dsh-remote-bridge 2.5.0 → 2.5.2

package/lib/client.cjs

@@ -172,9 +172,25 @@ window.__ModuleLoader__.load({
 			async tunnelActivity() {
 				return this.manageJson("/cloudflare/activity");
 			}
-			/** 创建（或复用）cloudflared 并启动 Quick Tunnel，返回对外地址。 */
-			async tunnelCreate() {
-				return this.manageJson("/cloudflare/create", { method: "POST" });
+			/**
+			* 创建（或复用）cloudflared 并启动 Quick Tunnel，返回对外地址。
+			*
+			* `withConfig=true`（一键「开隧道并出令牌」）：请求体带 `configText:true`，服务端在
+			* 隧道**起来之前**的这一次调用里等地址并顺带生成令牌配置文本（见 state.configText）。
+			* 必须走这班车：隧道一旦运行，单独的 /manage/config/text 会被管理面判据 0 挡 403。
+			* endpointLabel/rootIds/deviceName 可选透传给服务端的配置生成。
+			*/
+			async tunnelCreate(withConfig = false, options = {}) {
+				if (withConfig !== true) return this.manageJson("/cloudflare/create", { method: "POST" });
+				return this.manageJson("/cloudflare/create", {
+					method: "POST",
+					body: JSON.stringify({
+						configText: true,
+						...options.endpointLabel === void 0 ? {} : { endpointLabel: options.endpointLabel },
+						...options.rootIds === void 0 ? {} : { rootIds: options.rootIds },
+						...options.deviceName === void 0 ? {} : { deviceName: options.deviceName }
+					})
+				});
 			}
 			/** 停止当前隧道。 */
 			async tunnelStop() {
@@ -236,335 +252,42 @@ window.__ModuleLoader__.load({
 			} catch {}
 			throw new WorkspaceApiError(response.status, code, message);
 		}
-		//#endregion
-		//#region src/client/handoff.tsx
-		/**
-		* 浏览器半边：把**图片交接消息**里的那个地址渲染成图片本身。
-		*
-		* 这半边是从 `dsh-image-paths` 0.3.1 并过来的，接的是同一个契约：纯文本模型收到图片时，
-		* remote-bridge 会在用户消息里追加两行 ——
-		*
-		*   🖼️ 图片 1「shot.png」（当前模型看不到图，已存到 .dsh-images/<sha>.png；要看图，请用识图工具打开下面那行的路径）
-		*   [Image: source: /absolute/path/.dsh-images/<sha>.png]
-		*
-		* 本模块只读第一行里那个地址，把它变成一张真的图。第二行是给模型读的机器契约，同一张图
-		* 不再重复出第二张；而且只扫**用户消息**，上下文注入、助手正文、工具输出里引用的路径
-		* 一律不碰 —— 否则对话里到处都是 `.dsh-images/…` 的例子，每个都会被渲染成图。
-		*
-		* 取图走宿主那条只读路由 `/plugin/dsh-remote-bridge/raw?sessionId=…&name=…`：
-		* 请求里**只有会话与裸文件名**，目录由宿主按会话工作目录推出，客户端连「读哪个目录」
-		* 都递不进去。这条路是给 `<img>` 用的 —— 浏览器不会给图片请求加 Authorization 头，
-		* 所以它独立于版本化 REST，按回环 + 同源 + 文件名白名单 + 字节自证守门。
-		*
-		* 座位选的是 Turn 尾部（`conversation.chat.turnTail`）：Chat 节点座位会把这个 kind 收进
-		* 「过程分组」，standard 模式下折叠起来 —— DOM 里有、肉眼看不着。Turn 尾在独立成行的
-		* 白名单内，任何工作详情模式下都看得见。
-		*/
-		/** 本插件在 Chat store 里占的节点 kind。 */
-		const KIND = "dsh-remote-bridge-handoff-gallery";
-		/** 宿主的只读图片路由。 */
-		const ROUTE = "/plugin/dsh-remote-bridge/raw";
-		/** 每轮最多显示几张。 */
-		const MAX_IMAGES = 8;
-		/** 长过这个的路径不值得去解析。 */
-		const MAX_PATH_CHARS = 4096;
-		/** 图片扩展名：与宿主交接写盘的白名单一致。 */
-		const IMAGE_EXTENSION = /\.(?:png|jpe?g|webp|gif|heic|heif|bmp|avif)$/i;
-		/**
-		* 交接行的行首标记：中英两种文案都以它开头。
-		*
-		* 判据选「行首标记」而不是「句子里有 已存到」——后者会把用户自己写的句子也算进来，
-		* 而 dsh-companion 摘除这一行用的也是同一个标记，两边口径一致。
-		*/
-		const HANDOFF_LINE = /^🖼️\s*(?:图片|Image)\s+\d+/i;
-		/**
-		* 从交接行里抠出图片地址。
-		*
-		* 允许「已存到 / 已保存到 / saved to」后面隔一段散文（历史文案里有「工作目录」这种词），
-		* 所以是「点心号 + 非贪婪」而不是紧邻匹配。取出的是消息里**原样**的那条路径，
-		* 相对（`.dsh-images/x.png`）与绝对（兜底目录那版）都认。
-		*/
-		const HANDOFF_PATH = /(?:已(?:保存|存)到|saved to)[^；;\n]*?([A-Za-z0-9_./@~+-][^\s`"'()[\]{}<>|,;:?，。；：、！？]*?\.(?:png|jpe?g|webp|gif|heic|heif|bmp|avif))/i;
-		/** 路径里的文件名（路由只收裸文件名）。 */
-		function basenameOf(path) {
-			const cut = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
-			return cut === -1 ? path : path.slice(cut + 1);
-		}
-		/**
-		* 读出一段文本里的交接图片。
-		* @param text - 消息的文本内容（已按块拼接）。
-		* @returns 单个 `{ path, label }`，不是交接消息就是 null。
-		*/
-		function handoffMention(text) {
-			if (typeof text !== "string" || text === "") return null;
-			for (const line of text.split("\n")) {
-				if (!HANDOFF_LINE.test(line.trim())) continue;
-				const match = HANDOFF_PATH.exec(line);
-				if (match === null) continue;
-				const path = match[1] ?? "";
-				if (path.length === 0 || path.length > MAX_PATH_CHARS) continue;
-				if (!IMAGE_EXTENSION.test(path)) continue;
-				return {
-					path,
-					label: basenameOf(path)
-				};
-			}
-			return null;
-		}
-		/** 把一条消息的内容块拼成文本。 */
-		function contentText(content) {
-			if (!Array.isArray(content)) return "";
-			const parts = [];
-			for (const block of content) {
-				if (block === null || typeof block !== "object") continue;
-				const candidate = block;
-				if (candidate.type === "text" && typeof candidate.text === "string") parts.push(candidate.text);
-			}
-			return parts.join("\n");
-		}
-		/** 一条消息交接出去的那张图，没有就是空数组。 */
-		function itemsOfMessage(payload) {
-			if (payload === null || typeof payload !== "object") return [];
-			const item = handoffMention(contentText(payload.content));
-			return item === null ? [] : [item];
-		}
-		const WRAP_STYLE = {
-			display: "flex",
-			flexWrap: "wrap",
-			alignItems: "flex-start",
-			gap: 8,
-			margin: "8px 0 4px"
-		};
-		const ITEM_STYLE = {
-			display: "flex",
-			flexDirection: "column",
-			gap: 2,
-			maxWidth: "100%"
-		};
-		const THUMB_STYLE = {
-			display: "block",
-			maxHeight: 180,
-			maxWidth: "100%",
-			borderRadius: 8,
-			border: "1px solid rgba(127,127,127,0.28)",
-			background: "rgba(127,127,127,0.06)",
-			cursor: "zoom-in"
-		};
-		const CAPTION_STYLE = {
-			display: "block",
-			maxWidth: 180,
-			fontFamily: "inherit",
-			fontSize: 11,
-			lineHeight: 1.4,
-			color: "rgba(127,127,127,0.95)",
-			overflow: "hidden",
-			textOverflow: "ellipsis",
-			whiteSpace: "nowrap"
-		};
-		const OVERLAY_STYLE = {
-			position: "fixed",
-			inset: 0,
-			zIndex: 1e3,
-			display: "flex",
-			alignItems: "center",
-			justifyContent: "center",
-			background: "rgba(0,0,0,0.72)",
-			cursor: "zoom-out"
-		};
-		const FULL_STYLE = {
-			maxWidth: "92vw",
-			maxHeight: "92vh",
-			borderRadius: 6,
-			boxShadow: "0 8px 32px rgba(0,0,0,0.5)"
-		};
-		/** 某条地址在这条路由上的 URL。 */
-		function imageUrl(path, sessionId) {
-			return `${ROUTE}?sessionId=${encodeURIComponent(sessionId)}&name=${encodeURIComponent(basenameOf(path))}`;
-		}
-		/**
-		* 一张图。取不到的（文件已删、会话读不出、格式不符）自己消失，而不是在轮末留一个碎图标。
-		*/
-		function HandoffImage(props) {
-			const [failed, setFailed] = (0, react.useState)(false);
-			const [open, setOpen] = (0, react.useState)(false);
-			(0, react.useEffect)(() => {
-				if (!open) return void 0;
-				const onKey = (event) => {
-					if (event.key === "Escape") setOpen(false);
-				};
-				document.addEventListener("keydown", onKey);
-				return () => {
-					document.removeEventListener("keydown", onKey);
-				};
-			}, [open]);
-			if (failed) return null;
-			const url = imageUrl(props.item.path, props.sessionId);
-			const thumb = /* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
-				src: url,
-				alt: props.item.label,
-				title: props.item.path,
-				loading: "lazy",
-				decoding: "async",
-				referrerPolicy: "no-referrer",
-				style: THUMB_STYLE,
-				onError: () => setFailed(true),
-				onClick: () => setOpen(true)
-			});
-			const framed = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "daw-handoff-item",
-				style: ITEM_STYLE,
-				children: [thumb, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-					className: "daw-handoff-caption",
-					title: props.item.path,
-					style: CAPTION_STYLE,
-					children: props.item.path
-				})]
-			});
-			if (!open) return framed;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [framed, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-				style: OVERLAY_STYLE,
-				role: "dialog",
-				"aria-label": props.item.path,
-				onClick: () => setOpen(false),
-				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
-					src: url,
-					alt: props.item.label,
-					decoding: "async",
-					referrerPolicy: "no-referrer",
-					style: FULL_STYLE
-				})
-			})] });
-		}
-		/** 把本轮各节点里交接出去的图收成一串（按出现顺序去重）。 */
-		function collectTurnItems(nodes, locations, turn) {
-			if (nodes === void 0 || locations === void 0 || turn === void 0 || turn === null) return [];
-			let keys;
-			try {
-				keys = locations.getTurn(turn.turn);
-			} catch {
-				return [];
-			}
-			if (!Array.isArray(keys)) return [];
-			const seen = /* @__PURE__ */ new Set();
-			const items = [];
-			for (const key of keys) {
-				const node = nodes.get(key);
-				if (node === void 0 || node === null || node.kind !== KIND) continue;
-				const list = node.data?.items;
-				if (!Array.isArray(list)) continue;
-				for (const item of list) {
-					if (item === null || typeof item !== "object" || typeof item.path !== "string") continue;
-					if (seen.has(item.path)) continue;
-					seen.add(item.path);
-					items.push({
-						path: item.path,
-						label: typeof item.label === "string" ? item.label : basenameOf(item.path)
-					});
-					if (items.length >= MAX_IMAGES) return items;
-				}
-			}
-			return items;
-		}
 		/**
-		* Turn 尾部的图集：本轮每条交接消息各自那张图。
+		* @license lucide-react v0.468.0 - ISC
 		*
-		* 没有会话 id 就什么都不显示 —— 路由需要它来定位目录，猜一个只会 404。
+		* This source code is licensed under the ISC license.
+		* See the LICENSE file in the root directory of this source tree.
 		*/
-		function HandoffTurnTail(props) {
-			const items = collectTurnItems(props.useChat((snapshot) => snapshot.nodes), props.useChat((snapshot) => snapshot.locations), props.turn);
-			const sessionId = props.sessionId;
-			if (items.length === 0) return null;
-			if (typeof sessionId !== "string" || sessionId === "") return null;
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-				className: "daw-handoff-gallery",
-				style: WRAP_STYLE,
-				children: items.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HandoffImage, {
-					item,
-					sessionId
-				}, item.path))
-			});
-		}
-		/**
-		* 一条「交接消息 → 一个图集节点」的 Definition。
-		*
-		* 只匹配 `user/message`：交接说明属于读者自己发的那条消息。助手正文、上下文注入、
-		* 工具输出里到处都是引用 `.dsh-images/…` 的文本，读它们会把别人的话切成碎图。
-		*
-		* 节点自身**不注册渲染器**（Turn 尾负责显示），所以过程分组里不会多出一行、
-		* verbose 模式下也不会重复一次。
-		*/
-		const handoffDefinition = {
-			kind: KIND,
-			target: "chat",
-			match(event) {
-				if (event === null || typeof event !== "object" || event.surfaceOp !== "append") return null;
-				if (event.type !== "user/message") return null;
-				return {
-					id: `m:${String(event.seq)}`,
-					role: "start"
-				};
-			},
-			start(_context, match) {
-				return {
-					items: itemsOfMessage(match.event.data),
-					anchorSeq: match.event.seq
-				};
-			},
-			update(context) {
-				return context.state;
-			},
-			buildViewNode(context) {
-				const state = context.state;
-				if (state === void 0 || !Array.isArray(state.items) || state.items.length === 0) return null;
-				const start = context.start;
-				return {
-					key: context.key,
-					kind: KIND,
-					id: context.id,
-					target: "chat",
-					anchorSeq: state.anchorSeq,
-					location: start !== void 0 && start !== null ? start.location : { kind: "unresolved" },
-					visibility: "visible",
-					data: { items: state.items }
-				};
-			}
-		};
-		//#endregion
-		//#region node_modules/.pnpm/lucide-react@0.468.0_react@18.3.1/node_modules/lucide-react/dist/cjs/lucide-react.js
-		/**
-		* @license lucide-react v0.468.0 - ISC
-		*
-		* This source code is licensed under the ISC license.
-		* See the LICENSE file in the root directory of this source tree.
-		*/
-		var require_lucide_react = /* @__PURE__ */ __commonJSMin(((exports) => {
-			var react$1 = require("react");
-			const toKebabCase = (string) => string.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-			const mergeClasses = (...classes) => classes.filter((className, index, array) => {
-				return Boolean(className) && className.trim() !== "" && array.indexOf(className) === index;
-			}).join(" ").trim();
-			var defaultAttributes = {
-				xmlns: "http://www.w3.org/2000/svg",
-				width: 24,
-				height: 24,
-				viewBox: "0 0 24 24",
-				fill: "none",
-				stroke: "currentColor",
-				strokeWidth: 2,
-				strokeLinecap: "round",
-				strokeLinejoin: "round"
-			};
-			const Icon = react$1.forwardRef(({ color = "currentColor", size = 24, strokeWidth = 2, absoluteStrokeWidth, className = "", children, iconNode, ...rest }, ref) => {
-				return react$1.createElement("svg", {
-					ref,
-					...defaultAttributes,
-					width: size,
-					height: size,
-					stroke: color,
-					strokeWidth: absoluteStrokeWidth ? Number(strokeWidth) * 24 / Number(size) : strokeWidth,
-					className: mergeClasses("lucide", className),
-					...rest
-				}, [...iconNode.map(([tag, attrs]) => react$1.createElement(tag, attrs)), ...Array.isArray(children) ? children : [children]]);
+		//#endregion
+		//#region src/client/i18n.tsx
+		var import_lucide_react = (/* @__PURE__ */ __commonJSMin(((exports) => {
+			var react$1 = require("react");
+			const toKebabCase = (string) => string.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+			const mergeClasses = (...classes) => classes.filter((className, index, array) => {
+				return Boolean(className) && className.trim() !== "" && array.indexOf(className) === index;
+			}).join(" ").trim();
+			var defaultAttributes = {
+				xmlns: "http://www.w3.org/2000/svg",
+				width: 24,
+				height: 24,
+				viewBox: "0 0 24 24",
+				fill: "none",
+				stroke: "currentColor",
+				strokeWidth: 2,
+				strokeLinecap: "round",
+				strokeLinejoin: "round"
+			};
+			const Icon = react$1.forwardRef(({ color = "currentColor", size = 24, strokeWidth = 2, absoluteStrokeWidth, className = "", children, iconNode, ...rest }, ref) => {
+				return react$1.createElement("svg", {
+					ref,
+					...defaultAttributes,
+					width: size,
+					height: size,
+					stroke: color,
+					strokeWidth: absoluteStrokeWidth ? Number(strokeWidth) * 24 / Number(size) : strokeWidth,
+					className: mergeClasses("lucide", className),
+					...rest
+				}, [...iconNode.map(([tag, attrs]) => react$1.createElement(tag, attrs)), ...Array.isArray(children) ? children : [children]]);
 			});
 			const createLucideIcon = (iconName, iconNode) => {
 				const Component = react$1.forwardRef(({ className, ...props }, ref) => react$1.createElement(Icon, {
@@ -6770,7 +6493,7 @@ window.__ModuleLoader__.load({
 				d: "m22 10-7.5 7.5L13 16",
 				key: "ke71qq"
 			}]]);
-			createLucideIcon("Check", [["path", {
+			const Check = createLucideIcon("Check", [["path", {
 				d: "M20 6 9 17l-5-5",
 				key: "1gmf2c"
 			}]]);
@@ -9169,7 +8892,7 @@ window.__ModuleLoader__.load({
 					key: "zix9uf"
 				}]
 			]);
-			createLucideIcon("Copy", [["rect", {
+			const Copy = createLucideIcon("Copy", [["rect", {
 				width: "14",
 				height: "14",
 				x: "8",
@@ -15939,7 +15662,7 @@ window.__ModuleLoader__.load({
 					key: "jkujk7"
 				}]
 			]);
-			createLucideIcon("Languages", [
+			const Languages = createLucideIcon("Languages", [
 				["path", {
 					d: "m5 8 6 6",
 					key: "1wu5hv"
@@ -23108,7 +22831,7 @@ window.__ModuleLoader__.load({
 					key: "1o3tu8"
 				}]
 			]);
-			createLucideIcon("ScrollText", [
+			const ScrollText = createLucideIcon("ScrollText", [
 				["path", {
 					d: "M15 12h-5",
 					key: "r7krc0"
@@ -30050,16 +29773,18 @@ window.__ModuleLoader__.load({
 					key: "durymu"
 				}]
 			]);
+			exports.Check = Check;
+			exports.Copy = Copy;
 			exports.Download = Download;
 			exports.File = File;
 			exports.HardDrive = HardDrive;
 			exports.Image = Image;
+			exports.Languages = Languages;
+			exports.ScrollText = ScrollText;
 			exports.Smartphone = Smartphone;
 			exports.Trash2 = Trash2;
 			exports.Upload = Upload;
-		}));
-		//#endregion
-		//#region src/client/i18n.tsx
+		})))();
 		const STORAGE_KEY = "dsh-workspace-locale";
 		const dictionaries = {
 			"zh-CN": {
@@ -30231,6 +29956,54 @@ window.__ModuleLoader__.load({
 				errorNotFound: "请求的文件或资源不存在。",
 				errorConflict: "目标已存在或当前状态发生冲突。",
 				errorRateLimited: "请求过于频繁，请稍后重试。",
+				errorTunnelModeAdminDisabled: "云隧道正在运行，管理面已停用。请先在本机面板里停止隧道，或直接在本机 WebUI 操作。",
+				errorAdminProxyForwarded: "管理面不接受经代理转发的请求。请在本机用 127.0.0.1 或 localhost 直接打开。",
+				errorAdminHostNotLoopback: "管理面只在本机回环地址下可用。请用 127.0.0.1 或 localhost 打开本页。",
+				errorAdminLoopbackRequired: "此操作只能在本机执行。",
+				tunnelStageLocating: "正在定位本机 cloudflared…",
+				tunnelStageBinaryFound: "已找到本机二进制，直接复用",
+				tunnelStageDownloadGithub: "正在从 GitHub 下载 cloudflared…",
+				tunnelStageDownloadDeb: "正在从官方 deb 仓库下载 cloudflared…",
+				tunnelStageDownloadProgress: "正在下载 cloudflared… {mb}/{all} MB",
+				tunnelStageDownloadUnverified: "镜像源没有可用的校验和，仍在下载但本次不做完整性校验…",
+				tunnelStageUnpackDeb: "解包官方 deb 并提取二进制…",
+				tunnelStageWriteBinary: "写入二进制并赋予执行权限…",
+				tunnelStageStarting: "正在启动 cloudflared 隧道…",
+				tunnelErrorAlreadyRunning: "隧道已经在运行中，请先停止。",
+				tunnelErrorDownload: "下载 cloudflared 失败，请检查网络后重试；如需换源可设置 CLOUDFLARED_MIRROR。",
+				tunnelErrorExited: "cloudflared 已退出（code={code}，signal={signal}），未拿到隧道地址。",
+				tunnelStopConfirm: "停止云隧道后，公网临时地址立即失效，正在经隧道连接的手机会断开。确定停止吗？",
+				tunnelStartAndGenConfig: "开启隧道并生成配置",
+				tunnelRestartAndGenConfig: "停止后重开隧道并生成配置",
+				managementLockedWhileTunnel: "云隧道正在运行，管理面已安全锁定。除停止隧道外的配置暂时不可改，停止隧道后自动恢复。",
+				tunnelConfigAuto: "隧道已开启，配置文本已自动生成",
+				tunnelUrlPending: "隧道已启动，但暂时还没拿到公网地址，稍等片刻后点「用隧道地址生成配置」即可。",
+				copyUrl: "复制地址",
+				pairingExpiresAt: "配对码有效期约 {minutes} 分钟，请尽快在手机上输入。",
+				copyPairing: "复制配对码",
+				pairingCreated: "配对码已生成",
+				configCreated: "配置文本已生成",
+				revokeConfirm: "吊销后这台手机的令牌立即失效，必须重新配对才能访问。确定吊销「{name}」吗？",
+				removeRootConfirm: "移除根目录「{label}」不会删除磁盘上的文件，但所有手机将立刻失去对它的访问权。确定移除吗？",
+				disableRemoteConfirm: "关闭远程访问后，所有手机连接立即断开，需要重新启用并配对。确定关闭吗？",
+				rootAdded: "根目录已添加",
+				rootRemoved: "根目录已移除",
+				remoteDisabled: "远程访问已关闭",
+				permissionsSaved: "权限已保存",
+				deviceRevoked: "设备已吊销",
+				listenerSaved: "监听设置已保存",
+				trashRestored: "已恢复",
+				trashPurged: "已永久删除",
+				tunnelStarted: "云隧道已开启",
+				auditEmpty: "暂无审计事件",
+				auditLoadMore: "加载更多",
+				auditLoading: "正在加载…",
+				trashEmpty: "回收站是空的",
+				deviceLastSeen: "最后使用 {time}",
+				deviceNeverSeen: "从未连接",
+				imageLoadFailed: "图片加载失败",
+				prevImage: "上一张",
+				nextImage: "下一张",
 				author: "作者 Github@Hakunm",
 				version: "当前版本"
 			},
@@ -30317,7 +30090,7 @@ window.__ModuleLoader__.load({
 				removeRoot: "Remove root",
 				builtinRootBadge: "Default",
 				builtinRootHint: "Default directory · cannot be removed",
-				builtinRootNotice: "New roots are not granted to already paired phones by default. To share one, open 「设备」 and tick that directory for the phone in question.",
+				builtinRootNotice: "New roots are not granted to already paired phones by default. To share one, open the Devices card and tick that directory for the phone in question.",
 				errorRootBuiltin: "This is the current DSH working directory, so it cannot be removed. You can still add other roots above.",
 				scopeChatRead: "Read chat",
 				scopeChatWrite: "Send chat",
@@ -30403,6 +30176,54 @@ window.__ModuleLoader__.load({
 				errorNotFound: "The requested file or resource was not found.",
 				errorConflict: "The target already exists or its state has changed.",
 				errorRateLimited: "Too many requests. Try again shortly.",
+				errorTunnelModeAdminDisabled: "The Cloudflare tunnel is running, so management endpoints are disabled. Stop the tunnel in the local panel, or use the local WebUI.",
+				errorAdminProxyForwarded: "Management endpoints do not accept proxied requests. Open them locally via 127.0.0.1 or localhost.",
+				errorAdminHostNotLoopback: "Management endpoints are available only under a loopback address. Open this page via 127.0.0.1 or localhost.",
+				errorAdminLoopbackRequired: "This operation is available only from the local machine.",
+				tunnelStageLocating: "Locating the local cloudflared binary…",
+				tunnelStageBinaryFound: "Local binary found, reusing it",
+				tunnelStageDownloadGithub: "Downloading cloudflared from GitHub…",
+				tunnelStageDownloadDeb: "Downloading cloudflared from the official deb repo…",
+				tunnelStageDownloadProgress: "Downloading cloudflared… {mb}/{all} MB",
+				tunnelStageDownloadUnverified: "No checksum is published for this mirror; downloading without an integrity check…",
+				tunnelStageUnpackDeb: "Unpacking the deb and extracting the binary…",
+				tunnelStageWriteBinary: "Writing the binary and marking it executable…",
+				tunnelStageStarting: "Starting the cloudflared tunnel…",
+				tunnelErrorAlreadyRunning: "The tunnel is already running. Stop it first.",
+				tunnelErrorDownload: "Downloading cloudflared failed. Check the network and retry; set CLOUDFLARED_MIRROR to use another source.",
+				tunnelErrorExited: "cloudflared exited (code={code}, signal={signal}) before a tunnel address was obtained.",
+				tunnelStopConfirm: "Stopping the tunnel invalidates the public address immediately and disconnects phones currently connected through it. Stop anyway?",
+				tunnelStartAndGenConfig: "Start tunnel & generate config",
+				tunnelRestartAndGenConfig: "Restart tunnel & generate config",
+				managementLockedWhileTunnel: "The Cloudflare tunnel is running, so the management surface is safely locked. Everything except stopping the tunnel is read-only until you stop it.",
+				tunnelConfigAuto: "Tunnel started; config text generated automatically",
+				tunnelUrlPending: "The tunnel is starting but its public address is not ready yet. Wait a moment, then press “Generate config with tunnel address”.",
+				copyUrl: "Copy address",
+				pairingExpiresAt: "The pairing code is valid for about {minutes} minutes — enter it on the phone soon.",
+				copyPairing: "Copy code",
+				pairingCreated: "Pairing code generated",
+				configCreated: "Config text generated",
+				revokeConfirm: "Revoking invalidates this phone’s token at once; it must pair again to regain access. Revoke “{name}”?",
+				removeRootConfirm: "Removing “{label}” does not delete files on disk, but every phone immediately loses access to it. Remove it?",
+				disableRemoteConfirm: "Disabling remote access drops every phone connection right away; it must be re-enabled and re-paired. Disable it?",
+				rootAdded: "Root added",
+				rootRemoved: "Root removed",
+				remoteDisabled: "Remote access disabled",
+				permissionsSaved: "Permissions saved",
+				deviceRevoked: "Device revoked",
+				listenerSaved: "Listener settings saved",
+				trashRestored: "Restored",
+				trashPurged: "Permanently deleted",
+				tunnelStarted: "Tunnel started",
+				auditEmpty: "No audit events yet",
+				auditLoadMore: "Load more",
+				auditLoading: "Loading…",
+				trashEmpty: "The recycle bin is empty",
+				deviceLastSeen: "Last seen {time}",
+				deviceNeverSeen: "Never connected",
+				imageLoadFailed: "Image failed to load",
+				prevImage: "Previous image",
+				nextImage: "Next image",
 				author: "Author Github@Hakunm",
 				version: "Current version"
 			}
@@ -30412,76 +30233,553 @@ window.__ModuleLoader__.load({
 		function getWorkspaceLocale() {
 			return currentLocale;
 		}
-		function setWorkspaceLocale(locale) {
-			if (locale === currentLocale) return;
-			currentLocale = locale;
+		function setWorkspaceLocale(locale) {
+			if (locale === currentLocale) return;
+			currentLocale = locale;
+			try {
+				globalThis.localStorage?.setItem(STORAGE_KEY, locale);
+			} catch {}
+			for (const listener of listeners) listener();
+		}
+		function subscribeWorkspaceLocale(listener) {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		}
+		/**
+		* 取一条文案并填占位符。
+		*
+		* **缺键不抛异常**。原来这里是 `dictionaries[locale][key].replace(...)`：任何一个不存在的键
+		* 都会抛 TypeError，而它在 React 渲染路径上 —— 结果不是那一行显示不出原文，而是**整个设置
+		* 面板白屏**。缺一个描述行就把七张卡里的全部设置都搭进去，代价和收益完全不成比例。
+		*
+		* 降级成「回退到另一种语言 → 再回退成键名本身」：最坏情况是某一行露出 `rootsTabDesc`
+		* 这样的字面量，一眼能看出该补哪条，而不是面对一个空白面板。
+		*/
+		function translate(locale, key, values = {}) {
+			const fill = (template) => template?.replace(/\{(\w+)\}/g, (_, name) => String(values[name] ?? `{${name}}`));
+			const primary = fill(dictionaries[locale][key]);
+			if (primary !== void 0) return primary;
+			const text = fill(dictionaries["zh-CN"][key]) ?? key;
+			console.warn(`[dsh-remote-bridge] 缺少文案键 ${String(key)}（locale=${locale}），已降级显示键名`);
+			return text;
+		}
+		/**
+		* 权限码 → 人话。
+		*
+		* 用户要求「中文状态下显示中文，英文显示英文」。文案刻意**用人话而不是协议码**：
+		* `读文件` / `写文件` / `删文件` 自己就看得懂，而 `files.read` 要对照文档才知道指什么 ——
+		* 出问题时用户把屏幕上的字念出来，比报一串码有用得多。
+		*
+		* 键名 `scope${码}`（`chat.read` → `scopeChatRead`）：与既有 `rootsTab` 一致的拼法。
+		* 用**显式查表**而不是模板拼 —— 拼错会查不到键，而键查不到时 `translate` 会静默降级成
+		* 露出键名（见上面），界面上会突然冒出一行 `scopeChatread`。白屏那次就是这么来的。
+		*/
+		const SCOPE_LABEL_KEYS = {
+			"chat.read": "scopeChatRead",
+			"chat.write": "scopeChatWrite",
+			"files.read": "scopeFilesRead",
+			"files.write": "scopeFilesWrite",
+			"files.delete": "scopeFilesDelete",
+			"settings.read": "scopeSettingsRead",
+			"settings.write": "scopeSettingsWrite"
+		};
+		function scopeLabel(locale, scope) {
+			const key = SCOPE_LABEL_KEYS[scope];
+			if (key === void 0) return scope;
+			return translate(locale, key);
+		}
+		function useWorkspaceI18n() {
+			const locale = (0, react.useSyncExternalStore)(subscribeWorkspaceLocale, getWorkspaceLocale, () => "zh-CN");
+			return {
+				locale,
+				t: (0, react.useCallback)((key, values) => translate(locale, key, values), [locale]),
+				toggle: (0, react.useCallback)(() => setWorkspaceLocale(locale === "zh-CN" ? "en" : "zh-CN"), [locale])
+			};
+		}
+		function LanguageToggle() {
+			const { t, toggle } = useWorkspaceI18n();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+				className: "daw-icon",
+				type: "button",
+				title: t("switchLanguage"),
+				"aria-label": t("switchLanguage"),
+				onClick: toggle,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Languages, { size: 16 })
+			});
+		}
+		function readStoredLocale() {
+			try {
+				return globalThis.localStorage?.getItem(STORAGE_KEY) === "en" ? "en" : "zh-CN";
+			} catch {
+				return "zh-CN";
+			}
+		}
+		//#endregion
+		//#region src/client/handoff.tsx
+		/**
+		* 浏览器半边：把**图片交接消息**里的那个地址渲染成图片本身。
+		*
+		* 这半边是从 `dsh-image-paths` 0.3.1 并过来的，接的是同一个契约：纯文本模型收到图片时，
+		* remote-bridge 会在用户消息里追加两行 ——
+		*
+		*   🖼️ 图片 1「shot.png」（当前模型看不到图，已存到 .dsh-images/<sha>.png；要看图，请用识图工具打开下面那行的路径）
+		*   [Image: source: /absolute/path/.dsh-images/<sha>.png]
+		*
+		* 本模块只读第一行里那个地址，把它变成一张真的图。第二行是给模型读的机器契约，同一张图
+		* 不再重复出第二张；而且只扫**用户消息**，上下文注入、助手正文、工具输出里引用的路径
+		* 一律不碰 —— 否则对话里到处都是 `.dsh-images/…` 的例子，每个都会被渲染成图。
+		*
+		* 取图走宿主那条只读路由 `/plugin/dsh-remote-bridge/raw?sessionId=…&name=…`：
+		* 请求里**只有会话与裸文件名**，目录由宿主按会话工作目录推出，客户端连「读哪个目录」
+		* 都递不进去。这条路是给 `<img>` 用的 —— 浏览器不会给图片请求加 Authorization 头，
+		* 所以它独立于版本化 REST，按回环 + 同源 + 文件名白名单 + 字节自证守门。
+		*
+		* 座位选的是 Turn 尾部（`conversation.chat.turnTail`）：Chat 节点座位会把这个 kind 收进
+		* 「过程分组」，standard 模式下折叠起来 —— DOM 里有、肉眼看不着。Turn 尾在独立成行的
+		* 白名单内，任何工作详情模式下都看得见。
+		*/
+		/** 本插件在 Chat store 里占的节点 kind。 */
+		const KIND = "dsh-remote-bridge-handoff-gallery";
+		/** 宿主的只读图片路由。 */
+		const ROUTE = "/plugin/dsh-remote-bridge/raw";
+		/** 每轮最多显示几张。 */
+		const MAX_IMAGES = 8;
+		/** 长过这个的路径不值得去解析。 */
+		const MAX_PATH_CHARS = 4096;
+		/** 图片扩展名：与宿主交接写盘的白名单一致。 */
+		const IMAGE_EXTENSION = /\.(?:png|jpe?g|webp|gif|heic|heif|bmp|avif)$/i;
+		/**
+		* 交接行的行首标记：中英两种文案都以它开头。
+		*
+		* 判据选「行首标记」而不是「句子里有 已存到」——后者会把用户自己写的句子也算进来，
+		* 而 dsh-companion 摘除这一行用的也是同一个标记，两边口径一致。
+		*/
+		const HANDOFF_LINE = /^🖼️\s*(?:图片|Image)\s+\d+/i;
+		/**
+		* 从交接行里抠出图片地址。
+		*
+		* 允许「已存到 / 已保存到 / saved to」后面隔一段散文（历史文案里有「工作目录」这种词），
+		* 所以是「点心号 + 非贪婪」而不是紧邻匹配。取出的是消息里**原样**的那条路径，
+		* 相对（`.dsh-images/x.png`）与绝对（兜底目录那版）都认。
+		*/
+		const HANDOFF_PATH = /(?:已(?:保存|存)到|saved to)[^；;\n]*?([A-Za-z0-9_./@~+-][^\s`"'()[\]{}<>|,;:?，。；：、！？]*?\.(?:png|jpe?g|webp|gif|heic|heif|bmp|avif))/i;
+		/** 路径里的文件名（路由只收裸文件名）。 */
+		function basenameOf(path) {
+			const cut = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
+			return cut === -1 ? path : path.slice(cut + 1);
+		}
+		/**
+		* 读出一段文本里的交接图片。
+		* @param text - 消息的文本内容（已按块拼接）。
+		* @returns 单个 `{ path, label }`，不是交接消息就是 null。
+		*/
+		function handoffMention(text) {
+			if (typeof text !== "string" || text === "") return null;
+			for (const line of text.split("\n")) {
+				if (!HANDOFF_LINE.test(line.trim())) continue;
+				const match = HANDOFF_PATH.exec(line);
+				if (match === null) continue;
+				const path = match[1] ?? "";
+				if (path.length === 0 || path.length > MAX_PATH_CHARS) continue;
+				if (!IMAGE_EXTENSION.test(path)) continue;
+				return {
+					path,
+					label: basenameOf(path)
+				};
+			}
+			return null;
+		}
+		/** 把一条消息的内容块拼成文本。 */
+		function contentText(content) {
+			if (!Array.isArray(content)) return "";
+			const parts = [];
+			for (const block of content) {
+				if (block === null || typeof block !== "object") continue;
+				const candidate = block;
+				if (candidate.type === "text" && typeof candidate.text === "string") parts.push(candidate.text);
+			}
+			return parts.join("\n");
+		}
+		/** 一条消息交接出去的那张图，没有就是空数组。 */
+		function itemsOfMessage(payload) {
+			if (payload === null || typeof payload !== "object") return [];
+			const item = handoffMention(contentText(payload.content));
+			return item === null ? [] : [item];
+		}
+		const WRAP_STYLE = {
+			display: "flex",
+			flexWrap: "wrap",
+			alignItems: "flex-start",
+			gap: 8,
+			margin: "8px 0 4px"
+		};
+		const ITEM_STYLE = {
+			display: "flex",
+			flexDirection: "column",
+			gap: 2,
+			maxWidth: "100%"
+		};
+		const THUMB_STYLE = {
+			display: "block",
+			maxHeight: 180,
+			maxWidth: "100%",
+			borderRadius: 8,
+			border: "1px solid rgba(127,127,127,0.28)",
+			background: "rgba(127,127,127,0.06)",
+			cursor: "zoom-in"
+		};
+		const CAPTION_STYLE = {
+			display: "block",
+			maxWidth: 180,
+			fontFamily: "inherit",
+			fontSize: 11,
+			lineHeight: 1.4,
+			color: "rgba(127,127,127,0.95)",
+			overflow: "hidden",
+			textOverflow: "ellipsis",
+			whiteSpace: "nowrap"
+		};
+		const OVERLAY_STYLE = {
+			position: "fixed",
+			inset: 0,
+			zIndex: 1e3,
+			display: "flex",
+			alignItems: "center",
+			justifyContent: "center",
+			background: "rgba(0,0,0,0.72)",
+			cursor: "zoom-out"
+		};
+		const FULL_STYLE = {
+			maxWidth: "92vw",
+			maxHeight: "92vh",
+			borderRadius: 6,
+			boxShadow: "0 8px 32px rgba(0,0,0,0.5)"
+		};
+		/** 加载失败的缩略图占位（不再像旧版那样整张消失，只留一个问号让人瞎猜）。 */
+		const THUMB_BROKEN_STYLE = {
+			...THUMB_STYLE,
+			display: "flex",
+			alignItems: "center",
+			justifyContent: "center",
+			width: 160,
+			height: 120,
+			cursor: "default",
+			fontSize: 12
+		};
+		const LIGHTBOX_NAV_STYLE = {
+			position: "absolute",
+			top: "50%",
+			transform: "translateY(-50%)",
+			zIndex: 1001,
+			width: 44,
+			height: 44,
+			borderRadius: "50%",
+			border: "none",
+			background: "rgba(255,255,255,0.14)",
+			color: "#fff",
+			fontSize: 22,
+			lineHeight: "44px",
+			textAlign: "center",
+			cursor: "pointer",
+			padding: 0
+		};
+		const LIGHTBOX_CLOSE_STYLE = {
+			position: "absolute",
+			top: 16,
+			right: 16,
+			zIndex: 1001,
+			width: 40,
+			height: 40,
+			borderRadius: "50%",
+			border: "none",
+			background: "rgba(255,255,255,0.14)",
+			color: "#fff",
+			fontSize: 20,
+			lineHeight: "40px",
+			textAlign: "center",
+			cursor: "pointer",
+			padding: 0
+		};
+		const LIGHTBOX_FULL_BROKEN_STYLE = {
+			...FULL_STYLE,
+			display: "flex",
+			alignItems: "center",
+			justifyContent: "center",
+			width: "min(72vw, 560px)",
+			height: "min(60vh, 360px)",
+			background: "rgba(127,127,127,0.18)",
+			color: "rgba(255,255,255,0.92)",
+			fontSize: 14
+		};
+		/** 某条地址在这条路由上的 URL。 */
+		function imageUrl(path, sessionId) {
+			return `${ROUTE}?sessionId=${encodeURIComponent(sessionId)}&name=${encodeURIComponent(basenameOf(path))}`;
+		}
+		/**
+		* 缩略图。取不到的（文件已删、会话读不出、格式不符）显示一块「加载失败」占位，
+		* 而不是像旧版那样整张消失——消失了用户只会以为模型没存图，根本不知道该重试。
+		*/
+		function HandoffThumb(props) {
+			const [failed, setFailed] = (0, react.useState)(false);
+			if (failed) return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "daw-handoff-item",
+				style: ITEM_STYLE,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					style: THUMB_BROKEN_STYLE,
+					title: props.item.path,
+					children: props.failedText
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "daw-handoff-caption",
+					title: props.item.path,
+					style: CAPTION_STYLE,
+					children: props.item.path
+				})]
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "daw-handoff-item",
+				style: ITEM_STYLE,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
+					src: imageUrl(props.item.path, props.sessionId),
+					alt: props.item.label,
+					title: props.item.path,
+					loading: "lazy",
+					decoding: "async",
+					referrerPolicy: "no-referrer",
+					style: THUMB_STYLE,
+					onError: () => setFailed(true),
+					onClick: props.onOpen
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "daw-handoff-caption",
+					title: props.item.path,
+					style: CAPTION_STYLE,
+					children: props.item.path
+				})]
+			});
+		}
+		/** 灯箱里的大图；换图时靠 key 重挂载来重置 failed。 */
+		function LightboxImage(props) {
+			const [failed, setFailed] = (0, react.useState)(false);
+			if (failed) return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				style: LIGHTBOX_FULL_BROKEN_STYLE,
+				children: props.failedText
+			});
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
+				src: imageUrl(props.item.path, props.sessionId),
+				alt: props.item.label,
+				decoding: "async",
+				referrerPolicy: "no-referrer",
+				style: FULL_STYLE,
+				onError: () => setFailed(true)
+			});
+		}
+		/**
+		* 图集灯箱：点遮罩空白处关闭，但**点图片本身不再误关**（旧版 img 的点击冒泡到 overlay）。
+		* 多图时左右切换，Esc 关闭。
+		*/
+		function HandoffLightbox(props) {
+			const { items, index, onClose, onPrev, onNext } = props;
+			const multiple = items.length > 1;
+			(0, react.useEffect)(() => {
+				const onKey = (event) => {
+					if (event.key === "Escape") onClose();
+					else if (multiple && event.key === "ArrowLeft") onPrev();
+					else if (multiple && event.key === "ArrowRight") onNext();
+				};
+				document.addEventListener("keydown", onKey);
+				return () => {
+					document.removeEventListener("keydown", onKey);
+				};
+			}, [
+				multiple,
+				onClose,
+				onPrev,
+				onNext
+			]);
+			const item = items[index];
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					...OVERLAY_STYLE,
+					cursor: "zoom-out"
+				},
+				role: "dialog",
+				"aria-modal": "true",
+				"aria-label": item.path,
+				onClick: onClose,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						style: LIGHTBOX_CLOSE_STYLE,
+						"aria-label": "×",
+						onClick: onClose,
+						children: "×"
+					}),
+					multiple && index > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						style: {
+							...LIGHTBOX_NAV_STYLE,
+							left: 24
+						},
+						"aria-label": props.prevLabel,
+						title: props.prevLabel,
+						onClick: (e) => {
+							e.stopPropagation();
+							onPrev();
+						},
+						children: "‹"
+					}) : null,
+					multiple && index < items.length - 1 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						type: "button",
+						style: {
+							...LIGHTBOX_NAV_STYLE,
+							right: 24
+						},
+						"aria-label": props.nextLabel,
+						title: props.nextLabel,
+						onClick: (e) => {
+							e.stopPropagation();
+							onNext();
+						},
+						children: "›"
+					}) : null,
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						style: {
+							position: "relative",
+							cursor: "default"
+						},
+						onClick: (e) => e.stopPropagation(),
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(LightboxImage, {
+							item,
+							sessionId: props.sessionId,
+							failedText: props.failedText
+						}, index), multiple ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							style: {
+								position: "absolute",
+								bottom: -28,
+								left: 0,
+								right: 0,
+								textAlign: "center",
+								color: "rgba(255,255,255,0.85)",
+								fontSize: 12
+							},
+							children: [
+								index + 1,
+								" / ",
+								items.length
+							]
+						}) : null]
+					})
+				]
+			});
+		}
+		/** 把本轮各节点里交接出去的图收成一串（按出现顺序去重）。 */
+		function collectTurnItems(nodes, locations, turn) {
+			if (nodes === void 0 || locations === void 0 || turn === void 0 || turn === null) return [];
+			let keys;
 			try {
-				globalThis.localStorage?.setItem(STORAGE_KEY, locale);
-			} catch {}
-			for (const listener of listeners) listener();
-		}
-		function subscribeWorkspaceLocale(listener) {
-			listeners.add(listener);
-			return () => listeners.delete(listener);
+				keys = locations.getTurn(turn.turn);
+			} catch {
+				return [];
+			}
+			if (!Array.isArray(keys)) return [];
+			const seen = /* @__PURE__ */ new Set();
+			const items = [];
+			for (const key of keys) {
+				const node = nodes.get(key);
+				if (node === void 0 || node === null || node.kind !== KIND) continue;
+				const list = node.data?.items;
+				if (!Array.isArray(list)) continue;
+				for (const item of list) {
+					if (item === null || typeof item !== "object" || typeof item.path !== "string") continue;
+					if (seen.has(item.path)) continue;
+					seen.add(item.path);
+					items.push({
+						path: item.path,
+						label: typeof item.label === "string" ? item.label : basenameOf(item.path)
+					});
+					if (items.length >= MAX_IMAGES) return items;
+				}
+			}
+			return items;
 		}
 		/**
-		* 取一条文案并填占位符。
-		*
-		* **缺键不抛异常**。原来这里是 `dictionaries[locale][key].replace(...)`：任何一个不存在的键
-		* 都会抛 TypeError，而它在 React 渲染路径上 —— 结果不是那一行显示不出原文，而是**整个设置
-		* 面板白屏**。缺一个描述行就把七张卡里的全部设置都搭进去，代价和收益完全不成比例。
+		* Turn 尾部的图集：本轮每条交接消息各自那张图。
 		*
-		* 降级成「回退到另一种语言 → 再回退成键名本身」：最坏情况是某一行露出 `rootsTabDesc`
-		* 这样的字面量，一眼能看出该补哪条，而不是面对一个空白面板。
+		* 没有会话 id 就什么都不显示 —— 路由需要它来定位目录，猜一个只会 404。
 		*/
-		function translate(locale, key, values = {}) {
-			const fill = (template) => template?.replace(/\{(\w+)\}/g, (_, name) => String(values[name] ?? `{${name}}`));
-			const primary = fill(dictionaries[locale][key]);
-			if (primary !== void 0) return primary;
-			const text = fill(dictionaries["zh-CN"][key]) ?? key;
-			console.warn(`[dsh-remote-bridge] 缺少文案键 ${String(key)}（locale=${locale}），已降级显示键名`);
-			return text;
+		function HandoffTurnTail(props) {
+			const items = collectTurnItems(props.useChat((snapshot) => snapshot.nodes), props.useChat((snapshot) => snapshot.locations), props.turn);
+			const sessionId = props.sessionId;
+			const { t } = useWorkspaceI18n();
+			const [activeIndex, setActiveIndex] = (0, react.useState)(null);
+			if (items.length === 0) return null;
+			if (typeof sessionId !== "string" || sessionId === "") return null;
+			const openIndex = activeIndex !== null && activeIndex < items.length ? activeIndex : null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "daw-handoff-gallery",
+				style: WRAP_STYLE,
+				children: items.map((item, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HandoffThumb, {
+					item,
+					sessionId,
+					failedText: t("imageLoadFailed"),
+					onOpen: () => setActiveIndex(index)
+				}, item.path))
+			}), openIndex !== null ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(HandoffLightbox, {
+				items,
+				index: openIndex,
+				sessionId,
+				failedText: t("imageLoadFailed"),
+				prevLabel: t("prevImage"),
+				nextLabel: t("nextImage"),
+				onClose: () => setActiveIndex(null),
+				onPrev: () => setActiveIndex((i) => i === null ? i : Math.max(0, i - 1)),
+				onNext: () => setActiveIndex((i) => i === null ? i : Math.min(items.length - 1, i + 1))
+			}) : null] });
 		}
 		/**
-		* 权限码 → 人话。
+		* 一条「交接消息 → 一个图集节点」的 Definition。
 		*
-		* 用户要求「中文状态下显示中文，英文显示英文」。文案刻意**用人话而不是协议码**：
-		* `读文件` / `写文件` / `删文件` 自己就看得懂，而 `files.read` 要对照文档才知道指什么 ——
-		* 出问题时用户把屏幕上的字念出来，比报一串码有用得多。
+		* 只匹配 `user/message`：交接说明属于读者自己发的那条消息。助手正文、上下文注入、
+		* 工具输出里到处都是引用 `.dsh-images/…` 的文本，读它们会把别人的话切成碎图。
 		*
-		* 键名 `scope${码}`（`chat.read` → `scopeChatRead`）：与既有 `rootsTab` 一致的拼法。
-		* 用**显式查表**而不是模板拼 —— 拼错会查不到键，而键查不到时 `translate` 会静默降级成
-		* 露出键名（见上面），界面上会突然冒出一行 `scopeChatread`。白屏那次就是这么来的。
+		* 节点自身**不注册渲染器**（Turn 尾负责显示），所以过程分组里不会多出一行、
+		* verbose 模式下也不会重复一次。
 		*/
-		const SCOPE_LABEL_KEYS = {
-			"chat.read": "scopeChatRead",
-			"chat.write": "scopeChatWrite",
-			"files.read": "scopeFilesRead",
-			"files.write": "scopeFilesWrite",
-			"files.delete": "scopeFilesDelete",
-			"settings.read": "scopeSettingsRead",
-			"settings.write": "scopeSettingsWrite"
-		};
-		function scopeLabel(locale, scope) {
-			const key = SCOPE_LABEL_KEYS[scope];
-			if (key === void 0) return scope;
-			return translate(locale, key);
-		}
-		function useWorkspaceI18n() {
-			const locale = (0, react.useSyncExternalStore)(subscribeWorkspaceLocale, getWorkspaceLocale, () => "zh-CN");
-			return {
-				locale,
-				t: (0, react.useCallback)((key, values) => translate(locale, key, values), [locale]),
-				toggle: (0, react.useCallback)(() => setWorkspaceLocale(locale === "zh-CN" ? "en" : "zh-CN"), [locale])
-			};
-		}
-		function readStoredLocale() {
-			try {
-				return globalThis.localStorage?.getItem(STORAGE_KEY) === "en" ? "en" : "zh-CN";
-			} catch {
-				return "zh-CN";
+		const handoffDefinition = {
+			kind: KIND,
+			target: "chat",
+			match(event) {
+				if (event === null || typeof event !== "object" || event.surfaceOp !== "append") return null;
+				if (event.type !== "user/message") return null;
+				return {
+					id: `m:${String(event.seq)}`,
+					role: "start"
+				};
+			},
+			start(_context, match) {
+				return {
+					items: itemsOfMessage(match.event.data),
+					anchorSeq: match.event.seq
+				};
+			},
+			update(context) {
+				return context.state;
+			},
+			buildViewNode(context) {
+				const state = context.state;
+				if (state === void 0 || !Array.isArray(state.items) || state.items.length === 0) return null;
+				const start = context.start;
+				return {
+					key: context.key,
+					kind: KIND,
+					id: context.id,
+					target: "chat",
+					anchorSeq: state.anchorSeq,
+					location: start !== void 0 && start !== null ? start.location : { kind: "unresolved" },
+					visibility: "visible",
+					data: { items: state.items }
+				};
 			}
-		}
+		};
 		//#endregion
 		//#region src/client/styles.ts
 		const STYLE_ID = "dsh-workspace-style";
@@ -30497,16 +30795,33 @@ window.__ModuleLoader__.load({
 		* 类型检查、单测、构建全都发现不了，只有肉眼看渲染或量计算样式才抓得到。
 		*/
 		const WORKSPACE_CSS = `
-.daw-version{font:600 11px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-muted);white-space:nowrap}
 .daw-root,.daw-settings-section{--daw-bg:var(--dsw-alias-bg-base,var(--dsw-alias-bg-layer-2,#f7f8fa));--daw-panel:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));--daw-ink:var(--dsw-alias-label-primary,#18202a);--daw-muted:var(--dsw-alias-label-tertiary,#687381);--daw-line:var(--dsw-alias-border-l2,#dfe4e8);--daw-accent:var(--dsw-alias-brand-primary,#087f8c);--daw-accent-soft:var(--dsw-alias-bg-module-platform,#e5f5f6);--daw-good:var(--dsw-alias-state-success-primary,#2f7d4a);--daw-danger:var(--dsw-alias-state-error-primary,#b33a3a);color:var(--daw-ink);background:transparent;font:13px/1.45 Inter,ui-sans-serif,system-ui,sans-serif;letter-spacing:0;min-width:0}
-.daw-root *{box-sizing:border-box;letter-spacing:0}
-.daw-input:focus-visible{border-color:var(--dsw-alias-brand-primary,var(--daw-accent));outline:none}.daw-icon{width:30px;padding:0}
+.daw-root *,.daw-settings-section *{box-sizing:border-box;letter-spacing:0}
+/* 输入控件基线（UI-04）：此前只有 :focus-visible 一条，非聚焦态全靠浏览器默认（2px inset/Arial/灰底），
+   深色令牌下实测白底黑字与面板割裂。这里给齐边框/底/字/内边距，聚焦态只换描边。 */
+.daw-input{width:100%;min-width:0;height:30px;padding:4px 9px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:6px;background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit}
+.daw-input::placeholder{color:var(--dsw-alias-label-tertiary,var(--daw-muted))}
+.daw-input:focus-visible{border-color:var(--dsw-alias-brand-primary,var(--daw-accent));outline:none}
+.daw-input:disabled{opacity:.55;cursor:not-allowed}.daw-icon{width:30px;padding:0}
 .daw-icon:hover{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}
 .daw-icon.danger{color:var(--daw-danger);border-color:transparent;background:transparent}
 .daw-icon:disabled{opacity:.45;cursor:not-allowed}
-.daw-command{padding:0 10px;border-color:#cbd2d8;background:#fff}.daw-command.primary{color:var(--dsw-alias-label-primary,var(--daw-ink));background:var(--dsw-alias-bg-module-platform,var(--daw-panel));border-color:var(--dsw-alias-border-l2,var(--daw-line));font-weight:500}
-.daw-command.primary:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}.daw-command.danger{color:var(--daw-danger)}.daw-filebar{display:flex;align-items:center;gap:6px;border-bottom:1px solid var(--daw-line);padding:4px 8px;min-width:0}.daw-admin{overflow:auto;padding:18px;display:flex;flex-direction:column;gap:10px}.daw-admin h3{font-size:14px;margin:0 0 12px}
-.daw-cards{display:grid;gap:10px}
+/* 普通命令按钮基线（UI-04）：旧版写死 background:#fff/border:#cbd2d8，深色令牌下成了白块黑字。
+   全部改走 DSH 令牌；.primary 沿用面板底色做次按钮、真正的主操作由调用方加 .primary 配合。 */
+.daw-command{height:30px;padding:0 12px;border-radius:6px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit;cursor:pointer}
+.daw-command:hover:not(:disabled){border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-command:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,var(--daw-accent));outline-offset:1px}
+/* 禁用态（UI-05）：此前无任何 :disabled 样式，只剩浏览器默认的 30% 文字且仍是箭头手型。 */
+.daw-command:disabled{opacity:.5;cursor:not-allowed}
+.daw-command.primary{color:var(--dsw-alias-label-primary,var(--daw-ink));background:var(--dsw-alias-bg-module-platform,var(--daw-panel));border-color:var(--dsw-alias-border-l2,var(--daw-line));font-weight:500}
+.daw-command.primary:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-command.danger{color:var(--daw-danger)}
+.daw-command.danger:hover:not(:disabled){border-color:var(--daw-danger)}
+/* 图标+文字的小复制按钮：图标和文字对齐，窄屏只露图标也不改变按钮高度。 */
+.daw-command.icon-as-command{display:inline-flex;align-items:center;gap:6px;padding:0 10px;white-space:nowrap}
+.daw-copy-label{font-size:12px}
+.daw-empty{padding:14px 2px;text-align:center}
+.daw-admin{overflow:auto;padding:18px;display:flex;flex-direction:column;gap:10px}.daw-admin h3{font-size:14px;margin:0 0 12px}
 .daw-card{border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));border-radius:12px;list-style:none;transition:border-color .16s,background .16s}
 .daw-card:hover{border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
 .daw-card-open{background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
@@ -30521,7 +30836,17 @@ window.__ModuleLoader__.load({
 .daw-card-body{border-top:1px solid var(--dsw-alias-border-l2,var(--daw-line));margin:0 16px;padding-bottom:8px}.daw-settings-section{display:grid;grid-template-rows:auto minmax(0,1fr);gap:10px;min-width:0;min-height:0}.daw-settings-section>.daw-list-meta{margin:0}.daw-settings-section .daw-admin{padding:14px 2px}.daw-qr-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin-top:12px}.daw-qr-card{margin:0;display:grid;justify-items:center;gap:8px;padding:16px;border:1px solid var(--daw-line);border-radius:6px;background:var(--daw-panel)}.daw-qr-image{width:180px;height:180px;background:var(--dsw-alias-bg-layer-3,#fff);border-radius:4px}.daw-qr-site{font-weight:600}.daw-qr-url{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-accent);text-decoration:none;overflow-wrap:anywhere;text-align:center}.daw-qr-url:hover{text-decoration:underline}.daw-form-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(120px,.45fr) auto;gap:8px;margin-bottom:14px}.daw-listener-form{display:grid;grid-template-columns:minmax(180px,1fr) 130px auto;gap:8px;align-items:end}.daw-field{display:grid;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:12px}.daw-listener-status{display:flex;flex-wrap:wrap;gap:5px 18px;padding:9px 0;color:var(--daw-muted);font:12px ui-monospace,SFMono-Regular,Consolas,monospace}.daw-listener-hint{margin:0 0 8px}.daw-list{border-top:1px solid var(--daw-line)}.daw-list-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:center;min-height:48px;border-bottom:1px solid var(--daw-line);padding:7px 2px}.daw-list-title{font-weight:600;overflow-wrap:anywhere}
 .daw-list-title .daw-pill{margin-left:8px;vertical-align:middle}
 .daw-builtin-hint{text-align:right;align-self:center}
-.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-row{display:flex;flex-wrap:wrap;gap:8px}.daw-inline-command{margin-left:8px}@mediaa(max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
+.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-command{margin-left:8px}
+/* 成功反馈条（UI-07）：与 .daw-warning 同形，但走成功色，操作成功不再静默。 */
+.daw-success{flex:none;border:1px solid var(--dsw-alias-state-success-primary,var(--daw-good));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--dsw-alias-state-success-primary,var(--daw-good));margin-bottom:0}
+.daw-admin-topbar{display:flex;justify-content:flex-end;margin-bottom:8px}
+.daw-url-row{display:flex;align-items:center;gap:8px;margin-top:8px}.daw-url-row .daw-tunnel-url{flex:1 1 auto;margin:0;min-width:0}
+.daw-code-row{display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin:12px 0}.daw-code-row .daw-code{margin:0;flex:1 1 220px;min-width:0}.daw-copy-inline{flex:none}
+/* 隧道/监听进行中的流动条（UI-08）：percent=null 时铺一段高光在轨道里循环滑动，
+   不再把「未知进度」伪装成恒定 30%。 */
+.daw-progress-fill.indeterminate{width:40%;background:linear-gradient(90deg,transparent,var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line))),transparent);animation:daw-indeterminate 1.1s ease-in-out infinite}
+@keyframes daw-indeterminate{0%{transform:translateX(-120%)}100%{transform:translateX(280%)}}
+@media (max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
 `;
 		function installWorkspaceStyles() {
 			if (document.getElementById(STYLE_ID) !== null) return;
@@ -30558,7 +30883,6 @@ window.__ModuleLoader__.load({
 		}];
 		//#endregion
 		//#region src/client/workspace.tsx
-		var import_lucide_react = require_lucide_react();
 		/** What the settings-page launcher opens: authorized roots, the first section. */
 		const DEFAULT_PANEL_SECTION = "roots";
 		/**
@@ -30571,9 +30895,37 @@ window.__ModuleLoader__.load({
 		function tabLabelKey(tab) {
 			return tab === "app-download" ? "appDownloadTab" : `${tab}Tab`;
 		}
-		/** 云隧道进度条宽度：有确定百分比则用之，否则给 30% 作「流动中」占位。 */
-		function pct(a) {
-			return `${a.percent ?? 30}%`;
+		/** 配对码剩余分钟：向上取整 —— 显示「约 9 分钟」比「约 8 分钟」在最后一刻更诚实。 */
+		function pairingMinutesLeft(expiresAt, now) {
+			return Math.max(0, Math.ceil((expiresAt - now) / 6e4));
+		}
+		/**
+		* 通用复制小按钮：成功后短暂换成对勾 + 「已复制」，2s 自动复位；
+		* 非安全上下文（HTTP/LAN）拿不到 Clipboard API 时退化为选中文本提示，见 copyText 的调用方。
+		*/
+		function CopyButton(props) {
+			const [state, setState] = (0, react.useState)("idle");
+			const [inFlight, setInFlight] = (0, react.useState)(false);
+			const label = state === "done" ? props.copiedText : state === "manual" ? props.manualText ?? props.title : props.title;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+				type: "button",
+				className: `daw-command icon-as-command${props.className === void 0 ? "" : ` ${props.className}`}`,
+				title: props.title,
+				"aria-label": props.title,
+				disabled: inFlight || state !== "idle",
+				onClick: () => {
+					if (inFlight) return;
+					setInFlight(true);
+					props.copyText(props.text).then((kind) => {
+						setState(kind === "done" ? "done" : "manual");
+						window.setTimeout(() => setState("idle"), kind === "done" ? 2e3 : 2500);
+					}).finally(() => setInFlight(false));
+				},
+				children: [state === "done" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Check, { size: 15 }) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Copy, { size: 15 }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "daw-copy-label",
+					children: label
+				})]
+			});
 		}
 		/**
 		* 卡片头部的描述行。与 `tabLabelKey` 同理：唯一含连字符的分区显式映射。
@@ -30713,9 +31065,52 @@ window.__ModuleLoader__.load({
 			const [openCards, setOpenCards] = (0, react.useState)(() => /* @__PURE__ */ new Set([props.initialOpen]));
 			const [imageSaved, setImageSaved] = (0, react.useState)(false);
 			const [error, setError] = (0, react.useState)();
+			const [notice, setNotice] = (0, react.useState)();
 			const [tunnel, setTunnel] = (0, react.useState)();
 			const [tunnelBusy, setTunnelBusy] = (0, react.useState)(false);
 			const [activity, setActivity] = (0, react.useState)();
+			const [auditLimit, setAuditLimit] = (0, react.useState)(50);
+			const [auditLoading, setAuditLoading] = (0, react.useState)(false);
+			const [now, setNow] = (0, react.useState)(() => Date.now());
+			const notify = (0, react.useCallback)((key, params) => {
+				setNotice(params === void 0 ? {
+					id: Date.now() + Math.random(),
+					key
+				} : {
+					id: Date.now() + Math.random(),
+					key,
+					params
+				});
+			}, []);
+			(0, react.useEffect)(() => {
+				if (notice === void 0) return;
+				const timer = window.setTimeout(() => setNotice(void 0), 3500);
+				return () => window.clearTimeout(timer);
+			}, [notice]);
+			(0, react.useEffect)(() => {
+				const timer = window.setInterval(() => setNow(Date.now()), 3e4);
+				return () => window.clearInterval(timer);
+			}, []);
+			const copyText = (0, react.useCallback)(async (text) => {
+				const clipboard = globalThis.navigator?.clipboard;
+				if (clipboard !== void 0) try {
+					await clipboard.writeText(text);
+					return "done";
+				} catch {}
+				try {
+					const node = document.createElement("textarea");
+					node.value = text;
+					node.style.position = "fixed";
+					node.style.top = "-9999px";
+					node.setAttribute("readonly", "");
+					document.body.append(node);
+					node.select();
+					const ok = document.execCommand("copy");
+					node.remove();
+					if (ok) return "done";
+				} catch {}
+				return "manual";
+			}, []);
 			const isOpen = (0, react.useCallback)((card) => openCards.has(card), [openCards]);
 			const toggleCard = (0, react.useCallback)((card) => {
 				setOpenCards((previous) => {
@@ -30725,6 +31120,9 @@ window.__ModuleLoader__.load({
 				});
 			}, []);
 			const refresh = (0, react.useCallback)(async () => {
+				try {
+					setTunnel(await props.api.tunnelStatus());
+				} catch {}
 				try {
 					const next = await props.api.status();
 					setStatus(next);
@@ -30736,49 +31134,157 @@ window.__ModuleLoader__.load({
 						setImageDraft(settings.subdir);
 						setImageSaved(false);
 					}
-					if (openCards.has("remote")) setTunnel(await props.api.tunnelStatus());
-					setError(void 0);
 				} catch (cause) {
-					setError(cause);
+					if (!(cause instanceof WorkspaceApiError && cause.status === 403 && (cause.code === "TUNNEL_MODE_ADMIN_DISABLED" || cause.code === "ADMIN_PROXY_FORWARDED"))) setError(cause);
 				}
 			}, [props.api, openCards]);
-			const createTunnel = (0, react.useCallback)(() => {
+			const tunnelErrorText = (0, react.useCallback)((s) => {
+				if (s.errorKey !== void 0) return t(s.errorKey, s.errorParams ?? {});
+				return s.error ?? t("listenerFailed");
+			}, [t]);
+			const pollActivityOnce = (0, react.useCallback)(async (active) => {
+				while (active()) {
+					try {
+						const a = await props.api.tunnelActivity();
+						if (!active()) return;
+						setActivity(a.stage === "idle" ? void 0 : a);
+					} catch {}
+					await delay(400);
+				}
+			}, [props.api]);
+			const waitForTunnelUrl = (0, react.useCallback)(async (active) => {
+				for (let attempt = 0; attempt < 40 && active(); attempt += 1) {
+					await delay(500);
+					const s = await props.api.tunnelStatus();
+					if (!active()) return null;
+					setTunnel(s);
+					if (s.errorKey !== void 0 || s.error !== void 0) throw new Error(tunnelErrorText(s));
+					if (s.running && s.url !== null) return s.url;
+				}
+				return null;
+			}, [props.api, tunnelErrorText]);
+			const generateConfigForUrl = (0, react.useCallback)(async (baseUrl, noticeKey = "configCreated") => {
+				setConfigTextBusy(true);
+				setError(void 0);
+				try {
+					const currentRoots = status?.roots ?? [];
+					const value = await props.api.createConfigText({
+						...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) },
+						endpoints: [{
+							label: t("tunnelEndpointLabel"),
+							baseUrl
+						}]
+					});
+					setConfigText(value);
+					notify(noticeKey);
+					return true;
+				} catch (cause) {
+					setError(cause);
+					return false;
+				} finally {
+					setConfigTextBusy(false);
+				}
+			}, [
+				props.api,
+				status,
+				t,
+				notify
+			]);
+			const createTunnel = (0, react.useCallback)(async (opts = {}) => {
 				if (!window.confirm(t("tunnelStartConfirm"))) return;
+				const wantConfig = opts.thenGenConfig === true;
+				let alive = true;
 				setTunnelBusy(true);
 				setError(void 0);
-				setActivity(void 0);
+				setConfigText(void 0);
 				setActivity({
 					stage: "locating",
-					label: "正在准备 cloudflared…",
+					labelKey: "tunnelStageLocating",
 					percent: null
 				});
-				const poll = window.setInterval(() => {
-					props.api.tunnelActivity().then((a) => {
-						if (a.stage !== "idle") setActivity(a);
-					}).catch(() => {});
-				}, 350);
-				props.api.tunnelCreate().then(async (next) => {
-					setTunnel(next);
+				pollActivityOnce(() => alive);
+				try {
+					const currentRoots = status?.roots ?? [];
+					const created = await props.api.tunnelCreate(wantConfig, { ...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) } });
+					setTunnel(created);
 					setActivity(void 0);
+					if (created.errorKey !== void 0 || created.error !== void 0) throw new Error(tunnelErrorText(created));
+					if (wantConfig && created.configText !== void 0) {
+						setConfigText(created.configText);
+						await refresh();
+						notify("tunnelConfigAuto");
+						return;
+					}
+					const url = created.url ?? await waitForTunnelUrl(() => alive);
 					await refresh();
-				}).catch(setError).finally(() => {
-					window.clearInterval(poll);
+					if (url === null) {
+						notify("tunnelUrlPending");
+						return;
+					}
+					if (wantConfig) await generateConfigForUrl(url, "tunnelConfigAuto");
+					else notify("tunnelStarted");
+				} catch (cause) {
+					setError(cause);
+				} finally {
+					alive = false;
 					setActivity(void 0);
 					setTunnelBusy(false);
-				});
+				}
 			}, [
 				props.api,
 				refresh,
-				t
-			]);
-			const stopTunnel = (0, react.useCallback)(() => {
+				status,
+				t,
+				notify,
+				pollActivityOnce,
+				waitForTunnelUrl,
+				tunnelErrorText,
+				generateConfigForUrl
+			]);
+			const stopTunnel = (0, react.useCallback)(async () => {
+				if (!window.confirm(t("tunnelStopConfirm"))) return;
 				setTunnelBusy(true);
 				setError(void 0);
-				props.api.tunnelStop().then(async (next) => {
+				try {
+					const next = await props.api.tunnelStop();
 					setTunnel(next);
 					await refresh();
-				}).catch(setError).finally(() => setTunnelBusy(false));
-			}, [props.api, refresh]);
+					notify("tunnelStopped");
+				} catch (cause) {
+					setError(cause);
+				} finally {
+					setTunnelBusy(false);
+				}
+			}, [
+				props.api,
+				refresh,
+				t,
+				notify
+			]);
+			const tunnelConfigClick = (0, react.useCallback)(async () => {
+				if (tunnel?.running === true) {
+					if (!window.confirm(t("tunnelStopConfirm"))) return;
+					setTunnelBusy(true);
+					setError(void 0);
+					try {
+						const stopped = await props.api.tunnelStop();
+						setTunnel(stopped);
+						await refresh();
+					} catch (cause) {
+						setError(cause);
+					} finally {
+						setTunnelBusy(false);
+					}
+					await createTunnel({ thenGenConfig: true });
+				} else await createTunnel({ thenGenConfig: true });
+			}, [
+				props.api,
+				tunnel,
+				t,
+				createTunnel,
+				refresh,
+				setError
+			]);
 			(0, react.useEffect)(() => {
 				refresh();
 			}, [refresh]);
@@ -30788,25 +31294,7 @@ window.__ModuleLoader__.load({
 				setListenerPort(String(status.configuredPort));
 			}, [status?.configuredHost, status?.configuredPort]);
 			const roots = status?.roots ?? [];
-			const genTunnelConfig = (0, react.useCallback)((baseUrl) => {
-				setConfigTextBusy(true);
-				setError(void 0);
-				props.api.createConfigText({
-					...roots.length === 0 ? {} : { rootIds: roots.map((root) => root.id) },
-					endpoints: [{
-						label: t("tunnelEndpointLabel"),
-						baseUrl
-					}]
-				}).then((value) => {
-					setConfigText(value);
-					return refresh();
-				}).catch(setError).finally(() => setConfigTextBusy(false));
-			}, [
-				props.api,
-				refresh,
-				roots,
-				t
-			]);
+			const managementLocked = tunnel?.running === true;
 			const [grantedScopes, setGrantedScopes] = (0, react.useState)([...DEVICE_SCOPES]);
 			const toggleScope = (0, react.useCallback)((scope) => {
 				setGrantedScopes((current) => current.includes(scope) ? current.filter((item) => item !== scope) : [...current, scope]);
@@ -30835,10 +31323,25 @@ window.__ModuleLoader__.load({
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("main", {
 				className: "daw-admin",
 				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-admin-topbar",
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(LanguageToggle, {})
+					}),
 					error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "daw-warning",
+						role: "alert",
 						children: messageOf(error, t)
 					}),
+					notice !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-success",
+						role: "status",
+						children: t(notice.key, notice.params)
+					}),
+					managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-warning",
+						role: "status",
+						children: t("managementLockedWhileTunnel")
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
 						tab: "roots",
 						nameKey: tabLabelKey("roots"),
@@ -30863,10 +31366,14 @@ window.__ModuleLoader__.load({
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										className: "daw-command primary",
+										disabled: managementLocked,
+										title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
 										onClick: () => {
+											setError(void 0);
 											props.api.addRoot(path, label || void 0).then(() => {
 												setPath("");
 												setLabel("");
+												notify("rootAdded");
 												return refresh();
 											}).catch(setError);
 										},
@@ -30893,8 +31400,15 @@ window.__ModuleLoader__.load({
 									}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										className: "daw-icon danger",
 										title: t("removeRoot"),
+										"aria-label": t("removeRoot"),
+										disabled: managementLocked,
 										onClick: () => {
-											props.api.removeRoot(root.id).then(refresh).catch(setError);
+											if (!window.confirm(t("removeRootConfirm", { label: root.label }))) return;
+											setError(void 0);
+											props.api.removeRoot(root.id).then(() => {
+												notify("rootRemoved");
+												return refresh();
+											}).catch(setError);
 										},
 										children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
 									})]
@@ -30917,7 +31431,7 @@ window.__ModuleLoader__.load({
 								className: "daw-warning",
 								children: t("httpWarning")
 							}),
-							roots.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							roots.length === 0 && !managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "daw-warning",
 								children: t("addRootBeforeRemote")
 							}),
@@ -30929,7 +31443,7 @@ window.__ModuleLoader__.load({
 										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("bindIp") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 											className: "daw-input",
 											value: listenerHost,
-											disabled: status?.remoteEnabled,
+											disabled: status?.remoteEnabled || managementLocked,
 											spellCheck: false,
 											placeholder: "0.0.0.0",
 											onChange: (event) => setListenerHost(event.target.value)
@@ -30944,15 +31458,19 @@ window.__ModuleLoader__.load({
 											max: 65535,
 											inputMode: "numeric",
 											value: listenerPort,
-											disabled: status?.remoteEnabled,
+											disabled: status?.remoteEnabled || managementLocked,
 											onChange: (event) => setListenerPort(event.target.value)
 										})]
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										className: "daw-command",
-										disabled: status?.remoteEnabled || listenerHost.trim() === "" || !listenerPortValid || !listenerDirty,
+										disabled: managementLocked || status?.remoteEnabled || listenerHost.trim() === "" || !listenerPortValid || !listenerDirty,
 										onClick: () => {
-											props.api.configureListener(listenerHost.trim(), parsedListenerPort).then((result) => poll(result.id)).then(refresh).catch(setError);
+											setError(void 0);
+											props.api.configureListener(listenerHost.trim(), parsedListenerPort).then((result) => poll(result.id)).then(() => {
+												notify("listenerSaved");
+												return refresh();
+											}).catch(setError);
 										},
 										children: t("saveListener")
 									})
@@ -31000,19 +31518,33 @@ window.__ModuleLoader__.load({
 										className: "daw-warning",
 										children: t("tunnelSecurityWarning")
 									}),
-									tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									tunnel?.errorKey !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-warning",
+										role: "alert",
+										children: t(tunnel.errorKey, tunnel.errorParams ?? {})
+									}),
+									tunnel?.errorKey === void 0 && tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 										className: "daw-warning",
+										role: "alert",
 										children: tunnel.error
 									}),
-									tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-tunnel-url",
-										style: { marginTop: 8 },
-										children: tunnel.url
+									tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-url-row",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+											className: "daw-tunnel-url",
+											children: tunnel.url
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+											text: tunnel.url,
+											title: t("copyUrl"),
+											copiedText: t("copied"),
+											manualText: t("copyManual"),
+											copyText
+										})]
 									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										className: "daw-command primary",
 										style: { marginTop: 10 },
-										disabled: tunnelBusy || roots.length === 0,
+										disabled: tunnelBusy || tunnel?.running !== true && roots.length === 0,
 										onClick: () => {
 											if (tunnel?.running === true) stopTunnel();
 											else createTunnel();
@@ -31025,31 +31557,39 @@ window.__ModuleLoader__.load({
 										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 											className: "daw-progress-track",
 											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-												className: "daw-progress-fill",
-												style: { width: pct(activity) }
+												className: `daw-progress-fill${activity.percent === null ? " indeterminate" : ""}`,
+												style: activity.percent === null ? void 0 : { width: `${activity.percent}%` }
 											})
 										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 											className: "daw-list-meta",
 											style: { marginTop: 4 },
-											children: activity.label
+											children: activity.labelKey === "" ? "" : t(activity.labelKey, activity.labelParams ?? {})
 										})]
 									})
 								]
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-scope-grid",
-								children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-									className: "daw-check",
-									children: [
-										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-											type: "checkbox",
-											checked: grantedScopes.includes(scope),
-											onChange: () => toggleScope(scope)
-										}),
-										" ",
-										scopeLabel(locale, scope)
-									]
-								}, scope))
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("fieldset", {
+								disabled: managementLocked,
+								style: {
+									border: "none",
+									margin: 0,
+									padding: 0
+								},
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "daw-scope-grid",
+									children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+										className: "daw-check",
+										children: [
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+												type: "checkbox",
+												checked: grantedScopes.includes(scope),
+												onChange: () => toggleScope(scope)
+											}),
+											" ",
+											scopeLabel(locale, scope)
+										]
+									}, scope))
+								})
 							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "daw-list-meta",
@@ -31057,30 +31597,44 @@ window.__ModuleLoader__.load({
 							}),
 							status?.remoteEnabled ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								className: "daw-command danger",
+								disabled: managementLocked,
+								title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
 								onClick: () => {
-									props.api.disableRemote().then((result) => poll(result.id)).then(refresh).catch(setError);
+									if (!window.confirm(t("disableRemoteConfirm"))) return;
+									setError(void 0);
+									props.api.disableRemote().then((result) => poll(result.id)).then(() => {
+										notify("remoteDisabled");
+										return refresh();
+									}).catch(setError);
 								},
 								children: t("disableRemote")
 							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 								className: "daw-command primary",
-								disabled: roots.length === 0 || listenerDirty || !listenerPortValid || listenerHost.trim() === "" || grantedScopes.length === 0,
+								disabled: managementLocked || roots.length === 0 || listenerDirty || !listenerPortValid || listenerHost.trim() === "" || grantedScopes.length === 0,
 								onClick: () => {
+									setError(void 0);
 									props.api.enableRemote(roots.map((root) => root.id), grantedScopes).then((result) => poll(result.id)).catch(setError);
 								},
 								children: t("enablePairing")
 							}),
-							status?.remoteEnabled && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+							(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									className: "daw-command daw-inline-command",
-									disabled: grantedScopes.length === 0,
+									disabled: managementLocked || grantedScopes.length === 0,
+									title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
 									onClick: () => {
-										props.api.createPairing(roots.map((root) => root.id), grantedScopes).then((value) => setPairing(value)).catch(setError);
+										setError(void 0);
+										props.api.createPairing(roots.map((root) => root.id), grantedScopes).then((value) => {
+											setPairing(value);
+											notify("pairingCreated");
+										}).catch(setError);
 									},
 									children: t("newPairingCode")
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									className: "daw-command daw-inline-command",
-									disabled: configTextBusy,
+									disabled: managementLocked || configTextBusy,
+									title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
 									onClick: () => {
 										const manual = configEndpoint.trim();
 										setConfigTextBusy(true);
@@ -31093,7 +31647,7 @@ window.__ModuleLoader__.load({
 											}] }
 										}).then((value) => {
 											setConfigText(value);
-											return refresh();
+											notify("configCreated");
 										}).catch(setError).finally(() => setConfigTextBusy(false));
 									},
 									children: t("newConfigText")
@@ -31102,21 +31656,34 @@ window.__ModuleLoader__.load({
 									className: "daw-command daw-inline-command",
 									disabled: configTextBusy || tunnelBusy,
 									onClick: () => {
-										if (tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0) genTunnelConfig(tunnel.url);
-										else createTunnel();
+										tunnelConfigClick();
 									},
-									children: tunnel.running === true && tunnel.url !== null && tunnel.url !== void 0 ? t("tunnelGenConfigReady") : t("tunnelGenConfigOff")
+									children: tunnel.running !== true ? t("tunnelStartAndGenConfig") : t("tunnelRestartAndGenConfig")
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "daw-list-meta daw-listener-hint",
 									children: t("configTextScopeNote")
 								})
 							] }),
-							pairing !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-code",
-								children: pairing.code
-							}),
-							status?.remoteEnabled && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							pairing !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-code-row",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "daw-code",
+									children: pairing.code
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+									className: "daw-copy-inline",
+									text: pairing.code,
+									title: t("copyPairing"),
+									copiedText: t("copied"),
+									manualText: t("copyManual"),
+									copyText
+								})]
+							}), pairing.expiresAt !== void 0 && pairing.expiresAt > now && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-list-meta",
+								style: { marginTop: -4 },
+								children: t("pairingExpiresAt", { minutes: pairingMinutesLeft(pairing.expiresAt, now) })
+							})] }),
+							(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								style: {
 									marginTop: 12,
 									maxWidth: 560
@@ -31126,6 +31693,7 @@ window.__ModuleLoader__.load({
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("configTextManual") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 										className: "daw-input",
 										value: configEndpoint,
+										disabled: managementLocked,
 										spellCheck: false,
 										placeholder: t("configTextManualPlaceholder"),
 										onChange: (event) => setConfigEndpoint(event.target.value)
@@ -31152,7 +31720,8 @@ window.__ModuleLoader__.load({
 								device,
 								roots,
 								onChanged: refresh,
-								onError: setError
+								onError: setError,
+								onNotice: notify
 							}, device.id))
 						})
 					}, "devices"),
@@ -31256,7 +31825,10 @@ window.__ModuleLoader__.load({
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 							className: "daw-list-meta",
 							children: t("pluginTrashHint")
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						}), trash.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta daw-empty",
+							children: t("trashEmpty")
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "daw-list",
 							children: trash.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 								className: "daw-list-row",
@@ -31275,14 +31847,22 @@ window.__ModuleLoader__.load({
 								})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									className: "daw-command",
 									onClick: () => {
-										props.api.restoreTrash(item.id).then(refresh).catch(setError);
+										setError(void 0);
+										props.api.restoreTrash(item.id).then(() => {
+											notify("trashRestored");
+											return refresh();
+										}).catch(setError);
 									},
 									children: t("restore")
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 									className: "daw-icon danger",
 									title: t("deletePermanently"),
+									"aria-label": t("deletePermanently"),
 									onClick: () => {
-										if (confirm(t("purgeConfirm"))) props.api.purgeTrash(item.id).then(refresh).catch(setError);
+										if (confirm(t("purgeConfirm"))) props.api.purgeTrash(item.id).then(() => {
+											notify("trashPurged");
+											return refresh();
+										}).catch(setError);
 									},
 									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
 								})] })]
@@ -31295,9 +31875,12 @@ window.__ModuleLoader__.load({
 						descKey: tabDescKey("audit"),
 						open: isOpen("audit"),
 						onToggle: () => toggleCard("audit"),
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						children: audit.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta daw-empty",
+							children: t("auditEmpty")
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "daw-list",
-							children: audit.map((item, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							children: audit.slice(0, auditLimit).map((item, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 								className: "daw-list-row",
 								children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "daw-list-title",
@@ -31315,7 +31898,18 @@ window.__ModuleLoader__.load({
 									]
 								})] })
 							}, String(item.id ?? index)))
-						})
+						}), auditLimit < audit.length && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command daw-inline-command",
+							disabled: auditLoading,
+							onClick: () => {
+								setAuditLoading(true);
+								window.setTimeout(() => {
+									setAuditLimit((value) => value + 50);
+									setAuditLoading(false);
+								}, 0);
+							},
+							children: auditLoading ? t("auditLoading") : t("auditLoadMore")
+						})] })
 					}, "audit"),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AppDownloadSection, {
 						open: isOpen("app-download"),
@@ -31375,13 +31969,6 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/**
-		* Standalone settings overlay kept for the `/dsh-workspace` page (mobile WebView / direct link).
-		*
-		* The desktop WebUI does **not** use this: its settings live inline inside DSH's own settings page
-		* (`PhoneSettingsBody`), so a user never opens a dialog from inside a dialog. This one keeps its own
-		* shell because the standalone page has no settings container to render into.
-		*/
-		/**
 		* Shows a freshly minted `DSH1:` config text.
 		*
 		* The text is a credential carrier, so this panel keeps the "it is a key" reminder visible and lists
@@ -31512,6 +32099,8 @@ window.__ModuleLoader__.load({
 			const [scopes, setScopes] = (0, react.useState)(props.device.scopes);
 			const [rootIds, setRootIds] = (0, react.useState)(props.device.rootIds);
 			const toggle = (list, value) => list.includes(value) ? list.filter((item) => item !== value) : [...list, value];
+			const shortId = props.device.id.length > 14 ? `${props.device.id.slice(0, 8)}…${props.device.id.slice(-4)}` : props.device.id;
+			const lastSeen = props.device.lastSeenAt === void 0 ? t("deviceNeverSeen") : t("deviceLastSeen", { time: new Date(props.device.lastSeenAt).toLocaleString(locale) });
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "daw-list-row",
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
@@ -31529,7 +32118,12 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: "daw-list-meta",
 						children: [
-							props.device.id,
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								title: props.device.id,
+								children: shortId
+							}),
+							" · ",
+							lastSeen,
 							" · ",
 							props.device.scopes.length === 0 ? t("noScopes") : props.device.scopes.map((scope) => scopeLabel(locale, scope)).join(" · ")
 						]
@@ -31559,7 +32153,10 @@ window.__ModuleLoader__.load({
 					editing && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						className: "daw-command primary",
 						onClick: () => {
-							props.api.updateDevice(props.device.id, scopes, rootIds).then(props.onChanged).then(() => setEditing(false)).catch(props.onError);
+							props.api.updateDevice(props.device.id, scopes, rootIds).then(props.onChanged).then(() => {
+								setEditing(false);
+								props.onNotice("permissionsSaved");
+							}).catch(props.onError);
 						},
 						children: t("save")
 					}),
@@ -31571,8 +32168,10 @@ window.__ModuleLoader__.load({
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 						className: "daw-icon danger",
 						title: t("revokeDevice"),
+						"aria-label": t("revokeDevice"),
 						onClick: () => {
-							props.api.revokeDevice(props.device.id).then(props.onChanged).catch(props.onError);
+							if (!window.confirm(t("revokeConfirm", { name: props.device.name }))) return;
+							props.api.revokeDevice(props.device.id).then(props.onChanged).then(() => props.onNotice("deviceRevoked")).catch(props.onError);
 						},
 						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
 					})
@@ -31584,6 +32183,7 @@ window.__ModuleLoader__.load({
 			if (tab === "devices") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Smartphone, { size: 15 });
 			if (tab === "image") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Image, { size: 15 });
 			if (tab === "trash") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 });
+			if (tab === "audit") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.ScrollText, { size: 15 });
 			if (tab === "remote") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Upload, { size: 15 });
 			if (tab === "app-download") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Download, { size: 15 });
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.File, { size: 15 });
@@ -31614,6 +32214,10 @@ window.__ModuleLoader__.load({
 			if (error.code === "LISTENER_PORT_INVALID") return "listenerPortInvalid";
 			if (error.code === "REMOTE_ENABLED") return "disableToEditListener";
 			if (error.code === "NO_ENDPOINT") return "configTextNoEndpoints";
+			if (error.code === "TUNNEL_MODE_ADMIN_DISABLED") return "errorTunnelModeAdminDisabled";
+			if (error.code === "ADMIN_PROXY_FORWARDED") return "errorAdminProxyForwarded";
+			if (error.code === "ADMIN_HOST_NOT_LOOPBACK") return "errorAdminHostNotLoopback";
+			if (error.code === "ADMIN_LOOPBACK_REQUIRED") return "errorAdminLoopbackRequired";
 			if (error.code.includes("PATH") || error.code.includes("SYMLINK") || error.code.includes("REPARSE")) return "errorPathInvalid";
 			if (error.status === 403) return "errorForbidden";
 			if (error.status === 404) return "errorNotFound";