dsh-mobile 0.8.2 → 0.8.4

package/lib/client.js

@@ -1160,6 +1160,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "Enlarge the QR code",
 			closeEnlargedQr: "Close the enlarged QR code",
 			irohPairingReady: "iroh pairing code {code} is live for five minutes. Scan it from the iroh pairing screen; opening another code replaces this one.",
+			irohPairingCopyOnly: "The QR image could not be generated. Copy the pairing link and paste it into the App’s iroh pairing screen.",
 			irohDescription: "Peer-to-peer encrypted link with relay fallback. No domain, port or account needed; requires the full Android App.",
 			prepareIroh: "Prepare iroh",
 			irohInstallNote: "The Install button downloads the pinned sidecar release (dsh-mobile-iroh 0.1.0-alpha.1, about 15 MB on Windows x64, 24 MB on Linux x64) into the plugin private directory and verifies its SHA-256. An installed companion with a verified copy is reused instead, with no download.",
@@ -1194,6 +1195,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "Ingrandisci il codice QR",
 			closeEnlargedQr: "Chiudi il codice QR ingrandito",
 			irohPairingReady: "Il codice iroh {code} è attivo per cinque minuti. Scansionalo dalla schermata di abbinamento iroh; aprirne un altro sostituisce questo.",
+			irohPairingCopyOnly: "Impossibile generare il codice QR. Copia il link di abbinamento e incollalo nella schermata di abbinamento iroh dell’app.",
 			irohDescription: "Collegamento cifrato peer-to-peer con ripiego su relay. Nessun dominio, porta o account richiesto; richiede l’App Android completa.",
 			prepareIroh: "Prepara iroh",
 			irohInstallNote: "Il pulsante Installa scarica la release pinnata del sidecar (dsh-mobile-iroh 0.1.0-alpha.1, circa 15 MB su Windows x64, 24 MB su Linux x64) nella directory privata del plugin e ne verifica lo SHA-256. Un complemento installato con una copia verificata viene invece riutilizzato senza scaricare nulla.",
@@ -1228,6 +1230,7 @@ window.__ModuleLoader__.load({
 			enlargeQr: "放大二维码",
 			closeEnlargedQr: "关闭放大的二维码",
 			irohPairingReady: "iroh 配对码 {code} 已生效，有效期 5 分钟。请在 App 的 iroh 配对页扫码；再生成一个会替换当前这个。",
+			irohPairingCopyOnly: "未能生成二维码。可复制配对链接，粘贴到 App 的 iroh 配对页。",
 			irohDescription: "点对点加密直连，跨网自动经中继。无需域名、端口或账号；需完整版 App。",
 			prepareIroh: "准备 iroh",
 			irohInstallNote: "点击安装会下载固定的 sidecar 发行版（dsh-mobile-iroh 0.1.0-alpha.1，Windows x64 约 15 MB，Linux x64 约 24 MB）到插件私有目录并校验 SHA-256；已安装的配套插件如有校验通过的副本会直接复用，不再下载。",
@@ -2042,6 +2045,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "The loopback plaintext vhost port of your own frps (upstream default 7080).",
 			frpPublicPort: "Public entry port",
 			frpPublicPortHint: "Raw TCP proxy port used as the public HTTPS entry (default 33080, never 3080/3443/3444).",
+			frpUser: "frpc user (optional)",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel is listening. Verify public access from a network outside this tailnet.",
+			macosFolderHelpTitle: "Before leaving this Mac",
+			macosFolderHelpNote: "Open the workspace folder you plan to use in DSH on this Mac and respond to any macOS prompt. In System Settings → Privacy & Security → Files and Folders, allow only the locations you need. If opening a folder remotely times out, check this Mac for a pending prompt before changing the pairing.",
+			frpUserHint: "Optional user field of shared frps services: the proxy registers as user.proxyName. Leave blank to omit it.",
+			frpUserInvalid: "The user must be 1–128 letters, digits, dots, underscores, or hyphens.",
 			frpAttachPlan: "Copy attach runbook",
 			frpAttachPlanCopied: "Attach runbook copied: local frpc.toml plus the VPS checklist.",
 			frpAttachPlanFailed: "Could not build the attach runbook: {error}",
@@ -2095,6 +2105,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "Porta vhost in chiaro su loopback del tuo frps (predefinita 7080).",
 			frpPublicPort: "Porta pubblica di ingresso",
 			frpPublicPortHint: "Porta del proxy TCP grezzo usata come ingresso HTTPS pubblico (predefinita 33080, mai 3080/3443/3444).",
+			frpUser: "Utente frpc (facoltativo)",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel è in ascolto. Verifica l’accesso pubblico da una rete esterna alla tailnet.",
+			macosFolderHelpTitle: "Prima di lasciare il Mac",
+			macosFolderHelpNote: "Apri in DSH su questo Mac la cartella di lavoro che userai e rispondi alle eventuali richieste di macOS. In Impostazioni di Sistema → Privacy e sicurezza → File e cartelle, autorizza solo le posizioni necessarie. Se una cartella non si apre da remoto per un timeout, controlla se sul Mac c’è una richiesta in attesa prima di modificare l’abbinamento.",
+			frpUserHint: "Campo utente facoltativo dei servizi frps condivisi: il proxy si registra come user.nomeproxy. Lascia vuoto per ometterlo.",
+			frpUserInvalid: "L’utente deve essere di 1–128 lettere, cifre, punti, trattini bassi o trattini.",
 			frpAttachPlan: "Copia il runbook attach",
 			frpAttachPlanCopied: "Runbook attach copiato: frpc.toml locale più la checklist VPS.",
 			frpAttachPlanFailed: "Impossibile creare il runbook attach: {error}",
@@ -2148,6 +2165,13 @@ window.__ModuleLoader__.load({
 			frpVhostHttpPortHint: "你自己 frps 的回环明文 vhost 端口（上游默认 7080）。",
 			frpPublicPort: "公网入口端口",
 			frpPublicPortHint: "作为公网 HTTPS 入口的 TCP 透传端口（默认 33080，不得为 3080/3443/3444）。",
+			frpUser: "用户名（可选）",
+			frpUserPlaceholder: "myfrpuser",
+			funnelListenerReady: "Funnel 已启动监听。请在此 tailnet 之外的网络验证公网访问。",
+			macosFolderHelpTitle: "离开这台 Mac 前",
+			macosFolderHelpNote: "先在这台 Mac 的 DSH 中打开远程会用到的工作区目录，处理可能出现的系统提示。在「系统设置 → 隐私与安全性 → 文件与文件夹」只授权需要的位置。手机打开文件夹超时时，先检查 Mac 上是否有待确认提示，不要急着重新配对。",
+			frpUserHint: "共享 frp 服务的可选 user 字段：代理会以「用户名.代理名」注册。留空则不发送。",
+			frpUserInvalid: "用户名只能包含 1–128 个字母、数字、点、下划线或连字符。",
 			frpAttachPlan: "复制接入清单",
 			frpAttachPlanCopied: "接入清单已复制：本机 frpc.toml 与 VPS 侧待办。",
 			frpAttachPlanFailed: "生成接入清单失败：{error}",
@@ -2466,7 +2490,8 @@ window.__ModuleLoader__.load({
 			"mode",
 			"entryTls",
 			"vhostHttpPort",
-			"publicPort"
+			"publicPort",
+			"user"
 		]);
 		function hostname(value) {
 			if (value.length > 253 || !value.includes(".")) return false;
@@ -2489,6 +2514,11 @@ window.__ModuleLoader__.load({
 			if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
 			return value;
 		}
+		/** Validate the optional frpc `user` field; it must stay one safe TOML token. */
+		function validateFrpUser(value) {
+			if (typeof value !== "string" || value.length < 1 || value.length > 128 || !/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error("frp_user_invalid");
+			return value;
+		}
 		/** Validate the public HTTPS origin used by Caddy and Android pairing. */
 		function validateFrpPublicOrigin(value) {
 			if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
@@ -2566,6 +2596,7 @@ window.__ModuleLoader__.load({
 			const entryTls = record.entryTls === void 0 ? void 0 : validateFrpEntryTls(record.entryTls);
 			const vhostHttpPort = record.vhostHttpPort === void 0 ? void 0 : validateFrpVhostHttpPort(record.vhostHttpPort);
 			const publicPort = record.publicPort === void 0 ? void 0 : validateFrpPublicPort(record.publicPort);
+			const user = record.user === void 0 || record.user === "" ? void 0 : validateFrpUser(record.user);
 			const resolvedMode = mode ?? "deploy";
 			const resolvedEntryTls = entryTls ?? "public-ip-cert";
 			if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
@@ -2581,7 +2612,8 @@ window.__ModuleLoader__.load({
 				...mode === void 0 ? {} : { mode },
 				...entryTls === void 0 ? {} : { entryTls },
 				...vhostHttpPort === void 0 ? {} : { vhostHttpPort },
-				...publicPort === void 0 ? {} : { publicPort }
+				...publicPort === void 0 ? {} : { publicPort },
+				...user === void 0 ? {} : { user }
 			});
 		}
 		function tomlString(value) {
@@ -2627,6 +2659,7 @@ window.__ModuleLoader__.load({
 				`serverPort = ${String(settings.serverPort)}`,
 				"auth.method = \"token\"",
 				`auth.token = ${tomlString(settings.token)}`,
+				...settings.user === void 0 ? [] : [`user = ${tomlString(settings.user)}`],
 				"transport.tls.enable = true",
 				"",
 				"[[proxies]]",
@@ -2874,6 +2907,11 @@ window.__ModuleLoader__.load({
 				code: "frp_public_origin_invalid",
 				messageKey: "frpPublicOriginInvalid"
 			},
+			frp_user_invalid: {
+				field: "user",
+				code: "frp_user_invalid",
+				messageKey: "frpUserInvalid"
+			},
 			frp_attach_mode_requires_vhost_port: {
 				field: "vhostHttpPort",
 				code: "frp_attach_mode_requires_vhost_port",
@@ -2907,6 +2945,7 @@ window.__ModuleLoader__.load({
 			check("serverAddress", "frpServerAddressInvalid", () => validateFrpServerAddress(form.serverAddress));
 			check("serverPort", "frpServerPortInvalid", () => validateFrpServerPort(form.serverPort));
 			if (form.token !== "" || !allowSavedToken) check("token", "frpTokenInvalid", () => validateFrpToken(form.token));
+			if (form.user !== void 0 && form.user !== "") check("user", "frpUserInvalid", () => validateFrpUser(form.user));
 			check("publicOrigin", "frpPublicOriginInvalid", () => validateFrpPublicOrigin(form.publicOrigin));
 			check("mode", "frpModeInvalid", () => validateFrpMode(form.mode));
 			check("entryTls", "frpEntryTlsInvalid", () => validateFrpEntryTls(form.entryTls));
@@ -2929,45 +2968,173 @@ window.__ModuleLoader__.load({
 			}
 			return issues;
 		}
-		// node_modules/@noble/hashes/esm/utils.js
-		/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-		/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+		// node_modules/@noble/hashes/_u64.js
+		const fromNumH = (n) => n / 2 ** 32 | 0;
+		const fromNumL = (n) => n >>> 0;
+		function setU64FromNum(view, byteOffset, n, isLE) {
+			const h = fromNumH(n);
+			const l = fromNumL(n);
+			view.setUint32(byteOffset, isLE ? l : h, isLE);
+			view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+		}
+		// node_modules/@noble/hashes/utils.js
+		/**
+		* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+		* @param a - value to test
+		* @returns `true` when the value is a Uint8Array-compatible view.
+		* @example
+		* Check whether a value is a Uint8Array-compatible view.
+		* ```ts
+		* isBytes(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
 		function isBytes(a) {
-			return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+			return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 		}
-		/** Asserts something is Uint8Array. */
-		function abytes(b, ...lengths) {
-			if (!isBytes(b)) throw new Error("Uint8Array expected");
-			if (lengths.length > 0 && !lengths.includes(b.length)) throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+		const atitle = (title) => title ? `"${title}" ` : "";
+		/**
+		* Asserts something is a non-negative integer.
+		* @param n - number to validate
+		* @param title - label included in thrown errors
+		* @returns The validated number.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate a non-negative integer option.
+		* ```ts
+		* anumber(32, 'length');
+		* ```
+		*/
+		function anumber(n, title = "") {
+			if (typeof n !== "number") throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+			if (!Number.isSafeInteger(n) || n < 0) throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+			return n;
 		}
-		/** Asserts a hash instance has not been destroyed / finished */
+		/**
+		* Asserts something is Uint8Array.
+		* @param value - value to validate
+		* @param length - optional exact length constraint
+		* @param title - label included in thrown errors
+		* @returns The validated byte array.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate that a value is a byte array.
+		* ```ts
+		* abytes(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
+		function abytes(value, length, title = "") {
+			if (isBytes(value) && (length === void 0 || value.length === length)) return value;
+			if (length !== void 0) anumber(length, "length");
+			const bytes = isBytes(value);
+			const ofLen = length !== void 0 ? ` of length ${length}` : "";
+			const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+			const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+			if (!bytes) throw new TypeError(message);
+			throw new RangeError(message);
+		}
+		const aobject = (value, label) => {
+			if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+		};
+		const aopts = (value, label) => {
+			aobject(value, label);
+			const proto = Object.getPrototypeOf(value);
+			if (proto !== Object.prototype && proto !== null) throw new TypeError(`"${label}" expected plain object`);
+			if (Object.hasOwn(value, "__proto__")) throw new TypeError(`"${label}.__proto__" is not allowed`);
+		};
+		/**
+		* Asserts a hash instance has not been destroyed or finished.
+		* @param instance - hash instance to validate
+		* @param checkFinished - whether to reject finalized instances
+		* @throws If the hash instance has already been destroyed or finalized. {@link Error}
+		* @example
+		* Validate that a hash instance is still usable.
+		* ```ts
+		* import { aexists } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const hash = sha256.create();
+		* aexists(hash);
+		* ```
+		*/
 		function aexists(instance, checkFinished = true) {
-			if (instance.destroyed) throw new Error("Hash instance has been destroyed");
-			if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
+			if (instance.destroyed) throw new Error("hash was destroyed");
+			if (checkFinished && instance.finished) throw new Error("digest() was already called");
 		}
-		/** Asserts output is properly-sized byte array */
+		/**
+		* Asserts output is a sufficiently-sized byte array.
+		* @param out - destination buffer
+		* @param instance - hash instance providing output length
+		* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+		* @throws On wrong argument types. {@link TypeError}
+		* @throws On wrong argument ranges or values. {@link RangeError}
+		* @example
+		* Validate a caller-provided digest buffer.
+		* ```ts
+		* import { aoutput } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const hash = sha256.create();
+		* aoutput(new Uint8Array(hash.outputLen), hash);
+		* ```
+		*/
 		function aoutput(out, instance) {
-			abytes(out);
+			abytes(out, void 0, "output");
 			const min = instance.outputLen;
-			if (out.length < min) throw new Error("digestInto() expects output buffer of length at least " + min);
+			if (!(out.length >= min)) throw new RangeError("\"output\" expected length >= " + min);
 		}
-		/** Zeroize a byte array. Warning: JS provides no guarantees. */
+		/**
+		* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+		* @param arrays - arrays to overwrite with zeros
+		* @example
+		* Zeroize sensitive buffers in place.
+		* ```ts
+		* clean(new Uint8Array([1, 2, 3]));
+		* ```
+		*/
 		function clean(...arrays) {
 			for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
 		}
-		/** Create DataView of an array for easy byte-level manipulation. */
+		/**
+		* Creates a DataView for byte-level manipulation.
+		* @param arr - source typed array
+		* @returns DataView over the same buffer region.
+		* @example
+		* Create a DataView over an existing buffer.
+		* ```ts
+		* createView(new Uint8Array(4));
+		* ```
+		*/
 		function createView(arr) {
 			return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 		}
-		/** The rotate right (circular right shift) operation for uint32 */
+		/**
+		* Rotate-right operation for uint32 values.
+		* @param word - source word
+		* @param shift - shift amount in bits
+		* @returns Rotated word.
+		* @example
+		* Rotate a 32-bit word to the right.
+		* ```ts
+		* rotr(0x12345678, 8);
+		* ```
+		*/
 		function rotr(word, shift) {
 			return word << 32 - shift | word >>> shift;
 		}
 		const hasHexBuiltin = /* @__PURE__ */ (() => typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function")();
 		const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
 		/**
-		* Convert byte array to hex string. Uses built-in function, when available.
-		* @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'
+		* Convert byte array to hex string.
+		* Uses the built-in function when available and assumes it matches the tested
+		* fallback semantics.
+		* @param bytes - bytes to encode
+		* @returns Lowercase hexadecimal string.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Convert bytes to lowercase hexadecimal.
+		* ```ts
+		* bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
+		* ```
 		*/
 		function bytesToHex(bytes) {
 			abytes(bytes);
@@ -2978,69 +3145,169 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* Converts string to bytes using UTF8 encoding.
-		* @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
+		* Built-in doesn't validate input to be string: we do the check.
+		* Non-ASCII details are delegated to the platform `TextEncoder`.
+		* @param str - string to encode
+		* @returns UTF-8 encoded bytes.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Encode a string as UTF-8 bytes.
+		* ```ts
+		* utf8ToBytes('abc'); // Uint8Array.from([97, 98, 99])
+		* ```
 		*/
 		function utf8ToBytes(str) {
-			if (typeof str !== "string") throw new Error("string expected");
-			return new Uint8Array(new TextEncoder().encode(str));
+			if (typeof str !== "string") throw new TypeError("string expected");
+			const encoded = new TextEncoder().encode(str);
+			try {
+				return new Uint8Array(encoded);
+			} finally {
+				clean(encoded);
+			}
 		}
 		/**
-		* Normalizes (non-hex) string or Uint8Array to Uint8Array.
-		* Warning: when Uint8Array is passed, it would NOT get copied.
-		* Keep in mind for future mutable operations.
+		* Merges default options and passed options.
+		* @param defaults - base option object
+		* @param opts - user overrides
+		* @param title - label included in thrown override errors
+		* @returns Fresh merged option object with a null prototype.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Merge user overrides onto default options.
+		* ```ts
+		* checkOpts({ dkLen: 32 }, { asyncTick: 10 });
+		* ```
 		*/
-		function toBytes(data) {
-			if (typeof data === "string") data = utf8ToBytes(data);
-			abytes(data);
-			return data;
-		}
-		/** For runtime check if class implements interface */
-		var Hash = class {};
-		/** Wraps hash function, creating an interface on top of it */
-		function createHasher(hashCons) {
-			const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-			const tmp = hashCons();
+		function checkOpts(defaults, opts, title = "opts") {
+			aopts(defaults, "defaults");
+			if (opts !== void 0) aopts(opts, title);
+			return Object.assign(Object.create(null), defaults, opts);
+		}
+		/**
+		* Creates a callable hash function from a stateful class constructor.
+		* @param hashCons - hash constructor or factory
+		* @param info - optional metadata such as DER OID
+		* @returns Frozen callable hash wrapper with `.create()`.
+		*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+		*   `outputLen` / `blockLen`, so constructor side effects happen at module
+		*   init time.
+		* @throws On wrong argument types. {@link TypeError}
+		* @example
+		* Wrap a stateful hash constructor into a callable helper.
+		* ```ts
+		* import { createHasher } from '@noble/hashes/utils.js';
+		* import { sha256 } from '@noble/hashes/sha2.js';
+		* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+		* wrapped(new Uint8Array([1]));
+		* ```
+		*/
+		function createHasher(hashCons, info = {}) {
+			if (typeof hashCons !== "function") throw new TypeError("\"hashCons\" expected function, got type=" + typeof hashCons);
+			info = checkOpts({}, info, "info");
+			const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+			const tmp = hashCons(void 0);
 			hashC.outputLen = tmp.outputLen;
 			hashC.blockLen = tmp.blockLen;
-			hashC.create = () => hashCons();
-			return hashC;
+			hashC.canXOF = tmp.canXOF;
+			hashC.create = (opts) => hashCons(opts);
+			Object.assign(hashC, info);
+			return Object.freeze(hashC);
 		}
-		// node_modules/@noble/hashes/esm/_md.js
+		/**
+		* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+		* @param suffix - final OID byte for the selected hash.
+		*   The helper accepts any byte even though only the documented NIST hash
+		*   suffixes are meaningful downstream.
+		* @returns Object containing the DER-encoded OID.
+		* @example
+		* Build OID metadata for a NIST hash.
+		* ```ts
+		* oidNist(0x01);
+		* ```
+		*/
+		const oidNist = (suffix) => ({ oid: Uint8Array.from([
+			6,
+			9,
+			96,
+			134,
+			72,
+			1,
+			101,
+			3,
+			4,
+			2,
+			suffix
+		]) });
+		// node_modules/@noble/hashes/_md.js
 		/**
 		* Internal Merkle-Damgard hash utils.
 		* @module
 		*/
-		/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */
-		function setBigUint64(view, byteOffset, value, isLE) {
-			if (typeof view.setBigUint64 === "function") return view.setBigUint64(byteOffset, value, isLE);
-			const _32n = BigInt(32);
-			const _u32_max = BigInt(4294967295);
-			const wh = Number(value >> _32n & _u32_max);
-			const wl = Number(value & _u32_max);
-			const h = isLE ? 4 : 0;
-			const l = isLE ? 0 : 4;
-			view.setUint32(byteOffset + h, wh, isLE);
-			view.setUint32(byteOffset + l, wl, isLE);
-		}
-		/** Choice: a ? b : c */
+		/**
+		* Shared 32-bit conditional boolean primitive reused by SHA-256, SHA-1, and MD5 `F`.
+		* Returns bits from `b` when `a` is set, otherwise from `c`.
+		* The XOR form is equivalent to MD5's `F(X,Y,Z) = XY v not(X)Z` because the masked terms never
+		* set the same bit.
+		* @param a - selector word
+		* @param b - word chosen when selector bit is set
+		* @param c - word chosen when selector bit is clear
+		* @returns Mixed 32-bit word.
+		* @example
+		* Combine three words with the shared 32-bit choice primitive.
+		* ```ts
+		* Chi(0xffffffff, 0x12345678, 0x87654321);
+		* ```
+		*/
 		function Chi(a, b, c) {
 			return a & b ^ ~a & c;
 		}
-		/** Majority function, true if any two inputs is true. */
+		/**
+		* Shared 32-bit majority primitive reused by SHA-256 and SHA-1.
+		* Returns bits shared by at least two inputs.
+		* @param a - first input word
+		* @param b - second input word
+		* @param c - third input word
+		* @returns Mixed 32-bit word.
+		* @example
+		* Combine three words with the shared 32-bit majority primitive.
+		* ```ts
+		* Maj(0xffffffff, 0x12345678, 0x87654321);
+		* ```
+		*/
 		function Maj(a, b, c) {
 			return a & b ^ a & c ^ b & c;
 		}
 		/**
 		* Merkle-Damgard hash construction base class.
 		* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+		* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+		* strings with partial-byte tails.
+		* @param blockLen - internal block size in bytes
+		* @param outputLen - digest size in bytes
+		* @param padOffset - trailing length field size in bytes
+		* @param isLE - whether length and state words are encoded in little-endian
+		* @example
+		* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+		* ```ts
+		* import { _SHA1 } from '@noble/hashes/legacy.js';
+		* const hash = new _SHA1();
+		* hash.update(new Uint8Array([97, 98, 99]));
+		* hash.digest();
+		* ```
 		*/
-		var HashMD = class extends Hash {
+		var HashMD = class {
+			blockLen;
+			outputLen;
+			canXOF = false;
+			padOffset;
+			isLE;
+			buffer;
+			view;
+			finished = false;
+			length = 0;
+			pos = 0;
+			destroyed = false;
 			constructor(blockLen, outputLen, padOffset, isLE) {
-				super();
-				this.finished = false;
-				this.length = 0;
-				this.pos = 0;
-				this.destroyed = false;
 				this.blockLen = blockLen;
 				this.outputLen = outputLen;
 				this.padOffset = padOffset;
@@ -3050,27 +3317,29 @@ window.__ModuleLoader__.load({
 			}
 			update(data) {
 				aexists(this);
-				data = toBytes(data);
 				abytes(data);
 				const { view, buffer, blockLen } = this;
 				const len = data.length;
+				let processed = false;
 				for (let pos = 0; pos < len;) {
 					const take = Math.min(blockLen - this.pos, len - pos);
 					if (take === blockLen) {
 						const dataView = createView(data);
 						for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+						processed = true;
 						continue;
 					}
-					buffer.set(data.subarray(pos, pos + take), this.pos);
+					buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
 					this.pos += take;
 					pos += take;
 					if (this.pos === blockLen) {
 						this.process(view, 0);
 						this.pos = 0;
+						processed = true;
 					}
 				}
 				this.length += data.length;
-				this.roundClean();
+				if (processed) this.roundClean();
 				return this;
 			}
 			digestInto(out) {
@@ -3080,20 +3349,19 @@ window.__ModuleLoader__.load({
 				const { buffer, view, blockLen, isLE } = this;
 				let { pos } = this;
 				buffer[pos++] = 128;
-				clean(this.buffer.subarray(pos));
+				buffer.fill(0, pos);
 				if (this.padOffset > blockLen - pos) {
 					this.process(view, 0);
-					pos = 0;
+					buffer.fill(0);
 				}
-				for (let i = pos; i < blockLen; i++) buffer[i] = 0;
-				setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+				setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
 				this.process(view, 0);
-				const oview = createView(out);
+				this.roundClean();
+				const oview = out === buffer ? view : createView(out);
 				const len = this.outputLen;
-				if (len % 4) throw new Error("_sha2: outputLen should be aligned to 32bit");
 				const outLen = len / 4;
 				const state = this.get();
-				if (outLen > state.length) throw new Error("_sha2: outputLen bigger than state");
+				if (len % 4 || outLen > state.length) throw new Error("invalid outputLen");
 				for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
 			}
 			digest() {
@@ -3103,15 +3371,13 @@ window.__ModuleLoader__.load({
 				this.destroy();
 				return res;
 			}
-			_cloneInto(to) {
-				to || (to = new this.constructor());
-				to.set(...this.get());
-				const { blockLen, buffer, length, finished, destroyed, pos } = this;
+			_cloneIntoMeta(to) {
+				const { buffer, length, finished, destroyed, pos } = this;
 				to.destroyed = destroyed;
 				to.finished = finished;
 				to.length = length;
 				to.pos = pos;
-				if (length % blockLen) to.buffer.set(buffer);
+				if (pos) to.buffer.set(buffer);
 				return to;
 			}
 			clone() {
@@ -3122,7 +3388,9 @@ window.__ModuleLoader__.load({
 		* Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
 		* Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
 		*/
-		/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */
+		/** Initial SHA256 state from RFC 6234 §6.1: the first 32 bits of the fractional parts of the
+		* square roots of the first eight prime numbers. Exported as a shared table; callers must treat
+		* it as read-only because constructors copy words from it by index. */
 		const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
 			1779033703,
 			3144134277,
@@ -3133,17 +3401,17 @@ window.__ModuleLoader__.load({
 			528734635,
 			1541459225
 		]);
-		// node_modules/@noble/hashes/esm/sha2.js
+		// node_modules/@noble/hashes/sha2.js
 		/**
 		* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
 		* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
-		* Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and
-		* [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
+		* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+		* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
 		* @module
 		*/
 		/**
-		* Round constants:
-		* First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)
+		* SHA-224 / SHA-256 round constants from RFC 6234 §5.1: the first 32 bits
+		* of the cube roots of the first 64 primes (2..311).
 		*/
 		const SHA256_K = /* @__PURE__ */ Uint32Array.from([
 			1116352408,
@@ -3211,19 +3479,28 @@ window.__ModuleLoader__.load({
 			3204031479,
 			3329325298
 		]);
-		/** Reusable temporary buffer. "W" comes straight from spec. */
+		/** Reusable SHA-224 / SHA-256 message schedule buffer `W_t` from RFC 6234 §6.2 step 1. */
 		const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-		var SHA256 = class extends HashMD {
-			constructor(outputLen = 32) {
+		/** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
+		var SHA2_32B = class extends HashMD {
+			A = 0;
+			B = 0;
+			C = 0;
+			D = 0;
+			E = 0;
+			F = 0;
+			G = 0;
+			H = 0;
+			constructor(outputLen, IV) {
 				super(64, outputLen, 8, false);
-				this.A = SHA256_IV[0] | 0;
-				this.B = SHA256_IV[1] | 0;
-				this.C = SHA256_IV[2] | 0;
-				this.D = SHA256_IV[3] | 0;
-				this.E = SHA256_IV[4] | 0;
-				this.F = SHA256_IV[5] | 0;
-				this.G = SHA256_IV[6] | 0;
-				this.H = SHA256_IV[7] | 0;
+				this.A = IV[0] | 0;
+				this.B = IV[1] | 0;
+				this.C = IV[2] | 0;
+				this.D = IV[3] | 0;
+				this.E = IV[4] | 0;
+				this.F = IV[5] | 0;
+				this.G = IV[6] | 0;
+				this.H = IV[7] | 0;
 			}
 			get() {
 				const { A, B, C, D, E, F, G, H } = this;
@@ -3248,6 +3525,10 @@ window.__ModuleLoader__.load({
 				this.G = G | 0;
 				this.H = H | 0;
 			}
+			_cloneInto(to) {
+				(to ||= new this.constructor()).set(...this.get());
+				return this._cloneIntoMeta(to);
+			}
 			process(view, offset) {
 				for (let i = 0; i < 16; i++, offset += 4) SHA256_W[i] = view.getUint32(offset, false);
 				for (let i = 16; i < 64; i++) {
@@ -3285,23 +3566,34 @@ window.__ModuleLoader__.load({
 				clean(SHA256_W);
 			}
 			destroy() {
+				this.destroyed = true;
 				this.set(0, 0, 0, 0, 0, 0, 0, 0);
 				clean(this.buffer);
 			}
 		};
-		// node_modules/@noble/hashes/esm/sha256.js
+		/** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
+		var _SHA256 = class extends SHA2_32B {
+			constructor() {
+				super(32, SHA256_IV);
+			}
+		};
 		/**
-		* SHA2-256 a.k.a. sha256. In JS, it is the fastest hash, even faster than Blake3.
+		* SHA2-256 hash function from RFC 4634. In JS it's the fastest: even faster than Blake3. Some info:
 		*
-		* To break sha256 using birthday attack, attackers need to try 2^128 hashes.
-		* BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
-		*
-		* Check out [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
-		* @module
-		* @deprecated
+		* - Trying 2^128 hashes would get 50% chance of collision, using birthday attack.
+		* - BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
+		* - Each sha256 hash is executing 2^18 bit operations.
+		* - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
+		* @param msg - message bytes to hash
+		* @param opts - Reserved hash options.
+		* @returns Digest bytes.
+		* @example
+		* Hash a message with SHA2-256.
+		* ```ts
+		* sha256(new Uint8Array([97, 98, 99]));
+		* ```
 		*/
-		/** @deprecated Use import from `noble/hashes/sha2` module */
-		const sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+		const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), /* @__PURE__ */ oidNist(1));
 		Object.freeze({
 			title: 80,
 			body: 200,
@@ -3310,7 +3602,7 @@ window.__ModuleLoader__.load({
 		const MAX_SEEN_QUESTION_KEYS = 20;
 		/** A bounded native identifier derived from the complete, case-sensitive wire ID. */
 		function notificationIdentity(value) {
-			return bytesToHex(sha256(JSON.stringify(value)).subarray(0, 16));
+			return bytesToHex(sha256(utf8ToBytes(JSON.stringify(value))).subarray(0, 16));
 		}
 		/** Stable per-turn tag so concurrent sessions keep separate notifications. */
 		function taskCompletionTag(sessionId, turn) {
@@ -3755,6 +4047,20 @@ window.__ModuleLoader__.load({
 				}
 			});
 		}
+		// src/mobile-layout-attributes.ts
+		/**
+		* Root marker the dedicated layout publishes for its wide/narrow band.
+		*
+		* The band depends on the device screen size, which a media query cannot read,
+		* so the layout decides it in JS and writes this attribute on `.dshm-shell`:
+		* `"1"` docks the sidebar, anything else — `"0"`, or no marker — is the overlay
+		* drawer. The stylesheet and the sidebar scroll adapter both follow the marker,
+		* so the band has exactly one owner.
+		*
+		* This module stays free of imports: the dedicated layout bundle and the native
+		* client bundle both use it, and neither should pull the other in.
+		*/
+		const WIDE_LAYOUT_ATTRIBUTE = "data-dshm-wide";
 		// src/mobile-sidebar-scroll.ts
 		function sidebarRestoreTop(snapshot, anchorTop) {
 			return Math.max(0, anchorTop === void 0 || snapshot.offset === void 0 ? snapshot.top : anchorTop - snapshot.offset);
@@ -3785,7 +4091,16 @@ window.__ModuleLoader__.load({
 		function installMobileSidebarScrollMemory() {
 			const memories = /* @__PURE__ */ new Map();
 			const stockViewport = window.matchMedia("(max-width:720px)");
-			const dedicatedViewport = window.matchMedia("(max-width:899px)");
+			/**
+			* Whether the dedicated layout currently renders the sidebar as an overlay
+			* drawer. That is the layout's own decision on the shell — a landscape phone
+			* is an overlay there although its viewport is wide — so a width query would
+			* disable this memory exactly where the drawer is hardest to reach.
+			*/
+			const drawerBand = () => {
+				const shell = document.querySelector(".dshm-shell");
+				return shell === null || shell.getAttribute("data-dshm-wide") !== "1";
+			};
 			let root;
 			let open = false;
 			let ports = /* @__PURE__ */ new Map();
@@ -3836,7 +4151,7 @@ window.__ModuleLoader__.load({
 			const sync = () => {
 				if (disposed) return;
 				const next = document.querySelector("[data-dsh-mobile-sidebar-root]") ?? void 0;
-				const mobile = next?.closest("[data-pane=\"sidebar\"]") != null ? dedicatedViewport.matches : stockViewport.matches;
+				const mobile = next?.closest("[data-pane=\"sidebar\"]") != null ? drawerBand() : stockViewport.matches;
 				if (next !== root) {
 					cancel();
 					ports.clear();
@@ -3881,7 +4196,6 @@ window.__ModuleLoader__.load({
 				remember();
 			};
 			stockViewport.addEventListener("change", sync);
-			dedicatedViewport.addEventListener("change", sync);
 			document.addEventListener("scroll", onScroll, true);
 			for (const type of [
 				"pointerdown",
@@ -3896,7 +4210,6 @@ window.__ModuleLoader__.load({
 					disposed = true;
 					cancel();
 					stockViewport.removeEventListener("change", sync);
-					dedicatedViewport.removeEventListener("change", sync);
 					document.removeEventListener("scroll", onScroll, true);
 					for (const type of [
 						"pointerdown",
@@ -5696,7 +6009,8 @@ window.__ModuleLoader__.load({
 					"readonly",
 					"aria-busy",
 					"aria-selected",
-					"data-dsh-mobile-session"
+					"data-dsh-mobile-session",
+					WIDE_LAYOUT_ATTRIBUTE
 				]
 			});
 			overlayQuery.addEventListener("change", schedule);
@@ -9516,11 +9830,15 @@ window.__ModuleLoader__.load({
 			};
 			return (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_row",
-				style: { flexWrap: "wrap" },
+				style: {
+					flexDirection: "column",
+					alignItems: "stretch",
+					gap: 12
+				},
 				lang: locale === "zh" ? "zh-CN" : locale
 			}, (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_rowText",
-				style: { paddingRight: 8 }
+				style: { paddingRight: 0 }
 			}, (0, react.createElement)("div", { className: "dsh-mobile-settings_title" }, copy.title), (0, react.createElement)("div", {
 				className: "dsh-mobile-settings_desc",
 				"aria-live": "polite"
@@ -10789,6 +11107,23 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					if (!escape.defaultPrevented) blocked();
 					return;
 				}
+				if (top.getAttribute("data-shortcut-modal") === "sidebar" && top.closest("[data-sidebar-drawer]") !== null) {
+					if (layers.some((layer) => layer !== top && !top.contains(layer))) {
+						blocked();
+						return;
+					}
+					const focused = page.activeElement;
+					const target = focused !== null && top.contains(focused) ? focused : top;
+					const escape = new KeyboardEvent("keydown", {
+						key: "Escape",
+						code: "Escape",
+						bubbles: true,
+						cancelable: true
+					});
+					target.dispatchEvent(escape);
+					if (!escape.defaultPrevented) blocked();
+					return;
+				}
 				if (top.getAttribute("role") === "dialog") {
 					const wrapper = top.parentElement;
 					const mask = wrapper?.firstElementChild;
@@ -11147,7 +11482,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				mode: "attach",
 				entryTls: form.entryTls,
 				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+				...form.user === void 0 || form.user === "" ? {} : { user: form.user }
 			});
 		}
 		/**
@@ -12071,6 +12407,16 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpToken.autocomplete = "off";
 			frpToken.spellcheck = false;
 			frpToken.placeholder = t("frpTokenPlaceholder");
+			const frpUserLabel = element("label", "dsh-mobile-control__field");
+			frpUserLabel.textContent = t("frpUser");
+			const frpUser = element("input");
+			frpUser.type = "text";
+			frpUser.autocomplete = "off";
+			frpUser.spellcheck = false;
+			frpUser.placeholder = t("frpUserPlaceholder");
+			const frpUserHint = element("p", "dsh-mobile-control__frp-hint");
+			frpUserHint.textContent = t("frpUserHint");
+			frpUserLabel.append(frpUser, frpUserHint);
 			const frpOriginLabel = element("label", "dsh-mobile-control__field");
 			frpOriginLabel.textContent = t("frpPublicOrigin");
 			const frpOrigin = element("input");
@@ -12133,6 +12479,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: frpServer,
 				serverPort: frpPort,
 				token: frpToken,
+				user: frpUser,
 				publicOrigin: frpOrigin,
 				mode: frpMode,
 				entryTls: frpEntryTls,
@@ -12143,6 +12490,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: frpServerLabel,
 				serverPort: frpPortLabel,
 				token: frpTokenLabel,
+				user: frpUserLabel,
 				publicOrigin: frpOriginLabel,
 				mode: frpModeLabel,
 				entryTls: frpEntryTlsLabel,
@@ -12153,6 +12501,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				serverAddress: "frpServerAddress",
 				serverPort: "frpServerPort",
 				token: "frpToken",
+				user: "frpUser",
 				publicOrigin: "frpPublicOrigin",
 				mode: "frpMode",
 				entryTls: "frpEntryTls",
@@ -12175,7 +12524,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpOriginHint.textContent = t("frpPublicOriginHint");
 			frpOriginLabel.append(frpOriginHint);
 			frpOrigin.setAttribute("aria-describedby", `${frpOriginHint.id} ${frpOrigin.getAttribute("aria-describedby") ?? ""}`);
-			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpOriginLabel, frpModeLabel, frpEntryTlsLabel, frpVhostLabel, frpPublicPortLabel);
+			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpUserLabel, frpOriginLabel, frpModeLabel, frpEntryTlsLabel, frpVhostLabel, frpPublicPortLabel);
 			frpStep1.append(frpStep1Title, frpStep1Text, frpFields);
 			const frpStep2 = element("section", "dsh-mobile-control__frp-step");
 			const frpStep2Title = element("strong");
@@ -12535,6 +12884,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			const irohQr = element("div", "dsh-mobile-control__qr is-expandable");
 			irohQr.hidden = true;
 			const irohPairStatus = element("p", "dsh-mobile-control__component-status");
+			irohPairStatus.setAttribute("aria-live", "polite");
 			const irohCopyDescriptor = element("button", "dsh-mobile-control__secondary");
 			irohCopyDescriptor.type = "button";
 			irohCopyDescriptor.textContent = t("copyPairLink");
@@ -12864,6 +13214,16 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				disclosure.hidden = true;
 				setupDetailsRow.append(disclosure);
 			}
+			const macosFolderHelp = element("details", "dsh-mobile-control__details");
+			macosFolderHelp.hidden = true;
+			const macosFolderHelpSummary = element("summary");
+			macosFolderHelpSummary.textContent = t("macosFolderHelpTitle");
+			const macosFolderHelpBody = element("div", "dsh-mobile-control__details-body");
+			const macosFolderHelpNote = element("p");
+			macosFolderHelpNote.textContent = t("macosFolderHelpNote");
+			macosFolderHelpBody.append(macosFolderHelpNote);
+			macosFolderHelp.append(macosFolderHelpSummary, macosFolderHelpBody);
+			setupDetailsRow.append(macosFolderHelp);
 			remoteWorkspace.append(remoteStatus, remoteAccess, remoteGuide, providerSetupBody, remoteQr, pairingValidity, providerInstallRow, remoteActions, remotePairLink, setupDetailsRow);
 			const diagnosticsView = element("div", "dsh-mobile-control__view is-diagnostics");
 			diagnosticsView.hidden = true;
@@ -13013,6 +13373,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			let configuredFrpOrigin = "";
 			let configuredFrpVhostPort = 7080;
 			let configuredFrpPublicPort = 33080;
+			let configuredFrpUser = "";
+			let frpUserDraft = false;
 			/** Proxy name the host writes into its frpc.toml; the local clipboard copy must match. */
 			let configuredFrpProxyName;
 			let frpConfiguredMode = "deploy";
@@ -13390,6 +13752,17 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				irohQr.hidden = false;
 				irohQr.append(placeholder);
 			};
+			const clearIrohPairing = () => {
+				activeIrohDescriptor = "";
+				activeIrohPairExpiresAt = 0;
+				activeIrohQrSvg = "";
+				clearQrTarget(irohQr);
+				irohQr.hidden = true;
+				const wasZoomed = !irohQrZoom.hidden;
+				setIrohQrZoomOpen(false);
+				irohQrZoomImage.removeAttribute("src");
+				if (wasZoomed && !irohPair.disabled && !irohPair.hidden) irohPair.focus();
+			};
 			const showRemoteQrPlaceholder = (text) => {
 				clearQrTarget(remoteQr);
 				const placeholder = element("span", "dsh-mobile-control__qr-placeholder");
@@ -13661,6 +14034,9 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				if (frpConfigured && !frpEntryTlsDraft) frpEntryTls.value = configuredFrpEntryTls;
 				if (typeof frpConfiguration.vhostHttpPort === "number") configuredFrpVhostPort = frpConfiguration.vhostHttpPort;
 				if (typeof frpConfiguration.publicPort === "number") configuredFrpPublicPort = frpConfiguration.publicPort;
+				configuredFrpUser = typeof frpConfiguration.user === "string" ? frpConfiguration.user : "";
+				if (!frpUserDraft) frpUser.value = configuredFrpUser;
+				else if (frpUser.value.trim() === configuredFrpUser) frpUserDraft = false;
 				configuredFrpProxyName = typeof frpConfiguration.proxyName === "string" && frpConfiguration.proxyName !== "" ? frpConfiguration.proxyName : void 0;
 				if (!frpVhostDraft) {
 					if (frpMode.value === "attach" && configuredFrpMode === "attach" && configuredFrpEntryTls === "public-ip-cert") {
@@ -13825,6 +14201,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				}[errorCode] ?? "";
 				const needsFunnelSetup = state === "error" && remoteSetupUrl !== "";
 				remoteReady = remoteRunning && state === "ready" && remoteOrigin !== "";
+				macosFolderHelp.hidden = data.macosHost !== true || !remoteReady;
 				frpChoiceBadge.textContent = frpConfigured && frpInstalled ? t("ready") : t("advanced");
 				originChoiceBadge.textContent = managedOrigin ? t(remoteReady ? "ready" : "advanced") : originListening ? t("originBackendReady") : t("advanced");
 				if (remoteStatus.style) remoteStatus.style.display = state === "off" && remoteFailureText === "" ? "none" : "";
@@ -13839,7 +14216,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					starting: cpolar ? t("remoteStartingCpolar") : cloudflared ? t("remoteStartingCloudflared") : frp ? t("remoteStartingFrp") : origin ? t("originStarting") : iroh ? t("irohStarting") : t("remoteStartingTailscale"),
 					"needs-login": t("remoteNeedsLogin"),
 					connecting: cpolar ? t("remoteConnectingCpolar") : cloudflared ? t("remoteConnectingCloudflared") : frp ? t("remoteConnectingFrp") : iroh ? t("irohConnecting") : t("remoteConnectingTailscale"),
-					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : t("remoteReady"),
+					ready: origin ? t(managedOrigin ? "caddyVerified" : "originReady") : tailscale ? t("funnelListenerReady") : t("remoteReady"),
 					error: t("remoteError")
 				};
 				const errorLabels = translatedRemoteErrors();
@@ -13877,15 +14254,15 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				irohPair.disabled = !remoteReady || !iroh || remoteProviderBusy;
 				irohPair.hidden = !iroh;
 				irohCopyDescriptor.hidden = !iroh;
-				if (iroh && irohInstalled && activeIrohQrSvg === "") showIrohQrPlaceholder();
-				else if (!iroh || !irohInstalled) irohQr.hidden = true;
-				if ((!iroh || !remoteReady) && activeIrohDescriptor !== "") {
-					activeIrohDescriptor = "";
-					activeIrohPairExpiresAt = 0;
-					activeIrohQrSvg = "";
-					showQr("", irohQr);
-					setIrohQrZoomOpen(false);
-					irohPairStatus.textContent = "";
+				const irohPairingExpired = activeIrohPairExpiresAt > 0 && activeIrohPairExpiresAt <= Date.now();
+				if (activeIrohDescriptor !== "" && (!iroh || !irohInstalled || !remoteReady || irohPairingExpired)) {
+					clearIrohPairing();
+					irohPairStatus.textContent = iroh && irohInstalled && remoteReady && irohPairingExpired ? t("pairingExpired") : "";
+				}
+				if (!iroh || !irohInstalled) irohQr.hidden = true;
+				else if (activeIrohQrSvg === "") {
+					if (activeIrohDescriptor === "") showIrohQrPlaceholder();
+					else irohQr.hidden = true;
 				}
 				irohCopyDescriptor.disabled = !iroh || !remoteReady || remoteProviderBusy || activeIrohDescriptor === "" || activeIrohPairExpiresAt <= Date.now();
 				if (origin) {
@@ -14074,8 +14451,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			});
 			const openIrohPairing = async () => {
 				const generation = remotePairingGeneration;
-				activeIrohDescriptor = "";
-				activeIrohPairExpiresAt = 0;
+				clearIrohPairing();
 				irohCopyDescriptor.disabled = true;
 				const data = await controlRequestJson("/api/mobile-access/remote/iroh/pairing/begin", {
 					method: "POST",
@@ -14086,12 +14462,12 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				const qrSvg = typeof record.qrSvg === "string" ? record.qrSvg : "";
 				const code = typeof record.irohCode === "string" ? record.irohCode : "";
 				const expiresAt = typeof record.expiresAt === "number" && Number.isFinite(record.expiresAt) ? record.expiresAt : 0;
-				showQr(qrSvg, irohQr);
-				if (qrSvg === "" || code === "" || expiresAt <= Date.now()) {
-					activeIrohQrSvg = "";
+				if (!/^\d{6}$/u.test(code) || expiresAt <= Date.now()) {
 					irohPairStatus.textContent = t("keyGenerationFailed");
 					return;
 				}
+				if (qrSvg === "") irohQr.hidden = true;
+				else showQr(qrSvg, irohQr);
 				activeIrohQrSvg = qrSvg;
 				const fields = [
 					"version",
@@ -14109,7 +14485,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				for (const field of fields) descriptor[field] = record[field];
 				activeIrohDescriptor = JSON.stringify(descriptor);
 				activeIrohPairExpiresAt = expiresAt;
-				irohPairStatus.textContent = t("irohPairingReady", { code });
+				irohPairStatus.textContent = qrSvg === "" ? t("irohPairingCopyOnly") : t("irohPairingReady", { code });
 			};
 			irohPair.addEventListener("click", () => {
 				if (remoteProviderBusy || !remoteReady || remoteProvider !== "iroh") return;
@@ -14427,6 +14803,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					serverAddress: String(frpServer.value ?? "").trim(),
 					serverPort: Number(frpPort.value),
 					token: String(frpToken.value ?? ""),
+					user: String(frpUser.value ?? "").trim(),
 					publicOrigin: String(frpOrigin.value ?? "").trim(),
 					mode,
 					entryTls: frpEntryTls.value === "self-signed" ? "self-signed" : "public-ip-cert",
@@ -14445,7 +14822,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				publicOrigin: form.publicOrigin,
 				entryTls: form.entryTls,
 				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+				...form.user === "" ? {} : { user: form.user }
 			});
 			const validFrpForm = (form) => {
 				return validateFrpForm(form).length === 0;
@@ -14476,6 +14854,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 				return issues.length === 0;
 			};
 			for (const [name, input] of Object.entries(frpInputs)) input.addEventListener(name === "mode" || name === "entryTls" ? "change" : "input", () => {
+				if (name === "user") frpUserDraft = true;
 				if (frpValidationShown) renderFrpIssues(validateFrpForm(frpForm(), frpValidationAllowsSavedToken));
 			});
 			frpCopyTemplate.addEventListener("click", () => {
@@ -14658,7 +15037,8 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 					mode: form.mode,
 					entryTls: form.entryTls,
 					...form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
-					...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+					...form.publicPort === void 0 ? {} : { publicPort: form.publicPort },
+					user: form.user
 				};
 			};
 			const validVpsFrpForm = () => {
@@ -14898,9 +15278,10 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
 			frpConfigure.addEventListener("click", () => {
 				if (remoteProviderBusy || !frpInstalled) return;
 				const form = frpForm();
-				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin && form.mode === (frpConfiguredMode === "attach" ? "attach" : "deploy") && form.entryTls === (frpConfiguredEntryTls === "self-signed" ? "self-signed" : "public-ip-cert") && (form.vhostHttpPort ?? configuredFrpVhostPort) === configuredFrpVhostPort && (form.publicPort ?? configuredFrpPublicPort) === configuredFrpPublicPort;
+				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin && form.mode === (frpConfiguredMode === "attach" ? "attach" : "deploy") && form.entryTls === (frpConfiguredEntryTls === "self-signed" ? "self-signed" : "public-ip-cert") && (form.vhostHttpPort ?? configuredFrpVhostPort) === configuredFrpVhostPort && (form.publicPort ?? configuredFrpPublicPort) === configuredFrpPublicPort && form.user === configuredFrpUser;
 				if (!unchanged) {
-					if (!checkFrpForm(form)) return;
+					const sameServer = frpConfigured && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort;
+					if (!checkFrpForm(form, sameServer)) return;
 				}
 				renderFrpIssues([]);
 				remoteProviderBusy = true;
@@ -16919,7 +17300,7 @@ dialog.dshm-picker[open]{display:grid;place-items:center}dialog.dshm-picker::bac
    style rule of its own. */
 .dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__progress{box-sizing:border-box;width:100%;height:6px;margin:0 0 10px}.dsh-mobile-control__progress[hidden]{display:none}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
-.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields[hidden]{display:none}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields[hidden]{display:none}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(7){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
 .dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}.dsh-mobile-control__qr.is-expandable{cursor:zoom-in}.dsh-mobile-control__qr.is-expandable:focus-visible{outline:3px solid var(--dsw-alias-state-business-primary,#2563eb);outline-offset:2px;border-radius:12px}.dsh-mobile-control__qr-zoom{position:fixed;inset:0;z-index:1001;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.72)}.dsh-mobile-control__qr-zoom[hidden]{display:none}.dsh-mobile-control__qr-zoom-image{width:min(84vw,360px);height:min(84vw,360px);border-radius:12px;background:#fff;padding:12px}.dsh-mobile-control__qr-zoom-close{position:absolute;top:12px;right:16px;min-width:44px;min-height:44px;border-radius:999px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:600 18px/1 system-ui;cursor:pointer}