dsh-remote-bridge 2.9.0 → 2.9.2

package/lib/client.cjs

@@ -8277,7 +8277,7 @@ window.__ModuleLoader__.load({
 					key: "1quai1"
 				}]
 			]);
-			createLucideIcon("Cloud", [["path", {
+			const Cloud = createLucideIcon("Cloud", [["path", {
 				d: "M17.5 19H9a7 7 0 1 1 6.71-9h1.79a4.5 4.5 0 1 1 0 9Z",
 				key: "p7xjir"
 			}]]);
@@ -23958,7 +23958,7 @@ window.__ModuleLoader__.load({
 				d: "M11 16.586V19a1 1 0 0 1-1 1H2L18.37 3.63a1 1 0 1 1 3 3l-9.663 9.663a1 1 0 0 1-1.414 0L8 14",
 				key: "1sllp5"
 			}]]);
-			createLucideIcon("SlidersHorizontal", [
+			const SlidersHorizontal = createLucideIcon("SlidersHorizontal", [
 				["line", {
 					x1: "21",
 					x2: "14",
@@ -29825,6 +29825,7 @@ window.__ModuleLoader__.load({
 				}]
 			]);
 			exports.Check = Check;
+			exports.Cloud = Cloud;
 			exports.Copy = Copy;
 			exports.Download = Download;
 			exports.File = File;
@@ -29833,6 +29834,7 @@ window.__ModuleLoader__.load({
 			exports.Languages = Languages;
 			exports.Package = Package;
 			exports.RefreshCw = RefreshCw;
+			exports.SlidersHorizontal = SlidersHorizontal;
 			exports.Smartphone = Smartphone;
 			exports.Trash2 = Trash2;
 			exports.Upload = Upload;
@@ -29894,17 +29896,21 @@ window.__ModuleLoader__.load({
 				close: "关闭",
 				rootsTab: "根目录",
 				remoteTab: "远程访问",
+				tunnelTab: "外网隧道",
 				devicesTab: "设备",
 				trashTab: "回收站",
 				auditTab: "审计",
 				imageTab: "识图",
 				rootsTabDesc: "授权手机访问这台机器上的哪些目录。新增、命名、移除都在这里。",
 				remoteTabDesc: "绑定 IP 与端口、开关远程访问、生成配对码与配置文本。",
+				tunnelTabDesc: "人在外网时用：一键创建临时公网地址，把本机端口经 Cloudflare 边缘暴露出去。",
 				devicesTabDesc: "查看已配对的手机，修改它们的权限范围与可访问目录，或吊销设备。",
 				imageTabDesc: "设置图片交给识图工具的落盘目录名。",
 				trashTabDesc: "经手机端删除的文件留在这里，可恢复或彻底清理。",
 				auditTabDesc: "最近的操作记录：谁、在什么时间、动了哪个路径。",
 				appDownloadTabDesc: "手机客户端的下载二维码与地址。",
+				advancedGroupTitle: "高级设置",
+				advancedGroupDesc: "平时用不到的几项，收在这里，功能与主列表一致。",
 				imageTitle: "识图路径",
 				imageHint: "纯文本模型收到图片时，图片会落在这个目录里，消息里只留路径给识图工具读。这里改的就是那个目录。",
 				imageSubdir: "识图路径（目录名）",
@@ -29960,6 +29966,7 @@ window.__ModuleLoader__.load({
 				tunnelStop: "停止云隧道",
 				tunnelEndpointLabel: "云隧道",
 				tunnelGenConfigReady: "生成隧道配置文件",
+				tunnelGenConfigByUrl: "用隧道地址生成配置",
 				tunnelGenConfigOff: "隧道未开启",
 				tunnelSecurityWarning: "开启后将本机远程端口经 Cloudflare 边缘暴露到公网，任何人拿到下面的临时地址即可尝试连接。请仅在需要外网连回来时开启，用完及时停止隧道。",
 				tunnelStartConfirm: "开启云隧道会把你设置页里的远程端口经 Cloudflare 暴露到公网，强密码（token）才能挡住乱连。确认开启吗？",
@@ -30153,17 +30160,21 @@ window.__ModuleLoader__.load({
 				close: "Close",
 				rootsTab: "Roots",
 				remoteTab: "Remote",
+				tunnelTab: "Public tunnel",
 				devicesTab: "Devices",
 				trashTab: "Trash",
 				auditTab: "Audit",
 				imageTab: "Image reading",
 				rootsTabDesc: "Which directories on this machine phones may reach. Add, rename and remove them here.",
 				remoteTabDesc: "Bind address and port, switch remote access on or off, mint pairing codes and config texts.",
+				tunnelTabDesc: "For when you are out on another network: create a temporary public address that exposes the local port through the Cloudflare edge.",
 				devicesTabDesc: "Paired phones, their permission scopes and reachable roots — or revoke them outright.",
 				imageTabDesc: "Choose the directory name where images land for the image-reading tool.",
 				trashTabDesc: "Files deleted from a phone land here. Restore them, or purge them for good.",
 				auditTabDesc: "Recent activity: who, when, and which path was touched.",
 				appDownloadTabDesc: "QR codes and addresses for the phone app download.",
+				advancedGroupTitle: "Advanced settings",
+				advancedGroupDesc: "The few sections nobody opens daily, kept here — every one of them works exactly as it would in the main list.",
 				imageTitle: "Image-reading path",
 				imageHint: "When a text-only model receives a picture, the file lands in this directory and the message keeps only its path for the image-reading tool. This setting is that directory.",
 				imageSubdir: "Image path (directory name)",
@@ -30219,6 +30230,7 @@ window.__ModuleLoader__.load({
 				tunnelStop: "Stop tunnel",
 				tunnelEndpointLabel: "Cloudflare tunnel",
 				tunnelGenConfigReady: "Generate config file from tunnel",
+				tunnelGenConfigByUrl: "Generate config with tunnel address",
 				tunnelGenConfigOff: "Tunnel not started",
 				tunnelSecurityWarning: "Starting exposes your remote port to the public internet through Cloudflare edge; anyone with the temporary address below can try to connect. Only start it when you need to reach the machine from outside, and stop the tunnel when done.",
 				tunnelStartConfirm: "Starting the tunnel exposes your remote port through Cloudflare to the public internet; only the device token (a strong password) keeps strangers out. Start anyway?",
@@ -30911,68 +30923,15 @@ window.__ModuleLoader__.load({
 			}
 		};
 		//#endregion
-		//#region src/shared/contracts.ts
-		const DEVICE_SCOPES = [
-			"chat.read",
-			"chat.write",
-			"files.read",
-			"files.write",
-			"files.delete",
-			"settings.read",
-			"settings.write"
-		];
-		/**
-		* 授予新设备时的默认权限（**五个非破坏性权限**）。
-		*
-		* 刻意不含 `files.delete` 与 `settings.write`：这两个是破坏性权限，应当是用户显式
-		* 要求才授予。`settings.write` 尤其危险 —— 拿到它就能改供应商 `baseURL`，把模型
-		* 请求连同真实凭据引到任意地址（SEC-H11），所以它绝不能是默认值。
-		*
-		* 三条路径必须共用这一份，否则「同一个产品里三处默认权限不一样」这种缺陷会反复
-		* 复发：服务端生成配置文本时的缺省、Web UI 配对码面板的初始勾选、隧道一键路径。
-		*/
-		const DEFAULT_DEVICE_SCOPES = [
-			"chat.read",
-			"chat.write",
-			"files.read",
-			"files.write",
-			"settings.read"
-		];
-		new Set(DEVICE_SCOPES);
-		//#endregion
-		//#region src/client/app-qr.ts
-		const APP_QR_CODES = [{
-			"key": "github",
-			"label": "GitHub",
-			"url": "https://github.com/westanke/dsh-companion/releases",
-			"dataUrl": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNjQiIGhlaWdodD0iMjY0IiB2aWV3Qm94PSIwIDAgNDEgNDEiIHNoYXBlLXJlbmRlcmluZz0iY3Jpc3BFZGdlcyI+PHBhdGggZmlsbD0iI2ZmZmZmZiIgZD0iTTAgMGg0MXY0MUgweiIvPjxwYXRoIHN0cm9rZT0iIzAwMDAwMCIgZD0iTTQgNC41aDdtMSAwaDFtMiAwaDFtMyAwaDNtMyAwaDFtMSAwaDFtMiAwaDdNNCA1LjVoMW01IDBoMW0zIDBoM200IDBoMW0xIDBoMW0yIDBoMW0zIDBoMW01IDBoMU00IDYuNWgxbTEgMGgzbTEgMGgxbTMgMGgybTEgMGgxbTEgMGgxbTQgMGg1bTEgMGgxbTEgMGgzbTEgMGgxTTQgNy41aDFtMSAwaDNtMSAwaDFtMSAwaDJtMiAwaDFtMSAwaDJtMSAwaDJtMSAwaDFtMiAwaDFtMiAwaDFtMSAwaDNtMSAwaDFNNCA4LjVoMW0xIDBoM20xIDBoMW0xIDBoNG0xIDBoMm0zIDBoM20yIDBoMW0yIDBoMW0xIDBoM20xIDBoMU00IDkuNWgxbTUgMGgxbTEgMGgxbTEgMGgxbTMgMGgxbTEgMGg0bTEgMGgxbTQgMGgxbTUgMGgxTTQgMTAuNWg3bTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGg3TTEyIDExLjVoMW01IDBoNW0yIDBoNE00IDEyLjVoMW0zIDBoMW0xIDBoNG03IDBoMW0xIDBoM20zIDBoNW0yIDBoMU00IDEzLjVoMW02IDBoMW0zIDBoMW0xIDBoNG02IDBoMW0xIDBoMW0zIDBoM000IDE0LjVoMm00IDBoNm0zIDBoMW0xIDBoMW0yIDBoMm0xIDBoMW0yIDBoMW0yIDBoMW0xIDBoMU00IDE1LjVoMW0yIDBoMm0zIDBoMW0xIDBoM20xIDBoMW0yIDBoNW0xIDBoMW0xIDBoMW01IDBoMk01IDE2LjVoMW0xIDBoMW0yIDBoMW0xIDBoMW0yIDBoMW0xIDBoM20yIDBoN20xIDBoMW0xIDBoMm0xIDBoMk00IDE3LjVoMW02IDBoMW0xIDBoNW0yIDBoMW0yIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDE4LjVoMm0xIDBoM20xIDBoMm01IDBoNG0zIDBoMW0xIDBoM20yIDBoMk00IDE5LjVoMW0yIDBoMm00IDBoMm0zIDBoMW0yIDBoMW0xIDBoNG0yIDBoMk02IDIwLjVoMW0yIDBoMm0yIDBoMm0yIDBoM20xIDBoMW0zIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0yIDBoMU00IDIxLjVoMW0xIDBoMW0yIDBoMW0yIDBoMW0xIDBoMm0yIDBoMm0xIDBoMm00IDBoMW0xIDBoMW0zIDBoM000IDIyLjVoNW0xIDBoMW0xIDBoMm0xIDBoM20xIDBoMW0yIDBoMW0xIDBoNG0xIDBoM20xIDBoMW0xIDBoMU01IDIzLjVoMm0xIDBoMm0yIDBoMW0yIDBoMm0yIDBoMW0zIDBoM20xIDBoNW0zIDBoMU01IDI0LjVoMW0xIDBoMm0xIDBoMW0zIDBoMm0xIDBoMm0xIDBoMW0zIDBoM20zIDBoMW0xIDBoMk00IDI1LjVoM20xIDBoMW0yIDBoMm05IDBoM20xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDI2LjVoMW0xIDBoMW0xIDBoMW0xIDBoMW00IDBoM20xIDBoMW0yIDBoMW0xIDBoNG0yIDBoMW0yIDBoMU04IDI3LjVoMm0xIDBoMW0xIDBoMm0yIDBoMW0xIDBoNW0xIDBoMW0yIDBoNW0zIDBoMU00IDI4LjVoNW0xIDBoMW0yIDBoNG0xIDBoMW0yIDBoMW0xIDBoMTFtMSAwaDJNMTIgMjkuNWgybTIgMGgybTEgMGgybTEgMGgxbTEgMGgxbTIgMGgybTMgMGgxbTEgMGgyTTQgMzAuNWg3bTEgMGgxbTEgMGgxbTQgMGgxbTEgMGgxbTIgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgyTTQgMzEuNWgxbTUgMGgxbTMgMGgxbTUgMGgzbTEgMGgybTIgMGgxbTMgMGgxTTQgMzIuNWgxbTEgMGgzbTEgMGgxbTEgMGgxbTQgMGgzbTIgMGgxbTIgMGgybTEgMGg2bTEgMGgxTTQgMzMuNWgxbTEgMGgzbTEgMGgxbTIgMGgxbTEgMGgybTMgMGgybTMgMGgxbTEgMGgybTEgMGgzbTEgMGgxTTQgMzQuNWgxbTEgMGgzbTEgMGgxbTIgMGgzbTQgMGgxbTEgMGgxbTEgMGgxbTIgMGgybTEgMGg0TTQgMzUuNWgxbTUgMGgxbTQgMGgxbTUgMGgxbTIgMGgybTEgMGg0TTQgMzYuNWg3bTEgMGgxbTEgMGgzbTEgMGgybTEgMGgxbTEgMGg0bTEgMGgybTYgMGgxIi8+PC9zdmc+Cg=="
-		}, {
-			"key": "gitee",
-			"label": "Gitee",
-			"url": "https://gitee.com/westanke/dsh-companion/releases",
-			"dataUrl": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNjQiIGhlaWdodD0iMjY0IiB2aWV3Qm94PSIwIDAgNDEgNDEiIHNoYXBlLXJlbmRlcmluZz0iY3Jpc3BFZGdlcyI+PHBhdGggZmlsbD0iI2ZmZmZmZiIgZD0iTTAgMGg0MXY0MUgweiIvPjxwYXRoIHN0cm9rZT0iIzAwMDAwMCIgZD0iTTQgNC41aDdtMSAwaDFtMSAwaDJtMSAwaDRtNiAwaDJtMSAwaDdNNCA1LjVoMW01IDBoMW0zIDBoMm0xIDBoMm0xIDBoMW0xIDBoMm0yIDBoMW0zIDBoMW01IDBoMU00IDYuNWgxbTEgMGgzbTEgMGgxbTIgMGgybTEgMGgxbTEgMGgxbTEgMGg0bTEgMGgxbTEgMGgybTEgMGgxbTEgMGgzbTEgMGgxTTQgNy41aDFtMSAwaDNtMSAwaDFtMSAwaDVtMiAwaDNtNSAwaDFtMiAwaDFtMSAwaDNtMSAwaDFNNCA4LjVoMW0xIDBoM20xIDBoMW0xIDBoMW0xIDBoM20zIDBoMW0yIDBoMW0xIDBoMW0xIDBoMW0yIDBoMW0xIDBoM20xIDBoMU00IDkuNWgxbTUgMGgxbTEgMGgybTMgMGgzbTQgMGgzbTEgMGgxbTEgMGgxbTUgMGgxTTQgMTAuNWg3bTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGg3TTEyIDExLjVoNW00IDBoMW0xIDBoNk00IDEyLjVoMW0zIDBoMW0xIDBoNG0xIDBoMm0xIDBoNG0zIDBoOW0yIDBoMU00IDEzLjVoMW0xIDBoM201IDBoMW0xIDBoMW0xIDBoNW00IDBoMW0xIDBoMW0zIDBoM000IDE0LjVoMW0xIDBoMW0xIDBoMW0xIDBoNG0zIDBoNG0xIDBoMW0xIDBoN20yIDBoMW0xIDBoMU01IDE1LjVoMW0zIDBoMW0xIDBoMm0yIDBoMW0xIDBoMW0xIDBoMW00IDBoMm0xIDBoNG00IDBoMk00IDE2LjVoMm0yIDBoMW0xIDBoMW0yIDBoMm0yIDBoMW0yIDBoMW0yIDBoMW0xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMk04IDE3LjVoMm0xIDBoMW0yIDBoM20xIDBoMW0zIDBoM20xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMU00IDE4LjVoMW0xIDBoMW0xIDBoM20xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMm0xIDBoMW0yIDBoMW0xIDBoNW0xIDBoMW0yIDBoMU00IDE5LjVoMW00IDBoMW0yIDBoMW0yIDBoM20xIDBoNG0yIDBoMW0xIDBoNU00IDIwLjVoNW0xIDBoNW0yIDBoMW0zIDBoMW0xIDBoNG0xIDBoMW0xIDBoMW0xIDBoMm0xIDBoMU01IDIxLjVoMW01IDBoMm01IDBoM20xIDBoMW00IDBoMW0xIDBoMW0zIDBoM001IDIyLjVoMm0yIDBoM20yIDBoMW0xIDBoMW0xIDBoMm0xIDBoMW0yIDBoMW0xIDBoMm0xIDBoM20xIDBoMW0xIDBoMU00IDIzLjVoMW0yIDBoMW0zIDBoNW01IDBoNW0xIDBoMm0xIDBoMm0zIDBoMk00IDI0LjVoNG0xIDBoMm0xIDBoMm0xIDBoMW0yIDBoMm0yIDBoNW0xIDBoM20xIDBoMm0xIDBoMk00IDI1LjVoNG00IDBoM20xIDBoMW0zIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0yIDBoMk04IDI2LjVoNW0yIDBoNG0xIDBoMW0xIDBoMm0zIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDI3LjVoMW0yIDBoMW00IDBoM200IDBoMW0xIDBoM20zIDBoMm00IDBoMU00IDI4LjVoM20zIDBoM200IDBoMW0xIDBoMW0xIDBoMW0zIDBoMm0xIDBoNW0yIDBoMk0xMiAyOS41aDFtMiAwaDFtMyAwaDFtMSAwaDJtNCAwaDJtMyAwaDFtMSAwaDJNNCAzMC41aDdtMSAwaDFtMyAwaDRtMiAwaDFtMSAwaDJtMiAwaDFtMSAwaDFtMSAwaDJtMSAwaDFNNCAzMS41aDFtNSAwaDFtMiAwaDFtMiAwaDFtMiAwaDFtMyAwaDNtMiAwaDFtMyAwaDFtMiAwaDFNNCAzMi41aDFtMSAwaDNtMSAwaDFtMSAwaDFtMSAwaDFtMSAwaDJtMiAwaDFtMyAwaDNtMSAwaDZNNCAzMy41aDFtMSAwaDNtMSAwaDFtMiAwaDFtMiAwaDFtNCAwaDhtMSAwaDNtMSAwaDFNNCAzNC41aDFtMSAwaDNtMSAwaDFtMiAwaDFtMSAwaDJtMSAwaDJtNCAwaDJtMSAwaDJtMSAwaDNNNCAzNS41aDFtNSAwaDFtNCAwaDNtMSAwaDVtMSAwaDFtMiAwaDNNNCAzNi41aDdtMSAwaDFtMiAwaDJtMSAwaDFtMiAwaDFtMSAwaDNtMSAwaDJtNyAwaDEiLz48L3N2Zz4K"
-		}];
-		//#endregion
-		//#region src/client/workspace.tsx
-		/** What the settings-page launcher opens: authorized roots, the first section. */
-		const DEFAULT_PANEL_SECTION = "roots";
+		//#region src/client/cards/shared.tsx
 		/**
-		* i18n key for a rail entry.
+		* 跨卡复用的小部件与纯函数。
 		*
-		* Most sections map to `${name}Tab`, but `app-download` contains a hyphen, so a bare template would
-		* ask for `app-downloadTab` — a key nobody should have to remember the spelling of. Map it
-		* explicitly instead of encoding a naming rule into a template.
+		* 判据同 `context.ts`：**至少两张卡在用**才放这里。只服务一张卡的留在那张卡的文件里。
 		*/
-		function tabLabelKey(tab) {
-			return tab === "app-download" ? "appDownloadTab" : `${tab}Tab`;
-		}
-		/** 配对码剩余分钟：向上取整 —— 显示「约 9 分钟」比「约 8 分钟」在最后一刻更诚实。 */
-		function pairingMinutesLeft(expiresAt, now) {
-			return Math.max(0, Math.ceil((expiresAt - now) / 6e4));
-		}
 		/**
-		* 通用复制小按钮：成功后短暂换成对勾 + 「已复制」，2s 自动复位；
-		* 非安全上下文（HTTP/LAN）拿不到 Clipboard API 时退化为选中文本提示，见 copyText 的调用方。
+		* 通用复制小按钮：成功后短暂换成对勾 +「已复制」，2s 自动复位；
+		* 非安全上下文（HTTP/LAN）拿不到 Clipboard API 时退化为选中文本提示，见 `copyText` 的调用方。
 		*/
 		function CopyButton(props) {
 			const [state, setState] = (0, react.useState)("idle");
@@ -30998,1013 +30957,1117 @@ window.__ModuleLoader__.load({
 				})]
 			});
 		}
-		/**
-		* 卡片头部的描述行。与 `tabLabelKey` 同理：唯一含连字符的分区显式映射。
-		*
-		* 键名是 `${tab}TabDesc`（**带 Tab**），不是 `${tab}Desc`。这个中间段不是冗余：它让
-		* 描述键与标题键 `rootsTab` / `rootsTabDesc` 成对，读的人一眼能看出这两个属于同一张卡。
-		*
-		* 踩过的坑：早先这里写成 `${tab}Desc`，`rootsDesc` 之类根本不在字典里 —— `translate` 直接
-		* `dictionaries[locale][key].replace(...)` 抛 TypeError，整个设置面板白屏。`as MessageKey`
-		* 把类型检查骗过去了，所以单测全绿也照样白屏。**键名靠模板拼出来时，类型系统是最后一道
-		* 防线，这里偏偏被断言关掉了。** 现在改成显式查表，见下。
-		*/
-		const TAB_DESC_KEYS = {
-			roots: "rootsTabDesc",
-			remote: "remoteTabDesc",
-			devices: "devicesTabDesc",
-			image: "imageTabDesc",
-			trash: "trashTabDesc",
-			plugins: "pluginsTabDesc",
-			"app-download": "appDownloadTabDesc"
-		};
-		function tabDescKey(tab) {
-			return TAB_DESC_KEYS[tab];
+		/** 配对码剩余分钟：向上取整 —— 显示「约 9 分钟」比「约 8 分钟」在最后一刻更诚实。 */
+		function pairingMinutesLeft(expiresAt, now) {
+			return Math.max(0, Math.ceil((expiresAt - now) / 6e4));
 		}
 		/**
-		* The single desktop dialog: a vertical section rail on the left, one content pane on the right.
-		*
-		* Settings only — the five admin sections. The file tree used to live here as a sixth row; it does
-		* not any more, so this is the old `AdminOverlay` body with a rail, not a workspace host.
-		*/
-		/**
-		* 导航栏 + 内容区，**不含任何对话框外壳**。
-		*
-		* 抽出来是为了让 DSH 设置页能把它**内联**渲染。
+		* `host:port` 的统一显示。
 		*
-		* 早先的版本做不到这一点，于是设置页里只放了一句说明加一个「打开手机设置面板」按钮，
-		* 真正的设置藏在按钮后面的模态框里。用户的反应很直接：「其他的可以设置的东西那去了」——
-		* 这就是把弹窗嵌进设置页的代价：入口看起来是空的，因为内容在下一层。
-		* 设置页本身就是一层容器，没有任何理由再套一层。
+		* IPv6 要加方括号（`[::1]:3090`），否则地址里的冒号会让人把它读成「主机 `::1` + 端口」以外的
+		* 东西，复制出去也非法。端口非有限值时不显示数字而不是显示 `NaN`。
 		*/
+		function formatEndpoint(host, port) {
+			return `${host.includes(":") ? `[${host}]` : host}:${Number.isFinite(port) ? port : ""}`;
+		}
+		/** 字节数转人话。回收站里常有 KB/MB 级文件，只显示原始字节数没人读得动。 */
+		function formatBytes(value) {
+			if (value < 1024) return `${value} B`;
+			if (value < 1048576) return `${(value / 1024).toFixed(1)} KB`;
+			return `${(value / 1024 / 1024).toFixed(1)} MB`;
+		}
 		/**
-		* 设置面板主体：**七张卡片平铺，各自独立开合，没有导航栏**。
-		*
-		* 上一版留了个分区导航栏、一次只显示一张卡。对照 Vision Router 的实际长相才发现差得远：
-		* 它是全部卡片一起列出来、想开哪张开哪张，标题栏自己就是入口。那句提示词写得很直白 ——
-		* 「多张卡可以同时保持展开」。所以导航栏这一层是多余的，用户还得先点导航、再点卡片头，
-		* 两次点击才走一步。
-		*
-		* 抽出来是为了让 DSH 设置页能把它**内联**渲染。
+		* 监听器操作失败时的人话。
 		*
-		* 早先的版本做不到这一点，于是设置页里只放了一句说明加一个「打开手机设置面板」按钮，
-		* 真正的设置藏在按钮后面的模态框里。用户的反应很直接：「其他的可以设置的东西那去了」——
-		* 这就是把弹窗嵌进设置页的代价：入口看起来是空的，因为内容在下一层。
-		* 设置页本身就是一层容器，没有任何理由再套一层。
-		*
-		* `section` / `onSection` 保留是为了兼容旧调用方，但现在**不再决定显示哪一张卡**，
-		* 只用来决定默认展开哪一张。
+		* `code` 与 `message` 两个来源都要看：服务端给了已知码就翻成人话，否则退回原始 message；
+		* 两个都没有才用 fallback。只认其中一个会在另一种情况下显示空白。
 		*/
-		function PhoneSettingsBody(props) {
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AdminPanel, {
-				api: props.api,
-				initialOpen: props.section,
-				onOpenPluginList: props.onOpenPluginList
+		function listenerOperationError(code, fallback, t) {
+			if (code === "LISTENER_ADDRESS_IN_USE") return t("listenerAddressInUse");
+			if (code === "LISTENER_ADDRESS_UNAVAILABLE") return t("listenerAddressUnavailable");
+			if (code === "LISTENER_PERMISSION_DENIED") return t("listenerPermissionDenied");
+			return fallback ?? t("listenerFailed");
+		}
+		/** 等一会儿。轮询与「等隧道出地址」都用它。 */
+		async function delay(ms) {
+			await new Promise((resolve) => {
+				setTimeout(resolve, ms);
 			});
 		}
 		/**
-		* 一个设置分区 = 一张 Vision Router 式折叠卡片。
+		* 错误码 → 人话。
 		*
-		* 交互模型照搬 dsh-vision-router 的 `vr-card`：外壳是圆角 12px 卡片，展开时加
-		* `daw-card-open`；头部是一个 `aria-expanded` 的按钮，装着图标 + 标题 + 描述 + 旋转箭头；
-		* 展开体是 `daw-card-body`（顶部一条分隔线）。
-		*
-		* 七张卡同时挂在页面上，各张独立开合 —— 导航栏已经删掉了，卡片头自己就是入口。
+		* 这张表是「用户看到什么」的唯一来源：`messageOf` 与各卡片都靠它把裸码翻成人话。
+		* 压成一句「操作失败」会让用户反复点同一个按钮 —— 每一个码都指向不同的下一步，
+		* 例如 `TUNNEL_MODE_ADMIN_DISABLED` 要人去停隧道、`ADMIN_HOST_NOT_LOOPBACK` 要人换地址打开。
 		*/
-		function SettingsCard(props) {
-			const { t } = useWorkspaceI18n();
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
-				className: `daw-card${props.open ? " daw-card-open" : ""}`,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-					type: "button",
-					className: "daw-card-header",
-					"aria-expanded": props.open,
-					onClick: props.onToggle,
-					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "daw-card-icon",
-							"aria-hidden": "true",
-							children: tabIcon(props.tab)
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-							className: "daw-card-headtext",
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-card-name",
-								children: t(props.nameKey)
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-card-desc",
-								children: t(props.descKey)
-							})]
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: `daw-card-chevron${props.open ? " daw-card-chevron-open" : ""}`,
-							"aria-hidden": "true",
-							children: "▾"
-						})
-					]
-				}), props.open && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-					className: "daw-card-body",
-					children: props.children
-				})]
-			});
+		function apiErrorKey(error) {
+			if (error.status === 401) return "errorUnauthorized";
+			if (error.status === 429) return "errorRateLimited";
+			if (error.code === "ROOT_NOT_GRANTED" || error.code === "ROOT_FORBIDDEN") return "errorRootDenied";
+			if (error.code === "ROOT_BUILTIN") return "errorRootBuiltin";
+			if (error.code === "ETAG_MISMATCH") return "errorEtag";
+			if (error.code === "LISTENER_HOST_INVALID") return "listenerHostInvalid";
+			if (error.code === "LISTENER_PORT_INVALID") return "listenerPortInvalid";
+			if (error.code === "REMOTE_ENABLED") return "disableToEditListener";
+			if (error.code === "NO_ENDPOINT") return "configTextNoEndpoints";
+			if (error.code === "TUNNEL_MODE_ADMIN_DISABLED") return "errorTunnelModeAdminDisabled";
+			if (error.code === "ADMIN_PROXY_FORWARDED") return "errorAdminProxyForwarded";
+			if (error.code === "ADMIN_HOST_NOT_LOOPBACK") return "errorAdminHostNotLoopback";
+			if (error.code === "ADMIN_LOOPBACK_REQUIRED") return "errorAdminLoopbackRequired";
+			if (error.code === "PLUGIN_OFFICIAL_IMMUTABLE") return "pluginsErrorOfficial";
+			if (error.code === "PLUGIN_NAME_INVALID") return "pluginsErrorNameInvalid";
+			if (error.code === "PROFILE_UNKNOWN") return "pluginsErrorProfileUnknown";
+			if (error.code === "MANIFEST_UNREADABLE") return "pluginsErrorManifestUnreadable";
+			if (error.code === "PLUGIN_NOT_INSTALLED") return "pluginsErrorNotInstalled";
+			if (error.code.includes("PATH") || error.code.includes("SYMLINK") || error.code.includes("REPARSE")) return "errorPathInvalid";
+			if (error.status === 403) return "errorForbidden";
+			if (error.status === 404) return "errorNotFound";
+			if (error.status === 409) return "errorConflict";
+		}
+		function messageOf(cause, t) {
+			if (cause instanceof WorkspaceApiError) {
+				const translated = apiErrorKey(cause);
+				if (translated !== void 0) return t(translated);
+			}
+			return cause instanceof Error ? cause.message : String(cause);
+		}
+		function pluginStateKey(state) {
+			if (state === "loaded") return "pluginsStateLoaded";
+			if (state === "runtime-provided") return "pluginsStateRuntimeProvided";
+			if (state === "installed-not-loaded") return "pluginsStateInstalledNotLoaded";
+			return "pluginsStateDeclaredMissing";
 		}
 		/**
-		* The settings content of one admin section, extracted from `AdminOverlay` so the unified panel and
-		* the standalone `/dsh-workspace` page render exactly the same body.
-		*/
-		/**
-		* 设置面板：七张卡片平铺，各自独立开合。
+		* Shows a freshly minted `DSH1:` config text.
 		*
-		* `initialOpen` 决定进页面时先展开哪一张（默认第一张），之后完全由用户点卡片头控制。
-		* 展开状态存 Set —— 这样「同时展开两张」是自然结果，不需要额外的互斥逻辑。
+		* The text is a credential carrier, so this panel keeps the "it is a key" reminder visible and lists
+		* the addresses the host actually detected, letting the user confirm them before sending the text away.
+		* Copying degrades to "the text is selected, copy it yourself" when the Clipboard API is unavailable —
+		* the normal case when this WebUI is opened over plain HTTP on a LAN address.
 		*/
-		function AdminPanel(props) {
-			const { locale, t } = useWorkspaceI18n();
-			const [status, setStatus] = (0, react.useState)();
-			const [trash, setTrash] = (0, react.useState)([]);
-			const [path, setPath] = (0, react.useState)("");
-			const [label, setLabel] = (0, react.useState)("");
-			const [listenerHost, setListenerHost] = (0, react.useState)("0.0.0.0");
-			const [listenerPort, setListenerPort] = (0, react.useState)("3090");
-			const [pairing, setPairing] = (0, react.useState)();
-			const [configText, setConfigText] = (0, react.useState)();
-			const [configEndpoint, setConfigEndpoint] = (0, react.useState)("");
-			const [configTextBusy, setConfigTextBusy] = (0, react.useState)(false);
-			const [image, setImage] = (0, react.useState)();
-			const [imageDraft, setImageDraft] = (0, react.useState)("");
-			const [imageBusy, setImageBusy] = (0, react.useState)(false);
-			const [openCards, setOpenCards] = (0, react.useState)(() => /* @__PURE__ */ new Set([props.initialOpen]));
-			const [imageSaved, setImageSaved] = (0, react.useState)(false);
-			const [error, setError] = (0, react.useState)();
-			const [notice, setNotice] = (0, react.useState)();
-			const [tunnel, setTunnel] = (0, react.useState)();
-			const [tunnelBusy, setTunnelBusy] = (0, react.useState)(false);
-			const [activity, setActivity] = (0, react.useState)();
-			const [pruneDays, setPruneDays] = (0, react.useState)(30);
-			const [pruneBusy, setPruneBusy] = (0, react.useState)(false);
-			const [now, setNow] = (0, react.useState)(() => Date.now());
-			const notify = (0, react.useCallback)((key, params) => {
-				setNotice(params === void 0 ? {
-					id: Date.now() + Math.random(),
-					key
-				} : {
-					id: Date.now() + Math.random(),
-					key,
-					params
-				});
-			}, []);
-			(0, react.useEffect)(() => {
-				if (notice === void 0) return;
-				const timer = window.setTimeout(() => setNotice(void 0), 3500);
-				return () => window.clearTimeout(timer);
-			}, [notice]);
-			(0, react.useEffect)(() => {
-				const timer = window.setInterval(() => setNow(Date.now()), 3e4);
-				return () => window.clearInterval(timer);
-			}, []);
-			const copyText = (0, react.useCallback)(async (text) => {
+		function ConfigTextPanel(props) {
+			const { t } = useWorkspaceI18n();
+			const [copyState, setCopyState] = (0, react.useState)();
+			const textRef = (0, react.useRef)(null);
+			const copy = (0, react.useCallback)(async () => {
 				const clipboard = globalThis.navigator?.clipboard;
 				if (clipboard !== void 0) try {
-					await clipboard.writeText(text);
-					return "done";
+					await clipboard.writeText(props.result.text);
+					setCopyState("done");
+					return;
 				} catch {}
-				try {
-					const node = document.createElement("textarea");
-					node.value = text;
-					node.style.position = "fixed";
-					node.style.top = "-9999px";
-					node.setAttribute("readonly", "");
-					document.body.append(node);
+				const node = textRef.current;
+				if (node !== null) {
+					node.focus();
 					node.select();
-					const ok = document.execCommand("copy");
-					node.remove();
-					if (ok) return "done";
-				} catch {}
-				return "manual";
-			}, []);
-			const isOpen = (0, react.useCallback)((card) => openCards.has(card), [openCards]);
-			const toggleCard = (0, react.useCallback)((card) => {
-				setOpenCards((previous) => {
-					const next = new Set(previous);
-					if (!next.delete(card)) next.add(card);
-					return next;
-				});
-			}, []);
-			const refresh = (0, react.useCallback)(async () => {
-				try {
-					setTunnel(await props.api.tunnelStatus());
-				} catch {}
-				try {
-					const next = await props.api.status();
-					setStatus(next);
-					if (openCards.has("trash")) setTrash((await props.api.trashItems()).items);
-					if (openCards.has("image")) {
-						const settings = await props.api.imageSettings();
-						setImage(settings);
-						setImageDraft(settings.subdir);
-						setImageSaved(false);
-					}
-				} catch (cause) {
-					if (!(cause instanceof WorkspaceApiError && cause.status === 403 && (cause.code === "TUNNEL_MODE_ADMIN_DISABLED" || cause.code === "ADMIN_PROXY_FORWARDED"))) setError(cause);
-				}
-			}, [props.api, openCards]);
-			const tunnelErrorText = (0, react.useCallback)((s) => {
-				if (s.errorKey !== void 0) return t(s.errorKey, s.errorParams ?? {});
-				return s.error ?? t("listenerFailed");
-			}, [t]);
-			const pollActivityOnce = (0, react.useCallback)(async (active) => {
-				while (active()) {
-					try {
-						const a = await props.api.tunnelActivity();
-						if (!active()) return;
-						setActivity(a.stage === "idle" ? void 0 : a);
-					} catch {}
-					await delay(400);
-				}
-			}, [props.api]);
-			const waitForTunnelUrl = (0, react.useCallback)(async (active) => {
-				for (let attempt = 0; attempt < 40 && active(); attempt += 1) {
-					await delay(500);
-					const s = await props.api.tunnelStatus();
-					if (!active()) return null;
-					setTunnel(s);
-					if (s.errorKey !== void 0 || s.error !== void 0) throw new Error(tunnelErrorText(s));
-					if (s.running && s.url !== null) return s.url;
-				}
-				return null;
-			}, [props.api, tunnelErrorText]);
-			const generateConfigForUrl = (0, react.useCallback)(async (baseUrl, noticeKey = "configCreated") => {
-				setConfigTextBusy(true);
-				setError(void 0);
-				try {
-					const currentRoots = status?.roots ?? [];
-					const value = await props.api.createConfigText({
-						...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) },
-						endpoints: [{
-							label: t("tunnelEndpointLabel"),
-							baseUrl
-						}]
-					});
-					setConfigText(value);
-					notify(noticeKey);
-					return true;
-				} catch (cause) {
-					setError(cause);
-					return false;
-				} finally {
-					setConfigTextBusy(false);
-				}
-			}, [
-				props.api,
-				status,
-				t,
-				notify
-			]);
-			const createTunnel = (0, react.useCallback)(async (opts = {}) => {
-				if (!window.confirm(t("tunnelStartConfirm"))) return;
-				const wantConfig = opts.thenGenConfig === true;
-				let alive = true;
-				setTunnelBusy(true);
-				setError(void 0);
-				setConfigText(void 0);
-				setActivity({
-					stage: "locating",
-					labelKey: "tunnelStageLocating",
-					percent: null
-				});
-				pollActivityOnce(() => alive);
-				try {
-					const currentRoots = status?.roots ?? [];
-					const created = await props.api.tunnelCreate(wantConfig, { ...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) } });
-					setTunnel(created);
-					setActivity(void 0);
-					if (created.errorKey !== void 0 || created.error !== void 0) throw new Error(tunnelErrorText(created));
-					if (wantConfig && created.configText !== void 0) {
-						setConfigText(created.configText);
-						await refresh();
-						notify("tunnelConfigAuto");
-						return;
-					}
-					const url = created.url ?? await waitForTunnelUrl(() => alive);
-					await refresh();
-					if (url === null) {
-						notify("tunnelUrlPending");
-						return;
-					}
-					if (wantConfig) await generateConfigForUrl(url, "tunnelConfigAuto");
-					else notify("tunnelStarted");
-				} catch (cause) {
-					setError(cause);
-				} finally {
-					alive = false;
-					setActivity(void 0);
-					setTunnelBusy(false);
-				}
-			}, [
-				props.api,
-				refresh,
-				status,
-				t,
-				notify,
-				pollActivityOnce,
-				waitForTunnelUrl,
-				tunnelErrorText,
-				generateConfigForUrl
-			]);
-			const stopTunnel = (0, react.useCallback)(async () => {
-				if (!window.confirm(t("tunnelStopConfirm"))) return;
-				setTunnelBusy(true);
-				setError(void 0);
-				try {
-					const next = await props.api.tunnelStop();
-					setTunnel(next);
-					await refresh();
-					notify("tunnelStopped");
-				} catch (cause) {
-					setError(cause);
-				} finally {
-					setTunnelBusy(false);
-				}
-			}, [
-				props.api,
-				refresh,
-				t,
-				notify
-			]);
-			const tunnelConfigClick = (0, react.useCallback)(async () => {
-				if (tunnel?.running === true) {
-					if (!window.confirm(t("tunnelStopConfirm"))) return;
-					setTunnelBusy(true);
-					setError(void 0);
-					try {
-						const stopped = await props.api.tunnelStop();
-						setTunnel(stopped);
-						await refresh();
-					} catch (cause) {
-						setError(cause);
-					} finally {
-						setTunnelBusy(false);
-					}
-					await createTunnel({ thenGenConfig: true });
-				} else await createTunnel({ thenGenConfig: true });
-			}, [
-				props.api,
-				tunnel,
-				t,
-				createTunnel,
-				refresh,
-				setError
-			]);
-			(0, react.useEffect)(() => {
-				refresh();
-			}, [refresh]);
-			(0, react.useEffect)(() => {
-				if (status === void 0) return;
-				setListenerHost(status.configuredHost);
-				setListenerPort(String(status.configuredPort));
-			}, [status?.configuredHost, status?.configuredPort]);
-			const roots = status?.roots ?? [];
-			const managementLocked = tunnel?.running === true;
-			const [grantedScopes, setGrantedScopes] = (0, react.useState)([...DEFAULT_DEVICE_SCOPES]);
-			const toggleScope = (0, react.useCallback)((scope) => {
-				setGrantedScopes((current) => current.includes(scope) ? current.filter((item) => item !== scope) : [...current, scope]);
-			}, []);
-			const grantNotice = grantedScopes.length === 0 ? t("scopeGrantNoticeEmpty") : (status?.devices?.length ?? 0) === 0 ? t("scopeGrantNotice") : t("scopeGrantNoticeExisting");
-			const parsedListenerPort = Number(listenerPort);
-			const listenerPortValid = Number.isInteger(parsedListenerPort) && parsedListenerPort >= 1 && parsedListenerPort <= 65535;
-			const listenerDirty = status !== void 0 && (listenerHost.trim() !== status.configuredHost || parsedListenerPort !== status.configuredPort);
-			const poll = async (id) => {
-				for (let attempt = 0; attempt < 30; attempt += 1) {
-					await delay(300);
-					const next = await props.api.operation(id);
-					setStatus(next);
-					const operation = next.operation;
-					if (operation?.state === "succeeded") {
-						if (operation.pairingCode !== void 0) setPairing({
-							code: operation.pairingCode,
-							...operation.pairingExpiresAt === void 0 ? {} : { expiresAt: operation.pairingExpiresAt }
-						});
-						return;
-					}
-					if (operation?.state === "failed") throw new Error(listenerOperationError(operation.code, operation.message, t));
 				}
-				throw new Error(t("listenerTimedOut"));
-			};
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("main", {
-				className: "daw-admin",
+				setCopyState("manual");
+			}, [props.result.text]);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: { marginTop: 14 },
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-admin-topbar",
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(LanguageToggle, {})
-					}),
-					error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "daw-warning",
-						role: "alert",
-						children: messageOf(error, t)
+						children: t("configTextSecurity")
 					}),
-					notice !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-success",
-						role: "status",
-						children: t(notice.key, notice.params)
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						children: t("configTextHint")
 					}),
-					managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-warning",
-						role: "status",
-						children: t("managementLockedWhileTunnel")
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("textarea", {
+						ref: textRef,
+						className: "daw-input",
+						style: {
+							width: "100%",
+							height: "auto",
+							minHeight: 76,
+							marginTop: 8,
+							padding: "8px 9px",
+							fontFamily: "ui-monospace,SFMono-Regular,Consolas,monospace",
+							fontSize: 12,
+							lineHeight: 1.5,
+							resize: "vertical"
+						},
+						readOnly: true,
+						rows: 4,
+						spellCheck: false,
+						value: props.result.text,
+						onFocus: (event) => event.currentTarget.select()
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-						tab: "roots",
-						nameKey: tabLabelKey("roots"),
-						descKey: tabDescKey("roots"),
-						open: isOpen("roots"),
-						onToggle: () => toggleCard("roots"),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-form-row",
+						style: {
+							marginTop: 8,
+							marginBottom: 10,
+							gridTemplateColumns: "auto auto minmax(0,1fr)",
+							alignItems: "center"
+						},
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-form-row",
-								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: "daw-input",
-										placeholder: t("absolutePath"),
-										value: path,
-										onChange: (event) => setPath(event.target.value)
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: "daw-input",
-										placeholder: t("displayLabel"),
-										value: label,
-										onChange: (event) => setLabel(event.target.value)
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										className: "daw-command primary",
-										disabled: managementLocked,
-										title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
-										onClick: () => {
-											setError(void 0);
-											props.api.addRoot(path, label || void 0).then(() => {
-												setPath("");
-												setLabel("");
-												notify("rootAdded");
-												return refresh();
-											}).catch(setError);
-										},
-										children: t("addRoot")
-									})
-								]
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								className: "daw-command primary",
+								onClick: () => {
+									copy();
+								},
+								children: t("copy")
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list",
-								children: roots.map((root) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									className: "daw-list-row",
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-list-title",
-										children: [root.label, root.builtin === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-											className: "daw-pill on",
-											children: t("builtinRootBadge")
-										})]
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-list-meta",
-										children: root.realPath
-									})] }), root.builtin === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: "daw-list-meta daw-builtin-hint",
-										children: t("builtinRootHint")
-									}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										className: "daw-icon danger",
-										title: t("removeRoot"),
-										"aria-label": t("removeRoot"),
-										disabled: managementLocked,
-										onClick: () => {
-											if (!window.confirm(t("removeRootConfirm", { label: root.label }))) return;
-											setError(void 0);
-											props.api.removeRoot(root.id).then(() => {
-												notify("rootRemoved");
-												return refresh();
-											}).catch(setError);
-										},
-										children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
-									})]
-								}, root.id))
+							copyState === "done" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-pill on",
+								children: t("copied")
 							}),
-							roots.some((root) => root.builtin === true) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta daw-builtin-notice",
-								children: t("builtinRootNotice")
+							copyState === "manual" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-list-meta",
+								children: t("copyManual")
 							})
 						]
-					}, "roots"),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-						tab: "remote",
-						nameKey: tabLabelKey("remote"),
-						descKey: tabDescKey("remote"),
-						open: isOpen("remote"),
-						onToggle: () => toggleCard("remote"),
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-list-meta",
+						style: { marginBottom: 2 },
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-warning",
-								children: t("httpWarning")
-							}),
-							roots.length === 0 && !managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-warning",
-								children: t("addRootBeforeRemote")
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-listener-form",
+							t("configTextDevice"),
+							": ",
+							props.result.deviceName,
+							" · ",
+							t("configTextDeviceId"),
+							": ",
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								style: { fontFamily: "ui-monospace,SFMono-Regular,Consolas,monospace" },
+								children: props.result.deviceId
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginBottom: 10 },
+						children: t("configTextScopes")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("configTextDetected") }),
+					props.result.endpoints.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-warning",
+						style: { marginTop: 8 },
+						children: t("configTextNoEndpoints")
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list",
+						children: props.result.endpoints.map((endpoint) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-row",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-list-title",
+								children: endpoint.label
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-list-meta",
+								children: [endpoint.baseUrl, endpoint.kind === void 0 ? "" : ` · ${endpoint.kind}`]
+							})] })
+						}, `${endpoint.label}:${endpoint.baseUrl}`))
+					})
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/plugins.tsx
+		/**
+		* 插件清单的右侧栏形态：一个真正的 `SidebarRightTabDefinition`。
+		*
+		* ## 为什么不是「再注册一个 slot」
+		*
+		* 报告里第 2 项讲的是 DSH 0.2.1-rc.3 的三处 pin 机制（`view-pins` / `panel-pins` /
+		* `guide-pins`）。pin 只作用于**注册了 panel / view / guide 的插件**——桥原来那两个座位
+		* （`conversation.chat.turnTail` 与 `settings.section`）都不在这三者的管辖内，所以哪怕把
+		* 三个新 slot 全注册一遍，桥自己的东西也一个都 pin 不到，只能消费别人的条目。
+		*
+		* 要真拿到 pin，唯一的路是**成为 tab 类型提供方**：往 `sidebarRightTabs` 注册一个
+		* definition，并在 `sidebar.right.pane.tab` / `.title` 两个 keyed seat 上按 `definition.id`
+		* 挂上 body 与标题。这样 guide 页会列出这张卡片，用户能在 rc.3 的 More 菜单里把它
+		* 固定 / 取消固定（`guide-pins.d.ts` 的 `FIXED_GUIDE_KIND = "files"` 只豁免文件卡片，
+		* 桥的 kind 不在豁免名单里）。
+		*
+		* ## 为什么单独一个文件
+		*
+		* `workspace.tsx` 已经 1200 多行，而 `docs/project/TECH-DEBT.md` 的行数预算写的是
+		* 600 行/文件、超预算要先登记。把新 UI 面拆出来既不加剧那笔债，也让「设置页里的折叠卡」
+		* 与「右侧栏的常驻 tab」这两种形态各自独立演进。
+		*
+		* ## rc.2 上的降级
+		*
+		* `sidebarRightTabs` 在 rc.2 与 rc.3 都提供，definition 契约两版一致，所以 tab 本身能用；
+		* 但 rc.2 的 `GuideBody` 没有 `entryPins` / `entryActions` / More 菜单，卡片会正常列出、
+		* 点开也正常，只是**不能 pin**。这是可接受的降级：能力随宿主版本生长，桥不做版本判断。
+		*/
+		/** definition 的 id：tab 系统的实现身份，同时是 body/title 两个 keyed seat 的 key。 */
+		const PLUGINS_TAB_ID = "dsh-remote-bridge-plugins";
+		/**
+		* tab 类型名。
+		*
+		* 必须与 DSH 内置类型不冲突 —— 内置的有 `guide` / `files` / `terminal` / `browser` /
+		* `plan` / `schedule` / `deliverables` 等。冲突时 `sidebarRightTabs.register` 会抛
+		* `sidebarRight: tab kind "…" is already registered`，整个插件起不来，所以带上插件前缀。
+		*/
+		const PLUGINS_TAB_KIND = "remote-bridge-plugins";
+		/**
+		* 构造 tab 类型定义。
+		*
+		* 文案用 thunk（`() => string`）而不是现取的字符串：契约里写明 thunk 每次使用都会重读，
+		* 所以切换语言不需要重新注册。`title` 是 tab chip 的初始文字，开 tab 的那一刻被捕获进
+		* layout record。
+		*
+		* `patterns` 故意省略 —— 省略即「page type」，只能按 kind 打开（guide 卡片点一下就是这条路），
+		* 不会被文件地址意外匹配到。`priority` 用默认的 `extension`。
+		*/
+		function pluginsTabDefinition() {
+			const label = () => translate(getWorkspaceLocale(), "pluginsTab");
+			const description = () => translate(getWorkspaceLocale(), "pluginsTabDesc");
+			return {
+				id: PLUGINS_TAB_ID,
+				kind: PLUGINS_TAB_KIND,
+				title: label,
+				guide: [{
+					id: "plugins",
+					order: 40,
+					title: label,
+					description,
+					icon: import_lucide_react.Package
+				}]
+			};
+		}
+		/**
+		* tab chip 里的文字。
+		*
+		* 不读 `useTabInfo` 是刻意的：标题在开 tab 时就被捕获了，跟着当前语言走没有意义；
+		* 而且 rc.2 / rc.3 的 hook 注入形状不同，少依赖一处就少一处版本耦合。
+		*/
+		function PluginsTabTitle() {
+			const { t } = useWorkspaceI18n();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, { children: t("pluginsTab") });
+		}
+		/**
+		* 右侧栏里的插件清单。
+		*
+		* 与设置页那张折叠卡读同一对端点（`GET/PATCH /settings/plugins`），但形态不同：
+		* 这里是**常驻面板**，没有卡片外壳，清单直接铺开；刷新按钮常驻而不是「展开才拉」——
+		* 用户既然把这张卡 pin 到了 guide 页，就是打算经常看。
+		*
+		* 三条与设置页一致的产品约束（详见 `workspace.tsx` 的 `PluginsSection` 注释）：
+		* 官方包不可停用、`runtime-provided` 不是故障、改完要重启才生效。
+		*/
+		function makePluginsTabBody(api) {
+			return function PluginsTabBody() {
+				const { t } = useWorkspaceI18n();
+				const [inventory, setInventory] = (0, react.useState)(void 0);
+				const [busy, setBusy] = (0, react.useState)(false);
+				const [checking, setChecking] = (0, react.useState)(false);
+				const [toggling, setToggling] = (0, react.useState)(void 0);
+				const [error, setError] = (0, react.useState)(void 0);
+				const [restartRequired, setRestartRequired] = (0, react.useState)(false);
+				const load = (0, react.useCallback)(async (checkUpdates) => {
+					if (checkUpdates) setChecking(true);
+					else setBusy(true);
+					setError(void 0);
+					try {
+						setInventory(await api.pluginInventory(checkUpdates));
+					} catch (cause) {
+						setError(messageOf(cause, t));
+					} finally {
+						if (checkUpdates) setChecking(false);
+						else setBusy(false);
+					}
+				}, [t]);
+				(0, react.useEffect)(() => {
+					load(false);
+				}, [load]);
+				const toggle = (0, react.useCallback)(async (entry) => {
+					setToggling(entry.name);
+					setError(void 0);
+					try {
+						await api.togglePlugin(entry.name, !entry.loaded);
+						setInventory(await api.pluginInventory(false));
+						setRestartRequired(true);
+					} catch (cause) {
+						setError(messageOf(cause, t));
+					} finally {
+						setToggling(void 0);
+					}
+				}, [t]);
+				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "daw-plugins-tab",
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "daw-list-meta",
+							children: t("pluginsHint")
+						}),
+						error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-warning",
+							role: "alert",
+							children: error
+						}),
+						restartRequired && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-success",
+							role: "status",
+							children: t("pluginsRestartRequired")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "daw-form-row",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+								type: "button",
+								className: "daw-command",
+								disabled: busy,
+								onClick: () => {
+									load(false);
+								},
 								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-										className: "daw-field",
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("bindIp") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-											className: "daw-input",
-											value: listenerHost,
-											disabled: status?.remoteEnabled || managementLocked,
-											spellCheck: false,
-											placeholder: "0.0.0.0",
-											onChange: (event) => setListenerHost(event.target.value)
-										})]
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-										className: "daw-field",
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("bindPort") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-											className: "daw-input",
-											type: "number",
-											min: 1,
-											max: 65535,
-											inputMode: "numeric",
-											value: listenerPort,
-											disabled: status?.remoteEnabled || managementLocked,
-											onChange: (event) => setListenerPort(event.target.value)
-										})]
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										className: "daw-command",
-										disabled: managementLocked || status?.remoteEnabled || listenerHost.trim() === "" || !listenerPortValid || !listenerDirty,
-										onClick: () => {
-											setError(void 0);
-											props.api.configureListener(listenerHost.trim(), parsedListenerPort).then((result) => poll(result.id)).then(() => {
-												notify("listenerSaved");
-												return refresh();
-											}).catch(setError);
-										},
-										children: t("saveListener")
-									})
-								]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-listener-status",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("strong", { children: [t("configuredListener"), ":"] }),
-									" ",
-									formatEndpoint(status?.configuredHost ?? listenerHost, status?.configuredPort ?? parsedListenerPort)
-								] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("strong", { children: [t("actualListener"), ":"] }),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.RefreshCw, { size: 14 }),
 									" ",
-									formatEndpoint(status?.host ?? "127.0.0.1", status?.port ?? parsedListenerPort)
-								] })]
-							}),
-							status?.remoteEnabled && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta daw-listener-hint",
-								children: t("disableToEditListener")
-							}),
-							!status?.remoteEnabled && listenerDirty && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta daw-listener-hint",
-								children: t("saveBeforeEnable")
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: `daw-pill${status?.remoteEnabled ? " on" : ""}`,
-								children: status?.remoteEnabled ? t("remoteEnabled") : t("loopbackOnly")
-							}) }),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-tunnel",
-								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-tunnel-head",
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("tunnelTitle") }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-											className: `daw-pill${tunnel?.running ? " on" : ""}`,
-											children: tunnel?.running ? t("tunnelRunning") : t("tunnelStopped")
-										})]
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-										className: "daw-list-meta",
-										children: t("tunnelHint")
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-warning",
-										children: t("tunnelSecurityWarning")
-									}),
-									tunnel?.errorKey !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-warning",
-										role: "alert",
-										children: t(tunnel.errorKey, tunnel.errorParams ?? {})
-									}),
-									tunnel?.errorKey === void 0 && tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-warning",
-										role: "alert",
-										children: tunnel.error
-									}),
-									tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-url-row",
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-											className: "daw-tunnel-url",
-											children: tunnel.url
-										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
-											text: tunnel.url,
-											title: t("copyUrl"),
-											copiedText: t("copied"),
-											manualText: t("copyManual"),
-											copyText
-										})]
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										className: "daw-command primary",
-										style: { marginTop: 10 },
-										disabled: tunnelBusy || tunnel?.running !== true && roots.length === 0,
-										onClick: () => {
-											if (tunnel?.running === true) stopTunnel();
-											else createTunnel();
-										},
-										children: tunnel?.running === true ? t("tunnelStop") : t("tunnelCreate")
-									}),
-									activity !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-tunnel-progress",
-										style: { marginTop: 10 },
-										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-											className: "daw-progress-track",
-											children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-												className: `daw-progress-fill${activity.percent === null ? " indeterminate" : ""}`,
-												style: activity.percent === null ? void 0 : { width: `${activity.percent}%` }
-											})
-										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-											className: "daw-list-meta",
-											style: { marginTop: 4 },
-											children: activity.labelKey === "" ? "" : t(activity.labelKey, activity.labelParams ?? {})
-										})]
-									})
+									busy ? t("loading") : t("refresh")
 								]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("fieldset", {
-								disabled: managementLocked,
-								style: {
-									border: "none",
-									margin: 0,
-									padding: 0
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								type: "button",
+								className: "daw-command",
+								disabled: checking,
+								onClick: () => {
+									load(true);
 								},
-								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "daw-scope-grid",
-									children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-										className: "daw-check",
+								children: checking ? t("pluginsChecking") : t("pluginsCheckUpdates")
+							})]
+						}),
+						inventory === void 0 ? busy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta",
+							children: t("loading")
+						}) : null : !inventory.available ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta",
+							children: t("pluginsUnavailable", { reason: inventory.reason ?? "" })
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "daw-list-meta",
+							children: [
+								inventory.profile !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [inventory.profile, " · "] }),
+								inventory.loadedCount,
+								" / ",
+								inventory.items.length,
+								inventory.problemCount > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" · ", t("pluginsProblems", { count: inventory.problemCount })] })
+							]
+						}), inventory.items.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta daw-empty",
+							children: t("pluginsEmpty")
+						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list",
+							children: inventory.items.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-list-row",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-list-title",
+										children: [entry.name, entry.installed !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "daw-list-meta",
+											children: [" · ", entry.installed]
+										})]
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: "daw-list-meta",
+										children: entry.description ?? t("pluginsNoDescription")
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "daw-list-meta",
 										children: [
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-												type: "checkbox",
-												checked: grantedScopes.includes(scope),
-												onChange: () => toggleScope(scope)
+											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: `daw-pill${entry.loaded ? " on" : ""}`,
+												children: t(pluginStateKey(entry.state))
 											}),
-											" ",
-											scopeLabel(locale, scope)
+											entry.updateAvailable === true && entry.latestVersion !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "daw-pill",
+												children: t("pluginsUpdateAvailable", { version: entry.latestVersion })
+											})] }),
+											entry.updateAvailable === false && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" · ", t("pluginsLatest")] })
 										]
-									}, scope))
-								})
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								children: grantNotice
-							}),
-							status?.remoteEnabled ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								className: "daw-command danger",
-								disabled: managementLocked,
-								title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
-								onClick: () => {
-									if (!window.confirm(t("disableRemoteConfirm"))) return;
-									setError(void 0);
-									props.api.disableRemote().then((result) => poll(result.id)).then(() => {
-										notify("remoteDisabled");
-										return refresh();
-									}).catch(setError);
-								},
-								children: t("disableRemote")
-							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								className: "daw-command primary",
-								disabled: managementLocked || roots.length === 0 || listenerDirty || !listenerPortValid || listenerHost.trim() === "" || grantedScopes.length === 0,
-								onClick: () => {
-									setError(void 0);
-									props.api.enableRemote(roots.map((root) => root.id), grantedScopes).then((result) => poll(result.id)).catch(setError);
-								},
-								children: t("enablePairing")
-							}),
-							(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-command daw-inline-command",
-									disabled: managementLocked || grantedScopes.length === 0,
-									title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
-									onClick: () => {
-										setError(void 0);
-										props.api.createPairing(roots.map((root) => root.id), grantedScopes).then((value) => {
-											setPairing(value);
-											notify("pairingCreated");
-										}).catch(setError);
-									},
-									children: t("newPairingCode")
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-command daw-inline-command",
-									disabled: managementLocked || configTextBusy,
-									title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
-									onClick: () => {
-										const manual = configEndpoint.trim();
-										setConfigTextBusy(true);
-										setError(void 0);
-										props.api.createConfigText({
-											...roots.length === 0 ? {} : { rootIds: roots.map((root) => root.id) },
-											...manual === "" ? {} : { endpoints: [{
-												label: t("configTextManualLabel"),
-												baseUrl: manual
-											}] }
-										}).then((value) => {
-											setConfigText(value);
-											notify("configCreated");
-										}).catch(setError).finally(() => setConfigTextBusy(false));
-									},
-									children: t("newConfigText")
-								}),
-								tunnel !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-command daw-inline-command",
-									disabled: configTextBusy || tunnelBusy,
+									})
+								] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: entry.toggleable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									className: "daw-command",
+									disabled: toggling === entry.name,
 									onClick: () => {
-										tunnelConfigClick();
+										toggle(entry);
 									},
-									children: tunnel.running !== true ? t("tunnelStartAndGenConfig") : t("tunnelRestartAndGenConfig")
-								}),
-								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "daw-list-meta daw-listener-hint",
-									children: t("configTextScopeNote")
-								})
-							] }),
-							pairing !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-code-row",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "daw-code",
-									children: pairing.code
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
-									className: "daw-copy-inline",
-									text: pairing.code,
-									title: t("copyPairing"),
-									copiedText: t("copied"),
-									manualText: t("copyManual"),
-									copyText
-								})]
-							}), pairing.expiresAt !== void 0 && pairing.expiresAt > now && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								style: { marginTop: -4 },
-								children: t("pairingExpiresAt", { minutes: pairingMinutesLeft(pairing.expiresAt, now) })
-							})] }),
-							(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								style: {
-									marginTop: 12,
-									maxWidth: 560
-								},
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-									className: "daw-field",
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("configTextManual") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-										className: "daw-input",
-										value: configEndpoint,
-										disabled: managementLocked,
-										spellCheck: false,
-										placeholder: t("configTextManualPlaceholder"),
-										onChange: (event) => setConfigEndpoint(event.target.value)
-									})]
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "daw-list-meta",
-									style: { marginTop: 5 },
-									children: t("configTextManualHint")
-								})]
+									children: entry.loaded ? t("pluginsDisable") : t("pluginsEnable")
+								}) })]
+							}, entry.name))
+						})] })
+					]
+				});
+			};
+		}
+		//#endregion
+		//#region src/client/styles.ts
+		const STYLE_ID = "dsh-workspace-style";
+		/**
+		* 插件的全部样式。
+		*
+		* 导出出来是为了让测试能守住一条容易失守的不变量：**CSS 变量块必须同时覆盖
+		* `.daw-root` 与 `.daw-settings-section`**。
+		*
+		* 这条防线来自一个真实发生过的隐形 bug：设置页内联渲染时，那一节没有 `.daw-root` 祖先，
+		* 于是 `var(--daw-accent)` 解析失败 → `.daw-command.primary` 的 `background` 失效变透明、
+		* 而 `color` 仍是 `#fff` → **白字落在白底上，按钮彻底看不见**。
+		* 类型检查、单测、构建全都发现不了，只有肉眼看渲染或量计算样式才抓得到。
+		*/
+		const WORKSPACE_CSS = `
+.daw-root,.daw-settings-section,.daw-plugins-tab{--daw-bg:var(--dsw-alias-bg-base,var(--dsw-alias-bg-layer-2,#f7f8fa));--daw-panel:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));--daw-ink:var(--dsw-alias-label-primary,#18202a);--daw-muted:var(--dsw-alias-label-tertiary,#687381);--daw-line:var(--dsw-alias-border-l2,#dfe4e8);--daw-accent:var(--dsw-alias-brand-primary,#087f8c);--daw-accent-soft:var(--dsw-alias-bg-module-platform,#e5f5f6);--daw-good:var(--dsw-alias-state-success-primary,#2f7d4a);--daw-danger:var(--dsw-alias-state-error-primary,#b33a3a);color:var(--daw-ink);background:transparent;font:13px/1.45 Inter,ui-sans-serif,system-ui,sans-serif;letter-spacing:0;min-width:0}
+.daw-root *,.daw-settings-section *,.daw-plugins-tab *{box-sizing:border-box;letter-spacing:0}
+/* 输入控件基线（UI-04）：此前只有 :focus-visible 一条，非聚焦态全靠浏览器默认（2px inset/Arial/灰底），
+   深色令牌下实测白底黑字与面板割裂。这里给齐边框/底/字/内边距，聚焦态只换描边。 */
+.daw-input{width:100%;min-width:0;height:30px;padding:4px 9px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:6px;background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit}
+.daw-input::placeholder{color:var(--dsw-alias-label-tertiary,var(--daw-muted))}
+.daw-input:focus-visible{border-color:var(--dsw-alias-brand-primary,var(--daw-accent));outline:none}
+.daw-input:disabled{opacity:.55;cursor:not-allowed}.daw-icon{width:30px;padding:0}
+.daw-icon:hover{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}
+.daw-icon.danger{color:var(--daw-danger);border-color:transparent;background:transparent}
+.daw-icon:disabled{opacity:.45;cursor:not-allowed}
+/* 普通命令按钮基线（UI-04）：旧版写死 background:#fff/border:#cbd2d8，深色令牌下成了白块黑字。
+   全部改走 DSH 令牌；.primary 沿用面板底色做次按钮、真正的主操作由调用方加 .primary 配合。 */
+.daw-command{height:30px;padding:0 12px;border-radius:6px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit;cursor:pointer}
+.daw-command:hover:not(:disabled){border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-command:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,var(--daw-accent));outline-offset:1px}
+/* 禁用态（UI-05）：此前无任何 :disabled 样式，只剩浏览器默认的 30% 文字且仍是箭头手型。 */
+.daw-command:disabled{opacity:.5;cursor:not-allowed}
+.daw-command.primary{color:var(--dsw-alias-label-primary,var(--daw-ink));background:var(--dsw-alias-bg-module-platform,var(--daw-panel));border-color:var(--dsw-alias-border-l2,var(--daw-line));font-weight:500}
+.daw-command.primary:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-command.danger{color:var(--daw-danger)}
+.daw-command.danger:hover:not(:disabled){border-color:var(--daw-danger)}
+/* 图标+文字的小复制按钮：图标和文字对齐，窄屏只露图标也不改变按钮高度。 */
+.daw-command.icon-as-command{display:inline-flex;align-items:center;gap:6px;padding:0 10px;white-space:nowrap}
+.daw-copy-label{font-size:12px}
+.daw-empty{padding:14px 2px;text-align:center}
+.daw-admin{overflow:auto;padding:18px;display:flex;flex-direction:column;gap:10px}.daw-admin h3{font-size:14px;margin:0 0 12px}
+.daw-card{border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));border-radius:12px;list-style:none;transition:border-color .16s,background .16s}
+.daw-card:hover{border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-card-open{background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
+.daw-card-header{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;align-items:center;gap:12px;padding:14px 16px;display:flex}
+.daw-card-header:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,var(--daw-accent));outline-offset:-2px}
+.daw-card-icon{color:var(--dsw-alias-label-tertiary,var(--daw-muted));flex:none;display:flex;align-items:center}
+.daw-card-headtext{flex-direction:column;flex:1;gap:4px;min-width:0;display:flex}
+.daw-card-name{color:var(--dsw-alias-label-primary,var(--daw-ink));font-size:15px;font-weight:600;line-height:1.4}
+.daw-card-desc{color:var(--dsw-alias-label-tertiary,var(--daw-muted));font-size:13px;line-height:1.5}
+.daw-card-chevron{color:var(--dsw-alias-label-tertiary,var(--daw-muted));flex:none;transition:transform .16s;font-size:12px;line-height:1}
+.daw-card-chevron-open{transform:rotate(180deg)}
+.daw-card-body{border-top:1px solid var(--dsw-alias-border-l2,var(--daw-line));margin:0 16px;padding-bottom:8px}.daw-settings-section{display:grid;grid-template-rows:auto minmax(0,1fr);gap:10px;min-width:0;min-height:0}.daw-plugins-tab{overflow:auto;padding:14px 16px;display:flex;flex-direction:column;gap:10px;min-width:0;min-height:0}.daw-settings-section>.daw-list-meta{margin:0}.daw-settings-section .daw-admin{padding:14px 2px}.daw-qr-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin-top:12px}.daw-qr-card{margin:0;display:grid;justify-items:center;gap:8px;padding:16px;border:1px solid var(--daw-line);border-radius:6px;background:var(--daw-panel)}.daw-qr-image{width:180px;height:180px;background:var(--dsw-alias-bg-layer-3,#fff);border-radius:4px}.daw-qr-site{font-weight:600}.daw-qr-url{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-accent);text-decoration:none;overflow-wrap:anywhere;text-align:center}.daw-qr-url:hover{text-decoration:underline}.daw-form-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(120px,.45fr) auto;gap:8px;margin-bottom:14px}.daw-listener-form{display:grid;grid-template-columns:minmax(180px,1fr) 130px auto;gap:8px;align-items:end}.daw-field{display:grid;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:12px}.daw-listener-status{display:flex;flex-wrap:wrap;gap:5px 18px;padding:9px 0;color:var(--daw-muted);font:12px ui-monospace,SFMono-Regular,Consolas,monospace}.daw-listener-hint{margin:0 0 8px}.daw-list{border-top:1px solid var(--daw-line)}.daw-list-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:center;min-height:48px;border-bottom:1px solid var(--daw-line);padding:7px 2px}.daw-list-title{font-weight:600;overflow-wrap:anywhere}
+.daw-list-title .daw-pill{margin-left:8px;vertical-align:middle}
+.daw-builtin-hint{text-align:right;align-self:center}
+.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-command{margin-left:8px}
+/* 成功反馈条（UI-07）：与 .daw-warning 同形，但走成功色，操作成功不再静默。 */
+.daw-success{flex:none;border:1px solid var(--dsw-alias-state-success-primary,var(--daw-good));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--dsw-alias-state-success-primary,var(--daw-good));margin-bottom:0}
+.daw-admin-topbar{display:flex;justify-content:flex-end;margin-bottom:8px}
+.daw-url-row{display:flex;align-items:center;gap:8px;margin-top:8px}.daw-url-row .daw-tunnel-url{flex:1 1 auto;margin:0;min-width:0}
+.daw-code-row{display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin:12px 0}.daw-code-row .daw-code{margin:0;flex:1 1 220px;min-width:0}.daw-copy-inline{flex:none}
+/* 隧道/监听进行中的流动条（UI-08）：percent=null 时铺一段高光在轨道里循环滑动，
+   不再把「未知进度」伪装成恒定 30%。 */
+.daw-progress-fill.indeterminate{width:40%;background:linear-gradient(90deg,transparent,var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line))),transparent);animation:daw-indeterminate 1.1s ease-in-out infinite}
+@keyframes daw-indeterminate{0%{transform:translateX(-120%)}100%{transform:translateX(280%)}}
+/* 「高级设置」组：外层是个普通卡片，组内的卡片缩进一格并挂一道左侧色条，
+   让人一眼看出「这些是嵌进去的，不是与主列表同级」。功能上与主列表完全一致。 */
+.daw-advanced-group .daw-card-body{display:flex;flex-direction:column;gap:10px;padding-bottom:14px}
+.daw-advanced-body .daw-card{border-left:3px solid var(--dsw-alias-state-info-primary,var(--daw-accent));background:var(--dsw-alias-bg-layer-3,var(--daw-panel))}
+.daw-advanced-body .daw-card-header{padding:12px 14px}
+.daw-advanced-body .daw-card-name{font-size:14px}
+@media (max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
+`;
+		function installWorkspaceStyles() {
+			if (document.getElementById(STYLE_ID) !== null) return;
+			const style = document.createElement("style");
+			style.id = STYLE_ID;
+			style.dataset.plugin = "dsh-workspace";
+			style.textContent = WORKSPACE_CSS;
+			document.head.appendChild(style);
+		}
+		//#endregion
+		//#region src/client/app-qr.ts
+		const APP_QR_CODES = [{
+			"key": "github",
+			"label": "GitHub",
+			"url": "https://github.com/westanke/dsh-companion/releases",
+			"dataUrl": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNjQiIGhlaWdodD0iMjY0IiB2aWV3Qm94PSIwIDAgNDEgNDEiIHNoYXBlLXJlbmRlcmluZz0iY3Jpc3BFZGdlcyI+PHBhdGggZmlsbD0iI2ZmZmZmZiIgZD0iTTAgMGg0MXY0MUgweiIvPjxwYXRoIHN0cm9rZT0iIzAwMDAwMCIgZD0iTTQgNC41aDdtMSAwaDFtMiAwaDFtMyAwaDNtMyAwaDFtMSAwaDFtMiAwaDdNNCA1LjVoMW01IDBoMW0zIDBoM200IDBoMW0xIDBoMW0yIDBoMW0zIDBoMW01IDBoMU00IDYuNWgxbTEgMGgzbTEgMGgxbTMgMGgybTEgMGgxbTEgMGgxbTQgMGg1bTEgMGgxbTEgMGgzbTEgMGgxTTQgNy41aDFtMSAwaDNtMSAwaDFtMSAwaDJtMiAwaDFtMSAwaDJtMSAwaDJtMSAwaDFtMiAwaDFtMiAwaDFtMSAwaDNtMSAwaDFNNCA4LjVoMW0xIDBoM20xIDBoMW0xIDBoNG0xIDBoMm0zIDBoM20yIDBoMW0yIDBoMW0xIDBoM20xIDBoMU00IDkuNWgxbTUgMGgxbTEgMGgxbTEgMGgxbTMgMGgxbTEgMGg0bTEgMGgxbTQgMGgxbTUgMGgxTTQgMTAuNWg3bTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGg3TTEyIDExLjVoMW01IDBoNW0yIDBoNE00IDEyLjVoMW0zIDBoMW0xIDBoNG03IDBoMW0xIDBoM20zIDBoNW0yIDBoMU00IDEzLjVoMW02IDBoMW0zIDBoMW0xIDBoNG02IDBoMW0xIDBoMW0zIDBoM000IDE0LjVoMm00IDBoNm0zIDBoMW0xIDBoMW0yIDBoMm0xIDBoMW0yIDBoMW0yIDBoMW0xIDBoMU00IDE1LjVoMW0yIDBoMm0zIDBoMW0xIDBoM20xIDBoMW0yIDBoNW0xIDBoMW0xIDBoMW01IDBoMk01IDE2LjVoMW0xIDBoMW0yIDBoMW0xIDBoMW0yIDBoMW0xIDBoM20yIDBoN20xIDBoMW0xIDBoMm0xIDBoMk00IDE3LjVoMW02IDBoMW0xIDBoNW0yIDBoMW0yIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDE4LjVoMm0xIDBoM20xIDBoMm01IDBoNG0zIDBoMW0xIDBoM20yIDBoMk00IDE5LjVoMW0yIDBoMm00IDBoMm0zIDBoMW0yIDBoMW0xIDBoNG0yIDBoMk02IDIwLjVoMW0yIDBoMm0yIDBoMm0yIDBoM20xIDBoMW0zIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0yIDBoMU00IDIxLjVoMW0xIDBoMW0yIDBoMW0yIDBoMW0xIDBoMm0yIDBoMm0xIDBoMm00IDBoMW0xIDBoMW0zIDBoM000IDIyLjVoNW0xIDBoMW0xIDBoMm0xIDBoM20xIDBoMW0yIDBoMW0xIDBoNG0xIDBoM20xIDBoMW0xIDBoMU01IDIzLjVoMm0xIDBoMm0yIDBoMW0yIDBoMm0yIDBoMW0zIDBoM20xIDBoNW0zIDBoMU01IDI0LjVoMW0xIDBoMm0xIDBoMW0zIDBoMm0xIDBoMm0xIDBoMW0zIDBoM20zIDBoMW0xIDBoMk00IDI1LjVoM20xIDBoMW0yIDBoMm05IDBoM20xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDI2LjVoMW0xIDBoMW0xIDBoMW0xIDBoMW00IDBoM20xIDBoMW0yIDBoMW0xIDBoNG0yIDBoMW0yIDBoMU04IDI3LjVoMm0xIDBoMW0xIDBoMm0yIDBoMW0xIDBoNW0xIDBoMW0yIDBoNW0zIDBoMU00IDI4LjVoNW0xIDBoMW0yIDBoNG0xIDBoMW0yIDBoMW0xIDBoMTFtMSAwaDJNMTIgMjkuNWgybTIgMGgybTEgMGgybTEgMGgxbTEgMGgxbTIgMGgybTMgMGgxbTEgMGgyTTQgMzAuNWg3bTEgMGgxbTEgMGgxbTQgMGgxbTEgMGgxbTIgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgyTTQgMzEuNWgxbTUgMGgxbTMgMGgxbTUgMGgzbTEgMGgybTIgMGgxbTMgMGgxTTQgMzIuNWgxbTEgMGgzbTEgMGgxbTEgMGgxbTQgMGgzbTIgMGgxbTIgMGgybTEgMGg2bTEgMGgxTTQgMzMuNWgxbTEgMGgzbTEgMGgxbTIgMGgxbTEgMGgybTMgMGgybTMgMGgxbTEgMGgybTEgMGgzbTEgMGgxTTQgMzQuNWgxbTEgMGgzbTEgMGgxbTIgMGgzbTQgMGgxbTEgMGgxbTEgMGgxbTIgMGgybTEgMGg0TTQgMzUuNWgxbTUgMGgxbTQgMGgxbTUgMGgxbTIgMGgybTEgMGg0TTQgMzYuNWg3bTEgMGgxbTEgMGgzbTEgMGgybTEgMGgxbTEgMGg0bTEgMGgybTYgMGgxIi8+PC9zdmc+Cg=="
+		}, {
+			"key": "gitee",
+			"label": "Gitee",
+			"url": "https://gitee.com/westanke/dsh-companion/releases",
+			"dataUrl": "data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNjQiIGhlaWdodD0iMjY0IiB2aWV3Qm94PSIwIDAgNDEgNDEiIHNoYXBlLXJlbmRlcmluZz0iY3Jpc3BFZGdlcyI+PHBhdGggZmlsbD0iI2ZmZmZmZiIgZD0iTTAgMGg0MXY0MUgweiIvPjxwYXRoIHN0cm9rZT0iIzAwMDAwMCIgZD0iTTQgNC41aDdtMSAwaDFtMSAwaDJtMSAwaDRtNiAwaDJtMSAwaDdNNCA1LjVoMW01IDBoMW0zIDBoMm0xIDBoMm0xIDBoMW0xIDBoMm0yIDBoMW0zIDBoMW01IDBoMU00IDYuNWgxbTEgMGgzbTEgMGgxbTIgMGgybTEgMGgxbTEgMGgxbTEgMGg0bTEgMGgxbTEgMGgybTEgMGgxbTEgMGgzbTEgMGgxTTQgNy41aDFtMSAwaDNtMSAwaDFtMSAwaDVtMiAwaDNtNSAwaDFtMiAwaDFtMSAwaDNtMSAwaDFNNCA4LjVoMW0xIDBoM20xIDBoMW0xIDBoMW0xIDBoM20zIDBoMW0yIDBoMW0xIDBoMW0xIDBoMW0yIDBoMW0xIDBoM20xIDBoMU00IDkuNWgxbTUgMGgxbTEgMGgybTMgMGgzbTQgMGgzbTEgMGgxbTEgMGgxbTUgMGgxTTQgMTAuNWg3bTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGgxbTEgMGg3TTEyIDExLjVoNW00IDBoMW0xIDBoNk00IDEyLjVoMW0zIDBoMW0xIDBoNG0xIDBoMm0xIDBoNG0zIDBoOW0yIDBoMU00IDEzLjVoMW0xIDBoM201IDBoMW0xIDBoMW0xIDBoNW00IDBoMW0xIDBoMW0zIDBoM000IDE0LjVoMW0xIDBoMW0xIDBoMW0xIDBoNG0zIDBoNG0xIDBoMW0xIDBoN20yIDBoMW0xIDBoMU01IDE1LjVoMW0zIDBoMW0xIDBoMm0yIDBoMW0xIDBoMW0xIDBoMW00IDBoMm0xIDBoNG00IDBoMk00IDE2LjVoMm0yIDBoMW0xIDBoMW0yIDBoMm0yIDBoMW0yIDBoMW0yIDBoMW0xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMk04IDE3LjVoMm0xIDBoMW0yIDBoM20xIDBoMW0zIDBoM20xIDBoMm0xIDBoMW0xIDBoMW0xIDBoMU00IDE4LjVoMW0xIDBoMW0xIDBoM20xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMm0xIDBoMW0yIDBoMW0xIDBoNW0xIDBoMW0yIDBoMU00IDE5LjVoMW00IDBoMW0yIDBoMW0yIDBoM20xIDBoNG0yIDBoMW0xIDBoNU00IDIwLjVoNW0xIDBoNW0yIDBoMW0zIDBoMW0xIDBoNG0xIDBoMW0xIDBoMW0xIDBoMm0xIDBoMU01IDIxLjVoMW01IDBoMm01IDBoM20xIDBoMW00IDBoMW0xIDBoMW0zIDBoM001IDIyLjVoMm0yIDBoM20yIDBoMW0xIDBoMW0xIDBoMm0xIDBoMW0yIDBoMW0xIDBoMm0xIDBoM20xIDBoMW0xIDBoMU00IDIzLjVoMW0yIDBoMW0zIDBoNW01IDBoNW0xIDBoMm0xIDBoMm0zIDBoMk00IDI0LjVoNG0xIDBoMm0xIDBoMm0xIDBoMW0yIDBoMm0yIDBoNW0xIDBoM20xIDBoMm0xIDBoMk00IDI1LjVoNG00IDBoM20xIDBoMW0zIDBoMm0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0yIDBoMk04IDI2LjVoNW0yIDBoNG0xIDBoMW0xIDBoMm0zIDBoMW0xIDBoMW0xIDBoMW0xIDBoMW0xIDBoMU02IDI3LjVoMW0yIDBoMW00IDBoM200IDBoMW0xIDBoM20zIDBoMm00IDBoMU00IDI4LjVoM20zIDBoM200IDBoMW0xIDBoMW0xIDBoMW0zIDBoMm0xIDBoNW0yIDBoMk0xMiAyOS41aDFtMiAwaDFtMyAwaDFtMSAwaDJtNCAwaDJtMyAwaDFtMSAwaDJNNCAzMC41aDdtMSAwaDFtMyAwaDRtMiAwaDFtMSAwaDJtMiAwaDFtMSAwaDFtMSAwaDJtMSAwaDFNNCAzMS41aDFtNSAwaDFtMiAwaDFtMiAwaDFtMiAwaDFtMyAwaDNtMiAwaDFtMyAwaDFtMiAwaDFNNCAzMi41aDFtMSAwaDNtMSAwaDFtMSAwaDFtMSAwaDFtMSAwaDJtMiAwaDFtMyAwaDNtMSAwaDZNNCAzMy41aDFtMSAwaDNtMSAwaDFtMiAwaDFtMiAwaDFtNCAwaDhtMSAwaDNtMSAwaDFNNCAzNC41aDFtMSAwaDNtMSAwaDFtMiAwaDFtMSAwaDJtMSAwaDJtNCAwaDJtMSAwaDJtMSAwaDNNNCAzNS41aDFtNSAwaDFtNCAwaDNtMSAwaDVtMSAwaDFtMiAwaDNNNCAzNi41aDdtMSAwaDFtMiAwaDJtMSAwaDFtMiAwaDFtMSAwaDNtMSAwaDJtNyAwaDEiLz48L3N2Zz4K"
+		}];
+		//#endregion
+		//#region src/client/cards/shell.tsx
+		/**
+		* 每张卡的图标。
+		*
+		* `remote` 与 `tunnel` 刻意不同款：前者是「在本机开个口子」（Upload），后者是「把机器搬到
+		* 外网」（Cloud）。两者共用同一个图标会让用户以为它们是同一件事的两个开关 ——
+		* 而那正是拆分前那张 123 行卡片的毛病。
+		*/
+		function tabIcon(tab) {
+			if (tab === "roots") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.HardDrive, { size: 15 });
+			if (tab === "devices") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Smartphone, { size: 15 });
+			if (tab === "image") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Image, { size: 15 });
+			if (tab === "trash") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 });
+			if (tab === "plugins") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Package, { size: 15 });
+			if (tab === "remote") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Upload, { size: 15 });
+			if (tab === "tunnel") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Cloud, { size: 15 });
+			if (tab === "app-download") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Download, { size: 15 });
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.File, { size: 15 });
+		}
+		function SettingsCard(props) {
+			const { t } = useWorkspaceI18n();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: `daw-card${props.open ? " daw-card-open" : ""}`,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: "daw-card-header",
+					"aria-expanded": props.open,
+					onClick: props.onToggle,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "daw-card-icon",
+							"aria-hidden": "true",
+							children: tabIcon(props.tab)
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: "daw-card-headtext",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-card-name",
+								children: t(props.nameKey)
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-card-desc",
+								children: t(props.descKey)
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: `daw-card-chevron${props.open ? " daw-card-chevron-open" : ""}`,
+							"aria-hidden": "true",
+							children: "▾"
+						})
+					]
+				}), props.open && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-card-body",
+					children: props.children
+				})]
+			});
+		}
+		/**
+		* 「高级设置」组：把平时用不到的分区收进一个可折叠的容器。
+		*
+		* 关键点：**分组只影响显隐，不影响功能**。组里的每一张仍是完整的 `SettingsCard`，
+		* 该拉的请求照拉、该写的接口照写 —— `image` 的懒加载挂在 `openCards` 上、
+		* `plugins` 的懒加载挂在它自己的 `open` 上，两者都不经过这一层。
+		*
+		* 组本身**默认收起**：设置页一进来先看到主列表那几张常用的卡。
+		*/
+		function AdvancedGroup(props) {
+			const { t } = useWorkspaceI18n();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
+				className: `daw-card${props.open ? " daw-card-open" : ""} daw-advanced-group`,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+					type: "button",
+					className: "daw-card-header",
+					"aria-expanded": props.open,
+					onClick: props.onToggle,
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "daw-card-icon",
+							"aria-hidden": "true",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.SlidersHorizontal, { size: 15 })
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+							className: "daw-card-headtext",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-card-name",
+								children: t("advancedGroupTitle")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-card-desc",
+								children: t("advancedGroupDesc")
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: `daw-card-chevron${props.open ? " daw-card-chevron-open" : ""}`,
+							"aria-hidden": "true",
+							children: "▾"
+						})
+					]
+				}), props.open && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-card-body daw-advanced-body",
+					children: props.children
+				})]
+			});
+		}
+		/**
+		* 卡片标题的 i18n 键。
+		*
+		* 大多数分区是 `${tab}Tab`，但 `app-download` 带连字符，裸模板会拼出 `app-downloadTab`
+		* —— 没人该去记那个拼法的键名。显式映射，而不是把命名规则编码进模板。
+		*/
+		function tabLabelKey(tab) {
+			return tab === "app-download" ? "appDownloadTab" : `${tab}Tab`;
+		}
+		/**
+		* 卡片头部的描述行。与 `tabLabelKey` 同理：唯一含连字符的分区显式映射。
+		*
+		* 键名是 `${tab}TabDesc`（**带 Tab**），不是 `${tab}Desc`。这个中间段不是冗余：它让
+		* 描述键与标题键 `rootsTab` / `rootsTabDesc` 成对，读的人一眼能看出这两个属于同一张卡。
+		*
+		* 踩过的坑：早先这里写成 `${tab}Desc`，`rootsDesc` 之类根本不在字典里 —— `translate` 直接
+		* `dictionaries[locale][key].replace(...)` 抛 TypeError，整个设置面板白屏。`as MessageKey`
+		* 把类型检查骗过去了，所以单测全绿也照样白屏。**键名靠模板拼出来时，类型系统是最后一道
+		* 防线，这里偏偏被断言关掉了。** 现在改成显式查表，见下。
+		*/
+		const TAB_DESC_KEYS = {
+			roots: "rootsTabDesc",
+			remote: "remoteTabDesc",
+			tunnel: "tunnelTabDesc",
+			devices: "devicesTabDesc",
+			image: "imageTabDesc",
+			trash: "trashTabDesc",
+			plugins: "pluginsTabDesc",
+			"app-download": "appDownloadTabDesc"
+		};
+		function tabDescKey(tab) {
+			return TAB_DESC_KEYS[tab];
+		}
+		//#endregion
+		//#region src/client/cards/app-download.tsx
+		/**
+		* 「App 下载」卡：手机客户端的下载二维码与地址。
+		*
+		* 这张卡不碰任何服务端状态 —— 二维码是构建期生成的常量（`app-qr.ts`，由
+		* `scripts/generate-app-qr.mjs` 产出）。它唯一的问题是「二维码指向的地址是否还有效」，
+		* 那由生成脚本负责，不在这里。
+		*/
+		function AppDownloadCard(props) {
+			const { t } = useWorkspaceI18n();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "app-download",
+				nameKey: tabLabelKey("app-download"),
+				descKey: tabDescKey("app-download"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "daw-list-meta",
+					children: t("appDownloadHint")
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-qr-grid",
+					children: APP_QR_CODES.map((code) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("figure", {
+						className: "daw-qr-card",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
+								className: "daw-qr-image",
+								src: code.dataUrl,
+								alt: t("appDownloadQrAlt", { site: code.label }),
+								width: 180,
+								height: 180
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("figcaption", {
+								className: "daw-qr-site",
+								children: code.label
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
+								className: "daw-qr-url",
+								href: code.url,
+								target: "_blank",
+								rel: "noreferrer",
+								children: code.url
+							})
+						]
+					}, code.key))
+				})]
+			});
+		}
+		//#endregion
+		//#region src/client/cards/context.ts
+		/**
+		* 卡片共享上下文：`AdminPanel` 拆成 `cards/*.tsx` 之后，各卡不再共用一个巨型函数作用域，
+		* 而是从这里取「大家都要用」的东西。
+		*
+		* ## 为什么用 context 而不是逐层传 props
+		*
+		* 七张卡共享的是**同一份状态**，不是各自的副本：`error` 红条要跨卡显示、`refresh()` 一次
+		* 刷新所有分区、`openCards` 决定展开态。逐层传 props 会让 `AdminPanel` 重新长成一张巨大的
+		* 中转表（每个 prop 出现七八遍），跟没拆一样。context 把「谁给的」这件事收敛到一处。
+		*
+		* ## 放进来的判据
+		*
+		* **至少两张卡要用**，才进这里。只有一张卡用的状态留在那个文件里，不往上提 ——
+		* 否则 context 会变成第二个巨型组件，只是换了个写法。
+		*
+		* ## 不放进来的东西
+		*
+		* 各卡自己的草稿态（根目录输入框里还没提交的路径、识图目录名草稿）刻意留在卡片内：
+		* 它们不需要跨卡共享，提上来只会让「这张卡正在编辑什么」泄漏到全局。
+		*/
+		const CardsContext = (0, react.createContext)(void 0);
+		const CardsProvider = CardsContext.Provider;
+		function useCards() {
+			const value = (0, react.useContext)(CardsContext);
+			if (value === void 0) throw new Error("useCards 必须在 CardsProvider 内使用 —— 卡片没有拿到共享上下文");
+			return value;
+		}
+		//#endregion
+		//#region src/shared/contracts.ts
+		const DEVICE_SCOPES = [
+			"chat.read",
+			"chat.write",
+			"files.read",
+			"files.write",
+			"files.delete",
+			"settings.read",
+			"settings.write"
+		];
+		/**
+		* 授予新设备时的默认权限（**五个非破坏性权限**）。
+		*
+		* 刻意不含 `files.delete` 与 `settings.write`：这两个是破坏性权限，应当是用户显式
+		* 要求才授予。`settings.write` 尤其危险 —— 拿到它就能改供应商 `baseURL`，把模型
+		* 请求连同真实凭据引到任意地址（SEC-H11），所以它绝不能是默认值。
+		*
+		* 三条路径必须共用这一份，否则「同一个产品里三处默认权限不一样」这种缺陷会反复
+		* 复发：服务端生成配置文本时的缺省、Web UI 配对码面板的初始勾选、隧道一键路径。
+		*/
+		const DEFAULT_DEVICE_SCOPES = [
+			"chat.read",
+			"chat.write",
+			"files.read",
+			"files.write",
+			"settings.read"
+		];
+		new Set(DEVICE_SCOPES);
+		//#endregion
+		//#region src/client/cards/devices.tsx
+		/**
+		* 「设备」卡：查看已配对的手机、改名、调权限，以及一键清理长期不动的设备。
+		*
+		* 从 `workspace.tsx` 的 `AdminPanel` 搬出来。搬的是**整张卡连同它的 `DeviceRow`**：
+		* 设备行的编辑态（editing / scopes / rootIds / name）只服务这一张卡，留在卡外没有意义。
+		*
+		* ## 一个「保存」按钮同时提交改名与权限
+		*
+		* 理由（原样保留）：界面上它们在同一块编辑区里，并排两个「保存」必然有人点错。分成两次
+		* 请求（而不是一个 PATCH 带全部字段）是因为它们是两件不同的事：改名不需要权限校验通过，
+		* 权限校验失败也不该把名字回滚。
+		*
+		* 顺序：**先改名，后权限**。名字是无害的装饰性字段；万一权限请求失败，留下一个已改的
+		* 名字比「权限已变但界面报错」好。
+		*/
+		function DevicesCard(props) {
+			const { api, t, status, managementLocked, refresh, notify, setError } = useCards();
+			const [pruneDays, setPruneDays] = (0, react.useState)(30);
+			const [pruneBusy, setPruneBusy] = (0, react.useState)(false);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "devices",
+				nameKey: tabLabelKey("devices"),
+				descKey: tabDescKey("devices"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "daw-inline-command",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "daw-field",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("pruneInactiveDays") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							className: "daw-input",
+							type: "number",
+							min: 1,
+							max: 3650,
+							value: pruneDays,
+							disabled: managementLocked || pruneBusy,
+							onChange: (event) => setPruneDays(Math.max(1, Math.min(3650, Number(event.target.value) || 1)))
+						})]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command",
+						disabled: managementLocked || pruneBusy,
+						onClick: () => {
+							if (!confirm(t("pruneInactiveConfirm", { days: String(pruneDays) }))) return;
+							setPruneBusy(true);
+							setError(void 0);
+							api.pruneInactiveDevices(pruneDays).then((result) => {
+								if (result.pruned === 0) notify("pruneInactiveNone");
+								else notify("pruneInactiveDone", { count: String(result.pruned) });
+								return refresh();
+							}).catch(setError).finally(() => setPruneBusy(false));
+						},
+						children: pruneBusy ? t("pruneInactiveBusy") : t("pruneInactiveAction", { days: String(pruneDays) })
+					})]
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-list",
+					children: (status?.devices ?? []).map((device) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(DeviceRow, { device }, device.id))
+				})]
+			});
+		}
+		/**
+		* 一台设备的行：名字 + 身份摘要 + 可展开的权限编辑区。
+		*
+		* 共享的东西（api / roots / refresh / notify / setError）从 `useCards()` 取，而不是
+		* 一层层往下传 —— 这张行的调用点只有一处，多传六个 prop 只是把巨型 props 表挪个地方。
+		*/
+		function DeviceRow(props) {
+			const { api, roots, refresh, notify, setError } = useCards();
+			const { locale, t } = useWorkspaceI18n();
+			const [editing, setEditing] = (0, react.useState)(false);
+			const [scopes, setScopes] = (0, react.useState)(props.device.scopes);
+			const [rootIds, setRootIds] = (0, react.useState)(props.device.rootIds);
+			const [name, setName] = (0, react.useState)(props.device.name);
+			const toggle = (list, value) => list.includes(value) ? list.filter((item) => item !== value) : [...list, value];
+			const shortId = props.device.id.length > 14 ? `${props.device.id.slice(0, 8)}…${props.device.id.slice(-4)}` : props.device.id;
+			const lastSeen = props.device.lastSeenAt === void 0 ? t("deviceNeverSeen") : t("deviceLastSeen", { time: new Date(props.device.lastSeenAt).toLocaleString(locale) });
+			const autoNamed = props.device.nameSource === "default" || props.device.nameSource === "detected";
+			const saveAll = () => {
+				const trimmed = name.trim();
+				const rename = trimmed !== "" && trimmed !== props.device.name;
+				(rename ? api.renameDevice(props.device.id, trimmed) : Promise.resolve()).then(() => api.updateDevice(props.device.id, scopes, rootIds)).then(() => refresh()).then(() => {
+					setEditing(false);
+					notify(rename ? "deviceNameSaved" : "permissionsSaved");
+				}).catch(setError);
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				className: "daw-list-row",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-list-title",
+						children: [
+							props.device.name,
+							props.device.revokedAt !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-pill",
+								children: t("revoked")
 							}),
-							configText !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ConfigTextPanel, { result: configText })
+							autoNamed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-pill",
+								title: t("deviceRenameHint"),
+								children: t("deviceDetectedName")
+							})
 						]
-					}, "remote"),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-						tab: "devices",
-						nameKey: tabLabelKey("devices"),
-						descKey: tabDescKey("devices"),
-						open: isOpen("devices"),
-						onToggle: () => toggleCard("devices"),
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							className: "daw-inline-command",
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "daw-field",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("pruneInactiveDays") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									className: "daw-input",
-									type: "number",
-									min: 1,
-									max: 3650,
-									value: pruneDays,
-									disabled: managementLocked || pruneBusy,
-									onChange: (event) => setPruneDays(Math.max(1, Math.min(3650, Number(event.target.value) || 1)))
-								})]
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								className: "daw-command",
-								disabled: managementLocked || pruneBusy,
-								onClick: () => {
-									if (!confirm(t("pruneInactiveConfirm", { days: String(pruneDays) }))) return;
-									setPruneBusy(true);
-									setError(void 0);
-									props.api.pruneInactiveDevices(pruneDays).then((result) => {
-										if (result.pruned === 0) notify("pruneInactiveNone");
-										else notify("pruneInactiveDone", { count: String(result.pruned) });
-										return refresh();
-									}).catch(setError).finally(() => setPruneBusy(false));
-								},
-								children: pruneBusy ? t("pruneInactiveBusy") : t("pruneInactiveAction", { days: String(pruneDays) })
-							})]
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list",
-							children: (status?.devices ?? []).map((device) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(DeviceRow, {
-								api: props.api,
-								device,
-								roots,
-								onChanged: refresh,
-								onError: setError,
-								onNotice: notify
-							}, device.id))
-						})]
-					}, "devices"),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-						tab: "image",
-						nameKey: tabLabelKey("image"),
-						descKey: tabDescKey("image"),
-						open: isOpen("image"),
-						onToggle: () => toggleCard("image"),
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-list-meta",
 						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-								className: "daw-list-meta",
-								children: t("imageHint")
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "daw-field",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageSubdir") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									className: "daw-input",
-									value: imageDraft,
-									spellCheck: false,
-									disabled: imageBusy || image === void 0,
-									onChange: (event) => {
-										setImageDraft(event.target.value);
-										setImageSaved(false);
-									}
-								})]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								style: { marginTop: 5 },
-								children: t("imageSubdirHint")
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "daw-field",
-								style: { marginTop: 14 },
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageDefault") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									className: "daw-input",
-									value: image?.defaultSubdir ?? "",
-									readOnly: true,
-									disabled: true
-								})]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								style: { marginTop: 5 },
-								children: t("imageDefaultHint")
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "daw-field",
-								style: { marginTop: 14 },
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageFallback") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									className: "daw-input",
-									value: image?.fallbackDir ?? "",
-									readOnly: true,
-									disabled: true
-								})]
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								style: { marginTop: 5 },
-								children: t("imageFallbackHint")
-							}),
-							image !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-meta",
-								style: { marginTop: 12 },
-								children: t("imageExample", { subdir: image.subdir })
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								title: props.device.id,
+								children: shortId
 							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-form-row",
-								style: {
-									marginTop: 12,
-									gridTemplateColumns: "auto auto minmax(0,1fr)",
-									alignItems: "center"
-								},
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-command primary",
-									disabled: imageBusy || image === void 0 || imageDraft.trim() === "" || imageDraft.trim() === image.subdir,
-									onClick: () => {
-										setImageBusy(true);
-										setError(void 0);
-										props.api.saveImageSubdir(imageDraft.trim()).then((next) => {
-											setImage(next);
-											setImageDraft(next.subdir);
-											setImageSaved(true);
-										}).catch(setError).finally(() => setImageBusy(false));
-									},
-									children: t("save")
-								}), imageSaved && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-									className: "daw-pill on",
-									children: t("imageSaved")
-								})]
-							})
+							props.device.platform !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+								" · ",
+								props.device.platform,
+								props.device.model === void 0 ? "" : ` · ${props.device.model}`
+							] }),
+							" · ",
+							lastSeen,
+							" · ",
+							props.device.scopes.length === 0 ? t("noScopes") : props.device.scopes.map((scope) => scopeLabel(locale, scope)).join(" · ")
 						]
-					}, "image"),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-						tab: "trash",
-						nameKey: tabLabelKey("trash"),
-						descKey: tabDescKey("trash"),
-						open: isOpen("trash"),
-						onToggle: () => toggleCard("trash"),
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: "daw-list-meta",
-							children: t("pluginTrashHint")
-						}), trash.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list-meta daw-empty",
-							children: t("trashEmpty")
-						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list",
-							children: trash.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-list-row",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-									className: "daw-list-title",
-									children: item.path
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									className: "daw-list-meta",
-									children: [
-										item.kind,
-										" · ",
-										formatBytes(item.size),
-										" · ",
-										new Date(item.createdAt).toLocaleString(locale)
-									]
-								})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-command",
-									onClick: () => {
-										setError(void 0);
-										props.api.restoreTrash(item.id).then(() => {
-											notify("trashRestored");
-											return refresh();
-										}).catch(setError);
-									},
-									children: t("restore")
-								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									className: "daw-icon danger",
-									title: t("deletePermanently"),
-									"aria-label": t("deletePermanently"),
-									onClick: () => {
-										if (confirm(t("purgeConfirm"))) props.api.purgeTrash(item.id).then(() => {
-											notify("trashPurged");
-											return refresh();
-										}).catch(setError);
-									},
-									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
-								})] })]
-							}, item.id))
-						})]
-					}, "trash"),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(PluginsSection, {
-						api: props.api,
-						open: isOpen("plugins"),
-						onToggle: () => toggleCard("plugins"),
-						onOpenPluginList: props.onOpenPluginList
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AppDownloadSection, {
-						open: isOpen("app-download"),
-						onToggle: () => toggleCard("app-download")
+					editing && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: "daw-field",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("deviceRename") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "daw-input",
+								value: name,
+								placeholder: t("deviceRenamePlaceholder"),
+								title: t("deviceRenameHint"),
+								onChange: (event) => setName(event.target.value),
+								onKeyDown: (event) => {
+									if (event.key === "Enter") saveAll();
+								}
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-scope-grid",
+							children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "daw-check",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									type: "checkbox",
+									checked: scopes.includes(scope),
+									onChange: () => setScopes((current) => toggle(current, scope))
+								}), scopeLabel(locale, scope)]
+							}, scope))
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-scope-grid",
+							children: roots.map((root) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "daw-check",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									type: "checkbox",
+									checked: rootIds.includes(root.id),
+									onChange: () => setRootIds((current) => toggle(current, root.id))
+								}), root.label]
+							}, root.id))
+						})
+					] })
+				] }), props.device.revokedAt === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
+					editing && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command primary",
+						onClick: saveAll,
+						children: t("save")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command",
+						onClick: () => {
+							setName(props.device.name);
+							setEditing((value) => !value);
+						},
+						children: editing ? t("cancel") : t("permissions")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-icon danger",
+						title: t("revokeDevice"),
+						"aria-label": t("revokeDevice"),
+						onClick: () => {
+							if (!window.confirm(t("revokeConfirm", { name: props.device.name }))) return;
+							api.revokeDevice(props.device.id).then(() => refresh()).then(() => notify("deviceRevoked")).catch(setError);
+						},
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
 					})
-				]
+				] })]
 			});
 		}
+		//#endregion
+		//#region src/client/cards/image.tsx
 		/**
-		* 插件卡片：这台机器 profile 里装了哪些插件、能不能停用、有没有更新。
+		* 「识图」卡：设置图片交给识图工具的落盘目录名。
+		*
+		* 上半截可改（当前值，存数据库、改完立即生效，不必重启）；下半截「当前默认」**只读**
+		* —— 那是出厂字面量 `.dsh-images`，历史交接消息和下游工具都按它写过路径，它不是一个
+		* 跟着用户改的偏好项。兜底目录同样只读：它是解析不出会话工作目录时的落点。
 		*
-		* ## 为什么加这张卡
+		* ## 数据是懒加载的，判据是 `open` 而不是「组开没开」
 		*
-		* 用户的反馈是「功能单调点，无法查看装的插件情况」—— 想知道装了哪些插件、有没有出问题的，
-		* 必须回到电脑前的 WebUI。宿主的 `GET /settings/plugins` 与 `PATCH /settings/plugins` 早就有，
-		* 只是浏览器半边从来没有消费它们；这张卡补的就是那半截。
+		* 原实现把 `imageSettings()` 放在 `AdminPanel.refresh()` 里，条件是 `openCards.has('image')`。
+		* 拆出来之后这条判据变成这张卡自己的 `open` prop —— **语义完全等价**：`open` 就是
+		* `isOpen('image')` 的返回值，同一个 Set、同一个值。请求仍然只在真正展开这一节时才发，
+		* 不会因为设置页一进来就打一个没人看的往返。
+		*
+		* 反过来，如果把这层懒加载丢掉、改成挂载即拉，那就是行为变更：整整多一个请求。
+		*/
+		function ImageCard(props) {
+			const { api, t, setError } = useCards();
+			const [image, setImage] = (0, react.useState)();
+			const [draft, setDraft] = (0, react.useState)("");
+			const [busy, setBusy] = (0, react.useState)(false);
+			const [saved, setSaved] = (0, react.useState)(false);
+			(0, react.useEffect)(() => {
+				if (!props.open) return;
+				let cancelled = false;
+				api.imageSettings().then((settings) => {
+					if (cancelled) return;
+					setImage(settings);
+					setDraft(settings.subdir);
+					setSaved(false);
+				}).catch((cause) => {
+					if (!cancelled) setError(cause);
+				});
+				return () => {
+					cancelled = true;
+				};
+			}, [
+				props.open,
+				api,
+				setError
+			]);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "image",
+				nameKey: tabLabelKey("image"),
+				descKey: tabDescKey("image"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "daw-list-meta",
+						children: t("imageHint")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "daw-field",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageSubdir") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							className: "daw-input",
+							value: draft,
+							spellCheck: false,
+							disabled: busy || image === void 0,
+							onChange: (event) => {
+								setDraft(event.target.value);
+								setSaved(false);
+							}
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginTop: 5 },
+						children: t("imageSubdirHint")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "daw-field",
+						style: { marginTop: 14 },
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageDefault") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							className: "daw-input",
+							value: image?.defaultSubdir ?? "",
+							readOnly: true,
+							disabled: true
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginTop: 5 },
+						children: t("imageDefaultHint")
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+						className: "daw-field",
+						style: { marginTop: 14 },
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("imageFallback") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+							className: "daw-input",
+							value: image?.fallbackDir ?? "",
+							readOnly: true,
+							disabled: true
+						})]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginTop: 5 },
+						children: t("imageFallbackHint")
+					}),
+					image !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginTop: 12 },
+						children: t("imageExample", { subdir: image.subdir })
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-form-row",
+						style: {
+							marginTop: 12,
+							gridTemplateColumns: "auto auto minmax(0,1fr)",
+							alignItems: "center"
+						},
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command primary",
+							disabled: busy || image === void 0 || draft.trim() === "" || draft.trim() === image.subdir,
+							onClick: () => {
+								setBusy(true);
+								setError(void 0);
+								api.saveImageSubdir(draft.trim()).then((next) => {
+									setImage(next);
+									setDraft(next.subdir);
+									setSaved(true);
+								}).catch(setError).finally(() => setBusy(false));
+							},
+							children: t("save")
+						}), saved && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "daw-pill on",
+							children: t("imageSaved")
+						})]
+					})
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/cards/plugins.tsx
+		/**
+		* 「插件」卡：这台机器 profile 里装了哪些插件、能不能停用、有没有更新。
 		*
-		* ## 三个必须说清楚的地方
+		* ## 为什么它收在「高级设置」组里
 		*
-		* 1. **官方包不能停**（`toggleable === false`）。它们随 DSH 运行时安装、不由 profile 管理，
-		*    改 bundles 也加载不出来。服务端会拒绝并回 `PLUGIN_OFFICIAL_IMMUTABLE`，这里干脆不给按钮。
-		* 2. **`runtime-provided` 不是故障**。官方包出现在 `dsh.profile.bundles` 里但不在 profile 的
-		*    node_modules 下，早期实现把它误判成「声明加载但缺失」，真机上一次冒出 5 条假警报。
-		* 3. **改完要重启**。bundles 只在启动时读一次，所以成功提示不是「已停用」而是
-		*    「已写进 package.json，重启后生效」—— 否则用户会以为点了没反应，再点几次。
+		* DSH 内核自己有插件页（侧栏「插件」），这张卡与它是**同一条车道**：看清单、启停、检查更新。
+		* 桥不跑内核、也不该重做内核的 UI，所以把它从主列表收进高级组 —— 功能照留（手机端与
+		* 桌面端都能从这里改），但不再占日常视线。
 		*
-		* ## 更新检查为什么是按钮而不是自动
+		* ## 为什么还要留这一张
 		*
-		* 它要打 npm registry，十次里九次用户只想看「装了啥」。默认不查，`updateAvailable` 因此是
-		* 三态（`null` = 没查），而不是压成 `false` 去谎称「已是最新」。
+		* 手机 App 那边没有内核的插件页可点，`pluginInventory` 是它唯一能看到「这台机器装了什么」的
+		* 通道。删掉这张卡等于把这个能力从移动端拿走，所以是隐藏而不是删除。
 		*/
-		function PluginsSection(props) {
+		function PluginsCard(props) {
 			const { t } = useWorkspaceI18n();
+			const { api } = useCards();
 			const [inventory, setInventory] = (0, react.useState)(void 0);
 			const [busy, setBusy] = (0, react.useState)(false);
 			const [checking, setChecking] = (0, react.useState)(false);
@@ -32017,14 +32080,14 @@ window.__ModuleLoader__.load({
 				else setBusy(true);
 				setError(void 0);
 				try {
-					setInventory(await props.api.pluginInventory(checkUpdates));
+					setInventory(await api.pluginInventory(checkUpdates));
 				} catch (cause) {
 					setError(messageOf(cause, t));
 				} finally {
 					if (checkUpdates) setChecking(false);
 					else setBusy(false);
 				}
-			}, [props.api, t]);
+			}, [api, t]);
 			(0, react.useEffect)(() => {
 				if (!props.open || inventory !== void 0) return;
 				load(false);
@@ -32037,15 +32100,15 @@ window.__ModuleLoader__.load({
 				setToggling(entry.name);
 				setError(void 0);
 				try {
-					await props.api.togglePlugin(entry.name, !entry.loaded);
-					setInventory(await props.api.pluginInventory(false));
+					await api.togglePlugin(entry.name, !entry.loaded);
+					setInventory(await api.pluginInventory(false));
 					setRestartRequired(true);
 				} catch (cause) {
 					setError(messageOf(cause, t));
 				} finally {
 					setToggling(void 0);
 				}
-			}, [props.api, t]);
+			}, [api, t]);
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
 				tab: "plugins",
 				nameKey: tabLabelKey("plugins"),
@@ -32157,667 +32220,981 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
-		/** 四种 `PluginState` 各自的中文/英文说法 —— 状态本身是产品语义，不该在界面上露出裸码。 */
-		function pluginStateKey(state) {
-			if (state === "loaded") return "pluginsStateLoaded";
-			if (state === "runtime-provided") return "pluginsStateRuntimeProvided";
-			if (state === "installed-not-loaded") return "pluginsStateInstalledNotLoaded";
-			return "pluginsStateDeclaredMissing";
-		}
-		/**
-		* The App download page: one QR card per release host.
-		*
-		* The codes come from `APP_QR_CODES` as inlined SVG data URLs, so this page makes **no network
-		* request** and adds no runtime dependency — the bytes are in the bundle. Both point at a Releases
-		* *listing* page rather than a fixed file, so publishing a new APK needs no change here.
-		*
-		* The address is rendered as a real link next to the image on purpose: a phone cannot scan its own
-		* screen, so this page is mostly used by the desktop admin to send a code to someone else. Without
-		* the text there would be no way to type the address in by hand when a camera is unavailable.
-		*/
-		function AppDownloadSection(props) {
-			const { t } = useWorkspaceI18n();
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
-				tab: "app-download",
-				nameKey: tabLabelKey("app-download"),
-				descKey: tabDescKey("app-download"),
-				open: props.open,
-				onToggle: props.onToggle,
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-					className: "daw-list-meta",
-					children: t("appDownloadHint")
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-					className: "daw-qr-grid",
-					children: APP_QR_CODES.map((code) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("figure", {
-						className: "daw-qr-card",
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("img", {
-								className: "daw-qr-image",
-								src: code.dataUrl,
-								alt: t("appDownloadQrAlt", { site: code.label }),
-								width: 180,
-								height: 180
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("figcaption", {
-								className: "daw-qr-site",
-								children: code.label
-							}),
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
-								className: "daw-qr-url",
-								href: code.url,
-								target: "_blank",
-								rel: "noreferrer",
-								children: code.url
-							})
-						]
-					}, code.key))
-				})]
-			});
-		}
+		//#endregion
+		//#region src/client/cards/remote.tsx
 		/**
-		* Shows a freshly minted `DSH1:` config text.
+		* 「远程访问」卡：在本机开一个口子 —— 绑定 IP/端口、开关远程访问、生成配对码与令牌配置。
 		*
-		* The text is a credential carrier, so this panel keeps the "it is a key" reminder visible and lists
-		* the addresses the host actually detected, letting the user confirm them before sending the text away.
-		* Copying degrades to "the text is selected, copy it yourself" when the Clipboard API is unavailable —
-		* the normal case when this WebUI is opened over plain HTTP on a LAN address.
+		* ## 这张卡为什么还是最长的一张
+		*
+		* 它把三件相邻但不同的事收在一处：**监听器**（绑哪个地址）、**配对码**（把手机接进来）、
+		* **权限勾选**（接进来之后能干什么）。三者是同一条流程的三步（勾权限 → 生成访问码 →
+		* App 输入码 → 权限随设备落库），拆开会让人在两张卡之间来回跳，所以留在一起。
+		*
+		* 「外网隧道」已经从这张卡里独立出去了（见 `tunnel.tsx`）—— 那不是同一条流程，
+		* 是另一条通道。当年挤在一张卡里，用户会以为隧道是远程访问的一个开关。
+		*
+		* ## 哪些东西不在这里
+		*
+		* `refresh()` 与隧道状态的拉取**不搬**：隧道状态必须**先于、独立于** `/manage/status`
+		* 拉取（隧道运行期 status 会 403 中断整个 try），那属于 `AdminPanel`。
+		* 本卡只消费它的结果（`tunnel` / `managementLocked` 等经 `context.ts` 下发）。
+		*
+		* ## 权限勾选的默认值为什么是「五个非破坏性权限」
+		*
+		* 见下方 `grantedScopes` 的初始化处 —— 这是 SEC-H11 的修复点，默认值偏松不是小事。
 		*/
-		function ConfigTextPanel(props) {
-			const { t } = useWorkspaceI18n();
-			const [copyState, setCopyState] = (0, react.useState)();
-			const textRef = (0, react.useRef)(null);
-			const copy = (0, react.useCallback)(async () => {
-				const clipboard = globalThis.navigator?.clipboard;
-				if (clipboard !== void 0) try {
-					await clipboard.writeText(props.result.text);
-					setCopyState("done");
-					return;
-				} catch {}
-				const node = textRef.current;
-				if (node !== null) {
-					node.focus();
-					node.select();
+		function RemoteCard(props) {
+			const { t, locale } = useWorkspaceI18n();
+			const { api, status, roots, managementLocked, refresh, notify, copyText, setError, setStatus, tunnel, tunnelBusy, configText, configTextBusy, setConfigText, setConfigTextBusy, configEndpoint, setConfigEndpoint, tunnelConfigClick } = useCards();
+			const [listenerHost, setListenerHost] = (0, react.useState)("0.0.0.0");
+			const [listenerPort, setListenerPort] = (0, react.useState)("3090");
+			const [pairing, setPairing] = (0, react.useState)();
+			const [now, setNow] = (0, react.useState)(() => Date.now());
+			(0, react.useEffect)(() => {
+				const timer = window.setInterval(() => setNow(Date.now()), 3e4);
+				return () => window.clearInterval(timer);
+			}, []);
+			(0, react.useEffect)(() => {
+				if (status === void 0) return;
+				setListenerHost(status.configuredHost);
+				setListenerPort(String(status.configuredPort));
+			}, [status?.configuredHost, status?.configuredPort]);
+			const [grantedScopes, setGrantedScopes] = (0, react.useState)([...DEFAULT_DEVICE_SCOPES]);
+			const toggleScope = (0, react.useCallback)((scope) => {
+				setGrantedScopes((current) => current.includes(scope) ? current.filter((item) => item !== scope) : [...current, scope]);
+			}, []);
+			const grantNotice = grantedScopes.length === 0 ? t("scopeGrantNoticeEmpty") : (status?.devices?.length ?? 0) === 0 ? t("scopeGrantNotice") : t("scopeGrantNoticeExisting");
+			const parsedListenerPort = Number(listenerPort);
+			const listenerPortValid = Number.isInteger(parsedListenerPort) && parsedListenerPort >= 1 && parsedListenerPort <= 65535;
+			const listenerDirty = status !== void 0 && (listenerHost.trim() !== status.configuredHost || parsedListenerPort !== status.configuredPort);
+			const poll = async (id) => {
+				for (let attempt = 0; attempt < 30; attempt += 1) {
+					await delay(300);
+					const next = await api.operation(id);
+					setStatus(next);
+					const operation = next.operation;
+					if (operation?.state === "succeeded") {
+						if (operation.pairingCode !== void 0) setPairing({
+							code: operation.pairingCode,
+							...operation.pairingExpiresAt === void 0 ? {} : { expiresAt: operation.pairingExpiresAt }
+						});
+						return;
+					}
+					if (operation?.state === "failed") throw new Error(listenerOperationError(operation.code, operation.message, t));
 				}
-				setCopyState("manual");
-			}, [props.result.text]);
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				style: { marginTop: 14 },
+				throw new Error(t("listenerTimedOut"));
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "remote",
+				nameKey: tabLabelKey("remote"),
+				descKey: tabDescKey("remote"),
+				open: props.open,
+				onToggle: props.onToggle,
 				children: [
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 						className: "daw-warning",
-						children: t("configTextSecurity")
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-list-meta",
-						children: t("configTextHint")
+						children: t("httpWarning")
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("textarea", {
-						ref: textRef,
-						className: "daw-input",
-						style: {
-							width: "100%",
-							height: "auto",
-							minHeight: 76,
-							marginTop: 8,
-							padding: "8px 9px",
-							fontFamily: "ui-monospace,SFMono-Regular,Consolas,monospace",
-							fontSize: 12,
-							lineHeight: 1.5,
-							resize: "vertical"
-						},
-						readOnly: true,
-						rows: 4,
-						spellCheck: false,
-						value: props.result.text,
-						onFocus: (event) => event.currentTarget.select()
+					roots.length === 0 && !managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-warning",
+						children: t("addRootBeforeRemote")
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "daw-form-row",
-						style: {
-							marginTop: 8,
-							marginBottom: 10,
-							gridTemplateColumns: "auto auto minmax(0,1fr)",
-							alignItems: "center"
-						},
+						className: "daw-listener-form",
 						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "daw-field",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("bindIp") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "daw-input",
+									value: listenerHost,
+									disabled: status?.remoteEnabled || managementLocked,
+									spellCheck: false,
+									placeholder: "0.0.0.0",
+									onChange: (event) => setListenerHost(event.target.value)
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "daw-field",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("bindPort") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									className: "daw-input",
+									type: "number",
+									min: 1,
+									max: 65535,
+									inputMode: "numeric",
+									value: listenerPort,
+									disabled: status?.remoteEnabled || managementLocked,
+									onChange: (event) => setListenerPort(event.target.value)
+								})]
+							}),
 							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								className: "daw-command primary",
+								className: "daw-command",
+								disabled: managementLocked || status?.remoteEnabled || listenerHost.trim() === "" || !listenerPortValid || !listenerDirty,
 								onClick: () => {
-									copy();
+									setError(void 0);
+									api.configureListener(listenerHost.trim(), parsedListenerPort).then((result) => poll(result.id)).then(() => {
+										notify("listenerSaved");
+										return refresh();
+									}).catch(setError);
 								},
-								children: t("copy")
-							}),
-							copyState === "done" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-pill on",
-								children: t("copied")
-							}),
-							copyState === "manual" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-list-meta",
-								children: t("copyManual")
+								children: t("saveListener")
 							})
 						]
 					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "daw-list-meta",
-						style: { marginBottom: 2 },
-						children: [
-							t("configTextDevice"),
-							": ",
-							props.result.deviceName,
-							" · ",
-							t("configTextDeviceId"),
-							": ",
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								style: { fontFamily: "ui-monospace,SFMono-Regular,Consolas,monospace" },
-								children: props.result.deviceId
-							})
-						]
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-list-meta",
-						style: { marginBottom: 10 },
-						children: t("configTextScopes")
+						className: "daw-listener-status",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("strong", { children: [t("configuredListener"), ":"] }),
+							" ",
+							formatEndpoint(status?.configuredHost ?? listenerHost, status?.configuredPort ?? parsedListenerPort)
+						] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("strong", { children: [t("actualListener"), ":"] }),
+							" ",
+							formatEndpoint(status?.host ?? "127.0.0.1", status?.port ?? parsedListenerPort)
+						] })]
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("configTextDetected") }),
-					props.result.endpoints.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-warning",
-						style: { marginTop: 8 },
-						children: t("configTextNoEndpoints")
-					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						className: "daw-list",
-						children: props.result.endpoints.map((endpoint) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list-row",
-							children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-								className: "daw-list-title",
-								children: endpoint.label
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-list-meta",
-								children: [endpoint.baseUrl, endpoint.kind === void 0 ? "" : ` · ${endpoint.kind}`]
-							})] })
-						}, `${endpoint.label}:${endpoint.baseUrl}`))
-					})
-				]
-			});
-		}
-		function DeviceRow(props) {
-			const { locale, t } = useWorkspaceI18n();
-			const [editing, setEditing] = (0, react.useState)(false);
-			const [scopes, setScopes] = (0, react.useState)(props.device.scopes);
-			const [rootIds, setRootIds] = (0, react.useState)(props.device.rootIds);
-			const [name, setName] = (0, react.useState)(props.device.name);
-			const toggle = (list, value) => list.includes(value) ? list.filter((item) => item !== value) : [...list, value];
-			const shortId = props.device.id.length > 14 ? `${props.device.id.slice(0, 8)}…${props.device.id.slice(-4)}` : props.device.id;
-			const lastSeen = props.device.lastSeenAt === void 0 ? t("deviceNeverSeen") : t("deviceLastSeen", { time: new Date(props.device.lastSeenAt).toLocaleString(locale) });
-			const autoNamed = props.device.nameSource === "default" || props.device.nameSource === "detected";
-			const saveAll = () => {
-				const trimmed = name.trim();
-				const rename = trimmed !== "" && trimmed !== props.device.name;
-				(rename ? props.api.renameDevice(props.device.id, trimmed) : Promise.resolve()).then(() => props.api.updateDevice(props.device.id, scopes, rootIds)).then(props.onChanged).then(() => {
-					setEditing(false);
-					props.onNotice(rename ? "deviceNameSaved" : "permissionsSaved");
-				}).catch(props.onError);
-			};
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "daw-list-row",
-				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "daw-list-title",
-						children: [
-							props.device.name,
-							props.device.revokedAt !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-pill",
-								children: t("revoked")
-							}),
-							autoNamed && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "daw-pill",
-								title: t("deviceRenameHint"),
-								children: t("deviceDetectedName")
-							})
-						]
+					status?.remoteEnabled && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta daw-listener-hint",
+						children: t("disableToEditListener")
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						className: "daw-list-meta",
-						children: [
-							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								title: props.device.id,
-								children: shortId
-							}),
-							props.device.platform !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
-								" · ",
-								props.device.platform,
-								props.device.model === void 0 ? "" : ` · ${props.device.model}`
-							] }),
-							" · ",
-							lastSeen,
-							" · ",
-							props.device.scopes.length === 0 ? t("noScopes") : props.device.scopes.map((scope) => scopeLabel(locale, scope)).join(" · ")
-						]
+					!status?.remoteEnabled && listenerDirty && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta daw-listener-hint",
+						children: t("saveBeforeEnable")
 					}),
-					editing && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-							className: "daw-field",
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("deviceRename") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-								className: "daw-input",
-								value: name,
-								placeholder: t("deviceRenamePlaceholder"),
-								title: t("deviceRenameHint"),
-								onChange: (event) => setName(event.target.value),
-								onKeyDown: (event) => {
-									if (event.key === "Enter") saveAll();
-								}
-							})]
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						className: `daw-pill${status?.remoteEnabled ? " on" : ""}`,
+						children: status?.remoteEnabled ? t("remoteEnabled") : t("loopbackOnly")
+					}) }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("fieldset", {
+						disabled: managementLocked,
+						style: {
+							border: "none",
+							margin: 0,
+							padding: 0
+						},
+						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "daw-scope-grid",
 							children: DEVICE_SCOPES.map((scope) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
 								className: "daw-check",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									type: "checkbox",
-									checked: scopes.includes(scope),
-									onChange: () => setScopes((current) => toggle(current, scope))
-								}), scopeLabel(locale, scope)]
-							}, scope))
-						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-scope-grid",
-							children: props.roots.map((root) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-								className: "daw-check",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-									type: "checkbox",
-									checked: rootIds.includes(root.id),
-									onChange: () => setRootIds((current) => toggle(current, root.id))
-								}), root.label]
-							}, root.id))
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+										type: "checkbox",
+										checked: grantedScopes.includes(scope),
+										onChange: () => toggleScope(scope)
+									}),
+									" ",
+									scopeLabel(locale, scope)
+								]
+							}, scope))
 						})
-					] })
-				] }), props.device.revokedAt === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
-					editing && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						className: "daw-command primary",
-						onClick: saveAll,
-						children: t("save")
 					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						className: "daw-command",
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						children: grantNotice
+					}),
+					status?.remoteEnabled ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command danger",
+						disabled: managementLocked,
+						title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
 						onClick: () => {
-							setName(props.device.name);
-							setEditing((value) => !value);
+							if (!window.confirm(t("disableRemoteConfirm"))) return;
+							setError(void 0);
+							api.disableRemote().then((result) => poll(result.id)).then(() => {
+								notify("remoteDisabled");
+								return refresh();
+							}).catch(setError);
 						},
-						children: editing ? t("cancel") : t("permissions")
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						className: "daw-icon danger",
-						title: t("revokeDevice"),
-						"aria-label": t("revokeDevice"),
+						children: t("disableRemote")
+					}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command primary",
+						disabled: managementLocked || roots.length === 0 || listenerDirty || !listenerPortValid || listenerHost.trim() === "" || grantedScopes.length === 0,
 						onClick: () => {
-							if (!window.confirm(t("revokeConfirm", { name: props.device.name }))) return;
-							props.api.revokeDevice(props.device.id).then(props.onChanged).then(() => props.onNotice("deviceRevoked")).catch(props.onError);
+							setError(void 0);
+							api.enableRemote(roots.map((root) => root.id), grantedScopes).then((result) => poll(result.id)).catch(setError);
 						},
-						children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
-					})
-				] })]
+						children: t("enablePairing")
+					}),
+					(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command daw-inline-command",
+							disabled: managementLocked || grantedScopes.length === 0,
+							title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
+							onClick: () => {
+								setError(void 0);
+								api.createPairing(roots.map((root) => root.id), grantedScopes).then((value) => {
+									setPairing(value);
+									notify("pairingCreated");
+								}).catch(setError);
+							},
+							children: t("newPairingCode")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command daw-inline-command",
+							disabled: managementLocked || configTextBusy,
+							title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
+							onClick: () => {
+								const manual = configEndpoint.trim();
+								setConfigTextBusy(true);
+								setError(void 0);
+								api.createConfigText({
+									...roots.length === 0 ? {} : { rootIds: roots.map((root) => root.id) },
+									...manual === "" ? {} : { endpoints: [{
+										label: t("configTextManualLabel"),
+										baseUrl: manual
+									}] }
+								}).then((value) => {
+									setConfigText(value);
+									notify("configCreated");
+								}).catch(setError).finally(() => setConfigTextBusy(false));
+							},
+							children: t("newConfigText")
+						}),
+						tunnel !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command daw-inline-command",
+							disabled: configTextBusy || tunnelBusy,
+							onClick: () => {
+								tunnelConfigClick();
+							},
+							children: tunnel.running !== true ? t("tunnelStartAndGenConfig") : t("tunnelRestartAndGenConfig")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta daw-listener-hint",
+							children: t("configTextScopeNote")
+						})
+					] }),
+					pairing !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-code-row",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-code",
+							children: pairing.code
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+							className: "daw-copy-inline",
+							text: pairing.code,
+							title: t("copyPairing"),
+							copiedText: t("copied"),
+							manualText: t("copyManual"),
+							copyText
+						})]
+					}), pairing.expiresAt !== void 0 && pairing.expiresAt > now && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta",
+						style: { marginTop: -4 },
+						children: t("pairingExpiresAt", { minutes: pairingMinutesLeft(pairing.expiresAt, now) })
+					})] }),
+					(status?.remoteEnabled === true || managementLocked) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						style: {
+							marginTop: 12,
+							maxWidth: 560
+						},
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+							className: "daw-field",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: t("configTextManual") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "daw-input",
+								value: configEndpoint,
+								disabled: managementLocked,
+								spellCheck: false,
+								placeholder: t("configTextManualPlaceholder"),
+								onChange: (event) => setConfigEndpoint(event.target.value)
+							})]
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-meta",
+							style: { marginTop: 5 },
+							children: t("configTextManualHint")
+						})]
+					}),
+					configText !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ConfigTextPanel, { result: configText })
+				]
 			});
 		}
-		function tabIcon(tab) {
-			if (tab === "roots") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.HardDrive, { size: 15 });
-			if (tab === "devices") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Smartphone, { size: 15 });
-			if (tab === "image") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Image, { size: 15 });
-			if (tab === "trash") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 });
-			if (tab === "plugins") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Package, { size: 15 });
-			if (tab === "remote") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Upload, { size: 15 });
-			if (tab === "app-download") return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Download, { size: 15 });
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.File, { size: 15 });
-		}
-		function messageOf(cause, t) {
-			if (cause instanceof WorkspaceApiError) {
-				const translated = apiErrorKey(cause);
-				if (translated !== void 0) return t(translated);
-			}
-			return cause instanceof Error ? cause.message : String(cause);
-		}
-		function listenerOperationError(code, fallback, t) {
-			if (code === "LISTENER_ADDRESS_IN_USE") return t("listenerAddressInUse");
-			if (code === "LISTENER_ADDRESS_UNAVAILABLE") return t("listenerAddressUnavailable");
-			if (code === "LISTENER_PERMISSION_DENIED") return t("listenerPermissionDenied");
-			return fallback ?? t("listenerFailed");
-		}
-		function formatEndpoint(host, port) {
-			return `${host.includes(":") ? `[${host}]` : host}:${Number.isFinite(port) ? port : ""}`;
-		}
-		function apiErrorKey(error) {
-			if (error.status === 401) return "errorUnauthorized";
-			if (error.status === 429) return "errorRateLimited";
-			if (error.code === "ROOT_NOT_GRANTED" || error.code === "ROOT_FORBIDDEN") return "errorRootDenied";
-			if (error.code === "ROOT_BUILTIN") return "errorRootBuiltin";
-			if (error.code === "ETAG_MISMATCH") return "errorEtag";
-			if (error.code === "LISTENER_HOST_INVALID") return "listenerHostInvalid";
-			if (error.code === "LISTENER_PORT_INVALID") return "listenerPortInvalid";
-			if (error.code === "REMOTE_ENABLED") return "disableToEditListener";
-			if (error.code === "NO_ENDPOINT") return "configTextNoEndpoints";
-			if (error.code === "TUNNEL_MODE_ADMIN_DISABLED") return "errorTunnelModeAdminDisabled";
-			if (error.code === "ADMIN_PROXY_FORWARDED") return "errorAdminProxyForwarded";
-			if (error.code === "ADMIN_HOST_NOT_LOOPBACK") return "errorAdminHostNotLoopback";
-			if (error.code === "ADMIN_LOOPBACK_REQUIRED") return "errorAdminLoopbackRequired";
-			if (error.code === "PLUGIN_OFFICIAL_IMMUTABLE") return "pluginsErrorOfficial";
-			if (error.code === "PLUGIN_NAME_INVALID") return "pluginsErrorNameInvalid";
-			if (error.code === "PROFILE_UNKNOWN") return "pluginsErrorProfileUnknown";
-			if (error.code === "MANIFEST_UNREADABLE") return "pluginsErrorManifestUnreadable";
-			if (error.code === "PLUGIN_NOT_INSTALLED") return "pluginsErrorNotInstalled";
-			if (error.code.includes("PATH") || error.code.includes("SYMLINK") || error.code.includes("REPARSE")) return "errorPathInvalid";
-			if (error.status === 403) return "errorForbidden";
-			if (error.status === 404) return "errorNotFound";
-			if (error.status === 409) return "errorConflict";
-		}
-		function formatBytes(value) {
-			if (value < 1024) return `${value} B`;
-			if (value < 1048576) return `${(value / 1024).toFixed(1)} KB`;
-			return `${(value / 1024 / 1024).toFixed(1)} MB`;
+		//#endregion
+		//#region src/client/cards/roots.tsx
+		/**
+		* 「根目录」卡：授权手机访问这台机器上的哪些目录。
+		*
+		* 为什么它收在「高级设置」组里而不是主列表：它一次配置完就基本不动，而主列表要留给
+		* 日常会看的东西。但它在组内**排第一位** —— 没有授权根目录，启用远程访问与创建隧道
+		* 都会被 `roots.length === 0` 锁死，它是所有远程能力的前置。
+		*/
+		function RootsCard(props) {
+			const { api, t, roots, managementLocked, refresh, notify, setError } = useCards();
+			const [path, setPath] = (0, react.useState)("");
+			const [label, setLabel] = (0, react.useState)("");
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "roots",
+				nameKey: tabLabelKey("roots"),
+				descKey: tabDescKey("roots"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-form-row",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "daw-input",
+								placeholder: t("absolutePath"),
+								value: path,
+								onChange: (event) => setPath(event.target.value)
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+								className: "daw-input",
+								placeholder: t("displayLabel"),
+								value: label,
+								onChange: (event) => setLabel(event.target.value)
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								className: "daw-command primary",
+								disabled: managementLocked,
+								title: managementLocked ? t("managementLockedWhileTunnel") : void 0,
+								onClick: () => {
+									setError(void 0);
+									api.addRoot(path, label || void 0).then(() => {
+										setPath("");
+										setLabel("");
+										notify("rootAdded");
+										return refresh();
+									}).catch(setError);
+								},
+								children: t("addRoot")
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list",
+						children: roots.map((root) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "daw-list-row",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-list-title",
+								children: [root.label, root.builtin === true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "daw-pill on",
+									children: t("builtinRootBadge")
+								})]
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-list-meta",
+								children: root.realPath
+							})] }), root.builtin === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "daw-list-meta daw-builtin-hint",
+								children: t("builtinRootHint")
+							}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								className: "daw-icon danger",
+								title: t("removeRoot"),
+								"aria-label": t("removeRoot"),
+								disabled: managementLocked,
+								onClick: () => {
+									if (!window.confirm(t("removeRootConfirm", { label: root.label }))) return;
+									setError(void 0);
+									api.removeRoot(root.id).then(() => {
+										notify("rootRemoved");
+										return refresh();
+									}).catch(setError);
+								},
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
+							})]
+						}, root.id))
+					}),
+					roots.some((root) => root.builtin === true) && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "daw-list-meta daw-builtin-notice",
+						children: t("builtinRootNotice")
+					})
+				]
+			});
 		}
-		function delay(ms) {
-			return new Promise((resolve) => setTimeout(resolve, ms));
+		//#endregion
+		//#region src/client/cards/trash.tsx
+		/**
+		* 「回收站」卡：手机端删掉的文件留在这里，可以还原或彻底删除。
+		*
+		* 从 `workspace.tsx` 的 `AdminPanel` 搬出来。与 `image.tsx` 同样处理懒加载：
+		*
+		* ## 列表数据是懒加载的，判据是 `open`
+		*
+		* 原实现把 `trashItems()` 放在 `AdminPanel.refresh()` 里，条件是 `openCards.has('trash')`。
+		* 拆出来后这条判据变成这张卡自己的 `open` prop —— **语义完全等价**：`open` 就是
+		* `isOpen('trash')` 的返回值，同一个 Set、同一个值。
+		*
+		* 但有一个细节必须一起搬：原实现里还原/彻底删除之后走的是 `return refresh()`，而
+		* `refresh()` 在「卡展开着」时会把回收站列表重新拉一遍 —— 所以删除动作的结果能立刻
+		* 反映到列表上。列表状态现在住在这张卡里，`refresh()` 已经不知道它的存在，于是
+		* 这里必须自己再拉一次，否则用户点了「还原」、文件从磁盘回来了、列表里那一行却还在。
+		*/
+		function TrashCard(props) {
+			const { api, t, locale, refresh, notify, setError } = useCards();
+			const [trash, setTrash] = (0, react.useState)([]);
+			(0, react.useEffect)(() => {
+				if (!props.open) return;
+				let cancelled = false;
+				api.trashItems().then((next) => {
+					if (cancelled) return;
+					setTrash(next.items);
+				}).catch((cause) => {
+					if (!cancelled) setError(cause);
+				});
+				return () => {
+					cancelled = true;
+				};
+			}, [
+				props.open,
+				api,
+				setError
+			]);
+			/**
+			* 还原/删除之后的重新拉取。
+			*
+			* 两件事都要做：`refresh()` 让设置页其余分区跟着更新（原来的 `return refresh()` 就是这么
+			* 干的），再单独把本卡的列表换掉 —— 后者正是拆卡之后必须自己补上的那一步。
+			*/
+			const reloadAfterAction = () => Promise.all([refresh(), api.trashItems().then((next) => setTrash(next.items))]).then(() => void 0);
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "trash",
+				nameKey: tabLabelKey("trash"),
+				descKey: tabDescKey("trash"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+					className: "daw-list-meta",
+					children: t("pluginTrashHint")
+				}), trash.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-list-meta daw-empty",
+					children: t("trashEmpty")
+				}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+					className: "daw-list",
+					children: trash.map((item) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-list-row",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-list-title",
+							children: item.path
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "daw-list-meta",
+							children: [
+								item.kind,
+								" · ",
+								formatBytes(item.size),
+								" · ",
+								new Date(item.createdAt).toLocaleString(locale)
+							]
+						})] }), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-command",
+							onClick: () => {
+								setError(void 0);
+								api.restoreTrash(item.id).then(() => {
+									notify("trashRestored");
+									return reloadAfterAction();
+								}).catch(setError);
+							},
+							children: t("restore")
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							className: "daw-icon danger",
+							title: t("deletePermanently"),
+							"aria-label": t("deletePermanently"),
+							onClick: () => {
+								if (confirm(t("purgeConfirm"))) api.purgeTrash(item.id).then(() => {
+									notify("trashPurged");
+									return reloadAfterAction();
+								}).catch(setError);
+							},
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.Trash2, { size: 15 })
+						})] })]
+					}, item.id))
+				})]
+			});
 		}
 		//#endregion
-		//#region src/client/plugins.tsx
+		//#region src/client/cards/tunnel.tsx
 		/**
-		* 插件清单的右侧栏形态：一个真正的 `SidebarRightTabDefinition`。
+		* 「外网隧道」卡：Cloudflare Quick Tunnel —— 公网连入的兜底通道。
 		*
-		* ## 为什么不是「再注册一个 slot」
+		* ## 为什么从 `remote` 里拆出来
 		*
-		* 报告里第 2 项讲的是 DSH 0.2.1-rc.3 的三处 pin 机制（`view-pins` / `panel-pins` /
-		* `guide-pins`）。pin 只作用于**注册了 panel / view / guide 的插件**——桥原来那两个座位
-		* （`conversation.chat.turnTail` 与 `settings.section`）都不在这三者的管辖内，所以哪怕把
-		* 三个新 slot 全注册一遍，桥自己的东西也一个都 pin 不到，只能消费别人的条目。
+		* 拆之前这张卡挤在「远程访问」卡的末尾，一共 123 行里它占 37 行，语义却是两件事：
+		* 前者是「在本机开个口子」（绑 IP/端口 + 配对码），后者是「把机器搬到外网」。
+		* 用户看到同一个卡里既绑端口又开隧道，会以为隧道是远程访问的一个开关 ——
+		* 它不是，它是**独立的一条通道**，与「远程访问已启用」和「选择权限」并列。
 		*
-		* 要真拿到 pin，唯一的路是**成为 tab 类型提供方**：往 `sidebarRightTabs` 注册一个
-		* definition，并在 `sidebar.right.pane.tab` / `.title` 两个 keyed seat 上按 `definition.id`
-		* 挂上 body 与标题。这样 guide 页会列出这张卡片，用户能在 rc.3 的 More 菜单里把它
-		* 固定 / 取消固定（`guide-pins.d.ts` 的 `FIXED_GUIDE_KIND = "files"` 只豁免文件卡片，
-		* 桥的 kind 不在豁免名单里）。
+		* ## 状态为什么住在 `AdminPanel` 而不是这里
 		*
-		* ## 为什么单独一个文件
+		* 这张卡用到的 `tunnel` / `tunnelBusy` / `activity` / `createTunnel` / `stopTunnel`
+		* 有一半要供主壳算 `managementLocked`（隧道运行 ⇒ 除隧道自身外所有管理写操作 403），
+		* 另一半还要被 `remote` 卡的「一键开隧道并出令牌」按钮消费。状态搬进这个文件，
+		* 主壳就没有依据去禁用别的卡片了。所以它们经 `context.ts` 下发，见那里的长注释。
 		*
-		* `workspace.tsx` 已经 1200 多行，而 `docs/project/TECH-DEBT.md` 的行数预算写的是
-		* 600 行/文件、超预算要先登记。把新 UI 面拆出来既不加剧那笔债，也让「设置页里的折叠卡」
-		* 与「右侧栏的常驻 tab」这两种形态各自独立演进。
+		* ## 必须保住的一处判据
+		*
+		* 「停止」按钮**绝不能**被 `roots.length === 0` 锁死。隧道运行期间管理面关门，
+		* `status` / `roots` 可能刷新失败为空；若停止也要求有根目录，用户就再也关不掉隧道了。
+		* 只有「创建」需要至少一个授权根（配置文本要有落点）。
+		*/
+		function TunnelCard(props) {
+			const { t } = useWorkspaceI18n();
+			const { tunnel, tunnelBusy, activity, roots, copyText, createTunnel, stopTunnel, configText, generateConfigForUrl, configTextBusy, managementLocked, setError } = useCards();
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(SettingsCard, {
+				tab: "tunnel",
+				nameKey: tabLabelKey("tunnel"),
+				descKey: tabDescKey("tunnel"),
+				open: props.open,
+				onToggle: props.onToggle,
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "daw-tunnel",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-tunnel-head",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("strong", { children: t("tunnelTitle") }) }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: `daw-pill${tunnel?.running ? " on" : ""}`,
+									children: tunnel?.running ? t("tunnelRunning") : t("tunnelStopped")
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: "daw-list-meta",
+								children: t("tunnelHint")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-warning",
+								children: t("tunnelSecurityWarning")
+							}),
+							tunnel?.errorKey !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-warning",
+								role: "alert",
+								children: t(tunnel.errorKey, tunnel.errorParams ?? {})
+							}),
+							tunnel?.errorKey === void 0 && tunnel?.error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "daw-warning",
+								role: "alert",
+								children: tunnel.error
+							}),
+							tunnel?.url !== void 0 && tunnel.url !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-url-row",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "daw-tunnel-url",
+									children: tunnel.url
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CopyButton, {
+									text: tunnel.url,
+									title: t("copyUrl"),
+									copiedText: t("copied"),
+									manualText: t("copyManual"),
+									copyText
+								})]
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+								className: "daw-command primary",
+								style: { marginTop: 10 },
+								disabled: tunnelBusy || tunnel?.running !== true && roots.length === 0,
+								onClick: () => {
+									if (tunnel?.running === true) stopTunnel();
+									else createTunnel({ thenGenConfig: true });
+								},
+								children: tunnel?.running === true ? t("tunnelStop") : t("tunnelCreate")
+							}),
+							activity !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "daw-tunnel-progress",
+								style: { marginTop: 10 },
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "daw-progress-track",
+									children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+										className: `daw-progress-fill${activity.percent === null ? " indeterminate" : ""}`,
+										style: activity.percent === null ? void 0 : { width: `${activity.percent}%` }
+									})
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+									className: "daw-list-meta",
+									style: { marginTop: 4 },
+									children: activity.labelKey === "" ? "" : t(activity.labelKey, activity.labelParams ?? {})
+								})]
+							})
+						]
+					}),
+					tunnel?.running === true && tunnel.url != null && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+						className: "daw-command",
+						style: { marginTop: 10 },
+						disabled: configTextBusy,
+						onClick: () => {
+							generateConfigForUrl(tunnel.url, "tunnelConfigAuto").catch(setError);
+						},
+						children: t("tunnelGenConfigByUrl")
+					}),
+					configText !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ConfigTextPanel, { result: configText })
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/workspace.tsx
+		/**
+		* 收进「高级设置」的分区：主列表不显示，但**每一个都照旧可用**。
 		*
-		* ## rc.2 上的降级
+		* 顺序即展开后的显示顺序。要加一张卡回主列表，把它从 `ADVANCED_TABS` 移回
+		* `ADMIN_TABS` 即可 —— `TAB_DESC_KEYS` 是 `Record<AdminTab, …>` 全覆盖的，
+		* 两处都能编译通过，不需要再补别的。
 		*
-		* `sidebarRightTabs` 在 rc.2 与 rc.3 都提供，definition 契约两版一致，所以 tab 本身能用；
-		* 但 rc.2 的 `GuideBody` 没有 `entryPins` / `entryActions` / More 菜单，卡片会正常列出、
-		* 点开也正常，只是**不能 pin**。这是可接受的降级：能力随宿主版本生长，桥不做版本判断。
+		* `roots` 排第一位：它是所有远程能力的**前置**（没有授权根目录，启用远程访问与创建隧道
+		* 都会被 `roots.length === 0` 锁死）。放在组首，用户一展开就先看到它。
 		*/
-		/** definition 的 id：tab 系统的实现身份，同时是 body/title 两个 keyed seat 的 key。 */
-		const PLUGINS_TAB_ID = "dsh-remote-bridge-plugins";
+		const ADVANCED_TABS = [
+			"roots",
+			"image",
+			"plugins"
+		];
 		/**
-		* tab 类型名。
+		* 进设置页时先展开哪一张。
 		*
-		* 必须与 DSH 内置类型不冲突 —— 内置的有 `guide` / `files` / `terminal` / `browser` /
-		* `plan` / `schedule` / `deliverables` 等。冲突时 `sidebarRightTabs.register` 会抛
-		* `sidebarRight: tab kind "…" is already registered`，整个插件起不来，所以带上插件前缀。
+		* 不能指向 `ADVANCED_TABS` 里的卡：那样进来看到的是一张收起的卡（甚至整组是收起的），
+		* 用户不会知道该先授权根目录。见 `AdminPanel` 里 `advancedOpen` 的初始化 ——
+		* 万一以后有人把它改成组内卡，那组会自动展开，不会出现「默认卡在关着的组里」。
 		*/
-		const PLUGINS_TAB_KIND = "remote-bridge-plugins";
+		const DEFAULT_PANEL_SECTION = "remote";
 		/**
-		* 构造 tab 类型定义。
+		* The single desktop dialog: a vertical section rail on the left, one content pane on the right.
 		*
-		* 文案用 thunk（`() => string`）而不是现取的字符串：契约里写明 thunk 每次使用都会重读，
-		* 所以切换语言不需要重新注册。`title` 是 tab chip 的初始文字，开 tab 的那一刻被捕获进
-		* layout record。
+		* Settings only — the five admin sections. The file tree used to live here as a sixth row; it does
+		* not any more, so this is the old `AdminOverlay` body with a rail, not a workspace host.
+		*/
+		/**
+		* 导航栏 + 内容区，**不含任何对话框外壳**。
 		*
-		* `patterns` 故意省略 —— 省略即「page type」，只能按 kind 打开（guide 卡片点一下就是这条路），
-		* 不会被文件地址意外匹配到。`priority` 用默认的 `extension`。
+		* 抽出来是为了让 DSH 设置页能把它**内联**渲染。
+		*
+		* 早先的版本做不到这一点，于是设置页里只放了一句说明加一个「打开手机设置面板」按钮，
+		* 真正的设置藏在按钮后面的模态框里。用户的反应很直接：「其他的可以设置的东西那去了」——
+		* 这就是把弹窗嵌进设置页的代价：入口看起来是空的，因为内容在下一层。
+		* 设置页本身就是一层容器，没有任何理由再套一层。
 		*/
-		function pluginsTabDefinition() {
-			const label = () => translate(getWorkspaceLocale(), "pluginsTab");
-			const description = () => translate(getWorkspaceLocale(), "pluginsTabDesc");
-			return {
-				id: PLUGINS_TAB_ID,
-				kind: PLUGINS_TAB_KIND,
-				title: label,
-				guide: [{
-					id: "plugins",
-					order: 40,
-					title: label,
-					description,
-					icon: import_lucide_react.Package
-				}]
-			};
-		}
 		/**
-		* tab chip 里的文字。
+		* 设置面板主体：**七张卡片平铺，各自独立开合，没有导航栏**。
 		*
-		* 不读 `useTabInfo` 是刻意的：标题在开 tab 时就被捕获了，跟着当前语言走没有意义；
-		* 而且 rc.2 / rc.3 的 hook 注入形状不同，少依赖一处就少一处版本耦合。
+		* 上一版留了个分区导航栏、一次只显示一张卡。对照 Vision Router 的实际长相才发现差得远：
+		* 它是全部卡片一起列出来、想开哪张开哪张，标题栏自己就是入口。那句提示词写得很直白 ——
+		* 「多张卡可以同时保持展开」。所以导航栏这一层是多余的，用户还得先点导航、再点卡片头，
+		* 两次点击才走一步。
+		*
+		* 抽出来是为了让 DSH 设置页能把它**内联**渲染。
+		*
+		* 早先的版本做不到这一点，于是设置页里只放了一句说明加一个「打开手机设置面板」按钮，
+		* 真正的设置藏在按钮后面的模态框里。用户的反应很直接：「其他的可以设置的东西那去了」——
+		* 这就是把弹窗嵌进设置页的代价：入口看起来是空的，因为内容在下一层。
+		* 设置页本身就是一层容器，没有任何理由再套一层。
+		*
+		* `section` / `onSection` 保留是为了兼容旧调用方，但现在**不再决定显示哪一张卡**，
+		* 只用来决定默认展开哪一张。
 		*/
-		function PluginsTabTitle() {
-			const { t } = useWorkspaceI18n();
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(react_jsx_runtime.Fragment, { children: t("pluginsTab") });
+		function PhoneSettingsBody(props) {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AdminPanel, {
+				api: props.api,
+				initialOpen: props.section,
+				onOpenPluginList: props.onOpenPluginList
+			});
 		}
 		/**
-		* 右侧栏里的插件清单。
-		*
-		* 与设置页那张折叠卡读同一对端点（`GET/PATCH /settings/plugins`），但形态不同：
-		* 这里是**常驻面板**，没有卡片外壳，清单直接铺开；刷新按钮常驻而不是「展开才拉」——
-		* 用户既然把这张卡 pin 到了 guide 页，就是打算经常看。
+		* The settings content of one admin section, extracted from `AdminOverlay` so the unified panel and
+		* the standalone `/dsh-workspace` page render exactly the same body.
+		*/
+		/**
+		* 设置面板：卡片平铺，各自独立开合。
 		*
-		* 三条与设置页一致的产品约束（详见 `workspace.tsx` 的 `PluginsSection` 注释）：
-		* 官方包不可停用、`runtime-provided` 不是故障、改完要重启才生效。
+		* `initialOpen` 决定进页面时先展开哪一张（默认第一张），之后完全由用户点卡片头控制。
+		* 展开状态存 Set —— 这样「同时展开两张」是自然结果，不需要额外的互斥逻辑。
 		*/
-		function makePluginsTabBody(api) {
-			return function PluginsTabBody() {
-				const { t } = useWorkspaceI18n();
-				const [inventory, setInventory] = (0, react.useState)(void 0);
-				const [busy, setBusy] = (0, react.useState)(false);
-				const [checking, setChecking] = (0, react.useState)(false);
-				const [toggling, setToggling] = (0, react.useState)(void 0);
-				const [error, setError] = (0, react.useState)(void 0);
-				const [restartRequired, setRestartRequired] = (0, react.useState)(false);
-				const load = (0, react.useCallback)(async (checkUpdates) => {
-					if (checkUpdates) setChecking(true);
-					else setBusy(true);
-					setError(void 0);
+		function AdminPanel(props) {
+			const { locale, t } = useWorkspaceI18n();
+			const [status, setStatus] = (0, react.useState)();
+			const [configText, setConfigText] = (0, react.useState)();
+			const [configEndpoint, setConfigEndpoint] = (0, react.useState)("");
+			const [configTextBusy, setConfigTextBusy] = (0, react.useState)(false);
+			const [openCards, setOpenCards] = (0, react.useState)(() => /* @__PURE__ */ new Set([props.initialOpen]));
+			const [advancedOpen, setAdvancedOpen] = (0, react.useState)(() => ADVANCED_TABS.includes(props.initialOpen));
+			const [error, setError] = (0, react.useState)();
+			const [notice, setNotice] = (0, react.useState)();
+			const [tunnel, setTunnel] = (0, react.useState)();
+			const [tunnelBusy, setTunnelBusy] = (0, react.useState)(false);
+			const [activity, setActivity] = (0, react.useState)();
+			const notify = (0, react.useCallback)((key, params) => {
+				setNotice(params === void 0 ? {
+					id: Date.now() + Math.random(),
+					key
+				} : {
+					id: Date.now() + Math.random(),
+					key,
+					params
+				});
+			}, []);
+			const copyText = (0, react.useCallback)(async (text) => {
+				const clipboard = globalThis.navigator?.clipboard;
+				if (clipboard !== void 0) try {
+					await clipboard.writeText(text);
+					return "done";
+				} catch {}
+				try {
+					const node = document.createElement("textarea");
+					node.value = text;
+					node.style.position = "fixed";
+					node.style.top = "-9999px";
+					node.setAttribute("readonly", "");
+					document.body.append(node);
+					node.select();
+					const ok = document.execCommand("copy");
+					node.remove();
+					if (ok) return "done";
+				} catch {}
+				return "manual";
+			}, []);
+			const isOpen = (0, react.useCallback)((card) => openCards.has(card), [openCards]);
+			const toggleCard = (0, react.useCallback)((card) => {
+				setOpenCards((previous) => {
+					const next = new Set(previous);
+					if (!next.delete(card)) next.add(card);
+					return next;
+				});
+			}, []);
+			const refresh = (0, react.useCallback)(async () => {
+				try {
+					setTunnel(await props.api.tunnelStatus());
+				} catch {}
+				try {
+					const next = await props.api.status();
+					setStatus(next);
+				} catch (cause) {
+					if (!(cause instanceof WorkspaceApiError && cause.status === 403 && (cause.code === "TUNNEL_MODE_ADMIN_DISABLED" || cause.code === "ADMIN_PROXY_FORWARDED"))) setError(cause);
+				}
+			}, [props.api, openCards]);
+			const tunnelErrorText = (0, react.useCallback)((s) => {
+				if (s.errorKey !== void 0) return t(s.errorKey, s.errorParams ?? {});
+				return s.error ?? t("listenerFailed");
+			}, [t]);
+			const pollActivityOnce = (0, react.useCallback)(async (active) => {
+				while (active()) {
 					try {
-						setInventory(await api.pluginInventory(checkUpdates));
-					} catch (cause) {
-						setError(messageOf(cause, t));
-					} finally {
-						if (checkUpdates) setChecking(false);
-						else setBusy(false);
+						const a = await props.api.tunnelActivity();
+						if (!active()) return;
+						setActivity(a.stage === "idle" ? void 0 : a);
+					} catch {}
+					await delay(400);
+				}
+			}, [props.api]);
+			const waitForTunnelUrl = (0, react.useCallback)(async (active) => {
+				for (let attempt = 0; attempt < 40 && active(); attempt += 1) {
+					await delay(500);
+					const s = await props.api.tunnelStatus();
+					if (!active()) return null;
+					setTunnel(s);
+					if (s.errorKey !== void 0 || s.error !== void 0) throw new Error(tunnelErrorText(s));
+					if (s.running && s.url !== null) return s.url;
+				}
+				return null;
+			}, [props.api, tunnelErrorText]);
+			const generateConfigForUrl = (0, react.useCallback)(async (baseUrl, noticeKey = "configCreated") => {
+				setConfigTextBusy(true);
+				setError(void 0);
+				try {
+					const currentRoots = status?.roots ?? [];
+					const value = await props.api.createConfigText({
+						...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) },
+						endpoints: [{
+							label: t("tunnelEndpointLabel"),
+							baseUrl
+						}]
+					});
+					setConfigText(value);
+					notify(noticeKey);
+					return true;
+				} catch (cause) {
+					setError(cause);
+					return false;
+				} finally {
+					setConfigTextBusy(false);
+				}
+			}, [
+				props.api,
+				status,
+				t,
+				notify
+			]);
+			const createTunnel = (0, react.useCallback)(async (opts = {}) => {
+				if (!window.confirm(t("tunnelStartConfirm"))) return;
+				const wantConfig = opts.thenGenConfig === true;
+				let alive = true;
+				setTunnelBusy(true);
+				setError(void 0);
+				setConfigText(void 0);
+				setActivity({
+					stage: "locating",
+					labelKey: "tunnelStageLocating",
+					percent: null
+				});
+				pollActivityOnce(() => alive);
+				try {
+					const currentRoots = status?.roots ?? [];
+					const created = await props.api.tunnelCreate(wantConfig, { ...currentRoots.length === 0 ? {} : { rootIds: currentRoots.map((root) => root.id) } });
+					setTunnel(created);
+					setActivity(void 0);
+					if (created.errorKey !== void 0 || created.error !== void 0) throw new Error(tunnelErrorText(created));
+					if (wantConfig && created.configText !== void 0) {
+						setConfigText(created.configText);
+						await refresh();
+						notify("tunnelConfigAuto");
+						return;
 					}
-				}, [t]);
-				(0, react.useEffect)(() => {
-					load(false);
-				}, [load]);
-				const toggle = (0, react.useCallback)(async (entry) => {
-					setToggling(entry.name);
+					const url = created.url ?? await waitForTunnelUrl(() => alive);
+					await refresh();
+					if (url === null) {
+						notify("tunnelUrlPending");
+						return;
+					}
+					if (wantConfig) await generateConfigForUrl(url, "tunnelConfigAuto");
+					else notify("tunnelStarted");
+				} catch (cause) {
+					setError(cause);
+				} finally {
+					alive = false;
+					setActivity(void 0);
+					setTunnelBusy(false);
+				}
+			}, [
+				props.api,
+				refresh,
+				status,
+				t,
+				notify,
+				pollActivityOnce,
+				waitForTunnelUrl,
+				tunnelErrorText,
+				generateConfigForUrl
+			]);
+			const stopTunnel = (0, react.useCallback)(async () => {
+				if (!window.confirm(t("tunnelStopConfirm"))) return;
+				setTunnelBusy(true);
+				setError(void 0);
+				try {
+					const next = await props.api.tunnelStop();
+					setTunnel(next);
+					await refresh();
+					notify("tunnelStopped");
+				} catch (cause) {
+					setError(cause);
+				} finally {
+					setTunnelBusy(false);
+				}
+			}, [
+				props.api,
+				refresh,
+				t,
+				notify
+			]);
+			const tunnelConfigClick = (0, react.useCallback)(async () => {
+				if (tunnel?.running === true) {
+					if (!window.confirm(t("tunnelStopConfirm"))) return;
+					setTunnelBusy(true);
 					setError(void 0);
 					try {
-						await api.togglePlugin(entry.name, !entry.loaded);
-						setInventory(await api.pluginInventory(false));
-						setRestartRequired(true);
+						const stopped = await props.api.tunnelStop();
+						setTunnel(stopped);
+						await refresh();
 					} catch (cause) {
-						setError(messageOf(cause, t));
+						setError(cause);
 					} finally {
-						setToggling(void 0);
+						setTunnelBusy(false);
 					}
-				}, [t]);
-				return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "daw-plugins-tab",
+					await createTunnel({ thenGenConfig: true });
+				} else await createTunnel({ thenGenConfig: true });
+			}, [
+				props.api,
+				tunnel,
+				t,
+				createTunnel,
+				refresh,
+				setError
+			]);
+			(0, react.useEffect)(() => {
+				refresh();
+			}, [refresh]);
+			const roots = status?.roots ?? [];
+			const managementLocked = tunnel?.running === true;
+			const cards = {
+				api: props.api,
+				t,
+				locale,
+				status,
+				roots,
+				managementLocked,
+				refresh,
+				notify,
+				copyText,
+				error,
+				setError,
+				setStatus,
+				tunnel,
+				tunnelBusy,
+				activity,
+				configText,
+				configTextBusy,
+				setConfigText,
+				setConfigTextBusy,
+				configEndpoint,
+				setConfigEndpoint,
+				createTunnel,
+				stopTunnel,
+				tunnelConfigClick,
+				generateConfigForUrl
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)(CardsProvider, {
+				value: cards,
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("main", {
+					className: "daw-admin",
 					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-							className: "daw-list-meta",
-							children: t("pluginsHint")
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-admin-topbar",
+							children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(LanguageToggle, {})
 						}),
 						error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "daw-warning",
 							role: "alert",
-							children: error
+							children: messageOf(error, t)
 						}),
-						restartRequired && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						notice !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "daw-success",
 							role: "status",
-							children: t("pluginsRestartRequired")
+							children: t(notice.key, notice.params)
 						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							className: "daw-form-row",
-							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
-								type: "button",
-								className: "daw-command",
-								disabled: busy,
-								onClick: () => {
-									load(false);
-								},
-								children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)(import_lucide_react.RefreshCw, { size: 14 }),
-									" ",
-									busy ? t("loading") : t("refresh")
-								]
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-								type: "button",
-								className: "daw-command",
-								disabled: checking,
-								onClick: () => {
-									load(true);
-								},
-								children: checking ? t("pluginsChecking") : t("pluginsCheckUpdates")
-							})]
+						managementLocked && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+							className: "daw-warning",
+							role: "status",
+							children: t("managementLockedWhileTunnel")
 						}),
-						inventory === void 0 ? busy ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list-meta",
-							children: t("loading")
-						}) : null : !inventory.available ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list-meta",
-							children: t("pluginsUnavailable", { reason: inventory.reason ?? "" })
-						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-							className: "daw-list-meta",
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(RemoteCard, {
+							open: isOpen("remote"),
+							onToggle: () => toggleCard("remote")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TunnelCard, {
+							open: isOpen("tunnel"),
+							onToggle: () => toggleCard("tunnel")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(DevicesCard, {
+							open: isOpen("devices"),
+							onToggle: () => toggleCard("devices")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(TrashCard, {
+							open: isOpen("trash"),
+							onToggle: () => toggleCard("trash")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(AppDownloadCard, {
+							open: isOpen("app-download"),
+							onToggle: () => toggleCard("app-download")
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)(AdvancedGroup, {
+							open: advancedOpen,
+							onToggle: () => setAdvancedOpen((v) => !v),
 							children: [
-								inventory.profile !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [inventory.profile, " · "] }),
-								inventory.loadedCount,
-								" / ",
-								inventory.items.length,
-								inventory.problemCount > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" · ", t("pluginsProblems", { count: inventory.problemCount })] })
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(RootsCard, {
+									open: isOpen("roots"),
+									onToggle: () => toggleCard("roots")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ImageCard, {
+									open: isOpen("image"),
+									onToggle: () => toggleCard("image")
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsx)(PluginsCard, {
+									open: isOpen("plugins"),
+									onToggle: () => toggleCard("plugins"),
+									onOpenPluginList: props.onOpenPluginList
+								})
 							]
-						}), inventory.items.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list-meta daw-empty",
-							children: t("pluginsEmpty")
-						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "daw-list",
-							children: inventory.items.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-								className: "daw-list-row",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", { children: [
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-list-title",
-										children: [entry.name, entry.installed !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-											className: "daw-list-meta",
-											children: [" · ", entry.installed]
-										})]
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-										className: "daw-list-meta",
-										children: entry.description ?? t("pluginsNoDescription")
-									}),
-									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-										className: "daw-list-meta",
-										children: [
-											/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-												className: `daw-pill${entry.loaded ? " on" : ""}`,
-												children: t(pluginStateKey(entry.state))
-											}),
-											entry.updateAvailable === true && entry.latestVersion !== null && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" ", /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-												className: "daw-pill",
-												children: t("pluginsUpdateAvailable", { version: entry.latestVersion })
-											})] }),
-											entry.updateAvailable === false && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [" · ", t("pluginsLatest")] })
-										]
-									})
-								] }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", { children: entry.toggleable && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-									type: "button",
-									className: "daw-command",
-									disabled: toggling === entry.name,
-									onClick: () => {
-										toggle(entry);
-									},
-									children: entry.loaded ? t("pluginsDisable") : t("pluginsEnable")
-								}) })]
-							}, entry.name))
-						})] })
+						})
 					]
-				});
-			};
-		}
-		//#endregion
-		//#region src/client/styles.ts
-		const STYLE_ID = "dsh-workspace-style";
-		/**
-		* 插件的全部样式。
-		*
-		* 导出出来是为了让测试能守住一条容易失守的不变量：**CSS 变量块必须同时覆盖
-		* `.daw-root` 与 `.daw-settings-section`**。
-		*
-		* 这条防线来自一个真实发生过的隐形 bug：设置页内联渲染时，那一节没有 `.daw-root` 祖先，
-		* 于是 `var(--daw-accent)` 解析失败 → `.daw-command.primary` 的 `background` 失效变透明、
-		* 而 `color` 仍是 `#fff` → **白字落在白底上，按钮彻底看不见**。
-		* 类型检查、单测、构建全都发现不了，只有肉眼看渲染或量计算样式才抓得到。
-		*/
-		const WORKSPACE_CSS = `
-.daw-root,.daw-settings-section,.daw-plugins-tab{--daw-bg:var(--dsw-alias-bg-base,var(--dsw-alias-bg-layer-2,#f7f8fa));--daw-panel:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));--daw-ink:var(--dsw-alias-label-primary,#18202a);--daw-muted:var(--dsw-alias-label-tertiary,#687381);--daw-line:var(--dsw-alias-border-l2,#dfe4e8);--daw-accent:var(--dsw-alias-brand-primary,#087f8c);--daw-accent-soft:var(--dsw-alias-bg-module-platform,#e5f5f6);--daw-good:var(--dsw-alias-state-success-primary,#2f7d4a);--daw-danger:var(--dsw-alias-state-error-primary,#b33a3a);color:var(--daw-ink);background:transparent;font:13px/1.45 Inter,ui-sans-serif,system-ui,sans-serif;letter-spacing:0;min-width:0}
-.daw-root *,.daw-settings-section *,.daw-plugins-tab *{box-sizing:border-box;letter-spacing:0}
-/* 输入控件基线（UI-04）：此前只有 :focus-visible 一条，非聚焦态全靠浏览器默认（2px inset/Arial/灰底），
-   深色令牌下实测白底黑字与面板割裂。这里给齐边框/底/字/内边距，聚焦态只换描边。 */
-.daw-input{width:100%;min-width:0;height:30px;padding:4px 9px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:6px;background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit}
-.daw-input::placeholder{color:var(--dsw-alias-label-tertiary,var(--daw-muted))}
-.daw-input:focus-visible{border-color:var(--dsw-alias-brand-primary,var(--daw-accent));outline:none}
-.daw-input:disabled{opacity:.55;cursor:not-allowed}.daw-icon{width:30px;padding:0}
-.daw-icon:hover{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}
-.daw-icon.danger{color:var(--daw-danger);border-color:transparent;background:transparent}
-.daw-icon:disabled{opacity:.45;cursor:not-allowed}
-/* 普通命令按钮基线（UI-04）：旧版写死 background:#fff/border:#cbd2d8，深色令牌下成了白块黑字。
-   全部改走 DSH 令牌；.primary 沿用面板底色做次按钮、真正的主操作由调用方加 .primary 配合。 */
-.daw-command{height:30px;padding:0 12px;border-radius:6px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));color:var(--dsw-alias-label-primary,var(--daw-ink));font:inherit;cursor:pointer}
-.daw-command:hover:not(:disabled){border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
-.daw-command:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,var(--daw-accent));outline-offset:1px}
-/* 禁用态（UI-05）：此前无任何 :disabled 样式，只剩浏览器默认的 30% 文字且仍是箭头手型。 */
-.daw-command:disabled{opacity:.5;cursor:not-allowed}
-.daw-command.primary{color:var(--dsw-alias-label-primary,var(--daw-ink));background:var(--dsw-alias-bg-module-platform,var(--daw-panel));border-color:var(--dsw-alias-border-l2,var(--daw-line));font-weight:500}
-.daw-command.primary:hover:not(:disabled){background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
-.daw-command.danger{color:var(--daw-danger)}
-.daw-command.danger:hover:not(:disabled){border-color:var(--daw-danger)}
-/* 图标+文字的小复制按钮：图标和文字对齐，窄屏只露图标也不改变按钮高度。 */
-.daw-command.icon-as-command{display:inline-flex;align-items:center;gap:6px;padding:0 10px;white-space:nowrap}
-.daw-copy-label{font-size:12px}
-.daw-empty{padding:14px 2px;text-align:center}
-.daw-admin{overflow:auto;padding:18px;display:flex;flex-direction:column;gap:10px}.daw-admin h3{font-size:14px;margin:0 0 12px}
-.daw-card{border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-layer-3,var(--daw-panel));border-radius:12px;list-style:none;transition:border-color .16s,background .16s}
-.daw-card:hover{border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
-.daw-card-open{background:var(--dsw-alias-bg-layer-2,var(--daw-panel));border-color:var(--dsw-alias-label-dimmed,var(--daw-line))}
-.daw-card-header{appearance:none;width:100%;font:inherit;color:inherit;text-align:left;cursor:pointer;background:0 0;border:0;border-radius:12px;align-items:center;gap:12px;padding:14px 16px;display:flex}
-.daw-card-header:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,var(--daw-accent));outline-offset:-2px}
-.daw-card-icon{color:var(--dsw-alias-label-tertiary,var(--daw-muted));flex:none;display:flex;align-items:center}
-.daw-card-headtext{flex-direction:column;flex:1;gap:4px;min-width:0;display:flex}
-.daw-card-name{color:var(--dsw-alias-label-primary,var(--daw-ink));font-size:15px;font-weight:600;line-height:1.4}
-.daw-card-desc{color:var(--dsw-alias-label-tertiary,var(--daw-muted));font-size:13px;line-height:1.5}
-.daw-card-chevron{color:var(--dsw-alias-label-tertiary,var(--daw-muted));flex:none;transition:transform .16s;font-size:12px;line-height:1}
-.daw-card-chevron-open{transform:rotate(180deg)}
-.daw-card-body{border-top:1px solid var(--dsw-alias-border-l2,var(--daw-line));margin:0 16px;padding-bottom:8px}.daw-settings-section{display:grid;grid-template-rows:auto minmax(0,1fr);gap:10px;min-width:0;min-height:0}.daw-plugins-tab{overflow:auto;padding:14px 16px;display:flex;flex-direction:column;gap:10px;min-width:0;min-height:0}.daw-settings-section>.daw-list-meta{margin:0}.daw-settings-section .daw-admin{padding:14px 2px}.daw-qr-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px;margin-top:12px}.daw-qr-card{margin:0;display:grid;justify-items:center;gap:8px;padding:16px;border:1px solid var(--daw-line);border-radius:6px;background:var(--daw-panel)}.daw-qr-image{width:180px;height:180px;background:var(--dsw-alias-bg-layer-3,#fff);border-radius:4px}.daw-qr-site{font-weight:600}.daw-qr-url{font:12px ui-monospace,SFMono-Regular,Consolas,monospace;color:var(--daw-accent);text-decoration:none;overflow-wrap:anywhere;text-align:center}.daw-qr-url:hover{text-decoration:underline}.daw-form-row{display:grid;grid-template-columns:minmax(0,1fr) minmax(120px,.45fr) auto;gap:8px;margin-bottom:14px}.daw-listener-form{display:grid;grid-template-columns:minmax(180px,1fr) 130px auto;gap:8px;align-items:end}.daw-field{display:grid;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:12px}.daw-listener-status{display:flex;flex-wrap:wrap;gap:5px 18px;padding:9px 0;color:var(--daw-muted);font:12px ui-monospace,SFMono-Regular,Consolas,monospace}.daw-listener-hint{margin:0 0 8px}.daw-list{border-top:1px solid var(--daw-line)}.daw-list-row{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:12px;align-items:center;min-height:48px;border-bottom:1px solid var(--daw-line);padding:7px 2px}.daw-list-title{font-weight:600;overflow-wrap:anywhere}
-.daw-list-title .daw-pill{margin-left:8px;vertical-align:middle}
-.daw-builtin-hint{text-align:right;align-self:center}
-.daw-builtin-notice{margin-top:10px;padding:8px 10px;border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft))}.daw-list-meta{font-size:12px;color:var(--daw-muted);overflow-wrap:anywhere}.daw-scope-grid{display:flex;flex-wrap:wrap;gap:6px 12px;padding:8px 0}.daw-check{display:inline-flex;align-items:center;gap:5px;color:var(--dsw-alias-label-secondary,var(--daw-muted))}.daw-code{font:600 22px ui-monospace,SFMono-Regular,Consolas,monospace;letter-spacing:2px!important;padding:14px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px;text-align:center;margin:12px 0}.daw-warning{flex:none;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--daw-muted);margin-bottom:0}.daw-pill{display:inline-flex;align-items:center;gap:5px;border-radius:999px;padding:1px 8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-label-secondary,var(--daw-muted));font-size:11px;font-weight:500;line-height:17px}.daw-pill.on{background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));color:var(--dsw-alias-state-success-primary,var(--daw-good))}.daw-tunnel{margin-top:14px;border-top:1px dashed var(--dsw-alias-border-l2,var(--daw-line));padding-top:12px}.daw-tunnel-head{display:flex;align-items:center;gap:8px;justify-content:space-between}.daw-tunnel-url{font:500 13px ui-monospace,SFMono-Regular,Consolas,monospace;overflow-wrap:anywhere;padding:9px 11px;border:1px solid var(--dsw-alias-border-l2,var(--daw-line));background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));border-radius:8px}.daw-tunnel-progress{max-width:360px}.daw-progress-track{height:6px;border-radius:999px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));overflow:hidden}.daw-progress-fill{height:100%;border-radius:999px;background:var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line)));transition:width .25s ease}.daw-inline-command{margin-left:8px}
-/* 成功反馈条（UI-07）：与 .daw-warning 同形，但走成功色，操作成功不再静默。 */
-.daw-success{flex:none;border:1px solid var(--dsw-alias-state-success-primary,var(--daw-good));border-radius:8px;background:var(--dsw-alias-bg-module-platform,var(--daw-accent-soft));padding:9px 11px;color:var(--dsw-alias-state-success-primary,var(--daw-good));margin-bottom:0}
-.daw-admin-topbar{display:flex;justify-content:flex-end;margin-bottom:8px}
-.daw-url-row{display:flex;align-items:center;gap:8px;margin-top:8px}.daw-url-row .daw-tunnel-url{flex:1 1 auto;margin:0;min-width:0}
-.daw-code-row{display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin:12px 0}.daw-code-row .daw-code{margin:0;flex:1 1 220px;min-width:0}.daw-copy-inline{flex:none}
-/* 隧道/监听进行中的流动条（UI-08）：percent=null 时铺一段高光在轨道里循环滑动，
-   不再把「未知进度」伪装成恒定 30%。 */
-.daw-progress-fill.indeterminate{width:40%;background:linear-gradient(90deg,transparent,var(--dsw-alias-state-info-primary,var(--daw-accent,var(--daw-line))),transparent);animation:daw-indeterminate 1.1s ease-in-out infinite}
-@keyframes daw-indeterminate{0%{transform:translateX(-120%)}100%{transform:translateX(280%)}}
-@media (max-width:720px){.daw-form-row,.daw-listener-form{grid-template-columns:1fr}.daw-admin{padding:12px}.daw-qr-grid{grid-template-columns:1fr}.daw-qr-image{width:150px;height:150px}.daw-inline-command{margin:8px 0 0}}
-`;
-		function installWorkspaceStyles() {
-			if (document.getElementById(STYLE_ID) !== null) return;
-			const style = document.createElement("style");
-			style.id = STYLE_ID;
-			style.dataset.plugin = "dsh-workspace";
-			style.textContent = WORKSPACE_CSS;
-			document.head.appendChild(style);
+				})
+			});
 		}
 		//#endregion
 		//#region src/client/index.tsx