dsh-remote-bridge 2.3.7 → 2.4.1

package/README.en.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.6-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.1-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -77,10 +77,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # 2. tarball from the GitHub release
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.1/dsh-remote-bridge-v2.4.1.tgz
 
 # 3. tarball from the Gitee release (faster from mainland China)
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.1/dsh-remote-bridge-v2.4.1.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -97,7 +97,7 @@ Restart DSH after installation, then open settings — The section is titled **
 To install a downloaded release archive:
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.1.tgz
 ```
 
 ## First connection
@@ -331,11 +331,11 @@ pnpm pack
 
 `npm pack` produces roughly a **0.29 MB** archive: 2.2.0 dropped the standalone page and its editor dependencies and turned source maps off, down from 1.72 MB.
 
-v2.3.6 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
+v2.4.1 was developed against DSH `master@47f943859bef60e4160492346772ded9b24f765a`. CI covers Windows, Ubuntu, and macOS.
 
 ## Project
 
-- Version: `v2.3.6`
+- Version: `v2.4.1`
 - Author: upstream [Hakunm](https://github.com/Hakunm); this fork maintained by [westanke](https://github.com/westanke)
 - Repository: [GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm: [`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge) ([mainland-China mirror](https://registry.npmmirror.com/dsh-remote-bridge))

package/README.md

@@ -9,7 +9,7 @@
 </p>
 
 <p align="center">
-  <img alt="Version" src="https://img.shields.io/badge/version-v2.3.6-087f8c">
+  <img alt="Version" src="https://img.shields.io/badge/version-v2.4.1-087f8c">
   <img alt="DSH plugin" src="https://img.shields.io/badge/DeepSeek_Harness-plugin-1f2328">
   <img alt="Platforms" src="https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-586069">
   <img alt="License" src="https://img.shields.io/badge/license-AGPL--3.0-2da44e">
@@ -76,10 +76,10 @@ dsh plugin --profile web add dsh-remote-bridge
 dsh plugin --profile web add dsh-remote-bridge --registry https://registry.npmmirror.com
 
 # ② GitHub Release 的 tarball
-dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://github.com/westanke/dsh-remote-bridge/releases/download/v2.4.1/dsh-remote-bridge-v2.4.1.tgz
 
 # ③ Gitee Release 的 tarball（国内访问更快）
-dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.3.6/dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add https://gitee.com/westanke/dsh-remote-bridge/releases/download/v2.4.1/dsh-remote-bridge-v2.4.1.tgz
 
 npx @deepseek-ai/dsh web
 ```
@@ -95,7 +95,7 @@ npx @deepseek-ai/dsh web
 从 GitHub Release 下载离线安装包时，可直接安装 tarball：
 
 ```sh
-dsh plugin --profile web add ./dsh-remote-bridge-v2.3.6.tgz
+dsh plugin --profile web add ./dsh-remote-bridge-v2.4.1.tgz
 ```
 
 ## 第一次使用
@@ -325,11 +325,11 @@ pnpm pack
 
 `npm pack` 的产物约 **0.29 MB**：2.2.0 删除独立页及其编辑器依赖、并关闭 source map 之后，从 1.72 MB 降下来。
 
-v2.3.6 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
+v2.4.1 基于 DSH `master@47f943859bef60e4160492346772ded9b24f765a` 开发，CI 覆盖 Windows、Ubuntu 和 macOS。
 
 ## 项目信息
 
-- 当前版本：`v2.3.6`
+- 当前版本：`v2.4.1`
 - 作者：上游 [Hakunm](https://github.com/Hakunm)，本 fork 维护 [westanke](https://github.com/westanke)
 - 仓库：[GitHub](https://github.com/westanke/dsh-remote-bridge) · [Gitee](https://gitee.com/westanke/dsh-remote-bridge)
 - npm：[`dsh-remote-bridge`](https://www.npmjs.com/package/dsh-remote-bridge)（[国内镜像](https://registry.npmmirror.com/dsh-remote-bridge)）

package/docs/api/asyncapi.yaml

@@ -1,7 +1,7 @@
 asyncapi: 3.0.0
 info:
   title: DeepSeek Harness Mobile Events
-  version: 2.3.7
+  version: 2.4.1
   description: |
     Live file and authorized DSH chat events. Reconnect clients must refresh
     REST state; unbounded replay is not provided.
@@ -39,7 +39,7 @@ components:
           id: { type: string }
           type:
             type: string
-            examples: [file.changed, file.trashed, chat.message.delta, chat.message.committed, chat.session.status, chat.approval.requested, chat.approval.resolved, chat.turn.failed, connection.ready]
+            examples: [file.changed, file.trashed, chat.message.delta, chat.message.committed, chat.session.status, chat.session.snapshot, chat.deliverables.presented, chat.approval.requested, chat.approval.resolved, chat.turn.failed, connection.ready]
           time: { type: integer }
           data:
             oneOf:
@@ -48,17 +48,31 @@ components:
               - $ref: '#/components/schemas/ChatApprovalRequested'
               - $ref: '#/components/schemas/ChatApprovalResolved'
               - $ref: '#/components/schemas/ChatTurnFailed'
+              - $ref: '#/components/schemas/ConnectionReadyData'
+              - $ref: '#/components/schemas/ChatSessionSnapshot'
+              - $ref: '#/components/schemas/ChatDeliverablesPresented'
               - type: object
                 additionalProperties: true
   schemas:
     ChatMessageDelta:
       type: object
-      description: A stable token-level assistant update normalized from DSH assistant/chunk events.
+      description: |
+        A stable token-level assistant update normalized from DSH assistant/chunk events.
+        Streaming deltas have **no durable position** -- `index` is the chunk index within the
+        current stream (it restarts at 0 every turn), so this message carries no `seq`. See
+        ADR-0008: `seq` means one thing only, the durable session event sequence.
       required: [sessionId, eventType, turn, step, index, kind, text]
       properties:
         sessionId: { type: string }
         eventType: { type: string, const: assistant/chunk }
-        seq: { type: integer }
+        seq:
+          type: integer
+          deprecated: true
+          description: |
+            Deprecated and **no longer emitted** on this message (ADR-0008). It previously
+            carried the chunk index, which made `seq` mean two different things depending on
+            which path produced the frame. Kept in the schema rather than removed so existing
+            third-party implementations are not judged invalid; it was optional either way.
         turn: { type: integer }
         step: { type: integer }
         index: { type: integer }
@@ -77,13 +91,22 @@ components:
         step: { type: integer }
     ChatApprovalRequested:
       type: object
-      description: Signals that clients should refresh the session pending-approval REST resource.
+      description: |
+        Signals that clients should refresh the session pending-approval REST resource.
+        On WebSocket connect the plugin also replays every approval that is still pending to
+        **that connection only** (it is not broadcast). Re-querying REST after connecting is a
+        client's own choice, so the protocol does not rely on it: this makes "a fresh connection
+        learns everything still pending" a server-side guarantee rather than a client
+        obligation. Clients that already refresh on connect just see one idempotent extra
+        refresh. Those frames carry `replayed: true`; deduplicate by `approvalId` or ignore the
+        flag entirely.
       required: [sessionId, approvalId, toolName, risk]
       properties:
         sessionId: { type: string }
         approvalId: { type: string }
         toolName: { type: string }
         risk: { type: string, enum: [standard, full-access] }
+        replayed: { type: boolean }
     ChatApprovalResolved:
       type: object
       description: Signals that an approval was settled and clients should refresh session state.
@@ -119,3 +142,92 @@ components:
             message: { type: string }
             code: { type: string }
             stopped: { type: boolean, const: true }
+
+    ChatTurnEnd:
+      type: object
+      description: |
+        A turn ended. Emitted for every `turn/end` the host reports, including the
+        ordinary `reason.kind === 'ok'` case. When the host stops a turn at its
+        output-token cap (`reason.kind === 'max-tokens'`) the reply is **truncated,
+        not failed** — this frame is the only place a client can learn that, because
+        no separate failure frame is emitted for it. Clients that ignore `reason`
+        keep working unchanged (the field is additive).
+      required: [sessionId, eventType]
+      properties:
+        sessionId: { type: string }
+        eventType: { type: string, const: turn/end }
+        seq: { type: integer }
+        reason:
+          type: object
+          description: |
+            Forwarded **verbatim** from the host; this repository does not interpret
+            it. Known `kind` values (kernel `turn-error.js` / `turn-max-tokens.js` /
+            `retry.js`): `ok` (normal), `error` (terminal failure — also delivered as
+            `chat.turn.failed`), `max-tokens` (output-token cap: reply truncated,
+            earlier output preserved — render as a **warning**, not an error),
+            `aborted` (cancelled by the user or a hook, e.g. signing out).
+            Unknown kinds must be ignored rather than treated as failure.
+          properties:
+            kind: { type: string }
+            error:
+              type: object
+              properties:
+                message: { type: string }
+                code: { type: string }
+    ChatDeliverablesPresented:
+      type: object
+      description: |
+        A file the agent explicitly **presented** (`chat.deliverables.presented`, produced by the
+        kernel's `present` tool). The durable event `deliverables/presented` has always been
+        forwarded verbatim inside history; this frame is what makes it visible **live**, so a
+        client does not have to wait for the next message to discover a new deliverable.
+        `files` is forwarded as-is (clients read `path` and `description`), so fields the kernel
+        adds later need no change here.
+      required: [sessionId, files]
+      properties:
+        sessionId: { type: string }
+        eventType: { type: string, const: deliverables/presented }
+        seq: { type: integer }
+        files:
+          type: array
+          items:
+            type: object
+            properties:
+              path: { type: string }
+              description: { type: string }
+
+    ChatSessionSnapshot:
+      type: object
+      description: |
+        The **subscription baseline** (`chat.session.snapshot`): the durable event sequence the
+        server starts streaming from. Sent once when a session's live relay attaches (the
+        upstream relay's first frame is always a snapshot). `cursor` is the durable `seq` at that cut, so a client can tell
+        whether its own history is behind (`max(local seq) < cursor` = events were missed
+        between the REST read and the subscription).
+        The baseline's **records are deliberately not shipped**: this bridge is REST + WebSocket
+        dual-channel, and pushing history bodies here would create two baselines whose relative
+        order cannot be guaranteed. History bodies stay on REST as the single source.
+      required: [sessionId]
+      properties:
+        sessionId: { type: string }
+        cursor: { type: integer }
+        hasMore: { type: boolean }
+        recordCount: { type: integer }
+
+    ConnectionReadyData:
+      type: object
+      description: |
+        Payload of the very first frame on every accepted WebSocket
+        (`{"type": "connection.ready"}`). Clients should use `capabilities` for
+        feature detection instead of comparing `bridgeVersion` against a
+        hard-coded minimum: a capability says what this server can do right now,
+        while a version number is only its historical label. Capability names are
+        `<feature>-v<major>` and are never silently removed. Send
+        `Authorization: Bearer <token>` (or the `bearer.<token>` subprotocol) as
+        usual; this frame carries no credentials.
+      required: [bridgeVersion, capabilities]
+      properties:
+        bridgeVersion: { type: string }
+        capabilities:
+          type: array
+          items: { type: string }

package/docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: DeepSeek Harness Mobile API
-  version: 2.3.7
+  version: 2.4.1
   description: Versioned file and chat BFF for mobile and third-party DSH clients. HTTP and HTTPS are both supported.
 servers:
   - url: http://127.0.0.1:3090/api/v1
@@ -24,7 +24,7 @@ paths:
                 properties:
                   ok: { type: boolean, const: true }
                   version: { type: string, const: v1 }
-                  pluginVersion: { type: string, const: 2.3.7 }
+                  pluginVersion: { type: string, const: 2.4.1 }
   /pairings/exchange:
     post:
       security: []
@@ -457,6 +457,17 @@ paths:
   /chat/sessions:
     get:
       operationId: listChatSessions
+      parameters:
+        - name: archived
+          in: query
+          schema: { type: boolean, default: false }
+          description: |
+            When true, return the **archived** sessions instead of the active ones.
+            Archiving hides a session from every grouped surface (kernel semantics), so
+            without this parameter a mobile client that archives a session could never see it
+            again. Un-archiving is NOT part of this bridge: the adapter only wraps the kernel's
+            `archiveSession`, and whether the kernel exposes an unarchive call is not verifiable
+            from this repository.
       responses:
         '200':
           description: Sessions whose cwd is within a granted root.
@@ -566,7 +577,29 @@ paths:
           in: query
           schema: { type: integer, minimum: 1 }
       responses:
-        '200': { description: DSH history events and continuation state. }
+        '200':
+          description: |
+            DSH history events and continuation state. Subject to a byte budget
+            (2 MiB per response, 512 KiB per event): the oldest events may be dropped
+            (with `hasMore` forced to true) and oversized strings inside one event may be
+            head/tail clamped (that element then carries `bridgeTruncated`). `truncated`
+            and `bytes` appear only when something was actually clamped -- otherwise the
+            payload is byte-for-byte what it was before the budget existed.
+            `historyFormatVersion` is always present and describes the shape of `events`.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [events, hasMore]
+                properties:
+                  events:
+                    type: array
+                    items: { type: object, additionalProperties: true }
+                  hasMore: { type: boolean }
+                  projections: { type: object, additionalProperties: true }
+                  bytes: { type: integer, minimum: 0 }
+                  truncated: { type: boolean }
+                  historyFormatVersion: { type: integer, minimum: 1 }
         '404': { $ref: '#/components/responses/Error' }
     post:
       operationId: sendMessage

package/kotlin-sdk/build.gradle.kts

@@ -4,7 +4,7 @@ plugins {
 }
 
 group = "ai.deepseek.dsh"
-version = "2.3.7"
+version = "2.4.1"
 
 repositories { mavenCentral() }
 

package/lib/client.cjs

@@ -164,6 +164,22 @@ window.__ModuleLoader__.load({
 			async audit() {
 				return this.manageJson("/audit?limit=200");
 			}
+			/** 当前 Cloudflare 隧道状态（未启动时 running:false）。 */
+			async tunnelStatus() {
+				return this.manageJson("/cloudflare/status");
+			}
+			/** 创建云隧道进行中任务的阶段进度（无任务时 stage 为 idle）。 */
+			async tunnelActivity() {
+				return this.manageJson("/cloudflare/activity");
+			}
+			/** 创建（或复用）cloudflared 并启动 Quick Tunnel，返回对外地址。 */
+			async tunnelCreate() {
+				return this.manageJson("/cloudflare/create", { method: "POST" });
+			}
+			/** 停止当前隧道。 */
+			async tunnelStop() {
+				return this.manageJson("/cloudflare/stop", { method: "POST" });
+			}
 			/** 识图路径：当前值 + 出厂默认（只读）+ 兜底目录（只读）。 */
 			async imageSettings() {
 				return this.manageJson("/image");
@@ -30159,6 +30175,17 @@ window.__ModuleLoader__.load({
 				enablePairing: "启用并创建配对",
 				newPairingCode: "新建配对码",
 				newConfigText: "生成配置文本",
+				tunnelTitle: "Cloudflare 隧道（公网）",
+				tunnelHint: "在外网想连回来时用：一键创建快速隧道，把本机端口经 Cloudflare 边缘暴露成临时公网地址。地址是临时、会变的，重建即换新。",
+				tunnelRunning: "隧道运行中",
+				tunnelStopped: "隧道已停止",
+				tunnelCreate: "开启云隧道",
+				tunnelStop: "停止云隧道",
+				tunnelEndpointLabel: "云隧道",
+				tunnelGenConfigReady: "生成隧道配置文件",
+				tunnelGenConfigOff: "隧道未开启",
+				tunnelSecurityWarning: "开启后将本机远程端口经 Cloudflare 边缘暴露到公网，任何人拿到下面的临时地址即可尝试连接。请仅在需要外网连回来时开启，用完及时停止隧道。",
+				tunnelStartConfirm: "开启云隧道会把你设置页里的远程端口经 Cloudflare 暴露到公网，强密码（token）才能挡住乱连。确认开启吗？",
 				configTextSecurity: "这段文本内含设备令牌，等价于一把钥匙：只发给自己，不要发到群聊、公开仓库或截图里。",
 				configTextHint: "把它发给自己（微信、邮件都可以），到外面在手机 APP 里选择「导入配置文本」粘贴即可，全程不需要电脑在旁。",
 				configTextManual: "手工指定地址（可选）",
@@ -30320,6 +30347,17 @@ window.__ModuleLoader__.load({
 				enablePairing: "Enable and create pairing",
 				newPairingCode: "New pairing code",
 				newConfigText: "Generate config text",
+				tunnelTitle: "Cloudflare tunnel (public)",
+				tunnelHint: "To reach this machine from public networks: create a quick tunnel that exposes the local port through Cloudflare edge as a temporary public address. The address is temporary and changes on recreation.",
+				tunnelRunning: "Tunnel running",
+				tunnelStopped: "Tunnel stopped",
+				tunnelCreate: "Start tunnel",
+				tunnelStop: "Stop tunnel",
+				tunnelEndpointLabel: "Cloudflare tunnel",
+				tunnelGenConfigReady: "Generate config file from tunnel",
+				tunnelGenConfigOff: "Tunnel not started",
+				tunnelSecurityWarning: "Starting exposes your remote port to the public internet through Cloudflare edge; anyone with the temporary address below can try to connect. Only start it when you need to reach the machine from outside, and stop the tunnel when done.",
+				tunnelStartConfirm: "Starting the tunnel exposes your remote port through Cloudflare to the public internet; only the device token (a strong password) keeps strangers out. Start anyway?",
 				configTextSecurity: "This text embeds a device token — treat it like a key: send it only to yourself, never to a group chat, a public repo, or a screenshot.",
 				configTextHint: "Send it to yourself (WeChat, email, anything), then paste it into the phone app under \"Import config text\". The computer does not need to be nearby.",
 				configTextManual: "Manual address (optional)",
@@ -30483,7 +30521,7 @@ window.__ModuleLoader__.load({
 .daw-card-body{border-top:1px solid var(--dsw-alias-border-l2,var(--daw-line));margin:0 16px;padding-bottom:8px}.daw-settings-section{display:grid;grid-template-rows:auto minmax(0,1fr);gap:10px;min-width:0;min-height:0}.daw-settings-section>.daw-list-meta{margin:0}.daw-settings-section .daw-admin{padding:14px 2px}.daw-qr-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin-top:12px}.daw-qr-card{margin:0;display:grid;justify-items:center;gap:8px;padding:16px;border:1px solid var(--daw-line);border-radius:6px;background:var(--daw-panel)}.daw-qr-image{width:180px;height:180px;background:var(--dsw-alias-bg-layer-3,#fff);border-radius:4px}.daw-qr-site{font-weight:600}.daw-qr-url{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-accent);text-decoration:none;overflow-wrap:anywhere;text-align:center}.daw-qr-url:hover{text-decoration:underline}.daw-form-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(120px,.45fr) auto;gap:8px;margin-bottom:14px}.daw-listener-form{display:grid;grid-template-columns:minmax(180px,1fr) 130px auto;gap:8px;align-items:end}.daw-field{display:grid;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:12px}.daw-listener-status{display:flex;flex-wrap:wrap;gap:5px 18px;padding:9px 0;color:var(--daw-muted);font:12px ui-monospace,SFMono-Regular,Consolas,monospace}.daw-listener-hint{margin:0 0 8px}.daw-list{border-top:1px solid var(--daw-line)}.daw-list-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:center;min-height:48px;border-bottom:1px solid var(--daw-line);padding:7px 2px}.daw-list-title{font-weight:600;overflow-wrap:anywhere}
 .daw-list-title .daw-pill{margin-left:8px;vertical-align:middle}
 .daw-builtin-hint{text-align:right;align-self:center}
-.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-inline-command{margin-left:8px}@mediaa(max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
+.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-row{display:flex;flex-wrap:wrap;gap:8px}.daw-inline-command{margin-left:8px}@mediaa(max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
 `;
 		function installWorkspaceStyles() {
 			if (document.getElementById(STYLE_ID) !== null) return;
@@ -30533,6 +30571,10 @@ window.__ModuleLoader__.load({
 		function tabLabelKey(tab) {
 			return tab === "app-download" ? "appDownloadTab" : `${tab}Tab`;
 		}
+		/** 云隧道进度条宽度：有确定百分比则用之，否则给 30% 作「流动中」占位。 */
+		function pct(a) {
+			return `${a.percent ?? 30}%`;
+		}
 		/**
 		* 卡片头部的描述行。与 `tabLabelKey` 同理：唯一含连字符的分区显式映射。
 		*
@@ -30671,6 +30713,9 @@ window.__ModuleLoader__.load({
 			const [openCards, setOpenCards] = (0, react.useState)(() => /* @__PURE__ */ new Set([props.initialOpen]));
 			const [imageSaved, setImageSaved] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
+			const [tunnel, setTunnel] = (0, react.useState)();
+			const [tunnelBusy, setTunnelBusy] = (0, react.useState)(false);
+			const [activity, setActivity] = (0, react.useState)();
 			const isOpen = (0, react.useCallback)((card) => openCards.has(card), [openCards]);
 			const toggleCard = (0, react.useCallback)((card) => {
 				setOpenCards((previous) => {
@@ -30691,11 +30736,49 @@ window.__ModuleLoader__.load({
 						setImageDraft(settings.subdir);
 						setImageSaved(false);
 					}
+					if (openCards.has("remote")) setTunnel(await props.api.tunnelStatus());
 					setError(void 0);
 				} catch (cause) {
 					setError(cause);
 				}
 			}, [props.api, openCards]);
+			const createTunnel = (0, react.useCallback)(() => {
+				if (!window.confirm(t("tunnelStartConfirm"))) return;
+				setTunnelBusy(true);
+				setError(void 0);
+				setActivity(void 0);
+				setActivity({
+					stage: "locating",
+					label: "正在准备 cloudflared…",
+					percent: null
+				});
+				const poll = window.setInterval(() => {
+					props.api.tunnelActivity().then((a) => {
+						if (a.stage !== "idle") setActivity(a);
+					}).catch(() => {});
+				}, 350);
+				props.api.tunnelCreate().then(async (next) => {
+					setTunnel(next);
+					setActivity(void 0);
+					await refresh();
+				}).catch(setError).finally(() => {
+					window.clearInterval(poll);
+					setActivity(void 0);
+					setTunnelBusy(false);
+				});
+			}, [
+				props.api,
+				refresh,
+				t
+			]);
+			const stopTunnel = (0, react.useCallback)(() => {
+				setTunnelBusy(true);
+				setError(void 0);
+				props.api.tunnelStop().then(async (next) => {
+					setTunnel(next);
+					await refresh();
+				}).catch(setError).finally(() => setTunnelBusy(false));
+			}, [props.api, refresh]);
 			(0, react.useEffect)(() => {
 				refresh();
 			}, [refresh]);
@@ -30705,6 +30788,25 @@ window.__ModuleLoader__.load({
 				setListenerPort(String(status.configuredPort));
 			}, [status?.configuredHost, status?.configuredPort]);
 			const roots = status?.roots ?? [];
+			const genTunnelConfig = (0, react.useCallback)((baseUrl) => {
+				setConfigTextBusy(true);
+				setError(void 0);
+				props.api.createConfigText({
+					...roots.length === 0 ? {} : { rootIds: roots.map((root) => root.id) },
+					endpoints: [{
+						label: t("tunnelEndpointLabel"),
+						baseUrl
+					}]
+				}).then((value) => {
+					setConfigText(value);
+					return refresh();
+				}).catch(setError).finally(() => setConfigTextBusy(false));
+			}, [
+				props.api,
+				refresh,
+				roots,
+				t
+			]);
 			const [grantedScopes, setGrantedScopes] = (0, react.useState)([...DEVICE_SCOPES]);
 			const toggleScope = (0, react.useCallback)((scope) => {
 				setGrantedScopes((current) => current.includes(scope) ? current.filter((item) => item !== scope) : [...current, scope]);
@@ -30880,6 +30982,60 @@ window.__ModuleLoader__.load({
 								className: `daw-pill${status?.remoteEnabled ? " on" : ""}`,
 								children: status?.remoteEnabled ? t("remoteEnabled") : t("loopbackOnly")
 							}) }),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-tunnel",
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-tunnel-head",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("tunnelTitle") }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: `daw-pill${tunnel?.running ? " on" : ""}`,
+											children: tunnel?.running ? t("tunnelRunning") : t("tunnelStopped")
+										})]
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: "daw-list-meta",
+										children: t("tunnelHint")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-warning",
+										children: t("tunnelSecurityWarning")
+									}),
+									tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-warning",
+										children: tunnel.error
+									}),
+									tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-tunnel-url",
+										style: { marginTop: 8 },
+										children: tunnel.url
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+										className: "daw-command primary",
+										style: { marginTop: 10 },
+										disabled: tunnelBusy || roots.length === 0,
+										onClick: () => {
+											if (tunnel?.running === true) stopTunnel();
+											else createTunnel();
+										},
+										children: tunnel?.running === true ? t("tunnelStop") : t("tunnelCreate")
+									}),
+									activity !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-tunnel-progress",
+										style: { marginTop: 10 },
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "daw-progress-track",
+											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+												className: "daw-progress-fill",
+												style: { width: pct(activity) }
+											})
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "daw-list-meta",
+											style: { marginTop: 4 },
+											children: activity.label
+										})]
+									})
+								]
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "daw-scope-grid",
 								children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
@@ -30942,6 +31098,15 @@ window.__ModuleLoader__.load({
 									},
 									children: t("newConfigText")
 								}),
+								tunnel !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									className: "daw-command daw-inline-command",
+									disabled: configTextBusy || tunnelBusy,
+									onClick: () => {
+										if (tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0) genTunnelConfig(tunnel.url);
+										else createTunnel();
+									},
+									children: tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0 ? t("tunnelGenConfigReady") : t("tunnelGenConfigOff")
+								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "daw-list-meta daw-listener-hint",
 									children: t("configTextScopeNote")