dsh-mobile 0.6.11 → 0.6.13

package/lib/index.mjs

@@ -9,7 +9,7 @@ import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
-import { createServer as createServer$1, request } from "node:http";
+import { STATUS_CODES, createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2, request as request$1 } from "node:https";
 import { Readable, Transform, finished } from "node:stream";
 import { finished as finished$1, pipeline } from "node:stream/promises";
@@ -64,6 +64,10 @@ var BoundedRateLimiter = class {
 		current.count += 1;
 		return true;
 	}
+	/** Discard entries that no longer identify an eligible key in a trusted, finite key set. */
+	retainKeys(eligible) {
+		for (const key of this.buckets.keys()) if (!eligible.has(key)) this.buckets.delete(key);
+	}
 	/** Current table size, exposed for bounded-state assertions. */
 	get size() {
 		return this.buckets.size;
@@ -104,6 +108,7 @@ var AccessController = class {
 	pairLimiter;
 	devices = [];
 	pairingWindow;
+	pairPending = false;
 	sessions = /* @__PURE__ */ new Map();
 	sessionEndedListeners = /* @__PURE__ */ new Set();
 	mutation = Promise.resolve();
@@ -212,40 +217,52 @@ var AccessController = class {
 			});
 		});
 	}
+	/** Limit invalid guesses by peer without letting them consume a valid one-time secret's admission. */
+	rejectPairingAttempt(sourceKey, now) {
+		if (!this.pairLimiter.take(sourceKey, now)) throw new AccessError(429, "rate_limited");
+		throw new AccessError(401, "authentication_failed");
+	}
 	/** Consume the pairing window exactly once and persist only the device-token digest. */
 	async pair(sourceKey, token, label) {
 		this.requireInitialized();
-		const now = this.now();
-		if (!this.pairLimiter.take(sourceKey, now)) throw new AccessError(429, "rate_limited");
-		if (token.length > 512) throw new AccessError(401, "authentication_failed");
-		return this.exclusive(async () => {
-			const window = this.pairingWindow;
-			if (window === void 0 || window.expiresAt <= now || !matchesDigest(token, window.digest)) {
-				if (window !== void 0 && window.expiresAt <= now) this.pairingWindow = void 0;
-				throw new AccessError(401, "authentication_failed");
-			}
-			this.pairingWindow = void 0;
-			if (this.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).length >= this.options.maxDevices) throw new AccessError(409, "device_limit");
-			const deviceToken = opaqueToken();
-			const device = Object.freeze({
-				id: randomBytes(16).toString("hex"),
-				label: normalizeLabel(label),
-				tokenDigest: digestHex(deviceToken),
-				createdAt: now,
-				expiresAt: now + this.options.deviceTtlMs,
-				lastSeenAt: now,
-				...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
-			});
-			const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
-			await this.store.save(this.snapshot(next));
-			this.devices = next;
-			const session = this.createSession(device, now);
-			return Object.freeze({
-				...session,
-				deviceToken,
-				deviceExpiresAt: device.expiresAt
+		const initialNow = this.now();
+		const initialWindow = this.pairingWindow;
+		if (token.length > 512 || initialWindow === void 0 || initialWindow.expiresAt <= initialNow || !matchesDigest(token, initialWindow.digest)) this.rejectPairingAttempt(sourceKey, initialNow);
+		if (this.pairPending) throw new AccessError(429, "rate_limited");
+		this.pairPending = true;
+		try {
+			return await this.exclusive(async () => {
+				const now = this.now();
+				const window = this.pairingWindow;
+				if (window === void 0 || window.expiresAt <= now || !matchesDigest(token, window.digest)) {
+					if (window !== void 0 && window.expiresAt <= now) this.pairingWindow = void 0;
+					this.rejectPairingAttempt(sourceKey, now);
+				}
+				this.pairingWindow = void 0;
+				if (this.devices.filter((device) => device.revokedAt === void 0 && device.expiresAt > now).length >= this.options.maxDevices) throw new AccessError(409, "device_limit");
+				const deviceToken = opaqueToken();
+				const device = Object.freeze({
+					id: randomBytes(16).toString("hex"),
+					label: normalizeLabel(label),
+					tokenDigest: digestHex(deviceToken),
+					createdAt: now,
+					expiresAt: now + this.options.deviceTtlMs,
+					lastSeenAt: now,
+					...this.options.pairingInstanceId === void 0 ? {} : { nativeInstanceId: this.options.pairingInstanceId }
+				});
+				const next = [...this.devices.filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now), device];
+				await this.store.save(this.snapshot(next));
+				this.devices = next;
+				const session = this.createSession(device, now);
+				return Object.freeze({
+					...session,
+					deviceToken,
+					deviceExpiresAt: device.expiresAt
+				});
 			});
-		});
+		} finally {
+			this.pairPending = false;
+		}
 	}
 	/** Exchange a valid persistent device credential for a new short Session. */
 	async renew(deviceToken) {
@@ -1951,7 +1968,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS = 3e4;
+const LOG_INTERVAL_MS$1 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2048,7 +2065,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.nextLogAt = now + LOG_INTERVAL_MS$1;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2065,6 +2082,129 @@ var AuthFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/http-failure-log.ts
+function safeParserCode(code) {
+	switch (code) {
+		case "ERR_HTTP_REQUEST_TIMEOUT":
+		case "HPE_HEADER_OVERFLOW":
+		case "HPE_INVALID_CHUNK_SIZE":
+		case "HPE_INVALID_CONTENT_LENGTH":
+		case "HPE_INVALID_EOF_STATE":
+		case "HPE_INVALID_HEADER_TOKEN":
+		case "HPE_INVALID_TRANSFER_ENCODING":
+		case "HPE_UNEXPECTED_CONTENT_LENGTH": return code;
+		default: return "other";
+	}
+}
+/**
+* Classify Node's HTTP rejection without reflecting an unrecognized error code.
+* @param nodeCode - The parser error's machine code, not its message or raw packet.
+* @returns The fixed public HTTP status/category and allowlisted diagnostic code.
+*/
+function classifyHttpParserFailure(nodeCode) {
+	const parserCode = safeParserCode(nodeCode);
+	if (parserCode === "ERR_HTTP_REQUEST_TIMEOUT") return {
+		status: 408,
+		code: "request_timeout",
+		parserCode
+	};
+	if (parserCode === "HPE_HEADER_OVERFLOW") return {
+		status: 431,
+		code: "headers_too_large",
+		parserCode
+	};
+	return {
+		status: 400,
+		code: "bad_request",
+		parserCode
+	};
+}
+const LOG_INTERVAL_MS = 3e4;
+/**
+* Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
+* Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
+* A sink failure cannot change a response, retry a write or expose the diagnostic sink's error.
+*/
+var HttpFailureRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	windows = {
+		parser: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		target: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		upstream: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access HTTP diagnostics could not be recorded", { code: "DSH_MOBILE_HTTP_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Classify an inbound parser rejection and sample only its fixed status and safe code. */
+	recordParser(nodeCode) {
+		const failure = classifyHttpParserFailure(nodeCode);
+		this.record({
+			kind: "parser",
+			status: failure.status,
+			code: failure.parserCode
+		});
+		return failure;
+	}
+	/** Sample an invalid request target without retaining its raw or decoded URL. */
+	recordTarget() {
+		this.record({
+			kind: "target",
+			status: 400,
+			code: "bad_request"
+		});
+	}
+	/** Sample only authenticated prompt rejections; the caller must authorize before forwarding. */
+	recordUpstream(method, pathname, status) {
+		if (method !== "POST" || pathname !== "/api/session/prompt" || !Number.isInteger(status) || status < 400 || status > 599) return;
+		this.record({
+			kind: "upstream",
+			status,
+			method: "POST",
+			path: "/api/session/prompt"
+		});
+	}
+	record(entry) {
+		if (this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[entry.kind];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				...entry,
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
@@ -5035,7 +5175,7 @@ function rejectUpgrade(socket, status, code) {
 	if (socket.destroyed) return;
 	const body = `${JSON.stringify({ error: code })}\n`;
 	socket.end([
-		`HTTP/1.1 ${String(status)} ${status === 401 ? "Unauthorized" : status === 403 ? "Forbidden" : "Bad Request"}`,
+		`HTTP/1.1 ${String(status)} ${STATUS_CODES[status] ?? "Bad Request"}`,
 		"Connection: close",
 		"Cache-Control: no-store",
 		"Content-Type: application/json; charset=utf-8",
@@ -5395,14 +5535,19 @@ var MobileAccessGateway = class {
 	closeTask;
 	removeSessionListener;
 	removeExtensionContentListener;
-	renewLimiter;
-	probeLimiter;
+	renewFailureLimiter;
+	renewDeviceLimiter;
+	renewInFlight = /* @__PURE__ */ new Set();
+	probeFailureLimiter;
+	probeDeviceLimiter;
+	probeInFlight = /* @__PURE__ */ new Set();
 	clientModulePreferences;
 	clientModuleOperations = /* @__PURE__ */ new Set();
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog) {
+	httpFailures;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5410,6 +5555,7 @@ var MobileAccessGateway = class {
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
+		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5425,8 +5571,12 @@ var MobileAccessGateway = class {
 			maxPairingAttempts: config.maxPairingAttempts,
 			maxRateLimitKeys: config.maxRateLimitKeys
 		});
-		this.renewLimiter = new BoundedRateLimiter(Math.min(100, config.maxPairingAttempts * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
-		this.probeLimiter = new BoundedRateLimiter(Math.min(1e3, config.maxDevices * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
+		const renewLimit = Math.min(100, config.maxPairingAttempts * 4);
+		const probeLimit = Math.min(1e3, config.maxDevices * 4);
+		this.renewFailureLimiter = new BoundedRateLimiter(renewLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
+		this.renewDeviceLimiter = new BoundedRateLimiter(renewLimit, config.rateLimitWindowMs, config.maxDevices);
+		this.probeFailureLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxRateLimitKeys);
+		this.probeDeviceLimiter = new BoundedRateLimiter(probeLimit, config.rateLimitWindowMs, config.maxDevices);
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
 			if (reason === "revoked") {
 				const cleanup = this.clientModulePreferences.removeDevice(authorization.deviceId).catch(() => {
@@ -5502,8 +5652,10 @@ var MobileAccessGateway = class {
 					rejectUpgrade(client, mapped.status, mapped.code);
 				});
 			});
-			server.on("clientError", (_error, socket) => {
-				rejectUpgrade(socket, 400, "bad_request");
+			server.on("clientError", (error, socket) => {
+				const nodeCode = "code" in error && typeof error.code === "string" ? error.code : void 0;
+				const failure = this.httpFailures.recordParser(nodeCode);
+				rejectUpgrade(socket, failure.status, failure.code);
 			});
 			await new Promise((resolve, reject) => {
 				const failed = (error) => {
@@ -5754,6 +5906,27 @@ var MobileAccessGateway = class {
 			maxAgeSeconds: (deviceExpiresAt - Date.now()) / 1e3
 		})]);
 	}
+	/** Separate malformed or invalid requests from device-authenticated work without trusting forwarded addresses. */
+	async withDeviceRequest(request, failureLimiter, deviceLimiter, inFlight, validate, operation) {
+		let device;
+		try {
+			device = await validate();
+		} catch (error) {
+			if ((error instanceof HttpError || error instanceof AccessError) && error.status >= 400 && error.status < 500 && !failureLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
+			throw error;
+		}
+		if (inFlight.has(device.deviceId)) throw new HttpError(429, "rate_limited");
+		const now = Date.now();
+		const activeIds = new Set(this.access.listDevices().filter((candidate) => candidate.revokedAt === void 0 && candidate.expiresAt > now).map((candidate) => candidate.id));
+		deviceLimiter.retainKeys(activeIds);
+		if (!deviceLimiter.take(device.deviceId, now)) throw new HttpError(429, "rate_limited");
+		inFlight.add(device.deviceId);
+		try {
+			return await operation(device);
+		} finally {
+			inFlight.delete(device.deviceId);
+		}
+	}
 	async handlePair(request, response) {
 		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 		if (typeof body.token !== "string" || body.label !== void 0 && typeof body.label !== "string") throw new HttpError(400, "bad_request");
@@ -5776,21 +5949,28 @@ var MobileAccessGateway = class {
 		}, this.tlsEnabled);
 	}
 	async handleRenew(request, response) {
-		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		const cookies = browserAuthCookies(request.headers.cookie);
-		const bindings = this.tlsEnabled ? cookies.get(HOST_DEVICE_COOKIE) : void 0;
-		if (bindings !== void 0 && bindings.length !== 1) throw new HttpError(401, "authentication_failed");
-		const device = authenticatedCookie(cookies.get("dsh_ma_device") ?? [], (token) => this.access.authorizeDevice(token), (candidate) => bindings === void 0 || candidate.deviceId === bindings[0]);
-		const result = await this.access.renew(device.value);
-		this.setSessionCookies(response, result, Date.now());
-		this.setBrowserDeviceBinding(response, result.deviceId, device.result.deviceExpiresAt);
-		sendJson(response, 200, {
-			renewed: true,
-			deviceId: result.deviceId,
-			csrfToken: result.csrfToken,
-			sessionExpiresAt: result.sessionExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.renewFailureLimiter, this.renewDeviceLimiter, this.renewInFlight, async () => {
+			await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			const cookies = browserAuthCookies(request.headers.cookie);
+			const bindings = this.tlsEnabled ? cookies.get(HOST_DEVICE_COOKIE) : void 0;
+			if (bindings !== void 0 && bindings.length !== 1) throw new HttpError(401, "authentication_failed");
+			const device = authenticatedCookie(cookies.get("dsh_ma_device") ?? [], (token) => this.access.authorizeDevice(token), (candidate) => bindings === void 0 || candidate.deviceId === bindings[0]);
+			return {
+				deviceId: device.result.deviceId,
+				token: device.value,
+				credential: device.result
+			};
+		}, async (selected) => {
+			const result = await this.access.renew(selected.token);
+			this.setSessionCookies(response, result, Date.now());
+			this.setBrowserDeviceBinding(response, result.deviceId, selected.credential.deviceExpiresAt);
+			sendJson(response, 200, {
+				renewed: true,
+				deviceId: result.deviceId,
+				csrfToken: result.csrfToken,
+				sessionExpiresAt: result.sessionExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	/** CA-backed entries retain their pin; public entries project the authenticated credential's identity. */
 	nativeResponseInstanceId(result) {
@@ -5811,28 +5991,40 @@ var MobileAccessGateway = class {
 		}, this.tlsEnabled);
 	}
 	async handleNativeRenew(request, response) {
-		if (!this.renewLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
-		const result = await this.access.renew(body.deviceToken);
-		sendJson(response, 200, {
-			instanceId: this.nativeResponseInstanceId(result),
-			deviceId: result.deviceId,
-			sessionToken: result.sessionToken,
-			csrfToken: result.csrfToken,
-			sessionExpiresAt: result.sessionExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.renewFailureLimiter, this.renewDeviceLimiter, this.renewInFlight, async () => {
+			const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+			return {
+				deviceId: this.access.authorizeDevice(body.deviceToken).deviceId,
+				token: body.deviceToken
+			};
+		}, async (selected) => {
+			const result = await this.access.renew(selected.token);
+			sendJson(response, 200, {
+				instanceId: this.nativeResponseInstanceId(result),
+				deviceId: result.deviceId,
+				sessionToken: result.sessionToken,
+				csrfToken: result.csrfToken,
+				sessionExpiresAt: result.sessionExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	async handleNativeProbe(request, response) {
-		if (!this.probeLimiter.take(request.socket.remoteAddress ?? "unknown", Date.now())) throw new HttpError(429, "rate_limited");
-		const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
-		if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
-		const result = await this.access.probe(body.deviceToken);
-		sendJson(response, 200, {
-			instanceId: this.nativeResponseInstanceId(result),
-			deviceId: result.deviceId,
-			deviceExpiresAt: result.deviceExpiresAt
-		}, this.tlsEnabled);
+		await this.withDeviceRequest(request, this.probeFailureLimiter, this.probeDeviceLimiter, this.probeInFlight, async () => {
+			const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+			if (typeof body.deviceToken !== "string") throw new HttpError(400, "bad_request");
+			return {
+				deviceId: this.access.authorizeDevice(body.deviceToken).deviceId,
+				token: body.deviceToken
+			};
+		}, async (selected) => {
+			const result = await this.access.probe(selected.token);
+			sendJson(response, 200, {
+				instanceId: this.nativeResponseInstanceId(result),
+				deviceId: result.deviceId,
+				deviceExpiresAt: result.deviceExpiresAt
+			}, this.tlsEnabled);
+		});
 	}
 	async handleLogout(request, response) {
 		await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
@@ -5867,7 +6059,13 @@ var MobileAccessGateway = class {
 		sendJson(response, 200, { loggedOut: true }, this.tlsEnabled);
 	}
 	async handleExternalRequest(request, response) {
-		const target = parseRequestTarget(request.url);
+		let target;
+		try {
+			target = parseRequestTarget(request.url);
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 400) this.httpFailures.recordTarget();
+			throw error;
+		}
 		const policy = this.requirePolicy();
 		const isMutation = request.method !== "GET" && request.method !== "HEAD";
 		assertExternalTrust(request, policy, isMutation);
@@ -6390,7 +6588,8 @@ var MobileAccessGateway = class {
 					headers: {
 						host: this.config.upstreamOrigin.host,
 						accept: "text/html",
-						"accept-encoding": "identity"
+						"accept-encoding": "identity",
+						"sec-fetch-mode": "same-origin"
 					},
 					agent: false
 				});
@@ -7027,6 +7226,7 @@ var MobileAccessGateway = class {
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
 			const statusCode = proxied.statusCode ?? 502;
+			this.httpFailures.recordUpstream(request$2.method, request$2.url?.split("?", 1)[0] ?? "", statusCode);
 			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
 			const compressible = canCompressResponse(request$2, proxied);
@@ -17535,6 +17735,8 @@ async function apply(ctx, config) {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
 		}, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -17593,6 +17795,8 @@ async function apply(ctx, config) {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -17609,7 +17813,11 @@ async function apply(ctx, config) {
 		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
 		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), void 0, stateDirectory);
 		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -17620,7 +17828,11 @@ async function apply(ctx, config) {
 	};
 	const createOriginGateway = async (settings) => {
 		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, remoteInstanceId, settings.listenPort, instanceId);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {