dsh-mobile 0.8.1 → 0.8.3

package/lib/client.js

@@ -5,7 +5,7 @@ window.__ModuleLoader__.load({
 		var exports = module.exports;
 		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 		let react = require("react");
-		//#region src/client-messages.ts
+		// src/client-messages.ts
 		const frpFormMessages = {
 			en: {
 				frpServerAddressInvalid: "Enter the frps IP address or full hostname only, without https://, a port, or a path.",
@@ -1160,6 +1160,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "Enlarge the QR code",
 			closeEnlargedQr: "Close the enlarged QR code",
 			irohPairingReady: "iroh pairing code {code} is live for five minutes. Scan it from the iroh pairing screen; opening another code replaces this one.",
+			irohPairingCopyOnly: "The QR image could not be generated. Copy the pairing link and paste it into the App’s iroh pairing screen.",
 			irohDescription: "Peer-to-peer encrypted link with relay fallback. No domain, port or account needed; requires the full Android App.",
 			prepareIroh: "Prepare iroh",
 			irohInstallNote: "The Install button downloads the pinned sidecar release (dsh-mobile-iroh 0.1.0-alpha.1, about 15 MB on Windows x64, 24 MB on Linux x64) into the plugin private directory and verifies its SHA-256. An installed companion with a verified copy is reused instead, with no download.",
@@ -1194,6 +1195,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "Ingrandisci il codice QR",
 			closeEnlargedQr: "Chiudi il codice QR ingrandito",
 			irohPairingReady: "Il codice iroh {code} è attivo per cinque minuti. Scansionalo dalla schermata di abbinamento iroh; aprirne un altro sostituisce questo.",
+			irohPairingCopyOnly: "Impossibile generare il codice QR. Copia il link di abbinamento e incollalo nella schermata di abbinamento iroh dell’app.",
 			irohDescription: "Collegamento cifrato peer-to-peer con ripiego su relay. Nessun dominio, porta o account richiesto; richiede l’App Android completa.",
 			prepareIroh: "Prepara iroh",
 			irohInstallNote: "Il pulsante Installa scarica la release pinnata del sidecar (dsh-mobile-iroh 0.1.0-alpha.1, circa 15 MB su Windows x64, 24 MB su Linux x64) nella directory privata del plugin e ne verifica lo SHA-256. Un complemento installato con una copia verificata viene invece riutilizzato senza scaricare nulla.",
@@ -1228,6 +1230,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "放大二维码",
 			closeEnlargedQr: "关闭放大的二维码",
 			irohPairingReady: "iroh 配对码 {code} 已生效，有效期 5 分钟。请在 App 的 iroh 配对页扫码；再生成一个会替换当前这个。",
+			irohPairingCopyOnly: "未能生成二维码。可复制配对链接，粘贴到 App 的 iroh 配对页。",
 			irohDescription: "点对点加密直连，跨网自动经中继。无需域名、端口或账号；需完整版 App。",
 			prepareIroh: "准备 iroh",
 			irohInstallNote: "点击安装会下载固定的 sidecar 发行版（dsh-mobile-iroh 0.1.0-alpha.1，Windows x64 约 15 MB，Linux x64 约 24 MB）到插件私有目录并校验 SHA-256；已安装的配套插件如有校验通过的副本会直接复用，不再下载。",
@@ -1866,6 +1869,93 @@ window.__ModuleLoader__.load({
 			cloudflaredTunnelSettingsInvalid: "隧道设置未通过校验。",
 			cloudflaredTunnelConfigMissing: "使用命名隧道需要同时填写令牌、公网域名和端口。"
 		});
+		/** Measurement boundaries shared by diagnostic cards and copied reports. */
+		const DIAGNOSTIC_SCOPE_MESSAGES = {
+			en: {
+				scripts: "Page scripts",
+				configuration: "Configuration",
+				computer: "Computer-side check",
+				phone: "Phone not tested",
+				versions: "Version information",
+				provider: "Local channel state",
+				dns: "System DNS",
+				coverage: "Computer-side checks only. Phone reachability, authenticated pages, resources and WebSockets have not been verified."
+			},
+			it: {
+				scripts: "Script pagina",
+				configuration: "Configurazione",
+				computer: "Controllo dal computer",
+				phone: "Telefono non verificato",
+				versions: "Informazioni versioni",
+				provider: "Stato del canale locale",
+				dns: "DNS di sistema",
+				coverage: "Solo controlli dal computer. Raggiungibilità dal telefono, pagine autenticate, risorse e WebSocket non verificati."
+			},
+			zh: {
+				scripts: "页面脚本",
+				configuration: "配置信息",
+				computer: "电脑侧检查",
+				phone: "手机尚未验证",
+				versions: "版本信息",
+				provider: "本机通道状态",
+				dns: "系统 DNS",
+				coverage: "仅为电脑侧检查。手机可达性、认证页面、资源加载和 WebSocket 尚未验证。"
+			}
+		};
+		/** Fixed DNS/egress observations never imply acceptance from another network. */
+		const DIAGNOSTIC_NETWORK_MESSAGES = {
+			en: {
+				"remote-service-ready": ["{provider} reports its local component ready; public and phone paths are not verified.", ""],
+				"plugin-inspection-unavailable": ["Active page scripts could not be inspected; absence of a competing remote channel is unverified.", "Other network checks are independent. Keep the reproduction environment and inspect the relevant plugins."],
+				"firewall-inactive": ["LAN is off, so LAN firewall rules were not probed. This does not assess the remote entry.", "Enable LAN first if you need a local connection."],
+				"remote-tailnet-shadowed": ["System DNS returned tailnet addresses and this Funnel-only listener does not accept that private path. This failed check does not establish a public Funnel outage.", "Compare from outside the tailnet. If you voluntarily change device DNS for a test, consider other private services and restore it afterward."],
+				"dns-public": ["System DNS returned ordinary public-address results. This does not establish endpoint reachability.", ""],
+				"dns-tailnet": ["System DNS returned tailnet addresses, not Fake-IP. This is a private path, not an independent public-path test.", ""],
+				"dns-fake-ip": ["System DNS returned Fake-IP-range addresses; proxy routing may affect the measurement.", "Check the DNS/routing policy without disabling certificate verification."],
+				"dns-private": ["System DNS returned private/local addresses. This does not test the public ingress.", ""],
+				"dns-mixed": ["System DNS returned mixed address categories; do not attribute the failure to a single private address.", "Compare the actual routes and address families."],
+				"dns-unknown": ["System DNS context was unavailable or exceeded its wait budget; no public DNS service was queried.", ""],
+				"remote-dns-failed": ["The computer-side endpoint probe failed during name resolution.", "Check system DNS; compare from the phone network before judging the public service."],
+				"remote-connect-failed": ["The computer-side endpoint probe could not establish or retain its connection.", "Check the current route and ingress, then compare from another network."],
+				"remote-tls-failed": ["The computer-side TLS identity check failed.", "Check the certificate, hostname and proxy route. Do not disable certificate verification."],
+				"remote-probe-timeout": ["The computer-side endpoint probe exceeded its wait budget.", "A timeout does not locate the failed hop. Compare from another network."],
+				"remote-http-failed": ["The computer reached an HTTP endpoint but did not receive a successful health status.", "Check the ingress route and provider access policy; no credentials were sent by this probe."]
+			},
+			it: {
+				"remote-service-ready": ["{provider} segnala il componente locale pronto; i percorsi pubblico e del telefono non sono verificati.", ""],
+				"plugin-inspection-unavailable": ["Script attivi non verificati; non è confermata l’assenza di un altro canale remoto.", "Gli altri controlli sono indipendenti. Mantieni il caso riproducibile e controlla i plugin coinvolti."],
+				"firewall-inactive": ["LAN disattivata: regole firewall locali non verificate. Il canale remoto non viene valutato da questo controllo.", "Abilita LAN prima di verificare una connessione locale."],
+				"remote-tailnet-shadowed": ["Il DNS restituisce indirizzi tailnet e questo listener solo Funnel non accetta il percorso privato. Il controllo fallito non prova un guasto pubblico.", "Confronta da una rete esterna alla tailnet. Se modifichi volontariamente il DNS del dispositivo, valuta gli altri servizi privati e ripristinalo dopo il test."],
+				"dns-public": ["Il DNS di sistema restituisce indirizzi pubblici ordinari; non prova la raggiungibilità.", ""],
+				"dns-tailnet": ["Il DNS restituisce indirizzi tailnet, non Fake-IP. È un percorso privato, non un test pubblico indipendente.", ""],
+				"dns-fake-ip": ["Il DNS restituisce indirizzi Fake-IP; il routing del proxy può influire sulla misura.", "Controlla DNS e routing senza disabilitare la verifica dei certificati."],
+				"dns-private": ["Il DNS restituisce indirizzi privati/locali; non verifica l’ingresso pubblico.", ""],
+				"dns-mixed": ["Il DNS restituisce categorie miste; non attribuire il problema a un solo indirizzo privato.", "Confronta percorsi e famiglie IP effettivi."],
+				"dns-unknown": ["Il contesto DNS non è disponibile o ha superato il tempo previsto; nessun DNS pubblico è stato interrogato.", ""],
+				"remote-dns-failed": ["La risoluzione del nome è fallita nel controllo dal computer.", "Controlla il DNS di sistema e confronta dalla rete del telefono."],
+				"remote-connect-failed": ["Il controllo dal computer non ha stabilito o mantenuto la connessione.", "Controlla percorso e ingresso, poi confronta da un’altra rete."],
+				"remote-tls-failed": ["La verifica TLS dal computer è fallita.", "Controlla certificato, nome host e proxy. Non disabilitare la verifica TLS."],
+				"remote-probe-timeout": ["Il controllo dal computer ha superato il tempo previsto.", "Il timeout non identifica il punto guasto; confronta da un’altra rete."],
+				"remote-http-failed": ["Il computer ha raggiunto HTTP ma senza uno stato di salute riuscito.", "Controlla percorso e criteri di accesso. Il test non invia credenziali."]
+			},
+			zh: {
+				"remote-service-ready": ["{provider} 报告本机组件已就绪；公网与手机路径尚未验证。", ""],
+				"plugin-inspection-unavailable": ["本次未能检查活动页面脚本，不能据此认定不存在其他远程通道。", "其余网络项目独立检查；保留复现环境并核对相关插件。"],
+				"firewall-inactive": ["局域网未启用，本次没有探测局域网防火墙规则，不用于判断远程入口。", "需要局域网连接时，先启用再检查。"],
+				"remote-tailnet-shadowed": ["系统 DNS 返回 tailnet 地址，而当前 Funnel-only 监听不接受此私网路径。本次失败不能证明公网 Funnel 故障。", "用 tailnet 外的网络对照。若自愿临时调整设备 DNS，注意其他私网服务的影响，并在测试后恢复。"],
+				"dns-public": ["系统 DNS 返回普通公网地址类别；这本身不证明端点可达。", ""],
+				"dns-tailnet": ["系统 DNS 返回 tailnet 地址，不是 Fake-IP。这是私网路径，不是独立的公网验证。", ""],
+				"dns-fake-ip": ["系统 DNS 返回 Fake-IP 网段；代理路由可能影响本次测量。", "核对 DNS 和路由策略，不要关闭证书验证。"],
+				"dns-private": ["系统 DNS 返回私网或本机地址，不是在验证公网入口。", ""],
+				"dns-mixed": ["系统 DNS 返回混合地址类别，不能只凭其中一个私网地址归因。", "对照实际路由与 IPv4/IPv6 路径。"],
+				"dns-unknown": ["系统 DNS 信息不可用或等待超时；没有查询公共 DNS 服务。", ""],
+				"remote-dns-failed": ["电脑出口探测在名称解析阶段失败。", "检查系统 DNS，并用手机当前网络对照后再判断公网状态。"],
+				"remote-connect-failed": ["电脑出口探测无法建立或保持连接。", "核对当前路由和入口，再用其他网络对照。"],
+				"remote-tls-failed": ["电脑出口探测的 TLS 身份验证失败。", "检查证书、主机名和代理路由，不要关闭证书验证。"],
+				"remote-probe-timeout": ["电脑出口探测超过了等待预算。", "超时不能定位具体故障节点，请用其他网络对照。"],
+				"remote-http-failed": ["电脑已到达 HTTP 入口，但未得到成功的健康状态。", "检查入口路由与服务商访问策略；本次探测不发送配对凭据。"]
+			}
+		};
 		const DIAGNOSTIC_REASON_MESSAGES = {
 			en: {
 				"lan-setup-required": ["Local network setup has not been completed.", "Return to Local network and choose a network to finish setup."],
@@ -1873,24 +1963,24 @@ window.__ModuleLoader__.load({
 				"network-unavailable": ["The saved local network adapter is unavailable.", "Run dsh-mobile setup again."],
 				"network-interface": ["Using network interface {interfaceName}.", ""],
 				"network-fixed": ["A fixed local network configuration is in use.", ""],
-				"lan-ready": ["The local gateway is listening at {endpointSuffix}; pairing is available.", ""],
+				"lan-ready": ["The computer gateway is listening at {endpointSuffix}; phone reachability is unverified.", ""],
 				"lan-off": ["Local network access is currently off.", "Enable local network access when the phone must connect directly."],
-				"firewall-ready": ["Local TCP and discovery firewall rules are enabled.", ""],
+				"firewall-ready": ["Enabled local TCP/discovery rules were found; this does not prove the phone route is permitted.", ""],
 				"firewall-missing": ["The complete local network firewall rules were not found.", "Run dsh-mobile setup as administrator and check the firewall rules."],
 				"firewall-unknown": ["The system did not allow the plugin to read firewall status.", "If the phone cannot find this computer, run setup as administrator."],
 				"remote-off": ["Remote access through {provider} is currently off.", ""],
 				"remote-origin-ready": ["The private HTTP backend is listening; public HTTPS is not verified.", "Verify your reverse proxy, public certificate, external Host including port, and WebSocket access from your phone. Keep the HTTP backend private."],
-				"remote-ready": ["{provider} endpoint {endpointSuffix} is reachable in about {latencyMs} ms.", ""],
+				"remote-ready": ["Computer-side HTTP reached {provider} endpoint {endpointSuffix} in about {latencyMs} ms; phone and independent public-path reachability are unverified.", ""],
 				"remote-ready-via-proxy": ["The computer reached {provider} endpoint {endpointSuffix} through its configured proxy in about {latencyMs} ms; phone reachability is not verified.", "Test the connection from the phone’s network."],
 				"remote-rate-limited": ["{provider} endpoint {endpointSuffix} is reachable, but this check observed rate limiting.", "Try again later; older sessions load on demand to reduce traffic."],
 				"remote-rate-limited-via-proxy": ["The computer reached {provider} endpoint {endpointSuffix} through its proxy, but the service rate-limited this check; phone reachability is not verified.", "Try again later and test from the phone’s network."],
-				"remote-fake-ip": ["The Tailscale address is intercepted by the current VPN or DNS proxy, so TLS was not established.", "Switch VPN node or proxy mode; if it still fails, use cpolar."],
-				"remote-unreachable": ["{provider} reports ready, but endpoint {endpointSuffix} is not reachable.", "Reconnect, then check the provider status if it still fails."],
+				"remote-fake-ip": ["System DNS returned Fake-IP-range addresses and the computer-side probe failed; this does not prove a public outage.", "Check DNS/proxy routing and compare another network without disabling certificate checks."],
+				"remote-unreachable": ["The computer-side probe of {provider} endpoint {endpointSuffix} failed; this does not establish failure from other networks.", "Compare DNS, routing, TLS and ingress from the phone network before reconnecting."],
 				"remote-needs-login": ["Tailscale is waiting for login to finish.", "Return to Remote access and continue login."],
 				"remote-connecting": ["The {provider} remote channel is still connecting.", "Wait briefly, then check again."],
 				"remote-controller-error": ["The {provider} controller reported {controllerCode}.", "Return to Remote access and reconnect."],
 				"competing-remote-channel": ["Another remote plugin is injecting its own request channel; the phone may show that plugin’s pairing screen.", "Turn off dsh-remote-web-ui remote access on the computer, refresh, and pair using the current DSH Mobile QR code. Do not mix pairing codes."],
-				"phone-network-unknown": ["The computer cannot determine whether the router isolates the phone.", "Confirm the phone and computer use the same network, then disable guest-network or AP isolation."]
+				"phone-network-unknown": ["The phone network, paired page, resources and WebSocket have not been tested by this computer.", "Test from the current phone network; record the failing stage without sharing pairing secrets."]
 			},
 			it: {
 				"lan-setup-required": ["La configurazione della rete locale non è completa.", "Torna a Rete locale e scegli una rete per completare la configurazione."],
@@ -1898,24 +1988,24 @@ window.__ModuleLoader__.load({
 				"network-unavailable": ["La scheda di rete locale salvata non è disponibile.", "Esegui di nuovo dsh-mobile setup."],
 				"network-interface": ["È in uso l’interfaccia di rete {interfaceName}.", ""],
 				"network-fixed": ["È in uso una configurazione di rete locale fissa.", ""],
-				"lan-ready": ["Il gateway locale è in ascolto su {endpointSuffix}; l’abbinamento è disponibile.", ""],
+				"lan-ready": ["Il gateway del computer è in ascolto su {endpointSuffix}; il telefono non è verificato.", ""],
 				"lan-off": ["L’accesso dalla rete locale è disattivato.", "Attiva l’accesso locale quando il telefono deve collegarsi direttamente."],
-				"firewall-ready": ["Le regole firewall TCP locale e di rilevamento sono attive.", ""],
+				"firewall-ready": ["Trovate regole TCP/discovery abilitate; il percorso dal telefono non è verificato.", ""],
 				"firewall-missing": ["Le regole firewall complete per la rete locale non sono state trovate.", "Esegui dsh-mobile setup come amministratore e controlla le regole firewall."],
 				"firewall-unknown": ["Il sistema non ha consentito al plugin di leggere lo stato del firewall.", "Se il telefono non trova il computer, esegui setup come amministratore."],
 				"remote-off": ["L’accesso remoto tramite {provider} è disattivato.", ""],
 				"remote-origin-ready": ["Il backend HTTP privato è in ascolto; HTTPS pubblico non è verificato.", "Verifica dal telefono reverse proxy, certificato pubblico, Host esterno inclusa la porta e accesso WebSocket. Mantieni privato il backend HTTP."],
-				"remote-ready": ["L’endpoint {provider} {endpointSuffix} è raggiungibile in circa {latencyMs} ms.", ""],
+				"remote-ready": ["HTTP dal computer ha raggiunto {provider} su {endpointSuffix} in circa {latencyMs} ms; telefono e percorso pubblico indipendente non verificati.", ""],
 				"remote-ready-via-proxy": ["Il computer ha raggiunto l’endpoint {provider} {endpointSuffix} tramite il proxy configurato in circa {latencyMs} ms; la raggiungibilità dal telefono non è verificata.", "Prova la connessione dalla rete del telefono."],
 				"remote-rate-limited": ["L’endpoint {provider} {endpointSuffix} è raggiungibile, ma il controllo ha rilevato una limitazione temporanea.", "Riprova più tardi; le sessioni precedenti vengono caricate su richiesta per ridurre il traffico."],
 				"remote-rate-limited-via-proxy": ["Il computer ha raggiunto l’endpoint {provider} {endpointSuffix} tramite proxy, ma il servizio ha limitato questo controllo; la raggiungibilità dal telefono non è verificata.", "Riprova più tardi e verifica dalla rete del telefono."],
-				"remote-fake-ip": ["L’indirizzo Tailscale è intercettato dalla VPN o dal proxy DNS corrente e TLS non è stato stabilito.", "Cambia nodo VPN o modalità proxy; se il problema continua, usa cpolar."],
-				"remote-unreachable": ["{provider} risulta pronto, ma l’endpoint {endpointSuffix} non è raggiungibile.", "Riconnettiti; se il problema continua, controlla lo stato del provider."],
+				"remote-fake-ip": ["Il DNS restituisce indirizzi Fake-IP e il controllo dal computer è fallito; non prova un guasto pubblico.", "Controlla DNS e routing e confronta una rete alternativa senza disabilitare TLS."],
+				"remote-unreachable": ["Il controllo dal computer di {provider} su {endpointSuffix} è fallito; altre reti non sono verificate.", "Confronta DNS, routing, TLS e ingresso dalla rete del telefono."],
 				"remote-needs-login": ["Tailscale attende il completamento dell’accesso.", "Torna ad Accesso remoto e continua l’accesso."],
 				"remote-connecting": ["Il canale remoto {provider} è ancora in connessione.", "Attendi qualche istante e ripeti il controllo."],
 				"remote-controller-error": ["Il controller {provider} ha segnalato {controllerCode}.", "Torna ad Accesso remoto e riconnettiti."],
 				"competing-remote-channel": ["Un altro plugin remoto sta inserendo il proprio canale di richieste; sul telefono potrebbe apparire la sua schermata di abbinamento.", "Disattiva l’accesso remoto di dsh-remote-web-ui sul computer, aggiorna la pagina e usa il codice QR corrente di DSH Mobile. Non mescolare i codici."],
-				"phone-network-unknown": ["Il computer non può stabilire se il router isola il telefono.", "Verifica che telefono e computer usino la stessa rete, poi disattiva rete ospiti o isolamento AP."]
+				"phone-network-unknown": ["Rete del telefono, pagina abbinata, risorse e WebSocket non sono stati verificati dal computer.", "Verifica dalla rete del telefono e indica la fase del problema senza condividere credenziali."]
 			},
 			zh: {
 				"lan-setup-required": ["尚未完成局域网初始化。", "返回局域网页选择网卡并完成配置。"],
@@ -1923,24 +2013,24 @@ window.__ModuleLoader__.load({
 				"network-unavailable": ["已保存的局域网网卡当前不可用。", "重新运行 dsh-mobile setup。"],
 				"network-interface": ["正在使用网卡 {interfaceName}。", ""],
 				"network-fixed": ["当前使用固定局域网配置。", ""],
-				"lan-ready": ["局域网网关正在监听 {endpointSuffix}，配对入口可用。", ""],
+				"lan-ready": ["电脑网关已监听 {endpointSuffix}；手机能否到达尚未验证。", ""],
 				"lan-off": ["局域网访问当前未开启。", "手机需要直连时开启局域网访问。"],
-				"firewall-ready": ["局域网 TCP 与发现防火墙规则已启用。", ""],
+				"firewall-ready": ["已发现启用的局域网 TCP 与发现规则；这不证明手机路由或全部防火墙策略已放行。", ""],
 				"firewall-missing": ["未找到完整的局域网防火墙规则。", "以管理员身份运行 dsh-mobile setup 并检查防火墙规则。"],
 				"firewall-unknown": ["系统未允许插件读取防火墙状态。", "若手机找不到电脑，请以管理员身份运行 setup。"],
 				"remote-off": ["{provider} 远程访问当前未启用。", ""],
 				"remote-origin-ready": ["私有 HTTP 后端已监听；尚未验证公网 HTTPS。", "请用手机核对反向代理、公网证书、含端口的外部 Host 及 WebSocket 访问。HTTP 后端必须留在私网。"],
-				"remote-ready": ["{provider} 端点 {endpointSuffix} 可达，往返约 {latencyMs} ms。", ""],
+				"remote-ready": ["电脑当前出口可访问 {provider} 入口 {endpointSuffix}，约 {latencyMs} ms；公网及手机路径未独立验证。", ""],
 				"remote-ready-via-proxy": ["电脑经已配置代理访问 {provider} 端点 {endpointSuffix}，约 {latencyMs} ms；尚未验证手机网络是否可达。", "请用手机当前网络实际连接测试。"],
 				"remote-rate-limited": ["{provider} 端点 {endpointSuffix} 可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。"],
 				"remote-rate-limited-via-proxy": ["电脑经代理访问 {provider} 端点 {endpointSuffix} 时遇到限流；尚未验证手机网络是否可达。", "稍后重试，并用手机当前网络实际连接测试。"],
-				"remote-fake-ip": ["Tailscale 地址被当前 VPN 或 DNS 代理接管，TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。"],
-				"remote-unreachable": ["{provider} 显示已就绪，但端点 {endpointSuffix} 暂不可达。", "点击重新连接；仍失败时检查提供方状态。"],
+				"remote-fake-ip": ["系统 DNS 返回 Fake-IP 网段，电脑出口探测未成功；这不是公网故障的证明。", "核对 DNS 与代理路由，用其他网络对照，不要关闭证书验证。"],
+				"remote-unreachable": ["电脑当前出口无法完成 {provider} 入口 {endpointSuffix} 的探测；这不证明其他网络也失败。", "先对照手机网络及 DNS、路由、证书和入口，再决定是否重连。"],
 				"remote-needs-login": ["Tailscale 正在等待完成登录。", "返回远程访问并继续登录。"],
 				"remote-connecting": ["{provider} 远程通道仍在连接。", "等待片刻后重新检查。"],
 				"remote-controller-error": ["{provider} 控制器报告 {controllerCode}。", "返回远程访问并重新连接。"],
 				"competing-remote-channel": ["检测到另一个远程插件注入自己的请求通道；手机可能显示它的配对页面。", "在电脑端关闭 dsh-remote-web-ui 的远程访问并刷新，再用 DSH Mobile 当前二维码配对；不要混用配对码。"],
-				"phone-network-unknown": ["电脑无法判断路由器是否隔离了手机。", "确认手机与电脑使用同一网络，并关闭访客网络或 AP 隔离。"]
+				"phone-network-unknown": ["电脑没有验证手机网络、配对后的页面、资源和 WebSocket。", "请用手机当前网络实际连接，记录失败阶段，不要提供配对密钥。"]
 			}
 		};
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
@@ -1955,6 +2045,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "The loopback plaintext vhost port of your own frps (upstream default 7080).",
 			frpPublicPort: "Public entry port",
 			frpPublicPortHint: "Raw TCP proxy port used as the public HTTPS entry (default 33080, never 3080/3443/3444).",
+			frpUser: "frpc user (optional)",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel is listening. Verify public access from a network outside this tailnet.",
+			macosFolderHelpTitle: "Before leaving this Mac",
+			macosFolderHelpNote: "Open the workspace folder you plan to use in DSH on this Mac and respond to any macOS prompt. In System Settings → Privacy & Security → Files and Folders, allow only the locations you need. If opening a folder remotely times out, check this Mac for a pending prompt before changing the pairing.",
+			frpUserHint: "Optional user field of shared frps services: the proxy registers as user.proxyName. Leave blank to omit it.",
+			frpUserInvalid: "The user must be 1–128 letters, digits, dots, underscores, or hyphens.",
 			frpAttachPlan: "Copy attach runbook",
 			frpAttachPlanCopied: "Attach runbook copied: local frpc.toml plus the VPS checklist.",
 			frpAttachPlanFailed: "Could not build the attach runbook: {error}",
@@ -2008,6 +2105,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "Porta vhost in chiaro su loopback del tuo frps (predefinita 7080).",
 			frpPublicPort: "Porta pubblica di ingresso",
 			frpPublicPortHint: "Porta del proxy TCP grezzo usata come ingresso HTTPS pubblico (predefinita 33080, mai 3080/3443/3444).",
+			frpUser: "Utente frpc (facoltativo)",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel è in ascolto. Verifica l’accesso pubblico da una rete esterna alla tailnet.",
+			macosFolderHelpTitle: "Prima di lasciare il Mac",
+			macosFolderHelpNote: "Apri in DSH su questo Mac la cartella di lavoro che userai e rispondi alle eventuali richieste di macOS. In Impostazioni di Sistema → Privacy e sicurezza → File e cartelle, autorizza solo le posizioni necessarie. Se una cartella non si apre da remoto per un timeout, controlla se sul Mac c’è una richiesta in attesa prima di modificare l’abbinamento.",
+			frpUserHint: "Campo utente facoltativo dei servizi frps condivisi: il proxy si registra come user.nomeproxy. Lascia vuoto per ometterlo.",
+			frpUserInvalid: "L’utente deve essere di 1–128 lettere, cifre, punti, trattini bassi o trattini.",
 			frpAttachPlan: "Copia il runbook attach",
 			frpAttachPlanCopied: "Runbook attach copiato: frpc.toml locale più la checklist VPS.",
 			frpAttachPlanFailed: "Impossibile creare il runbook attach: {error}",
@@ -2061,6 +2165,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "你自己 frps 的回环明文 vhost 端口（上游默认 7080）。",
 			frpPublicPort: "公网入口端口",
 			frpPublicPortHint: "作为公网 HTTPS 入口的 TCP 透传端口（默认 33080，不得为 3080/3443/3444）。",
+			frpUser: "用户名（可选）",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel 已启动监听。请在此 tailnet 之外的网络验证公网访问。",
+			macosFolderHelpTitle: "离开这台 Mac 前",
+			macosFolderHelpNote: "先在这台 Mac 的 DSH 中打开远程会用到的工作区目录，处理可能出现的系统提示。在「系统设置 → 隐私与安全性 → 文件与文件夹」只授权需要的位置。手机打开文件夹超时时，先检查 Mac 上是否有待确认提示，不要急着重新配对。",
+			frpUserHint: "共享 frp 服务的可选 user 字段：代理会以「用户名.代理名」注册。留空则不发送。",
+			frpUserInvalid: "用户名只能包含 1–128 个字母、数字、点、下划线或连字符。",
 			frpAttachPlan: "复制接入清单",
 			frpAttachPlanCopied: "接入清单已复制：本机 frpc.toml 与 VPS 侧待办。",
 			frpAttachPlanFailed: "生成接入清单失败：{error}",
@@ -2228,8 +2339,7 @@ window.__ModuleLoader__.load({
 			if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
 			return lines.join("\n");
 		}
-		//#endregion
-		//#region src/ip.ts
+		// src/ip.ts
 		/**
 		* Browser-safe IP literal classification.
 		*
@@ -2310,8 +2420,7 @@ window.__ModuleLoader__.load({
 			if (leftGroups < 0 || rightGroups < 0) return 0;
 			return leftGroups + rightGroups >= 8 ? 0 : 6;
 		}
-		//#endregion
-		//#region src/network.ts
+		// src/network.ts
 		/**
 		* IPv4 ranges that are never a public VPS endpoint (IANA special-purpose,
 		* private, shared, loopback, link-local, documentation, benchmark, multicast,
@@ -2381,7 +2490,8 @@ window.__ModuleLoader__.load({
 			"mode",
 			"entryTls",
 			"vhostHttpPort",
-			"publicPort"
+			"publicPort",
+			"user"
 		]);
 		function hostname(value) {
 			if (value.length > 253 || !value.includes(".")) return false;
@@ -2404,6 +2514,11 @@ window.__ModuleLoader__.load({
 			if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
 			return value;
 		}
+		/** Validate the optional frpc `user` field; it must stay one safe TOML token. */
+		function validateFrpUser(value) {
+			if (typeof value !== "string" || value.length < 1 || value.length > 128 || !/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error("frp_user_invalid");
+			return value;
+		}
 		/** Validate the public HTTPS origin used by Caddy and Android pairing. */
 		function validateFrpPublicOrigin(value) {
 			if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
@@ -2481,6 +2596,7 @@ window.__ModuleLoader__.load({
 			const entryTls = record.entryTls === void 0 ? void 0 : validateFrpEntryTls(record.entryTls);
 			const vhostHttpPort = record.vhostHttpPort === void 0 ? void 0 : validateFrpVhostHttpPort(record.vhostHttpPort);
 			const publicPort = record.publicPort === void 0 ? void 0 : validateFrpPublicPort(record.publicPort);
+			const user = record.user === void 0 || record.user === "" ? void 0 : validateFrpUser(record.user);
 			const resolvedMode = mode ?? "deploy";
 			const resolvedEntryTls = entryTls ?? "public-ip-cert";
 			if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
@@ -2496,7 +2612,8 @@ window.__ModuleLoader__.load({
 				...mode === void 0 ? {} : { mode },
 				...entryTls === void 0 ? {} : { entryTls },
 				...vhostHttpPort === void 0 ? {} : { vhostHttpPort },
-				...publicPort === void 0 ? {} : { publicPort }
+				...publicPort === void 0 ? {} : { publicPort },
+				...user === void 0 ? {} : { user }
 			});
 		}
 		function tomlString(value) {
@@ -2542,6 +2659,7 @@ window.__ModuleLoader__.load({
 				`serverPort = ${String(settings.serverPort)}`,
 				"auth.method = \"token\"",
 				`auth.token = ${tomlString(settings.token)}`,
+				...settings.user === void 0 ? [] : [`user = ${tomlString(settings.user)}`],
 				"transport.tls.enable = true",
 				"",
 				"[[proxies]]",
@@ -2569,8 +2687,7 @@ window.__ModuleLoader__.load({
 				""
 			].join("\n");
 		}
-		//#endregion
-		//#region src/frp-attach.ts
+		// src/frp-attach.ts
 		/** Default proof path used to confirm the public entry answered from this computer. */
 		const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
 		/** Declaration printed above the VPS half of an attach template. */
@@ -2767,8 +2884,7 @@ window.__ModuleLoader__.load({
 		function createFrpAttachTemplate(settings, options = {}) {
 			return createFrpAttachTemplateParts(settings, options).text;
 		}
-		//#endregion
-		//#region src/frp-form-validation.ts
+		// src/frp-form-validation.ts
 		/** Field ownership for errors returned by the Host parser. */
 		const FRP_FORM_ERRORS = {
 			frp_server_address_invalid: {
@@ -2791,6 +2907,11 @@ window.__ModuleLoader__.load({
 				code: "frp_public_origin_invalid",
 				messageKey: "frpPublicOriginInvalid"
 			},
+			frp_user_invalid: {
+				field: "user",
+				code: "frp_user_invalid",
+				messageKey: "frpUserInvalid"
+			},
 			frp_attach_mode_requires_vhost_port: {
 				field: "vhostHttpPort",
 				code: "frp_attach_mode_requires_vhost_port",
@@ -2824,6 +2945,7 @@ window.__ModuleLoader__.load({
 			check("serverAddress", "frpServerAddressInvalid", () => validateFrpServerAddress(form.serverAddress));
 			check("serverPort", "frpServerPortInvalid", () => validateFrpServerPort(form.serverPort));
 			if (form.token !== "" || !allowSavedToken) check("token", "frpTokenInvalid", () => validateFrpToken(form.token));
+			if (form.user !== void 0 && form.user !== "") check("user", "frpUserInvalid", () => validateFrpUser(form.user));
 			check("publicOrigin", "frpPublicOriginInvalid", () => validateFrpPublicOrigin(form.publicOrigin));
 			check("mode", "frpModeInvalid", () => validateFrpMode(form.mode));
 			check("entryTls", "frpEntryTlsInvalid", () => validateFrpEntryTls(form.entryTls));
@@ -2846,46 +2968,173 @@ window.__ModuleLoader__.load({
 			}
 			return issues;
 		}
-		//#endregion
-		//#region node_modules/@noble/hashes/esm/utils.js
-		/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-		/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+		// node_modules/@noble/hashes/_u64.js
+		const fromNumH = (n) => n / 2 ** 32 | 0;
+		const fromNumL = (n) => n >>> 0;
+		function setU64FromNum(view, byteOffset, n, isLE) {
+			const h = fromNumH(n);
+			const l = fromNumL(n);
+			view.setUint32(byteOffset, isLE ? l : h, isLE);
+			view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+		}
+		// node_modules/@noble/hashes/utils.js
+		/**
+		* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+		* @param a - value to test
+		* @returns `true` when the value is a Uint8Array-compatible view.
+		* @example
+		* Check whether a value is a Uint8Array-compatible view.
+		* ```ts
+		* isBytes(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
 		function isBytes(a) {
-			return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+			return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+		}
+		const atitle = (title) => title ? `"${title}" ` : "";
+		/**
+		* Asserts something is a non-negative integer.
+		* @param n - number to validate
+		* @param title - label included in thrown errors
+		* @returns The validated number.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate a non-negative integer option.
+		* ```ts
+		* anumber(32, 'length');
+		* ```
+		*/
+		function anumber(n, title = "") {
+			if (typeof n !== "number") throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+			if (!Number.isSafeInteger(n) || n < 0) throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+			return n;
 		}
-		/** Asserts something is Uint8Array. */
-		function abytes(b, ...lengths) {
-			if (!isBytes(b)) throw new Error("Uint8Array expected");
-			if (lengths.length > 0 && !lengths.includes(b.length)) throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+		/**
+		* Asserts something is Uint8Array.
+		* @param value - value to validate
+		* @param length - optional exact length constraint
+		* @param title - label included in thrown errors
+		* @returns The validated byte array.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate that a value is a byte array.
+		* ```ts
+		* abytes(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
+		function abytes(value, length, title = "") {
+			if (isBytes(value) && (length === void 0 || value.length === length)) return value;
+			if (length !== void 0) anumber(length, "length");
+			const bytes = isBytes(value);
+			const ofLen = length !== void 0 ? ` of length ${length}` : "";
+			const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+			const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+			if (!bytes) throw new TypeError(message);
+			throw new RangeError(message);
 		}
-		/** Asserts a hash instance has not been destroyed / finished */
+		const aobject = (value, label) => {
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+		};
+		const aopts = (value, label) => {
+			aobject(value, label);
+			const proto = Object.getPrototypeOf(value);
+			if (proto !== Object.prototype && proto !== null) throw new TypeError(`"${label}" expected plain object`);
+			if (Object.hasOwn(value, "__proto__")) throw new TypeError(`"${label}.__proto__" is not allowed`);
+		};
+		/**
+		* Asserts a hash instance has not been destroyed or finished.
+		* @param instance - hash instance to validate
+		* @param checkFinished - whether to reject finalized instances
+		* @throws If the hash instance has already been destroyed or finalized. {@link Error}
+		* @example
+		* Validate that a hash instance is still usable.
+		* ```ts
+		* import { aexists } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const hash = sha256.create();
+		* aexists(hash);
+		* ```
+		*/
 		function aexists(instance, checkFinished = true) {
-			if (instance.destroyed) throw new Error("Hash instance has been destroyed");
-			if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
+			if (instance.destroyed) throw new Error("hash was destroyed");
+			if (checkFinished && instance.finished) throw new Error("digest() was already called");
 		}
-		/** Asserts output is properly-sized byte array */
+		/**
+		* Asserts output is a sufficiently-sized byte array.
+		* @param out - destination buffer
+		* @param instance - hash instance providing output length
+		* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate a caller-provided digest buffer.
+		* ```ts
+		* import { aoutput } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const hash = sha256.create();
+		* aoutput(new Uint8Array(hash.outputLen), hash);
+		* ```
+		*/
 		function aoutput(out, instance) {
-			abytes(out);
+			abytes(out, void 0, "output");
 			const min = instance.outputLen;
-			if (out.length < min) throw new Error("digestInto() expects output buffer of length at least " + min);
+			if (!(out.length >= min)) throw new RangeError("\"output\" expected length >= " + min);
 		}
-		/** Zeroize a byte array. Warning: JS provides no guarantees. */
+		/**
+		* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+		* @param arrays - arrays to overwrite with zeros
+		* @example
+		* Zeroize sensitive buffers in place.
+		* ```ts
+		* clean(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
 		function clean(...arrays) {
 			for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
 		}
-		/** Create DataView of an array for easy byte-level manipulation. */
+		/**
+		* Creates a DataView for byte-level manipulation.
+		* @param arr - source typed array
+		* @returns DataView over the same buffer region.
+		* @example
+		* Create a DataView over an existing buffer.
+		* ```ts
+		* createView(new Uint8Array(4));
+		* ```
+		*/
 		function createView(arr) {
 			return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 		}
-		/** The rotate right (circular right shift) operation for uint32 */
+		/**
+		* Rotate-right operation for uint32 values.
+		* @param word - source word
+		* @param shift - shift amount in bits
+		* @returns Rotated word.
+		* @example
+		* Rotate a 32-bit word to the right.
+		* ```ts
+		* rotr(0x12345678, 8);
+		* ```
+		*/
 		function rotr(word, shift) {
 			return word << 32 - shift | word >>> shift;
 		}
 		const hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
 		const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 		/**
-		* Convert byte array to hex string. Uses built-in function, when available.
-		* @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'
+		* Convert byte array to hex string.
+		* Uses the built-in function when available and assumes it matches the tested
+		* fallback semantics.
+		* @param bytes - bytes to encode
+		* @returns Lowercase hexadecimal string.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Convert bytes to lowercase hexadecimal.
+		* ```ts
+		* bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
+		* ```
 		*/
 		function bytesToHex(bytes) {
 			abytes(bytes);
@@ -2896,70 +3145,169 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* Converts string to bytes using UTF8 encoding.
-		* @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
+		* Built-in doesn't validate input to be string: we do the check.
+		* Non-ASCII details are delegated to the platform `TextEncoder`.
+		* @param str - string to encode
+		* @returns UTF-8 encoded bytes.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Encode a string as UTF-8 bytes.
+		* ```ts
+		* utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])
+		* ```
 		*/
 		function utf8ToBytes(str) {
-			if (typeof str !== "string") throw new Error("string expected");
-			return new Uint8Array(new TextEncoder().encode(str));
+			if (typeof str !== "string") throw new TypeError("string expected");
+			const encoded = new TextEncoder().encode(str);
+			try {
+				return new Uint8Array(encoded);
+			} finally {
+				clean(encoded);
+			}
 		}
 		/**
-		* Normalizes (non-hex) string or Uint8Array to Uint8Array.
-		* Warning: when Uint8Array is passed, it would NOT get copied.
-		* Keep in mind for future mutable operations.
+		* Merges default options and passed options.
+		* @param defaults - base option object
+		* @param opts - user overrides
+		* @param title - label included in thrown override errors
+		* @returns Fresh merged option object with a null prototype.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Merge user overrides onto default options.
+		* ```ts
+		* checkOpts({ dkLen: 32 }, { asyncTick: 10 });
+		* ```
 		*/
-		function toBytes(data) {
-			if (typeof data === "string") data = utf8ToBytes(data);
-			abytes(data);
-			return data;
-		}
-		/** For runtime check if class implements interface */
-		var Hash = class {};
-		/** Wraps hash function, creating an interface on top of it */
-		function createHasher(hashCons) {
-			const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-			const tmp = hashCons();
+		function checkOpts(defaults, opts, title = "opts") {
+			aopts(defaults, "defaults");
+			if (opts !== void 0) aopts(opts, title);
+			return Object.assign(Object.create(null), defaults, opts);
+		}
+		/**
+		* Creates a callable hash function from a stateful class constructor.
+		* @param hashCons - hash constructor or factory
+		* @param info - optional metadata such as DER OID
+		* @returns Frozen callable hash wrapper with `.create()`.
+		*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+		*   `outputLen` / `blockLen`, so constructor side effects happen at module
+		*   init time.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Wrap a stateful hash constructor into a callable helper.
+		* ```ts
+		* import { createHasher } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+		* wrapped(new Uint8Array([1]));
+		* ```
+		*/
+		function createHasher(hashCons, info = {}) {
+			if (typeof hashCons !== "function") throw new TypeError("\"hashCons\" expected function, got type=" + typeof hashCons);
+			info = checkOpts({}, info, "info");
+			const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+			const tmp = hashCons(void 0);
 			hashC.outputLen = tmp.outputLen;
 			hashC.blockLen = tmp.blockLen;
-			hashC.create = () => hashCons();
-			return hashC;
+			hashC.canXOF = tmp.canXOF;
+			hashC.create = (opts) => hashCons(opts);
+			Object.assign(hashC, info);
+			return Object.freeze(hashC);
 		}
-		//#endregion
-		//#region node_modules/@noble/hashes/esm/_md.js
+		/**
+		* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+		* @param suffix - final OID byte for the selected hash.
+		*   The helper accepts any byte even though only the documented NIST hash
+		*   suffixes are meaningful downstream.
+		* @returns Object containing the DER-encoded OID.
+		* @example
+		* Build OID metadata for a NIST hash.
+		* ```ts
+		* oidNist(0x01);
+		* ```
+		*/
+		const oidNist = (suffix) => ({ oid: Uint8Array.from([
+			6,
+			9,
+			96,
+			134,
+			72,
+			1,
+			101,
+			3,
+			4,
+			2,
+			suffix
+		]) });
+		// node_modules/@noble/hashes/_md.js
 		/**
 		* Internal Merkle-Damgard hash utils.
 		* @module
 		*/
-		/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */
-		function setBigUint64(view, byteOffset, value, isLE) {
-			if (typeof view.setBigUint64 === "function") return view.setBigUint64(byteOffset, value, isLE);
-			const _32n = BigInt(32);
-			const _u32_max = BigInt(4294967295);
-			const wh = Number(value >> _32n & _u32_max);
-			const wl = Number(value & _u32_max);
-			const h = isLE ? 4 : 0;
-			const l = isLE ? 0 : 4;
-			view.setUint32(byteOffset + h, wh, isLE);
-			view.setUint32(byteOffset + l, wl, isLE);
-		}
-		/** Choice: a ? b : c */
+		/**
+		* Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+		* Returns bits from `b` when `a` is set, otherwise from `c`.
+		* The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+		* set the same bit.
+		* @param a - selector word
+		* @param b - word chosen when selector bit is set
+		* @param c - word chosen when selector bit is clear
+		* @returns Mixed 32-bit word.
+		* @example
+		* Combine three words with the shared 32-bit choice primitive.
+		* ```ts
+		* Chi(0xffffffff, 0x12345678, 0x87654321);
+		* ```
+		*/
 		function Chi(a, b, c) {
 			return a & b ^ ~a & c;
 		}
-		/** Majority function, true if any two inputs is true. */
+		/**
+		* Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+		* Returns bits shared by at least two inputs.
+		* @param a - first input word
+		* @param b - second input word
+		* @param c - third input word
+		* @returns Mixed 32-bit word.
+		* @example
+		* Combine three words with the shared 32-bit majority primitive.
+		* ```ts
+		* Maj(0xffffffff, 0x12345678, 0x87654321);
+		* ```
+		*/
 		function Maj(a, b, c) {
 			return a & b ^ a & c ^ b & c;
 		}
 		/**
 		* Merkle-Damgard hash construction base class.
 		* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+		* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+		* strings with partial-byte tails.
+		* @param blockLen - internal block size in bytes
+		* @param outputLen - digest size in bytes
+		* @param padOffset - trailing length field size in bytes
+		* @param isLE - whether length and state words are encoded in little-endian
+		* @example
+		* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+		* ```ts
+		* import { _SHA1 } from '@noble/hashes/legacy.js';
+		* const hash = new _SHA1();
+		* hash.update(new Uint8Array([97, 98, 99]));
+		* hash.digest();
+		* ```
 		*/
-		var HashMD = class extends Hash {
+		var HashMD = class {
+			blockLen;
+			outputLen;
+			canXOF = false;
+			padOffset;
+			isLE;
+			buffer;
+			view;
+			finished = false;
+			length = 0;
+			pos = 0;
+			destroyed = false;
 			constructor(blockLen, outputLen, padOffset, isLE) {
-				super();
-				this.finished = false;
-				this.length = 0;
-				this.pos = 0;
-				this.destroyed = false;
 				this.blockLen = blockLen;
 				this.outputLen = outputLen;
 				this.padOffset = padOffset;
@@ -2969,27 +3317,29 @@ window.__ModuleLoader__.load({
 			}
 			update(data) {
 				aexists(this);
-				data = toBytes(data);
 				abytes(data);
 				const { view, buffer, blockLen } = this;
 				const len = data.length;
+				let processed = false;
 				for (let pos = 0; pos < len;) {
 					const take = Math.min(blockLen - this.pos, len - pos);
 					if (take === blockLen) {
 						const dataView = createView(data);
 						for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+						processed = true;
 						continue;
 					}
-					buffer.set(data.subarray(pos, pos + take), this.pos);
+					buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
 					this.pos += take;
 					pos += take;
 					if (this.pos === blockLen) {
 						this.process(view, 0);
 						this.pos = 0;
+						processed = true;
 					}
 				}
 				this.length += data.length;
-				this.roundClean();
+				if (processed) this.roundClean();
 				return this;
 			}
 			digestInto(out) {
@@ -2999,20 +3349,19 @@ window.__ModuleLoader__.load({
 				const { buffer, view, blockLen, isLE } = this;
 				let { pos } = this;
 				buffer[pos++] = 128;
-				clean(this.buffer.subarray(pos));
+				buffer.fill(0, pos);
 				if (this.padOffset > blockLen - pos) {
 					this.process(view, 0);
-					pos = 0;
+					buffer.fill(0);
 				}
-				for (let i = pos; i < blockLen; i++) buffer[i] = 0;
-				setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+				setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
 				this.process(view, 0);
-				const oview = createView(out);
+				this.roundClean();
+				const oview = out === buffer ? view : createView(out);
 				const len = this.outputLen;
-				if (len % 4) throw new Error("_sha2: outputLen should be aligned to 32bit");
 				const outLen = len / 4;
 				const state = this.get();
-				if (outLen > state.length) throw new Error("_sha2: outputLen bigger than state");
+				if (len % 4 || outLen > state.length) throw new Error("invalid outputLen");
 				for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
 			}
 			digest() {
@@ -3022,15 +3371,13 @@ window.__ModuleLoader__.load({
 				this.destroy();
 				return res;
 			}
-			_cloneInto(to) {
-				to || (to = new this.constructor());
-				to.set(...this.get());
-				const { blockLen, buffer, length, finished, destroyed, pos } = this;
+			_cloneIntoMeta(to) {
+				const { buffer, length, finished, destroyed, pos } = this;
 				to.destroyed = destroyed;
 				to.finished = finished;
 				to.length = length;
 				to.pos = pos;
-				if (length % blockLen) to.buffer.set(buffer);
+				if (pos) to.buffer.set(buffer);
 				return to;
 			}
 			clone() {
@@ -3041,7 +3388,9 @@ window.__ModuleLoader__.load({
 		* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
 		* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
 		*/
-		/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */
+		/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+		* square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+		* it as read-only because constructors copy words from it by index. */
 		const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
 			1779033703,
 			3144134277,
@@ -3052,18 +3401,17 @@ window.__ModuleLoader__.load({
 			528734635,
 			1541459225
 		]);
-		//#endregion
-		//#region node_modules/@noble/hashes/esm/sha2.js
+		// node_modules/@noble/hashes/sha2.js
 		/**
 		* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
 		* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
-		* Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and
-		* [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
+		* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+		* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
 		* @module
 		*/
 		/**
-		* Round constants:
-		* First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)
+		* SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+		* of the cube roots of the first 64 primes (2..311).
 		*/
 		const SHA256_K = /* @__PURE__ */ Uint32Array.from([
 			1116352408,
@@ -3131,19 +3479,28 @@ window.__ModuleLoader__.load({
 			3204031479,
 			3329325298
 		]);
-		/** Reusable temporary buffer. "W" comes straight from spec. */
+		/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
 		const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-		var SHA256 = class extends HashMD {
-			constructor(outputLen = 32) {
+		/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+		var SHA2_32B = class extends HashMD {
+			A = 0;
+			B = 0;
+			C = 0;
+			D = 0;
+			E = 0;
+			F = 0;
+			G = 0;
+			H = 0;
+			constructor(outputLen, IV) {
 				super(64, outputLen, 8, false);
-				this.A = SHA256_IV[0] | 0;
-				this.B = SHA256_IV[1] | 0;
-				this.C = SHA256_IV[2] | 0;
-				this.D = SHA256_IV[3] | 0;
-				this.E = SHA256_IV[4] | 0;
-				this.F = SHA256_IV[5] | 0;
-				this.G = SHA256_IV[6] | 0;
-				this.H = SHA256_IV[7] | 0;
+				this.A = IV[0] | 0;
+				this.B = IV[1] | 0;
+				this.C = IV[2] | 0;
+				this.D = IV[3] | 0;
+				this.E = IV[4] | 0;
+				this.F = IV[5] | 0;
+				this.G = IV[6] | 0;
+				this.H = IV[7] | 0;
 			}
 			get() {
 				const { A, B, C, D, E, F, G, H } = this;
@@ -3168,6 +3525,10 @@ window.__ModuleLoader__.load({
 				this.G = G | 0;
 				this.H = H | 0;
 			}
+			_cloneInto(to) {
+				(to ||= new this.constructor()).set(...this.get());
+				return this._cloneIntoMeta(to);
+			}
 			process(view, offset) {
 				for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
 				for (let i = 16; i < 64; i++) {
@@ -3205,24 +3566,34 @@ window.__ModuleLoader__.load({
 				clean(SHA256_W);
 			}
 			destroy() {
+				this.destroyed = true;
 				this.set(0, 0, 0, 0, 0, 0, 0, 0);
 				clean(this.buffer);
 			}
 		};
-		//#endregion
-		//#region node_modules/@noble/hashes/esm/sha256.js
+		/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+		var _SHA256 = class extends SHA2_32B {
+			constructor() {
+				super(32, SHA256_IV);
+			}
+		};
 		/**
-		* SHA2-256 a.k.a. sha256. In JS, it is the fastest hash, even faster than Blake3.
-		*
-		* To break sha256 using birthday attack, attackers need to try 2^128 hashes.
-		* BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+		* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
 		*
-		* Check out [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
-		* @module
-		* @deprecated
+		* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+		* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+		* - Each sha256 hash is executing 2^18 bit operations.
+		* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+		* @param msg - message bytes to hash
+		* @param opts - Reserved hash options.
+		* @returns Digest bytes.
+		* @example
+		* Hash a message with SHA2-256.
+		* ```ts
+		* sha256(new Uint8Array([97, 98, 99]));
+		* ```
 		*/
-		/** @deprecated Use import from `noble/hashes/sha2` module */
-		const sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+		const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
 		Object.freeze({
 			title: 80,
 			body: 200,
@@ -3231,7 +3602,7 @@ window.__ModuleLoader__.load({
 		const MAX_SEEN_QUESTION_KEYS = 20;
 		/** A bounded native identifier derived from the complete, case-sensitive wire ID. */
 		function notificationIdentity(value) {
-			return bytesToHex(sha256(JSON.stringify(value)).subarray(0, 16));
+			return bytesToHex(sha256(utf8ToBytes(JSON.stringify(value))).subarray(0, 16));
 		}
 		/** Stable per-turn tag so concurrent sessions keep separate notifications. */
 		function taskCompletionTag(sessionId, turn) {
@@ -3521,8 +3892,7 @@ window.__ModuleLoader__.load({
 				if (anchorTimer !== 0) window.clearTimeout(anchorTimer);
 			};
 		}
-		//#endregion
-		//#region src/mobile-composer-toolbar.ts
+		// src/mobile-composer-toolbar.ts
 		/**
 		* Compact the stock InputBar without changing its React ownership, handlers,
 		* activity tree or the two groups observed by DSH's model-width controller.
@@ -3557,8 +3927,7 @@ window.__ModuleLoader__.load({
   [data-dsh-mobile-composer-model-label] { flex:1 1 auto !important; max-width:none !important; min-width:0 !important; overflow:hidden !important; text-overflow:ellipsis !important; white-space:nowrap !important; }
 }
 `;
-		//#endregion
-		//#region src/browser-file-picker.ts
+		// src/browser-file-picker.ts
 		/** Browser chooser lifetime shared by camera controls and the extension SDK. */
 		const BROWSER_FILE_PICKER_DEADLINE_MS = 3e5;
 		const browserEnvironment = {
@@ -3678,8 +4047,21 @@ window.__ModuleLoader__.load({
 				}
 			});
 		}
-		//#endregion
-		//#region src/mobile-sidebar-scroll.ts
+		// src/mobile-layout-attributes.ts
+		/**
+		* Root marker the dedicated layout publishes for its wide/narrow band.
+		*
+		* The band depends on the device screen size, which a media query cannot read,
+		* so the layout decides it in JS and writes this attribute on `.dshm-shell`:
+		* `"1"` docks the sidebar, anything else — `"0"`, or no marker — is the overlay
+		* drawer. The stylesheet and the sidebar scroll adapter both follow the marker,
+		* so the band has exactly one owner.
+		*
+		* This module stays free of imports: the dedicated layout bundle and the native
+		* client bundle both use it, and neither should pull the other in.
+		*/
+		const WIDE_LAYOUT_ATTRIBUTE = "data-dshm-wide";
+		// src/mobile-sidebar-scroll.ts
 		function sidebarRestoreTop(snapshot, anchorTop) {
 			return Math.max(0, anchorTop === void 0 || snapshot.offset === void 0 ? snapshot.top : anchorTop - snapshot.offset);
 		}
@@ -3709,7 +4091,16 @@ window.__ModuleLoader__.load({
 		function installMobileSidebarScrollMemory() {
 			const memories = /* @__PURE__ */ new Map();
 			const stockViewport = window.matchMedia("(max-width:720px)");
-			const dedicatedViewport = window.matchMedia("(max-width:899px)");
+			/**
+			* Whether the dedicated layout currently renders the sidebar as an overlay
+			* drawer. That is the layout's own decision on the shell — a landscape phone
+			* is an overlay there although its viewport is wide — so a width query would
+			* disable this memory exactly where the drawer is hardest to reach.
+			*/
+			const drawerBand = () => {
+				const shell = document.querySelector(".dshm-shell");
+				return shell === null || shell.getAttribute("data-dshm-wide") !== "1";
+			};
 			let root;
 			let open = false;
 			let ports = /* @__PURE__ */ new Map();
@@ -3760,7 +4151,7 @@ window.__ModuleLoader__.load({
 			const sync = () => {
 				if (disposed) return;
 				const next = document.querySelector("[data-dsh-mobile-sidebar-root]") ?? void 0;
-				const mobile = next?.closest("[data-pane=\"sidebar\"]") != null ? dedicatedViewport.matches : stockViewport.matches;
+				const mobile = next?.closest("[data-pane=\"sidebar\"]") != null ? drawerBand() : stockViewport.matches;
 				if (next !== root) {
 					cancel();
 					ports.clear();
@@ -3805,7 +4196,6 @@ window.__ModuleLoader__.load({
 				remember();
 			};
 			stockViewport.addEventListener("change", sync);
-			dedicatedViewport.addEventListener("change", sync);
 			document.addEventListener("scroll", onScroll, true);
 			for (const type of [
 				"pointerdown",
@@ -3820,7 +4210,6 @@ window.__ModuleLoader__.load({
 					disposed = true;
 					cancel();
 					stockViewport.removeEventListener("change", sync);
-					dedicatedViewport.removeEventListener("change", sync);
 					document.removeEventListener("scroll", onScroll, true);
 					for (const type of [
 						"pointerdown",
@@ -3835,8 +4224,7 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
-		//#endregion
-		//#region src/native-mobile.ts
+		// src/native-mobile.ts
 		/**
 		* Viewport below which the injected chrome becomes an overlay drawer: the
 		* sidebar slides in as a sheet, the right panel as a drawer, and the scrim dims
@@ -4176,6 +4564,14 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/**
+		* Detect upstream ownership before applying legacy frame geometry.
+		* @param frame - the stock frame's element lookup, if mounted.
+		* @returns whether it provides the responsive sidebar opener.
+		*/
+		function stockOwnsMobileDrawer(frame) {
+			return frame?.querySelector("[data-sidebar-opener]") != null;
+		}
+		/**
 		* Mirror the classes of the stock Add-menu item on an injected attachment action.
 		*
 		* An empty class name is not nullish: trusting it would strip the plugin's own
@@ -5464,11 +5860,27 @@ window.__ModuleLoader__.load({
 				const nextFrame = resolveNativeMobileFrame(document, dedicatedCenter);
 				if (frame !== nextFrame) frame?.removeAttribute("data-dsh-mobile-frame");
 				frame = nextFrame;
-				if (frame !== void 0) frame.dataset.dshMobileFrame = "true";
-				sidebar = frame === void 0 ? document.querySelector(".dshm-drawer") ?? void 0 : firstByClassSuffix(frame, "_sidebarCol");
+				const nativeDrawer = stockOwnsMobileDrawer(frame);
+				if (frame !== void 0) {
+					if (nativeDrawer) frame.removeAttribute("data-dsh-mobile-frame");
+					else frame.dataset.dshMobileFrame = "true";
+				}
+				if (nativeDrawer) {
+					sidebar?.removeAttribute("data-dsh-mobile-sidebar");
+					sidebarRoot?.removeAttribute("data-dsh-mobile-sidebar-root");
+					toggle?.removeAttribute("data-dsh-mobile-toggle");
+					for (const node of frame.querySelectorAll("[data-dsh-mobile-details],[data-dsh-mobile-handle]")) {
+						node.removeAttribute("data-dsh-mobile-details");
+						node.removeAttribute("data-dsh-mobile-handle");
+					}
+					sidebarRoot = void 0;
+					toggle = void 0;
+					backdrop.hidden = true;
+				}
+				sidebar = nativeDrawer ? void 0 : frame === void 0 ? document.querySelector(".dshm-drawer") ?? void 0 : firstByClassSuffix(frame, "_sidebarCol");
 				const center = frame === void 0 ? dedicatedCenter : firstByClassSuffix(frame, "_centerCol");
-				const details = frame === void 0 ? void 0 : firstByClassSuffix(frame, "_detailsCol");
-				const handle = frame === void 0 ? void 0 : firstByClassSuffix(frame, "_handle");
+				const details = frame === void 0 || nativeDrawer ? void 0 : firstByClassSuffix(frame, "_detailsCol");
+				const handle = frame === void 0 || nativeDrawer ? void 0 : firstByClassSuffix(frame, "_handle");
 				markNativeMobileSettings(document);
 				if (center === void 0) {
 					syncPanHeader(void 0);
@@ -5482,12 +5894,15 @@ window.__ModuleLoader__.load({
 					return;
 				}
 				if (center !== void 0) {
-					center.dataset.dshMobileCenter = "true";
+					if (nativeDrawer) center.removeAttribute("data-dsh-mobile-center");
+					else center.dataset.dshMobileCenter = "true";
 					const header = center.querySelector("header") ?? void 0;
-					header?.setAttribute("data-dsh-mobile-header", "true");
-					syncPanHeader(header);
+					if (nativeDrawer) header?.removeAttribute("data-dsh-mobile-header");
+					else header?.setAttribute("data-dsh-mobile-header", "true");
+					syncPanHeader(nativeDrawer ? void 0 : header);
 					viewArea = firstByClassSuffix(center, "_viewArea");
-					if (viewArea !== void 0) viewArea.dataset.dshMobileView = "true";
+					if (nativeDrawer) viewArea?.removeAttribute("data-dsh-mobile-view");
+					else if (viewArea !== void 0) viewArea.dataset.dshMobileView = "true";
 					const conversation = center.querySelector("[data-conversation-scroll]");
 					const composerCard = center.querySelector("[data-composer-card]");
 					bindHistoryScroller(conversation ?? void 0, composerCard ?? null);
@@ -5594,7 +6009,8 @@ window.__ModuleLoader__.load({
 					"readonly",
 					"aria-busy",
 					"aria-selected",
-					"data-dsh-mobile-session"
+					"data-dsh-mobile-session",
+					WIDE_LAYOUT_ATTRIBUTE
 				]
 			});
 			overlayQuery.addEventListener("change", schedule);
@@ -5696,8 +6112,7 @@ window.__ModuleLoader__.load({
 				delete document.documentElement.dataset.dshMobileInput;
 			};
 		}
-		//#endregion
-		//#region src/voice-session.ts
+		// src/voice-session.ts
 		/** Screen wake-lock ownership and mobile composer focus during DSH dictation. */
 		/** Voice phases during which the user is dictating. */
 		const DICTATING_PHASES = [
@@ -6154,8 +6569,7 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
-		//#endregion
-		//#region src/mobile-font-capabilities.ts
+		// src/mobile-font-capabilities.ts
 		const NO_ADVANCED_MOBILE_TYPOGRAPHY = Object.freeze({
 			codeSize: false,
 			textFamily: false,
@@ -6211,8 +6625,7 @@ window.__ModuleLoader__.load({
 				code.remove();
 			}
 		}
-		//#endregion
-		//#region src/mobile-font.ts
+		// src/mobile-font.ts
 		/** Device-local typography for authenticated mobile pages, without Host settings writes. */
 		const MOBILE_FONT_STORAGE_KEY = "dsh-mobile.content-font-size.v1";
 		const MOBILE_TYPOGRAPHY_STORAGE_KEY = "dsh-mobile.typography.v1";
@@ -6638,8 +7051,7 @@ window.__ModuleLoader__.load({
 				}
 			}, copy.reset)));
 		}
-		//#endregion
-		//#region src/mobile-display-scale.ts
+		// src/mobile-display-scale.ts
 		/** Native App page scaling in DSH General settings, independent from local typography. */
 		/** Validate the native reply before displaying or reusing its values in a request. */
 		function parseMobileDisplayScale(value) {
@@ -6856,8 +7268,7 @@ window.__ModuleLoader__.load({
 				}
 			}, copy.reset)));
 		}
-		//#endregion
-		//#region src/mobile-native-settings-action.ts
+		// src/mobile-native-settings-action.ts
 		/** Own capability discovery and explicit calls; native actions retain the App's own timeout. */
 		var MobileNativeSettingsActionController = class {
 			action;
@@ -6966,8 +7377,7 @@ window.__ModuleLoader__.load({
 				for (const listener of this.listeners) listener();
 			}
 		};
-		//#endregion
-		//#region src/local-admin-host.ts
+		// src/local-admin-host.ts
 		/** Browser-safe desktop-admin Host checks. Do not import Node APIs here. */
 		const DESKTOP_ADMIN_HEADER = "x-dsh-mobile-desktop-admin";
 		const DESKTOP_ADMIN_MARKER = "dsh-app://app";
@@ -7031,8 +7441,7 @@ window.__ModuleLoader__.load({
 			const query = search.startsWith("?") ? search.slice(1) : search;
 			return (protocol === "dsh-app:" ? hostname === "app" : (protocol === "" || protocol === "http:" || protocol === "https:") && isLocalAdminHostname(hostname)) && frontend !== "dedicated" && !new URLSearchParams(query).has("dsh-mobile-preview");
 		}
-		//#endregion
-		//#region src/client-module-presentation.ts
+		// src/client-module-presentation.ts
 		/** Group boot-protected entries before considering their package namespace.
 		* @param entry - Catalog entry with server-owned required and dependency fields.
 		* @returns Display group, never an authorization or compatibility decision.
@@ -7109,6 +7518,21 @@ window.__ModuleLoader__.load({
 			}
 			return entries.filter((entry) => !keep.has(entry.id)).map((entry) => entry.id);
 		}
+		/**
+		* Describe the optional modules removed by the minimal preset without treating unmeasured sizes as zero.
+		* @param entries - The complete displayed catalog, including required dependencies.
+		* @returns Excluded count, known gzip bytes when measured, and the number still unmeasured.
+		*/
+		function clientModuleMinimalImpact(entries) {
+			const excluded = new Set(clientModuleMinimalExclusion(entries));
+			const rows = entries.filter((entry) => excluded.has(entry.id));
+			const measured = rows.filter((entry) => entry.gzipBytes !== void 0);
+			return {
+				count: rows.length,
+				...measured.length === 0 ? {} : { gzipBytes: measured.reduce((sum, entry) => sum + entry.gzipBytes, 0) },
+				unknown: rows.length - measured.length
+			};
+		}
 		/** Editable selections retain unknown server exclusions and never cascade dependencies. */
 		var ClientModuleDraft = class {
 			initial;
@@ -7236,8 +7660,7 @@ window.__ModuleLoader__.load({
 				return filter === "loaded" ? [] : this.invalidExclusions.filter((entry) => matchesQuery(entry.id, query));
 			}
 		};
-		//#endregion
-		//#region src/client-module-ui.ts
+		// src/client-module-ui.ts
 		/** Device-local module selection and the computer's defaults share a read-only catalog. */
 		const CLIENT_MODULE_COPY = {
 			zh: {
@@ -7266,6 +7689,7 @@ window.__ModuleLoader__.load({
 				failed: "暂时无法读取模块。请确认移动访问已启用后重试。",
 				saveFailed: "未确认保存成功，已保留你的选择。可重新保存，或重新读取已保存设置。",
 				conflict: "无法保存：",
+				catalogChanged: "模块目录已变化（插件或版本有更新），本次保存已取消。请点「重新读取」，确认后再保存。",
 				computerSource: "当前来源：电脑默认设置",
 				deviceSource: "当前来源：本设备设置",
 				pluginSource: "当前来源：插件默认设置",
@@ -7295,6 +7719,7 @@ window.__ModuleLoader__.load({
 				totalUnknown: "勾选合计：部分模块未测到体积",
 				minimal: "仅必需（最小加载）",
 				minimalConfirm: "把除了启动必需项及其依赖之外全部设为不加载？保存后下次打开生效。",
+				minimalDetail: "将排除 {count} 个可选模块；已测 gzip 合计 {size}，另有 {unknown} 项体积未知。启动必需项及其依赖会保留。",
 				retry: "重新读取",
 				saving: "正在保存…",
 				readTimeout: "读取超时。当前页面和已保存设置未变，请重试。",
@@ -7332,6 +7757,7 @@ window.__ModuleLoader__.load({
 				failed: "Could not read modules. Enable mobile access and try again.",
 				saveFailed: "Saving was not confirmed. Your choices are kept. Save again or reread the saved settings.",
 				conflict: "Could not save: ",
+				catalogChanged: "The module catalog changed (a plugin or version update). This save was cancelled; reread the settings, then confirm again.",
 				computerSource: "Source: computer defaults",
 				deviceSource: "Source: this device’s settings",
 				pluginSource: "Source: plugin defaults",
@@ -7361,6 +7787,7 @@ window.__ModuleLoader__.load({
 				totalUnknown: "Selection total: some sizes are unknown",
 				minimal: "Required only (minimal load)",
 				minimalConfirm: "Mark everything except required modules and their dependencies as not loaded? Applies on the next open after saving.",
+				minimalDetail: "This excludes {count} optional modules; measured gzip total: {size}; {unknown} remain unmeasured. Required modules and their dependencies stay loaded.",
 				retry: "Reread settings",
 				saving: "Saving…",
 				readTimeout: "Reading timed out. This page and saved settings are unchanged; try again.",
@@ -7398,6 +7825,7 @@ window.__ModuleLoader__.load({
 				failed: "Impossibile leggere i moduli. Abilita accesso mobile e riprova.",
 				saveFailed: "Salvataggio non confermato. Le scelte restano; salva di nuovo o rileggi le impostazioni salvate.",
 				conflict: "Impossibile salvare: ",
+				catalogChanged: "Il catalogo dei moduli è cambiato (aggiornamento di plugin o versione). Salvataggio annullato: rileggi le impostazioni e conferma di nuovo.",
 				computerSource: "Origine: predefiniti del computer",
 				deviceSource: "Origine: impostazioni del dispositivo",
 				pluginSource: "Origine: predefiniti del plugin",
@@ -7427,6 +7855,7 @@ window.__ModuleLoader__.load({
 				totalUnknown: "Totale selezione: alcune dimensioni sono sconosciute",
 				minimal: "Solo obbligatori (caricamento minimo)",
 				minimalConfirm: "Impostare come non caricati tutti i moduli tranne gli obbligatori e le loro dipendenze? Vale alla prossima apertura dopo il salvataggio.",
+				minimalDetail: "Verranno esclusi {count} moduli facoltativi; totale gzip misurato: {size}; {unknown} non misurati. Gli obbligatori e le loro dipendenze restano caricati.",
 				retry: "Rileggi impostazioni",
 				saving: "Salvataggio…",
 				readTimeout: "Lettura scaduta. Pagina e impostazioni salvate non cambiano; riprova.",
@@ -7441,9 +7870,11 @@ window.__ModuleLoader__.load({
 		};
 		var ClientModuleUiConflict = class extends Error {
 			detail;
-			constructor(detail) {
+			code;
+			constructor(detail, code = "invalid_selection") {
 				super("client_module_conflict");
 				this.detail = detail;
+				this.code = code;
 			}
 		};
 		/** A deadline does not imply that a POST was rolled back by the server. */
@@ -7503,12 +7934,16 @@ window.__ModuleLoader__.load({
 				};
 			});
 			if (new Set(entries.map((entry) => entry.id)).size !== entries.length) throw new Error("invalid_module_catalog");
+			const revision = value.revision;
+			if (revision !== void 0 && (typeof revision !== "string" || revision === "" || revision.length > 64)) throw new Error("invalid_module_catalog");
+			const excludedClientModules = value.excludedClientModules.map((id) => {
+				if (typeof id !== "string") throw new Error("invalid_module_catalog");
+				return id;
+			});
 			return {
 				entries,
-				excludedClientModules: value.excludedClientModules.map((id) => {
-					if (typeof id !== "string") throw new Error("invalid_module_catalog");
-					return id;
-				}),
+				...typeof revision === "string" ? { revision } : {},
+				excludedClientModules,
 				source: value.source === "device" ? "device" : value.source === "computer" ? "computer" : "plugin"
 			};
 		}
@@ -7555,7 +7990,9 @@ window.__ModuleLoader__.load({
 				const value = await response.json();
 				if (!response.ok) {
 					const detail = typeof value === "object" && value !== null && "detail" in value && typeof value.detail === "string" ? value.detail.slice(0, 512) : "";
-					if (response.status === 409 && detail !== "" && typeof value === "object" && value !== null && "error" in value && value.error === "excluded_client_modules_invalid") throw new ClientModuleUiConflict(detail);
+					const code = typeof value === "object" && value !== null && "error" in value && typeof value.error === "string" ? value.error : "";
+					if (response.status === 409 && detail !== "" && code === "client_module_catalog_changed") throw new ClientModuleUiConflict(detail, "catalog_changed");
+					if (response.status === 409 && detail !== "" && code === "excluded_client_modules_invalid") throw new ClientModuleUiConflict(detail);
 					throw new Error("client_module_request_failed");
 				}
 				return parseClientModuleView(value);
@@ -7715,6 +8152,7 @@ window.__ModuleLoader__.load({
 			let measurementController;
 			let generation = 0;
 			let draft;
+			let catalogRevision;
 			let unconfirmedWrite = false;
 			const expansion = /* @__PURE__ */ new Map([
 				["extensions", true],
@@ -7886,12 +8324,13 @@ window.__ModuleLoader__.load({
 			};
 			const render = (view) => {
 				draft = new ClientModuleDraft(view.entries, view.excludedClientModules);
+				catalogRevision = view.revision;
 				source.textContent = view.source === "device" ? copy.deviceSource : view.source === "computer" ? copy.computerSource : copy.pluginSource;
 				renderList();
 			};
 			const failed = (error, mutation) => {
 				status.classList.add("dsh-module-error");
-				status.textContent = error instanceof ClientModuleUiConflict ? `${copy.conflict}${error.detail}` : error instanceof ClientModuleRequestTimeout ? error.mutation ? copy.writeTimeout : copy.readTimeout : mutation ? copy.saveFailed : copy.failed;
+				status.textContent = error instanceof ClientModuleUiConflict ? error.code === "catalog_changed" ? copy.catalogChanged : `${copy.conflict}${error.detail}` : error instanceof ClientModuleRequestTimeout ? error.mutation ? copy.writeTimeout : copy.readTimeout : mutation ? copy.saveFailed : copy.failed;
 				status.focus({ preventScroll: true });
 			};
 			const runRequest = (payload) => {
@@ -7933,13 +8372,24 @@ window.__ModuleLoader__.load({
 			search.addEventListener("input", renderList);
 			filter.addEventListener("change", renderList);
 			save.addEventListener("click", () => {
-				if ((draft?.changeCount ?? 0) > 0) runRequest({ excludedClientModules: draft?.excludedIds });
+				if ((draft?.changeCount ?? 0) > 0) runRequest({
+					excludedClientModules: draft?.excludedIds,
+					...catalogRevision === void 0 ? {} : { revision: catalogRevision }
+				});
 			});
 			reset.addEventListener("click", () => {
 				if (busy === void 0 && draft !== void 0 && window.confirm(copy.resetConfirm)) runRequest({ reset: true });
 			});
 			minimal.addEventListener("click", () => {
-				if (busy !== void 0 || draft === void 0 || !window.confirm(copy.minimalConfirm)) return;
+				if (busy !== void 0 || draft === void 0) return;
+				const impact = clientModuleMinimalImpact(draft.entries);
+				const detail = copy.minimalDetail.replace("{count}", String(impact.count)).replace("{size}", impact.gzipBytes === void 0 ? "—" : formatClientModuleSize({
+					id: "",
+					required: false,
+					dependencies: [],
+					gzipBytes: impact.gzipBytes
+				}) ?? "—").replace("{unknown}", String(impact.unknown));
+				if (!window.confirm(`${copy.minimalConfirm}\n\n${detail}`)) return;
 				if (draft.applyMinimalSelection()) {
 					renderList();
 					search.focus({ preventScroll: true });
@@ -8018,8 +8468,7 @@ window.__ModuleLoader__.load({
 				}
 			}, copy.open));
 		}
-		//#endregion
-		//#region src/extension-recovery-ui.ts
+		// src/extension-recovery-ui.ts
 		/** Validate the Host response and select only stopped workers, never in-process hosts. */
 		function parseUnavailableExtensionHosts(payload) {
 			if (typeof payload !== "object" || payload === null || !("hosts" in payload) || !Array.isArray(payload.hosts)) return void 0;
@@ -8221,8 +8670,7 @@ window.__ModuleLoader__.load({
 .dsh-mobile-control__extension-recovery button:active:not(:disabled){background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-interactive-bg-hover))}
 .dsh-mobile-control__extension-recovery .dsh-mobile-control__extension-recovery-error{color:var(--dsw-alias-label-primary)}
 `;
-		//#endregion
-		//#region src/native-capability.ts
+		// src/native-capability.ts
 		/** Cancel queued calls before native effects start; started effects are not rolled back. */
 		function invokeBoundNativeCapability(bridge, currentBridge, action, input, signal) {
 			const abortReason = () => signal.reason ?? new DOMException("mobile extension disposed", "AbortError");
@@ -8256,8 +8704,7 @@ window.__ModuleLoader__.load({
 				});
 			});
 		}
-		//#endregion
-		//#region src/mobile-custom-assets.ts
+		// src/mobile-custom-assets.ts
 		const COPY = {
 			en: {
 				gateway_required: "Custom mobile CSS, scripts and extensions require a paired DSH Mobile access entry. This page is not using the Mobile gateway.",
@@ -8397,8 +8844,7 @@ window.__ModuleLoader__.load({
 				reader.releaseLock();
 			}
 		}
-		//#endregion
-		//#region src/mobile-customization-notice.ts
+		// src/mobile-customization-notice.ts
 		/** Copy for the notice, per locale, kept beside the existing dictionaries. */
 		const NOTICE_COPY = {
 			en: {
@@ -8516,8 +8962,7 @@ window.__ModuleLoader__.load({
 				style.remove();
 			};
 		}
-		//#endregion
-		//#region src/extension-limits.ts
+		// src/extension-limits.ts
 		/** Maximum sizes accepted for legacy mobile customization resources. */
 		const LEGACY_CUSTOM_ASSET_LIMIT = 262144;
 		/** Maximum sizes enforced when reading local extension files. */
@@ -8530,8 +8975,7 @@ window.__ModuleLoader__.load({
 			assetBytes: 33554432,
 			assetDepth: 8
 		});
-		//#endregion
-		//#region src/client-recovery.ts
+		// src/client-recovery.ts
 		/** Only a visible, disconnected public transport needs an immediate resume nudge. */
 		function shouldNudgeReconnect(visibility, connection) {
 			return visibility === "visible" && connection !== "connected";
@@ -8711,15 +9155,13 @@ window.__ModuleLoader__.load({
 			onRejected?.(rejected, retry);
 			return dispose;
 		}
-		//#endregion
-		//#region src/browser-ui-locale.ts
+		// src/browser-ui-locale.ts
 		const UI_LOCALE_COOKIE = "dsh_ma_ui_locale";
 		/** Host-only, non-secret preference, independent of the short authentication session. */
 		function browserUiLocaleCookie(locale, secure) {
 			return `${UI_LOCALE_COOKIE}=${locale}; Path=/mobile-access; Max-Age=31536000; SameSite=Lax${secure ? "; Secure" : ""}`;
 		}
-		//#endregion
-		//#region src/mobile-ui-locale.ts
+		// src/mobile-ui-locale.ts
 		/** Remember the DSH display language only on authenticated Mobile Gateway documents. */
 		function installMobileUiLocalePersistence(page, view) {
 			if (page.querySelector("meta[name=\"dsh-mobile-gateway\"][content=\"authenticated\"]") === null) return () => {};
@@ -8748,8 +9190,7 @@ window.__ModuleLoader__.load({
 				observer.disconnect();
 			};
 		}
-		//#endregion
-		//#region src/mobile-push/browser-api.ts
+		// src/mobile-push/browser-api.ts
 		function apiError(code) {
 			return Object.assign(/* @__PURE__ */ new Error(code === "stale_generation" ? "Push settings changed elsewhere." : "Push request failed."), { code });
 		}
@@ -8815,16 +9256,14 @@ window.__ModuleLoader__.load({
 				}
 			};
 		}
-		//#endregion
-		//#region src/mobile-push/installation-id.ts
+		// src/mobile-push/installation-id.ts
 		/** Browser-safe installation-id validation shared by the browser controller and the Gateway. */
 		const INSTALLATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 		/** True only for a UUID-shaped installation id with an allowed version and variant nibble. */
 		function isPushInstallationId(value) {
 			return typeof value === "string" && INSTALLATION_ID.test(value);
 		}
-		//#endregion
-		//#region src/mobile-push/client.ts
+		// src/mobile-push/client.ts
 		const ID_KEY = "dsh-mobile-push-installation";
 		const defaults = Object.freeze({
 			question: true,
@@ -9259,8 +9698,7 @@ window.__ModuleLoader__.load({
 				locale: view.document.documentElement.lang.toLowerCase().startsWith("zh") ? "zh-CN" : view.document.documentElement.lang.toLowerCase().startsWith("it") ? "it" : "en"
 			};
 		}
-		//#endregion
-		//#region src/mobile-push/switch-component.ts
+		// src/mobile-push/switch-component.ts
 		/**
 		* Lazily require the public Switch from the DSH module loader at category render time.
 		*
@@ -9280,8 +9718,7 @@ window.__ModuleLoader__.load({
 				return;
 			}
 		}
-		//#endregion
-		//#region src/mobile-push/settings.ts
+		// src/mobile-push/settings.ts
 		const MOBILE_PUSH_SETTINGS_COPY = {
 			en: {
 				title: "Web push notifications",
@@ -9393,11 +9830,15 @@ window.__ModuleLoader__.load({
 			};
 			return (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_row",
-				style: { flexWrap: "wrap" },
+				style: {
+					flexDirection: "column",
+					alignItems: "stretch",
+					gap: 12
+				},
 				lang: locale === "zh" ? "zh-CN" : locale
 			}, (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_rowText",
-				style: { paddingRight: 8 }
+				style: { paddingRight: 0 }
 			}, (0, react.createElement)("div", { className: "dsh-mobile-settings_title" }, copy.title), (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_desc",
 				"aria-live": "polite"
@@ -9441,8 +9882,7 @@ window.__ModuleLoader__.load({
 				disabled: true
 			}, copy.busy)));
 		}
-		//#endregion
-		//#region src/mobile-push/navigation.ts
+		// src/mobile-push/navigation.ts
 		const REF_PARAMETER = "mobile-push";
 		/**
 		* Consume one authenticated tap reference after the public Workspace and Session
@@ -9521,8 +9961,7 @@ window.__ModuleLoader__.load({
 			const snapshot = ctx.sessions.list.getSnapshot();
 			return snapshot.phase === "ready" && snapshot.ids.includes(sessionId) && snapshot.byId[sessionId] !== void 0;
 		}
-		//#endregion
-		//#region src/mobile-directory-browser.ts
+		// src/mobile-directory-browser.ts
 		/** Expected Gateway or response-validation failure for one read-only listing. */
 		var MobileDirectoryReadError = class extends Error {
 			code;
@@ -9916,8 +10355,7 @@ window.__ModuleLoader__.load({
 				for (const listener of this.listeners) listener();
 			}
 		};
-		//#endregion
-		//#region src/mobile-directory-picker.ts
+		// src/mobile-directory-picker.ts
 		/** Dedicated Mobile directory-flow occupant; stock DSH retains its own chooser. */
 		const MESSAGES = {
 			zh: {
@@ -10589,8 +11027,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (failures.length > 0) throw new AggregateError(failures, "Mobile directory picker disposal failed");
 			};
 		}
-		//#endregion
-		//#region src/client.ts
+		// src/client.ts
 		/** Map a host-reported provider onto the UI union, defaulting to the built-in one. */
 		function parseMobileRemoteProvider(value) {
 			return value === "cpolar" || value === "cloudflared" || value === "frp" || value === "origin" || value === "iroh" ? value : "tailscale";
@@ -10670,11 +11107,28 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					if (!escape.defaultPrevented) blocked();
 					return;
 				}
+				if (top.getAttribute("data-shortcut-modal") === "sidebar" && top.closest("[data-sidebar-drawer]") !== null) {
+					if (layers.some((layer) => layer !== top && !top.contains(layer))) {
+						blocked();
+						return;
+					}
+					const focused = page.activeElement;
+					const target = focused !== null && top.contains(focused) ? focused : top;
+					const escape = new KeyboardEvent("keydown", {
+						key: "Escape",
+						code: "Escape",
+						bubbles: true,
+						cancelable: true
+					});
+					target.dispatchEvent(escape);
+					if (!escape.defaultPrevented) blocked();
+					return;
+				}
 				if (top.getAttribute("role") === "dialog") {
 					const wrapper = top.parentElement;
 					const mask = wrapper?.firstElementChild;
 					const maskStyle = mask === void 0 || mask === null ? void 0 : view.getComputedStyle(mask);
-					if (wrapper?.getAttribute("role") === "presentation" && wrapper.children.length === 2 && wrapper.lastElementChild === top && mask?.tagName === "DIV" && mask.getAttribute("aria-hidden") === "true" && mask.isConnected && !mask.hidden && maskStyle?.display !== "none" && maskStyle?.visibility !== "hidden" && mask.getClientRects().length > 0) {
+					if (wrapper?.getAttribute("role") === "presentation" && wrapper.children.length === 2 && wrapper.lastElementChild === top && mask?.tagName === "DIV" && mask.getAttribute("aria-hidden") !== "false" && mask.getAttribute("role") === null && mask.getAttribute("tabindex") === null && mask.getAttribute("contenteditable") === null && mask.children.length === 0 && (mask.textContent ?? "").trim() === "" && mask.isConnected && !mask.hidden && maskStyle?.display !== "none" && maskStyle?.visibility !== "hidden" && mask.getClientRects().length > 0) {
 						mask.click();
 						return;
 					}
@@ -11028,7 +11482,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				mode: "attach",
 				entryTls: form.entryTls,
 				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+				...form.user === void 0 || form.user === "" ? {} : { user: form.user }
 			});
 		}
 		/**
@@ -11282,7 +11737,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const facts = entry.facts !== null && typeof entry.facts === "object" ? entry.facts : {};
 			const copyReason = facts.viaProxy === true && (reason === "remote-ready" || reason === "remote-rate-limited") ? `${reason}-via-proxy` : reason;
 			const catalog = DIAGNOSTIC_REASON_MESSAGES[locale];
-			const templates = Object.prototype.hasOwnProperty.call(catalog, copyReason) ? catalog[copyReason] : void 0;
+			const networkCatalog = DIAGNOSTIC_NETWORK_MESSAGES[locale];
+			const templates = Object.prototype.hasOwnProperty.call(networkCatalog, copyReason) ? networkCatalog[copyReason] : Object.prototype.hasOwnProperty.call(catalog, copyReason) ? catalog[copyReason] : void 0;
 			if (templates === void 0) return serverCopy;
 			const providerNames = {
 				tailscale: "Tailscale Funnel",
@@ -11305,6 +11761,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const interpolate = (template) => template.replace(/\{(\w+)\}/gu, (_match, key) => values[key] ?? "");
 			let detail = reason === "remote-controller-error" && controllerCode === "" ? t("remoteError") : interpolate(templates[0]);
 			let action = interpolate(templates[1]);
+			if (reason.startsWith("dns-")) {
+				const families = {
+					ipv4: "IPv4",
+					ipv6: "IPv6",
+					dual: "IPv4 + IPv6"
+				};
+				const family = typeof facts.dnsFamily === "string" && Object.hasOwn(families, facts.dnsFamily) ? families[facts.dnsFamily] : void 0;
+				if (family !== void 0) detail += ` (${family})`;
+			}
 			if (reason === "versions-current") {
 				const fields = versions !== null && typeof versions === "object" ? versions : {};
 				if ([
@@ -11942,6 +12407,16 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpToken.autocomplete = "off";
 			frpToken.spellcheck = false;
 			frpToken.placeholder = t("frpTokenPlaceholder");
+			const frpUserLabel = element("label", "dsh-mobile-control__field");
+			frpUserLabel.textContent = t("frpUser");
+			const frpUser = element("input");
+			frpUser.type = "text";
+			frpUser.autocomplete = "off";
+			frpUser.spellcheck = false;
+			frpUser.placeholder = t("frpUserPlaceholder");
+			const frpUserHint = element("p", "dsh-mobile-control__frp-hint");
+			frpUserHint.textContent = t("frpUserHint");
+			frpUserLabel.append(frpUser, frpUserHint);
 			const frpOriginLabel = element("label", "dsh-mobile-control__field");
 			frpOriginLabel.textContent = t("frpPublicOrigin");
 			const frpOrigin = element("input");
@@ -12004,6 +12479,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: frpServer,
 				serverPort: frpPort,
 				token: frpToken,
+				user: frpUser,
 				publicOrigin: frpOrigin,
 				mode: frpMode,
 				entryTls: frpEntryTls,
@@ -12014,6 +12490,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: frpServerLabel,
 				serverPort: frpPortLabel,
 				token: frpTokenLabel,
+				user: frpUserLabel,
 				publicOrigin: frpOriginLabel,
 				mode: frpModeLabel,
 				entryTls: frpEntryTlsLabel,
@@ -12024,6 +12501,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: "frpServerAddress",
 				serverPort: "frpServerPort",
 				token: "frpToken",
+				user: "frpUser",
 				publicOrigin: "frpPublicOrigin",
 				mode: "frpMode",
 				entryTls: "frpEntryTls",
@@ -12046,7 +12524,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpOriginHint.textContent = t("frpPublicOriginHint");
 			frpOriginLabel.append(frpOriginHint);
 			frpOrigin.setAttribute("aria-describedby", `${frpOriginHint.id} ${frpOrigin.getAttribute("aria-describedby") ?? ""}`);
-			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpOriginLabel, frpModeLabel, frpEntryTlsLabel, frpVhostLabel, frpPublicPortLabel);
+			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpUserLabel, frpOriginLabel, frpModeLabel, frpEntryTlsLabel, frpVhostLabel, frpPublicPortLabel);
 			frpStep1.append(frpStep1Title, frpStep1Text, frpFields);
 			const frpStep2 = element("section", "dsh-mobile-control__frp-step");
 			const frpStep2Title = element("strong");
@@ -12406,6 +12884,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const irohQr = element("div", "dsh-mobile-control__qr is-expandable");
 			irohQr.hidden = true;
 			const irohPairStatus = element("p", "dsh-mobile-control__component-status");
+			irohPairStatus.setAttribute("aria-live", "polite");
 			const irohCopyDescriptor = element("button", "dsh-mobile-control__secondary");
 			irohCopyDescriptor.type = "button";
 			irohCopyDescriptor.textContent = t("copyPairLink");
@@ -12735,6 +13214,16 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				disclosure.hidden = true;
 				setupDetailsRow.append(disclosure);
 			}
+			const macosFolderHelp = element("details", "dsh-mobile-control__details");
+			macosFolderHelp.hidden = true;
+			const macosFolderHelpSummary = element("summary");
+			macosFolderHelpSummary.textContent = t("macosFolderHelpTitle");
+			const macosFolderHelpBody = element("div", "dsh-mobile-control__details-body");
+			const macosFolderHelpNote = element("p");
+			macosFolderHelpNote.textContent = t("macosFolderHelpNote");
+			macosFolderHelpBody.append(macosFolderHelpNote);
+			macosFolderHelp.append(macosFolderHelpSummary, macosFolderHelpBody);
+			setupDetailsRow.append(macosFolderHelp);
 			remoteWorkspace.append(remoteStatus, remoteAccess, remoteGuide, providerSetupBody, remoteQr, pairingValidity, providerInstallRow, remoteActions, remotePairLink, setupDetailsRow);
 			const diagnosticsView = element("div", "dsh-mobile-control__view is-diagnostics");
 			diagnosticsView.hidden = true;
@@ -12884,6 +13373,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let configuredFrpOrigin = "";
 			let configuredFrpVhostPort = 7080;
 			let configuredFrpPublicPort = 33080;
+			let configuredFrpUser = "";
+			let frpUserDraft = false;
 			/** Proxy name the host writes into its frpc.toml; the local clipboard copy must match. */
 			let configuredFrpProxyName;
 			let frpConfiguredMode = "deploy";
@@ -13261,6 +13752,17 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				irohQr.hidden = false;
 				irohQr.append(placeholder);
 			};
+			const clearIrohPairing = () => {
+				activeIrohDescriptor = "";
+				activeIrohPairExpiresAt = 0;
+				activeIrohQrSvg = "";
+				clearQrTarget(irohQr);
+				irohQr.hidden = true;
+				const wasZoomed = !irohQrZoom.hidden;
+				setIrohQrZoomOpen(false);
+				irohQrZoomImage.removeAttribute("src");
+				if (wasZoomed && !irohPair.disabled && !irohPair.hidden) irohPair.focus();
+			};
 			const showRemoteQrPlaceholder = (text) => {
 				clearQrTarget(remoteQr);
 				const placeholder = element("span", "dsh-mobile-control__qr-placeholder");
@@ -13532,6 +14034,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (frpConfigured && !frpEntryTlsDraft) frpEntryTls.value = configuredFrpEntryTls;
 				if (typeof frpConfiguration.vhostHttpPort === "number") configuredFrpVhostPort = frpConfiguration.vhostHttpPort;
 				if (typeof frpConfiguration.publicPort === "number") configuredFrpPublicPort = frpConfiguration.publicPort;
+				configuredFrpUser = typeof frpConfiguration.user === "string" ? frpConfiguration.user : "";
+				if (!frpUserDraft) frpUser.value = configuredFrpUser;
+				else if (frpUser.value.trim() === configuredFrpUser) frpUserDraft = false;
 				configuredFrpProxyName = typeof frpConfiguration.proxyName === "string" && frpConfiguration.proxyName !== "" ? frpConfiguration.proxyName : void 0;
 				if (!frpVhostDraft) {
 					if (frpMode.value === "attach" && configuredFrpMode === "attach" && configuredFrpEntryTls === "public-ip-cert") {
@@ -13543,6 +14048,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const attachSelected = frpMode.value === "attach";
 				const selfSignedSelected = attachSelected && frpEntryTls.value === "self-signed";
 				frpStep2Title.textContent = t(attachSelected ? "frpStep2TitleAttach" : "frpStep2Title");
+				frpVpsSummary.textContent = t(attachSelected ? "frpStep2TitleAttach" : "frpStep2Title");
 				frpStep2Text.textContent = attachSelected && configuredFrpProxyName === void 0 ? t("loadingRemoteStatus") : t(attachSelected ? "frpStep2TextAttach" : "frpStep2Text");
 				frpStep4Text.textContent = t(attachSelected ? "frpStep4TextAttach" : "frpStep4Text");
 				frpAppRequirement.textContent = t(selfSignedSelected ? "frpAppRequirementSelfSigned" : "frpAppRequirement");
@@ -13695,6 +14201,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				}[errorCode] ?? "";
 				const needsFunnelSetup = state === "error" && remoteSetupUrl !== "";
 				remoteReady = remoteRunning && state === "ready" && remoteOrigin !== "";
+				macosFolderHelp.hidden = data.macosHost !== true || !remoteReady;
 				frpChoiceBadge.textContent = frpConfigured && frpInstalled ? t("ready") : t("advanced");
 				originChoiceBadge.textContent = managedOrigin ? t(remoteReady ? "ready" : "advanced") : originListening ? t("originBackendReady") : t("advanced");
 				if (remoteStatus.style) remoteStatus.style.display = state === "off" && remoteFailureText === "" ? "none" : "";
@@ -13709,7 +14216,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : iroh ? t("irohStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
 					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : iroh ? t("irohConnecting") : t("remoteConnectingTailscale"),
-					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : t("remoteReady"),
+					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : tailscale ? t("funnelListenerReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
 				const errorLabels = translatedRemoteErrors();
@@ -13747,15 +14254,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				irohPair.disabled = !remoteReady || !iroh || remoteProviderBusy;
 				irohPair.hidden = !iroh;
 				irohCopyDescriptor.hidden = !iroh;
-				if (iroh && irohInstalled && activeIrohQrSvg === "") showIrohQrPlaceholder();
-				else if (!iroh || !irohInstalled) irohQr.hidden = true;
-				if ((!iroh || !remoteReady) && activeIrohDescriptor !== "") {
-					activeIrohDescriptor = "";
-					activeIrohPairExpiresAt = 0;
-					activeIrohQrSvg = "";
-					showQr("", irohQr);
-					setIrohQrZoomOpen(false);
-					irohPairStatus.textContent = "";
+				const irohPairingExpired = activeIrohPairExpiresAt > 0 && activeIrohPairExpiresAt <= Date.now();
+				if (activeIrohDescriptor !== "" && (!iroh || !irohInstalled || !remoteReady || irohPairingExpired)) {
+					clearIrohPairing();
+					irohPairStatus.textContent = iroh && irohInstalled && remoteReady && irohPairingExpired ? t("pairingExpired") : "";
+				}
+				if (!iroh || !irohInstalled) irohQr.hidden = true;
+				else if (activeIrohQrSvg === "") {
+					if (activeIrohDescriptor === "") showIrohQrPlaceholder();
+					else irohQr.hidden = true;
 				}
 				irohCopyDescriptor.disabled = !iroh || !remoteReady || remoteProviderBusy || activeIrohDescriptor === "" || activeIrohPairExpiresAt <= Date.now();
 				if (origin) {
@@ -13944,8 +14451,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			});
 			const openIrohPairing = async () => {
 				const generation = remotePairingGeneration;
-				activeIrohDescriptor = "";
-				activeIrohPairExpiresAt = 0;
+				clearIrohPairing();
 				irohCopyDescriptor.disabled = true;
 				const data = await controlRequestJson("/api/mobile-access/remote/iroh/pairing/begin", {
 					method: "POST",
@@ -13956,12 +14462,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const qrSvg = typeof record.qrSvg === "string" ? record.qrSvg : "";
 				const code = typeof record.irohCode === "string" ? record.irohCode : "";
 				const expiresAt = typeof record.expiresAt === "number" && Number.isFinite(record.expiresAt) ? record.expiresAt : 0;
-				showQr(qrSvg, irohQr);
-				if (qrSvg === "" || code === "" || expiresAt <= Date.now()) {
-					activeIrohQrSvg = "";
+				if (!/^\d{6}$/u.test(code) || expiresAt <= Date.now()) {
 					irohPairStatus.textContent = t("keyGenerationFailed");
 					return;
 				}
+				if (qrSvg === "") irohQr.hidden = true;
+				else showQr(qrSvg, irohQr);
 				activeIrohQrSvg = qrSvg;
 				const fields = [
 					"version",
@@ -13979,7 +14485,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				for (const field of fields) descriptor[field] = record[field];
 				activeIrohDescriptor = JSON.stringify(descriptor);
 				activeIrohPairExpiresAt = expiresAt;
-				irohPairStatus.textContent = t("irohPairingReady", { code });
+				irohPairStatus.textContent = qrSvg === "" ? t("irohPairingCopyOnly") : t("irohPairingReady", { code });
 			};
 			irohPair.addEventListener("click", () => {
 				if (remoteProviderBusy || !remoteReady || remoteProvider !== "iroh") return;
@@ -14297,6 +14803,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					serverAddress: String(frpServer.value ?? "").trim(),
 					serverPort: Number(frpPort.value),
 					token: String(frpToken.value ?? ""),
+					user: String(frpUser.value ?? "").trim(),
 					publicOrigin: String(frpOrigin.value ?? "").trim(),
 					mode,
 					entryTls: frpEntryTls.value === "self-signed" ? "self-signed" : "public-ip-cert",
@@ -14315,7 +14822,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				publicOrigin: form.publicOrigin,
 				entryTls: form.entryTls,
 				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+				...form.user === "" ? {} : { user: form.user }
 			});
 			const validFrpForm = (form) => {
 				return validateFrpForm(form).length === 0;
@@ -14346,6 +14854,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				return issues.length === 0;
 			};
 			for (const [name, input] of Object.entries(frpInputs)) input.addEventListener(name === "mode" || name === "entryTls" ? "change" : "input", () => {
+				if (name === "user") frpUserDraft = true;
 				if (frpValidationShown) renderFrpIssues(validateFrpForm(frpForm(), frpValidationAllowsSavedToken));
 			});
 			frpCopyTemplate.addEventListener("click", () => {
@@ -14528,7 +15037,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					mode: form.mode,
 					entryTls: form.entryTls,
 					...form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-					...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+					...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+					user: form.user
 				};
 			};
 			const validVpsFrpForm = () => {
@@ -14768,9 +15278,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpConfigure.addEventListener("click", () => {
 				if (remoteProviderBusy || !frpInstalled) return;
 				const form = frpForm();
-				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin && form.mode === (frpConfiguredMode === "attach" ? "attach" : "deploy") && form.entryTls === (frpConfiguredEntryTls === "self-signed" ? "self-signed" : "public-ip-cert") && (form.vhostHttpPort ?? configuredFrpVhostPort) === configuredFrpVhostPort && (form.publicPort ?? configuredFrpPublicPort) === configuredFrpPublicPort;
+				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin && form.mode === (frpConfiguredMode === "attach" ? "attach" : "deploy") && form.entryTls === (frpConfiguredEntryTls === "self-signed" ? "self-signed" : "public-ip-cert") && (form.vhostHttpPort ?? configuredFrpVhostPort) === configuredFrpVhostPort && (form.publicPort ?? configuredFrpPublicPort) === configuredFrpPublicPort && form.user === configuredFrpUser;
 				if (!unchanged) {
-					if (!checkFrpForm(form)) return;
+					const sameServer = frpConfigured && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort;
+					if (!checkFrpForm(form, sameServer)) return;
 				}
 				renderFrpIssues([]);
 				remoteProviderBusy = true;
@@ -15250,11 +15761,13 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				});
 			});
 			const renderDiagnostics = (data) => {
+				const scopeCopy = DIAGNOSTIC_SCOPE_MESSAGES[locale];
+				const scopeOf = (entry) => entry.scope === "configuration" || entry.id === "versions" ? scopeCopy.configuration : entry.scope === "phone" || entry.id === "phone-network" ? scopeCopy.phone : scopeCopy.computer;
 				const entries = [...diagnosticEntriesForRender(data)];
 				const overall = diagnosticOverallForChecks(data.overall, entries.map((entry) => entry.status));
 				diagnosticsSummary.className = `dsh-mobile-control__diagnostic-summary is-${overall}`;
-				diagnosticsSummaryTitle.textContent = overall === "ok" ? t("diagnosticsComplete") : overall === "attention" ? t("diagnosticsAttention") : t("diagnosticsProblem");
-				diagnosticsSummaryText.textContent = locale === "zh" && data.overall === overall && typeof data.summary === "string" ? data.summary : t("diagnosticsCompleteFallback");
+				diagnosticsSummaryTitle.textContent = `${scopeCopy.computer} · ${overall === "ok" ? t("diagnosticsComplete") : overall === "attention" ? t("diagnosticsAttention") : t("diagnosticsProblem")}`;
+				diagnosticsSummaryText.textContent = scopeCopy.coverage;
 				diagnosticsChecks.replaceChildren();
 				const statusLabels = {
 					ok: t("diagnosticStatusOk"),
@@ -15299,8 +15812,14 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 						const localizedCopy = localizedEntryCopy(entry);
 						const detail = element("p");
 						detail.textContent = localizedCopy.detail;
+						if (entry.id === "versions") rowTitle.textContent = scopeCopy.versions;
+						else if (entry.id === "remote-service") rowTitle.textContent = scopeCopy.provider;
+						else if (entry.id === "remote-dns") rowTitle.textContent = scopeCopy.dns;
+						else if (entry.id === "plugin-inspection" || entry.id === "remote-plugin-conflict") rowTitle.textContent = scopeCopy.scripts;
+						const scope = element("small", "dsh-mobile-control__diagnostic-scope");
+						scope.textContent = scopeOf(entry);
 						rowHeader.append(rowTitle, badge);
-						rowBody.append(rowHeader, detail);
+						rowBody.append(rowHeader, scope, detail);
 						if (localizedCopy.action !== "") {
 							const action = element("p", "dsh-mobile-control__diagnostic-action");
 							const actionLabel = element("span");
@@ -15330,11 +15849,13 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					const labelKey = typeof entry.id === "string" ? diagnosticLabelKeys[entry.id] : void 0;
 					const label = labelKey === void 0 && typeof entry.label === "string" ? entry.label : labelKey === void 0 ? t("diagnosticCheck") : t(labelKey);
 					const localizedCopy = localizedEntryCopy(entry);
-					return `[${statusLabels[state]}] ${label}: ${localizedCopy.detail}${localizedCopy.action === "" ? "" : ` ${localizedCopy.action}`}`;
+					const scopedLabel = entry.id === "versions" ? scopeCopy.versions : entry.id === "remote-service" ? scopeCopy.provider : entry.id === "remote-dns" ? scopeCopy.dns : entry.id === "plugin-inspection" || entry.id === "remote-plugin-conflict" ? scopeCopy.scripts : label;
+					return `[${statusLabels[state]}][${scopeOf(entry)}] ${scopedLabel}: ${localizedCopy.detail}${localizedCopy.action === "" ? "" : ` ${localizedCopy.action}`}`;
 				});
 				copiedDiagnosticReport = [
 					reportCopy.reportTitle,
 					`${reportCopy.generated}: ${generatedAt}`,
+					scopeCopy.coverage,
 					...lines
 				].join("\n");
 				diagnosticsReport.textContent = copiedDiagnosticReport;
@@ -16444,6 +16965,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				manifestEtag = "";
 			};
 			const refreshExtensions = async (signal) => {
+				let failureStage = "manifest_unavailable";
 				try {
 					const headers = {};
 					if (manifestEtag !== "") headers["if-none-match"] = manifestEtag;
@@ -16486,6 +17008,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 						failed("manifest_invalid", signal);
 						return false;
 					}
+					failureStage = "resource_unavailable";
 					events?.setEnabled(true);
 					const entries = payload.extensions;
 					const seen = new Set(entries.map((entry) => entry.id));
@@ -16645,7 +17168,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					} else manifestEtag = "";
 					return refreshComplete;
 				} catch {
-					failed("refresh_failed", signal);
+					failed(failureStage, signal);
 					return false;
 				}
 			};
@@ -16777,7 +17300,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
    style rule of its own. */
 .dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__progress{box-sizing:border-box;width:100%;height:6px;margin:0 0 10px}.dsh-mobile-control__progress[hidden]{display:none}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
-.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields[hidden]{display:none}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(7){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
 .dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}.dsh-mobile-control__qr.is-expandable{cursor:zoom-in}.dsh-mobile-control__qr.is-expandable:focus-visible{outline:3px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px;border-radius:12px}.dsh-mobile-control__qr-zoom{position:fixed;inset:0;z-index:1001;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.72)}.dsh-mobile-control__qr-zoom[hidden]{display:none}.dsh-mobile-control__qr-zoom-image{width:min(84vw,360px);height:min(84vw,360px);border-radius:12px;background:#fff;padding:12px}.dsh-mobile-control__qr-zoom-close{position:absolute;top:12px;right:16px;min-width:44px;min-height:44px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:600 18px/1 system-ui;cursor:pointer}
@@ -17142,9 +17665,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 		}
 		/** Client services required by the mobile adaptation. */
 		const inject = ["slots"];
-		//#endregion
 		exports.CONTROL_STYLES = CONTROL_STYLES;
+		exports.DIAGNOSTIC_NETWORK_MESSAGES = DIAGNOSTIC_NETWORK_MESSAGES;
 		exports.DIAGNOSTIC_REASON_MESSAGES = DIAGNOSTIC_REASON_MESSAGES;
+		exports.DIAGNOSTIC_SCOPE_MESSAGES = DIAGNOSTIC_SCOPE_MESSAGES;
 		exports.LOCALIZED_DIAGNOSTIC_COPY = LOCALIZED_DIAGNOSTIC_COPY;
 		exports.MOBILE_CONTROL_MESSAGES = MOBILE_CONTROL_MESSAGES;
 		exports.PerIdActivationLifecycle = PerIdActivationLifecycle;