@riceawa/dsh-lan-gateway 0.6.1 → 0.7.0

package/README.md

@@ -6,7 +6,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/DeepSeek%20Harness-4d6bfe?logo=deepseek&logoColor=fff&style=flat-square" alt="DeepSeek Harness" />
-  <img src="https://img.shields.io/badge/version-0.6.1-2b7fff?style=flat-square" alt="version 0.6.1" />
+  <img src="https://img.shields.io/badge/version-0.7.0-2b7fff?style=flat-square" alt="version 0.7.0" />
   <img src="https://img.shields.io/badge/TLS-8b5cf6?logo=lock&logoColor=fff&style=flat-square" alt="TLS" />
   <img src="https://img.shields.io/github/license/rice-awa/dsh-lan-gateway?style=flat-square" alt="MIT license" />
   <a href="https://awesome-dsh-plugin.com"><img src="https://awesome-dsh-plugin.com/badge.svg" alt="awesome · DSH plugin" /></a>
@@ -44,7 +44,7 @@ cd dsh-lan-gateway
 pnpm install
 pnpm build          # host → lib/index.js
 pnpm build:client   # client → lib/client.js
-pnpm test           # 204 项
+pnpm test           # 216 项
 ```
 
 仓库里还有一个 [lan-gateway](skills/lan-gateway.md) 技能，安装后可直接在 dsh 对话里说「设置网关密码为 …」「开启远程访问」，agent 会调用 `lan_gateway` 工具完成，密码以参数传入，不写入配置，也不回显。改密码也可以不走模型：在本机打开 **Plugins** 页的「LAN 网关」卡片，直接填两次新密码覆盖（见下「登录密码」）。安装方式见 [INSTALL.md](INSTALL.md#for-agents完整安装流程)。
@@ -70,7 +70,7 @@ lan_gateway disable           # 关闭
 
 ## 配置
 
-所有可调项都写在本插件自己的 profile 条目里（dsh ≥ 0.1.7 起，设置写入按**条目 id** 寻址；此前的 `lan-gateway` 用户设置命名空间已随 `settingsScope` 一起移除）。打开侧边栏的 **Plugins** 页，在官方插件列表里点开「LAN 网关」卡片即可修改，保存即生效，监听器会按新配置自动重启。卡片挂在 Plugins 页的 `plugins.item` 槽上，且只在底座确实 served 本插件条目时注册——没有 Loader 条目（写入必然 409）时卡片不会出现。下表既是卡片字段，也是配置键；卡片顶部另有一栏「登录密码」，改密码不走配置表（见下「登录密码」）：
+所有可调项都写在本插件自己的 profile 条目里（dsh ≥ 0.1.7 起，设置写入按**条目 id** 寻址；此前的 `lan-gateway` 用户设置命名空间已随 `settingsScope` 一起移除）。打开侧边栏的 **Plugins** 页 →「已安装」→ `@riceawa/dsh-lan-gateway`：本插件的配置就渲染在这个包自己的页面上——挂的是 dsh 给「bundle 自己的配置」声明的 `plugins.bundle.config` 槽（按**包名** `@riceawa/dsh-lan-gateway` 挂载，与 dsh-mnemon、dshmarket 等插件同一套机制），页面标题、图标与面包屑由 Plugins 页自己绘制。保存即生效，监听器会按新配置自动重启。宿主机上用 `127.0.0.1` / `localhost` 打开网关地址时该页面同样可用（网关只对宿主机本机浏览器放行它的管理前缀，见「安全模型」）；用局域网 IP、域名或从别的机器访问时页面读不到配置，改用 `lan_gateway` 工具。注册只在底座确实 served 本插件条目时发生——没有 Loader 条目（写入必然 409）时页面不会出现。下表既是卡片字段，也是配置键；页面顶部另有一栏「登录密码」，改密码不走配置表（见下「登录密码」）：
 
 | 键 | 默认值 | 说明 |
 | --- | --- | --- |
@@ -100,7 +100,7 @@ lan_gateway disable           # 关闭
 卡片顶部就是「登录密码」栏：一个「已设置 / 未设置」状态，两个密码框（新密码、再次输入），点「修改密码」直接覆盖原密码。
 
 - **不回显旧密码。** 界面只报告密码是否存在；卡片读不到旧密码。`state.json` 里只有 scrypt 哈希与盐，`/lan-gateway/password` 也从不把哈希、盐或长度返回给浏览器。
-- **不需要旧密码。** 该路由与配置路由共用同一道围栏：只接受本机 loopback 的同源请求（Host 必须是回环、跨站请求拒绝、写操作必须带匹配的 `Origin`），经网关远程访问的浏览器一律 403。能通过这道门的本地用户本来就能读 `~/.dsh`。
+- **不需要旧密码。** 该路由与配置路由共用同一道围栏：只接受本机 loopback 的同源请求（Host 必须是回环、跨站请求拒绝、写操作必须带匹配的 `Origin`）。经网关访问时，只有宿主机本机浏览器（回环来源 + 回环地址）能被放行到这道围栏，远程浏览器仍是一律 403。能通过这两道门的本地用户本来就能读 `~/.dsh`。
 - **改完即生效。** 写盘后递增会话代次：旧密码立即失效，所有已登录会话与已建立的 WebSocket 全部作废，各来源需要重新登录。
 - **只设置，不清空。** 清空密码会按设计停掉监听器（没有密码不允许监听），卡片不做这件事；要清空请用 `lan_gateway set-password` 并留空密码。
 - **密码不是配置键。** 它不写进 profile 条目，也不会出现在 `--dump-config` 里；保存配置字段动不到它，改密码也不会碰你尚未保存的字段草稿。
@@ -183,7 +183,7 @@ lan_gateway disable           # 关闭
 - **共享上游会话中继**（dsh ≥ 0.1.7）。dsh 不再信任回环 Host，要求出示 HMAC 签名的 `dsh-auth-*` cookie。插件经 `connection` 服务拿到启动令牌，在回环传输上做一次浏览器等价的令牌换取，取得 cookie 后中继到每个转发请求；上游一旦 401 就丢弃这条会话并重新换取。这仍是「单密码 = 单操作者」：通过网关登录的用户共用同一条上游会话，持钥的上游才是真正的授权主体。
 - **登录页**。`/__login` 由网关独占、不转发。密码以 scrypt 校验，每写一次重新加盐；登录尝试按来源限流（5 次 / 分钟）。
 - **会话 cookie** 是 `payload.signature` 结构（HMAC-SHA256），带撤销 epoch 与逐会话 id，`HttpOnly; SameSite=Strict`。登出撤销的是当前这条会话：它建立的 WebSocket 一并断开，其他设备不受影响。改密、清密、`rotate-secret` 递增 epoch，作废全部已签发 cookie 并断开全部已建立的 WebSocket，客户端需要重新登录。清空密码会直接停止监听。
-- **管理面不外泄**。`/lan-gateway/*`（含配置路由）由网关独占、一律 403 不转发，远程访问者无法借网关改写 Host 触及本机 loopback 的配置接口。原生 `/lan-gateway/config` 只应答回环 Host 且同源的请求。远程管理走 `lan_gateway` 工具。
+- **管理面不外泄**。`/lan-gateway/*`（含配置路由与改密路由）由网关独占：唯一放行的是**宿主机本机浏览器**，即「TCP 来源为 loopback **且** 浏览器地址栏写的是回环权威（`127.0.0.1` / `localhost` / `::1`）」的请求，其余一律 403 不转发，远程访问者无法借网关改写 Host 触及本机 loopback 的配置接口。两个条件缺一不可：来源一项远程无法伪造，地址一项则挡住受信 TLS 终止代理的部署——那里所有请求的 TCP 来源都是代理自己的回环地址，只有回环权威仍被拒。放行的请求照样要过会话门与 CSRF 围栏，再以改写后的 loopback Host 交给插件自己的回环同源围栏。升级请求（WebSocket）不在此列，一律拒。原生 `/lan-gateway/config` 只应答回环 Host 且同源的请求。远程管理走 `lan_gateway` 工具。
 - **CSRF 围栏**（HTTP 与 WebSocket）。网关把 Origin 改写回 loopback，会蒙蔽 dsh 自身的 CSRF 防线，所以在改写前对每个转发请求自检：`sec-fetch-site: cross-site` 直接拒；Origin 必须匹配访问者实际使用的网关权威来源；状态变更方法与 WebSocket 升级请求必须携带同源 Origin，否则 403。
 - **未设置密码时拒绝监听**，与来源无关。
 
@@ -204,7 +204,7 @@ client bundle 在模块级给 `Crypto` 原型补一个基于 `crypto.getRandomVa
 ## 开发
 
 ```bash
-pnpm test        # 204 项
+pnpm test        # 216 项
 pnpm typecheck   # tsc 双端（host + client）
 ```
 
@@ -212,17 +212,20 @@ pnpm typecheck   # tsc 双端（host + client）
 ✓ tests/gateway.test.ts                        (40) 分类 / HMAC cookie / epoch / 逐会话撤销 / 密码状态 / 限流
 ✓ tests/start-guard.test.ts                    (19) fail-closed 启动守卫 / 配置路由回环围栏 /
                                                     Secure cookie 属性推断（含 null 清除路径）
-✓ tests/request-policy.test.ts                 (46) 判定缝纯函数：路径归一化 / 归属前缀 / 同站与登录围栏 /
-                                                    两个方向的头部变换
+✓ tests/request-policy.test.ts                 (50) 判定缝纯函数：路径归一化 / 归属前缀 / 同站与登录围栏 /
+                                                    回环权威（Host）判定 / 两个方向的头部变换
 ✓ tests/upstream-session.test.ts               ( 8) 真实回环令牌换取：cookie 名匹配 / 拒绝后重换 /
                                                     invalidate 重获取 / 日志播报 / 保住已持有会话
 ✓ tests/x509.test.ts                           ( 6) 自签名证书 DER/SAN/签名/TLS 握手
 ✓ tests/tls.test.ts                            ( 9) 证书持久化 / 到期换发 / 重生成 / 自定义证书加载
 ✓ tests/uuid-shim.test.ts                      ( 3) 不安全源补丁 / 安全源 no-op / v4 正确性
-✓ tests/settings-card.test.ts                  (15) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
-                                                    卡片注册槽与条目 id 契约 / 密码草稿闸门（长度与确认）
-✓ tests/integration/gateway.test.ts            (26) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
-                                                    cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继
+✓ tests/settings-card.test.ts                  (19) 设置页字段编解码（三态 auto ↔ false 不可混淆）/
+                                                    卡片注册槽与条目 id 契约 / 密码草稿闸门（长度与确认）/
+                                                    密码状态徽标三态（缺字段 = 未知，不是「未设置」）/
+                                                    「网关自己拒绝」与其它失败的文案分流
+✓ tests/integration/gateway.test.ts            (30) 真实网关端到端：全来源登录 / LAN 豁免 / 跨站 403 / 升级拒绝 /
+                                                    cookie 属性 / epoch 撤销 / 逐会话登出 / 尾斜杠 / IPv6 / 会话中继 /
+                                                    管理面只对本机浏览器放行（来源与 Host 两项都要满足）
 ✓ tests/integration/management-plane.test.ts   (24) 真实 apply()：工具与卡片交替启停 / 未编辑字段与未知键保留 /
                                                     清空后继承 / 拒绝不可启动配置 / 卡片改密路由（覆盖原密码 /
                                                     递增代次 / 不返回哈希 / 不给清空 / 无 settings 也生效）

package/lib/client.js

@@ -151,17 +151,30 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/lan-gateway-card.tsx
 		/**
-		* The lan-gateway settings card, rendered by the official DSH Plugins page
-		* through its `plugins.item` slot.
+		* The lan-gateway configuration card, rendered by the official DSH Plugins page
+		* on this bundle's own page through its `plugins.bundle.config` slot.
 		*
 		* ModLens-style: the card carries NO injected services. It reads and writes
 		* the loopback-only `/lan-gateway/config` host route (the browser never sees
 		* the settings seam or any secret), so the only platform service it needs is
 		* the `slots` service every plugin already has.
 		*
+		* The page — not the card — draws the plugin's title, icon, and crumb, and the
+		* card is the page body: `view: 'summary'` renders nothing (bundle
+		* configuration is `page`-only).
+		*
 		* @module @riceawa/dsh-lan-gateway/client/card
 		*/
 		/**
+		* Classify the host's `passwordSet` for the badge.
+		* @param passwordSet - the snapshot's flag, or `undefined` when absent.
+		* @returns `set` / `unset` / `unknown` (absent field).
+		*/
+		function passwordStatus(passwordSet) {
+			if (passwordSet === void 0) return "unknown";
+			return passwordSet ? "set" : "unset";
+		}
+		/**
 		* Judge a password draft the way the host's password route will, so a draft the
 		* card enables is never answered with a 400. The length bound is the shared
 		* {@link MIN_PASSWORD_LENGTH}; the confirmation is a UI concern and is checked
@@ -176,6 +189,22 @@ window.__ModuleLoader__.load({
 			if (password !== confirm) return "mismatch";
 			return null;
 		}
+		/**
+		* Whether the config route's refusal came from the gateway rather than from dsh
+		* itself.
+		*
+		* The gateway owns the `/lan-gateway*` prefix and answers it with a bare 403
+		* `forbidden` whenever the client is not on the host; dsh, when it answers the
+		* route at all, does not produce that pair. Telling the two apart is what lets
+		* the card say "you are not on the host loopback" instead of the generic
+		* "cannot read the configuration".
+		* @param status - the HTTP status of the failed read.
+		* @param body - that response's body.
+		* @returns true when the gateway itself refused the read.
+		*/
+		function refusedByGateway(status, body) {
+			return status === 403 && body.trim() === "forbidden";
+		}
 		const LABELS = {
 			zh: {
 				title: "LAN 网关",
@@ -185,7 +214,8 @@ window.__ModuleLoader__.load({
 				saving: "保存中…",
 				discard: "放弃",
 				reset: "重置",
-				readOnly: "网关设置只能在宿主机本机打开 dsh web 时修改：配置路由仅监听回环地址，经网关远程访问的浏览器会被拒绝。远程请改用 lan_gateway 工具。",
+				readOnly: "读不到网关配置：这个接口只在宿主机本机应答——Host 必须是回环地址且同源。请在宿主机上打开 dsh web 时修改，远程请改用 lan_gateway 工具。",
+				readOnlyGateway: "网关拒绝了这次读取：/lan-gateway/* 管理面由网关独占，只放行「TCP 来源为回环 且 地址写的是 127.0.0.1 / localhost」的浏览器。你现在不是从宿主机回环地址访问的——请在宿主机上用 127.0.0.1 或 localhost 打开本页（局域网 IP、域名都不算），或远程改用 lan_gateway 工具。",
 				saveFailed: "保存未生效，请检查输入后重试。",
 				loadFailed: "无法读取网关配置",
 				emptyMeansClear: "留空 = 使用默认",
@@ -199,7 +229,9 @@ window.__ModuleLoader__.load({
 				passwordConfirm: "再次输入新密码",
 				passwordSet: "已设置",
 				passwordUnset: "未设置",
+				passwordUnknown: "状态未知（宿主端较旧）",
 				passwordRequired: "未设置密码时网关拒绝启动。",
+				passwordHostStale: "宿主端没有报告密码状态，说明 dsh web 还在运行旧版本：重启后这里才会显示「已设置 / 未设置」，这个改密表单也才会生效。",
 				passwordChange: "修改密码",
 				passwordChanged: "密码已更新：旧密码立即失效，所有已登录会话已作废。",
 				passwordFailed: "修改密码失败，请重试。",
@@ -248,7 +280,8 @@ window.__ModuleLoader__.load({
 				saving: "Saving…",
 				discard: "Discard",
 				reset: "Reset",
-				readOnly: "Gateway settings can only be changed where dsh web runs locally: the config route listens on loopback only, so a browser reaching dsh through the gateway is refused. Use the lan_gateway tool remotely.",
+				readOnly: "Cannot read the configuration: the route answers on the host only — the Host must be a loopback address and same-origin. Change the settings where dsh web runs on the host, or use the lan_gateway tool remotely.",
+				readOnlyGateway: "The gateway refused this read: it owns the /lan-gateway/* management plane and admits only browsers that are both loopback-sourced and using a 127.0.0.1 / localhost address. You are not on the host loopback — open this page on the host via 127.0.0.1 or localhost (a LAN IP or a hostname does not qualify), or use the lan_gateway tool remotely.",
 				saveFailed: "The save did not land — check the inputs and retry.",
 				loadFailed: "Cannot read the gateway configuration",
 				emptyMeansClear: "Empty = default",
@@ -262,7 +295,9 @@ window.__ModuleLoader__.load({
 				passwordConfirm: "Repeat new password",
 				passwordSet: "Set",
 				passwordUnset: "Not set",
+				passwordUnknown: "Unknown (older host)",
 				passwordRequired: "The gateway refuses to start without a password.",
+				passwordHostStale: "The host did not report a password state, so dsh web is still running the previous build: restart it to get Set / Not set here and to make this form take effect.",
 				passwordChange: "Change password",
 				passwordChanged: "Password updated: the old one no longer works and every signed-in session was revoked.",
 				passwordFailed: "The password change failed — retry.",
@@ -308,28 +343,19 @@ window.__ModuleLoader__.load({
 			return (typeof navigator !== "undefined" ? navigator.language : "en").toLowerCase().startsWith("zh") ? LABELS.zh : LABELS.en;
 		}
 		/**
-		* The card's title in the browser's language, for the Plugins page's list
-		* entry. A thunk so the label follows the page's locale without re-registering.
-		* @returns the localized card title.
-		*/
-		function cardTitle() {
-			return labels().title;
-		}
-		/**
-		* Render the LAN gateway card. Self-loading: fetches the config route on
-		* mount, posts the edited config on save.
+		* Render the LAN gateway configuration card. Self-loading: fetches the config
+		* route on mount, posts the edited config on save.
 		*
-		* `view` swaps between the card's one-liner and its page body, so the branch
-		* sits after the hooks: the Plugins page re-renders one contribution under the
-		* other view when the card is opened.
+		* `summary` renders nothing: dsh asks a bundle's own configuration for its page
+		* body only, and the card's former one-liner (a list entry on the official
+		* plugin card) went away with `plugins.item`.
 		* @param props - the view the Plugins page is asking for.
-		* @returns the one-liner, the card, or nothing while the route is unreachable.
+		* @returns the page body, or nothing while the view is `summary`.
 		*/
 		function LanGatewayCard(props) {
 			const t = labels();
-			const [open, setOpen] = (0, react.useState)(false);
 			const [route, setRoute] = (0, react.useState)(null);
-			const [loadFailed, setLoadFailed] = (0, react.useState)(false);
+			const [failure, setFailure] = (0, react.useState)(null);
 			const [drafts, setDrafts] = (0, react.useState)({});
 			const [saving, setSaving] = (0, react.useState)(false);
 			const [failed, setFailed] = (0, react.useState)(null);
@@ -342,36 +368,28 @@ window.__ModuleLoader__.load({
 				let cancelled = false;
 				fetch("/lan-gateway/config").then(async (response) => {
 					if (cancelled) return;
-					if (!response.ok) throw new Error(`HTTP ${response.status}`);
+					if (!response.ok) {
+						const body = await response.text().catch(() => "");
+						if (!cancelled) setFailure(refusedByGateway(response.status, body) ? "gateway" : "other");
+						return;
+					}
 					setRoute(await response.json());
 				}).catch(() => {
-					if (!cancelled) setLoadFailed(true);
+					if (!cancelled) setFailure("other");
 				});
 				return () => {
 					cancelled = true;
 				};
 			}, []);
-			if (props.view === "summary") return t.description;
-			if (loadFailed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+			if (props.view === "summary") return null;
+			if (failure !== null) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				style: styles.card,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					style: styles.header,
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						style: styles.headerTop,
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							style: styles.name,
-							children: t.title
-						})
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						style: styles.description,
-						children: t.loadFailed
-					})]
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-					style: styles.body,
-					children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-						style: styles.hint,
-						children: t.readOnly
-					})
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					style: styles.status,
+					children: t.loadFailed
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					style: styles.hint,
+					children: failure === "gateway" ? t.readOnlyGateway : t.readOnly
 				})]
 			});
 			if (route === null) return null;
@@ -402,6 +420,7 @@ window.__ModuleLoader__.load({
 			const dirty = Object.keys(drafts).length > 0;
 			const passwordDraftProblem = passwordProblem(password, passwordConfirm);
 			const passwordTyping = password !== "" || passwordConfirm !== "";
+			const passwordBadge = passwordStatus(route.passwordSet);
 			/** Adopt the host's post-write snapshot, keeping the last known values. */
 			const adopt = (body) => {
 				if (body.config === void 0) return;
@@ -411,7 +430,7 @@ window.__ModuleLoader__.load({
 					port: body.port ?? 0,
 					tls: body.tls ?? "",
 					lastError: body.lastError ?? null,
-					passwordSet: body.passwordSet === true
+					...body.passwordSet !== void 0 ? { passwordSet: body.passwordSet } : {}
 				});
 			};
 			/**
@@ -578,46 +597,18 @@ window.__ModuleLoader__.load({
 			};
 			const statusLine = `${route.running ? t.running : t.stopped} · ${t.tls}: ${route.tls} · :${route.port}`;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				style: open ? {
-					...styles.card,
-					...styles.cardOpen
-				} : styles.card,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-					type: "button",
-					style: styles.header,
-					"aria-expanded": open,
-					onClick: () => {
-						setOpen(!open);
-					},
-					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-						style: styles.headerTop,
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								style: styles.name,
-								children: t.title
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								style: styles.status,
-								title: statusLine,
-								children: statusLine
-							}),
-							dirty ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								style: styles.pending,
-								children: t.unsaved
-							}) : null,
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								style: open ? {
-									...styles.chevron,
-									...styles.chevronOpen
-								} : styles.chevron,
-								children: open ? "▾" : "▸"
-							})
-						]
-					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-						style: styles.description,
-						children: t.description
-					})]
-				}), open ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: styles.card,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					style: styles.statusRow,
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: styles.status,
+						title: statusLine,
+						children: statusLine
+					}), dirty ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: styles.pending,
+						children: t.unsaved
+					}) : null]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					style: styles.body,
 					children: [
 						route.lastError ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
@@ -638,18 +629,22 @@ window.__ModuleLoader__.load({
 										style: styles.label,
 										children: t.passwordSection
 									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										style: route.passwordSet === true ? styles.badge : styles.badgeAlert,
-										children: route.passwordSet === true ? t.passwordSet : t.passwordUnset
+										style: passwordBadge === "unset" ? styles.badgeAlert : styles.badge,
+										children: passwordBadge === "set" ? t.passwordSet : passwordBadge === "unset" ? t.passwordUnset : t.passwordUnknown
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									style: styles.hint,
 									children: t.passwordHint
 								}),
-								route.passwordSet === true ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								passwordBadge === "unset" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 									style: styles.error,
 									children: t.passwordRequired
-								}),
+								}) : null,
+								passwordBadge === "unknown" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									style: styles.hint,
+									children: t.passwordHostStale
+								}) : null,
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									style: styles.passwordRow,
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
@@ -736,7 +731,7 @@ window.__ModuleLoader__.load({
 							]
 						})
 					]
-				}) : null]
+				})]
 			});
 		}
 		/** Theme token with a fallback for token-less environments. */
@@ -746,13 +741,10 @@ window.__ModuleLoader__.load({
 		const L = {
 			border: tk("--dsw-alias-border-l2", "rgba(127,127,127,0.35)"),
 			bg: tk("--dsw-alias-bg-layer-3", "transparent"),
-			bgOpen: tk("--dsw-alias-bg-layer-2", "transparent"),
 			labelPrimary: tk("--dsw-alias-label-primary", "inherit"),
 			labelSecondary: tk("--dsw-alias-label-secondary", "inherit"),
 			labelTertiary: tk("--dsw-alias-label-tertiary", "rgba(127,127,127,0.8)"),
-			labelDimmed: tk("--dsw-alias-label-dimmed", "rgba(127,127,127,0.6)"),
 			error: tk("--dsw-alias-label-error", "#d1242f"),
-			brand: tk("--dsw-alias-brand-primary", "#4f6ef7"),
 			badgeBg: tk("--dsw-alias-bg-module-platform", "rgba(127,127,127,0.14)")
 		};
 		const styles = {
@@ -761,45 +753,21 @@ window.__ModuleLoader__.load({
 				border: `1px solid ${L.border}`,
 				borderRadius: "12px",
 				background: L.bg,
-				transition: "border-color .16s, background .16s",
-				overflow: "hidden"
-			},
-			cardOpen: {
-				background: L.bgOpen,
-				borderColor: L.labelDimmed
-			},
-			header: {
 				display: "flex",
 				flexDirection: "column",
-				alignItems: "stretch",
-				gap: "6px",
-				width: "100%",
-				padding: "14px 16px",
-				border: 0,
-				background: "none",
-				font: "inherit",
-				color: "inherit",
-				textAlign: "left",
-				cursor: "pointer"
+				overflow: "hidden"
 			},
-			headerTop: {
+			statusRow: {
 				display: "flex",
 				alignItems: "center",
 				gap: "12px",
-				width: "100%"
-			},
-			name: {
-				flex: "1 1 auto",
-				minWidth: 0,
-				fontSize: "15px",
-				fontWeight: 600,
-				lineHeight: 1.4,
-				color: L.labelPrimary
+				padding: "12px 16px",
+				borderBottom: `1px solid ${L.border}`
 			},
 			status: {
 				flex: "0 1 auto",
 				minWidth: 0,
-				maxWidth: "60%",
+				maxWidth: "80%",
 				fontSize: "11px",
 				lineHeight: 1.4,
 				color: L.labelTertiary,
@@ -807,15 +775,6 @@ window.__ModuleLoader__.load({
 				overflow: "hidden",
 				textOverflow: "ellipsis"
 			},
-			description: {
-				display: "block",
-				fontSize: "13px",
-				lineHeight: 1.5,
-				color: L.labelTertiary,
-				whiteSpace: "nowrap",
-				overflow: "hidden",
-				textOverflow: "ellipsis"
-			},
 			pending: {
 				flex: "none",
 				borderRadius: "999px",
@@ -827,17 +786,8 @@ window.__ModuleLoader__.load({
 				background: L.badgeBg,
 				color: L.labelSecondary
 			},
-			chevron: {
-				flex: "none",
-				color: L.labelTertiary,
-				fontSize: "12px",
-				transition: "transform .16s"
-			},
-			chevronOpen: { transform: "rotate(180deg)" },
 			body: {
-				borderTop: `1px solid ${L.border}`,
-				margin: "0 16px",
-				paddingBottom: "8px",
+				padding: "4px 16px 8px",
 				display: "flex",
 				flexDirection: "column"
 			},
@@ -997,8 +947,12 @@ window.__ModuleLoader__.load({
 		*    module scope. With TLS enabled the origin is secure and the shim is a
 		*    no-op.
 		* 2. Settings card: registers the LAN gateway card into the official Plugins
-		*    page (`plugins.item` slot) so port, CIDRs, auth, and TLS stay adjustable
-		*    from the GUI.
+		*    page as THIS bundle's own configuration (`plugins.bundle.config`, keyed by
+		*    the package name), so port, CIDRs, auth, and TLS stay adjustable from the
+		*    GUI on the plugin's own page. `plugins.item` is deliberately not used: dsh
+		*    reserves it for the official settings pages, one companion package per
+		*    host-plane namespace, and a bundle's configuration belongs in its own
+		*    config slot instead.
 		*/
 		/** RFC 4122 v4 UUID from crypto.getRandomValues (available on insecure origins). */
 		function uuidFromRandomValues() {
@@ -1042,8 +996,14 @@ window.__ModuleLoader__.load({
 		installRandomUuidShim();
 		const name = "dsh-lan-gateway";
 		/**
-		* The profile entry id this plugin's bundle patch composes it under, and the
-		* settings namespace dsh ≥ 0.1.7 addresses every write by.
+		* The package name dsh keys a bundle's own configuration by in
+		* `plugins.bundle.config`, and the name this profile's bundle row resolves to.
+		* It is the package's npm name — not the locale namespace or the row id.
+		*/
+		const PACKAGE_NAME = "@riceawa/dsh-lan-gateway";
+		/**
+		* The profile entry id this plugin's bundle patch composes it under. dsh >=
+		* 0.1.7 addresses both settings writes and the serve gate by entry id.
 		*/
 		const ENTRY_ID = "dsh-lan-gateway";
 		/** The slots service the card rides, and the settings mirror the gate reads. */
@@ -1054,11 +1014,9 @@ window.__ModuleLoader__.load({
 		*/
 		function apply(ctx) {
 			installRandomUuidShim();
-			ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () => ctx.slots.inject("plugins.item", () => ctx.slots.register({
-				name: "plugins.item",
-				id: ENTRY_ID,
-				order: 30,
-				label: () => cardTitle()
+			ctx.effect(() => ctx.configForms.whileServed([ENTRY_ID], () => ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
+				name: "plugins.bundle.config",
+				key: PACKAGE_NAME
 			}, LanGatewayCard))));
 		}
 		//#endregion