device-center 0.2.0-beta.6 → 0.2.0-beta.8

package/scripts/driver.mjs

@@ -9,6 +9,8 @@ import { cloudOrigin, publicIdentity, signedRequest } from '../server/drivers/dr
 import { cloudPost, defaultLinkFile, readLink, writeLink, linkSummary, ensurePrivateDirectory } from '../server/drivers/cloudLink.mjs';
 import { issueCertificate } from '../server/drivers/certificates.mjs';
 import { pairingBrowserUrl, openPairingBrowser, waitForFirstReport } from '../server/drivers/browserPairing.mjs';
+import { transientConnectionError, validPendingPairing, connectionFailure } from '../server/drivers/connectionRecovery.mjs';
+import { createInterface } from 'node:readline/promises';
 
 const usage = 'npm run driver -- plan|connect|run|status|disconnect --cloud https://你的域名 [--browser] [--share-ssh] [--port 5174] [--confirm]';
 export function driverPlan(argv = []) {
@@ -45,7 +47,12 @@ export async function runLocal(plan) {
   const shutdown = () => instance.server.close(() => { instance.db.close(); process.exit(0); });
   process.once('SIGINT', shutdown); process.once('SIGTERM', shutdown);
 }
-export async function main(argv = process.argv.slice(2), { file = defaultLinkFile(), post = cloudPost, openBrowser = openPairingBrowser, runDriver = runLocal, waitReport = waitForFirstReport } = {}) {
+export async function main(argv = process.argv.slice(2), { file = defaultLinkFile(), post = cloudPost, openBrowser = openPairingBrowser, runDriver = runLocal, waitReport = waitForFirstReport, now = Date.now, sleep = ms => new Promise(done => setTimeout(done, ms)), renew = async () => {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try { return /^(y|yes|是)$/i.test((await rl.question('配对申请已过期，安装与身份已保留。登录或邮箱验证完成后，重新打开绑定页面继续？[y/N]：')).trim()); }
+  finally { rl.close(); }
+} } = {}) {
   const plan = driverPlan(argv);
   if (Number(process.versions.node.split('.')[0]) < 24) throw new Error('需要 Node.js 24 或更高版本。');
   if (plan.command === 'plan') return plan; // No files, key generation, network or installation.
@@ -67,36 +74,57 @@ export async function main(argv = process.argv.slice(2), { file = defaultLinkFil
     writeLink(file, state, { create: true });
   }
   if (!state.certificate) { state.certificate = await issueCertificate(state); writeLink(file, state); }
-  let pending;
-  try { pending = await post(plan.origin, '/api/driver/pair/start', { publicKey: state.publicKey, certificate: state.certificate, name: hostname().slice(0,80), platform: ({ darwin: 'macOS', linux: 'Linux', win32: 'Windows' })[platform()] ?? platform(), shareSsh: plan.shareSsh, ...(plan.browser ? { browser: true } : {}) }); }
-  catch (error) {
-    if (plan.browser && error.statusCode === 400 && error.message === 'invalid_driver_input') throw new Error('控制面尚不支持浏览器接入，请升级控制面；或在本机终端使用不带 --browser 的 connect。未自动输出配对凭据。');
-    throw error;
-  }
-  if (!/^[a-f0-9-]{36}$/.test(pending.id) || (!plan.browser && !/^[A-F0-9]{4}-[A-F0-9]{4}$/.test(pending.code)) || pending.fingerprint !== state.fingerprint || !Number.isSafeInteger(pending.expiresAt)) throw new Error('云端配对响应无效。');
-  if (plan.browser) {
-    const url = pairingBrowserUrl(plan.origin, pending);
-    console.log(`正在打开本机浏览器。请本人登录账号，核对设备后批准一次。\n本机公钥指纹：${state.fingerprint}\n无需填写配对码，也无需回复 Agent；程序会自动等待并核验。`);
-    await openBrowser(url);
-  } else console.log(`请打开 ${plan.origin}，点“连接我的电脑”，在面板单独输入以下配对码（5分钟内有效）：\n${pending.code}\n核对本机公钥指纹：${state.fingerprint}\n仅批准你刚在这台电脑发起的请求；配对码不放入智能体prompt或安装脚本。`);
-  const deadline = Math.min(pending.expiresAt, Date.now() + 300_000);
-  while (Date.now() < deadline) {
-    const result = await post(plan.origin, '/api/driver/pair/poll', signedRequest(state.privateKey, plan.origin, '/api/driver/pair/poll', pending.id, {}));
-    if (result.state === 'approved') {
-      if (!/^[a-f0-9-]{36}$/.test(result.driverId) || typeof result.shareSsh !== 'boolean' || result.shareSsh && !plan.shareSsh) throw new Error('云端批准范围无效。');
-      state = { ...state, driverId: result.driverId, shareSsh: result.shareSsh, disabled: false }; writeLink(file, state);
-      console.log('已绑定。私钥留在本机，只回报获准字段；远程任务未授权。');
-      const since = Date.now();
-      await runDriver(plan);
-      if (!plan.browser) return linkSummary(state);
-      const report = await waitReport({ port: plan.port, driverId: state.driverId, origin: state.origin, since });
-      console.log(report.verified ? '云端已接收首次资源回报，接入完成。' : '账号绑定已完成，但尚未确认首次资源回报。请检查本机服务与网络，不要重复绑定。');
-      return { ...linkSummary(state), firstReport: report };
+  let pending = validPendingPairing(state.pendingPairing, { now: now(), browser: plan.browser, shareSsh: plan.shareSsh, recoverApproved: true }) ? state.pendingPairing : null;
+  const sessionDeadline = now() + 30 * 60_000;
+  while (now() < sessionDeadline) {
+    if (!pending) try { pending = await post(plan.origin, '/api/driver/pair/start', { publicKey: state.publicKey, certificate: state.certificate, name: hostname().slice(0,80), platform: ({ darwin: 'macOS', linux: 'Linux', win32: 'Windows' })[platform()] ?? platform(), shareSsh: plan.shareSsh, ...(plan.browser ? { browser: true } : {}) }); }
+    catch (error) {
+      if (plan.browser && error.statusCode === 400 && error.message === 'invalid_driver_input') throw new Error('控制面尚不支持浏览器接入，请升级控制面；或在本机终端使用不带 --browser 的 connect。未自动输出配对凭据。');
+      throw connectionFailure(error, '创建配对申请');
+    }
+    pending = { id: pending.id, fingerprint: pending.fingerprint, expiresAt: pending.expiresAt, browser: plan.browser, shareSsh: plan.shareSsh, ...(plan.browser ? { browserTicket: pending.browserTicket } : { code: pending.code }) };
+    if (!validPendingPairing(pending, { now: now(), browser: plan.browser, shareSsh: plan.shareSsh, recoverApproved: true }) || pending.fingerprint !== state.fingerprint) throw new Error('云端配对响应无效。');
+    state.pendingPairing = pending;
+    writeLink(file, state);
+    const recoveringExpired = pending.expiresAt <= now();
+    if (recoveringExpired) console.log('正在核对上次申请的批准结果；不会重复批准或新增设备。');
+    else if (plan.browser) {
+      const url = pairingBrowserUrl(plan.origin, pending);
+      console.log(`正在打开本机浏览器。请本人登录账号，核对设备后批准一次。\n本机公钥指纹：${state.fingerprint}\n无需填写配对码，也无需回复 Agent；程序会自动等待并核验。`);
+      await openBrowser(url);
+    } else console.log(`请打开 ${plan.origin}，点“连接我的电脑”，在面板单独输入以下配对码（5分钟内有效）：\n${pending.code}\n核对本机公钥指纹：${state.fingerprint}\n仅批准你刚在这台电脑发起的请求；配对码不放入智能体prompt或安装脚本。`);
+    const deadline = Math.min(pending.expiresAt, now() + 300_000);
+    let networkWaiting = false;
+    while (true) {
+      let result;
+      try { result = await post(plan.origin, '/api/driver/pair/poll', signedRequest(state.privateKey, plan.origin, '/api/driver/pair/poll', pending.id, {}, now())); }
+      catch (error) {
+        if (error.statusCode === 410) break;
+        if (error.statusCode === 403 && error.message === 'driver_revoked') { delete state.pendingPairing; writeLink(file, state); throw connectionFailure(error, '上次批准已撤销'); }
+        if (!transientConnectionError(error) || recoveringExpired || now() >= deadline) throw connectionFailure(error, '等待设备批准');
+        if (!networkWaiting) console.log('等待批准时网络暂不可用，正在保留当前申请并重试；无需重新安装。');
+        networkWaiting = true; await sleep(5000); continue;
+      }
+      networkWaiting = false;
+      if (result.state === 'approved') {
+        if (!/^[a-f0-9-]{36}$/.test(result.driverId) || typeof result.shareSsh !== 'boolean' || result.shareSsh && !plan.shareSsh) throw new Error('云端批准范围无效。');
+        state = { ...state, driverId: result.driverId, shareSsh: result.shareSsh, disabled: false }; delete state.pendingPairing; writeLink(file, state);
+        console.log('已绑定。私钥留在本机，只回报获准字段；远程任务未授权。');
+        const since = now();
+        await runDriver(plan);
+        const report = await waitReport({ port: plan.port, driverId: state.driverId, origin: state.origin, since });
+        console.log(report.verified ? '云端已接收首次资源回报，接入完成。' : '账号绑定已完成，但尚未确认首次资源回报。请检查本机服务与网络，不要重复绑定。');
+        return { ...linkSummary(state), firstReport: report };
+      }
+      if (result.state !== 'pending') throw new Error('配对响应无效。');
+      if (now() >= deadline) throw connectionFailure(new Error('pairing_result_unconfirmed'), '等待设备批准');
+      await sleep(5000);
     }
-    if (result.state !== 'pending') throw new Error('配对响应无效。');
-    await new Promise(done => setTimeout(done, 5000));
+    pending = null;
+    delete state.pendingPairing; writeLink(file, state);
+    if (!await renew()) break;
   }
-  throw new Error('配对已过期；未绑定，可重新 connect。身份文件保留在本机。');
+  throw new Error('配对已过期；安装与身份已保留。完成登录后重新运行同一 connect 命令或打开安装器继续，无需重装。');
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
   try { const result = await main(); if (result) console.log(JSON.stringify(result, null, 2)); }

package/scripts/service.mjs

@@ -50,6 +50,24 @@ function run(command, args) {
   return child.stdout;
 }
 async function exists(path) { try { await lstat(path); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; } }
+// Used only after the installer explicitly confirms a program upgrade.
+export async function controlExistingService(plan, operation) {
+  if (!['start', 'stop'].includes(operation) || !plan.supported) throw new Error('unsupported_service_control');
+  const { readFile } = await import('node:fs/promises');
+  const configuration = plan.task ? JSON.stringify(readPrivateJson(plan.configPath, null)) : await readFile(plan.configPath, 'utf8');
+  if (configuration !== plan.configuration) throw new Error('已有后台配置与程序位置或端口不同，已保留，未停止或替换。');
+  if (plan.task) windowsTask(operation, plan.task);
+  else if (plan.manager === 'launchd') run('launchctl', [operation === 'stop' ? 'bootout' : 'bootstrap', `gui/${process.getuid()}`, plan.configPath]);
+  else run('systemctl', ['--user', operation, 'device-center.service']);
+  for (let attempt = 0; attempt < 40; attempt++) {
+    let running = false;
+    try { const status = await (await fetch(`${plan.url}/api/connector/status`, { signal: AbortSignal.timeout(500) })).json(); running = status.service?.persistence === plan.manager; }
+    catch (error) { if (operation === 'stop' && error.cause?.code === 'ECONNREFUSED') return; }
+    if (operation === 'start' && running) return;
+    await new Promise(resolve => setTimeout(resolve, 250));
+  }
+  throw new Error('后台启动或停止尚未确认，已保留配置。请检查服务日志后继续。');
+}
 async function install(plan) {
   if (!plan.supported) throw new Error('Unsupported user service platform.');
   if (await exists(plan.configPath)) throw new Error('The service config already exists. Inspect it first; this installer will not overwrite it.');

package/server/drivers/cloudRegistry.mjs

@@ -41,9 +41,9 @@ export function createCloudRegistry({ db, origin, now = Date.now, multiUser = fa
     if (typeof code !== 'string' || !/^[A-F0-9]{4}-[A-F0-9]{4}$/.test(code)) fail('invalid_pairing_code');
     return publicCodeHash(code);
   };
-  function pairing(id) {
+  function pairing(id, recoverApproved = false) {
     const row = db.prepare('SELECT * FROM driver_pairings WHERE id=?').get(id);
-    if (!row || row.expires_at <= now()) fail('driver_pairing_expired', 410);
+    if (!row || (row.expires_at <= now() && !(recoverApproved && row.driver_id && row.expires_at + 86_400_000 > now()))) fail('driver_pairing_expired', 410);
     return row;
   }
   function credential(input) {
@@ -93,9 +93,9 @@ export function createCloudRegistry({ db, origin, now = Date.now, multiUser = fa
       const name = text(input.name), platform = text(input.platform, 64);
       if (typeof input.shareSsh !== 'boolean') fail('invalid_driver_scope');
       // Only protocol-expired pending requests are removed; registered devices and reports are retained.
-      db.prepare('DELETE FROM driver_pairings WHERE expires_at<=?').run(now());
+      db.prepare('DELETE FROM driver_pairings WHERE (driver_id IS NULL AND expires_at<=?) OR expires_at<=?').run(now(), now() - 86_400_000);
       for (const [id, at] of polls) if (at <= now() - PAIR_AGE) polls.delete(id);
-      if (db.prepare('SELECT count(*) AS n FROM driver_pairings').get().n >= 32) fail('driver_pairing_busy', 429);
+      if (db.prepare('SELECT count(*) AS n FROM driver_pairings WHERE driver_id IS NULL').get().n >= 32) fail('driver_pairing_busy', 429);
       const id = randomUUID(), raw = randomBytes(4).toString('hex').toUpperCase(), code = `${raw.slice(0,4)}-${raw.slice(4)}`;
       db.prepare('INSERT INTO driver_pairings (id,code_hash,public_key,fingerprint,name,platform,requested_ssh,created_at,expires_at,certificate) VALUES (?,?,?,?,?,?,?,?,?,?)').run(id, hashCode(code), identity.publicKey, identity.fingerprint, name, platform, Number(input.shareSsh), now(), now() + PAIR_AGE, certificate);
       if (input.browser) {
@@ -108,7 +108,7 @@ export function createCloudRegistry({ db, origin, now = Date.now, multiUser = fa
     poll(input) {
       object(input, ['id', 'at', 'nonce', 'payload', 'signature']);
       if (typeof input.id !== 'string') fail('driver_proof_required', 401);
-      const row = pairing(input.id); proof(row, '/api/driver/pair/poll', input); object(input.payload, []);
+      const row = pairing(input.id, true); proof(row, '/api/driver/pair/poll', input); object(input.payload, []);
       if (polls.has(row.id) && now() - polls.get(row.id) < 4500) fail('driver_poll_too_frequent', 429);
       polls.set(row.id, now());
       if (!row.driver_id) return { state: 'pending' };
@@ -124,6 +124,19 @@ export function createCloudRegistry({ db, origin, now = Date.now, multiUser = fa
       if (!row || row.expires_at <= now() || row.driver_id) fail('driver_pairing_unavailable', 404);
       return { id: row.id, name: row.name, platform: row.platform, fingerprint: row.fingerprint, requestedSsh: Boolean(row.requested_ssh), expiresAt: row.expires_at };
     },
+    pairingResult(input, tenantId) {
+      globalLookups = limited(globalLookups, 64); limitAccount(lookups, tenantId); object(input, ['browserTicket']);
+      const token = credential(input);
+      const row = db.prepare('SELECT * FROM driver_pairings WHERE browser_hash=?').get(token.hash);
+      if (!row || row.expires_at + 86_400_000 <= now()) fail('driver_pairing_unavailable', 404);
+      if (row.driver_id) {
+        const driver = db.prepare('SELECT * FROM cloud_drivers WHERE id=? AND tenant_id=? AND revoked_at IS NULL').get(row.driver_id, tenantId);
+        if (!driver) fail('driver_pairing_unavailable', 404);
+        return { state: 'approved', driverId: driver.id };
+      }
+      if (row.expires_at <= now()) fail('driver_pairing_expired', 410);
+      return { state: 'pending' };
+    },
     approve(input, tenantId) {
       globalApprovals = limited(globalApprovals, 64); limitAccount(approvals, tenantId);
       object(input, ['id', 'code', 'browserTicket', 'fingerprint', 'shareSsh']);
@@ -222,7 +235,7 @@ export function createCloudRegistry({ db, origin, now = Date.now, multiUser = fa
     forTenant(tenantId) {
       if (typeof tenantId !== 'string' || !/^(cloud-owner|account-[a-f0-9]{64})$/.test(tenantId)) fail('driver_account_required', 403);
       return {
-        lookup: input => registry.lookup(input, tenantId), approve: input => registry.approve(input, tenantId),
+        lookup: input => registry.lookup(input, tenantId), approve: input => registry.approve(input, tenantId), pairingResult: input => registry.pairingResult(input, tenantId),
         revoke: input => registry.revoke(input, tenantId), bindings: () => registry.bindings(tenantId), devices: () => registry.devices(tenantId), relayUsage: () => relay.usage(tenantId),
         saveProfile: input => registry.saveProfile(input, tenantId), collect: input => registry.collect(input, tenantId),
         cli: management.owner(tenantId),

package/server/drivers/connectionRecovery.mjs

@@ -0,0 +1,10 @@
+export function transientConnectionError(error) {
+  return [429, 502, 503, 504].includes(error.statusCode) || ['TimeoutError', 'AbortError'].includes(error.name) || ['ECONNRESET','ECONNREFUSED','ETIMEDOUT','EHOSTUNREACH','ENETUNREACH','EAI_AGAIN','UND_ERR_CONNECT_TIMEOUT','UND_ERR_SOCKET'].includes(error.code ?? error.cause?.code) || (error.name === 'TypeError' && error.message === 'fetch failed');
+}
+export function validPendingPairing(value, { now = Date.now(), browser, shareSsh, recoverApproved = false } = {}) {
+  return Boolean(value && /^[a-f0-9-]{36}$/.test(value.id ?? '') && Number.isSafeInteger(value.expiresAt) && value.expiresAt + (recoverApproved ? 86_400_000 : 0) > now && value.expiresAt <= now + 330_000 && value.browser === browser && value.shareSsh === shareSsh && (browser ? /^[a-f0-9]{64}$/.test(value.browserTicket ?? '') : /^[A-F0-9]{4}-[A-F0-9]{4}$/.test(value.code ?? '')));
+}
+export function connectionFailure(error, stage) {
+  const code = transientConnectionError(error) ? 'network_timeout_or_unavailable' : /^[a-z_]+$/.test(error.message ?? '') ? error.message : 'connection_failed';
+  return new Error(`接入停在“${stage}”（${code}）。已保留程序、身份与当前申请；网络恢复后重新运行同一 connect 命令或打开安装器继续，无需重新安装或解绑。`);
+}

package/server/drivers/windowsService.mjs

@@ -11,8 +11,18 @@ export function windowsServiceDefinition({ home, root, node, script, port, dbPat
     workingDirectory: root, logonType: 'InteractiveToken', runLevel: 'Limited', trigger: 'CurrentUserLogon',
   };
 }
-// COM Task Scheduler is built into Windows. Only this user's exact task is touched.
-export const windowsTaskSource = powershellPreamble + `
+export const windowsTaskIdentitySource = `
+function Resolve-TaskSid([string] $userId) {
+  try {
+    if ($userId -match '^S-1-') { return ([System.Security.Principal.SecurityIdentifier]::new($userId)).Value }
+    return ([System.Security.Principal.NTAccount]::new($userId)).Translate([System.Security.Principal.SecurityIdentifier]).Value
+  } catch { throw 'task_user_unresolved' }
+}
+`;
+// COM may return account names even when the task was registered with a SID.
+// Normalize both identities while retaining every action, scope and trigger check.
+export const windowsTaskSource = powershellPreamble + windowsTaskIdentitySource + `
+try {
 $scheduler = New-Object -ComObject 'Schedule.Service'
 $scheduler.Connect()
 $folder = $scheduler.GetFolder('\\')
@@ -26,15 +36,19 @@ function Assert-OurTask {
   if (-not $task) { throw 'task_missing' }
   $definition = $task.Definition
   $principal = $definition.Principal
-  $principalSid = $principal.UserId
-  if ($principal.UserId -ne $sid.Value) { $principalSid = ([System.Security.Principal.NTAccount]::new($principal.UserId)).Translate([System.Security.Principal.SecurityIdentifier]).Value }
+  $principalSid = Resolve-TaskSid $principal.UserId
   if ($principalSid -ne $sid.Value -or $principal.LogonType -ne 3 -or $principal.RunLevel -ne 0) { throw 'task_principal_changed' }
   if ($definition.Actions.Count -ne 1 -or $definition.Triggers.Count -ne 1) { throw 'task_changed' }
   $action = $definition.Actions.Item(1)
   $trigger = $definition.Triggers.Item(1)
-  if ($action.Type -ne 0 -or $action.Path -ne $request.task.executable -or $action.Arguments -cne $request.task.arguments -or $action.WorkingDirectory -cne $request.task.workingDirectory -or $trigger.Type -ne 9 -or $trigger.UserId -ne $sid.Value) { throw 'task_action_changed' }
+  if ($action.Type -ne 0 -or $action.Path -ne $request.task.executable -or $action.Arguments -cne $request.task.arguments -or $action.WorkingDirectory -cne $request.task.workingDirectory -or $trigger.Type -ne 9 -or (Resolve-TaskSid $trigger.UserId) -ne $sid.Value) { throw 'task_action_changed' }
 }
 switch ($request.operation) {
+  'start' {
+    Assert-OurTask
+    $null = $task.Run($null)
+    @{ started = $true } | ConvertTo-Json -Compress
+  }
   'install' {
     if ($task) { throw 'task_already_exists' }
     $definition = $scheduler.NewTask(0)
@@ -69,9 +83,24 @@ switch ($request.operation) {
   'remove' { Assert-OurTask; $folder.DeleteTask($request.task.taskName, 0); @{ removed = $true } | ConvertTo-Json -Compress }
   default { throw 'unknown_task_operation' }
 }
+} catch {
+  $failure = $_.Exception
+  while ($failure.InnerException) { $failure = $failure.InnerException }
+  $known = @('task_missing','task_user_unresolved','task_principal_changed','task_changed','task_action_changed','task_already_exists','unknown_task_operation')
+  $code = 'windows_task_failed'
+  if ($_.Exception.Message -in $known) { $code = $_.Exception.Message }
+  @{ error = $code; hresult = $failure.HResult } | ConvertTo-Json -Compress
+}
 `;
-export function windowsTask(operation, task) {
-  if (process.platform !== 'win32') throw new Error('windows_only');
-  try { return runPowerShell(windowsTaskSource, { operation, task }); }
-  catch { throw new Error('Windows 当前用户任务操作失败。请检查任务计划程序、组策略或既有任务；未提权、改策略或覆盖任务。可改用 start 前台模式。'); }
+export function windowsTask(operation, task, { platform = process.platform, run = runPowerShell } = {}) {
+  if (platform !== 'win32') throw new Error('windows_only');
+  let result;
+  try { result = run(windowsTaskSource, { operation, task }); }
+  catch { result = { error: 'windows_task_failed' }; }
+  if (result.error) {
+    const known = ['task_missing','task_user_unresolved','task_principal_changed','task_changed','task_action_changed','task_already_exists'];
+    const code = known.includes(result.error) ? result.error : 'windows_task_failed';
+    throw new Error(`Windows 后台任务检查失败（${code}${Number.isInteger(result.hresult) ? `，HRESULT ${result.hresult}` : ''}）。已保留任务和数据；可在安装向导中选择前台继续。请查看本用户 Device Center 数据目录中的 service.log / service-error.log。`);
+  }
+  return result;
 }

package/server/index.mjs

@@ -1,3 +1,4 @@
+import { installerCatalog, serveInstaller } from './installerPackages.mjs';
 import { createServer as createHttpServer } from 'node:http';
 import { readFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
@@ -14,7 +15,7 @@ import { createRemoteAgent, createRemoteClient } from './drivers/remote.mjs';
 
 const PROJECT_ROOT = resolve(fileURLToPath(new URL('..', import.meta.url)));
 const MIME_TYPES = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png' };
-const PUBLIC_GUIDES = Object.freeze({ '/install/agent.md': 'docs/agent-install.md', '/install/trial.md': 'docs/friend-trial.md', '/install/remote-access.md': 'docs/remote-access.md', '/install/device-profiles.md': 'docs/device-profiles.md', '/install/troubleshooting.md': 'docs/troubleshooting.md' });
+const PUBLIC_GUIDES = Object.freeze({ '/install/offline.md': 'docs/offline-install.md', '/install/agent.md': 'docs/agent-install.md', '/install/skill.md': 'docs/SKILL.md', '/install/cli.md': 'docs/cli.md', '/install/trial.md': 'docs/friend-trial.md', '/install/remote-access.md': 'docs/remote-access.md', '/install/device-profiles.md': 'docs/device-profiles.md', '/install/troubleshooting.md': 'docs/troubleshooting.md' });
 // Deployed archives carry release.json; npm and source installs report only the package version.
 function deployedVersion(releaseFile) {
   const version = JSON.parse(readFileSync(resolve(PROJECT_ROOT, 'package.json'), 'utf8')).version;
@@ -70,7 +71,7 @@ async function serveStatic(pathname, response) {
   } catch { sendJson(response, 404, { error: 'not_found' }); }
 }
 
-export function createDeviceCenterServer({ dbPath = './data/device-center.sqlite', web = true, runtime = 'native', sshHome, sshProbe, publicOrigin, authFile, authFetch, cloudLinkFile, driverFetch, driverBundlePath = resolve(PROJECT_ROOT, 'driver-source.tar.gz'), releaseFile = resolve(PROJECT_ROOT, 'release.json') } = {}) {
+export function createDeviceCenterServer({ dbPath = './data/device-center.sqlite', web = true, runtime = 'native', sshHome, sshProbe, publicOrigin, authFile, authFetch, cloudLinkFile, driverFetch, driverBundlePath = resolve(PROJECT_ROOT, 'driver-source.tar.gz'), releaseFile = resolve(PROJECT_ROOT, 'release.json'), installerDirectory = process.env.DEVICE_CENTER_INSTALLERS_DIR } = {}) {
   const cloudAccess = createCloudAccess({ publicOrigin, authFile, fetchImpl: authFetch });
   if (runtime === 'cloud' && !cloudAccess) throw new Error('cloud_authentication_required');
   const cloud = Boolean(cloudAccess);
@@ -95,15 +96,20 @@ export function createDeviceCenterServer({ dbPath = './data/device-center.sqlite
       const path = url.pathname;
       // Public liveness and deployed version only; no account, device or configuration data.
       if (path === '/api/health' && request.method === 'GET') return sendJson(response, 200, health);
-      if (['/pair', '/src/pair.js', '/src/pair.css', '/src/pairing-handoff.js', '/src/api.js'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
-      if (['/cli', '/src/cli-approval.js', '/src/cli-handoff.js'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
+      if (['/pair', '/src/pair.js', '/src/pair.css', '/src/pairing-handoff.js', '/src/pair-recovery.js', '/src/installed-cli.js', '/src/api.js'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
+      if (['/cli', '/src/cli-approval.js', '/src/cli-handoff.js', '/src/agent-setup.js'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
       // Public static installation reference only. No identity, configuration or owner API.
-      if (['/start', '/start.html', '/favicon.svg', '/src/start.js', '/src/start.css', '/src/onboarding.js', '/src/i18n.js', '/src/i18n.css', '/src/messages.js', '/src/install-prompt.js', '/src/install-walkthrough.js'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
+      if (['/start', '/start.html', '/favicon.svg', '/src/start.js', '/src/install-packages.js', '/src/start.css', '/src/onboarding.js', '/src/i18n.js', '/src/i18n.css', '/src/messages.js', '/src/install-prompt.js', '/src/install-walkthrough.js', '/src/install-walkthrough.css'].includes(path) && request.method === 'GET') return await serveStatic(path, response);
       if (Object.hasOwn(PUBLIC_GUIDES, path) && request.method === 'GET') {
         const body = await readFile(resolve(PROJECT_ROOT, PUBLIC_GUIDES[path]));
         response.writeHead(200, { 'content-type': 'text/markdown; charset=utf-8', 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'content-security-policy': "default-src 'none'; frame-ancestors 'none'", 'referrer-policy': 'no-referrer' });
         return response.end(body);
       }
+      if (path === '/install/packages' && request.method === 'GET') return sendJson(response, 200, { packages: await installerCatalog(installerDirectory) });
+      if (path.startsWith('/install/packages/') && request.method === 'GET') {
+        if (await serveInstaller(installerDirectory, path.slice('/install/packages/'.length), response)) return;
+        return sendJson(response, 404, { error: 'installer_unavailable' });
+      }
       let accountRegistry;
       if (cloud) {
         const machineActions = { '/api/driver/pair/start': 'start', '/api/driver/pair/poll': 'poll', '/api/driver/report': 'report', '/api/driver/disconnect': 'disconnect' };
@@ -152,7 +158,7 @@ export function createDeviceCenterServer({ dbPath = './data/device-center.sqlite
           if (request.headers.origin !== origin) return sendJson(response, 403, { error: 'same_origin_required' });
           return sendJson(response, 200, accountRegistry.cli[cliOwnerActions[path]](await readJson(request)));
         }
-        const ownerActions = { '/api/devices/profile': 'saveProfile', '/api/devices/collect': 'collect', '/api/drivers/pairing/lookup': 'lookup', '/api/drivers/pairing/approve': 'approve', '/api/drivers/revoke': 'revoke' };
+        const ownerActions = { '/api/devices/profile': 'saveProfile', '/api/devices/collect': 'collect', '/api/drivers/pairing/lookup': 'lookup', '/api/drivers/pairing/approve': 'approve', '/api/drivers/pairing/result': 'pairingResult', '/api/drivers/revoke': 'revoke' };
         if (Object.hasOwn(ownerActions, path) && request.method === 'POST') {
           if (request.headers.origin !== origin) return sendJson(response, 403, { error: 'same_origin_required' });
           return sendJson(response, 200, accountRegistry[ownerActions[path]](await readJson(request)));

package/server/installerPackages.mjs

@@ -0,0 +1,45 @@
+import { promises as fs, constants } from 'node:fs';
+import { resolve, basename, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { pipeline } from 'node:stream/promises';
+
+const ID = /^device-center-[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+-(win32|darwin|linux)-(x64|arm64)-[a-f0-9]{12}$/;
+const type = { win32: ['zip', 'application/zip'], darwin: ['dmg', 'application/x-apple-diskimage'], linux: ['sh', 'application/octet-stream'] };
+export async function installerCatalog(directory) {
+  if (!directory) return [];
+  const root = resolve(directory);
+  const info = await fs.lstat(root).catch(() => null);
+  if (!info) return [];
+  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error('invalid_installer_directory');
+  const packages = [];
+  for (const name of await fs.readdir(root)) {
+    if (!name.endsWith('.installer.json')) continue;
+    try {
+      if (!(await fs.lstat(join(root, name))).isFile()) continue;
+      const meta = JSON.parse(await fs.readFile(join(root, name), 'utf8'));
+      const match = ID.exec(meta.id);
+      if (meta.format !== 1 || !match || match[1] !== meta.platform || match[2] !== meta.arch || !type[meta.platform] || meta.filename !== `${meta.id}.${type[meta.platform][0]}` || name !== `${meta.filename}.installer.json` || basename(meta.filename) !== meta.filename || !/^[a-f0-9]{64}$/.test(meta.sha256 ?? '') || !Number.isSafeInteger(meta.bytes) || meta.bytes < 1 || !/^[a-f0-9]{40}$/.test(meta.sourceSha ?? '') || typeof meta.dirty !== 'boolean' || typeof meta.signed !== 'boolean' || typeof meta.notarized !== 'boolean') continue;
+      const file = await fs.lstat(join(root, meta.filename));
+      if (!file.isFile() || file.isSymbolicLink() || file.size !== meta.bytes) continue;
+      packages.push({ id: meta.id, filename: meta.filename, platform: meta.platform, arch: meta.arch, version: meta.version, bytes: meta.bytes, sha256: meta.sha256, sourceSha: meta.sourceSha, signed: meta.signed, notarized: meta.notarized, candidate: Boolean(meta.dirty || !meta.signed), url: `/install/packages/${meta.id}` });
+    } catch { /* Incomplete or invalid assets are never advertised as downloadable installers. */ }
+  }
+  return packages.sort((a, b) => a.filename.localeCompare(b.filename, 'en'));
+}
+export async function serveInstaller(directory, id, response) {
+  const meta = ID.test(id) ? (await installerCatalog(directory)).find(item => item.id === id) : null;
+  if (!meta) return false;
+  const file = join(resolve(directory), meta.filename);
+  // Pin the same regular file across verification and streaming, even if an archive is replaced.
+  const handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const info = await handle.stat();
+    if (!info.isFile() || info.size !== meta.bytes) throw Object.assign(new Error('installer_integrity_failed'), { statusCode: 503 });
+    const digest = createHash('sha256');
+    for await (const bytes of handle.createReadStream({ start: 0, autoClose: false })) digest.update(bytes);
+    if (digest.digest('hex') !== meta.sha256) throw Object.assign(new Error('installer_integrity_failed'), { statusCode: 503 });
+    response.writeHead(200, { 'content-type': type[meta.platform][1], 'content-length': meta.bytes, 'content-disposition': `attachment; filename="${meta.filename}"`, 'cache-control': 'no-store', 'x-content-type-options': 'nosniff', 'content-security-policy': "default-src 'none'; frame-ancestors 'none'", 'referrer-policy': 'no-referrer' });
+    await pipeline(handle.createReadStream({ start: 0, autoClose: false }), response);
+  } finally { await handle.close(); }
+  return true;
+}

package/server/unifiedAccess.mjs

@@ -120,7 +120,7 @@ export function createUnifiedAccess({ config, publicOrigin, now = Date.now, fetc
     legacyOwnerMapped: accountMode === 'personal' || config.legacyOwnerId !== undefined,
     resolvePrincipal,
     options(request) {
-      return { provider: 'app-services', accountMode, accountLoginUrl: `${account.origin}/?login=1&loginNext=%2Fdashboard`, automaticContinue: readCookie(request, SIGNED_OUT) !== '1' };
+      return { provider: 'app-services', accountMode, accountLoginUrl: `${account.origin}/auth/connect?${new URLSearchParams({ product: 'device-center', parentOrigin: publicOrigin })}`, automaticContinue: readCookie(request, SIGNED_OUT) !== '1' };
     },
     async authenticated(request) {
       return Boolean(await resolvePrincipal(request));

package/src/agent-setup.js

@@ -0,0 +1,49 @@
+import { agentInstallPlan, terminalInstallScript, OFFICIAL_CONTROL_ORIGIN } from './onboarding.js';
+import { translate, getLocale, h } from './i18n.js';
+import { installedCliCommand } from './installed-cli.js';
+
+// Public instructions only. No installation, authentication or credential generation here.
+export function agentSetupPrompt({ role = 'manager', locale = 'zh-CN', ...options } = {}) {
+  if (!['manager', 'device'].includes(role)) throw new Error('invalid_agent_role');
+  const plan = agentInstallPlan(options);
+  return translate(locale, 'agent.setup.prompt', {
+    skill: `${plan.controlOrigin ?? OFFICIAL_CONTROL_ORIGIN}/install/skill.md`,
+    role: translate(locale, `agent.setup.${role}`),
+    mode: translate(locale, plan.mode === 'local' ? 'guide.local' : plan.mode === 'official' ? 'guide.hosted' : 'guide.custom'),
+    origin: plan.controlOrigin ?? translate(locale, 'guide.local'),
+    os: plan.os === 'windows' ? 'Windows 11 / PowerShell' : 'macOS / Linux',
+    version: plan.version, port: new URL(plan.url).port,
+    run: translate(locale, plan.background ? 'prompt.background' : 'prompt.foreground'),
+  });
+}
+
+export function managerSetupPlan({ origin, os = 'posix', locale = 'zh-CN' } = {}) {
+  const options = { mode: origin === OFFICIAL_CONTROL_ORIGIN ? 'official' : 'self-hosted', ...(origin === OFFICIAL_CONTROL_ORIGIN ? {} : { origin }), os, background: true };
+  const plan = agentInstallPlan(options);
+  const authorization = installedCliCommand('auth login --minutes 60 --confirm', os);
+  const verify = installedCliCommand('devices list --cloud --json', os);
+  const install = terminalInstallScript(options);
+  // Keep the original installer's stop-on-existing-install and error semantics.
+  const script = os === 'windows'
+    ? `& {\n$ErrorActionPreference = 'Stop'\n${install}\n${authorization}\nif ($LASTEXITCODE -ne 0) { throw 'CLI authorization failed. Keep the existing installation and binding.' }\n${verify}\nif ($LASTEXITCODE -ne 0) { throw 'Cloud verification failed. Inspect auth status; do not rebind.' }\n}`
+    : `(\nset -eu\n${install}\n${authorization}\n${verify}\n)`;
+  return { prompt: agentSetupPrompt({ ...options, role: 'manager', locale }), script, authorization, verify, skillUrl: `${plan.controlOrigin}/install/skill.md` };
+}
+
+const escape = value => String(value).replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
+const flowIcon = type => `<svg viewBox="0 0 32 24" aria-hidden="true">${type === 'browser' ? '<rect x="2" y="2" width="28" height="20" rx="2"/><path d="M2 7h28m-19 7 4 4 7-8"/>' : type === 'devices' ? '<rect x="2" y="2" width="19" height="13" rx="2"/><path d="M5 20h13m-7-5v5"/><rect x="24" y="9" width="6" height="13" rx="1"/>' : '<rect x="2" y="2" width="28" height="20" rx="2"/><path d="m7 8 5 4-5 4m9 0h8"/>'}</svg>`;
+
+export function managerSetupMarkup({ origin, os = 'posix', method = 'agent', copied = false } = {}) {
+  if (!['agent', 'manual'].includes(method)) throw new Error('invalid_setup_method');
+  const plan = managerSetupPlan({ origin, os, locale: getLocale() }), manual = method === 'manual';
+  return `<section class="cli-setup" aria-labelledby="cli-setup-title"><h2 id="cli-setup-title">${h('cli.setup.start')}</h2><p>${h('cli.setup.body')}</p>
+    <div class="cli-setup-destination"><span>${h('cli.setup.destination')}</span><strong>${escape(origin)}</strong></div>
+    <div class="cli-setup-choices" role="group" aria-label="${h('guide.method.title')}">${[['agent','guide.method.agent'],['manual','guide.method.manual']].map(([value,key]) => `<button type="button" data-setup-method="${value}" aria-pressed="${method === value}">${h(key)}</button>`).join('')}</div>
+    <label class="cli-setup-os" for="cli-setup-os">${h('guide.os.title')}<select id="cli-setup-os"><option value="posix" ${os === 'posix' ? 'selected' : ''}>macOS / Linux</option><option value="windows" ${os === 'windows' ? 'selected' : ''}>Windows 11</option></select></label>
+    <button type="button" data-setup-copy="cli-setup-text">${h(manual ? 'guide.manual.copy' : 'cli.setup.copyAgent')}</button><p class="cli-setup-copy-status" role="status">${copied ? h(manual ? 'cli.setup.copiedManual' : 'cli.setup.copiedAgent') : ''}</p>
+    ${manual ? `<p>${h(os === 'windows' ? 'guide.windowsPrerequisites' : 'guide.manual.prerequisites')}</p>` : ''}<details class="cli-setup-preview"><summary>${h(manual ? 'guide.manual.preview' : 'guide.preview')}</summary><textarea id="cli-setup-text" readonly rows="${manual ? 8 : 5}" aria-label="${h(manual ? 'guide.manual.scriptLabel' : 'guide.instructions')}" spellcheck="false">${escape(manual ? plan.script : plan.prompt)}</textarea></details>
+    <ol class="cli-setup-flow"><li>${flowIcon('terminal')}<strong>01 · ${h(manual ? 'cli.setup.terminal' : 'cli.setup.agent')}</strong><span>${h(manual ? 'cli.setup.terminalBody' : 'cli.setup.agentBody')}</span></li><li>${flowIcon('browser')}<strong>02 · ${h('cli.setup.approval')}</strong><span>${h('cli.setup.approvalBody')}</span></li><li>${flowIcon('devices')}<strong>03 · ${h('cli.setup.ready')}</strong><span>${h(manual ? 'walk.cloudCheckBody' : 'cli.setup.readyBody')}</span></li></ol>
+    <p class="cli-setup-scope">${h('cli.setup.scope')}</p>
+    <details class="cli-setup-existing"><summary>${h('cli.setup.existing')}</summary><p>${h('cli.setup.existingBody')}</p><textarea id="cli-existing-auth" readonly rows="3" aria-label="${h('cli.setup.existing')}" spellcheck="false">${escape(plan.authorization)}</textarea><button type="button" class="secondary" data-setup-copy="cli-existing-auth">${h('cli.setup.copyAuth')}</button></details>
+    <div class="cli-setup-links"><a href="${escape(plan.skillUrl)}">${h('cli.setup.skill')} ↗</a><a href="/install/cli.md">${h('cli.setup.manual')} ↗</a></div></section>`;
+}

package/src/api.js

@@ -4,11 +4,12 @@ async function request(path, { timeoutMs = 12000, ...options } = {}) {
   const response = await fetch(path, { ...options, cache: 'no-store', signal: AbortSignal.timeout(timeoutMs) });
   const payload = await response.json().catch(() => ({}));
   if (response.status === 401) { location.replace('/login?lang=' + getLocale()); throw new Error('authentication_required'); }
-  if (!response.ok) throw new Error(payload.error ?? `http_${response.status}`);
+  if (!response.ok) throw Object.assign(new Error(payload.error ?? `http_${response.status}`), { statusCode: response.status });
   clearLoginNavigation();
   return payload;
 }
 export const api = {
+  browserPairingResult: browserTicket => request('/api/drivers/pairing/result', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ browserTicket }) }),
   lookupBrowserPairing: browserTicket => request('/api/drivers/pairing/lookup', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ browserTicket }) }),
   approveBrowserPairing: input => request('/api/drivers/pairing/approve', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(input) }),
   saveDeviceProfile: (profile) => request('/api/devices/profile', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(profile) }),

package/src/cli-approval.js

@@ -1,7 +1,9 @@
 import { captureCli, clearCli } from './cli-handoff.js';
-import { initLanguage, getLocale, h } from './i18n.js';
+import { initLanguage, getLocale, h, t } from './i18n.js';
+import { managerSetupMarkup } from './agent-setup.js';
 const escape = value => String(value).replace(/[&<>"']/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
 let handoff = captureCli(), request, phase = handoff ? 'loading' : 'missing', timer;
+let setupOrigin, setup = { os: 'posix', method: 'agent', copied: false }, copyGeneration = 0;
 document.querySelector('link[href="/src/login.css"]').href = '/src/pair.css';
 document.body.innerHTML = `<header><a class="brand" href="/start" data-language-link><img src="/favicon.svg" alt="" width="26" height="26">Device Center</a><div class="language-picker" data-language-picker></div></header><main id="cli-root" aria-live="polite"></main><footer data-i18n="cli.boundary"></footer>`;
 document.querySelector('title').dataset.i18n = 'cli.title';
@@ -14,15 +16,37 @@ async function api(path, input) {
   return response.json();
 }
 function render() {
+  const titleKey = phase === 'manage' ? 'cli.setup.title' : 'cli.title';
+  document.querySelector('title').dataset.i18n = titleKey;
+  document.title = t(titleKey);
+  root.classList.toggle('cli-management', phase === 'manage');
   root.setAttribute('aria-busy', String(phase === 'loading' || phase === 'saving'));
   let body = '';
   if (phase === 'ready') body = `<p>${h('cli.intro')}</p><div class="device"><strong>${escape(request.name)}</strong><p>${escape(request.platform)} · ${h('cli.duration', { minutes: request.minutes })}</p></div><p>${h('pair.fingerprint')}</p><code class="fingerprint">${escape(request.fingerprint)}</code><ul><li>${h('cli.read')}</li><li>${h('cli.profile')}</li><li>${h('cli.collect')}</li></ul><p>${h('cli.boundary')}</p><button id="approve">${h('cli.approve')}</button><button id="deny" class="secondary">${h('pair.cancel')}</button>`;
   else if (phase === 'done') body = `<div class="status-mark" aria-hidden="true">✓</div><p>${h('cli.done')}</p><p>${h('pair.noReply')}</p><a class="primary" href="/cli?lang=${getLocale()}">${h('cli.manage')}</a>`;
-  else if (phase === 'manage') body = `<p>${h('cli.manageBody')}</p>${request.grants.map(grant => `<div class="device"><strong>${escape(grant.name)}</strong><p>${escape(new Date(grant.expiresAt).toLocaleString(getLocale()))} · ${h(grant.authorized ? 'cli.active' : 'cli.inactive')}</p><code class="fingerprint">${escape(grant.fingerprint)}</code>${grant.authorized ? `<button data-revoke="${escape(grant.driverId)}" class="secondary">${h('cli.revoke')}</button>` : ''}</div>`).join('') || `<p>${h('cli.empty')}</p>`}`;
+  else if (phase === 'manage') body = `${managerSetupMarkup({ origin: setupOrigin, ...setup })}<details class="cli-grants"><summary>${h('cli.manage')}</summary><p>${h('cli.manageBody')}</p>${request.grants.map(grant => `<div class="device"><strong>${escape(grant.name)}</strong><p>${escape(new Date(grant.expiresAt).toLocaleString(getLocale()))} · ${h(grant.authorized ? 'cli.active' : 'cli.inactive')}</p><code class="fingerprint">${escape(grant.fingerprint)}</code>${grant.authorized ? `<button data-revoke="${escape(grant.driverId)}" class="secondary">${h('cli.revoke')}</button>` : ''}</div>`).join('') || `<p>${h('cli.empty')}</p>`}</details>`;
   else body = `<p>${h(['loading', 'saving'].includes(phase) ? 'pair.wait' : phase === 'cancelled' ? 'pair.cancelledBody' : 'cli.missing')}</p>`;
-  root.innerHTML = `<p class="eyebrow">DEVICE CENTER / CLI</p><h1>${h(phase === 'manage' ? 'cli.manage' : 'cli.title')}</h1>${body}<p><a href="/?lang=${getLocale()}">${h('pair.dashboard')}</a></p>`;
+  root.innerHTML = `<p class="eyebrow">DEVICE CENTER / CLI</p><h1>${h(phase === 'manage' ? 'cli.setup.title' : 'cli.title')}</h1>${body}<p><a href="/?lang=${getLocale()}">${h('pair.dashboard')}</a></p>`;
 }
 root.addEventListener('click', async event => {
+  const button = event.target.closest('button');
+  if (phase === 'manage' && ['agent','manual'].includes(button?.dataset.setupMethod)) {
+    copyGeneration++; setup.method = button.dataset.setupMethod; setup.copied = false; render(); return;
+  }
+  if (phase === 'manage' && ['cli-setup-text','cli-existing-auth'].includes(button?.dataset.setupCopy)) {
+    const field = document.getElementById(button.dataset.setupCopy), generation = ++copyGeneration;
+    let copied = false;
+    try { if (navigator.clipboard?.writeText) { await navigator.clipboard.writeText(field.value); copied = true; } } catch { /* retain manual copy */ }
+    if (generation !== copyGeneration || phase !== 'manage') return;
+    if (!copied) {
+      field.closest('details')?.setAttribute('open',''); field.focus(); field.select();
+      try { copied = document.execCommand('copy'); } catch { /* selection remains available */ }
+    }
+    if (button.dataset.setupCopy === 'cli-existing-auth' || !copied) {
+      root.querySelector('.cli-setup-copy-status').textContent = t(copied ? 'panel.492' : 'panel.229');
+    } else { setup.copied = true; render(); }
+    return;
+  }
   const action = event.target.id, revoke = event.target.dataset.revoke;
   if (revoke && phase === 'manage') {
     phase = 'saving'; render();
@@ -38,12 +62,20 @@ root.addEventListener('click', async event => {
   } catch (error) { if (error.message === 'authentication_required') return; phase = 'missing'; }
   clearTimeout(timer); clearCli(); handoff = null; render();
 });
-initLanguage({ onChange: render }); render();
+root.addEventListener('change', event => {
+  if (event.target.id === 'cli-setup-os' && ['posix','windows'].includes(event.target.value)) {
+    copyGeneration++; setup.os = event.target.value; setup.copied = false; render();
+  }
+});
+initLanguage({ onChange: () => { copyGeneration++; setup.copied = false; render(); } }); render();
 try {
   if (handoff) {
     request = await api('/api/cli/lookup', { ticket: handoff.ticket }); phase = 'ready';
     timer = setTimeout(() => { if (phase === 'ready') { clearCli(); handoff = null; phase = 'missing'; render(); } }, Math.max(0, request.expiresAt - Date.now()));
-  } else { request = await api('/api/cli/grants'); phase = 'manage'; }
+  } else {
+    const [grants, overview] = await Promise.all([api('/api/cli/grants'), api('/api/overview')]);
+    request = grants; setupOrigin = overview.controlOrigin; phase = 'manage';
+  }
   render();
 } catch (error) { if (error.message !== 'authentication_required') { clearCli(); handoff = null; phase = 'missing'; render(); } }
 window.addEventListener('pagehide', () => clearTimeout(timer));

package/src/install-packages.js

@@ -0,0 +1,34 @@
+import { t } from './i18n.js';
+
+const platforms = { windows: 'win32', macos: 'darwin', linux: 'linux' };
+export function architectureChoices(os) {
+  const choices = { windows: [['x64', 'x64 (Intel / AMD)'], ['arm64', 'ARM64 (Windows on ARM)']], macos: [['arm64', 'Apple Silicon (ARM64)'], ['x64', 'Intel (x64)']], linux: [['x64', 'x86_64 (Intel / AMD)'], ['arm64', 'ARM64 (aarch64)']] };
+  if (!choices[os]) throw new Error('invalid_install_os');
+  return choices[os];
+}
+export function matchingPackages(packages, os, arch) {
+  return packages.filter(p => p.platform === platforms[os] && p.arch === arch &&
+    /^device-center-[\w.-]+$/.test(p.id ?? '') && p.url === `/install/packages/${p.id}` &&
+    /^device-center-[\w.-]+\.(zip|dmg|sh)$/.test(p.filename ?? '') && /^[a-f0-9]{64}$/.test(p.sha256 ?? ''));
+}
+export function renderPackageChoices(container, { packages, os, arch, loading = false, failed = false }) {
+  container.replaceChildren();
+  if (loading || failed || !matchingPackages(packages, os, arch).length) {
+    const p = document.createElement('p'); p.className = 'hint';
+    p.textContent = t(loading ? 'guide.package.loading' : failed ? 'guide.package.error' : 'guide.package.unavailable');
+    container.append(p); return;
+  }
+  for (const item of matchingPackages(packages, os, arch)) {
+    const card = document.createElement('div'); card.className = 'package-download';
+    const link = document.createElement('a'); link.className = 'primary'; link.href = item.url; link.download = item.filename;
+    link.textContent = t('guide.package.download', { format: item.filename.split('.').at(-1).toUpperCase(), arch: item.arch });
+    const name = document.createElement('p'); name.className = 'hint'; name.textContent = `${item.filename} · ${(item.bytes / 1048576).toFixed(1)} MiB`;
+    const digest = document.createElement('code'); digest.className = 'package-digest'; digest.textContent = `SHA-256: ${item.sha256}`;
+    card.append(link, name, digest);
+    const launch = document.createElement('p'); launch.className = 'hint';
+    launch.textContent = t(item.platform === 'darwin' && item.signed && item.notarized ? 'guide.package.macosApp' : item.platform === 'darwin' ? 'guide.package.macos' : item.platform === 'win32' ? 'guide.package.windows' : 'guide.package.linux');
+    card.append(launch);
+    if (item.candidate) { const notice = document.createElement('p'); notice.className = 'hint'; notice.textContent = t(item.platform === 'darwin' ? 'guide.package.candidate' : 'guide.package.unsigned'); card.append(notice); }
+    container.append(card);
+  }
+}