dsh-mobile 0.6.16 → 0.6.17

package/lib/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32 } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
@@ -1973,7 +1973,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS$2 = 3e4;
+const LOG_INTERVAL_MS$3 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2070,7 +2070,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$2;
+		window.nextLogAt = now + LOG_INTERVAL_MS$3;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2124,7 +2124,7 @@ function classifyHttpParserFailure(nodeCode) {
 		parserCode
 	};
 }
-const LOG_INTERVAL_MS$1 = 3e4;
+const LOG_INTERVAL_MS$2 = 3e4;
 /**
 * Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
@@ -2193,7 +2193,7 @@ var HttpFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$1;
+		window.nextLogAt = now + LOG_INTERVAL_MS$2;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2210,6 +2210,114 @@ var HttpFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/api-latency-log.ts
+/**
+* Bounded API latency samples for diagnosing slow mobile requests.
+*
+* A sample never carries a query string, request body, header or credential.
+* The path collapses to its first `/api/` segment, so the recorded key set is
+* limited to fixed route categories rather than session or turn identifiers, and the
+* same report stays comparable across devices and releases.
+*/
+/** Only methods with a fixed spelling are recorded; anything else collapses. */
+const BOUNDED_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** Requests below this budget are ordinary traffic and stay out of the log. */
+const API_LATENCY_MIN_MS = 3e3;
+const LOG_INTERVAL_MS$1 = 3e4;
+const ROUTE_SEGMENTS = Object.freeze([
+	"session",
+	"sessions",
+	"workspace",
+	"workspaces",
+	"settings",
+	"llm",
+	"remote",
+	"mobile-access",
+	"plugins",
+	"plugin-manager",
+	"interactions",
+	"credentials",
+	"auth"
+]);
+/**
+* Reduce a request target to a bounded diagnostic route.
+* @param url - The raw request target; its query string is ignored entirely.
+* @returns `/api/<category>` for a fixed category, `/api/other` for an
+*   unrecognized one, or `undefined` when the target is not an API request.
+*/
+function boundedApiPath(url) {
+	const pathname = url?.split("?", 1)[0] ?? "";
+	if (!pathname.startsWith("/api/")) return void 0;
+	const category = (pathname.slice(5).split("/", 1)[0] ?? "").toLowerCase();
+	return ROUTE_SEGMENTS.includes(category) ? `/api/${category}` : "/api/other";
+}
+/**
+* Per-Gateway slow-request diagnostics.
+*
+* Records once immediately, then at most once per 30 seconds with a suppressed
+* count, mirroring the HTTP failure recorder. A sink failure cannot change a
+* response, retry a write or expose the diagnostic sink's error.
+*/
+var ApiLatencyRecorder = class {
+	observe;
+	now;
+	minDurationMs;
+	reportObserverFailure;
+	nextLogAt = 0;
+	suppressed = 0;
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), minDurationMs = API_LATENCY_MIN_MS, reportObserverFailure = () => {
+		process.emitWarning("Mobile access latency diagnostics could not be recorded", { code: "DSH_MOBILE_LATENCY_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.minDurationMs = minDurationMs;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/**
+	* Record one completed request when it exceeded the reporting budget.
+	* @param sample - The bounded route, method, status and measured duration.
+	*/
+	record(sample) {
+		if (this.observe === void 0) return;
+		if (!Number.isFinite(sample.durationMs) || sample.durationMs < this.minDurationMs) return;
+		const now = this.now();
+		if (now < this.nextLogAt) {
+			this.suppressed = Math.min(Number.MAX_SAFE_INTEGER, this.suppressed + 1);
+			return;
+		}
+		const suppressed = this.suppressed;
+		this.nextLogAt = now + LOG_INTERVAL_MS$1;
+		this.suppressed = 0;
+		const method = sample.method?.toUpperCase() ?? "";
+		const status = Number.isInteger(sample.status) && sample.status >= 100 && sample.status <= 599 ? sample.status : 0;
+		const entry = {
+			kind: "api",
+			method: BOUNDED_METHODS.has(method) ? method : "OTHER",
+			path: sample.path,
+			status,
+			durationMs: Math.round(sample.durationMs),
+			...suppressed === 0 ? {} : { suppressed }
+		};
+		try {
+			this.observe(entry);
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/upstream-auth-log.ts
 const LOG_INTERVAL_MS = 3e4;
 /** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
@@ -2928,6 +3036,81 @@ async function listComputerImages(path, signal) {
 		truncated
 	});
 }
+/**
+* Resolve a workspace path without a relative or current-drive fallback.
+*
+* @param path - Fully qualified directory, or null/empty for the Host home.
+* @param platform - Host path syntax; explicit for cross-platform parser tests.
+* @returns The normalized fully qualified path in the selected syntax.
+*/
+function resolveWorkspaceDirectoryPath(path, platform = process.platform) {
+	if (path === null || path === "") return homedir();
+	const paths = platform === "win32" ? win32 : posix;
+	const qualified = platform !== "win32" || /^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/]+[^\\/]+(?:[\\/]|$))/u.test(path) && !/^[\\/]{2}[?.][\\/]/u.test(path);
+	if (path.includes("\0") || !paths.isAbsolute(path) || !qualified) throw new HttpError(400, "bad_path");
+	return paths.resolve(path);
+}
+/**
+* List folders only for the dedicated mobile workspace picker.
+*
+* Returns at most 500 enterable folders, including directory links. A truncated
+* level retains its first filesystem-enumerated rows; callers can enter an
+* absolute path to reach an omitted row. Cancellation preserves its reason;
+* pending filesystem operations and handle closure settle before this request
+* releases its Gateway work slot.
+*/
+async function listWorkspaceDirectories(path, signal) {
+	signal?.throwIfAborted();
+	const target = resolveWorkspaceDirectoryPath(path);
+	const rows = [];
+	let truncated = false;
+	let directory;
+	try {
+		directory = await opendir(target);
+		for (;;) {
+			signal?.throwIfAborted();
+			const entry = await directory.read();
+			signal?.throwIfAborted();
+			if (entry === null) break;
+			const entryPath = resolve(target, entry.name);
+			let enterable = entry.isDirectory();
+			if (!enterable && entry.isSymbolicLink()) try {
+				enterable = (await stat(entryPath)).isDirectory();
+				signal?.throwIfAborted();
+			} catch {
+				signal?.throwIfAborted();
+				continue;
+			}
+			if (!enterable) continue;
+			if (rows.length === MAX_ENTRIES) {
+				truncated = true;
+				break;
+			}
+			rows.push({
+				name: entry.name,
+				path: entryPath
+			});
+		}
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		throw new HttpError(404, "directory_unavailable");
+	} finally {
+		try {
+			await directory?.close();
+		} catch {
+			throw new HttpError(500, "directory_cleanup_failed");
+		}
+	}
+	signal?.throwIfAborted();
+	rows.sort((left, right) => left.name.localeCompare(right.name));
+	const parent = dirname(target);
+	return Object.freeze({
+		path: target,
+		...parent === target ? {} : { parent },
+		entries: Object.freeze(rows),
+		truncated
+	});
+}
 /** Read one bounded regular image file selected by an authenticated device. */
 async function readComputerImage(path, signal) {
 	signal?.throwIfAborted();
@@ -4945,21 +5128,43 @@ const MOBILE_DOCUMENT_VIEW_HEADER = "x-dsh-mobile-view";
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
 /**
-* Per-merged-batch byte budget. One upstream application batch can carry dozens
-* of client bundles whose combined size exceeds the hard batch cap; the layout
-* batch is therefore chunked into multiple merged batches, each kept safely
-* below {@link MAX_MOBILE_BOOT_BATCH_BYTES} so assembly can never reject it.
+* Target source-byte size for merged batches. A module larger than this target
+* remains whole, subject to the separate per-entry and assembly limits. Excess
+* merged batches use the original individual module URLs instead of rejecting
+* an otherwise loadable graph. Smaller responses do not guarantee a page-load
+* deadline: transfer time also depends on the complete graph and connection.
 */
-const MOBILE_BOOT_CHUNK_BYTES = 16777216;
+const MOBILE_BOOT_CHUNK_BYTES = 3145728;
+/** Bodies below this size cost more to gzip than they save on the wire. */
+const MIN_COMPRESSIBLE_DOCUMENT_BYTES = 1024;
 /** Bytes the assembly emits after each entry (`body` plus `\n;\n`). */
 const MOBILE_BOOT_SEPARATOR_BYTES = 3;
 /** Freshness window for cached upstream bundle byte sizes. */
+/** Catalog sizes change only on a plugin rebuild or host restart. */
+const CLIENT_MODULE_SIZE_TTL_MS = 6e5;
+/** Explicit metadata measurement is optional and must fit one short UI operation. */
+const CLIENT_MODULE_MEASUREMENT_BUDGET_MS = 5e3;
 const MOBILE_BOOT_SIZE_CACHE_TTL_MS = 3e4;
 /** Marker header distinguishing size probes from ordinary proxied bundle fetches. */
 const MOBILE_BOOT_SIZE_PROBE_HEADER = "x-dsh-mobile-size-probe";
-const MAX_MOBILE_BOOT_BATCHES = 8;
+const MAX_MOBILE_BOOT_BATCHES = 16;
 const MOBILE_BOOT_UPSTREAM_ATTEMPTS = 4;
 const MOBILE_BOOT_RETRY_DELAY_MS = 150;
+/**
+* Sanitize an installed package's description for the settings panel.
+*
+* The text comes from the plugin's own package metadata, not from an upstream
+* certification, so URLs are dropped and control characters collapse; the panel
+* keeps the wording as published instead of translating or editorializing it.
+* @param value - The package.json `description` field, possibly absent.
+* @returns A single-line description, or `undefined` when nothing usable remains.
+*/
+function sanitizeModuleDescription(value) {
+	if (typeof value !== "string") return void 0;
+	const text = value.replace(/[\u0000-\u001f\u007f]+/gu, " ").replace(/https?:\/\/\S+/giu, " ").replace(/\s+/gu, " ").trim();
+	if (text === "") return void 0;
+	return text.length <= 200 ? text : `${text.slice(0, 197)}…`;
+}
 function upstreamPluginBundleUrl(source, upstreamOrigin) {
 	if (!source.startsWith("/plugins/") && !source.startsWith("plugins/") || source.includes("#")) return void 0;
 	try {
@@ -5320,6 +5525,41 @@ function splitMobileBootBatch(entries, sizes, passThrough) {
 		rows
 	};
 }
+/**
+* Retain the layout replacement while bounding the graph's stored merged batches.
+* @param splits - Application batches already partitioned against the byte target.
+* @returns The same module coverage, with overflow served by valid upstream URLs.
+*/
+function limitMobileBootBatches(splits) {
+	const layoutPlan = splits.flatMap((split) => split.plans).find((plan) => plan.entries.some((entry) => entry.id === MOBILE_LAYOUT_MODULE));
+	let remaining = MAX_MOBILE_BOOT_BATCHES - (layoutPlan === void 0 ? 0 : 1);
+	const upstreamOrigin = new URL("http://dsh-mobile.invalid");
+	return splits.map((split) => {
+		const byPath = new Map(split.plans.map((plan) => [plan.path, plan]));
+		const plans = [];
+		return {
+			plans,
+			rows: split.rows.flatMap((row) => {
+				const plan = byPath.get(row.url);
+				if (plan === void 0) return [row];
+				if (plan === layoutPlan || remaining > 0) {
+					if (plan !== layoutPlan) remaining -= 1;
+					plans.push(plan);
+					return [row];
+				}
+				return plan.entries.map((entry) => {
+					if (upstreamPluginBundleUrl(entry.url, upstreamOrigin) === void 0) throw new Error("upstream DSH mobile boot has no valid module URL for an overflow batch");
+					return {
+						phase: "application",
+						url: entry.url,
+						rev: entry.rev,
+						entries: [entry.id]
+					};
+				});
+			})
+		};
+	});
+}
 function escapeMobilePreloadAttribute(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
@@ -5356,11 +5596,11 @@ function projectMobileBootGraph(plan, options) {
 	let batches = [];
 	let preloadReplacements = /* @__PURE__ */ new Map();
 	if (plan.batches !== void 0 && plan.rewrittenBatchEntries !== void 0) {
-		const rewrites = plan.rewrittenBatchEntries.map(({ batch, entries }) => ({
+		const splits = limitMobileBootBatches(plan.rewrittenBatchEntries.map(({ entries }) => splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())));
+		const rewrites = plan.rewrittenBatchEntries.map(({ batch }, index) => ({
 			batch,
-			split: splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())
+			split: splits[index]
 		}));
-		if (rewrites.reduce((count, item) => count + item.split.plans.length, 0) > MAX_MOBILE_BOOT_BATCHES) throw new Error(`upstream DSH mobile boot requires more than ${String(MAX_MOBILE_BOOT_BATCHES)} merged batches`);
 		for (const { batch, split } of rewrites) {
 			const at = plan.batches.indexOf(batch);
 			if (at < 0) throw new Error("upstream DSH boot manifest lost an application batch");
@@ -5576,9 +5816,29 @@ function isCompressibleContentType(value) {
 	const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
 	return mediaType.startsWith("text/") || /^(?:application\/(?:javascript|json|xml|x-javascript)|image\/svg\+xml)$/u.test(mediaType);
 }
+/** Media types the client must receive frame by frame, without gzip blocking. */
+const INCREMENTAL_MEDIA_TYPES = /* @__PURE__ */ new Set(["text/event-stream"]);
+/** Bodies below this size cost more to gzip than they save on the wire. */
+const MIN_COMPRESSIBLE_BYTES = 1024;
+function responseMediaType(value) {
+	return (Array.isArray(value) ? value[0] : value)?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+/** Static asset paths keep their existing compression contract unchanged. */
+function isStaticAssetPath(url) {
+	const pathname = url?.split("?", 1)[0] ?? "";
+	return pathname.startsWith("/plugins/") || pathname.startsWith("/assets/");
+}
 function canCompressResponse(request, response) {
-	const pathname = request.url?.split("?", 1)[0] ?? "";
-	return (request.method === "GET" || request.method === "HEAD") && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && isCompressibleContentType(response.headers["content-type"]);
+	if (!(request.method === "GET" || request.method === "HEAD")) return false;
+	if (response.statusCode !== 200) return false;
+	if (request.headers.range !== void 0) return false;
+	if (response.headers["content-range"] !== void 0) return false;
+	if (response.headers["content-encoding"] !== void 0) return false;
+	if (!isCompressibleContentType(response.headers["content-type"])) return false;
+	if (isStaticAssetPath(request.url)) return true;
+	if (INCREMENTAL_MEDIA_TYPES.has(responseMediaType(response.headers["content-type"]))) return false;
+	const declaredLength = Number(response.headers["content-length"]);
+	return Number.isFinite(declaredLength) && declaredLength >= MIN_COMPRESSIBLE_BYTES;
 }
 function revisionedStaticCacheControl(request, statusCode) {
 	if (request.method !== "GET" && request.method !== "HEAD") return void 0;
@@ -5813,6 +6073,7 @@ var MobileAccessGateway = class {
 	mobileBootBatches = /* @__PURE__ */ new Map();
 	mobileDocumentViews = /* @__PURE__ */ new Map();
 	mobileGraphTasks = /* @__PURE__ */ new Set();
+	workspaceDirectoryTasks = /* @__PURE__ */ new Set();
 	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
 	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
@@ -5840,13 +6101,18 @@ var MobileAccessGateway = class {
 	probeDeviceLimiter;
 	probeInFlight = /* @__PURE__ */ new Set();
 	clientModulePreferences;
+	clientModuleSizeCache = /* @__PURE__ */ new Map();
+	clientModuleDescriptionCache = /* @__PURE__ */ new Map();
+	clientModuleMetadataRevision;
+	clientModuleMeasurementActive = false;
 	clientModuleOperations = /* @__PURE__ */ new Set();
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
 	httpFailures;
+	apiLatency;
 	upstreamAuthDiagnostics;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog, apiLatencyLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5855,6 +6121,7 @@ var MobileAccessGateway = class {
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
+		this.apiLatency = new ApiLatencyRecorder(apiLatencyLog);
 		this.upstreamAuthDiagnostics = new UpstreamAuthRecorder(upstreamAuthLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
@@ -6468,6 +6735,7 @@ var MobileAccessGateway = class {
 		}
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
+		const workspaceDirectories = request.method === "GET" && target.decodedPathname === `/mobile-access/workspace-directories`;
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
@@ -6488,7 +6756,7 @@ var MobileAccessGateway = class {
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
 		} : void 0 : void 0;
-		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !workspaceDirectories && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (![
 			"GET",
 			"HEAD",
@@ -6542,6 +6810,7 @@ var MobileAccessGateway = class {
 					const keys = Object.keys(body);
 					if (keys.length !== 1) throw new HttpError(400, "bad_request");
 					if (keys[0] === "reset" && body.reset === true) kind = "reset";
+					else if (keys[0] === "measure" && body.measure === true) kind = "measure";
 					else if (keys[0] === "excludedClientModules") {
 						kind = "configure";
 						excluded = body.excludedClientModules;
@@ -6588,16 +6857,17 @@ var MobileAccessGateway = class {
 					body = Buffer.from(customAsset.fallback);
 				}
 				if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
+				operation.signal.throwIfAborted();
 				const etag = `"${createHash("sha256").update(body).digest("hex")}"`;
 				const responseHeaders = { ETag: etag };
 				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.setHeader("Cache-Control", "private, no-cache");
 				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
-					setSecurityHeaders(response, this.tlsEnabled);
 					response.writeHead(304, responseHeaders);
 					response.end();
 					return;
 				}
-				setSecurityHeaders(response, this.tlsEnabled);
 				response.writeHead(200, {
 					...responseHeaders,
 					"Content-Type": customAsset.contentType,
@@ -6620,6 +6890,41 @@ var MobileAccessGateway = class {
 				operation.release();
 			}
 		}
+		if (workspaceDirectories) {
+			const operation = this.allocateRequest(authorization, response, {});
+			const onClose = () => {
+				operation.abort();
+			};
+			response.once("close", onClose);
+			const task = (async () => {
+				try {
+					const query = new URL(target.raw, this.address().origin).searchParams;
+					const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
+					operation.signal.throwIfAborted();
+					sendJson(response, 200, listing, this.tlsEnabled);
+				} catch (error) {
+					if (operation.signal.aborted && error === operation.signal.reason) return;
+					throw error;
+				} finally {
+					response.removeListener("close", onClose);
+					operation.release();
+				}
+			})();
+			const completion = task.then(() => ({
+				status: "fulfilled",
+				value: void 0
+			}), (reason) => ({
+				status: "rejected",
+				reason
+			}));
+			this.workspaceDirectoryTasks.add(completion);
+			try {
+				await task;
+			} finally {
+				this.workspaceDirectoryTasks.delete(completion);
+			}
+			return;
+		}
 		if (computerImage) {
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
@@ -6967,6 +7272,14 @@ var MobileAccessGateway = class {
 	describeClientModules(deviceId, callerSignal) {
 		return this.clientModulePreferenceOperation("describe", void 0, deviceId, callerSignal);
 	}
+	/** Measure optional catalog metadata without changing saved module selections.
+	* @param deviceId - Authenticated device identity, or computer defaults when omitted.
+	* @param callerSignal - Cancels measurement and drains its admitted requests.
+	* @returns Current selections with the measurements completed within the budget.
+	*/
+	measureClientModules(deviceId, callerSignal) {
+		return this.clientModulePreferenceOperation("measure", void 0, deviceId, callerSignal);
+	}
 	/** Persist a validated device override or computer default.
 	* @param excluded - Untrusted module IDs to validate against the current boot graph.
 	* @param deviceId - Authenticated device identity; omitted for computer defaults.
@@ -6984,9 +7297,192 @@ var MobileAccessGateway = class {
 	resetClientModules(deviceId, callerSignal) {
 		return this.clientModulePreferenceOperation("reset", void 0, deviceId, callerSignal);
 	}
+	/** Return cached metadata only; catalog reads and saves never start bundle probes. */
+	describeMobileModulesWithSizes(html) {
+		const plan = parseMobileBootPlan(html);
+		if (this.clientModuleMetadataRevision !== plan.parsed.rev) {
+			this.clientModuleMetadataRevision = plan.parsed.rev;
+			this.clientModuleSizeCache.clear();
+			this.clientModuleDescriptionCache.clear();
+		}
+		const urls = new Map(plan.entries.map((entry) => [entry.id, entry.url]));
+		const now = Date.now();
+		return Object.freeze(describeMobileClientModules(html).map((entry) => {
+			const source = urls.get(entry.id);
+			const size = this.clientModuleSizeCache.get(source);
+			const description = this.clientModuleDescriptionCache.get(`${entry.id}\0${source}`);
+			return Object.freeze({
+				...entry,
+				...size === void 0 || now - size.at >= CLIENT_MODULE_SIZE_TTL_MS ? {} : {
+					bytes: size.bytes,
+					gzipBytes: size.gzipBytes
+				},
+				...description === void 0 || now - description.at >= CLIENT_MODULE_SIZE_TTL_MS ? {} : { description: description.description }
+			});
+		}));
+	}
+	/** Refresh metadata only after an explicit user action, with bounded concurrency. */
+	async measureMobileModules(html, signal) {
+		this.describeMobileModulesWithSizes(html);
+		const queue = [...parseMobileBootPlan(html).entries].sort((left, right) => Number(right.id === MOBILE_LAYOUT_MODULE) - Number(left.id === MOBILE_LAYOUT_MODULE));
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < queue.length) {
+				signal.throwIfAborted();
+				const entry = queue[cursor++];
+				await this.upstreamBundleMeasurement(entry.url, signal).catch((error) => {
+					if (signal.aborted) throw error;
+				});
+				signal.throwIfAborted();
+				await this.installedModuleDescription(entry.id, entry.url, signal);
+			}
+		};
+		await Promise.allSettled(Array.from({ length: Math.min(4, queue.length) }, worker));
+		signal.throwIfAborted();
+	}
+	/**
+	* Read the installed package description for one catalog module.
+	*
+	* This is best-effort package metadata lookup from the state directory's Node
+	* resolution context and this plugin's dependencies. Unexported or unavailable
+	* package metadata stays unknown; arbitrary paths and subpaths are not read.
+	*/
+	async installedModuleDescription(id, source, signal) {
+		if (!/^(?:@[a-z\d][a-z\d._-]*\/)?[a-z\d][a-z\d._-]*$/iu.test(id)) return;
+		const key = `${id}\0${source}`;
+		this.clientModuleDescriptionCache.delete(key);
+		const resolvers = [createRequire(join(dirname(this.config.stateFile), "package.json")), createRequire(import.meta.url)];
+		for (const resolver of resolvers) {
+			signal.throwIfAborted();
+			try {
+				const file = resolver.resolve(`${id}/package.json`);
+				const information = await stat(file);
+				if (!information.isFile() || information.size > 262144) continue;
+				const raw = await readFile(file, {
+					encoding: "utf8",
+					signal
+				});
+				const description = sanitizeModuleDescription(JSON.parse(raw).description);
+				signal.throwIfAborted();
+				if (description !== void 0) {
+					this.clientModuleDescriptionCache.set(key, {
+						at: Date.now(),
+						description
+					});
+					return;
+				}
+			} catch (error) {
+				if (signal.aborted) throw error;
+			}
+		}
+	}
+	/**
+	* Measure one upstream bundle's source and gzipped size.
+	*
+	* Measurements are cached for ten minutes: the settings panel is opened rarely
+	* and upstream bundle bytes only change on a plugin rebuild or host restart.
+	*/
+	async upstreamBundleMeasurement(source, signal) {
+		signal.throwIfAborted();
+		this.clientModuleSizeCache.delete(source);
+		if (source === MOBILE_LAYOUT_PATH) {
+			const information = await stat(this.config.mobileLayoutFile);
+			if (!information.isFile() || information.size > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+			const body = await readFile(this.config.mobileLayoutFile, { signal });
+			if (body.byteLength > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+			const gzipBytes = (await gzipBuffer(body)).byteLength;
+			signal.throwIfAborted();
+			this.clientModuleSizeCache.set(source, {
+				at: Date.now(),
+				bytes: body.byteLength,
+				gzipBytes
+			});
+			return {
+				bytes: body.byteLength,
+				gzipBytes
+			};
+		}
+		const target = upstreamPluginBundleUrl(source, this.config.upstreamOrigin);
+		if (target === void 0) return void 0;
+		let upstreamRequest;
+		let upstreamClosed;
+		const abort = () => {
+			upstreamRequest?.destroy(requestAbortedError());
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		try {
+			const upstreamCookie = await waitForRequestTask(this.upstreamCookieHeader(), signal);
+			signal.throwIfAborted();
+			const proxied = await new Promise((resolve, reject) => {
+				upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/javascript",
+						"accept-encoding": "identity",
+						[MOBILE_BOOT_SIZE_PROBE_HEADER]: "1",
+						...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+					},
+					agent: false
+				});
+				const opened = upstreamRequest;
+				upstreamClosed = new Promise((closed) => {
+					opened.once("close", () => {
+						closed();
+					});
+				});
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest?.destroy(upstreamTimeoutError());
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if (proxied.statusCode !== 200) {
+				proxied.resume();
+				return;
+			}
+			const chunks = [];
+			let bytes = 0;
+			for await (const chunk of proxied) {
+				signal.throwIfAborted();
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				bytes += buffer.byteLength;
+				if (bytes > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+				chunks.push(buffer);
+			}
+			const body = Buffer.concat(chunks);
+			const gzipBytes = (await gzipBuffer(body)).byteLength;
+			signal.throwIfAborted();
+			this.clientModuleSizeCache.set(source, {
+				at: Date.now(),
+				bytes: body.byteLength,
+				gzipBytes
+			});
+			return {
+				bytes: body.byteLength,
+				gzipBytes
+			};
+		} finally {
+			signal.removeEventListener("abort", abort);
+			upstreamRequest?.destroy();
+			await upstreamClosed;
+		}
+	}
 	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal) {
 		if (this.closing || !this.started) throw new HttpError(503, "unavailable");
+		if (kind === "measure" && this.clientModuleMeasurementActive) throw new HttpError(429, "busy");
+		if (kind === "measure") this.clientModuleMeasurementActive = true;
 		const controller = new AbortController();
+		let measurementExpired = false;
+		const measurementTimer = kind === "measure" ? setTimeout(() => {
+			measurementExpired = true;
+			controller.abort();
+		}, CLIENT_MODULE_MEASUREMENT_BUDGET_MS) : void 0;
 		const abort = () => controller.abort();
 		if (callerSignal?.aborted === true) controller.abort();
 		callerSignal?.addEventListener("abort", abort, { once: true });
@@ -7020,8 +7516,13 @@ var MobileAccessGateway = class {
 			controller.signal.throwIfAborted();
 			try {
 				const plan = parseMobileBootPlan(html);
+				if (kind === "measure") try {
+					await this.measureMobileModules(html, controller.signal);
+				} catch (error) {
+					if (!measurementExpired || callerSignal?.aborted === true || this.closing) throw error;
+				}
 				return Object.freeze({
-					entries: describeMobileClientModules(html),
+					entries: this.describeMobileModulesWithSizes(html),
 					...selection,
 					...plan.batches === void 0 ? {
 						excludedClientModules: Object.freeze([]),
@@ -7038,6 +7539,8 @@ var MobileAccessGateway = class {
 		try {
 			return await task;
 		} finally {
+			clearTimeout(measurementTimer);
+			if (kind === "measure") this.clientModuleMeasurementActive = false;
 			callerSignal?.removeEventListener("abort", abort);
 			this.clientModuleOperations.delete(controller);
 			this.clientModuleTasks.delete(task);
@@ -7169,12 +7672,18 @@ var MobileAccessGateway = class {
 			delete headers["content-encoding"];
 			delete headers.etag;
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
-			response.writeHead(200, {
+			const documentGzip = body.byteLength >= MIN_COMPRESSIBLE_DOCUMENT_BYTES && acceptsGzip(request.headers["accept-encoding"]);
+			const payload = documentGzip ? await gzipBuffer(body) : body;
+			operation.signal.throwIfAborted();
+			const documentHeaders = {
 				...headers,
 				"Content-Type": "text/html; charset=utf-8",
-				"Content-Length": body.byteLength
-			});
-			response.end(body);
+				"Content-Length": payload.byteLength
+			};
+			addVaryAcceptEncoding(documentHeaders);
+			if (documentGzip) documentHeaders["Content-Encoding"] = "gzip";
+			response.writeHead(200, documentHeaders);
+			response.end(payload);
 		} catch (error) {
 			holder.request?.destroy();
 			if (error instanceof HttpError) throw error;
@@ -7372,7 +7881,7 @@ var MobileAccessGateway = class {
 			const headers = {
 				"Content-Type": "text/javascript; charset=utf-8",
 				"Content-Length": body.byteLength,
-				"Cache-Control": "private, no-cache",
+				"Cache-Control": "private, max-age=30, must-revalidate",
 				ETag: etag
 			};
 			if (compressed) headers["Content-Encoding"] = "gzip";
@@ -7381,7 +7890,7 @@ var MobileAccessGateway = class {
 				setSecurityHeaders(response, this.tlsEnabled);
 				response.writeHead(304, {
 					ETag: etag,
-					"Cache-Control": "private, no-cache",
+					"Cache-Control": "private, max-age=30, must-revalidate",
 					Vary: String(headers.vary)
 				});
 				response.end();
@@ -7560,6 +8069,16 @@ var MobileAccessGateway = class {
 			operation.abort();
 		};
 		response.once("close", onClose);
+		const startedAt = performance.now();
+		const latencyPath = boundedApiPath(request.url);
+		if (latencyPath !== void 0) response.once("close", () => {
+			this.apiLatency.record({
+				method: request.method,
+				path: latencyPath,
+				status: response.headersSent ? response.statusCode : 0,
+				durationMs: performance.now() - startedAt
+			});
+		});
 		if (replayable) request.resume();
 		try {
 			const attempts = replayable ? MOBILE_BOOT_UPSTREAM_ATTEMPTS : 1;
@@ -8068,6 +8587,8 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		const failures = [];
+		const directoryDrain = Promise.all(this.workspaceDirectoryTasks);
 		for (const controller of this.clientModuleOperations) controller.abort();
 		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
 		this.extensionChangeTimer = void 0;
@@ -8077,7 +8598,9 @@ var MobileAccessGateway = class {
 		this.removeSessionListener();
 		this.pendingDeviceRevocations.clear();
 		for (const view of this.mobileDocumentViews.values()) this.removeMobileDocumentView(view);
-		const accessClose = this.access.close();
+		const accessClose = this.access.close().catch((error) => {
+			failures.push(error);
+		});
 		for (const stored of this.mobileBootBatches.values()) stored.assembly?.controller.abort();
 		for (const request of this.activeRequests.values()) {
 			clearTimeout(request.timer);
@@ -8090,19 +8613,29 @@ var MobileAccessGateway = class {
 		for (const socket of this.connectedSockets) socket.destroy();
 		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
 		this.discoveryTimer = void 0;
-		await this.closeBonjour();
+		for (const result of await directoryDrain) if (result.status === "rejected") failures.push(result.reason);
+		await this.closeBonjour().catch((error) => {
+			failures.push(error);
+		});
 		const discoverySocket = this.discoverySocket;
 		this.discoverySocket = void 0;
 		if (discoverySocket !== void 0) await new Promise((resolve) => {
 			discoverySocket.close(() => resolve());
+		}).catch((error) => {
+			failures.push(error);
 		});
 		const server = this.server;
 		this.server = void 0;
-		if (server !== void 0 && server.listening) {
+		if (server !== void 0 && server.listening) try {
 			server.closeAllConnections();
-			await new Promise((resolve) => {
-				server.close(() => resolve());
+			await new Promise((resolve, reject) => {
+				server.close((error) => {
+					if (error) reject(error);
+					else resolve();
+				});
 			});
+		} catch (error) {
+			failures.push(error);
 		}
 		await accessClose;
 		await Promise.allSettled(this.clientModuleTasks);
@@ -8113,6 +8646,7 @@ var MobileAccessGateway = class {
 		this.connectedSockets.clear();
 		this.policy = void 0;
 		this.listenerPort = void 0;
+		if (failures.length > 0) throw new AggregateError(failures, "mobile gateway cleanup failed");
 	}
 	/** Safe metadata helper for direct loopback integrations. */
 	devices() {
@@ -18190,6 +18724,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -18252,6 +18788,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -18274,6 +18812,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -18291,6 +18831,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -18515,8 +19057,8 @@ async function apply(ctx, config) {
 						}
 						if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 						const body = await readJsonObject(request, template.maxBodyBytes);
-						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules")) throw new HttpError(400, "bad_request");
-						sendJson(response, 200, body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
+						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules" && key !== "measure") || "measure" in body && body.measure !== true) throw new HttpError(400, "bad_request");
+						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
 					} catch (error) {
 						if (!(error instanceof ClientModuleConflictError)) throw error;
 						sendJson(response, 409, {