dsh-mobile 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Notable changes to DSH Mobile are recorded here. GitHub Releases remain the source for downloadable packages and complete generated commit notes.
 
+## 0.4.4 - 2026-09-20
+
+- Keep DSH running if mDNS response callbacks, the multicast-dns emitter, or the already-bound UDP discovery socket reports a network error. LAN discovery records the degraded channel and logs the error code while the authenticated HTTP and WebSocket gateway remains available (thanks @KMGTPEZY for [#95](https://github.com/saya-ch/dsh-mobile/issues/95)).
+- Accept pinned cpolar and cloudflared component downloads when a proxy omits `Content-Length`, and stop reading as soon as the response exceeds the pinned size.
+- Credit community PR authors, including work adapted after a PR was closed, and every historical issue author by contribution type in [CONTRIBUTORS.md](CONTRIBUTORS.md), separately from GitHub's commit-based Contributors panel.
+
 ## 0.4.3 - 2026-09-19
 
 - Support Linux for the Funnel, cpolar and cloudflared remote providers, including x64 and arm64 Funnel host binaries.

package/CONTRIBUTORS.md

@@ -0,0 +1,53 @@
+# 贡献者 / Contributors
+
+GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
+
+GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-09-20. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+
+## 已合并 PR / Merged pull requests
+
+| 社区成员 / Community member | 已合并 PR / Merged PRs |
+| --- | --- |
+| [@1624318455](https://github.com/1624318455) | [#93](https://github.com/saya-ch/dsh-mobile/pull/93) |
+| [@abworks-dev](https://github.com/abworks-dev) | [#91](https://github.com/saya-ch/dsh-mobile/pull/91) |
+| [@idoall](https://github.com/idoall) | [#61](https://github.com/saya-ch/dsh-mobile/pull/61), [#66](https://github.com/saya-ch/dsh-mobile/pull/66), [#67](https://github.com/saya-ch/dsh-mobile/pull/67), [#77](https://github.com/saya-ch/dsh-mobile/pull/77) |
+| [@JackRushante](https://github.com/JackRushante) | [#16](https://github.com/saya-ch/dsh-mobile/pull/16) |
+| [@longisland-icetea](https://github.com/longisland-icetea) | [#59](https://github.com/saya-ch/dsh-mobile/pull/59), [#60](https://github.com/saya-ch/dsh-mobile/pull/60), [#63](https://github.com/saya-ch/dsh-mobile/pull/63) |
+| [@qzyqmzn](https://github.com/qzyqmzn) | [#38](https://github.com/saya-ch/dsh-mobile/pull/38), [#75](https://github.com/saya-ch/dsh-mobile/pull/75) |
+| [@StrawberryAO](https://github.com/StrawberryAO) | [#34](https://github.com/saya-ch/dsh-mobile/pull/34), [#40](https://github.com/saya-ch/dsh-mobile/pull/40) |
+| [@xingleiwu](https://github.com/xingleiwu) | [#79](https://github.com/saya-ch/dsh-mobile/pull/79), [#84](https://github.com/saya-ch/dsh-mobile/pull/84), [#85](https://github.com/saya-ch/dsh-mobile/pull/85), [#86](https://github.com/saya-ch/dsh-mobile/pull/86) |
+
+## 已吸收但未直接合并的 PR / Incorporated without a direct merge
+
+[@BlueandwhiteXD](https://github.com/BlueandwhiteXD) 的 [#15](https://github.com/saya-ch/dsh-mobile/pull/15) 提出了并实现了 Android 键盘遮挡修复。由于发布分支已有重叠的状态栏改动，该方案改写后进入主线提交 [`09ef315`](https://github.com/saya-ch/dsh-mobile/commit/09ef31590219f2a436bd801214703338c215b00d)，并在 [`04e6a0d`](https://github.com/saya-ch/dsh-mobile/commit/04e6a0da030353d4f0897419d0f692dc538a752d) 以 `Co-authored-by` 致谢。PR 的 Closed 状态不应掩盖这项已采用的代码贡献。
+
+[@qzyqmzn](https://github.com/qzyqmzn) 的 [#32](https://github.com/saya-ch/dsh-mobile/pull/32) 和 [#37](https://github.com/saya-ch/dsh-mobile/pull/37) 被后续已合并的 [#38](https://github.com/saya-ch/dsh-mobile/pull/38) 取代；其正式贡献已列在上方。
+
+[@BlueandwhiteXD](https://github.com/BlueandwhiteXD)'s [#15](https://github.com/saya-ch/dsh-mobile/pull/15) supplied the Android keyboard-overlap fix. It was adapted into [`09ef315`](https://github.com/saya-ch/dsh-mobile/commit/09ef31590219f2a436bd801214703338c215b00d) alongside overlapping status-bar work and credited with `Co-authored-by` in [`04e6a0d`](https://github.com/saya-ch/dsh-mobile/commit/04e6a0da030353d4f0897419d0f692dc538a752d). Its Closed PR status does not mean the code contribution was rejected. @qzyqmzn's [#32](https://github.com/saya-ch/dsh-mobile/pull/32) and [#37](https://github.com/saya-ch/dsh-mobile/pull/37) were superseded by merged [#38](https://github.com/saya-ch/dsh-mobile/pull/38).
+
+## 问题反馈与建议 / Issue reports and ideas
+
+以下名单包括提出问题、复现缺陷和建议功能的成员；出现在本表不表示提交过代码。 / These members opened repository issues; listing them does not imply code authorship.
+
+| 反馈贡献者 / Issue reporter | 提交的问题 / Issues |
+| --- | --- |
+| [@1624318455](https://github.com/1624318455) | [#92](https://github.com/saya-ch/dsh-mobile/issues/92) |
+| [@CESAEREE](https://github.com/CESAEREE) | [#1](https://github.com/saya-ch/dsh-mobile/issues/1) |
+| [@CharlesLueng](https://github.com/CharlesLueng) | [#68](https://github.com/saya-ch/dsh-mobile/issues/68) |
+| [@chmzs](https://github.com/chmzs) | [#73](https://github.com/saya-ch/dsh-mobile/issues/73) |
+| [@idoall](https://github.com/idoall) | [#42](https://github.com/saya-ch/dsh-mobile/issues/42), [#45](https://github.com/saya-ch/dsh-mobile/issues/45), [#46](https://github.com/saya-ch/dsh-mobile/issues/46), [#47](https://github.com/saya-ch/dsh-mobile/issues/47), [#62](https://github.com/saya-ch/dsh-mobile/issues/62), [#64](https://github.com/saya-ch/dsh-mobile/issues/64) |
+| [@IvyC-zz](https://github.com/IvyC-zz) | [#58](https://github.com/saya-ch/dsh-mobile/issues/58), [#78](https://github.com/saya-ch/dsh-mobile/issues/78) |
+| [@jillkayat](https://github.com/jillkayat) | [#10](https://github.com/saya-ch/dsh-mobile/issues/10) |
+| [@KMGTPEZY](https://github.com/KMGTPEZY) | [#95](https://github.com/saya-ch/dsh-mobile/issues/95) |
+| [@LWping](https://github.com/LWping) | [#94](https://github.com/saya-ch/dsh-mobile/issues/94) |
+| [@oliverwan97](https://github.com/oliverwan97) | [#26](https://github.com/saya-ch/dsh-mobile/issues/26) |
+| [@rgshendong](https://github.com/rgshendong) | [#87](https://github.com/saya-ch/dsh-mobile/issues/87) |
+| [@RonaldinhoL](https://github.com/RonaldinhoL) | [#89](https://github.com/saya-ch/dsh-mobile/issues/89) |
+| [@shengyvself](https://github.com/shengyvself) | [#13](https://github.com/saya-ch/dsh-mobile/issues/13), [#14](https://github.com/saya-ch/dsh-mobile/issues/14) |
+| [@sortjiajun](https://github.com/sortjiajun) | [#90](https://github.com/saya-ch/dsh-mobile/issues/90) |
+| [@StrawberryAO](https://github.com/StrawberryAO) | [#39](https://github.com/saya-ch/dsh-mobile/issues/39) |
+| [@Surpass567](https://github.com/Surpass567) | [#80](https://github.com/saya-ch/dsh-mobile/issues/80), [#81](https://github.com/saya-ch/dsh-mobile/issues/81) |
+| [@taki-ohh](https://github.com/taki-ohh) | [#19](https://github.com/saya-ch/dsh-mobile/issues/19) |
+| [@Xingcheng-wang](https://github.com/Xingcheng-wang) | [#76](https://github.com/saya-ch/dsh-mobile/issues/76) |
+| [@Yurzi](https://github.com/Yurzi) | [#17](https://github.com/saya-ch/dsh-mobile/issues/17) |
+| [@Ztyss](https://github.com/Ztyss) | [#22](https://github.com/saya-ch/dsh-mobile/issues/22), [#23](https://github.com/saya-ch/dsh-mobile/issues/23) |

package/README.en.md

@@ -24,20 +24,21 @@
   <a href="#third-party-plugin-compatibility">Third-party plugins</a> ·
   <a href="#security">Security</a> ·
   <a href="#compatibility">Compatibility</a> ·
+  <a href="#contributors">Contributors</a> ·
   <a href="CHANGELOG.md">Changelog</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **0.4.3 update**: the Funnel, cpolar and cloudflared remote channels now support Linux (x64/arm64); a disconnected saved LAN interface no longer blocks the whole DSH boot (it stays dormant until the network returns); and heavy profiles no longer white-screen phones (boot-batch chunking plus large-bundle pass-through). [Details](CHANGELOG.md).
+> **0.4.4 update**: runtime mDNS or UDP discovery errors no longer take down DSH, and component downloads accept proxy responses without `Content-Length`. [Details](CHANGELOG.md).
 >
-> **Upgrade reminder**: the 0.4.3 plugin continues to work with existing Android apps and paired devices do not need re-pairing. Install the 0.4.3 app as well if you want this Android build. [Compatibility notes](#compatibility).
+> **Upgrade reminder**: the 0.4.4 plugin continues to work with existing Android apps and paired devices do not need re-pairing. Install the 0.4.4 app if you want this Android build. [Compatibility notes](#compatibility).
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.3/dsh-mobile-android-v0.4.3.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.3/dsh-mobile-android-v0.4.3.apk"><strong>Download Android app 0.4.3</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.3">Release notes and checksums</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.4/dsh-mobile-android-v0.4.4.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.4/dsh-mobile-android-v0.4.4.apk"><strong>Download Android app 0.4.4</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.4">Release notes and checksums</a></sub>
 </p>
 
 DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel, cpolar, cloudflared, self-hosted FRP, or own reverse-proxy remote path. Local and remote access keep the same sessions, Workspaces, messages, and tools while using separate switches and paired-device stores without modifying DeepSeek Harness source.
@@ -215,7 +216,7 @@ Compatibility and WebSocket rules:
 
 Proxied pages allow HTTP frames for compatibility with some community plugins; those pages are unencrypted and can be altered, and browsers may still block them as mixed content. Use HTTPS for sensitive work. The same warning appears at the top of the remote panel when it is opened over HTTPS.
 
-- The released 0.4.3 is contract-checked against DSH `0.1.6-alpha.2` (renderer-v2). The DSH page must expose the standard session, `main`/`panelInfo`, and `rightbar` slots; the community plugin must register its panel or sidebar content through DSH's standard entry points.
+- Version 0.4.4 is contract-checked against DSH `0.1.6-alpha.2` (renderer-v2). The DSH page must expose the standard session, `main`/`panelInfo`, and `rightbar` slots; the community plugin must register its panel or sidebar content through DSH's standard entry points.
 - The gateway allows first-party DSH WebSocket paths by default, including `/sidebar/ws/terminal`. Other paths used by community sidebar plugins are blocked by default and appear in Diagnostics; the `/sidebar/ws/agent-opens` and `/sidebar/ws/agent-terminals` paths in the image are examples that must be reviewed for the actual plugin.
 - In **Connection diagnostics → Third-party WebSocket paths**, select **Allow** only for an exact path you have verified. Query strings and fuzzy prefixes are rejected; **Allow all** is not recommended. Approved paths can be removed at any time, and the same policy applies to LAN and remote connections.
 - Approval only lets that path pass through the authenticated, same-origin DSH Mobile gateway. It does not open arbitrary TCP/UDP ports or bypass device pairing. If a community plugin still fails, check the path recorded by Diagnostics and approve one path at a time.
@@ -302,6 +303,7 @@ On macOS, local network, self-hosted FRP, and the own reverse proxy work; the th
 
 | DSH Mobile plugin | Verified DeepSeek Harness version |
 | --- | --- |
+| `0.4.4` | `0.1.6-alpha.2` (local source and renderer-v2 contract check) |
 | `0.4.3` | `0.1.6-alpha.2` (local source and renderer-v2 contract check) |
 | `0.4.2` | `0.1.6-alpha.1` (local source and renderer-v2 contract check) |
 | `0.4.1` | `0.1.6-alpha.1` (local source and renderer-v2 contract check) |
@@ -330,6 +332,10 @@ dsh plugin --profile web remove dsh-mobile
 
 Source users replace `dsh` with `pnpm dsh`.
 
+## Contributors
+
+Thanks to everyone who submitted PRs, reproduced issues, or proposed improvements. [The contributors list](CONTRIBUTORS.md) credits merged PRs, PR work later incorporated without a direct merge, and issue reports separately. GitHub's sidebar Contributors panel is generated from commits on the default branch and cannot be manually extended with issue-only contributors.
+
 ## Development
 
 ```powershell

package/README.md

@@ -24,20 +24,21 @@
   <a href="#第三方插件适配">第三方插件适配</a> ·
   <a href="#安全">安全</a> ·
   <a href="#兼容性">兼容性</a> ·
+  <a href="#贡献者">贡献者</a> ·
   <a href="CHANGELOG.md">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **0.4.3 更新**：Funnel、cpolar、cloudflared 远程通道支持 Linux（x64/arm64）；保存的局域网网卡断开不再阻断整个 DSH 启动（休眠等网卡回来）；插件多的用户手机端白屏修好（启动包分片 + 大 bundle 直通）。[详细记录](CHANGELOG.md)。
+> **0.4.4 更新**：局域网发现遇到运行期 mDNS/UDP 错误时不再带崩 DSH；组件下载也能处理缺少 `Content-Length` 的代理响应。[详细记录](CHANGELOG.md)。
 >
-> **升级提醒**：0.4.3 插件可继续使用现有 Android App，已有设备无需重新配对。若要使用本次 Android 构建，请同时安装 0.4.3 App。[兼容说明](#兼容性)。
+> **升级提醒**：0.4.4 插件可继续使用现有 Android App，已有设备无需重新配对。若要使用本次 Android 构建，请安装 0.4.4 App。[兼容说明](#兼容性)。
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.3/dsh-mobile-android-v0.4.3.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.3/dsh-mobile-android-v0.4.3.apk"><strong>下载 Android App 0.4.3</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.3">版本说明与校验文件</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.4/dsh-mobile-android-v0.4.4.apk"><img src="assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/v0.4.4/dsh-mobile-android-v0.4.4.apk"><strong>下载 Android App 0.4.4</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.4.4">版本说明与校验文件</a></sub>
 </p>
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar、cloudflared、自建 FRP 或自有反向代理远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。局域网与远程访问分别启停、分别管理设备，且都不修改 DeepSeek Harness 源码。
@@ -215,7 +216,7 @@ Android App 用一个“已配对设备”列表同时显示多台电脑：局
 
 代理页面为兼容部分社区插件允许嵌入 HTTP 页面；这类内容未加密，可能被篡改，浏览器也可能因混合内容策略拦截。处理敏感内容时请使用 HTTPS。通过 HTTPS 管理入口打开远程面板时，页面顶部会显示相同提醒。
 
-- 已发布的 0.4.3 按 DSH `0.1.6-alpha.2` 做过 renderer-v2 合同检查。DSH 页面需要提供标准的会话、`main`/`panelInfo` 和 `rightbar` 插槽；插件自身需要通过 DSH 的标准面板或侧边栏入口注册内容。
+- 0.4.4 按 DSH `0.1.6-alpha.2` 做 renderer-v2 契约检查。DSH 页面需要提供标准的会话、`main`/`panelInfo` 和 `rightbar` 插槽；插件自身需要通过 DSH 的标准面板或侧边栏入口注册内容。
 - 网关默认只允许 DSH 内置的第一方 WebSocket 路径。社区侧边栏插件使用的其他路径默认拦截，通常会在诊断页显示为待处理项目；截图中的`/sidebar/ws/agent-opens` 和`/sidebar/ws/agent-terminals` 就属于这类需要按实际插件确认的路径。
 - 在 **连接诊断 → 第三方 WebSocket 路径** 中，只对确认过的精确路径点击 **允许**。系统不接受带查询字符串或模糊前缀的路径；不建议使用“全部允许”。已允许的路径可以随时移除，局域网和远程连接使用同一套规则。
 - 放行只代表该路径可以通过已认证、同源的 DSH Mobile 网关，不会开放任意 TCP/UDP 端口，也不会绕过设备配对。若社区插件仍然连接失败，先看诊断页的实际拦截路径，再按一条路径放行。
@@ -303,6 +304,7 @@ macOS 上局域网、自建 FRP 与自有反向代理可用；三个托管组件
 
 | DSH Mobile 插件                         | 验证支持的 DeepSeek Harness 版本                             |
 | ----------------------------------------- | -------------------------------------------------------------- |
+| `0.4.4` | `0.1.6-alpha.2`（本机源码与 renderer-v2 契约检查） |
 | `0.4.3` | `0.1.6-alpha.2`（本机源码与 renderer-v2 契约检查） |
 | `0.4.2` | `0.1.6-alpha.1`（本机源码与 renderer-v2 契约检查） |
 | `0.4.1` | `0.1.6-alpha.1`（本机源码与 renderer-v2 契约检查） |
@@ -331,6 +333,10 @@ dsh plugin --profile web remove dsh-mobile
 
 源码模式把上述 `dsh` 换成 `pnpm dsh`。
 
+## 贡献者
+
+感谢提交 PR、复现问题和提出建议的社区成员。[贡献者名单](CONTRIBUTORS.md)按已合并 PR、后来吸收的 PR 工作和 issue 反馈分别致谢；GitHub 右侧的 Contributors 区域由进入默认分支的提交自动生成，不能手动加入仅反馈问题的成员。
+
 ## 开发
 
 ```powershell

package/lib/index.d.mts

@@ -597,6 +597,7 @@ declare class MobileAccessGateway {
   private readonly upstreamAuthenticatedUrl?;
   private readonly extraWebSocketPaths?;
   private readonly blockedUpgradeLog?;
+  private readonly onDiscoveryDegraded?;
   readonly access: AccessController;
   private readonly listenerTlsEnabled;
   private readonly tlsEnabled;
@@ -611,6 +612,7 @@ declare class MobileAccessGateway {
    * it, "the phone cannot find this computer" has no diagnosable cause on the host.
    */
   private discoveryError;
+  private mdnsError;
   /** Names of the bundled mobile assets that could not be read, if any. */
   private mobileAssetError;
   private bonjour;
@@ -644,10 +646,13 @@ declare class MobileAccessGateway {
   private readonly probeLimiter;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   private startDiscovery;
+  private reportDiscoveryDegraded;
+  private recordBroadcastFailure;
+  private recordMdnsFailure;
   private discoveryAnnouncement;
   private closeFailedStart;
   private closeBonjour;
@@ -668,6 +673,7 @@ declare class MobileAccessGateway {
     readonly broadcast: boolean;
     readonly mdns: boolean;
     readonly errorCode?: string;
+    readonly mdnsErrorCode?: string;
     readonly mobileAssetsErrorCode?: string;
   };
   private requirePolicy;

package/lib/index.mjs

@@ -2991,6 +2991,13 @@ function discoveryBroadcastTargets(cidrs) {
 	}
 	return [...targets];
 }
+function discoveryFailure(error) {
+	const code = error instanceof Error && typeof error.code === "string" ? error.code : "unknown";
+	return Object.freeze({
+		code,
+		message: error instanceof Error ? error.message : String(error)
+	});
+}
 function extensionTarget(pathname) {
 	const prefix = `${AUTH_PREFIX}/extensions`;
 	if (pathname === prefix || pathname === `${prefix}/` || pathname === `${prefix}/manifest`) return { kind: "manifest" };
@@ -3088,6 +3095,7 @@ var MobileAccessGateway = class {
 	upstreamAuthenticatedUrl;
 	extraWebSocketPaths;
 	blockedUpgradeLog;
+	onDiscoveryDegraded;
 	access;
 	listenerTlsEnabled;
 	tlsEnabled;
@@ -3102,6 +3110,7 @@ var MobileAccessGateway = class {
 	* it, "the phone cannot find this computer" has no diagnosable cause on the host.
 	*/
 	discoveryError;
+	mdnsError;
 	/** Names of the bundled mobile assets that could not be read, if any. */
 	mobileAssetError;
 	bonjour;
@@ -3133,12 +3142,13 @@ var MobileAccessGateway = class {
 	removeExtensionContentListener;
 	renewLimiter;
 	probeLimiter;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.blockedUpgradeLog = blockedUpgradeLog;
+		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -3252,33 +3262,56 @@ var MobileAccessGateway = class {
 		const socket = createSocket("udp4");
 		this.discoverySocket = socket;
 		const announcement = this.discoveryAnnouncement(port);
+		let binding = true;
+		socket.on("error", (error) => {
+			if (!binding) this.recordBroadcastFailure(error, true);
+		});
+		const sendAnnouncement = (targetPort, address) => {
+			if (this.closing || this.discoveryError !== void 0) return;
+			try {
+				socket.send(announcement, targetPort, address, (error) => {
+					if (error !== null) this.recordBroadcastFailure(error, true);
+				});
+			} catch (error) {
+				this.recordBroadcastFailure(error, true);
+			}
+		};
 		socket.on("message", (message, remote) => {
-			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
-			socket.send(announcement, remote.port, remote.address, () => void 0);
+			if (this.closing || this.discoveryError !== void 0 || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
+			sendAnnouncement(remote.port, remote.address);
 		});
 		const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
 		if (await new Promise((resolve) => {
 			const onBindError = (error) => {
 				socket.off("error", onBindError);
-				this.discoveryError = Object.freeze({
-					code: typeof error.code === "string" ? error.code : "unknown",
-					message: typeof error.message === "string" ? error.message : String(error)
-				});
+				this.recordBroadcastFailure(error, false);
 				resolve(false);
 			};
 			socket.once("error", onBindError);
-			socket.bind(port, bindHost, () => {
-				socket.off("error", onBindError);
-				socket.setBroadcast(true);
-				resolve(true);
-			});
-		})) {
+			try {
+				socket.bind(port, bindHost, () => {
+					socket.off("error", onBindError);
+					binding = false;
+					try {
+						socket.setBroadcast(true);
+						resolve(true);
+					} catch (error) {
+						this.recordBroadcastFailure(error, true);
+						resolve(false);
+					}
+				});
+			} catch (error) {
+				onBindError(error);
+			}
+		}) && this.discoveryError === void 0) {
 			const announce = () => {
-				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
+				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) sendAnnouncement(port, target);
 			};
 			announce();
-			this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
-			this.discoveryTimer.unref();
+			if (this.discoveryError === void 0) {
+				this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
+				this.discoveryTimer.unref();
+			}
 		} else {
 			this.discoverySocket = void 0;
 			try {
@@ -3286,8 +3319,12 @@ var MobileAccessGateway = class {
 			} catch {}
 		}
 		const deviceName = discoveryDeviceName();
-		const bonjour = new Bonjour({ disableIPv6: true });
+		const onMdnsError = (error) => {
+			this.recordMdnsFailure(error);
+		};
+		const bonjour = new Bonjour({ disableIPv6: true }, onMdnsError);
 		this.bonjour = bonjour;
+		bonjour.server.mdns.on("error", onMdnsError);
 		bonjour.publish({
 			name: `${deviceName} (${this.config.instanceId.slice(0, 8)})`,
 			type: MDNS_SERVICE_TYPE,
@@ -3303,6 +3340,25 @@ var MobileAccessGateway = class {
 			}
 		});
 	}
+	reportDiscoveryDegraded(source, code) {
+		try {
+			this.onDiscoveryDegraded?.(source, code);
+		} catch (error) {
+			process.emitWarning(`DSH Mobile could not log ${source} discovery error: ${String(error)}`, { code: "DSH_MOBILE_DISCOVERY_LOG_FAILED" });
+		}
+	}
+	recordBroadcastFailure(error, notify) {
+		if (this.closing || this.discoveryError !== void 0) return;
+		this.discoveryError = discoveryFailure(error);
+		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
+		this.discoveryTimer = void 0;
+		if (notify) this.reportDiscoveryDegraded("broadcast", this.discoveryError.code);
+	}
+	recordMdnsFailure(error) {
+		if (this.closing || this.mdnsError !== void 0) return;
+		this.mdnsError = discoveryFailure(error);
+		this.reportDiscoveryDegraded("mdns", this.mdnsError.code);
+	}
 	discoveryAnnouncement(port) {
 		return Buffer.from(JSON.stringify({
 			deviceName: discoveryDeviceName(),
@@ -3360,8 +3416,9 @@ var MobileAccessGateway = class {
 	discoveryStatus() {
 		return Object.freeze({
 			broadcast: this.discoverySocket !== void 0 && this.discoveryTimer !== void 0,
-			mdns: this.bonjour !== void 0,
+			mdns: this.bonjour !== void 0 && this.mdnsError === void 0,
 			...this.discoveryError === void 0 ? {} : { errorCode: `discovery_broadcast_${this.discoveryError.code}` },
+			...this.mdnsError === void 0 ? {} : { mdnsErrorCode: `discovery_mdns_${this.mdnsError.code}` },
 			...this.mobileAssetError === void 0 ? {} : { mobileAssetsErrorCode: this.mobileAssetError }
 		});
 	}
@@ -6721,10 +6778,23 @@ async function attemptDownload(request) {
 	});
 	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
 	if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
-	const declared = Number(response.headers.get("content-length"));
-	if (Number.isFinite(declared) && declared !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
-	const bytes = new Uint8Array(await response.arrayBuffer());
-	if (bytes.byteLength !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const contentLength = response.headers.get("content-length");
+	if (contentLength !== null && (!/^\d+$/u.test(contentLength) || Number(contentLength) !== request.expectedBytes)) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	if (response.body === null) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const bytes = new Uint8Array(request.expectedBytes);
+	const reader = response.body.getReader();
+	let received = 0;
+	while (true) {
+		const chunk = await reader.read();
+		if (chunk.done) break;
+		if (chunk.value.byteLength > bytes.byteLength - received) {
+			await reader.cancel();
+			throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+		}
+		bytes.set(chunk.value, received);
+		received += chunk.value.byteLength;
+	}
+	if (received !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
 	return bytes;
 }
 /**
@@ -11312,7 +11382,9 @@ async function apply(ctx, config) {
 			...candidateConfig,
 			upstreamOrigin: template.upstreamOrigin.origin
 		});
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
+			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
+		});
 		await candidate.start();
 		lanGateway = candidate;
 		const removeTaskSink = taskEventHub.add(candidate);