@tonyruan/dsh-bridge-host 0.1.1-beta.4 → 0.1.1-beta.7

package/README.md

@@ -1,9 +1,14 @@
-# DSH Bridge host beta
-
-A community DSH-compatible phone-access plugin, not an official DeepSeek product. Requires Node.js >=24.9.0 and DSH0.2.2-rc.1.
-
-Package: @tonyruan/dsh-bridge-host. Use the official DSH plugin manager for installation; stop the target profile before package-name migration. Cordis ID dsh-phone-access, plugin name phone-access, API routes and existing profileDirectory/identity remain stable. The default profile is the existing .dsh-phone-profile; changing an npm name does not authorize replacing data.
-
-This generic build contains no personal relay preset or update root/feed. Import the original trusted deployment configuration or use the private migration bridge locally before replacing an old configured build. Existing paired profiles without deployment configuration fail recoverably and retain identity, pairing and login data. Strict LAN-only use does not enable update or diagnostic networking.
-
-Own project code is licensed under the standard PolyForm Noncommercial License1.0.0 in LICENSE. This is not OSI open-source; permitted purposes and exceptions are governed by that exact text, not a blanket promise about every business/payment scenario. Third-party components retain their own permission, copyright and NOTICE terms in THIRD-PARTY-NOTICES.txt and oss-licenses/. These own-code terms do not restrict upstream rights. The complete own development project/Git repository is not included; npm runtime JavaScript is publicly readable. Native platform download assets are not included in this npm release.
+# DSH Bridge host beta
+
+A community DSH-compatible phone-access plugin, not an official DeepSeek product. Requires Node.js >=24.9.0 and DSH0.2.2-rc.1.
+
+Package: @tonyruan/dsh-bridge-host. Use the official DSH plugin manager for installation; stop the target profile before package-name migration. Cordis ID dsh-phone-access, plugin name phone-access, API routes and existing profileDirectory/identity remain stable. The default profile is the existing .dsh-phone-profile; changing an npm name does not authorize replacing data.
+
+This generic build contains no personal relay preset or update root/feed. Import the original trusted deployment configuration or use the private migration bridge locally before replacing an old configured build. Existing paired profiles without deployment configuration fail recoverably and retain identity, pairing and login data. Strict LAN-only use does not enable update or diagnostic networking.
+
+Own project code is licensed under the standard PolyForm Noncommercial License1.0.0 in LICENSE. This is not OSI open-source; permitted purposes and exceptions are governed by that exact text, not a blanket promise about every business/payment scenario. Third-party components retain their own permission, copyright and NOTICE terms in THIRD-PARTY-NOTICES.txt and oss-licenses/. These own-code terms do not restrict upstream rights. The complete own development project/Git repository is not included; npm runtime JavaScript is publicly readable. Native platform download assets are not included in this npm release.
+
+
+Beta6/build26 retains the original validated persisted connection realm across upgrades and LAN-only restarts, including previously paired WSS realms without an unused relay leaf. Existing trusted deployment is reused without import or rewrite. AUTO still requires trusted TLS material. Legacy private code-only presets require the separately delivered Linux pre-upgrade migration helper before replacement; it statically validates the original local package and pin, never executes old code or fetches a new network leaf. No identity/pairing/schema reinitialization or client update-source JSON is required. 
+
+Beta7/build27 fixes the setting sidebar icon through the native settings.section.icon slot, without changing the phone-connection name or the general settings icon. An already-native-authenticated hostname may be used only for independently proven direct LAN sockets; the private internal flag cannot authorize relay, unknown, virtual/VPN or unverified interfaces, or bypass native Cookie/Host/Origin. The UI distinguishes native admission403 from the plugin fixed management403, and both remain blocked. Targeted raw-LAN positives use synthetic interface facts; the actual rc.1 browser/navigation checks use an isolated loopback profile. The real user Ubuntu version and route were not inspected, so site-specific resolution and a real physical-LAN success are not claimed.

package/lib/agent.mjs

@@ -332,7 +332,13 @@ var require_is_electron = __commonJS({
   }
 });
 
-// npm-release-beta-r1/host/phone-access-plugin/src/agent.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/lan-provenance.mjs
+var accepted = /* @__PURE__ */ new WeakMap();
+function acceptedLanEndpoint(socket) {
+  return socket.destroyed ? null : accepted.get(socket) ?? null;
+}
+
+// host-config-migration-r1/host/phone-access-plugin/src/agent.mjs
 import net from "node:net";
 import { once } from "node:events";
 
@@ -15327,7 +15333,7 @@ function noise(init = {}) {
   return (components) => new Noise(components, init);
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/lan-trace.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/lan-trace.mjs
 var LAN_DETAIL_CODES = Object.freeze(["LAN_TCP_ACCEPTED", "LAN_TCP_CLOSED_REJECTED", "LAN_TCP_DISABLED_REJECTED", "LAN_TCP_POLICY_REJECTED", "LAN_TCP_SUBNET_REJECTED", "LAN_TCP_LIMIT_REJECTED", "LAN_TCP_GLOBAL_RATE_REJECTED", "LAN_TCP_SOURCE_RATE_REJECTED", "LAN_TCP_RATE_KEYS_REJECTED", "LAN_AGENT_CLOSED_REJECTED", "LAN_AGENT_LIMIT_REJECTED", "LAN_AGENT_HANDSHAKE_LIMIT_REJECTED", "LAN_AGENT_PEER_LIMIT_REJECTED", "LAN_AGENT_ADMISSION_REJECTED", "LAN_AGENT_READMISSION_REJECTED", "LAN_AGENT_FIRST_FRAME_EOF", "LAN_AGENT_NOISE_FAILED", "LAN_AGENT_FIRST_FRAME_TIMEOUT", "LAN_AGENT_FIRST_FRAME_FAILED", "LAN_AGENT_BACKEND_CONNECT_FAILED", "LAN_AGENT_REGISTER_FAILED", "LAN_AGENT_FORWARD_FAILED", "LAN_AGENT_CHANNEL_READY", "LAN_AGENT_CHANNEL_CLOSED"]);
 var codes = new Set(LAN_DETAIL_CODES);
 var bounded = (v, max) => Number.isSafeInteger(v) && v >= 0 ? Math.min(max, v) : 0;
@@ -15395,7 +15401,7 @@ function createLanTrace(diagnostic = () => {
   return { sample, lifetime, now };
 }
 
-// npm-release-beta-r1/host/noise-lab/core.mjs
+// host-config-migration-r1/host/noise-lab/core.mjs
 var silent = Object.assign(() => {
 }, { enabled: false, error: () => {
 }, trace: () => {
@@ -15435,7 +15441,7 @@ async function temporaryIdentity() {
   return { privateKey, peerId: peerIdFromPrivateKey(privateKey) };
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/agent.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/agent.mjs
 async function createPcAgent({ backendPort, listenPort = 0, listen = true, identity: providedIdentity, pairing = () => ({ confirmed: false, pin: null }), acquireLease, registerBackend, diagnostic = () => {
 }, factories = {} }) {
   if (!Number.isInteger(backendPort) || backendPort < 1 || backendPort > 65535) throw Error("INVALID_FIXED_BACKEND");
@@ -15452,7 +15458,7 @@ async function createPcAgent({ backendPort, listenPort = 0, listen = true, ident
   let handshaking = 0, closed = false, attempts = 0;
   const stats = { handshakes: 0, rejected: 0, handshakeFailed: 0, dshConnections: 0, upBytes: 0, downBytes: 0 };
   const acceptWire = (wire, { route = "RELAY", pairId } = {}) => {
-    const attempt = ++attempts, began = trace.now();
+    const attempt = ++attempts, began = trace.now(), lanEndpoint = route === "LAN" ? acceptedLanEndpoint(wire) : null;
     const event = (code3) => {
       try {
         diagnostic({ stage: route === "LAN" ? "LAN" : "AUTH", code: code3, attempt });
@@ -15629,7 +15635,7 @@ async function createPcAgent({ backendPort, listenPort = 0, listen = true, ident
         check();
         if (registerBackend) {
           phase = "REGISTER";
-          const registration = Promise.resolve(registerBackend({ localAddress: backend.localAddress, localPort: backend.localPort, remoteAddress: backend.remoteAddress, remotePort: backend.remotePort })).then((fn) => {
+          const registration = Promise.resolve(registerBackend({ localAddress: backend.localAddress, localPort: backend.localPort, remoteAddress: backend.remoteAddress, remotePort: backend.remotePort }, lease && lease.valid() ? { schema: 1, route: route === "LAN" && lanEndpoint ? "LAN" : route === "RELAY" ? "RELAY" : "UNKNOWN", peerId: lease.peerId, pairId: lease.pairId, generation: lease.generation, lanEndpoint: route === "LAN" ? lanEndpoint : null } : null)).then((fn) => {
             let released = false;
             const once2 = () => {
               if (released) return;

package/lib/child.mjs

@@ -1,38 +1,38 @@
-import {createPcAgent} from './agent.mjs';
-import {createPhoneSession} from './session.mjs';
-import {randomUUID} from 'node:crypto';
-let agent,closing=false,heartbeat;
-const registrations=new Map();
-function registerBackend(tuple){return new Promise((resolve,reject)=>{
- const registrationId=randomUUID(),timer=setTimeout(()=>{registrations.delete(registrationId);process.send?.({op:'backend.close',registrationId},()=>{});reject(Error('BACKEND_REGISTRATION_TIMEOUT'));},3000);
- registrations.set(registrationId,{resolve,reject,timer});
- process.send?.({op:'backend.open',registrationId,tuple},error=>{if(error){clearTimeout(timer);registrations.delete(registrationId);reject(Error('BACKEND_REGISTRATION_FAILED'));}});
-});}
-const finish=async()=>{if(closing)return;closing=true;clearInterval(heartbeat);await agent?.close();process.exit(0);};
-process.on('disconnect',finish);process.on('SIGTERM',finish);process.on('SIGINT',finish);
-// Parent IPC is the only controller. No unauthenticated control HTTP listener exists.
-process.on('message',async message=>{
- if(closing)return;
- try{
-  if(message?.op==='backend.ack'){
-   const r=registrations.get(message.registrationId);if(!r)return;registrations.delete(message.registrationId);clearTimeout(r.timer);
-   if(!message.ok)r.reject(Error('BACKEND_REGISTRATION_REJECTED'));else {let released=false;r.resolve(()=>{if(released)return;released=true;process.send?.({op:'backend.close',registrationId:message.registrationId},()=>{});});}return;
-  }
-  if(message?.op==='init'){
-   if(agent)throw Error('ALREADY_INITIALIZED');
-   if(message.profileDirectory&&!message.relay)throw Error('PERSISTENT_PROFILE_REQUIRES_FIXED_RELAY');
-   agent=message.relay?await createPhoneSession({backendPort:message.backendPort,connectionMode:message.connectionMode??'auto',lanAddress:message.lanAddress,relay:message.relay,relayCa:message.relayCa,relayLeaf:message.relayLeaf,profileDirectory:message.profileDirectory,lanEnabled:message.lanEnabled===true,registerBackend,diagnostics:{record:event=>{if(process.connected)process.send?.({op:'diagnostic',event:{...event,generation:Number.isInteger(message.diagnosticGeneration)?message.diagnosticGeneration:0}},()=>{});}}}):await createPcAgent({backendPort:message.backendPort,registerBackend});
-   heartbeat=setInterval(()=>{if(process.connected)process.send?.({op:'diagnostic',event:{stage:'LOCAL',code:'COMPANION_HEARTBEAT',count:1,generation:Number.isInteger(message.diagnosticGeneration)?message.diagnosticGeneration:0}},()=>{});},30000);heartbeat.unref?.();
-   process.send?.({id:message.id,ok:true,status:{pid:process.pid,...agent.status()}});
-  }else if(message?.op==='status'&&agent)process.send?.({id:message.id,ok:true,status:{pid:process.pid,...agent.status()}});
-  else if(message?.op==='confirmReverseScan'&&agent?.confirmReverseScan){await agent.confirmReverseScan(message.qr);process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='pair/start'&&agent?.beginPairing){await agent.beginPairing();process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='pair/cancel'&&agent?.cancelPairing){await agent.cancelPairing(message.sessionId);process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='revoke'&&agent?.revoke){await agent.revoke(message.target);process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='lan/settings'&&agent?.setLanEnabled){await agent.setLanEnabled(message.enabled);process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='reconnect'&&agent?.reconnect){await agent.reconnect();process.send?.({id:message.id,ok:true,status:agent.status()});}
-  else if(message?.op==='stop')await finish();
- }catch(error){const code=error?.code??error?.message;process.send?.({id:message?.id,ok:false,error:/^[A-Z_]{3,70}$/.test(code??'')?code:'AGENT_OPERATION_FAILED'});if(!agent)await finish();}
-});
-// Failed owners must not leave a child waiting forever before init.
-setTimeout(()=>{if(!agent)finish();},10000).unref();
+import {createPcAgent} from './agent.mjs';
+import {createPhoneSession} from './session.mjs';
+import {randomUUID} from 'node:crypto';
+let agent,closing=false,heartbeat;
+const registrations=new Map();
+function registerBackend(tuple,provenance){return new Promise((resolve,reject)=>{
+ const registrationId=randomUUID(),timer=setTimeout(()=>{registrations.delete(registrationId);process.send?.({op:'backend.close',registrationId},()=>{});reject(Error('BACKEND_REGISTRATION_TIMEOUT'));},3000);
+ registrations.set(registrationId,{resolve,reject,timer});
+ process.send?.({op:'backend.open',registrationId,tuple,provenance},error=>{if(error){clearTimeout(timer);registrations.delete(registrationId);reject(Error('BACKEND_REGISTRATION_FAILED'));}});
+});}
+const finish=async()=>{if(closing)return;closing=true;clearInterval(heartbeat);await agent?.close();process.exit(0);};
+process.on('disconnect',finish);process.on('SIGTERM',finish);process.on('SIGINT',finish);
+// Parent IPC is the only controller. No unauthenticated control HTTP listener exists.
+process.on('message',async message=>{
+ if(closing)return;
+ try{
+  if(message?.op==='backend.ack'){
+   const r=registrations.get(message.registrationId);if(!r)return;registrations.delete(message.registrationId);clearTimeout(r.timer);
+   if(!message.ok)r.reject(Error('BACKEND_REGISTRATION_REJECTED'));else {let released=false;r.resolve(()=>{if(released)return;released=true;process.send?.({op:'backend.close',registrationId:message.registrationId},()=>{});});}return;
+  }
+  if(message?.op==='init'){
+   if(agent)throw Error('ALREADY_INITIALIZED');
+   if(message.profileDirectory&&!message.relay)throw Error('PERSISTENT_PROFILE_REQUIRES_FIXED_RELAY');
+   agent=message.relay?await createPhoneSession({backendPort:message.backendPort,connectionMode:message.connectionMode??'auto',lanAddress:message.lanAddress,relay:message.relay,relayCa:message.relayCa,relayLeaf:message.relayLeaf,profileDirectory:message.profileDirectory,lanEnabled:message.lanEnabled===true,registerBackend,diagnostics:{record:event=>{if(process.connected)process.send?.({op:'diagnostic',event:{...event,generation:Number.isInteger(message.diagnosticGeneration)?message.diagnosticGeneration:0}},()=>{});}}}):await createPcAgent({backendPort:message.backendPort,registerBackend});
+   heartbeat=setInterval(()=>{if(process.connected)process.send?.({op:'diagnostic',event:{stage:'LOCAL',code:'COMPANION_HEARTBEAT',count:1,generation:Number.isInteger(message.diagnosticGeneration)?message.diagnosticGeneration:0}},()=>{});},30000);heartbeat.unref?.();
+   process.send?.({id:message.id,ok:true,status:{pid:process.pid,...agent.status()}});
+  }else if(message?.op==='status'&&agent)process.send?.({id:message.id,ok:true,status:{pid:process.pid,...agent.status()}});
+  else if(message?.op==='confirmReverseScan'&&agent?.confirmReverseScan){await agent.confirmReverseScan(message.qr);process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='pair/start'&&agent?.beginPairing){await agent.beginPairing();process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='pair/cancel'&&agent?.cancelPairing){await agent.cancelPairing(message.sessionId);process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='revoke'&&agent?.revoke){await agent.revoke(message.target);process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='lan/settings'&&agent?.setLanEnabled){await agent.setLanEnabled(message.enabled);process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='reconnect'&&agent?.reconnect){await agent.reconnect();process.send?.({id:message.id,ok:true,status:agent.status()});}
+  else if(message?.op==='stop')await finish();
+ }catch(error){const code=error?.code??error?.message;process.send?.({id:message?.id,ok:false,error:/^[A-Z_]{3,70}$/.test(code??'')?code:'AGENT_OPERATION_FAILED'});if(!agent)await finish();}
+});
+// Failed owners must not leave a child waiting forever before init.
+setTimeout(()=>{if(!agent)finish();},10000).unref();

package/lib/client.js

@@ -31,8 +31,9 @@ window.__ModuleLoader__.load({ id: "@tonyruan/dsh-bridge-host", factory: (requir
     decidePairing:'/api/phone-access/pair/confirm', revoke:'/api/phone-access/revoke',
     reconnect:'/api/phone-access/start', diagnosticInitialize:'/api/phone-access/diagnostics/initialize', diagnosticSettings:'/api/phone-access/diagnostics/settings', diagnosticExport:'/api/phone-access/diagnostics/export', lanSettings:'/api/phone-access/lan/settings', startupSettings:'/api/phone-access/startup/settings'
   });
-  const messages = { CLIENT_TARGET_REQUIRED:"请选择要撤销的客户端。",PAIRING_STALE:"身份或代次已变化，请刷新后重试。",PAIRING_BUSY:"已有配对正在进行。",PROFILE_CAPACITY:"已达到四个客户端上限。",PROFILE_UNAVAILABLE:"安全存储状态不确定，访问已关闭。请恢复存储并读取状态，不要删除配对或重新初始化。", STARTUP_SETTINGS_UNAVAILABLE:"自动启动设置无法保存，请检查本地存储。", AUTOSTART_PAIR_REQUIRED:"请先手动完成手机配对，自动启动不会创建身份。",  DIAGNOSTICS_STORAGE_UNAVAILABLE:"日志存储不可用，业务连接可继续使用。", DIAGNOSTICS_INITIALIZE_REQUIRED:"请先初始化独立日志身份。", DIAGNOSTICS_CONFIRM_REQUIRED:"请确认日志操作。", CONFIG_REQUIRED: "未找到有效的预置连接配置，请安装已配置中继与公开证书的用户专用插件包。", TRUST_EXPIRED: "relay 证书已过期。请更新插件包中的公开证书配置后重试。", BACKEND_NOT_CONNECTED: "配对管理接口尚未接入。请更新插件后重试。", SAME_ORIGIN_REQUIRED: "管理请求被拒绝。请从这台电脑的 DSH 重新打开页面。", LOCAL_MANAGEMENT_REQUIRED: "请在电脑浏览器打开本机 DSH，或使用 SSH 转发打开管理页面。手机远程通道不能执行管理操作。", STALE_REQUEST: "手机请求已变化或过期，请刷新后重新核对指纹。", PAIRING_EXPIRED: "二维码已过期，请重新开始配对。", RELAY_UNREACHABLE: "无法连接 relay。请检查地址、网络和证书配置。", TRUST_MISMATCH: "relay 证书校验失败，请核对公开证书或 SHA-256 指纹。", TIMEOUT: "请求超时。操作结果尚未确认，请刷新状态后再决定是否重试。", NETWORK: "无法读取连接状态。请检查 DSH 是否在线，再刷新。" };
+  const messages = { CLIENT_TARGET_REQUIRED:"请选择要撤销的客户端。",PAIRING_STALE:"身份或代次已变化，请刷新后重试。",PAIRING_BUSY:"已有配对正在进行。",PROFILE_CAPACITY:"已达到四个客户端上限。",PROFILE_UNAVAILABLE:"安全存储状态不确定，访问已关闭。请恢复存储并读取状态，不要删除配对或重新初始化。", STARTUP_SETTINGS_UNAVAILABLE:"自动启动设置无法保存，请检查本地存储。", AUTOSTART_PAIR_REQUIRED:"请先手动完成手机配对，自动启动不会创建身份。",  DIAGNOSTICS_STORAGE_UNAVAILABLE:"日志存储不可用，业务连接可继续使用。", DIAGNOSTICS_INITIALIZE_REQUIRED:"请先初始化独立日志身份。", DIAGNOSTICS_CONFIRM_REQUIRED:"请确认日志操作。", CONFIG_REQUIRED: "未找到有效的预置连接配置，请安装已配置中继与公开证书的用户专用插件包。", TRUST_EXPIRED: "relay 证书已过期。请更新插件包中的公开证书配置后重试。", BACKEND_NOT_CONNECTED: "配对管理接口尚未接入。请更新插件后重试。", SAME_ORIGIN_REQUIRED: "管理请求被拒绝。请从这台电脑的 DSH 重新打开页面。", LOCAL_MANAGEMENT_REQUIRED: "请在本机或已验证的局域网连接中管理插件；公网中继不允许管理。也可保留原有 SSH 转发方式。", STALE_REQUEST: "手机请求已变化或过期，请刷新后重新核对指纹。", PAIRING_EXPIRED: "二维码已过期，请重新开始配对。", RELAY_UNREACHABLE: "无法连接 relay。请检查地址、网络和证书配置。", TRUST_MISMATCH: "relay 证书校验失败，请核对公开证书或 SHA-256 指纹。", TIMEOUT: "请求超时。操作结果尚未确认，请刷新状态后再决定是否重试。", NETWORK: "无法读取连接状态。请检查 DSH 是否在线，再刷新。" };
   Object.assign(messages,{"CONFIGURATION_REQUIRED": "未找到有效的预置连接配置，请更新用户专用插件包。", "INITIALIZE_REQUIRED": "请先点击“初始化连接”，再开始配对。", "PAIR_REQUEST_CHANGED": "手机请求已变化或过期，请重新开始配对并核对指纹。", "ALREADY_PAIRED": "已配对一部手机，请先撤销现有配对。", "INVALID_ACTION_BODY": "请求未被接受，请刷新页面后重试。", "RELAY_OFFLINE": "中继离线或连接超时，请检查网络后重新诊断。", "RELAY_DISCONNECTED": "中继连接已断开，请重新连接后再试。", "TLS_LEAF_EXPIRED": "中继公开证书已过期或尚未生效，请更新用户专用插件包。", "TLS_LEAF_SAN_MISMATCH": "中继证书的域名或 IP 不匹配，请核对插件配置。", "TLS_LEAF_PIN_MISMATCH": "中继证书指纹不匹配，已拒绝连接。请更新正确的公开证书配置。", "TLS_LEAF_CA_FORBIDDEN": "需要固定中继的公开叶证书，请更新插件配置。", "PERSISTENCE_UNSUPPORTED_PLATFORM": "当前系统尚不支持本机身份存储。", "PROFILE_NOT_PROVISIONED": "请先初始化本机连接身份。", "PROFILE_RELAY_MISMATCH": "本机身份绑定了其他中继，请核对已安装的插件配置。", "LINUX_VAULT_UNSAFE_IN_USE_OR_RECOVERY_REQUIRED": "本机身份目录不可用、被占用或需要恢复。请关闭其他实例后检查目录。", "VAULT_UNAVAILABLE_OR_IN_USE": "Windows 安全存储不可用或被其他实例占用，请关闭其他实例后重试。", "LOCAL_AGENT_OPERATION_FAILED": "本机连接操作失败，请刷新并检查设备与中继状态。"});
+  messages.NATIVE_ACCESS_DENIED = "DSH 拒绝了此页面的认证或来源，请从原 DSH 入口重新打开。插件不会放宽认证或代理规则。";
   class UiError extends Error {
     constructor(code) {
       super(messages[code] || "操作未完成。请刷新状态；如仍失败，请检查插件和 relay 配置。");
@@ -96,13 +97,13 @@ window.__ModuleLoader__.load({ id: "@tonyruan/dsh-bridge-host", factory: (requir
       const abort = new AbortController(), timer = setTimeout(() => abort.abort(), 12e3);
       try {
         const r = await request(path, { method: body === void 0 ? "GET" : "POST", credentials: "same-origin", cache: "no-store", signal: abort.signal, headers: body === void 0 ? {} : { "content-type": "application/json" }, ...body === void 0 ? {} : { body: JSON.stringify(body) } });
-        if (r.status === 403) throw new UiError('LOCAL_MANAGEMENT_REQUIRED');
         let data;
         try {
           data = await r.json();
         } catch {
-          throw new UiError("INVALID_RESPONSE");
+          throw new UiError(r.status === 403 ? 'NATIVE_ACCESS_DENIED' : "INVALID_RESPONSE");
         }
+        if (r.status === 403) throw new UiError(data?.error?.code === 'LOCAL_MANAGEMENT_REQUIRED' ? 'LOCAL_MANAGEMENT_REQUIRED' : 'NATIVE_ACCESS_DENIED');
         if (!r.ok) throw new UiError(errorCode(data?.error) || 'REQUEST_FAILED');
         return data;
       } catch (e) {
@@ -122,9 +123,10 @@ window.__ModuleLoader__.load({ id: "@tonyruan/dsh-bridge-host", factory: (requir
       }
     };
   }
-  function PhoneIcon({ size = 20, ...props } = {}) {
-    const Icon = primitives.IconPhoneOutlineMedium || primitives.IconMobileOutlineMedium;
-    return Icon ? h(Icon, { size, ...props }) : h("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 1.7, "aria-hidden": true, ...props }, h("rect", { x: 6, y: 2.5, width: 12, height: 19, rx: 2.5 }), h("path", { d: "M10 5h4M10.5 18.5h3", strokeLinecap: "round" }));
+function PhoneIcon({ size = 20, ...props } = {}) {
+    return h("svg", { width: size, height: size, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 1.5, strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": true, focusable: false, ...props },
+      h("rect", { x: 3, y: 3, width: 10, height: 18, rx: 2 }),
+      h("path", { d: "M6.5 6h3M7 18h2M16 8a5 5 0 0 1 0 8M19 5a10 10 0 0 1 0 14" }));
   }
   const css = `.dsh-phone{font-family:inherit;font-size:14px;line-height:1.6;color:var(--dsw-alias-label-primary,#202329);max-width:690px;min-width:0}.dsh-phone *{box-sizing:border-box}.dsh-phone h2{font-size:20px;line-height:1.4;font-weight:600;margin:0}.dsh-phone h3{font-size:15px;font-weight:600;margin:0 0 6px}.dsh-phone p{margin:5px 0 12px}.dsh-phone .muted{color:var(--dsw-alias-label-secondary,#69707b);font-size:13px}.dsh-phone .head,.dsh-phone .actions{display:flex;align-items:center;gap:9px;flex-wrap:wrap}.dsh-phone .head{margin-bottom:8px}.dsh-phone .state{border:1px solid var(--dsw-alias-border-main,#e1e4e9);border-radius:10px;padding:14px 16px;margin:18px 0}.dsh-phone .state strong{font-weight:600}.dsh-phone .dot{display:inline-block;width:7px;height:7px;border-radius:50%;background:#959ba6;margin-right:8px}.dsh-phone .dot.online{background:#2b8b65}.dsh-phone .dot.wait{background:#b28122}.dsh-phone .block{padding:18px 0;border-top:1px solid var(--dsw-alias-border-main,#e7e9ed)}.dsh-phone label{display:block;font-size:13px;margin:12px 0 5px}.dsh-phone input,.dsh-phone select,.dsh-phone textarea{width:100%;font:inherit;color:inherit;background:var(--dsw-alias-bg-layer-2,#fff);border:1px solid var(--dsw-alias-border-main,#cfd4dd);border-radius:7px;padding:8px 10px;min-width:0}.dsh-phone textarea{resize:vertical}.dsh-phone button{font:inherit;font-size:13px;cursor:pointer;line-height:20px;padding:7px 12px;border:1px solid var(--dsw-alias-border-main,#d9dde4);border-radius:7px;background:var(--dsw-alias-bg-layer-2,#fff);color:inherit}.dsh-phone button.primary{background:var(--dsw-alias-brand-primary-new-colorprimary-new-color,#4d6bfe);color:white;border-color:transparent}.dsh-phone button.danger{color:#b13d3d}.dsh-phone button:disabled{opacity:.48;cursor:not-allowed}.dsh-phone :is(button,input,select,textarea):focus-visible{outline:2px solid #4d6bfe;outline-offset:2px}.dsh-phone .alert{border-left:3px solid #bb7830;padding:9px 12px;background:var(--dsw-alias-bg-layer-1,#faf7f2);margin:12px 0;overflow-wrap:anywhere}.dsh-phone .fingerprint,.dsh-phone pre{font:12px/1.7 ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;white-space:pre-wrap;background:var(--dsw-alias-bg-layer-1,#f5f6f8);border-radius:7px;padding:10px;user-select:text;margin:8px 0}.dsh-phone .qr-layout{display:flex;align-items:flex-start;gap:20px;flex-wrap:wrap;margin:14px 0}.dsh-phone .qr{background:#fff;color:#111;max-width:100%;width:196px;height:auto;border:1px solid #e4e7ec;border-radius:7px;flex:none;image-rendering:pixelated}.dsh-phone .qr-copy{flex:1;min-width:180px}.dsh-phone .check{display:flex;align-items:flex-start;gap:9px;margin:12px 0}.dsh-phone .check input{width:16px;height:16px;flex:none;margin-top:3px}.dsh-phone .diagnostics{padding-left:20px}.dsh-phone .diagnostics li{padding:3px 0}.dsh-phone .tag{font-size:12px;font-weight:400;margin-left:8px}.dsh-phone .actions{margin-top:12px}.dsh-phone .sr{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset(50%)}@media(max-width:460px){.dsh-phone .state{padding:12px}.dsh-phone .qr-layout{gap:12px}.dsh-phone .qr{width:180px}.dsh-phone button{min-height:38px}}`;
   function createPhonePage(api) {
@@ -421,7 +423,8 @@ function installSubmissionGuard(conversation, sessions, enabled, options={}) {
   function apply(ctx) {
     installPhoneCompatibility(ctx);
     const Page = createPhonePage(createPhoneApi());
-    ctx.slots.inject("settings.section", () => ctx.slots.register({ name: "settings.section", id: "phone-access", order: 18, label: "手机连接", icon: PhoneIcon }, Page));
+    ctx.slots.inject("settings.section", () => ctx.slots.register({ name: "settings.section", id: "phone-access", order: 18, label: "手机连接" }, Page));
+    ctx.slots.inject("settings.section.icon", () => ctx.slots.register({ name: "settings.section.icon", id: "phone-access" }, ({size = 16}) => h(PhoneIcon, {size})));
   }
   return { inject: ["slots"], apply, createPhoneApi, createPhonePage, PhoneIcon, publicStatus };
 } });

package/lib/controller.mjs

@@ -5,7 +5,7 @@ var __export = (target, all) => {
     __defProp(target, name2, { get: all[name2], enumerable: true });
 };
 
-// npm-release-beta-r1/host/diagnostics/lifecycle-trace.mjs
+// host-config-migration-r1/host/diagnostics/lifecycle-trace.mjs
 var STOP_REASON = Object.freeze({ USER_STOP: 1, PLUGIN_SHUTDOWN: 2, USER_RESTART: 3, REPLACE_CHILD: 4, INIT_FAILURE: 5, OWNER_DISCONNECT: 6 });
 var SIGNAL = Object.freeze({ NONE: 0, SIGTERM: 1, SIGKILL: 2, SIGINT: 3, SIGABRT: 4, SIGSEGV: 5, SIGBUS: 6, SIGHUP: 7, OTHER: 8 });
 var CRITICAL_CODES = Object.freeze(["COMPANION_START_BEGIN", "COMPANION_START_READY", "COMPANION_START_FAILED", "COMPANION_STOP_REQUESTED", "COMPANION_EXIT", "COMPANION_SIGNAL", "COMPANION_IPC_LOST", "DIAG_UPLOAD_FAILED", "RELAY_CONTROL_ENDED", "RELAY_CONTROL_TIMEOUT", "RELAY_CONTROL_CONNECT_FAILED", "RELAY_RECOVERY_BLOCKED"]);
@@ -41,7 +41,7 @@ function createLifecycleTrace(record) {
   } };
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/controller.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/controller.mjs
 import { fork } from "node:child_process";
 
 // ../../2026-10-22/task-2/node_modules/@libp2p/interface/dist/src/errors.js
@@ -8055,7 +8055,7 @@ function isSha256Multihash(multihash) {
   return multihash.code === sha256.code;
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/linux-vault.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/linux-vault.mjs
 import * as nativeFs from "node:fs/promises";
 import { constants as nativeConstants } from "node:fs";
 import { posix } from "node:path";
@@ -8214,7 +8214,7 @@ async function openLinuxVault(directory, { platform = process.platform, fs = nat
   };
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/profile-store.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/profile-store.mjs
 async function openWindowsVault() {
   throw Error("PERSISTENCE_UNSUPPORTED_PLATFORM");
 }
@@ -8250,7 +8250,7 @@ function openProfileVault(directory, options = {}) {
   throw Error("PERSISTENCE_UNSUPPORTED_PLATFORM");
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/multi-client-profile.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/multi-client-profile.mjs
 var LIMITS = Object.freeze({ maxPaired: 4, maxPending: 1, maxRecords: 16, maxBytes: 32768, maxPairingMs: 12e4 });
 var copy = (value) => structuredClone(value);
 var keys = (value, expected) => value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join(",") === expected;
@@ -8646,7 +8646,7 @@ var MultiClientProfile = class {
   }
 };
 
-// npm-release-beta-r1/host/phone-access-plugin/src/multi-client-runtime-profile.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/multi-client-runtime-profile.mjs
 async function loadMultiClientProfile(directory, options = {}) {
   const vault = await (options.openVault ?? openProfileVault)(directory), profile = new MultiClientProfile(vault, options);
   try {
@@ -8673,43 +8673,165 @@ async function initializeMultiClientProfile(directory, relay, { openVault = open
   }
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/controller.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/controller.mjs
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
-// npm-release-beta-r1/host/phone-access-plugin/src/local-management.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/local-management.mjs
+import { Server as HttpServer } from "node:http";
+import { Server as HttpsServer } from "node:https";
 import { isIP } from "node:net";
-var ip = (value) => typeof value === "string" && value.startsWith("::ffff:") ? value.slice(7) : value;
+
+// host-config-migration-r1/host/phone-access-plugin/src/lan-protocol.mjs
+var MAGIC = Buffer.from("DSHLAN01");
+
+// host-config-migration-r1/host/phone-access-plugin/src/management-lan.mjs
+var normalizedAddress = (value) => typeof value === "string" && value.startsWith("::ffff:") ? value.slice(7) : value;
+
+// host-config-migration-r1/host/phone-access-plugin/src/local-management.mjs
 var loopback = (value) => {
-  const a = ip(value);
+  const a = normalizedAddress(value);
   return a === "::1" || isIP(a ?? "") === 4 && a.startsWith("127.");
 };
 var port = (value) => Number.isInteger(value) && value > 0 && value <= 65535;
-var key = (s) => [ip(s.remoteAddress), s.remotePort, ip(s.localAddress), s.localPort].join("|");
+var key = (s) => [normalizedAddress(s.remoteAddress), s.remotePort, normalizedAddress(s.localAddress), s.localPort].join("|");
+var exact = (o, keys2) => o && typeof o === "object" && !Array.isArray(o) && Object.keys(o).sort().join(",") === keys2.slice().sort().join(",");
+function provenance(p) {
+  if (!exact(p, ["schema", "route", "peerId", "pairId", "generation", "lanEndpoint"]) || p.schema !== 1 || !["LAN", "RELAY"].includes(p.route) || !/^\w{16,128}$/.test(p.peerId ?? "") || !/^[a-f0-9]{32}$/.test(p.pairId ?? "") || !Number.isSafeInteger(p.generation) || p.generation < 1) return null;
+  if (p.route === "RELAY") return p.lanEndpoint === null ? Object.freeze({ ...p }) : null;
+  const e = p.lanEndpoint;
+  if (!exact(e, ["localAddress", "localPort", "remoteAddress", "remotePort"]) || isIP(normalizedAddress(e.localAddress)) !== 4 || isIP(normalizedAddress(e.remoteAddress)) !== 4 || e.localPort !== 38445 || !port(e.remotePort)) return null;
+  return Object.freeze({ ...p, lanEndpoint: Object.freeze({ ...e }) });
+}
 function createBackendRegistry(backendPort) {
-  const connections = /* @__PURE__ */ new Map();
+  const connections = /* @__PURE__ */ new Map(), tuples = /* @__PURE__ */ new Map(), sockets = /* @__PURE__ */ new WeakMap(), observed = /* @__PURE__ */ new Map(), waiting = /* @__PURE__ */ new Map(), denied = /* @__PURE__ */ new Set();
+  let registryEpoch = 0, owner = /* @__PURE__ */ Symbol("standalone"), observer = null;
+  const invalidate = () => {
+    registryEpoch++;
+    for (const w of waiting.values()) {
+      clearTimeout(w.timer);
+      w.reject(Error("BACKEND_OWNER_CLOSED"));
+    }
+    waiting.clear();
+    for (const r of connections.values()) r.active = false;
+    connections.clear();
+  };
   return {
-    add(id, tuple) {
-      if (typeof id !== "string" || id.length > 80 || connections.has(id) || connections.size >= 64 || !tuple || !loopback(tuple.localAddress) || !loopback(tuple.remoteAddress) || !port(tuple.localPort) || tuple.remotePort !== backendPort) throw Error("BACKEND_REGISTRATION_REJECTED");
-      connections.set(id, [ip(tuple.localAddress), tuple.localPort, ip(tuple.remoteAddress), tuple.remotePort].join("|"));
+    attachServer(server) {
+      if (observer || !(server instanceof HttpServer || server instanceof HttpsServer) || !server.listening || server.address()?.port !== backendPort) throw Error("MANAGEMENT_SOCKET_OBSERVER_UNAVAILABLE");
+      const event = server instanceof HttpsServer ? "secureConnection" : "connection";
+      const accept = (socket) => {
+        const k = key(socket);
+        if (observed.size >= 2048 || observed.has(k)) return;
+        observed.set(k, socket);
+        const w = waiting.get(k);
+        if (w) {
+          waiting.delete(k);
+          clearTimeout(w.timer);
+          w.resolve(socket);
+        }
+        socket.once("close", () => {
+          if (observed.get(k) === socket) observed.delete(k);
+          const r = sockets.get(socket);
+          if (r) {
+            r.active = false;
+            if (connections.get(r.id) === r) connections.delete(r.id);
+            if (tuples.get(k) === r) tuples.delete(k);
+          }
+        });
+      };
+      server.on(event, accept);
+      observer = { server, event, accept };
+      return () => {
+        if (observer?.accept !== accept) return;
+        server.off(event, accept);
+        observer = null;
+        invalidate();
+        owner = null;
+      };
+    },
+    beginOwner(next) {
+      invalidate();
+      denied.clear();
+      owner = next;
+    },
+    isOwner(value) {
+      return owner === value && owner !== null;
     },
-    remove(id) {
-      connections.delete(id);
+    endOwner(value) {
+      if (owner !== value) return;
+      invalidate();
+      owner = null;
+    },
+    async add(id, tuple, p, source = owner) {
+      if (!observer || source !== owner || owner === null || typeof id !== "string" || id.length > 80 || connections.has(id) || connections.size + waiting.size >= 64 || tuples.size >= 512 || !tuple || !loopback(tuple.localAddress) || !loopback(tuple.remoteAddress) || !port(tuple.localPort) || tuple.remotePort !== backendPort) throw Error("BACKEND_REGISTRATION_REJECTED");
+      const began = registryEpoch, k = [normalizedAddress(tuple.localAddress), tuple.localPort, normalizedAddress(tuple.remoteAddress), tuple.remotePort].join("|");
+      if (tuples.has(k) || waiting.has(k) || [...waiting.values()].some((w) => w.id === id)) throw Error("BACKEND_TUPLE_IN_USE");
+      let socket = observed.get(k);
+      if (!socket) socket = await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+          waiting.delete(k);
+          reject(Error("BACKEND_NATIVE_SOCKET_TIMEOUT"));
+        }, 2e3);
+        waiting.set(k, { id, resolve, reject, timer, provenance: provenance(p) });
+      });
+      if (began !== registryEpoch || source !== owner || owner === null || !observer || tuples.has(k) || connections.has(id) || !socket || socket.destroyed || observed.get(k) !== socket) throw Error("BACKEND_NATIVE_SOCKET_REQUIRED");
+      let meta = provenance(p);
+      if (meta && denied.has(meta.peerId + "|" + meta.generation)) meta = null;
+      const r = { id, key: k, owner, active: true, provenance: meta, socket };
+      connections.set(id, r);
+      tuples.set(k, r);
+      sockets.set(socket, r);
+    },
+    remove(id, source = owner) {
+      if (source !== owner) return;
+      for (const [k, w] of waiting) if (w.id === id) {
+        waiting.delete(k);
+        clearTimeout(w.timer);
+        w.reject(Error("BACKEND_CLOSED"));
+      }
+      const r = connections.get(id);
+      if (r) {
+        r.active = false;
+        connections.delete(id);
+      }
     },
     clear() {
-      connections.clear();
+      invalidate();
+    },
+    lookup(socket) {
+      if (!socket) return null;
+      const r = sockets.get(socket);
+      return r ?? (tuples.has(key(socket)) ? { active: false, provenance: null } : null);
+    },
+    active(r, socket) {
+      return !!r && !!observer && r.active && r.owner === owner && owner !== null && r.socket === socket && !socket.destroyed && connections.get(r.id) === r;
+    },
+    denyPeer(peer2, generation) {
+      if (peer2 && Number.isSafeInteger(generation)) denied.add(peer2 + "|" + generation);
+      for (const [id, r] of connections) if (!peer2 || r.provenance?.peerId === peer2 && (generation === void 0 || r.provenance?.generation === generation)) {
+        if (r.provenance) denied.add(r.provenance.peerId + "|" + r.provenance.generation);
+        r.active = false;
+        connections.delete(id);
+      }
+      for (const w of waiting.values()) if (w.provenance && (!peer2 || w.provenance.peerId === peer2 && (generation === void 0 || w.provenance.generation === generation))) denied.add(w.provenance.peerId + "|" + w.provenance.generation);
+    },
+    nativeObserved(socket) {
+      return !!observer && !!socket && !socket.destroyed && observed.get(key(socket)) === socket;
     },
     has(socket) {
-      const k = key(socket);
-      return [...connections.values()].includes(k);
+      return !!this.lookup(socket);
     },
     get size() {
       return connections.size;
+    },
+    get tracked() {
+      return { observed: observed.size, tuples: tuples.size, waiting: waiting.size };
     }
   };
 }
 
-// npm-release-beta-r1/host/phone-access-plugin/src/controller.mjs
+// host-config-migration-r1/host/phone-access-plugin/src/controller.mjs
 var AgentController = class {
   constructor({ backendPort, connectionMode = "auto", lanAddress, relay, relayCa, relayLeaf, profileDirectory, childEntry = new URL("./child.mjs", import.meta.url), onDiagnostic = () => {
   }, forkProcess = fork, timers = { setInterval, clearInterval } }) {
@@ -8801,7 +8923,9 @@ var AgentController = class {
       this.starts++;
       this.lifecycle.observe(child, this.starts);
       const generation = this.starts;
-      child.on("message", (message2) => {
+      this.backendRegistry.beginOwner(child);
+      child.on("message", async (message2) => {
+        if (this.child !== child || this.starts !== generation || !this.backendRegistry.isOwner(child) || !["starting", "running"].includes(this.phase)) return;
         if (message2?.op === "diagnostic") {
           try {
             this.onDiagnostic(message2.event);
@@ -8812,21 +8936,22 @@ var AgentController = class {
         if (message2?.op === "backend.open") {
           let ok = false;
           try {
-            this.backendRegistry.add(message2.registrationId, message2.tuple);
-            ok = true;
+            await this.backendRegistry.add(message2.registrationId, message2.tuple, message2.provenance, child);
+            ok = this.child === child && this.starts === generation && this.backendRegistry.isOwner(child) && ["starting", "running"].includes(this.phase);
           } catch {
           }
           if (child.connected) child.send({ op: "backend.ack", registrationId: message2.registrationId, ok }, () => {
           });
-        } else if (message2?.op === "backend.close") this.backendRegistry.remove(message2.registrationId);
+        } else if (message2?.op === "backend.close") this.backendRegistry.remove(message2.registrationId, child);
       });
       child.on("error", () => {
+        if (this.child !== child || this.starts !== generation) return;
         this.lifecycle.emit("COMPANION_START_FAILED", generation, 1);
         this.lastError = "AGENT_SPAWN_FAILED";
         this.phase = "failed";
       });
       child.once("exit", () => {
-        this.backendRegistry.clear();
+        this.backendRegistry.endOwner(child);
         if (this.child === child) {
           this.child = null;
           if (this.phase !== "stopping") {
@@ -8886,6 +9011,7 @@ var AgentController = class {
     return this.ask(this.child, "pair/cancel", { sessionId }).then((s) => this.snapshot(s));
   }
   revoke(target) {
+    this.backendRegistry.denyPeer(target?.remotePeer, target?.generation);
     if (this.child && this.phase === "running") return this.ask(this.child, "revoke", { target }).then((s) => this.snapshot(s));
     return this.serialize(async () => {
       if (this.child) return this.snapshot(await this.ask(this.child, "revoke", { target }));
@@ -8911,6 +9037,7 @@ var AgentController = class {
     });
   }
   async stopChild(child, reason = "USER_STOP") {
+    this.backendRegistry.endOwner(child);
     if (child.exitCode !== null || child.signalCode !== null) return;
     this.lifecycle.stop(child, reason);
     const exited = new Promise((resolve) => child.once("exit", resolve));
@@ -8935,6 +9062,7 @@ var AgentController = class {
     if (child.exitCode === null && child.signalCode === null) throw Error("OWNED_CHILD_NOT_STOPPED");
   }
   stop(reason = "USER_STOP") {
+    if (this.child) this.backendRegistry.endOwner(this.child);
     return this.serialize(async () => {
       this.phase = "stopping";
       if (this.child) await this.stopChild(this.child, reason);