dsh-mobile 0.6.17 → 0.7.0

package/lib/client.js

@@ -1021,6 +1021,105 @@ window.__ModuleLoader__.load({
 			frpStopped: "FRP 连接已停止。",
 			frpExited: "frpc 意外退出，请检查 VPS 配置后重新连接。"
 		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			irohName: "iroh (Experimental)",
+			irohExperimental: "Experimental",
+			irohNotReady: "iroh is not running. Start the channel first, then generate a pairing code.",
+			irohPairingFailed: "Could not open an iroh pairing window. Reconnect the channel and retry.",
+			irohPairingTitle: "Phone pairing (experimental)",
+			generateIrohQr: "Generate iroh pairing QR code",
+			enlargeQr: "Enlarge the QR code",
+			closeEnlargedQr: "Close the enlarged QR code",
+			irohPairingReady: "iroh pairing code {code} is live for five minutes. Scan it from the iroh pairing screen; opening another code replaces this one.",
+			irohDescription: "Direct encrypted connection with relay fallback. No public domain or tunnel account needed.",
+			prepareIroh: "Prepare iroh",
+			irohInstallNote: "The Install button downloads the pinned sidecar release (dsh-mobile-iroh 0.1.0-alpha.1, about 15 MB on Windows x64, 24 MB on Linux x64) into the plugin private directory and verifies its SHA-256. An installed companion with a verified copy is reused instead, with no download.",
+			irohComponentNote: "An installed sidecar is re-verified by SHA-256 on every use. It is not bundled with the plugin package; a companion-provided copy can only be removed by removing the companion.",
+			irohPhaseNote: "Experimental connection. Requires the full Android App 0.7.0+ with iroh; the compatibility APK and mobile browsers cannot use it.",
+			irohUnavailable: "iroh is not ready: no sidecar is installed yet. Install the official component below to download and verify it.",
+			irohStarting: "Resolving the iroh endpoint identity…",
+			irohConnecting: "Sidecar connected; starting the DSH authentication gateway…",
+			irohCompanionMissing: "No verified iroh sidecar is available. Use Install official component below; a separate companion plugin is optional.",
+			irohDataDirectoryInvalid: "Could not prepare the private sidecar directory. Check that DSH can manage its own profile directory, then retry.",
+			irohSidecarInvalid: "The installed sidecar failed checksum verification. Reinstall the component.",
+			irohDownloadFailed: "The sidecar download failed before verification. Check the network and retry.",
+			irohPlatformUnsupported: "iroh sidecars are published for Windows x64 and Linux x64 only.",
+			irohIdentityFailed: "Could not read the iroh endpoint identity from the sidecar.",
+			irohLaunchFailed: "The iroh sidecar failed to start.",
+			irohExited: "The iroh sidecar exited unexpectedly. Reconnect.",
+			irohTimeout: "Timed out waiting for the iroh sidecar. Reconnect.",
+			irohInstallConfirm: "Download and verify the pinned iroh sidecar now (about 15 MB on Windows x64, 24 MB on Linux x64)? Nothing else is installed.",
+			installingIroh: "Downloading and verifying the iroh sidecar…",
+			switchingIroh: "Switching to iroh…",
+			reconnectingIroh: "Reconnecting the iroh transport…",
+			resetIrohConfirm: "Disable the iroh channel? The companion and its pairings stay installed."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			irohName: "iroh (Sperimentale)",
+			irohExperimental: "Sperimentale",
+			irohNotReady: "iroh non è attivo. Avvia il canale e genera di nuovo il codice.",
+			irohPairingFailed: "Impossibile aprire una finestra di abbinamento iroh. Riconnetti il canale e riprova.",
+			irohPairingTitle: "Abbinamento telefono (sperimentale)",
+			generateIrohQr: "Genera QR di abbinamento iroh",
+			enlargeQr: "Ingrandisci il codice QR",
+			closeEnlargedQr: "Chiudi il codice QR ingrandito",
+			irohPairingReady: "Il codice iroh {code} è attivo per cinque minuti. Scansionalo dalla schermata di abbinamento iroh; aprirne un altro sostituisce questo.",
+			irohDescription: "Connessione cifrata diretta con ripiego su relay. Nessun dominio pubblico o account tunnel richiesto.",
+			prepareIroh: "Prepara iroh",
+			irohInstallNote: "Il pulsante Installa scarica la release pinnata del sidecar (dsh-mobile-iroh 0.1.0-alpha.1, circa 15 MB su Windows x64, 24 MB su Linux x64) nella directory privata del plugin e ne verifica lo SHA-256. Un complemento installato con una copia verificata viene invece riutilizzato senza scaricare nulla.",
+			irohComponentNote: "Un sidecar installato viene riverificato tramite SHA-256 a ogni uso. Non è incluso nel pacchetto del plugin; una copia fornita dal complemento può essere rimossa solo rimuovendo il complemento.",
+			irohPhaseNote: "Connessione sperimentale. Richiede l’App Android completa 0.7.0+ con iroh; APK compatibile e browser mobili non sono supportati.",
+			irohUnavailable: "iroh non è pronto: nessun sidecar è ancora installato. Installa il componente ufficiale qui sotto per scaricarlo e verificarlo.",
+			irohStarting: "Risoluzione dell’identità endpoint iroh…",
+			irohConnecting: "Sidecar connesso; avvio del gateway di autenticazione DSH…",
+			irohCompanionMissing: "Nessun sidecar iroh verificato disponibile. Usa Installa componente ufficiale qui sotto; il plugin complementare è facoltativo.",
+			irohDataDirectoryInvalid: "Impossibile preparare la directory privata del sidecar. Verifica che DSH possa gestire la propria directory del profilo, poi riprova.",
+			irohSidecarInvalid: "Il sidecar installato non ha superato la verifica del checksum. Reinstalla il componente.",
+			irohDownloadFailed: "Download del sidecar non riuscito prima della verifica. Controlla la rete e riprova.",
+			irohPlatformUnsupported: "I sidecar iroh sono pubblicati solo per Windows x64 e Linux x64.",
+			irohIdentityFailed: "Impossibile leggere l’identità endpoint iroh dal sidecar.",
+			irohLaunchFailed: "Avvio del sidecar iroh non riuscito.",
+			irohExited: "Il sidecar iroh è terminato inaspettatamente. Riconnettiti.",
+			irohTimeout: "Attesa del sidecar iroh scaduta. Riconnettiti.",
+			irohInstallConfirm: "Scaricare e verificare ora il sidecar iroh pinnato (circa 15 MB su Windows x64, 24 MB su Linux x64)? Non viene installato altro.",
+			installingIroh: "Download e verifica del sidecar iroh…",
+			switchingIroh: "Passaggio a iroh…",
+			reconnectingIroh: "Riconnessione del trasporto iroh…",
+			resetIrohConfirm: "Disattivare il canale iroh? Complemento e abbinamenti restano installati."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			irohName: "iroh（实验性）",
+			irohExperimental: "实验性",
+			irohNotReady: "iroh 通道未运行，请先启动通道再生成配对码。",
+			irohPairingFailed: "无法打开 iroh 配对窗口，请重连通道后重试。",
+			irohPairingTitle: "手机配对（实验性）",
+			generateIrohQr: "生成 iroh 配对二维码",
+			enlargeQr: "放大二维码",
+			closeEnlargedQr: "关闭放大的二维码",
+			irohPairingReady: "iroh 配对码 {code} 已生效，有效期 5 分钟。请在 App 的 iroh 配对页扫码；再生成一个会替换当前这个。",
+			irohDescription: "加密直连，失败时走中继。不需要公网域名或隧道账号。",
+			prepareIroh: "准备 iroh",
+			irohInstallNote: "点击安装会下载固定的 sidecar 发行版（dsh-mobile-iroh 0.1.0-alpha.1，Windows x64 约 15 MB，Linux x64 约 24 MB）到插件私有目录并校验 SHA-256；已安装的配套插件如有校验通过的副本会直接复用，不再下载。",
+			irohComponentNote: "已安装的 sidecar 每次使用都会重新校验 SHA-256。它不随插件包发布；配套提供的副本只能通过移除配套插件来删除。",
+			irohPhaseNote: "实验性连接。需使用含 iroh 的 Android App 0.7.0 及以上完整版；兼容版 APK 和手机浏览器不支持。",
+			irohUnavailable: "iroh 未就绪：尚未安装 sidecar，点击下方「安装官方组件」下载并校验。",
+			irohStarting: "正在解析 iroh 端点身份…",
+			irohConnecting: "Sidecar 已连接，正在启动 DSH 认证网关…",
+			irohCompanionMissing: "尚无校验通过的 iroh 组件，请点击下方「安装官方组件」；无需另装配套插件。",
+			irohDataDirectoryInvalid: "无法准备 sidecar 私有目录。请确认 DSH 能管理自己的配置目录后重试。",
+			irohSidecarInvalid: "已安装的 sidecar 哈希校验失败，请重装组件。",
+			irohDownloadFailed: "下载 sidecar 失败，还没开始校验。请检查网络后重试。",
+			irohPlatformUnsupported: "iroh sidecar 仅发布 Windows x64 与 Linux x64 版本。",
+			irohIdentityFailed: "无法从 sidecar 读取 iroh 端点身份。",
+			irohLaunchFailed: "iroh sidecar 启动失败。",
+			irohExited: "iroh sidecar 意外退出，请重新连接。",
+			irohTimeout: "等待 iroh sidecar 超时，请重新连接。",
+			irohInstallConfirm: "现在下载并校验固定的 iroh sidecar 吗（Windows x64 约 15 MB，Linux x64 约 24 MB）？不会安装其他任何内容。",
+			installingIroh: "正在下载并校验 iroh sidecar…",
+			switchingIroh: "正在切换到 iroh…",
+			reconnectingIroh: "正在重连 iroh 传输…",
+			resetIrohConfirm: "要停用 iroh 通道吗？配套插件与配对不受影响。"
+		});
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
 			requestTimeout: "The operation timed out. Confirm that DSH is still running, then try again.",
 			diagnostics: "Diagnostics",
@@ -7857,25 +7956,64 @@ window.__ModuleLoader__.load({
 		function ownsMobileCustomization(gateway, frontend) {
 			return gateway === true || frontend === "dedicated";
 		}
-		/** Emit each safe failure once until recovery, and ignore work after cancellation or disposal. */
+		/**
+		* Emit each safe failure once until recovery, and ignore work after cancellation
+		* or disposal.
+		*
+		* A failure that only reaches the console is invisible to the user, who sees the
+		* customization disappear and cannot tell it from a third-party plugin bug
+		* (issue #298). The reporter therefore also publishes its current state so the
+		* page can render a visible, localized notice with an explicit recovery action.
+		* @param locale - resolves the active UI locale for the copy.
+		* @param output - console sink for the developer-facing line.
+		* @returns the reporting calls plus a subscribable snapshot.
+		*/
 		function createMobileAssetLoadReporter(locale, output = console) {
 			const reported = /* @__PURE__ */ new Set();
+			const listeners = /* @__PURE__ */ new Set();
 			let disposed = false;
+			const visible = () => {
+				if (reported.has("authentication_required")) return "authentication_required";
+				if (reported.has("gateway_required")) return "gateway_required";
+				return reported.values().next().done === true ? void 0 : reported.values().next().value;
+			};
+			const publish = () => {
+				const state = visible();
+				for (const listener of listeners) try {
+					listener(state);
+				} catch (error) {}
+			};
 			return {
 				fail(reason, signal) {
 					if (disposed || signal?.aborted === true || reported.has(reason)) return;
 					if (reason === "resource_unavailable" && reported.has("authentication_required")) return;
 					reported.add(reason);
 					output.warn(`[DSH Mobile] ${COPY[locale()][reason]}`);
+					publish();
 				},
 				recover(signal) {
 					if (disposed || signal.aborted || reported.size === 0) return;
 					reported.clear();
 					output.info(`[DSH Mobile] ${COPY[locale()].recovered}`);
+					publish();
 				},
 				dispose() {
 					disposed = true;
 					reported.clear();
+					listeners.clear();
+				},
+				getState() {
+					return disposed ? void 0 : visible();
+				},
+				subscribe(listener) {
+					if (disposed) return () => {};
+					listeners.add(listener);
+					return () => {
+						listeners.delete(listener);
+					};
+				},
+				message(reason) {
+					return COPY[locale()][reason];
 				}
 			};
 		}
@@ -7925,6 +8063,125 @@ window.__ModuleLoader__.load({
 			}
 		}
 		//#endregion
+		//#region src/mobile-customization-notice.ts
+		/** Copy for the notice, per locale, kept beside the existing dictionaries. */
+		const NOTICE_COPY = {
+			en: {
+				title: {
+					authentication_required: "Device authentication is unavailable.",
+					gateway_required: "Custom mobile CSS, scripts and extensions need the paired Mobile access entry.",
+					other: "Mobile customization could not be loaded."
+				},
+				action: "Retry loading",
+				dismiss: "Dismiss"
+			},
+			zh: {
+				title: {
+					authentication_required: "设备认证暂不可用。",
+					gateway_required: "自定义移动样式、脚本与扩展需要通过已配对的移动访问入口打开。",
+					other: "移动定制加载失败。"
+				},
+				action: "重试加载",
+				dismiss: "忽略"
+			},
+			it: {
+				title: {
+					authentication_required: "Autenticazione del dispositivo non disponibile.",
+					gateway_required: "CSS, script ed estensioni mobili richiedono l’accesso Mobile abbinato.",
+					other: "Impossibile caricare la personalizzazione mobile."
+				},
+				action: "Riprova il caricamento",
+				dismiss: "Ignora"
+			}
+		};
+		const NOTICE_ATTRIBUTE = "data-dsh-mobile-customization-notice";
+		const NOTICE_STYLES = `
+[${NOTICE_ATTRIBUTE}]{position:fixed;z-index:1000;left:8px;right:8px;bottom:calc(env(safe-area-inset-bottom) + 8px);display:flex;align-items:flex-start;gap:10px;box-sizing:border-box;padding:10px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:0 8px 24px rgb(15 23 42 / 18%);font:13px/1.45 system-ui;color:var(--dsw-alias-label-primary,#16181d)}
+[${NOTICE_ATTRIBUTE}][hidden]{display:none}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{flex:1 1 auto;min-width:0}
+[${NOTICE_ATTRIBUTE}] button{flex:none;box-sizing:border-box;min-height:44px;min-width:44px;padding:0 10px;border:1px solid transparent;border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#16181d);font:600 13px/1.2 system-ui;cursor:pointer}
+[${NOTICE_ATTRIBUTE}] button.dshm-notice-action{background:var(--dsw-alias-state-business-primary,#2563eb);color:#fff;border-color:transparent}
+[${NOTICE_ATTRIBUTE}] button:hover{opacity:.9}
+[${NOTICE_ATTRIBUTE}]{max-height:40vh;overflow:auto;left:max(8px,env(safe-area-inset-left));right:max(8px,env(safe-area-inset-right));flex-wrap:wrap}
+[${NOTICE_ATTRIBUTE}] .dshm-notice-text{margin:0;flex-basis:100%}
+[${NOTICE_ATTRIBUTE}] button:focus-visible{outline:2px solid currentColor;outline-offset:2px}
+[${NOTICE_ATTRIBUTE}]{background-color:Canvas;background-image:linear-gradient(var(--dsw-alias-bg-layer-2,Canvas),var(--dsw-alias-bg-layer-2,Canvas));color:var(--dsw-alias-label-primary,CanvasText)}
+`;
+		/** Copy key for a failure, so the notice and the console never disagree. */
+		function titleKey(reason) {
+			return reason === "authentication_required" || reason === "gateway_required" ? reason : "other";
+		}
+		/**
+		* Mount one visible notice that follows the customization reporter's state.
+		* @param document - the page that owns the notice.
+		* @param options - locale lookup and the reconnect action.
+		* @returns a disposer that removes the notice and its stylesheet.
+		*/
+		function installCustomizationNotice(document, options) {
+			if (!(typeof document.createElement === "function" && typeof document.body?.append === "function" && typeof document.head?.append === "function")) return () => {};
+			const style = document.createElement("style");
+			style.dataset.plugin = "dsh-mobile-notice";
+			style.textContent = NOTICE_STYLES;
+			document.head.append(style);
+			const notice = document.createElement("div");
+			if (typeof notice.setAttribute !== "function" || typeof notice.append !== "function") {
+				style.remove();
+				return () => {};
+			}
+			notice.setAttribute(NOTICE_ATTRIBUTE, "");
+			notice.setAttribute("role", "status");
+			notice.setAttribute("aria-live", "polite");
+			notice.hidden = true;
+			const text = document.createElement("p");
+			text.className = "dshm-notice-text";
+			const action = document.createElement("button");
+			action.type = "button";
+			action.className = "dshm-notice-action";
+			const dismiss = document.createElement("button");
+			dismiss.type = "button";
+			notice.append(text, action, dismiss);
+			document.body.append(notice);
+			let current;
+			let dismissed;
+			const render = () => {
+				const copy = NOTICE_COPY[options.locale()] ?? NOTICE_COPY.en;
+				if (current === void 0 || current === dismissed) {
+					notice.hidden = true;
+					return;
+				}
+				const detail = options.message(current);
+				text.textContent = `${copy.title[titleKey(current)]} ${detail}`;
+				action.textContent = copy.action;
+				dismiss.textContent = copy.dismiss;
+				notice.hidden = false;
+			};
+			let disposed = false;
+			const retry = () => {
+				if (!disposed) options.reconnect();
+			};
+			const close = () => {
+				if (disposed) return;
+				dismissed = current;
+				render();
+			};
+			action.addEventListener("click", retry);
+			dismiss.addEventListener("click", close);
+			const unsubscribe = options.subscribe((reason) => {
+				if (reason !== current) dismissed = void 0;
+				current = reason;
+				render();
+			});
+			render();
+			return () => {
+				disposed = true;
+				action.removeEventListener("click", retry);
+				dismiss.removeEventListener("click", close);
+				unsubscribe();
+				notice.remove();
+				style.remove();
+			};
+		}
+		//#endregion
 		//#region src/extension-limits.ts
 		/** Maximum sizes accepted for legacy mobile customization resources. */
 		const LEGACY_CUSTOM_ASSET_LIMIT = 262144;
@@ -7948,6 +8205,25 @@ window.__ModuleLoader__.load({
 		function shouldRenewSession(connection, downForMs) {
 			return isDisconnected(connection) && downForMs >= 5e3;
 		}
+		/**
+		* Authentication rejection can warrant one renewal even while transport appears
+		* connected. A 403 can also indicate a permission failure, so it is not proof
+		* that the Session expired.
+		*
+		* Issue #298: DSH keeps Sessions in memory, so a Host restart kills every phone
+		* Session while the device credential survives. The live WebSocket can keep
+		* reporting `connected` for a while, so waiting for a disconnect never fires and
+		* the customization channel stays dark. A 401/403 on an authenticated gateway
+		* request is the signal that actually arrives, and it must be able to start the
+		* same renewal the disconnect path uses.
+		* @param status - HTTP status of a rejected gateway request.
+		* @param connection - current public connection state, if known.
+		* @returns whether this rejection should request a renewal.
+		*/
+		function shouldRenewAfterRejection(status, connection) {
+			if (status !== 401 && status !== 403) return false;
+			return !isDisconnected(connection) || connection === void 0;
+		}
 		function isDisconnected(connection) {
 			return connection === "connecting" || connection === "disconnected";
 		}
@@ -7956,9 +8232,12 @@ window.__ModuleLoader__.load({
 		* @param getConnection - Resolve the current service to reject a replaced owner.
 		* @param page - The document's window and advertised native adapter.
 		* @param document - The mounted document; page replacement withdraws its work.
+		* @param onRejected - receives the rejection signal, so a caller that observes a
+		* 401 can ask this same owner for one renewal instead of starting its own.
+		* @param onRenewed - refresh read-only customization after confirmed Cookie installation.
 		* @returns An awaited disposer, or nothing when no public connection is present.
 		*/
-		function installMobileConnectionRecovery(getConnection, page, document) {
+		function installMobileConnectionRecovery(getConnection, page, document, onRejected, onRenewed) {
 			const connection = getConnection();
 			const state = connection?.state;
 			if (connection === void 0 || state === void 0 || typeof connection.reconnect !== "function") return;
@@ -7968,6 +8247,8 @@ window.__ModuleLoader__.load({
 			let currentState = state.getSnapshot();
 			let downSince = isDisconnected(currentState) ? Date.now() : void 0;
 			let attempted = false;
+			let credentialsRejected = false;
+			let rejectedSince;
 			let bridge = page.__DSH_MOBILE_NATIVE__;
 			let pending;
 			let pendingAbort;
@@ -7981,8 +8262,13 @@ window.__ModuleLoader__.load({
 				const next = state.getSnapshot();
 				if (!isDisconnected(next)) {
 					downSince = void 0;
-					attempted = false;
-					if (currentState !== next) cancelPending();
+					if (currentState !== next) {
+						if (next === "connected") {
+							rejectedSince = void 0;
+							attempted = false;
+						}
+						cancelPending();
+					}
 				} else if (downSince === void 0) {
 					downSince = Date.now();
 					attempted = false;
@@ -7999,30 +8285,63 @@ window.__ModuleLoader__.load({
 			const renew = () => {
 				if (!current()) {
 					dispose();
-					return;
+					return false;
 				}
 				updateState();
 				updateBridge();
 				const adapter = bridge;
-				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || downSince === void 0 || !shouldRenewSession(currentState, Date.now() - downSince)) return;
+				const downLongEnough = downSince !== void 0 && shouldRenewSession(currentState, Date.now() - downSince);
+				const rejectionPending = rejectedSince !== void 0;
+				if (document.visibilityState !== "visible" || adapter === void 0 || pending !== void 0 || attempted || credentialsRejected || !downLongEnough && !rejectionPending) return false;
 				attempted = true;
 				const owner = generation;
 				const abort = new AbortController();
 				pendingAbort = abort;
-				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter && isDisconnected(state.getSnapshot());
+				const owns = () => current() && !abort.signal.aborted && generation === owner && page.__DSH_MOBILE_NATIVE__ === adapter;
 				const task = Promise.resolve().then(async () => {
 					if (!owns()) return;
 					const capabilities = await adapter.capabilities();
 					if (!owns() || !capabilities.includes("auth.renew")) return;
 					const result = await adapter.invoke("auth.renew", {}, { signal: abort.signal });
 					if (!owns() || typeof result !== "object" || result === null || !("renewed" in result) || result.renewed !== true) return;
+					rejectedSince = void 0;
 					connection.reconnect?.();
-				}).catch((_error) => {}).finally(() => {
+					if (current()) onRenewed?.();
+				}).catch((error) => {
+					if (!owns() || typeof error !== "object" || error === null || !("code" in error)) return;
+					credentialsRejected = error.code === "device_revoked" || error.code === "device_expired" || error.code === "authentication_failed";
+				}).finally(() => {
 					if (pending !== task) return;
 					pending = void 0;
 					pendingAbort = void 0;
 				});
 				pending = task;
+				return true;
+			};
+			const retry = () => {
+				if (!current()) return false;
+				updateState();
+				updateBridge();
+				if (!current() || pending !== void 0 || credentialsRejected || bridge === void 0 || rejectedSince === void 0 && downSince === void 0) return false;
+				attempted = false;
+				return renew();
+			};
+			/**
+			* Record a rejected authenticated request and try the same single renewal.
+			*
+			* Only an owner that is still current and has not already attempted may act, so
+			* a burst of 401s cannot start parallel renewals, and a revoked device cannot
+			* keep retrying: revocation arrives as 401 too, but the native bridge refuses
+			* `auth.renew` and the attempt is not restarted.
+			* @param status - HTTP status the gateway returned.
+			*/
+			const rejected = (status) => {
+				if (!current()) return;
+				updateState();
+				updateBridge();
+				if (!shouldRenewAfterRejection(status, state.getSnapshot())) return;
+				rejectedSince ??= Date.now();
+				renew();
 			};
 			const resume = () => {
 				if (!current()) {
@@ -8054,6 +8373,7 @@ window.__ModuleLoader__.load({
 			document.addEventListener("visibilitychange", resume);
 			page.addEventListener("dsh-mobile-native-ready", updateBridge);
 			page.addEventListener("pagehide", pagehide);
+			onRejected?.(rejected, retry);
 			return dispose;
 		}
 		//#endregion
@@ -8145,7 +8465,8 @@ window.__ModuleLoader__.load({
 			draft: "",
 			error: null,
 			hostBusy: false,
-			committed: false
+			committed: false,
+			creating: false
 		});
 		/** Read navigation stops on close; committing is final until the owner withdraws this flow. */
 		var MobileDirectoryBrowser = class {
@@ -8199,6 +8520,14 @@ window.__ModuleLoader__.load({
 					hostBusy
 				});
 			}
+			/** Block navigation/adoption while this flow's child-folder editor owns interaction. */
+			setCreating(creating) {
+				if (this.disposed || this.snapshot.creating === creating) return;
+				this.publish({
+					...this.snapshot,
+					creating
+				});
+			}
 			/** Read a folder or the initial home; superseded results cannot publish into the new request. */
 			navigate(path) {
 				if (!this.canNavigate()) return false;
@@ -8281,7 +8610,7 @@ window.__ModuleLoader__.load({
 			}
 			/** Cancel reading immediately; a committed/Host-busy adoption cannot be reported as cancelled. */
 			cancel() {
-				if (!this.canNavigate()) return false;
+				if (!this.canClose()) return false;
 				this.withdrawRead();
 				this.publish(CLOSED);
 				return true;
@@ -8295,9 +8624,12 @@ window.__ModuleLoader__.load({
 				await Promise.allSettled([...this.tasks]);
 				if (this.taskFailures.length > 0) throw new AggregateError(this.taskFailures, "Mobile directory observers failed during a listing");
 			}
-			canNavigate() {
+			canClose() {
 				return !this.disposed && this.snapshot.open && !this.snapshot.hostBusy && !this.snapshot.committed;
 			}
+			canNavigate() {
+				return this.canClose() && !this.snapshot.creating;
+			}
 			current(generation) {
 				return !this.disposed && this.snapshot.open && generation === this.generation;
 			}
@@ -8311,6 +8643,171 @@ window.__ModuleLoader__.load({
 				for (const listener of this.listeners) listener();
 			}
 		};
+		/** A creation failure without raw response bodies or filesystem details. */
+		var MobileDirectoryCreateError = class extends Error {
+			code;
+			constructor(code) {
+				super(`Mobile directory creation failed: ${code}`);
+				this.code = code;
+				this.name = "MobileDirectoryCreateError";
+			}
+		};
+		/** Portable single-segment validation; the Host additionally enforces its filesystem rules. */
+		function isMobileDirectoryName(name) {
+			return name.trim() !== "" && name.length <= 255 && name !== "." && name !== ".." && !/[\\/\0]/u.test(name);
+		}
+		const CREATE_CLOSED = Object.freeze({
+			open: false,
+			parent: null,
+			name: "",
+			pending: false,
+			error: null
+		});
+		/** Owns one non-replayed write, its deadline, cancellation and physical teardown. */
+		var MobileDirectoryCreator = class {
+			create;
+			onCreated;
+			deadlineMs;
+			snapshot = CREATE_CLOSED;
+			listeners = /* @__PURE__ */ new Set();
+			tasks = /* @__PURE__ */ new Set();
+			failures = [];
+			active;
+			generation = 0;
+			disposed = false;
+			constructor(create, onCreated, deadlineMs = 3e4) {
+				this.create = create;
+				this.onCreated = onCreated;
+				this.deadlineMs = deadlineMs;
+			}
+			getSnapshot = () => this.snapshot;
+			/** Subscribe to this editor; the returned disposer withdraws the observer. */
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => {
+					this.listeners.delete(listener);
+				};
+			}
+			/** Open against one already confirmed parent; cancelled physical work retains admission. */
+			open(parent) {
+				if (this.disposed || this.snapshot.open || this.tasks.size > 0 || !isMobileDirectoryPath(parent)) return false;
+				this.publish({
+					...CREATE_CLOSED,
+					open: true,
+					parent
+				});
+				return true;
+			}
+			/** Edit only while no write is in flight; typing never starts a filesystem operation. */
+			setName(name) {
+				if (this.disposed || !this.snapshot.open || this.snapshot.pending) return;
+				this.publish({
+					...this.snapshot,
+					name,
+					error: null
+				});
+			}
+			/** Admit one explicit creation. Repeated clicks/Enter cannot replay an admitted request. */
+			submit() {
+				if (this.disposed || !this.snapshot.open || this.snapshot.pending || this.tasks.size > 0 || this.snapshot.parent === null) return false;
+				const name = this.snapshot.name.trim();
+				if (!isMobileDirectoryName(name)) {
+					this.publish({
+						...this.snapshot,
+						error: "invalid-name"
+					});
+					return false;
+				}
+				const parent = this.snapshot.parent;
+				const generation = this.generation;
+				const controller = new AbortController();
+				this.active = controller;
+				this.publish({
+					...this.snapshot,
+					pending: true,
+					error: null
+				});
+				if (!this.current(generation) || controller.signal.aborted) {
+					if (this.active === controller) this.active = void 0;
+					if (!this.disposed) this.publish({
+						...this.snapshot,
+						pending: false
+					});
+					return false;
+				}
+				const timer = setTimeout(() => {
+					controller.abort(new MobileDirectoryCreateError("timeout"));
+					if (this.current(generation)) this.publish({
+						...this.snapshot,
+						error: "timeout"
+					});
+				}, this.deadlineMs);
+				const task = (async () => {
+					let created;
+					try {
+						created = await this.create(parent, name, controller.signal);
+						controller.signal.throwIfAborted();
+						if (!isMobileDirectoryPath(created)) throw new MobileDirectoryCreateError("invalid-response");
+					} catch (error) {
+						created = void 0;
+						if (this.current(generation)) {
+							const failure = controller.signal.aborted ? controller.signal.reason : error;
+							this.publish({
+								...this.snapshot,
+								error: failure instanceof MobileDirectoryCreateError ? failure.code : "request-failed"
+							});
+						}
+					} finally {
+						clearTimeout(timer);
+						if (this.active === controller) this.active = void 0;
+						if (!this.disposed) this.publish({
+							...this.snapshot,
+							pending: false
+						});
+					}
+					if (created !== void 0 && this.current(generation)) {
+						this.publish(CREATE_CLOSED);
+						this.onCreated(created);
+					}
+				})();
+				this.tasks.add(task);
+				task.then(() => {
+					this.tasks.delete(task);
+				}, (error) => {
+					this.tasks.delete(task);
+					this.failures.push(error);
+				});
+				return true;
+			}
+			/** Withdraw the editor and late results; an already completed mkdir is not rolled back. */
+			close() {
+				if (this.disposed || !this.snapshot.open) return false;
+				this.generation++;
+				this.active?.abort();
+				this.publish({
+					...CREATE_CLOSED,
+					pending: this.active !== void 0
+				});
+				return true;
+			}
+			/** Stop admission synchronously and await every accepted write before completion. */
+			async dispose() {
+				this.disposed = true;
+				this.generation++;
+				this.active?.abort();
+				this.snapshot = CREATE_CLOSED;
+				this.listeners.clear();
+				await Promise.allSettled([...this.tasks]);
+				if (this.failures.length > 0) throw new AggregateError(this.failures, "Mobile directory creation observers failed");
+			}
+			current(generation) {
+				return !this.disposed && this.snapshot.open && generation === this.generation;
+			}
+			publish(snapshot) {
+				this.snapshot = Object.freeze(snapshot);
+				for (const listener of this.listeners) listener();
+			}
+		};
 		//#endregion
 		//#region src/mobile-directory-picker.ts
 		/** Dedicated Mobile directory-flow occupant; stock DSH retains its own chooser. */
@@ -8335,7 +8832,17 @@ window.__ModuleLoader__.load({
 				"invalid-response": "目录响应不可用，请重试或重新连接电脑",
 				"request-failed": "读取目录失败，请检查连接后重试",
 				timeout: "读取目录超时，请重试或取消",
-				failedOpen: "无法打开目录选择器，请重新连接后重试"
+				failedOpen: "无法打开目录选择器，请重新连接后重试",
+				create: "新建文件夹",
+				createTitle: "新建文件夹名称",
+				createAction: "创建",
+				createInvalid: "请输入单个文件夹名称，不能包含路径分隔符。",
+				createExists: "同名文件夹已存在。",
+				createFailed: "无法创建文件夹，请检查该目录的写入权限后重试。",
+				createParent: "创建位置",
+				creating: "正在创建文件夹…",
+				createStopping: "正在结束创建请求…",
+				createUnknown: "无法确认创建结果，文件夹可能已创建。请返回并重新读取目录，确认后再决定是否重试。"
 			},
 			en: {
 				title: "Select workspace directory",
@@ -8357,7 +8864,17 @@ window.__ModuleLoader__.load({
 				"invalid-response": "The directory response is unavailable. Retry or reconnect to the computer.",
 				"request-failed": "Could not load this directory. Check the connection and retry.",
 				timeout: "Loading timed out. Retry or cancel.",
-				failedOpen: "Could not open the directory picker. Reconnect and retry."
+				failedOpen: "Could not open the directory picker. Reconnect and retry.",
+				create: "New folder",
+				createTitle: "New folder name",
+				createAction: "Create",
+				createInvalid: "Enter a single folder name without path separators.",
+				createExists: "A folder with that name already exists.",
+				createFailed: "Could not create the folder. Check write access to this directory and retry.",
+				createParent: "Create in",
+				creating: "Creating folder…",
+				createStopping: "Finishing the creation request…",
+				createUnknown: "The creation result is unknown; the folder may already exist. Go back and reload the directory before deciding whether to retry."
 			},
 			it: {
 				title: "Seleziona la cartella del workspace",
@@ -8378,11 +8895,21 @@ window.__ModuleLoader__.load({
 				unauthorized: "Autorizzazione non disponibile. Chiudi questa finestra e riconnettiti al computer.",
 				"invalid-response": "Risposta della cartella non disponibile. Riprova o riconnettiti al computer.",
 				"request-failed": "Impossibile caricare la cartella. Controlla la connessione e riprova.",
+				create: "Nuova cartella",
+				createTitle: "Nome della nuova cartella",
+				createAction: "Crea",
+				createInvalid: "Inserisci un singolo nome di cartella senza separatori di percorso.",
+				createExists: "Esiste già una cartella con questo nome.",
+				createFailed: "Impossibile creare la cartella. Controlla i permessi di scrittura e riprova.",
 				timeout: "Caricamento scaduto. Riprova o annulla.",
-				failedOpen: "Impossibile aprire la selezione della cartella. Riconnettiti e riprova."
+				failedOpen: "Impossibile aprire la selezione della cartella. Riconnettiti e riprova.",
+				createParent: "Crea in",
+				creating: "Creazione della cartella…",
+				createStopping: "Chiusura della richiesta di creazione…",
+				createUnknown: "Esito della creazione sconosciuto: la cartella potrebbe già esistere. Torna indietro e ricarica la directory prima di riprovare."
 			}
 		};
-		/** Authenticated read-only Gateway route; no native picker or Host service is replaced. */
+		/** Authenticated directory browsing/creation route; no native picker or Host service is replaced. */
 		const WORKSPACE_DIRECTORIES_PATH = "/mobile-access/workspace-directories";
 		/** Ask only this plugin's live directory dialog to handle a routed native Back. */
 		function dismissMobileDirectoryPicker(dialog) {
@@ -8399,6 +8926,32 @@ window.__ModuleLoader__.load({
 			}
 			return "en";
 		}
+		/** Create one child directory through the same authenticated route that lists them. */
+		async function createDirectory(path, name, signal) {
+			const response = await fetch(WORKSPACE_DIRECTORIES_PATH, {
+				method: "POST",
+				credentials: "same-origin",
+				cache: "no-store",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					path,
+					name
+				}),
+				signal
+			});
+			if (!response.ok) {
+				const code = response.status === 409 ? "directory-exists" : response.status === 400 ? "directory-create-failed" : response.status === 401 || response.status === 403 ? "unauthorized" : "directory-create-failed";
+				try {
+					await response.body?.cancel();
+				} catch (error) {
+					throw new MobileDirectoryCreateError(code);
+				}
+				throw new MobileDirectoryCreateError(code);
+			}
+			const payload = await response.json();
+			if (typeof payload?.path !== "string" || !isMobileDirectoryPath(payload.path)) throw new MobileDirectoryCreateError("invalid-response");
+			return payload.path;
+		}
 		async function readDirectories(path, signal) {
 			const query = path === null ? "" : `?path=${encodeURIComponent(path)}`;
 			const response = await fetch(`${WORKSPACE_DIRECTORIES_PATH}${query}`, {
@@ -8424,25 +8977,51 @@ window.__ModuleLoader__.load({
 		const STYLES = `
 dialog.dshm-picker{position:fixed;inset:0;box-sizing:border-box;width:100%;max-width:none;height:100%;max-height:none;margin:0;padding:max(16px,env(safe-area-inset-top)) max(16px,env(safe-area-inset-right)) max(16px,env(safe-area-inset-bottom)) max(16px,env(safe-area-inset-left));border:0;background:transparent;color:var(--dsw-alias-label-primary,#16181d);font:400 14px/1.5 system-ui;overflow:hidden}
 dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::backdrop{background:rgb(0 0 0 / 42%)}
-.dshm-picker__panel{display:flex;flex-direction:column;box-sizing:border-box;width:min(680px,100%);height:min(500px,100%);min-height:0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dde0e4);border-radius:16px;background:var(--dsw-alias-bg-layer-1,#fff);box-shadow:0 16px 56px rgb(0 0 0 / 18%)}
-.dshm-picker__header{display:flex;align-items:center;flex:none;gap:12px;padding:12px 16px;border-bottom:1px solid var(--dsw-alias-border-l2,#dde0e4)}
-.dshm-picker__title{flex:1;min-width:0;margin:0;font-size:16px;font-weight:500;overflow-wrap:anywhere}
-.dshm-picker__toolbar{display:flex;flex-wrap:wrap;gap:8px;flex:none;padding:12px 16px 8px}.dshm-picker__path-label{flex:1;min-width:min(180px,100%);display:flex;flex-direction:column;gap:4px;font-size:12px;color:var(--dsw-alias-label-secondary,#606873)}
-.dshm-picker__path{box-sizing:border-box;width:100%;min-width:0;min-height:48px;padding:10px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:400 16px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace}
+.dshm-picker__panel{display:flex;flex-direction:column;box-sizing:border-box;width:min(680px,100%);height:min(720px,100%);min-height:0;overflow:hidden;border:0;border-radius:20px;box-shadow:0 0 0 .5px rgba(0 0 0 / 16%),0 3px 8px rgba(0 0 0 / 4%);background:var(--dsw-alias-bg-layer-1,#fff)}
+.dshm-picker__header{display:flex;align-items:center;flex:none;gap:8px;padding:4px 8px 4px 12px;border-bottom:1px solid var(--dsw-alias-border-l2,#dde0e4)}
+.dshm-picker__title{flex:1;min-width:0;margin:0;font-size:16px;font-weight:510;line-height:24px;overflow-wrap:anywhere}
+.dshm-picker__toolbar{display:flex;align-items:center;flex-wrap:nowrap;gap:8px;flex:none;padding:8px 10px}.dshm-picker__path-label{flex:1;min-width:0;display:flex;color:var(--dsw-alias-label-secondary,#606873)}
+.dshm-picker__path-caption{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip-path:inset(50%);white-space:nowrap}
+.dshm-picker__path{box-sizing:border-box;width:100%;min-width:0;min-height:44px;padding:6px 8px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:8px;background:var(--dsw-alias-bg-layer-2,#f7f8fa);color:var(--dsw-alias-label-primary,#16181d);font:400 16px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace}
 .dshm-picker__path[aria-invalid=true]{border-color:var(--dsw-alias-state-error-primary,#b42318)}.dshm-picker__go{align-self:flex-end}
-.dshm-picker__navigation{display:flex;flex:none;gap:8px;padding:0 16px 8px}.dshm-picker__navigation .dshm-picker__button{flex:1;white-space:normal}
-.dshm-picker__list{flex:1;min-height:0;margin:0;padding:4px 12px;overflow:auto;overscroll-behavior:contain;list-style:none;scroll-padding:4px}
-.dshm-picker__row{display:flex;align-items:center;gap:12px;box-sizing:border-box;width:100%;min-height:48px;padding:10px 12px;border:0;border-radius:8px;background:transparent;color:inherit;font:inherit;text-align:left;cursor:pointer;touch-action:manipulation}
+.dshm-picker__navigation{display:flex;flex:none;gap:8px;padding:0}
+.dshm-picker__list{flex:1;min-height:0;margin:0;padding:0 10px 4px;overflow:auto;overscroll-behavior:contain;list-style:none;scroll-padding:4px}
+.dshm-picker__row{display:flex;align-items:center;gap:8px;box-sizing:border-box;width:100%;min-height:44px;padding:6px 8px;border:0;border-radius:8px;background:transparent;color:inherit;font:inherit;text-align:left;cursor:pointer;touch-action:manipulation}
 .dshm-picker__folder{flex:none;width:20px;height:20px;color:var(--dsw-alias-label-secondary,#606873)}
 .dshm-picker__name{flex:1;min-width:0;overflow-wrap:anywhere}.dshm-picker__row:hover:not(:disabled),.dshm-picker__button:hover:not(:disabled){background:var(--dsw-alias-interactive-bg-hover,#eef1f5)}
 .dshm-picker__row:active:not(:disabled),.dshm-picker__button:active:not(:disabled){background:var(--dsw-alias-interactive-bg-active,#e4e8ee)}
-.dshm-picker__button{flex:none;box-sizing:border-box;min-width:48px;min-height:48px;padding:10px 14px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:transparent;color:inherit;font:500 14px/1.4 system-ui;cursor:pointer;touch-action:manipulation}
+.dshm-picker__button{flex:none;box-sizing:border-box;min-width:44px;min-height:44px;padding:6px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:8px;background:transparent;color:inherit;font:500 14px/1.4 system-ui;cursor:pointer;touch-action:manipulation}
+.dshm-picker__icon{display:inline-flex;align-items:center;justify-content:center;width:44px;padding:0;border-color:transparent}.dshm-picker__icon>svg{display:block;width:18px;height:18px}
 .dshm-picker :is(button,input):focus-visible{outline:2px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px}.dshm-picker button:disabled{opacity:.5;cursor:default}
-.dshm-picker__status{flex:none;margin:0;padding:8px 16px;font-size:13px;color:var(--dsw-alias-label-secondary,#606873);overflow-wrap:anywhere}.dshm-picker__error{color:var(--dsw-alias-state-error-primary,#b42318)}
-.dshm-picker__status[hidden],.dshm-picker__button[hidden]{display:none}.dshm-picker__footer{display:flex;align-items:center;justify-content:flex-end;flex-wrap:wrap;flex:none;gap:8px;padding:12px 16px;border-top:1px solid var(--dsw-alias-border-l2,#dde0e4)}
-.dshm-picker__confirm{border-color:transparent;background:var(--dsw-alias-button-primary-fill,#2563eb);color:var(--dsw-alias-label-primary-foreground,#fff)}.dshm-picker__confirm:hover:not(:disabled),.dshm-picker__confirm:active:not(:disabled){background:var(--dsw-alias-button-primary-hover,#1d4ed8)}
-@media(max-width:420px){dialog.dshm-picker{padding:max(8px,env(safe-area-inset-top)) max(8px,env(safe-area-inset-right)) max(8px,env(safe-area-inset-bottom)) max(8px,env(safe-area-inset-left))}.dshm-picker__header,.dshm-picker__toolbar,.dshm-picker__footer{padding-left:12px;padding-right:12px}.dshm-picker__footer .dshm-picker__button{flex:1}.dshm-picker__path-label{min-width:0}}
+.dshm-picker [hidden]{display:none!important}.dshm-picker__create{flex:1;min-height:0;overflow:auto;display:flex;flex-direction:column;gap:8px;padding:12px 16px}
+.dshm-picker__create-title{margin:0;font-size:13px;color:var(--dsw-alias-label-secondary,#606873)}
+.dshm-picker__create-input{box-sizing:border-box;width:100%;min-width:0;min-height:48px;padding:10px 12px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#f7f8fa);color:var(--dsw-alias-label-primary,#0f1115);font:inherit;font-size:16px;line-height:1.4}
+.dshm-picker__create-actions{display:flex;justify-content:flex-end;gap:8px}.dshm-picker__create-error{color:var(--dsw-alias-state-error-primary,#b42318)}
+.dshm-picker__create-trigger{margin-right:auto;border-color:transparent;padding-left:8px;padding-right:8px}
+.dshm-picker__status{flex:none;margin:0;padding:4px 10px;font-size:13px;color:var(--dsw-alias-label-secondary,#606873);overflow-wrap:anywhere}.dshm-picker__error{color:var(--dsw-alias-state-error-primary,#b42318)}
+.dshm-picker__status[hidden],.dshm-picker__button[hidden]{display:none}.dshm-picker__footer{display:flex;align-items:center;justify-content:flex-end;flex-wrap:wrap;flex:none;gap:8px;padding:6px 10px;border-top:1px solid var(--dsw-alias-border-l2,#dde0e4)}
+.dshm-picker__confirm{min-width:72px;border-color:transparent;background:var(--dsw-alias-button-primary-fill,#2563eb);color:var(--dsw-alias-label-primary-foreground,#fff)}.dshm-picker__confirm:hover:not(:disabled),.dshm-picker__confirm:active:not(:disabled){background:var(--dsw-alias-button-primary-hover,#1d4ed8)}
+@media(max-width:420px){dialog.dshm-picker{padding:max(8px,env(safe-area-inset-top)) max(8px,env(safe-area-inset-right)) max(8px,env(safe-area-inset-bottom)) max(8px,env(safe-area-inset-left))}}
 `;
+		/**
+		* Whether DSH's own browse directory picker is already mounted on this page.
+		*
+		* DSH's adaptive `directory-picker` resolves to
+		* `@deepseek-ai/dsh-host-directory-picker-auto`, which mounts the Host backend
+		* and the Client face together and picks `browse` whenever the host is remotely
+		* reachable. Its client face fills the same directory-flow slots this plugin
+		* would use, so a plugin-owned picker would shadow the upstream one and take
+		* away its folder creation. The desktop keeps the native OS chooser; a remote
+		* browser can only reach the web implementation.
+		*
+		* @returns true when the upstream browse surface owns those slots on this page.
+		*/
+		function hasUpstreamBrowsePicker(view) {
+			if (!("__DSH_BOOT__" in view)) return false;
+			const graph = view.__DSH_BOOT__;
+			if (typeof graph !== "object" || graph === null || !("entries" in graph) || !Array.isArray(graph.entries)) return false;
+			return graph.entries.some((entry) => typeof entry === "object" && entry !== null && "id" in entry && entry.id === "@deepseek-ai/dsh-client-ui-directory-picker-browse");
+		}
 		function openDirectoryDialog(doc, getProps, trackDisposal) {
 			const view = doc.defaultView;
 			if (view === null) throw new Error("Directory picker requires a browser window");
@@ -8468,18 +9047,40 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (name !== void 0) value.setAttribute(`data-dshm-picker-${name}`, "");
 				return value;
 			};
+			const iconButton = (label, outline, name) => {
+				const value = button("", name);
+				value.classList.add("dshm-picker__icon");
+				value.setAttribute("aria-label", label);
+				value.title = label;
+				const icon = doc.createElementNS("http://www.w3.org/2000/svg", "svg");
+				icon.setAttribute("viewBox", "0 0 24 24");
+				icon.setAttribute("fill", "none");
+				icon.setAttribute("stroke", "currentColor");
+				icon.setAttribute("stroke-width", "1.75");
+				icon.setAttribute("stroke-linecap", "round");
+				icon.setAttribute("stroke-linejoin", "round");
+				icon.setAttribute("aria-hidden", "true");
+				const shape = doc.createElementNS("http://www.w3.org/2000/svg", "path");
+				shape.setAttribute("d", outline);
+				icon.append(shape);
+				value.append(icon);
+				return value;
+			};
 			const header = doc.createElement("header");
 			header.className = "dshm-picker__header";
 			const title = doc.createElement("h2");
 			title.className = "dshm-picker__title";
 			title.textContent = copy.title;
-			const close = button(copy.close);
+			const close = iconButton(copy.close, "M6 6l12 12M6 18L18 6");
 			header.append(title, close);
 			const toolbar = doc.createElement("form");
 			toolbar.className = "dshm-picker__toolbar";
 			const pathLabel = doc.createElement("label");
 			pathLabel.className = "dshm-picker__path-label";
-			pathLabel.textContent = copy.path;
+			const pathCaption = doc.createElement("span");
+			pathCaption.className = "dshm-picker__path-caption";
+			pathCaption.textContent = copy.path;
+			pathLabel.append(pathCaption);
 			const path = doc.createElement("input");
 			path.type = "text";
 			path.className = "dshm-picker__path";
@@ -8488,16 +9089,17 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			path.autocomplete = "off";
 			path.maxLength = 8192;
 			pathLabel.append(path);
-			const go = button(copy.go, "load");
+			const go = iconButton(copy.go, "M5 12h14m-6-6 6 6-6 6", "load");
 			go.type = "submit";
 			go.classList.add("dshm-picker__go");
 			toolbar.append(pathLabel, go);
 			const navigation = doc.createElement("nav");
 			navigation.className = "dshm-picker__navigation";
 			navigation.setAttribute("aria-label", copy.title);
-			const home = button(copy.home, "home");
-			const up = button(copy.up, "up");
+			const home = iconButton(copy.home, "m3 10 9-7 9 7v10a1 1 0 0 1-1 1h-5v-7H9v7H4a1 1 0 0 1-1-1Z", "home");
+			const up = iconButton(copy.up, "M12 20V4m-7 7 7-7 7 7", "up");
 			navigation.append(home, up);
+			toolbar.prepend(navigation);
 			const status = doc.createElement("p");
 			status.className = "dshm-picker__status";
 			status.setAttribute("role", "status");
@@ -8513,13 +9115,82 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			footer.className = "dshm-picker__footer";
 			const retry = button(copy.retry, "retry");
 			retry.hidden = true;
+			const create = button(copy.create, "create");
+			create.classList.add("dshm-picker__create-trigger");
 			const cancel = button(copy.cancel, "cancel");
 			const confirm = button(copy.open, "confirm");
 			confirm.classList.add("dshm-picker__confirm");
-			footer.append(retry, cancel, confirm);
-			panel.append(header, toolbar, navigation, status, error, list, footer);
+			const createPanel = doc.createElement("div");
+			createPanel.className = "dshm-picker__create";
+			createPanel.hidden = true;
+			const createTitle = doc.createElement("label");
+			createTitle.className = "dshm-picker__create-title";
+			createTitle.textContent = copy.createTitle;
+			const createInput = doc.createElement("input");
+			createInput.type = "text";
+			createInput.className = "dshm-picker__create-input";
+			createInput.setAttribute("data-dshm-picker-create-name", "");
+			createInput.spellcheck = false;
+			createInput.autocomplete = "off";
+			createInput.maxLength = 255;
+			createTitle.append(createInput);
+			const createParent = doc.createElement("p");
+			createParent.className = "dshm-picker__status";
+			const createStatus = doc.createElement("p");
+			createStatus.className = "dshm-picker__status";
+			createStatus.setAttribute("role", "status");
+			createStatus.setAttribute("aria-live", "polite");
+			const createError = doc.createElement("p");
+			createError.className = "dshm-picker__status dshm-picker__create-error";
+			createError.setAttribute("role", "alert");
+			createError.setAttribute("data-dshm-picker-create-error", "");
+			createError.hidden = true;
+			const createActions = doc.createElement("div");
+			createActions.className = "dshm-picker__create-actions";
+			const createCancel = button(copy.cancel, "create-cancel");
+			const createConfirm = button(copy.createAction, "create-confirm");
+			createActions.append(createCancel, createConfirm);
+			createPanel.append(createParent, createTitle, createError, createStatus, createActions);
+			footer.append(create, retry, cancel, confirm);
+			panel.append(header, toolbar, status, error, list, createPanel, footer);
 			dialog.append(panel);
 			const browser = new MobileDirectoryBrowser(readDirectories);
+			const creator = new MobileDirectoryCreator(createDirectory, (created) => {
+				browser.navigate(created);
+			});
+			let creationNotice = false;
+			let creationNoticeListing = null;
+			const closeCreate = () => {
+				const child = creator.getSnapshot();
+				if (child.pending || child.error === "timeout" || child.error === "request-failed" || child.error === "invalid-response") {
+					creationNotice = true;
+					creationNoticeListing = browser.getSnapshot().listing;
+				}
+				if (creator.close()) {
+					if (create.disabled) close.focus();
+					else create.focus();
+				}
+			};
+			create.addEventListener("click", () => {
+				const parent = browser.getSnapshot().listing?.path;
+				if (!browser.canConfirm() || parent === void 0 || !creator.open(parent)) return;
+				creationNotice = false;
+				createInput.focus();
+				createInput.select();
+			});
+			createCancel.addEventListener("click", closeCreate);
+			createConfirm.addEventListener("click", () => {
+				creator.submit();
+			});
+			createInput.addEventListener("input", () => {
+				creator.setName(createInput.value);
+			});
+			createInput.addEventListener("keydown", (event) => {
+				if (event.key === "Enter" && !event.isComposing) {
+					event.preventDefault();
+					creator.submit();
+				}
+			});
 			let disposed = false;
 			let closedByOwner = false;
 			let renderedListing;
@@ -8527,22 +9198,41 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const render = () => {
 				if (disposed) return;
 				const state = browser.getSnapshot();
+				if (creationNotice && state.listing !== creationNoticeListing) creationNotice = false;
+				const child = creator.getSnapshot();
 				const adopting = state.committed || state.hostBusy;
-				path.disabled = adopting;
+				const blocked = adopting || state.creating;
+				path.disabled = blocked;
 				if (path.value !== state.draft) path.value = state.draft;
 				path.setAttribute("aria-invalid", String(state.error === "bad-path"));
-				go.disabled = adopting || state.phase === "loading" || !isMobileDirectoryPath(state.draft);
-				home.disabled = adopting;
-				up.disabled = adopting || state.listing?.parent === void 0;
+				go.disabled = blocked || state.phase === "loading" || !isMobileDirectoryPath(state.draft);
+				home.disabled = blocked;
+				up.disabled = blocked || state.listing?.parent === void 0;
 				confirm.disabled = !browser.canConfirm();
 				cancel.disabled = adopting;
 				close.disabled = adopting;
 				retry.hidden = state.phase !== "error" || state.error === "bad-path";
-				retry.disabled = adopting;
-				status.textContent = adopting ? copy.adopting : state.phase === "loading" ? copy.loading : state.listing?.truncated === true ? copy.truncated : state.listing?.entries.length === 0 ? copy.empty : "";
-				status.hidden = status.textContent === "";
+				retry.disabled = blocked;
+				create.disabled = !browser.canConfirm();
+				title.textContent = child.open ? copy.create : copy.title;
+				toolbar.hidden = child.open;
+				navigation.hidden = child.open;
+				list.hidden = child.open;
+				footer.hidden = child.open;
+				createPanel.hidden = !child.open;
+				if (createInput.value !== child.name) createInput.value = child.name;
+				createInput.disabled = child.pending;
+				createInput.setAttribute("aria-invalid", String(child.error === "invalid-name"));
+				createConfirm.disabled = child.pending || !isMobileDirectoryName(child.name.trim());
+				createParent.textContent = `${copy.createParent}: ${child.parent ?? ""}`;
+				createError.textContent = child.error === null ? "" : child.error === "invalid-name" ? copy.createInvalid : child.error === "directory-exists" ? copy.createExists : child.error === "directory-create-failed" ? copy.createFailed : child.error === "unauthorized" ? copy.unauthorized : copy.createUnknown;
+				createError.hidden = child.error === null;
+				createStatus.textContent = child.pending && child.error === null ? copy.creating : "";
+				createStatus.hidden = createStatus.textContent === "";
+				status.textContent = child.pending ? copy.createStopping : creationNotice ? copy.createUnknown : adopting ? copy.adopting : state.phase === "loading" ? copy.loading : state.listing?.truncated === true ? copy.truncated : state.listing?.entries.length === 0 ? copy.empty : "";
+				status.hidden = child.open || status.textContent === "";
 				error.textContent = state.error === null ? "" : copy[state.error];
-				error.hidden = state.error === null;
+				error.hidden = child.open || state.error === null;
 				list.setAttribute("aria-busy", String(state.phase === "loading"));
 				if (renderedListing !== state.listing) {
 					renderedListing = state.listing;
@@ -8572,11 +9262,21 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 						list.append(item);
 					}
 				}
-				for (const row of list.querySelectorAll("button")) row.disabled = adopting;
+				for (const row of list.querySelectorAll("button")) row.disabled = blocked;
 			};
 			const unsubscribe = browser.subscribe(render);
+			const unsubscribeCreate = creator.subscribe(() => {
+				const child = creator.getSnapshot();
+				browser.setCreating(child.open || child.pending);
+				render();
+			});
 			const requestClose = () => {
+				if (creator.getSnapshot().open) {
+					closeCreate();
+					return;
+				}
 				if (disposed || !browser.cancel()) return;
+				creator.close();
 				closedByOwner = true;
 				if (dialog.open) dialog.close();
 				getProps().onCancel();
@@ -8597,6 +9297,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (disposal !== void 0) return disposal;
 				disposed = true;
 				unsubscribe();
+				unsubscribeCreate();
+				const creationStopped = creator.dispose();
 				const stopped = browser.dispose();
 				const failures = [];
 				const clean = (action) => {
@@ -8623,11 +9325,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					if (trigger?.isConnected) trigger.focus({ preventScroll: true });
 				});
 				disposal = (async () => {
-					try {
-						await stopped;
-					} catch (error) {
-						failures.push(error);
-					}
+					for (const result of await Promise.allSettled([stopped, creationStopped])) if (result.status === "rejected") failures.push(result.reason);
 					if (failures.length > 0) throw new AggregateError(failures, "Mobile directory dialog disposal failed");
 				})();
 				return disposal;
@@ -8787,7 +9485,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		//#region src/client.ts
 		/** Map a host-reported provider onto the UI union, defaulting to the built-in one. */
 		function parseMobileRemoteProvider(value) {
-			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" ? value : "tailscale";
+			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" || value === "iroh" ? value : "tailscale";
 		}
 		/**
 		* Set a surface's visibility; opening a page or overlay brings it to the front.
@@ -9333,6 +10031,23 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frp_discovery_invalid: "frpDiscoveryInvalid",
 			frp_stopped: "frpStopped",
 			frp_exited: "frpExited",
+			iroh_companion_missing: "irohCompanionMissing",
+			iroh_data_directory_invalid: "irohDataDirectoryInvalid",
+			iroh_sidecar_invalid: "irohSidecarInvalid",
+			iroh_download_failed: "irohDownloadFailed",
+			iroh_download_size_mismatch: "irohDownloadFailed",
+			iroh_download_hash_mismatch: "irohSidecarInvalid",
+			iroh_download_timeout: "irohTimeout",
+			iroh_platform_unsupported: "irohPlatformUnsupported",
+			iroh_identity_failed: "irohIdentityFailed",
+			iroh_identity_timeout: "irohIdentityFailed",
+			iroh_identity_invalid: "irohIdentityFailed",
+			iroh_launch_failed: "irohLaunchFailed",
+			iroh_start_timeout: "irohTimeout",
+			iroh_start_failed: "irohLaunchFailed",
+			iroh_exited: "irohExited",
+			iroh_not_ready: "irohNotReady",
+			iroh_pairing_failed: "irohPairingFailed",
 			frp_server_address_invalid: "frpServerAddressInvalid",
 			frp_server_port_invalid: "frpServerPortInvalid",
 			frp_token_invalid: "frpTokenInvalid",
@@ -9444,7 +10159,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cpolar: "cpolar",
 				cloudflared: "cloudflared",
 				frp: t("frpName"),
-				origin: t("originName")
+				origin: t("originName"),
+				iroh: t("irohName")
 			};
 			const providerId = typeof facts.provider === "string" ? facts.provider : "";
 			const controllerCode = typeof facts.controllerCode === "string" ? facts.controllerCode : "";
@@ -9977,7 +10693,19 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoiceDescription.textContent = t("originDescription");
 			originChoiceTop.append(originChoiceName);
 			originChoice.append(originChoiceTop, originChoiceDescription);
-			selfHostedBody.append(frpChoice, originChoice);
+			const irohChoice = element("button", "dsh-mobile-control__provider is-iroh");
+			irohChoice.type = "button";
+			irohChoice.setAttribute("aria-pressed", "false");
+			const irohChoiceTop = element("span", "dsh-mobile-control__provider-top");
+			const irohChoiceName = element("strong");
+			irohChoiceName.textContent = t("irohName");
+			const irohChoiceBadge = element("span", "dsh-mobile-control__provider-badge is-iroh");
+			irohChoiceBadge.textContent = t("irohExperimental");
+			const irohChoiceDescription = element("span", "dsh-mobile-control__provider-description");
+			irohChoiceDescription.textContent = t("irohDescription");
+			irohChoiceTop.append(irohChoiceName, irohChoiceBadge);
+			irohChoice.append(irohChoiceTop, irohChoiceDescription);
+			selfHostedBody.append(frpChoice, originChoice, irohChoice);
 			selfHosted.append(selfHostedSummary, selfHostedBody);
 			providerSection.append(providerHeading, providerInfo, providerChoices, selfHosted);
 			const frpSetup = element("section", "dsh-mobile-control__frp-setup");
@@ -10461,7 +11189,77 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			providerSetupMeta.append(providerSetupName, remoteStateBadge);
 			providerSetupHeader.append(providerSetupHeading, providerSetupMeta);
 			const providerSetupBody = element("div", "dsh-mobile-control__provider-setup-body");
-			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, tailscaleInfo);
+			const irohSetup = element("section", "dsh-mobile-control__frp-setup");
+			irohSetup.hidden = true;
+			const irohSetupTitle = element("h3", "dsh-mobile-control__section-title");
+			irohSetupTitle.textContent = t("prepareIroh");
+			const irohPhaseNote = element("p", "dsh-mobile-control__component-note");
+			irohPhaseNote.textContent = t("irohPhaseNote");
+			const irohComponentStatus = element("p", "dsh-mobile-control__component-status");
+			irohComponentStatus.textContent = t("checkingComponent");
+			irohComponentStatus.setAttribute("role", "status");
+			irohComponentStatus.setAttribute("aria-live", "polite");
+			const irohInstall = element("button", "dsh-mobile-control__primary");
+			irohInstall.type = "button";
+			irohInstall.textContent = t("installOfficial");
+			const irohInstallProgress = element("progress", "dsh-mobile-control__progress");
+			irohInstallProgress.hidden = true;
+			irohInstallProgress.setAttribute("aria-hidden", "true");
+			const irohPairing = element("div", "dsh-mobile-control__ws-paths");
+			const irohPairingTitle = element("p", "dsh-mobile-control__component-status");
+			irohPairingTitle.textContent = t("irohPairingTitle");
+			const irohPair = element("button", "dsh-mobile-control__primary");
+			irohPair.type = "button";
+			irohPair.textContent = t("generateIrohQr");
+			const irohQr = element("div", "dsh-mobile-control__qr is-expandable");
+			irohQr.hidden = true;
+			const irohPairStatus = element("p", "dsh-mobile-control__component-status");
+			const irohCopyDescriptor = element("button", "dsh-mobile-control__secondary");
+			irohCopyDescriptor.type = "button";
+			irohCopyDescriptor.textContent = t("copyPairLink");
+			irohCopyDescriptor.hidden = true;
+			irohPairing.append(irohPairingTitle, irohPair, irohQr, irohPairStatus, irohCopyDescriptor);
+			const irohDetails = element("details", "dsh-mobile-control__details");
+			const irohDetailsSummary = element("summary");
+			irohDetailsSummary.textContent = t("componentDetails");
+			const irohDetailsBody = element("div", "dsh-mobile-control__details-body");
+			const irohDetailsText = element("p");
+			irohDetailsText.textContent = t("irohComponentNote");
+			const irohInstallNote = element("p");
+			irohInstallNote.textContent = t("irohInstallNote");
+			const irohStorage = element("code", "dsh-mobile-control__storage");
+			irohStorage.textContent = t("pluginPrivateDirectory");
+			const irohOfficial = element("a", "dsh-mobile-control__text-link");
+			irohOfficial.href = "https://www.npmjs.com/package/dsh-mobile-iroh";
+			irohOfficial.target = "_blank";
+			irohOfficial.rel = "noopener noreferrer";
+			irohOfficial.textContent = t("officialDownload");
+			irohDetailsBody.append(irohDetailsText, irohInstallNote, irohStorage, irohOfficial);
+			irohDetails.append(irohDetailsSummary, irohDetailsBody);
+			irohSetup.append(irohSetupTitle, irohPhaseNote, irohComponentStatus, irohInstall, irohInstallProgress, irohPairing, irohDetails);
+			providerSetupBody.append(cpolarSetup, cloudflaredSetup, frpSetup, originSetup, irohSetup, tailscaleInfo);
+			const irohQrZoom = element("div", "dsh-mobile-control__qr-zoom");
+			irohQrZoom.hidden = true;
+			const irohQrZoomImage = element("img", "dsh-mobile-control__qr-zoom-image");
+			irohQrZoomImage.alt = t("pairingQr");
+			const irohQrZoomClose = element("button", "dsh-mobile-control__qr-zoom-close");
+			irohQrZoomClose.type = "button";
+			irohQrZoomClose.textContent = "×";
+			irohQrZoomClose.setAttribute("aria-label", t("closeEnlargedQr"));
+			const setIrohQrZoomOpen = (open) => {
+				if (open) {
+					irohQrZoom.setAttribute("role", "dialog");
+					irohQrZoom.setAttribute("aria-modal", "true");
+					irohQrZoom.setAttribute("aria-label", t("enlargeQr"));
+				} else {
+					irohQrZoom.removeAttribute("role");
+					irohQrZoom.removeAttribute("aria-modal");
+					irohQrZoom.removeAttribute("aria-label");
+				}
+				irohQrZoom.hidden = !open;
+			};
+			irohQrZoom.append(irohQrZoomImage, irohQrZoomClose);
+			root.append(irohQrZoom);
 			const remoteAccess = element("div", "dsh-mobile-control__access");
 			remoteAccess.hidden = true;
 			const remoteAccessLabel = element("span", "dsh-mobile-control__access-label");
@@ -10527,6 +11325,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			remotePairLink.hidden = true;
 			let activeRemotePairUrl = "";
 			let activeRemotePairExpiresAt = 0;
+			let activeIrohDescriptor = "";
+			let activeIrohQrSvg = "";
 			remoteActions.append(remoteToggle, remoteLogin, remoteReconnect, remotePair, remoteCopyLink);
 			const remoteManageRow = element("div", "dsh-mobile-control__manage-row");
 			const remoteDevices = element("button", "dsh-mobile-control__manage");
@@ -10823,6 +11623,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let latestRemoteState = {};
 			let frpInstalled = false;
 			let frpConfigured = false;
+			let irohInstalled = false;
+			/** True while a companion checksum verification is in flight; polls must not wipe its progress. */
+			let irohVerifying = false;
 			let frpLayoutInitialized = false;
 			let frpDownloadSize = "14.0";
 			let configuredFrpServer = "";
@@ -11144,6 +11947,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const cloudflared = remoteProvider === "cloudflared";
 				const frp = remoteProvider === "frp";
 				const origin = remoteProvider === "origin";
+				const iroh = remoteProvider === "iroh";
 				const managedOrigin = origin && data.originMode === "managed";
 				const tailscale = remoteProvider === "tailscale";
 				tailscaleChoice.classList.toggle("is-selected", tailscale);
@@ -11159,17 +11963,20 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.tabIndex = cloudflared ? 0 : -1;
 				frpChoice.setAttribute("aria-pressed", String(frp));
 				originChoice.setAttribute("aria-pressed", String(origin));
-				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t(managedOrigin ? "caddyName" : "originName") : "Tailscale Funnel";
+				irohChoice.setAttribute("aria-pressed", String(iroh));
+				providerSetupName.textContent = cpolar ? "cpolar" : cloudflared ? "cloudflared" : frp ? t("frpName") : origin ? t(managedOrigin ? "caddyName" : "originName") : iroh ? t("irohName") : "Tailscale Funnel";
 				tailscaleChoice.disabled = remoteProviderBusy;
 				cpolarChoice.disabled = remoteProviderBusy;
 				cloudflaredChoice.disabled = remoteProviderBusy;
 				frpChoice.disabled = remoteProviderBusy;
 				originChoice.disabled = remoteProviderBusy;
+				irohChoice.disabled = remoteProviderBusy;
 				cpolarSetup.hidden = !cpolar;
 				cloudflaredSetup.hidden = !cloudflared;
 				frpSetup.hidden = !frp;
 				originSetup.hidden = !origin;
-				if (frp || origin) selfHosted.open = true;
+				irohSetup.hidden = !iroh;
+				if (frp || origin || iroh) selfHosted.open = true;
 				tailscaleInfo.hidden = !tailscale;
 				remoteReset.textContent = tailscale ? t("resetRemoteLogin") : t("resetRemoteDevices");
 				const providers = data.providers !== null && typeof data.providers === "object" ? data.providers : {};
@@ -11324,6 +12131,30 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					frpVpsGroup.open = !frpConfigured;
 					frpLayoutInitialized = true;
 				}
+				const irohProvider = providers.iroh !== null && typeof providers.iroh === "object" ? providers.iroh : {};
+				const irohComponent = irohProvider.component !== null && typeof irohProvider.component === "object" ? irohProvider.component : {};
+				irohInstalled = irohComponent.installed === true;
+				const irohSupported = irohComponent.supported !== false;
+				const irohComponentError = typeof irohComponent.errorCode === "string" ? irohComponent.errorCode : "";
+				const irohVersion = typeof irohComponent.version === "string" ? irohComponent.version : "";
+				const irohDownloadBytes = typeof irohComponent.downloadBytes === "number" ? irohComponent.downloadBytes : 0;
+				const irohStoragePath = typeof irohComponent.storagePath === "string" ? irohComponent.storagePath : `DSH Mobile ${t("pluginPrivateDirectory")}`;
+				irohInstall.hidden = irohInstalled || !irohSupported;
+				if (irohVerifying) {
+					irohInstallProgress.hidden = false;
+					irohInstall.disabled = true;
+					irohInstall.textContent = t("installingIroh");
+					irohInstall.setAttribute("aria-busy", "true");
+					irohComponentStatus.textContent = t("installingIroh");
+				} else {
+					irohInstallProgress.hidden = true;
+					irohInstall.setAttribute("aria-busy", "false");
+					irohInstall.disabled = remoteProviderBusy;
+					irohInstall.textContent = irohDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(irohDownloadBytes) }) : t("installOfficial");
+					irohComponentStatus.textContent = !irohSupported ? t("irohPlatformUnsupported") : irohInstalled ? t("installed") + (irohVersion === "" ? "" : ` · ${irohVersion}`) : irohComponentError === "irohSidecarInvalid" ? t("irohSidecarInvalid") : t("irohUnavailable");
+				}
+				irohStorage.textContent = irohStoragePath;
+				irohStorage.title = irohStoragePath;
 				const originProvider = providers.origin !== null && typeof providers.origin === "object" ? providers.origin : {};
 				const originConfiguration = originProvider.configuration !== null && typeof originProvider.configuration === "object" ? originProvider.configuration : {};
 				originConfigured = originConfiguration.configured === true;
@@ -11414,10 +12245,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteStatus.classList.toggle("is-running", remoteReady);
 				const labels = {
 					off: t("remoteOff"),
-					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : t("remoteUnavailableTailscale"),
-					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : t("remoteStartingTailscale"),
+					unavailable: cpolar ? t("remoteUnavailableCpolar") : cloudflared ? t("remoteUnavailableCloudflared") : frp ? t("remoteUnavailableFrp") : origin ? t("originUnavailable") : iroh ? t("irohUnavailable") : t("remoteUnavailableTailscale"),
+					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : iroh ? t("irohStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
-					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : t("remoteConnectingTailscale"),
+					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : iroh ? t("irohConnecting") : t("remoteConnectingTailscale"),
 					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
@@ -11432,7 +12263,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteSetupRetry.disabled = remoteReconnectBusy;
 				remoteToggle.textContent = remoteRunning ? t("disableRemote") : t("enableRemote");
 				const originPrepared = data.originMode === "managed" ? caddySupported && caddyInstalled && caddyConfiguration.configured === true : originConfigured && !caddyModeManagedSelected;
-				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : true;
+				const providerPrepared = cpolar ? cpolarInstalled && cpolarConfigured : cloudflared ? cloudflaredInstalled : frp ? frpInstalled && frpConfigured : origin ? originPrepared : iroh ? irohInstalled : true;
 				remoteToggle.disabled = remoteProviderBusy || !providerPrepared && !(origin && remoteRunning);
 				remoteLogin.hidden = !tailscale || state !== "needs-login" || remoteLoginUrl === "";
 				remoteReconnect.hidden = needsFunnelSetup || state !== "error" && state !== "unavailable" || !providerPrepared;
@@ -11440,6 +12271,21 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remotePair.disabled = !remoteReady || remoteProviderBusy;
 				remoteCopyLink.disabled = !remoteReady || remoteProviderBusy;
 				remoteDevices.disabled = !remoteReady || remoteProviderBusy;
+				remotePair.hidden = iroh;
+				remoteCopyLink.hidden = iroh;
+				if (iroh) {
+					remoteQr.hidden = true;
+					remotePairLink.hidden = true;
+				}
+				irohPair.disabled = !remoteReady || !iroh || remoteProviderBusy;
+				if ((!iroh || !remoteReady) && activeIrohDescriptor !== "") {
+					activeIrohDescriptor = "";
+					activeIrohQrSvg = "";
+					showQr("", irohQr);
+					setIrohQrZoomOpen(false);
+					irohCopyDescriptor.hidden = true;
+					irohPairStatus.textContent = "";
+				}
 				if (origin) {
 					remoteReconnect.disabled = remoteProviderBusy || remoteReconnectBusy;
 					remoteReset.disabled = remoteProviderBusy;
@@ -11504,7 +12350,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				cloudflaredChoice.disabled = true;
 				frpChoice.disabled = true;
 				originChoice.disabled = true;
-				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : t("switchingTailscale");
+				irohChoice.disabled = true;
+				remoteStatus.textContent = provider === "cpolar" ? t("switchingCpolar") : provider === "cloudflared" ? t("switchingCloudflared") : provider === "frp" ? t("switchingFrp") : provider === "origin" ? t("switchingOrigin") : provider === "iroh" ? t("switchingIroh") : t("switchingTailscale");
 				controlRequestJson("/api/mobile-access/remote/provider", {
 					method: "POST",
 					body: JSON.stringify({ provider })
@@ -11531,6 +12378,111 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			originChoice.addEventListener("click", () => {
 				chooseRemoteProvider("origin");
 			});
+			irohChoice.addEventListener("click", () => {
+				chooseRemoteProvider("iroh");
+			});
+			irohInstall.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				if (!window.confirm(t("irohInstallConfirm"))) return;
+				remoteProviderBusy = true;
+				irohVerifying = true;
+				irohInstall.disabled = true;
+				irohInstall.textContent = t("installingIroh");
+				irohInstall.setAttribute("aria-busy", "true");
+				irohInstallProgress.hidden = false;
+				irohComponentStatus.textContent = t("installingIroh");
+				remoteStatus.textContent = t("installingIroh");
+				controlRequestJson("/api/mobile-access/remote/iroh/component/install", {
+					method: "POST",
+					body: JSON.stringify({ confirm: true })
+				}, LONG_CONTROL_REQUEST_TIMEOUT_MS).then(renderRemote, (error) => {
+					remoteFailureText = remoteFailureTextFor(error, "installFailed");
+					remoteStatus.textContent = remoteFailureText;
+					irohComponentStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					irohVerifying = false;
+					loadRemote();
+				});
+			});
+			const openIrohQrZoom = () => {
+				if (activeIrohQrSvg === "" || irohQr.hidden) return;
+				irohQrZoomImage.src = `data:image/svg+xml;base64,${btoa(activeIrohQrSvg)}`;
+				setIrohQrZoomOpen(true);
+				irohQrZoomClose.focus();
+			};
+			const closeIrohQrZoom = () => {
+				setIrohQrZoomOpen(false);
+				if (!irohQr.hidden) irohQr.focus();
+			};
+			irohQr.setAttribute("role", "button");
+			irohQr.setAttribute("tabindex", "0");
+			irohQr.setAttribute("aria-label", t("enlargeQr"));
+			irohQr.addEventListener("click", openIrohQrZoom);
+			irohQr.addEventListener("keydown", (event) => {
+				if (event.key !== "Enter" && event.key !== " ") return;
+				event.preventDefault();
+				openIrohQrZoom();
+			});
+			irohQrZoom.addEventListener("click", closeIrohQrZoom);
+			irohQrZoomClose.addEventListener("click", closeIrohQrZoom);
+			irohQrZoom.addEventListener("keydown", (event) => {
+				if (event.key !== "Escape") return;
+				closeIrohQrZoom();
+			});
+			const openIrohPairing = () => controlRequestJson("/api/mobile-access/remote/iroh/pairing/begin", {
+				method: "POST",
+				body: "{}"
+			}).then(async (data) => {
+				const record = data;
+				const qrSvg = typeof record.qrSvg === "string" ? record.qrSvg : "";
+				const code = typeof record.irohCode === "string" ? record.irohCode : "";
+				showQr(qrSvg, irohQr);
+				if (qrSvg === "" || code === "") {
+					activeIrohQrSvg = "";
+					irohPairStatus.textContent = t("keyGenerationFailed");
+					return;
+				}
+				activeIrohQrSvg = qrSvg;
+				const fields = [
+					"version",
+					"type",
+					"endpointId",
+					"origin",
+					"localPort",
+					"irohCode",
+					"gatewayToken",
+					"caCertificate",
+					"instanceId",
+					"expiresAt"
+				];
+				const descriptor = {};
+				for (const field of fields) descriptor[field] = record[field];
+				activeIrohDescriptor = JSON.stringify(descriptor);
+				irohCopyDescriptor.hidden = false;
+				irohPairStatus.textContent = t("irohPairingReady", { code });
+			});
+			irohPair.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				remoteProviderBusy = true;
+				irohPair.disabled = true;
+				irohPairStatus.textContent = t("loadingRemoteStatus");
+				openIrohPairing().catch((error) => {
+					remoteFailureText = remoteFailureTextFor(error, "requestFailed");
+					irohPairStatus.textContent = remoteFailureText;
+				}).finally(() => {
+					remoteProviderBusy = false;
+					loadRemote();
+				});
+			});
+			irohCopyDescriptor.addEventListener("click", () => {
+				if (activeIrohDescriptor === "") return;
+				navigator.clipboard.writeText(activeIrohDescriptor).then(() => {
+					irohPairStatus.textContent = t("linkCopied");
+				}, () => {
+					irohPairStatus.textContent = t("remoteQrReady");
+				});
+			});
 			cloudflaredInstall.addEventListener("click", () => {
 				if (remoteProviderBusy) return;
 				if (!window.confirm(t("installConfirmCloudflared", { size: cloudflaredDownloadSize }))) return;
@@ -12523,7 +13475,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				remoteReconnect.disabled = true;
 				remoteSetup.disabled = true;
 				remoteSetupRetry.disabled = true;
-				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : t("reconnectingTailscale");
+				remoteStatus.textContent = remoteProvider === "cpolar" ? t("reconnectingCpolar") : remoteProvider === "cloudflared" ? t("reconnectingCloudflared") : remoteProvider === "frp" ? t("reconnectingFrp") : remoteProvider === "origin" ? t("reconnectingOrigin") : remoteProvider === "iroh" ? t("reconnectingIroh") : t("reconnectingTailscale");
 				controlRequestJson("/api/mobile-access/remote/reconnect", {
 					method: "POST",
 					body: "{}"
@@ -12644,7 +13596,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (show) loadRemoteDevices();
 			});
 			remoteReset.addEventListener("click", () => {
-				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : t("resetTailscaleConfirm");
+				const prompt = remoteProvider === "cpolar" ? t("resetCpolarConfirm") : remoteProvider === "cloudflared" ? t("resetCloudflaredConfirm") : remoteProvider === "frp" ? t("resetFrpConfirm") : remoteProvider === "origin" ? t("resetOriginConfirm") : remoteProvider === "iroh" ? t("resetIrohConfirm") : t("resetTailscaleConfirm");
 				if (!window.confirm(prompt)) return;
 				controlRequestJson("/api/mobile-access/remote/reset", {
 					method: "POST",
@@ -13443,10 +14395,28 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			}
 		};
-		/** Install authenticated mobile customization refresh, retaining loaded legacy assets through temporary failures. */
-		function installCustomAssets() {
+		/**
+		* Install authenticated customization refresh, retaining assets through temporary failures.
+		* @param recovery - optional instance-owned authentication feedback and refresh registration.
+		* @returns synchronous teardown for the customization UI and refresh admission.
+		*/
+		function installCustomAssets(recovery) {
 			const reporter = createMobileAssetLoadReporter(selectedMobileControlLocale);
+			let refreshNow = () => {};
 			const customizationOwner = ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__);
+			const removeNotice = customizationOwner ? installCustomizationNotice(document, {
+				locale: () => {
+					const locale = selectedMobileControlLocale();
+					return locale === "zh" || locale === "it" ? locale : "en";
+				},
+				reconnect: () => {
+					const attempted = recovery?.retry() ?? false;
+					refreshNow();
+					return attempted;
+				},
+				subscribe: (listener) => reporter.subscribe(listener),
+				message: (reason) => reporter.message(reason)
+			}) : () => {};
 			const legacyStyle = element("style");
 			legacyStyle.dataset.plugin = "dsh-mobile-custom";
 			document.head.append(legacyStyle);
@@ -13478,7 +14448,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (reason === "authentication_required") events?.setEnabled(false);
 			};
 			const unavailable = (response, signal, fallback) => {
-				failed(response.status === 401 || response.status === 403 ? "authentication_required" : fallback, signal);
+				const rejectedAuth = response.status === 401 || response.status === 403;
+				failed(rejectedAuth ? "authentication_required" : fallback, signal);
+				if (rejectedAuth && !disposed && !signal.aborted) recovery?.rejected(response.status);
 				response.body?.cancel().catch((error) => {});
 			};
 			let expectedDefinitionId;
@@ -14038,6 +15010,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					events?.setEnabled(true);
 				}
 			});
+			refreshNow = () => {
+				stopRefresh.refresh();
+			};
+			const unregisterRefresh = recovery?.registerRefresh(refreshNow);
 			const stopEvents = startExtensionChangeStream(() => {
 				stopRefresh.refresh();
 			}, void 0, (payload) => {
@@ -14058,6 +15034,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			events = stopEvents;
 			return () => {
 				disposed = true;
+				unregisterRefresh?.();
+				removeNotice();
 				reporter.dispose();
 				stopNativeBack();
 				stopEvents();
@@ -14128,12 +15106,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 /* The cloudflared setup section deliberately reuses this card, so
    .dsh-mobile-control__cloudflared-setup is a DOM hook for targeting rather than a
    style rule of its own. */
-.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
+.dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__progress{box-sizing:border-box;width:100%;height:6px;margin:0 0 10px}.dsh-mobile-control__progress[hidden]{display:none}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
 .dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
-.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
+.dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}.dsh-mobile-control__qr.is-expandable{cursor:zoom-in}.dsh-mobile-control__qr.is-expandable:focus-visible{outline:3px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px;border-radius:12px}.dsh-mobile-control__qr-zoom{position:fixed;inset:0;z-index:1001;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.72)}.dsh-mobile-control__qr-zoom[hidden]{display:none}.dsh-mobile-control__qr-zoom-image{width:min(84vw,360px);height:min(84vw,360px);border-radius:12px;background:#fff;padding:12px}.dsh-mobile-control__qr-zoom-close{position:absolute;top:12px;right:16px;min-width:44px;min-height:44px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:600 18px/1 system-ui;cursor:pointer}
 .dsh-mobile-control__status{margin:0 0 14px;overflow-wrap:anywhere;color:var(--dsw-alias-label-secondary,#606873)}.dsh-mobile-control__status::before{display:inline-block;width:8px;height:8px;margin-right:7px;border-radius:50%;background:var(--dsw-alias-label-tertiary,#98a1ad);content:""}.dsh-mobile-control__status.is-running::before{background:var(--dsw-alias-state-success-primary,#16a36a)}.dsh-mobile-control__status.is-key{font-family:ui-monospace,SFMono-Regular,Consolas,monospace;font-size:12px;word-break:break-all}
 .dsh-mobile-control__guide{margin:0 0 14px;padding:12px;border:1px solid #6f96db;border-radius:12px;background:var(--dsw-alias-bg-layer-1,#eff6ff)}.dsh-mobile-control__guide[hidden]{display:none}.dsh-mobile-control__guide-title{margin:0;color:var(--dsw-alias-label-primary,#172554);font:650 13px/1.45 system-ui}.dsh-mobile-control__guide-summary,.dsh-mobile-control__guide-note{margin:4px 0 0;color:var(--dsw-alias-label-secondary,#475569);font-size:12px;line-height:1.5}.dsh-mobile-control__guide-steps{margin:8px 0 0;padding-left:20px;color:var(--dsw-alias-label-primary,#1e293b);font-size:12px;line-height:1.6}.dsh-mobile-control__guide-note{color:var(--dsw-alias-label-secondary,#64748b)}.dsh-mobile-control__guide-actions{display:grid;grid-template-columns:1fr 1fr;gap:8px;margin-top:10px}.dsh-mobile-control__guide-actions button{min-width:0;min-height:44px;padding:8px;border-radius:10px;font:12px/1.25 system-ui;cursor:pointer}.dsh-mobile-control__guide-actions button:disabled{cursor:not-allowed;opacity:.45}
 .dsh-mobile-control__extensions{margin:0 0 12px;color:var(--dsw-alias-label-secondary,#606873);font-size:12px}
@@ -14160,6 +15138,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 ` + EXTENSION_RECOVERY_STYLES;
 		/** Mount the desktop control or mobile feature enhancements. */
 		function apply(ctx) {
+			let gatewayRejectionSink;
+			let retryRecovery;
+			let refreshCustomization;
 			ctx.effect(() => installMobileUiLocalePersistence(document, window), "dsh-mobile: browser UI locale persistence");
 			ctx.effect(() => {
 				if (window.__DSH_MOBILE_FRONTEND__ !== "dedicated") return;
@@ -14168,7 +15149,26 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			}, "dsh-mobile: authenticated gateway client trust");
 			ctx.effect(() => {
 				if (!ownsMobileCustomization(document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null, window.__DSH_MOBILE_FRONTEND__)) return;
-				return installMobileConnectionRecovery(() => ctx.get("connection"), window, document);
+				let ownedRejection;
+				const recovery = installMobileConnectionRecovery(() => ctx.get("connection"), window, document, (rejected, retry) => {
+					ownedRejection = rejected;
+					gatewayRejectionSink = rejected;
+					retryRecovery = retry;
+				}, () => {
+					refreshCustomization?.();
+				});
+				if (recovery === void 0) {
+					gatewayRejectionSink = void 0;
+					retryRecovery = void 0;
+					return;
+				}
+				return () => {
+					if (gatewayRejectionSink === ownedRejection) {
+						gatewayRejectionSink = void 0;
+						retryRecovery = void 0;
+					}
+					return recovery();
+				};
 			}, "dsh-mobile: connection recovery");
 			ctx.effect(() => {
 				const desktopAdmin = isDesktopAdminSurface(location.hostname, location.search, window.__DSH_MOBILE_FRONTEND__, location.protocol);
@@ -14178,7 +15178,18 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				style.textContent = desktopAdmin ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
 				style.textContent += CLIENT_MODULE_STYLES;
 				document.head.append(style);
-				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets() : () => void 0;
+				const removeCustom = !desktopAdmin || gatewayCustomization ? installCustomAssets({
+					rejected: (status) => {
+						gatewayRejectionSink?.(status);
+					},
+					retry: () => retryRecovery?.() ?? false,
+					registerRefresh: (refresh) => {
+						refreshCustomization = refresh;
+						return () => {
+							if (refreshCustomization === refresh) refreshCustomization = void 0;
+						};
+					}
+				}) : () => void 0;
 				const removeVoiceSession = installVoiceSession(!desktopAdmin);
 				const removeDraftTransfer = !desktopAdmin && document.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") !== null ? installDraftTransfer(ctx, window, document) : () => void 0;
 				const removeModuleSettings = ctx.slots.inject("settings.general.item", () => ctx.slots.register({
@@ -14227,7 +15238,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 						getLayout: () => ctx.get("layout"),
 						getSidebarRight: () => ctx.get("sidebarRight")
 					}));
-					const removeDirectoryPicker = window.__DSH_MOBILE_FRONTEND__ === "dedicated" ? installMobileDirectoryPicker(ctx, document) : () => Promise.resolve();
+					const removeDirectoryPicker = window.__DSH_MOBILE_FRONTEND__ === "dedicated" && !hasUpstreamBrowsePicker(window) ? installMobileDirectoryPicker(ctx, document) : () => Promise.resolve();
 					return async () => {
 						const removal = removeDirectoryPicker();
 						try {