dsh-mobile 0.8.1 → 0.8.3

package/lib/index.mjs

@@ -28,7 +28,7 @@ import { lookup } from "node:dns/promises";
 import { constants } from "node:fs";
 import { z as z$1 } from "zod";
 import webPush from "web-push";
-//#region src/access.ts
+// src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
 	status;
@@ -466,8 +466,7 @@ var AccessController = class {
 		});
 	}
 };
-//#endregion
-//#region src/ip.ts
+// src/ip.ts
 /**
 * Browser-safe IP literal classification.
 *
@@ -548,8 +547,7 @@ function isIP$1(value) {
 	if (leftGroups < 0 || rightGroups < 0) return 0;
 	return leftGroups + rightGroups >= 8 ? 0 : 6;
 }
-//#endregion
-//#region src/network.ts
+// src/network.ts
 function parseIpv4$1(address) {
 	const parts = address.split(".");
 	if (parts.length !== 4) throw new Error(`invalid IPv4 address ${JSON.stringify(address)}`);
@@ -826,8 +824,7 @@ async function probeTcpReachable(host, port, timeoutMs = 1500) {
 		});
 	});
 }
-//#endregion
-//#region src/websocket-paths.ts
+// src/websocket-paths.ts
 /** Cap the admin-approved extra WebSocket upgrade paths (exact pathnames). */
 const MAX_EXTRA_WEBSOCKET_PATHS = 16;
 const MAX_WEBSOCKET_PATH_LENGTH = 256;
@@ -932,8 +929,7 @@ var WebSocketPathStore = class {
 		return this.list();
 	}
 };
-//#endregion
-//#region src/extension-worker-config.ts
+// src/extension-worker-config.ts
 function integer$1(value, name, fallback, minimum, maximum) {
 	const resolved = value ?? fallback;
 	if (typeof resolved !== "number" || !Number.isSafeInteger(resolved) || resolved < minimum || resolved > maximum) throw new Error(`hostExecution.${name} must be an integer from ${minimum} through ${maximum}`);
@@ -971,8 +967,7 @@ function resolveHostExecution(raw) {
 		logMessageBytes: integer$1(value.logMessageBytes, "logMessageBytes", 4096, 128, 65536)
 	});
 }
-//#endregion
-//#region src/config.ts
+// src/config.ts
 /** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
 const Config = z.object({
 	hostExecution: z.object({
@@ -1206,8 +1201,7 @@ function parseGatewayConfig(raw) {
 		maxRateLimitKeys: integer(value.maxRateLimitKeys, "maxRateLimitKeys", 256, 1, 4096)
 	});
 }
-//#endregion
-//#region src/exec-file.ts
+// src/exec-file.ts
 /** Capture both output streams even when a desktop host wraps execFile without Node's promisify metadata. */
 function execFileText(file, args, options = {}) {
 	return new Promise((resolve, reject) => {
@@ -1231,8 +1225,7 @@ function execFileText(file, args, options = {}) {
 		});
 	});
 }
-//#endregion
-//#region src/private-file.ts
+// src/private-file.ts
 let userSidTask;
 function commandFailureDetails(error) {
 	if (error === null || typeof error !== "object") return {};
@@ -1371,8 +1364,7 @@ async function restrictPrivateDirectory(directory) {
 		else if (info.isFile()) await restrictPrivateFile(child);
 	}
 }
-//#endregion
-//#region src/client-module-preferences.ts
+// src/client-module-preferences.ts
 const MAX_RECORD_BYTES = 1048576;
 /** Validate untrusted JSON selections; graph membership is checked by the Gateway. */
 function parseExcludedClientModules(value) {
@@ -1545,8 +1537,7 @@ var ClientModulePreferenceStore = class {
 		}
 	}
 };
-//#endregion
-//#region src/control.ts
+// src/control.ts
 /** A configuration change failed; recovered distinguishes a restored runtime from an unknown configuration. */
 var MobileAccessReconfigurationError = class extends Error {
 	recovered;
@@ -1868,8 +1859,7 @@ function isLocalAdminHostname(hostname) {
 	if (octets === void 0) return false;
 	return isLoopbackIpv4(octets) || isPrivateIpv4(octets) || isLinkLocalIpv4(octets);
 }
-//#endregion
-//#region src/http-security.ts
+// src/http-security.ts
 const DEVICE_COOKIE = "dsh_ma_device";
 const SESSION_COOKIE = "dsh_ma_session";
 const CSRF_COOKIE = "dsh_ma_csrf";
@@ -2053,8 +2043,7 @@ function assertLocalAdminTrust(request, requireBrowserOrigin, authenticateDeskto
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 	if (!loopback && !authenticateDesktop()) throw new HttpError(401, "admin_authentication_required");
 }
-//#endregion
-//#region src/browser-auth-cookies.ts
+// src/browser-auth-cookies.ts
 const HOST_SESSION_COOKIE = "__Host-dsh_ma_session";
 const HOST_CSRF_COOKIE = "__Host-dsh_ma_csrf";
 /** Non-secret browser identity; the persistent device credential keeps its narrow renewal path. */
@@ -2106,8 +2095,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 	if (selected === void 0) throw new HttpError(401, "authentication_failed");
 	return selected;
 }
-//#endregion
-//#region src/auth-failure-log.ts
+// src/auth-failure-log.ts
 const LOG_INTERVAL_MS$3 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
@@ -2222,12 +2210,17 @@ var AuthFailureRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/http-failure-log.ts
+// src/http-failure-log.ts
 function safeParserCode(code) {
 	switch (code) {
 		case "ERR_HTTP_REQUEST_TIMEOUT":
 		case "HPE_HEADER_OVERFLOW":
+		case "HPE_INVALID_METHOD":
+		case "HPE_INVALID_CONSTANT":
+		case "HPE_INVALID_URL":
+		case "HPE_INVALID_VERSION":
+		case "HPE_LF_EXPECTED":
+		case "HPE_PAUSED_H2_UPGRADE":
 		case "HPE_INVALID_CHUNK_SIZE":
 		case "HPE_INVALID_CONTENT_LENGTH":
 		case "HPE_INVALID_EOF_STATE":
@@ -2262,7 +2255,7 @@ function classifyHttpParserFailure(nodeCode) {
 }
 const LOG_INTERVAL_MS$2 = 3e4;
 /**
-* Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
+* Per-Gateway diagnostics with four fixed sampling slots and no timers or request-selected keys.
 * Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
 * A sink failure cannot change a response, retry a write or expose the diagnostic sink's error.
 */
@@ -2275,6 +2268,10 @@ var HttpFailureRecorder = class {
 			nextLogAt: 0,
 			suppressed: 0
 		},
+		transport: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
 		target: {
 			nextLogAt: 0,
 			suppressed: 0
@@ -2302,6 +2299,26 @@ var HttpFailureRecorder = class {
 		});
 		return failure;
 	}
+	/** Classify a client socket error without assigning an HTTP status to a transport failure. */
+	recordClientError(nodeCode) {
+		switch (nodeCode) {
+			case "ECONNRESET":
+			case "EPIPE":
+			case "ETIMEDOUT":
+			case "ERR_STREAM_PREMATURE_CLOSE": {
+				const failure = {
+					kind: "transport",
+					code: nodeCode
+				};
+				this.record(failure);
+				return failure;
+			}
+			default: return {
+				kind: "parser",
+				...this.recordParser(nodeCode)
+			};
+		}
+	}
 	/** Sample an invalid request target without retaining its raw or decoded URL. */
 	recordTarget() {
 		this.record({
@@ -2345,8 +2362,7 @@ var HttpFailureRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/api-latency-log.ts
+// src/api-latency-log.ts
 /**
 * Bounded API latency samples for diagnosing slow mobile requests.
 *
@@ -2453,8 +2469,7 @@ var ApiLatencyRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/upstream-auth-log.ts
+// src/upstream-auth-log.ts
 const LOG_INTERVAL_MS = 3e4;
 /** Two fixed sampling slots keep a first failure visible even after a successful exchange. */
 var UpstreamAuthRecorder = class {
@@ -2519,8 +2534,7 @@ var UpstreamAuthRecorder = class {
 		}
 	}
 };
-//#endregion
-//#region src/client-module-recovery.ts
+// src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
 		title: "移动页面模块需要调整",
@@ -2601,8 +2615,7 @@ function renderClientModuleRecoveryScript(locale) {
   })
 })()`;
 }
-//#endregion
-//#region src/mobile-compat-bootstrap.ts
+// src/mobile-compat-bootstrap.ts
 const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
 /**
 * Name the compatibility bundle by content.
@@ -2678,8 +2691,7 @@ const EXTENSION_LIMITS = Object.freeze({
 	assetBytes: 33554432,
 	assetDepth: 8
 });
-//#endregion
-//#region src/http-cache.ts
+// src/http-cache.ts
 /** Entity-tag handling for authenticated GET and HEAD cache validation. */
 const ENTITY_TAG = /^[\t ]*(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*")[\t ]*$/u;
 const ENTITY_TAG_LIST_ITEM = /(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*"/gu;
@@ -2716,8 +2728,7 @@ function weakenEntityTag(etag) {
 	const opaque = etag === void 0 ? void 0 : ENTITY_TAG.exec(etag)?.[1];
 	return opaque === void 0 ? void 0 : `W/${opaque}`;
 }
-//#endregion
-//#region src/mobile-graph-events.ts
+// src/mobile-graph-events.ts
 /** Bounded SSE framing for the dedicated Mobile client graph stream. */
 /** Maximum retained UTF-8 frame/output bytes, with CRLF normalized to LF. */
 const MOBILE_GRAPH_EVENT_MAX_BYTES = 4194304;
@@ -2906,8 +2917,7 @@ var MobileGraphEventTransform = class extends Transform {
 function createMobileGraphEventTransform(project) {
 	return new MobileGraphEventTransform(project);
 }
-//#endregion
-//#region src/websocket-compression.ts
+// src/websocket-compression.ts
 function payloadBytes(data) {
 	if (Array.isArray(data)) return data.reduce((bytes, part) => bytes + part.byteLength, 0);
 	return data.byteLength;
@@ -3127,15 +3137,13 @@ function bridgeCompressedWebSocket(request, client, upstream, head, target, upst
 		}
 	});
 }
-//#endregion
-//#region src/version.ts
+// src/version.ts
 const manifest = createRequire(import.meta.url)("../package.json");
 /** Version of the installed DSH Mobile plugin package. */
 const DSH_MOBILE_VERSION = typeof manifest.version === "string" ? manifest.version : "unknown";
 /** Oldest Android App release supported by this plugin generation. */
 const MINIMUM_ANDROID_APP_VERSION = "0.2.2";
-//#endregion
-//#region src/computer-images.ts
+// src/computer-images.ts
 const MAX_ENTRIES = 500;
 const MAX_IMAGE_BYTES = 20971520;
 const IMAGE_TYPES = Object.freeze({
@@ -3336,8 +3344,7 @@ async function readComputerImage(path, signal) {
 		throw new HttpError(404, "file_unavailable");
 	}
 }
-//#endregion
-//#region src/extension-worker.ts
+// src/extension-worker.ts
 /** Supervise opt-in local hosts without executing extension code on the DSH thread. */
 /** JSON bytes serialized and size-checked inside the worker. */
 var PreparedJsonResult = class {
@@ -3990,8 +3997,7 @@ var WorkerStreamBridge = class extends Readable {
 		return super.emit(event, ...args);
 	}
 };
-//#endregion
-//#region src/extensions.ts
+// src/extensions.ts
 /** A misbehaving host activation must not wedge the local watcher forever. */
 const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
 /** The previous Host outlives the hidden-page refresh interval and one timed refresh. */
@@ -5064,8 +5070,7 @@ function workerLoggerAdapter(context) {
 function createMobileAccessService(ctx) {
 	return new MobileAccessService(ctx);
 }
-//#endregion
-//#region src/auth-pages.ts
+// src/auth-pages.ts
 const COPY = {
 	en: {
 		lang: "en",
@@ -5293,8 +5298,7 @@ function renderLoginScript(locale) {
 })()
 `;
 }
-//#endregion
-//#region src/browser-ui-locale.ts
+// src/browser-ui-locale.ts
 const UI_LOCALE_COOKIE = "dsh_ma_ui_locale";
 /** Read presentation data only; malformed or ambiguous cookies keep browser negotiation. */
 function readBrowserUiLocale(cookieHeader) {
@@ -5313,8 +5317,7 @@ function readBrowserUiLocale(cookieHeader) {
 function resolveBrowserUiLocale(cookieHeader, acceptLanguage) {
 	return readBrowserUiLocale(cookieHeader) ?? resolveAuthPageLocale(acceptLanguage);
 }
-//#endregion
-//#region src/mobile-push/assets.ts
+// src/mobile-push/assets.ts
 const ICON_FILES = Object.freeze({
 	"/mobile-access/push/icon-180.png": "icon-180.png",
 	"/mobile-access/push/icon-192.png": "icon-192.png",
@@ -5366,16 +5369,14 @@ const loadFromPackage = createMobilePushAssetLoader(packageRoot);
 function mobilePushAsset(path, root = packageRoot) {
 	return root === packageRoot ? loadFromPackage(path) : createMobilePushAssetLoader(root)(path);
 }
-//#endregion
-//#region src/mobile-push/installation-id.ts
+// src/mobile-push/installation-id.ts
 /** Browser-safe installation-id validation shared by the browser controller and the Gateway. */
 const INSTALLATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
 /** True only for a UUID-shaped installation id with an allowed version and variant nibble. */
 function isPushInstallationId(value) {
 	return typeof value === "string" && INSTALLATION_ID.test(value);
 }
-//#endregion
-//#region src/gateway.ts
+// src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
 const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
@@ -5548,6 +5549,7 @@ const RUNTIME_MODULE = "@deepseek-ai/dsh-client-runtime";
 const RENDERER_MODULE = "@deepseek-ai/dsh-client-ui-renderer";
 const SIDEBAR_MODULE = "@deepseek-ai/dsh-client-ui-sidebar";
 const SETTINGS_MODULE = "@deepseek-ai/dsh-client-ui-settings";
+const SETTINGS_GENERAL_MODULE = "@deepseek-ai/dsh-client-ui-settings-general";
 const API_GATEWAY_MODULE = "@deepseek-ai/dsh-api-gateway";
 const API_REMOTES_MODULE = "@deepseek-ai/dsh-api-remotes";
 const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
@@ -5558,6 +5560,7 @@ const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
 	RENDERER_MODULE,
 	SIDEBAR_MODULE,
 	SETTINGS_MODULE,
+	SETTINGS_GENERAL_MODULE,
 	API_GATEWAY_MODULE,
 	API_REMOTES_MODULE
 ]);
@@ -5678,8 +5681,8 @@ var ExcludedClientModulesError = class extends Error {
 /** A graph-selection conflict with a bounded diagnostic safe for authenticated callers. */
 var ClientModuleConflictError = class extends HttpError {
 	detail;
-	constructor(detail) {
-		super(409, "excluded_client_modules_invalid");
+	constructor(detail, code = "excluded_client_modules_invalid") {
+		super(409, code);
 		this.detail = detail.replace(/[\u0000-\u001f\u007f]/gu, " ").replace(/(?:https?:\/\/|[a-z]:[\\/])\S+/giu, "[redacted]").slice(0, 512);
 	}
 };
@@ -5714,6 +5717,25 @@ function describeMobileClientModules(html) {
 		dependencies: Object.freeze(clientModuleDependencies(entry).filter((id) => ids.has(id)))
 	})));
 }
+/**
+* Canonical fingerprint of an installed catalog.
+*
+* A settings page computes "required only" client-side. If a plugin was added,
+* removed or became required while that page stayed open, the computed set is
+* based on a catalog that no longer exists. The fingerprint travels with the
+* read and back with the write, so a stale page is told to reread instead of
+* saving a selection made against an older graph.
+* @param entries - Catalog entries in any order.
+* @returns Stable 16-character hexadecimal revision.
+*/
+function clientModuleCatalogRevision(entries) {
+	const canonical = entries.map((entry) => [
+		entry.id,
+		entry.required,
+		[...new Set(entry.dependencies)].sort()
+	]).sort((left, right) => left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0);
+	return createHash("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 16);
+}
 /** Validate graph edges before removing application rows from both manifest views. */
 function excludeMobileBootEntries(entries, batches, excludedIds) {
 	if (excludedIds.length === 0) return;
@@ -6609,7 +6631,11 @@ var MobileAccessGateway = class {
 			});
 			server.on("clientError", (error, socket) => {
 				const nodeCode = "code" in error && typeof error.code === "string" ? error.code : void 0;
-				const failure = this.httpFailures.recordParser(nodeCode);
+				const failure = this.httpFailures.recordClientError(nodeCode);
+				if (failure.kind === "transport" || !socket.writable) {
+					socket.destroy();
+					return;
+				}
 				rejectUpgrade(socket, failure.status, failure.code);
 			});
 			await new Promise((resolve, reject) => {
@@ -7339,18 +7365,19 @@ var MobileAccessGateway = class {
 			try {
 				let kind = "describe";
 				let excluded;
+				let revision;
 				if (request.method === "POST") {
 					const body = await readJsonObject(request, this.config.maxBodyBytes);
 					const keys = Object.keys(body);
-					if (keys.length !== 1) throw new HttpError(400, "bad_request");
-					if (keys[0] === "reset" && body.reset === true) kind = "reset";
-					else if (keys[0] === "measure" && body.measure === true) kind = "measure";
-					else if (keys[0] === "excludedClientModules") {
+					if (keys.length === 1 && keys[0] === "reset" && body.reset === true) kind = "reset";
+					else if (keys.length === 1 && keys[0] === "measure" && body.measure === true) kind = "measure";
+					else if (keys.every((key) => key === "excludedClientModules" || key === "revision") && Object.prototype.hasOwnProperty.call(body, "excludedClientModules") && (body.revision === void 0 || typeof body.revision === "string")) {
 						kind = "configure";
 						excluded = body.excludedClientModules;
+						revision = body.revision;
 					} else throw new HttpError(400, "bad_request");
 				}
-				const view = await this.clientModulePreferenceOperation(kind, excluded, authorization.deviceId, operation.signal);
+				const view = await this.clientModulePreferenceOperation(kind, excluded, authorization.deviceId, operation.signal, revision);
 				operation.signal.throwIfAborted();
 				sendJson(response, 200, view, this.tlsEnabled);
 			} catch (error) {
@@ -7835,10 +7862,11 @@ var MobileAccessGateway = class {
 	* @param excluded - Untrusted module IDs to validate against the current boot graph.
 	* @param deviceId - Authenticated device identity; omitted for computer defaults.
 	* @param callerSignal - Cancels fetching and validation, not an atomic write already started.
+	* @param revision - Catalog fingerprint the selection was computed against; a mismatch is rejected.
 	* @returns The catalog and saved selection without reloading clients.
 	*/
-	configureClientModules(excluded, deviceId, callerSignal) {
-		return this.clientModulePreferenceOperation("configure", excluded, deviceId, callerSignal);
+	configureClientModules(excluded, deviceId, callerSignal, revision) {
+		return this.clientModulePreferenceOperation("configure", excluded, deviceId, callerSignal, revision);
 	}
 	/** Reset one override without reloading connected clients.
 	* @param deviceId - Authenticated device identity; omitted to reset computer defaults.
@@ -8024,7 +8052,7 @@ var MobileAccessGateway = class {
 			await upstreamClosed;
 		}
 	}
-	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal) {
+	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal, revision) {
 		if (this.closing || !this.started) throw new HttpError(503, "unavailable");
 		if (kind === "measure" && this.clientModuleMeasurementActive) throw new HttpError(429, "busy");
 		if (kind === "measure") this.clientModuleMeasurementActive = true;
@@ -8043,8 +8071,10 @@ var MobileAccessGateway = class {
 			const validate = async (selection) => {
 				html = (await this.fetchAuthenticatedUpstreamIndex(controller.signal)).html;
 				try {
+					if (revision !== void 0 && revision !== clientModuleCatalogRevision(describeMobileClientModules(html))) throw new ClientModuleConflictError("the module catalog changed since it was read; reread it and confirm the selection again", "client_module_catalog_changed");
 					parseMobileBootPlan(html, selection);
 				} catch (error) {
+					if (error instanceof ClientModuleConflictError) throw error;
 					if (error instanceof ExcludedClientModulesError) throw new ClientModuleConflictError(error.message);
 					throw new HttpError(502, "upstream_unavailable");
 				}
@@ -8072,8 +8102,10 @@ var MobileAccessGateway = class {
 				} catch (error) {
 					if (!measurementExpired || callerSignal?.aborted === true || this.closing) throw error;
 				}
+				const entries = this.describeMobileModulesWithSizes(html);
 				return Object.freeze({
-					entries: this.describeMobileModulesWithSizes(html),
+					entries,
+					revision: clientModuleCatalogRevision(entries),
 					...selection,
 					...plan.batches === void 0 ? {
 						excludedClientModules: Object.freeze([]),
@@ -9232,8 +9264,7 @@ var MobileAccessGateway = class {
 		};
 	}
 };
-//#endregion
-//#region src/storage.ts
+// src/storage.ts
 function assertInteger(value, name) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`device state ${name} must be a non-negative integer`);
 }
@@ -9360,8 +9391,7 @@ var MemoryDeviceStore = class {
 		return structuredClone(this.snapshot);
 	}
 };
-//#endregion
-//#region src/managed-files.ts
+// src/managed-files.ts
 /** Refuse link-shaped ancestors inside an owned state root before accessing a child. */
 async function assertManagedParents(root, target, prefix) {
 	const parent = resolve(root);
@@ -9528,8 +9558,7 @@ async function replaceManagedDirectory(root, target, candidate, prefix, operatio
 		}
 	}
 }
-//#endregion
-//#region src/component-download.ts
+// src/component-download.ts
 /**
 * Hosts a pinned GitHub release download may redirect to.
 *
@@ -9640,8 +9669,7 @@ async function downloadPinnedArtifact(request) {
 	}
 	throw lastError;
 }
-//#endregion
-//#region src/frp-component.ts
+// src/frp-component.ts
 const FRP_VERSION$1 = "0.70.1";
 const MAX_ARCHIVE_ENTRIES$1 = 128;
 const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
@@ -9925,8 +9953,7 @@ var FrpComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/windows-msi-extract.ts
+// src/windows-msi-extract.ts
 /** A failed read-only MSI extraction; causes deliberately exclude raw command arguments. */
 var WindowsMsiExtractionError = class extends Error {
 	stage;
@@ -10410,8 +10437,7 @@ async function extractWindowsMsiBinary(msi, destination, executableName, expecte
 		await copyFile(binary, join(destination, executableName));
 	});
 }
-//#endregion
-//#region src/cpolar-component.ts
+// src/cpolar-component.ts
 const CPOLAR_VERSION = "3.3.18";
 /** Pinned official cpolar release metadata for supported desktop targets. */
 const CPOLAR_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
@@ -10779,8 +10805,7 @@ var CpolarComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/frp-template.ts
+// src/frp-template.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 const FRP_VHOST_HTTP_PORT = 7080;
 /** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
@@ -10909,8 +10934,7 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin, opti
 	if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
 	return lines.join("\n");
 }
-//#endregion
-//#region src/frp-config.ts
+// src/frp-config.ts
 const MAX_SETTINGS_BYTES$1 = 8192;
 /** Public entry port used by the self-signed TCP passthrough (never 443 by requirement). */
 const FRP_DEFAULT_PUBLIC_PORT = 33080;
@@ -10930,7 +10954,8 @@ const FRP_SETTINGS_KEYS = /* @__PURE__ */ new Set([
 	"mode",
 	"entryTls",
 	"vhostHttpPort",
-	"publicPort"
+	"publicPort",
+	"user"
 ]);
 function hostname$2(value) {
 	if (value.length > 253 || !value.includes(".")) return false;
@@ -10953,6 +10978,11 @@ function validateFrpToken(value) {
 	if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
 	return value;
 }
+/** Validate the optional frpc `user` field; it must stay one safe TOML token. */
+function validateFrpUser(value) {
+	if (typeof value !== "string" || value.length < 1 || value.length > 128 || !/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error("frp_user_invalid");
+	return value;
+}
 /** Validate the public HTTPS origin used by Caddy and Android pairing. */
 function validateFrpPublicOrigin(value) {
 	if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
@@ -11043,6 +11073,7 @@ function parseFrpSettings(value) {
 	const entryTls = record.entryTls === void 0 ? void 0 : validateFrpEntryTls(record.entryTls);
 	const vhostHttpPort = record.vhostHttpPort === void 0 ? void 0 : validateFrpVhostHttpPort(record.vhostHttpPort);
 	const publicPort = record.publicPort === void 0 ? void 0 : validateFrpPublicPort(record.publicPort);
+	const user = record.user === void 0 || record.user === "" ? void 0 : validateFrpUser(record.user);
 	const resolvedMode = mode ?? "deploy";
 	const resolvedEntryTls = entryTls ?? "public-ip-cert";
 	if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
@@ -11058,7 +11089,8 @@ function parseFrpSettings(value) {
 		...mode === void 0 ? {} : { mode },
 		...entryTls === void 0 ? {} : { entryTls },
 		...vhostHttpPort === void 0 ? {} : { vhostHttpPort },
-		...publicPort === void 0 ? {} : { publicPort }
+		...publicPort === void 0 ? {} : { publicPort },
+		...user === void 0 ? {} : { user }
 	});
 }
 /**
@@ -11077,6 +11109,7 @@ function mergeSavedFrpSettings(partial, saved) {
 	const entryTls = pick("entryTls");
 	const vhostHttpPort = pick("vhostHttpPort");
 	const publicPort = pick("publicPort");
+	const user = partial.user === void 0 ? saved?.user : partial.user;
 	const merged = {
 		serverAddress: partial.serverAddress === "" || partial.serverAddress === void 0 ? saved?.serverAddress : partial.serverAddress,
 		serverPort: typeof partial.serverPort === "number" && Number.isSafeInteger(partial.serverPort) && partial.serverPort >= 1 ? partial.serverPort : saved?.serverPort,
@@ -11085,7 +11118,8 @@ function mergeSavedFrpSettings(partial, saved) {
 		...mode === "" || mode === void 0 ? {} : { mode },
 		...entryTls === "" || entryTls === void 0 ? {} : { entryTls },
 		...vhostHttpPort === "" || vhostHttpPort === void 0 ? {} : { vhostHttpPort },
-		...publicPort === "" || publicPort === void 0 ? {} : { publicPort }
+		...publicPort === "" || publicPort === void 0 ? {} : { publicPort },
+		...user === "" || user === void 0 ? {} : { user }
 	};
 	if (merged.serverAddress === void 0 && merged.serverPort === void 0 && merged.token === void 0 && merged.publicOrigin === void 0) throw new Error("frp_config_missing");
 	return parseFrpSettings(merged);
@@ -11155,6 +11189,7 @@ function createFrpcToml(settings, localPort, proxyName = FRP_DEFAULT_PROXY_NAME)
 		`serverPort = ${String(settings.serverPort)}`,
 		"auth.method = \"token\"",
 		`auth.token = ${tomlString(settings.token)}`,
+		...settings.user === void 0 ? [] : [`user = ${tomlString(settings.user)}`],
 		"transport.tls.enable = true",
 		"",
 		"[[proxies]]",
@@ -11267,7 +11302,8 @@ var FrpConfigStore = class {
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode },
 			...mode === void 0 || mode === "deploy" ? {} : { mode },
 			...entryTls === void 0 || entryTls === "public-ip-cert" ? {} : { entryTls },
-			...settings?.publicPort === void 0 ? {} : { publicPort: settings.publicPort }
+			...settings?.publicPort === void 0 ? {} : { publicPort: settings.publicPort },
+			...settings?.user === void 0 ? {} : { user: settings.user }
 		});
 	}
 	/** Return private settings only to the provider lifecycle. */
@@ -11298,8 +11334,7 @@ var FrpConfigStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/frp-attach.ts
+// src/frp-attach.ts
 /** Default proof path used to confirm the public entry answered from this computer. */
 const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
 /** Declaration printed above the VPS half of an attach template. */
@@ -11496,8 +11531,7 @@ function createFrpAttachTemplateParts(settings, options = {}) {
 function createFrpAttachTemplate(settings, options = {}) {
 	return createFrpAttachTemplateParts(settings, options).text;
 }
-//#endregion
-//#region src/frp-attach-plan.ts
+// src/frp-attach-plan.ts
 const DEFAULT_PLAN_CONFIG_FILE = "<DSH Mobile 私有目录>/remote/frp/config/frpc.toml";
 function planConfigFile(options) {
 	const file = options.configFile;
@@ -11635,8 +11669,7 @@ function createFrpAttachPlan(settings, options = {}) {
 		])
 	});
 }
-//#endregion
-//#region src/cert-renewal.ts
+// src/cert-renewal.ts
 /** Days left below which the entry certificate is reported as expiring. */
 const CERT_EXPIRING_DAYS = 2;
 const DAY_MS = 864e5;
@@ -11742,8 +11775,7 @@ async function probeOriginCertificate(host, port, timeoutMs = 5e3) {
 		});
 	});
 }
-//#endregion
-//#region src/managed-setup.ts
+// src/managed-setup.ts
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
 	"docker",
@@ -12241,8 +12273,7 @@ async function materializeManagedSetup(setup, table) {
 		}
 	};
 }
-//#endregion
-//#region src/frp-ingress.ts
+// src/frp-ingress.ts
 /** Private ingress directory, always a sibling of the remote device file. */
 function frpIngressPaths(stateFile) {
 	const directory = join(dirname(stateFile), "ingress");
@@ -12462,8 +12493,7 @@ async function purgeFrpIngressCertificates(stateFile, ownedRoot = dirname(stateF
 		throw error;
 	}
 }
-//#endregion
-//#region src/remote.ts
+// src/remote.ts
 const REMOTE_PROVIDERS = Object.freeze([
 	"tailscale",
 	"cpolar",
@@ -12699,8 +12729,7 @@ function configuredRemoteProvider(environment) {
 	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin" && value !== "iroh") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, origin, or iroh");
 	return value;
 }
-//#endregion
-//#region src/frp.ts
+// src/frp.ts
 const START_TIMEOUT_MS$2 = 45e3;
 const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
 const DISCOVERY_RETRY_MS = 1e3;
@@ -13310,8 +13339,7 @@ var FrpController = class {
 		], "FRP resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/origin-proxy-config.ts
+// src/origin-proxy-config.ts
 const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
 const MAX_SETTINGS_BYTES = 8192;
 /**
@@ -13481,8 +13509,7 @@ var OriginConfigStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/origin-proxy.ts
+// src/origin-proxy.ts
 /** Owns an authenticated HTTP gateway, with no tunnel process or public network probes. */
 var OriginController = class {
 	options;
@@ -13632,13 +13659,12 @@ var OriginController = class {
 		});
 	}
 };
-//#endregion
-//#region src/cloudflared-component.ts
+// src/cloudflared-component.ts
 /** Upper bound for `tar -t` output; a pinned release listing is a few lines. */
 const MAX_ARCHIVE_LIST_BYTES = 1048576;
 const MAX_ARCHIVE_ENTRIES = 256;
 const DOWNLOAD_TIMEOUT_MS = 3e5;
-const CLOUDFLARED_VERSION = "2026.9.1";
+const CLOUDFLARED_VERSION = "2026.10.7";
 /** Pinned official cloudflared release metadata for supported desktop targets. */
 const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 	{
@@ -13646,44 +13672,44 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		platform: "win32",
 		arch: "x64",
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-windows-amd64.exe`,
-		downloadBytes: 54976432,
-		downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
+		downloadBytes: 55390512,
+		downloadSha256: "2493dbc168923bb3e59e5e7716f71deced92992eea9acd6e9d74f84ac7751343",
 		executableName: "cloudflared.exe",
-		executableBytes: 54976432,
-		executableSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712"
+		executableBytes: 55390512,
+		executableSha256: "2493dbc168923bb3e59e5e7716f71deced92992eea9acd6e9d74f84ac7751343"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
 		platform: "linux",
 		arch: "x64",
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-amd64`,
-		downloadBytes: 39838488,
-		downloadSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
+		downloadBytes: 40274445,
+		downloadSha256: "1f99fb518b83dec2ba8d870a7cc991d82a77e6196295a3d2754ba17ab9f91872",
 		executableName: "cloudflared",
-		executableBytes: 39838488,
-		executableSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc"
+		executableBytes: 40274445,
+		executableSha256: "1f99fb518b83dec2ba8d870a7cc991d82a77e6196295a3d2754ba17ab9f91872"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
 		platform: "linux",
 		arch: "arm64",
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64`,
-		downloadBytes: 37466252,
-		downloadSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
+		downloadBytes: 37667293,
+		downloadSha256: "3df43aedc9ff291d1735b5cb576cb97e0b157488796db2e32b28aecabb445775",
 		executableName: "cloudflared",
-		executableBytes: 37466252,
-		executableSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3"
+		executableBytes: 37667293,
+		executableSha256: "3df43aedc9ff291d1735b5cb576cb97e0b157488796db2e32b28aecabb445775"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
 		platform: "darwin",
 		arch: "x64",
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-amd64.tgz`,
-		downloadBytes: 21118723,
-		downloadSha256: "ff0d3b51d5ff70eceef89d6b32145fee985018a2174596a5dbe405e2766e2ac4",
+		downloadBytes: 21834416,
+		downloadSha256: "02f3edfd87684dd5b705607688e4eb4b323f6e777b81e7b3a85af556aa356848",
 		executableName: "cloudflared",
-		executableBytes: 41731488,
-		executableSha256: "1ea07ae775b03236bd6be18ca1848d6bdc4af2f4f3bce398823b5a36e5761b75",
+		executableBytes: 42430512,
+		executableSha256: "5c55e77da7012cebca19170357e196176c48c9647cc2ead404702fa125ddbd86",
 		archive: {
 			format: "tgz",
 			member: "cloudflared"
@@ -13694,11 +13720,11 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		platform: "darwin",
 		arch: "arm64",
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-arm64.tgz`,
-		downloadBytes: 19217478,
-		downloadSha256: "c27ab8fd0aa489449e3d201eb02f957ef460a13b613662928b1b23394bf1bcfe",
+		downloadBytes: 19847161,
+		downloadSha256: "3586ccf397e98e5f437e60e7c307ca6ac463e110580503af8bb8e6f9ebf831bd",
 		executableName: "cloudflared",
-		executableBytes: 38893072,
-		executableSha256: "9a0b19f67dc7a3011bc6b972c7ce06a5fcea8784ac6bd599ffa382ea4aeb5a6e",
+		executableBytes: 39487168,
+		executableSha256: "2136431d5eb467bf447d2ee514b713e192719b143aec1d9e09bf7dc290d5bb12",
 		archive: {
 			format: "tgz",
 			member: "cloudflared"
@@ -13958,8 +13984,7 @@ var CloudflaredComponentManager = class {
 		return task.then(() => this.status());
 	}
 };
-//#endregion
-//#region src/cloudflared.ts
+// src/cloudflared.ts
 const MAX_LOG_BUFFER_BYTES$1 = 65536;
 /**
 * A quick tunnel has to be allocated and registered with the Cloudflare edge
@@ -14477,8 +14502,7 @@ var CloudflaredController = class {
 		], "cloudflared resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/cloudflared-tunnel.ts
+// src/cloudflared-tunnel.ts
 const MAX_CONFIG_BYTES$1 = 8192;
 const QUICK_TUNNEL_SUFFIX = ".trycloudflare.com";
 /** Cloudflare's own tunnel-routing domain; it can never be a public hostname. */
@@ -14684,8 +14708,7 @@ var CloudflaredTunnelStore = class {
 		return this.status();
 	}
 };
-//#endregion
-//#region src/iroh-files.ts
+// src/iroh-files.ts
 async function renameIrohPath(root, source, destination) {
 	await renameManagedPath(root, source, destination, "iroh");
 }
@@ -14695,8 +14718,7 @@ async function ensureIrohDirectory(root, directory) {
 async function removeIrohTree(root, target) {
 	await removeManagedTree(root, target, "iroh");
 }
-//#endregion
-//#region src/iroh-manifest.ts
+// src/iroh-manifest.ts
 /** Checksum-gated resolution of the iroh transport host binary.
 *
 * The sidecar is built and published by the independent `dsh-mobile-iroh`
@@ -14800,8 +14822,7 @@ async function resolveIrohSidecarAt(companionRoot, platform, arch) {
 	if (process.platform !== "win32" && platform !== "win32" && (before.mode & 73) === 0) throw new Error("iroh_native_not_executable");
 	return path;
 }
-//#endregion
-//#region src/iroh-component.ts
+// src/iroh-component.ts
 /** Managed view of the iroh transport host sidecar.
 *
 * Explicit installation verifies and promotes a pinned sidecar release into
@@ -15115,8 +15136,7 @@ var IrohComponentManager = class {
 		return this.cached;
 	}
 };
-//#endregion
-//#region src/iroh-sidecar.ts
+// src/iroh-sidecar.ts
 /** Versioned parent-to-sidecar protocol for the iroh transport host.
 *
 * Ported from the independent `dsh-mobile-iroh` companion's sidecar
@@ -15246,8 +15266,7 @@ function decodeIrohEvent(line) {
 	}
 	return Object.freeze(event);
 }
-//#endregion
-//#region src/iroh-origin.ts
+// src/iroh-origin.ts
 /** Identity-derived browser origins for the raw TLS-over-iroh carrier.
 *
 * Ported from the independent `dsh-mobile-iroh` companion's origin contract.
@@ -15278,8 +15297,7 @@ function validateIrohOrigin(value, endpointId, localPort = DEFAULT_IROH_LOCAL_PO
 	if (value !== expected) throw new Error("iroh origin does not match the selected endpoint and local port");
 	return expected;
 }
-//#endregion
-//#region src/iroh-pairing.ts
+// src/iroh-pairing.ts
 /** Short-lived iroh pairing descriptors for QR transport.
 *
 * Byte-compatible with the independent `dsh-mobile-iroh` companion's
@@ -15372,6 +15390,14 @@ function validatePairingDescriptor(value, options = {}) {
 function encodePairingDescriptor(value, options = {}) {
 	return JSON.stringify(validatePairingDescriptor(value, options));
 }
+/** Draw the canonical pairing payload with its four-module quiet zone inside the SVG. */
+function renderIrohPairingQr(encoded) {
+	return QRCode.toString(encoded, {
+		type: "svg",
+		margin: 4,
+		errorCorrectionLevel: "M"
+	});
+}
 /** Decode untrusted QR text, validating its expiry and public CA before use. */
 function decodePairingDescriptor(encoded, options = {}) {
 	if (typeof encoded !== "string" || Buffer.byteLength(encoded, "utf8") > 2200) reject("pairing_descriptor_too_large");
@@ -15387,8 +15413,7 @@ function decodePairingDescriptor(encoded, options = {}) {
 }
 /** Phone-side listener port advertised in QR codes minted by this computer. */
 const PAIRING_DESCRIPTOR_LOCAL_PORT = DEFAULT_IROH_LOCAL_PORT;
-//#endregion
-//#region src/iroh.ts
+// src/iroh.ts
 /** Experimental iroh remote transport as a first-class remote provider.
 *
 * The sidecar is distributed by this plugin itself: an explicit install
@@ -15939,8 +15964,7 @@ var IrohController = class {
 		});
 	}
 };
-//#endregion
-//#region src/iroh-tls.ts
+// src/iroh-tls.ts
 /** Self-signed TLS identity for the experimental iroh gateway.
 *
 * Reuses this repository's managed CA path (`managed-setup.ts`) instead of
@@ -16107,8 +16131,7 @@ function irohGatewayConfig(template, endpointId, stateFile, tls, listenPort = 0)
 		pairingTtlMs: 3e5
 	});
 }
-//#endregion
-//#region src/task-events.ts
+// src/task-events.ts
 const TASK_EVENT_DEBOUNCE_MS = 1e3;
 function turnNumber(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
@@ -16185,8 +16208,99 @@ var TaskEventHub = class {
 		return this.sinks.size;
 	}
 };
-//#endregion
-//#region src/diagnostics.ts
+// src/diagnostic-network-context.ts
+function addressKind(address) {
+	if (isIP(address) === 4) {
+		const [first, second] = address.split(".").map(Number);
+		if (first === 100 && second >= 64 && second <= 127) return "tailnet";
+		if (first === 198 && (second === 18 || second === 19)) return "fake-ip";
+		if (first === 0 || first === 10 || first === 127 || first >= 224 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168) return "private";
+		return "public";
+	}
+	if (isIP(address) === 6) {
+		const lower = address.toLowerCase();
+		if (lower.startsWith("::ffff:") && isIP(lower.slice(7)) === 4) return addressKind(lower.slice(7));
+		if (lower.startsWith("fd7a:115c:a1e0:")) return "tailnet";
+		if (lower === "::" || lower === "::1" || /^(?:f[cd]|fe[89ab]|ff)/u.test(lower)) return "private";
+		return "public";
+	}
+	return "unknown";
+}
+/**
+* Collapse system resolver results into non-identifying categories, without retaining addresses.
+* @param addresses - Addresses supplied by the system resolver.
+* @returns Address category and observed IP families; mixed answers are not treated as tailnet-only.
+*/
+function classifyDiagnosticDns(addresses) {
+	const kinds = new Set(addresses.map((entry) => addressKind(entry.address)));
+	const families = new Set(addresses.map((entry) => isIP(entry.address)).filter((value) => value !== 0));
+	return {
+		kind: kinds.size === 0 ? "unknown" : kinds.size === 1 ? [...kinds][0] : "mixed",
+		family: families.size === 0 ? "unknown" : families.size > 1 ? "dual" : families.has(4) ? "ipv4" : "ipv6"
+	};
+}
+/**
+* Read bounded system-DNS context; never consult an external DNS service or modify settings.
+* @param hostname - The configured endpoint's hostname.
+* @param budgetMs - Maximum wait; OS lookup completion itself cannot be cancelled.
+* @param resolve - System lookup or an instance-local controlled fixture.
+* @returns Unknown on failure/deadline, not a conclusion that DNS or the public service is down.
+*/
+async function probeDiagnosticDns(hostname, budgetMs, resolve = (host) => lookup(host, { all: true })) {
+	let timer;
+	try {
+		return classifyDiagnosticDns(await Promise.race([resolve(hostname), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("dns_context_timeout")), Math.max(1, budgetMs));
+			timer.unref();
+		})]));
+	} catch {
+		return {
+			kind: "unknown",
+			family: "unknown"
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* Classify fixed transport machine codes without reflecting messages, URLs or nested errors.
+* @param error - A failed endpoint request.
+* @returns The last observed transport stage, or unknown rather than a guessed cause.
+*/
+function diagnosticFailureStage(error) {
+	let current = error;
+	for (let depth = 0; depth < 4 && current !== null && typeof current === "object"; depth++) {
+		const code = "code" in current && typeof current.code === "string" ? current.code : "";
+		if ("name" in current && current.name === "TimeoutError") return "timeout";
+		if (["ENOTFOUND", "EAI_AGAIN"].includes(code)) return "dns";
+		if ([
+			"ECONNREFUSED",
+			"ECONNRESET",
+			"EPIPE",
+			"ENETUNREACH",
+			"EHOSTUNREACH",
+			"UND_ERR_SOCKET"
+		].includes(code)) return "connect";
+		if ([
+			"ETIMEDOUT",
+			"UND_ERR_CONNECT_TIMEOUT",
+			"UND_ERR_HEADERS_TIMEOUT",
+			"UND_ERR_BODY_TIMEOUT"
+		].includes(code)) return "timeout";
+		if ([
+			"ERR_TLS_CERT_ALTNAME_INVALID",
+			"CERT_HAS_EXPIRED",
+			"UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+			"DEPTH_ZERO_SELF_SIGNED_CERT",
+			"SELF_SIGNED_CERT_IN_CHAIN",
+			"UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+			"ERR_SSL_WRONG_VERSION_NUMBER"
+		].includes(code)) return "tls";
+		current = "cause" in current ? current.cause : void 0;
+	}
+	return "unknown";
+}
+// src/diagnostics.ts
 /** Recognize the active remote-web-ui boot hook without evaluating or modifying it. */
 function hasCompetingRemoteChannelBoot(rows) {
 	return rows.some((row) => row.kind === "script" && row.text?.includes("__DSH_REMOTE_CHANNEL_BOOT__") === true);
@@ -16245,6 +16359,7 @@ function check(id, status, reason, label, detail, action, facts) {
 		id,
 		status,
 		reason,
+		scope: id === "versions" ? "configuration" : id === "phone-network" ? "phone" : "computer",
 		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
 		label,
 		detail,
@@ -16489,28 +16604,6 @@ async function relayProbeThroughProxy(target, proxy, budgetMs = remoteDiagnostic
 		hopRequest.end();
 	});
 }
-/** Bounded supplementary DNS context for a failed direct attempt. */
-async function unreachableWithDnsContext(hostname, budgetMs) {
-	let fakeIp = false;
-	let timer;
-	try {
-		fakeIp = (await Promise.race([lookup(hostname, { all: true }), new Promise((_resolve, reject) => {
-			timer = setTimeout(() => {
-				reject(/* @__PURE__ */ new Error("dns_context_timeout"));
-			}, Math.max(1, budgetMs));
-			timer.unref();
-		})])).some(({ address }) => {
-			const [first, second] = address.split(".").map(Number);
-			return first === 198 && (second === 18 || second === 19);
-		});
-	} catch {} finally {
-		clearTimeout(timer);
-	}
-	return {
-		state: "unreachable",
-		...fakeIp ? { fakeIp: true } : {}
-	};
-}
 async function fetchRemoteHealth(target, budgetMs) {
 	const started = performance.now();
 	try {
@@ -16520,19 +16613,28 @@ async function fetchRemoteHealth(target, budgetMs) {
 			signal: AbortSignal.timeout(Math.max(1, budgetMs - 500))
 		});
 		const latencyMs = Math.max(0, Math.round(performance.now() - started));
-		if (response.status === 429) return {
-			state: "rate-limited",
-			latencyMs
-		};
-		return response.ok ? {
+		if (response.status === 429) {
+			await response.body?.cancel();
+			return {
+				state: "rate-limited",
+				latencyMs
+			};
+		}
+		const observation = response.ok ? {
 			state: "ready",
 			latencyMs
 		} : {
 			state: "unreachable",
-			latencyMs
+			latencyMs,
+			failureStage: "http"
+		};
+		await response.body?.cancel();
+		return observation;
+	} catch (error) {
+		return {
+			state: "unreachable",
+			failureStage: diagnosticFailureStage(error)
 		};
-	} catch {
-		return unreachableWithDnsContext(target.hostname, Math.max(1, budgetMs - (performance.now() - started)));
 	}
 }
 /**
@@ -16555,7 +16657,14 @@ async function probeRemoteHealth(origin, options = {}) {
 		return { state: "not-applicable" };
 	}
 	const budgetMs = remoteDiagnosticTimeoutMs(origin);
-	const observation = await (options.direct ?? fetchRemoteHealth)(target, budgetMs);
+	const direct = options.direct ?? fetchRemoteHealth;
+	const [observed, dns] = await Promise.all([direct(target, budgetMs), options.direct !== void 0 && options.lookup === void 0 ? void 0 : probeDiagnosticDns(target.hostname, Math.min(750, budgetMs), options.lookup)]);
+	const context = dns === void 0 ? {} : { dns };
+	const observation = {
+		...observed,
+		...context,
+		...dns?.kind === "fake-ip" ? { fakeIp: true } : {}
+	};
 	if (observation.state !== "unreachable") return observation;
 	const relay = configuredProxyFor(origin, options.env ?? process.env);
 	if (relay === void 0) return observation;
@@ -16565,12 +16674,14 @@ async function probeRemoteHealth(origin, options = {}) {
 		if (status === 429) return {
 			state: "rate-limited",
 			latencyMs,
-			viaProxy: true
+			viaProxy: true,
+			...context
 		};
 		return status >= 200 && status < 300 ? {
 			state: "ready",
 			latencyMs,
-			viaProxy: true
+			viaProxy: true,
+			...context
 		} : observation;
 	} catch {
 		return observation;
@@ -16580,28 +16691,38 @@ async function defaultRemoteProbe(origin) {
 	return probeRemoteHealth(origin);
 }
 function reportLine(entry) {
-	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
+	return `[${entry.status.toUpperCase()}][${entry.scope}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
 }
 /** Run bounded read-only checks and return a report safe to paste into an issue. */
 async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	const checks = [];
 	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.provider !== "iroh" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
-	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
-	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
+	const [firewall, remoteObservation] = await Promise.all([snapshot.lan.running ? (probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port) : Promise.resolve({ state: "not-applicable" }), remoteProbe]);
+	checks.push(check("versions", "ok", "versions-current", "版本信息", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
 	if (snapshot.competingRemoteChannelBoot === true) checks.push(check("remote-plugin-conflict", "warning", "competing-remote-channel", "第三方远程插件", "检测到另一套远程请求通道脚本；手机页面可能进入该插件自己的配对流程。", "在电脑端关闭 dsh-remote-web-ui 的远程访问后刷新，再使用 DSH Mobile 当前二维码配对；不要混用两种配对码。"));
-	if (snapshot.lan.configured === false) checks.push(check("network", "error", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "返回局域网页选择网卡并完成配置。"));
-	else if (snapshot.lan.networkError !== void 0) checks.push(check("network", "error", "network-unavailable", "局域网网卡", "已保存的网卡当前不可用。", "重新运行 dsh-mobile setup。"));
+	if (snapshot.indexInspectionUnavailable === true) checks.push(check("plugin-inspection", "warning", "plugin-inspection-unavailable", "页面脚本检查", "本次未能检查活动页面脚本；不能据此认定不存在其他远程通道。", "其余网络项目独立检查；保留复现环境并核对相关插件。"));
+	if (snapshot.lan.configured === false) checks.push(check("network", snapshot.lan.running ? "error" : "info", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "需要局域网连接时，返回局域网页选择网卡并完成配置。"));
+	else if (snapshot.lan.networkError !== void 0) checks.push(check("network", snapshot.lan.running ? "error" : "info", "network-unavailable", "局域网网卡", "已保存的网卡当前不可用。", snapshot.lan.running ? "在局域网页重新确认网卡配置。" : "局域网未启用；此配置不用于判断远程入口。"));
 	else if (snapshot.lan.configuredInterface !== void 0) {
 		const interfaceName = snapshot.lan.interfaceName ?? snapshot.lan.configuredInterface;
 		checks.push(check("network", "ok", "network-interface", "局域网网卡", `正在跟随 ${interfaceName}。`, void 0, { interfaceName }));
 	} else checks.push(check("network", "info", "network-fixed", "局域网网卡", "当前使用固定网络配置。"));
 	if (snapshot.lan.running && snapshot.lan.origin !== void 0) {
 		const endpointSuffix = maskLanOrigin(snapshot.lan.origin);
-		checks.push(check("lan", "ok", "lan-ready", "局域网网关", `已监听 ${endpointSuffix}，配对入口可用。`, void 0, { endpointSuffix }));
+		checks.push(check("lan", "ok", "lan-ready", "局域网网关", `电脑网关已监听 ${endpointSuffix}；尚未验证手机能否到达。`, void 0, { endpointSuffix }));
 	} else checks.push(check("lan", "info", "lan-off", "局域网网关", "当前未开启。", "需要手机直连时开启局域网访问。"));
-	if (firewall.state === "ready") checks.push(check("firewall", "ok", "firewall-ready", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
-	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
+	if (!snapshot.lan.running) checks.push(check("firewall", "info", "firewall-inactive", "Windows 防火墙", "局域网未启用，本次未检查局域网防火墙规则。", "不据此判断远程入口；需要局域网时再启用并检查。"));
+	else if (firewall.state === "ready") checks.push(check("firewall", "ok", "firewall-ready", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
+	else if (firewall.state === "missing") checks.push(check("firewall", snapshot.lan.running ? "warning" : "info", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", snapshot.lan.running ? "确认需要局域网连接，再检查相应规则；不要关闭整个防火墙。" : "局域网未启用，不据此判断远程入口失败。"));
 	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
+	if (snapshot.remote.running && snapshot.remote.state === "ready") checks.push(check("remote-service", "ok", "remote-service-ready", "本机通道状态", "提供方报告本机组件已就绪；不代表公网或手机路径已验证。", void 0, { provider: snapshot.remote.provider }));
+	if (remoteObservation.dns !== void 0) {
+		const kind = remoteObservation.dns.kind;
+		checks.push(check("remote-dns", kind === "fake-ip" ? "warning" : "info", `dns-${kind}`, "系统 DNS", `电脑系统解析分类：${kind}；IP：${remoteObservation.dns.family}。未查询公共 DNS，地址不写入报告。`, void 0, {
+			dnsKind: kind,
+			dnsFamily: remoteObservation.dns.family
+		}));
+	}
 	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
 	else if (snapshot.remote.provider === "origin" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-origin-ready", "远程通道", "私网 HTTP 后端已就绪；未检测公网 HTTPS、证书或 WebSocket 连通性。", "在手机上经反向代理验证连接；代理须保留原始 Host（含端口）并支持 WebSocket。", { provider: "origin" }));
 	else if (snapshot.remote.provider === "iroh" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-iroh-ready", "远程通道", "iroh 通道已就绪；端点身份为回环 TLS，不从电脑端探测手机可达性。", "在手机上用配对二维码验证连接；二维码过期或通道报错时重新生成并重连。", { provider: "iroh" }));
@@ -16613,10 +16734,14 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 			...remoteObservation.latencyMs === void 0 ? {} : { latencyMs: remoteObservation.latencyMs },
 			...remoteObservation.viaProxy === true ? { viaProxy: true } : {}
 		};
-		if (remoteObservation.state === "ready") checks.push(check("remote", remoteObservation.viaProxy === true ? "warning" : "ok", "remote-ready", "远程通道", remoteObservation.viaProxy === true ? `电脑经代理可访问 ${endpointSuffix}，但尚未验证手机能否连接。` : `${snapshot.remote.provider} 公共地址 ${endpointSuffix} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`, remoteObservation.viaProxy === true ? "请在手机上测试远程连接。" : void 0, facts));
+		if (remoteObservation.state === "ready") checks.push(check("remote", remoteObservation.viaProxy === true ? "warning" : "ok", "remote-ready", "远程通道", remoteObservation.viaProxy === true ? `电脑经代理可访问 ${endpointSuffix}，但尚未验证手机能否连接。` : `电脑当前出口可访问 ${snapshot.remote.provider} 入口 ${endpointSuffix}，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms；公网及手机路径未独立验证。`, remoteObservation.viaProxy === true ? "请在手机上测试远程连接。" : void 0, facts));
 		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "remote-rate-limited", "远程通道", remoteObservation.viaProxy === true ? "电脑经代理访问时观察到限流，尚未验证手机能否连接。" : "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。", facts));
-		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。", facts));
-		else checks.push(check("remote", "error", "remote-unreachable", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。", facts));
+		else if (snapshot.remote.provider === "tailscale" && remoteObservation.dns?.kind === "tailnet" && (remoteObservation.failureStage === "connect" || remoteObservation.failureStage === "timeout")) checks.push(check("remote", "warning", "remote-tailnet-shadowed", "电脑出口探测", "本机系统 DNS 返回 tailnet 地址，当前 Funnel-only 监听不接受此私网路径；本次失败不能证明公网 Funnel 故障。", "用 tailnet 外的网络单独验证；如自愿临时调整设备 DNS，注意其对其他私网服务的影响并在对照后恢复。", facts));
+		else if (snapshot.remote.provider === "tailscale" && (remoteObservation.fakeIp === true || remoteObservation.dns?.kind === "fake-ip") && remoteObservation.failureStage !== "tls" && remoteObservation.failureStage !== "http") checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "本机系统 DNS 返回 Fake-IP 网段，本次出口探测未成功；这不是公网故障的证明。", "核对 DNS 与代理路由，用其他网络对照，不要关闭证书验证。", facts));
+		else {
+			const reason = remoteObservation.failureStage === "dns" ? "remote-dns-failed" : remoteObservation.failureStage === "connect" ? "remote-connect-failed" : remoteObservation.failureStage === "tls" ? "remote-tls-failed" : remoteObservation.failureStage === "timeout" ? "remote-probe-timeout" : remoteObservation.failureStage === "http" ? "remote-http-failed" : "remote-unreachable";
+			checks.push(check("remote", "error", reason, "电脑出口探测", "电脑当前出口的探测未通过；不代表其他网络或手机一定失败。", "按失败阶段核对 DNS、路由、证书或代理，并用手机当前网络对照。", facts));
+		}
 	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") {
 		const needsLogin = snapshot.remote.state === "needs-login";
 		checks.push(check("remote", "warning", needsLogin ? "remote-needs-login" : "remote-connecting", "远程通道", needsLogin ? "等待完成 Tailscale 登录。" : "仍在建立连接。", needsLogin ? "返回远程页继续登录。" : "等待片刻后重新检查。", { provider: snapshot.remote.provider }));
@@ -16627,15 +16752,16 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 			controllerCode
 		}));
 	}
-	checks.push(check("phone-network", "info", "phone-network-unknown", "手机网络", "电脑无法判断路由器是否隔离了手机。", "局域网仍失败时，确认手机与电脑在同一网络，并关闭访客网络或 AP 隔离。"));
+	checks.push(check("phone-network", "info", "phone-network-unknown", "手机网络", "电脑没有验证手机网络、认证页面、资源加载或 WebSocket。", "请用手机当前网络实际连接，记录失败阶段；不要提供配对凭据或直接关闭安全隔离措施。"));
 	const overall = checks.some((entry) => entry.status === "error") ? "error" : checks.some((entry) => entry.status === "warning") ? "attention" : "ok";
-	const summary = overall === "ok" ? "连接基础检查正常。" : overall === "attention" ? "发现需要留意的项目。" : "发现会影响连接的问题。";
+	const summary = overall === "ok" ? "电脑端基础检查完成；手机、认证页面、资源与 WebSocket 尚未验证。" : overall === "attention" ? "电脑端检查有待确认项目；请区分测量路径与实际手机连接。" : "电脑端检查有失败项目；不据此推断所有网络均不可达。";
 	const report = [
 		"DSH Mobile 诊断报告",
 		`生成时间: ${(/* @__PURE__ */ new Date()).toISOString()}`,
 		`版本: plugin=${DSH_MOBILE_VERSION}; dsh=${snapshot.dshVersion}; min-app=${MINIMUM_ANDROID_APP_VERSION}`,
 		`LAN: ${snapshot.lan.running ? "on" : "off"}; endpoint=${maskLanOrigin(snapshot.lan.origin)}`,
 		`Remote: provider=${snapshot.remote.provider}; state=${snapshot.remote.state}; endpoint=${remoteSuffix(snapshot.remote.origin)}`,
+		"Coverage: computer-side only; phone, authenticated page, resources and WebSocket remain unverified.",
 		...checks.map(reportLine)
 	].join("\n");
 	return Object.freeze({
@@ -16649,11 +16775,19 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 		}),
 		summary,
 		checks: Object.freeze(checks),
-		report
+		report,
+		coverage: Object.freeze({
+			measuredFrom: "computer",
+			unverified: Object.freeze([
+				"phone",
+				"authenticated-page",
+				"resources",
+				"websocket"
+			])
+		})
 	});
 }
-//#endregion
-//#region src/mobile-guide.ts
+// src/mobile-guide.ts
 /** Compose the guide with the current customization state injected. */
 function buildMobileGuide(state) {
 	const styleLine = state.hasCustomCss ? "存在（已检测到文件，需在已配对页面验证加载）" : "不存在（使用内置默认样式）";
@@ -16718,8 +16852,7 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
 - 创建或修改扩展后，确认 extension.json 的 schemaVersion 为 1、id 与目录名一致、且 id 只含小写字母数字和连字符
 - 扩展的 host.mjs 若在完成前无法激活，先修正而不是留下损坏的扩展
 - 完成后检查自己实际写入了哪些文件，向用户简要说明改了什么、手机端会有什么变化`;
-//#endregion
-//#region src/vps-deploy.ts
+// src/vps-deploy.ts
 const FRP_VERSION = "0.70.1";
 const SSH_TIMEOUT_MS = 3e5;
 const LINUX_ARTIFACTS = Object.freeze({
@@ -17690,8 +17823,7 @@ async function uninstallVps(serverAddress, uninstall, input, options = {}) {
 		checks
 	});
 }
-//#endregion
-//#region src/lan-rebind.ts
+// src/lan-rebind.ts
 /** An unreadable setup is rejected before stopping the listener or replacing any file. */
 var ManagedLanConfigurationError = class extends Error {
 	constructor(cause) {
@@ -17728,8 +17860,7 @@ async function rebindManagedLan(options) {
 		running: result.running
 	};
 }
-//#endregion
-//#region src/funnel.ts
+// src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
 const FUNNEL_START_TIMEOUT_MS = 45e3;
 function publicStatus$1(status) {
@@ -18243,8 +18374,7 @@ function funnelExecutable(importMetaUrl, environment = process.env) {
 	const file = `dsh-mobile-funnel-${process.platform}-${process.arch}${suffix}`;
 	return resolve(fileURLToPath(new URL(`../bin/${file}`, importMetaUrl)));
 }
-//#endregion
-//#region src/cpolar.ts
+// src/cpolar.ts
 const MAX_LOG_BUFFER_BYTES = 65536;
 const START_TIMEOUT_MS = 45e3;
 const CPOLAR_HOST_SUFFIXES = Object.freeze([
@@ -18660,8 +18790,7 @@ var CpolarController = class {
 		], "cpolar resource cleanup failed");
 	}
 };
-//#endregion
-//#region src/caddy-files.ts
+// src/caddy-files.ts
 /** Refuse link-shaped ancestors within Caddy's owned state root. */
 async function assertCaddyParents(root, target) {
 	await assertManagedParents(root, target, "caddy");
@@ -18682,8 +18811,7 @@ async function writeCaddyPrivateFile(root, file, body) {
 async function removeCaddyTree(root, target) {
 	await removeManagedTree(root, target, "caddy");
 }
-//#endregion
-//#region src/caddy-component.ts
+// src/caddy-component.ts
 const CADDY_VERSION = "2.11.7";
 const CADDY_DNS_PLUGIN_VERSION = "v0.4.3";
 const CADDY_DOWNLOAD_PAGE = "https://github.com/saya-ch/dsh-mobile/releases/tag/caddy-component-2.11.7-tencentcloud-0.4.3-r1";
@@ -19202,8 +19330,7 @@ var CaddyConfigStore = class {
 		return task;
 	}
 };
-//#endregion
-//#region src/caddy.ts
+// src/caddy.ts
 /** Private directories override Caddy's platform defaults; ambient API keys and admin/proxy overrides are omitted. */
 function caddyProcessEnvironment(config, settings, environment = process.env) {
 	const credentials = config.credentials();
@@ -19533,8 +19660,7 @@ var CaddyController = class {
 		}
 	}
 };
-//#endregion
-//#region src/managed-origin.ts
+// src/managed-origin.ts
 /** Children never independently restore a durable enabled switch. */
 function createVolatileRemoteControlStore() {
 	let value = {
@@ -19715,8 +19841,7 @@ var ManagedOriginController = class {
 		return task;
 	}
 };
-//#endregion
-//#region src/release-update.ts
+// src/release-update.ts
 const PACKAGE_NAME = "dsh-mobile";
 const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
 const ANDROID_RELEASE_DESCRIPTOR_URL = "https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/apps/mobile/release.json";
@@ -20179,8 +20304,7 @@ var PluginReleaseManager = class {
 		});
 	}
 };
-//#endregion
-//#region src/file-logger.ts
+// src/file-logger.ts
 const MAX_LOG_BYTES = 5242880;
 const MAX_QUEUED_BYTES = 262144;
 const PATH_PREFIX = "mobile_log";
@@ -20290,14 +20414,12 @@ async function installMobileFileLogger(ctx, stateDirectory, options = {}) {
 	}
 	return file;
 }
-//#endregion
-//#region src/mobile-push/contracts.ts
+// src/mobile-push/contracts.ts
 const OUTCOME_COALESCE_MS = 1e3;
 const ATTENTION_TTL_MS = 3e5;
 const OUTCOME_TTL_MS = 18e5;
 const ATTEMPT_TIMEOUT_MS = 1e4;
-//#endregion
-//#region src/mobile-push/requests.ts
+// src/mobile-push/requests.ts
 var RequestLifetimes = class {
 	#records = /* @__PURE__ */ new Map();
 	#byCall = /* @__PURE__ */ new Map();
@@ -20477,8 +20599,7 @@ var RequestLifetimes = class {
 		}, 250);
 	}
 };
-//#endregion
-//#region src/mobile-push/outcomes.ts
+// src/mobile-push/outcomes.ts
 const isCompletedGoalPhase = (phase) => phase === "complete";
 var OutcomeLifetimes = class {
 	#ctx;
@@ -20658,8 +20779,7 @@ var OutcomeLifetimes = class {
 		return current;
 	}
 };
-//#endregion
-//#region src/mobile-push/reconcile.ts
+// src/mobile-push/reconcile.ts
 const TURN_REASONS = [
 	"completed",
 	"error",
@@ -20931,8 +21051,7 @@ var PushReconciler = class {
 		return verifyOutcome(source, values, agent);
 	}
 };
-//#endregion
-//#region src/mobile-push/host.ts
+// src/mobile-push/host.ts
 function hasContract(ctx) {
 	return typeof ctx.on === "function" && typeof ctx.sessionProjections?.stateOf === "function" && typeof ctx.sessionProjections.snapshot === "function" && typeof ctx.sessionProjections.register === "function" && typeof ctx.sessionQuery?.observeSession === "function" && typeof ctx.agents?.get === "function" && typeof ctx.agents.list === "function" && typeof ctx.agents.roots === "function" && typeof ctx.agents.isOwnedBy === "function" && ctx.userQuestions !== void 0 && ctx.approval !== void 0;
 }
@@ -21143,8 +21262,7 @@ function createPushHost(ctx) {
 		}
 	};
 }
-//#endregion
-//#region src/mobile-push/endpoint.ts
+// src/mobile-push/endpoint.ts
 const MAX_ENDPOINT_BYTES = 2048;
 const APPLE_SUFFIX = ".push.apple.com";
 const BASE64URL = /^[A-Za-z0-9_-]+$/u;
@@ -21261,8 +21379,7 @@ async function resolveAppleEndpoint(endpoint, resolver = systemResolver) {
 		addresses: Object.freeze([...addresses])
 	});
 }
-//#endregion
-//#region src/mobile-push/store.ts
+// src/mobile-push/store.ts
 const MAX_STATE_BYTES = 4194304;
 const emptySnapshot = () => ({
 	version: 1,
@@ -21525,8 +21642,7 @@ var JsonPushStore = class {
 		}
 	}
 };
-//#endregion
-//#region src/mobile-push/registry.ts
+// src/mobile-push/registry.ts
 const empty = () => ({
 	version: 1,
 	ownerGenerations: [],
@@ -21914,8 +22030,7 @@ var PushRegistry = class {
 		};
 	}
 };
-//#endregion
-//#region src/mobile-push/payload.ts
+// src/mobile-push/payload.ts
 const messages = {
 	en: {
 		question: ["Input requested", "A response needs your attention."],
@@ -21967,8 +22082,7 @@ function buildDeclarativePayload(category, locale, navigate, tag) {
 	if (Buffer.byteLength(payload, "utf8") > 3072) throw new TypeError("push_payload_too_large");
 	return payload;
 }
-//#endregion
-//#region src/mobile-push/retention.ts
+// src/mobile-push/retention.ts
 /** Pure defer-membership retention helpers shared by delivery maintenance. */
 /** Removes deferred-recheck entries whose owning pending intent no longer exists; returns how many were removed. */
 function pruneOrphanedDeferrals(deferred, pending) {
@@ -21981,8 +22095,7 @@ function pruneOrphanedDeferrals(deferred, pending) {
 	}
 	return removed;
 }
-//#endregion
-//#region src/mobile-push/sender.ts
+// src/mobile-push/sender.ts
 const MAX_RESPONSE_BYTES = 8192;
 const MAX_TTL_SECONDS = 1800;
 const CONTENT_ENCODING = "aes128gcm";
@@ -22268,8 +22381,7 @@ var PushSender = class {
 		}
 	}
 };
-//#endregion
-//#region src/mobile-push/delivery.ts
+// src/mobile-push/delivery.ts
 const RECONCILE_INTERVAL_MS = 3e4;
 const RETRY_BACKOFF_MS = [1e3, 5e3];
 const MAX_TEST_QUEUE = 64;
@@ -23055,8 +23167,7 @@ var PushDelivery = class {
 		}, delay);
 	}
 };
-//#endregion
-//#region src/mobile-push/gateway.ts
+// src/mobile-push/gateway.ts
 /** One service shared by every Gateway while each Gateway owns a separate auth/origin attachment. */
 var PushGatewayCoordinator = class {
 	host;
@@ -23179,8 +23290,7 @@ var PushGatewayCoordinator = class {
 		return true;
 	}
 };
-//#endregion
-//#region src/installation-id.ts
+// src/installation-id.ts
 const INSTALLATION_ID_PATTERN = /^[a-f0-9]{64}\n$/u;
 const INSTALLATION_ID_BYTES = 65;
 async function readInstallationId(file) {
@@ -23244,8 +23354,7 @@ async function loadOrCreateInstallationId(file) {
 		}
 	}
 }
-//#endregion
-//#region src/gateway-identity.ts
+// src/gateway-identity.ts
 /**
 * Attach the authenticated installation identity while retaining existing entry identity rules.
 * @param config - Validated gateway configuration containing the legacy identity.
@@ -23265,8 +23374,7 @@ function withInstallationIdentity(config, installationId, explicitIdentity) {
 		legacyInstanceId: config.instanceId
 	});
 }
-//#endregion
-//#region src/lan-setup.ts
+// src/lan-setup.ts
 const FIREWALL_TCP_RULE = "DSH Mobile HTTPS";
 const FIREWALL_UDP_RULE = "DSH Mobile Discovery";
 async function runElevatedPowerShell(script) {
@@ -23338,8 +23446,7 @@ async function prepareManagedLanSetup(options) {
 		androidCertificate
 	});
 }
-//#endregion
-//#region src/plugin.ts
+// src/plugin.ts
 /** Stable Cordis plugin name. */
 const name = "dsh-mobile";
 /** The stock WebServer serves the control card; Connection authenticates the loopback DSH origin. */
@@ -24281,7 +24388,8 @@ async function apply(ctx, config) {
 		}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status(), caddyComponent.status(), irohComponent.status()),
 		originMode: originController.mode(),
 		caddyConfiguration: caddyConfig.status(),
-		caddyState: caddyController.status()
+		caddyState: caddyController.status(),
+		...process.platform === "darwin" ? { macosHost: true } : {}
 	});
 	const lanPayload = () => ({
 		...loaded.kind === "unconfigured" ? {
@@ -24324,7 +24432,18 @@ async function apply(ctx, config) {
 			windowsFirewall: process.platform === "win32"
 		};
 	};
-	const diagnosticsPayload = async () => {
+	const diagnosticsPayload = async (request) => {
+		const admission = ctx.connection?.admit?.(request);
+		if (admission !== void 0 && "rejection" in admission) throw new HttpError(admission.rejection, "authentication_failed");
+		const indexCollector = ctx.webServer;
+		let indexInjections = [];
+		let indexInspectionUnavailable = false;
+		if (typeof indexCollector.collectIndexInjections === "function") try {
+			indexInjections = indexCollector.collectIndexInjections(admission?.peer);
+		} catch (inspectionError) {
+			indexInspectionUnavailable = true;
+		}
+		else indexInspectionUnavailable = true;
 		let interfaceName;
 		let networkError;
 		if (loaded.kind === "managed") try {
@@ -24354,7 +24473,8 @@ async function apply(ctx, config) {
 		} : void 0;
 		return collectConnectionDiagnostics({
 			dshVersion,
-			competingRemoteChannelBoot: hasCompetingRemoteChannelBoot(ctx.webServer.collectIndexInjections?.() ?? []),
+			competingRemoteChannelBoot: hasCompetingRemoteChannelBoot(indexInjections),
+			indexInspectionUnavailable,
 			lan: {
 				configured: loaded.kind !== "unconfigured" || preparedLanSetup !== void 0,
 				running: lanController.isRunning(),
@@ -24425,12 +24545,15 @@ async function apply(ctx, config) {
 						}
 						if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
 						const body = await readJsonObject(request, template.maxBodyBytes);
-						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules" && key !== "measure") || "measure" in body && body.measure !== true) throw new HttpError(400, "bad_request");
-						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
+						const keys = Object.keys(body);
+						const configure = keys.every((key) => key === "excludedClientModules" || key === "revision") && Object.prototype.hasOwnProperty.call(body, "excludedClientModules") && (body.revision === void 0 || typeof body.revision === "string");
+						const single = keys.length === 1 && (body.reset === true || body.measure === true);
+						if (!configure && !single) throw new HttpError(400, "bad_request");
+						sendJson(response, 200, body.measure === true ? await gateway.measureClientModules(void 0, operation.signal) : body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal, typeof body.revision === "string" ? body.revision : void 0), false);
 					} catch (error) {
 						if (!(error instanceof ClientModuleConflictError)) throw error;
 						sendJson(response, 409, {
-							error: "excluded_client_modules_invalid",
+							error: error.code,
 							detail: error.detail
 						}, false);
 					} finally {
@@ -24461,7 +24584,7 @@ async function apply(ctx, config) {
 					return;
 				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/diagnostics`) {
-					sendJson(response, 200, await diagnosticsPayload(), false);
+					sendJson(response, 200, await diagnosticsPayload(request), false);
 					return;
 				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/release`) {
@@ -24764,7 +24887,12 @@ async function apply(ctx, config) {
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/configure`) {
 					const body = await readJsonObject(request, 4096);
 					await remoteProviders.mutate(async () => {
-						await frpConfig.configure(body);
+						const saved = frpConfig.settings();
+						const reuseToken = body.token === "" && saved !== void 0 && body.serverAddress === saved.serverAddress && body.serverPort === saved.serverPort;
+						await frpConfig.configure(reuseToken ? {
+							...body,
+							token: saved.token
+						} : body);
 						if (remoteControllers.frp.status().enabled) await remoteControllers.frp.reconnect();
 					});
 					sendJson(response, 200, remotePayload(), false);
@@ -24811,10 +24939,7 @@ async function apply(ctx, config) {
 					});
 					let qrSvg = "";
 					try {
-						qrSvg = await QRCode.toString(pairing.encoded, {
-							type: "svg",
-							margin: 1
-						});
+						qrSvg = await renderIrohPairingQr(pairing.encoded);
 					} catch {}
 					logger.info("iroh pairing window opened");
 					sendJson(response, 201, {
@@ -25146,7 +25271,6 @@ async function apply(ctx, config) {
 		};
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
-//#endregion
 export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CPOLAR_COMPONENT_RELEASE, CPOLAR_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, CpolarComponentManager, DEFAULT_IROH_LOCAL_PORT, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, IROH_COMPONENT_RELEASES, IROH_LEAF_RENEW_BEFORE_DAYS, IROH_LEAF_VALIDITY_DAYS, IROH_VERSION, IrohComponentManager, IrohController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_PAIRING_DESCRIPTOR_BYTES, MAX_PAIRING_LIFETIME_MS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, PAIRING_DESCRIPTOR_LOCAL_PORT, PAIRING_DESCRIPTOR_TYPE, PAIRING_DESCRIPTOR_VERSION, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, decodePairingDescriptor, encodePairingDescriptor, ensureFrpIngressCertificate, ensureIrohTls, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, irohGatewayConfig, irohHostname, irohOrigin, irohTlsPaths, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, resolveHostExecution, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateIrohOrigin, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validatePairingDescriptor, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map