dsh-mobile-access 1.0.3 → 1.1.0

package/client.js

@@ -262,8 +262,13 @@ function statusOf(state, loading, error, t) {
         return { label: t('statusError'), tone: 'bad' };
     if (state === null)
         return { label: loading ? t('statusLoading') : t('statusError'), tone: 'muted' };
-    if (state.loopback)
+    if (state.loopback) {
+        if (state.gateway.running)
+            return { label: t('statusGateway'), tone: 'ok' };
+        if (state.gateway.starting)
+            return { label: t('statusGatewayStarting'), tone: 'warn' };
         return { label: t('statusLoopback'), tone: 'bad' };
+    }
     if (state.locked)
         return { label: t('statusLocked'), tone: 'bad' };
     if (state.expired)
@@ -274,8 +279,8 @@ function statusOf(state, loading, error, t) {
 "use strict";
 const NS = 'dsh-mobile-access';
 const PANEL_ID = 'mobile-access';
-const ZH = {"panel":"手机访问","title":"手机访问","subtitle":"在同一局域网内，用 iPhone 或 iPad 打开这台 Mac 上的官方 DSH。","statusLoading":"正在读取配对状态","statusReady":"已就绪","statusLoopback":"仅回环地址","statusLocked":"配对码已锁定","statusExpired":"配对码已过期","statusError":"暂时无法读取状态","errorTitle":"无法读取配对状态","retry":"重新加载","urlLabel":"iPhone 打开的地址","urlHint":"在 iPhone 的 Safari 地址栏输入这个地址。","codeLabel":"配对码","codeHint":"在 iPhone 的配对页输入这 8 位数字。","copyLink":"复制地址","copyCode":"复制配对码","copied":"已复制","copyFailed":"复制失败，请手动选择文本","rotate":"刷新配对码","rotating":"正在刷新…","toastRotated":"配对码已刷新","rotateFailed":"刷新失败，请重试","expiry":"有效至","expiresIn":"剩余","expired":"已过期","locked":"已锁定","never":"尚未配对","lastPaired":"最近配对","pairCount":"成功配对次数","stepsTitle":"在 iPhone 上连接","step1":"确认 iPhone 与 Mac 连接同一个 Wi-Fi，且没有开启会隔离设备的访客网络。","step2":"在 iPhone Safari 打开上面的地址，输入配对码并点「连接 DSH」。","step3":"配对成功后会自动进入 DSH；再点 Safari 分享按钮，选择「添加到主屏幕」。","diagnosticsTitle":"连接诊断","bindLabel":"Mac 监听地址","deviceLabel":"当前设备","deviceIOS":"iPhone / iPad","deviceOther":"电脑或其他设备","launchMode":"启动方式","standaloneYes":"已从主屏幕启动","standaloneNo":"浏览器标签页","secureYes":"安全上下文","secureNo":"HTTP 非安全上下文（剪贴板回退已启用）","loopbackTitle":"iPhone 现在无法连接","loopbackBody":"DSH 只监听了回环地址（localhost / 127.0.0.1）。请把 Host 的 webserver.host 改为这台 Mac 的局域网 IPv4 地址，然后由你手动重启 DSH。","httpTitle":"关于 HTTP 访问","httpBody":"当前是局域网 HTTP。DSH 已为 UUID 和多数复制按钮提供兼容实现；本插件会在 iPhone 上补齐直接调用 navigator.clipboard 的旧代码。","selftestTitle":"浏览器能力自检","selftestRun":"运行自检","selftestRunning":"正在自检…","selftestNote":"自检只读取浏览器能力，不修改 DSH 配置，也不影响 Mac。","checkClipboard":"剪贴板写入","checkCrypto":"安全随机数","checkStorage":"本地存储","checkWebSocket":"WebSocket","checkViewport":"移动端视口","checkOnline":"网络状态","checkPass":"通过","checkWarn":"注意","checkFail":"失败","limitsTitle":"平台边界（不是插件缺陷）","limit1":"iOS Safari 不支持桌面式拖放；文件请用系统选择器上传。","limit2":"iOS 会在后台挂起网页；长任务请保持 DSH 页面在前台。","limit3":"下载文件由 Safari 交给「文件」App，落点由 iOS 决定。","zeroImpactTitle":"对 Mac 的零影响设计","zeroImpactBody":"插件只增加三个精确路由、一个左侧栏入口和一个主面板；不修改核心代码、认证、配置、主题、布局或其他插件，也不在后台轮询。","mainAria":"手机访问面板","codeAria":"配对码","reload":"刷新","unknown":"未知"};
-const EN = {"panel":"Mobile Access","title":"Mobile Access","subtitle":"Open this Mac’s official DSH from an iPhone or iPad on the same LAN.","statusLoading":"Reading pairing state","statusReady":"Ready","statusLoopback":"Loopback only","statusLocked":"Code locked","statusExpired":"Code expired","statusError":"State unavailable","errorTitle":"Could not read pairing state","retry":"Reload","urlLabel":"Address for iPhone","urlHint":"Type this address into Safari on the iPhone.","codeLabel":"Pairing code","codeHint":"Enter these 8 digits on the iPhone pairing page.","copyLink":"Copy address","copyCode":"Copy code","copied":"Copied","copyFailed":"Copy failed; select the text manually","rotate":"New code","rotating":"Rotating…","toastRotated":"Pairing code rotated","rotateFailed":"Rotation failed; try again","expiry":"Valid until","expiresIn":"Remaining","expired":"Expired","locked":"Locked","never":"Never","lastPaired":"Last paired","pairCount":"Successful pairings","stepsTitle":"Connect from iPhone","step1":"Put the iPhone and the Mac on the same Wi-Fi, without client isolation.","step2":"Open the address in Safari, enter the code, and tap “Connect DSH”.","step3":"After pairing, use Safari Share → “Add to Home Screen”.","diagnosticsTitle":"Connection diagnostics","bindLabel":"Mac listener","deviceLabel":"This device","deviceIOS":"iPhone / iPad","deviceOther":"Computer or other device","launchMode":"Launch mode","standaloneYes":"Launched from Home Screen","standaloneNo":"Browser tab","secureYes":"Secure context","secureNo":"HTTP insecure context (clipboard fallback enabled)","loopbackTitle":"The iPhone cannot connect yet","loopbackBody":"DSH is listening on loopback only. Set Host webserver.host to this Mac’s LAN IPv4 address, then restart DSH manually.","httpTitle":"About HTTP","httpBody":"This is plain-HTTP LAN access. DSH already handles UUIDs and most copy buttons; this plugin adds a fallback for older direct navigator.clipboard calls on iPhone.","selftestTitle":"Browser capability self-test","selftestRun":"Run self-test","selftestRunning":"Testing…","selftestNote":"The self-test only reads browser capabilities; it does not change DSH or affect the Mac.","checkClipboard":"Clipboard write","checkCrypto":"Secure random","checkStorage":"Local storage","checkWebSocket":"WebSocket","checkViewport":"Mobile viewport","checkOnline":"Network status","checkPass":"Pass","checkWarn":"Note","checkFail":"Fail","limitsTitle":"Platform limits (not plugin defects)","limit1":"iOS Safari has no desktop drag-and-drop; use the system file picker.","limit2":"iOS suspends background pages; keep DSH in the foreground for long tasks.","limit3":"Safari hands downloads to the Files app; iOS chooses the location.","zeroImpactTitle":"Zero-impact design for the Mac","zeroImpactBody":"The plugin adds exactly three routes, one sidebar entry, and one main panel. It does not modify core code, auth, config, theme, layout, or other plugins, and it never polls in the background.","mainAria":"Mobile access panel","codeAria":"Pairing code","reload":"Reload","unknown":"Unknown"};
+const ZH = {"panel":"手机访问","title":"手机访问","subtitle":"在同一局域网内，用 iPhone 或 iPad 打开这台 Mac 上的官方 DSH。","statusLoading":"正在读取配对状态","statusReady":"已就绪","statusLoopback":"仅回环地址","statusGateway":"局域网网关已开启","statusGatewayStarting":"正在开启局域网网关","statusLocked":"配对码已锁定","statusExpired":"配对码已过期","statusError":"暂时无法读取状态","errorTitle":"无法读取配对状态","retry":"重新加载","urlLabel":"iPhone 打开的地址","urlHint":"在 iPhone 的 Safari 地址栏输入这个地址。","codeLabel":"配对码","codeHint":"在 iPhone 的配对页输入这 8 位数字。","copyLink":"复制地址","copyCode":"复制配对码","copied":"已复制","copyFailed":"复制失败，请手动选择文本","rotate":"刷新配对码","rotating":"正在刷新…","toastRotated":"配对码已刷新","rotateFailed":"刷新失败，请重试","expiry":"有效至","expiresIn":"剩余","expired":"已过期","locked":"已锁定","never":"尚未配对","lastPaired":"最近配对","pairCount":"成功配对次数","stepsTitle":"在 iPhone 上连接","step1":"确认 iPhone 与 Mac 连接同一个 Wi-Fi，且没有开启会隔离设备的访客网络。","step2":"在 iPhone Safari 打开上面的地址，输入配对码并点「连接 DSH」。","step3":"配对成功后会自动进入 DSH；再点 Safari 分享按钮，选择「添加到主屏幕」。","diagnosticsTitle":"连接诊断","bindLabel":"Mac 监听地址","gatewayLabel":"局域网网关","gatewayOn":"已开启","gatewayOff":"未开启","deviceLabel":"当前设备","deviceIOS":"iPhone / iPad","deviceOther":"电脑或其他设备","launchMode":"启动方式","standaloneYes":"已从主屏幕启动","standaloneNo":"浏览器标签页","secureYes":"安全上下文","secureNo":"HTTP 非安全上下文（剪贴板回退已启用）","loopbackTitle":"iPhone 现在无法连接","loopbackBody":"DSH 只监听回环地址；插件正在尝试开启局域网网关。若失败，诊断信息会显示在这里，Mac 仍可正常使用 127.0.0.1。","gatewayTitle":"局域网网关已开启","gatewayBody":"DSH 仍只监听 127.0.0.1；iPhone 通过下面的局域网地址访问。Mac 继续用原地址，不受影响。","gatewayStartingTitle":"正在开启局域网网关","httpTitle":"关于 HTTP 访问","httpBody":"当前是局域网 HTTP。DSH 已为 UUID 和多数复制按钮提供兼容实现；本插件会在 iPhone 上补齐直接调用 navigator.clipboard 的旧代码。","selftestTitle":"浏览器能力自检","selftestRun":"运行自检","selftestRunning":"正在自检…","selftestNote":"自检只读取浏览器能力，不修改 DSH 配置，也不影响 Mac。","checkClipboard":"剪贴板写入","checkCrypto":"安全随机数","checkStorage":"本地存储","checkWebSocket":"WebSocket","checkViewport":"移动端视口","checkOnline":"网络状态","checkPass":"通过","checkWarn":"注意","checkFail":"失败","limitsTitle":"平台边界（不是插件缺陷）","limit1":"iOS Safari 不支持桌面式拖放；文件请用系统选择器上传。","limit2":"iOS 会在后台挂起网页；长任务请保持 DSH 页面在前台。","limit3":"下载文件由 Safari 交给「文件」App，落点由 iOS 决定。","zeroImpactTitle":"对 Mac 的零影响设计","zeroImpactBody":"插件只增加三个精确路由、一个左侧栏入口和一个主面板；不修改核心代码、认证、配置、主题、布局或其他插件，也不在后台轮询。","mainAria":"手机访问面板","codeAria":"配对码","reload":"刷新","unknown":"未知"};
+const EN = {"panel":"Mobile Access","title":"Mobile Access","subtitle":"Open this Mac’s official DSH from an iPhone or iPad on the same LAN.","statusLoading":"Reading pairing state","statusReady":"Ready","statusLoopback":"Loopback only","statusGateway":"LAN gateway on","statusGatewayStarting":"Starting LAN gateway","statusLocked":"Code locked","statusExpired":"Code expired","statusError":"State unavailable","errorTitle":"Could not read pairing state","retry":"Reload","urlLabel":"Address for iPhone","urlHint":"Type this address into Safari on the iPhone.","codeLabel":"Pairing code","codeHint":"Enter these 8 digits on the iPhone pairing page.","copyLink":"Copy address","copyCode":"Copy code","copied":"Copied","copyFailed":"Copy failed; select the text manually","rotate":"New code","rotating":"Rotating…","toastRotated":"Pairing code rotated","rotateFailed":"Rotation failed; try again","expiry":"Valid until","expiresIn":"Remaining","expired":"Expired","locked":"Locked","never":"Never","lastPaired":"Last paired","pairCount":"Successful pairings","stepsTitle":"Connect from iPhone","step1":"Put the iPhone and the Mac on the same Wi-Fi, without client isolation.","step2":"Open the address in Safari, enter the code, and tap “Connect DSH”.","step3":"After pairing, use Safari Share → “Add to Home Screen”.","diagnosticsTitle":"Connection diagnostics","bindLabel":"Mac listener","gatewayLabel":"LAN gateway","gatewayOn":"On","gatewayOff":"Off","deviceLabel":"This device","deviceIOS":"iPhone / iPad","deviceOther":"Computer or other device","launchMode":"Launch mode","standaloneYes":"Launched from Home Screen","standaloneNo":"Browser tab","secureYes":"Secure context","secureNo":"HTTP insecure context (clipboard fallback enabled)","loopbackTitle":"The iPhone cannot connect yet","loopbackBody":"DSH is listening on loopback only. The plugin is starting a LAN gateway; if it fails, diagnostics appear here. The Mac keeps using 127.0.0.1.","gatewayTitle":"LAN gateway is on","gatewayBody":"DSH still listens only on 127.0.0.1. The iPhone uses the LAN address below; the Mac keeps its original address.","gatewayStartingTitle":"Starting LAN gateway","httpTitle":"About HTTP","httpBody":"This is plain-HTTP LAN access. DSH already handles UUIDs and most copy buttons; this plugin adds a fallback for older direct navigator.clipboard calls on iPhone.","selftestTitle":"Browser capability self-test","selftestRun":"Run self-test","selftestRunning":"Testing…","selftestNote":"The self-test only reads browser capabilities; it does not change DSH or affect the Mac.","checkClipboard":"Clipboard write","checkCrypto":"Secure random","checkStorage":"Local storage","checkWebSocket":"WebSocket","checkViewport":"Mobile viewport","checkOnline":"Network status","checkPass":"Pass","checkWarn":"Note","checkFail":"Fail","limitsTitle":"Platform limits (not plugin defects)","limit1":"iOS Safari has no desktop drag-and-drop; use the system file picker.","limit2":"iOS suspends background pages; keep DSH in the foreground for long tasks.","limit3":"Safari hands downloads to the Files app; iOS chooses the location.","zeroImpactTitle":"Zero-impact design for the Mac","zeroImpactBody":"The plugin adds exactly three routes, one sidebar entry, and one main panel. It does not modify core code, auth, config, theme, layout, or other plugins, and it never polls in the background.","mainAria":"Mobile access panel","codeAria":"Pairing code","reload":"Reload","unknown":"Unknown"};
 function createPanel(t, locale) {
     return function MobileAccessPanel() {
         useLocaleRevision(locale);
@@ -287,6 +292,7 @@ function createPanel(t, locale) {
         const toastTimer = React.useRef(undefined);
         const remaining = useRemaining(state?.expiresAt);
         const status = statusOf(state, loading, error, t);
+        const publicReady = state?.gateway.running === true && state.gateway.publicOrigin !== null;
         const isIOS = isAppleMobile();
         const standalone = navigator.standalone === true
             || window.matchMedia('(display-mode: standalone)').matches;
@@ -348,13 +354,17 @@ function createPanel(t, locale) {
         };
         const codeBlock = state === null
             ? null
-            : h('div', { className: 'dsh-ma-card dsh-ma-pair' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('p', { className: 'dsh-ma-label' }, t('codeLabel')), h('div', { className: 'dsh-ma-code', 'aria-label': t('codeAria') }, state.displayCode), h('p', { className: 'dsh-ma-hint' }, t('codeHint'))), h('div', { className: `dsh-ma-pill ${state.loopback || state.locked ? 'is-bad' : state.expired ? 'is-warn' : 'is-ok'}` }, h('span', { className: 'dsh-ma-dot' }), status.label)), h('div', { className: 'dsh-ma-actions' }, h('button', { type: 'button', className: 'dsh-ma-button primary', onClick: () => { void copy(state.pairUrl); }, disabled: state.loopback }, t('copyLink')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void copy(state.displayCode); } }, t('copyCode')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void rotate(); }, disabled: rotating }, rotating ? t('rotating') : t('rotate'))), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('expiry')), h('dd', null, new Date(state.expiresAt).toLocaleTimeString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('expiresIn')), h('dd', { className: remaining === 0 ? 'is-bad' : '' }, remaining === 0 ? t('expired') : formatRemaining(remaining))), h('div', null, h('dt', null, t('lastPaired')), h('dd', null, state.lastPairedAt === null ? t('never') : new Date(state.lastPairedAt).toLocaleString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('pairCount')), h('dd', null, String(state.pairingCount)))));
+            : h('div', { className: 'dsh-ma-card dsh-ma-pair' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('p', { className: 'dsh-ma-label' }, t('codeLabel')), h('div', { className: 'dsh-ma-code', 'aria-label': t('codeAria') }, state.displayCode), h('p', { className: 'dsh-ma-hint' }, t('codeHint'))), h('div', { className: `dsh-ma-pill ${state.loopback || state.locked ? 'is-bad' : state.expired ? 'is-warn' : 'is-ok'}` }, h('span', { className: 'dsh-ma-dot' }), status.label)), h('div', { className: 'dsh-ma-actions' }, h('button', { type: 'button', className: 'dsh-ma-button primary', onClick: () => { void copy(state.pairUrl); }, disabled: state.loopback && !publicReady }, t('copyLink')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void copy(state.displayCode); } }, t('copyCode')), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void rotate(); }, disabled: rotating }, rotating ? t('rotating') : t('rotate'))), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('expiry')), h('dd', null, new Date(state.expiresAt).toLocaleTimeString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('expiresIn')), h('dd', { className: remaining === 0 ? 'is-bad' : '' }, remaining === 0 ? t('expired') : formatRemaining(remaining))), h('div', null, h('dt', null, t('lastPaired')), h('dd', null, state.lastPairedAt === null ? t('never') : new Date(state.lastPairedAt).toLocaleString(undefined, { hour12: false }))), h('div', null, h('dt', null, t('pairCount')), h('dd', null, String(state.pairingCount)))));
         return h('div', { className: 'dsh-ma', 'data-testid': 'mobile-access-panel', 'data-state': status.tone }, h('style', null, STYLES), h('div', { className: 'dsh-ma-inner', role: 'region', 'aria-label': t('mainAria') }, h('header', { className: 'dsh-ma-head' }, h('div', { className: 'dsh-ma-mark' }, 'D'), h('div', null, h('h1', null, t('title')), h('p', null, t('subtitle')))), h('div', { className: 'dsh-ma-card dsh-ma-url' }, h('p', { className: 'dsh-ma-label' }, t('urlLabel')), state === null
             ? h('p', { className: 'dsh-ma-hint' }, loading ? t('statusLoading') : t('statusError'))
-            : h('code', null, state.pairUrl), h('p', { className: 'dsh-ma-hint' }, t('urlHint')), state?.loopback ? h('div', { className: 'dsh-ma-alert' }, h('strong', null, t('loopbackTitle')), h('p', null, t('loopbackBody'))) : null), error !== null ? h('div', { className: 'dsh-ma-alert' }, h('strong', null, t('errorTitle')), h('p', null, error), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void reload(); } }, t('retry'))) : null, state === null && loading ? h('div', { className: 'dsh-ma-card dsh-ma-hint' }, t('statusLoading')) : null, codeBlock, h('div', { className: 'dsh-ma-card' }, h('h2', null, t('stepsTitle')), h('ol', { className: 'dsh-ma-steps' }, h('li', null, t('step1')), h('li', null, t('step2')), h('li', null, t('step3')))), h('div', { className: 'dsh-ma-card' }, h('h2', null, t('diagnosticsTitle')), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('bindLabel')), h('dd', null, state === null ? t('unknown') : `${state.bindHost}:${state.port}`)), h('div', null, h('dt', null, t('deviceLabel')), h('dd', null, isIOS ? t('deviceIOS') : t('deviceOther'))), h('div', null, h('dt', null, t('launchMode')), h('dd', null, standalone ? t('standaloneYes') : t('standaloneNo'))), h('div', null, h('dt', null, t('secureYes')), h('dd', null, window.isSecureContext ? t('secureYes') : t('secureNo'))))), h('div', { className: 'dsh-ma-card' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('h2', null, t('selftestTitle')), h('p', { className: 'dsh-ma-hint' }, t('selftestNote'))), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void selfTest(); }, disabled: testing }, testing ? t('selftestRunning') : t('selftestRun'))), checks === null ? null : h('ul', { className: 'dsh-ma-checks' }, ...checks.map((check, index) => h('li', { key: index, className: `is-${check.status}` }, h('span', { className: 'dsh-ma-dot' }), h('span', { className: 'dsh-ma-check-label' }, labels[check.label] ?? check.label), h('span', { className: 'dsh-ma-check-status' }, statusText[check.status]), h('span', { className: 'dsh-ma-check-detail' }, check.detail))))), h('div', { className: 'dsh-ma-card dsh-ma-note' }, h('h2', null, t('httpTitle')), h('p', null, t('httpBody')), h('h2', null, t('zeroImpactTitle')), h('p', null, t('zeroImpactBody'))), h('details', { className: 'dsh-ma-card dsh-ma-details' }, h('summary', null, t('limitsTitle')), h('ul', null, h('li', null, t('limit1')), h('li', null, t('limit2')), h('li', null, t('limit3')))), h('p', { className: 'dsh-ma-toast', 'aria-live': 'polite' }, toast ?? '')));
+            : h('code', null, state.pairUrl), h('p', { className: 'dsh-ma-hint' }, t('urlHint')), state?.loopback
+            ? state.gateway.running
+                ? h('div', { className: 'dsh-ma-alert is-ok' }, h('strong', null, t('gatewayTitle')), h('p', null, t('gatewayBody')), state.gateway.publicOrigin === null ? null : h('code', null, state.gateway.publicOrigin))
+                : h('div', { className: 'dsh-ma-alert' }, h('strong', null, state.gateway.starting ? t('gatewayStartingTitle') : t('loopbackTitle')), h('p', null, state.gateway.error ?? t('loopbackBody')))
+            : null), error !== null ? h('div', { className: 'dsh-ma-alert' }, h('strong', null, t('errorTitle')), h('p', null, error), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void reload(); } }, t('retry'))) : null, state === null && loading ? h('div', { className: 'dsh-ma-card dsh-ma-hint' }, t('statusLoading')) : null, codeBlock, h('div', { className: 'dsh-ma-card' }, h('h2', null, t('stepsTitle')), h('ol', { className: 'dsh-ma-steps' }, h('li', null, t('step1')), h('li', null, t('step2')), h('li', null, t('step3')))), h('div', { className: 'dsh-ma-card' }, h('h2', null, t('diagnosticsTitle')), h('dl', { className: 'dsh-ma-meta' }, h('div', null, h('dt', null, t('bindLabel')), h('dd', null, state === null ? t('unknown') : `${state.bindHost}:${state.port}`)), h('div', null, h('dt', null, t('gatewayLabel')), h('dd', null, state === null ? t('unknown') : state.gateway.running ? (state.gateway.publicOrigin ?? t('gatewayOn')) : t('gatewayOff'))), h('div', null, h('dt', null, t('deviceLabel')), h('dd', null, isIOS ? t('deviceIOS') : t('deviceOther'))), h('div', null, h('dt', null, t('launchMode')), h('dd', null, standalone ? t('standaloneYes') : t('standaloneNo'))), h('div', null, h('dt', null, t('secureYes')), h('dd', null, window.isSecureContext ? t('secureYes') : t('secureNo'))))), h('div', { className: 'dsh-ma-card' }, h('div', { className: 'dsh-ma-row' }, h('div', null, h('h2', null, t('selftestTitle')), h('p', { className: 'dsh-ma-hint' }, t('selftestNote'))), h('button', { type: 'button', className: 'dsh-ma-button', onClick: () => { void selfTest(); }, disabled: testing }, testing ? t('selftestRunning') : t('selftestRun'))), checks === null ? null : h('ul', { className: 'dsh-ma-checks' }, ...checks.map((check, index) => h('li', { key: index, className: `is-${check.status}` }, h('span', { className: 'dsh-ma-dot' }), h('span', { className: 'dsh-ma-check-label' }, labels[check.label] ?? check.label), h('span', { className: 'dsh-ma-check-status' }, statusText[check.status]), h('span', { className: 'dsh-ma-check-detail' }, check.detail))))), h('div', { className: 'dsh-ma-card dsh-ma-note' }, h('h2', null, t('httpTitle')), h('p', null, t('httpBody')), h('h2', null, t('zeroImpactTitle')), h('p', null, t('zeroImpactBody'))), h('details', { className: 'dsh-ma-card dsh-ma-details' }, h('summary', null, t('limitsTitle')), h('ul', null, h('li', null, t('limit1')), h('li', null, t('limit2')), h('li', null, t('limit3')))), h('p', { className: 'dsh-ma-toast', 'aria-live': 'polite' }, toast ?? '')));
     };
 }
-const STYLES = ".dsh-ma{height:100%;min-height:100%;overflow:auto;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827)}\n.dsh-ma *{box-sizing:border-box}\n.dsh-ma-inner{width:100%;max-width:860px;margin:0 auto;padding:clamp(18px,4vw,36px);display:flex;flex-direction:column;gap:14px}\n.dsh-ma-head{display:flex;align-items:center;gap:14px;margin-bottom:4px}\n.dsh-ma-mark{display:grid;place-items:center;flex:0 0 46px;width:46px;height:46px;border-radius:14px;background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff;font:800 21px/1 -apple-system,BlinkMacSystemFont,sans-serif}\n.dsh-ma-head h1{margin:0 0 3px;font-size:24px;line-height:1.2;letter-spacing:-.02em}\n.dsh-ma-head p{margin:0;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.5}\n.dsh-ma-card{padding:16px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}\n.dsh-ma-card h2{margin:0 0 8px;font-size:15px;line-height:1.35}\n.dsh-ma-card p{margin:0 0 8px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.6}\n.dsh-ma-card p:last-child{margin-bottom:0}\n.dsh-ma-row{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}\n.dsh-ma-label{margin:0 0 5px!important;color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important;font-weight:700;letter-spacing:.06em;text-transform:uppercase}\n.dsh-ma-url code{display:block;padding:12px 13px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:11px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:600 15px/1.45 ui-monospace,\"SF Mono\",Menlo,monospace;word-break:break-all}\n.dsh-ma-hint{color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important}\n.dsh-ma-code{margin:3px 0 6px;font:800 clamp(28px,6vw,40px)/1.1 ui-monospace,\"SF Mono\",Menlo,monospace;font-variant-numeric:tabular-nums;letter-spacing:.1em;color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-pill{display:inline-flex;align-items:center;gap:7px;min-height:28px;padding:4px 10px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:999px;font-size:12px;font-weight:700;white-space:nowrap}\n.dsh-ma-pill.is-ok{color:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn{color:#b45309}\n.dsh-ma-pill.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-dot{display:inline-block;flex:0 0 8px;width:8px;height:8px;border-radius:50%;background:currentColor}\n.dsh-ma-pill.is-ok .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-pill.is-bad .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-actions{display:flex;flex-wrap:wrap;gap:8px;margin:12px 0}\n.dsh-ma-button{display:inline-flex;align-items:center;justify-content:center;min-height:40px;padding:8px 13px;border:1px solid var(--dsw-alias-border-l2,#d5dbe5);border-radius:10px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:650 13px/1.2 -apple-system,BlinkMacSystemFont,sans-serif;cursor:pointer;-webkit-tap-highlight-color:transparent}\n.dsh-ma-button.primary{border-color:var(--dsw-alias-brand-primary,#2f5bea);background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff}\n.dsh-ma-button:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-button:disabled{opacity:.55;cursor:not-allowed}\n.dsh-ma-button:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#2f5bea);outline-offset:2px}\n.dsh-ma-meta{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:10px 16px;margin:8px 0 0}\n.dsh-ma-meta div{min-width:0}\n.dsh-ma-meta dt{margin:0 0 2px;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase}\n.dsh-ma-meta dd{margin:0;font-size:13px;line-height:1.45;word-break:break-word}\n.dsh-ma-meta dd.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert{margin:12px 0 0;padding:12px 13px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 35%,transparent);border-radius:12px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 8%,transparent);color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert strong{display:block;margin-bottom:4px;font-size:13px}\n.dsh-ma-alert p{color:inherit!important;font-size:13px!important;line-height:1.55!important}\n.dsh-ma-steps{margin:0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.65}\n.dsh-ma-steps li{margin:0 0 7px;padding-left:2px}\n.dsh-ma-steps li:last-child{margin-bottom:0}\n.dsh-ma-checks{display:flex;flex-direction:column;gap:7px;margin:10px 0 0;padding:0;list-style:none}\n.dsh-ma-checks li{display:flex;align-items:center;gap:8px;flex-wrap:wrap;font-size:13px;color:var(--dsw-alias-label-secondary,#5f6b7a)}\n.dsh-ma-checks li.is-pass .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-checks li.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-checks li.is-fail .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-check-label{color:var(--dsw-alias-label-primary,#111827);font-weight:650}\n.dsh-ma-check-status{font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.05em}\n.dsh-ma-check-detail{margin-left:auto;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:12px;word-break:break-word}\n.dsh-ma-note h2{font-size:13px;margin-top:4px}\n.dsh-ma-details summary{cursor:pointer;font-size:14px;font-weight:700}\n.dsh-ma-details ul{margin:10px 0 0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:13px;line-height:1.65}\n.dsh-ma-toast{min-height:20px;margin:0!important;text-align:center;color:var(--dsw-alias-brand-primary,#2f5bea)!important;font-size:13px!important;font-weight:650}\n@media (max-width:560px){\n.dsh-ma-inner{padding:max(14px,env(safe-area-inset-top)) max(14px,env(safe-area-inset-right)) max(18px,env(safe-area-inset-bottom)) max(14px,env(safe-area-inset-left));gap:11px}\n.dsh-ma-card{padding:14px;border-radius:14px}\n.dsh-ma-head h1{font-size:21px}\n.dsh-ma-mark{flex-basis:40px;width:40px;height:40px;border-radius:12px;font-size:18px}\n.dsh-ma-actions .dsh-ma-button{flex:1 1 140px;min-height:44px}\n.dsh-ma-check-detail{width:100%;margin-left:16px}\n}\n@media (prefers-reduced-motion:no-preference){\n.dsh-ma-button{transition:border-color .15s ease,background-color .15s ease,opacity .15s ease}\n}";
+const STYLES = ".dsh-ma{height:100%;min-height:100%;overflow:auto;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827)}\n.dsh-ma *{box-sizing:border-box}\n.dsh-ma-inner{width:100%;max-width:860px;margin:0 auto;padding:clamp(18px,4vw,36px);display:flex;flex-direction:column;gap:14px}\n.dsh-ma-head{display:flex;align-items:center;gap:14px;margin-bottom:4px}\n.dsh-ma-mark{display:grid;place-items:center;flex:0 0 46px;width:46px;height:46px;border-radius:14px;background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff;font:800 21px/1 -apple-system,BlinkMacSystemFont,sans-serif}\n.dsh-ma-head h1{margin:0 0 3px;font-size:24px;line-height:1.2;letter-spacing:-.02em}\n.dsh-ma-head p{margin:0;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.5}\n.dsh-ma-card{padding:16px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}\n.dsh-ma-card h2{margin:0 0 8px;font-size:15px;line-height:1.35}\n.dsh-ma-card p{margin:0 0 8px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.6}\n.dsh-ma-card p:last-child{margin-bottom:0}\n.dsh-ma-row{display:flex;align-items:flex-start;justify-content:space-between;gap:12px;flex-wrap:wrap}\n.dsh-ma-label{margin:0 0 5px!important;color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important;font-weight:700;letter-spacing:.06em;text-transform:uppercase}\n.dsh-ma-url code{display:block;padding:12px 13px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:11px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:600 15px/1.45 ui-monospace,\"SF Mono\",Menlo,monospace;word-break:break-all}\n.dsh-ma-hint{color:var(--dsw-alias-label-tertiary,#6b7280)!important;font-size:12px!important}\n.dsh-ma-code{margin:3px 0 6px;font:800 clamp(28px,6vw,40px)/1.1 ui-monospace,\"SF Mono\",Menlo,monospace;font-variant-numeric:tabular-nums;letter-spacing:.1em;color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-pill{display:inline-flex;align-items:center;gap:7px;min-height:28px;padding:4px 10px;border:1px solid var(--dsw-alias-border-l2,#dfe4ec);border-radius:999px;font-size:12px;font-weight:700;white-space:nowrap}\n.dsh-ma-pill.is-ok{color:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn{color:#b45309}\n.dsh-ma-pill.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-dot{display:inline-block;flex:0 0 8px;width:8px;height:8px;border-radius:50%;background:currentColor}\n.dsh-ma-pill.is-ok .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-pill.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-pill.is-bad .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-actions{display:flex;flex-wrap:wrap;gap:8px;margin:12px 0}\n.dsh-ma-button{display:inline-flex;align-items:center;justify-content:center;min-height:40px;padding:8px 13px;border:1px solid var(--dsw-alias-border-l2,#d5dbe5);border-radius:10px;background:var(--dsw-alias-bg-base,#fff);color:var(--dsw-alias-label-primary,#111827);font:650 13px/1.2 -apple-system,BlinkMacSystemFont,sans-serif;cursor:pointer;-webkit-tap-highlight-color:transparent}\n.dsh-ma-button.primary{border-color:var(--dsw-alias-brand-primary,#2f5bea);background:var(--dsw-alias-brand-primary,#2f5bea);color:#fff}\n.dsh-ma-button:hover:not(:disabled){border-color:var(--dsw-alias-brand-primary,#2f5bea)}\n.dsh-ma-button:disabled{opacity:.55;cursor:not-allowed}\n.dsh-ma-button:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#2f5bea);outline-offset:2px}\n.dsh-ma-meta{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:10px 16px;margin:8px 0 0}\n.dsh-ma-meta div{min-width:0}\n.dsh-ma-meta dt{margin:0 0 2px;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase}\n.dsh-ma-meta dd{margin:0;font-size:13px;line-height:1.45;word-break:break-word}\n.dsh-ma-meta dd.is-bad{color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert{margin:12px 0 0;padding:12px 13px;border:1px solid color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 35%,transparent);border-radius:12px;background:color-mix(in srgb,var(--dsw-alias-state-error-primary,#b42318) 8%,transparent);color:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-alert strong{display:block;margin-bottom:4px;font-size:13px}\n.dsh-ma-alert p{color:inherit!important;font-size:13px!important;line-height:1.55!important}\n.dsh-ma-alert.is-ok{border-color:color-mix(in srgb,var(--dsw-alias-state-success-primary,#087443) 35%,transparent);background:color-mix(in srgb,var(--dsw-alias-state-success-primary,#087443) 8%,transparent);color:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-steps{margin:0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:14px;line-height:1.65}\n.dsh-ma-steps li{margin:0 0 7px;padding-left:2px}\n.dsh-ma-steps li:last-child{margin-bottom:0}\n.dsh-ma-checks{display:flex;flex-direction:column;gap:7px;margin:10px 0 0;padding:0;list-style:none}\n.dsh-ma-checks li{display:flex;align-items:center;gap:8px;flex-wrap:wrap;font-size:13px;color:var(--dsw-alias-label-secondary,#5f6b7a)}\n.dsh-ma-checks li.is-pass .dsh-ma-dot{background:var(--dsw-alias-state-success-primary,#087443)}\n.dsh-ma-checks li.is-warn .dsh-ma-dot{background:#d97706}\n.dsh-ma-checks li.is-fail .dsh-ma-dot{background:var(--dsw-alias-state-error-primary,#b42318)}\n.dsh-ma-check-label{color:var(--dsw-alias-label-primary,#111827);font-weight:650}\n.dsh-ma-check-status{font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.05em}\n.dsh-ma-check-detail{margin-left:auto;color:var(--dsw-alias-label-tertiary,#6b7280);font-size:12px;word-break:break-word}\n.dsh-ma-note h2{font-size:13px;margin-top:4px}\n.dsh-ma-details summary{cursor:pointer;font-size:14px;font-weight:700}\n.dsh-ma-details ul{margin:10px 0 0;padding-left:20px;color:var(--dsw-alias-label-secondary,#5f6b7a);font-size:13px;line-height:1.65}\n.dsh-ma-toast{min-height:20px;margin:0!important;text-align:center;color:var(--dsw-alias-brand-primary,#2f5bea)!important;font-size:13px!important;font-weight:650}\n@media (max-width:560px){\n.dsh-ma-inner{padding:max(14px,env(safe-area-inset-top)) max(14px,env(safe-area-inset-right)) max(18px,env(safe-area-inset-bottom)) max(14px,env(safe-area-inset-left));gap:11px}\n.dsh-ma-card{padding:14px;border-radius:14px}\n.dsh-ma-head h1{font-size:21px}\n.dsh-ma-mark{flex-basis:40px;width:40px;height:40px;border-radius:12px;font-size:18px}\n.dsh-ma-actions .dsh-ma-button{flex:1 1 140px;min-height:44px}\n.dsh-ma-check-detail{width:100%;margin-left:16px}\n}\n@media (prefers-reduced-motion:no-preference){\n.dsh-ma-button{transition:border-color .15s ease,background-color .15s ease,opacity .15s ease}\n}";
 function factory(require) {
     React = require('react');
     return {

package/gateway.js

@@ -0,0 +1,368 @@
+/**
+ * Loopback-only DSH needs one LAN entry to be reachable from a phone. This
+ * gateway is deliberately small and additive: it forwards HTTP and the one
+ * DSH WebSocket endpoint to the loopback listener, rewriting Host/Origin so
+ * the existing Connection trust fence and cookies keep their normal meaning.
+ * The DSH listener itself never changes and the Mac keeps using 127.0.0.1.
+ */
+import { createServer, request as httpRequest } from 'node:http';
+import { connect } from 'node:net';
+import { networkInterfaces } from 'node:os';
+import { isLoopbackHost } from './service.js';
+const DEFAULT_PORT = 3081;
+const PORT_ATTEMPTS = 10;
+const UPGRADE_PATH = '/api/remote.mux';
+const HOP_BY_HOP = new Set([
+    'connection',
+    'keep-alive',
+    'proxy-authenticate',
+    'proxy-authorization',
+    'proxy-connection',
+    'te',
+    'trailer',
+    'transfer-encoding',
+    'upgrade',
+]);
+export const EMPTY_GATEWAY_STATUS = {
+    available: false,
+    running: false,
+    starting: false,
+    port: null,
+    publicOrigin: null,
+    lanAddresses: [],
+    error: null,
+};
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function stripBrackets(host) {
+    return host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+}
+function isPrivate(address) {
+    if (address.startsWith('10.'))
+        return true;
+    if (address.startsWith('192.168.'))
+        return true;
+    const parts = address.split('.');
+    if (parts.length !== 4)
+        return false;
+    const second = Number(parts[1]);
+    return parts[0] === '172' && second >= 16 && second <= 31;
+}
+function interfaceScore(name, address) {
+    const lower = name.toLowerCase();
+    if (lower === 'en0' || lower === 'wi-fi' || lower === 'wlan0')
+        return 0;
+    if (lower === 'en1' || lower === 'ethernet' || lower === 'eth0')
+        return 1;
+    if (lower.startsWith('utun') || lower.includes('tailscale'))
+        return 40;
+    return isPrivate(address) ? 10 : 20;
+}
+/** Every usable non-loopback IPv4 address, best candidate first. */
+export function lanIPv4Addresses() {
+    const found = [];
+    for (const [name, entries] of Object.entries(networkInterfaces())) {
+        for (const entry of entries ?? []) {
+            if (entry.internal)
+                continue;
+            if (entry.family !== 'IPv4')
+                continue;
+            if (entry.address.startsWith('127.') || entry.address.startsWith('169.254.'))
+                continue;
+            if (entry.address === '0.0.0.0')
+                continue;
+            found.push({ address: entry.address, score: interfaceScore(name, entry.address) });
+        }
+    }
+    const seen = new Set();
+    return found
+        .sort((left, right) => left.score - right.score || left.address.localeCompare(right.address))
+        .map((entry) => entry.address)
+        .filter((address) => {
+        if (seen.has(address))
+            return false;
+        seen.add(address);
+        return true;
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve) => {
+        server.close(() => resolve());
+        setTimeout(resolve, 500).unref();
+    });
+}
+export class LanGateway {
+    target;
+    targetHost;
+    targetPort;
+    preferredPort;
+    addresses;
+    unavailable;
+    server;
+    port = null;
+    running = false;
+    starting = false;
+    error = null;
+    stopped = false;
+    sockets = new Set();
+    constructor(options) {
+        this.target = new URL(options.targetOrigin);
+        this.targetHost = stripBrackets(this.target.hostname);
+        this.targetPort = Number(this.target.port || (this.target.protocol === 'https:' ? 443 : 80));
+        this.preferredPort = options.preferredPort ?? DEFAULT_PORT;
+        this.addresses = options.addresses ?? lanIPv4Addresses();
+        if (!isLoopbackHost(this.target.hostname)) {
+            this.unavailable = null;
+        }
+        else if (this.target.protocol !== 'http:') {
+            this.unavailable = 'HTTPS DSH 监听地址不能由 HTTP 网关代理；请继续使用局域网绑定或受信任证书。';
+        }
+        else if (this.addresses.length === 0) {
+            this.unavailable = '未找到可用的局域网 IPv4 地址；请检查 Mac/Windows 的网络连接。';
+        }
+        else {
+            this.unavailable = null;
+        }
+    }
+    get available() {
+        return this.unavailable === null && isLoopbackHost(this.target.hostname);
+    }
+    status() {
+        const publicAddress = this.addresses[0];
+        return {
+            available: this.available,
+            running: this.running,
+            starting: this.starting,
+            port: this.port,
+            publicOrigin: this.running && this.port !== null && publicAddress !== undefined
+                ? `http://${publicAddress}:${this.port}`
+                : null,
+            lanAddresses: this.addresses,
+            error: this.error ?? (this.available ? null : this.unavailable),
+        };
+    }
+    async start() {
+        if (this.stopped || this.running || this.starting)
+            return;
+        if (!this.available) {
+            this.error = this.unavailable;
+            return;
+        }
+        this.starting = true;
+        this.error = null;
+        try {
+            const server = createServer((request, response) => this.onRequest(request, response));
+            server.on('upgrade', (request, socket, head) => this.onUpgrade(request, socket, head));
+            server.on('connection', (socket) => this.track(socket));
+            server.on('clientError', (_error, socket) => {
+                if (socket.writable)
+                    socket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+            });
+            const port = await listenOnFreePort(server, this.preferredPort);
+            this.server = server;
+            this.port = port;
+            this.running = true;
+            server.on('error', (caught) => {
+                this.error = errorText(caught);
+                this.running = false;
+            });
+        }
+        catch (caught) {
+            this.error = errorText(caught);
+            await this.closeServer();
+        }
+        finally {
+            this.starting = false;
+        }
+    }
+    async stop() {
+        this.stopped = true;
+        this.running = false;
+        this.port = null;
+        for (const socket of this.sockets)
+            socket.destroy();
+        this.sockets.clear();
+        await this.closeServer();
+    }
+    async closeServer() {
+        const server = this.server;
+        this.server = undefined;
+        if (server === undefined)
+            return;
+        await closeServer(server);
+    }
+    track(socket) {
+        this.sockets.add(socket);
+        socket.on('close', () => this.sockets.delete(socket));
+        socket.on('error', () => this.sockets.delete(socket));
+    }
+    get publicOrigin() {
+        const address = this.addresses[0];
+        return address === undefined || this.port === null ? null : `http://${address}:${this.port}`;
+    }
+    rewriteOrigin(value) {
+        const publicOrigin = this.publicOrigin;
+        return publicOrigin !== null && value === publicOrigin ? this.target.origin : value;
+    }
+    rewriteReferer(value) {
+        const publicOrigin = this.publicOrigin;
+        if (publicOrigin === null || !value.startsWith(`${publicOrigin}/`))
+            return value;
+        return `${this.target.origin}${value.slice(publicOrigin.length)}`;
+    }
+    requestHeaders(request) {
+        const headers = {};
+        for (const [name, value] of Object.entries(request.headers)) {
+            if (value === undefined)
+                continue;
+            const lower = name.toLowerCase();
+            if (HOP_BY_HOP.has(lower) || lower === 'host' || lower.startsWith('x-forwarded-'))
+                continue;
+            if (lower === 'origin') {
+                headers.origin = this.rewriteOrigin(String(value));
+                continue;
+            }
+            if (lower === 'referer') {
+                headers.referer = this.rewriteReferer(String(value));
+                continue;
+            }
+            headers[lower] = value;
+        }
+        headers.host = this.target.host;
+        const publicOrigin = this.publicOrigin;
+        if (publicOrigin !== null) {
+            const publicUrl = new URL(publicOrigin);
+            headers['x-forwarded-host'] = publicUrl.host;
+            headers['x-forwarded-proto'] = 'http';
+        }
+        return headers;
+    }
+    responseHeaders(headers) {
+        const result = {};
+        for (const [name, value] of Object.entries(headers)) {
+            if (value === undefined)
+                continue;
+            const lower = name.toLowerCase();
+            if (HOP_BY_HOP.has(lower))
+                continue;
+            if (lower === 'location' && typeof value === 'string') {
+                const publicOrigin = this.publicOrigin;
+                result.location = publicOrigin !== null && value.startsWith(`${this.target.origin}/`)
+                    ? `${publicOrigin}${value.slice(this.target.origin.length)}`
+                    : value;
+                continue;
+            }
+            if (lower === 'set-cookie') {
+                result['set-cookie'] = (Array.isArray(value) ? value : [value])
+                    .map((cookie) => cookie.replaceAll(/;\s*Domain=[^;]*/gi, ''));
+                continue;
+            }
+            result[lower] = value;
+        }
+        return result;
+    }
+    onRequest(request, response) {
+        if (!this.running) {
+            response.writeHead(503, { 'content-type': 'text/plain; charset=utf-8' });
+            response.end('LAN gateway is not running');
+            return;
+        }
+        const upstream = httpRequest({
+            protocol: 'http:',
+            hostname: this.targetHost,
+            port: this.targetPort,
+            method: request.method,
+            path: request.url,
+            headers: this.requestHeaders(request),
+        }, (incoming) => {
+            response.writeHead(incoming.statusCode ?? 502, this.responseHeaders(incoming.headers));
+            incoming.pipe(response);
+        });
+        upstream.on('error', () => {
+            if (!response.headersSent) {
+                response.writeHead(502, { 'content-type': 'text/plain; charset=utf-8' });
+                response.end('LAN gateway upstream error');
+            }
+            else {
+                response.destroy();
+            }
+        });
+        request.on('error', () => upstream.destroy());
+        request.pipe(upstream);
+    }
+    onUpgrade(request, socket, head) {
+        if (!this.running) {
+            socket.destroy();
+            return;
+        }
+        let pathname;
+        try {
+            pathname = new URL(request.url ?? '/', this.target.origin).pathname;
+        }
+        catch {
+            socket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+            return;
+        }
+        if (pathname !== UPGRADE_PATH) {
+            socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
+            return;
+        }
+        const upstream = connect({ host: this.targetHost, port: this.targetPort }, () => {
+            const headers = this.requestHeaders(request);
+            headers.connection = 'Upgrade';
+            headers.upgrade = 'websocket';
+            const lines = [`GET ${request.url ?? '/'} HTTP/1.1`];
+            for (const [name, value] of Object.entries(headers)) {
+                if (value === undefined)
+                    continue;
+                if (Array.isArray(value)) {
+                    for (const item of value)
+                        lines.push(`${name}: ${item}`);
+                }
+                else {
+                    lines.push(`${name}: ${String(value)}`);
+                }
+            }
+            upstream.write(`${lines.join('\r\n')}\r\n\r\n`);
+            if (head.length > 0)
+                upstream.write(head);
+            socket.pipe(upstream);
+            upstream.pipe(socket);
+        });
+        this.track(upstream);
+        upstream.on('error', () => socket.destroy());
+        socket.on('error', () => upstream.destroy());
+        socket.on('close', () => upstream.destroy());
+    }
+}
+async function listenOnFreePort(server, preferredPort) {
+    const candidates = Array.from({ length: PORT_ATTEMPTS }, (_, index) => preferredPort + index);
+    candidates.push(0);
+    let lastError;
+    for (const port of candidates) {
+        try {
+            await new Promise((resolve, reject) => {
+                const onError = (caught) => {
+                    server.off('listening', onListening);
+                    reject(caught);
+                };
+                const onListening = () => {
+                    server.off('error', onError);
+                    resolve();
+                };
+                server.once('error', onError);
+                server.once('listening', onListening);
+                server.listen({ host: '0.0.0.0', port, exclusive: true });
+            });
+            const address = server.address();
+            return typeof address === 'object' && address !== null ? address.port : port;
+        }
+        catch (caught) {
+            lastError = caught;
+            if (server.listening)
+                await closeServer(server);
+        }
+    }
+    throw lastError instanceof Error ? lastError : new Error('no free LAN gateway port');
+}

package/index.js

@@ -1,19 +1,39 @@
 /** Host half of the independent `dsh-mobile-access` bundle. */
+import { LanGateway } from './gateway.js';
 import { registerMobileAccess } from './routes.js';
 import { PairingService } from './service.js';
 export const name = 'dsh-mobile-access';
 export const inject = ['webServer', 'connection'];
 /**
- * Register exactly three additive routes. No existing route, auth record,
- * profile setting, layout component, or client root is read or replaced.
+ * Register the additive routes and, only when the official listener is bound
+ * to loopback, start the optional LAN gateway. A DSH already bound to a LAN
+ * address never opens another listener.
  */
 export function apply(ctx) {
     const service = new PairingService();
+    let gateway;
+    try {
+        gateway = new LanGateway({ targetOrigin: ctx.webServer.getOrigin() });
+    }
+    catch (error) {
+        ctx.logger?.warn?.(`[mobile-access] gateway disabled: ${error instanceof Error ? error.message : String(error)}`);
+    }
     ctx.effect(() => {
-        const dispose = registerMobileAccess(ctx, service);
+        const dispose = registerMobileAccess(ctx, service, gateway);
+        if (gateway !== undefined) {
+            void gateway.start().then(() => {
+                const status = gateway?.status();
+                if (status?.running === true)
+                    ctx.logger?.info?.(`[mobile-access] LAN gateway on ${status.publicOrigin ?? 'unknown'}`);
+            }).catch((error) => {
+                ctx.logger?.warn?.(`[mobile-access] gateway failed: ${error instanceof Error ? error.message : String(error)}`);
+            });
+        }
         ctx.logger?.info?.('[mobile-access] routes registered');
         return () => {
             dispose();
+            if (gateway !== undefined)
+                void gateway.stop();
             ctx.logger?.info?.('[mobile-access] routes disposed');
         };
     }, 'mobile-access routes');

package/locale/en.json

@@ -10,6 +10,8 @@
     "statusLoading": "Reading pairing state",
     "statusReady": "Ready",
     "statusLoopback": "Loopback only",
+    "statusGateway": "LAN gateway on",
+    "statusGatewayStarting": "Starting LAN gateway",
     "statusLocked": "Code locked",
     "statusExpired": "Code expired",
     "statusError": "State unavailable",
@@ -40,6 +42,9 @@
     "step3": "After pairing, use Safari Share → “Add to Home Screen”.",
     "diagnosticsTitle": "Connection diagnostics",
     "bindLabel": "Mac listener",
+    "gatewayLabel": "LAN gateway",
+    "gatewayOn": "On",
+    "gatewayOff": "Off",
     "deviceLabel": "This device",
     "deviceIOS": "iPhone / iPad",
     "deviceOther": "Computer or other device",
@@ -49,7 +54,10 @@
     "secureYes": "Secure context",
     "secureNo": "HTTP insecure context (clipboard fallback enabled)",
     "loopbackTitle": "The iPhone cannot connect yet",
-    "loopbackBody": "DSH is listening on loopback only. Set Host webserver.host to this Mac’s LAN IPv4 address, then restart DSH manually.",
+    "loopbackBody": "DSH is listening on loopback only. The plugin is starting a LAN gateway; if it fails, diagnostics appear here. The Mac keeps using 127.0.0.1.",
+    "gatewayTitle": "LAN gateway is on",
+    "gatewayBody": "DSH still listens only on 127.0.0.1. The iPhone uses the LAN address below; the Mac keeps its original address.",
+    "gatewayStartingTitle": "Starting LAN gateway",
     "httpTitle": "About HTTP",
     "httpBody": "This is plain-HTTP LAN access. DSH already handles UUIDs and most copy buttons; this plugin adds a fallback for older direct navigator.clipboard calls on iPhone.",
     "selftestTitle": "Browser capability self-test",

package/locale/zh.json

@@ -10,6 +10,8 @@
     "statusLoading": "正在读取配对状态",
     "statusReady": "已就绪",
     "statusLoopback": "仅回环地址",
+    "statusGateway": "局域网网关已开启",
+    "statusGatewayStarting": "正在开启局域网网关",
     "statusLocked": "配对码已锁定",
     "statusExpired": "配对码已过期",
     "statusError": "暂时无法读取状态",
@@ -40,6 +42,9 @@
     "step3": "配对成功后会自动进入 DSH；再点 Safari 分享按钮，选择「添加到主屏幕」。",
     "diagnosticsTitle": "连接诊断",
     "bindLabel": "Mac 监听地址",
+    "gatewayLabel": "局域网网关",
+    "gatewayOn": "已开启",
+    "gatewayOff": "未开启",
     "deviceLabel": "当前设备",
     "deviceIOS": "iPhone / iPad",
     "deviceOther": "电脑或其他设备",
@@ -49,7 +54,10 @@
     "secureYes": "安全上下文",
     "secureNo": "HTTP 非安全上下文（剪贴板回退已启用）",
     "loopbackTitle": "iPhone 现在无法连接",
-    "loopbackBody": "DSH 只监听了回环地址（localhost / 127.0.0.1）。请把 Host 的 webserver.host 改为这台 Mac 的局域网 IPv4 地址，然后由你手动重启 DSH。",
+    "loopbackBody": "DSH 只监听回环地址；插件正在尝试开启局域网网关。若失败，诊断信息会显示在这里，Mac 仍可正常使用 127.0.0.1。",
+    "gatewayTitle": "局域网网关已开启",
+    "gatewayBody": "DSH 仍只监听 127.0.0.1；iPhone 通过下面的局域网地址访问。Mac 继续用原地址，不受影响。",
+    "gatewayStartingTitle": "正在开启局域网网关",
     "httpTitle": "关于 HTTP 访问",
     "httpBody": "当前是局域网 HTTP。DSH 已为 UUID 和多数复制按钮提供兼容实现；本插件会在 iPhone 上补齐直接调用 navigator.clipboard 的旧代码。",
     "selftestTitle": "浏览器能力自检",

package/package.json

@@ -1,9 +1,17 @@
 {
   "name": "dsh-mobile-access",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Independent DSH bundle that pairs iPhones and iPads with the official DeepSeek Harness Web GUI over the local network.",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/abbaababa/dsh-mobile-access.git"
+  },
+  "homepage": "https://github.com/abbaababa/dsh-mobile-access#readme",
+  "bugs": {
+    "url": "https://github.com/abbaababa/dsh-mobile-access/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -20,6 +28,7 @@
     "index.js",
     "service.js",
     "routes.js",
+    "gateway.js",
     "html.js",
     "types.js",
     "client.js",
@@ -48,5 +57,9 @@
         "@deepseek-ai/dsh-client-ui-sidebar"
       ]
     }
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.5",
+    "typescript": "6.0.3"
   }
 }