dsh-mobile 0.6.12 → 0.6.13

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.6.13 - 2026-10-19
+
+- Distinguish inbound HTTP receive timeouts (408 `request_timeout`) and oversized request headers (431 `headers_too_large`) from other malformed HTTP requests (400 `bad_request`). Preserve the existing receive limits and single-attempt POST forwarding; do not automatically retry messages.
+- Add sampled HTTP rejection diagnostics that distinguish parser errors, invalid targets and authenticated upstream prompt rejections without recording request contents, raw packets, Cookies or arbitrary URLs. Connect diagnostic sinks for all Gateway factories, including own-origin and self-signed FRP entries.
+- Add real-page prompt-failure checks for restored text/images and visible errors. Separately reproduce a DSH 0.2.0-rc.2 and 0.2.1-rc.2 lifecycle defect: leaving a Session during a pending send cancels that request and discards its recovery state, including in pure stock profiles without Mobile installed. DSH source remains unchanged; this upstream defect and the exact cause of the reported #234 rejection are not claimed fixed. Thanks @Void-LifeStream for [#234](https://github.com/saya-ch/dsh-mobile/issues/234).
+- Distinguish HTTP receive timeouts and oversized request headers in the Gateway response and add bounded, privacy-preserving rejection diagnostics across all Gateway factories. Existing request limits, authentication checks and single-attempt POST forwarding remain unchanged; this release does not add automatic message retries.
+- Add a packed prompt-failure smoke covering text/image recovery and visible DSH errors on DSH 0.2.0-rc.2 and 0.2.1-rc.2. The optional navigation diagnostic records an upstream Session-lifecycle failure but is not a passing regression lane.
+- Keep DSH source and installed frontend artifacts read-only. The proposed iroh P2P channel in [#235](https://github.com/saya-ch/dsh-mobile/issues/235) is intentionally outside this repository and this release; it requires a separate host-side proof of concept.
+
 ## 0.6.12 - 2026-10-18
 
 - Send explicit non-navigation Fetch Metadata during the Gateway's internal DSH cookie exchange. This avoids the HTML navigation bounce produced by community authentication plugins without accepting arbitrary HTTP 200 pages, following redirects, or forwarding the upstream Cookie to the phone. Thanks @jamorzzz for [#230](https://github.com/saya-ch/dsh-mobile/issues/230).

package/CONTRIBUTORS.md

@@ -136,7 +136,7 @@ Thanks [@xhwxt](https://github.com/xhwxt) for the document-picker proposal in [#
 | [@sortjiajun](https://github.com/sortjiajun) | [#90](https://github.com/saya-ch/dsh-mobile/issues/90) |
 | [@StrawberryAO](https://github.com/StrawberryAO) | [#39](https://github.com/saya-ch/dsh-mobile/issues/39) |
 | [@Surpass567](https://github.com/Surpass567) | [#80](https://github.com/saya-ch/dsh-mobile/issues/80), [#81](https://github.com/saya-ch/dsh-mobile/issues/81) |
-| [@Void-LifeStream](https://github.com/Void-LifeStream) | [#205](https://github.com/saya-ch/dsh-mobile/issues/205), [#219](https://github.com/saya-ch/dsh-mobile/issues/219), [#225](https://github.com/saya-ch/dsh-mobile/issues/225) |
+| [@Void-LifeStream](https://github.com/Void-LifeStream) | [#205](https://github.com/saya-ch/dsh-mobile/issues/205), [#219](https://github.com/saya-ch/dsh-mobile/issues/219), [#225](https://github.com/saya-ch/dsh-mobile/issues/225), [#234](https://github.com/saya-ch/dsh-mobile/issues/234) |
 | [@WalkerJay666](https://github.com/WalkerJay666) | [#201](https://github.com/saya-ch/dsh-mobile/issues/201) |
 | [@up-and-down-0618](https://github.com/up-and-down-0618) | [#115](https://github.com/saya-ch/dsh-mobile/issues/115) |
 | [@taki-ohh](https://github.com/taki-ohh) | [#19](https://github.com/saya-ch/dsh-mobile/issues/19) |

package/README.en.md

@@ -26,13 +26,13 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.12">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.13">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **Current stable release: 0.6.12**. Fix page 502 errors with community authentication and pairing/renewal limits behind shared proxies; add missing old-engine APIs and actionable startup feedback. Android App **0.6.5** is unchanged and needs no matching update. [Release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.12) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.6.13**. Distinguish Gateway receive timeouts and oversized headers, add privacy-bounded rejection diagnostics, and cover packed text/image prompt failures. Android App **0.6.5** is unchanged and needs no matching update. [Release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.13) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
@@ -340,7 +340,7 @@ The dedicated mobile page synchronously loads the authenticated, same-origin `/m
 
 **Old-engine limits**: API shims cannot repair JavaScript syntax an engine cannot parse. The published **DSH 0.2.1-rc.2** frontend contains class static blocks, which Chromium **92** cannot parse. This syntax became enabled by default in Chrome 94, but that does not establish full DSH compatibility on 94. [V8 announcement](https://v8.dev/blog/v8-release-94). The App's below-100 advisory is not a compatibility guarantee; choosing Continue does not make the current DSH runnable. If system WebView cannot be updated, use a phone browser already confirmed to work with the computer's mobile address, without clearing existing App pairings.
 
-**Plugin 0.6.12** adds identified missing array, string, object and structured-clone APIs, plus startup-failure feedback with Reload page and Keep waiting actions when DSH has not rendered. It does not transpile DSH or reload automatically; acceptance on the physical Huawei Chromium 92 App remains unverified. Reports should include DSH/plugin/App and WebView versions, entry mode and the first redacted console error, never tokens or complete pairing URLs.
+**Plugin 0.6.13** retains the 0.6.12 compatibility layer and startup feedback, distinguishes Gateway receive timeouts from oversized headers, and adds packed text/image prompt-failure checks. It does not transpile or modify DSH, and it does not automatically replay messages; acceptance on the physical Huawei Chromium 92 App remains unverified. Reports should include DSH/plugin/App and WebView versions, entry mode and the first redacted console error, never tokens or complete pairing URLs.
 
 > **Community client (unofficial)**: [WeChat Mini-Program client](https://github.com/StrawberryAO/dsh-mobile-minapp)
 > A native WeChat Mini-Program that reuses the Mobile Access pairing and Remote stream protocol (requires dsh-mobile ≥ 0.3.8).
@@ -408,6 +408,7 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 | --- | --- |
 | `0.6.11` | Isolated packed-browser CI on `0.1.7-alpha.2`, `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.2` and `0.2.1-alpha.3`; additional real history-pagination, viewport-preservation and manual-loading checks on `0.2.0-rc.2` and `0.2.1-alpha.3`. Browser checks do not establish acceptance of every phone engine, third-party plugin or public route |
 | `0.6.12` | Packed installation, mobile boot, missing-API simulation, Workspace streaming, retained-page transport recovery and mobile settings on `0.2.1-rc.2`; authentication/resource regression with the actual community `dsh-web-startup-auth@0.1.12` on `0.2.0-rc.2`. This does not establish physical Chromium 92, arbitrary auth-plugin or public-route acceptance |
+| `0.6.13` | Packed text/image HTTP 400 recovery, Host refusal guard and error-feedback checks on `0.2.0-rc.2` and `0.2.1-rc.2`; Gateway 408/431 classification, bounded diagnostics and four Gateway factory wiring passed local tests. DSH source, iroh P2P and Android native code are outside this release |
 
 <details>
 <summary>Historical version checks</summary>

package/README.md

@@ -26,13 +26,13 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.12">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.13">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **当前正式版本：0.6.12**。修复社区认证插件下的页面 502、共享代理下的配对与续期限流问题，并补充旧内核 API 和启动失败提示。Android App **0.6.5** 保持不变，无需同步升级。[更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.12) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.6.13**。区分网关 HTTP 接收超时与请求头过大错误，增加隐私受限的拒绝诊断，并补充图文发送失败回归。Android App **0.6.5** 保持不变，无需同步升级。[更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.13) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
@@ -340,7 +340,7 @@ Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏
 
 **旧内核限制**：API 兼容实现不能修复内核无法解析的 JavaScript 语法。DSH **0.2.1-rc.2** 的正式前端包含 class static blocks，Chromium **92** 无法解析；该语法从 Chrome 94 默认可用，但这不代表 94 已通过整个 DSH 的兼容验收。[V8 说明](https://v8.dev/blog/v8-release-94)。App 的“内核低于 100”提醒只是建议，点击继续不代表当前 DSH 可以运行。若系统 WebView 无法更新，可使用已确认正常的手机浏览器访问电脑端提供的移动地址，无需清除原有 App 配对。
 
-插件 **0.6.12** 补齐已识别的数组、字符串、对象和结构化克隆 API，并在 DSH 尚未显示时提供启动失败说明、“重新载入页面”和“继续等待”。它不转译 DSH，也不自动刷新页面；华为 Chromium 92 的实际 App 尚未完成验收。反馈问题时请提供 DSH／插件／App 与 WebView 版本、进入方式和脱敏后的首个控制台错误，不要发送令牌或完整配对地址。
+插件 **0.6.13** 在保留 0.6.12 兼容层和启动反馈的基础上，区分网关接收超时与请求头过大，并增加图文发送失败的打包回归。它不转译 DSH、不修改 DSH 源码，也不自动重发消息；华为 Chromium 92 的实际 App 尚未完成验收。反馈问题时请提供 DSH／插件／App 与 WebView 版本、进入方式和脱敏后的首个控制台错误，不要发送令牌或完整配对地址。
 
 > **社区客户端（非官方）**：[微信小程序客户端](https://github.com/StrawberryAO/dsh-mobile-minapp)
 > 原生微信小程序实现，复用「移动访问」的配对与 Remote 流协议（需 dsh-mobile ≥ 0.3.8）。
@@ -409,6 +409,7 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 | --- | --- |
 | `0.6.11` | `0.1.7-alpha.2`、`0.1.7-rc.1`、`0.1.7-rc.2`、`0.2.0-rc.1`、`0.2.0-rc.2`、`0.2.1-alpha.2`、`0.2.1-alpha.3` 的隔离打包浏览器 CI；`0.2.0-rc.2` 与 `0.2.1-alpha.3` 另通过真实历史分页、滚动位置保持和手动加载检查。浏览器检查不代表所有手机内核、第三方插件或公网线路已验收 |
 | `0.6.12` | `0.2.1-rc.2` 的打包安装、移动启动、缺失 API 模拟、工作区实时读取、保留页面的断线恢复及移动设置；`0.2.0-rc.2` 搭配实际社区认证插件 `dsh-web-startup-auth@0.1.12` 的认证与资源回归。未将 Chromium 92 真机、任意认证插件或公网线路写成已验收 |
+| `0.6.13` | `0.2.0-rc.2`、`0.2.1-rc.2` 的打包图文 HTTP 400 恢复、Host 拒绝护栏与错误提示回归；网关 408/431 分类、三类受限诊断及四种 Gateway 工厂接线通过本地测试。DSH 源码、iroh P2P 和 Android 原生代码不在本版范围 |
 
 <details>
 <summary>历史版本验证记录</summary>

package/SECURITY.md

@@ -50,6 +50,7 @@ The maintainer will acknowledge a complete report within seven days. Publication
 - The Funnel node stores its Tailscale login state under `$DSH_HOME/mobile-access/remote/tailscale/`. The plugin does not request or store a Tailscale password, Auth Key, or OAuth secret.
 - The proxy-assisted remote diagnostic probes only the public `/mobile-access/health` path. It tries direct HTTPS first and, only after direct failure, may use an HTTP CONNECT proxy named by the DSH process environment unless `NO_PROXY` excludes the target. The probe sends no device token or session Cookie; configured proxy credentials are sent to that proxy for CONNECT, not placed in the diagnostic report. A proxy-only success is a warning to test from the phone, not proof that the phone or the provider route is available. This diagnostic does not change the remote provider's traffic path.
 - Plugin 0.6.11 and later record limited HTTP authorization and CSRF rejection metadata. It omits credential values and query strings, categorizes arbitrary paths, normalizes Origin and admits only recognized fetch-site values. Each Gateway keeps two fixed diagnostic categories with 30-second repeat aggregation, not an unbounded per-client/path history. Diagnostic-callback failures do not change the rejection response. These records are not complete WebSocket or native-pairing traces, and absence of a record does not establish successful authentication. Review even bounded metadata before sharing logs.
+- The unreleased HTTP-diagnostic change adds three fixed per-Gateway categories: parser rejection, invalid target, and an authenticated exact `POST /api/session/prompt` rejected by the upstream. Each has 30-second sampling with suppressed counts. Parser codes are allowlisted; raw packets, headers, request bodies, error messages, arbitrary URLs and query strings are excluded. A diagnostic failure cannot change the response or retry a write. Request timeout and header overflow remain rejected, using 408 and 431 rather than a generic 400; receive limits are not relaxed.
 - cpolar is downloaded only after confirmation from a pinned official artifact whose size and SHA-256 are verified. Its Authtoken is stored in a private, self-update-disabled configuration under `$DSH_HOME/mobile-access/`, never returned by the admin API or written to logs. Component removal deletes its managed executable, Authtoken configuration, logs and staging files, but retains LAN and shared remote pairing records.
 - Self-hosted FRP accepts a VPS address, frps control port, operator-generated high-entropy shared token, and standard-port public HTTPS origin. The 0.4.6 self-signed entry additionally selects a non-reserved public TCP port on a globally routable IPv4 address. The plugin validates token length and format; the operator remains responsible for its entropy. Managed deployment creates one HTTP vhost and Caddy; existing-frps attachment changes no VPS files or services and allows either a restricted HTTP vhost with a public CA or one TCP passthrough to a computer-side HTTPS gateway. Arbitrary FRP configuration, general TCP/UDP forwarding, FRP plugins, PATH entries, and startup tasks are not supported.
 - For an HTTP-vhost entry, the generated managed-frps template binds the plaintext listener to `127.0.0.1` and uses Caddy for public HTTPS. An existing frps must have its actual `vhostHTTPPort` entered explicitly and its plaintext vhost kept off the public network; the plugin probes the configured port before starting `frpc`. frps `proxyBindAddr` governs proxy listeners globally: exposing a TCP passthrough on the same instance must not accidentally expose another plaintext vhost. A separate frps instance may be required. For self-signed ingress, the computer-side CA lasts five years and the leaf lasts 397 days; the leaf is renewed under the same CA, but an expired or replaced CA is not silently trusted and requires fresh pairing. A local readiness probe does not establish phone reachability; verify the public entry from an independent network.

package/docs/SLOW_CONNECTIONS.en.md

@@ -20,6 +20,14 @@ Both [#126](https://github.com/saya-ch/dsh-mobile/issues/126) and [#146](https:/
 
 Plugin 0.6.11 and later write limited `auth failure` HTTP diagnostics to the plugin log (`$DSH_HOME/mobile-access/logs/dsh-mobile.log`): authorization versus CSRF rejection, status, method, a safe route or route category, related Cookie/header presence and counts, normalized Origin and recognized fetch-site values. It omits tokens, Cookie values, query strings and arbitrary original paths. Each Gateway rate-limits its two categories separately: the first event is immediate and same-category rejections aggregate within a 30-second window; `suppressed` counts previously suppressed records of that category, not all requests or only the current path. This helps investigate missing credentials and CSRF failures; it does not automatically repair a 401/403. The absence of a record does not establish successful authentication: earlier Host/Origin rejections, WebSocket upgrades and native pairing/renewal are outside these two recording points. Review logs before sharing them.
 
+## HTTP 400, 408 and 431 (in development)
+
+The unpublished plugin correction distinguishes request receive timeouts as `408 request_timeout` and oversized headers as `431 headers_too_large`; other malformed HTTP requests remain `400 bad_request`. Older versions may return 400 with the same short JSON for all of them, so a status and a 24-byte body do not identify the cause.
+
+New `http failure` diagnostics distinguish three per-Gateway categories: `parser` for HTTP parsing/receive failures, `target` for invalid request targets, and `upstream` for an authenticated `POST /api/session/prompt` rejected upstream. The first event of each kind is immediate; repeats aggregate for 30 seconds, with `suppressed` counting earlier suppressed events of that kind. Logs exclude raw errors, request bodies, raw packets, Cookies, Tokens, queries and arbitrary URLs. No record does not establish success.
+
+`upstreamTimeoutMs` governs upstream transport waits and also configures the complete inbound-request receive deadline. A continuously active upload can still exceed that total deadline, and Node's periodic checks affect the observed firing time. Do not delete pairings, clear App data or automatically resend because of HTTP 400 alone. Identify the rejection layer using the actual response body, Content-Type, exact versions and redacted proxy upstream status. Check the Session result before retrying an operation whose execution outcome is unknown.
+
 ## Keep event streams distinct
 
 In DSH 0.2.0-rc.2, `/plugins/events` is the SSE stream for plugin-module graph and build updates, not conversation-message delivery. Its `200` response, small body or repeated reconnects alone cannot establish successful delivery, failure or a missing processing animation. Inspect the `/api/remote.mux` WebSocket and the actual HTTP request for that operation as well.

package/docs/SLOW_CONNECTIONS.md

@@ -20,6 +20,14 @@
 
 插件 0.6.11 起会在插件日志（`$DSH_HOME/mobile-access/logs/dsh-mobile.log`）记录有限的 `auth failure` HTTP 诊断：区分授权与 CSRF 拒绝，包含状态、方法、安全路径或路径类别、相关 Cookie／请求头是否存在及计数、规范化 Origin 和受支持的 fetch-site 值，不记录令牌、Cookie 值、查询参数或任意原始路径。每个网关的两类诊断分别限频，首条立即记录，30 秒窗口内同类拒绝聚合；`suppressed` 表示此前被抑制的同类记录数量，不是全部请求数，也不限定于当前路径。它帮助排查凭据未携带或 CSRF 校验失败，不会自动修复 401／403。没有日志也不代表认证成功：更早的 Host／Origin 拒绝、WebSocket 升级和原生配对／续期不在这两处记录范围内。分享前仍应检查日志。
 
+## HTTP 400、408 与 431 的区别（开发中）
+
+尚未发布的插件修正会把请求接收超时区分为 `408 request_timeout`，请求头过大区分为 `431 headers_too_large`；其他非法 HTTP 请求仍为 `400 bad_request`。旧版可能把这几类情况都返回成 400 和相同的短 JSON，因此状态码与“24 字节”不足以定位原因。
+
+新的 `http failure` 日志按网关区分 `parser`、`target`、`upstream` 三类：分别表示 HTTP 解析／接收失败、非法请求目标、已认证的 `POST /api/session/prompt` 被上游拒绝。每类首条立即记录，后续 30 秒内聚合，下一条的 `suppressed` 是此前被抑制的同类数量。日志不保留原始报错、请求正文、原始包、Cookie、Token、查询参数或任意 URL；不记录某条也不能证明它成功。
+
+`upstreamTimeoutMs` 既用于上游传输等待，也配置了入站完整请求的接收期限；持续上传不保证避开这个总期限，Node 的定期检查会影响实际触发时刻。不要仅凭 HTTP 400 就删除配对、清空 App 数据或自动重发。先区分拒绝来源，并查看实际响应正文、Content-Type、准确版本和脱敏的代理上游状态；消息或工具是否已执行不明时，先核对会话结果。
+
 ## 不同事件流不能混为一谈
 
 在 DSH 0.2.0-rc.2 中，`/plugins/events` 是插件模块图和构建更新的 SSE，不是对话消息投递通道。它返回 `200`、传输很少字节或反复重连，不能单独证明消息发送成功、失败或处理中动画丢失；同时检查 `/api/remote.mux` WebSocket 与那次操作实际发出的 HTTP 请求。

package/lib/index.d.mts

@@ -540,6 +540,33 @@ interface AuthFailureEntry {
   readonly suppressed?: number;
 }
 //#endregion
+//#region src/http-failure-log.d.ts
+/** Fixed parser details safe to record without Node's raw packet, message or request headers. */
+type HttpParserCode = 'ERR_HTTP_REQUEST_TIMEOUT' | 'HPE_HEADER_OVERFLOW' | 'HPE_INVALID_CHUNK_SIZE' | 'HPE_INVALID_CONTENT_LENGTH' | 'HPE_INVALID_EOF_STATE' | 'HPE_INVALID_HEADER_TOKEN' | 'HPE_INVALID_TRANSFER_ENCODING' | 'HPE_UNEXPECTED_CONTENT_LENGTH' | 'other';
+/** A rejected inbound HTTP message's public response and bounded diagnostic category. */
+interface HttpParserFailure {
+  readonly status: 400 | 408 | 431;
+  readonly code: 'bad_request' | 'request_timeout' | 'headers_too_large';
+  readonly parserCode: HttpParserCode;
+}
+/** One sampled rejection. Arbitrary paths, query strings, body data and credentials are excluded. */
+type HttpFailureEntry = ({
+  readonly kind: 'parser';
+  readonly status: HttpParserFailure['status'];
+  readonly code: HttpParserCode;
+} | {
+  readonly kind: 'target';
+  readonly status: 400;
+  readonly code: 'bad_request';
+} | {
+  readonly kind: 'upstream';
+  readonly status: number;
+  readonly method: 'POST';
+  readonly path: '/api/session/prompt';
+}) & {
+  readonly suppressed?: number;
+};
+//#endregion
 //#region src/http-security.d.ts
 export declare const DEVICE_COOKIE = "dsh_ma_device";
 export declare const SESSION_COOKIE = "dsh_ma_session";
@@ -1002,9 +1029,10 @@ export declare class MobileAccessGateway {
   private readonly clientModuleTasks;
   private readonly clientModuleRevocations;
   private readonly authFailures;
+  private readonly httpFailures;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */

package/lib/index.mjs

@@ -9,7 +9,7 @@ import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
-import { createServer as createServer$1, request } from "node:http";
+import { STATUS_CODES, createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2, request as request$1 } from "node:https";
 import { Readable, Transform, finished } from "node:stream";
 import { finished as finished$1, pipeline } from "node:stream/promises";
@@ -1968,7 +1968,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS = 3e4;
+const LOG_INTERVAL_MS$1 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2065,7 +2065,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.nextLogAt = now + LOG_INTERVAL_MS$1;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2082,6 +2082,129 @@ var AuthFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/http-failure-log.ts
+function safeParserCode(code) {
+	switch (code) {
+		case "ERR_HTTP_REQUEST_TIMEOUT":
+		case "HPE_HEADER_OVERFLOW":
+		case "HPE_INVALID_CHUNK_SIZE":
+		case "HPE_INVALID_CONTENT_LENGTH":
+		case "HPE_INVALID_EOF_STATE":
+		case "HPE_INVALID_HEADER_TOKEN":
+		case "HPE_INVALID_TRANSFER_ENCODING":
+		case "HPE_UNEXPECTED_CONTENT_LENGTH": return code;
+		default: return "other";
+	}
+}
+/**
+* Classify Node's HTTP rejection without reflecting an unrecognized error code.
+* @param nodeCode - The parser error's machine code, not its message or raw packet.
+* @returns The fixed public HTTP status/category and allowlisted diagnostic code.
+*/
+function classifyHttpParserFailure(nodeCode) {
+	const parserCode = safeParserCode(nodeCode);
+	if (parserCode === "ERR_HTTP_REQUEST_TIMEOUT") return {
+		status: 408,
+		code: "request_timeout",
+		parserCode
+	};
+	if (parserCode === "HPE_HEADER_OVERFLOW") return {
+		status: 431,
+		code: "headers_too_large",
+		parserCode
+	};
+	return {
+		status: 400,
+		code: "bad_request",
+		parserCode
+	};
+}
+const LOG_INTERVAL_MS = 3e4;
+/**
+* Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
+* Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
+* A sink failure cannot change a response, retry a write or expose the diagnostic sink's error.
+*/
+var HttpFailureRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	windows = {
+		parser: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		target: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		upstream: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access HTTP diagnostics could not be recorded", { code: "DSH_MOBILE_HTTP_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Classify an inbound parser rejection and sample only its fixed status and safe code. */
+	recordParser(nodeCode) {
+		const failure = classifyHttpParserFailure(nodeCode);
+		this.record({
+			kind: "parser",
+			status: failure.status,
+			code: failure.parserCode
+		});
+		return failure;
+	}
+	/** Sample an invalid request target without retaining its raw or decoded URL. */
+	recordTarget() {
+		this.record({
+			kind: "target",
+			status: 400,
+			code: "bad_request"
+		});
+	}
+	/** Sample only authenticated prompt rejections; the caller must authorize before forwarding. */
+	recordUpstream(method, pathname, status) {
+		if (method !== "POST" || pathname !== "/api/session/prompt" || !Number.isInteger(status) || status < 400 || status > 599) return;
+		this.record({
+			kind: "upstream",
+			status,
+			method: "POST",
+			path: "/api/session/prompt"
+		});
+	}
+	record(entry) {
+		if (this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[entry.kind];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				...entry,
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
@@ -5052,7 +5175,7 @@ function rejectUpgrade(socket, status, code) {
 	if (socket.destroyed) return;
 	const body = `${JSON.stringify({ error: code })}\n`;
 	socket.end([
-		`HTTP/1.1 ${String(status)} ${status === 401 ? "Unauthorized" : status === 403 ? "Forbidden" : "Bad Request"}`,
+		`HTTP/1.1 ${String(status)} ${STATUS_CODES[status] ?? "Bad Request"}`,
 		"Connection: close",
 		"Cache-Control: no-store",
 		"Content-Type: application/json; charset=utf-8",
@@ -5423,7 +5546,8 @@ var MobileAccessGateway = class {
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog) {
+	httpFailures;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5431,6 +5555,7 @@ var MobileAccessGateway = class {
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
+		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5527,8 +5652,10 @@ var MobileAccessGateway = class {
 					rejectUpgrade(client, mapped.status, mapped.code);
 				});
 			});
-			server.on("clientError", (_error, socket) => {
-				rejectUpgrade(socket, 400, "bad_request");
+			server.on("clientError", (error, socket) => {
+				const nodeCode = "code" in error && typeof error.code === "string" ? error.code : void 0;
+				const failure = this.httpFailures.recordParser(nodeCode);
+				rejectUpgrade(socket, failure.status, failure.code);
 			});
 			await new Promise((resolve, reject) => {
 				const failed = (error) => {
@@ -5932,7 +6059,13 @@ var MobileAccessGateway = class {
 		sendJson(response, 200, { loggedOut: true }, this.tlsEnabled);
 	}
 	async handleExternalRequest(request, response) {
-		const target = parseRequestTarget(request.url);
+		let target;
+		try {
+			target = parseRequestTarget(request.url);
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 400) this.httpFailures.recordTarget();
+			throw error;
+		}
 		const policy = this.requirePolicy();
 		const isMutation = request.method !== "GET" && request.method !== "HEAD";
 		assertExternalTrust(request, policy, isMutation);
@@ -7093,6 +7226,7 @@ var MobileAccessGateway = class {
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
 			const statusCode = proxied.statusCode ?? 502;
+			this.httpFailures.recordUpstream(request$2.method, request$2.url?.split("?", 1)[0] ?? "", statusCode);
 			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
 			const compressible = canCompressResponse(request$2, proxied);
@@ -17601,6 +17735,8 @@ async function apply(ctx, config) {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
 		}, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -17659,6 +17795,8 @@ async function apply(ctx, config) {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -17675,7 +17813,11 @@ async function apply(ctx, config) {
 		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
 		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), void 0, stateDirectory);
 		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -17686,7 +17828,11 @@ async function apply(ctx, config) {
 	};
 	const createOriginGateway = async (settings) => {
 		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, remoteInstanceId, settings.listenPort, instanceId);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {