dsh-deeppilot 0.9.8 → 0.9.9

package/README.md

@@ -125,10 +125,30 @@ system-reported name; saving an empty value restores the iPhone-reported
 default.
 
 The settings page's **Testing & troubleshooting** group has a `debug` toggle.
-Turning it on prints handshake and push diagnostics to the DSH host's terminal
+Turning it on prints per-frame and push diagnostics to the DSH host's terminal
 output (for example, the actual capability bits sent in `s2c.welcome`); it
-never prints pairing tokens, APNs tokens, or message content, and takes effect
-immediately without restarting DSH.
+never prints pairing tokens, APNs tokens, or message content. The toggle is
+snapshotted per connection, so an already-open connection only picks up the new
+value after it reconnects.
+
+**Connection failures do not need that toggle.** The plugin always records
+admission rejections, authentication failures (4401 distinguishes an unknown
+device, a revoked device, a bad signature, an expired challenge and clock skew),
+TLS handshake failures and pairing failures. They show up in the terminal as
+`[deeppilot] <time> WARN <event> <reason> src=<source hash> attempt=<attempt ID>`
+and are appended under `diagnostics/` in the plugin data directory (7 days,
+5 MB cap). The settings page's **Connection diagnostics** group lists the most
+recent failures with a copy button, and `/phone/health` additionally returns the
+local transport phase and port, the data-plane phase, whether the TLS identity
+was rebuilt, the start time and the last failure, so the phone can locate the
+cause even while it cannot connect. Records contain only source hashes — never
+raw IPs, pairing codes, keys, APNs tokens or message content.
+
+Each connection attempt from the phone carries a random `attemptId` (the `?at=`
+query parameter on the WebSocket upgrade, or the `X-DeepPilot-Attempt` header on
+pairing and health checks). The plugin writes it into the log lines and
+diagnostic events above, so a user reporting that ID lets you find the exact
+attempt in the host log.
 
 Offline push is optional. Relay mode sends only the target APNs device token
 and a limited notification payload; full conversation history and live output

package/README.zh-CN.md

@@ -108,8 +108,21 @@ DeepPilot 设置页提供“每个公网来源的连接上限”，默认 `8`，
 也不会被覆盖。留空保存可恢复 iPhone 上报的默认名称。
 
 设置页的“测试与故障排查”分组下有一个 `debug` 开关，打开后会在 DSH host 的
-终端输出里打印握手、推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
-不会打印配对令牌、APNs token 或消息内容；改这个开关立即生效，不需要重启 DSH。
+终端输出里打印逐帧与推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
+不会打印配对令牌、APNs token 或消息内容。该开关按连接快照，已建立的连接需要
+重连一次才按新值工作。
+
+**连不上时不需要打开这个开关**：插件会无条件记录准入拒绝、认证失败（4401 会区分
+设备不存在、已撤销、签名错、挑战过期、时钟偏差等原因）、TLS 握手失败与配对失败，
+在终端输出为 `[deeppilot] <时间> WARN <事件> <原因> src=<来源哈希> attempt=<尝试 ID>`，
+并落盘到插件数据目录的 `diagnostics/`（保留 7 天、上限 5 MB）。设置页“连接诊断”
+分组可查看最近失败并一键复制；`/phone/health` 额外返回本地传输相位与端口、数据面
+相位、是否重建过 TLS 身份、启动时间与最近一次失败，手机端在连不上时也能据此定位。
+记录只含来源哈希，不含原始 IP、配对码、密钥、APNs token 或消息内容。
+
+手机端每次连接尝试会带一个随机的 `attemptId`（WebSocket 升级的 `?at=` 查询参数，
+或配对/健康检查的 `X-DeepPilot-Attempt` 请求头）。插件把它写进上面的日志与诊断
+事件；用户反馈时报告这个 ID，就能在主机日志里定位到同一次尝试。
 
 离线推送是可选功能。中继模式只发送目标 APNs 设备 Token 和有限的通知内容；
 完整会话历史与实时输出不会经过中继。启用远程访问或推送前，请阅读

package/bin/SHA256SUMS

@@ -1,6 +1,6 @@
-c70401fd9530f2fae6abe7aec5eacacca239ba315cedc7197db530df8c6f97bd  ./darwin-amd64/dsh-deeppilot-tunnel
-45ff6b53d3e27fe6242e4904055d647d8b220a5c56ca76e542ffcd861ad3bbad  ./darwin-arm64/dsh-deeppilot-tunnel
-8d4937de90564327dcf8392dba6241e4facc30044a48447b22de99f3e62c9808  ./linux-amd64/dsh-deeppilot-tunnel
-cd4638f9aa3e60340d4f446301b2b6f6452f5cb89fc012884e5a893ab8dbd577  ./linux-arm64/dsh-deeppilot-tunnel
-d5435d4e0c02056b3fac39a5f289acb404e6f060dc566e5dea724ee2b86a4296  ./windows-amd64/dsh-deeppilot-tunnel.exe
-7d79c848b2b74286764bd284005edbcfdf539be90ce0b160ea464ae3af70e005  ./windows-arm64/dsh-deeppilot-tunnel.exe
+4e83f82d5c623115d121f58264ca84706e5fc935dadc0747b37ae886d102dc6a  ./darwin-amd64/dsh-deeppilot-tunnel
+7707999a5b745d11afeb4ab1868c85680e4ff5567202d97015d72d810817a134  ./darwin-arm64/dsh-deeppilot-tunnel
+8a83351568cb223854efbe8f54ca9a403fc2b152382d4e7c952d372b0b0cb3e9  ./linux-amd64/dsh-deeppilot-tunnel
+dfa4eb4dd50b386aadf40d9767ac0df8151308b620fa395d0a560498f01eb0cb  ./linux-arm64/dsh-deeppilot-tunnel
+9c734ea42bc6dd5763930991db52f910d5138e9b12df0e826d6964ceb271e215  ./windows-amd64/dsh-deeppilot-tunnel.exe
+e7db4a0e62f04266d97a5bad38e1a21961474440e7231fd5b24980053589faa0  ./windows-arm64/dsh-deeppilot-tunnel.exe

package/docs/DSH_RELEASE_MEMORY.md

@@ -87,12 +87,34 @@
   `0.2.0-rc.2` this branch builds and typechecks against.
 - **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state, and
   device records are untouched by this release; no phone needs to re-pair.
-- **Audit limits, stated rather than implied.** The positive half of the rc.2
-  verification — loading this plugin on a real isolated `0.2.1-rc.2` host after the
-  widening — had **not** been completed when this entry was written, and neither had
-  the full release check set against that host. Until they run, rc.2 is recorded as
-  audited at the artifact-diff and declaration level only; no plugin release has
-  been made from this tree.
+- **The limits this entry originally stated are now closed.** The positive half of
+  the rc.2 verification ran before publication: on an isolated `0.2.1-rc.2` host
+  carrying the widened declaration, `--dump-config` wrote nothing to stderr, the
+  composed tree contained `# == dsh-deeppilot` (line 1233) together with
+  `# == @deepseek-ai/dsh-web-app, patched by dsh-deeppilot` (line 449), the running
+  host logged four `[deeppilot]` lines, and the plugin's own LAN listener on port
+  3098 answered `/phone/health` with `200` and `serverVersion` `0.9.8`. A tamper
+  control removed the `0.2.1-rc.2` token from a copy of `engines.dsh`: the host
+  refused again with the single `engines.dsh` requirement (`exempted: false`) and
+  accepted it once restored. Independent verification of the whole release tree —
+  `npm ci`, 581 tests (580 pass, 0 fail, 1 pre-existing TODO), typecheck, build
+  with a byte-identical regenerated `lib/`, `check:config-schema`, the Go helper
+  tests, and all six `bin/SHA256SUMS` entries — is recorded in
+  `.rc2-verify/VERIFICATION.md`; that pass also caught a real defect, a version
+  bump that had left `tests/apply-baseline.snapshot.json` stale.
+- **Published as 0.9.8 on 2026-10-18.** The annotated tag `v0.9.8` dereferences to
+  `f4551b61602e5e60b11565ae31ccba3257d3dc9e` on `main`, CI and CodeQL were green on
+  that commit, and `publish.yml` ran on the tag (run `39048037503`, 24/24 steps).
+  The registry records `latest: 0.9.8`, published `2026-10-17T16:12:59.699Z`, with a
+  `https://slsa.dev/provenance/v1` attestation naming that commit as its source. The
+  published tarball's SHA1 `8288977711e04679d077b970f863e726631fc309` and its SHA512
+  match the registry, its 68 entries and 130,945,335 unpacked bytes match the
+  pre-publication pack, and every packaged file compared byte-identically with the
+  verified tree. A clean isolated profile then installed `dsh-deeppilot@0.9.8` from
+  npm, composed it on a real `0.2.1-rc.2` host, and answered `/phone/health` with
+  `200` and `serverVersion: "0.9.8"`; the GitHub Release was made public only after
+  that install verification. The same release shipped the mobile skills, host
+  commands, and catalog-cache work recorded below.
 
 ### Previous decision — `dsh-v0.2.1-alpha.5`
 
@@ -1756,7 +1778,7 @@ release notes.
 
 ## 2026-10-15 — 移动端技能发现扩展
 
-新增可选的 `skills` 手机能力，使用官方 `sessionSkillCatalog.list({sessionId}, AbortSignal)` 服务，已对照本机 `0.2.0-rc.2` 和 `0.2.1-alpha.3` 发行声明。缺少服务只关闭该特性，晚挂载服务会重新探测，不缓存缺席。未修改宿主版本范围、鉴权、包版本或命令派发契约。手机只接收元数据，技能注册表和会话预设、工作目录变化触发目录失效。完整文档清单与四类差异表见《技能提示对接说明》。此源码改动尚未发布，真实主机与真机技能加载仍未验收。
+新增可选的 `skills` 手机能力，使用官方 `sessionSkillCatalog.list({sessionId}, AbortSignal)` 服务，已对照本机 `0.2.0-rc.2` 和 `0.2.1-alpha.3` 发行声明。缺少服务只关闭该特性，晚挂载服务会重新探测，不缓存缺席。未修改宿主版本范围、鉴权、包版本或命令派发契约。手机只接收元数据，技能注册表和会话预设、工作目录变化触发目录失效。完整文档清单与四类差异表见《技能提示对接说明》。此源码改动随 0.9.8（2026-10-18）发布；主机侧集成已在本机隔离真实宿主上验收，真机技能加载仍未验收。
 
 ## 2026-10-16 — 移动端系统指令扩展
 
@@ -1770,4 +1792,4 @@ release notes.
 1. 安装与主机 API：本轮不改安装范围或依赖；读取沿用现有技能、命令和模型接口。工作区另有 alpha.4 兼容改动，命令对接已重新枚举该版 29 包、144 个接口，相关主机实现与 alpha.3 相同；不据此宣称真实业务验收。
 2. 手机协议：模型当前选择投影新增 `s2c.models.changed`，受 `sessions.read` 控制；原生权限执行可附加 `expectedDefinitionId`，重读目录核对来源，旧客户端字段缺省兼容。无新增周期轮询或第二层主机时间缓存。
 3. 客户端：内存五分钟、磁盘最长七天，重启旧目录先展示并校验，按配对身份/主机/会话隔离；当前模型、权限和执行结果不落盘。具体约定和格式重建见[移动端目录缓存](移动端目录缓存.md)。
-4. 验证：插件 577 项通过、1 项原有待办，类型检查、生成产物构建和使用本机固定版本的离线配置校验通过；两端缓存单元与模拟器证据见各自文档。未发布。
+4. 验证：插件 577 项通过、1 项原有待办，类型检查、生成产物构建和使用本机固定版本的离线配置校验通过；两端缓存单元与模拟器证据见各自文档。随 0.9.8（2026-10-18）发布；真机与系统分享仍未验收。

package/docs/NPM_PUBLISHING.md

@@ -105,6 +105,17 @@
    本轮还确认了一个易漏点：升版本号必须同步重录
    `tests/apply-baseline.snapshot.json`，否则 `npm test` 会失败——已写入
    `AGENTS.md` 的发布流程第 1 步。
+8. `0.9.8` 的实际发布结果（2026-10-18）：附注标签 `v0.9.8` 指向
+   `f4551b61602e5e60b11565ae31ccba3257d3dc9e`，该提交的 CI 与 CodeQL 均为绿；
+   `publish.yml` 在该标签上运行（运行号 `39048037503`，24 个步骤全部成功），
+   注册表 `latest` 为 `0.9.8`。逐项核验：来源证明类型为
+   `https://slsa.dev/provenance/v1`，其 `gitCommit` 正是该提交；压缩包 SHA1
+   `8288977711e04679d077b970f863e726631fc309` 与 SHA512 与注册表一致；注册表
+   条目数 68、解包 130,945,335 字节与发布前的打包核对一致，包内逐个文件与已验证
+   的工作树逐字节相同。随后在全新隔离 profile 中从 npm 安装
+   `dsh-deeppilot@0.9.8`，在真实 `0.2.1-rc.2` 宿主上完成组合与启动，插件自有端口
+   3098 的 `/phone/health` 返回 200 且 `serverVersion` 为 `0.9.8`；GitHub Release
+   在这一步通过后才公开并标记 Latest。
 
 ## 五、官方资料
 

package/lib/client.js

@@ -245,6 +245,40 @@ window.__ModuleLoader__.load({
 				results
 			};
 		}
+		function parseDiagnosticFailure(value) {
+			const s = rec(value, "diagnostics.recentFailures[]");
+			const kind = str(s, "kind", "diagnostics.kind");
+			if (!/^[a-z][a-z0-9-]{0,47}$/.test(kind)) reject("diagnostics.kind");
+			const reason = str(s, "reason", "diagnostics.reason");
+			if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(reason)) reject("diagnostics.reason");
+			const attemptId = s.attemptId;
+			if (attemptId !== void 0 && (typeof attemptId !== "string" || !/^[A-Za-z0-9_-]{1,16}$/.test(attemptId))) reject("diagnostics.attemptId");
+			const source = s.source;
+			if (source !== void 0 && (typeof source !== "string" || !/^[0-9a-f]{8,64}$/.test(source))) reject("diagnostics.source");
+			const closeCode = s.closeCode;
+			if (closeCode !== void 0 && (typeof closeCode !== "number" || !Number.isInteger(closeCode))) reject("diagnostics.closeCode");
+			const durationMs = s.durationMs;
+			if (durationMs !== void 0 && (typeof durationMs !== "number" || !Number.isFinite(durationMs) || durationMs < 0)) reject("diagnostics.durationMs");
+			return {
+				ts: int(s, "ts", "diagnostics.ts"),
+				kind,
+				reason,
+				...typeof attemptId === "string" ? { attemptId } : {},
+				...typeof source === "string" ? { source } : {},
+				...typeof closeCode === "number" ? { closeCode } : {},
+				...typeof durationMs === "number" ? { durationMs: Math.round(durationMs) } : {}
+			};
+		}
+		function parseDiagnostics(value) {
+			const s = rec(value, "diagnostics");
+			const failures = s.recentFailures;
+			if (!Array.isArray(failures)) reject("diagnostics.recentFailures");
+			if (failures.length > 20) reject("diagnostics.recentFailures");
+			return {
+				startedAt: int(s, "startedAt", "diagnostics.startedAt"),
+				recentFailures: failures.map(parseDiagnosticFailure)
+			};
+		}
 		function parseReport(value) {
 			const s = rec(value, "report");
 			const devices = s.devices;
@@ -266,7 +300,8 @@ window.__ModuleLoader__.load({
 				lanAddresses,
 				local: parseLocal(s.local),
 				remote: parseRemote(s.remote),
-				devices: devices.map(parseDevice)
+				devices: devices.map(parseDevice),
+				...s.diagnostics !== void 0 ? { diagnostics: parseDiagnostics(s.diagnostics) } : {}
 			};
 		}
 		const reportSchema = { parse: parseReport };
@@ -458,6 +493,31 @@ window.__ModuleLoader__.load({
 				"troubleshooting.description": "仅在排查连接或推送问题时使用。",
 				"troubleshooting.debugTitle": "调试日志",
 				"troubleshooting.debugDescription": "打开后在 DSH host 的终端输出里打印握手、推送等诊断信息；不会打印配对令牌、APNs token 或消息内容。改动立即生效，无需重启。",
+				"diagnostics.title": "连接诊断",
+				"diagnostics.description": "最近的连接失败事件；可一键复制后发给维护者排查。",
+				"diagnostics.recent": "最近失败",
+				"diagnostics.empty": "最近没有失败记录",
+				"diagnostics.staleHost": "宿主插件版本较旧，没有连接诊断数据，请更新 dsh-deeppilot。",
+				"diagnostics.copy": "复制诊断信息",
+				"diagnostics.copied": "诊断信息已复制",
+				"diagnostics.copyFailed": "复制诊断信息失败：",
+				"diagnostics.item": "{time} · {kind} · {reason}",
+				"diagnostics.attempt": "尝试 {id}",
+				"diagnostics.source": "来源 {label}",
+				"diagnostics.closeCode": "关闭码 {code}",
+				"diagnostics.duration": "耗时 {ms}ms",
+				"diagnostics.startedAt": "启动于 {time}",
+				"diagnostics.reportTitle": "DeepPilot 诊断信息",
+				"diagnostics.reportGeneratedAt": "生成时间",
+				"diagnostics.reportVersion": "插件版本",
+				"diagnostics.reportEnabled": "总开关",
+				"diagnostics.reportLocal": "局域网",
+				"diagnostics.reportRemote": "公网",
+				"diagnostics.reportConnections": "当前连接",
+				"diagnostics.reportFailureHeader": "最近失败",
+				"diagnostics.reportNone": "（无）",
+				"diagnostics.on": "已启用",
+				"diagnostics.off": "已关闭",
 				"system.summary": "系统信息",
 				"system.title": "运行信息",
 				"system.description": "插件、协议与连接端点的技术信息。",
@@ -676,6 +736,31 @@ window.__ModuleLoader__.load({
 				"troubleshooting.description": "Use these only when diagnosing connection or push issues.",
 				"troubleshooting.debugTitle": "Debug logging",
 				"troubleshooting.debugDescription": "When on, prints handshake and push diagnostics to the DSH host’s terminal output; never prints pairing tokens, APNs tokens, or message content. Takes effect immediately, no restart needed.",
+				"diagnostics.title": "Connection diagnostics",
+				"diagnostics.description": "Recent connection failures; copy them for troubleshooting.",
+				"diagnostics.recent": "Recent failures",
+				"diagnostics.empty": "No recent failures",
+				"diagnostics.staleHost": "This host is too old to report connection diagnostics. Update dsh-deeppilot.",
+				"diagnostics.copy": "Copy diagnostics",
+				"diagnostics.copied": "Diagnostics copied",
+				"diagnostics.copyFailed": "Copying diagnostics failed: ",
+				"diagnostics.item": "{time} · {kind} · {reason}",
+				"diagnostics.attempt": "attempt {id}",
+				"diagnostics.source": "source {label}",
+				"diagnostics.closeCode": "close code {code}",
+				"diagnostics.duration": "{ms}ms",
+				"diagnostics.startedAt": "Started {time}",
+				"diagnostics.reportTitle": "DeepPilot diagnostics",
+				"diagnostics.reportGeneratedAt": "Generated",
+				"diagnostics.reportVersion": "Plugin version",
+				"diagnostics.reportEnabled": "Master switch",
+				"diagnostics.reportLocal": "LAN",
+				"diagnostics.reportRemote": "Funnel",
+				"diagnostics.reportConnections": "Active connections",
+				"diagnostics.reportFailureHeader": "Recent failures",
+				"diagnostics.reportNone": "(none)",
+				"diagnostics.on": "enabled",
+				"diagnostics.off": "disabled",
 				"system.summary": "System information",
 				"system.title": "Runtime information",
 				"system.description": "Technical details about the plugin, protocol, and endpoints.",
@@ -3877,9 +3962,11 @@ window.__ModuleLoader__.load({
 			const remote = dotState(input.remoteDot);
 			const attention = local.attention || remote.attention;
 			const online = local.online || remote.online;
+			const hasSignal = (dot) => dot !== void 0 && dot !== "";
+			const anySignal = hasSignal(input.localDot) || hasSignal(input.remoteDot);
 			return {
-				kind: !input.switchReady ? "loading" : !input.enabled ? "off" : attention ? "attention" : online ? "ready" : "loading",
-				dot: !input.enabled ? "" : attention ? " pbb-dotBad" : online ? " pbb-dotOk" : " pbb-dotWarn"
+				kind: !input.switchReady ? "loading" : !input.enabled ? "off" : attention ? "attention" : online ? "ready" : anySignal ? "loading" : "off",
+				dot: !input.enabled || !attention && !online && !anySignal ? "" : attention ? " pbb-dotBad" : online ? " pbb-dotOk" : " pbb-dotWarn"
 			};
 		}
 		const LOCAL_PORT_RANGE = {
@@ -4072,6 +4159,11 @@ window.__ModuleLoader__.load({
 			const [deviceMessage, setDeviceMessage] = (0, react.useState)("");
 			const [editingDeviceId, setEditingDeviceId] = (0, react.useState)(null);
 			const [deviceNameDraft, setDeviceNameDraft] = (0, react.useState)("");
+			/** 复制诊断信息的结果提示；failed 决定是否染红。 */
+			const [diagnosticsCopy, setDiagnosticsCopy] = (0, react.useState)({
+				message: "",
+				failed: false
+			});
 			(0, react.useEffect)(() => {
 				if (!can("refresh")) return;
 				const refresh = props.refresh;
@@ -4481,6 +4573,62 @@ window.__ModuleLoader__.load({
 			});
 			const serviceStatusText = translateWith(props.t, SERVICE_STATUS_KEY[service.kind]);
 			const serviceDot = service.dot;
+			/** 一条失败事件的单行文本：时间 · 类型 · 分因，附带可选排查字段。 */
+			const diagnosticLine = (failure) => {
+				const base = translateWith(props.t, "diagnostics.item", {
+					time: new Date(failure.ts).toLocaleString(),
+					kind: failure.kind,
+					reason: failure.reason
+				});
+				const extras = [];
+				if (failure.attemptId !== void 0) extras.push(translateWith(props.t, "diagnostics.attempt", { id: failure.attemptId }));
+				if (failure.closeCode !== void 0) extras.push(translateWith(props.t, "diagnostics.closeCode", { code: failure.closeCode }));
+				if (failure.durationMs !== void 0) extras.push(translateWith(props.t, "diagnostics.duration", { ms: failure.durationMs }));
+				if (failure.source !== void 0) extras.push(translateWith(props.t, "diagnostics.source", { label: failure.source }));
+				return extras.length === 0 ? base : base + " · " + extras.join(" · ");
+			};
+			/**
+			* 复制诊断信息：报告里的结构化事实（版本 / 相位 / 连接数 / 最近失败）。
+			* 走既有的 report 通道与 i18n；内容不含配对码、公钥、APNs token 与消息正文。
+			*/
+			const copyDiagnostics = () => {
+				if (report === null) return;
+				const enabledText = report.enabled ? translateWith(props.t, "diagnostics.on") : translateWith(props.t, "diagnostics.off");
+				const failures = report.diagnostics?.recentFailures ?? [];
+				const lines = [
+					translateWith(props.t, "diagnostics.reportTitle"),
+					translateWith(props.t, "diagnostics.reportGeneratedAt") + ": " + (/* @__PURE__ */ new Date()).toLocaleString(),
+					translateWith(props.t, "diagnostics.reportVersion") + ": v" + report.pluginVersion + " (" + translateWith(props.t, "advanced.protocolVersion") + " v" + String(report.protocolVersion) + ")",
+					translateWith(props.t, "diagnostics.reportEnabled") + ": " + enabledText,
+					translateWith(props.t, "diagnostics.reportLocal") + ": " + report.local.phase + (report.local.phase === "online" ? " :" + String(report.local.port) : ""),
+					translateWith(props.t, "diagnostics.reportRemote") + ": " + report.remote.phase,
+					translateWith(props.t, "diagnostics.reportConnections") + ": " + String(report.activeConnections)
+				];
+				if (report.diagnostics !== void 0) lines.push(translateWith(props.t, "diagnostics.startedAt", { time: new Date(report.diagnostics.startedAt).toLocaleString() }));
+				lines.push(translateWith(props.t, "diagnostics.reportFailureHeader") + ":");
+				if (failures.length === 0) lines.push("- " + translateWith(props.t, "diagnostics.reportNone"));
+				else for (const failure of failures.slice(-5).reverse()) lines.push("- " + diagnosticLine(failure));
+				writeClipboard(props.t, lines.join("\n")).then(() => {
+					setDiagnosticsCopy({
+						message: translateWith(props.t, "diagnostics.copied"),
+						failed: false
+					});
+				}, (error) => {
+					setDiagnosticsCopy({
+						message: translateWith(props.t, "diagnostics.copyFailed") + (error instanceof Error ? error.message : String(error)),
+						failed: true
+					});
+				});
+			};
+			const diagnosticsSection = report === null ? null : (0, react.createElement)("div", { className: "pbb-helpSection" }, (0, react.createElement)("div", { className: "pbb-row" }, (0, react.createElement)("div", { className: "pbb-switchText" }, (0, react.createElement)("span", { className: "pbb-testTitle" }, translateWith(props.t, "diagnostics.title")), (0, react.createElement)("span", { className: "pbb-testDescription" }, translateWith(props.t, "diagnostics.description"))), (0, react.createElement)("button", {
+				type: "button",
+				className: "pbb-action",
+				onClick: copyDiagnostics,
+				"data-testid": "diagnosticsCopy"
+			}, translateWith(props.t, "diagnostics.copy"))), diagnosticsCopy.message ? (0, react.createElement)("p", { className: "pbb-diag" + (diagnosticsCopy.failed ? " pbb-diagBad" : "") }, diagnosticsCopy.message) : null, report.diagnostics === void 0 ? (0, react.createElement)("p", { className: "pbb-diag" }, translateWith(props.t, "diagnostics.staleHost")) : report.diagnostics.recentFailures.length === 0 ? (0, react.createElement)("p", { className: "pbb-diag" }, translateWith(props.t, "diagnostics.empty")) : (0, react.createElement)("div", null, (0, react.createElement)("span", { className: "pbb-label" }, translateWith(props.t, "diagnostics.recent")), report.diagnostics.recentFailures.slice(-5).reverse().map((failure, index) => (0, react.createElement)("p", {
+				className: "pbb-diag",
+				key: String(index)
+			}, diagnosticLine(failure)))));
 			return (0, react.createElement)("div", { className: "pbb-section" }, (0, react.createElement)("header", { className: "pbb-pageHeader" }, (0, react.createElement)("div", null, (0, react.createElement)("h2", { className: "pbb-title" }, "DeepPilot"), (0, react.createElement)("p", { className: "pbb-intro" }, translateWith(props.t, "meta.intro"))), (0, react.createElement)("button", {
 				type: "button",
 				className: "pbb-refresh",
@@ -4631,7 +4779,7 @@ window.__ModuleLoader__.load({
 			}, (step.ok ? "✓ " : "✗ ") + (step.id === "health" ? translateWith(props.t, "push.relayStep.health") : translateWith(props.t, "push.relayStep.enroll")) + (step.latencyMs !== void 0 ? ` (${String(step.latencyMs)}ms)` : "") + " — " + step.message))), pushTestError ? (0, react.createElement)("p", { className: "pbb-diag pbb-diagBad" }, pushTestError) : null, pushTestResult === null ? (0, react.createElement)("p", { className: "pbb-diag" }, translateWith(props.t, "push.pushDefault")) : (0, react.createElement)("div", { className: "pbb-helpBody" }, (0, react.createElement)("div", { className: "pbb-row" }, (0, react.createElement)("code", { className: "pbb-token " + (pushTestResult.overall === "sent" ? "pbb-ok" : pushTestResult.overall === "failed" ? "pbb-bad" : "") }, pushTestResult.overall === "sent" ? translateWith(props.t, "push.pushSent") : pushTestResult.overall === "failed" ? translateWith(props.t, "push.pushFailed") : pushTestResult.overall === "no-targets" ? translateWith(props.t, "push.pushNoTargets") : translateWith(props.t, "push.pushNotEnabled"))), pushTestResult.message ? (0, react.createElement)("p", { className: "pbb-diag" }, pushTestResult.message) : null, pushTestResult.results.map((r, index) => (0, react.createElement)("p", {
 				className: "pbb-diag",
 				key: String(index)
-			}, (r.outcome === "sent" ? "✓ " : "✗ ") + r.name + " [" + r.environment + "] — " + r.outcome + (r.reason ? "（" + r.reason + "）" : "") + (r.tokenFingerprint ? "　token:" + r.tokenFingerprint + "…" : "")))))), report === null ? null : (0, react.createElement)("details", { className: "pbb-card pbb-disclosure" }, (0, react.createElement)("summary", null, (0, react.createElement)("span", { className: "pbb-disclosureTitle" }, translateWith(props.t, "system.summary")), (0, react.createElement)("span", { className: "pbb-disclosureMeta" }, "v" + report.pluginVersion)), (0, react.createElement)("div", { className: "pbb-disclosureBody" }, (0, react.createElement)("div", { className: "pbb-sectionIntro" }, (0, react.createElement)("h3", { className: "pbb-cardTitle" }, translateWith(props.t, "system.title")), (0, react.createElement)("p", { className: "pbb-cardDescription" }, translateWith(props.t, "system.description"))), (0, react.createElement)("div", { className: "pbb-runtimeList" }, (0, react.createElement)("div", { className: "pbb-runtimeRow" }, (0, react.createElement)("span", { className: "pbb-label" }, "DeepPilot"), (0, react.createElement)("span", { className: "pbb-value" }, "v" + report.pluginVersion)), advancedRows, report.updateAvailable === true ? (0, react.createElement)("div", { className: "pbb-updateRow" }, (0, react.createElement)("span", null, translateWith(props.t, "update.badge")), (0, react.createElement)("a", {
+			}, (r.outcome === "sent" ? "✓ " : "✗ ") + r.name + " [" + r.environment + "] — " + r.outcome + (r.reason ? "（" + r.reason + "）" : "") + (r.tokenFingerprint ? "　token:" + r.tokenFingerprint + "…" : "")))), diagnosticsSection)), report === null ? null : (0, react.createElement)("details", { className: "pbb-card pbb-disclosure" }, (0, react.createElement)("summary", null, (0, react.createElement)("span", { className: "pbb-disclosureTitle" }, translateWith(props.t, "system.summary")), (0, react.createElement)("span", { className: "pbb-disclosureMeta" }, "v" + report.pluginVersion)), (0, react.createElement)("div", { className: "pbb-disclosureBody" }, (0, react.createElement)("div", { className: "pbb-sectionIntro" }, (0, react.createElement)("h3", { className: "pbb-cardTitle" }, translateWith(props.t, "system.title")), (0, react.createElement)("p", { className: "pbb-cardDescription" }, translateWith(props.t, "system.description"))), (0, react.createElement)("div", { className: "pbb-runtimeList" }, (0, react.createElement)("div", { className: "pbb-runtimeRow" }, (0, react.createElement)("span", { className: "pbb-label" }, "DeepPilot"), (0, react.createElement)("span", { className: "pbb-value" }, "v" + report.pluginVersion)), advancedRows, report.updateAvailable === true ? (0, react.createElement)("div", { className: "pbb-updateRow" }, (0, react.createElement)("span", null, translateWith(props.t, "update.badge")), (0, react.createElement)("a", {
 				className: "pbb-action pbb-buttonPrimary",
 				href: typeof report.releaseUrl === "string" && /^https:\/\//.test(report.releaseUrl) ? report.releaseUrl : "https://github.com/Mars-Sea/dsh-deeppilot/releases",
 				target: "_blank",