dsh-mobile 0.2.2 → 0.3.0

package/lib/index.mjs

@@ -13,11 +13,12 @@ import { createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { createGzip } from "node:zlib";
+import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
 import { Service } from "@deepseek-ai/cordis";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
+import { lookup } from "node:dns/promises";
 import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
@@ -708,7 +709,8 @@ const SUPPORTED_DSH_VERSIONS = Object.freeze([
 	"0.1.0-rc.5",
 	"0.1.0-rc.6",
 	"0.1.0-rc.7",
-	"0.1.1-rc.2"
+	"0.1.1-rc.2",
+	"0.1.2-alpha.1"
 ]);
 /**
 * Reject an unverified DeepSeek Harness Host before opening the LAN listener.
@@ -720,10 +722,10 @@ function assertSupportedDshVersion(version) {
 }
 //#endregion
 //#region src/private-file.ts
-const execFile$2 = promisify(execFile);
+const execFile$3 = promisify(execFile);
 let userSidTask;
 async function currentWindowsUserSid() {
-	userSidTask ??= execFile$2("whoami.exe", [
+	userSidTask ??= execFile$3("whoami.exe", [
 		"/user",
 		"/fo",
 		"csv",
@@ -743,7 +745,7 @@ async function restrictPrivateFile(file, mode = 384) {
 	await chmod(file, mode);
 	if (process.platform !== "win32") return;
 	const userSid = await currentWindowsUserSid();
-	await execFile$2("icacls.exe", [
+	await execFile$3("icacls.exe", [
 		file,
 		"/inheritance:r",
 		"/grant:r",
@@ -985,7 +987,11 @@ const CSRF_COOKIE = "dsh_ma_csrf";
 const CSRF_HEADER = "x-dsh-mobile-csrf";
 const LOCAL_ADMIN_PREFIX = "/api/mobile-access";
 const AUTH_PREFIX = "/mobile-access";
-const WS_PATHS = /* @__PURE__ */ new Set(["/api/events.mux", "/api/events.host"]);
+const WS_PATHS = /* @__PURE__ */ new Set([
+	"/api/events.mux",
+	"/api/events.host",
+	"/api/remote.mux"
+]);
 /** Terse request failure safe to expose without internal diagnostics. */
 var HttpError = class extends Error {
 	status;
@@ -1146,6 +1152,13 @@ function assertLocalAdminTrust(request, requireBrowserOrigin) {
 	if (requireBrowserOrigin && site !== void 0 && (origin === void 0 || site !== "same-origin")) throw new HttpError(403, "forbidden");
 }
 //#endregion
+//#region src/version.ts
+const manifest = createRequire(import.meta.url)("../package.json");
+/** Version of the installed DSH Mobile plugin package. */
+const DSH_MOBILE_VERSION = typeof manifest.version === "string" ? manifest.version : "unknown";
+/** Oldest Android App release supported by this plugin generation. */
+const MINIMUM_ANDROID_APP_VERSION = "0.2.2";
+//#endregion
 //#region src/computer-images.ts
 const MAX_ENTRIES = 500;
 const MAX_IMAGE_BYTES = 20971520;
@@ -1751,11 +1764,33 @@ const DISCOVERY_INTERVAL_MS = 3e3;
 const MDNS_SERVICE_TYPE = "dsh-mobile";
 const MOBILE_LAYOUT_MODULE = "@deepseek-ai/dsh-client-ui-layout";
 const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
+const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
+const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
+const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
+const MAX_MOBILE_BOOT_BATCHES = 8;
+const UPSTREAM_AUTH_REFRESH_MARGIN_MS = 6e4;
+const UPSTREAM_COOKIE_PAIR = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+=[\x21-\x3A\x3C-\x7E]*$/u;
+const CUSTOM_STYLE_FALLBACK = "/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n";
+const CUSTOM_SCRIPT_FALLBACK = "window.dshMobile?.register(() => undefined)\n";
 const MOBILE_CLIENT_MODULE = "dsh-mobile";
 const CONNECTION_MODULE = "@deepseek-ai/dsh-client-connection";
 const RUNTIME_MODULE = "@deepseek-ai/dsh-client-runtime";
+const RENDERER_MODULE = "@deepseek-ai/dsh-client-ui-renderer";
+const SIDEBAR_MODULE = "@deepseek-ai/dsh-client-ui-sidebar";
 const SETTINGS_MODULE = "@deepseek-ai/dsh-client-ui-settings";
-const MOBILE_LAYOUT_DEPENDENCIES = Object.freeze([RUNTIME_MODULE, "@deepseek-ai/dsh-client-ui-theme"]);
+const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
+	slots: RUNTIME_MODULE,
+	dependencies: Object.freeze([RUNTIME_MODULE, "@deepseek-ai/dsh-client-ui-theme"])
+}), Object.freeze({
+	slots: RENDERER_MODULE,
+	dependencies: Object.freeze([
+		"@deepseek-ai/dsh-client-locale",
+		RENDERER_MODULE,
+		"@deepseek-ai/dsh-client-ui-session",
+		"@deepseek-ai/dsh-client-ui-theme"
+	])
+})]);
+const MOBILE_CSRF_FETCH_BOOTSTRAP = `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${CSRF_COOKIE}=`)};const token=document.cookie.split(';').map(value=>value.trim()).find(value=>value.startsWith(prefix))?.slice(prefix.length);if(token!==undefined)headers.set(${JSON.stringify(CSRF_HEADER)},token)}return nativeFetch(input,{...init,headers})};})();`;
 const PAIR_PAGE = `<!doctype html>
 <html lang="en">
 <meta charset="utf-8">
@@ -1773,6 +1808,7 @@ const PAIR_PAGE = `<!doctype html>
 <script src="/mobile-access/pair.js" defer><\/script>
 </html>
 `;
+const gzipBuffer = promisify(gzip);
 function ensureMobileViewport(html) {
 	const match = /<meta\b(?=[^>]*\bname\s*=\s*["']viewport["'])[^>]*>/iu.exec(html);
 	if (match === null) {
@@ -1786,18 +1822,24 @@ function ensureMobileViewport(html) {
 	const next = content.test(match[0]) ? match[0].replace(content, (_whole, quote, value) => `content=${quote}${value},viewport-fit=cover${quote}`) : match[0].replace(/\s*\/?>$/u, " content=\"width=device-width,initial-scale=1,viewport-fit=cover\">");
 	return `${html.slice(0, match.index)}${next}${html.slice(match.index + match[0].length)}`;
 }
-function orderAuthenticatedSettings(entries) {
+function orderAuthenticatedSettings(entries, slotsProvider) {
 	const mobile = entries.filter((entry) => entry !== null && typeof entry === "object" && entry.id === MOBILE_CLIENT_MODULE);
 	const settings = entries.filter((entry) => entry !== null && typeof entry === "object" && entry.id === SETTINGS_MODULE);
 	if (mobile.length === 0 || settings.length === 0) return;
 	if (mobile.length !== 1 || settings.length !== 1) throw new Error("upstream DSH mobile settings graph is ambiguous");
-	if (!Array.isArray(mobile[0]?.inject) || !mobile[0].inject.includes(CONNECTION_MODULE) || !mobile[0].inject.includes(RUNTIME_MODULE)) throw new Error("dsh-mobile client has unsupported dependencies");
-	if (!Array.isArray(settings[0]?.inject) || !settings[0].inject.includes(CONNECTION_MODULE) || !settings[0].inject.includes(RUNTIME_MODULE)) throw new Error("upstream DSH settings module has unsupported dependencies");
-	mobile[0].inject = [CONNECTION_MODULE, RUNTIME_MODULE];
+	if (!Array.isArray(mobile[0]?.inject) || !mobile[0].inject.includes(CONNECTION_MODULE) || !mobile[0].inject.includes(SIDEBAR_MODULE)) throw new Error("dsh-mobile client has unsupported dependencies");
+	if (!Array.isArray(settings[0]?.inject) || !settings[0].inject.includes(CONNECTION_MODULE)) throw new Error("upstream DSH settings module has unsupported dependencies");
+	mobile[0].inject = [CONNECTION_MODULE, slotsProvider];
 	if (!settings[0].inject.includes(MOBILE_CLIENT_MODULE)) settings[0].inject = [...settings[0].inject, MOBILE_CLIENT_MODULE];
 }
-/** Replace only DSH's layout client module while retaining its complete plugin graph. */
-function rewriteMobileIndex(html) {
+function revisionedMobileBatchPath(entries) {
+	const key = createHash("sha256").update(DSH_MOBILE_VERSION).update(JSON.stringify(entries)).digest("hex");
+	return {
+		key,
+		path: `${MOBILE_BOOT_BATCH_PREFIX}${key}.js`
+	};
+}
+function rewriteMobileIndexWithBatch(html) {
 	const assignment = /(?:window\.__DSH_BOOT__|globalThis\["__DSH_BOOT__"\])\s*=\s*/u.exec(html);
 	if (assignment?.index === void 0) throw new Error("upstream DSH index has no boot manifest");
 	const start = assignment.index;
@@ -1810,12 +1852,55 @@ function rewriteMobileIndex(html) {
 	const entries = parsed.entries;
 	const layout = entries.filter((entry) => entry !== null && typeof entry === "object" && entry.id === MOBILE_LAYOUT_MODULE);
 	if (layout.length !== 1 || typeof layout[0]?.url !== "string" || typeof layout[0].rev !== "string") throw new Error("upstream DSH boot manifest has no unique layout module");
-	if (!Array.isArray(layout[0].inject) || MOBILE_LAYOUT_DEPENDENCIES.some((dependency) => !layout[0]?.inject?.includes(dependency))) throw new Error("upstream DSH layout module has unsupported dependencies");
+	if (!Array.isArray(layout[0].inject)) throw new Error("upstream DSH layout module has unsupported dependencies");
+	const dependencyProfile = MOBILE_LAYOUT_DEPENDENCY_PROFILES.find((profile) => profile.dependencies.every((dependency) => layout[0]?.inject?.includes(dependency)));
+	if (dependencyProfile === void 0) throw new Error("upstream DSH layout module has unsupported dependencies");
 	layout[0].url = MOBILE_LAYOUT_PATH;
-	layout[0].rev = "dsh-mobile-layout-v1";
-	orderAuthenticatedSettings(entries);
-	const replacement = `window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment[0]}${JSON.stringify(parsed)};`;
-	return ensureMobileViewport(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`);
+	layout[0].rev = `dsh-mobile-layout-${DSH_MOBILE_VERSION}`;
+	orderAuthenticatedSettings(entries, dependencyProfile.slots);
+	let mobileBatch;
+	if (parsed.batches !== void 0) {
+		if (!Array.isArray(parsed.batches)) throw new Error("upstream DSH boot manifest batches are malformed");
+		const batches = parsed.batches;
+		const entryById = new Map(entries.map((entry) => [entry.id, entry]));
+		if (entryById.size !== entries.length) throw new Error("upstream DSH boot manifest has duplicate entries");
+		const layoutBatches = [];
+		for (const batch of batches) {
+			if (batch === null || typeof batch !== "object" || batch.phase !== "bootstrap" && batch.phase !== "application" || typeof batch.url !== "string" || typeof batch.rev !== "string" || !Array.isArray(batch.entries) || batch.entries.length === 0 || batch.entries.some((id) => typeof id !== "string" || !entryById.has(id))) throw new Error("upstream DSH boot manifest batches are malformed");
+			if (batch.entries.includes(MOBILE_LAYOUT_MODULE)) layoutBatches.push(batch);
+		}
+		if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
+		const layoutBatch = layoutBatches[0];
+		const planEntries = layoutBatch.entries.map((id) => {
+			const entry = entryById.get(id);
+			if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
+			return Object.freeze({
+				id,
+				url: entry.url,
+				rev: entry.rev
+			});
+		});
+		const revision = revisionedMobileBatchPath(planEntries);
+		layoutBatch.url = revision.path;
+		layoutBatch.rev = revision.key;
+		mobileBatch = Object.freeze({
+			...revision,
+			entries: Object.freeze(planEntries)
+		});
+		parsed.rev = createHash("sha256").update(JSON.stringify({
+			entries,
+			batches
+		})).digest("hex").slice(0, 16);
+	}
+	const replacement = `${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment[0]}${JSON.stringify(parsed)};`;
+	return Object.freeze({
+		html: ensureMobileViewport(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`),
+		...mobileBatch === void 0 ? {} : { batch: mobileBatch }
+	});
+}
+/** Replace only DSH's layout client module while retaining its complete plugin graph. */
+function rewriteMobileIndex(html) {
+	return rewriteMobileIndexWithBatch(html).html;
 }
 const PAIR_SCRIPT = `(() => {
   const form = document.getElementById('pair-form')
@@ -2083,6 +2168,20 @@ function shouldCompressResponse(request, response) {
 	const pathname = request.url?.split("?", 1)[0] ?? "";
 	return (request.method === "GET" && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) || request.method === "POST" && pathname === SESSION_HISTORY_PATH) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && acceptsGzip(request.headers["accept-encoding"]) && isCompressibleContentType(response.headers["content-type"]);
 }
+function revisionedStaticCacheControl(request) {
+	if (request.method !== "GET" && request.method !== "HEAD") return void 0;
+	let target;
+	try {
+		target = new URL(request.url ?? "/", "https://dsh-mobile.invalid");
+	} catch {
+		return;
+	}
+	const revision = target.searchParams.get("rev");
+	const hasRevision = revision !== null && /^[a-z0-9_-]{4,128}$/iu.test(revision);
+	const hashedAsset = /^\/assets\/.*-[a-z0-9_-]{8,}\.[a-z0-9]+$/iu.test(target.pathname);
+	if (!(target.pathname.startsWith("/plugins/") && hasRevision) && !(target.pathname.startsWith("/assets/") && (hasRevision || hashedAsset))) return void 0;
+	return "private, max-age=31536000, immutable";
+}
 function isJsonRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2177,6 +2276,9 @@ function extensionTarget(pathname) {
 		path: `/${parts.join("/")}`.replace(/\/{2,}/gu, "/")
 	};
 }
+function mobileBootBatchKey(pathname) {
+	return new RegExp(`^${MOBILE_BOOT_BATCH_PREFIX.replaceAll("/", "\\/")}([a-f\\d]{64})\\.js$`, "u").exec(pathname)?.[1];
+}
 async function readBoundedBody(request, maximum) {
 	const declared = request.headers["content-length"];
 	if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > maximum)) throw new HttpError(413, "payload_too_large");
@@ -2226,6 +2328,7 @@ function extensionContentType(path) {
 var MobileAccessGateway = class {
 	config;
 	extensions;
+	upstreamAuthenticatedUrl;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -2239,15 +2342,21 @@ var MobileAccessGateway = class {
 	connectedSockets = /* @__PURE__ */ new Set();
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
+	mobileBootBatches = /* @__PURE__ */ new Map();
+	upstreamCookie;
+	upstreamCookieExpiresAt = 0;
+	upstreamCookieTask;
+	upstreamAuthRequest;
 	nextOperationId = 1;
 	closing = false;
 	started = false;
 	closeTask;
 	removeSessionListener;
 	renewLimiter;
-	constructor(config, store, extensions) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl) {
 		this.config = config;
 		this.extensions = extensions;
+		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -2543,13 +2652,24 @@ var MobileAccessGateway = class {
 	}
 	async handleExternalRequest(request, response) {
 		const target = parseRequestTarget(request.url);
-		assertExternalTrust(request, this.requirePolicy(), request.method !== "GET" && request.method !== "HEAD");
+		const policy = this.requirePolicy();
+		const isMutation = request.method !== "GET" && request.method !== "HEAD";
+		assertExternalTrust(request, policy, isMutation);
 		if (target.decodedPathname === "/api/mobile-access" || target.decodedPathname.startsWith(`/api/mobile-access/`)) throw new HttpError(404, "not_found");
 		if (request.method === "TRACE" || request.method === "CONNECT") throw new HttpError(405, "method_not_allowed");
 		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/health`) {
 			sendJson(response, 200, { ok: true }, this.tlsEnabled);
 			return;
 		}
+		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/metadata`) {
+			sendJson(response, 200, {
+				version: 1,
+				pluginVersion: DSH_MOBILE_VERSION,
+				minimumAndroidAppVersion: MINIMUM_ANDROID_APP_VERSION,
+				discoveryProtocol: DISCOVERY_PROTOCOL
+			}, this.tlsEnabled);
+			return;
+		}
 		if (target.search === "" && request.method === "GET" && target.decodedPathname === `/mobile-access/discovery`) {
 			sendJson(response, 200, {
 				deviceName: discoveryDeviceName(),
@@ -2617,22 +2737,22 @@ var MobileAccessGateway = class {
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
+		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
 		const customAsset = request.method === "GET" ? target.decodedPathname === `/mobile-access/custom.css` ? {
 			file: this.config.customCssFile,
 			contentType: "text/css; charset=utf-8",
-			fallback: "/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n"
+			fallback: CUSTOM_STYLE_FALLBACK
 		} : target.decodedPathname === `/mobile-access/custom.js` ? {
 			file: this.config.customScriptFile,
 			contentType: "text/javascript; charset=utf-8",
-			fallback: "window.dshMobile?.register(() => undefined)\n"
+			fallback: CUSTOM_SCRIPT_FALLBACK
 		} : target.decodedPathname === MOBILE_LAYOUT_PATH ? {
 			file: this.config.mobileLayoutFile,
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
 		} : void 0 : void 0;
-		if (customAsset === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST" && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
-		if (request.method === "POST" && target.decodedPathname !== "/api" && !target.decodedPathname.startsWith("/api/") && requestedExtension?.kind !== "action" && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
 		let authorization;
 		try {
 			authorization = this.authorize(request);
@@ -2652,11 +2772,16 @@ var MobileAccessGateway = class {
 			}
 			throw error;
 		}
+		if (isMutation) this.requireCsrf(request, authorization);
 		const extension = requestedExtension;
 		if (extension !== void 0) {
 			await this.handleExtensionRequest(extension, target, request, response, authorization);
 			return;
 		}
+		if (requestedMobileBootBatch !== void 0) {
+			await this.serveMobileBootBatch(requestedMobileBootBatch, request, response, authorization);
+			return;
+		}
 		if (customAsset !== void 0) {
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
@@ -2734,15 +2859,30 @@ var MobileAccessGateway = class {
 	async handleExtensionRequest(targetInfo, target, request, response, authorization) {
 		const extensions = this.extensions;
 		if (extensions === void 0) throw new HttpError(404, "not_found");
-		if (request.method !== "GET" && request.method !== "HEAD") this.requireCsrf(request, authorization);
 		if (targetInfo.kind === "manifest") {
 			if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
 				operation.signal.throwIfAborted();
+				const customRevision = async (file, fallback) => {
+					let source;
+					try {
+						source = await readFile(file, { signal: operation.signal });
+					} catch (error) {
+						if (error.code !== "ENOENT") throw error;
+						source = Buffer.from(fallback);
+					}
+					if (source.byteLength > 262144) throw new HttpError(413, "payload_too_large");
+					return createHash("sha256").update(source).digest("hex");
+				};
+				const [scriptRevision, styleRevision] = await Promise.all([customRevision(this.config.customScriptFile, CUSTOM_SCRIPT_FALLBACK), customRevision(this.config.customCssFile, CUSTOM_STYLE_FALLBACK)]);
 				const body = Buffer.from(JSON.stringify({
 					protocol: 1,
-					extensions: extensions.manifest()
+					extensions: extensions.manifest(),
+					legacy: {
+						scriptRevision,
+						styleRevision
+					}
 				}));
 				const etag = createHash("sha256").update(body).update(extensions.contentDigest()).digest("hex");
 				if (headerValue(request.headers, "if-none-match") === etag) {
@@ -2897,11 +3037,81 @@ var MobileAccessGateway = class {
 		}
 		await pipeline(result.body, new ByteLimitTransform(4194304), response);
 	}
+	/** Exchange DSH's process-local launch token for an authority-bound cookie kept inside this gateway. */
+	async upstreamCookieHeader() {
+		if (this.upstreamAuthenticatedUrl === void 0) return void 0;
+		if (this.upstreamCookie !== void 0 && this.upstreamCookieExpiresAt > Date.now() + UPSTREAM_AUTH_REFRESH_MARGIN_MS) return this.upstreamCookie;
+		if (this.upstreamCookieTask !== void 0) return this.upstreamCookieTask;
+		const task = this.exchangeUpstreamCookie();
+		this.upstreamCookieTask = task;
+		try {
+			return await task;
+		} finally {
+			if (this.upstreamCookieTask === task) this.upstreamCookieTask = void 0;
+		}
+	}
+	async exchangeUpstreamCookie() {
+		const authenticatedUrl = this.upstreamAuthenticatedUrl;
+		if (authenticatedUrl === void 0) throw new HttpError(502, "upstream_unavailable");
+		let target;
+		try {
+			target = new URL(authenticatedUrl);
+		} catch {
+			throw new HttpError(502, "upstream_unavailable");
+		}
+		if (target.origin !== this.config.upstreamOrigin.origin || target.pathname !== "/" || target.hash !== "" || target.search === "") throw new HttpError(502, "upstream_unavailable");
+		try {
+			const proxied = await new Promise((resolve, reject) => {
+				const upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/html",
+						"accept-encoding": "identity"
+					},
+					agent: false
+				});
+				this.upstreamAuthRequest = upstreamRequest;
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			await new Promise((resolve, reject) => {
+				proxied.once("end", resolve);
+				proxied.once("error", reject);
+				proxied.resume();
+			});
+			const setCookie = proxied.headers["set-cookie"]?.[0];
+			const pair = setCookie?.split(";", 1)[0];
+			const maxAgeText = setCookie === void 0 ? void 0 : /(?:^|;\s*)Max-Age=(\d+)(?:;|$)/iu.exec(setCookie)?.[1];
+			const maxAgeSeconds = maxAgeText === void 0 ? NaN : Number(maxAgeText);
+			const expiresAt = Date.now() + maxAgeSeconds * 1e3;
+			if (proxied.statusCode !== 303 || pair === void 0 || pair.length > 4096 || !UPSTREAM_COOKIE_PAIR.test(pair) || !Number.isSafeInteger(expiresAt) || maxAgeSeconds <= 0) throw new HttpError(502, "upstream_unavailable");
+			this.upstreamCookie = pair;
+			this.upstreamCookieExpiresAt = expiresAt;
+			return pair;
+		} catch (error) {
+			if (error instanceof HttpError) throw error;
+			throw new HttpError(502, "upstream_unavailable");
+		} finally {
+			this.upstreamAuthRequest?.destroy();
+			this.upstreamAuthRequest = void 0;
+		}
+	}
 	async proxyMobileIndex(request$1, response, authorization) {
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
 		try {
 			const upstreamHeaders = sanitizeRequestHeaders(request$1, this.config.upstreamOrigin);
+			const upstreamCookie = await this.upstreamCookieHeader();
+			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
 			upstreamHeaders["accept-encoding"] = "identity";
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
@@ -2932,7 +3142,9 @@ var MobileAccessGateway = class {
 			}
 			let body;
 			try {
-				body = Buffer.from(rewriteMobileIndex(Buffer.concat(chunks).toString("utf8")));
+				const rewritten = rewriteMobileIndexWithBatch(Buffer.concat(chunks).toString("utf8"));
+				if (rewritten.batch !== void 0) this.rememberMobileBootBatch(rewritten.batch);
+				body = Buffer.from(rewritten.html);
 			} catch {
 				throw new HttpError(502, "upstream_unavailable");
 			}
@@ -2956,6 +3168,128 @@ var MobileAccessGateway = class {
 			operation.release();
 		}
 	}
+	rememberMobileBootBatch(plan) {
+		const existing = this.mobileBootBatches.get(plan.key);
+		this.mobileBootBatches.delete(plan.key);
+		this.mobileBootBatches.set(plan.key, existing ?? { plan });
+		while (this.mobileBootBatches.size > MAX_MOBILE_BOOT_BATCHES) {
+			const oldest = this.mobileBootBatches.keys().next().value;
+			if (oldest === void 0) break;
+			this.mobileBootBatches.delete(oldest);
+		}
+	}
+	async serveMobileBootBatch(key, request, response, authorization) {
+		if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
+		const stored = this.mobileBootBatches.get(key);
+		if (stored === void 0) throw new HttpError(404, "not_found");
+		const operation = this.allocateRequest(authorization, response, {});
+		try {
+			const layoutStat = await stat(this.config.mobileLayoutFile);
+			if (stored.body === void 0 || stored.etag === void 0 || stored.layoutMtimeMs !== layoutStat.mtimeMs) {
+				const body = await this.assembleMobileBootBatch(stored.plan, operation.signal);
+				stored.body = body;
+				delete stored.gzipBody;
+				stored.etag = createHash("sha256").update(body).digest("hex");
+				stored.layoutMtimeMs = layoutStat.mtimeMs;
+			}
+			const compressed = acceptsGzip(request.headers["accept-encoding"]);
+			const body = compressed ? stored.gzipBody ??= await gzipBuffer(stored.body) : stored.body;
+			const etag = compressed ? `${stored.etag}-gzip` : stored.etag;
+			const headers = {
+				"Content-Type": "text/javascript; charset=utf-8",
+				"Content-Length": body.byteLength,
+				"Cache-Control": "private, no-cache",
+				ETag: etag
+			};
+			if (compressed) headers["Content-Encoding"] = "gzip";
+			addVaryAcceptEncoding(headers);
+			if (headerValue(request.headers, "if-none-match") === etag) {
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.writeHead(304, {
+					ETag: etag,
+					"Cache-Control": "private, no-cache",
+					Vary: String(headers.vary)
+				});
+				response.end();
+				return;
+			}
+			setSecurityHeaders(response, this.tlsEnabled);
+			response.writeHead(200, headers);
+			if (request.method === "HEAD") response.end();
+			else response.end(body);
+		} catch (error) {
+			if (error.code === "ENOENT") throw new HttpError(503, "mobile_frontend_unavailable");
+			throw error;
+		} finally {
+			operation.release();
+		}
+	}
+	async assembleMobileBootBatch(plan, signal) {
+		const bodies = new Array(plan.entries.length);
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < plan.entries.length) {
+				const index = cursor++;
+				const entry = plan.entries[index];
+				bodies[index] = entry.id === MOBILE_LAYOUT_MODULE ? await readFile(this.config.mobileLayoutFile, { signal }) : await this.readUpstreamClientBundle(entry.url, signal);
+				if (bodies[index].byteLength > MAX_MOBILE_BOOT_ENTRY_BYTES) throw new HttpError(502, "upstream_unavailable");
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(8, plan.entries.length) }, worker));
+		if (bodies.reduce((bytes, body) => bytes + body.byteLength + 2, 0) > MAX_MOBILE_BOOT_BATCH_BYTES) throw new HttpError(502, "upstream_unavailable");
+		return Buffer.concat(bodies.flatMap((body) => [body, Buffer.from("\n;\n")]));
+	}
+	async readUpstreamClientBundle(source, signal) {
+		if (!source.startsWith("/plugins/") || source.includes("#")) throw new HttpError(502, "upstream_unavailable");
+		const target = new URL(source, this.config.upstreamOrigin);
+		if (target.origin !== this.config.upstreamOrigin.origin) throw new HttpError(502, "upstream_unavailable");
+		let upstreamRequest;
+		const aborted = () => {
+			upstreamRequest?.destroy(/* @__PURE__ */ new Error("request aborted"));
+		};
+		signal.addEventListener("abort", aborted, { once: true });
+		try {
+			const upstreamCookie = await this.upstreamCookieHeader();
+			const proxied = await new Promise((resolve, reject) => {
+				upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/javascript",
+						"accept-encoding": "identity",
+						...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+					},
+					agent: false
+				});
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest?.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if ((proxied.statusCode ?? 502) !== 200) throw new HttpError(502, "upstream_unavailable");
+			const chunks = [];
+			let bytes = 0;
+			for await (const chunk of proxied) {
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				bytes += buffer.byteLength;
+				if (bytes > MAX_MOBILE_BOOT_ENTRY_BYTES) throw new HttpError(502, "upstream_unavailable");
+				chunks.push(buffer);
+			}
+			return Buffer.concat(chunks);
+		} catch (error) {
+			if (error instanceof HttpError) throw error;
+			throw new HttpError(502, "upstream_unavailable");
+		} finally {
+			signal.removeEventListener("abort", aborted);
+			upstreamRequest?.destroy();
+		}
+	}
 	allocateRequest(authorization, response, upstream) {
 		if (this.activeRequests.size >= this.config.maxActiveRequests) throw new HttpError(429, "busy");
 		const id = this.nextOperationId++;
@@ -2991,6 +3325,8 @@ var MobileAccessGateway = class {
 		try {
 			const bufferedBody = request$2.method === "POST" && request$2.url?.split("?", 1)[0] === SESSION_HISTORY_PATH ? mobileHistoryRequestBody(request$2, await readBoundedBody(request$2, this.config.maxBodyBytes)) : void 0;
 			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			const upstreamCookie = await this.upstreamCookieHeader();
+			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
 			if (bufferedBody !== void 0) upstreamHeaders["content-length"] = String(bufferedBody.byteLength);
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
@@ -3017,6 +3353,8 @@ var MobileAccessGateway = class {
 			});
 			setSecurityHeaders(response, this.tlsEnabled);
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			const cacheControl = revisionedStaticCacheControl(request$2);
+			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
 			const compressed = shouldCompressResponse(request$2, proxied);
 			if (compressed) {
 				delete headers["accept-ranges"];
@@ -3132,6 +3470,7 @@ var MobileAccessGateway = class {
 		if (decodedKey.length !== 16 || decodedKey.toString("base64") !== key) throw new HttpError(400, "bad_request");
 		const authorization = this.authorize(request);
 		if (this.activeWebSockets.size >= this.config.maxWebSockets) throw new HttpError(429, "busy");
+		const upstreamCookie = await this.upstreamCookieHeader();
 		const upstream = connect({
 			host: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 			port: Number(this.config.upstreamOrigin.port)
@@ -3190,6 +3529,7 @@ var MobileAccessGateway = class {
 				`Sec-WebSocket-Key: ${key}`,
 				"Sec-WebSocket-Version: 13"
 			];
+			if (upstreamCookie !== void 0) requestLines.push(`Cookie: ${upstreamCookie}`);
 			const protocol = headerValue(request.headers, "sec-websocket-protocol");
 			const extensions = headerValue(request.headers, "sec-websocket-extensions");
 			if (protocol !== void 0) requestLines.push(`Sec-WebSocket-Protocol: ${protocol}`);
@@ -3289,6 +3629,8 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		this.upstreamAuthRequest?.destroy();
+		this.upstreamAuthRequest = void 0;
 		this.removeSessionListener();
 		const accessClose = this.access.close();
 		for (const request of this.activeRequests.values()) request.abort();
@@ -3452,6 +3794,190 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
+//#region src/diagnostics.ts
+const execFile$2 = promisify(execFile);
+const REMOTE_ERROR_GUIDANCE = Object.freeze({
+	component_missing: "重新安装完整插件包。",
+	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
+	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
+	funnel_start_failed: "重新打开授权页并允许 Funnel。",
+	funnel_start_timeout: "检查网络后点击“重新连接”。",
+	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
+	sidecar_launch_failed: "重新安装完整插件包后重试。",
+	sidecar_stopped: "点击“重新连接”。",
+	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	control_channel_failed: "点击“重新连接”。",
+	cpolar_component_missing: "先安装 cpolar 官方组件。",
+	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
+	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
+	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
+	cpolar_start_timeout: "检查网络后点击“重新连接”。",
+	cpolar_stopped: "点击“重新连接”。",
+	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
+});
+function check(id, status, label, detail, action) {
+	return Object.freeze({
+		id,
+		status,
+		label,
+		detail,
+		...action === void 0 ? {} : { action }
+	});
+}
+function maskLanOrigin(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const url = new URL(origin);
+		const octets = url.hostname.split(".");
+		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
+		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
+	} catch {
+		return "地址格式无效";
+	}
+}
+function remoteSuffix(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const hostname = new URL(origin).hostname;
+		if (hostname.endsWith(".ts.net")) return "*.ts.net";
+		for (const suffix of [
+			".cpolar.cn",
+			".cpolar.io",
+			".cpolar.top",
+			".cpolar.com"
+		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
+		return "公共 HTTPS 地址";
+	} catch {
+		return "地址格式无效";
+	}
+}
+function defaultFirewallProbe(platform = process.platform) {
+	return async (port) => {
+		if (platform !== "win32") return { state: "not-applicable" };
+		if (port === void 0) return { state: "unknown" };
+		const script = [
+			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
+			"$ready = $true",
+			"$specs | ForEach-Object {",
+			"  $spec = $_",
+			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
+			"  if ($null -eq $rule) { $ready = $false; return }",
+			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
+			`  $matching = @($filters | Where-Object { $_.Protocol -eq $spec.Protocol -and ($_.LocalPort -eq 'Any' -or $_.LocalPort -eq '${String(port)}') })`,
+			"  if ($matching.Count -eq 0) { $ready = $false }",
+			"}",
+			"if ($ready) { 'ready' } else { 'missing' }"
+		].join("; ");
+		try {
+			return { state: (await execFile$2("powershell.exe", [
+				"-NoProfile",
+				"-NonInteractive",
+				"-Command",
+				script
+			], {
+				encoding: "utf8",
+				timeout: 3e3,
+				windowsHide: true
+			})).stdout.trim() === "ready" ? "ready" : "missing" };
+		} catch {
+			return { state: "unknown" };
+		}
+	};
+}
+/** Allow remote relays enough time to answer without making diagnostics unbounded. */
+function remoteDiagnosticTimeoutMs(origin) {
+	const hostname = new URL(origin).hostname.toLowerCase();
+	if (hostname.endsWith(".ts.net") || hostname.includes(".cpolar.")) return 1e4;
+	return 5e3;
+}
+async function defaultRemoteProbe(origin) {
+	if (origin === void 0) return { state: "not-applicable" };
+	const hostname = new URL(origin).hostname;
+	const started = performance.now();
+	try {
+		const response = await fetch(new URL("/mobile-access/health", origin), {
+			cache: "no-store",
+			redirect: "error",
+			signal: AbortSignal.timeout(remoteDiagnosticTimeoutMs(origin))
+		});
+		const latencyMs = Math.max(0, Math.round(performance.now() - started));
+		if (response.status === 429) return {
+			state: "rate-limited",
+			latencyMs
+		};
+		return response.ok ? {
+			state: "ready",
+			latencyMs
+		} : {
+			state: "unreachable",
+			latencyMs
+		};
+	} catch {
+		let fakeIp = false;
+		try {
+			fakeIp = (await lookup(hostname, { all: true })).some(({ address }) => {
+				const [first, second] = address.split(".").map(Number);
+				return first === 198 && (second === 18 || second === 19);
+			});
+		} catch {}
+		return {
+			state: "unreachable",
+			...fakeIp ? { fakeIp: true } : {}
+		};
+	}
+}
+function reportLine(entry) {
+	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
+}
+/** Run bounded read-only checks and return a report safe to paste into an issue. */
+async function collectConnectionDiagnostics(snapshot, probes = {}) {
+	const checks = [];
+	const remoteProbe = snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
+	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
+	checks.push(check("versions", "ok", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
+	if (snapshot.lan.networkError !== void 0) checks.push(check("network", "error", "局域网网卡", "已保存的网卡当前不可用。", "重新运行 dsh-mobile setup。"));
+	else if (snapshot.lan.configuredInterface !== void 0) checks.push(check("network", "ok", "局域网网卡", `正在跟随 ${snapshot.lan.interfaceName ?? snapshot.lan.configuredInterface}。`));
+	else checks.push(check("network", "info", "局域网网卡", "当前使用固定网络配置。"));
+	if (snapshot.lan.running && snapshot.lan.origin !== void 0) checks.push(check("lan", "ok", "局域网网关", `已监听 ${maskLanOrigin(snapshot.lan.origin)}，配对入口可用。`));
+	else checks.push(check("lan", "info", "局域网网关", "当前未开启。", "需要手机直连时开启局域网访问。"));
+	if (firewall.state === "ready") checks.push(check("firewall", "ok", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
+	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
+	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
+	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "远程通道", "当前未启用。"));
+	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
+		if (remoteObservation.state === "ready") checks.push(check("remote", "ok", "远程通道", `${snapshot.remote.provider} 公共地址 ${remoteSuffix(snapshot.remote.origin)} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`));
+		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "远程通道", "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。"));
+		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。"));
+		else checks.push(check("remote", "error", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。"));
+	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") checks.push(check("remote", "warning", "远程通道", snapshot.remote.state === "needs-login" ? "等待完成 Tailscale 登录。" : "仍在建立连接。", snapshot.remote.state === "needs-login" ? "返回远程页继续登录。" : "等待片刻后重新检查。"));
+	else checks.push(check("remote", "error", "远程通道", `连接未建立（${snapshot.remote.errorCode ?? snapshot.remote.state}）。`, REMOTE_ERROR_GUIDANCE[snapshot.remote.errorCode ?? ""] ?? "返回远程页点击“重新连接”。"));
+	checks.push(check("phone-network", "info", "手机网络", "电脑无法判断路由器是否隔离了手机。", "局域网仍失败时，确认手机与电脑在同一网络，并关闭访客网络或 AP 隔离。"));
+	const overall = checks.some((entry) => entry.status === "error") ? "error" : checks.some((entry) => entry.status === "warning") ? "attention" : "ok";
+	const summary = overall === "ok" ? "连接基础检查正常。" : overall === "attention" ? "发现需要留意的项目。" : "发现会影响连接的问题。";
+	const report = [
+		"DSH Mobile 诊断报告",
+		`生成时间: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`版本: plugin=${DSH_MOBILE_VERSION}; dsh=${snapshot.dshVersion}; min-app=${MINIMUM_ANDROID_APP_VERSION}`,
+		`LAN: ${snapshot.lan.running ? "on" : "off"}; endpoint=${maskLanOrigin(snapshot.lan.origin)}`,
+		`Remote: provider=${snapshot.remote.provider}; state=${snapshot.remote.state}; endpoint=${remoteSuffix(snapshot.remote.origin)}`,
+		...checks.map(reportLine)
+	].join("\n");
+	return Object.freeze({
+		version: 1,
+		generatedAt: Date.now(),
+		overall,
+		versions: Object.freeze({
+			plugin: DSH_MOBILE_VERSION,
+			dsh: snapshot.dshVersion,
+			minimumAndroidApp: MINIMUM_ANDROID_APP_VERSION
+		}),
+		summary,
+		checks: Object.freeze(checks),
+		report
+	});
+}
+//#endregion
 //#region src/mobile-guide.ts
 /**
 * Instructions handed to the DSH agent when the user runs `/mobile <task>`.
@@ -3487,6 +4013,7 @@ const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机
 //#endregion
 //#region src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
+const FUNNEL_START_TIMEOUT_MS = 45e3;
 function publicStatus$1(status) {
 	return Object.freeze({
 		enabled: status.enabled,
@@ -3580,6 +4107,7 @@ var FunnelController = class {
 		state: "off"
 	});
 	queue = Promise.resolve();
+	startTimer;
 	constructor(options) {
 		this.options = options;
 		if (!isAbsolute(options.executable) || !isAbsolute(options.stateDirectory)) throw new Error("Funnel paths must be absolute");
@@ -3718,6 +4246,11 @@ var FunnelController = class {
 			windowsHide: true
 		});
 		this.child = child;
+		this.clearStartTimer();
+		this.startTimer = setTimeout(() => {
+			this.enqueue(() => this.failGeneration(generation, "funnel_start_timeout"));
+		}, FUNNEL_START_TIMEOUT_MS);
+		this.startTimer.unref();
 		child.stderr.resume();
 		child.stdout.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => {
@@ -3756,6 +4289,7 @@ var FunnelController = class {
 	}
 	async handleEvent(generation, event) {
 		if (generation !== this.generation || !this.enabled) return;
+		this.clearStartTimer();
 		if (event.type === "login") {
 			this.publish({
 				enabled: true,
@@ -3825,6 +4359,7 @@ var FunnelController = class {
 		await this.stopProcessAndGateway();
 	}
 	async stopProcessAndGateway() {
+		this.clearStartTimer();
 		const child = this.child;
 		this.child = void 0;
 		child?.stdin.end();
@@ -3850,6 +4385,11 @@ var FunnelController = class {
 		this.gatewayValue = void 0;
 		await gateway?.close();
 	}
+	clearStartTimer() {
+		if (this.startTimer === void 0) return;
+		clearTimeout(this.startTimer);
+		this.startTimer = void 0;
+	}
 };
 /** Locate the current platform's bundled Funnel executable, with one local development override. */
 function funnelExecutable(importMetaUrl, environment = process.env) {
@@ -4789,8 +5329,16 @@ async function materializeManagedSetup(setup, table) {
 //#region src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
-/** The stock WebServer serves the control card; commands exposes /mobile to the DSH agent. */
-const inject = ["webServer", "commands"];
+/** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
+const inject = [
+	"webServer",
+	"commands",
+	"connection"
+];
+function upstreamAuthenticatedUrl(ctx, upstreamOrigin) {
+	const connection = ctx.connection;
+	return typeof connection?.authenticatedUrl === "function" ? connection.authenticatedUrl(upstreamOrigin.origin) : void 0;
+}
 function installedDshVersion() {
 	const manifest = createRequire(import.meta.url)("@deepseek-ai/dsh-host-webserver/package.json");
 	if (manifest === null || typeof manifest !== "object") return void 0;
@@ -4922,10 +5470,12 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 }
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 async function apply(ctx, config) {
-	assertSupportedDshVersion(installedDshVersion());
+	const dshVersion = installedDshVersion();
+	assertSupportedDshVersion(dshVersion);
 	const loaded = await loadSetup(config);
 	const mobileAccess = createMobileAccessService(ctx);
 	const template = loopbackTemplate(loaded);
+	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, template.upstreamOrigin);
 	const instanceId = await stableInstanceId(loaded, template);
 	const stateDirectory = dirname(template.stateFile);
 	const remoteDirectory = join(stateDirectory, "remote");
@@ -4966,7 +5516,7 @@ async function apply(ctx, config) {
 	let lanGateway;
 	const startGateway = async (candidateConfig) => {
 		const resolved = parseGatewayConfig(candidateConfig);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl);
 		await candidate.start();
 		lanGateway = candidate;
 		return { close: async () => {
@@ -5006,7 +5556,7 @@ async function apply(ctx, config) {
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl);
 		await candidate.start();
 		return candidate;
 	};
@@ -5054,6 +5604,39 @@ async function apply(ctx, config) {
 		origin: lanGateway?.address().origin,
 		...lanGateway === void 0 ? {} : { extensions: lanGateway.extensionStatus() }
 	});
+	const diagnosticsPayload = async () => {
+		let interfaceName;
+		let networkError;
+		if (loaded.kind === "managed") try {
+			interfaceName = selectLanNetwork(void 0, loaded.setup.networkInterface).name;
+		} catch {
+			networkError = "network_interface_unavailable";
+		}
+		const remote = remoteController().status();
+		return collectConnectionDiagnostics({
+			dshVersion,
+			lan: {
+				running: lanController.isRunning(),
+				...lanGateway === void 0 ? {} : {
+					origin: lanGateway.address().origin,
+					port: lanGateway.address().port
+				},
+				...loaded.kind === "managed" ? {
+					configuredInterface: loaded.setup.networkInterface,
+					port: loaded.setup.listenPort
+				} : {},
+				...interfaceName === void 0 ? {} : { interfaceName },
+				...networkError === void 0 ? {} : { networkError }
+			},
+			remote: {
+				provider: remoteProvider,
+				running: remote.enabled,
+				state: remote.state,
+				...remote.origin === void 0 ? {} : { origin: remote.origin },
+				...remote.errorCode === void 0 ? {} : { errorCode: remote.errorCode }
+			}
+		});
+	};
 	const adminRoute = {
 		kind: "prefix",
 		path: LOCAL_ADMIN_PREFIX,
@@ -5067,6 +5650,10 @@ async function apply(ctx, config) {
 					sendJson(response, 200, lanPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/diagnostics`) {
+					sendJson(response, 200, await diagnosticsPayload(), false);
+					return;
+				}
 				if (request.method === "POST" && lanControl) {
 					const body = await readJsonObject(request, 4096);
 					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");