dsh-remote-bridge 2.3.6 → 2.4.0

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.6-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.0-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -34,7 +34,11 @@ The desktop entry lives **inside your DSH settings**: look for the section title
 
 Remote access remains disabled until a local administrator chooses a bind address, port, and initial device permissions.
 
-> This section used to carry two UI screenshots, but both showed the pre-rename interface (titled "DSH 文件工作区"; the remote-access one was still labelled v1.0.0 and showed the file tree and settings as two stacked dialogs). They no longer match the shape described above, so they were removed rather than left to mislead. Re-recording needs a browser environment that can drive the plugin panel, which is not available here.
+![Phone settings — the Roots card, open by default](assets/screenshots/panel-roots.png)
+
+> **About these screenshots.** The four images under `assets/screenshots/` are generated by `scripts/generate-screenshots.ts`, which renders the panel from the same sources the tests use — `ADMIN_TABS`, `WORKSPACE_CSS` and `APP_QR_CODES` out of `src/client/` — so what you see is the shipped markup and stylesheet, not a redrawn mock-up. They show a machine that has just installed the plugin and not yet enabled remote access, which is the honest default state. An earlier revision of this README carried two UI screenshots; both predated the rename and showed the file tree and settings as two stacked dialogs, so they were removed rather than left to mislead.
+>
+> Storefronts pick these up automatically from [`screenshots.json`](./screenshots.json) — no pull request, no waiting on a maintainer. Update the images and push; the next build takes them.
 
 ## About the rename (2.0.4)
 
@@ -73,10 +77,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # 2. tarball from the GitHub release
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
 
 # 3. tarball from the Gitee release (faster from mainland China)
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -93,7 +97,7 @@ Restart DSH after installation, then open settings — The section is titled **
 To install a downloaded release archive:
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.0.tgz
 ```
 
 ## First connection
@@ -327,11 +331,11 @@ pnpm pack
 
 `npm pack` produces roughly a **0.29 MB** archive: 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB.
 
-v2.3.6 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
+v2.4.0 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
 
 ## Project
 
-- Version: `v2.3.6`
+- Version: `v2.4.0`
 - Author: upstream [Hakunm](https://github.com/Hakunm); this fork maintained by [westanke](https://github.com/westanke)
 - Repository: [GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm: [`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge) ([mainland-China mirror](https://registry.npmmirror.com/dsh-remote-bridge))

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.6-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.0-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -32,6 +32,12 @@
 
 远程访问默认关闭。管理员可在本机 WebUI 中设置绑定 IP、端口和新设备的初始权限。
 
+![手机设置 —— 默认展开的「根目录」卡片](assets/screenshots/panel-roots.png)
+
+> **关于这几张截图。** `assets/screenshots/` 下的四张图由 `scripts/generate-screenshots.ts` 生成，它用与测试同一份产出来源渲染面板 —— `ADMIN_TABS`、`WORKSPACE_CSS`、`APP_QR_CODES` 全部取自 `src/client/`，所以你看到的是**发布包里的标记与样式表**，不是另画的示意图。图中呈现的是一台刚装好插件、尚未启用远程访问的机器，这是最诚实的默认状态。本 README 早前曾放过两张界面截图，但都摄于改名之前（标题还是「DSH 文件工作区」，远程访问那张还标着 v1.0.0，且把文件树与设置显示成上下两个弹窗），与上文描述的形态已不符，于是撤掉而不是留着误导。
+>
+> 市场会从 [`screenshots.json`](./screenshots.json) 自动取用这些图 —— 不必再来提 PR、不必等维护者。换了图直接推自己的仓库即可，下一次构建自动生效。
+
 
 ## 关于改名（2.0.4）
 
@@ -70,10 +76,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # ② GitHub Release 的 tarball
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
 
 # ③ Gitee Release 的 tarball（国内访问更快）
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.0/dsh-remote-bridge-v2.4.0.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -89,7 +95,7 @@ npx @deepseek-ai/dsh web
 从 GitHub Release 下载离线安装包时，可直接安装 tarball：
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.0.tgz
 ```
 
 ## 第一次使用
@@ -319,11 +325,11 @@ pnpm pack
 
 `npm pack` 的产物约 **0.29 MB**：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后，从 1.72 MB 降下来。
 
-v2.3.6 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
+v2.4.0 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
 
 ## 项目信息
 
-- 当前版本：`v2.3.6`
+- 当前版本：`v2.4.0`
 - 作者：上游 [Hakunm](https://github.com/Hakunm)，本 fork 维护 [westanke](https://github.com/westanke)
 - 仓库：[GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm：[`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge)（[国内镜像](https://registry.npmmirror.com/dsh-remote-bridge)）

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.3.6
+  version: 2.4.0
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.
@@ -39,7 +39,7 @@ components:
           id: { type: string }
           type:
             type: string
-            examples: [file.changed, file.trashed, chat.message.delta, chat.message.committed, chat.session.status, chat.approval.requested, chat.approval.resolved, chat.turn.failed, connection.ready]
+            examples: [file.changed, file.trashed, chat.message.delta, chat.message.committed, chat.session.status, chat.session.snapshot, chat.deliverables.presented, chat.approval.requested, chat.approval.resolved, chat.turn.failed, connection.ready]
           time: { type: integer }
           data:
             oneOf:
@@ -48,17 +48,31 @@ components:
               - $ref: '#/components/schemas/ChatApprovalRequested'
               - $ref: '#/components/schemas/ChatApprovalResolved'
               - $ref: '#/components/schemas/ChatTurnFailed'
+              - $ref: '#/components/schemas/ConnectionReadyData'
+              - $ref: '#/components/schemas/ChatSessionSnapshot'
+              - $ref: '#/components/schemas/ChatDeliverablesPresented'
               - type: object
                 additionalProperties: true
   schemas:
     ChatMessageDelta:
       type: object
-      description: A stable token-level assistant update normalized from DSH assistant/chunk events.
+      description: |
+        A stable token-level assistant update normalized from DSH assistant/chunk events.
+        Streaming deltas have **no durable position** -- `index` is the chunk index within the
+        current stream (it restarts at 0 every turn), so this message carries no `seq`. See
+        ADR-0008: `seq` means one thing only, the durable session event sequence.
       required: [sessionId, eventType, turn, step, index, kind, text]
       properties:
         sessionId: { type: string }
         eventType: { type: string, const: assistant/chunk }
-        seq: { type: integer }
+        seq:
+          type: integer
+          deprecated: true
+          description: |
+            Deprecated and **no longer emitted** on this message (ADR-0008). It previously
+            carried the chunk index, which made `seq` mean two different things depending on
+            which path produced the frame. Kept in the schema rather than removed so existing
+            third-party implementations are not judged invalid; it was optional either way.
         turn: { type: integer }
         step: { type: integer }
         index: { type: integer }
@@ -77,13 +91,22 @@ components:
         step: { type: integer }
     ChatApprovalRequested:
       type: object
-      description: Signals that clients should refresh the session pending-approval REST resource.
+      description: |
+        Signals that clients should refresh the session pending-approval REST resource.
+        On WebSocket connect the plugin also replays every approval that is still pending to
+        **that connection only** (it is not broadcast). Re-querying REST after connecting is a
+        client's own choice, so the protocol does not rely on it: this makes "a fresh connection
+        learns everything still pending" a server-side guarantee rather than a client
+        obligation. Clients that already refresh on connect just see one idempotent extra
+        refresh. Those frames carry `replayed: true`; deduplicate by `approvalId` or ignore the
+        flag entirely.
       required: [sessionId, approvalId, toolName, risk]
       properties:
         sessionId: { type: string }
         approvalId: { type: string }
         toolName: { type: string }
         risk: { type: string, enum: [standard, full-access] }
+        replayed: { type: boolean }
     ChatApprovalResolved:
       type: object
       description: Signals that an approval was settled and clients should refresh session state.
@@ -119,3 +142,61 @@ components:
             message: { type: string }
             code: { type: string }
             stopped: { type: boolean, const: true }
+
+    ChatDeliverablesPresented:
+      type: object
+      description: |
+        A file the agent explicitly **presented** (`chat.deliverables.presented`, produced by the
+        kernel's `present` tool). The durable event `deliverables/presented` has always been
+        forwarded verbatim inside history; this frame is what makes it visible **live**, so a
+        client does not have to wait for the next message to discover a new deliverable.
+        `files` is forwarded as-is (clients read `path` and `description`), so fields the kernel
+        adds later need no change here.
+      required: [sessionId, files]
+      properties:
+        sessionId: { type: string }
+        eventType: { type: string, const: deliverables/presented }
+        seq: { type: integer }
+        files:
+          type: array
+          items:
+            type: object
+            properties:
+              path: { type: string }
+              description: { type: string }
+
+    ChatSessionSnapshot:
+      type: object
+      description: |
+        The **subscription baseline** (`chat.session.snapshot`): the durable event sequence the
+        server starts streaming from. Sent once when a session's live relay attaches (the
+        upstream relay's first frame is always a snapshot). `cursor` is the durable `seq` at that cut, so a client can tell
+        whether its own history is behind (`max(local seq) < cursor` = events were missed
+        between the REST read and the subscription).
+        The baseline's **records are deliberately not shipped**: this bridge is REST + WebSocket
+        dual-channel, and pushing history bodies here would create two baselines whose relative
+        order cannot be guaranteed. History bodies stay on REST as the single source.
+      required: [sessionId]
+      properties:
+        sessionId: { type: string }
+        cursor: { type: integer }
+        hasMore: { type: boolean }
+        recordCount: { type: integer }
+
+    ConnectionReadyData:
+      type: object
+      description: |
+        Payload of the very first frame on every accepted WebSocket
+        (`{"type": "connection.ready"}`). Clients should use `capabilities` for
+        feature detection instead of comparing `bridgeVersion` against a
+        hard-coded minimum: a capability says what this server can do right now,
+        while a version number is only its historical label. Capability names are
+        `<feature>-v<major>` and are never silently removed. Send
+        `Authorization: Bearer <token>` (or the `bearer.<token>` subprotocol) as
+        usual; this frame carries no credentials.
+      required: [bridgeVersion, capabilities]
+      properties:
+        bridgeVersion: { type: string }
+        capabilities:
+          type: array
+          items: { type: string }

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.3.6
+  version: 2.4.0
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.3.6 }
+                  pluginVersion: { type: string, const: 2.4.0 }
   /pairings/exchange:
     post:
       security: []
@@ -457,6 +457,17 @@ paths:
   /chat/sessions:
     get:
       operationId: listChatSessions
+      parameters:
+        - name: archived
+          in: query
+          schema: { type: boolean, default: false }
+          description: |
+            When true, return the **archived** sessions instead of the active ones.
+            Archiving hides a session from every grouped surface (kernel semantics), so
+            without this parameter a mobile client that archives a session could never see it
+            again. Un-archiving is NOT part of this bridge: the adapter only wraps the kernel's
+            `archiveSession`, and whether the kernel exposes an unarchive call is not verifiable
+            from this repository.
       responses:
         '200':
           description: Sessions whose cwd is within a granted root.
@@ -566,7 +577,29 @@ paths:
           in: query
           schema: { type: integer, minimum: 1 }
       responses:
-        '200': { description: DSH history events and continuation state. }
+        '200':
+          description: |
+            DSH history events and continuation state. Subject to a byte budget
+            (2 MiB per response, 512 KiB per event): the oldest events may be dropped
+            (with `hasMore` forced to true) and oversized strings inside one event may be
+            head/tail clamped (that element then carries `bridgeTruncated`). `truncated`
+            and `bytes` appear only when something was actually clamped -- otherwise the
+            payload is byte-for-byte what it was before the budget existed.
+            `historyFormatVersion` is always present and describes the shape of `events`.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [events, hasMore]
+                properties:
+                  events:
+                    type: array
+                    items: { type: object, additionalProperties: true }
+                  hasMore: { type: boolean }
+                  projections: { type: object, additionalProperties: true }
+                  bytes: { type: integer, minimum: 0 }
+                  truncated: { type: boolean }
+                  historyFormatVersion: { type: integer, minimum: 1 }
         '404': { $ref: '#/components/responses/Error' }
     post:
       operationId: sendMessage

package/kotlin-sdk/build.gradle.kts

@@ -4,7 +4,7 @@ plugins {
 }
 
 group = "ai.deepseek.dsh"
-version = "2.3.6"
+version = "2.4.0"
 
 repositories { mavenCentral() }
 

package/lib/client.cjs

@@ -164,6 +164,22 @@ window.__ModuleLoader__.load({
 			async audit() {
 				return this.manageJson("/audit?limit=200");
 			}
+			/** 当前 Cloudflare 隧道状态（未启动时 running:false）。 */
+			async tunnelStatus() {
+				return this.manageJson("/cloudflare/status");
+			}
+			/** 创建云隧道进行中任务的阶段进度（无任务时 stage 为 idle）。 */
+			async tunnelActivity() {
+				return this.manageJson("/cloudflare/activity");
+			}
+			/** 创建（或复用）cloudflared 并启动 Quick Tunnel，返回对外地址。 */
+			async tunnelCreate() {
+				return this.manageJson("/cloudflare/create", { method: "POST" });
+			}
+			/** 停止当前隧道。 */
+			async tunnelStop() {
+				return this.manageJson("/cloudflare/stop", { method: "POST" });
+			}
 			/** 识图路径：当前值 + 出厂默认（只读）+ 兜底目录（只读）。 */
 			async imageSettings() {
 				return this.manageJson("/image");
@@ -30159,6 +30175,17 @@ window.__ModuleLoader__.load({
 				enablePairing: "启用并创建配对",
 				newPairingCode: "新建配对码",
 				newConfigText: "生成配置文本",
+				tunnelTitle: "Cloudflare 隧道（公网）",
+				tunnelHint: "在外网想连回来时用：一键创建快速隧道，把本机端口经 Cloudflare 边缘暴露成临时公网地址。地址是临时、会变的，重建即换新。",
+				tunnelRunning: "隧道运行中",
+				tunnelStopped: "隧道已停止",
+				tunnelCreate: "开启云隧道",
+				tunnelStop: "停止云隧道",
+				tunnelEndpointLabel: "云隧道",
+				tunnelGenConfigReady: "生成隧道配置文件",
+				tunnelGenConfigOff: "隧道未开启",
+				tunnelSecurityWarning: "开启后将本机远程端口经 Cloudflare 边缘暴露到公网，任何人拿到下面的临时地址即可尝试连接。请仅在需要外网连回来时开启，用完及时停止隧道。",
+				tunnelStartConfirm: "开启云隧道会把你设置页里的远程端口经 Cloudflare 暴露到公网，强密码（token）才能挡住乱连。确认开启吗？",
 				configTextSecurity: "这段文本内含设备令牌，等价于一把钥匙：只发给自己，不要发到群聊、公开仓库或截图里。",
 				configTextHint: "把它发给自己（微信、邮件都可以），到外面在手机 APP 里选择「导入配置文本」粘贴即可，全程不需要电脑在旁。",
 				configTextManual: "手工指定地址（可选）",
@@ -30320,6 +30347,17 @@ window.__ModuleLoader__.load({
 				enablePairing: "Enable and create pairing",
 				newPairingCode: "New pairing code",
 				newConfigText: "Generate config text",
+				tunnelTitle: "Cloudflare tunnel (public)",
+				tunnelHint: "To reach this machine from public networks: create a quick tunnel that exposes the local port through Cloudflare edge as a temporary public address. The address is temporary and changes on recreation.",
+				tunnelRunning: "Tunnel running",
+				tunnelStopped: "Tunnel stopped",
+				tunnelCreate: "Start tunnel",
+				tunnelStop: "Stop tunnel",
+				tunnelEndpointLabel: "Cloudflare tunnel",
+				tunnelGenConfigReady: "Generate config file from tunnel",
+				tunnelGenConfigOff: "Tunnel not started",
+				tunnelSecurityWarning: "Starting exposes your remote port to the public internet through Cloudflare edge; anyone with the temporary address below can try to connect. Only start it when you need to reach the machine from outside, and stop the tunnel when done.",
+				tunnelStartConfirm: "Starting the tunnel exposes your remote port through Cloudflare to the public internet; only the device token (a strong password) keeps strangers out. Start anyway?",
 				configTextSecurity: "This text embeds a device token — treat it like a key: send it only to yourself, never to a group chat, a public repo, or a screenshot.",
 				configTextHint: "Send it to yourself (WeChat, email, anything), then paste it into the phone app under \"Import config text\". The computer does not need to be nearby.",
 				configTextManual: "Manual address (optional)",
@@ -30483,7 +30521,7 @@ window.__ModuleLoader__.load({
 .daw-card-body{border-top:1px solid var(--dsw-alias-border-l2,var(--daw-line));margin:0 16px;padding-bottom:8px}.daw-settings-section{display:grid;grid-template-rows:auto minmax(0,1fr);gap:10px;min-width:0;min-height:0}.daw-settings-section>.daw-list-meta{margin:0}.daw-settings-section .daw-admin{padding:14px 2px}.daw-qr-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin-top:12px}.daw-qr-card{margin:0;display:grid;justify-items:center;gap:8px;padding:16px;border:1px solid var(--daw-line);border-radius:6px;background:var(--daw-panel)}.daw-qr-image{width:180px;height:180px;background:var(--dsw-alias-bg-layer-3,#fff);border-radius:4px}.daw-qr-site{font-weight:600}.daw-qr-url{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-accent);text-decoration:none;overflow-wrap:anywhere;text-align:center}.daw-qr-url:hover{text-decoration:underline}.daw-form-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(120px,.45fr) auto;gap:8px;margin-bottom:14px}.daw-listener-form{display:grid;grid-template-columns:minmax(180px,1fr) 130px auto;gap:8px;align-items:end}.daw-field{display:grid;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:12px}.daw-listener-status{display:flex;flex-wrap:wrap;gap:5px 18px;padding:9px 0;color:var(--daw-muted);font:12px ui-monospace,SFMono-Regular,Consolas,monospace}.daw-listener-hint{margin:0 0 8px}.daw-list{border-top:1px solid var(--daw-line)}.daw-list-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:center;min-height:48px;border-bottom:1px solid var(--daw-line);padding:7px 2px}.daw-list-title{font-weight:600;overflow-wrap:anywhere}
 .daw-list-title .daw-pill{margin-left:8px;vertical-align:middle}
 .daw-builtin-hint{text-align:right;align-self:center}
-.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-inline-command{margin-left:8px}@mediaa(max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
+.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-row{display:flex;flex-wrap:wrap;gap:8px}.daw-inline-command{margin-left:8px}@mediaa(max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
 `;
 		function installWorkspaceStyles() {
 			if (document.getElementById(STYLE_ID) !== null) return;
@@ -30533,6 +30571,10 @@ window.__ModuleLoader__.load({
 		function tabLabelKey(tab) {
 			return tab === "app-download" ? "appDownloadTab" : `${tab}Tab`;
 		}
+		/** 云隧道进度条宽度：有确定百分比则用之，否则给 30% 作「流动中」占位。 */
+		function pct(a) {
+			return `${a.percent ?? 30}%`;
+		}
 		/**
 		* 卡片头部的描述行。与 `tabLabelKey` 同理：唯一含连字符的分区显式映射。
 		*
@@ -30671,6 +30713,9 @@ window.__ModuleLoader__.load({
 			const [openCards, setOpenCards] = (0, react.useState)(() => /* @__PURE__ */ new Set([props.initialOpen]));
 			const [imageSaved, setImageSaved] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
+			const [tunnel, setTunnel] = (0, react.useState)();
+			const [tunnelBusy, setTunnelBusy] = (0, react.useState)(false);
+			const [activity, setActivity] = (0, react.useState)();
 			const isOpen = (0, react.useCallback)((card) => openCards.has(card), [openCards]);
 			const toggleCard = (0, react.useCallback)((card) => {
 				setOpenCards((previous) => {
@@ -30691,11 +30736,49 @@ window.__ModuleLoader__.load({
 						setImageDraft(settings.subdir);
 						setImageSaved(false);
 					}
+					if (openCards.has("remote")) setTunnel(await props.api.tunnelStatus());
 					setError(void 0);
 				} catch (cause) {
 					setError(cause);
 				}
 			}, [props.api, openCards]);
+			const createTunnel = (0, react.useCallback)(() => {
+				if (!window.confirm(t("tunnelStartConfirm"))) return;
+				setTunnelBusy(true);
+				setError(void 0);
+				setActivity(void 0);
+				setActivity({
+					stage: "locating",
+					label: "正在准备 cloudflared…",
+					percent: null
+				});
+				const poll = window.setInterval(() => {
+					props.api.tunnelActivity().then((a) => {
+						if (a.stage !== "idle") setActivity(a);
+					}).catch(() => {});
+				}, 350);
+				props.api.tunnelCreate().then(async (next) => {
+					setTunnel(next);
+					setActivity(void 0);
+					await refresh();
+				}).catch(setError).finally(() => {
+					window.clearInterval(poll);
+					setActivity(void 0);
+					setTunnelBusy(false);
+				});
+			}, [
+				props.api,
+				refresh,
+				t
+			]);
+			const stopTunnel = (0, react.useCallback)(() => {
+				setTunnelBusy(true);
+				setError(void 0);
+				props.api.tunnelStop().then(async (next) => {
+					setTunnel(next);
+					await refresh();
+				}).catch(setError).finally(() => setTunnelBusy(false));
+			}, [props.api, refresh]);
 			(0, react.useEffect)(() => {
 				refresh();
 			}, [refresh]);
@@ -30705,6 +30788,25 @@ window.__ModuleLoader__.load({
 				setListenerPort(String(status.configuredPort));
 			}, [status?.configuredHost, status?.configuredPort]);
 			const roots = status?.roots ?? [];
+			const genTunnelConfig = (0, react.useCallback)((baseUrl) => {
+				setConfigTextBusy(true);
+				setError(void 0);
+				props.api.createConfigText({
+					...roots.length === 0 ? {} : { rootIds: roots.map((root) => root.id) },
+					endpoints: [{
+						label: t("tunnelEndpointLabel"),
+						baseUrl
+					}]
+				}).then((value) => {
+					setConfigText(value);
+					return refresh();
+				}).catch(setError).finally(() => setConfigTextBusy(false));
+			}, [
+				props.api,
+				refresh,
+				roots,
+				t
+			]);
 			const [grantedScopes, setGrantedScopes] = (0, react.useState)([...DEVICE_SCOPES]);
 			const toggleScope = (0, react.useCallback)((scope) => {
 				setGrantedScopes((current) => current.includes(scope) ? current.filter((item) => item !== scope) : [...current, scope]);
@@ -30880,6 +30982,60 @@ window.__ModuleLoader__.load({
 								className: `daw-pill${status?.remoteEnabled ? " on" : ""}`,
 								children: status?.remoteEnabled ? t("remoteEnabled") : t("loopbackOnly")
 							}) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-tunnel",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-tunnel-head",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("tunnelTitle") }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: `daw-pill${tunnel?.running ? " on" : ""}`,
+											children: tunnel?.running ? t("tunnelRunning") : t("tunnelStopped")
+										})]
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: "daw-list-meta",
+										children: t("tunnelHint")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-warning",
+										children: t("tunnelSecurityWarning")
+									}),
+									tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-warning",
+										children: tunnel.error
+									}),
+									tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-tunnel-url",
+										style: { marginTop: 8 },
+										children: tunnel.url
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										className: "daw-command primary",
+										style: { marginTop: 10 },
+										disabled: tunnelBusy || roots.length === 0,
+										onClick: () => {
+											if (tunnel?.running === true) stopTunnel();
+											else createTunnel();
+										},
+										children: tunnel?.running === true ? t("tunnelStop") : t("tunnelCreate")
+									}),
+									activity !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-tunnel-progress",
+										style: { marginTop: 10 },
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "daw-progress-track",
+											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+												className: "daw-progress-fill",
+												style: { width: pct(activity) }
+											})
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "daw-list-meta",
+											style: { marginTop: 4 },
+											children: activity.label
+										})]
+									})
+								]
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "daw-scope-grid",
 								children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
@@ -30942,6 +31098,15 @@ window.__ModuleLoader__.load({
 									},
 									children: t("newConfigText")
 								}),
+								tunnel !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									className: "daw-command daw-inline-command",
+									disabled: configTextBusy || tunnelBusy,
+									onClick: () => {
+										if (tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0) genTunnelConfig(tunnel.url);
+										else createTunnel();
+									},
+									children: tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0 ? t("tunnelGenConfigReady") : t("tunnelGenConfigOff")
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "daw-list-meta daw-listener-hint",
 									children: t("configTextScopeNote")