gateway tls-regenerate    # 换发自签名证书（tlsMode=self-signed 时
 lan_gateway disable           # 关闭
 ```
 
-`lan_gateway` 是模型可调用的工具，上述命令无需手动执行。直接在对话里说「查看网关状态」「设置网关密码为 ……」即可，密码以参数传给模型，不会写入任何配置文件。
+`lan_gateway` 是模型可调用的工具，上述命令无需手动执行。直接在对话里说「查看网关状态」「设置网关密码为 ……」即可，密码以参数传给模型，不会写入任何配置文件。改密码也可以完全不经模型：在本机 Plugins 页的插件卡片里直接改（见下「登录密码」）。
 
 ## 配置
 
-所有可调项都暴露为 `lan-gateway` 用户设置命名空间。打开 **DSH 的 Settings → Plugins → 可配置插件**，展开「LAN 网关」卡片即可修改，保存即生效，监听器会按新配置自动重启。下表既是卡片字段，也是配置键：
+所有可调项都写在本插件自己的 profile 条目里（dsh ≥ 0.1.7 起，设置写入按**条目 id** 寻址；此前的 `lan-gateway` 用户设置命名空间已随 `settingsScope` 一起移除）。打开侧边栏的 **Plugins** 页，在官方插件列表里点开「LAN 网关」卡片即可修改，保存即生效，监听器会按新配置自动重启。卡片挂在 Plugins 页的 `plugins.item` 槽上，且只在底座确实 served 本插件条目时注册——没有 Loader 条目（写入必然 409）时卡片不会出现。下表既是卡片字段，也是配置键；卡片顶部另有一栏「登录密码」，改密码不走配置表（见下「登录密码」）：
 
 | 键 | 默认值 | 说明 |
 | --- | --- | --- |
@@ -95,6 +95,16 @@ lan_gateway disable           # 关闭
 
 配置里残留 `authRequired: false`（v0.4 及更早的写法）会被启停守卫拒绝并提示迁移，不会静默降级成免密。
 
+### 登录密码
+
+卡片顶部就是「登录密码」栏：一个「已设置 / 未设置」状态，两个密码框（新密码、再次输入），点「修改密码」直接覆盖原密码。
+
+- **不回显旧密码。** 界面只报告密码是否存在；卡片读不到旧密码。`state.json` 里只有 scrypt 哈希与盐，`/lan-gateway/password` 也从不把哈希、盐或长度返回给浏览器。
+- **不需要旧密码。** 该路由与配置路由共用同一道围栏：只接受本机 loopback 的同源请求（Host 必须是回环、跨站请求拒绝、写操作必须带匹配的 `Origin`），经网关远程访问的浏览器一律 403。能通过这道门的本地用户本来就能读 `~/.dsh`。
+- **改完即生效。** 写盘后递增会话代次：旧密码立即失效，所有已登录会话与已建立的 WebSocket 全部作废，各来源需要重新登录。
+- **只设置，不清空。** 清空密码会按设计停掉监听器（没有密码不允许监听），卡片不做这件事；要清空请用 `lan_gateway set-password` 并留空密码。
+- **密码不是配置键。** 它不写进 profile 条目，也不会出现在 `--dump-config` 里；保存配置字段动不到它，改密码也不会碰你尚未保存的字段草稿。
+
 ### 入口加密
 
 网关默认拒绝纯明文监听，以下三种方式任选其一方可启动：
@@ -169,8 +179,8 @@ lan_gateway disable           # 关闭
 ## 安全模型
 
 - **来源分级只认 `socket.remoteAddress`**（IPv4-mapped IPv6 会先解包），分 loopback / lan / internet 三档，绝不信任 `X-Forwarded-For`。分级本身不授予任何访问，每一档默认都要出示有效网关会话，否则 302 到 `/__login`。
-- **LAN 免密是显式 opt-in**。`lanPasswordless: true` 只让命中 `lanCidrs` 或 loopback 的来源跳过网关自己的登录页；底座 ≥ 0.1.2-rc.1 时上游会话仍把关每个请求。底座没有浏览器会话认证时这个开关拒绝启用，否则等同于把 QVD-2026-57410 原样恢复。
-- **共享上游会话中继**（dsh ≥ 0.1.2-rc.1）。dsh 不再信任回环 Host，要求出示 HMAC 签名的 `dsh-auth-*` cookie。插件经 `connection` 服务拿到启动令牌，在回环传输上做一次浏览器等价的令牌换取，取得 cookie 后中继到每个转发请求；上游一旦 401 就丢弃这条会话并重新换取。这仍是「单密码 = 单操作者」：通过网关登录的用户共用同一条上游会话，持钥的上游才是真正的授权主体。
+- **LAN 免密是显式 opt-in**。`lanPasswordless: true` 只让命中 `lanCidrs` 或 loopback 的来源跳过网关自己的登录页；受支持的底座（dsh ≥ 0.1.7）上游会话仍把关每个请求。底座没有浏览器会话认证时这个开关拒绝启用，否则等同于把 QVD-2026-57410 原样恢复。
+- **共享上游会话中继**（dsh ≥ 0.1.7）。dsh 不再信任回环 Host，要求出示 HMAC 签名的 `dsh-auth-*` cookie。插件经 `connection` 服务拿到启动令牌，在回环传输上做一次浏览器等价的令牌换取，取得 cookie 后中继到每个转发请求；上游一旦 401 就丢弃这条会话并重新换取。这仍是「单密码 = 单操作者」：通过网关登录的用户共用同一条上游会话，持钥的上游才是真正的授权主体。
 - **登录页**。`/__login` 由网关独占、不转发。密码以 scrypt 校验，每写一次重新加盐；登录尝试按来源限流（5 次 / 分钟）。
 - **会话 cookie** 是 `payload.signature` 结构（HMAC-SHA256），带撤销 epoch 与逐会话 id，`HttpOnly; SameSite=Strict`。登出撤销的是当前这条会话：它建立的 WebSocket 一并断开，其他设备不受影响。改密、清密、`rotate-secret` 递增 epoch，作废全部已签发 cookie 并断开全部已建立的 WebSocket，客户端需要重新登录。清空密码会直接停止监听。
 - **管理面不外泄**。`/lan-gateway/*`（含配置路由）由网关独占、一律 403 不转发，远程访问者无法借网关改写 Host 触及本机 loopback 的配置接口。原生 `/lan-gateway/config` 只应答回环 Host 且同源的请求。远程管理走 `lan_gateway` 工具。
@@ -194,22 +204,29 @@ client bundle 在模块级给 `Crypto` 原型补一个基于 `crypto.getRandomVa
 ## 开发
 
 ```bash
-pnpm test        # 117 项
+pnpm test        # 204 项
 pnpm typecheck   # tsc 双端（host + client）
 ```
 
 ```
-✓ tests/gateway.test.ts               (40) 分类 / HMAC cookie / epoch / 逐会话撤销 / 密码状态 / 限流
-✓ tests/start-guard.test.ts           (19) fail-closed 启动守卫 / 配置路由回环围栏 /
-                                           Secure cookie 属性推断（含 null 清除路径）
-✓ tests/integration/gateway.test.ts   (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
-                                           cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
-✓ tests/uuid-shim.test.ts             ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
-✓ tests/x509.test.ts                  ( 6) 自签名证书 DER/SAN/签名/TLS 握手
-✓ tests/tls.test.ts                   ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
-✓ tests/upstream-session.test.ts      ( 8) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
-                                           invalidate 重获取 / 日志播报 / 保住已持有会话
-✓ tests/settings-card.test.ts         ( 6) 设置页字段编解码：三态 auto ↔ false 不可混淆
+✓ tests/gateway.test.ts                        (40) 分类 / HMAC cookie / epoch / 逐会话撤销 / 密码状态 / 限流
+✓ tests/start-guard.test.ts                    (19) fail-closed 启动守卫 / 配置路由回环围栏 /
+                                                    Secure cookie 属性推断（含 null 清除路径）
+✓ tests/request-policy.test.ts                 (46) 判定缝纯函数：路径归一化 / 归属前缀 / 同站与登录围栏 /
+                                                    两个方向的头部变换
+✓ tests/upstream-session.test.ts               ( 8) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
+                                                    invalidate 重获取 / 日志播报 / 保住已持有会话
+✓ tests/x509.test.ts                           ( 6) 自签名证书 DER/SAN/签名/TLS 握手
+✓ tests/tls.test.ts                            ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
+✓ tests/uuid-shim.test.ts                      ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
+✓ tests/settings-card.test.ts                  (15) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
+                                                    卡片注册槽与条目 id 契约 / 密码草稿闸门（长度与确认）
+✓ tests/integration/gateway.test.ts            (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
+                                                    cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
+✓ tests/integration/management-plane.test.ts   (24) 真实 apply()：工具与卡片交替启停 / 未编辑字段与未知键保留 /
+                                                    清空后继承 / 拒绝不可启动配置 / 卡片改密路由（覆盖原密码 /
+                                                    递增代次 / 不返回哈希 / 不给清空 / 无 settings 也生效）
+✓ tests/integration/session-races.test.ts      ( 8) 改密落在登录与握手途中的竞态 / 上游非 101 应答
 ```
 
 ### 发布
@@ -233,8 +250,8 @@ pnpm typecheck   # tsc 双端（host + client）
 pnpm install --frozen-lockfile
 pnpm typecheck && pnpm test
 npm publish --access public                       # prepack 自动构建 lib/
-git tag -a v0.5.5 -m "…" && git push origin v0.5.5
-gh release create v0.5.5 --generate-notes ./*.tgz # 可选：Release + tgz 附件
+git tag -a v0.6.0 -m "…" && git push origin v0.6.0
+gh release create v0.6.0 --generate-notes ./*.tgz # 可选：Release + tgz 附件
 ```
 
 ## 安全评估
@@ -246,6 +263,10 @@ gh release create v0.5.5 --generate-notes ./*.tgz # 可选：Release + tgz 附
 - [上游研究](docs/security/qvd-2026-57410-research.md)：公开通告、上游提交与版本核对。
 - [0.5.4 复审与修复清单](docs/security/audit-2026-09-19-fix-list.md)：0.5.3 的实现细节复审（G1–G12）与修复记录。
 
+架构层面的复审另见 [docs/review/](docs/review/)：
+
+- [架构复审（2026-09-19）](docs/review/architecture-review-2026-09-19.md)：针对 0.5.4 的 C1–C6 结构候选与 D1–D14 缺陷清单，0.5.5 已全部关闭。文档记录的是复审当时的状态，不是待办列表。
+
 ## 许可
 
 [MIT](./LICENSE)

package/lib/client.js

@@ -151,16 +151,31 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/lan-gateway-card.tsx
 		/**
-		* The lan-gateway settings card shown in the official DSH Settings → Plugins
-		* page (the `settings.plugin.item` slot).
+		* The lan-gateway settings card, rendered by the official DSH Plugins page
+		* through its `plugins.item` slot.
 		*
 		* ModLens-style: the card carries NO injected services. It reads and writes
 		* the loopback-only `/lan-gateway/config` host route (the browser never sees
-		* the settings seam or any secret), so the client bundle's only dependency is
-		* the `slots` service that every plugin already has.
+		* the settings seam or any secret), so the only platform service it needs is
+		* the `slots` service every plugin already has.
 		*
 		* @module @riceawa/dsh-lan-gateway/client/card
 		*/
+		/**
+		* Judge a password draft the way the host's password route will, so a draft the
+		* card enables is never answered with a 400. The length bound is the shared
+		* {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked
+		* here rather than server-side (the host is told one password, and storing only
+		* what was typed twice is the browser's job).
+		* @param password - the new password draft.
+		* @param confirm - the confirmation draft.
+		* @returns the reason it cannot be submitted, or `null` when it can.
+		*/
+		function passwordProblem(password, confirm) {
+			if (password.length < 8) return "tooShort";
+			if (password !== confirm) return "mismatch";
+			return null;
+		}
 		const LABELS = {
 			zh: {
 				title: "LAN 网关",
@@ -178,6 +193,19 @@ window.__ModuleLoader__.load({
 				stopped: "已停止",
 				tls: "TLS",
 				lastError: "上次错误",
+				passwordSection: "登录密码",
+				passwordHint: "当前密码不会显示（也读不出来）。输入两次新密码后直接覆盖原密码；改密会递增会话代次，所有已登录会话与已建立的 WebSocket 立即失效。仅在从本机 loopback 打开 dsh web 时可改。",
+				passwordNew: "新密码（至少 8 位）",
+				passwordConfirm: "再次输入新密码",
+				passwordSet: "已设置",
+				passwordUnset: "未设置",
+				passwordRequired: "未设置密码时网关拒绝启动。",
+				passwordChange: "修改密码",
+				passwordChanged: "密码已更新：旧密码立即失效，所有已登录会话已作废。",
+				passwordFailed: "修改密码失败，请重试。",
+				passwordStaleHost: "宿主端没有响应这个接口：可能还没重启 dsh web 加载新版本。重启后再试；重启前仍可用 lan_gateway 工具改密。",
+				passwordTooShort: "密码至少 8 位。",
+				passwordMismatch: "两次输入不一致。",
 				"field.enabled": "启用网关",
 				"hint.enabled": "启动时监听 0.0.0.0 网关端口",
 				"field.gatewayPort": "网关端口",
@@ -228,6 +256,19 @@ window.__ModuleLoader__.load({
 				stopped: "Stopped",
 				tls: "TLS",
 				lastError: "Last error",
+				passwordSection: "Login password",
+				passwordHint: "The current password is never shown (it cannot be read back). Enter a new one twice to overwrite it; changing it advances the session epoch, so every signed-in session and live WebSocket is invalidated at once. Only changeable where dsh web runs on loopback.",
+				passwordNew: "New password (min 8 chars)",
+				passwordConfirm: "Repeat new password",
+				passwordSet: "Set",
+				passwordUnset: "Not set",
+				passwordRequired: "The gateway refuses to start without a password.",
+				passwordChange: "Change password",
+				passwordChanged: "Password updated: the old one no longer works and every signed-in session was revoked.",
+				passwordFailed: "The password change failed — retry.",
+				passwordStaleHost: "The host did not answer this endpoint — it may still be running the previous build. Restart dsh web and retry; the lan_gateway tool can change the password meanwhile.",
+				passwordTooShort: "At least 8 characters.",
+				passwordMismatch: "The two entries do not match.",
 				"field.enabled": "Enable gateway",
 				"hint.enabled": "Listen on the gateway port at boot",
 				"field.gatewayPort": "Gateway port",
@@ -267,12 +308,24 @@ window.__ModuleLoader__.load({
 			return (typeof navigator !== "undefined" ? navigator.language : "en").toLowerCase().startsWith("zh") ? LABELS.zh : LABELS.en;
 		}
 		/**
+		* The card's title in the browser's language, for the Plugins page's list
+		* entry. A thunk so the label follows the page's locale without re-registering.
+		* @returns the localized card title.
+		*/
+		function cardTitle() {
+			return labels().title;
+		}
+		/**
 		* Render the LAN gateway card. Self-loading: fetches the config route on
 		* mount, posts the edited config on save.
-		* @param _props - unused; the card needs no injected face.
-		* @returns the card, or nothing while the route is unreachable.
+		*
+		* `view` swaps between the card's one-liner and its page body, so the branch
+		* sits after the hooks: the Plugins page re-renders one contribution under the
+		* other view when the card is opened.
+		* @param props - the view the Plugins page is asking for.
+		* @returns the one-liner, the card, or nothing while the route is unreachable.
 		*/
-		function LanGatewayCard(_props) {
+		function LanGatewayCard(props) {
 			const t = labels();
 			const [open, setOpen] = (0, react.useState)(false);
 			const [route, setRoute] = (0, react.useState)(null);
@@ -280,6 +333,11 @@ window.__ModuleLoader__.load({
 			const [drafts, setDrafts] = (0, react.useState)({});
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [failed, setFailed] = (0, react.useState)(null);
+			const [password, setPasswordDraft] = (0, react.useState)("");
+			const [passwordConfirm, setPasswordConfirmDraft] = (0, react.useState)("");
+			const [passwordBusy, setPasswordBusy] = (0, react.useState)(false);
+			const [passwordError, setPasswordError] = (0, react.useState)(null);
+			const [passwordNotice, setPasswordNotice] = (0, react.useState)(null);
 			(0, react.useEffect)(() => {
 				let cancelled = false;
 				fetch("/lan-gateway/config").then(async (response) => {
@@ -293,7 +351,8 @@ window.__ModuleLoader__.load({
 					cancelled = true;
 				};
 			}, []);
-			if (loadFailed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+			if (props.view === "summary") return t.description;
+			if (loadFailed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: styles.card,
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					style: styles.header,
@@ -341,6 +400,56 @@ window.__ModuleLoader__.load({
 				return def === void 0 || parseValue(def, text ?? "") === void 0;
 			});
 			const dirty = Object.keys(drafts).length > 0;
+			const passwordDraftProblem = passwordProblem(password, passwordConfirm);
+			const passwordTyping = password !== "" || passwordConfirm !== "";
+			/** Adopt the host's post-write snapshot, keeping the last known values. */
+			const adopt = (body) => {
+				if (body.config === void 0) return;
+				setRoute({
+					config: body.config,
+					running: body.running ?? false,
+					port: body.port ?? 0,
+					tls: body.tls ?? "",
+					lastError: body.lastError ?? null,
+					passwordSet: body.passwordSet === true
+				});
+			};
+			/**
+			* Overwrite the login password. Deliberately writes only to
+			* `/lan-gateway/password`: the credential is not part of the config patch, so
+			* a change here can never disturb an unsaved settings draft, and the old
+			* password is neither sent nor requested.
+			*/
+			const changePassword = async () => {
+				if (passwordBusy || passwordProblem(password, passwordConfirm) !== null) return;
+				setPasswordBusy(true);
+				setPasswordError(null);
+				setPasswordNotice(null);
+				try {
+					const response = await fetch("/lan-gateway/password", {
+						method: "POST",
+						headers: { "content-type": "application/json" },
+						body: JSON.stringify({ password })
+					});
+					const body = await response.json().catch(() => null);
+					if (!response.ok) {
+						setPasswordError(body?.error ?? (response.status === 404 ? t.passwordStaleHost : `HTTP ${response.status}`));
+						return;
+					}
+					if (body === null) {
+						setPasswordError(t.passwordStaleHost);
+						return;
+					}
+					setPasswordDraft("");
+					setPasswordConfirmDraft("");
+					setPasswordNotice(t.passwordChanged);
+					adopt(body);
+				} catch {
+					setPasswordError(t.passwordFailed);
+				} finally {
+					setPasswordBusy(false);
+				}
+			};
 			const save = async () => {
 				if (!dirty || saving || invalid()) return;
 				setSaving(true);
@@ -364,13 +473,7 @@ window.__ModuleLoader__.load({
 						setFailed(body.error ?? `HTTP ${response.status}`);
 						return;
 					}
-					if (body.config !== void 0) setRoute({
-						config: body.config,
-						running: body.running ?? false,
-						port: body.port ?? 0,
-						tls: body.tls ?? "",
-						lastError: body.lastError ?? null
-					});
+					adopt(body);
 					setDrafts({});
 				} catch {
 					setFailed(t.saveFailed);
@@ -474,7 +577,7 @@ window.__ModuleLoader__.load({
 				}
 			};
 			const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: open ? {
 					...styles.card,
 					...styles.cardOpen
@@ -526,6 +629,85 @@ window.__ModuleLoader__.load({
 								route.lastError
 							]
 						}) : null,
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: styles.section,
+							children: [
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: styles.sectionHead,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: styles.label,
+										children: t.passwordSection
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										style: route.passwordSet === true ? styles.badge : styles.badgeAlert,
+										children: route.passwordSet === true ? t.passwordSet : t.passwordUnset
+									})]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: styles.hint,
+									children: t.passwordHint
+								}),
+								route.passwordSet === true ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: styles.error,
+									children: t.passwordRequired
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: styles.passwordRow,
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										id: "lan-gw-password",
+										type: "password",
+										autoComplete: "new-password",
+										"aria-label": t.passwordNew,
+										style: passwordInput,
+										placeholder: t.passwordNew,
+										value: password,
+										disabled: passwordBusy,
+										onChange: (e) => {
+											setPasswordDraft(e.target.value);
+											setPasswordError(null);
+											setPasswordNotice(null);
+										}
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										id: "lan-gw-password-confirm",
+										type: "password",
+										autoComplete: "new-password",
+										"aria-label": t.passwordConfirm,
+										style: passwordInput,
+										placeholder: t.passwordConfirm,
+										value: passwordConfirm,
+										disabled: passwordBusy,
+										onChange: (e) => {
+											setPasswordConfirmDraft(e.target.value);
+											setPasswordError(null);
+											setPasswordNotice(null);
+										}
+									})]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									style: styles.passwordFoot,
+									children: [passwordError !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										style: styles.error,
+										role: "alert",
+										children: passwordError
+									}) : passwordNotice !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										style: styles.notice,
+										role: "status",
+										children: passwordNotice
+									}) : passwordTyping && passwordDraftProblem !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										style: styles.error,
+										role: "status",
+										children: passwordDraftProblem === "tooShort" ? t.passwordTooShort : t.passwordMismatch
+									}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										type: "button",
+										style: styles.save,
+										disabled: passwordBusy || passwordDraftProblem !== null,
+										onClick: () => {
+											changePassword();
+										},
+										children: passwordBusy ? t.saving : t.passwordChange
+									})]
+								})
+							]
+						}),
 						FIELDS.map((def) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: renderControl(def) }, def.field)),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							style: styles.footer,
@@ -659,6 +841,58 @@ window.__ModuleLoader__.load({
 				display: "flex",
 				flexDirection: "column"
 			},
+			section: {
+				display: "flex",
+				flexDirection: "column",
+				gap: "8px",
+				padding: "14px 0",
+				borderBottom: `1px solid ${L.border}`
+			},
+			sectionHead: {
+				display: "flex",
+				alignItems: "center",
+				gap: "8px"
+			},
+			badge: {
+				borderRadius: "999px",
+				padding: "1px 8px",
+				fontSize: "11px",
+				lineHeight: "17px",
+				fontWeight: 500,
+				whiteSpace: "nowrap",
+				background: L.badgeBg,
+				color: L.labelSecondary
+			},
+			badgeAlert: {
+				borderRadius: "999px",
+				padding: "1px 8px",
+				fontSize: "11px",
+				lineHeight: "17px",
+				fontWeight: 500,
+				whiteSpace: "nowrap",
+				background: L.badgeBg,
+				color: L.error
+			},
+			notice: {
+				flex: 1,
+				minWidth: 0,
+				margin: 0,
+				fontSize: "12px",
+				lineHeight: 1.5,
+				color: L.labelSecondary
+			},
+			passwordRow: {
+				display: "flex",
+				flexWrap: "wrap",
+				gap: "8px"
+			},
+			passwordFoot: {
+				display: "flex",
+				alignItems: "center",
+				justifyContent: "flex-end",
+				gap: "8px",
+				marginTop: "2px"
+			},
 			field: {
 				display: "flex",
 				flexDirection: "column",
@@ -746,6 +980,11 @@ window.__ModuleLoader__.load({
 				cursor: "pointer"
 			}
 		};
+		/** The shared input style plus the growth two side-by-side password boxes need. */
+		const passwordInput = {
+			...styles.input,
+			flex: "1 1 160px"
+		};
 		//#endregion
 		//#region src/client/index.ts
 		/**
@@ -757,10 +996,9 @@ window.__ModuleLoader__.load({
 		*    installs a getRandomValues-backed `randomUUID` on the Crypto prototype at
 		*    module scope. With TLS enabled the origin is secure and the shim is a
 		*    no-op.
-		* 2. Settings card: registers the LAN gateway card into the official
-		*    Settings → Plugins page (`settings.plugin.item` slot), editing the
-		*    `lan-gateway` settings namespace so port, CIDRs, auth, and TLS are
-		*    adjustable from the GUI.
+		* 2. Settings card: registers the LAN gateway card into the official Plugins
+		*    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable
+		*    from the GUI.
 		*/
 		/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */
 		function uuidFromRandomValues() {
@@ -803,25 +1041,25 @@ window.__ModuleLoader__.load({
 		}
 		installRandomUuidShim();
 		const name = "dsh-lan-gateway";
-		/** Only the slots service: the card itself is self-loading (ModLens-style). */
-		const inject = ["slots"];
+		/**
+		* The profile entry id this plugin's bundle patch composes it under, and the
+		* settings namespace dsh ≥ 0.1.7 addresses every write by.
+		*/
+		const ENTRY_ID = "dsh-lan-gateway";
+		/** The slots service the card rides, and the settings mirror the gate reads. */
+		const inject = ["slots", "configForms"];
 		/**
 		* Mount the settings card and the UUID shim.
 		* @param ctx - the browser plugin context.
 		*/
 		function apply(ctx) {
 			installRandomUuidShim();
-			const legacyListOptions = {
-				id: "lan-gateway",
-				order: 30
-			};
-			ctx.slots.inject("settings.plugin.item", function* () {
-				yield ctx.slots.register({
-					name: "settings.plugin.item",
-					key: "lan-gateway",
-					...legacyListOptions
-				}, LanGatewayCard);
-			});
+			ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () => ctx.slots.inject("plugins.item", () => ctx.slots.register({
+				name: "plugins.item",
+				id: ENTRY_ID,
+				order: 30,
+				label: () => cardTitle()
+			}, LanGatewayCard))));
 		}
 		//#endregion
 		exports.apply = apply;