dsh-mobile 0.8.0 → 0.8.2

package/lib/index.mjs

@@ -28,7 +28,7 @@ import { lookup } from "node:dns/promises";
 import { constants } from "node:fs";
 import { z as z$1 } from "zod";
 import webPush from "web-push";
-//#region src/access.ts
+// src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
 	status;
@@ -466,8 +466,7 @@ var AccessController = class {
 		});
 	}
 };
-//#endregion
-//#region src/ip.ts
+// src/ip.ts
 /**
 * Browser-safe IP literal classification.
 *
@@ -548,8 +547,7 @@ function isIP$1(value) {
 	if (leftGroups < 0 || rightGroups < 0) return 0;
 	return leftGroups + rightGroups >= 8 ? 0 : 6;
 }
-//#endregion
-//#region src/network.ts
+// src/network.ts
 function parseIpv4$1(address) {
 	const parts = address.split(".");
 	if (parts.length !== 4) throw new Error(`invalid IPv4 address ${JSON.stringify(address)}`);
@@ -826,8 +824,7 @@ async function probeTcpReachable(host, port, timeoutMs = 1500) {
 		});
 	});
 }
-//#endregion
-//#region src/websocket-paths.ts
+// src/websocket-paths.ts
 /** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
 const MAX_EXTRA_WEBSOCKET_PATHS = 16;
 const MAX_WEBSOCKET_PATH_LENGTH = 256;
@@ -932,8 +929,7 @@ var WebSocketPathStore = class {
 		return this.list();
 	}
 };
-//#endregion
-//#region src/extension-worker-config.ts
+// src/extension-worker-config.ts
 function integer$1(value, name, fallback, minimum, maximum) {
 	const resolved = value ?? fallback;
 	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`hostExecution.${name} must be an integer from ${minimum} through ${maximum}`);
@@ -971,8 +967,7 @@ function resolveHostExecution(raw) {
 		logMessageBytes: integer$1(value.logMessageBytes, "logMessageBytes", 4096, 128, 65536)
 	});
 }
-//#endregion
-//#region src/config.ts
+// src/config.ts
 /** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
 const Config = z.object({
 	hostExecution: z.object({
@@ -1206,8 +1201,7 @@ function parseGatewayConfig(raw) {
 		maxRateLimitKeys: integer(value.maxRateLimitKeys, "maxRateLimitKeys", 256, 1, 4096)
 	});
 }
-//#endregion
-//#region src/exec-file.ts
+// src/exec-file.ts
 /** Capture both output streams even when a desktop host wraps execFile without Node's promisify metadata. */
 function execFileText(file, args, options = {}) {
 	return new Promise((resolve, reject) => {
@@ -1231,8 +1225,7 @@ function execFileText(file, args, options = {}) {
 		});
 	});
 }
-//#endregion
-//#region src/private-file.ts
+// src/private-file.ts
 let userSidTask;
 function commandFailureDetails(error) {
 	if (error === null || typeof error !== "object") return {};
@@ -1371,8 +1364,7 @@ async function restrictPrivateDirectory(directory) {
 		else if (info.isFile()) await restrictPrivateFile(child);
 	}
 }
-//#endregion
-//#region src/client-module-preferences.ts
+// src/client-module-preferences.ts
 const MAX_RECORD_BYTES = 1048576;
 /** Validate untrusted JSON selections; graph membership is checked by the Gateway. */
 function parseExcludedClientModules(value) {
@@ -1545,8 +1537,16 @@ var ClientModulePreferenceStore = class {
 		}
 	}
 };
-//#endregion
-//#region src/control.ts
+// src/control.ts
+/** A configuration change failed; recovered distinguishes a restored runtime from an unknown configuration. */
+var MobileAccessReconfigurationError = class extends Error {
+	recovered;
+	constructor(recovered, cause) {
+		super(recovered ? "mobile access configuration restored" : "mobile access configuration requires recovery", { cause });
+		this.recovered = recovered;
+		this.name = "MobileAccessReconfigurationError";
+	}
+};
 /** Keeps one runtime aligned with a changing network selection. */
 var FollowingMobileAccessRuntime = class {
 	select;
@@ -1737,6 +1737,36 @@ var MobileAccessGatewayController = class {
 			else await this.disable();
 		});
 	}
+	/** Change configuration with the runtime stopped, without changing its durable enabled preference. */
+	reconfigure(change, restore) {
+		if (this.closing) return Promise.reject(/* @__PURE__ */ new Error("mobile-access control is closing"));
+		return this.enqueue(async () => {
+			if (!this.initialized) throw new Error("mobile-access control is not initialized");
+			const previous = this.runtime;
+			if (previous !== void 0) try {
+				await previous.close();
+			} catch (error) {
+				throw new MobileAccessReconfigurationError(false, error);
+			}
+			this.runtime = void 0;
+			try {
+				const value = await change();
+				if (previous !== void 0) this.runtime = await this.startRuntime();
+				return {
+					value,
+					running: previous !== void 0
+				};
+			} catch (error) {
+				try {
+					await restore();
+					if (previous !== void 0) this.runtime = await this.startRuntime();
+				} catch (restoreError) {
+					throw new MobileAccessReconfigurationError(false, new AggregateError([error, restoreError]));
+				}
+				throw new MobileAccessReconfigurationError(true, error);
+			}
+		});
+	}
 	/** Stop the runtime after earlier transitions without changing the restart preference. */
 	close() {
 		if (this.closeTask !== void 0) return this.closeTask;
@@ -1829,8 +1859,7 @@ function isLocalAdminHostname(hostname) {
 	if (octets === void 0) return false;
 	return isLoopbackIpv4(octets) || isPrivateIpv4(octets) || isLinkLocalIpv4(octets);
 }
-//#endregion
-//#region src/http-security.ts
+// src/http-security.ts
 const DEVICE_COOKIE = "dsh_ma_device";
 const SESSION_COOKIE = "dsh_ma_session";
 const CSRF_COOKIE = "dsh_ma_csrf";
@@ -2014,8 +2043,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 	if (!loopback && !authenticateDesktop()) throw new HttpError(401, "admin_authentication_required");
 }
-//#endregion
-//#region src/browser-auth-cookies.ts
+// src/browser-auth-cookies.ts
 const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
 const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
 /** Non-secret browser identity; the persistent device credential keeps its narrow renewal path. */
@@ -2067,8 +2095,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 	if (selected === void 0) throw new HttpError(401, "authentication_failed");
 	return selected;
 }
-//#endregion
-//#region src/auth-failure-log.ts
+// src/auth-failure-log.ts
 const LOG_INTERVAL_MS$3 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
@@ -2183,12 +2210,17 @@ var AuthFailureRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/http-failure-log.ts
+// src/http-failure-log.ts
 function safeParserCode(code) {
 	switch (code) {
 		case "ERR_HTTP_REQUEST_TIMEOUT":
 		case "HPE_HEADER_OVERFLOW":
+		case "HPE_INVALID_METHOD":
+		case "HPE_INVALID_CONSTANT":
+		case "HPE_INVALID_URL":
+		case "HPE_INVALID_VERSION":
+		case "HPE_LF_EXPECTED":
+		case "HPE_PAUSED_H2_UPGRADE":
 		case "HPE_INVALID_CHUNK_SIZE":
 		case "HPE_INVALID_CONTENT_LENGTH":
 		case "HPE_INVALID_EOF_STATE":
@@ -2223,7 +2255,7 @@ function classifyHttpParserFailure(nodeCode) {
 }
 const LOG_INTERVAL_MS$2 = 3e4;
 /**
-* Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
+* Per-Gateway diagnostics with four fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
 * A sink failure cannot change a response, retry a write or expose the diagnostic sink's error.
 */
@@ -2236,6 +2268,10 @@ var HttpFailureRecorder = class {
 			nextLogAt: 0,
 			suppressed: 0
 		},
+		transport: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
 		target: {
 			nextLogAt: 0,
 			suppressed: 0
@@ -2263,6 +2299,26 @@ var HttpFailureRecorder = class {
 		});
 		return failure;
 	}
+	/** Classify a client socket error without assigning an HTTP status to a transport failure. */
+	recordClientError(nodeCode) {
+		switch (nodeCode) {
+			case "ECONNRESET":
+			case "EPIPE":
+			case "ETIMEDOUT":
+			case "ERR_STREAM_PREMATURE_CLOSE": {
+				const failure = {
+					kind: "transport",
+					code: nodeCode
+				};
+				this.record(failure);
+				return failure;
+			}
+			default: return {
+				kind: "parser",
+				...this.recordParser(nodeCode)
+			};
+		}
+	}
 	/** Sample an invalid request target without retaining its raw or decoded URL. */
 	recordTarget() {
 		this.record({
@@ -2306,8 +2362,7 @@ var HttpFailureRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/api-latency-log.ts
+// src/api-latency-log.ts
 /**
 * Bounded API latency samples for diagnosing slow mobile requests.
 *
@@ -2414,8 +2469,7 @@ var ApiLatencyRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/upstream-auth-log.ts
+// src/upstream-auth-log.ts
 const LOG_INTERVAL_MS = 3e4;
 /** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
 var UpstreamAuthRecorder = class {
@@ -2480,8 +2534,7 @@ var UpstreamAuthRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/client-module-recovery.ts
+// src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
 		title: "移动页面模块需要调整",
@@ -2562,8 +2615,7 @@ function renderClientModuleRecoveryScript(locale) {
   })
 })()`;
 }
-//#endregion
-//#region src/mobile-compat-bootstrap.ts
+// src/mobile-compat-bootstrap.ts
 const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
 /**
 * Name the compatibility bundle by content.
@@ -2639,8 +2691,7 @@ const EXTENSION_LIMITS = Object.freeze({
 	assetBytes: 33554432,
 	assetDepth: 8
 });
-//#endregion
-//#region src/http-cache.ts
+// src/http-cache.ts
 /** Entity-tag handling for authenticated GET and HEAD cache validation. */
 const ENTITY_TAG = /^[\t ]*(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*")[\t ]*$/u;
 const ENTITY_TAG_LIST_ITEM = /(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*"/gu;
@@ -2677,8 +2728,7 @@ function weakenEntityTag(etag) {
 	const opaque = etag === void 0 ? void 0 : ENTITY_TAG.exec(etag)?.[1];
 	return opaque === void 0 ? void 0 : `W/${opaque}`;
 }
-//#endregion
-//#region src/mobile-graph-events.ts
+// src/mobile-graph-events.ts
 /** Bounded SSE framing for the dedicated Mobile client graph stream. */
 /** Maximum retained UTF-8 frame/output bytes, with CRLF normalized to LF. */
 const MOBILE_GRAPH_EVENT_MAX_BYTES = 4194304;
@@ -2867,8 +2917,7 @@ var MobileGraphEventTransform = class extends Transform {
 function createMobileGraphEventTransform(project) {
 	return new MobileGraphEventTransform(project);
 }
-//#endregion
-//#region src/websocket-compression.ts
+// src/websocket-compression.ts
 function payloadBytes(data) {
 	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
 	return data.byteLength;
@@ -3088,15 +3137,13 @@ function bridgeCompressedWebSocket(request, client, upstream, head, target, upst
 		}
 	});
 }
-//#endregion
-//#region src/version.ts
+// src/version.ts
 const manifest = createRequire(import.meta.url)("../package.json");
 /** Version of the installed DSH Mobile plugin package. */
 const DSH_MOBILE_VERSION = typeof manifest.version === "string" ? manifest.version : "unknown";
 /** Oldest Android App release supported by this plugin generation. */
 const MINIMUM_ANDROID_APP_VERSION = "0.2.2";
-//#endregion
-//#region src/computer-images.ts
+// src/computer-images.ts
 const MAX_ENTRIES = 500;
 const MAX_IMAGE_BYTES = 20971520;
 const IMAGE_TYPES = Object.freeze({
@@ -3297,8 +3344,7 @@ async function readComputerImage(path, signal) {
 		throw new HttpError(404, "file_unavailable");
 	}
 }
-//#endregion
-//#region src/extension-worker.ts
+// src/extension-worker.ts
 /** Supervise opt-in local hosts without executing extension code on the DSH thread. */
 /** JSON bytes serialized and size-checked inside the worker. */
 var PreparedJsonResult = class {
@@ -3951,8 +3997,7 @@ var WorkerStreamBridge = class extends Readable {
 		return super.emit(event, ...args);
 	}
 };
-//#endregion
-//#region src/extensions.ts
+// src/extensions.ts
 /** A misbehaving host activation must not wedge the local watcher forever. */
 const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
 /** The previous Host outlives the hidden-page refresh interval and one timed refresh. */
@@ -5025,8 +5070,7 @@ function workerLoggerAdapter(context) {
 function createMobileAccessService(ctx) {
 	return new MobileAccessService(ctx);
 }
-//#endregion
-//#region src/auth-pages.ts
+// src/auth-pages.ts
 const COPY = {
 	en: {
 		lang: "en",
@@ -5254,8 +5298,7 @@ function renderLoginScript(locale) {
 })()
 `;
 }
-//#endregion
-//#region src/browser-ui-locale.ts
+// src/browser-ui-locale.ts
 const UI_LOCALE_COOKIE = "dsh_ma_ui_locale";
 /** Read presentation data only; malformed or ambiguous cookies keep browser negotiation. */
 function readBrowserUiLocale(cookieHeader) {
@@ -5274,8 +5317,7 @@ function readBrowserUiLocale(cookieHeader) {
 function resolveBrowserUiLocale(cookieHeader, acceptLanguage) {
 	return readBrowserUiLocale(cookieHeader) ?? resolveAuthPageLocale(acceptLanguage);
 }
-//#endregion
-//#region src/mobile-push/assets.ts
+// src/mobile-push/assets.ts
 const ICON_FILES = Object.freeze({
 	"/mobile-access/push/icon-180.png": "icon-180.png",
 	"/mobile-access/push/icon-192.png": "icon-192.png",
@@ -5327,16 +5369,14 @@ const loadFromPackage = createMobilePushAssetLoader(packageRoot);
 function mobilePushAsset(path, root = packageRoot) {
 	return root === packageRoot ? loadFromPackage(path) : createMobilePushAssetLoader(root)(path);
 }
-//#endregion
-//#region src/mobile-push/installation-id.ts
+// src/mobile-push/installation-id.ts
 /** Browser-safe installation-id validation shared by the browser controller and the Gateway. */
 const INSTALLATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 /** True only for a UUID-shaped installation id with an allowed version and variant nibble. */
 function isPushInstallationId(value) {
 	return typeof value === "string" && INSTALLATION_ID.test(value);
 }
-//#endregion
-//#region src/gateway.ts
+// src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
 const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
@@ -5509,6 +5549,7 @@ const RUNTIME_MODULE = "@deepseek-ai/dsh-client-runtime";
 const RENDERER_MODULE = "@deepseek-ai/dsh-client-ui-renderer";
 const SIDEBAR_MODULE = "@deepseek-ai/dsh-client-ui-sidebar";
 const SETTINGS_MODULE = "@deepseek-ai/dsh-client-ui-settings";
+const SETTINGS_GENERAL_MODULE = "@deepseek-ai/dsh-client-ui-settings-general";
 const API_GATEWAY_MODULE = "@deepseek-ai/dsh-api-gateway";
 const API_REMOTES_MODULE = "@deepseek-ai/dsh-api-remotes";
 const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
@@ -5519,6 +5560,7 @@ const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
 	RENDERER_MODULE,
 	SIDEBAR_MODULE,
 	SETTINGS_MODULE,
+	SETTINGS_GENERAL_MODULE,
 	API_GATEWAY_MODULE,
 	API_REMOTES_MODULE
 ]);
@@ -5639,8 +5681,8 @@ var ExcludedClientModulesError = class extends Error {
 /** A graph-selection conflict with a bounded diagnostic safe for authenticated callers. */
 var ClientModuleConflictError = class extends HttpError {
 	detail;
-	constructor(detail) {
-		super(409, "excluded_client_modules_invalid");
+	constructor(detail, code = "excluded_client_modules_invalid") {
+		super(409, code);
 		this.detail = detail.replace(/[\u0000-\u001f\u007f]/gu, " ").replace(/(?:https?:\/\/|[a-z]:[\\/])\S+/giu, "[redacted]").slice(0, 512);
 	}
 };
@@ -5675,6 +5717,25 @@ function describeMobileClientModules(html) {
 		dependencies: Object.freeze(clientModuleDependencies(entry).filter((id) => ids.has(id)))
 	})));
 }
+/**
+* Canonical fingerprint of an installed catalog.
+*
+* A settings page computes "required only" client-side. If a plugin was added,
+* removed or became required while that page stayed open, the computed set is
+* based on a catalog that no longer exists. The fingerprint travels with the
+* read and back with the write, so a stale page is told to reread instead of
+* saving a selection made against an older graph.
+* @param entries - Catalog entries in any order.
+* @returns Stable 16-character hexadecimal revision.
+*/
+function clientModuleCatalogRevision(entries) {
+	const canonical = entries.map((entry) => [
+		entry.id,
+		entry.required,
+		[...new Set(entry.dependencies)].sort()
+	]).sort((left, right) => left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0);
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 16);
+}
 /** Validate graph edges before removing application rows from both manifest views. */
 function excludeMobileBootEntries(entries, batches, excludedIds) {
 	if (excludedIds.length === 0) return;
@@ -6570,7 +6631,11 @@ var MobileAccessGateway = class {
 			});
 			server.on("clientError", (error, socket) => {
 				const nodeCode = "code" in error && typeof error.code === "string" ? error.code : void 0;
-				const failure = this.httpFailures.recordParser(nodeCode);
+				const failure = this.httpFailures.recordClientError(nodeCode);
+				if (failure.kind === "transport" || !socket.writable) {
+					socket.destroy();
+					return;
+				}
 				rejectUpgrade(socket, failure.status, failure.code);
 			});
 			await new Promise((resolve, reject) => {
@@ -7300,18 +7365,19 @@ var MobileAccessGateway = class {
 			try {
 				let kind = "describe";
 				let excluded;
+				let revision;
 				if (request.method === "POST") {
 					const body = await readJsonObject(request, this.config.maxBodyBytes);
 					const keys = Object.keys(body);
-					if (keys.length !== 1) throw new HttpError(400, "bad_request");
-					if (keys[0] === "reset" && body.reset === true) kind = "reset";
-					else if (keys[0] === "measure" && body.measure === true) kind = "measure";
-					else if (keys[0] === "excludedClientModules") {
+					if (keys.length === 1 && keys[0] === "reset" && body.reset === true) kind = "reset";
+					else if (keys.length === 1 && keys[0] === "measure" && body.measure === true) kind = "measure";
+					else if (keys.every((key) => key === "excludedClientModules" || key === "revision") && Object.prototype.hasOwnProperty.call(body, "excludedClientModules") && (body.revision === void 0 || typeof body.revision === "string")) {
 						kind = "configure";
 						excluded = body.excludedClientModules;
+						revision = body.revision;
 					} else throw new HttpError(400, "bad_request");
 				}
-				const view = await this.clientModulePreferenceOperation(kind, excluded, authorization.deviceId, operation.signal);
+				const view = await this.clientModulePreferenceOperation(kind, excluded, authorization.deviceId, operation.signal, revision);
 				operation.signal.throwIfAborted();
 				sendJson(response, 200, view, this.tlsEnabled);
 			} catch (error) {
@@ -7796,10 +7862,11 @@ var MobileAccessGateway = class {
 	* @param excluded - Untrusted module IDs to validate against the current boot graph.
 	* @param deviceId - Authenticated device identity; omitted for computer defaults.
 	* @param callerSignal - Cancels fetching and validation, not an atomic write already started.
+	* @param revision - Catalog fingerprint the selection was computed against; a mismatch is rejected.
 	* @returns The catalog and saved selection without reloading clients.
 	*/
-	configureClientModules(excluded, deviceId, callerSignal) {
-		return this.clientModulePreferenceOperation("configure", excluded, deviceId, callerSignal);
+	configureClientModules(excluded, deviceId, callerSignal, revision) {
+		return this.clientModulePreferenceOperation("configure", excluded, deviceId, callerSignal, revision);
 	}
 	/** Reset one override without reloading connected clients.
 	* @param deviceId - Authenticated device identity; omitted to reset computer defaults.
@@ -7985,7 +8052,7 @@ var MobileAccessGateway = class {
 			await upstreamClosed;
 		}
 	}
-	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal) {
+	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal, revision) {
 		if (this.closing || !this.started) throw new HttpError(503, "unavailable");
 		if (kind === "measure" && this.clientModuleMeasurementActive) throw new HttpError(429, "busy");
 		if (kind === "measure") this.clientModuleMeasurementActive = true;
@@ -8004,8 +8071,10 @@ var MobileAccessGateway = class {
 			const validate = async (selection) => {
 				html = (await this.fetchAuthenticatedUpstreamIndex(controller.signal)).html;
 				try {
+					if (revision !== void 0 && revision !== clientModuleCatalogRevision(describeMobileClientModules(html))) throw new ClientModuleConflictError("the module catalog changed since it was read; reread it and confirm the selection again", "client_module_catalog_changed");
 					parseMobileBootPlan(html, selection);
 				} catch (error) {
+					if (error instanceof ClientModuleConflictError) throw error;
 					if (error instanceof ExcludedClientModulesError) throw new ClientModuleConflictError(error.message);
 					throw new HttpError(502, "upstream_unavailable");
 				}
@@ -8033,8 +8102,10 @@ var MobileAccessGateway = class {
 				} catch (error) {
 					if (!measurementExpired || callerSignal?.aborted === true || this.closing) throw error;
 				}
+				const entries = this.describeMobileModulesWithSizes(html);
 				return Object.freeze({
-					entries: this.describeMobileModulesWithSizes(html),
+					entries,
+					revision: clientModuleCatalogRevision(entries),
 					...selection,
 					...plan.batches === void 0 ? {
 						excludedClientModules: Object.freeze([]),
@@ -9193,8 +9264,7 @@ var MobileAccessGateway = class {
 		};
 	}
 };
-//#endregion
-//#region src/storage.ts
+// src/storage.ts
 function assertInteger(value, name) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`device state ${name} must be a non-negative integer`);
 }
@@ -9321,8 +9391,7 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 };
-//#endregion
-//#region src/managed-files.ts
+// src/managed-files.ts
 /** Refuse link-shaped ancestors inside an owned state root before accessing a child. */
 async function assertManagedParents(root, target, prefix) {
 	const parent = resolve(root);
@@ -9489,8 +9558,7 @@ async function replaceManagedDirectory(root, target, candidate, prefix, operatio
 		}
 	}
 }
-//#endregion
-//#region src/component-download.ts
+// src/component-download.ts
 /**
 * Hosts a pinned GitHub release download may redirect to.
 *
@@ -9601,8 +9669,7 @@ async function downloadPinnedArtifact(request) {
 	}
 	throw lastError;
 }
-//#endregion
-//#region src/frp-component.ts
+// src/frp-component.ts
 const FRP_VERSION$1 = "0.70.1";
 const MAX_ARCHIVE_ENTRIES$1 = 128;
 const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
@@ -9886,8 +9953,7 @@ var FrpComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/windows-msi-extract.ts
+// src/windows-msi-extract.ts
 /** A failed read-only MSI extraction; causes deliberately exclude raw command arguments. */
 var WindowsMsiExtractionError = class extends Error {
 	stage;
@@ -10371,8 +10437,7 @@ async function extractWindowsMsiBinary(msi, destination, executableName, expecte
 		await copyFile(binary, join(destination, executableName));
 	});
 }
-//#endregion
-//#region src/cpolar-component.ts
+// src/cpolar-component.ts
 const CPOLAR_VERSION = "3.3.18";
 /** Pinned official cpolar release metadata for supported desktop targets. */
 const CPOLAR_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
@@ -10740,8 +10805,7 @@ var CpolarComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/frp-template.ts
+// src/frp-template.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 const FRP_VHOST_HTTP_PORT = 7080;
 /** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
@@ -10870,8 +10934,7 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin, opti
 	if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/frp-config.ts
+// src/frp-config.ts
 const MAX_SETTINGS_BYTES$1 = 8192;
 /** Public entry port used by the self-signed TCP passthrough (never 443 by requirement). */
 const FRP_DEFAULT_PUBLIC_PORT = 33080;
@@ -11259,8 +11322,7 @@ var FrpConfigStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/frp-attach.ts
+// src/frp-attach.ts
 /** Default proof path used to confirm the public entry answered from this computer. */
 const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
 /** Declaration printed above the VPS half of an attach template. */
@@ -11457,8 +11519,7 @@ function createFrpAttachTemplateParts(settings, options = {}) {
 function createFrpAttachTemplate(settings, options = {}) {
 	return createFrpAttachTemplateParts(settings, options).text;
 }
-//#endregion
-//#region src/frp-attach-plan.ts
+// src/frp-attach-plan.ts
 const DEFAULT_PLAN_CONFIG_FILE = "<DSH Mobile 私有目录>/remote/frp/config/frpc.toml";
 function planConfigFile(options) {
 	const file = options.configFile;
@@ -11596,8 +11657,7 @@ function createFrpAttachPlan(settings, options = {}) {
 		])
 	});
 }
-//#endregion
-//#region src/cert-renewal.ts
+// src/cert-renewal.ts
 /** Days left below which the entry certificate is reported as expiring. */
 const CERT_EXPIRING_DAYS = 2;
 const DAY_MS = 864e5;
@@ -11703,8 +11763,7 @@ async function probeOriginCertificate(host, port, timeoutMs = 5e3) {
 		});
 	});
 }
-//#endregion
-//#region src/managed-setup.ts
+// src/managed-setup.ts
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
 	"docker",
@@ -11829,6 +11888,11 @@ async function saveManagedTrustedNetworks(setupFile, values) {
 	await restrictPrivateFile(setupFile);
 	return next;
 }
+/** Persist an existing managed setup without resetting its identity, paths or extra trusted networks. */
+async function saveManagedSetup(setupFile, setup) {
+	const validated = parseManagedSetup(setup);
+	await atomicWrite(setupFile, `${JSON.stringify(validated, null, 2)}\n`);
+}
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -12197,8 +12261,7 @@ async function materializeManagedSetup(setup, table) {
 		}
 	};
 }
-//#endregion
-//#region src/frp-ingress.ts
+// src/frp-ingress.ts
 /** Private ingress directory, always a sibling of the remote device file. */
 function frpIngressPaths(stateFile) {
 	const directory = join(dirname(stateFile), "ingress");
@@ -12418,8 +12481,7 @@ async function purgeFrpIngressCertificates(stateFile, ownedRoot = dirname(stateF
 		throw error;
 	}
 }
-//#endregion
-//#region src/remote.ts
+// src/remote.ts
 const REMOTE_PROVIDERS = Object.freeze([
 	"tailscale",
 	"cpolar",
@@ -12655,8 +12717,7 @@ function configuredRemoteProvider(environment) {
 	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin" && value !== "iroh") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, origin, or iroh");
 	return value;
 }
-//#endregion
-//#region src/frp.ts
+// src/frp.ts
 const START_TIMEOUT_MS$2 = 45e3;
 const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
 const DISCOVERY_RETRY_MS = 1e3;
@@ -13266,8 +13327,7 @@ var FrpController = class {
 		], "FRP resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/origin-proxy-config.ts
+// src/origin-proxy-config.ts
 const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
 const MAX_SETTINGS_BYTES = 8192;
 /**
@@ -13437,8 +13497,7 @@ var OriginConfigStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/origin-proxy.ts
+// src/origin-proxy.ts
 /** Owns an authenticated HTTP gateway, with no tunnel process or public network probes. */
 var OriginController = class {
 	options;
@@ -13588,8 +13647,7 @@ var OriginController = class {
 		});
 	}
 };
-//#endregion
-//#region src/cloudflared-component.ts
+// src/cloudflared-component.ts
 /** Upper bound for `tar -t` output; a pinned release listing is a few lines. */
 const MAX_ARCHIVE_LIST_BYTES = 1048576;
 const MAX_ARCHIVE_ENTRIES = 256;
@@ -13914,8 +13972,7 @@ var CloudflaredComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/cloudflared.ts
+// src/cloudflared.ts
 const MAX_LOG_BUFFER_BYTES$1 = 65536;
 /**
 * A quick tunnel has to be allocated and registered with the Cloudflare edge
@@ -14433,8 +14490,7 @@ var CloudflaredController = class {
 		], "cloudflared resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/cloudflared-tunnel.ts
+// src/cloudflared-tunnel.ts
 const MAX_CONFIG_BYTES$1 = 8192;
 const QUICK_TUNNEL_SUFFIX = ".trycloudflare.com";
 /** Cloudflare's own tunnel-routing domain; it can never be a public hostname. */
@@ -14640,8 +14696,7 @@ var CloudflaredTunnelStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/iroh-files.ts
+// src/iroh-files.ts
 async function renameIrohPath(root, source, destination) {
 	await renameManagedPath(root, source, destination, "iroh");
 }
@@ -14651,8 +14706,7 @@ async function ensureIrohDirectory(root, directory) {
 async function removeIrohTree(root, target) {
 	await removeManagedTree(root, target, "iroh");
 }
-//#endregion
-//#region src/iroh-manifest.ts
+// src/iroh-manifest.ts
 /** Checksum-gated resolution of the iroh transport host binary.
 *
 * The sidecar is built and published by the independent `dsh-mobile-iroh`
@@ -14756,8 +14810,7 @@ async function resolveIrohSidecarAt(companionRoot, platform, arch) {
 	if (process.platform !== "win32" && platform !== "win32" && (before.mode & 73) === 0) throw new Error("iroh_native_not_executable");
 	return path;
 }
-//#endregion
-//#region src/iroh-component.ts
+// src/iroh-component.ts
 /** Managed view of the iroh transport host sidecar.
 *
 * Explicit installation verifies and promotes a pinned sidecar release into
@@ -15071,8 +15124,7 @@ var IrohComponentManager = class {
 		return this.cached;
 	}
 };
-//#endregion
-//#region src/iroh-sidecar.ts
+// src/iroh-sidecar.ts
 /** Versioned parent-to-sidecar protocol for the iroh transport host.
 *
 * Ported from the independent `dsh-mobile-iroh` companion's sidecar
@@ -15202,8 +15254,7 @@ function decodeIrohEvent(line) {
 	}
 	return Object.freeze(event);
 }
-//#endregion
-//#region src/iroh-origin.ts
+// src/iroh-origin.ts
 /** Identity-derived browser origins for the raw TLS-over-iroh carrier.
 *
 * Ported from the independent `dsh-mobile-iroh` companion's origin contract.
@@ -15234,8 +15285,7 @@ function validateIrohOrigin(value, endpointId, localPort = DEFAULT_IROH_LOCAL_PO
 	if (value !== expected) throw new Error("iroh origin does not match the selected endpoint and local port");
 	return expected;
 }
-//#endregion
-//#region src/iroh-pairing.ts
+// src/iroh-pairing.ts
 /** Short-lived iroh pairing descriptors for QR transport.
 *
 * Byte-compatible with the independent `dsh-mobile-iroh` companion's
@@ -15343,8 +15393,7 @@ function decodePairingDescriptor(encoded, options = {}) {
 }
 /** Phone-side listener port advertised in QR codes minted by this computer. */
 const PAIRING_DESCRIPTOR_LOCAL_PORT = DEFAULT_IROH_LOCAL_PORT;
-//#endregion
-//#region src/iroh.ts
+// src/iroh.ts
 /** Experimental iroh remote transport as a first-class remote provider.
 *
 * The sidecar is distributed by this plugin itself: an explicit install
@@ -15895,8 +15944,7 @@ var IrohController = class {
 		});
 	}
 };
-//#endregion
-//#region src/iroh-tls.ts
+// src/iroh-tls.ts
 /** Self-signed TLS identity for the experimental iroh gateway.
 *
 * Reuses this repository's managed CA path (`managed-setup.ts`) instead of
@@ -16063,8 +16111,7 @@ function irohGatewayConfig(template, endpointId, stateFile, tls, listenPort = 0)
 		pairingTtlMs: 3e5
 	});
 }
-//#endregion
-//#region src/task-events.ts
+// src/task-events.ts
 const TASK_EVENT_DEBOUNCE_MS = 1e3;
 function turnNumber(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
@@ -16141,8 +16188,99 @@ var TaskEventHub = class {
 		return this.sinks.size;
 	}
 };
-//#endregion
-//#region src/diagnostics.ts
+// src/diagnostic-network-context.ts
+function addressKind(address) {
+	if (isIP(address) === 4) {
+		const [first, second] = address.split(".").map(Number);
+		if (first === 100 && second >= 64 && second <= 127) return "tailnet";
+		if (first === 198 && (second === 18 || second === 19)) return "fake-ip";
+		if (first === 0 || first === 10 || first === 127 || first >= 224 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) return "private";
+		return "public";
+	}
+	if (isIP(address) === 6) {
+		const lower = address.toLowerCase();
+		if (lower.startsWith("::ffff:") && isIP(lower.slice(7)) === 4) return addressKind(lower.slice(7));
+		if (lower.startsWith("fd7a:115c:a1e0:")) return "tailnet";
+		if (lower === "::" || lower === "::1" || /^(?:f[cd]|fe[89ab]|ff)/u.test(lower)) return "private";
+		return "public";
+	}
+	return "unknown";
+}
+/**
+* Collapse system resolver results into non-identifying categories, without retaining addresses.
+* @param addresses - Addresses supplied by the system resolver.
+* @returns Address category and observed IP families; mixed answers are not treated as tailnet-only.
+*/
+function classifyDiagnosticDns(addresses) {
+	const kinds = new Set(addresses.map((entry) => addressKind(entry.address)));
+	const families = new Set(addresses.map((entry) => isIP(entry.address)).filter((value) => value !== 0));
+	return {
+		kind: kinds.size === 0 ? "unknown" : kinds.size === 1 ? [...kinds][0] : "mixed",
+		family: families.size === 0 ? "unknown" : families.size > 1 ? "dual" : families.has(4) ? "ipv4" : "ipv6"
+	};
+}
+/**
+* Read bounded system-DNS context; never consult an external DNS service or modify settings.
+* @param hostname - The configured endpoint's hostname.
+* @param budgetMs - Maximum wait; OS lookup completion itself cannot be cancelled.
+* @param resolve - System lookup or an instance-local controlled fixture.
+* @returns Unknown on failure/deadline, not a conclusion that DNS or the public service is down.
+*/
+async function probeDiagnosticDns(hostname, budgetMs, resolve = (host) => lookup(host, { all: true })) {
+	let timer;
+	try {
+		return classifyDiagnosticDns(await Promise.race([resolve(hostname), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("dns_context_timeout")), Math.max(1, budgetMs));
+			timer.unref();
+		})]));
+	} catch {
+		return {
+			kind: "unknown",
+			family: "unknown"
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* Classify fixed transport machine codes without reflecting messages, URLs or nested errors.
+* @param error - A failed endpoint request.
+* @returns The last observed transport stage, or unknown rather than a guessed cause.
+*/
+function diagnosticFailureStage(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current !== null && typeof current === "object"; depth++) {
+		const code = "code" in current && typeof current.code === "string" ? current.code : "";
+		if ("name" in current && current.name === "TimeoutError") return "timeout";
+		if (["ENOTFOUND", "EAI_AGAIN"].includes(code)) return "dns";
+		if ([
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"EPIPE",
+			"ENETUNREACH",
+			"EHOSTUNREACH",
+			"UND_ERR_SOCKET"
+		].includes(code)) return "connect";
+		if ([
+			"ETIMEDOUT",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT"
+		].includes(code)) return "timeout";
+		if ([
+			"ERR_TLS_CERT_ALTNAME_INVALID",
+			"CERT_HAS_EXPIRED",
+			"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+			"DEPTH_ZERO_SELF_SIGNED_CERT",
+			"SELF_SIGNED_CERT_IN_CHAIN",
+			"UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+			"ERR_SSL_WRONG_VERSION_NUMBER"
+		].includes(code)) return "tls";
+		current = "cause" in current ? current.cause : void 0;
+	}
+	return "unknown";
+}
+// src/diagnostics.ts
 /** Recognize the active remote-web-ui boot hook without evaluating or modifying it. */
 function hasCompetingRemoteChannelBoot(rows) {
 	return rows.some((row) => row.kind === "script" && row.text?.includes("__DSH_REMOTE_CHANNEL_BOOT__") === true);
@@ -16201,6 +16339,7 @@ function check(id, status, reason, label, detail, action, facts) {
 		id,
 		status,
 		reason,
+		scope: id === "versions" ? "configuration" : id === "phone-network" ? "phone" : "computer",
 		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
 		label,
 		detail,
@@ -16445,28 +16584,6 @@ async function relayProbeThroughProxy(target, proxy, budgetMs = remoteDiagnostic
 		hopRequest.end();
 	});
 }
-/** Bounded supplementary DNS context for a failed direct attempt. */
-async function unreachableWithDnsContext(hostname, budgetMs) {
-	let fakeIp = false;
-	let timer;
-	try {
-		fakeIp = (await Promise.race([lookup(hostname, { all: true }), new Promise((_resolve, reject) => {
-			timer = setTimeout(() => {
-				reject(/* @__PURE__ */ new Error("dns_context_timeout"));
-			}, Math.max(1, budgetMs));
-			timer.unref();
-		})])).some(({ address }) => {
-			const [first, second] = address.split(".").map(Number);
-			return first === 198 && (second === 18 || second === 19);
-		});
-	} catch {} finally {
-		clearTimeout(timer);
-	}
-	return {
-		state: "unreachable",
-		...fakeIp ? { fakeIp: true } : {}
-	};
-}
 async function fetchRemoteHealth(target, budgetMs) {
 	const started = performance.now();
 	try {
@@ -16476,19 +16593,28 @@ async function fetchRemoteHealth(target, budgetMs) {
 			signal: AbortSignal.timeout(Math.max(1, budgetMs - 500))
 		});
 		const latencyMs = Math.max(0, Math.round(performance.now() - started));
-		if (response.status === 429) return {
-			state: "rate-limited",
-			latencyMs
-		};
-		return response.ok ? {
+		if (response.status === 429) {
+			await response.body?.cancel();
+			return {
+				state: "rate-limited",
+				latencyMs
+			};
+		}
+		const observation = response.ok ? {
 			state: "ready",
 			latencyMs
 		} : {
 			state: "unreachable",
-			latencyMs
+			latencyMs,
+			failureStage: "http"
+		};
+		await response.body?.cancel();
+		return observation;
+	} catch (error) {
+		return {
+			state: "unreachable",
+			failureStage: diagnosticFailureStage(error)
 		};
-	} catch {
-		return unreachableWithDnsContext(target.hostname, Math.max(1, budgetMs - (performance.now() - started)));
 	}
 }
 /**
@@ -16511,7 +16637,14 @@ async function probeRemoteHealth(origin, options = {}) {
 		return { state: "not-applicable" };
 	}
 	const budgetMs = remoteDiagnosticTimeoutMs(origin);
-	const observation = await (options.direct ?? fetchRemoteHealth)(target, budgetMs);
+	const direct = options.direct ?? fetchRemoteHealth;
+	const [observed, dns] = await Promise.all([direct(target, budgetMs), options.direct !== void 0 && options.lookup === void 0 ? void 0 : probeDiagnosticDns(target.hostname, Math.min(750, budgetMs), options.lookup)]);
+	const context = dns === void 0 ? {} : { dns };
+	const observation = {
+		...observed,
+		...context,
+		...dns?.kind === "fake-ip" ? { fakeIp: true } : {}
+	};
 	if (observation.state !== "unreachable") return observation;
 	const relay = configuredProxyFor(origin, options.env ?? process.env);
 	if (relay === void 0) return observation;
@@ -16521,12 +16654,14 @@ async function probeRemoteHealth(origin, options = {}) {
 		if (status === 429) return {
 			state: "rate-limited",
 			latencyMs,
-			viaProxy: true
+			viaProxy: true,
+			...context
 		};
 		return status >= 200 && status < 300 ? {
 			state: "ready",
 			latencyMs,
-			viaProxy: true
+			viaProxy: true,
+			...context
 		} : observation;
 	} catch {
 		return observation;
@@ -16536,28 +16671,38 @@ async function defaultRemoteProbe(origin) {
 	return probeRemoteHealth(origin);
 }
 function reportLine(entry) {
-	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
+	return `[${entry.status.toUpperCase()}][${entry.scope}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
 }
 /** Run bounded read-only checks and return a report safe to paste into an issue. */
 async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	const checks = [];
 	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.provider !== "iroh" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
-	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
-	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
+	const [firewall, remoteObservation] = await Promise.all([snapshot.lan.running ? (probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port) : Promise.resolve({ state: "not-applicable" }), remoteProbe]);
+	checks.push(check("versions", "ok", "versions-current", "版本信息", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
 	if (snapshot.competingRemoteChannelBoot === true) checks.push(check("remote-plugin-conflict", "warning", "competing-remote-channel", "第三方远程插件", "检测到另一套远程请求通道脚本；手机页面可能进入该插件自己的配对流程。", "在电脑端关闭 dsh-remote-web-ui 的远程访问后刷新，再使用 DSH Mobile 当前二维码配对；不要混用两种配对码。"));
-	if (snapshot.lan.configured === false) checks.push(check("network", "error", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "返回局域网页选择网卡并完成配置。"));
-	else if (snapshot.lan.networkError !== void 0) checks.push(check("network", "error", "network-unavailable", "局域网网卡", "已保存的网卡当前不可用。", "重新运行 dsh-mobile setup。"));
+	if (snapshot.indexInspectionUnavailable === true) checks.push(check("plugin-inspection", "warning", "plugin-inspection-unavailable", "页面脚本检查", "本次未能检查活动页面脚本；不能据此认定不存在其他远程通道。", "其余网络项目独立检查；保留复现环境并核对相关插件。"));
+	if (snapshot.lan.configured === false) checks.push(check("network", snapshot.lan.running ? "error" : "info", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "需要局域网连接时，返回局域网页选择网卡并完成配置。"));
+	else if (snapshot.lan.networkError !== void 0) checks.push(check("network", snapshot.lan.running ? "error" : "info", "network-unavailable", "局域网网卡", "已保存的网卡当前不可用。", snapshot.lan.running ? "在局域网页重新确认网卡配置。" : "局域网未启用；此配置不用于判断远程入口。"));
 	else if (snapshot.lan.configuredInterface !== void 0) {
 		const interfaceName = snapshot.lan.interfaceName ?? snapshot.lan.configuredInterface;
 		checks.push(check("network", "ok", "network-interface", "局域网网卡", `正在跟随 ${interfaceName}。`, void 0, { interfaceName }));
 	} else checks.push(check("network", "info", "network-fixed", "局域网网卡", "当前使用固定网络配置。"));
 	if (snapshot.lan.running && snapshot.lan.origin !== void 0) {
 		const endpointSuffix = maskLanOrigin(snapshot.lan.origin);
-		checks.push(check("lan", "ok", "lan-ready", "局域网网关", `已监听 ${endpointSuffix}，配对入口可用。`, void 0, { endpointSuffix }));
+		checks.push(check("lan", "ok", "lan-ready", "局域网网关", `电脑网关已监听 ${endpointSuffix}；尚未验证手机能否到达。`, void 0, { endpointSuffix }));
 	} else checks.push(check("lan", "info", "lan-off", "局域网网关", "当前未开启。", "需要手机直连时开启局域网访问。"));
-	if (firewall.state === "ready") checks.push(check("firewall", "ok", "firewall-ready", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
-	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
+	if (!snapshot.lan.running) checks.push(check("firewall", "info", "firewall-inactive", "Windows 防火墙", "局域网未启用，本次未检查局域网防火墙规则。", "不据此判断远程入口；需要局域网时再启用并检查。"));
+	else if (firewall.state === "ready") checks.push(check("firewall", "ok", "firewall-ready", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
+	else if (firewall.state === "missing") checks.push(check("firewall", snapshot.lan.running ? "warning" : "info", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", snapshot.lan.running ? "确认需要局域网连接，再检查相应规则；不要关闭整个防火墙。" : "局域网未启用，不据此判断远程入口失败。"));
 	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
+	if (snapshot.remote.running && snapshot.remote.state === "ready") checks.push(check("remote-service", "ok", "remote-service-ready", "本机通道状态", "提供方报告本机组件已就绪；不代表公网或手机路径已验证。", void 0, { provider: snapshot.remote.provider }));
+	if (remoteObservation.dns !== void 0) {
+		const kind = remoteObservation.dns.kind;
+		checks.push(check("remote-dns", kind === "fake-ip" ? "warning" : "info", `dns-${kind}`, "系统 DNS", `电脑系统解析分类：${kind}；IP：${remoteObservation.dns.family}。未查询公共 DNS，地址不写入报告。`, void 0, {
+			dnsKind: kind,
+			dnsFamily: remoteObservation.dns.family
+		}));
+	}
 	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
 	else if (snapshot.remote.provider === "origin" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-origin-ready", "远程通道", "私网 HTTP 后端已就绪；未检测公网 HTTPS、证书或 WebSocket 连通性。", "在手机上经反向代理验证连接；代理须保留原始 Host（含端口）并支持 WebSocket。", { provider: "origin" }));
 	else if (snapshot.remote.provider === "iroh" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-iroh-ready", "远程通道", "iroh 通道已就绪；端点身份为回环 TLS，不从电脑端探测手机可达性。", "在手机上用配对二维码验证连接；二维码过期或通道报错时重新生成并重连。", { provider: "iroh" }));
@@ -16569,10 +16714,14 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 			...remoteObservation.latencyMs === void 0 ? {} : { latencyMs: remoteObservation.latencyMs },
 			...remoteObservation.viaProxy === true ? { viaProxy: true } : {}
 		};
-		if (remoteObservation.state === "ready") checks.push(check("remote", remoteObservation.viaProxy === true ? "warning" : "ok", "remote-ready", "远程通道", remoteObservation.viaProxy === true ? `电脑经代理可访问 ${endpointSuffix}，但尚未验证手机能否连接。` : `${snapshot.remote.provider} 公共地址 ${endpointSuffix} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`, remoteObservation.viaProxy === true ? "请在手机上测试远程连接。" : void 0, facts));
+		if (remoteObservation.state === "ready") checks.push(check("remote", remoteObservation.viaProxy === true ? "warning" : "ok", "remote-ready", "远程通道", remoteObservation.viaProxy === true ? `电脑经代理可访问 ${endpointSuffix}，但尚未验证手机能否连接。` : `电脑当前出口可访问 ${snapshot.remote.provider} 入口 ${endpointSuffix}，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms；公网及手机路径未独立验证。`, remoteObservation.viaProxy === true ? "请在手机上测试远程连接。" : void 0, facts));
 		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "remote-rate-limited", "远程通道", remoteObservation.viaProxy === true ? "电脑经代理访问时观察到限流，尚未验证手机能否连接。" : "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。", facts));
-		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。", facts));
-		else checks.push(check("remote", "error", "remote-unreachable", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。", facts));
+		else if (snapshot.remote.provider === "tailscale" && remoteObservation.dns?.kind === "tailnet" && (remoteObservation.failureStage === "connect" || remoteObservation.failureStage === "timeout")) checks.push(check("remote", "warning", "remote-tailnet-shadowed", "电脑出口探测", "本机系统 DNS 返回 tailnet 地址，当前 Funnel-only 监听不接受此私网路径；本次失败不能证明公网 Funnel 故障。", "用 tailnet 外的网络单独验证；如自愿临时调整设备 DNS，注意其对其他私网服务的影响并在对照后恢复。", facts));
+		else if (snapshot.remote.provider === "tailscale" && (remoteObservation.fakeIp === true || remoteObservation.dns?.kind === "fake-ip") && remoteObservation.failureStage !== "tls" && remoteObservation.failureStage !== "http") checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "本机系统 DNS 返回 Fake-IP 网段，本次出口探测未成功；这不是公网故障的证明。", "核对 DNS 与代理路由，用其他网络对照，不要关闭证书验证。", facts));
+		else {
+			const reason = remoteObservation.failureStage === "dns" ? "remote-dns-failed" : remoteObservation.failureStage === "connect" ? "remote-connect-failed" : remoteObservation.failureStage === "tls" ? "remote-tls-failed" : remoteObservation.failureStage === "timeout" ? "remote-probe-timeout" : remoteObservation.failureStage === "http" ? "remote-http-failed" : "remote-unreachable";
+			checks.push(check("remote", "error", reason, "电脑出口探测", "电脑当前出口的探测未通过；不代表其他网络或手机一定失败。", "按失败阶段核对 DNS、路由、证书或代理，并用手机当前网络对照。", facts));
+		}
 	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") {
 		const needsLogin = snapshot.remote.state === "needs-login";
 		checks.push(check("remote", "warning", needsLogin ? "remote-needs-login" : "remote-connecting", "远程通道", needsLogin ? "等待完成 Tailscale 登录。" : "仍在建立连接。", needsLogin ? "返回远程页继续登录。" : "等待片刻后重新检查。", { provider: snapshot.remote.provider }));
@@ -16583,15 +16732,16 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 			controllerCode
 		}));
 	}
-	checks.push(check("phone-network", "info", "phone-network-unknown", "手机网络", "电脑无法判断路由器是否隔离了手机。", "局域网仍失败时，确认手机与电脑在同一网络，并关闭访客网络或 AP 隔离。"));
+	checks.push(check("phone-network", "info", "phone-network-unknown", "手机网络", "电脑没有验证手机网络、认证页面、资源加载或 WebSocket。", "请用手机当前网络实际连接，记录失败阶段；不要提供配对凭据或直接关闭安全隔离措施。"));
 	const overall = checks.some((entry) => entry.status === "error") ? "error" : checks.some((entry) => entry.status === "warning") ? "attention" : "ok";
-	const summary = overall === "ok" ? "连接基础检查正常。" : overall === "attention" ? "发现需要留意的项目。" : "发现会影响连接的问题。";
+	const summary = overall === "ok" ? "电脑端基础检查完成；手机、认证页面、资源与 WebSocket 尚未验证。" : overall === "attention" ? "电脑端检查有待确认项目；请区分测量路径与实际手机连接。" : "电脑端检查有失败项目；不据此推断所有网络均不可达。";
 	const report = [
 		"DSH Mobile 诊断报告",
 		`生成时间: ${(/* @__PURE__ */ new Date()).toISOString()}`,
 		`版本: plugin=${DSH_MOBILE_VERSION}; dsh=${snapshot.dshVersion}; min-app=${MINIMUM_ANDROID_APP_VERSION}`,
 		`LAN: ${snapshot.lan.running ? "on" : "off"}; endpoint=${maskLanOrigin(snapshot.lan.origin)}`,
 		`Remote: provider=${snapshot.remote.provider}; state=${snapshot.remote.state}; endpoint=${remoteSuffix(snapshot.remote.origin)}`,
+		"Coverage: computer-side only; phone, authenticated page, resources and WebSocket remain unverified.",
 		...checks.map(reportLine)
 	].join("\n");
 	return Object.freeze({
@@ -16605,11 +16755,19 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 		}),
 		summary,
 		checks: Object.freeze(checks),
-		report
+		report,
+		coverage: Object.freeze({
+			measuredFrom: "computer",
+			unverified: Object.freeze([
+				"phone",
+				"authenticated-page",
+				"resources",
+				"websocket"
+			])
+		})
 	});
 }
-//#endregion
-//#region src/mobile-guide.ts
+// src/mobile-guide.ts
 /** Compose the guide with the current customization state injected. */
 function buildMobileGuide(state) {
 	const styleLine = state.hasCustomCss ? "存在（已检测到文件，需在已配对页面验证加载）" : "不存在（使用内置默认样式）";
@@ -16674,8 +16832,7 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
 - 创建或修改扩展后，确认 extension.json 的 schemaVersion 为 1、id 与目录名一致、且 id 只含小写字母数字和连字符
 - 扩展的 host.mjs 若在完成前无法激活，先修正而不是留下损坏的扩展
 - 完成后检查自己实际写入了哪些文件，向用户简要说明改了什么、手机端会有什么变化`;
-//#endregion
-//#region src/vps-deploy.ts
+// src/vps-deploy.ts
 const FRP_VERSION = "0.70.1";
 const SSH_TIMEOUT_MS = 3e5;
 const LINUX_ARTIFACTS = Object.freeze({
@@ -17646,8 +17803,44 @@ async function uninstallVps(serverAddress, uninstall, input, options = {}) {
 		checks
 	});
 }
-//#endregion
-//#region src/funnel.ts
+// src/lan-rebind.ts
+/** An unreadable setup is rejected before stopping the listener or replacing any file. */
+var ManagedLanConfigurationError = class extends Error {
+	constructor(cause) {
+		super("managed LAN configuration is unreadable", { cause });
+		this.name = "ManagedLanConfigurationError";
+	}
+};
+/** Rebind an existing listener; callers serialize this call with all other setup-file writes. */
+async function rebindManagedLan(options) {
+	let previous;
+	try {
+		previous = parseManagedSetup(JSON.parse(await readFile(options.setupFile, "utf8")));
+		await readManagedCa(previous.tls);
+	} catch (error) {
+		throw new ManagedLanConfigurationError(error);
+	}
+	const result = await options.controller.reconfigure(async () => {
+		const next = Object.freeze({
+			...previous,
+			networkInterface: options.network.name
+		});
+		await refreshManagedServerCertificate(next, options.network.address);
+		await saveManagedSetup(options.setupFile, next);
+		options.publish(next);
+		return next;
+	}, async () => {
+		await saveManagedSetup(options.setupFile, previous);
+		options.publish(previous);
+		const network = options.selectPrevious?.(previous) ?? selectLanNetwork(void 0, previous.networkInterface);
+		await refreshManagedServerCertificate(previous, network.address);
+	});
+	return {
+		setup: result.value,
+		running: result.running
+	};
+}
+// src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
 const FUNNEL_START_TIMEOUT_MS = 45e3;
 function publicStatus$1(status) {
@@ -18161,8 +18354,7 @@ function funnelExecutable(importMetaUrl, environment = process.env) {
 	const file = `dsh-mobile-funnel-${process.platform}-${process.arch}${suffix}`;
 	return resolve(fileURLToPath(new URL(`../bin/${file}`, importMetaUrl)));
 }
-//#endregion
-//#region src/cpolar.ts
+// src/cpolar.ts
 const MAX_LOG_BUFFER_BYTES = 65536;
 const START_TIMEOUT_MS = 45e3;
 const CPOLAR_HOST_SUFFIXES = Object.freeze([
@@ -18578,8 +18770,7 @@ var CpolarController = class {
 		], "cpolar resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/caddy-files.ts
+// src/caddy-files.ts
 /** Refuse link-shaped ancestors within Caddy's owned state root. */
 async function assertCaddyParents(root, target) {
 	await assertManagedParents(root, target, "caddy");
@@ -18600,8 +18791,7 @@ async function writeCaddyPrivateFile(root, file, body) {
 async function removeCaddyTree(root, target) {
 	await removeManagedTree(root, target, "caddy");
 }
-//#endregion
-//#region src/caddy-component.ts
+// src/caddy-component.ts
 const CADDY_VERSION = "2.11.7";
 const CADDY_DNS_PLUGIN_VERSION = "v0.4.3";
 const CADDY_DOWNLOAD_PAGE = "https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1";
@@ -19120,8 +19310,7 @@ var CaddyConfigStore = class {
 		return task;
 	}
 };
-//#endregion
-//#region src/caddy.ts
+// src/caddy.ts
 /** Private directories override Caddy's platform defaults; ambient API keys and admin/proxy overrides are omitted. */
 function caddyProcessEnvironment(config, settings, environment = process.env) {
 	const credentials = config.credentials();
@@ -19451,8 +19640,7 @@ var CaddyController = class {
 		}
 	}
 };
-//#endregion
-//#region src/managed-origin.ts
+// src/managed-origin.ts
 /** Children never independently restore a durable enabled switch. */
 function createVolatileRemoteControlStore() {
 	let value = {
@@ -19633,8 +19821,7 @@ var ManagedOriginController = class {
 		return task;
 	}
 };
-//#endregion
-//#region src/release-update.ts
+// src/release-update.ts
 const PACKAGE_NAME = "dsh-mobile";
 const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
 const ANDROID_RELEASE_DESCRIPTOR_URL = "https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/apps/mobile/release.json";
@@ -20097,8 +20284,7 @@ var PluginReleaseManager = class {
 		});
 	}
 };
-//#endregion
-//#region src/file-logger.ts
+// src/file-logger.ts
 const MAX_LOG_BYTES = 5242880;
 const MAX_QUEUED_BYTES = 262144;
 const PATH_PREFIX = "mobile_log";
@@ -20208,14 +20394,12 @@ async function installMobileFileLogger(ctx, stateDirectory, options = {}) {
 	}
 	return file;
 }
-//#endregion
-//#region src/mobile-push/contracts.ts
+// src/mobile-push/contracts.ts
 const OUTCOME_COALESCE_MS = 1e3;
 const ATTENTION_TTL_MS = 3e5;
 const OUTCOME_TTL_MS = 18e5;
 const ATTEMPT_TIMEOUT_MS = 1e4;
-//#endregion
-//#region src/mobile-push/requests.ts
+// src/mobile-push/requests.ts
 var RequestLifetimes = class {
 	#records = /* @__PURE__ */ new Map();
 	#byCall = /* @__PURE__ */ new Map();
@@ -20395,8 +20579,7 @@ var RequestLifetimes = class {
 		}, 250);
 	}
 };
-//#endregion
-//#region src/mobile-push/outcomes.ts
+// src/mobile-push/outcomes.ts
 const isCompletedGoalPhase = (phase) => phase === "complete";
 var OutcomeLifetimes = class {
 	#ctx;
@@ -20576,8 +20759,7 @@ var OutcomeLifetimes = class {
 		return current;
 	}
 };
-//#endregion
-//#region src/mobile-push/reconcile.ts
+// src/mobile-push/reconcile.ts
 const TURN_REASONS = [
 	"completed",
 	"error",
@@ -20849,8 +21031,7 @@ var PushReconciler = class {
 		return verifyOutcome(source, values, agent);
 	}
 };
-//#endregion
-//#region src/mobile-push/host.ts
+// src/mobile-push/host.ts
 function hasContract(ctx) {
 	return typeof ctx.on === "function" && typeof ctx.sessionProjections?.stateOf === "function" && typeof ctx.sessionProjections.snapshot === "function" && typeof ctx.sessionProjections.register === "function" && typeof ctx.sessionQuery?.observeSession === "function" && typeof ctx.agents?.get === "function" && typeof ctx.agents.list === "function" && typeof ctx.agents.roots === "function" && typeof ctx.agents.isOwnedBy === "function" && ctx.userQuestions !== void 0 && ctx.approval !== void 0;
 }
@@ -21061,8 +21242,7 @@ function createPushHost(ctx) {
 		}
 	};
 }
-//#endregion
-//#region src/mobile-push/endpoint.ts
+// src/mobile-push/endpoint.ts
 const MAX_ENDPOINT_BYTES = 2048;
 const APPLE_SUFFIX = ".push.apple.com";
 const BASE64URL = /^[A-Za-z0-9_-]+$/u;
@@ -21179,8 +21359,7 @@ async function resolveAppleEndpoint(endpoint, resolver = systemResolver) {
 		addresses: Object.freeze([...addresses])
 	});
 }
-//#endregion
-//#region src/mobile-push/store.ts
+// src/mobile-push/store.ts
 const MAX_STATE_BYTES = 4194304;
 const emptySnapshot = () => ({
 	version: 1,
@@ -21443,8 +21622,7 @@ var JsonPushStore = class {
 		}
 	}
 };
-//#endregion
-//#region src/mobile-push/registry.ts
+// src/mobile-push/registry.ts
 const empty = () => ({
 	version: 1,
 	ownerGenerations: [],
@@ -21832,8 +22010,7 @@ var PushRegistry = class {
 		};
 	}
 };
-//#endregion
-//#region src/mobile-push/payload.ts
+// src/mobile-push/payload.ts
 const messages = {
 	en: {
 		question: ["Input requested", "A response needs your attention."],
@@ -21885,8 +22062,7 @@ function buildDeclarativePayload(category, locale, navigate, tag) {
 	if (Buffer.byteLength(payload, "utf8") > 3072) throw new TypeError("push_payload_too_large");
 	return payload;
 }
-//#endregion
-//#region src/mobile-push/retention.ts
+// src/mobile-push/retention.ts
 /** Pure defer-membership retention helpers shared by delivery maintenance. */
 /** Removes deferred-recheck entries whose owning pending intent no longer exists; returns how many were removed. */
 function pruneOrphanedDeferrals(deferred, pending) {
@@ -21899,8 +22075,7 @@ function pruneOrphanedDeferrals(deferred, pending) {
 	}
 	return removed;
 }
-//#endregion
-//#region src/mobile-push/sender.ts
+// src/mobile-push/sender.ts
 const MAX_RESPONSE_BYTES = 8192;
 const MAX_TTL_SECONDS = 1800;
 const CONTENT_ENCODING = "aes128gcm";
@@ -22186,8 +22361,7 @@ var PushSender = class {
 		}
 	}
 };
-//#endregion
-//#region src/mobile-push/delivery.ts
+// src/mobile-push/delivery.ts
 const RECONCILE_INTERVAL_MS = 3e4;
 const RETRY_BACKOFF_MS = [1e3, 5e3];
 const MAX_TEST_QUEUE = 64;
@@ -22973,8 +23147,7 @@ var PushDelivery = class {
 		}, delay);
 	}
 };
-//#endregion
-//#region src/mobile-push/gateway.ts
+// src/mobile-push/gateway.ts
 /** One service shared by every Gateway while each Gateway owns a separate auth/origin attachment. */
 var PushGatewayCoordinator = class {
 	host;
@@ -23097,8 +23270,7 @@ var PushGatewayCoordinator = class {
 		return true;
 	}
 };
-//#endregion
-//#region src/installation-id.ts
+// src/installation-id.ts
 const INSTALLATION_ID_PATTERN = /^[a-f0-9]{64}\n$/u;
 const INSTALLATION_ID_BYTES = 65;
 async function readInstallationId(file) {
@@ -23162,8 +23334,7 @@ async function loadOrCreateInstallationId(file) {
 		}
 	}
 }
-//#endregion
-//#region src/gateway-identity.ts
+// src/gateway-identity.ts
 /**
 * Attach the authenticated installation identity while retaining existing entry identity rules.
 * @param config - Validated gateway configuration containing the legacy identity.
@@ -23183,8 +23354,7 @@ function withInstallationIdentity(config, installationId, explicitIdentity) {
 		legacyInstanceId: config.instanceId
 	});
 }
-//#endregion
-//#region src/lan-setup.ts
+// src/lan-setup.ts
 const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
 const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
 async function runElevatedPowerShell(script) {
@@ -23256,8 +23426,7 @@ async function prepareManagedLanSetup(options) {
 		androidCertificate
 	});
 }
-//#endregion
-//#region src/plugin.ts
+// src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
@@ -23614,6 +23783,9 @@ function locateIrohCompanionRoots(importMetaUrl, environment = process.env) {
 async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
+	/** Rebind overrides the managed setup at runtime; the file on disk is the source of truth on restart. */
+	let managedSetupOverride;
+	let lanRebindRecoveryRequired = false;
 	const mobileAccess = createMobileAccessService(ctx);
 	const baseTemplate = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, baseTemplate.upstreamOrigin);
@@ -23910,8 +24082,17 @@ async function apply(ctx, config) {
 	let lanGateway;
 	let preparedLanSetup;
 	let trustedNetworksRestartRequired = false;
-	let trustedNetworksWrite = Promise.resolve();
+	let lanConfigurationWork = Promise.resolve();
 	let adminClosing = false;
+	const mutateLan = (operation) => {
+		if (adminClosing) return Promise.reject(new HttpError(503, "unavailable"));
+		const run = lanConfigurationWork.then(() => {
+			if (adminClosing) throw new HttpError(503, "unavailable");
+			return operation();
+		});
+		lanConfigurationWork = run.then(() => {}, () => {});
+		return run;
+	};
 	const startGateway = async (candidateConfig) => {
 		const resolved = withInstallationIdentity(parseGatewayConfig({
 			...candidateConfig,
@@ -23941,12 +24122,13 @@ async function apply(ctx, config) {
 		if (loaded.kind === "unconfigured") throw new Error(preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
 		if (loaded.kind === "fixed") return startGateway(loaded.config);
 		const following = new FollowingMobileAccessRuntime(async () => {
-			const network = selectLanNetwork(void 0, loaded.setup.networkInterface);
+			const setup = managedSetupOverride ?? loaded.setup;
+			const network = selectLanNetwork(void 0, setup.networkInterface);
 			return {
 				key: `${network.name}\0${network.address}\0${network.cidr}`,
 				start: async () => startGateway({
 					...loaded.config,
-					...await materializeManagedSetup(loaded.setup)
+					...await materializeManagedSetup(setup)
 				})
 			};
 		}, (error) => {
@@ -24194,6 +24376,8 @@ async function apply(ctx, config) {
 			restartRequired: preparedLanSetup !== void 0
 		} : {},
 		running: lanController.isRunning(),
+		rebindSupported: loaded.kind === "managed",
+		...lanRebindRecoveryRequired ? { recoveryRequired: true } : {},
 		origin: lanGateway?.address().origin,
 		...preparedLanSetup === void 0 ? {} : { pendingOrigin: preparedLanSetup.origin },
 		...lanGateway === void 0 ? {} : { extensions: lanGateway.extensionStatus() }
@@ -24227,7 +24411,18 @@ async function apply(ctx, config) {
 			windowsFirewall: process.platform === "win32"
 		};
 	};
-	const diagnosticsPayload = async () => {
+	const diagnosticsPayload = async (request) => {
+		const admission = ctx.connection?.admit?.(request);
+		if (admission !== void 0 && "rejection" in admission) throw new HttpError(admission.rejection, "authentication_failed");
+		const indexCollector = ctx.webServer;
+		let indexInjections = [];
+		let indexInspectionUnavailable = false;
+		if (typeof indexCollector.collectIndexInjections === "function") try {
+			indexInjections = indexCollector.collectIndexInjections(admission?.peer);
+		} catch (inspectionError) {
+			indexInspectionUnavailable = true;
+		}
+		else indexInspectionUnavailable = true;
 		let interfaceName;
 		let networkError;
 		if (loaded.kind === "managed") try {
@@ -24257,7 +24452,8 @@ async function apply(ctx, config) {
 		} : void 0;
 		return collectConnectionDiagnostics({
 			dshVersion,
-			competingRemoteChannelBoot: hasCompetingRemoteChannelBoot(ctx.webServer.collectIndexInjections?.() ?? []),
+			competingRemoteChannelBoot: hasCompetingRemoteChannelBoot(indexInjections),
+			indexInspectionUnavailable,
 			lan: {
 				configured: loaded.kind !== "unconfigured" || preparedLanSetup !== void 0,
 				running: lanController.isRunning(),
@@ -24328,12 +24524,15 @@ async function apply(ctx, config) {
 						}
 						if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 						const body = await readJsonObject(request, template.maxBodyBytes);
-						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules" && key !== "measure") || "measure" in body && body.measure !== true) throw new HttpError(400, "bad_request");
-						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
+						const keys = Object.keys(body);
+						const configure = keys.every((key) => key === "excludedClientModules" || key === "revision") && Object.prototype.hasOwnProperty.call(body, "excludedClientModules") && (body.revision === void 0 || typeof body.revision === "string");
+						const single = keys.length === 1 && (body.reset === true || body.measure === true);
+						if (!configure && !single) throw new HttpError(400, "bad_request");
+						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal, typeof body.revision === "string" ? body.revision : void 0), false);
 					} catch (error) {
 						if (!(error instanceof ClientModuleConflictError)) throw error;
 						sendJson(response, 409, {
-							error: "excluded_client_modules_invalid",
+							error: error.code,
 							detail: error.detail
 						}, false);
 					} finally {
@@ -24356,18 +24555,15 @@ async function apply(ctx, config) {
 					} catch {
 						throw new HttpError(400, "lan_trusted_networks_invalid");
 					}
-					const write = trustedNetworksWrite.then(async () => {
-						if (adminClosing) throw new HttpError(503, "unavailable");
+					await mutateLan(async () => {
 						await saveManagedTrustedNetworks(loaded.setupFile, values);
 						trustedNetworksRestartRequired = true;
 					});
-					trustedNetworksWrite = write.catch(() => void 0);
-					await write;
 					sendJson(response, 200, await trustedNetworksPayload(), false);
 					return;
 				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/diagnostics`) {
-					sendJson(response, 200, await diagnosticsPayload(), false);
+					sendJson(response, 200, await diagnosticsPayload(request), false);
 					return;
 				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/release`) {
@@ -24391,10 +24587,13 @@ async function apply(ctx, config) {
 					return;
 				}
 				if (request.method === "POST" && lanControl) {
-					const body = await readJsonObject(request, 4096);
-					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					if (body.running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
-					await lanController.setRunning(body.running);
+					const running = (await readJsonObject(request, 4096)).running;
+					if (typeof running !== "boolean") throw new HttpError(400, "bad_request");
+					if (running && loaded.kind === "unconfigured") throw new HttpError(409, preparedLanSetup === void 0 ? "lan_setup_required" : "lan_setup_restart_required");
+					await mutateLan(async () => {
+						if (running && lanRebindRecoveryRequired) throw new HttpError(409, "lan_rebind_recovery_required");
+						await lanController.setRunning(running);
+					});
 					sendJson(response, 200, lanPayload(), false);
 					return;
 				}
@@ -24424,6 +24623,74 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await lanSetupPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/lan/networks`) {
+					await lanConfigurationWork;
+					const networks = availableLanNetworks();
+					const preferred = await preferredLanInterfaceNames();
+					let recommendedAddress;
+					try {
+						recommendedAddress = selectLanNetwork(void 0, void 0, void 0, preferred).address;
+					} catch {}
+					const currentInterface = loaded.kind === "managed" ? (managedSetupOverride ?? loaded.setup).networkInterface : void 0;
+					sendJson(response, 200, {
+						supported: loaded.kind === "managed",
+						currentInterface,
+						listenPort: loaded.kind === "managed" ? loaded.setup.listenPort : 3443,
+						platform: process.platform,
+						networks: networks.map((network) => ({
+							name: network.name,
+							address: network.address,
+							cidr: network.cidr,
+							current: network.name === currentInterface,
+							recommended: network.address === recommendedAddress
+						}))
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/lan/rebind`) {
+					if (loaded.kind !== "managed") throw new HttpError(409, "lan_rebind_unsupported");
+					const body = await readJsonObject(request, 4096);
+					const networkInterface = typeof body.networkInterface === "string" ? body.networkInterface : "";
+					if (networkInterface === "" || Object.keys(body).some((key) => key !== "networkInterface")) throw new HttpError(400, "bad_request");
+					sendJson(response, 200, await mutateLan(async () => {
+						let network;
+						try {
+							network = selectLanNetwork(void 0, networkInterface);
+						} catch {
+							throw new HttpError(409, "lan_rebind_network_unavailable");
+						}
+						const current = managedSetupOverride ?? loaded.setup;
+						if (!lanRebindRecoveryRequired && current.networkInterface === networkInterface) throw new HttpError(409, "lan_rebind_unchanged");
+						const previousOrigin = lanGateway?.address().origin;
+						try {
+							const result = await rebindManagedLan({
+								setupFile: loaded.setupFile,
+								controller: lanController,
+								network,
+								publish: (setup) => {
+									managedSetupOverride = setup;
+								}
+							});
+							trustedNetworksRestartRequired = false;
+							lanRebindRecoveryRequired = false;
+							return {
+								origin: lanGateway?.address().origin ?? `https://${network.address}:${String(result.setup.listenPort)}`,
+								previousOrigin,
+								restartRequired: false,
+								disconnected: result.running,
+								ready: lanGateway !== void 0
+							};
+						} catch (error) {
+							if (error instanceof ManagedLanConfigurationError) throw new HttpError(409, "lan_rebind_configuration_invalid");
+							if (!(error instanceof MobileAccessReconfigurationError)) throw new HttpError(503, "lan_rebind_unavailable");
+							const recovered = error.recovered;
+							if (!recovered) lanRebindRecoveryRequired = true;
+							logger.error("managed LAN rebind failed; prior configuration restored: %s", String(recovered));
+							throw new HttpError(500, recovered ? "lan_rebind_failed" : "lan_rebind_recovery_required");
+						}
+					}), false);
+					return;
+				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/control`) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
@@ -24942,7 +25209,7 @@ async function apply(ctx, config) {
 					stopAdmin,
 					drainRemoteWork,
 					() => releaseManager.dispose(),
-					() => trustedNetworksWrite,
+					() => lanConfigurationWork,
 					disposeMobileCommand,
 					disposeTaskEvents,
 					async () => {
@@ -24965,7 +25232,7 @@ async function apply(ctx, config) {
 				stopAdmin,
 				drainRemoteWork,
 				() => releaseManager.dispose(),
-				() => trustedNetworksWrite,
+				() => lanConfigurationWork,
 				disposeMobileCommand,
 				disposeTaskEvents,
 				async () => {
@@ -24981,7 +25248,6 @@ async function apply(ctx, config) {
 		};
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
-//#endregion
 export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CPOLAR_COMPONENT_RELEASE, CPOLAR_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, CpolarComponentManager, DEFAULT_IROH_LOCAL_PORT, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, IROH_COMPONENT_RELEASES, IROH_LEAF_RENEW_BEFORE_DAYS, IROH_LEAF_VALIDITY_DAYS, IROH_VERSION, IrohComponentManager, IrohController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_PAIRING_DESCRIPTOR_BYTES, MAX_PAIRING_LIFETIME_MS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, PAIRING_DESCRIPTOR_LOCAL_PORT, PAIRING_DESCRIPTOR_TYPE, PAIRING_DESCRIPTOR_VERSION, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, decodePairingDescriptor, encodePairingDescriptor, ensureFrpIngressCertificate, ensureIrohTls, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, irohGatewayConfig, irohHostname, irohOrigin, irohTlsPaths, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, resolveHostExecution, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateIrohOrigin, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validatePairingDescriptor, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map