dsh-mobile 0.4.0 → 0.4.2

package/lib/client.js

@@ -20,7 +20,6 @@ window.__ModuleLoader__.load({
 				pluginUpdatedRestart: "Updated to v{version}. Restart DSH to apply it.",
 				pluginUpdateFailed: "Update failed: {error}",
 				updateTo: "Update to v{version}",
-				updateNotesHeading: "What’s new",
 				updateNotice: "Restart DSH after installing. Existing apps and paired devices need no re-pairing; unsure about the desktop version? Check the README compatibility table.",
 				updateNotesEmpty: "No release notes fetched — updating is still fine; full details on the GitHub Release page.",
 				updateNow: "Update now",
@@ -39,6 +38,7 @@ window.__ModuleLoader__.load({
 				clearAllDevices: "Clear all devices",
 				pairingQr: "Pairing QR code",
 				remoteIntro: "Choose the remote channel that suits you. Switching or disabling remote access does not affect the local network.",
+				httpFrameWarning: "HTTP pages may be embedded for compatibility, but their contents are unencrypted and can be altered. Use HTTPS for sensitive work.",
 				chooseProvider: "Choose connection method",
 				currentProvider: "Current connection",
 				remoteStateOff: "Off",
@@ -188,7 +188,6 @@ window.__ModuleLoader__.load({
 				pluginUpdatedRestart: "Aggiornato alla v{version}. Riavvia DSH per applicarlo.",
 				pluginUpdateFailed: "Aggiornamento non riuscito: {error}",
 				updateTo: "Aggiorna alla v{version}",
-				updateNotesHeading: "Novità",
 				updateNotice: "Riavvia DSH dopo l’installazione. Le app esistenti e i dispositivi già associati non richiedono ri-associazione; in caso di dubbi sulla versione desktop, consulta la tabella di compatibilità nel README.",
 				updateNotesEmpty: "Note di rilascio non recuperate — l’aggiornamento resta possibile; dettagli nella pagina Release su GitHub.",
 				updateNow: "Aggiorna ora",
@@ -207,6 +206,7 @@ window.__ModuleLoader__.load({
 				clearAllDevices: "Rimuovi tutti i dispositivi",
 				pairingQr: "Codice QR di abbinamento",
 				remoteIntro: "Scegli il canale remoto più adatto. Cambiare o disattivare l’accesso remoto non influisce sulla rete locale.",
+				httpFrameWarning: "Le pagine HTTP possono essere incorporate per compatibilità, ma i contenuti non sono cifrati e possono essere alterati. Usa HTTPS per le attività sensibili.",
 				chooseProvider: "Scegli metodo di connessione",
 				currentProvider: "Connessione attuale",
 				remoteStateOff: "Disattivata",
@@ -358,7 +358,6 @@ window.__ModuleLoader__.load({
 			pluginUpdatedRestart: "插件已更新至 v{version}，重启 DSH 后生效。",
 			pluginUpdateFailed: "更新失败：{error}",
 			updateTo: "更新到 v{version}",
-			updateNotesHeading: "更新内容",
 			updateNotice: "安装后需重启 DSH。现有 App 与已配对设备无需重新配对；电脑端版本不确定时，先对照 README 兼容表。",
 			updateNotesEmpty: "未取到最新版更新说明，仍可继续更新；详情见 GitHub Release 页。",
 			updateNow: "立即更新",
@@ -377,6 +376,7 @@ window.__ModuleLoader__.load({
 			clearAllDevices: "清除所有设备",
 			pairingQr: "配对二维码",
 			remoteIntro: "选择更适合你的远程通道。切换或关闭远程访问不会影响局域网。",
+			httpFrameWarning: "为兼容性允许嵌入 HTTP 页面，但内容未加密，可能被篡改；处理敏感内容请使用 HTTPS。",
 			chooseProvider: "选择连接方式",
 			currentProvider: "当前连接",
 			remoteStateOff: "未启用",
@@ -560,7 +560,6 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
 			selfHostedConnections: "Self-hosted connection",
-			selfHostedDescription: "For users with a VPS and domain. It does not depend on public tunnel bandwidth.",
 			advanced: "Advanced",
 			frpName: "Self-hosted FRP",
 			frpDescription: "A restricted FRP channel for this DSH gateway only. You manage the VPS and public domain.",
@@ -648,7 +647,6 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
 			selfHostedConnections: "Connessione autogestita",
-			selfHostedDescription: "Per chi dispone di VPS e dominio. Non dipende dalla banda dei tunnel pubblici.",
 			advanced: "Avanzato",
 			frpName: "FRP autogestito",
 			frpDescription: "Canale FRP limitato al solo gateway DSH. VPS e dominio pubblico restano sotto il tuo controllo.",
@@ -736,7 +734,6 @@ window.__ModuleLoader__.load({
 		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
 			selfHostedConnections: "自建连接",
-			selfHostedDescription: "适合已有 VPS 的用户，可使用域名或公网 IPv4，不受公共服务带宽限制。",
 			advanced: "高级",
 			frpName: "自建 FRP",
 			frpDescription: "只为当前 DSH 网关建立单用途 FRP 通道，VPS 和公开入口由你掌控。",
@@ -1037,6 +1034,336 @@ window.__ModuleLoader__.load({
 				generated: "生成时间"
 			}
 		};
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			selfHostedDescription: "Use your own VPS or HTTPS reverse proxy without a public tunnel service.",
+			originName: "Own reverse proxy",
+			originDescription: "You manage HTTPS. DSH Mobile provides a private, authenticated HTTP backend; no tunnel component is installed.",
+			prepareOrigin: "Connect your HTTPS reverse proxy",
+			originPublicOrigin: "Public HTTPS address",
+			originListenHost: "Private listen IPv4",
+			originListenPort: "HTTP backend port",
+			originAllowedCidrs: "Allowed proxy source CIDRs",
+			originHelp: "Same computer: use 127.0.0.1. For a proxy on another LAN device, use this computer’s private IPv4 and allow only the proxy’s direct source IPv4/32. Separate CIDRs with spaces or commas.",
+			originWarning: "Keep this HTTP backend private. Never expose or port-forward it to the Internet. Your proxy must terminate HTTPS and preserve the external Host, including its port, and WebSocket upgrades.",
+			originSaveStart: "Save and start backend",
+			originBackendSaved: "Saved HTTP backend (not running)",
+			originBackendListening: "Listening HTTP backend",
+			originCopyBackend: "Copy backend address",
+			originBackendCopied: "HTTP backend address copied.",
+			originPurge: "Clear proxy settings",
+			originPurgeConfirm: "Stop this private HTTP backend and delete only its reverse-proxy settings? Paired remote devices, LAN access, and other providers are kept.",
+			originPurged: "The backend is stopped and its proxy settings are cleared. Paired devices are kept.",
+			originSaving: "Saving settings and starting the private backend…",
+			originPurging: "Stopping the backend and clearing its settings…",
+			originBackendReady: "Backend listening",
+			originReady: "The private HTTP backend is listening. Public HTTPS, its certificate, and WebSocket connectivity have NOT been verified. Test the public address from your phone before relying on it.",
+			originUnavailable: "Configure the public HTTPS address and private backend first.",
+			originStarting: "Starting the private HTTP backend…",
+			switchingOrigin: "Switching to your own reverse proxy…",
+			reconnectingOrigin: "Restarting the private HTTP backend…",
+			resetOriginConfirm: "Stop this backend and reset remote pairing? All paired remote devices must pair again. Reverse-proxy settings and LAN devices are kept.",
+			originPublicOriginInvalid: "Enter a public HTTPS origin only, such as https://phone.example.com:8815; no path, query, credentials, or private address.",
+			originListenHostInvalid: "Use an explicit loopback or private IPv4 address on this computer, not 0.0.0.0 or a public address.",
+			originListenPortInvalid: "Use a whole-number port from 1024 to 65535; lower ports need privileges the plugin does not have.",
+			originListenPortReserved: "Port 3443 belongs to the LAN gateway and port 3080 to DSH itself, so both are always taken. Choose another port, such as 3444 or 3445.",
+			originAllowedCidrsInvalid: "Allow 1–16 valid loopback/private IPv4 CIDRs with no host bits. For a LAN listener, include the actual proxy source IPv4/32; public ranges are not accepted.",
+			originSettingsInvalid: "The reverse-proxy settings are invalid. Check the four fields and save again.",
+			originConfigMissing: "Save the reverse-proxy settings before starting the backend.",
+			originConfigInvalid: "The saved settings are invalid. Correct and save them again, or clear only these settings.",
+			originPortInUse: "The backend port is already in use. Stop the conflicting listener or choose another port. Note that 3443, 3080, and a port already used by a cloudflared tunnel are never free.",
+			originAddressUnavailable: "The listen address is not available on this computer. Choose its current private IPv4.",
+			originStartFailed: "The private backend could not start. Check its address, port, permissions, and local logs.",
+			originConfigTargetInvalid: "The saved proxy settings file is not a regular file. Remove it and save the settings again.",
+			originControllerUnavailable: "The reverse-proxy provider is not available in this session. Restart DSH and try again."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			selfHostedDescription: "Usa il tuo VPS o reverse proxy HTTPS senza un servizio di tunnel pubblico.",
+			originName: "Reverse proxy proprio",
+			originDescription: "Gestisci tu HTTPS. DSH Mobile offre un backend HTTP privato con autenticazione; non installa componenti tunnel.",
+			prepareOrigin: "Collega il tuo reverse proxy HTTPS",
+			originPublicOrigin: "Indirizzo HTTPS pubblico",
+			originListenHost: "IPv4 privato di ascolto",
+			originListenPort: "Porta backend HTTP",
+			originAllowedCidrs: "CIDR sorgente del proxy consentiti",
+			originHelp: "Stesso computer: usa 127.0.0.1. Per un proxy su un altro dispositivo LAN, usa l’IPv4 privato di questo computer e consenti solo l’IPv4 sorgente diretta del proxy con /32. Separa i CIDR con spazi o virgole.",
+			originWarning: "Mantieni privato il backend HTTP. Non esporlo né inoltrarne la porta su Internet. Il proxy deve terminare HTTPS e conservare l’Host esterno, inclusa la porta, e gli upgrade WebSocket.",
+			originSaveStart: "Salva e avvia backend",
+			originBackendSaved: "Backend HTTP salvato (non attivo)",
+			originBackendListening: "Backend HTTP in ascolto",
+			originCopyBackend: "Copia indirizzo backend",
+			originBackendCopied: "Indirizzo backend HTTP copiato.",
+			originPurge: "Cancella impostazioni proxy",
+			originPurgeConfirm: "Fermare questo backend HTTP privato ed eliminare solo le sue impostazioni reverse proxy? Dispositivi remoti abbinati, accesso LAN e altri provider vengono conservati.",
+			originPurged: "Backend fermato e impostazioni proxy cancellate. I dispositivi abbinati sono conservati.",
+			originSaving: "Salvataggio impostazioni e avvio del backend privato…",
+			originPurging: "Arresto del backend e cancellazione impostazioni…",
+			originBackendReady: "Backend in ascolto",
+			originReady: "Il backend HTTP privato è in ascolto. HTTPS pubblico, certificato e connettività WebSocket NON sono stati verificati. Prova l’indirizzo pubblico dal telefono prima di usarlo.",
+			originUnavailable: "Configura prima l’indirizzo HTTPS pubblico e il backend privato.",
+			originStarting: "Avvio del backend HTTP privato…",
+			switchingOrigin: "Passaggio al reverse proxy proprio…",
+			reconnectingOrigin: "Riavvio del backend HTTP privato…",
+			resetOriginConfirm: "Fermare il backend e reimpostare gli abbinamenti remoti? Tutti i dispositivi remoti dovranno essere abbinati di nuovo. Le impostazioni proxy e i dispositivi LAN vengono conservati.",
+			originPublicOriginInvalid: "Inserisci solo un’origine HTTPS pubblica, ad esempio https://phone.example.com:8815, senza percorso, query, credenziali o indirizzo privato.",
+			originListenHostInvalid: "Usa un IPv4 loopback o privato esplicito di questo computer, non 0.0.0.0 né un indirizzo pubblico.",
+			originListenPortInvalid: "Usa una porta intera da 1024 a 65535; le porte più basse richiedono privilegi che il plugin non ha.",
+			originListenPortReserved: "La porta 3443 appartiene al gateway LAN e la 3080 a DSH stesso, quindi sono sempre occupate. Scegli un’altra porta, ad esempio 3444 o 3445.",
+			originAllowedCidrsInvalid: "Consenti 1–16 CIDR IPv4 loopback/privati validi senza bit host. Per l’ascolto LAN includi l’IPv4 sorgente reale del proxy con /32; le reti pubbliche non sono ammesse.",
+			originSettingsInvalid: "Impostazioni reverse proxy non valide. Controlla i quattro campi e salva di nuovo.",
+			originConfigMissing: "Salva le impostazioni reverse proxy prima di avviare il backend.",
+			originConfigInvalid: "Impostazioni salvate non valide. Correggile e salvale di nuovo, oppure cancella solo queste impostazioni.",
+			originPortInUse: "La porta backend è già occupata. Ferma il processo in conflitto o scegli un’altra porta. 3443, 3080 e una porta già usata da un tunnel cloudflared non sono mai libere.",
+			originAddressUnavailable: "L’indirizzo di ascolto non è disponibile su questo computer. Scegli il suo IPv4 privato attuale.",
+			originStartFailed: "Impossibile avviare il backend privato. Controlla indirizzo, porta, permessi e log locali.",
+			originConfigTargetInvalid: "Il file delle impostazioni proxy salvato non è un file regolare. Rimuovilo e salva di nuovo le impostazioni.",
+			originControllerUnavailable: "Il provider reverse proxy non è disponibile in questa sessione. Riavvia DSH e riprova."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			selfHostedDescription: "使用自己的 VPS 或 HTTPS 反向代理，不依赖公共隧道服务。",
+			originName: "自有反向代理",
+			originDescription: "HTTPS 由你管理，插件提供带认证的私有 HTTP 后端，无需安装隧道组件。",
+			prepareOrigin: "接入自有 HTTPS 反向代理",
+			originPublicOrigin: "公网 HTTPS 地址",
+			originListenHost: "私有监听 IPv4",
+			originListenPort: "HTTP 后端端口",
+			originAllowedCidrs: "允许的代理来源 CIDR",
+			originHelp: "代理与 DSH 同机时用 127.0.0.1；代理在另一台局域网设备上时，填写本机私有 IPv4，并只允许代理实际直连来源 IPv4/32。多个 CIDR 用空格或逗号分隔。",
+			originWarning: "HTTP 后端必须留在私网，绝不能直接暴露公网或做公网端口映射。反向代理负责 HTTPS，并须保留外部 Host（含端口）及 WebSocket 升级。",
+			originSaveStart: "保存并启动后端",
+			originBackendSaved: "已保存的 HTTP 后端（未运行）",
+			originBackendListening: "正在监听的 HTTP 后端",
+			originCopyBackend: "复制后端地址",
+			originBackendCopied: "已复制 HTTP 后端地址。",
+			originPurge: "清除代理配置",
+			originPurgeConfirm: "停止此私有 HTTP 后端，并且只删除它的反向代理配置？已配对的远程设备、局域网访问和其他提供方均保留。",
+			originPurged: "已停止后端并清除代理配置，已配对设备仍保留。",
+			originSaving: "正在保存配置并启动私有后端…",
+			originPurging: "正在停止后端并清除配置…",
+			originBackendReady: "后端已监听",
+			originReady: "私有 HTTP 后端已监听，但尚未验证公网 HTTPS、证书及 WebSocket 连通性。请先用手机测试公网地址，不代表公网连接已成功。",
+			originUnavailable: "请先配置公网 HTTPS 地址和私有后端。",
+			originStarting: "正在启动私有 HTTP 后端…",
+			switchingOrigin: "正在切换到自有反向代理…",
+			reconnectingOrigin: "正在重启私有 HTTP 后端…",
+			resetOriginConfirm: "停止此后端并重置远程配对？所有已配对的远程设备都需要重新配对；反向代理配置和局域网设备保留。",
+			originPublicOriginInvalid: "只填写公网 HTTPS 源地址，例如 https://phone.example.com:8815；不能含路径、查询参数、账号密码或私有地址。",
+			originListenHostInvalid: "填写本机明确的回环或私有 IPv4，不能使用 0.0.0.0 或公网地址。",
+			originListenPortInvalid: "端口必须是 1024–65535 的整数；更低的端口需要插件没有的特权。",
+			originListenPortReserved: "3443 属于局域网网关、3080 属于 DSH 自身，两者始终被占用。请换一个端口，例如 3444 或 3445。",
+			originAllowedCidrsInvalid: "填写 1–16 个规范的回环/私有 IPv4 CIDR，不能有主机位；局域网监听时须包含代理实际来源 IPv4/32，不接受公网网段。",
+			originSettingsInvalid: "反向代理配置无效，请检查四个字段后重新保存。",
+			originConfigMissing: "请先保存反向代理配置，再启动后端。",
+			originConfigInvalid: "已保存的配置无效，请修正并重新保存，或仅清除这项配置。",
+			originPortInUse: "后端端口已被占用，请停止冲突进程或改用其他端口。3443、3080 以及已被 cloudflared 隧道占用的端口永远不会空闲。",
+			originAddressUnavailable: "本机没有这个监听地址，请选择当前本机的私有 IPv4。",
+			originStartFailed: "私有后端启动失败，请检查地址、端口、权限和本地日志。",
+			originConfigTargetInvalid: "已保存的代理配置文件不是普通文件。请移除后重新保存设置。",
+			originControllerUnavailable: "当前会话里反向代理提供方不可用。请重启 DSH 后重试。"
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			cloudflaredBadge: "Account optional",
+			cloudflaredDescription: "Installs the official cloudflared client on demand. A quick tunnel needs no account and gives a temporary public address; a named tunnel uses a Cloudflare account token and keeps one hostname that survives restarts.",
+			prepareCloudflared: "Prepare cloudflared",
+			cloudflaredUnsupported: "Only Windows x64 is currently supported. You can still use the built-in Tailscale Funnel.",
+			cloudflaredNotInstalled: "Not installed. A fixed version is downloaded from the official cloudflared release page only after you click the button below.",
+			cloudflaredReady: "Official component {version} is ready.",
+			cloudflaredQuickNote: "Quick tunnel: no Cloudflare account is needed, but Cloudflare positions quick tunnels for testing — the address is random, rate-limited, and carries no uptime guarantee. Do not rely on one for access that must stay reachable.",
+			cloudflaredNamedNote: "Named tunnel: the hostname above stays the same across restarts and Cloudflare routes it to the local forward port. The connector token is stored only in the DSH Mobile private directory, is handed to cloudflared through its environment rather than the command line, and is never shown again once saved.",
+			cloudflaredComponentNote: "Downloaded from the official cloudflared release page and verified at a fixed version only after you choose Install. The client is started with automatic updates disabled. It does not add a system service, startup item, registry entry, or PATH entry.",
+			installConfirmCloudflared: "Download and verify cloudflared {size} from the official release page and store it only in the DSH Mobile private directory? No system service, PATH/registry entry, or startup item is added.",
+			installingCloudflared: "Installing the official cloudflared component. Keep DSH running until it completes.",
+			purgeCloudflared: "Completely remove the cloudflared component",
+			purgeCloudflaredConfirm: "Completely remove the cloudflared component and its runtime logs from the DSH Mobile private directory? Local network access, DSH data, and other system programs are unaffected.",
+			purgingCloudflared: "Stopping the channel and removing cloudflared files managed by DSH Mobile…",
+			switchingCloudflared: "Switching to cloudflared…",
+			reconnectingCloudflared: "Reconnecting cloudflared…",
+			remoteUnavailableCloudflared: "cloudflared is not installed.",
+			remoteStartingCloudflared: "Starting the cloudflared connector…",
+			remoteConnectingCloudflared: "Starting the DSH authentication gateway…",
+			resetCloudflaredConfirm: "Disable the cloudflared remote channel and remove all remote paired devices? The installed component and the local network configuration are unchanged.",
+			cloudflaredMissing: "The official cloudflared component is not installed. Complete the preparation steps above.",
+			cloudflaredInvalid: "cloudflared component verification failed. Remove it completely and reinstall.",
+			cloudflaredPortUnavailable: "Could not allocate a local remote-gateway port. Try again.",
+			cloudflaredLaunchFailed: "The cloudflared client failed to start.",
+			cloudflaredTimeout: "Timed out waiting for the tunnel to become reachable. Reconnect.",
+			cloudflaredStopped: "The cloudflared connection stopped.",
+			cloudflaredExited: "The cloudflared connection exited unexpectedly. Reconnect.",
+			cloudflaredOutputInvalid: "cloudflared returned an unrecognized status.",
+			cloudflaredOriginInvalid: "The public address returned by cloudflared failed validation.",
+			cloudflaredComponentUnsupported: "This build cannot run the cloudflared component.",
+			cloudflaredDownloadHashMismatch: "The downloaded cloudflared failed its SHA-256 verification. Retry the install.",
+			cloudflaredDownloadSizeMismatch: "The downloaded cloudflared is not the pinned size. Retry the install.",
+			cloudflaredDownloadRedirectMissing: "The download page stopped redirecting to the release asset. Retry later, or install from the official page manually.",
+			cloudflaredDownloadRedirectInvalid: "The download redirect did not point at a GitHub release asset, so it was refused.",
+			cloudflaredDownloadRedirectRejected: "The download redirect was refused by policy. Retry later, or install from the official page manually.",
+			cloudflaredExecutableHashMismatch: "The installed cloudflared no longer matches the verified build. Remove it completely and install again.",
+			cloudflaredPortReservationFailed: "Could not reserve a local port for the tunnel. Try again.",
+			cloudflaredTunnelTargetInvalid: "The saved tunnel configuration is not a regular file. Remove it and save the settings again.",
+			cloudflaredTunnelSaving: "Saving the tunnel settings and reconnecting cloudflared…",
+			cloudflaredTunnelForgetting: "Removing the saved tunnel token…",
+			cloudflaredTunnelTitle: "Tunnel type",
+			cloudflaredTunnelQuick: "Quick",
+			cloudflaredTunnelNamed: "Named",
+			cloudflaredTunnelQuickHint: "No account: cloudflared allocates a random address on every start.",
+			cloudflaredTunnelNamedHint: "Uses a Cloudflare account token and keeps one address that survives restarts.",
+			cloudflaredTunnelHostname: "Public hostname",
+			cloudflaredTunnelHostnamePlaceholder: "dsh.example.com",
+			cloudflaredTunnelPort: "Local forward port",
+			cloudflaredTunnelToken: "Connector token",
+			cloudflaredTunnelTokenPlaceholder: "Paste the tunnel token from the Cloudflare dashboard",
+			cloudflaredTunnelTokenSaved: "A token is saved. Leave blank to keep it.",
+			cloudflaredTunnelSave: "Save and connect",
+			cloudflaredTunnelSaveQuick: "Switch to a quick tunnel",
+			cloudflaredTunnelConfigured: "Named tunnel configured: {hostname} reaches this computer on 127.0.0.1:{port}.",
+			cloudflaredTunnelMissing: "No named tunnel configured yet.",
+			cloudflaredTunnelHint: "In the Cloudflare dashboard create a tunnel, then set its public hostname to http://127.0.0.1:{port}. The token is stored only in the DSH Mobile private directory and is never shown again after saving.",
+			cloudflaredTunnelForget: "Remove the saved token",
+			cloudflaredTunnelForgetConfirm: "Remove the saved tunnel token, stop the cloudflared channel, and go back to a quick tunnel? Nothing reconnects on its own: switch the channel back on afterwards. The tunnel still exists in your Cloudflare account, and its public hostname is unchanged.",
+			cloudflaredTunnelInvalid: "The saved named-tunnel configuration is unreadable; the provider is using a quick tunnel. Save the settings again.",
+			cloudflaredTunnelPortUnavailable: "The configured local forward port is unavailable. Cloudflare routes the public hostname to that exact port, so free it or choose another one.",
+			cloudflaredTunnelHostnameInvalid: "Enter a public hostname under a domain on this Cloudflare account, for example dsh.example.com.",
+			cloudflaredTunnelPortInvalid: "Enter a forward port between 1024 and 65535.",
+			cloudflaredTunnelPortReserved: "Port 3443 is reserved for the DSH Mobile LAN gateway and is always occupied. Choose another port, such as 3444 or 3445.",
+			cloudflaredTunnelTokenInvalid: "That does not look like a tunnel token. Copy the whole token from the Cloudflare dashboard.",
+			cloudflaredTunnelSettingsInvalid: "The tunnel settings were rejected.",
+			cloudflaredTunnelConfigMissing: "Enter the token, hostname, and port to use a named tunnel."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			cloudflaredBadge: "Account facoltativo",
+			cloudflaredDescription: "Installa su richiesta il client cloudflared ufficiale. Il tunnel rapido non richiede account e fornisce un indirizzo pubblico temporaneo; il tunnel con nome usa il token di un account Cloudflare e mantiene un hostname stabile tra i riavvii.",
+			prepareCloudflared: "Prepara cloudflared",
+			cloudflaredUnsupported: "Attualmente è supportato solo Windows x64. Puoi comunque usare Tailscale Funnel integrato.",
+			cloudflaredNotInstalled: "Non installato. Una versione fissa viene scaricata dalla pagina ufficiale di cloudflared solo dopo aver premuto il pulsante.",
+			cloudflaredReady: "Componente ufficiale {version} pronto.",
+			cloudflaredQuickNote: "Tunnel rapido: non serve un account Cloudflare, ma Cloudflare li considera pensati per i test — l’indirizzo è casuale, soggetto a limiti di frequenza e senza garanzia di disponibilità. Non usarlo per un accesso che deve restare raggiungibile.",
+			cloudflaredNamedNote: "Tunnel con nome: l’hostname qui sopra resta lo stesso tra i riavvii e Cloudflare lo instrada verso la porta di inoltro locale. Il token del connettore è salvato solo nella directory privata DSH Mobile, viene passato a cloudflared tramite l’ambiente e non tramite la riga di comando, e dopo il salvataggio non viene più mostrato.",
+			cloudflaredComponentNote: "Viene scaricato dalla pagina ufficiale di cloudflared e verificato a una versione fissa solo dopo aver scelto Installa. Il client viene avviato con gli aggiornamenti automatici disattivati. Non aggiunge servizi di sistema, avvio automatico, voci di registro o PATH.",
+			installConfirmCloudflared: "Scaricare e verificare cloudflared {size} dalla pagina ufficiale e salvarlo solo nella directory privata DSH Mobile? Non vengono aggiunti servizi, PATH/registro o avvio automatico.",
+			installingCloudflared: "Installazione del componente cloudflared ufficiale. Mantieni DSH in esecuzione fino al termine.",
+			purgeCloudflared: "Rimuovi completamente il componente cloudflared",
+			purgeCloudflaredConfirm: "Rimuovere completamente il componente cloudflared e i log runtime dalla directory privata DSH Mobile? Rete locale, dati DSH e altri programmi non sono interessati.",
+			purgingCloudflared: "Arresto del canale e rimozione dei file cloudflared gestiti da DSH Mobile…",
+			switchingCloudflared: "Passaggio a cloudflared…",
+			reconnectingCloudflared: "Riconnessione di cloudflared…",
+			remoteUnavailableCloudflared: "cloudflared non è installato.",
+			remoteStartingCloudflared: "Avvio del connettore cloudflared…",
+			remoteConnectingCloudflared: "Avvio del gateway di autenticazione DSH…",
+			resetCloudflaredConfirm: "Disattivare il canale remoto cloudflared e rimuovere tutti i dispositivi remoti? Il componente installato e la configurazione della rete locale restano invariati.",
+			cloudflaredMissing: "Il componente cloudflared ufficiale non è installato. Completa i passaggi sopra.",
+			cloudflaredInvalid: "Verifica del componente cloudflared non riuscita. Rimuovilo completamente e reinstallalo.",
+			cloudflaredPortUnavailable: "Impossibile assegnare una porta locale al gateway remoto. Riprova.",
+			cloudflaredLaunchFailed: "Il client cloudflared non è stato avviato.",
+			cloudflaredTimeout: "Timeout in attesa che il tunnel diventi raggiungibile. Riconnettiti.",
+			cloudflaredStopped: "La connessione cloudflared è stata arrestata.",
+			cloudflaredExited: "La connessione cloudflared è terminata in modo imprevisto. Riconnettiti.",
+			cloudflaredOutputInvalid: "cloudflared ha restituito uno stato non riconosciuto.",
+			cloudflaredOriginInvalid: "L’indirizzo pubblico restituito da cloudflared non ha superato la verifica.",
+			cloudflaredComponentUnsupported: "Questa build non può eseguire il componente cloudflared.",
+			cloudflaredDownloadHashMismatch: "Il cloudflared scaricato non ha superato la verifica SHA-256. Riprova l’installazione.",
+			cloudflaredDownloadSizeMismatch: "Il cloudflared scaricato non ha la dimensione prevista. Riprova l’installazione.",
+			cloudflaredDownloadRedirectMissing: "La pagina di download non reindirizza più all’asset della release. Riprova più tardi o installa manualmente dalla pagina ufficiale.",
+			cloudflaredDownloadRedirectInvalid: "Il reindirizzamento di download non puntava a un asset di release GitHub ed è stato rifiutato.",
+			cloudflaredDownloadRedirectRejected: "Il reindirizzamento di download è stato rifiutato dalle regole. Riprova più tardi o installa manualmente dalla pagina ufficiale.",
+			cloudflaredExecutableHashMismatch: "Il cloudflared installato non corrisponde più alla build verificata. Rimuovilo completamente e reinstalla.",
+			cloudflaredPortReservationFailed: "Impossibile riservare una porta locale per il tunnel. Riprova.",
+			cloudflaredTunnelTargetInvalid: "La configurazione salvata del tunnel non è un file regolare. Rimuovila e salva di nuovo le impostazioni.",
+			cloudflaredTunnelSaving: "Salvataggio delle impostazioni e riconnessione di cloudflared…",
+			cloudflaredTunnelForgetting: "Rimozione del token del tunnel salvato…",
+			cloudflaredTunnelTitle: "Tipo di tunnel",
+			cloudflaredTunnelQuick: "Rapido",
+			cloudflaredTunnelNamed: "Con nome",
+			cloudflaredTunnelQuickHint: "Senza account: cloudflared assegna un indirizzo casuale a ogni avvio.",
+			cloudflaredTunnelNamedHint: "Usa il token di un account Cloudflare e mantiene un indirizzo stabile tra i riavvii.",
+			cloudflaredTunnelHostname: "Hostname pubblico",
+			cloudflaredTunnelHostnamePlaceholder: "dsh.example.com",
+			cloudflaredTunnelPort: "Porta di inoltro locale",
+			cloudflaredTunnelToken: "Token del connettore",
+			cloudflaredTunnelTokenPlaceholder: "Incolla il token del tunnel dalla dashboard Cloudflare",
+			cloudflaredTunnelTokenSaved: "Un token è salvato. Lascia vuoto per mantenerlo.",
+			cloudflaredTunnelSave: "Salva e connetti",
+			cloudflaredTunnelSaveQuick: "Passa a un tunnel rapido",
+			cloudflaredTunnelConfigured: "Tunnel con nome configurato: {hostname} raggiunge questo computer su 127.0.0.1:{port}.",
+			cloudflaredTunnelMissing: "Nessun tunnel con nome configurato.",
+			cloudflaredTunnelHint: "Nella dashboard Cloudflare crea un tunnel e imposta il suo hostname pubblico su http://127.0.0.1:{port}. Il token è salvato solo nella directory privata DSH Mobile e non viene più mostrato dopo il salvataggio.",
+			cloudflaredTunnelForget: "Rimuovi il token salvato",
+			cloudflaredTunnelForgetConfirm: "Rimuovere il token salvato, arrestare il canale cloudflared e tornare a un tunnel rapido? Nulla si riconnette da solo: riattiva il canale in seguito. Il tunnel resta nel tuo account Cloudflare e il suo hostname pubblico non cambia.",
+			cloudflaredTunnelInvalid: "La configurazione salvata del tunnel con nome non è leggibile; il provider usa un tunnel rapido. Salva di nuovo le impostazioni.",
+			cloudflaredTunnelPortUnavailable: "La porta di inoltro locale configurata non è disponibile. Cloudflare instrada l’hostname pubblico esattamente su quella porta: liberala o scegline un’altra.",
+			cloudflaredTunnelHostnameInvalid: "Inserisci un hostname pubblico sotto un dominio di questo account Cloudflare, ad esempio dsh.example.com.",
+			cloudflaredTunnelPortInvalid: "Inserisci una porta di inoltro tra 1024 e 65535.",
+			cloudflaredTunnelPortReserved: "La porta 3443 è riservata al gateway LAN di DSH Mobile ed è sempre occupata. Scegli un’altra porta, ad esempio 3444 o 3445.",
+			cloudflaredTunnelTokenInvalid: "Non sembra un token di tunnel. Copia il token completo dalla dashboard Cloudflare.",
+			cloudflaredTunnelSettingsInvalid: "Le impostazioni del tunnel sono state rifiutate.",
+			cloudflaredTunnelConfigMissing: "Inserisci token, hostname e porta per usare un tunnel con nome."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			cloudflaredBadge: "账号可选",
+			cloudflaredDescription: "按需安装官方 cloudflared 客户端。快速隧道无需账号，提供临时公网地址；命名隧道使用 Cloudflare 账号令牌，地址固定、重启不变。",
+			prepareCloudflared: "准备 cloudflared",
+			cloudflaredUnsupported: "当前仅支持 Windows x64。你仍可选择内置的 Tailscale Funnel。",
+			cloudflaredNotInstalled: "尚未安装。只有点击下方按钮后，才会从 cloudflared 官方发布页下载固定版本。",
+			cloudflaredReady: "官方组件 {version} 已就绪。",
+			cloudflaredQuickNote: "快速隧道：无需 Cloudflare 账号，但官方定位是测试用途 —— 地址随机、有限流、无可用性保证。请勿用于必须长期可达的访问。",
+			cloudflaredNamedNote: "命名隧道：上面的公网域名重启后不变，由 Cloudflare 转发到本机转发端口。连接器令牌只保存在 DSH Mobile 私有目录，经环境变量而非命令行传给 cloudflared，保存后不再显示。",
+			cloudflaredComponentNote: "仅在你点击安装后从 cloudflared 官方发布页下载并校验固定版本，且启动时关闭自动更新。不会写入系统服务、开机启动、注册表或 PATH。",
+			installConfirmCloudflared: "将从 cloudflared 官方发布页下载并校验固定版本（{size}），仅保存到 DSH Mobile 私有目录。不会安装系统服务、写入 PATH/注册表或设置开机启动。是否继续？",
+			installingCloudflared: "正在安装 cloudflared 官方组件。完成前请保持 DSH 运行。",
+			purgeCloudflared: "彻底移除 cloudflared 组件",
+			purgeCloudflaredConfirm: "彻底移除 DSH Mobile 私有目录中的 cloudflared 组件和运行日志？不会影响局域网、DSH 数据或系统中的其他程序。",
+			purgingCloudflared: "正在关闭通道并清理 DSH Mobile 管理的 cloudflared 文件…",
+			switchingCloudflared: "正在切换到 cloudflared…",
+			reconnectingCloudflared: "正在重连 cloudflared…",
+			remoteUnavailableCloudflared: "cloudflared 尚未安装。",
+			remoteStartingCloudflared: "正在启动 cloudflared 连接器…",
+			remoteConnectingCloudflared: "正在启动 DSH 认证网关…",
+			resetCloudflaredConfirm: "关闭 cloudflared 远程通道并移除所有远程配对设备？已安装组件与局域网配置保持不变。",
+			cloudflaredMissing: "cloudflared 官方组件尚未安装。请先完成上方准备步骤。",
+			cloudflaredInvalid: "cloudflared 组件校验失败。请彻底移除后重新安装。",
+			cloudflaredPortUnavailable: "无法分配本机远程网关端口，请重试。",
+			cloudflaredLaunchFailed: "cloudflared 客户端未能启动。",
+			cloudflaredTimeout: "等待隧道可用超时，请重新连接。",
+			cloudflaredStopped: "cloudflared 连接已停止。",
+			cloudflaredExited: "cloudflared 连接意外退出，请重新连接。",
+			cloudflaredOutputInvalid: "cloudflared 返回了无法识别的状态。",
+			cloudflaredOriginInvalid: "cloudflared 返回的公网地址未通过校验。",
+			cloudflaredComponentUnsupported: "当前构建无法运行 cloudflared 组件。",
+			cloudflaredDownloadHashMismatch: "下载的 cloudflared 未通过 SHA-256 校验。请重新安装。",
+			cloudflaredDownloadSizeMismatch: "下载的 cloudflared 体积与固定版本不符。请重新安装。",
+			cloudflaredDownloadRedirectMissing: "下载页不再跳转到发布资源。请稍后重试，或按官方页面手动安装。",
+			cloudflaredDownloadRedirectInvalid: "下载跳转的目标不是 GitHub 发布资源，已被拒绝。",
+			cloudflaredDownloadRedirectRejected: "下载跳转未通过校验规则。请稍后重试，或按官方页面手动安装。",
+			cloudflaredExecutableHashMismatch: "已安装的 cloudflared 与校验过的版本不一致。请彻底移除后重新安装。",
+			cloudflaredPortReservationFailed: "无法为隧道预留本机端口，请重试。",
+			cloudflaredTunnelTargetInvalid: "已保存的隧道配置不是普通文件。请移除后重新保存设置。",
+			cloudflaredTunnelSaving: "正在保存隧道设置并重新连接 cloudflared…",
+			cloudflaredTunnelForgetting: "正在移除已保存的隧道令牌…",
+			cloudflaredTunnelTitle: "隧道类型",
+			cloudflaredTunnelQuick: "快速隧道",
+			cloudflaredTunnelNamed: "命名隧道",
+			cloudflaredTunnelQuickHint: "无需账号：每次启动由 cloudflared 随机分配地址。",
+			cloudflaredTunnelNamedHint: "使用 Cloudflare 账号令牌，地址固定，重启后仍然有效。",
+			cloudflaredTunnelHostname: "公网域名",
+			cloudflaredTunnelHostnamePlaceholder: "dsh.example.com",
+			cloudflaredTunnelPort: "本机转发端口",
+			cloudflaredTunnelToken: "连接器令牌",
+			cloudflaredTunnelTokenPlaceholder: "粘贴 Cloudflare 控制台里的隧道令牌",
+			cloudflaredTunnelTokenSaved: "已保存令牌，留空表示不更改。",
+			cloudflaredTunnelSave: "保存并连接",
+			cloudflaredTunnelSaveQuick: "切换到快速隧道",
+			cloudflaredTunnelConfigured: "命名隧道已配置：{hostname} 将转发到本机 127.0.0.1:{port}。",
+			cloudflaredTunnelMissing: "尚未配置命名隧道。",
+			cloudflaredTunnelHint: "先在 Cloudflare 控制台创建隧道，并把它的公开主机名指向 http://127.0.0.1:{port}。令牌只保存在 DSH Mobile 私有目录，保存后不会再显示。",
+			cloudflaredTunnelForget: "移除已保存的令牌",
+			cloudflaredTunnelForgetConfirm: "移除已保存的隧道令牌、停止 cloudflared 通道并改回快速隧道？不会自动重连，之后需要手动重新打开开关。Cloudflare 账号里的隧道本身仍在，公开主机名也不会改变。",
+			cloudflaredTunnelInvalid: "已保存的命名隧道配置无法读取，当前按快速隧道运行。请重新保存设置。",
+			cloudflaredTunnelPortUnavailable: "配置的本机转发端口不可用。Cloudflare 把公开主机名固定转发到该端口，请释放它或换一个端口。",
+			cloudflaredTunnelHostnameInvalid: "请填写本 Cloudflare 账号下某个域名的公开主机名，例如 dsh.example.com。",
+			cloudflaredTunnelPortInvalid: "请填写 1024 到 65535 之间的转发端口。",
+			cloudflaredTunnelPortReserved: "3443 已留给 DSH Mobile 局域网网关，且始终被占用。请换一个端口，例如 3444 或 3445。",
+			cloudflaredTunnelTokenInvalid: "这不像是一个隧道令牌。请从 Cloudflare 控制台完整复制令牌。",
+			cloudflaredTunnelSettingsInvalid: "隧道设置未通过校验。",
+			cloudflaredTunnelConfigMissing: "使用命名隧道需要同时填写令牌、公网域名和端口。"
+		});
 		const DIAGNOSTIC_REASON_MESSAGES = {
 			en: {
 				"lan-setup-required": ["Local network setup has not been completed.", "Return to Local network and choose a network to finish setup."],
@@ -1050,6 +1377,7 @@ window.__ModuleLoader__.load({
 				"firewall-missing": ["The complete local network firewall rules were not found.", "Run dsh-mobile setup as administrator and check the firewall rules."],
 				"firewall-unknown": ["The system did not allow the plugin to read firewall status.", "If the phone cannot find this computer, run setup as administrator."],
 				"remote-off": ["Remote access through {provider} is currently off.", ""],
+				"remote-origin-ready": ["The private HTTP backend is listening; public HTTPS is not verified.", "Verify your reverse proxy, public certificate, external Host including port, and WebSocket access from your phone. Keep the HTTP backend private."],
 				"remote-ready": ["{provider} endpoint {endpointSuffix} is reachable in about {latencyMs} ms.", ""],
 				"remote-rate-limited": ["{provider} endpoint {endpointSuffix} is reachable, but this check observed rate limiting.", "Try again later; older sessions load on demand to reduce traffic."],
 				"remote-fake-ip": ["The Tailscale address is intercepted by the current VPN or DNS proxy, so TLS was not established.", "Switch VPN node or proxy mode; if it still fails, use cpolar."],
@@ -1071,6 +1399,7 @@ window.__ModuleLoader__.load({
 				"firewall-missing": ["Le regole firewall complete per la rete locale non sono state trovate.", "Esegui dsh-mobile setup come amministratore e controlla le regole firewall."],
 				"firewall-unknown": ["Il sistema non ha consentito al plugin di leggere lo stato del firewall.", "Se il telefono non trova il computer, esegui setup come amministratore."],
 				"remote-off": ["L’accesso remoto tramite {provider} è disattivato.", ""],
+				"remote-origin-ready": ["Il backend HTTP privato è in ascolto; HTTPS pubblico non è verificato.", "Verifica dal telefono reverse proxy, certificato pubblico, Host esterno inclusa la porta e accesso WebSocket. Mantieni privato il backend HTTP."],
 				"remote-ready": ["L’endpoint {provider} {endpointSuffix} è raggiungibile in circa {latencyMs} ms.", ""],
 				"remote-rate-limited": ["L’endpoint {provider} {endpointSuffix} è raggiungibile, ma il controllo ha rilevato una limitazione temporanea.", "Riprova più tardi; le sessioni precedenti vengono caricate su richiesta per ridurre il traffico."],
 				"remote-fake-ip": ["L’indirizzo Tailscale è intercettato dalla VPN o dal proxy DNS corrente e TLS non è stato stabilito.", "Cambia nodo VPN o modalità proxy; se il problema continua, usa cpolar."],
@@ -1092,6 +1421,7 @@ window.__ModuleLoader__.load({
 				"firewall-missing": ["未找到完整的局域网防火墙规则。", "以管理员身份运行 dsh-mobile setup 并检查防火墙规则。"],
 				"firewall-unknown": ["系统未允许插件读取防火墙状态。", "若手机找不到电脑，请以管理员身份运行 setup。"],
 				"remote-off": ["{provider} 远程访问当前未启用。", ""],
+				"remote-origin-ready": ["私有 HTTP 后端已监听；尚未验证公网 HTTPS。", "请用手机核对反向代理、公网证书、含端口的外部 Host 及 WebSocket 访问。HTTP 后端必须留在私网。"],
 				"remote-ready": ["{provider} 端点 {endpointSuffix} 可达，往返约 {latencyMs} ms。", ""],
 				"remote-rate-limited": ["{provider} 端点 {endpointSuffix} 可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。"],
 				"remote-fake-ip": ["Tailscale 地址被当前 VPN 或 DNS 代理接管，TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。"],
@@ -1576,11 +1906,11 @@ window.__ModuleLoader__.load({
   .dsh-native-mobile-backdrop { display:block; position:fixed; z-index:235; inset:env(safe-area-inset-top) 0 0; border:0; background:rgb(15 23 42 / 32%); }
   .dsh-native-mobile-backdrop:not([hidden]) { animation:dsh-mobile-fade-in var(--dsh-mobile-motion-duration) ease-out; }
   .dsh-native-mobile-backdrop[hidden] { display:none; }
-  [data-dsh-mobile-details] { position:fixed !important; z-index:250 !important; inset:0 0 0 auto !important; width:min(94vw,460px) !important; max-width:none !important; transform:translateX(100%); transition:transform var(--dsh-mobile-motion-duration) var(--dsh-mobile-motion-ease); background:var(--dsw-bg, #fff); box-shadow:-18px 0 46px rgb(15 23 42 / 18%); }
+  [data-dsh-mobile-details] { position:fixed !important; z-index:250 !important; inset:0 0 0 auto !important; width:min(94vw,460px) !important; max-width:none !important; transform:translateX(100%); transition:transform var(--dsh-mobile-motion-duration) var(--dsh-mobile-motion-ease); background:var(--dsw-alias-bg-layer-1, #fff); box-shadow:-18px 0 46px rgb(15 23 42 / 18%); }
   [data-dsh-mobile-details][data-open="true"] { transform:translateX(0); }
   [data-dsh-mobile-handle] { display:none !important; }
   [data-dsh-mobile-settings] { flex-direction:column !important; width:100vw !important; height:100dvh !important; max-width:none !important; border-radius:0 !important; animation:dsh-mobile-panel-in var(--dsh-mobile-motion-duration) var(--dsh-mobile-motion-ease); }
-  [data-dsh-mobile-settings-nav] { flex:none !important; width:100% !important; padding:max(14px,env(safe-area-inset-top)) 12px 8px !important; gap:10px !important; border-bottom:1px solid var(--dsw-alias-border-subtle,#e8ebef); }
+  [data-dsh-mobile-settings-nav] { flex:none !important; width:100% !important; padding:max(14px,env(safe-area-inset-top)) 12px 8px !important; gap:10px !important; border-bottom:1px solid var(--dsw-alias-border-l2,#e8ebef); }
   [data-dsh-mobile-settings-nav] [class*="_navTitle"] { padding:0 8px !important; font-size:18px !important; line-height:28px !important; }
   [data-dsh-mobile-settings-list] { flex-direction:row !important; gap:4px !important; overflow-x:auto !important; scrollbar-width:none; }
   [data-dsh-mobile-settings-list]::-webkit-scrollbar { display:none; }
@@ -1664,7 +1994,7 @@ window.__ModuleLoader__.load({
      camera action on the same row metrics and tokens as the native menu. */
   .dsh-mobile-media-action { box-sizing:border-box; display:flex; align-items:center; justify-content:flex-start; gap:8px; width:100%; min-width:0; min-height:40px; padding:8px 10px; border:0; border-radius:10px; background:transparent; color:var(--dsw-alias-label-primary,inherit); cursor:pointer; font:inherit; font-size:14px; line-height:22px; text-align:left; touch-action:manipulation; }
   .dsh-mobile-media-action:active { opacity:.72; }
-  .dsh-mobile-media-action:focus-visible { outline:2px solid var(--dsw-alias-interactive-border-focus,#4c82f7); outline-offset:1px; }
+  .dsh-mobile-media-action:focus-visible { outline:2px solid var(--dsw-alias-state-business-primary,#4c82f7); outline-offset:1px; }
   .dsh-mobile-media-action:disabled { cursor:default; opacity:.38; }
   .dsh-mobile-media-action svg { flex:none; width:16px; height:16px; color:var(--dsw-alias-label-tertiary,currentColor); }
   .dsh-mobile-media-action span { min-width:0; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
@@ -2327,7 +2657,60 @@ window.__ModuleLoader__.load({
 			};
 		}
 		//#endregion
+		//#region src/local-admin-host.ts
+		/** Browser-safe desktop-admin Host checks. Do not import Node APIs here. */
+		function unwrapBrackets(hostname) {
+			return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+		}
+		function parseIpv4(hostname) {
+			const parts = hostname.split(".");
+			if (parts.length !== 4) return void 0;
+			const octets = [];
+			for (const part of parts) {
+				if (!/^(?:0|[1-9]\d{0,2})$/u.test(part)) return void 0;
+				const value = Number(part);
+				if (value > 255) return void 0;
+				octets.push(value);
+			}
+			return octets;
+		}
+		function isLoopbackIpv4(octets) {
+			return octets[0] === 127;
+		}
+		function isPrivateIpv4(octets) {
+			return octets[0] === 10 || octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31 || octets[0] === 192 && octets[1] === 168;
+		}
+		function isLinkLocalIpv4(octets) {
+			return octets[0] === 169 && octets[1] === 254;
+		}
+		/**
+		* Hostnames that may appear on the DSH desktop admin surface.
+		* Loopback, RFC1918, and IPv4 link-local are accepted. Public IPs,
+		* CGNAT, and arbitrary DNS names stay rejected so DNS rebinding
+		* cannot reach `/api/mobile-access`.
+		*/
+		function isLocalAdminHostname(hostname) {
+			const host = unwrapBrackets(hostname).trim().toLowerCase();
+			if (host === "localhost" || host === "::1") return true;
+			const octets = parseIpv4(host);
+			if (octets === void 0) return false;
+			return isLoopbackIpv4(octets) || isPrivateIpv4(octets) || isLinkLocalIpv4(octets);
+		}
+		/**
+		* Whether the current browser document should mount the desktop Mobile access
+		* control. Dedicated Mobile HTTPS (the phone surface) stays native even when
+		* the Host is a private LAN address.
+		*/
+		function isDesktopAdminSurface(hostname, search = "", frontend) {
+			const query = search.startsWith("?") ? search.slice(1) : search;
+			return isLocalAdminHostname(hostname) && frontend !== "dedicated" && !new URLSearchParams(query).has("dsh-mobile-preview");
+		}
+		//#endregion
 		//#region src/client.ts
+		/** Map a host-reported provider onto the UI union, defaulting to the built-in one. */
+		function parseMobileRemoteProvider(value) {
+			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" ? value : "tailscale";
+		}
 		const queuedDefinitions = [];
 		let queuedLegacyMount;
 		if (typeof window !== "undefined" && window.dshMobile === void 0) window.dshMobile = {
@@ -2338,9 +2721,6 @@ window.__ModuleLoader__.load({
 				queuedDefinitions.push(definition);
 			}
 		};
-		function isLoopbackHost(hostname) {
-			return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-		}
 		function selectMobileControlLocale(documentLanguage = "", navigatorLanguages = []) {
 			for (const value of [documentLanguage, ...navigatorLanguages]) {
 				const language = value.trim().toLowerCase().split(/[-_]/u)[0];
@@ -2593,7 +2973,103 @@ window.__ModuleLoader__.load({
 		function createFrpServerTemplateForClipboard(serverPort, token, publicOrigin) {
 			return createRestrictedFrpServerTemplate(serverPort, token, publicOrigin);
 		}
+		const ORIGIN_ERROR_MESSAGE_KEYS = {
+			origin_public_origin_invalid: "originPublicOriginInvalid",
+			origin_listen_host_invalid: "originListenHostInvalid",
+			origin_listen_port_invalid: "originListenPortInvalid",
+			origin_listen_port_reserved: "originListenPortReserved",
+			origin_allowed_cidrs_invalid: "originAllowedCidrsInvalid",
+			origin_settings_invalid: "originSettingsInvalid",
+			origin_config_missing: "originConfigMissing",
+			origin_config_invalid: "originConfigInvalid",
+			origin_config_target_invalid: "originConfigTargetInvalid",
+			origin_controller_unavailable: "originControllerUnavailable",
+			origin_listen_port_in_use: "originPortInUse",
+			origin_listen_address_unavailable: "originAddressUnavailable",
+			origin_gateway_start_failed: "originStartFailed"
+		};
 		function installControl() {
+			/**
+			* Provider failure codes to message keys.
+			*
+			* Kept as keys rather than translated text so the same table can serve both the
+			* status repaint and a failed request: a server rejection carries its code in
+			* `error.message`, and showing that raw would print `Error: cloudflared_...` in
+			* every language while the translated sentence sat unreachable.
+			*/
+			const REMOTE_ERROR_MESSAGE_KEYS = {
+				funnel_permission_required: "funnelPermission",
+				funnel_https_required: "funnelHttps",
+				funnel_start_failed: "funnelStart",
+				funnel_start_timeout: "funnelTimeout",
+				tailscale_dns_missing: "tailscaleDnsMissing",
+				gateway_start_failed: "gatewayStartFailed",
+				control_channel_failed: "controlChannelFailed",
+				cpolar_component_missing: "cpolarMissing",
+				cpolar_component_invalid: "cpolarInvalid",
+				cpolar_config_missing: "cpolarConfigMissing",
+				cpolar_config_invalid: "cpolarConfigInvalid",
+				cpolar_port_unavailable: "cpolarPortUnavailable",
+				cpolar_launch_failed: "cpolarLaunchFailed",
+				cpolar_start_timeout: "cpolarTimeout",
+				cpolar_stopped: "cpolarStopped",
+				cpolar_exited: "cpolarExited",
+				cpolar_invalid_output: "cpolarOutputInvalid",
+				cpolar_invalid_origin: "cpolarOriginInvalid",
+				cloudflared_component_missing: "cloudflaredMissing",
+				cloudflared_component_invalid: "cloudflaredInvalid",
+				cloudflared_port_unavailable: "cloudflaredPortUnavailable",
+				cloudflared_launch_failed: "cloudflaredLaunchFailed",
+				cloudflared_start_timeout: "cloudflaredTimeout",
+				cloudflared_stopped: "cloudflaredStopped",
+				cloudflared_exited: "cloudflaredExited",
+				cloudflared_invalid_output: "cloudflaredOutputInvalid",
+				cloudflared_invalid_origin: "cloudflaredOriginInvalid",
+				cloudflared_tunnel_port_unavailable: "cloudflaredTunnelPortUnavailable",
+				cloudflared_tunnel_hostname_invalid: "cloudflaredTunnelHostnameInvalid",
+				cloudflared_tunnel_port_invalid: "cloudflaredTunnelPortInvalid",
+				cloudflared_tunnel_port_reserved: "cloudflaredTunnelPortReserved",
+				cloudflared_tunnel_token_invalid: "cloudflaredTunnelTokenInvalid",
+				cloudflared_tunnel_settings_invalid: "cloudflaredTunnelSettingsInvalid",
+				cloudflared_tunnel_config_missing: "cloudflaredTunnelConfigMissing",
+				cloudflared_tunnel_config_invalid: "cloudflaredTunnelInvalid",
+				cloudflared_tunnel_target_invalid: "cloudflaredTunnelTargetInvalid",
+				cloudflared_component_unsupported: "cloudflaredComponentUnsupported",
+				cloudflared_download_hash_mismatch: "cloudflaredDownloadHashMismatch",
+				cloudflared_download_size_mismatch: "cloudflaredDownloadSizeMismatch",
+				cloudflared_executable_hash_mismatch: "cloudflaredExecutableHashMismatch",
+				cloudflared_download_redirect_missing: "cloudflaredDownloadRedirectMissing",
+				cloudflared_download_redirect_invalid: "cloudflaredDownloadRedirectInvalid",
+				cloudflared_download_redirect_rejected: "cloudflaredDownloadRedirectRejected",
+				cloudflared_port_reservation_failed: "cloudflaredPortReservationFailed",
+				frp_component_missing: "frpMissing",
+				frp_component_invalid: "frpInvalid",
+				frp_config_missing: "frpConfigMissing",
+				frp_config_verify_failed: "frpConfigVerifyFailed",
+				frp_vhost_publicly_reachable: "frpVhostPublic",
+				frp_vhost_probe_failed: "frpVhostProbeFailed",
+				frp_launch_failed: "frpLaunchFailed",
+				frp_start_timeout: "frpTimeout",
+				frp_discovery_mismatch: "frpDiscoveryMismatch",
+				frp_discovery_invalid: "frpDiscoveryInvalid",
+				frp_stopped: "frpStopped",
+				frp_exited: "frpExited",
+				...ORIGIN_ERROR_MESSAGE_KEYS
+			};
+			/** The table above, translated, for the status repaint. */
+			const translatedRemoteErrors = () => Object.fromEntries(Object.entries(REMOTE_ERROR_MESSAGE_KEYS).map(([code, key]) => [code, t(key)]));
+			/**
+			* Text for a failed control request.
+			*
+			* A rejection carries its code in `error.message`, so a known code renders its
+			* translated sentence; only an unrecognized one falls back to the generic message,
+			* and it shows the bare message rather than a stringified Error.
+			*/
+			const remoteFailureTextFor = (error, fallbackKey) => {
+				const message = error instanceof Error ? error.message : String(error);
+				const key = REMOTE_ERROR_MESSAGE_KEYS[message];
+				return key === void 0 ? t(fallbackKey, { error: message }) : t(key);
+			};
 			const locale = selectedMobileControlLocale();
 			const localeTag = locale === "it" ? "it-IT" : locale === "zh" ? "zh-CN" : "en-US";
 			const t = controlTranslator(locale);
@@ -2728,6 +3204,10 @@ window.__ModuleLoader__.load({
 			remoteView.hidden = true;
 			const remoteIntro = element("p", "dsh-mobile-control__intro");
 			remoteIntro.textContent = t("remoteIntro");
+			const httpFrameWarning = element("p", "dsh-mobile-control__http-frame-warning");
+			httpFrameWarning.textContent = t("httpFrameWarning");
+			httpFrameWarning.hidden = location.protocol !== "https:";
+			httpFrameWarning.setAttribute("role", "note");
 			const providerSection = element("section", "dsh-mobile-control__provider-section");
 			const providerHeading = element("h3", "dsh-mobile-control__section-title");
 			providerHeading.textContent = t("chooseProvider");
@@ -2781,7 +3261,35 @@ window.__ModuleLoader__.load({
 			cpolarChoiceDescription.textContent = t("cpolarDescription");
 			cpolarChoiceTop.append(cpolarChoiceName, cpolarChoiceBadge);
 			cpolarChoice.append(cpolarChoiceTop, cpolarChoiceDescription);
-			providerChoices.append(cpolarChoice, tailscaleChoice);
+			const cloudflaredChoice = element("button", "dsh-mobile-control__provider");
+			cloudflaredChoice.type = "button";
+			cloudflaredChoice.setAttribute("role", "radio");
+			cloudflaredChoice.setAttribute("aria-checked", "false");
+			const cloudflaredChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const cloudflaredChoiceName = element("strong");
+			cloudflaredChoiceName.textContent = "cloudflared";
+			const cloudflaredChoiceBadge = element("span", "dsh-mobile-control__provider-badge");
+			cloudflaredChoiceBadge.textContent = t("cloudflaredBadge");
+			const cloudflaredChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			cloudflaredChoiceDescription.textContent = t("cloudflaredDescription");
+			cloudflaredChoiceTop.append(cloudflaredChoiceName, cloudflaredChoiceBadge);
+			cloudflaredChoice.append(cloudflaredChoiceTop, cloudflaredChoiceDescription);
+			providerChoices.append(cpolarChoice, cloudflaredChoice, tailscaleChoice);
+			const providerCardOrder = [
+				cpolarChoice,
+				cloudflaredChoice,
+				tailscaleChoice
+			];
+			providerChoices.addEventListener("keydown", (event) => {
+				const step = event.key === "ArrowRight" || event.key === "ArrowDown" ? 1 : event.key === "ArrowLeft" || event.key === "ArrowUp" ? -1 : 0;
+				const jump = event.key === "Home" ? 0 : event.key === "End" ? providerCardOrder.length - 1 : void 0;
+				if (step === 0 && jump === void 0) return;
+				const current = providerCardOrder.indexOf(document.activeElement);
+				if (current < 0) return;
+				const next = jump ?? (current + step + providerCardOrder.length) % providerCardOrder.length;
+				event.preventDefault();
+				providerCardOrder[next]?.focus();
+			});
 			const cpolarSetup = element("section", "dsh-mobile-control__cpolar-setup");
 			cpolarSetup.hidden = true;
 			const cpolarSetupTitle = element("h3", "dsh-mobile-control__section-title");
@@ -2843,6 +3351,96 @@ window.__ModuleLoader__.load({
 			cpolarDetailsBody.append(cpolarDetailsText, cpolarStorage, cpolarOfficial, cpolarTerms, cpolarPurge);
 			cpolarDetails.append(cpolarDetailsSummary, cpolarDetailsBody);
 			cpolarSetup.append(cpolarSetupTitle, cpolarComponentStatus, cpolarInstall, cpolarAccount, cpolarDetails);
+			const cloudflaredSetup = element("section", "dsh-mobile-control__cpolar-setup dsh-mobile-control__cloudflared-setup");
+			cloudflaredSetup.hidden = true;
+			const cloudflaredSetupTitle = element("h3", "dsh-mobile-control__section-title");
+			cloudflaredSetupTitle.textContent = t("prepareCloudflared");
+			const cloudflaredTunnelTitle = element("h3", "dsh-mobile-control__section-title");
+			cloudflaredTunnelTitle.textContent = t("cloudflaredTunnelTitle");
+			const cloudflaredMode = element("div", "dsh-mobile-control__switcher");
+			const cloudflaredModeQuick = element("button", "dsh-mobile-control__tab is-active");
+			cloudflaredModeQuick.type = "button";
+			cloudflaredModeQuick.textContent = t("cloudflaredTunnelQuick");
+			const cloudflaredModeNamed = element("button", "dsh-mobile-control__tab");
+			cloudflaredModeNamed.type = "button";
+			cloudflaredModeNamed.textContent = t("cloudflaredTunnelNamed");
+			cloudflaredMode.append(cloudflaredModeQuick, cloudflaredModeNamed);
+			const cloudflaredModeHint = element("p", "dsh-mobile-control__component-status");
+			cloudflaredModeHint.textContent = t("cloudflaredTunnelQuickHint");
+			const cloudflaredTunnel = element("div", "dsh-mobile-control__tunnel");
+			cloudflaredTunnel.hidden = true;
+			const cloudflaredTunnelFields = element("div", "dsh-mobile-control__frp-fields");
+			const cloudflaredHostnameLabel = element("label", "dsh-mobile-control__field");
+			cloudflaredHostnameLabel.textContent = t("cloudflaredTunnelHostname");
+			const cloudflaredHostname = element("input");
+			cloudflaredHostname.type = "text";
+			cloudflaredHostname.autocomplete = "off";
+			cloudflaredHostname.spellcheck = false;
+			cloudflaredHostname.placeholder = t("cloudflaredTunnelHostnamePlaceholder");
+			const cloudflaredPortLabel = element("label", "dsh-mobile-control__field");
+			cloudflaredPortLabel.textContent = t("cloudflaredTunnelPort");
+			const cloudflaredPort = element("input");
+			cloudflaredPort.type = "number";
+			cloudflaredPort.inputMode = "numeric";
+			cloudflaredPort.min = "1024";
+			cloudflaredPort.max = "65535";
+			cloudflaredPort.value = "3444";
+			const cloudflaredTokenLabel = element("label", "dsh-mobile-control__field");
+			cloudflaredTokenLabel.textContent = t("cloudflaredTunnelToken");
+			const cloudflaredToken = element("input");
+			cloudflaredToken.type = "password";
+			cloudflaredToken.autocomplete = "off";
+			cloudflaredToken.spellcheck = false;
+			cloudflaredToken.placeholder = t("cloudflaredTunnelTokenPlaceholder");
+			cloudflaredHostnameLabel.append(cloudflaredHostname);
+			cloudflaredPortLabel.append(cloudflaredPort);
+			cloudflaredTokenLabel.append(cloudflaredToken);
+			cloudflaredTunnelFields.append(cloudflaredHostnameLabel, cloudflaredPortLabel, cloudflaredTokenLabel);
+			const cloudflaredTunnelStatus = element("p", "dsh-mobile-control__component-status");
+			cloudflaredTunnelStatus.textContent = t("cloudflaredTunnelMissing");
+			const cloudflaredTunnelHint = element("p", "dsh-mobile-control__component-status");
+			cloudflaredTunnelHint.textContent = t("cloudflaredTunnelHint", { port: "3444" });
+			const cloudflaredTunnelSave = element("button", "dsh-mobile-control__primary dsh-mobile-control__frp-action");
+			cloudflaredTunnelSave.type = "button";
+			cloudflaredTunnelSave.textContent = t("cloudflaredTunnelSave");
+			/** The button commits the shown mode, so quick mode must not promise to save settings. */
+			const cloudflaredSaveLabel = () => (cloudflaredModeDraft ?? cloudflaredTunnelMode) === "named" ? t("cloudflaredTunnelSave") : t("cloudflaredTunnelSaveQuick");
+			const cloudflaredTunnelForget = element("button", "dsh-mobile-control__danger dsh-mobile-control__frp-action");
+			cloudflaredTunnelForget.type = "button";
+			cloudflaredTunnelForget.textContent = t("cloudflaredTunnelForget");
+			cloudflaredTunnelForget.hidden = true;
+			cloudflaredTunnel.append(cloudflaredTunnelFields, cloudflaredTunnelStatus, cloudflaredTunnelHint);
+			const cloudflaredComponentStatus = element("p", "dsh-mobile-control__component-status");
+			cloudflaredComponentStatus.textContent = t("checkingComponent");
+			const cloudflaredInstall = element("button", "dsh-mobile-control__primary");
+			cloudflaredInstall.type = "button";
+			cloudflaredInstall.textContent = t("installOfficial");
+			const cloudflaredNote = element("p", "dsh-mobile-control__origin-warning");
+			cloudflaredNote.textContent = t("cloudflaredQuickNote");
+			const cloudflaredDetails = element("details", "dsh-mobile-control__details");
+			const cloudflaredDetailsSummary = element("summary");
+			cloudflaredDetailsSummary.textContent = t("componentDetails");
+			const cloudflaredDetailsBody = element("div", "dsh-mobile-control__details-body");
+			const cloudflaredDetailsText = element("p");
+			cloudflaredDetailsText.textContent = t("cloudflaredComponentNote");
+			const cloudflaredStorage = element("code", "dsh-mobile-control__storage");
+			cloudflaredStorage.textContent = t("pluginPrivateDirectory");
+			const cloudflaredOfficial = element("a", "dsh-mobile-control__text-link");
+			cloudflaredOfficial.href = "https://github.com/cloudflare/cloudflared/releases";
+			cloudflaredOfficial.target = "_blank";
+			cloudflaredOfficial.rel = "noopener noreferrer";
+			cloudflaredOfficial.textContent = t("officialDownload");
+			const cloudflaredTerms = element("a", "dsh-mobile-control__text-link");
+			cloudflaredTerms.href = "https://www.cloudflare.com/website-terms/";
+			cloudflaredTerms.target = "_blank";
+			cloudflaredTerms.rel = "noopener noreferrer";
+			cloudflaredTerms.textContent = t("terms");
+			const cloudflaredPurge = element("button", "dsh-mobile-control__danger");
+			cloudflaredPurge.type = "button";
+			cloudflaredPurge.textContent = t("purgeCloudflared");
+			cloudflaredDetailsBody.append(cloudflaredDetailsText, cloudflaredStorage, cloudflaredOfficial, cloudflaredTerms, cloudflaredPurge);
+			cloudflaredDetails.append(cloudflaredDetailsSummary, cloudflaredDetailsBody);
+			cloudflaredSetup.append(cloudflaredSetupTitle, cloudflaredTunnelTitle, cloudflaredMode, cloudflaredModeHint, cloudflaredTunnel, cloudflaredTunnelSave, cloudflaredTunnelForget, cloudflaredComponentStatus, cloudflaredInstall, cloudflaredNote, cloudflaredDetails);
 			const selfHosted = element("details", "dsh-mobile-control__self-hosted");
 			const selfHostedSummary = element("summary", "dsh-mobile-control__self-hosted-summary");
 			const selfHostedSummaryText = element("span");
@@ -2865,7 +3463,17 @@ window.__ModuleLoader__.load({
 			frpChoiceDescription.textContent = t("frpDescription");
 			frpChoiceTop.append(frpChoiceName);
 			frpChoice.append(frpChoiceTop, frpChoiceDescription);
-			selfHostedBody.append(frpChoice);
+			const originChoice = element("button", "dsh-mobile-control__provider is-origin");
+			originChoice.type = "button";
+			originChoice.setAttribute("aria-pressed", "false");
+			const originChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const originChoiceName = element("strong");
+			originChoiceName.textContent = t("originName");
+			const originChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			originChoiceDescription.textContent = t("originDescription");
+			originChoiceTop.append(originChoiceName);
+			originChoice.append(originChoiceTop, originChoiceDescription);
+			selfHostedBody.append(frpChoice, originChoice);
 			selfHosted.append(selfHostedSummary, selfHostedBody);
 			providerSection.append(providerHeading, providerInfo, providerChoices, selfHosted);
 			const frpSetup = element("section", "dsh-mobile-control__frp-setup");
@@ -3046,6 +3654,82 @@ window.__ModuleLoader__.load({
 			frpVerifySummary.textContent = t("frpStep4Title");
 			frpVerifyGroup.append(frpVerifySummary, frpStep4);
 			frpSetup.append(frpSetupTitle, frpOverview, frpConnectionGroup, frpVpsGroup, frpComponentGroup, frpVerifyGroup, frpDetails);
+			const originSetup = element("section", "dsh-mobile-control__origin-setup");
+			originSetup.hidden = true;
+			const originSetupTitle = element("h3", "dsh-mobile-control__section-title");
+			originSetupTitle.textContent = t("prepareOrigin");
+			const originHelp = element("p", "dsh-mobile-control__component-note");
+			originHelp.id = "dsh-mobile-origin-help";
+			originHelp.textContent = t("originHelp");
+			const originWarning = element("p", "dsh-mobile-control__origin-warning");
+			originWarning.textContent = t("originWarning");
+			const originFields = element("div", "dsh-mobile-control__origin-fields");
+			const originPublicLabel = element("label", "dsh-mobile-control__field");
+			originPublicLabel.textContent = t("originPublicOrigin");
+			const originPublic = element("input");
+			originPublic.type = "url";
+			originPublic.placeholder = "https://phone.example.com:8815";
+			originPublic.maxLength = 512;
+			const originHostLabel = element("label", "dsh-mobile-control__field");
+			originHostLabel.textContent = t("originListenHost");
+			const originHost = element("input");
+			originHost.type = "text";
+			originHost.value = "127.0.0.1";
+			originHost.maxLength = 15;
+			const originPortLabel = element("label", "dsh-mobile-control__field");
+			originPortLabel.textContent = t("originListenPort");
+			const originPort = element("input");
+			originPort.type = "number";
+			originPort.inputMode = "numeric";
+			originPort.min = "1024";
+			originPort.max = "65535";
+			originPort.step = "1";
+			originPort.value = "3444";
+			const originCidrsLabel = element("label", "dsh-mobile-control__field");
+			originCidrsLabel.textContent = t("originAllowedCidrs");
+			const originCidrs = element("input");
+			originCidrs.type = "text";
+			originCidrs.value = "127.0.0.0/8";
+			originCidrs.maxLength = 1040;
+			for (const input of [
+				originPublic,
+				originHost,
+				originPort,
+				originCidrs
+			]) {
+				input.required = true;
+				input.autocomplete = "off";
+				input.spellcheck = false;
+				input.setAttribute("aria-describedby", "dsh-mobile-origin-help dsh-mobile-origin-feedback");
+			}
+			originPublicLabel.append(originPublic);
+			originHostLabel.append(originHost);
+			originPortLabel.append(originPort);
+			originCidrsLabel.append(originCidrs);
+			originFields.append(originPublicLabel, originHostLabel, originPortLabel, originCidrsLabel);
+			const originFeedback = element("p", "dsh-mobile-control__origin-feedback");
+			originFeedback.id = "dsh-mobile-origin-feedback";
+			originFeedback.setAttribute("role", "status");
+			originFeedback.setAttribute("aria-live", "polite");
+			originFeedback.hidden = true;
+			const originConfigure = element("button", "dsh-mobile-control__primary");
+			originConfigure.type = "button";
+			originConfigure.textContent = t("originSaveStart");
+			const originPurge = element("button", "dsh-mobile-control__danger");
+			originPurge.type = "button";
+			originPurge.textContent = t("originPurge");
+			originPurge.hidden = true;
+			const originFormActions = element("div", "dsh-mobile-control__actions");
+			originFormActions.append(originConfigure, originPurge);
+			const originBackend = element("div", "dsh-mobile-control__origin-backend");
+			originBackend.hidden = true;
+			const originBackendLabel = element("span", "dsh-mobile-control__access-label");
+			const originBackendAddress = element("code", "dsh-mobile-control__storage");
+			const originCopyBackend = element("button", "dsh-mobile-control__secondary");
+			originCopyBackend.type = "button";
+			originCopyBackend.textContent = t("originCopyBackend");
+			originBackend.append(originBackendLabel, originBackendAddress, originCopyBackend);
+			originSetup.append(originSetupTitle, originHelp, originWarning, originFields, originFeedback, originFormActions, originBackend);
 			const tailscaleInfo = element("details", "dsh-mobile-control__details");
 			const tailscaleInfoSummary = element("summary");
 			tailscaleInfoSummary.textContent = t("tailscaleHelp");
@@ -3065,7 +3749,7 @@ window.__ModuleLoader__.load({
 			providerSetupMeta.append(providerSetupName, remoteStateBadge);
 			providerSetupHeader.append(providerSetupHeading, providerSetupMeta);
 			const providerSetupBody = element("div", "dsh-mobile-control__provider-setup-body");
-			providerSetupBody.append(cpolarSetup, frpSetup, tailscaleInfo);
+			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, tailscaleInfo);
 			const remoteAccess = element("div", "dsh-mobile-control__access");
 			remoteAccess.hidden = true;
 			const remoteAccessLabel = element("span", "dsh-mobile-control__access-label");
@@ -3372,7 +4056,7 @@ window.__ModuleLoader__.load({
 			header.append(title, headerActions);
 			actions.append(toggle, pair, linkPair);
 			lanView.append(lanSetup, access, qrBox, status, extensionStatus, actions, manageRow, devicePanel);
-			remoteView.append(remoteIntro, providerSection, remoteWorkspace);
+			remoteView.append(remoteIntro, httpFrameWarning, providerSection, remoteWorkspace);
 			diagnosticsView.append(diagnosticsIntro, diagnosticsSummary, diagnosticsToolbar, diagnosticsFeedback, diagnosticsChecks, wsPathsSection, diagnosticsDetails);
 			panel.append(header, releaseNotice, updateCard, appDownload, switcher, lanView, remoteView, diagnosticsView);
 			root.append(panel);
@@ -3391,8 +4075,23 @@ window.__ModuleLoader__.load({
 			let remoteSetupOpenedAt = 0;
 			let remoteReconnectBusy = false;
 			let remoteProviderBusy = false;
+			let remoteFailureText;
 			let cpolarInstalled = false;
 			let cpolarConfigured = false;
+			let cloudflaredInstalled = false;
+			let cloudflaredDownloadSize = "";
+			let cloudflaredTunnelMode = "quick";
+			let cloudflaredModeDraft = null;
+			let cloudflaredTunnelConfigured = false;
+			let configuredCloudflaredHostname = "";
+			let configuredCloudflaredPort = 3444;
+			let cloudflaredHostnameDirty = false;
+			let cloudflaredPortDirty = false;
+			let originConfigured = false;
+			let originFormDirty = false;
+			let originFormBusy = false;
+			let remoteSnapshotEpoch = 0;
+			let latestRemoteState = {};
 			let frpInstalled = false;
 			let frpConfigured = false;
 			let frpLayoutInitialized = false;
@@ -3697,24 +4396,38 @@ window.__ModuleLoader__.load({
 				});
 			});
 			const renderRemote = (data) => {
+				latestRemoteState = data;
 				remoteRunning = data.running === true;
-				remoteProvider = data.provider === "cpolar" ? "cpolar" : data.provider === "frp" ? "frp" : "tailscale";
+				remoteProvider = parseMobileRemoteProvider(data.provider);
 				const cpolar = remoteProvider === "cpolar";
+				const cloudflared = remoteProvider === "cloudflared";
 				const frp = remoteProvider === "frp";
+				const origin = remoteProvider === "origin";
 				const tailscale = remoteProvider === "tailscale";
 				tailscaleChoice.classList.toggle("is-selected", tailscale);
 				cpolarChoice.classList.toggle("is-selected", cpolar);
+				cloudflaredChoice.classList.toggle("is-selected", cloudflared);
 				frpChoice.classList.toggle("is-selected", frp);
+				originChoice.classList.toggle("is-selected", origin);
 				tailscaleChoice.setAttribute("aria-checked", String(tailscale));
 				cpolarChoice.setAttribute("aria-checked", String(cpolar));
+				cloudflaredChoice.setAttribute("aria-checked", String(cloudflared));
+				tailscaleChoice.tabIndex = tailscale ? 0 : -1;
+				cpolarChoice.tabIndex = cpolar ? 0 : -1;
+				cloudflaredChoice.tabIndex = cloudflared ? 0 : -1;
 				frpChoice.setAttribute("aria-pressed", String(frp));
-				providerSetupName.textContent = cpolar ? "cpolar" : frp ? t("frpName") : "Tailscale Funnel";
+				originChoice.setAttribute("aria-pressed", String(origin));
+				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t("originName") : "Tailscale Funnel";
 				tailscaleChoice.disabled = remoteProviderBusy;
 				cpolarChoice.disabled = remoteProviderBusy;
+				cloudflaredChoice.disabled = remoteProviderBusy;
 				frpChoice.disabled = remoteProviderBusy;
+				originChoice.disabled = remoteProviderBusy;
 				cpolarSetup.hidden = !cpolar;
+				cloudflaredSetup.hidden = !cloudflared;
 				frpSetup.hidden = !frp;
-				if (frp) selfHosted.open = true;
+				originSetup.hidden = !origin;
+				if (frp || origin) selfHosted.open = true;
 				tailscaleInfo.hidden = !tailscale;
 				remoteReset.textContent = tailscale ? t("resetRemoteLogin") : t("resetRemoteDevices");
 				const providers = data.providers !== null && typeof data.providers === "object" ? data.providers : {};
@@ -3736,6 +4449,52 @@ window.__ModuleLoader__.load({
 				cpolarConfigure.disabled = remoteProviderBusy;
 				cpolarPurge.hidden = !cpolarInstalled && !cpolarConfigured;
 				cpolarComponentStatus.textContent = !cpolarSupported ? t("cpolarUnsupported") : !cpolarInstalled ? t("cpolarNotInstalled") : !cpolarConfigured ? t("cpolarNeedsToken", { version: componentVersion }) : t("cpolarReady", { version: componentVersion });
+				const cloudflaredProvider = providers.cloudflared !== null && typeof providers.cloudflared === "object" ? providers.cloudflared : {};
+				const cloudflaredComponent = cloudflaredProvider.component !== null && typeof cloudflaredProvider.component === "object" ? cloudflaredProvider.component : {};
+				cloudflaredInstalled = cloudflaredComponent.installed === true;
+				const cloudflaredSupported = cloudflaredComponent.supported !== false;
+				const cloudflaredComponentError = typeof cloudflaredComponent.errorCode === "string" ? cloudflaredComponent.errorCode : "";
+				const cloudflaredVersion = typeof cloudflaredComponent.version === "string" ? cloudflaredComponent.version : "";
+				const cloudflaredDownloadBytes = typeof cloudflaredComponent.downloadBytes === "number" ? cloudflaredComponent.downloadBytes : 0;
+				if (cloudflaredDownloadBytes > 0) cloudflaredDownloadSize = formatMegabytes(cloudflaredDownloadBytes);
+				const cloudflaredStoragePath = typeof cloudflaredComponent.storagePath === "string" ? cloudflaredComponent.storagePath : `DSH Mobile ${t("pluginPrivateDirectory")}`;
+				cloudflaredStorage.textContent = cloudflaredStoragePath;
+				cloudflaredStorage.title = cloudflaredStoragePath;
+				cloudflaredChoiceBadge.textContent = cloudflaredInstalled ? t("ready") : t("cloudflaredBadge");
+				cloudflaredInstall.hidden = cloudflaredInstalled || !cloudflaredSupported;
+				cloudflaredInstall.textContent = cloudflaredDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(cloudflaredDownloadBytes) }) : t("installOfficial");
+				cloudflaredInstall.disabled = remoteProviderBusy;
+				cloudflaredPurge.hidden = !cloudflaredInstalled;
+				cloudflaredComponentStatus.textContent = !cloudflaredSupported ? t("cloudflaredUnsupported") : !cloudflaredInstalled ? cloudflaredComponentError === "cloudflared_component_invalid" ? t("cloudflaredInvalid") : t("cloudflaredNotInstalled") : t("cloudflaredReady", { version: cloudflaredVersion });
+				const cloudflaredTunnelConfiguration = cloudflaredProvider.configuration !== null && typeof cloudflaredProvider.configuration === "object" ? cloudflaredProvider.configuration : {};
+				cloudflaredTunnelMode = cloudflaredTunnelConfiguration.mode === "named" ? "named" : "quick";
+				cloudflaredTunnelConfigured = cloudflaredTunnelConfiguration.configured === true;
+				configuredCloudflaredHostname = typeof cloudflaredTunnelConfiguration.hostname === "string" ? cloudflaredTunnelConfiguration.hostname : "";
+				configuredCloudflaredPort = typeof cloudflaredTunnelConfiguration.port === "number" ? cloudflaredTunnelConfiguration.port : 3444;
+				const cloudflaredTunnelError = typeof cloudflaredTunnelConfiguration.errorCode === "string" ? cloudflaredTunnelConfiguration.errorCode : "";
+				if (cloudflaredModeDraft !== null && cloudflaredModeDraft === cloudflaredTunnelMode) cloudflaredModeDraft = null;
+				const cloudflaredShownMode = cloudflaredModeDraft ?? cloudflaredTunnelMode;
+				cloudflaredModeQuick.classList.toggle("is-active", cloudflaredShownMode === "quick");
+				cloudflaredModeNamed.classList.toggle("is-active", cloudflaredShownMode === "named");
+				cloudflaredModeQuick.setAttribute("aria-pressed", String(cloudflaredShownMode === "quick"));
+				cloudflaredModeNamed.setAttribute("aria-pressed", String(cloudflaredShownMode === "named"));
+				cloudflaredModeQuick.disabled = remoteProviderBusy;
+				cloudflaredModeNamed.disabled = remoteProviderBusy;
+				cloudflaredModeHint.textContent = cloudflaredShownMode === "named" ? t("cloudflaredTunnelNamedHint") : t("cloudflaredTunnelQuickHint");
+				cloudflaredNote.textContent = cloudflaredShownMode === "named" ? t("cloudflaredNamedNote") : t("cloudflaredQuickNote");
+				cloudflaredTunnel.hidden = cloudflaredShownMode !== "named";
+				cloudflaredTunnelSave.textContent = cloudflaredSaveLabel();
+				if (!cloudflaredHostnameDirty) cloudflaredHostname.value = configuredCloudflaredHostname;
+				if (!cloudflaredPortDirty) cloudflaredPort.value = String(configuredCloudflaredPort);
+				cloudflaredToken.placeholder = cloudflaredTunnelConfigured ? t("cloudflaredTunnelTokenSaved") : t("cloudflaredTunnelTokenPlaceholder");
+				const cloudflaredFieldPort = String(cloudflaredPort.value ?? "").trim();
+				cloudflaredTunnelHint.textContent = t("cloudflaredTunnelHint", { port: cloudflaredFieldPort === "" ? String(configuredCloudflaredPort) : cloudflaredFieldPort });
+				cloudflaredTunnelStatus.textContent = cloudflaredTunnelError !== "" ? t("cloudflaredTunnelInvalid") : cloudflaredTunnelConfigured ? t("cloudflaredTunnelConfigured", {
+					hostname: configuredCloudflaredHostname,
+					port: String(configuredCloudflaredPort)
+				}) : t("cloudflaredTunnelMissing");
+				cloudflaredTunnelSave.disabled = remoteProviderBusy || !cloudflaredInstalled;
+				cloudflaredTunnelForget.hidden = !cloudflaredTunnelConfigured;
 				const frpProvider = providers.frp !== null && typeof providers.frp === "object" ? providers.frp : {};
 				const frpComponent = frpProvider.component !== null && typeof frpProvider.component === "object" ? frpProvider.component : {};
 				const frpConfiguration = frpProvider.configuration !== null && typeof frpProvider.configuration === "object" ? frpProvider.configuration : {};
@@ -3776,7 +4535,34 @@ window.__ModuleLoader__.load({
 					frpVpsGroup.open = !frpConfigured;
 					frpLayoutInitialized = true;
 				}
-				selfHostedBadge.textContent = frpConfigured && frpInstalled ? t("ready") : t("advanced");
+				const originProvider = providers.origin !== null && typeof providers.origin === "object" ? providers.origin : {};
+				const originConfiguration = originProvider.configuration !== null && typeof originProvider.configuration === "object" ? originProvider.configuration : {};
+				originConfigured = originConfiguration.configured === true;
+				if (!originFormDirty && !originFormBusy) {
+					originPublic.value = typeof originConfiguration.publicOrigin === "string" ? originConfiguration.publicOrigin : "";
+					originHost.value = typeof originConfiguration.listenHost === "string" ? originConfiguration.listenHost : "127.0.0.1";
+					originPort.value = typeof originConfiguration.listenPort === "number" ? String(originConfiguration.listenPort) : "3444";
+					originCidrs.value = Array.isArray(originConfiguration.allowedCidrs) ? originConfiguration.allowedCidrs.filter((value) => typeof value === "string").join(", ") : "127.0.0.0/8";
+				}
+				originSetup.setAttribute("aria-busy", String(originFormBusy));
+				originConfigure.setAttribute("aria-busy", String(originFormBusy));
+				originConfigure.textContent = originFormBusy ? t("saving") : t("originSaveStart");
+				for (const input of [
+					originPublic,
+					originHost,
+					originPort,
+					originCidrs
+				]) input.disabled = remoteProviderBusy;
+				originConfigure.disabled = remoteProviderBusy;
+				originPurge.disabled = remoteProviderBusy;
+				originPurge.hidden = !originConfigured && originConfiguration.errorCode !== "origin_config_invalid" && originProvider.running !== true;
+				const originListening = origin && originProvider.state === "ready" && originProvider.running === true;
+				const backendOrigin = originListening && typeof data.backendOrigin === "string" ? data.backendOrigin : typeof originConfiguration.backendOrigin === "string" ? originConfiguration.backendOrigin : "";
+				originBackend.hidden = backendOrigin === "";
+				originBackendLabel.textContent = originListening ? t("originBackendListening") : t("originBackendSaved");
+				originBackendAddress.textContent = backendOrigin;
+				originCopyBackend.disabled = remoteProviderBusy || backendOrigin === "";
+				selfHostedBadge.textContent = origin ? originListening ? t("originBackendReady") : t("advanced") : frpConfigured && frpInstalled ? t("ready") : t("advanced");
 				const state = typeof data.state === "string" ? data.state : "error";
 				const errorCode = typeof data.errorCode === "string" ? data.errorCode : "";
 				const remoteOrigin = typeof data.origin === "string" ? data.origin : "";
@@ -3792,7 +4578,7 @@ window.__ModuleLoader__.load({
 				remoteStateBadge.classList.toggle("is-ready", remoteReady);
 				remoteStateBadge.classList.toggle("is-busy", state === "starting" || state === "connecting" || state === "needs-login");
 				remoteStateBadge.classList.toggle("is-attention", state === "error" || state === "unavailable");
-				remoteStateBadge.textContent = remoteReady ? t("ready") : state === "starting" || state === "connecting" || state === "needs-login" ? t("remoteStateConnecting") : state === "error" || state === "unavailable" ? t("remoteStateAttention") : t("remoteStateOff");
+				remoteStateBadge.textContent = remoteReady ? origin ? t("originBackendReady") : t("ready") : state === "starting" || state === "connecting" || state === "needs-login" ? t("remoteStateConnecting") : state === "error" || state === "unavailable" ? t("remoteStateAttention") : t("remoteStateOff");
 				remoteAccess.hidden = !remoteReady;
 				remoteAccessLink.href = remoteOrigin;
 				remoteAccessLink.textContent = remoteOrigin;
@@ -3800,58 +4586,35 @@ window.__ModuleLoader__.load({
 				remoteStatus.classList.toggle("is-running", remoteReady);
 				const labels = {
 					off: t("remoteOff"),
-					unavailable: cpolar ? t("remoteUnavailableCpolar") : frp ? t("remoteUnavailableFrp") : t("remoteUnavailableTailscale"),
-					starting: cpolar ? t("remoteStartingCpolar") : frp ? t("remoteStartingFrp") : t("remoteStartingTailscale"),
+					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : t("remoteUnavailableTailscale"),
+					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
-					connecting: cpolar ? t("remoteConnectingCpolar") : frp ? t("remoteConnectingFrp") : t("remoteConnectingTailscale"),
-					ready: t("remoteReady"),
+					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : t("remoteConnectingTailscale"),
+					ready: origin ? t("originReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
-				const errorLabels = {
-					funnel_permission_required: t("funnelPermission"),
-					funnel_https_required: t("funnelHttps"),
-					funnel_start_failed: t("funnelStart"),
-					funnel_start_timeout: t("funnelTimeout"),
-					tailscale_dns_missing: t("tailscaleDnsMissing"),
-					gateway_start_failed: t("gatewayStartFailed"),
-					control_channel_failed: t("controlChannelFailed"),
-					cpolar_component_missing: t("cpolarMissing"),
-					cpolar_component_invalid: t("cpolarInvalid"),
-					cpolar_config_missing: t("cpolarConfigMissing"),
-					cpolar_config_invalid: t("cpolarConfigInvalid"),
-					cpolar_port_unavailable: t("cpolarPortUnavailable"),
-					cpolar_launch_failed: t("cpolarLaunchFailed"),
-					cpolar_start_timeout: t("cpolarTimeout"),
-					cpolar_stopped: t("cpolarStopped"),
-					cpolar_exited: t("cpolarExited"),
-					cpolar_invalid_output: t("cpolarOutputInvalid"),
-					cpolar_invalid_origin: t("cpolarOriginInvalid"),
-					frp_component_missing: t("frpMissing"),
-					frp_component_invalid: t("frpInvalid"),
-					frp_config_missing: t("frpConfigMissing"),
-					frp_config_verify_failed: t("frpConfigVerifyFailed"),
-					frp_vhost_publicly_reachable: t("frpVhostPublic"),
-					frp_vhost_probe_failed: t("frpVhostProbeFailed"),
-					frp_launch_failed: t("frpLaunchFailed"),
-					frp_start_timeout: t("frpTimeout"),
-					frp_discovery_mismatch: t("frpDiscoveryMismatch"),
-					frp_discovery_invalid: t("frpDiscoveryInvalid"),
-					frp_stopped: t("frpStopped"),
-					frp_exited: t("frpExited")
-				};
+				const errorLabels = translatedRemoteErrors();
 				remoteStatus.textContent = remoteSetupPending && needsFunnelSetup ? t("setupOpened") : state === "error" ? errorLabels[errorCode] ?? labels.error : labels[state] ?? labels.error;
+				if (remoteFailureText !== void 0) {
+					remoteStatus.textContent = remoteFailureText;
+					remoteFailureText = void 0;
+				}
 				remoteGuide.hidden = !needsFunnelSetup;
 				remoteSetup.disabled = remoteSetupUrl === "" || remoteReconnectBusy;
 				remoteSetupRetry.disabled = remoteReconnectBusy;
 				remoteToggle.textContent = remoteRunning ? t("disableRemote") : t("enableRemote");
-				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : frp ? frpInstalled && frpConfigured : true;
-				remoteToggle.disabled = remoteProviderBusy || !providerPrepared;
+				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originConfigured : true;
+				remoteToggle.disabled = remoteProviderBusy || !providerPrepared && !(origin && remoteRunning);
 				remoteLogin.hidden = !tailscale || state !== "needs-login" || remoteLoginUrl === "";
 				remoteReconnect.hidden = needsFunnelSetup || state !== "error" && state !== "unavailable" || !providerPrepared;
-				remoteActions.hidden = !providerPrepared;
-				remotePair.disabled = !remoteReady;
-				remoteCopyLink.disabled = !remoteReady;
-				remoteDevices.disabled = !remoteReady;
+				remoteActions.hidden = !providerPrepared && !(origin && remoteRunning);
+				remotePair.disabled = !remoteReady || originFormBusy;
+				remoteCopyLink.disabled = !remoteReady || originFormBusy;
+				remoteDevices.disabled = !remoteReady || originFormBusy;
+				if (origin) {
+					remoteReconnect.disabled = remoteProviderBusy || remoteReconnectBusy;
+					remoteReset.disabled = remoteProviderBusy;
+				} else remoteReset.disabled = false;
 				if (!remoteReady) {
 					remoteQr.hidden = true;
 					remotePairLink.hidden = true;
@@ -3862,10 +4625,13 @@ window.__ModuleLoader__.load({
 			};
 			let remoteLoadInFlight = false;
 			const loadRemote = () => {
-				if (remoteLoadInFlight) return;
+				if (remoteLoadInFlight || originFormBusy) return;
+				const epoch = remoteSnapshotEpoch;
 				remoteLoadInFlight = true;
-				controlRequestJson("/api/mobile-access/remote/control").then(renderRemote, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+				controlRequestJson("/api/mobile-access/remote/control").then((data) => {
+					if (epoch === remoteSnapshotEpoch) renderRemote(data);
+				}, (error) => {
+					if (epoch === remoteSnapshotEpoch) remoteStatus.textContent = t("requestFailed", { error: String(error) });
 				}).finally(() => {
 					remoteLoadInFlight = false;
 				});
@@ -3876,13 +4642,16 @@ window.__ModuleLoader__.load({
 				remoteProviderBusy = true;
 				tailscaleChoice.disabled = true;
 				cpolarChoice.disabled = true;
+				cloudflaredChoice.disabled = true;
 				frpChoice.disabled = true;
-				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "frp" ? t("switchingFrp") : t("switchingTailscale");
+				originChoice.disabled = true;
+				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : t("switchingTailscale");
 				controlRequestJson("/api/mobile-access/remote/provider", {
 					method: "POST",
 					body: JSON.stringify({ provider })
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					loadRemote();
@@ -3894,9 +4663,159 @@ window.__ModuleLoader__.load({
 			cpolarChoice.addEventListener("click", () => {
 				chooseRemoteProvider("cpolar");
 			});
+			cloudflaredChoice.addEventListener("click", () => {
+				chooseRemoteProvider("cloudflared");
+			});
 			frpChoice.addEventListener("click", () => {
 				chooseRemoteProvider("frp");
 			});
+			originChoice.addEventListener("click", () => {
+				chooseRemoteProvider("origin");
+			});
+			cloudflaredInstall.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("installConfirmCloudflared", { size: cloudflaredDownloadSize }))) return;
+				remoteProviderBusy = true;
+				cloudflaredInstall.disabled = true;
+				cloudflaredInstall.textContent = t("downloading");
+				remoteStatus.textContent = t("installingCloudflared");
+				controlRequestJson("/api/mobile-access/remote/cloudflared/component/install", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					loadRemote();
+				});
+			});
+			cloudflaredPurge.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("purgeCloudflaredConfirm"))) return;
+				remoteProviderBusy = true;
+				cloudflaredPurge.disabled = true;
+				remoteStatus.textContent = t("purgingCloudflared");
+				controlRequestJson("/api/mobile-access/remote/cloudflared/component/purge", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = t("purgeFailed", { error: String(error) });
+					remoteStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					cloudflaredPurge.disabled = false;
+					loadRemote();
+				});
+			});
+			const showCloudflaredMode = (mode) => {
+				cloudflaredModeDraft = mode;
+				cloudflaredModeQuick.classList.toggle("is-active", mode === "quick");
+				cloudflaredModeNamed.classList.toggle("is-active", mode === "named");
+				cloudflaredModeQuick.setAttribute("aria-pressed", String(mode === "quick"));
+				cloudflaredModeNamed.setAttribute("aria-pressed", String(mode === "named"));
+				cloudflaredModeHint.textContent = mode === "named" ? t("cloudflaredTunnelNamedHint") : t("cloudflaredTunnelQuickHint");
+				cloudflaredNote.textContent = mode === "named" ? t("cloudflaredNamedNote") : t("cloudflaredQuickNote");
+				cloudflaredTunnel.hidden = mode !== "named";
+				cloudflaredTunnelSave.textContent = cloudflaredSaveLabel();
+			};
+			cloudflaredModeQuick.addEventListener("click", () => {
+				if (!remoteProviderBusy) showCloudflaredMode("quick");
+			});
+			cloudflaredModeNamed.addEventListener("click", () => {
+				if (!remoteProviderBusy) showCloudflaredMode("named");
+			});
+			cloudflaredHostname.addEventListener("input", () => {
+				cloudflaredHostnameDirty = true;
+			});
+			cloudflaredPort.addEventListener("input", () => {
+				cloudflaredPortDirty = true;
+			});
+			cloudflaredTunnelSave.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				const mode = cloudflaredModeDraft ?? cloudflaredTunnelMode;
+				const hostname = String(cloudflaredHostname.value ?? "").trim();
+				const portValue = String(cloudflaredPort.value ?? "").trim();
+				const port = Number(portValue);
+				const token = String(cloudflaredToken.value ?? "");
+				if (mode === "named") {
+					if (hostname === "") {
+						remoteStatus.textContent = t("cloudflaredTunnelHostnameInvalid");
+						return;
+					}
+					if (portValue === "" || !Number.isSafeInteger(port) || port < 1024 || port > 65535) {
+						remoteStatus.textContent = t("cloudflaredTunnelPortInvalid");
+						return;
+					}
+					if (port === 3443) {
+						remoteStatus.textContent = t("cloudflaredTunnelPortReserved");
+						return;
+					}
+					if (token === "" && !cloudflaredTunnelConfigured) {
+						remoteStatus.textContent = t("cloudflaredTunnelConfigMissing");
+						return;
+					}
+					if (token !== "" && (token.length < 32 || !/^[A-Za-z0-9_=+/-]+$/u.test(token))) {
+						remoteStatus.textContent = t("cloudflaredTunnelTokenInvalid");
+						return;
+					}
+				}
+				remoteProviderBusy = true;
+				cloudflaredTunnelSave.disabled = true;
+				cloudflaredTunnelSave.textContent = t("saving");
+				remoteStatus.textContent = mode === "named" ? t("cloudflaredTunnelSaving") : t("switchingCloudflared");
+				controlRequestJson("/api/mobile-access/remote/cloudflared/tunnel", {
+					method: "POST",
+					body: JSON.stringify(mode === "named" ? {
+						mode,
+						hostname,
+						port,
+						token
+					} : { mode: "quick" })
+				}).then((data) => {
+					cloudflaredToken.value = "";
+					cloudflaredModeDraft = null;
+					cloudflaredHostnameDirty = false;
+					cloudflaredPortDirty = false;
+					remoteFailureText = "";
+					renderRemote(data);
+				}, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					cloudflaredTunnelSave.disabled = false;
+					cloudflaredTunnelSave.textContent = cloudflaredSaveLabel();
+					loadRemote();
+				});
+			});
+			cloudflaredTunnelForget.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("cloudflaredTunnelForgetConfirm"))) return;
+				remoteProviderBusy = true;
+				cloudflaredTunnelForget.disabled = true;
+				remoteStatus.textContent = t("cloudflaredTunnelForgetting");
+				controlRequestJson("/api/mobile-access/remote/cloudflared/tunnel/purge", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}).then((data) => {
+					cloudflaredToken.value = "";
+					cloudflaredHostname.value = "";
+					cloudflaredPort.value = "3444";
+					cloudflaredModeDraft = null;
+					cloudflaredHostnameDirty = false;
+					cloudflaredPortDirty = false;
+					remoteFailureText = "";
+					renderRemote(data);
+				}, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					cloudflaredTunnelForget.disabled = false;
+					loadRemote();
+				});
+			});
 			cpolarInstall.addEventListener("click", () => {
 				if (remoteProviderBusy) return;
 				if (!window.confirm(t("installConfirm"))) return;
@@ -3908,7 +4827,8 @@ window.__ModuleLoader__.load({
 					method: "POST",
 					body: JSON.stringify({ confirm: true })
 				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("installFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					loadRemote();
@@ -3937,7 +4857,8 @@ window.__ModuleLoader__.load({
 						body: JSON.stringify({ running: true })
 					});
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("configureFailed", { error: String(error) });
+					remoteFailureText = t("configureFailed", { error: String(error) });
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					cpolarConfigure.setAttribute("aria-busy", "false");
@@ -3955,7 +4876,8 @@ window.__ModuleLoader__.load({
 					method: "POST",
 					body: JSON.stringify({ confirm: true })
 				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("purgeFailed", { error: String(error) });
+					remoteFailureText = t("purgeFailed", { error: String(error) });
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					cpolarPurge.disabled = false;
@@ -4255,7 +5177,8 @@ window.__ModuleLoader__.load({
 					method: "POST",
 					body: JSON.stringify({ confirm: true })
 				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("installFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					loadRemote();
@@ -4284,7 +5207,8 @@ window.__ModuleLoader__.load({
 						body: JSON.stringify({ running: true })
 					});
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("configureFailed", { error: String(error) });
+					remoteFailureText = t("configureFailed", { error: String(error) });
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					frpConfigure.setAttribute("aria-busy", "false");
@@ -4301,20 +5225,132 @@ window.__ModuleLoader__.load({
 					method: "POST",
 					body: JSON.stringify({ confirm: true })
 				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("purgeFailed", { error: String(error) });
+					remoteFailureText = t("purgeFailed", { error: String(error) });
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteProviderBusy = false;
 					frpPurge.disabled = false;
 					loadRemote();
 				});
 			});
+			const clearOriginValidation = () => {
+				for (const input of [
+					originPublic,
+					originHost,
+					originPort,
+					originCidrs
+				]) input.removeAttribute("aria-invalid");
+			};
+			const showOriginFeedback = (message, error = false) => {
+				originFeedback.textContent = message;
+				originFeedback.hidden = false;
+				originFeedback.classList.toggle("is-error", error);
+			};
+			const showOriginError = (error) => {
+				const code = error instanceof Error ? error.message : String(error);
+				const key = ORIGIN_ERROR_MESSAGE_KEYS[code];
+				const fields = {
+					origin_public_origin_invalid: originPublic,
+					origin_listen_host_invalid: originHost,
+					origin_listen_address_unavailable: originHost,
+					origin_listen_port_invalid: originPort,
+					origin_listen_port_reserved: originPort,
+					origin_listen_port_in_use: originPort,
+					origin_allowed_cidrs_invalid: originCidrs
+				};
+				clearOriginValidation();
+				fields[code]?.setAttribute("aria-invalid", "true");
+				showOriginFeedback(key === void 0 ? t("configureFailed", { error: String(error) }) : t(key), true);
+			};
+			const setOriginFormBusy = (busy) => {
+				originFormBusy = busy;
+				remoteProviderBusy = busy;
+				remoteSnapshotEpoch += 1;
+				renderRemote(latestRemoteState);
+			};
+			for (const input of [
+				originPublic,
+				originHost,
+				originPort,
+				originCidrs
+			]) input.addEventListener("input", () => {
+				originFormDirty = true;
+				clearOriginValidation();
+				originFeedback.hidden = true;
+			});
+			originConfigure.addEventListener("click", () => {
+				if (remoteProviderBusy || remoteProvider !== "origin") return;
+				clearOriginValidation();
+				for (const input of [
+					originPublic,
+					originHost,
+					originPort,
+					originCidrs
+				]) if (!input.reportValidity()) return;
+				const form = {
+					publicOrigin: originPublic.value.trim(),
+					listenHost: originHost.value.trim(),
+					listenPort: Number(originPort.value),
+					allowedCidrs: originCidrs.value.trim().split(/[\s,]+/u).filter(Boolean)
+				};
+				setOriginFormBusy(true);
+				showOriginFeedback(t("originSaving"));
+				controlRequestJson("/api/mobile-access/remote/origin/configure", {
+					method: "POST",
+					body: JSON.stringify(form)
+				}).then(() => controlRequestJson("/api/mobile-access/remote/control", {
+					method: "POST",
+					body: JSON.stringify({ running: true })
+				})).then((data) => {
+					originFormDirty = false;
+					renderRemote(data);
+					if (data.state === "error") showOriginError(new Error(typeof data.errorCode === "string" ? data.errorCode : "origin_gateway_start_failed"));
+					else originFeedback.hidden = true;
+				}, showOriginError).finally(() => {
+					setOriginFormBusy(false);
+					[
+						originPublic,
+						originHost,
+						originPort,
+						originCidrs
+					].find((input) => input.getAttribute("aria-invalid") === "true")?.focus();
+					loadRemote();
+				});
+			});
+			originPurge.addEventListener("click", () => {
+				if (remoteProviderBusy || !window.confirm(t("originPurgeConfirm"))) return;
+				setOriginFormBusy(true);
+				showOriginFeedback(t("originPurging"));
+				controlRequestJson("/api/mobile-access/remote/origin/purge", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}).then((data) => {
+					originFormDirty = false;
+					clearOriginValidation();
+					renderRemote(data);
+					showOriginFeedback(t("originPurged"));
+				}, showOriginError).finally(() => {
+					setOriginFormBusy(false);
+					loadRemote();
+				});
+			});
+			originCopyBackend.addEventListener("click", () => {
+				const address = originBackendAddress.textContent ?? "";
+				if (address === "" || remoteProviderBusy) return;
+				Promise.resolve().then(() => navigator.clipboard.writeText(address)).then(() => {
+					showOriginFeedback(t("originBackendCopied"));
+				}, (error) => {
+					showOriginFeedback(t("requestFailed", { error: String(error) }), true);
+				});
+			});
 			remoteToggle.addEventListener("click", () => {
 				remoteToggle.disabled = true;
 				controlRequestJson("/api/mobile-access/remote/control", {
 					method: "POST",
 					body: JSON.stringify({ running: !remoteRunning })
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(loadRemote);
 			});
 			remoteLogin.addEventListener("click", () => {
@@ -4326,12 +5362,13 @@ window.__ModuleLoader__.load({
 				remoteReconnect.disabled = true;
 				remoteSetup.disabled = true;
 				remoteSetupRetry.disabled = true;
-				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "frp" ? t("reconnectingFrp") : t("reconnectingTailscale");
+				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : t("reconnectingTailscale");
 				controlRequestJson("/api/mobile-access/remote/reconnect", {
 					method: "POST",
 					body: "{}"
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteReconnectBusy = false;
 					remoteReconnect.disabled = false;
@@ -4387,7 +5424,8 @@ window.__ModuleLoader__.load({
 			remotePair.addEventListener("click", () => {
 				remotePair.disabled = true;
 				openRemotePairing().catch((error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remotePair.disabled = !remoteReady;
 				});
@@ -4395,7 +5433,8 @@ window.__ModuleLoader__.load({
 			remoteCopyLink.addEventListener("click", () => {
 				remoteCopyLink.disabled = true;
 				(activeRemotePairUrl !== "" && activeRemotePairExpiresAt > Date.now() ? copyRemotePairUrl() : openRemotePairing()).catch((error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				}).finally(() => {
 					remoteCopyLink.disabled = !remoteReady;
 				});
@@ -4424,7 +5463,8 @@ window.__ModuleLoader__.load({
 							method: "POST",
 							body: JSON.stringify({ deviceId: id })
 						}).then(loadRemoteDevices, (error) => {
-							remoteStatus.textContent = t("requestFailed", { error: String(error) });
+							remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+							remoteStatus.textContent = remoteFailureText;
 						});
 					});
 					row.append(label, meta, revoke);
@@ -4433,7 +5473,8 @@ window.__ModuleLoader__.load({
 			};
 			const loadRemoteDevices = () => {
 				controlRequestJson("/api/mobile-access/remote/devices").then(renderRemoteDevices, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				});
 			};
 			remoteDevices.addEventListener("click", () => {
@@ -4442,13 +5483,14 @@ window.__ModuleLoader__.load({
 				if (show) loadRemoteDevices();
 			});
 			remoteReset.addEventListener("click", () => {
-				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : t("resetTailscaleConfirm");
+				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : t("resetTailscaleConfirm");
 				if (!window.confirm(prompt)) return;
 				controlRequestJson("/api/mobile-access/remote/reset", {
 					method: "POST",
 					body: JSON.stringify({ confirm: true })
 				}).then(renderRemote, (error) => {
-					remoteStatus.textContent = t("requestFailed", { error: String(error) });
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					remoteStatus.textContent = remoteFailureText;
 				});
 			});
 			const renderDiagnostics = (data) => {
@@ -4479,12 +5521,21 @@ window.__ModuleLoader__.load({
 					const templates = DIAGNOSTIC_REASON_MESSAGES[locale][reason];
 					if (templates === void 0) return serverCopy;
 					const facts = entry.facts !== null && typeof entry.facts === "object" ? entry.facts : {};
+					const providerNames = {
+						tailscale: "Tailscale Funnel",
+						cpolar: "cpolar",
+						cloudflared: "cloudflared",
+						frp: t("frpName"),
+						origin: t("originName")
+					};
+					const providerId = typeof facts.provider === "string" ? facts.provider : "";
+					const controllerKey = typeof facts.controllerCode === "string" ? REMOTE_ERROR_MESSAGE_KEYS[facts.controllerCode] : void 0;
 					const values = {
-						provider: facts.provider === "tailscale" || facts.provider === "cpolar" || facts.provider === "frp" ? facts.provider : "",
+						provider: providerNames[providerId] ?? "",
 						latencyMs: typeof facts.latencyMs === "number" && Number.isFinite(facts.latencyMs) ? new Intl.NumberFormat(localeTag).format(facts.latencyMs) : "",
 						interfaceName: typeof facts.interfaceName === "string" ? facts.interfaceName : "",
 						endpointSuffix: typeof facts.endpointSuffix === "string" ? facts.endpointSuffix : "",
-						controllerCode: typeof facts.controllerCode === "string" ? facts.controllerCode : ""
+						controllerCode: controllerKey === void 0 ? "" : t(controllerKey)
 					};
 					const interpolate = (template) => template.replace(/\{(\w+)\}/gu, (_match, key) => values[key] ?? "");
 					let detail = interpolate(templates[0]);
@@ -4499,6 +5550,7 @@ window.__ModuleLoader__.load({
 					}
 					if (reason === "remote-controller-error") {
 						const actionKey = {
+							...ORIGIN_ERROR_MESSAGE_KEYS,
 							component_missing: "remoteUnavailableTailscale",
 							funnel_permission_required: "funnelPermission",
 							funnel_https_required: "funnelHttps",
@@ -4516,6 +5568,22 @@ window.__ModuleLoader__.load({
 							cpolar_start_timeout: "cpolarTimeout",
 							cpolar_stopped: "cpolarStopped",
 							cpolar_exited: "cpolarExited",
+							cloudflared_component_missing: "cloudflaredMissing",
+							cloudflared_component_invalid: "cloudflaredInvalid",
+							cloudflared_component_unsupported: "cloudflaredComponentUnsupported",
+							cloudflared_port_unavailable: "cloudflaredPortUnavailable",
+							cloudflared_port_reservation_failed: "cloudflaredPortReservationFailed",
+							cloudflared_launch_failed: "cloudflaredLaunchFailed",
+							cloudflared_start_timeout: "cloudflaredTimeout",
+							cloudflared_stopped: "cloudflaredStopped",
+							cloudflared_exited: "cloudflaredExited",
+							cloudflared_invalid_origin: "cloudflaredOriginInvalid",
+							cloudflared_tunnel_port_unavailable: "cloudflaredTunnelPortUnavailable",
+							cloudflared_tunnel_config_invalid: "cloudflaredTunnelInvalid",
+							cloudflared_tunnel_target_invalid: "cloudflaredTunnelTargetInvalid",
+							cloudflared_download_hash_mismatch: "cloudflaredDownloadHashMismatch",
+							cloudflared_download_size_mismatch: "cloudflaredDownloadSizeMismatch",
+							cloudflared_executable_hash_mismatch: "cloudflaredExecutableHashMismatch",
 							frp_component_missing: "frpMissing",
 							frp_component_invalid: "frpInvalid",
 							frp_config_missing: "frpConfigMissing",
@@ -4918,6 +5986,15 @@ window.__ModuleLoader__.load({
 			if (generation !== void 0) result.set("x-dsh-mobile-extension-generation", generation);
 			return result;
 		}
+		/** Build the JSON request used by a mobile extension to invoke a Host action. */
+		function extensionActionRequestInit(generation, input, signal) {
+			return {
+				method: "POST",
+				headers: extensionGenerationHeaders(generation, { "content-type": "application/json" }),
+				body: JSON.stringify(input ?? {}),
+				signal
+			};
+		}
 		function registerUniqueDisposable(entries, claimedIds, id, mount) {
 			if (claimedIds.has(id)) throw new Error(`duplicate lifecycle id: ${id}`);
 			claimedIds.add(id);
@@ -5482,12 +6559,7 @@ window.__ModuleLoader__.load({
 					host: {
 						invoke: (action, input) => {
 							ensureCurrent();
-							return mobileRequest(`/mobile-access/extensions/${encodeURIComponent(id)}/actions/${encodeURIComponent(action)}`, {
-								method: "POST",
-								headers: extensionGenerationHeaders(hostGeneration),
-								body: JSON.stringify(input ?? {}),
-								signal: controller.signal
-							}).then(async (response) => {
+							return mobileRequest(`/mobile-access/extensions/${encodeURIComponent(id)}/actions/${encodeURIComponent(action)}`, extensionActionRequestInit(hostGeneration, input, controller.signal)).then(async (response) => {
 								const value = await response.json();
 								if (!response.ok) throw new Error(typeof value === "object" && value !== null && "error" in value ? String(value.error) : `HTTP ${String(response.status)}`);
 								return value;
@@ -5950,31 +7022,38 @@ window.__ModuleLoader__.load({
 		/** Theme-aware desktop Mobile Access panel styles. */
 		const CONTROL_STYLES = `
 .dsh-mobile-control{position:fixed;z-index:1000;left:16px;bottom:112px;font:14px/1.45 system-ui;color:var(--dsw-alias-label-primary,#16181d)}
-.dsh-mobile-control__panel{box-sizing:border-box;width:min(380px,calc(100vw - 32px));max-height:calc(100vh - 140px);overflow-y:auto;padding:16px;border:1px solid var(--dsw-alias-border-subtle,#e1e5eb);border-radius:18px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 18px 50px rgb(15 23 42 / 18%)}
-.dsh-mobile-control__header{display:flex;align-items:center;justify-content:space-between;gap:8px;margin-bottom:10px}.dsh-mobile-control__panel h2{margin:0;font-size:17px;line-height:24px}.dsh-mobile-control__header-actions{display:flex;align-items:center;gap:2px}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry,.dsh-mobile-control__close{display:inline-flex;align-items:center;justify-content:center;min-width:44px;height:44px;padding:0;border:0;border-radius:10px;background:transparent;color:inherit;cursor:pointer}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry{padding:0 8px;color:#2563eb;font:650 12px/1 system-ui;white-space:nowrap}.dsh-mobile-control__update-plugin[hidden]{display:none}.dsh-mobile-control__update-plugin:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__close{font-size:24px;line-height:1}.dsh-mobile-control__update-plugin:hover:not(:disabled),.dsh-mobile-control__diagnostic-entry:hover,.dsh-mobile-control__close:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}
-.dsh-mobile-control__release-notice{margin:-2px 0 10px;padding:8px 10px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#eff6ff);color:var(--dsw-alias-label-primary,#1d4ed8);font-size:11px;line-height:1.45}.dsh-mobile-control__release-notice.is-error{color:#dc2626}.dsh-mobile-control__release-notice[hidden]{display:none}.dsh-mobile-control__update-card{margin:0 0 10px;padding:11px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__update-card[hidden]{display:none}.dsh-mobile-control__update-card-title{margin:0 0 7px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__update-notes{display:block;box-sizing:border-box;max-height:150px;overflow-y:auto;margin:0 0 8px;padding:8px 10px;border:1px solid var(--dsw-alias-border-subtle,#e1e5eb);border-radius:9px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#475569);white-space:pre-wrap;word-break:break-word;font:11px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.dsh-mobile-control__update-notes[hidden]{display:none}.dsh-mobile-control__update-notice{margin:0 0 9px;padding:7px 9px;border-radius:8px;background:#fff4d6;color:#92400e;font-size:11px;line-height:1.5}.dsh-mobile-control__update-actions{display:flex;align-items:center;justify-content:flex-end;gap:8px}.dsh-mobile-control__update-actions .dsh-mobile-control__primary,.dsh-mobile-control__update-actions .dsh-mobile-control__secondary{min-height:34px;padding:0 12px}.dsh-mobile-control__app-download{display:flex;align-items:center;justify-content:space-between;box-sizing:border-box;min-height:38px;margin:0 0 10px;padding:8px 11px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:600 12px/1.3 system-ui;text-decoration:none}.dsh-mobile-control__app-download[hidden]{display:none}.dsh-mobile-control__app-download::after{color:#2563eb;font-size:14px;content:"↗"}.dsh-mobile-control__app-download:hover{border-color:#9fb9e8;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-2,#f5f8ff));color:var(--dsw-alias-label-primary,#1d4ed8)}
-.dsh-mobile-control__switcher{display:grid;grid-template-columns:repeat(2,1fr);gap:4px;margin:0 0 14px;padding:4px;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f3f5f8)}.dsh-mobile-control__switcher[hidden]{display:none}.dsh-mobile-control__tab{min-height:36px;border:0;border-radius:9px;background:transparent;color:var(--dsw-alias-label-secondary,#606873);font:600 13px/1 system-ui;cursor:pointer}.dsh-mobile-control__tab.is-active{background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);box-shadow:0 1px 3px rgb(15 23 42 / 10%)}.dsh-mobile-control__view[hidden]{display:none}.dsh-mobile-control__intro{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.55}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions{display:grid;grid-template-columns:1fr 1fr;gap:8px}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions button[hidden]{display:none}
-.dsh-mobile-control__provider-section{position:relative;margin:0 0 14px}.dsh-mobile-control__section-title{margin:0 0 8px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__provider-section>.dsh-mobile-control__section-title{padding-right:42px}.dsh-mobile-control__provider-choices{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.dsh-mobile-control__provider{display:flex;min-width:0;flex-direction:column;gap:6px;min-height:94px;padding:10px 11px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);text-align:left;cursor:pointer;touch-action:manipulation;transition:border-color 160ms ease,background-color 160ms ease,box-shadow 160ms ease}.dsh-mobile-control__provider:hover{border-color:#6f96db;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-1,#f8fbff))}.dsh-mobile-control__provider.is-selected{border-color:#2563eb;background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-bg-layer-1,#f5f8ff));box-shadow:0 0 0 1px #2563eb inset}.dsh-mobile-control__provider:disabled{cursor:wait;opacity:.62}.dsh-mobile-control__provider-top{display:flex;min-width:0;align-items:flex-start;justify-content:space-between;gap:5px}.dsh-mobile-control__provider-top strong{min-width:0;font-size:12px;line-height:1.3}.dsh-mobile-control__provider-badge{flex:none;padding:2px 5px;border-radius:999px;background:#e8f0ff;color:#1d4ed8;font:650 9px/1.25 system-ui}.dsh-mobile-control__provider-badge.is-cpolar{background:#eaf8f2;color:#087454}.dsh-mobile-control__provider-description{color:var(--dsw-alias-label-secondary,#606873);font-size:10px;line-height:1.45}.dsh-mobile-control__provider-info{position:absolute;z-index:5;top:-13px;right:-8px}.dsh-mobile-control__provider-info-button{display:flex;align-items:center;justify-content:center;width:44px;height:44px;padding:0;border:0;border-radius:50%;background:transparent;color:var(--dsw-alias-label-secondary,#475569);cursor:pointer;touch-action:manipulation}.dsh-mobile-control__provider-info-button:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f5f9);color:#2563eb}.dsh-mobile-control__provider-info-glyph{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:18px;height:18px;border:1.5px solid currentColor;border-radius:50%;font:700 12px/1 system-ui}.dsh-mobile-control__provider-info-popover{position:absolute;z-index:6;top:38px;right:4px;box-sizing:border-box;width:min(292px,calc(100vw - 72px));padding:10px 12px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 10px 28px rgb(15 23 42 / 16%)}.dsh-mobile-control__provider-info-popover[hidden]{display:none}.dsh-mobile-control__provider-info-popover strong,.dsh-mobile-control__provider-info-popover span{display:block}.dsh-mobile-control__provider-info-popover strong{margin-bottom:3px;font-size:12px}.dsh-mobile-control__provider-info-popover span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}
-.dsh-mobile-control__self-hosted{margin:8px 0 0;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__self-hosted-summary{display:flex;box-sizing:border-box;min-height:48px;align-items:center;justify-content:space-between;gap:10px;padding:8px 11px;cursor:pointer;list-style-position:inside}.dsh-mobile-control__self-hosted-summary>span:first-child{display:flex;min-width:0;flex-direction:column;gap:1px}.dsh-mobile-control__self-hosted-summary strong{font-size:11px}.dsh-mobile-control__self-hosted-summary span span{color:var(--dsw-alias-label-secondary,#606873);font-size:9px;line-height:1.35}.dsh-mobile-control__provider-badge.is-frp{background:#eef0f3;color:#475569}.dsh-mobile-control__self-hosted-body{padding:0 8px 8px}.dsh-mobile-control__provider.is-frp{width:100%;min-height:64px;background:var(--dsw-alias-bg-layer-2,#fff)}
-.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:#2563eb;font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:30px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:10px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:38px;margin-top:3px;padding:7px 10px;border:1px solid #dc2626;border-radius:9px;background:transparent;color:#dc2626;font:12px/1.3 system-ui;cursor:pointer}
-.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 10px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 9px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:#e6f7f0;color:#087454}.dsh-mobile-control__state-badge.is-busy{background:#e8f0ff;color:#1d4ed8}.dsh-mobile-control__state-badge.is-attention{background:#fff4dc;color:#935100}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}
-.dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid #a9dfc9;border-radius:11px;background:#edf9f4}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:#075d46;font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:#357061;font:10px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-subtle,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}
-.dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
-.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:#2563eb;text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
-.dsh-mobile-control__status{margin:0 0 14px;overflow-wrap:anywhere;color:var(--dsw-alias-label-secondary,#606873)}.dsh-mobile-control__status::before{display:inline-block;width:8px;height:8px;margin-right:7px;border-radius:50%;background:#98a1ad;content:""}.dsh-mobile-control__status.is-running::before{background:#16a36a}.dsh-mobile-control__status.is-key{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;word-break:break-all}
+.dsh-mobile-control__panel{box-sizing:border-box;width:min(380px,calc(100vw - 32px));max-height:calc(100vh - 140px);overflow-y:auto;padding:16px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:18px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 18px 50px rgb(15 23 42 / 18%)}
+.dsh-mobile-control__header{display:flex;align-items:center;justify-content:space-between;gap:8px;margin-bottom:10px}.dsh-mobile-control__panel h2{margin:0;font-size:17px;line-height:24px}.dsh-mobile-control__header-actions{display:flex;align-items:center;gap:2px}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry,.dsh-mobile-control__close{display:inline-flex;align-items:center;justify-content:center;min-width:44px;height:44px;padding:0;border:0;border-radius:10px;background:transparent;color:inherit;cursor:pointer}.dsh-mobile-control__update-plugin,.dsh-mobile-control__diagnostic-entry{padding:0 8px;color:var(--dsw-alias-label-primary-bluish,#2563eb);font:650 12px/1 system-ui;white-space:nowrap}.dsh-mobile-control__update-plugin[hidden]{display:none}.dsh-mobile-control__update-plugin:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__close{font-size:24px;line-height:1}.dsh-mobile-control__update-plugin:hover:not(:disabled),.dsh-mobile-control__diagnostic-entry:hover,.dsh-mobile-control__close:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}
+.dsh-mobile-control__release-notice{margin:-2px 0 10px;padding:8px 10px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#eff6ff);color:var(--dsw-alias-label-primary,#1d4ed8);font-size:11px;line-height:1.45}.dsh-mobile-control__release-notice.is-error{color:var(--dsw-alias-label-primary,#dc2626);border-left:3px solid var(--dsw-alias-state-error-primary,#dc2626)}.dsh-mobile-control__release-notice[hidden]{display:none}.dsh-mobile-control__update-card{margin:0 0 10px;padding:11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__update-card[hidden]{display:none}.dsh-mobile-control__update-card-title{margin:0 0 7px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__update-notes{display:block;box-sizing:border-box;max-height:150px;overflow-y:auto;margin:0 0 8px;padding:8px 10px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:9px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#475569);white-space:pre-wrap;word-break:break-word;font:11px/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}.dsh-mobile-control__update-notes[hidden]{display:none}.dsh-mobile-control__update-notice{margin:0 0 9px;padding:7px 9px;border-radius:8px;background:var(--dsw-alias-state-warn-tertiary,#fff4d6);color:var(--dsw-alias-state-warn-label,#92400e);font-size:11px;line-height:1.5}.dsh-mobile-control__update-actions{display:flex;align-items:center;justify-content:flex-end;gap:8px}.dsh-mobile-control__update-actions .dsh-mobile-control__primary,.dsh-mobile-control__update-actions .dsh-mobile-control__secondary{min-height:36px;padding:0 12px}.dsh-mobile-control__app-download{display:flex;align-items:center;justify-content:space-between;box-sizing:border-box;min-height:44px;margin:0 0 10px;padding:8px 11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:600 12px/1.3 system-ui;text-decoration:none}.dsh-mobile-control__app-download[hidden]{display:none}.dsh-mobile-control__app-download::after{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:14px;content:"↗"}.dsh-mobile-control__app-download:hover{border-color:#9fb9e8;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-2,#f5f8ff));color:var(--dsw-alias-label-primary,#1d4ed8)}
+.dsh-mobile-control__switcher{display:grid;grid-template-columns:repeat(2,1fr);gap:4px;margin:0 0 14px;padding:4px;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f3f5f8)}.dsh-mobile-control__switcher[hidden]{display:none}.dsh-mobile-control__tab{min-height:36px;border:0;border-radius:9px;background:transparent;color:var(--dsw-alias-label-secondary,#606873);font:600 13px/1 system-ui;cursor:pointer}.dsh-mobile-control__tab.is-active{background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);box-shadow:0 1px 3px rgb(15 23 42 / 10%)}.dsh-mobile-control__view[hidden]{display:none}.dsh-mobile-control__intro{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.55}.dsh-mobile-control__http-frame-warning{box-sizing:border-box;margin:-4px 0 12px;padding:8px 10px;border:1px solid #d6a83f;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#fff7df);color:var(--dsw-alias-label-primary,#694b00);font-size:11px;line-height:1.5;overflow-wrap:anywhere}.dsh-mobile-control__http-frame-warning[hidden]{display:none}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions{display:grid;grid-template-columns:1fr 1fr;gap:8px}.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions button[hidden]{display:none}
+.dsh-mobile-control__provider-section{position:relative;margin:0 0 14px}.dsh-mobile-control__section-title{margin:0 0 8px;color:var(--dsw-alias-label-primary,#16181d);font:650 13px/1.4 system-ui}.dsh-mobile-control__provider-section>.dsh-mobile-control__section-title{padding-right:42px}.dsh-mobile-control__provider-choices{display:grid;grid-template-columns:1fr;gap:8px}.dsh-mobile-control__provider{display:flex;min-width:0;flex-direction:column;gap:6px;min-height:94px;padding:10px 11px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);text-align:left;cursor:pointer;touch-action:manipulation;transition:border-color 160ms ease,background-color 160ms ease,box-shadow 160ms ease}.dsh-mobile-control__provider:hover{border-color:#6f96db;background:var(--dsw-alias-interactive-bg-hover-solid,var(--dsw-alias-bg-layer-1,#f8fbff))}.dsh-mobile-control__provider.is-selected{border-color:var(--dsw-alias-label-primary-bluish,#2563eb);background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-bg-layer-1,#f5f8ff));box-shadow:0 0 0 1px var(--dsw-alias-label-primary-bluish,#2563eb) inset}.dsh-mobile-control__provider:disabled{cursor:wait;opacity:.62}.dsh-mobile-control__provider-top{display:flex;min-width:0;align-items:flex-start;justify-content:space-between;gap:5px}.dsh-mobile-control__provider-top strong{min-width:0;font-size:12px;line-height:1.3}.dsh-mobile-control__provider-badge{flex:none;padding:2px 5px;border-radius:999px;background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8);font:650 11px/1.25 system-ui}.dsh-mobile-control__provider-badge.is-cpolar{background:var(--dsw-alias-state-success-tertiary,#eaf8f2);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__provider-description{color:var(--dsw-alias-label-secondary,#606873);font-size:12px;line-height:1.45}.dsh-mobile-control__provider-info{position:absolute;z-index:5;top:-13px;right:-8px}.dsh-mobile-control__provider-info-button{display:flex;align-items:center;justify-content:center;width:44px;height:44px;padding:0;border:0;border-radius:50%;background:transparent;color:var(--dsw-alias-label-secondary,#475569);cursor:pointer;touch-action:manipulation}.dsh-mobile-control__provider-info-button:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f5f9);color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__provider-info-glyph{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:18px;height:18px;border:1.5px solid currentColor;border-radius:50%;font:700 12px/1 system-ui}.dsh-mobile-control__provider-info-popover{position:absolute;z-index:6;top:38px;right:4px;box-sizing:border-box;width:min(292px,calc(100vw - 72px));padding:10px 12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 10px 28px rgb(15 23 42 / 16%)}.dsh-mobile-control__provider-info-popover[hidden]{display:none}.dsh-mobile-control__provider-info-popover strong,.dsh-mobile-control__provider-info-popover span{display:block}.dsh-mobile-control__provider-info-popover strong{margin-bottom:3px;font-size:12px}.dsh-mobile-control__provider-info-popover span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}
+.dsh-mobile-control__self-hosted{margin:8px 0 0;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:12px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__self-hosted-summary{display:flex;box-sizing:border-box;min-height:48px;align-items:center;justify-content:space-between;gap:10px;padding:8px 11px;cursor:pointer;list-style-position:inside}.dsh-mobile-control__self-hosted-summary>span:first-child{display:flex;min-width:0;flex-direction:column;gap:1px}.dsh-mobile-control__self-hosted-summary strong{font-size:11px}.dsh-mobile-control__self-hosted-summary span span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.35}.dsh-mobile-control__provider-badge.is-frp{background:var(--dsw-alias-bg-layer-1,#eef0f3);color:var(--dsw-alias-label-secondary,#475569)}.dsh-mobile-control__self-hosted-body{padding:0 8px 8px}.dsh-mobile-control__provider.is-frp{width:100%;min-height:64px;background:var(--dsw-alias-bg-layer-2,#fff)}
+/* The cloudflared setup section deliberately reuses this card, so
+   .dsh-mobile-control__cloudflared-setup is a DOM hook for targeting rather than a
+   style rule of its own. */
+.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
+.dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
+.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
+.dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
+.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
+.dsh-mobile-control__status{margin:0 0 14px;overflow-wrap:anywhere;color:var(--dsw-alias-label-secondary,#606873)}.dsh-mobile-control__status::before{display:inline-block;width:8px;height:8px;margin-right:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary,#98a1ad);content:""}.dsh-mobile-control__status.is-running::before{background:var(--dsw-alias-state-success-primary,#16a36a)}.dsh-mobile-control__status.is-key{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;word-break:break-all}
 .dsh-mobile-control__guide{margin:0 0 14px;padding:12px;border:1px solid #6f96db;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#eff6ff)}.dsh-mobile-control__guide[hidden]{display:none}.dsh-mobile-control__guide-title{margin:0;color:var(--dsw-alias-label-primary,#172554);font:650 13px/1.45 system-ui}.dsh-mobile-control__guide-summary,.dsh-mobile-control__guide-note{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#475569);font-size:12px;line-height:1.5}.dsh-mobile-control__guide-steps{margin:8px 0 0;padding-left:20px;color:var(--dsw-alias-label-primary,#1e293b);font-size:12px;line-height:1.6}.dsh-mobile-control__guide-note{color:var(--dsw-alias-label-secondary,#64748b)}.dsh-mobile-control__guide-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:10px}.dsh-mobile-control__guide-actions button{min-width:0;min-height:44px;padding:8px;border-radius:10px;font:12px/1.25 system-ui;cursor:pointer}.dsh-mobile-control__guide-actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control__extensions{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px}
-.dsh-mobile-control__view.is-diagnostics{--dsh-diagnostic-ok:#087454;--dsh-diagnostic-warning:#a35b00;--dsh-diagnostic-error:#c62828;--dsh-diagnostic-info:#526071}.dsh-mobile-control__diagnostic-summary{box-sizing:border-box;margin:0;padding:13px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__diagnostic-summary-main{display:grid;grid-template-columns:36px minmax(0,1fr);align-items:center;gap:11px}.dsh-mobile-control__diagnostic-summary-icon{position:relative;display:block;width:36px;height:36px;border-radius:50%;background:#e8edf3;color:var(--dsh-diagnostic-info)}.dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-summary-icon::after{position:absolute;content:""}.dsh-mobile-control__diagnostic-summary-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__diagnostic-summary-body strong{font-size:13px;line-height:1.35}.dsh-mobile-control__diagnostic-summary-body span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__diagnostic-summary-meta{display:block;margin-top:11px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-subtle,#dbe1e8);color:var(--dsw-alias-label-secondary,#606873);font-size:10px;line-height:1.45}.dsh-mobile-control__diagnostic-summary.is-ok .dsh-mobile-control__diagnostic-summary-icon{background:#e6f7f0;color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-summary.is-ok .dsh-mobile-control__diagnostic-summary-icon::before{top:10px;left:10px;width:13px;height:7px;border-bottom:2px solid currentColor;border-left:2px solid currentColor;transform:rotate(-45deg)}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon{background:#fff4dc;color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon{background:#fdecec;color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon::before{top:8px;left:17px;width:2px;height:13px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon::after,.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon::after{bottom:8px;left:17px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon{background:#e8f0ff;color:#2563eb}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon::before{inset:9px;border:2px solid rgb(37 99 235 / 24%);border-top-color:currentColor;border-radius:50%;animation:dsh-diagnostic-spin .8s linear infinite}
+.dsh-mobile-control__view.is-diagnostics{--dsh-diagnostic-ok:var(--dsw-alias-state-success-primary,#087454);--dsh-diagnostic-warning:var(--dsw-alias-state-warn-primary,#a35b00);--dsh-diagnostic-error:var(--dsw-alias-state-error-primary,#c62828);--dsh-diagnostic-info:var(--dsw-alias-label-secondary,#526071)}.dsh-mobile-control__diagnostic-summary{box-sizing:border-box;margin:0;padding:13px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__diagnostic-summary-main{display:grid;grid-template-columns:36px minmax(0,1fr);align-items:center;gap:11px}.dsh-mobile-control__diagnostic-summary-icon{position:relative;display:block;width:36px;height:36px;border-radius:50%;background:var(--dsw-alias-bg-layer-1,#e8edf3);color:var(--dsh-diagnostic-info)}.dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-summary-icon::after{position:absolute;content:""}.dsh-mobile-control__diagnostic-summary-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__diagnostic-summary-body strong{font-size:13px;line-height:1.35}.dsh-mobile-control__diagnostic-summary-body span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__diagnostic-summary-meta{display:block;margin-top:11px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-l2,#dbe1e8);color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.45}.dsh-mobile-control__diagnostic-summary.is-ok .dsh-mobile-control__diagnostic-summary-icon{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-summary.is-ok .dsh-mobile-control__diagnostic-summary-icon::before{top:10px;left:10px;width:13px;height:7px;border-bottom:2px solid currentColor;border-left:2px solid currentColor;transform:rotate(-45deg)}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon{background:var(--dsw-alias-state-error-secondary,#fdecec);color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon::before{top:8px;left:17px;width:2px;height:13px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-summary.is-attention .dsh-mobile-control__diagnostic-summary-icon::after,.dsh-mobile-control__diagnostic-summary.is-error .dsh-mobile-control__diagnostic-summary-icon::after{bottom:8px;left:17px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary-bluish,#2563eb)}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon::before{inset:9px;border:2px solid rgb(37 99 235 / 24%);border-top-color:currentColor;border-radius:50%;animation:dsh-diagnostic-spin .8s linear infinite}
 .dsh-mobile-control__diagnostic-summary.is-idle .dsh-mobile-control__diagnostic-summary-icon::before{top:8px;left:17px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-summary.is-idle .dsh-mobile-control__diagnostic-summary-icon::after{top:13px;left:17px;width:2px;height:11px;border-radius:2px;background:currentColor}
-.dsh-mobile-control__diagnostic-toolbar{display:grid;grid-template-columns:1fr;gap:8px;margin-top:10px}.dsh-mobile-control__diagnostic-toolbar.has-report{grid-template-columns:1fr 1fr}.dsh-mobile-control__diagnostic-run,.dsh-mobile-control__diagnostic-copy{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border-radius:11px;font:650 12px/1.3 system-ui;cursor:pointer;touch-action:manipulation}.dsh-mobile-control__diagnostic-copy[hidden]{display:none}.dsh-mobile-control__diagnostic-run:disabled{cursor:wait;opacity:.58}.dsh-mobile-control__diagnostic-feedback{margin:8px 0 0;padding:8px 10px;border-radius:9px;background:#eff6ff;color:#1d4ed8;font-size:11px;line-height:1.45}.dsh-mobile-control__diagnostic-feedback[hidden]{display:none}
-.dsh-mobile-control__diagnostic-checks{display:grid;gap:12px;margin-top:12px;animation:dsh-diagnostic-reveal 160ms ease-out both}.dsh-mobile-control__diagnostic-checks[hidden]{display:none}.dsh-mobile-control__diagnostic-group{overflow:hidden;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-group-header{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:8px 11px;border-bottom:1px solid var(--dsw-alias-border-subtle,#e1e5eb);background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__diagnostic-group-header h3{margin:0;font:650 11px/1.4 system-ui}.dsh-mobile-control__diagnostic-group-header span{color:var(--dsw-alias-label-secondary,#606873);font-size:10px}.dsh-mobile-control__diagnostic-list{display:flex;flex-direction:column}.dsh-mobile-control__diagnostic-check{display:grid;grid-template-columns:26px minmax(0,1fr);gap:9px;padding:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-check + .dsh-mobile-control__diagnostic-check{border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}.dsh-mobile-control__diagnostic-marker{position:relative;width:26px;height:26px;border-radius:50%;background:#edf1f5;color:var(--dsh-diagnostic-info)}.dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-marker::after{position:absolute;content:""}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker{background:#e6f7f0;color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker::before{top:7px;left:7px;width:9px;height:5px;border-bottom:1.8px solid currentColor;border-left:1.8px solid currentColor;transform:rotate(-45deg)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker{background:#fff4dc;color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker{background:#fdecec;color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::after,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::after{bottom:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::after{top:10px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check-body{min-width:0}.dsh-mobile-control__diagnostic-check-header{display:flex;align-items:flex-start;justify-content:space-between;gap:8px}.dsh-mobile-control__diagnostic-check-header strong{min-width:0;font-size:12px;line-height:1.4}.dsh-mobile-control__diagnostic-badge{flex:none;padding:2px 6px;border-radius:999px;background:#edf1f5;color:var(--dsh-diagnostic-info);font:650 10px/1.3 system-ui}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-badge{background:#e6f7f0;color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-badge{background:#fff4dc;color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-badge{background:#fdecec;color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check p{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5;overflow-wrap:anywhere}.dsh-mobile-control__diagnostic-check .dsh-mobile-control__diagnostic-action{margin-top:7px;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f8fafc);color:var(--dsw-alias-label-primary,#16181d)}.dsh-mobile-control__diagnostic-action span{display:inline-block;margin-right:6px;color:#2563eb;font-weight:700}.dsh-mobile-control__diagnostic-details{margin-top:12px}.dsh-mobile-control__diagnostic-details[hidden]{display:none}.dsh-mobile-control__diagnostic-details>summary{box-sizing:border-box;min-height:44px;line-height:44px}.dsh-mobile-control__diagnostic-report{box-sizing:border-box;max-height:220px;margin:4px 0 0;overflow:auto;padding:10px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:10px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#606873);font:10px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere}
+.dsh-mobile-control__diagnostic-toolbar{display:grid;grid-template-columns:1fr;gap:8px;margin-top:10px}.dsh-mobile-control__diagnostic-toolbar.has-report{grid-template-columns:1fr 1fr}.dsh-mobile-control__diagnostic-run,.dsh-mobile-control__diagnostic-copy{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border-radius:11px;font:650 12px/1.3 system-ui;cursor:pointer;touch-action:manipulation}.dsh-mobile-control__diagnostic-copy[hidden]{display:none}.dsh-mobile-control__diagnostic-run:disabled{cursor:wait;opacity:.58}.dsh-mobile-control__diagnostic-feedback{margin:8px 0 0;padding:8px 10px;border-radius:9px;background:var(--dsw-alias-state-business-tertiary,#eff6ff);color:var(--dsw-alias-label-primary,#1d4ed8);font-size:11px;line-height:1.45}.dsh-mobile-control__diagnostic-feedback[hidden]{display:none}
+.dsh-mobile-control__diagnostic-checks{display:grid;gap:12px;margin-top:12px;animation:dsh-diagnostic-reveal 160ms ease-out both}.dsh-mobile-control__diagnostic-checks[hidden]{display:none}.dsh-mobile-control__diagnostic-group{overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-group-header{display:flex;align-items:center;justify-content:space-between;gap:8px;padding:8px 11px;border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__diagnostic-group-header h3{margin:0;font:650 11px/1.4 system-ui}.dsh-mobile-control__diagnostic-group-header span{color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__diagnostic-list{display:flex;flex-direction:column}.dsh-mobile-control__diagnostic-check{display:grid;grid-template-columns:26px minmax(0,1fr);gap:9px;padding:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__diagnostic-check + .dsh-mobile-control__diagnostic-check{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__diagnostic-marker{position:relative;width:26px;height:26px;border-radius:50%;background:var(--dsw-alias-bg-layer-1,#edf1f5);color:var(--dsh-diagnostic-info)}.dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-marker::after{position:absolute;content:""}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-marker::before{top:7px;left:7px;width:9px;height:5px;border-bottom:1.8px solid currentColor;border-left:1.8px solid currentColor;transform:rotate(-45deg)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker{background:var(--dsw-alias-state-error-secondary,#fdecec);color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::before,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-marker::after,.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-marker::after{bottom:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::before{top:6px;left:12px;width:2px;height:2px;border-radius:50%;background:currentColor}.dsh-mobile-control__diagnostic-check.is-info .dsh-mobile-control__diagnostic-marker::after{top:10px;left:12px;width:2px;height:9px;border-radius:2px;background:currentColor}.dsh-mobile-control__diagnostic-check-body{min-width:0}.dsh-mobile-control__diagnostic-check-header{display:flex;align-items:flex-start;justify-content:space-between;gap:8px}.dsh-mobile-control__diagnostic-check-header strong{min-width:0;font-size:12px;line-height:1.4}.dsh-mobile-control__diagnostic-badge{flex:none;padding:2px 6px;border-radius:999px;background:var(--dsw-alias-bg-layer-1,#edf1f5);color:var(--dsh-diagnostic-info);font:650 11px/1.3 system-ui}.dsh-mobile-control__diagnostic-check.is-ok .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsh-diagnostic-ok)}.dsh-mobile-control__diagnostic-check.is-warning .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsh-diagnostic-warning)}.dsh-mobile-control__diagnostic-check.is-error .dsh-mobile-control__diagnostic-badge{background:var(--dsw-alias-state-error-secondary,#fdecec);color:var(--dsh-diagnostic-error)}.dsh-mobile-control__diagnostic-check p{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5;overflow-wrap:anywhere}.dsh-mobile-control__diagnostic-check .dsh-mobile-control__diagnostic-action{margin-top:7px;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f8fafc);color:var(--dsw-alias-label-primary,#16181d)}.dsh-mobile-control__diagnostic-action span{display:inline-block;margin-right:6px;color:var(--dsw-alias-label-primary-bluish,#2563eb);font-weight:700}.dsh-mobile-control__diagnostic-details{margin-top:12px}.dsh-mobile-control__diagnostic-details[hidden]{display:none}.dsh-mobile-control__diagnostic-details>summary{box-sizing:border-box;min-height:44px;line-height:44px}.dsh-mobile-control__diagnostic-report{box-sizing:border-box;max-height:220px;margin:4px 0 0;overflow:auto;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:10px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#606873);font:11px/1.55 ui-monospace,SFMono-Regular,Consolas,monospace;white-space:pre-wrap;overflow-wrap:anywhere}
 .dsh-mobile-control__diagnostic-checks{transition:opacity 150ms ease}.dsh-mobile-control__diagnostic-checks.is-refreshing{opacity:.52}
 @keyframes dsh-diagnostic-spin{to{transform:rotate(360deg)}}@keyframes dsh-diagnostic-reveal{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}
-.dsh-mobile-control__actions{display:flex;flex-wrap:nowrap;gap:6px}.dsh-mobile-control__actions[hidden],.dsh-mobile-control__manage-row[hidden]{display:none}.dsh-mobile-control__actions button{flex:1 1 0;min-width:0;min-height:40px;padding:8px 4px;border-radius:10px;font:12px/1.2 system-ui;cursor:pointer;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.dsh-mobile-control__secondary{border:1px solid var(--dsw-alias-border-normal,#cfd5dd);background:transparent;color:inherit}.dsh-mobile-control__primary{border:1px solid #2563eb;background:#2563eb;color:#fff}.dsh-mobile-control__actions button:disabled{cursor:not-allowed;opacity:.45}
+.dsh-mobile-control__actions{display:flex;flex-wrap:nowrap;gap:6px}.dsh-mobile-control__actions[hidden],.dsh-mobile-control__manage-row[hidden]{display:none}.dsh-mobile-control__actions button{flex:1 1 0;min-width:0;min-height:44px;padding:8px 4px;border-radius:10px;font:12px/1.2 system-ui;cursor:pointer;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.dsh-mobile-control__secondary{border:1px solid var(--dsw-alias-border-l3,#cfd5dd);background:transparent;color:inherit}.dsh-mobile-control__primary{border:1px solid #2563eb;background:#2563eb;color:#fff}.dsh-mobile-control__actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control button:focus-visible,.dsh-mobile-control a:focus-visible,.dsh-mobile-control input:focus-visible,.dsh-mobile-control select:focus-visible,.dsh-mobile-control summary:focus-visible{outline:3px solid rgb(37 99 235 / 28%);outline-offset:2px}
+/* 42px matches the DSH sidebar footer row; it is not one of the panel target tiers. */
 .dsh-mobile-control__trigger{box-sizing:border-box;flex:1 1 auto;display:flex;align-items:center;gap:8px;width:100%;height:42px;margin:4px 0;padding:0 10px 0 8px;border:0;border-radius:12px;background:transparent;color:var(--dsw-alias-label-primary,#16181d);font-family:inherit;font-size:14px;line-height:22px;cursor:pointer;overflow:hidden}.dsh-mobile-control__trigger:hover{background:var(--dsw-alias-interactive-bg-hover,#f1f3f6)}.dsh-mobile-control__trigger:active,.dsh-mobile-control__trigger[aria-expanded="true"]{background:var(--dsw-alias-interactive-bg-active,#e8ebf0)}.dsh-mobile-control__trigger:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,currentColor);outline-offset:2px}.dsh-mobile-control__trigger.is-rail{flex:0 0 auto;width:36px;height:36px;margin:8px 0 10px;padding:0;justify-content:center;gap:0;border-radius:50%}.dsh-mobile-control__trigger-icon{display:block;flex:none}.dsh-mobile-control__trigger-label{min-width:0;overflow:hidden;white-space:nowrap;text-overflow:ellipsis}
-.dsh-mobile-control__manage-row{display:flex;justify-content:space-between;gap:8px;margin-top:10px}.dsh-mobile-control__manage{flex:1 1 0;min-width:0;min-height:34px;padding:6px 8px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:10px;background:transparent;color:inherit;font:12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__devices{margin-top:10px;border:1px solid var(--dsw-alias-border-subtle,#e1e5eb);border-radius:10px;padding:8px;max-height:220px;overflow-y:auto}.dsh-mobile-control__device-empty{color:var(--dsw-alias-label-secondary,#606873);font-size:12px;margin:0}.dsh-mobile-control__device{display:flex;align-items:center;gap:8px;padding:6px 2px}.dsh-mobile-control__device + .dsh-mobile-control__device{border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}.dsh-mobile-control__device-label{flex:1 1 0;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12px}.dsh-mobile-control__device-meta{flex:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;white-space:nowrap}.dsh-mobile-control__device-revoke{flex:none;min-height:28px;padding:4px 8px;border:1px solid #dc2626;border-radius:8px;background:transparent;color:#dc2626;font:12px/1.2 system-ui;cursor:pointer}.dsh-mobile-control__ws-paths{margin:10px 0 0;padding:12px;border:1px solid var(--dsw-alias-border-subtle,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__ws-paths-list{margin:0 0 8px;padding:0;list-style:none}.dsh-mobile-control__ws-paths-empty{color:var(--dsw-alias-label-secondary,#606873);font-size:12px}.dsh-mobile-control__ws-paths-item{display:flex;align-items:center;gap:8px;padding:6px 0}.dsh-mobile-control__ws-paths-item + .dsh-mobile-control__ws-paths-item{border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}.dsh-mobile-control__ws-paths-item code{flex:1 1 0;min-width:0;overflow:hidden;font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__ws-paths-remove{flex:none;min-height:28px;padding:4px 8px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:8px;background:transparent;color:inherit;font:12px/1.2 system-ui;cursor:pointer}.dsh-mobile-control__trigger,.dsh-mobile-control__diagnostic-entry{position:relative}.dsh-mobile-control__ws-dot{position:absolute;top:2px;right:2px;z-index:1;min-width:16px;height:16px;padding:0 4px;border-radius:999px;background:#dc2626;color:#fff;font:650 10px/16px system-ui;text-align:center;cursor:pointer}.dsh-mobile-control__ws-dot::after{content:'';position:absolute;inset:-5px}.dsh-mobile-control__ws-sr-status{position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0}.dsh-mobile-control__ws-paths-row{display:flex;gap:8px}.dsh-mobile-control__ws-paths-row .dsh-mobile-control__primary{width:auto;flex:none;padding:9px 14px;border-radius:10px}.dsh-mobile-control__ws-paths-group{padding:6px 0}.dsh-mobile-control__ws-paths-group + .dsh-mobile-control__ws-paths-group{border-top:1px solid var(--dsw-alias-border-subtle,#e1e5eb)}.dsh-mobile-control__ws-paths-group-head{display:flex;align-items:center;gap:8px}.dsh-mobile-control__ws-count{flex:none;padding:1px 7px;border-radius:999px;background:#e8f0ff;color:#1d4ed8;font:650 10px/1.6 system-ui}.dsh-mobile-control__ws-paths-item.is-child{padding-left:12px}.dsh-mobile-control__ws-paths-group-head .dsh-mobile-control__primary,.dsh-mobile-control__ws-paths-item .dsh-mobile-control__primary{width:auto;flex:none;min-height:34px;padding:6px 12px;border-radius:10px}.dsh-mobile-control__ws-paths-row input{flex:1 1 0;min-width:0;box-sizing:border-box;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-normal,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__ws-paths-row button{flex:none}.dsh-mobile-control__ws-paths-detected-title{margin:0 0 2px;font:600 12px/1.4 system-ui}.dsh-mobile-control__ws-paths-advanced{margin-top:8px}.dsh-mobile-control__ws-paths-advanced summary{cursor:pointer;color:var(--dsw-alias-label-secondary,#606873);font:12px/1.4 system-ui;user-select:none}.dsh-mobile-control__ws-paths-advanced summary:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,currentColor);outline-offset:2px;border-radius:4px}.dsh-mobile-control__ws-paths-advanced[open] summary{margin-bottom:6px}.dsh-mobile-control__ws-paths-advanced .dsh-mobile-control__status{margin:6px 0 0}
-@media (max-width:359px){.dsh-mobile-control__provider-choices{grid-template-columns:1fr}.dsh-mobile-control__provider{min-height:68px}}@media (prefers-reduced-motion:reduce){.dsh-mobile-control__provider,.dsh-mobile-control__cpolar-connect{transition:none}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-checks{animation:none}}
+.dsh-mobile-control__manage-row{display:flex;justify-content:space-between;gap:8px;margin-top:10px}.dsh-mobile-control__manage{flex:1 1 0;min-width:0;min-height:36px;padding:6px 8px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:transparent;color:inherit;font:12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__devices{margin-top:10px;border:1px solid var(--dsw-alias-border-l2,#e1e5eb);border-radius:10px;padding:8px;max-height:220px;overflow-y:auto}.dsh-mobile-control__device-empty{color:var(--dsw-alias-label-secondary,#606873);font-size:12px;margin:0}.dsh-mobile-control__device{display:flex;align-items:center;gap:8px;padding:6px 2px}.dsh-mobile-control__device + .dsh-mobile-control__device{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__device-label{flex:1 1 0;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:12px}.dsh-mobile-control__device-meta{flex:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;white-space:nowrap}.dsh-mobile-control__device-revoke{flex:none;min-height:36px;padding:4px 8px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:8px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.2 system-ui;cursor:pointer}.dsh-mobile-control__ws-paths{margin:10px 0 0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__ws-paths-list{margin:0 0 8px;padding:0;list-style:none}.dsh-mobile-control__ws-paths-empty{color:var(--dsw-alias-label-secondary,#606873);font-size:12px}.dsh-mobile-control__ws-paths-item{display:flex;align-items:center;gap:8px;padding:6px 0}.dsh-mobile-control__ws-paths-item + .dsh-mobile-control__ws-paths-item{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__ws-paths-item code{flex:1 1 0;min-width:0;overflow:hidden;font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__ws-paths-remove{flex:none;min-height:36px;padding:4px 8px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:8px;background:transparent;color:inherit;font:12px/1.2 system-ui;cursor:pointer}.dsh-mobile-control__trigger,.dsh-mobile-control__diagnostic-entry{position:relative}.dsh-mobile-control__ws-dot{position:absolute;top:2px;right:2px;z-index:1;min-width:16px;height:16px;padding:0 4px;border-radius:999px;background:var(--dsw-alias-state-error-primary,#dc2626);color:#fff;font:650 11px/16px system-ui;text-align:center;cursor:pointer}.dsh-mobile-control__ws-dot::after{content:'';position:absolute;inset:-5px}.dsh-mobile-control__ws-sr-status{position:absolute;width:1px;height:1px;margin:-1px;padding:0;overflow:hidden;clip:rect(0 0 0 0);white-space:nowrap;border:0}.dsh-mobile-control__ws-paths-row{display:flex;gap:8px}.dsh-mobile-control__ws-paths-row .dsh-mobile-control__primary{width:auto;flex:none;padding:9px 14px;border-radius:10px}.dsh-mobile-control__ws-paths-group{padding:6px 0}.dsh-mobile-control__ws-paths-group + .dsh-mobile-control__ws-paths-group{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__ws-paths-group-head{display:flex;align-items:center;gap:8px}.dsh-mobile-control__ws-count{flex:none;padding:1px 7px;border-radius:999px;background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8);font:650 11px/1.6 system-ui}.dsh-mobile-control__ws-paths-item.is-child{padding-left:12px}.dsh-mobile-control__ws-paths-group-head .dsh-mobile-control__primary,.dsh-mobile-control__ws-paths-item .dsh-mobile-control__primary{width:auto;flex:none;min-height:36px;padding:6px 12px;border-radius:10px}.dsh-mobile-control__ws-paths-row input{flex:1 1 0;min-width:0;box-sizing:border-box;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__ws-paths-row button{flex:none}.dsh-mobile-control__ws-paths-detected-title{margin:0 0 2px;font:600 12px/1.4 system-ui}.dsh-mobile-control__ws-paths-advanced{margin-top:8px}.dsh-mobile-control__ws-paths-advanced summary{cursor:pointer;color:var(--dsw-alias-label-secondary,#606873);font:12px/1.4 system-ui;user-select:none}.dsh-mobile-control__ws-paths-advanced summary:focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,currentColor);outline-offset:2px;border-radius:4px}.dsh-mobile-control__ws-paths-advanced[open] summary{margin-bottom:6px}.dsh-mobile-control__ws-paths-advanced .dsh-mobile-control__status{margin:6px 0 0}
+@media (max-width:359px){.dsh-mobile-control__provider{min-height:68px}}@media (prefers-reduced-motion:reduce){.dsh-mobile-control__provider,.dsh-mobile-control__cpolar-connect{transition:none}.dsh-mobile-control__diagnostic-summary.is-running .dsh-mobile-control__diagnostic-summary-icon::before,.dsh-mobile-control__diagnostic-checks{animation:none}}
+
+.dsh-mobile-control__origin-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__origin-setup[hidden],.dsh-mobile-control__origin-backend[hidden],.dsh-mobile-control__origin-feedback[hidden]{display:none}.dsh-mobile-control__origin-fields{display:grid;grid-template-columns:minmax(0,1fr) 110px;gap:12px}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field{font-size:12px}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field:nth-child(1),.dsh-mobile-control__origin-fields>.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field:nth-child(2){grid-column:1}.dsh-mobile-control__origin-fields>.dsh-mobile-control__field:nth-child(3){grid-column:2}.dsh-mobile-control__origin-warning{margin:12px 0;padding:10px 12px;border-left:3px solid var(--dsw-alias-state-warn-primary,#a56810);border-radius:4px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:12px;line-height:1.6}.dsh-mobile-control__origin-feedback{font-size:12px;line-height:1.6;overflow-wrap:anywhere}.dsh-mobile-control__origin-feedback.is-error{color:var(--dsw-alias-state-error-primary,#bc3030)}.dsh-mobile-control__origin-fields input[aria-invalid=true]{border-color:var(--dsw-alias-state-error-primary,#bc3030)}.dsh-mobile-control__origin-backend{display:flex;min-width:0;flex-direction:column;align-items:stretch;gap:8px;margin-top:12px;padding-top:12px;border-top:1px solid var(--dsw-alias-border-l2,#dbe1e8)}.dsh-mobile-control__origin-backend button{align-self:flex-start;min-height:44px}.dsh-mobile-control__self-hosted-body .is-origin{margin-top:8px}
 `;
 		/** Mount the desktop control or mobile feature enhancements. */
 		function apply(ctx) {
@@ -5983,12 +7062,12 @@ window.__ModuleLoader__.load({
 				return trustAuthenticatedGatewayConnection(ctx.get("connection"));
 			}, "dsh-mobile: authenticated gateway client trust");
 			ctx.effect(() => {
-				const loopback = isLoopbackHost(location.hostname) && !new URLSearchParams(location.search).has("dsh-mobile-preview");
+				const desktopAdmin = isDesktopAdminSurface(location.hostname, location.search, window.__DSH_MOBILE_FRONTEND__);
 				const style = element("style");
 				style.dataset.plugin = "dsh-mobile";
-				style.textContent = loopback ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
+				style.textContent = desktopAdmin ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
 				document.head.append(style);
-				if (!loopback) {
+				if (!desktopAdmin) {
 					const removeSettingsAction = ctx.slots.inject("settings.general.item", () => ctx.slots.register({
 						name: "settings.general.item",
 						id: "dsh-mobile-switch-computer",
@@ -6066,6 +7145,7 @@ window.__ModuleLoader__.load({
 		exports.diagnosticEntriesForRender = diagnosticEntriesForRender;
 		exports.diagnosticOverallForChecks = diagnosticOverallForChecks;
 		exports.diagnosticServerCopy = diagnosticServerCopy;
+		exports.extensionActionRequestInit = extensionActionRequestInit;
 		exports.extensionAssetUrl = extensionAssetUrl;
 		exports.extensionGenerationHeaders = extensionGenerationHeaders;
 		exports.extensionRouteUrl = extensionRouteUrl;
@@ -6076,6 +7156,7 @@ window.__ModuleLoader__.load({
 		exports.normalizeDiagnosticOverall = normalizeDiagnosticOverall;
 		exports.normalizeDiagnosticStatus = normalizeDiagnosticStatus;
 		exports.parseMobileExtensionManifest = parseMobileExtensionManifest;
+		exports.parseMobileRemoteProvider = parseMobileRemoteProvider;
 		exports.publishAuthoritativeExtensionIds = publishAuthoritativeExtensionIds;
 		exports.reconcileRemovedExtensions = reconcileRemovedExtensions;
 		exports.registerUniqueDisposable = registerUniqueDisposable;