dsh-mobile 0.6.16 → 0.6.18

package/lib/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32 } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
 import { connect, createServer } from "node:net";
@@ -958,6 +958,7 @@ const Config = z.object({
 	upstreamOrigin: z.string(),
 	publicAuthorities: z.array(String).default(void 0),
 	allowedCidrs: z.array(String).default(void 0),
+	adminAllowedCidrs: z.array(String).default([]),
 	stateFile: String,
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
@@ -1111,6 +1112,11 @@ function parseGatewayConfig(raw) {
 	if (new Set(authorities.map((entry) => `${entry.hostname}:${String(entry.port ?? listenPort)}`)).size !== authorities.length) throw new Error("publicAuthorities must not contain duplicates");
 	const allowedCidrs = stringArray(value.allowedCidrs ?? (isLoopbackAddress(listenHost) ? ["127.0.0.0/8", "::1/128"] : void 0), "allowedCidrs").map(parseCidr);
 	if (new Set(allowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== allowedCidrs.length) throw new Error("allowedCidrs must not contain duplicates");
+	const adminSources = value.adminAllowedCidrs === void 0 ? [] : value.adminAllowedCidrs;
+	if (!Array.isArray(adminSources) || adminSources.length > 32 || adminSources.some((source) => typeof source !== "string")) throw new Error("adminAllowedCidrs must contain at most 32 CIDR strings");
+	const adminAllowedCidrs = adminSources.map(parseCidr);
+	if (adminAllowedCidrs.some((entry) => entry.prefix === 0)) throw new Error("adminAllowedCidrs must not allow every address");
+	if (new Set(adminAllowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== adminAllowedCidrs.length) throw new Error("adminAllowedCidrs must not contain duplicates");
 	const deviceTtlMs = integer(value.deviceTtlMs, "deviceTtlMs", 7776e6, 6e4, 316224e5);
 	const sessionTtlMs = integer(value.sessionTtlMs, "sessionTtlMs", 288e5, 3e4, 864e5);
 	if (sessionTtlMs > deviceTtlMs) throw new Error("sessionTtlMs must not exceed deviceTtlMs");
@@ -1121,6 +1127,7 @@ function parseGatewayConfig(raw) {
 		upstreamOrigin,
 		authorities: Object.freeze(authorities),
 		allowedCidrs: Object.freeze(allowedCidrs),
+		adminAllowedCidrs: Object.freeze(adminAllowedCidrs),
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		extensionsDir: join(dirname(absoluteFile(value.stateFile, "stateFile")), "extensions"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
@@ -1896,9 +1903,11 @@ function localAuthority(header) {
 		return;
 	}
 }
-/** Protect the inner management route from non-loopback and DNS-rebinding callers. */
-function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false) {
-	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
+/** Protect management with direct-peer, Host, browser-source and optional authenticated-network admission. */
+function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false, adminAllowedCidrs = []) {
+	const peer = request.socket.remoteAddress;
+	const loopback = peer !== void 0 && isLoopbackAddress(peer);
+	if (!loopback && !addressAllowed(peer, adminAllowedCidrs)) throw new HttpError(403, "forbidden");
 	const host = localAuthority(request.headers.host);
 	if (host === void 0 || !isLocalAdminHostname(host.hostname)) throw new HttpError(403, "forbidden");
 	if (request.method === "OPTIONS") throw new HttpError(403, "forbidden");
@@ -1917,6 +1926,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	const webRequest = request.method === "POST" && (site === void 0 || site === "same-origin") && request.headers["x-dsh-mobile-web-admin"] === "same-origin-json" && request.headers["x-dsh-mobile-desktop-admin"] === void 0 && typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
 	if (requireBrowserOrigin && origin === void 0 && !webRequest && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
+	if (!loopback && !authenticateDesktop()) throw new HttpError(401, "admin_authentication_required");
 }
 //#endregion
 //#region src/browser-auth-cookies.ts
@@ -1973,7 +1983,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS$2 = 3e4;
+const LOG_INTERVAL_MS$3 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2070,7 +2080,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$2;
+		window.nextLogAt = now + LOG_INTERVAL_MS$3;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2124,7 +2134,7 @@ function classifyHttpParserFailure(nodeCode) {
 		parserCode
 	};
 }
-const LOG_INTERVAL_MS$1 = 3e4;
+const LOG_INTERVAL_MS$2 = 3e4;
 /**
 * Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
@@ -2193,7 +2203,7 @@ var HttpFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS$1;
+		window.nextLogAt = now + LOG_INTERVAL_MS$2;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2210,6 +2220,114 @@ var HttpFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/api-latency-log.ts
+/**
+* Bounded API latency samples for diagnosing slow mobile requests.
+*
+* A sample never carries a query string, request body, header or credential.
+* The path collapses to its first `/api/` segment, so the recorded key set is
+* limited to fixed route categories rather than session or turn identifiers, and the
+* same report stays comparable across devices and releases.
+*/
+/** Only methods with a fixed spelling are recorded; anything else collapses. */
+const BOUNDED_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** Requests below this budget are ordinary traffic and stay out of the log. */
+const API_LATENCY_MIN_MS = 3e3;
+const LOG_INTERVAL_MS$1 = 3e4;
+const ROUTE_SEGMENTS = Object.freeze([
+	"session",
+	"sessions",
+	"workspace",
+	"workspaces",
+	"settings",
+	"llm",
+	"remote",
+	"mobile-access",
+	"plugins",
+	"plugin-manager",
+	"interactions",
+	"credentials",
+	"auth"
+]);
+/**
+* Reduce a request target to a bounded diagnostic route.
+* @param url - The raw request target; its query string is ignored entirely.
+* @returns `/api/<category>` for a fixed category, `/api/other` for an
+*   unrecognized one, or `undefined` when the target is not an API request.
+*/
+function boundedApiPath(url) {
+	const pathname = url?.split("?", 1)[0] ?? "";
+	if (!pathname.startsWith("/api/")) return void 0;
+	const category = (pathname.slice(5).split("/", 1)[0] ?? "").toLowerCase();
+	return ROUTE_SEGMENTS.includes(category) ? `/api/${category}` : "/api/other";
+}
+/**
+* Per-Gateway slow-request diagnostics.
+*
+* Records once immediately, then at most once per 30 seconds with a suppressed
+* count, mirroring the HTTP failure recorder. A sink failure cannot change a
+* response, retry a write or expose the diagnostic sink's error.
+*/
+var ApiLatencyRecorder = class {
+	observe;
+	now;
+	minDurationMs;
+	reportObserverFailure;
+	nextLogAt = 0;
+	suppressed = 0;
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), minDurationMs = API_LATENCY_MIN_MS, reportObserverFailure = () => {
+		process.emitWarning("Mobile access latency diagnostics could not be recorded", { code: "DSH_MOBILE_LATENCY_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.minDurationMs = minDurationMs;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/**
+	* Record one completed request when it exceeded the reporting budget.
+	* @param sample - The bounded route, method, status and measured duration.
+	*/
+	record(sample) {
+		if (this.observe === void 0) return;
+		if (!Number.isFinite(sample.durationMs) || sample.durationMs < this.minDurationMs) return;
+		const now = this.now();
+		if (now < this.nextLogAt) {
+			this.suppressed = Math.min(Number.MAX_SAFE_INTEGER, this.suppressed + 1);
+			return;
+		}
+		const suppressed = this.suppressed;
+		this.nextLogAt = now + LOG_INTERVAL_MS$1;
+		this.suppressed = 0;
+		const method = sample.method?.toUpperCase() ?? "";
+		const status = Number.isInteger(sample.status) && sample.status >= 100 && sample.status <= 599 ? sample.status : 0;
+		const entry = {
+			kind: "api",
+			method: BOUNDED_METHODS.has(method) ? method : "OTHER",
+			path: sample.path,
+			status,
+			durationMs: Math.round(sample.durationMs),
+			...suppressed === 0 ? {} : { suppressed }
+		};
+		try {
+			this.observe(entry);
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/upstream-auth-log.ts
 const LOG_INTERVAL_MS = 3e4;
 /** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
@@ -2928,6 +3046,127 @@ async function listComputerImages(path, signal) {
 		truncated
 	});
 }
+/**
+* Resolve a workspace path without a relative or current-drive fallback.
+*
+* @param path - Fully qualified directory, or null/empty for the Host home.
+* @param platform - Host path syntax; explicit for cross-platform parser tests.
+* @returns The normalized fully qualified path in the selected syntax.
+*/
+function resolveWorkspaceDirectoryPath(path, platform = process.platform) {
+	if (path === null || path === "") return homedir();
+	const paths = platform === "win32" ? win32 : posix;
+	const qualified = platform !== "win32" || /^(?:[A-Za-z]:[\\/]|[\\/]{2}[^\\/]+[\\/]+[^\\/]+(?:[\\/]|$))/u.test(path) && !/^[\\/]{2}[?.][\\/]/u.test(path);
+	if (path.includes("\0") || !paths.isAbsolute(path) || !qualified) throw new HttpError(400, "bad_path");
+	return paths.resolve(path);
+}
+/**
+* List folders only for the dedicated mobile workspace picker.
+*
+* Returns at most 500 enterable folders, including directory links. A truncated
+* level retains its first filesystem-enumerated rows; callers can enter an
+* absolute path to reach an omitted row. Cancellation preserves its reason;
+* pending filesystem operations and handle closure settle before this request
+* releases its Gateway work slot.
+*/
+async function listWorkspaceDirectories(path, signal) {
+	signal?.throwIfAborted();
+	const target = resolveWorkspaceDirectoryPath(path);
+	const rows = [];
+	let truncated = false;
+	let directory;
+	try {
+		directory = await opendir(target);
+		for (;;) {
+			signal?.throwIfAborted();
+			const entry = await directory.read();
+			signal?.throwIfAborted();
+			if (entry === null) break;
+			const entryPath = resolve(target, entry.name);
+			let enterable = entry.isDirectory();
+			if (!enterable && entry.isSymbolicLink()) try {
+				enterable = (await stat(entryPath)).isDirectory();
+				signal?.throwIfAborted();
+			} catch {
+				signal?.throwIfAborted();
+				continue;
+			}
+			if (!enterable) continue;
+			if (rows.length === MAX_ENTRIES) {
+				truncated = true;
+				break;
+			}
+			rows.push({
+				name: entry.name,
+				path: entryPath
+			});
+		}
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		throw new HttpError(404, "directory_unavailable");
+	} finally {
+		try {
+			await directory?.close();
+		} catch {
+			throw new HttpError(500, "directory_cleanup_failed");
+		}
+	}
+	signal?.throwIfAborted();
+	rows.sort((left, right) => left.name.localeCompare(right.name));
+	const parent = dirname(target);
+	return Object.freeze({
+		path: target,
+		...parent === target ? {} : { parent },
+		entries: Object.freeze(rows),
+		truncated
+	});
+}
+/**
+* Resolve exactly one child name without drive-relative or reserved Win32 spellings.
+* @param path - Fully qualified parent without a home/current-drive fallback.
+* @param name - Single non-blank path segment.
+* @param platform - Host path rules, explicit for portable parser tests.
+* @returns The child path whose immediate parent is the normalized requested directory.
+*/
+function workspaceDirectoryChildPath(path, name, platform = process.platform) {
+	if (typeof path !== "string" || path.length === 0) throw new HttpError(400, "directory_create_invalid");
+	if (typeof name !== "string" || name.length === 0 || name.length > 255 || name.trim() === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || isAbsolute(name) || platform === "win32" && (/[<>:"|?*\u0000-\u001f]/u.test(name) || /[. ]$/u.test(name) || /^(?:CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(?:\.|$)/iu.test(name))) throw new HttpError(400, "directory_create_invalid");
+	const paths = platform === "win32" ? win32 : posix;
+	const parent = resolveWorkspaceDirectoryPath(path, platform);
+	const child = paths.resolve(parent, name);
+	if (paths.dirname(child) !== parent) throw new HttpError(400, "directory_create_invalid");
+	return child;
+}
+/**
+* Create one child directory under an explicitly confirmed existing parent.
+* @param path - Fully qualified existing parent; no home/default fallback is used.
+* @param name - One non-blank segment accepted by the Host filesystem rules.
+* @param signal - Cancellation withdraws admission/results, never a completed mkdir.
+* @returns The created directory's absolute path after filesystem work settles.
+*/
+async function createWorkspaceDirectory(path, name, signal) {
+	signal?.throwIfAborted();
+	const created = workspaceDirectoryChildPath(path, name);
+	const parent = resolveWorkspaceDirectoryPath(path);
+	let stats;
+	try {
+		stats = await stat(parent);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		throw new HttpError(404, "directory_unavailable");
+	}
+	if (!stats.isDirectory()) throw new HttpError(400, "directory_create_invalid");
+	signal?.throwIfAborted();
+	try {
+		await mkdir(created);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		if (error.code === "EEXIST") throw new HttpError(409, "directory_exists");
+		throw new HttpError(400, "directory_create_failed");
+	}
+	signal?.throwIfAborted();
+	return Object.freeze({ path: created });
+}
 /** Read one bounded regular image file selected by an authenticated device. */
 async function readComputerImage(path, signal) {
 	signal?.throwIfAborted();
@@ -4945,21 +5184,43 @@ const MOBILE_DOCUMENT_VIEW_HEADER = "x-dsh-mobile-view";
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
 /**
-* Per-merged-batch byte budget. One upstream application batch can carry dozens
-* of client bundles whose combined size exceeds the hard batch cap; the layout
-* batch is therefore chunked into multiple merged batches, each kept safely
-* below {@link MAX_MOBILE_BOOT_BATCH_BYTES} so assembly can never reject it.
+* Target source-byte size for merged batches. A module larger than this target
+* remains whole, subject to the separate per-entry and assembly limits. Excess
+* merged batches use the original individual module URLs instead of rejecting
+* an otherwise loadable graph. Smaller responses do not guarantee a page-load
+* deadline: transfer time also depends on the complete graph and connection.
 */
-const MOBILE_BOOT_CHUNK_BYTES = 16777216;
+const MOBILE_BOOT_CHUNK_BYTES = 3145728;
+/** Bodies below this size cost more to gzip than they save on the wire. */
+const MIN_COMPRESSIBLE_DOCUMENT_BYTES = 1024;
 /** Bytes the assembly emits after each entry (`body` plus `\n;\n`). */
 const MOBILE_BOOT_SEPARATOR_BYTES = 3;
 /** Freshness window for cached upstream bundle byte sizes. */
+/** Catalog sizes change only on a plugin rebuild or host restart. */
+const CLIENT_MODULE_SIZE_TTL_MS = 6e5;
+/** Explicit metadata measurement is optional and must fit one short UI operation. */
+const CLIENT_MODULE_MEASUREMENT_BUDGET_MS = 5e3;
 const MOBILE_BOOT_SIZE_CACHE_TTL_MS = 3e4;
 /** Marker header distinguishing size probes from ordinary proxied bundle fetches. */
 const MOBILE_BOOT_SIZE_PROBE_HEADER = "x-dsh-mobile-size-probe";
-const MAX_MOBILE_BOOT_BATCHES = 8;
+const MAX_MOBILE_BOOT_BATCHES = 16;
 const MOBILE_BOOT_UPSTREAM_ATTEMPTS = 4;
 const MOBILE_BOOT_RETRY_DELAY_MS = 150;
+/**
+* Sanitize an installed package's description for the settings panel.
+*
+* The text comes from the plugin's own package metadata, not from an upstream
+* certification, so URLs are dropped and control characters collapse; the panel
+* keeps the wording as published instead of translating or editorializing it.
+* @param value - The package.json `description` field, possibly absent.
+* @returns A single-line description, or `undefined` when nothing usable remains.
+*/
+function sanitizeModuleDescription(value) {
+	if (typeof value !== "string") return void 0;
+	const text = value.replace(/[\u0000-\u001f\u007f]+/gu, " ").replace(/https?:\/\/\S+/giu, " ").replace(/\s+/gu, " ").trim();
+	if (text === "") return void 0;
+	return text.length <= 200 ? text : `${text.slice(0, 197)}…`;
+}
 function upstreamPluginBundleUrl(source, upstreamOrigin) {
 	if (!source.startsWith("/plugins/") && !source.startsWith("plugins/") || source.includes("#")) return void 0;
 	try {
@@ -5320,6 +5581,41 @@ function splitMobileBootBatch(entries, sizes, passThrough) {
 		rows
 	};
 }
+/**
+* Retain the layout replacement while bounding the graph's stored merged batches.
+* @param splits - Application batches already partitioned against the byte target.
+* @returns The same module coverage, with overflow served by valid upstream URLs.
+*/
+function limitMobileBootBatches(splits) {
+	const layoutPlan = splits.flatMap((split) => split.plans).find((plan) => plan.entries.some((entry) => entry.id === MOBILE_LAYOUT_MODULE));
+	let remaining = MAX_MOBILE_BOOT_BATCHES - (layoutPlan === void 0 ? 0 : 1);
+	const upstreamOrigin = new URL("http://dsh-mobile.invalid");
+	return splits.map((split) => {
+		const byPath = new Map(split.plans.map((plan) => [plan.path, plan]));
+		const plans = [];
+		return {
+			plans,
+			rows: split.rows.flatMap((row) => {
+				const plan = byPath.get(row.url);
+				if (plan === void 0) return [row];
+				if (plan === layoutPlan || remaining > 0) {
+					if (plan !== layoutPlan) remaining -= 1;
+					plans.push(plan);
+					return [row];
+				}
+				return plan.entries.map((entry) => {
+					if (upstreamPluginBundleUrl(entry.url, upstreamOrigin) === void 0) throw new Error("upstream DSH mobile boot has no valid module URL for an overflow batch");
+					return {
+						phase: "application",
+						url: entry.url,
+						rev: entry.rev,
+						entries: [entry.id]
+					};
+				});
+			})
+		};
+	});
+}
 function escapeMobilePreloadAttribute(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
@@ -5356,11 +5652,11 @@ function projectMobileBootGraph(plan, options) {
 	let batches = [];
 	let preloadReplacements = /* @__PURE__ */ new Map();
 	if (plan.batches !== void 0 && plan.rewrittenBatchEntries !== void 0) {
-		const rewrites = plan.rewrittenBatchEntries.map(({ batch, entries }) => ({
+		const splits = limitMobileBootBatches(plan.rewrittenBatchEntries.map(({ entries }) => splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())));
+		const rewrites = plan.rewrittenBatchEntries.map(({ batch }, index) => ({
 			batch,
-			split: splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())
+			split: splits[index]
 		}));
-		if (rewrites.reduce((count, item) => count + item.split.plans.length, 0) > MAX_MOBILE_BOOT_BATCHES) throw new Error(`upstream DSH mobile boot requires more than ${String(MAX_MOBILE_BOOT_BATCHES)} merged batches`);
 		for (const { batch, split } of rewrites) {
 			const at = plan.batches.indexOf(batch);
 			if (at < 0) throw new Error("upstream DSH boot manifest lost an application batch");
@@ -5576,9 +5872,29 @@ function isCompressibleContentType(value) {
 	const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
 	return mediaType.startsWith("text/") || /^(?:application\/(?:javascript|json|xml|x-javascript)|image\/svg\+xml)$/u.test(mediaType);
 }
+/** Media types the client must receive frame by frame, without gzip blocking. */
+const INCREMENTAL_MEDIA_TYPES = /* @__PURE__ */ new Set(["text/event-stream"]);
+/** Bodies below this size cost more to gzip than they save on the wire. */
+const MIN_COMPRESSIBLE_BYTES = 1024;
+function responseMediaType(value) {
+	return (Array.isArray(value) ? value[0] : value)?.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+/** Static asset paths keep their existing compression contract unchanged. */
+function isStaticAssetPath(url) {
+	const pathname = url?.split("?", 1)[0] ?? "";
+	return pathname.startsWith("/plugins/") || pathname.startsWith("/assets/");
+}
 function canCompressResponse(request, response) {
-	const pathname = request.url?.split("?", 1)[0] ?? "";
-	return (request.method === "GET" || request.method === "HEAD") && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && isCompressibleContentType(response.headers["content-type"]);
+	if (!(request.method === "GET" || request.method === "HEAD")) return false;
+	if (response.statusCode !== 200) return false;
+	if (request.headers.range !== void 0) return false;
+	if (response.headers["content-range"] !== void 0) return false;
+	if (response.headers["content-encoding"] !== void 0) return false;
+	if (!isCompressibleContentType(response.headers["content-type"])) return false;
+	if (isStaticAssetPath(request.url)) return true;
+	if (INCREMENTAL_MEDIA_TYPES.has(responseMediaType(response.headers["content-type"]))) return false;
+	const declaredLength = Number(response.headers["content-length"]);
+	return Number.isFinite(declaredLength) && declaredLength >= MIN_COMPRESSIBLE_BYTES;
 }
 function revisionedStaticCacheControl(request, statusCode) {
 	if (request.method !== "GET" && request.method !== "HEAD") return void 0;
@@ -5813,6 +6129,7 @@ var MobileAccessGateway = class {
 	mobileBootBatches = /* @__PURE__ */ new Map();
 	mobileDocumentViews = /* @__PURE__ */ new Map();
 	mobileGraphTasks = /* @__PURE__ */ new Set();
+	workspaceDirectoryTasks = /* @__PURE__ */ new Set();
 	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
 	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
@@ -5840,13 +6157,18 @@ var MobileAccessGateway = class {
 	probeDeviceLimiter;
 	probeInFlight = /* @__PURE__ */ new Set();
 	clientModulePreferences;
+	clientModuleSizeCache = /* @__PURE__ */ new Map();
+	clientModuleDescriptionCache = /* @__PURE__ */ new Map();
+	clientModuleMetadataRevision;
+	clientModuleMeasurementActive = false;
 	clientModuleOperations = /* @__PURE__ */ new Set();
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
 	httpFailures;
+	apiLatency;
 	upstreamAuthDiagnostics;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog) {
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog, upstreamAuthLog, apiLatencyLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5855,6 +6177,7 @@ var MobileAccessGateway = class {
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
 		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
+		this.apiLatency = new ApiLatencyRecorder(apiLatencyLog);
 		this.upstreamAuthDiagnostics = new UpstreamAuthRecorder(upstreamAuthLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
@@ -6468,6 +6791,7 @@ var MobileAccessGateway = class {
 		}
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
+		const workspaceDirectories = (request.method === "GET" || request.method === "POST") && target.decodedPathname === `/mobile-access/workspace-directories`;
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
@@ -6488,7 +6812,7 @@ var MobileAccessGateway = class {
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
 		} : void 0 : void 0;
-		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !workspaceDirectories && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (![
 			"GET",
 			"HEAD",
@@ -6542,6 +6866,7 @@ var MobileAccessGateway = class {
 					const keys = Object.keys(body);
 					if (keys.length !== 1) throw new HttpError(400, "bad_request");
 					if (keys[0] === "reset" && body.reset === true) kind = "reset";
+					else if (keys[0] === "measure" && body.measure === true) kind = "measure";
 					else if (keys[0] === "excludedClientModules") {
 						kind = "configure";
 						excluded = body.excludedClientModules;
@@ -6588,16 +6913,17 @@ var MobileAccessGateway = class {
 					body = Buffer.from(customAsset.fallback);
 				}
 				if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
+				operation.signal.throwIfAborted();
 				const etag = `"${createHash("sha256").update(body).digest("hex")}"`;
 				const responseHeaders = { ETag: etag };
 				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.setHeader("Cache-Control", "private, no-cache");
 				if (matchesIfNoneMatch(headerValue(request.headers, "if-none-match"), etag)) {
-					setSecurityHeaders(response, this.tlsEnabled);
 					response.writeHead(304, responseHeaders);
 					response.end();
 					return;
 				}
-				setSecurityHeaders(response, this.tlsEnabled);
 				response.writeHead(200, {
 					...responseHeaders,
 					"Content-Type": customAsset.contentType,
@@ -6620,6 +6946,49 @@ var MobileAccessGateway = class {
 				operation.release();
 			}
 		}
+		if (workspaceDirectories) {
+			const operation = this.allocateRequest(authorization, response, {});
+			const onClose = () => {
+				operation.abort();
+			};
+			response.once("close", onClose);
+			const task = (async () => {
+				try {
+					if (request.method === "POST") {
+						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+						if (typeof body.path !== "string" || body.path.length === 0 || typeof body.name !== "string") throw new HttpError(400, "directory_create_invalid");
+						const created = await createWorkspaceDirectory(body.path, body.name, operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 201, created, this.tlsEnabled);
+					} else {
+						const query = new URL(target.raw, this.address().origin).searchParams;
+						const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 200, listing, this.tlsEnabled);
+					}
+				} catch (error) {
+					if (operation.signal.aborted && error === operation.signal.reason) return;
+					throw error;
+				} finally {
+					response.removeListener("close", onClose);
+					operation.release();
+				}
+			})();
+			const completion = task.then(() => ({
+				status: "fulfilled",
+				value: void 0
+			}), (reason) => ({
+				status: "rejected",
+				reason
+			}));
+			this.workspaceDirectoryTasks.add(completion);
+			try {
+				await task;
+			} finally {
+				this.workspaceDirectoryTasks.delete(completion);
+			}
+			return;
+		}
 		if (computerImage) {
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
@@ -6967,6 +7336,14 @@ var MobileAccessGateway = class {
 	describeClientModules(deviceId, callerSignal) {
 		return this.clientModulePreferenceOperation("describe", void 0, deviceId, callerSignal);
 	}
+	/** Measure optional catalog metadata without changing saved module selections.
+	* @param deviceId - Authenticated device identity, or computer defaults when omitted.
+	* @param callerSignal - Cancels measurement and drains its admitted requests.
+	* @returns Current selections with the measurements completed within the budget.
+	*/
+	measureClientModules(deviceId, callerSignal) {
+		return this.clientModulePreferenceOperation("measure", void 0, deviceId, callerSignal);
+	}
 	/** Persist a validated device override or computer default.
 	* @param excluded - Untrusted module IDs to validate against the current boot graph.
 	* @param deviceId - Authenticated device identity; omitted for computer defaults.
@@ -6984,9 +7361,192 @@ var MobileAccessGateway = class {
 	resetClientModules(deviceId, callerSignal) {
 		return this.clientModulePreferenceOperation("reset", void 0, deviceId, callerSignal);
 	}
+	/** Return cached metadata only; catalog reads and saves never start bundle probes. */
+	describeMobileModulesWithSizes(html) {
+		const plan = parseMobileBootPlan(html);
+		if (this.clientModuleMetadataRevision !== plan.parsed.rev) {
+			this.clientModuleMetadataRevision = plan.parsed.rev;
+			this.clientModuleSizeCache.clear();
+			this.clientModuleDescriptionCache.clear();
+		}
+		const urls = new Map(plan.entries.map((entry) => [entry.id, entry.url]));
+		const now = Date.now();
+		return Object.freeze(describeMobileClientModules(html).map((entry) => {
+			const source = urls.get(entry.id);
+			const size = this.clientModuleSizeCache.get(source);
+			const description = this.clientModuleDescriptionCache.get(`${entry.id}\0${source}`);
+			return Object.freeze({
+				...entry,
+				...size === void 0 || now - size.at >= CLIENT_MODULE_SIZE_TTL_MS ? {} : {
+					bytes: size.bytes,
+					gzipBytes: size.gzipBytes
+				},
+				...description === void 0 || now - description.at >= CLIENT_MODULE_SIZE_TTL_MS ? {} : { description: description.description }
+			});
+		}));
+	}
+	/** Refresh metadata only after an explicit user action, with bounded concurrency. */
+	async measureMobileModules(html, signal) {
+		this.describeMobileModulesWithSizes(html);
+		const queue = [...parseMobileBootPlan(html).entries].sort((left, right) => Number(right.id === MOBILE_LAYOUT_MODULE) - Number(left.id === MOBILE_LAYOUT_MODULE));
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < queue.length) {
+				signal.throwIfAborted();
+				const entry = queue[cursor++];
+				await this.upstreamBundleMeasurement(entry.url, signal).catch((error) => {
+					if (signal.aborted) throw error;
+				});
+				signal.throwIfAborted();
+				await this.installedModuleDescription(entry.id, entry.url, signal);
+			}
+		};
+		await Promise.allSettled(Array.from({ length: Math.min(4, queue.length) }, worker));
+		signal.throwIfAborted();
+	}
+	/**
+	* Read the installed package description for one catalog module.
+	*
+	* This is best-effort package metadata lookup from the state directory's Node
+	* resolution context and this plugin's dependencies. Unexported or unavailable
+	* package metadata stays unknown; arbitrary paths and subpaths are not read.
+	*/
+	async installedModuleDescription(id, source, signal) {
+		if (!/^(?:@[a-z\d][a-z\d._-]*\/)?[a-z\d][a-z\d._-]*$/iu.test(id)) return;
+		const key = `${id}\0${source}`;
+		this.clientModuleDescriptionCache.delete(key);
+		const resolvers = [createRequire(join(dirname(this.config.stateFile), "package.json")), createRequire(import.meta.url)];
+		for (const resolver of resolvers) {
+			signal.throwIfAborted();
+			try {
+				const file = resolver.resolve(`${id}/package.json`);
+				const information = await stat(file);
+				if (!information.isFile() || information.size > 262144) continue;
+				const raw = await readFile(file, {
+					encoding: "utf8",
+					signal
+				});
+				const description = sanitizeModuleDescription(JSON.parse(raw).description);
+				signal.throwIfAborted();
+				if (description !== void 0) {
+					this.clientModuleDescriptionCache.set(key, {
+						at: Date.now(),
+						description
+					});
+					return;
+				}
+			} catch (error) {
+				if (signal.aborted) throw error;
+			}
+		}
+	}
+	/**
+	* Measure one upstream bundle's source and gzipped size.
+	*
+	* Measurements are cached for ten minutes: the settings panel is opened rarely
+	* and upstream bundle bytes only change on a plugin rebuild or host restart.
+	*/
+	async upstreamBundleMeasurement(source, signal) {
+		signal.throwIfAborted();
+		this.clientModuleSizeCache.delete(source);
+		if (source === MOBILE_LAYOUT_PATH) {
+			const information = await stat(this.config.mobileLayoutFile);
+			if (!information.isFile() || information.size > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+			const body = await readFile(this.config.mobileLayoutFile, { signal });
+			if (body.byteLength > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+			const gzipBytes = (await gzipBuffer(body)).byteLength;
+			signal.throwIfAborted();
+			this.clientModuleSizeCache.set(source, {
+				at: Date.now(),
+				bytes: body.byteLength,
+				gzipBytes
+			});
+			return {
+				bytes: body.byteLength,
+				gzipBytes
+			};
+		}
+		const target = upstreamPluginBundleUrl(source, this.config.upstreamOrigin);
+		if (target === void 0) return void 0;
+		let upstreamRequest;
+		let upstreamClosed;
+		const abort = () => {
+			upstreamRequest?.destroy(requestAbortedError());
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		try {
+			const upstreamCookie = await waitForRequestTask(this.upstreamCookieHeader(), signal);
+			signal.throwIfAborted();
+			const proxied = await new Promise((resolve, reject) => {
+				upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/javascript",
+						"accept-encoding": "identity",
+						[MOBILE_BOOT_SIZE_PROBE_HEADER]: "1",
+						...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+					},
+					agent: false
+				});
+				const opened = upstreamRequest;
+				upstreamClosed = new Promise((closed) => {
+					opened.once("close", () => {
+						closed();
+					});
+				});
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest?.destroy(upstreamTimeoutError());
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if (proxied.statusCode !== 200) {
+				proxied.resume();
+				return;
+			}
+			const chunks = [];
+			let bytes = 0;
+			for await (const chunk of proxied) {
+				signal.throwIfAborted();
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				bytes += buffer.byteLength;
+				if (bytes > MAX_MOBILE_BOOT_ENTRY_BYTES) return void 0;
+				chunks.push(buffer);
+			}
+			const body = Buffer.concat(chunks);
+			const gzipBytes = (await gzipBuffer(body)).byteLength;
+			signal.throwIfAborted();
+			this.clientModuleSizeCache.set(source, {
+				at: Date.now(),
+				bytes: body.byteLength,
+				gzipBytes
+			});
+			return {
+				bytes: body.byteLength,
+				gzipBytes
+			};
+		} finally {
+			signal.removeEventListener("abort", abort);
+			upstreamRequest?.destroy();
+			await upstreamClosed;
+		}
+	}
 	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal) {
 		if (this.closing || !this.started) throw new HttpError(503, "unavailable");
+		if (kind === "measure" && this.clientModuleMeasurementActive) throw new HttpError(429, "busy");
+		if (kind === "measure") this.clientModuleMeasurementActive = true;
 		const controller = new AbortController();
+		let measurementExpired = false;
+		const measurementTimer = kind === "measure" ? setTimeout(() => {
+			measurementExpired = true;
+			controller.abort();
+		}, CLIENT_MODULE_MEASUREMENT_BUDGET_MS) : void 0;
 		const abort = () => controller.abort();
 		if (callerSignal?.aborted === true) controller.abort();
 		callerSignal?.addEventListener("abort", abort, { once: true });
@@ -7020,8 +7580,13 @@ var MobileAccessGateway = class {
 			controller.signal.throwIfAborted();
 			try {
 				const plan = parseMobileBootPlan(html);
+				if (kind === "measure") try {
+					await this.measureMobileModules(html, controller.signal);
+				} catch (error) {
+					if (!measurementExpired || callerSignal?.aborted === true || this.closing) throw error;
+				}
 				return Object.freeze({
-					entries: describeMobileClientModules(html),
+					entries: this.describeMobileModulesWithSizes(html),
 					...selection,
 					...plan.batches === void 0 ? {
 						excludedClientModules: Object.freeze([]),
@@ -7038,6 +7603,8 @@ var MobileAccessGateway = class {
 		try {
 			return await task;
 		} finally {
+			clearTimeout(measurementTimer);
+			if (kind === "measure") this.clientModuleMeasurementActive = false;
 			callerSignal?.removeEventListener("abort", abort);
 			this.clientModuleOperations.delete(controller);
 			this.clientModuleTasks.delete(task);
@@ -7114,8 +7681,7 @@ var MobileAccessGateway = class {
 			let body;
 			if (stockFrontend) body = Buffer.from(ensureMobileGatewayMarker(index.html));
 			else {
-				const preference = await this.clientModulePreferences.read(authorization.deviceId);
-				const excludedClientModules = preference.excludedClientModules;
+				const excludedClientModules = (await this.clientModulePreferences.read(authorization.deviceId)).excludedClientModules;
 				try {
 					const html = index.html;
 					const plan = parseMobileBootPlan(html, excludedClientModules);
@@ -7142,22 +7708,15 @@ var MobileAccessGateway = class {
 							this.lastModuleExclusionError = detail;
 							process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
 						}
-						if (preference.source === "device" || preference.source === "computer") {
-							operation.signal.throwIfAborted();
-							const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
-							const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
-							setSecurityHeaders(response, this.tlsEnabled);
-							response.writeHead(200, {
-								"Content-Type": "text/html; charset=utf-8",
-								"Content-Length": recovery.byteLength
-							});
-							response.end(recovery);
-							return;
-						}
-						sendJson(response, 409, {
-							error: "excluded_client_modules_invalid",
-							detail
-						}, this.tlsEnabled);
+						operation.signal.throwIfAborted();
+						const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
+						const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
+						setSecurityHeaders(response, this.tlsEnabled);
+						response.writeHead(200, {
+							"Content-Type": "text/html; charset=utf-8",
+							"Content-Length": recovery.byteLength
+						});
+						response.end(recovery);
 						return;
 					}
 					throw new HttpError(502, "upstream_unavailable");
@@ -7169,12 +7728,18 @@ var MobileAccessGateway = class {
 			delete headers["content-encoding"];
 			delete headers.etag;
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
-			response.writeHead(200, {
+			const documentGzip = body.byteLength >= MIN_COMPRESSIBLE_DOCUMENT_BYTES && acceptsGzip(request.headers["accept-encoding"]);
+			const payload = documentGzip ? await gzipBuffer(body) : body;
+			operation.signal.throwIfAborted();
+			const documentHeaders = {
 				...headers,
 				"Content-Type": "text/html; charset=utf-8",
-				"Content-Length": body.byteLength
-			});
-			response.end(body);
+				"Content-Length": payload.byteLength
+			};
+			addVaryAcceptEncoding(documentHeaders);
+			if (documentGzip) documentHeaders["Content-Encoding"] = "gzip";
+			response.writeHead(200, documentHeaders);
+			response.end(payload);
 		} catch (error) {
 			holder.request?.destroy();
 			if (error instanceof HttpError) throw error;
@@ -7372,7 +7937,7 @@ var MobileAccessGateway = class {
 			const headers = {
 				"Content-Type": "text/javascript; charset=utf-8",
 				"Content-Length": body.byteLength,
-				"Cache-Control": "private, no-cache",
+				"Cache-Control": "private, max-age=30, must-revalidate",
 				ETag: etag
 			};
 			if (compressed) headers["Content-Encoding"] = "gzip";
@@ -7381,7 +7946,7 @@ var MobileAccessGateway = class {
 				setSecurityHeaders(response, this.tlsEnabled);
 				response.writeHead(304, {
 					ETag: etag,
-					"Cache-Control": "private, no-cache",
+					"Cache-Control": "private, max-age=30, must-revalidate",
 					Vary: String(headers.vary)
 				});
 				response.end();
@@ -7560,6 +8125,16 @@ var MobileAccessGateway = class {
 			operation.abort();
 		};
 		response.once("close", onClose);
+		const startedAt = performance.now();
+		const latencyPath = boundedApiPath(request.url);
+		if (latencyPath !== void 0) response.once("close", () => {
+			this.apiLatency.record({
+				method: request.method,
+				path: latencyPath,
+				status: response.headersSent ? response.statusCode : 0,
+				durationMs: performance.now() - startedAt
+			});
+		});
 		if (replayable) request.resume();
 		try {
 			const attempts = replayable ? MOBILE_BOOT_UPSTREAM_ATTEMPTS : 1;
@@ -8068,6 +8643,8 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		const failures = [];
+		const directoryDrain = Promise.all(this.workspaceDirectoryTasks);
 		for (const controller of this.clientModuleOperations) controller.abort();
 		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
 		this.extensionChangeTimer = void 0;
@@ -8077,7 +8654,9 @@ var MobileAccessGateway = class {
 		this.removeSessionListener();
 		this.pendingDeviceRevocations.clear();
 		for (const view of this.mobileDocumentViews.values()) this.removeMobileDocumentView(view);
-		const accessClose = this.access.close();
+		const accessClose = this.access.close().catch((error) => {
+			failures.push(error);
+		});
 		for (const stored of this.mobileBootBatches.values()) stored.assembly?.controller.abort();
 		for (const request of this.activeRequests.values()) {
 			clearTimeout(request.timer);
@@ -8090,19 +8669,29 @@ var MobileAccessGateway = class {
 		for (const socket of this.connectedSockets) socket.destroy();
 		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
 		this.discoveryTimer = void 0;
-		await this.closeBonjour();
+		for (const result of await directoryDrain) if (result.status === "rejected") failures.push(result.reason);
+		await this.closeBonjour().catch((error) => {
+			failures.push(error);
+		});
 		const discoverySocket = this.discoverySocket;
 		this.discoverySocket = void 0;
 		if (discoverySocket !== void 0) await new Promise((resolve) => {
 			discoverySocket.close(() => resolve());
+		}).catch((error) => {
+			failures.push(error);
 		});
 		const server = this.server;
 		this.server = void 0;
-		if (server !== void 0 && server.listening) {
+		if (server !== void 0 && server.listening) try {
 			server.closeAllConnections();
-			await new Promise((resolve) => {
-				server.close(() => resolve());
+			await new Promise((resolve, reject) => {
+				server.close((error) => {
+					if (error) reject(error);
+					else resolve();
+				});
 			});
+		} catch (error) {
+			failures.push(error);
 		}
 		await accessClose;
 		await Promise.allSettled(this.clientModuleTasks);
@@ -8113,6 +8702,7 @@ var MobileAccessGateway = class {
 		this.connectedSockets.clear();
 		this.policy = void 0;
 		this.listenerPort = void 0;
+		if (failures.length > 0) throw new AggregateError(failures, "mobile gateway cleanup failed");
 	}
 	/** Safe metadata helper for direct loopback integrations. */
 	devices() {
@@ -10721,6 +11311,31 @@ function parseAdditionalTrustedNetworks(value) {
 	}
 	return Object.freeze(entries);
 }
+/**
+* Refresh the legacy `upstreamOrigin` snapshot to the DSH port actually in use.
+*
+* The runtime deliberately follows the WebServer port instead of this field (a Desktop
+* profile can start with `--port 0`), but a stale snapshot is indistinguishable from a
+* stale gateway to whoever reads the file while diagnosing a restart — #273 became a
+* manual edit because of it. Rewriting it keeps the file honest without changing which
+* upstream the gateway uses.
+*
+* @param setupFile - Existing managed setup file.
+* @param setup - The setup as it was read.
+* @param webServerPort - The port the active DSH WebServer bound.
+* @returns Whether the file needed rewriting.
+*/
+async function refreshManagedUpstreamOrigin(setupFile, setup, webServerPort) {
+	if (!Number.isInteger(webServerPort) || webServerPort <= 0) return false;
+	const upstreamOrigin = `http://127.0.0.1:${String(webServerPort)}`;
+	if (setup.upstreamOrigin === upstreamOrigin) return false;
+	const next = Object.freeze({
+		...setup,
+		upstreamOrigin
+	});
+	await atomicWrite(setupFile, `${JSON.stringify(next, null, 2)}\n`);
+	return true;
+}
 /** Save extra trusted networks without replacing the interface or pairing identity.
 * @param setupFile - Existing managed setup file.
 * @param values - Explicitly selected additional networks.
@@ -18098,11 +18713,18 @@ async function apply(ctx, config) {
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
+	const adminLogin = upstreamLoginUrl === void 0 ? void 0 : new URL(upstreamLoginUrl);
+	const supportsRemoteAdminAuthentication = adminLogin !== void 0 && adminLogin.origin === baseTemplate.upstreamOrigin.origin && adminLogin.pathname === "/" && adminLogin.username === "" && adminLogin.password === "" && adminLogin.hash === "" && (adminLogin.searchParams.get("token")?.length ?? 0) > 0;
 	const instanceId = await stableInstanceId(loaded, baseTemplate);
 	const stateDirectory = dirname(baseTemplate.stateFile);
 	const logFile = await installMobileFileLogger(ctx, stateDirectory);
 	const logger = ctx.logger("dsh-mobile");
 	logger.info("logging initialized file=%s", logFile);
+	if (loaded.kind === "managed" && typeof ctx.webServer.port === "number") try {
+		if (await refreshManagedUpstreamOrigin(loaded.setupFile, loaded.setup, ctx.webServer.port)) logger.info("dsh-mobile: refreshed the managed setup upstream snapshot to the active DSH port");
+	} catch (error) {
+		logger.warn("dsh-mobile: could not refresh the managed setup upstream snapshot: %s", error instanceof Error ? error.message : String(error));
+	}
 	const taskEventHub = new TaskEventHub();
 	const disposeTaskEvents = watchTaskCompletions(ctx, {
 		onTaskCompleted: (event) => taskEventHub.broadcast(event),
@@ -18190,6 +18812,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -18252,6 +18876,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -18274,6 +18900,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -18291,6 +18919,8 @@ async function apply(ctx, config) {
 			logger.warn("http failure %s", JSON.stringify(entry));
 		}, (entry) => {
 			logger.info("upstream auth %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("slow api %s", JSON.stringify(entry));
 		});
 		try {
 			await candidate.start();
@@ -18488,7 +19118,7 @@ async function apply(ctx, config) {
 		handler: async (request, response) => {
 			try {
 				const target = parseRequestTarget(request.url);
-				assertLocalAdminTrust(request, request.method === "POST", () => authenticateDesktopAdmin(request));
+				assertLocalAdminTrust(request, request.method === "POST", () => (isLoopbackAddress(request.socket.remoteAddress ?? "") || supportsRemoteAdminAuthentication) && authenticateDesktopAdmin(request), baseTemplate.adminAllowedCidrs);
 				if (adminClosing) throw new HttpError(503, "unavailable");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
 				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;
@@ -18515,8 +19145,8 @@ async function apply(ctx, config) {
 						}
 						if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 						const body = await readJsonObject(request, template.maxBodyBytes);
-						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules")) throw new HttpError(400, "bad_request");
-						sendJson(response, 200, body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
+						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules" && key !== "measure") || "measure" in body && body.measure !== true) throw new HttpError(400, "bad_request");
+						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
 					} catch (error) {
 						if (!(error instanceof ClientModuleConflictError)) throw error;
 						sendJson(response, 409, {