dsh-mobile 0.6.17 → 0.7.0

package/lib/index.mjs

@@ -3,7 +3,7 @@ import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomB
 import { basename, dirname, extname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
-import { connect, createServer } from "node:net";
+import { connect, createServer, isIP } from "node:net";
 import { chmod, copyFile, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
@@ -77,14 +77,14 @@ var BoundedRateLimiter = class {
 function opaqueToken() {
 	return randomBytes(32).toString("base64url");
 }
-function digest$1(value) {
+function digest$2(value) {
 	return createHash("sha256").update(value, "utf8").digest();
 }
 function digestHex(value) {
-	return digest$1(value).toString("hex");
+	return digest$2(value).toString("hex");
 }
 function matchesDigest(value, expected) {
-	return timingSafeEqual(digest$1(value), expected);
+	return timingSafeEqual(digest$2(value), expected);
 }
 function normalizeLabel(value) {
 	const label = (value ?? "Mobile device").normalize("NFC").trim();
@@ -187,7 +187,7 @@ var AccessController = class {
 		const record = Object.freeze({
 			key,
 			deviceId: device.id,
-			csrfDigest: digest$1(csrfToken),
+			csrfDigest: digest$2(csrfToken),
 			createdAt: now,
 			expiresAt: Math.min(now + this.options.sessionTtlMs, device.expiresAt)
 		});
@@ -209,7 +209,7 @@ var AccessController = class {
 			const token = opaqueToken();
 			const expiresAt = this.now() + ttl;
 			this.pairingWindow = Object.freeze({
-				digest: digest$1(token),
+				digest: digest$2(token),
 				expiresAt
 			});
 			return Object.freeze({
@@ -317,7 +317,7 @@ var AccessController = class {
 	}
 	requireDevice(deviceToken, now) {
 		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
-		const tokenDigest = digest$1(deviceToken);
+		const tokenDigest = digest$2(deviceToken);
 		const device = this.devices.find((candidate) => timingSafeEqual(Buffer.from(candidate.tokenDigest, "hex"), tokenDigest));
 		if (device === void 0) throw new AccessError(401, "authentication_failed");
 		if (device.revokedAt !== void 0) throw new AccessError(401, "device_revoked");
@@ -480,7 +480,7 @@ function countIpv6Groups(labels, allowDottedQuad) {
 * @param value - candidate address; non-strings are never an IP.
 * @returns `4` for IPv4, `6` for IPv6, `0` when the value is neither.
 */
-function isIP(value) {
+function isIP$1(value) {
 	if (typeof value !== "string") return 0;
 	if (isStrictIpv4(value)) return 4;
 	let text = value;
@@ -551,7 +551,7 @@ function parseIp(address) {
 		bits: 32,
 		value: parseIpv4$1(mapped)
 	};
-	const version = isIP(unwrapped.split("%", 1)[0] ?? unwrapped);
+	const version = isIP$1(unwrapped.split("%", 1)[0] ?? unwrapped);
 	if (version === 4) return {
 		bits: 32,
 		value: parseIpv4$1(unwrapped)
@@ -958,6 +958,7 @@ const Config = z.object({
 	upstreamOrigin: z.string(),
 	publicAuthorities: z.array(String).default(void 0),
 	allowedCidrs: z.array(String).default(void 0),
+	adminAllowedCidrs: z.array(String).default([]),
 	stateFile: String,
 	controlFile: z.string().hidden().required(),
 	customCssFile: z.string().hidden(),
@@ -1089,7 +1090,7 @@ function parseGatewayConfig(raw) {
 	if (publicOrigin !== void 0 && value.listenPort !== void 0) throw new Error("publicOrigin cannot be combined with listenPort");
 	if (publicOrigin !== void 0 && value.publicAuthorities !== void 0) throw new Error("publicOrigin cannot be combined with publicAuthorities");
 	const listenHost = value.listenHost ?? (publicOrigin === void 0 ? "127.0.0.1" : "0.0.0.0");
-	if (isIP(listenHost) === 0) throw new Error("listenHost must be an IP literal");
+	if (isIP$1(listenHost) === 0) throw new Error("listenHost must be an IP literal");
 	const listenPort = publicOrigin?.port ?? integer(value.listenPort, "listenPort", 3443, 0, 65535);
 	const upstreamOrigin = parseUpstream(value.upstreamOrigin);
 	const tls = parseTls(value.tls, listenHost);
@@ -1111,6 +1112,11 @@ function parseGatewayConfig(raw) {
 	if (new Set(authorities.map((entry) => `${entry.hostname}:${String(entry.port ?? listenPort)}`)).size !== authorities.length) throw new Error("publicAuthorities must not contain duplicates");
 	const allowedCidrs = stringArray(value.allowedCidrs ?? (isLoopbackAddress(listenHost) ? ["127.0.0.0/8", "::1/128"] : void 0), "allowedCidrs").map(parseCidr);
 	if (new Set(allowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== allowedCidrs.length) throw new Error("allowedCidrs must not contain duplicates");
+	const adminSources = value.adminAllowedCidrs === void 0 ? [] : value.adminAllowedCidrs;
+	if (!Array.isArray(adminSources) || adminSources.length > 32 || adminSources.some((source) => typeof source !== "string")) throw new Error("adminAllowedCidrs must contain at most 32 CIDR strings");
+	const adminAllowedCidrs = adminSources.map(parseCidr);
+	if (adminAllowedCidrs.some((entry) => entry.prefix === 0)) throw new Error("adminAllowedCidrs must not allow every address");
+	if (new Set(adminAllowedCidrs.map((entry) => `${String(entry.bits)}:${entry.network.toString(16)}:${String(entry.prefix)}`)).size !== adminAllowedCidrs.length) throw new Error("adminAllowedCidrs must not contain duplicates");
 	const deviceTtlMs = integer(value.deviceTtlMs, "deviceTtlMs", 7776e6, 6e4, 316224e5);
 	const sessionTtlMs = integer(value.sessionTtlMs, "sessionTtlMs", 288e5, 3e4, 864e5);
 	if (sessionTtlMs > deviceTtlMs) throw new Error("sessionTtlMs must not exceed deviceTtlMs");
@@ -1121,6 +1127,7 @@ function parseGatewayConfig(raw) {
 		upstreamOrigin,
 		authorities: Object.freeze(authorities),
 		allowedCidrs: Object.freeze(allowedCidrs),
+		adminAllowedCidrs: Object.freeze(adminAllowedCidrs),
 		stateFile: absoluteFile(value.stateFile, "stateFile"),
 		extensionsDir: join(dirname(absoluteFile(value.stateFile, "stateFile")), "extensions"),
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
@@ -1278,6 +1285,45 @@ async function restrictPrivateFile(file, mode = 384) {
 		timeout: 1e4
 	}));
 }
+/**
+* Restrict a plugin-owned private directory (and what already sits inside it)
+* so a strict native consumer can verify every ancestor and the leaf itself.
+* Inheritance is disabled and re-granted to the current user, SYSTEM and
+* administrators only; future children inherit the same compliant entries.
+* Reparse points are never followed: a linked child is left alone and fails
+* closed downstream instead of being repaired here.
+*/
+async function restrictPrivateDirectory(directory) {
+	await chmod(directory, 448);
+	const entry = await lstat(directory);
+	if (!entry.isDirectory() || entry.isSymbolicLink()) throw Object.assign(/* @__PURE__ */ new Error("private directory is not a real directory"), { code: "PRIVATE_DIRECTORY_INVALID" });
+	if (process.platform !== "win32") return;
+	const userSid = await currentWindowsUserSid();
+	const apply = (target) => permissionOperation("acl-apply", () => execFileText(windowsSystemTool("icacls.exe"), [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`*${userSid}:(OI)(CI)(F)`,
+		"*S-1-5-18:(OI)(CI)(F)",
+		"*S-1-5-32-544:(OI)(CI)(F)",
+		"/remove:g",
+		"*S-1-1-0",
+		"*S-1-5-11",
+		"*S-1-5-32-545"
+	], {
+		encoding: "utf8",
+		windowsHide: true,
+		timeout: 1e4
+	}));
+	await apply(directory);
+	for (const name of await readdir(directory)) {
+		const child = join(directory, name);
+		const info = await lstat(child);
+		if (info.isSymbolicLink()) continue;
+		if (info.isDirectory()) await restrictPrivateDirectory(child);
+		else if (info.isFile()) await restrictPrivateFile(child);
+	}
+}
 //#endregion
 //#region src/client-module-preferences.ts
 const MAX_RECORD_BYTES = 1048576;
@@ -1896,9 +1942,11 @@ function localAuthority(header) {
 		return;
 	}
 }
-/** Protect the inner management route from non-loopback and DNS-rebinding callers. */
-function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false) {
-	if (request.socket.remoteAddress === void 0 || !isLoopbackAddress(request.socket.remoteAddress)) throw new HttpError(403, "forbidden");
+/** Protect management with direct-peer, Host, browser-source and optional authenticated-network admission. */
+function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDesktop = () => false, adminAllowedCidrs = []) {
+	const peer = request.socket.remoteAddress;
+	const loopback = peer !== void 0 && isLoopbackAddress(peer);
+	if (!loopback && !addressAllowed(peer, adminAllowedCidrs)) throw new HttpError(403, "forbidden");
 	const host = localAuthority(request.headers.host);
 	if (host === void 0 || !isLocalAdminHostname(host.hostname)) throw new HttpError(403, "forbidden");
 	if (request.method === "OPTIONS") throw new HttpError(403, "forbidden");
@@ -1917,6 +1965,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	const webRequest = request.method === "POST" && (site === void 0 || site === "same-origin") && request.headers["x-dsh-mobile-web-admin"] === "same-origin-json" && request.headers["x-dsh-mobile-desktop-admin"] === void 0 && typeof contentType === "string" && contentType.split(";", 1)[0]?.trim().toLowerCase() === "application/json";
 	if (requireBrowserOrigin && origin === void 0 && !webRequest && !(desktopForward && authenticateDesktop())) throw new HttpError(403, "forbidden");
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
+	if (!loopback && !authenticateDesktop()) throw new HttpError(401, "admin_authentication_required");
 }
 //#endregion
 //#region src/browser-auth-cookies.ts
@@ -3111,6 +3160,52 @@ async function listWorkspaceDirectories(path, signal) {
 		truncated
 	});
 }
+/**
+* Resolve exactly one child name without drive-relative or reserved Win32 spellings.
+* @param path - Fully qualified parent without a home/current-drive fallback.
+* @param name - Single non-blank path segment.
+* @param platform - Host path rules, explicit for portable parser tests.
+* @returns The child path whose immediate parent is the normalized requested directory.
+*/
+function workspaceDirectoryChildPath(path, name, platform = process.platform) {
+	if (typeof path !== "string" || path.length === 0) throw new HttpError(400, "directory_create_invalid");
+	if (typeof name !== "string" || name.length === 0 || name.length > 255 || name.trim() === "" || name === "." || name === ".." || name.includes("/") || name.includes("\\") || name.includes("\0") || isAbsolute(name) || platform === "win32" && (/[<>:"|?*\u0000-\u001f]/u.test(name) || /[. ]$/u.test(name) || /^(?:CON|PRN|AUX|NUL|COM[1-9¹²³]|LPT[1-9¹²³])(?:\.|$)/iu.test(name))) throw new HttpError(400, "directory_create_invalid");
+	const paths = platform === "win32" ? win32 : posix;
+	const parent = resolveWorkspaceDirectoryPath(path, platform);
+	const child = paths.resolve(parent, name);
+	if (paths.dirname(child) !== parent) throw new HttpError(400, "directory_create_invalid");
+	return child;
+}
+/**
+* Create one child directory under an explicitly confirmed existing parent.
+* @param path - Fully qualified existing parent; no home/default fallback is used.
+* @param name - One non-blank segment accepted by the Host filesystem rules.
+* @param signal - Cancellation withdraws admission/results, never a completed mkdir.
+* @returns The created directory's absolute path after filesystem work settles.
+*/
+async function createWorkspaceDirectory(path, name, signal) {
+	signal?.throwIfAborted();
+	const created = workspaceDirectoryChildPath(path, name);
+	const parent = resolveWorkspaceDirectoryPath(path);
+	let stats;
+	try {
+		stats = await stat(parent);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		throw new HttpError(404, "directory_unavailable");
+	}
+	if (!stats.isDirectory()) throw new HttpError(400, "directory_create_invalid");
+	signal?.throwIfAborted();
+	try {
+		await mkdir(created);
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
+		if (error.code === "EEXIST") throw new HttpError(409, "directory_exists");
+		throw new HttpError(400, "directory_create_failed");
+	}
+	signal?.throwIfAborted();
+	return Object.freeze({ path: created });
+}
 /** Read one bounded regular image file selected by an authenticated device. */
 async function readComputerImage(path, signal) {
 	signal?.throwIfAborted();
@@ -5687,7 +5782,7 @@ async function tlsOptions(config) {
 	const leaf = chain[0].certificate;
 	for (const authority of config.authorities) {
 		const hostname = stripIpv6Brackets(authority.hostname);
-		if ((isIP(hostname) === 0 ? leaf.checkHost(hostname) : leaf.checkIP(hostname)) === void 0) throw new Error(`TLS certificate does not cover configured authority ${hostname}`);
+		if ((isIP$1(hostname) === 0 ? leaf.checkHost(hostname) : leaf.checkIP(hostname)) === void 0) throw new Error(`TLS certificate does not cover configured authority ${hostname}`);
 	}
 	return {
 		cert: chain.map((entry) => entry.pem).join(""),
@@ -6281,7 +6376,7 @@ var MobileAccessGateway = class {
 			if (this.closing || this.discoveryError !== void 0 || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
 			sendAnnouncement(remote.port, remote.address);
 		});
-		const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
+		const bindHost = isIP$1(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
 		if (await new Promise((resolve) => {
 			const onBindError = (error) => {
 				socket.off("error", onBindError);
@@ -6735,7 +6830,7 @@ var MobileAccessGateway = class {
 		}
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
-		const workspaceDirectories = request.method === "GET" && target.decodedPathname === `/mobile-access/workspace-directories`;
+		const workspaceDirectories = (request.method === "GET" || request.method === "POST") && target.decodedPathname === `/mobile-access/workspace-directories`;
 		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
@@ -6898,10 +6993,18 @@ var MobileAccessGateway = class {
 			response.once("close", onClose);
 			const task = (async () => {
 				try {
-					const query = new URL(target.raw, this.address().origin).searchParams;
-					const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
-					operation.signal.throwIfAborted();
-					sendJson(response, 200, listing, this.tlsEnabled);
+					if (request.method === "POST") {
+						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
+						if (typeof body.path !== "string" || body.path.length === 0 || typeof body.name !== "string") throw new HttpError(400, "directory_create_invalid");
+						const created = await createWorkspaceDirectory(body.path, body.name, operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 201, created, this.tlsEnabled);
+					} else {
+						const query = new URL(target.raw, this.address().origin).searchParams;
+						const listing = await listWorkspaceDirectories(query.get("path"), operation.signal);
+						operation.signal.throwIfAborted();
+						sendJson(response, 200, listing, this.tlsEnabled);
+					}
 				} catch (error) {
 					if (operation.signal.aborted && error === operation.signal.reason) return;
 					throw error;
@@ -7617,8 +7720,7 @@ var MobileAccessGateway = class {
 			let body;
 			if (stockFrontend) body = Buffer.from(ensureMobileGatewayMarker(index.html));
 			else {
-				const preference = await this.clientModulePreferences.read(authorization.deviceId);
-				const excludedClientModules = preference.excludedClientModules;
+				const excludedClientModules = (await this.clientModulePreferences.read(authorization.deviceId)).excludedClientModules;
 				try {
 					const html = index.html;
 					const plan = parseMobileBootPlan(html, excludedClientModules);
@@ -7645,22 +7747,15 @@ var MobileAccessGateway = class {
 							this.lastModuleExclusionError = detail;
 							process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
 						}
-						if (preference.source === "device" || preference.source === "computer") {
-							operation.signal.throwIfAborted();
-							const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
-							const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
-							setSecurityHeaders(response, this.tlsEnabled);
-							response.writeHead(200, {
-								"Content-Type": "text/html; charset=utf-8",
-								"Content-Length": recovery.byteLength
-							});
-							response.end(recovery);
-							return;
-						}
-						sendJson(response, 409, {
-							error: "excluded_client_modules_invalid",
-							detail
-						}, this.tlsEnabled);
+						operation.signal.throwIfAborted();
+						const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
+						const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
+						setSecurityHeaders(response, this.tlsEnabled);
+						response.writeHead(200, {
+							"Content-Type": "text/html; charset=utf-8",
+							"Content-Length": recovery.byteLength
+						});
+						response.end(recovery);
 						return;
 					}
 					throw new HttpError(502, "upstream_unavailable");
@@ -10368,7 +10463,7 @@ function hostname$2(value) {
 function validateFrpServerAddress(value) {
 	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
 	const normalized = value.toLowerCase().replace(/\.$/u, "");
-	if (isIP(normalized) === 0 && !hostname$2(normalized)) throw new Error("frp_server_address_invalid");
+	if (isIP$1(normalized) === 0 && !hostname$2(normalized)) throw new Error("frp_server_address_invalid");
 	return normalized;
 }
 /** Validate the FRP control port. */
@@ -10391,8 +10486,8 @@ function validateFrpPublicOrigin(value) {
 		throw new Error("frp_public_origin_invalid");
 	}
 	const publicHost = url.hostname;
-	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$2(publicHost)) throw new Error("frp_public_origin_invalid");
-	if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP$1(publicHost) !== 4 && !hostname$2(publicHost)) throw new Error("frp_public_origin_invalid");
+	if (isIP$1(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
 	return url.origin;
 }
 /** Validate the provisioning mode. */
@@ -10476,7 +10571,7 @@ function parseFrpSettings(value) {
 	if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
 	if (resolvedMode === "attach" && resolvedEntryTls === "public-ip-cert" && vhostHttpPort === void 0) throw new Error("frp_attach_mode_requires_vhost_port");
 	const publicOrigin = validateFrpPublicOrigin(record.publicOrigin);
-	if (resolvedEntryTls === "self-signed" && isIP(new URL(publicOrigin).hostname) !== 4) throw new Error("frp_self_signed_requires_public_ipv4");
+	if (resolvedEntryTls === "self-signed" && isIP$1(new URL(publicOrigin).hostname) !== 4) throw new Error("frp_self_signed_requires_public_ipv4");
 	return Object.freeze({
 		version: 1,
 		serverAddress: validateFrpServerAddress(record.serverAddress),
@@ -10830,7 +10925,7 @@ function frpAttachVpsParts(settings, options = {}) {
 		selfSigned: false,
 		vhostHttpPort,
 		snippet: `${FRP_CADDY_SNIPPET_MARKER}\n${site.trimEnd()}\n`,
-		certGuide: Object.freeze(isIP(publicHost) === 4 ? guideCommands(manualIpCertificateGuide(publicHost)) : [])
+		certGuide: Object.freeze(isIP$1(publicHost) === 4 ? guideCommands(manualIpCertificateGuide(publicHost)) : [])
 	});
 }
 /**
@@ -11255,6 +11350,31 @@ function parseAdditionalTrustedNetworks(value) {
 	}
 	return Object.freeze(entries);
 }
+/**
+* Refresh the legacy `upstreamOrigin` snapshot to the DSH port actually in use.
+*
+* The runtime deliberately follows the WebServer port instead of this field (a Desktop
+* profile can start with `--port 0`), but a stale snapshot is indistinguishable from a
+* stale gateway to whoever reads the file while diagnosing a restart — #273 became a
+* manual edit because of it. Rewriting it keeps the file honest without changing which
+* upstream the gateway uses.
+*
+* @param setupFile - Existing managed setup file.
+* @param setup - The setup as it was read.
+* @param webServerPort - The port the active DSH WebServer bound.
+* @returns Whether the file needed rewriting.
+*/
+async function refreshManagedUpstreamOrigin(setupFile, setup, webServerPort) {
+	if (!Number.isInteger(webServerPort) || webServerPort <= 0) return false;
+	const upstreamOrigin = `http://127.0.0.1:${String(webServerPort)}`;
+	if (setup.upstreamOrigin === upstreamOrigin) return false;
+	const next = Object.freeze({
+		...setup,
+		upstreamOrigin
+	});
+	await atomicWrite(setupFile, `${JSON.stringify(next, null, 2)}\n`);
+	return true;
+}
 /** Save extra trusted networks without replacing the interface or pairing identity.
 * @param setupFile - Existing managed setup file.
 * @param values - Explicitly selected additional networks.
@@ -11653,7 +11773,7 @@ function frpIngressPaths(stateFile) {
 		statusFile: join(dirname(stateFile), "ingress-identity.json")
 	});
 }
-async function regularFileExists(file) {
+async function regularFileExists$1(file) {
 	try {
 		const entry = await lstat(file);
 		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
@@ -11664,7 +11784,7 @@ async function regularFileExists(file) {
 	}
 }
 async function readIngressIdentity(file) {
-	if (!await regularFileExists(file)) return void 0;
+	if (!await regularFileExists$1(file)) return void 0;
 	try {
 		const parsed = JSON.parse(await readFile(file, "utf8"));
 		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("invalid identity");
@@ -11704,10 +11824,10 @@ async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now()
 	}
 	const previousFingerprint = await readIngressIdentity(paths.statusFile);
 	const [caCertExists, caKeyExists, leafCertExists, leafKeyExists] = await Promise.all([
-		regularFileExists(paths.caCertFile),
-		regularFileExists(paths.caKeyFile),
-		regularFileExists(paths.certFile),
-		regularFileExists(paths.keyFile)
+		regularFileExists$1(paths.caCertFile),
+		regularFileExists$1(paths.caKeyFile),
+		regularFileExists$1(paths.certFile),
+		regularFileExists$1(paths.keyFile)
 	]);
 	if (caCertExists !== caKeyExists || !caCertExists && (previousFingerprint !== void 0 || leafCertExists || leafKeyExists)) throw new Error("frp_ingress_ca_invalid");
 	if (caCertExists && (await readCertificateRenewal(paths.caCertFile, now)).state === "expired") throw new Error("frp_ingress_ca_expired");
@@ -11867,7 +11987,8 @@ const REMOTE_PROVIDERS = Object.freeze([
 	"cpolar",
 	"cloudflared",
 	"frp",
-	"origin"
+	"origin",
+	"iroh"
 ]);
 function aggregateErrors(errors, message) {
 	if (errors.length === 0) return void 0;
@@ -12027,7 +12148,7 @@ async function terminateRemoteProcess(child, gracefulTimeoutMs = 1500, forcedTim
 function parseRemoteProviderState(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
 	const record = value;
-	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "cloudflared" && record.provider !== "frp" && record.provider !== "origin" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "cloudflared" && record.provider !== "frp" && record.provider !== "origin" && record.provider !== "iroh" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
 	return Object.freeze({
 		version: 1,
 		provider: record.provider
@@ -12093,7 +12214,7 @@ var JsonRemoteProviderStore = class {
 /** Resolve the first-run provider without letting environment values bypass validation. */
 function configuredRemoteProvider(environment) {
 	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
-	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, or origin");
+	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin" && value !== "iroh") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, origin, or iroh");
 	return value;
 }
 //#endregion
@@ -12128,7 +12249,7 @@ const CLIENT_FAILURE_CODES = Object.freeze([
 function frpcDiagnosisCode(output) {
 	return CLIENT_FAILURE_CODES.find(([pattern]) => pattern.test(output))?.[1];
 }
-function publicStatus$3(status) {
+function publicStatus$4(status) {
 	return Object.freeze({
 		enabled: status.enabled,
 		state: status.state,
@@ -12334,7 +12455,7 @@ var FrpController = class {
 	child;
 	gatewayValue;
 	generation = 0;
-	latest = publicStatus$3({
+	latest = publicStatus$4({
 		enabled: false,
 		state: "off"
 	});
@@ -12364,7 +12485,7 @@ var FrpController = class {
 	}
 	/** Return state safe for the desktop control UI. */
 	status() {
-		return publicStatus$3(this.latest);
+		return publicStatus$4(this.latest);
 	}
 	/** Enable or disable FRP without changing LAN or another provider. */
 	async setEnabled(enabled) {
@@ -12430,7 +12551,7 @@ var FrpController = class {
 		return task;
 	}
 	publish(status) {
-		this.latest = publicStatus$3(status);
+		this.latest = publicStatus$4(status);
 		try {
 			this.options.onStatus?.(this.status());
 		} catch {}
@@ -12749,18 +12870,18 @@ function validateOriginPublicOrigin(value) {
 		"internal",
 		"home.arpa"
 	].some((suffix) => host === suffix || host.endsWith("." + suffix));
-	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
+	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP$1(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP$1(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
 	return url.origin;
 }
 /** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 function validateOriginListenHost(value) {
-	const addressFamily = isIP(value);
+	const addressFamily = isIP$1(value);
 	if (typeof value !== "string" || value.includes("%") || addressFamily === 0 || !addressAllowed(value, TRUSTED_NETWORKS.filter((range) => range.bits === (addressFamily === 6 ? 128 : 32)))) throw new Error("origin_listen_host_invalid");
 	return addressFamily === 6 ? new URL("http://[" + value + "]").hostname.slice(1, -1) : value;
 }
 /** Format a validated backend listener, including the brackets required by IPv6 URLs. */
 function formatOriginBackendOrigin(listenHost, listenPort) {
-	return "http://" + (isIP(listenHost) === 6 ? "[" + listenHost + "]" : listenHost) + ":" + String(listenPort);
+	return "http://" + (isIP$1(listenHost) === 6 ? "[" + listenHost + "]" : listenHost) + ":" + String(listenPort);
 }
 function validateOriginListenPort(value) {
 	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
@@ -12769,12 +12890,12 @@ function validateOriginListenPort(value) {
 }
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
 function validateOriginAllowedCidrs(value, listenHost) {
-	const addressFamily = isIP(listenHost);
+	const addressFamily = isIP$1(listenHost);
 	const input = value === void 0 && isLoopbackAddress(listenHost) ? [addressFamily === 6 ? "::1/128" : "127.0.0.0/8"] : value;
 	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
 	const cidrs = [];
 	for (const entry of input) {
-		if (typeof entry !== "string" || entry.length > 64 || entry.includes("%") || isIP(entry.split("/")[0] ?? "") !== addressFamily) throw new Error("origin_allowed_cidrs_invalid");
+		if (typeof entry !== "string" || entry.length > 64 || entry.includes("%") || isIP$1(entry.split("/")[0] ?? "") !== addressFamily) throw new Error("origin_allowed_cidrs_invalid");
 		try {
 			const cidr = parseCidr(entry);
 			if (cidr.bits !== (addressFamily === 6 ? 128 : 32) || !TRUSTED_NETWORKS.some((range) => cidr.bits === range.bits && cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
@@ -13390,7 +13511,7 @@ const RESERVED_CLOUDFLARED_LABELS = Object.freeze([
 	"update",
 	"login"
 ]);
-function publicStatus$2(status) {
+function publicStatus$3(status) {
 	return Object.freeze({
 		enabled: status.enabled,
 		state: status.state,
@@ -13510,7 +13631,7 @@ var CloudflaredController = class {
 	buffer = "";
 	mode = "quick";
 	namedOrigin;
-	latest = publicStatus$2({
+	latest = publicStatus$3({
 		enabled: false,
 		state: "off"
 	});
@@ -13538,7 +13659,7 @@ var CloudflaredController = class {
 	}
 	/** Return state safe for the desktop control UI. */
 	status() {
-		return publicStatus$2(this.latest);
+		return publicStatus$3(this.latest);
 	}
 	/** Enable or disable cloudflared without changing LAN or other provider state. */
 	async setEnabled(enabled) {
@@ -13604,7 +13725,7 @@ var CloudflaredController = class {
 		return task;
 	}
 	publish(status) {
-		this.latest = publicStatus$2(status);
+		this.latest = publicStatus$3(status);
 		try {
 			this.options.onStatus?.(this.status());
 		} catch {}
@@ -13911,7 +14032,7 @@ function hostname$1(value) {
 function validateCloudflaredTunnelHostname(value) {
 	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253) throw new Error("cloudflared_tunnel_hostname_invalid");
 	const normalized = value.toLowerCase().replace(/\.$/u, "");
-	if (isIP(normalized) !== 0 || !hostname$1(normalized) || normalized.includes("*") || RESERVED_APEX_NAMES.includes(normalized) || normalized.endsWith(QUICK_TUNNEL_SUFFIX) || normalized.endsWith(TUNNEL_ROUTING_SUFFIX)) throw new Error("cloudflared_tunnel_hostname_invalid");
+	if (isIP$1(normalized) !== 0 || !hostname$1(normalized) || normalized.includes("*") || RESERVED_APEX_NAMES.includes(normalized) || normalized.endsWith(QUICK_TUNNEL_SUFFIX) || normalized.endsWith(TUNNEL_ROUTING_SUFFIX)) throw new Error("cloudflared_tunnel_hostname_invalid");
 	return normalized;
 }
 /** Validate the stable loopback port Cloudflare's ingress forwards to. */
@@ -14082,186 +14203,1593 @@ var CloudflaredTunnelStore = class {
 	}
 };
 //#endregion
-//#region src/task-events.ts
-const TASK_EVENT_DEBOUNCE_MS = 1e3;
-function turnNumber(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+//#region src/iroh-files.ts
+async function renameIrohPath(root, source, destination) {
+	await renameManagedPath(root, source, destination, "iroh");
 }
-function turnData(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
-		turn: 0,
-		completed: false
-	};
-	const record = value;
-	const reason = record.reason;
-	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
-	return {
-		turn: turnNumber(record.turn),
-		completed
-	};
+async function ensureIrohDirectory(root, directory) {
+	await ensureManagedDirectory(root, directory, "iroh");
 }
-/**
-* Subscribe to completed root turns. Subagent turns are skipped so one task
-* announces once, and rapid turn boundaries collapse into a single event.
-* Returns a disposer that also drops pending debounces.
-*/
-function watchTaskCompletions(ctx, options) {
-	const debounceMs = options.debounceMs ?? 1e3;
-	const pending = /* @__PURE__ */ new Map();
-	const disposeListener = ctx.on("session/event", (session, event) => {
-		if (event.type !== "turn/end") return;
-		const { turn, completed } = turnData(event.data);
-		if (!completed) return;
-		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
-		const sessionId = String(session.id);
-		options.log?.("task-completed-observed", {
-			sessionId,
-			turn
-		});
-		const previous = pending.get(sessionId);
-		if (previous !== void 0) clearTimeout(previous);
-		pending.set(sessionId, setTimeout(() => {
-			pending.delete(sessionId);
-			options.log?.("task-completed-announced", {
-				sessionId,
-				turn
-			});
-			options.onTaskCompleted(Object.freeze({
-				sessionId,
-				turn
-			}));
-		}, debounceMs));
-	});
-	return () => {
-		disposeListener();
-		for (const timer of pending.values()) clearTimeout(timer);
-		pending.clear();
-	};
+async function removeIrohTree(root, target) {
+	await removeManagedTree(root, target, "iroh");
 }
-/** One subscription feeding every live gateway; gateways register on start. */
-var TaskEventHub = class {
-	sinks = /* @__PURE__ */ new Set();
-	/** Register a sink; returns its disposer. */
-	add(sink) {
-		this.sinks.add(sink);
-		return () => {
-			this.sinks.delete(sink);
-		};
-	}
-	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
-	broadcast(event) {
-		for (const sink of [...this.sinks]) try {
-			sink.broadcastTaskEvent(event);
-		} catch {}
-	}
-	/** Visible for tests. */
-	get size() {
-		return this.sinks.size;
-	}
-};
 //#endregion
-//#region src/diagnostics.ts
-/** Recognize the active remote-web-ui boot hook without evaluating or modifying it. */
-function hasCompetingRemoteChannelBoot(rows) {
-	return rows.some((row) => row.kind === "script" && row.text?.includes("__DSH_REMOTE_CHANNEL_BOOT__") === true);
-}
-const REMOTE_ERROR_GUIDANCE = Object.freeze({
-	component_missing: "重新安装完整插件包。",
-	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
-	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
-	funnel_start_failed: "重新打开授权页并允许 Funnel。",
-	funnel_start_timeout: "检查网络后点击“重新连接”。",
-	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
-	sidecar_launch_failed: "重新安装完整插件包后重试。",
-	sidecar_stopped: "点击“重新连接”。",
-	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	control_channel_failed: "点击“重新连接”。",
-	cpolar_component_missing: "先安装 cpolar 官方组件。",
-	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
-	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
-	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
-	cpolar_start_timeout: "检查网络后点击“重新连接”。",
-	cpolar_stopped: "点击“重新连接”。",
-	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	cloudflared_component_missing: "先安装 cloudflared 官方组件。",
-	cloudflared_component_invalid: "彻底移除 cloudflared 组件后重新安装。",
-	cloudflared_port_unavailable: "无法分配本机远程网关端口，请重试。",
-	cloudflared_launch_failed: "重新安装 cloudflared 官方组件后重试。",
-	cloudflared_start_timeout: "检查网络后点击“重新连接”。",
-	cloudflared_stopped: "点击“重新连接”。",
-	cloudflared_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	cloudflared_invalid_output: "cloudflared 返回了无法识别的状态。",
-	cloudflared_invalid_origin: "cloudflared 返回的公网地址未通过校验。",
-	origin_config_missing: "先保存自有反向代理配置。",
-	origin_config_invalid: "重新保存自有反向代理配置。",
-	origin_listen_port_in_use: "更换 HTTP 后端端口；不要使用局域网的 3443、DSH 自身的 3080，或已被 cloudflared 隧道占用的 3444。",
-	origin_listen_address_unavailable: "监听地址不属于当前电脑，请重新选择本机的私网 IPv4 地址。",
-	origin_gateway_start_failed: "检查 HTTP 后端监听地址和端口后重新连接。",
-	frp_component_missing: "先安装 FRP 官方组件。",
-	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
-	frp_config_missing: "先保存自建 FRP 连接配置。",
-	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
-	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
-	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
-	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
-	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
-	frp_proxy_name_in_use: "该 frps 上已有同名代理：在另一台 DSH 电脑上关闭自建 FRP，或在 frps 上清掉该代理后重新连接。",
-	frp_remote_port_in_use: "公网入口端口被其他代理占用：改用其他入口端口后重新连接。",
-	frp_proxy_start_failed: "查看 frps 日志与 allowPorts，确认它能接受该代理名和入口端口。",
-	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
-	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
-	frp_stopped: "点击“重新连接”。",
-	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
-	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
+//#region src/iroh-manifest.ts
+/** Checksum-gated resolution of the iroh transport host binary.
+*
+* The sidecar is built and published by the independent `dsh-mobile-iroh`
+* companion (npm alpha channel); this stable plugin never bundles, downloads
+* or rebuilds it. Resolution points at an installed companion directory,
+* validates its manifest against that package's own version, then verifies
+* the platform binary byte-for-byte. Anything unexpected fails closed.
+*/
+const IROH_NATIVE_TARGETS = Object.freeze({
+	"win32-x64": "dsh-mobile-iroh-host-win32-x64.exe",
+	"linux-x64": "dsh-mobile-iroh-host-linux-x64"
 });
-function check(id, status, reason, label, detail, action, facts) {
+const MAX_BINARY_BYTES = 134217728;
+const MAX_MANIFEST_BYTES = 4096;
+function exactKeys(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+}
+/** Validate the complete package-bound inventory; artifact paths are never supplied by metadata. */
+function validateIrohNativeManifest(value, packageVersion) {
+	if (!exactKeys(value, [
+		"schemaVersion",
+		"packageVersion",
+		"artifacts"
+	]) || value.schemaVersion !== 1 || value.packageVersion !== packageVersion || !exactKeys(value.artifacts, Object.keys(IROH_NATIVE_TARGETS))) throw new Error("iroh_native_manifest_invalid");
+	const artifacts = {};
+	for (const target of Object.keys(IROH_NATIVE_TARGETS)) {
+		const entry = value.artifacts[target];
+		if (!exactKeys(entry, [
+			"file",
+			"bytes",
+			"sha256"
+		]) || entry.file !== IROH_NATIVE_TARGETS[target] || !Number.isSafeInteger(entry.bytes) || entry.bytes < 64 || entry.bytes > MAX_BINARY_BYTES || typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/u.test(entry.sha256)) throw new Error("iroh_native_manifest_invalid");
+		artifacts[target] = Object.freeze({
+			file: entry.file,
+			bytes: entry.bytes,
+			sha256: entry.sha256
+		});
+	}
 	return Object.freeze({
-		id,
-		status,
-		reason,
-		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
-		label,
-		detail,
-		...action === void 0 ? {} : { action }
+		schemaVersion: 1,
+		packageVersion: value.packageVersion,
+		artifacts: Object.freeze(artifacts)
 	});
 }
-function maskLanOrigin(origin) {
-	if (origin === void 0) return "未分配";
+/**
+* Return the checksum-verified sidecar inside an installed companion package.
+* @param companionRoot - Companion package directory (contains `package.json` + `native/`).
+*/
+async function resolveIrohSidecarAt(companionRoot, platform, arch) {
+	const target = `${platform}-${arch}`;
+	if (!Object.hasOwn(IROH_NATIVE_TARGETS, target)) throw new Error("iroh_native_platform_unsupported");
+	const root = await realpath(resolve(companionRoot)).catch(() => {
+		throw new Error("iroh_native_missing");
+	});
+	const nativeDirectory = join(root, "native");
+	const directory = await lstat(nativeDirectory).catch(() => {
+		throw new Error("iroh_native_missing");
+	});
+	if (!directory.isDirectory() || directory.isSymbolicLink()) throw new Error("iroh_native_file_invalid");
+	const manifestPath = join(nativeDirectory, "manifest.json");
+	const manifestStat = await lstat(manifestPath).catch(() => {
+		throw new Error("iroh_native_missing");
+	});
+	if (!manifestStat.isFile() || manifestStat.isSymbolicLink() || manifestStat.size > MAX_MANIFEST_BYTES) throw new Error("iroh_native_manifest_invalid");
+	let manifest;
 	try {
-		const url = new URL(origin);
-		const octets = url.hostname.split(".");
-		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
-		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
-	} catch {
-		return "地址格式无效";
+		const pkg = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+		if (typeof pkg.version !== "string") throw new Error("iroh_native_manifest_invalid");
+		manifest = validateIrohNativeManifest(JSON.parse(await readFile(manifestPath, "utf8")), pkg.version);
+	} catch (error) {
+		if (error instanceof Error && error.message === "iroh_native_manifest_invalid") throw error;
+		throw new Error("iroh_native_manifest_invalid");
 	}
-}
-function remoteSuffix(origin) {
-	if (origin === void 0) return "未分配";
+	const expected = manifest.artifacts[target];
+	const path = join(nativeDirectory, IROH_NATIVE_TARGETS[target]);
+	const before = await lstat(path).catch(() => {
+		throw new Error("iroh_native_missing");
+	});
+	if (!before.isFile() || before.isSymbolicLink() || before.size !== expected.bytes) throw new Error("iroh_native_file_invalid");
+	const file = await open(path, "r").catch(() => {
+		throw new Error("iroh_native_missing");
+	});
 	try {
-		const hostname = new URL(origin).hostname;
-		if (hostname.endsWith(".ts.net")) return "*.ts.net";
-		if (hostname.endsWith(".trycloudflare.com")) return "*.trycloudflare.com";
-		for (const suffix of [
-			".cpolar.cn",
-			".cpolar.io",
-			".cpolar.top",
-			".cpolar.com"
-		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
-		return "公共 HTTPS 地址";
-	} catch {
-		return "地址格式无效";
+		const opened = await file.stat();
+		if (!opened.isFile() || opened.size !== expected.bytes || opened.ino !== before.ino || opened.dev !== before.dev) throw new Error("iroh_native_file_invalid");
+		const hash = createHash("sha256");
+		let bytes = 0;
+		for await (const chunk of file.createReadStream({ autoClose: false })) {
+			const buffer = chunk;
+			bytes += buffer.length;
+			if (bytes > expected.bytes) throw new Error("iroh_native_file_changed");
+			hash.update(buffer);
+		}
+		if (hash.digest("hex") !== expected.sha256) throw new Error("iroh_native_hash_mismatch");
+		const after = await lstat(path);
+		if (after.isSymbolicLink() || after.ino !== opened.ino || after.dev !== opened.dev || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs) throw new Error("iroh_native_file_changed");
+	} finally {
+		await file.close();
 	}
+	if (process.platform !== "win32" && platform !== "win32" && (before.mode & 73) === 0) throw new Error("iroh_native_not_executable");
+	return path;
 }
-function defaultFirewallProbe(platform = process.platform) {
-	return async (port) => {
-		if (platform !== "win32") return { state: "not-applicable" };
-		if (port === void 0) return { state: "unknown" };
-		const script = [
-			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
-			"$ready = $true",
-			"$specs | ForEach-Object {",
-			"  $spec = $_",
+//#endregion
+//#region src/iroh-component.ts
+/** Managed view of the iroh transport host sidecar.
+*
+* Explicit installation verifies and promotes a pinned sidecar release into
+* private storage. A verified independent companion copy can be reused without
+* downloading. Enabling the channel alone never downloads a component.
+*/
+const IROH_VERSION = "0.1.0-alpha.1";
+const IROH_RELEASE_PAGE = "https://github.com/saya-ch/dsh-mobile-iroh/releases";
+const IROH_COMPONENT_RELEASES = Object.freeze({
+	"linux-x64": Object.freeze({
+		version: IROH_VERSION,
+		platform: "linux",
+		arch: "x64",
+		executableName: "dsh-mobile-iroh-host-linux-x64",
+		downloadUrl: "https://unpkg.com/dsh-mobile-iroh@0.1.0-alpha.1/native/dsh-mobile-iroh-host-linux-x64",
+		downloadBytes: 24451352,
+		executableBytes: 24451352,
+		downloadSha256: "be391dfba3f0f1323d4fe9989e56a0554ceaf74e00a44acdf4a3bfd163bdcab5",
+		executableSha256: "be391dfba3f0f1323d4fe9989e56a0554ceaf74e00a44acdf4a3bfd163bdcab5"
+	}),
+	"win32-x64": Object.freeze({
+		version: IROH_VERSION,
+		platform: "win32",
+		arch: "x64",
+		executableName: "dsh-mobile-iroh-host-win32-x64.exe",
+		downloadUrl: "https://unpkg.com/dsh-mobile-iroh@0.1.0-alpha.1/native/dsh-mobile-iroh-host-win32-x64.exe",
+		downloadBytes: 14865920,
+		executableBytes: 14865920,
+		downloadSha256: "883987c636a379dc999a7f15fd1f9addbb7d28f430ed1f952ad5a610c37cc032",
+		executableSha256: "883987c636a379dc999a7f15fd1f9addbb7d28f430ed1f952ad5a610c37cc032"
+	})
+});
+async function digest$1(file) {
+	return createHash("sha256").update(await readFile(file)).digest("hex");
+}
+function digestBytes(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+var IrohComponentManager = class {
+	stateDirectory;
+	platform;
+	arch;
+	locateCompanionRoots;
+	resolveSidecar;
+	artifact;
+	fetchArtifact;
+	componentRoot;
+	componentStorage;
+	executablePath;
+	stagingRoot;
+	cached;
+	cachedExecutable;
+	origin;
+	queue = Promise.resolve();
+	constructor(options) {
+		if (typeof options.stateDirectory !== "string" || options.stateDirectory === "" || !isAbsolute(options.stateDirectory)) throw new Error("iroh component state directory invalid");
+		this.stateDirectory = resolve(options.stateDirectory);
+		this.platform = options.platform ?? process.platform;
+		this.arch = options.arch ?? process.arch;
+		const artifact = options.artifact ?? IROH_COMPONENT_RELEASES[`${this.platform}-${this.arch}`];
+		if (artifact !== void 0 && (artifact.platform !== this.platform || artifact.arch !== this.arch || !/^https:\/\//u.test(artifact.downloadUrl) || !/^[a-f0-9]{64}$/u.test(artifact.downloadSha256) || !/^[a-f0-9]{64}$/u.test(artifact.executableSha256) || artifact.downloadBytes < 1 || artifact.executableBytes < 1 || !/^[a-z0-9.-]+$/u.test(artifact.executableName))) throw new Error("iroh_artifact_invalid");
+		this.artifact = artifact;
+		this.locateCompanionRoots = options.locateCompanionRoots ?? (() => []);
+		this.resolveSidecar = options.resolveSidecar ?? resolveIrohSidecarAt;
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => downloadPinnedArtifact({
+			url,
+			signal,
+			expectedBytes: artifact?.downloadBytes ?? 0,
+			errorPrefix: "iroh",
+			redirectHosts: ["unpkg.com"]
+		}));
+		this.componentRoot = join(this.stateDirectory, "components", "iroh");
+		this.componentStorage = join(this.componentRoot, artifact?.version ?? "0.1.0-alpha.1");
+		this.executablePath = join(this.componentStorage, artifact?.executableName ?? (this.platform === "win32" ? "dsh-mobile-iroh-host-win32-x64.exe" : "dsh-mobile-iroh-host-linux-x64"));
+		this.stagingRoot = join(this.stateDirectory, "staging", "iroh");
+		this.cached = this.baseStatus();
+	}
+	/** Resolved, verified sidecar executable, or undefined when unavailable. */
+	get executable() {
+		return this.cachedExecutable;
+	}
+	/** Cached component state; refresh with {@link initialize} or {@link install}. */
+	status() {
+		return this.cached;
+	}
+	/** Verify the sidecar once at startup; safe to call before any status read. */
+	async initialize() {
+		await this.enqueue(() => this.refresh());
+	}
+	/**
+	* Confirm a usable sidecar without downloading anything.
+	*
+	* Enabling the channel calls this: starting must never trigger a download
+	* on its own. Only the explicit install button below may fetch bytes.
+	*/
+	async ensureAvailable() {
+		return this.enqueue(async () => {
+			const current = await this.refresh();
+			if (!(this.artifact !== void 0)) throw new Error("iroh_platform_unsupported");
+			if (!current.installed) throw new Error("iroh_companion_missing");
+			return current;
+		});
+	}
+	/**
+	* Ensure a verified sidecar in the plugin private directory.
+	*
+	* Prefers an already installed companion copy (no network), otherwise
+	* downloads the pinned release and verifies size and SHA-256 before
+	* promoting it. A companion that exists but fails verification is reported
+	* instead of being silently replaced by a download.
+	*/
+	async install() {
+		return this.enqueue(async () => {
+			const artifact = this.artifact;
+			if (artifact === void 0) throw new Error("iroh_platform_unsupported");
+			const stateValid = await this.checkStateExecutable(artifact).catch(() => void 0);
+			if (stateValid !== void 0) {
+				this.publishInstalled(artifact, this.executablePath, stateValid, "state");
+				return this.cached;
+			}
+			const companion = await this.findCompanionExecutable().catch(() => void 0);
+			if (companion !== void 0) {
+				if (companion.valid) {
+					await this.publishBytes(artifact, await readFile(companion.executable));
+					return this.cached;
+				}
+				this.origin = void 0;
+				this.cachedExecutable = void 0;
+				this.cached = Object.freeze({
+					...this.baseStatus(),
+					installed: false,
+					errorCode: "irohSidecarInvalid"
+				});
+				throw new Error("iroh_sidecar_invalid");
+			}
+			let bytes;
+			try {
+				bytes = await this.downloadArtifact(artifact);
+			} catch (error) {
+				if (error instanceof Error && error.message.startsWith("iroh_")) throw error;
+				throw new Error("iroh_download_failed", { cause: error });
+			}
+			await this.publishBytes(artifact, bytes);
+			return this.cached;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	baseStatus() {
+		const supported = this.artifact !== void 0;
+		return Object.freeze({
+			supported,
+			installed: false,
+			version: "",
+			downloadBytes: this.artifact?.downloadBytes ?? 0,
+			installedBytes: 0,
+			sourceUrl: this.artifact?.downloadUrl ?? "https://www.npmjs.com/package/dsh-mobile-iroh",
+			releasePage: IROH_RELEASE_PAGE,
+			storagePath: this.stateDirectory,
+			...supported ? {} : { errorCode: "irohPlatformUnsupported" }
+		});
+	}
+	publishInstalled(artifact, executable, version, origin) {
+		this.origin = origin;
+		this.cachedExecutable = executable;
+		this.cached = Object.freeze({
+			supported: true,
+			installed: true,
+			version,
+			downloadBytes: artifact.downloadBytes,
+			installedBytes: artifact.executableBytes,
+			sourceUrl: artifact.downloadUrl,
+			releasePage: IROH_RELEASE_PAGE,
+			storagePath: executable
+		});
+	}
+	async checkStateExecutable(artifact) {
+		const entry = await lstat(this.executablePath);
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== artifact.executableBytes) throw new Error("iroh_sidecar_invalid");
+		if (this.platform !== "win32" && (entry.mode & 73) === 0) throw new Error("iroh_sidecar_invalid");
+		if (await digest$1(this.executablePath) !== artifact.executableSha256) throw new Error("iroh_sidecar_invalid");
+		return artifact.version;
+	}
+	async findCompanionExecutable() {
+		for (const root of this.locateCompanionRoots()) try {
+			const executable = await this.resolveSidecar(root, this.platform, this.arch);
+			await lstat(executable);
+			let version = "";
+			try {
+				const pkg = JSON.parse(await readFile(join(root, "package.json"), "utf8"));
+				if (pkg.name === "dsh-mobile-iroh" && typeof pkg.version === "string") version = pkg.version;
+			} catch {}
+			return {
+				executable,
+				version,
+				valid: true
+			};
+		} catch (error) {
+			if (error instanceof Error && error.message === "iroh_native_platform_unsupported") continue;
+			if (error instanceof Error && (error.message === "iroh_native_hash_mismatch" || error.message === "iroh_native_file_changed" || error.message === "iroh_native_file_invalid" || error.message === "iroh_native_manifest_invalid" || error.message === "iroh_native_not_executable")) return {
+				executable: "",
+				version: "",
+				valid: false
+			};
+		}
+	}
+	async downloadArtifact(artifact) {
+		const controller = new AbortController();
+		const timeout = setTimeout(() => {
+			controller.abort(/* @__PURE__ */ new Error("iroh_download_timeout"));
+		}, 6e5);
+		timeout.unref();
+		try {
+			const bytes = await this.fetchArtifact(artifact.downloadUrl, controller.signal);
+			if (bytes.byteLength !== artifact.downloadBytes) throw new Error("iroh_download_size_mismatch");
+			if (digestBytes(bytes) !== artifact.downloadSha256) throw new Error("iroh_download_hash_mismatch");
+			return bytes;
+		} finally {
+			clearTimeout(timeout);
+		}
+	}
+	async publishBytes(artifact, bytes) {
+		if (bytes.byteLength !== artifact.executableBytes || digestBytes(bytes) !== artifact.executableSha256) throw new Error("iroh_download_hash_mismatch");
+		await ensureIrohDirectory(this.stateDirectory, this.stagingRoot);
+		await ensureIrohDirectory(this.stateDirectory, this.componentRoot);
+		const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+		const staged = join(staging, artifact.executableName);
+		const backup = join(this.componentRoot, `.previous-${Date.now().toString(36)}`);
+		let movedPrevious = false;
+		try {
+			await writeFile(staged, bytes, {
+				flag: "wx",
+				mode: 448
+			});
+			await chmod(staged, 448);
+			if (digestBytes(await readFile(staged)) !== artifact.executableSha256) throw new Error("iroh_download_hash_mismatch");
+			await ensureIrohDirectory(this.stateDirectory, this.componentStorage);
+			try {
+				await lstat(this.executablePath);
+				await renameIrohPath(this.stateDirectory, this.componentStorage, backup);
+				movedPrevious = true;
+				await ensureIrohDirectory(this.stateDirectory, this.componentStorage);
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+			}
+			try {
+				await rename(staged, this.executablePath);
+			} catch (error) {
+				if (movedPrevious) try {
+					await renameIrohPath(this.stateDirectory, backup, this.componentStorage);
+					movedPrevious = false;
+				} catch {}
+				throw error;
+			}
+			this.publishInstalled(artifact, this.executablePath, artifact.version, "state");
+		} finally {
+			const leftovers = movedPrevious ? [staging, backup] : [staging];
+			const failures = [];
+			for (const path of leftovers) try {
+				await removeIrohTree(this.stateDirectory, path);
+			} catch (error) {
+				failures.push(error);
+			}
+			if (failures.length > 0) throw new AggregateError(failures, "iroh_component_cleanup_failed");
+		}
+	}
+	async refresh() {
+		if (this.artifact === void 0) {
+			this.origin = void 0;
+			this.cachedExecutable = void 0;
+			this.cached = this.baseStatus();
+			return this.cached;
+		}
+		const stateVersion = await this.checkStateExecutable(this.artifact).catch(() => void 0);
+		if (stateVersion !== void 0) {
+			this.publishInstalled(this.artifact, this.executablePath, stateVersion, "state");
+			return this.cached;
+		}
+		const companion = await this.findCompanionExecutable().catch(() => void 0);
+		if (companion !== void 0 && companion.valid) {
+			this.publishInstalled(this.artifact, companion.executable, companion.version, "companion");
+			return this.cached;
+		}
+		const stateExists = await lstat(this.executablePath).then((entry) => entry.isFile() && !entry.isSymbolicLink()).catch(() => false);
+		this.origin = void 0;
+		this.cachedExecutable = void 0;
+		this.cached = Object.freeze({
+			...this.baseStatus(),
+			installed: false,
+			...stateExists || companion !== void 0 && !companion.valid ? { errorCode: "irohSidecarInvalid" } : {}
+		});
+		return this.cached;
+	}
+};
+//#endregion
+//#region src/iroh-sidecar.ts
+/** Versioned parent-to-sidecar protocol for the iroh transport host.
+*
+* Ported from the independent `dsh-mobile-iroh` companion's sidecar
+* controller. Only the pure command/event codec lives here; child-process
+* ownership stays with the provider controller so lifecycle, timeouts and
+* test doubles follow this repository's existing controller conventions.
+* Every message is versioned, bounded and rejected closed on unknown fields.
+*/
+const MAX_LINE_BYTES$1 = 16384;
+const ENDPOINT_ID_PATTERN$1 = /^[0-9a-f]{64}$/u;
+function isPlainText(value, maximum) {
+	return typeof value === "string" && value.length > 0 && value.length <= maximum && !/[\u0000-\u001f\u007f]/u.test(value);
+}
+function hasExactFields(value, fields) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return Object.keys(value).sort().join(",") === [...fields].sort().join(",");
+}
+function stripBrackets(hostname) {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function isEndpointId(value) {
+	return typeof value === "string" && ENDPOINT_ID_PATTERN$1.test(value);
+}
+/** Validate the loopback socket destination; TLS remains end to end. */
+function validateIrohProxyTarget(value) {
+	const target = new URL(value);
+	if (!["http:", "https:"].includes(target.protocol) || !["127.0.0.1", "::1"].includes(stripBrackets(target.hostname)) || target.username !== "" || target.password !== "" || target.pathname !== "/" || target.search !== "" || target.hash !== "") throw new Error("sidecar proxy target must be an explicit HTTP(S) loopback origin");
+	return target.origin;
+}
+/** Strict parent-to-sidecar v1 command encoder. */
+function encodeIrohCommand(message) {
+	if (message?.version !== 1) throw new Error("invalid sidecar command version");
+	if (!hasExactFields(message, message.type === "device-forget" ? [
+		"version",
+		"type",
+		"id"
+	] : ["version", "type"]) || ![
+		"pairing-begin",
+		"device-list",
+		"device-forget",
+		"shutdown"
+	].includes(message.type) || message.type === "device-forget" && !isEndpointId(message.id)) throw new Error("invalid sidecar command");
+	const line = JSON.stringify(message);
+	if (Buffer.byteLength(line) > MAX_LINE_BYTES$1) throw new Error("sidecar command too large");
+	return `${line}\n`;
+}
+function isDirectAddress(value) {
+	if (!isPlainText(value, 128)) return false;
+	try {
+		const url = new URL(`http://${value}`);
+		return isIP(stripBrackets(url.hostname)) !== 0 && url.port !== "" && url.pathname === "/" && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+	} catch {
+		return false;
+	}
+}
+/** Decode exact first-party stdout events; no extension fields grant authority. */
+function decodeIrohEvent(line) {
+	if (typeof line !== "string" || Buffer.byteLength(line) > MAX_LINE_BYTES$1) throw new Error("sidecar event too large");
+	let event;
+	try {
+		event = JSON.parse(line);
+	} catch {
+		throw new Error("invalid sidecar event JSON");
+	}
+	if (event?.version !== 1 || typeof event.type !== "string") throw new Error("invalid sidecar event version");
+	const base = ["version", "type"];
+	const fields = {
+		ready: [
+			"endpoint_id",
+			"direct_addresses",
+			"local_only"
+		],
+		pairing: ["code", "expires_in_sec"],
+		"pairing-closed": ["reason"],
+		"pairing-done": ["peer", "name"],
+		"peer-connected": ["peer", "name"],
+		"peer-path": [
+			"peer",
+			"kind",
+			"remote"
+		],
+		"peer-disconnected": ["peer"],
+		"proxy-opened": ["peer"],
+		devices: ["devices"],
+		error: ["code", "message"],
+		stopped: []
+	}[event.type];
+	if (fields === void 0 || !hasExactFields(event, [...base, ...fields])) throw new Error("invalid sidecar event fields");
+	if ("peer" in event && !isEndpointId(event.peer)) throw new Error("invalid sidecar event peer");
+	if ("name" in event && !isPlainText(event.name, 128)) throw new Error("invalid sidecar event name");
+	switch (event.type) {
+		case "ready": {
+			const addresses = event.direct_addresses;
+			if (!isEndpointId(event.endpoint_id) || typeof event.local_only !== "boolean" || !Array.isArray(addresses) || addresses.length > 64 || !addresses.every(isDirectAddress)) throw new Error("invalid sidecar ready event");
+			return Object.freeze({
+				version: 1,
+				type: "ready",
+				endpoint_id: event.endpoint_id,
+				direct_addresses: Object.freeze([...addresses]),
+				local_only: event.local_only
+			});
+		}
+		case "pairing":
+			if (!/^[0-9]{6}$/u.test(String(event.code)) || !Number.isSafeInteger(event.expires_in_sec) || event.expires_in_sec < 1 || event.expires_in_sec > 3600) throw new Error("invalid sidecar pairing event");
+			break;
+		case "pairing-closed":
+			if (!isPlainText(event.reason, 128)) throw new Error("invalid sidecar reason");
+			break;
+		case "peer-path":
+			if (event.kind !== "direct" && event.kind !== "relay" || !isPlainText(event.remote, 512)) throw new Error("invalid sidecar path event");
+			break;
+		case "devices": {
+			const devices = event.devices;
+			if (!Array.isArray(devices) || devices.length > 256 || !devices.every((device) => hasExactFields(device, [
+				"id",
+				"name",
+				"paired_at",
+				"online"
+			]) && isEndpointId(device.id) && isPlainText(device.name, 128) && isPlainText(device.paired_at, 64) && typeof device.online === "boolean")) throw new Error("invalid sidecar device event");
+			return Object.freeze({
+				version: 1,
+				type: "devices",
+				devices: Object.freeze(devices.map((device) => Object.freeze({ ...device })))
+			});
+		}
+		case "error": if (!isPlainText(event.code, 128) || !isPlainText(event.message, 1024)) throw new Error("invalid sidecar error event");
+	}
+	return Object.freeze(event);
+}
+//#endregion
+//#region src/iroh-origin.ts
+/** Identity-derived browser origins for the raw TLS-over-iroh carrier.
+*
+* Ported from the independent `dsh-mobile-iroh` companion's origin contract.
+* The local port is a deployment choice; changing it changes browser storage
+* identity, so the selected port is part of every persisted record.
+*/
+const DEFAULT_IROH_LOCAL_PORT = 25443;
+const ENDPOINT_ID_PATTERN = /^[a-f0-9]{64}$/u;
+function checkEndpointId(endpointId) {
+	if (typeof endpointId !== "string" || !ENDPOINT_ID_PATTERN.test(endpointId)) throw new Error("iroh endpoint id must be a lowercase 32-byte public key");
+}
+function checkLocalPort(localPort) {
+	if (!Number.isSafeInteger(localPort) || localPort < 1024 || localPort > 65535) throw new Error("iroh local port must be from 1024 through 65535");
+}
+/** Keep the full endpoint key in DNS-safe labels rather than a colliding port hash. */
+function irohHostname(endpointId) {
+	checkEndpointId(endpointId);
+	return `${endpointId.slice(0, 32)}.${endpointId.slice(32)}.iroh.localhost`;
+}
+/** HTTPS origin the phone's local transport listener serves for one endpoint. */
+function irohOrigin(endpointId, localPort = DEFAULT_IROH_LOCAL_PORT) {
+	checkLocalPort(localPort);
+	return `https://${irohHostname(endpointId)}:${localPort}`;
+}
+/** Reject an Origin that does not belong to the selected cryptographic host identity. */
+function validateIrohOrigin(value, endpointId, localPort = DEFAULT_IROH_LOCAL_PORT) {
+	const expected = irohOrigin(endpointId, localPort);
+	if (value !== expected) throw new Error("iroh origin does not match the selected endpoint and local port");
+	return expected;
+}
+//#endregion
+//#region src/iroh-pairing.ts
+/** Short-lived iroh pairing descriptors for QR transport.
+*
+* Byte-compatible with the independent `dsh-mobile-iroh` companion's
+* descriptor v1: the same field order, byte budget, CA checks and
+* duplicate-key rejection, so a future Phase 2 phone accepts QR codes from
+* either side. Error messages never contain the descriptor, pairing code,
+* or gateway token.
+*/
+const PAIRING_DESCRIPTOR_VERSION = 1;
+const PAIRING_DESCRIPTOR_TYPE = "dsh-mobile-iroh-pairing";
+const MAX_PAIRING_DESCRIPTOR_BYTES = 2200;
+const MAX_PAIRING_LIFETIME_MS = 6e5;
+const FIELDS = Object.freeze([
+	"version",
+	"type",
+	"endpointId",
+	"origin",
+	"localPort",
+	"irohCode",
+	"gatewayToken",
+	"caCertificate",
+	"instanceId",
+	"expiresAt"
+]);
+const HEX_ID = /^[a-f0-9]{64}$/u;
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
+/** Error messages never contain the descriptor, pairing code, or gateway token. */
+var PairingDescriptorError = class extends Error {
+	code;
+	constructor(code) {
+		super(code);
+		this.name = "PairingDescriptorError";
+		this.code = code;
+	}
+};
+function reject(code) {
+	throw new PairingDescriptorError(code);
+}
+function validateCertificate(value, instanceId, now, expiresAt) {
+	if (typeof value !== "string" || value.length === 0 || value.length > Math.ceil(512) * 4 || !BASE64.test(value)) reject("invalid_pairing_ca_encoding");
+	const encoded = value;
+	const der = Buffer.from(encoded, "base64");
+	if (der.length === 0 || der.length > 1536 || der.toString("base64") !== encoded) reject("invalid_pairing_ca_encoding");
+	let ca;
+	try {
+		ca = new X509Certificate(der);
+	} catch {
+		reject("invalid_pairing_ca_certificate");
+	}
+	if (!ca.raw.equals(der)) reject("invalid_pairing_ca_certificate");
+	try {
+		if (!ca.ca || ca.subject !== ca.issuer || !ca.verify(ca.publicKey)) reject("pairing_ca_must_be_self_signed");
+	} catch (error) {
+		if (error instanceof PairingDescriptorError) throw error;
+		reject("pairing_ca_must_be_self_signed");
+	}
+	const notBefore = Date.parse(ca.validFrom);
+	const notAfter = Date.parse(ca.validTo);
+	if (!Number.isFinite(notBefore) || !Number.isFinite(notAfter) || now < notBefore || expiresAt > notAfter) reject("pairing_ca_outside_validity");
+	if (createHash("sha256").update(der).digest("hex") !== instanceId) reject("pairing_ca_fingerprint_mismatch");
+}
+/**
+* Validate QR transport material, not a DSH Session or persistent credential.
+* localPort is mandatory on the wire and must match the identity-derived HTTPS
+* Origin. The QR is sensitive: only the public CA may be retained or logged on
+* its own; neither pairing secret may be copied into logs or device-list text.
+*
+* Scanning this descriptor is the user's out-of-band trust action. A self-signed
+* CA does not independently authenticate a QR received from an untrusted party.
+*/
+function validatePairingDescriptor(value, options = {}) {
+	const now = options.now ?? Date.now();
+	if (!Number.isSafeInteger(now) || now < 0) reject("invalid_pairing_clock");
+	if (value === null || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)) || Object.keys(value).sort().join(",") !== [...FIELDS].sort().join(",")) reject("invalid_pairing_fields");
+	const record = value;
+	if (record.version !== 1 || record.type !== "dsh-mobile-iroh-pairing") reject("unsupported_pairing_descriptor");
+	if (typeof record.endpointId !== "string" || !HEX_ID.test(record.endpointId)) reject("invalid_pairing_endpoint");
+	if (!Number.isSafeInteger(record.localPort) || record.localPort < 1024 || record.localPort > 65535) reject("invalid_pairing_local_port");
+	if (record.origin !== irohOrigin(record.endpointId, record.localPort)) reject("invalid_pairing_origin");
+	if (typeof record.irohCode !== "string" || !/^[0-9]{6}$/u.test(record.irohCode)) reject("invalid_iroh_pairing_code");
+	if (typeof record.gatewayToken !== "string" || !/^[A-Za-z0-9_-]{43}$/u.test(record.gatewayToken) || Buffer.from(record.gatewayToken, "base64url").toString("base64url") !== record.gatewayToken) reject("invalid_gateway_pairing_token");
+	if (typeof record.instanceId !== "string" || !HEX_ID.test(record.instanceId)) reject("invalid_pairing_instance_id");
+	if (!Number.isSafeInteger(record.expiresAt) || record.expiresAt <= now || record.expiresAt - now > 6e5) reject("invalid_pairing_expiry");
+	validateCertificate(record.caCertificate, record.instanceId, now, record.expiresAt);
+	const descriptor = Object.fromEntries(FIELDS.map((field) => [field, record[field]]));
+	if (Buffer.byteLength(JSON.stringify(descriptor), "utf8") > 2200) reject("pairing_descriptor_too_large");
+	return Object.freeze(descriptor);
+}
+/** Encode a bounded canonical-field-order QR payload without implicit defaults. */
+function encodePairingDescriptor(value, options = {}) {
+	return JSON.stringify(validatePairingDescriptor(value, options));
+}
+/** Decode untrusted QR text, validating its expiry and public CA before use. */
+function decodePairingDescriptor(encoded, options = {}) {
+	if (typeof encoded !== "string" || Buffer.byteLength(encoded, "utf8") > 2200) reject("pairing_descriptor_too_large");
+	let value;
+	try {
+		value = JSON.parse(encoded);
+	} catch {
+		reject("invalid_pairing_json");
+	}
+	const descriptor = validatePairingDescriptor(value, options);
+	if ((encoded.match(/"(?:[^"\\]|\\[\s\S])*"\s*:/gu) ?? []).length !== FIELDS.length) reject("duplicate_pairing_fields");
+	return descriptor;
+}
+/** Phone-side listener port advertised in QR codes minted by this computer. */
+const PAIRING_DESCRIPTOR_LOCAL_PORT = DEFAULT_IROH_LOCAL_PORT;
+//#endregion
+//#region src/iroh.ts
+/** Experimental iroh remote transport as a first-class remote provider.
+*
+* The sidecar is distributed by this plugin itself: an explicit install
+* downloads a pinned release into the plugin private directory (an installed
+* companion copy is reused without downloading during the transition). The
+* controller owns exactly one sidecar child process plus one dedicated
+* loopback gateway, and status flows through the same coordinator, control
+* routes and task-event fan-out as every other remote provider. Enabling the
+* channel never downloads anything; only the install button may fetch bytes.
+* `ready` therefore means the sidecar is connected and the gateway serves
+* its loopback socket.
+*/
+const READY_TIMEOUT_MS = 45e3;
+const IDENTITY_TIMEOUT_MS = 15e3;
+const IDENTITY_METADATA_MAX_BYTES = 8192;
+const PAIRING_TIMEOUT_MS = 15e3;
+const MAX_LINE_BYTES = 16384;
+/** Gateway pairing windows default to five minutes; the descriptor caps at ten. */
+const MAX_PAIRING_WINDOW_MS = 3e5;
+const MIN_PAIRING_WINDOW_MS = 1e4;
+function publicStatus$2(status) {
+	return Object.freeze({ ...status });
+}
+/**
+* Prepare the sidecar's private identity/TLS state and resolve its endpoint.
+*
+* Failed termination is reported separately; the controller retains the child
+* until close so shutdown/reconnect can retry cleanup before starting a successor.
+* @param executable - verified sidecar path.
+* @param dataDir - private directory owning the endpoint identity.
+* @param options - child ownership callback and optional launcher/deadline overrides.
+* @returns the validated endpoint identity after the probe closes.
+*/
+async function defaultResolveIdentity(executable, dataDir, options = {}) {
+	const args = [
+		"--lang",
+		"en",
+		"tls-prepare",
+		"--data-dir",
+		dataDir
+	];
+	const child = options.launch === void 0 ? spawn(executable, args, {
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	}) : options.launch(executable, args);
+	options.onSpawn?.(child);
+	let output = Buffer.alloc(0);
+	let settled = false;
+	return await new Promise((resolve, reject) => {
+		const fail = (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(deadline);
+			terminateRemoteProcess(child).then(() => {
+				reject(new Error(code));
+			}, () => {
+				reject(new AggregateError([new Error(code), /* @__PURE__ */ new Error("iroh_probe_stop_failed")], "iroh_identity_cleanup_failed"));
+			});
+		};
+		const deadline = setTimeout(() => {
+			fail("iroh_identity_timeout");
+		}, options.timeoutMs ?? IDENTITY_TIMEOUT_MS);
+		deadline.unref?.();
+		child.stdout.on("data", (chunk) => {
+			if (settled) return;
+			if (output.length + chunk.length > IDENTITY_METADATA_MAX_BYTES) {
+				fail("iroh_identity_output_too_large");
+				return;
+			}
+			output = Buffer.concat([output, chunk]);
+		});
+		child.stderr?.resume();
+		child.once("error", () => {
+			fail("iroh_identity_failed");
+		});
+		child.once("close", (code) => {
+			clearTimeout(deadline);
+			if (settled) return;
+			settled = true;
+			let metadata;
+			try {
+				metadata = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(output));
+			} catch {
+				reject(/* @__PURE__ */ new Error("iroh_identity_invalid"));
+				return;
+			}
+			if (code !== 0 || typeof metadata !== "object" || metadata === null || !("version" in metadata) || metadata.version !== 1 || !("endpointId" in metadata) || typeof metadata.endpointId !== "string" || !/^[0-9a-f]{64}$/u.test(metadata.endpointId)) reject(/* @__PURE__ */ new Error("iroh_identity_invalid"));
+			else resolve(metadata.endpointId);
+		});
+	});
+}
+var IrohController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	generation = 0;
+	queue = Promise.resolve();
+	latest = publicStatus$2({
+		enabled: false,
+		state: "off"
+	});
+	gatewayValue;
+	child;
+	identityChild;
+	closeTask;
+	endpointId;
+	constructor(options) {
+		this.options = options;
+		if (typeof options.dataDirectory !== "string" || options.dataDirectory === "") throw new Error("iroh data directory invalid");
+		if (typeof options.createGateway !== "function") throw new Error("iroh gateway factory invalid");
+	}
+	async initialize(initialState) {
+		await this.enqueue(async () => {
+			const state = initialState ?? await this.options.store.load();
+			if (this.disposed) return;
+			this.enabled = state.enabled;
+			this.initialized = true;
+			if (this.enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+	}
+	/** Return the active iroh-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return this.latest;
+	}
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("iroh controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled ? this.latest.state === "ready" : this.child === void 0 && this.identityChild === void 0 && this.gatewayValue === void 0)) return;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			this.enabled = enabled;
+			if (!enabled) await this.stop();
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart iroh while retaining its sidecar identity and devices. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("iroh controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+				this.enabled = true;
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable iroh without deleting its sidecar identity or companion files. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("iroh controller is unavailable");
+		await this.enqueue(async () => {
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.enabled = false;
+			await this.stop();
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/**
+	* Mint one short-lived pairing descriptor for a QR code.
+	*
+	* Requires a live channel: the sidecar issues its six-digit code while the
+	* gateway opens a one-time pairing window, and the descriptor binds both to
+	* the pinned CA. Opening again replaces both windows without returning the
+	* replaced secrets. The Phase 2 phone redeems the gateway token through the
+	* ordinary pair endpoint over the iroh transport.
+	*/
+	async beginPairing() {
+		if (!this.initialized || this.disposed) throw new Error("iroh controller is unavailable");
+		return this.enqueue(async () => {
+			const generation = this.generation;
+			const child = this.child;
+			const gateway = this.gatewayValue;
+			const endpointId = this.endpointId;
+			if (!this.enabled || child === void 0 || gateway === void 0 || endpointId === void 0) throw new Error("iroh_not_ready");
+			let buffered;
+			do
+				buffered = child.stdout.read();
+			while (buffered !== null);
+			try {
+				child.stdin.write(encodeIrohCommand({
+					version: 1,
+					type: "pairing-begin"
+				}));
+			} catch {
+				throw new Error("iroh_not_ready");
+			}
+			const pairing = await this.waitForPairingCode(child, this.options.pairingTimeoutMs ?? PAIRING_TIMEOUT_MS);
+			if (generation !== this.generation || !this.enabled || this.child !== child || this.gatewayValue !== gateway) throw new Error("iroh_not_ready");
+			if (pairing === void 0) throw new Error("iroh_pairing_failed");
+			const ttlMs = Math.min(Math.max(pairing.expiresInSec * 1e3, MIN_PAIRING_WINDOW_MS), MAX_PAIRING_WINDOW_MS);
+			const opened = await gateway.access.openPairing(ttlMs).catch((error) => {
+				throw new Error("iroh_pairing_failed", { cause: error });
+			});
+			const expiresAt = Math.min(Date.now() + pairing.expiresInSec * 1e3, opened.expiresAt);
+			if (expiresAt - Date.now() > 6e5) throw new Error("iroh_pairing_failed");
+			const resolvePairingCa = this.options.resolvePairingCa;
+			if (resolvePairingCa === void 0) throw new Error("iroh_pairing_failed");
+			const ca = await resolvePairingCa().catch((error) => {
+				throw new Error("iroh_pairing_failed", { cause: error });
+			});
+			const encoded = encodePairingDescriptor({
+				version: 1,
+				type: "dsh-mobile-iroh-pairing",
+				endpointId,
+				origin: irohOrigin(endpointId, DEFAULT_IROH_LOCAL_PORT),
+				localPort: DEFAULT_IROH_LOCAL_PORT,
+				irohCode: pairing.code,
+				gatewayToken: opened.token,
+				caCertificate: ca.der.toString("base64"),
+				instanceId: ca.fingerprint,
+				expiresAt
+			});
+			return {
+				descriptor: JSON.parse(encoded),
+				encoded,
+				code: pairing.code,
+				expiresAt
+			};
+		});
+	}
+	/** Stop all iroh resources without changing the remembered switch. */
+	async close() {
+		if (this.closeTask !== void 0) return this.closeTask;
+		this.disposed = true;
+		this.generation += 1;
+		const close = this.queue.then(() => this.stop(), () => this.stop());
+		this.closeTask = close;
+		try {
+			await close;
+		} catch (error) {
+			this.closeTask = void 0;
+			throw error;
+		}
+	}
+	enqueue(operation) {
+		const run = () => this.disposed ? Promise.reject(/* @__PURE__ */ new Error("iroh controller is unavailable")) : operation();
+		const task = this.queue.then(run, run);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$2(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async failGeneration(generation, errorCode, origin) {
+		if (generation !== this.generation) return;
+		this.generation += 1;
+		this.publish({
+			enabled: this.enabled,
+			state: "error",
+			...origin === void 0 ? {} : { origin },
+			errorCode
+		});
+		await this.stopResources();
+	}
+	async stop() {
+		this.generation += 1;
+		await this.stopResources();
+	}
+	async stopResources() {
+		const child = this.child;
+		const identityChild = this.identityChild;
+		const gateway = this.gatewayValue;
+		this.endpointId = void 0;
+		await settleRemoteResources([
+			async () => {
+				if (child === void 0) return;
+				try {
+					child.stdin.write(encodeIrohCommand({
+						version: 1,
+						type: "shutdown"
+					}));
+				} catch {}
+				await terminateRemoteProcess(child);
+				if (this.child === child) this.child = void 0;
+			},
+			async () => {
+				if (identityChild === void 0) return;
+				await terminateRemoteProcess(identityChild);
+				if (this.identityChild === identityChild) this.identityChild = void 0;
+			},
+			async () => {
+				await gateway?.close();
+				if (this.gatewayValue === gateway) this.gatewayValue = void 0;
+			}
+		], "iroh resource cleanup failed");
+	}
+	async start() {
+		await this.stopResources();
+		if (this.disposed || !this.enabled) return;
+		const generation = ++this.generation;
+		let executable;
+		try {
+			const available = await this.options.component.ensureAvailable();
+			executable = this.options.component.executable ?? available.storagePath;
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "iroh_companion_missing"
+			});
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
+		if (executable === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "iroh_companion_missing"
+			});
+			return;
+		}
+		await mkdir(this.options.dataDirectory, {
+			recursive: true,
+			mode: 448
+		}).catch(() => {
+			throw new Error("iroh_data_directory_invalid");
+		});
+		await restrictPrivateDirectory(this.options.dataDirectory).catch(() => {
+			throw new Error("iroh_data_directory_invalid");
+		});
+		if (generation !== this.generation || !this.enabled) return;
+		let endpointId;
+		try {
+			endpointId = this.options.resolveIdentity === void 0 ? await defaultResolveIdentity(executable, this.options.dataDirectory, { onSpawn: (child) => {
+				this.identityChild = child;
+				child.once("close", () => {
+					if (this.identityChild === child) this.identityChild = void 0;
+				});
+			} }) : await this.options.resolveIdentity(executable, this.options.dataDirectory);
+		} catch (error) {
+			await this.failGeneration(generation, error instanceof AggregateError ? "iroh_identity_cleanup_failed" : "iroh_identity_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
+		const origin = irohOrigin(endpointId);
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin
+		});
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(endpointId);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed", origin);
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		try {
+			validateIrohProxyTarget(`http://127.0.0.1:${gateway.address().port}/`);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed", origin);
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
+		let child;
+		try {
+			child = (this.options.launchSidecar ?? ((file, args) => spawn(file, [...args], {
+				stdio: [
+					"pipe",
+					"pipe",
+					"pipe"
+				],
+				windowsHide: true
+			})))(executable, [
+				"--lang",
+				"en",
+				"host",
+				"--data-dir",
+				this.options.dataDirectory,
+				"--proxy-target",
+				`127.0.0.1:${gateway.address().port}`
+			]);
+		} catch {
+			await this.failGeneration(generation, "iroh_launch_failed", origin);
+			return;
+		}
+		this.child = child;
+		const onFailure = () => {
+			if (this.disposed || generation !== this.generation) return;
+			this.enqueue(() => this.failGeneration(generation, "iroh_exited", origin)).catch(() => {
+				if (!this.disposed && this.generation === generation + 1) this.publish({
+					enabled: this.enabled,
+					state: "error",
+					origin,
+					errorCode: "iroh_cleanup_failed"
+				});
+			});
+		};
+		child.once("error", onFailure);
+		child.once("close", onFailure);
+		child.stdin.on("error", onFailure);
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		try {
+			const ready = await this.waitForReady(child, endpointId, this.options.readyTimeoutMs ?? READY_TIMEOUT_MS);
+			if (generation !== this.generation || !this.enabled) return;
+			if (!ready) {
+				await this.failGeneration(generation, "iroh_start_timeout", origin);
+				return;
+			}
+			this.endpointId = endpointId;
+			this.publish({
+				enabled: true,
+				state: "ready",
+				origin
+			});
+		} catch {
+			await this.failGeneration(generation, "iroh_start_failed", origin);
+		}
+	}
+	waitForReady(child, endpointId, timeoutMs) {
+		return new Promise((resolve) => {
+			let pending = Buffer.alloc(0);
+			let settled = false;
+			const finish = (ready) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(deadline);
+				child.stdout.off("data", onData);
+				resolve(ready);
+			};
+			const deadline = setTimeout(() => finish(false), timeoutMs);
+			deadline.unref?.();
+			const onData = (chunk) => {
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				if (pending.length + buffer.length > 64 * MAX_LINE_BYTES) {
+					finish(false);
+					return;
+				}
+				pending = Buffer.concat([pending, buffer]);
+				let index = pending.indexOf(10);
+				while (index !== -1) {
+					const line = pending.subarray(0, index).toString("utf8");
+					pending = pending.subarray(index + 1);
+					let event;
+					try {
+						event = decodeIrohEvent(line);
+					} catch {
+						finish(false);
+						return;
+					}
+					if (event.type === "ready") {
+						finish(event.endpoint_id === endpointId);
+						return;
+					}
+					if (event.type === "error") {
+						finish(false);
+						return;
+					}
+					index = pending.indexOf(10);
+				}
+			};
+			child.stdout.on("data", onData);
+			child.once("error", () => finish(false));
+			child.once("close", () => finish(false));
+		});
+	}
+	waitForPairingCode(child, timeoutMs) {
+		return new Promise((resolve) => {
+			let pending = Buffer.alloc(0);
+			let settled = false;
+			const finish = (pairing) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(deadline);
+				child.stdout.off("data", onData);
+				resolve(pairing);
+			};
+			const deadline = setTimeout(() => finish(void 0), timeoutMs);
+			deadline.unref?.();
+			const onData = (chunk) => {
+				const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+				if (pending.length + buffer.length > 64 * MAX_LINE_BYTES) {
+					finish(void 0);
+					return;
+				}
+				pending = Buffer.concat([pending, buffer]);
+				let index = pending.indexOf(10);
+				while (index !== -1) {
+					const line = pending.subarray(0, index).toString("utf8");
+					pending = pending.subarray(index + 1);
+					let event;
+					try {
+						event = decodeIrohEvent(line);
+					} catch {
+						finish(void 0);
+						return;
+					}
+					if (event.type === "pairing") {
+						finish({
+							code: event.code,
+							expiresInSec: event.expires_in_sec
+						});
+						return;
+					}
+					if (event.type === "error") {
+						finish(void 0);
+						return;
+					}
+					index = pending.indexOf(10);
+				}
+			};
+			child.stdout.on("data", onData);
+			child.once("error", () => finish(void 0));
+			child.once("close", () => finish(void 0));
+		});
+	}
+};
+//#endregion
+//#region src/iroh-tls.ts
+/** Self-signed TLS identity for the experimental iroh gateway.
+*
+* Reuses this repository's managed CA path (`managed-setup.ts`) instead of
+* the companion's native TLS manager: the CA persists under the iroh state
+* directory, one leaf carries the identity-derived DNS name, and corrupt or
+* foreign material fails closed rather than regenerating silently. The
+* gateway terminates TLS with this leaf (see `irohGatewayConfig`), so the
+* sidecar only proxies opaque bytes and the app pins the CA from
+* `GET /mobile-access/ca.cer` in Phase 2.
+*/
+/** Leaf lifetime and renewal headroom, matching the companion's native policy. */
+const IROH_LEAF_VALIDITY_DAYS = 90;
+const IROH_LEAF_RENEW_BEFORE_DAYS = 30;
+/** Private TLS directory, always a sibling of the remote device file. */
+function irohTlsPaths(stateFile, ownedRoot) {
+	const directory = join(ownedRoot ?? dirname(stateFile), "iroh-tls");
+	return Object.freeze({
+		directory,
+		caCertFile: join(directory, "ca.pem"),
+		caKeyFile: join(directory, "ca-key.pem"),
+		certFile: join(directory, "server.pem"),
+		keyFile: join(directory, "server-key.pem"),
+		statusFile: join(dirname(stateFile), "iroh-identity.json")
+	});
+}
+async function regularFileExists(file) {
+	try {
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("iroh_tls_file_invalid");
+		return true;
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		return false;
+	}
+}
+async function readIrohIdentity(file) {
+	if (!await regularFileExists(file)) return void 0;
+	try {
+		const parsed = JSON.parse(await readFile(file, "utf8"));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("invalid identity");
+		const record = parsed;
+		if (record.version !== 1 || typeof record.endpointId !== "string" || !/^[a-f0-9]{64}$/u.test(record.endpointId) || typeof record.caFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(record.caFingerprint)) throw new Error("invalid identity");
+		return Object.freeze({
+			endpointId: record.endpointId,
+			caFingerprint: record.caFingerprint
+		});
+	} catch (error) {
+		throw new Error("iroh_tls_ca_invalid", { cause: error });
+	}
+}
+async function writeIrohIdentity(file, identity, ownedRoot) {
+	await writeManagedPrivateFile(ownedRoot, file, `${JSON.stringify({
+		version: 1,
+		endpointId: identity.endpointId,
+		caFingerprint: identity.caFingerprint
+	})}\n`, "iroh_tls");
+}
+function fingerprintOf(certificate) {
+	return certificate.fingerprint256.replaceAll(":", "").toLowerCase();
+}
+function leafCoversEndpoint(leaf, endpointId, now) {
+	const hostname = irohHostname(endpointId);
+	if (!(leaf.subjectAltName ?? "").split(",").map((entry) => entry.trim()).includes(`DNS:${hostname}`)) return false;
+	const notAfter = Date.parse(leaf.validTo);
+	if (!Number.isFinite(notAfter)) return false;
+	return notAfter - now > 2592e6 && Date.parse(leaf.validFrom) <= now;
+}
+/**
+* Materialize the CA and endpoint leaf the iroh gateway terminates TLS with.
+*
+* A recorded CA fingerprint that no longer matches fails closed: deleting or
+* replacing the CA is an explicit operator act, never an automatic recovery.
+* The endpoint may change under a stable CA; only the leaf is re-issued then.
+*/
+async function ensureIrohTls(endpointId, stateFile, ownedRoot, now = Date.now()) {
+	if (!/^[a-f0-9]{64}$/u.test(endpointId)) throw new Error("iroh endpoint id must be a lowercase 32-byte public key");
+	await assertManagedParents(ownedRoot, stateFile, "iroh_tls");
+	const paths = irohTlsPaths(stateFile, ownedRoot);
+	const identity = await readIrohIdentity(paths.statusFile);
+	const ca = await ensureManagedCa({
+		mode: "managed",
+		caCertFile: paths.caCertFile,
+		caKeyFile: paths.caKeyFile,
+		certFile: paths.certFile,
+		keyFile: paths.keyFile
+	}).catch((error) => {
+		throw new Error("iroh_tls_ca_invalid", { cause: error });
+	});
+	const caFingerprint = fingerprintOf(ca);
+	if (identity !== void 0 && identity.caFingerprint !== caFingerprint) throw new Error("iroh_tls_ca_invalid");
+	let leaf;
+	if (await regularFileExists(paths.certFile) && await regularFileExists(paths.keyFile)) try {
+		const [certPem, keyPem] = await Promise.all([readFile(paths.certFile, "utf8"), readFile(paths.keyFile, "utf8")]);
+		const candidate = new X509Certificate(certPem);
+		const key = createPrivateKey(keyPem);
+		if (!candidate.ca && candidate.verify(ca.publicKey) && candidate.checkPrivateKey(key) && leafCoversEndpoint(candidate, endpointId, now)) leaf = candidate;
+	} catch {
+		throw new Error("iroh_tls_ca_invalid");
+	}
+	if (leaf === void 0) {
+		await issueServerCertificate({
+			caCertFile: paths.caCertFile,
+			caKeyFile: paths.caKeyFile
+		}, {
+			commonName: "DeepSeek Harness Mobile iroh",
+			dnsNames: [irohHostname(endpointId)]
+		}, {
+			certFile: paths.certFile,
+			keyFile: paths.keyFile
+		}, 90).catch((error) => {
+			throw new Error("iroh_tls_leaf_invalid", { cause: error });
+		});
+		try {
+			const [certPem, keyPem] = await Promise.all([readFile(paths.certFile, "utf8"), readFile(paths.keyFile, "utf8")]);
+			const candidate = new X509Certificate(certPem);
+			const key = createPrivateKey(keyPem);
+			if (candidate.ca || !candidate.verify(ca.publicKey) || !candidate.checkPrivateKey(key) || !leafCoversEndpoint(candidate, endpointId, Date.now())) throw new Error("iroh_tls_leaf_invalid");
+			leaf = candidate;
+		} catch (error) {
+			if (error instanceof Error && (error.message === "iroh_tls_leaf_invalid" || error.message === "iroh_tls_ca_invalid")) throw error;
+			throw new Error("iroh_tls_leaf_invalid", { cause: error });
+		}
+	}
+	await writeIrohIdentity(paths.statusFile, {
+		endpointId,
+		caFingerprint
+	}, ownedRoot);
+	return Object.freeze({
+		paths,
+		ca,
+		leaf,
+		caFingerprint,
+		endpointId
+	});
+}
+/**
+* Gateway config for the iroh endpoint-pinned entry.
+*
+* Like the self-signed FRP ingress, the gateway itself terminates TLS: the
+* sidecar only forwards raw TCP, so the listener speaks HTTPS with the leaf
+* the iroh CA signed, and the pairing CA is retained so the app can pin it
+* from `GET /mobile-access/ca.cer`. The listener stays on loopback because
+* the public path is the iroh transport, never a direct bind.
+*/
+function irohGatewayConfig(template, endpointId, stateFile, tls, listenPort = 0) {
+	const { pairingCaFile: _templateCaFile, ...shared } = template;
+	const authority = new URL(irohOrigin(endpointId, DEFAULT_IROH_LOCAL_PORT)).host;
+	return Object.freeze({
+		...shared,
+		listenHost: "127.0.0.1",
+		listenPort,
+		authorities: Object.freeze([parseAuthority(authority)]),
+		allowedCidrs: Object.freeze([parseCidr("127.0.0.0/8")]),
+		stateFile,
+		instanceId: tls.caFingerprint,
+		pairingCaFile: tls.paths.caCertFile,
+		tls: Object.freeze({
+			mode: "provided",
+			certFile: tls.paths.certFile,
+			keyFile: tls.paths.keyFile
+		}),
+		publicTls: true,
+		discovery: false,
+		pairingTtlMs: 3e5
+	});
+}
+//#endregion
+//#region src/task-events.ts
+const TASK_EVENT_DEBOUNCE_MS = 1e3;
+function turnNumber(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function turnData(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
+		turn: 0,
+		completed: false
+	};
+	const record = value;
+	const reason = record.reason;
+	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
+	return {
+		turn: turnNumber(record.turn),
+		completed
+	};
+}
+/**
+* Subscribe to completed root turns. Subagent turns are skipped so one task
+* announces once, and rapid turn boundaries collapse into a single event.
+* Returns a disposer that also drops pending debounces.
+*/
+function watchTaskCompletions(ctx, options) {
+	const debounceMs = options.debounceMs ?? 1e3;
+	const pending = /* @__PURE__ */ new Map();
+	const disposeListener = ctx.on("session/event", (session, event) => {
+		if (event.type !== "turn/end") return;
+		const { turn, completed } = turnData(event.data);
+		if (!completed) return;
+		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
+		const sessionId = String(session.id);
+		options.log?.("task-completed-observed", {
+			sessionId,
+			turn
+		});
+		const previous = pending.get(sessionId);
+		if (previous !== void 0) clearTimeout(previous);
+		pending.set(sessionId, setTimeout(() => {
+			pending.delete(sessionId);
+			options.log?.("task-completed-announced", {
+				sessionId,
+				turn
+			});
+			options.onTaskCompleted(Object.freeze({
+				sessionId,
+				turn
+			}));
+		}, debounceMs));
+	});
+	return () => {
+		disposeListener();
+		for (const timer of pending.values()) clearTimeout(timer);
+		pending.clear();
+	};
+}
+/** One subscription feeding every live gateway; gateways register on start. */
+var TaskEventHub = class {
+	sinks = /* @__PURE__ */ new Set();
+	/** Register a sink; returns its disposer. */
+	add(sink) {
+		this.sinks.add(sink);
+		return () => {
+			this.sinks.delete(sink);
+		};
+	}
+	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
+	broadcast(event) {
+		for (const sink of [...this.sinks]) try {
+			sink.broadcastTaskEvent(event);
+		} catch {}
+	}
+	/** Visible for tests. */
+	get size() {
+		return this.sinks.size;
+	}
+};
+//#endregion
+//#region src/diagnostics.ts
+/** Recognize the active remote-web-ui boot hook without evaluating or modifying it. */
+function hasCompetingRemoteChannelBoot(rows) {
+	return rows.some((row) => row.kind === "script" && row.text?.includes("__DSH_REMOTE_CHANNEL_BOOT__") === true);
+}
+const REMOTE_ERROR_GUIDANCE = Object.freeze({
+	component_missing: "重新安装完整插件包。",
+	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
+	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
+	funnel_start_failed: "重新打开授权页并允许 Funnel。",
+	funnel_start_timeout: "检查网络后点击“重新连接”。",
+	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
+	sidecar_launch_failed: "重新安装完整插件包后重试。",
+	sidecar_stopped: "点击“重新连接”。",
+	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	control_channel_failed: "点击“重新连接”。",
+	cpolar_component_missing: "先安装 cpolar 官方组件。",
+	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
+	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
+	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
+	cpolar_start_timeout: "检查网络后点击“重新连接”。",
+	cpolar_stopped: "点击“重新连接”。",
+	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_component_missing: "先安装 cloudflared 官方组件。",
+	cloudflared_component_invalid: "彻底移除 cloudflared 组件后重新安装。",
+	cloudflared_port_unavailable: "无法分配本机远程网关端口，请重试。",
+	cloudflared_launch_failed: "重新安装 cloudflared 官方组件后重试。",
+	cloudflared_start_timeout: "检查网络后点击“重新连接”。",
+	cloudflared_stopped: "点击“重新连接”。",
+	cloudflared_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_invalid_output: "cloudflared 返回了无法识别的状态。",
+	cloudflared_invalid_origin: "cloudflared 返回的公网地址未通过校验。",
+	origin_config_missing: "先保存自有反向代理配置。",
+	origin_config_invalid: "重新保存自有反向代理配置。",
+	origin_listen_port_in_use: "更换 HTTP 后端端口；不要使用局域网的 3443、DSH 自身的 3080，或已被 cloudflared 隧道占用的 3444。",
+	origin_listen_address_unavailable: "监听地址不属于当前电脑，请重新选择本机的私网 IPv4 地址。",
+	origin_gateway_start_failed: "检查 HTTP 后端监听地址和端口后重新连接。",
+	frp_component_missing: "先安装 FRP 官方组件。",
+	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
+	frp_config_missing: "先保存自建 FRP 连接配置。",
+	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
+	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
+	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
+	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
+	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
+	frp_proxy_name_in_use: "该 frps 上已有同名代理：在另一台 DSH 电脑上关闭自建 FRP，或在 frps 上清掉该代理后重新连接。",
+	frp_remote_port_in_use: "公网入口端口被其他代理占用：改用其他入口端口后重新连接。",
+	frp_proxy_start_failed: "查看 frps 日志与 allowPorts，确认它能接受该代理名和入口端口。",
+	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
+	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
+	frp_stopped: "点击“重新连接”。",
+	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
+	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
+});
+function check(id, status, reason, label, detail, action, facts) {
+	return Object.freeze({
+		id,
+		status,
+		reason,
+		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
+		label,
+		detail,
+		...action === void 0 ? {} : { action }
+	});
+}
+function maskLanOrigin(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const url = new URL(origin);
+		const octets = url.hostname.split(".");
+		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
+		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
+	} catch {
+		return "地址格式无效";
+	}
+}
+function remoteSuffix(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const hostname = new URL(origin).hostname;
+		if (hostname.endsWith(".ts.net")) return "*.ts.net";
+		if (hostname.endsWith(".trycloudflare.com")) return "*.trycloudflare.com";
+		for (const suffix of [
+			".cpolar.cn",
+			".cpolar.io",
+			".cpolar.top",
+			".cpolar.com"
+		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
+		return "公共 HTTPS 地址";
+	} catch {
+		return "地址格式无效";
+	}
+}
+function defaultFirewallProbe(platform = process.platform) {
+	return async (port) => {
+		if (platform !== "win32") return { state: "not-applicable" };
+		if (port === void 0) return { state: "unknown" };
+		const script = [
+			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
+			"$ready = $true",
+			"$specs | ForEach-Object {",
+			"  $spec = $_",
 			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
 			"  if ($null -eq $rule) { $ready = $false; return }",
 			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
@@ -14559,7 +16087,7 @@ function reportLine(entry) {
 /** Run bounded read-only checks and return a report safe to paste into an issue. */
 async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	const checks = [];
-	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
+	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.provider !== "iroh" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
 	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
 	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
 	if (snapshot.competingRemoteChannelBoot === true) checks.push(check("remote-plugin-conflict", "warning", "competing-remote-channel", "第三方远程插件", "检测到另一套远程请求通道脚本；手机页面可能进入该插件自己的配对流程。", "在电脑端关闭 dsh-remote-web-ui 的远程访问后刷新，再使用 DSH Mobile 当前二维码配对；不要混用两种配对码。"));
@@ -14578,6 +16106,7 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
 	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
 	else if (snapshot.remote.provider === "origin" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-origin-ready", "远程通道", "私网 HTTP 后端已就绪；未检测公网 HTTPS、证书或 WebSocket 连通性。", "在手机上经反向代理验证连接；代理须保留原始 Host（含端口）并支持 WebSocket。", { provider: "origin" }));
+	else if (snapshot.remote.provider === "iroh" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-iroh-ready", "远程通道", "iroh 通道已就绪；端点身份为回环 TLS，不从电脑端探测手机可达性。", "在手机上用配对二维码验证连接；二维码过期或通道报错时重新生成并重连。", { provider: "iroh" }));
 	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
 		const endpointSuffix = remoteSuffix(snapshot.remote.origin);
 		const facts = {
@@ -14731,7 +16260,7 @@ function shellQuote(value) {
 * shared frpc settings stay permissive so local loopback test rigs keep working.
 */
 function assertPublicSshTarget(serverAddress) {
-	if (isIP(serverAddress) === 4 && !isGloballyRoutableIpv4(serverAddress)) throw new Error("vps_server_not_public");
+	if (isIP$1(serverAddress) === 4 && !isGloballyRoutableIpv4(serverAddress)) throw new Error("vps_server_not_public");
 }
 /**
 * Validate a VPS address for every operation that opens a network connection
@@ -14740,7 +16269,7 @@ function assertPublicSshTarget(serverAddress) {
 */
 function validateVpsServerTarget(serverAddress) {
 	const address = validateFrpServerAddress(serverAddress);
-	if (isIP(address) !== 0 && address.includes(":")) throw new Error("vps_ipv6_ssh_not_supported");
+	if (isIP$1(address) !== 0 && address.includes(":")) throw new Error("vps_ipv6_ssh_not_supported");
 	assertPublicSshTarget(address);
 	return address;
 }
@@ -16958,7 +18487,7 @@ function parseCaddySettings(value) {
 		3080
 	].includes(Number(listenPort))) throw new Error("caddy_listen_port_reserved");
 	const publicOrigin = validateOriginPublicOrigin(record.publicOrigin);
-	if (isIP(new URL(publicOrigin).hostname) !== 0) throw new Error("caddy_domain_required");
+	if (isIP$1(new URL(publicOrigin).hostname) !== 0) throw new Error("caddy_domain_required");
 	return Object.freeze({
 		version: 1,
 		publicOrigin,
@@ -18395,6 +19924,7 @@ function mapAdminError(error) {
 		"frp_settings_invalid"
 	].includes(error.message)) return new HttpError(400, error.message);
 	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message.startsWith("iroh_")) return new HttpError(409, error.message);
 	if (error instanceof Error && [
 		"origin_settings_invalid",
 		"origin_public_origin_invalid",
@@ -18578,7 +20108,7 @@ function originGatewayConfig(template, settings, stateFile, instanceId, listenPo
 		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration, caddyComponentStatus) {
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration, caddyComponentStatus, irohComponent) {
 	return {
 		provider,
 		running: status.enabled,
@@ -18621,10 +20151,34 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				state: providerStatuses.origin.state,
 				configuration: originConfiguration,
 				component: caddyComponentStatus
+			},
+			iroh: {
+				bundled: false,
+				running: providerStatuses.iroh.enabled,
+				state: providerStatuses.iroh.state,
+				component: irohComponent
 			}
 		}
 	};
 }
+/**
+* Candidate directories for an installed `dsh-mobile-iroh` companion package.
+*
+* A verified companion copy is reused without downloading during the
+* transition away from the experimental companion repository. An explicit
+* absolute override wins for tests and unusual layouts, otherwise the
+* sibling of this package covers the hoisted npm layout while realpath
+* (applied at verification) follows pnpm links.
+*/
+function locateIrohCompanionRoots(importMetaUrl, environment = process.env) {
+	const override = environment.DSH_MOBILE_IROH_COMPANION?.trim();
+	if (override !== void 0 && override !== "") {
+		if (!isAbsolute(override)) throw new Error("DSH_MOBILE_IROH_COMPANION must be an absolute path");
+		return Object.freeze([resolve(override)]);
+	}
+	const ownPackageRoot = dirname(dirname(fileURLToPath(importMetaUrl)));
+	return Object.freeze([join(dirname(ownPackageRoot), "dsh-mobile-iroh")]);
+}
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
@@ -18632,11 +20186,18 @@ async function apply(ctx, config) {
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
+	const adminLogin = upstreamLoginUrl === void 0 ? void 0 : new URL(upstreamLoginUrl);
+	const supportsRemoteAdminAuthentication = adminLogin !== void 0 && adminLogin.origin === baseTemplate.upstreamOrigin.origin && adminLogin.pathname === "/" && adminLogin.username === "" && adminLogin.password === "" && adminLogin.hash === "" && (adminLogin.searchParams.get("token")?.length ?? 0) > 0;
 	const instanceId = await stableInstanceId(loaded, baseTemplate);
 	const stateDirectory = dirname(baseTemplate.stateFile);
 	const logFile = await installMobileFileLogger(ctx, stateDirectory);
 	const logger = ctx.logger("dsh-mobile");
 	logger.info("logging initialized file=%s", logFile);
+	if (loaded.kind === "managed" && typeof ctx.webServer.port === "number") try {
+		if (await refreshManagedUpstreamOrigin(loaded.setupFile, loaded.setup, ctx.webServer.port)) logger.info("dsh-mobile: refreshed the managed setup upstream snapshot to the active DSH port");
+	} catch (error) {
+		logger.warn("dsh-mobile: could not refresh the managed setup upstream snapshot: %s", error instanceof Error ? error.message : String(error));
+	}
 	const taskEventHub = new TaskEventHub();
 	const disposeTaskEvents = watchTaskCompletions(ctx, {
 		onTaskCompleted: (event) => taskEventHub.broadcast(event),
@@ -18655,6 +20216,11 @@ async function apply(ctx, config) {
 	await cloudflaredComponent.initialize();
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
+	const irohComponent = new IrohComponentManager({
+		stateDirectory,
+		locateCompanionRoots: () => locateIrohCompanionRoots(import.meta.url)
+	});
+	await irohComponent.initialize();
 	const frpIdentity = await loadOrCreateInstallationId(join(stateDirectory, "installation-id"));
 	const template = Object.freeze({
 		...baseTemplate,
@@ -18795,6 +20361,34 @@ async function apply(ctx, config) {
 		return candidate;
 	};
 	/**
+	* Gateway factory for the experimental iroh provider.
+	*
+	* The endpoint identity resolves inside the controller start, so TLS is
+	* ensured here per endpoint: a stable CA with a leaf for the exact
+	* identity-derived DNS name. The gateway terminates TLS itself (provided
+	* mode) and retains the pairing CA for the app to pin, exactly like the
+	* self-signed FRP ingress. Device pairings share the remote device file
+	* with the other remote providers.
+	*/
+	const createIrohGateway = async (endpointId) => {
+		const tls = await ensureIrohTls(endpointId, remoteDeviceFile, stateDirectory);
+		const resolved = irohGatewayConfig(template, endpointId, remoteDeviceFile, tls);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.info("upstream auth %s", JSON.stringify(entry));
+		});
+		try {
+			await candidate.start();
+		} catch (error) {
+			await candidate.close();
+			throw error;
+		}
+		return candidate;
+	};
+	/**
 	* Gateway factory for the FRP provider.
 	*
 	* The public-CA entry keeps the ordinary Caddy-fronted remote gateway. The
@@ -18847,6 +20441,7 @@ async function apply(ctx, config) {
 	const cloudflaredStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cloudflared", "control.json"), false);
 	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
 	const originStore = new JsonMobileAccessControlStore(join(remoteDirectory, "origin", "control.json"), false);
+	const irohStore = new JsonMobileAccessControlStore(join(remoteDirectory, "iroh", "control.json"), false);
 	const caddyController = new CaddyController({
 		store: createVolatileRemoteControlStore(),
 		component: caddyComponent,
@@ -18864,6 +20459,35 @@ async function apply(ctx, config) {
 		}),
 		managed: caddyController
 	});
+	const irohController = new IrohController({
+		store: irohStore,
+		component: irohComponent,
+		dataDirectory: join(remoteDirectory, "iroh", "sidecar"),
+		createGateway: (endpointId) => createIrohGateway(endpointId),
+		/**
+		* Read the pairing CA the live gateway advertises. The fingerprint must
+		* match the gateway instance id, otherwise a rotated CA would mint QR
+		* codes no phone can pin.
+		*/
+		resolvePairingCa: async () => {
+			const gateway = irohController.gateway();
+			if (gateway === void 0) throw new Error("iroh_not_ready");
+			const paths = irohTlsPaths(remoteDeviceFile, stateDirectory);
+			let pem;
+			try {
+				pem = await readFile(paths.caCertFile, "utf8");
+			} catch (error) {
+				throw new Error("iroh_pairing_failed", { cause: error });
+			}
+			const ca = new X509Certificate(pem);
+			const fingerprint = ca.fingerprint256.replaceAll(":", "").toLowerCase();
+			if (!ca.ca || fingerprint !== gateway.config.instanceId) throw new Error("iroh_pairing_failed");
+			return {
+				der: ca.raw,
+				fingerprint
+			};
+		}
+	});
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -18905,7 +20529,8 @@ async function apply(ctx, config) {
 				await gateway.refreshProvidedTls();
 			}
 		}),
-		origin: originController
+		origin: originController,
+		iroh: irohController
 	};
 	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
 	const remoteController = () => remoteProviders.controller();
@@ -18921,8 +20546,9 @@ async function apply(ctx, config) {
 			cpolar: remoteControllers.cpolar.status(),
 			cloudflared: remoteControllers.cloudflared.status(),
 			frp: remoteControllers.frp.status(),
-			origin: remoteControllers.origin.status()
-		}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status(), caddyComponent.status()),
+			origin: remoteControllers.origin.status(),
+			iroh: remoteControllers.iroh.status()
+		}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status(), caddyComponent.status(), irohComponent.status()),
 		originMode: originController.mode(),
 		caddyConfiguration: caddyConfig.status(),
 		caddyState: caddyController.status()
@@ -19030,7 +20656,7 @@ async function apply(ctx, config) {
 		handler: async (request, response) => {
 			try {
 				const target = parseRequestTarget(request.url);
-				assertLocalAdminTrust(request, request.method === "POST", () => authenticateDesktopAdmin(request));
+				assertLocalAdminTrust(request, request.method === "POST", () => (isLoopbackAddress(request.socket.remoteAddress ?? "") || supportsRemoteAdminAuthentication) && authenticateDesktopAdmin(request), baseTemplate.adminAllowedCidrs);
 				if (adminClosing) throw new HttpError(503, "unavailable");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
 				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;
@@ -19159,7 +20785,7 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
 					const body = await readJsonObject(request, 4096);
-					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "cloudflared" && body.provider !== "frp" && body.provider !== "origin") throw new HttpError(400, "bad_request");
+					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "cloudflared" && body.provider !== "frp" && body.provider !== "origin" && body.provider !== "iroh") throw new HttpError(400, "bad_request");
 					await remoteProviders.select(body.provider);
 					sendJson(response, 200, remotePayload(), false);
 					return;
@@ -19330,6 +20956,42 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/iroh/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("iroh component install started");
+					try {
+						await remoteProviders.mutate(async () => irohComponent.install());
+						logger.info("iroh component install completed");
+					} catch (error) {
+						logger.error("iroh component install failed: %s", error instanceof Error ? error.stack ?? error.message : String(error));
+						throw error;
+					}
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/iroh/pairing/begin`) {
+					await readJsonObject(request, 4096);
+					logger.info("iroh pairing window requested");
+					const pairing = await remoteProviders.mutateSelected("iroh", async () => irohController.beginPairing()).catch((error) => {
+						const code = error instanceof Error ? error.message : String(error);
+						logger.error("iroh pairing failed: %s", code);
+						if (error instanceof HttpError) throw error;
+						throw new HttpError(409, code === "iroh_not_ready" ? "iroh_not_ready" : "iroh_pairing_failed");
+					});
+					let qrSvg = "";
+					try {
+						qrSvg = await QRCode.toString(pairing.encoded, {
+							type: "svg",
+							margin: 1
+						});
+					} catch {}
+					logger.info("iroh pairing window opened");
+					sendJson(response, 201, {
+						...pairing.descriptor,
+						qrSvg
+					}, false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/attach-plan`) {
 					const settings = mergeSavedFrpSettings(await readJsonObject(request, 8192), frpConfig.settings());
 					const options = {
@@ -19580,7 +21242,8 @@ async function apply(ctx, config) {
 				cpolar: cpolarStore,
 				cloudflared: cloudflaredStore,
 				frp: frpStore,
-				origin: originStore
+				origin: originStore,
+				iroh: irohStore
 			};
 			const prepared = await prepareDisabledRemoteProviders(remoteProviders.selected, stores);
 			for (const provider of REMOTE_PROVIDERS) if (provider === remoteProviders.selected) await remoteControllers[provider].initialize();
@@ -19628,6 +21291,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CPOLAR_COMPONENT_RELEASE, CPOLAR_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, CpolarComponentManager, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, resolveHostExecution, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CPOLAR_COMPONENT_RELEASE, CPOLAR_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, CpolarComponentManager, DEFAULT_IROH_LOCAL_PORT, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, IROH_COMPONENT_RELEASES, IROH_LEAF_RENEW_BEFORE_DAYS, IROH_LEAF_VALIDITY_DAYS, IROH_VERSION, IrohComponentManager, IrohController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_PAIRING_DESCRIPTOR_BYTES, MAX_PAIRING_LIFETIME_MS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, PAIRING_DESCRIPTOR_LOCAL_PORT, PAIRING_DESCRIPTOR_TYPE, PAIRING_DESCRIPTOR_VERSION, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, decodePairingDescriptor, encodePairingDescriptor, ensureFrpIngressCertificate, ensureIrohTls, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, irohGatewayConfig, irohHostname, irohOrigin, irohTlsPaths, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, resolveHostExecution, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateIrohOrigin, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validatePairingDescriptor, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map