dsh-zen-remote 2.2.9 → 2.3.1

package/src/adapters/dsh-better-sidebar/index.ts

@@ -1,6 +1,6 @@
 /**
  * The dsh-better-sidebar adapter (PB-12), written against EXACTLY
- * versions 0.25.0, 0.26.0, 0.26.1, 0.28.0-alpha.0 and 0.28.0 (PB-15 widened the list; 0.26.1 is a
+ * versions 0.25.0, 0.26.0, 0.26.1, 0.28.0-alpha.0, 0.28.0 and 0.28.1 (PB-15 widened the list; 0.26.1 is a
  * perf-only patch with the same wire surface as 0.26.0; 0.26.0 is a JSON-api
  * superset of 0.25.0 — it grows fs.readPage and the sidechat dequeue/model/
  * models methods, and moves fs.write's content onto the new raw-text
@@ -62,7 +62,11 @@ export const dshBetterSidebarAdapter: BridgeAdapter = {
   // 0.28.0 (stable, DSH 0.2.1-rc.1+): lib/index.js byte-identical to
   // 0.28.0-alpha.0; the client bundles differ only in CSS-module map order
   // and the service version string. alpha.0 stays for DSH 0.2.1-alpha.5.
-  versions: ['0.25.0', '0.26.0', '0.26.1', '0.28.0-alpha.0', '0.28.0'],
+  // 0.28.1: same routes and WebSockets; the JSON api grows `git.history`
+  // (paged git-log companion to git.graph — session-scoped read via
+  // gitCwdOf, base64url cursor in / commits out, no session ids in the
+  // answer; verified against the npm build's lib/index.js:8986).
+  versions: ['0.25.0', '0.26.0', '0.26.1', '0.28.0-alpha.0', '0.28.0', '0.28.1'],
   routes: [
     {
       // The JSON API: the method name rides the path tail, the session

package/src/adapters/dsh-better-sidebar/methods.ts

@@ -115,6 +115,9 @@ export const SIDEBAR_METHODS: Readonly<Record<string, SidebarMethodSpec>> = {
   'git.log': forward('read'),
   // 0.28.0-alpha.0：只读拓扑提交图（lib/index.js:8626），sessionId 定位，响应无会话 id。
   'git.graph': forward('read'),
+  // 0.28.1：git.graph 的分页 git-log 伴读（lib/index.js:8986），同样
+  // sessionId 定位、base64url 游标进 / 提交列表出，响应无会话 id。
+  'git.history': forward('read'),
   'git.commit-diff': forward('read'),
   'git.show': forward('read'),
   'git.blame': forward('read'),

package/src/admin-routes.ts

@@ -129,6 +129,43 @@ export interface AdminConfigSnapshot {
   sources: Record<keyof ZenRemoteConfig, ConfigSource>
 }
 
+/** The gateway-wizard declared fields (GW-1). They reach the browser only
+ * through the sanitized wizard/status projection (src/wizard/status.ts) —
+ * the raw config dump on admin/status strips them, the same redaction
+ * discipline that keeps `deviceToken` off every wire surface. */
+const INGRESS_FIELDS = [
+  'ingressMode',
+  'ingressDomain',
+  'ingressHttpsPort',
+  'ingressAcmeEmail',
+  'ingressPublicUrl',
+] as const
+
+/** One {@link INGRESS_FIELDS} member. */
+type IngressField = (typeof INGRESS_FIELDS)[number]
+
+/** The admin/status config shape: the resolved snapshot minus the ingress fields. */
+export interface AdminPublicConfig {
+  values: Omit<ZenRemoteConfig, IngressField>
+  sources: Omit<Record<keyof ZenRemoteConfig, ConfigSource>, IngressField>
+}
+
+/** Copy the snapshot without the wizard-declared fields (a copy, never the
+ * live object — the resolver's values are per-request but still shared with
+ * other readers of the same getConfig() answer). */
+function publicConfigSnapshot(snapshot: AdminConfigSnapshot): AdminPublicConfig {
+  const values = { ...snapshot.values } as Record<string, unknown>
+  const sources = { ...snapshot.sources } as Record<string, unknown>
+  for (const field of INGRESS_FIELDS) {
+    delete values[field]
+    delete sources[field]
+  }
+  return {
+    values: values as Omit<ZenRemoteConfig, IngressField>,
+    sources: sources as AdminPublicConfig['sources'],
+  }
+}
+
 export interface AdminHandlerOptions {
   /** The connection service's admit, injected by apply(); tests fake it. */
   admit: (req: IncomingMessage) => AdminAdmission
@@ -310,7 +347,7 @@ function testPushPayload(lang: ZenRemoteConfig['lang']): { title: string; body:
  * plugin restart, so an apply-time snapshot would go stale. */
 async function respondStatus(options: AdminHandlerOptions, req: IncomingMessage, res: ServerResponse): Promise<void> {
   const viaGateway = req.headers['x-zen-remote-via'] !== undefined
-  const config = options.getConfig()
+  const config = publicConfigSnapshot(options.getConfig())
   let gateway: unknown = null
   let gatewayStatus: number | null = null
   let gatewayReachable = false
@@ -327,9 +364,14 @@ async function respondStatus(options: AdminHandlerOptions, req: IncomingMessage,
     // No answer at all (refused, reset, timeout, non-JSON): gatewayStatus
     // stays null and the settings page renders from config alone.
   }
-  // A remote device may see the device list but never the live pairing code.
+  // A remote device may see the device list but never the live pairing
+  // code — and never the untrusted-proxy detection or the web-claim record
+  // (GW-fix-2/L1, GW-9): both are server-owner surfaces carrying network
+  // topology facts and device ids a remote device has no business reading.
   if (viaGateway && gateway !== null && typeof gateway === 'object') {
     ;(gateway as { pairing?: unknown }).pairing = null
+    ;(gateway as { lastForwardedSource?: unknown }).lastForwardedSource = null
+    ;(gateway as { lastWebClaim?: unknown }).lastWebClaim = null
   }
   responseJson(res, 200, { ok: true, gateway, gatewayReachable, gatewayStatus, config, viaGateway })
 }

package/src/client/index.tsx

@@ -29,6 +29,8 @@ import { NS } from './locales.ts'
 import type { MobileNavKey } from './locales.ts'
 import { SettingsSection } from './settings/SettingsSection.tsx'
 import { registerSettingsPage } from './settings/register-settings.ts'
+import { GatewayWizard } from './wizard/GatewayWizard.tsx'
+import { registerGatewayWizard } from './wizard/register-wizard.ts'
 import { RemoteHeaderIcon } from './RemoteHeaderIcon.tsx'
 import { RemoteShareMenuItem } from './RemoteShareMenu.tsx'
 import { getSharesStore } from '../client-data/shares.ts'
@@ -115,6 +117,13 @@ export function apply(ctx: ClientContext): void {
   // 数组，否则没有该服务的环境整个界面半边都加载不了）。
   registerSettingsPage(ctx, SettingsSection)
 
+  // GW-10 网关配置引导「让手机连上来」：同样在桌面门之前注册——桌面端 App
+  // 正是主服务端，wizard 恰好是它最有用的入口。部件自身三重门控：subject
+  // 过滤（kind === 'row' && pkg.name === 'dsh-zen-remote'）、保存角色检查
+  // （client 角色不渲染）、viaGateway 时全部操作禁用。样式全部作用在组件
+  // 自身的 data 属性下，≥1024px 的其他页面逐像素不受影响。
+  registerGatewayWizard(ctx, GatewayWizard)
+
   // T33b 会话共享的三个入口里前两个（标题行远程图标、会话右键菜单项）：
   // 同样必须在桌面门之前注册——桌面端 App 就是主服务端，图标和菜单恰好
   // 住在它的标题行与会话菜单里。部件自身按数据降级：shares 路由 404

package/src/client/locales.ts

@@ -196,7 +196,7 @@ export const zh = {
   // T60: the pairing button's disabled reason while the device-name draft is invalid.
   'settings.client.fixDeviceName': '请先修正设备名称',
   'settings.client.pairingCode': '配对码',
-  'settings.client.pairingCodeHint': '在服务端设置页生成「桌面应用端」配对码后填入（8 位，自动转大写）。',
+  'settings.client.pairingCodeHint': '在服务端设置页生成「桌面应用端」配对码后填入（8 位，自动转大写并过滤 0/O/1/I/L 与符号）。',
   'settings.client.pair': '配对',
   'settings.client.pairing': '配对中…',
   'settings.client.failInvalid': '服务端地址不合法',
@@ -309,6 +309,210 @@ export const zh = {
   'downloadToLocal': '下载到本机',
   'downloadBusy': '下载中…',
   'downloadFailed': '下载失败',
+  // --- GW-10: 远程访问与配对向导（服务端公网/局域网接入 + 手机/桌面客户端配对） ---
+  'wizard.title': '远程访问与设备配对',
+  'wizard.subtitle': '配置本机作为服务端（开放手机与另一台电脑连入）或作为客户端连接远端主机',
+  'wizard.off': '局域网模式 / 待配置',
+  'wizard.step.pick': '选择角色与接入',
+  'wizard.step.configure': '填写连接参数',
+  'wizard.step.verify': '连通验证与配对',
+  'wizard.role.sectionTitle': '本机角色',
+  'wizard.role.host': '作为服务端（主机）',
+  'wizard.role.hostDesc': '本机运行主力会话与网关，允许手机或另一台 DSH 电脑连入并操作会话',
+  'wizard.role.client': '作为桌面客户端（从机）',
+  'wizard.role.clientDesc': '本机连接到另一台 DSH 服务端，在侧边栏直接查看与操作远端共享的会话',
+  'wizard.role.clientPickNote': '切为客户端后，本机将连接到远端服务端的网关（支持公网 HTTPS 域名或局域网 / Tailscale 地址）。点击「下一步」填写服务端地址与配对码。',
+  'wizard.ingressSectionTitle': '服务端接入方式',
+  'wizard.path.caddy': '内置 Caddy（推荐）',
+  'wizard.path.caddyDesc': '适合有公网 IP 的环境。自动下载 Caddy 并通过 Cloudflare DNS 申请证书，无需手写反代配置',
+  'wizard.path.external': '使用已有反向代理',
+  'wizard.path.externalDesc': '适合已部署 Nginx、Caddy 或 Lucky 的环境。提供现成转发规则，直接填入现有反代即可',
+  'wizard.path.cloudflared': 'Cloudflare Tunnel 内网穿透',
+  'wizard.path.cloudflaredDesc': '无需公网 IP，也不必配置路由器端口映射。通过 Cloudflare 隧道直连本机，需域名已接入 Cloudflare',
+  'wizard.path.lan': '局域网 / Tailscale 直连',
+  'wizard.path.lanDesc': '在同一局域网或虚拟局域网内连接手机与另一台电脑，无需域名与公网证书',
+  'wizard.next': '下一步',
+  'wizard.back': '上一步',
+  'wizard.hostName': '服务端显示名称',
+  'wizard.hostNamePlaceholder': '例如：mac-mini',
+  'wizard.hostNameHint': '其他电脑或手机连入后在侧边栏看到的主机名称（可留空使用默认名称）',
+  'wizard.autoShare': '新建会话自动共享给已配对的桌面客户端',
+  'wizard.lanUrl': '局域网 / Tailscale 访问地址（可选）',
+  'wizard.lanUrlPlaceholder': 'http://192.168.1.10:3088',
+  'wizard.lanUrlHint': '填写本机局域网或 Tailscale 地址（如 http://192.168.1.10:3088），方便下一步直接生成手机扫码二维码与客户端连接信息',
+  'wizard.domain': '访问域名',
+  'wizard.domainHint': '填写完整域名，如 dsh.example.com（不带 https:// 和路径）',
+  'wizard.httpsPort': 'HTTPS 端口',
+  'wizard.cfToken': 'Cloudflare API 令牌',
+  'wizard.cfTokenHint': '用于自动申请证书或配置隧道，以 0600 权限保存在本机，不写入配置文件',
+  'wizard.cfTokenHowTo': '如何获取 API 令牌',
+  'wizard.serverUrl': '反代后的公网地址',
+  'wizard.serverUrlHint': '填写完整 HTTPS 根地址，如 https://dsh.example.com（不支持子目录）',
+  'wizard.proxySnippet': '查看 Nginx / Caddy / Lucky 配置参考',
+  'wizard.badDomain': '域名格式无效，请填写如 dsh.example.com 的域名',
+  'wizard.badPort': '端口号需为 1–65535 之间的整数',
+  'wizard.missingToken': '请填写 Cloudflare API 令牌',
+  'wizard.badServerUrl': '请填写有效的根路径地址（公网需 https://，局域网可用 http://，不含子目录）',
+  'wizard.verify.gateway': '本地网关就绪',
+  'wizard.verify.public': '访问地址连通',
+  'wizard.verify.pairing': '设备配对状态',
+  'wizard.light.pass': '正常',
+  'wizard.light.pending': '待验证',
+  'wizard.light.fail': '异常',
+  'wizard.pairTarget.web': '配对手机 / 浏览器（扫码）',
+  'wizard.pairTarget.desktop': '配对另一台电脑（桌面客户端）',
+  'wizard.startVerify': '生成配对二维码',
+  'wizard.reverify': '重新生成二维码',
+  'wizard.pairingCode': '配对码',
+  'wizard.pairingSeconds': '有效期剩余 {seconds} 秒',
+  'wizard.qrHint': '用手机相机或浏览器扫码打开配对页，输入上方配对码完成连接',
+  'wizard.verifyPass': '配对成功，设备 {deviceId} 已连接',
+  'wizard.verifyCookieInsecure': '手机已完成配对，但反向代理未传递 X-Forwarded-Proto: https，导致安全 Cookie 未生效。请检查转发头后重试',
+  'wizard.verifyExpired': '配对码已过期，请点击下方按钮重新生成',
+  'wizard.verifyStale': '接入配置已变更，请重新生成二维码',
+  'wizard.verifyPending': '请用手机扫描二维码并在页面中输入配对码…',
+  'wizard.verifyNotStarted': '点击下方按钮验证访问地址并生成手机配对二维码',
+  'wizard.desktop.addressLabel': '服务端连接地址（供客户端填写）',
+  'wizard.desktop.addressFallback': 'http://<本机局域网IP>:{port}',
+  'wizard.desktop.generate': '生成桌面客户端配对码',
+  'wizard.desktop.regenerate': '重新生成配对码',
+  'wizard.desktop.copyInfo': '复制地址与配对码',
+  'wizard.desktop.guide': '在另一台电脑打开本插件详情页，第 1 步选「作为桌面客户端」，第 2 步填入上方服务端地址与 8 位配对码即可完成连接。',
+  'wizard.desktop.pairedTitle': '已连接的桌面客户端（{count}）',
+  'wizard.desktop.pairedEmpty': '暂未配对桌面客户端',
+  'wizard.client.deviceName': '本机设备名称',
+  'wizard.client.deviceNamePlaceholder': '例如：macbook-pro',
+  'wizard.client.deviceNameHint': '配对后在服务端设备列表中显示的名称',
+  'wizard.client.serverUrl': '服务端地址',
+  'wizard.client.serverUrlPlaceholder': 'https://dsh.example.com 或 http://192.168.1.10:3088',
+  'wizard.client.serverUrlHint': '填写服务端的公网 HTTPS 地址，或局域网 / Tailscale 下的 http://<服务端IP>:3088',
+  'wizard.client.pairingCode': '8 位桌面配对码',
+  'wizard.client.pairingCodePlaceholder': '在服务端向导第 3 步切到「配对另一台电脑」生成',
+  'wizard.client.pairingCodeHint': '输入服务端生成的 8 位桌面客户端专用配对码（自动转大写，自动过滤 0/O/1/I/L 及符号）',
+  'wizard.client.pairAndConnect': '配对并连接服务端',
+  'wizard.client.pairingBusy': '正在配对并连接…',
+  'wizard.client.skipToStatus': '已配对，查看连接状态',
+  'wizard.client.lightCredential': '本地配对凭证',
+  'wizard.client.lightConnection': '服务端连接',
+  'wizard.client.lightSync': '会话与插件同步',
+  'wizard.client.reconfigure': '更换服务端 / 重新配对',
+  'wizard.startFailed': '验证未通过：{reason}',
+  'wizard.startFailedProbe': '无法访问该连接地址（{detail}）',
+  'wizard.startFailedRuntime': '入口服务尚未运行，请先在上方启动',
+  'wizard.startFailedGateway': '本地网关未响应，请检查网关运行状态',
+  'wizard.startFailedPair': '无法生成配对码（{detail}）',
+  'wizard.startFailedUrl': '公网地址格式无效',
+  'wizard.remoteOnly': '安全限制：公网接入向导仅限在服务端本机操作',
+  'wizard.notWired': '当前服务端版本不支持此功能，请升级后重试',
+  'wizard.card.proxyTitle': '反向代理配置参考',
+  'wizard.card.tokenTitle': '获取 Cloudflare API 令牌',
+  'wizard.card.copy': '复制配置',
+  'wizard.card.copied': '已复制',
+  'wizard.card.close': '关闭',
+  'wizard.card.tokenStep1': '登录 Cloudflare 控制台（dash.cloudflare.com），进入右上角「我的个人资料 → API 令牌」（用户令牌，以 cfut_ 开头），或左侧「管理账户 → 账户 API 令牌」（账户令牌，以 cfat_ 开头）',
+  'wizard.card.tokenStep2': '点击「创建令牌」（Create Token），选择「编辑区域 DNS」（Edit zone DNS）模板',
+  'wizard.card.tokenStep3': '在「权限」中保留默认的「区域（Zone）· DNS · 编辑（Edit）」权限',
+  'wizard.card.tokenStep4': '在「区域资源」（Zone Resources）中选择「包括（Include）· 特定区域（Specific zone）· 你的域名」',
+  'wizard.card.tokenStep5': '若使用 Cloudflare Tunnel，点击「+ 添加更多权限」补充下方所列的隧道、账户设置与区域读取权限',
+  'wizard.card.tokenStep6': '点击「继续以显示摘要」（Continue to summary），核对无误后点击「创建令牌」（Create Token）',
+  'wizard.card.tokenStep7': '复制生成的 API 令牌密钥（仅在创建完成页显示一次，关闭后无法再次查看）',
+  'wizard.card.tokenStep8': '粘贴到下方输入框并点击「保存令牌」',
+  'wizard.card.tokenPerms': '所需权限对照',
+  'wizard.card.tokenPermDns': '区域 · DNS · 编辑',
+  'wizard.card.tokenPermDnsWhy': '必选，用于 DNS-01 证书签发与解析记录配置',
+  'wizard.card.tokenPermTunnel': '账户 · Cloudflare Tunnel · 编辑',
+  'wizard.card.tokenPermTunnelWhy': '仅 Cloudflare Tunnel 方式需要',
+  'wizard.card.tokenPermAccount': '账户 · 账户设置 · 读取',
+  'wizard.card.tokenPermAccountWhy': '仅 Cloudflare Tunnel 方式需要（读取账户 ID）',
+  'wizard.card.tokenPermZoneRead': '区域 · 区域 · 读取',
+  'wizard.card.tokenPermZoneReadWhy': '仅 Cloudflare Tunnel 方式需要（定位域名所属区域）',
+  'wizard.card.tokenPaste': '粘贴 API 令牌',
+  'wizard.card.tokenUse': '保存令牌',
+  'wizard.card.migrateTitle': '将域名接入 Cloudflare',
+  'wizard.card.migrateStep1': '在域名注册商后台关闭 DNSSEC（若已开启），并确认域名未锁定 NS（名称服务器）修改',
+  'wizard.card.migrateStep2': '登录 Cloudflare 控制台，在左侧导航进入「域（Domains）→ 概览」，点击「接入域」（Onboard a domain）',
+  'wizard.card.migrateStep3': '输入你的根域名（如 example.com），选择快速扫描 DNS 记录，点击继续并选择 Free 计划',
+  'wizard.card.migrateStep4': '核对扫描出的 DNS 解析记录后继续，复制 Cloudflare 分配的两个名称服务器（Nameservers）地址',
+  'wizard.card.migrateStep5': '前往域名注册商后台，将原有 NS 替换为 Cloudflare 分配的两个名称服务器地址',
+  'wizard.card.migrateStep6': '等待状态变为「活动（Active）」（通常数分钟至数小时），返回此处点击「重新检测域名状态」',
+  'wizard.card.migrateRecheck': '重新检测域名状态',
+  'wizard.card.proxyCheck': '已配置完成，去验证',
+  'wizard.card.portForwardTitle': '路由器端口映射说明',
+  'wizard.card.portForwardStep1': '登录路由器管理后台（常见地址为 192.168.1.1 或 192.168.0.1）',
+  'wizard.card.portForwardStep2': '进入「端口转发 / 虚拟服务器 / NAT」设置页面',
+  'wizard.card.portForwardStep3': '新增 TCP 转发规则：外部端口 {port} 指向本机内网 IP 的 {port} 端口',
+  'wizard.card.portForwardStep4': '保存规则后，使用手机移动网络（关闭 Wi-Fi）测试公网连接',
+  'wizard.portForwardEntry': '非 443 端口：查看路由器端口映射说明',
+  'wizard.migrateEntry': '域名尚未接入 Cloudflare？',
+  'wizard.ingress': '入口服务',
+  'wizard.caddy.start': '启动 Caddy',
+  'wizard.caddy.starting': '正在下载并启动…',
+  'wizard.caddy.stop': '停止',
+  'wizard.caddy.running': 'Caddy 运行中',
+  'wizard.caddy.stopped': 'Caddy 已停止',
+  'wizard.caddy.neverStarted': 'Caddy 未启动',
+  'wizard.caddy.startOk': 'Caddy 已启动',
+  'wizard.caddy.startFailed': 'Caddy 启动失败：{reason}',
+  'wizard.caddy.failDownload': '自动下载失败，请手动安装后重试',
+  'wizard.caddy.failValidate': '生成的配置文件校验未通过',
+  'wizard.caddy.failAlreadyRunning': '服务已在运行中',
+  'wizard.caddy.failMissingToken': '请先在上一步保存 Cloudflare API 令牌',
+  'wizard.caddy.failNoDomain': '请先在上一步填写有效的访问域名',
+  'wizard.caddy.failBadConfig': '配置参数有误：{detail}',
+  'wizard.caddy.failSpawn': '无法拉起 Caddy 进程',
+  'wizard.token.saved': '已保存在本机',
+  'wizard.token.saveFailed': '令牌保存失败，请重试',
+  'wizard.tunnel.setup': '创建并启动隧道',
+  'wizard.tunnel.stop': '停止',
+  'wizard.tunnel.running': '隧道运行中',
+  'wizard.tunnel.stopped': '隧道已停止',
+  'wizard.tunnel.neverStarted': '隧道未启动',
+  'wizard.tunnel.ok': 'Cloudflare 隧道已就绪并开始运行',
+  'wizard.tunnel.conflict': '检测到同名隧道，请选择要复用的隧道：',
+  'wizard.tunnel.useExisting': '复用隧道',
+  'wizard.tunnel.zoneNotFound': '当前令牌下未找到该域名所属的 Cloudflare 区域，请确认域名已接入该账号',
+  'wizard.tunnel.dnsConflict': '该域名已存在指向 {detail} 的 CNAME 记录，请先在 Cloudflare DNS 中清理后再试',
+  'wizard.tunnel.auth': 'Cloudflare 认证失败，请检查令牌权限是否正确',
+  'wizard.tunnel.network': '无法连接 Cloudflare API，请检查网络',
+  'wizard.tunnel.api': 'Cloudflare 接口报错：{detail}',
+  'wizard.tunnel.spawnFailed': 'cloudflared 启动失败：{detail}',
+  'wizard.tunnel.noToken': '请先在上一步保存 Cloudflare API 令牌',
+  'wizard.tunnel.badDomain': '域名格式无效',
+  'wizard.tunnel.checking': '正在配置隧道并启动（首次自动下载 cloudflared）…',
+  'wizard.check.okOnCf': '已确认域名托管在 Cloudflare',
+  'wizard.check.okNotOnCf': '未在 Cloudflare 中找到该域名，请先完成域名接入',
+  'wizard.check.failed': '域名检测失败：{reason}',
+  'wizard.overview.roleLabel': '当前角色',
+  'wizard.overview.gatewayLabel': '本地网关',
+  'wizard.overview.gatewayReady': '运行正常 · 端口 {port}',
+  'wizard.overview.gatewayDown': '未响应',
+  'wizard.overview.ingressLabel': '接入方式与地址',
+  'wizard.overview.devicesLabel': '已配对设备',
+  'wizard.overview.devicesSummary': '手机/网页 {web} 台 · 桌面客户端 {desktop} 台',
+  'wizard.overview.devicesNone': '暂未配对设备',
+  'wizard.overview.clientCredLabel': '本地配对凭证',
+  'wizard.overview.clientConnLabel': '服务端连接',
+  'wizard.overview.clientServerLabel': '远端服务端地址',
+  'wizard.overview.startSetup': '开始配置向导',
+  'wizard.overview.reconfigure': '修改接入配置',
+  'wizard.overview.pairPhone': '配对手机 / 扫码',
+  'wizard.overview.pairDesktop': '配对另一台电脑',
+  'wizard.overview.clientDetail': '连接详情与配对向导',
+  'wizard.overview.emptyIntro': '尚未完成远程访问配置。点击右侧按钮启动向导，按步骤配置本机作为服务端（开放手机与另一台电脑连入）或作为桌面客户端连接远端主机。',
+  'wizard.modal.title': '远程访问与配对向导',
+  'wizard.modal.stepTag': '第 {num} 步',
+  'wizard.modal.step1Desc': '选择本机作为服务端还是桌面客户端；若作为服务端，选择外部设备的连入方式',
+  'wizard.modal.step2Desc': '根据上一步选择的方案，填写对应的连接地址、域名或配对凭证',
+  'wizard.modal.step3Desc': '检测连通状态，并扫码配对手机或生成桌面客户端配对码',
+  'wizard.modal.selectedPlan': '已选方案：{plan}',
+  'wizard.modal.cancel': '取消',
+  'wizard.modal.saveAndNext': '保存并进入验证',
+  'wizard.modal.finish': '完成',
+  'wizard.light.probing': '检测中…',
+  'wizard.overview.manageDevices': '管理设备',
+  'wizard.devicesModal.title': '已配对设备管理',
+  'wizard.devicesModal.subtitle': '查看与管理已配对的手机/网页设备及桌面客户端，支持改名、切换布局或吊销凭证',
+  'wizard.devicesModal.retest': '重新测试连通性',
 } as const
 
 /** English dictionary, key-identical to the Chinese source of truth. */
@@ -504,7 +708,7 @@ export const en: Record<MobileNavKey, string> = {
   // T60: the pairing button's disabled reason while the device-name draft is invalid.
   'settings.client.fixDeviceName': 'Fix the device name first',
   'settings.client.pairingCode': 'Pairing code',
-  'settings.client.pairingCodeHint': 'Generate a desktop-client pairing code on the server\u2019s settings page and enter it here (8 characters, uppercased automatically).',
+  'settings.client.pairingCodeHint': 'Generate a desktop-client pairing code on the server\u2019s settings page and enter it here (8 characters; auto-uppercased and filters out 0/O/1/I/L and symbols).',
   'settings.client.pair': 'Pair',
   'settings.client.pairing': 'Pairing…',
   'settings.client.failInvalid': 'The server address is not valid',
@@ -615,6 +819,210 @@ export const en: Record<MobileNavKey, string> = {
   'downloadToLocal': 'Download to this computer',
   'downloadBusy': 'Downloading…',
   'downloadFailed': 'Download failed',
+  // --- GW-10: remote access & device pairing wizard ---
+  'wizard.title': 'Remote Access & Device Pairing',
+  'wizard.subtitle': 'Set up this machine as a server (for phones and other computers) or as a client connected to a remote host',
+  'wizard.off': 'LAN mode / Not configured',
+  'wizard.step.pick': 'Role & Access',
+  'wizard.step.configure': 'Connection Settings',
+  'wizard.step.verify': 'Verify & Pair',
+  'wizard.role.sectionTitle': 'Machine Role',
+  'wizard.role.host': 'Server (Host)',
+  'wizard.role.hostDesc': 'Runs main sessions and the gateway on this machine so phones or other DSH computers can connect',
+  'wizard.role.client': 'Desktop Client',
+  'wizard.role.clientDesc': 'Connects to another DSH server so shared remote sessions appear directly in this sidebar',
+  'wizard.role.clientPickNote': 'In Client mode, this machine connects to a remote server gateway over HTTPS or LAN / Tailscale. Click "Next" to enter the server address and pairing code.',
+  'wizard.ingressSectionTitle': 'Server Access Method',
+  'wizard.path.caddy': 'Managed Caddy (Recommended)',
+  'wizard.path.caddyDesc': 'Best when you have a public IP. Downloads Caddy and issues TLS certificates via Cloudflare DNS automatically',
+  'wizard.path.external': 'Existing Reverse Proxy',
+  'wizard.path.externalDesc': 'Already running Nginx, Caddy, or Lucky? Copy a ready-made proxy rule into your existing setup',
+  'wizard.path.cloudflared': 'Cloudflare Tunnel',
+  'wizard.path.cloudflaredDesc': 'No public IP or router port forwarding needed. Connects directly through a Cloudflare tunnel',
+  'wizard.path.lan': 'LAN / Tailscale Direct',
+  'wizard.path.lanDesc': 'Connect phones and computers on the same LAN or Tailscale network without a domain or TLS certificate',
+  'wizard.next': 'Next',
+  'wizard.back': 'Back',
+  'wizard.hostName': 'Server Display Name',
+  'wizard.hostNamePlaceholder': 'e.g. mac-mini',
+  'wizard.hostNameHint': 'Name shown in the sidebar of connected computers and phones (leave blank for default)',
+  'wizard.autoShare': 'Automatically share new sessions with paired desktop clients',
+  'wizard.lanUrl': 'LAN / Tailscale URL (optional)',
+  'wizard.lanUrlPlaceholder': 'http://192.168.1.10:3088',
+  'wizard.lanUrlHint': 'Enter this machine\u2019s LAN or Tailscale URL (e.g. http://192.168.1.10:3088) to generate a phone QR code and copyable client address in the next step',
+  'wizard.domain': 'Domain',
+  'wizard.domainHint': 'Full domain name, e.g. dsh.example.com (without https:// or path)',
+  'wizard.httpsPort': 'HTTPS Port',
+  'wizard.cfToken': 'Cloudflare API Token',
+  'wizard.cfTokenHint': 'Used for certificate issuance or tunnel setup. Stored locally (0600) and never written to config files',
+  'wizard.cfTokenHowTo': 'How to create an API token',
+  'wizard.serverUrl': 'Public HTTPS URL',
+  'wizard.serverUrlHint': 'Root HTTPS URL, e.g. https://dsh.example.com (subdirectories are not supported)',
+  'wizard.proxySnippet': 'View Nginx / Caddy / Lucky config snippets',
+  'wizard.badDomain': 'Invalid domain format (e.g. dsh.example.com)',
+  'wizard.badPort': 'Port must be an integer between 1 and 65535',
+  'wizard.missingToken': 'Enter your Cloudflare API token',
+  'wizard.badServerUrl': 'Enter a valid root URL (https:// for public, http:// for LAN, no path)',
+  'wizard.verify.gateway': 'Local gateway',
+  'wizard.verify.public': 'Access URL reachable',
+  'wizard.verify.pairing': 'Device paired',
+  'wizard.light.pass': 'Ready',
+  'wizard.light.pending': 'Waiting',
+  'wizard.light.fail': 'Failed',
+  'wizard.pairTarget.web': 'Pair Phone / Browser (QR)',
+  'wizard.pairTarget.desktop': 'Pair Another Computer (Desktop Client)',
+  'wizard.startVerify': 'Generate Pairing QR Code',
+  'wizard.reverify': 'Regenerate QR Code',
+  'wizard.pairingCode': 'Pairing code',
+  'wizard.pairingSeconds': 'Expires in {seconds}s',
+  'wizard.qrHint': 'Scan with your phone to open the pairing page, then enter the code above',
+  'wizard.verifyPass': 'Paired — device {deviceId} connected',
+  'wizard.verifyCookieInsecure': 'Paired, but the reverse proxy did not pass X-Forwarded-Proto: https. Add the header so secure cookies work, then verify again',
+  'wizard.verifyExpired': 'Pairing code expired — generate a new one below',
+  'wizard.verifyStale': 'Configuration changed — generate a new QR code',
+  'wizard.verifyPending': 'Scan the QR code on your phone and enter the pairing code…',
+  'wizard.verifyNotStarted': 'Click the button below to verify the access URL and generate a phone pairing QR code',
+  'wizard.desktop.addressLabel': 'Server Address (for client machine)',
+  'wizard.desktop.addressFallback': 'http://<LAN-IP>:{port}',
+  'wizard.desktop.generate': 'Generate Desktop Pairing Code',
+  'wizard.desktop.regenerate': 'Regenerate Code',
+  'wizard.desktop.copyInfo': 'Copy Address & Code',
+  'wizard.desktop.guide': 'On the other computer, open this plugin page, choose "Desktop Client" in Step 1, and enter the server address and 8-character code above in Step 2.',
+  'wizard.desktop.pairedTitle': 'Paired Desktop Clients ({count})',
+  'wizard.desktop.pairedEmpty': 'No desktop clients paired yet',
+  'wizard.client.deviceName': 'This Computer\u2019s Name',
+  'wizard.client.deviceNamePlaceholder': 'e.g. macbook-pro',
+  'wizard.client.deviceNameHint': 'Shown in the server\u2019s paired device list',
+  'wizard.client.serverUrl': 'Server Address',
+  'wizard.client.serverUrlPlaceholder': 'https://dsh.example.com or http://192.168.1.10:3088',
+  'wizard.client.serverUrlHint': 'Enter the server\u2019s public HTTPS URL or LAN / Tailscale http://<IP>:3088 address',
+  'wizard.client.pairingCode': '8-Character Desktop Pairing Code',
+  'wizard.client.pairingCodePlaceholder': 'Generated under "Pair Another Computer" in Step 3 on the server',
+  'wizard.client.pairingCodeHint': 'Enter the 8-character desktop client code generated on the server (auto-uppercased; 0/O/1/I/L and symbols are filtered out)',
+  'wizard.client.pairAndConnect': 'Pair & Connect',
+  'wizard.client.pairingBusy': 'Pairing & connecting…',
+  'wizard.client.skipToStatus': 'Already Paired — View Status',
+  'wizard.client.lightCredential': 'Pairing token',
+  'wizard.client.lightConnection': 'Server connection',
+  'wizard.client.lightSync': 'Session & plugin sync',
+  'wizard.client.reconfigure': 'Change Server / Re-pair',
+  'wizard.startFailed': 'Verification failed: {reason}',
+  'wizard.startFailedProbe': 'access URL could not reach this gateway ({detail})',
+  'wizard.startFailedRuntime': 'ingress service is not running — start it above first',
+  'wizard.startFailedGateway': 'local gateway did not respond',
+  'wizard.startFailedPair': 'failed to generate pairing code ({detail})',
+  'wizard.startFailedUrl': 'invalid public URL',
+  'wizard.remoteOnly': 'Security restriction: public access setup is only available directly on the host machine',
+  'wizard.notWired': 'This feature requires a newer server version',
+  'wizard.card.proxyTitle': 'Reverse Proxy Configuration',
+  'wizard.card.tokenTitle': 'Create a Cloudflare API Token',
+  'wizard.card.copy': 'Copy',
+  'wizard.card.copied': 'Copied',
+  'wizard.card.close': 'Close',
+  'wizard.card.tokenStep1': 'In the Cloudflare dashboard (dash.cloudflare.com), open "My Profile → API Tokens" (user token, cfut_) or "Manage Account → Account API tokens" (account token, cfat_)',
+  'wizard.card.tokenStep2': 'Select "Create Token" and choose the "Edit zone DNS" template',
+  'wizard.card.tokenStep3': 'Under Permissions, keep the default "Zone · DNS · Edit" permission',
+  'wizard.card.tokenStep4': 'Under "Zone Resources", select "Include · Specific zone · your domain"',
+  'wizard.card.tokenStep5': 'If using Cloudflare Tunnel, click "+ Add more" to add the tunnel, account settings, and zone read permissions listed below',
+  'wizard.card.tokenStep6': 'Select "Continue to summary", review the details, and select "Create Token"',
+  'wizard.card.tokenStep7': 'Copy the generated token secret (shown only once)',
+  'wizard.card.tokenStep8': 'Paste it below and click "Save Token"',
+  'wizard.card.tokenPerms': 'Required permissions',
+  'wizard.card.tokenPermDns': 'Zone · DNS · Edit',
+  'wizard.card.tokenPermDnsWhy': 'Required for DNS-01 certificate issuance and DNS records',
+  'wizard.card.tokenPermTunnel': 'Account · Cloudflare Tunnel · Edit',
+  'wizard.card.tokenPermTunnelWhy': 'Cloudflare Tunnel only',
+  'wizard.card.tokenPermAccount': 'Account · Account Settings · Read',
+  'wizard.card.tokenPermAccountWhy': 'Cloudflare Tunnel only (reads account ID)',
+  'wizard.card.tokenPermZoneRead': 'Zone · Zone · Read',
+  'wizard.card.tokenPermZoneReadWhy': 'Cloudflare Tunnel only (locates domain zone)',
+  'wizard.card.tokenPaste': 'Paste API token',
+  'wizard.card.tokenUse': 'Save Token',
+  'wizard.card.migrateTitle': 'Add Your Domain to Cloudflare',
+  'wizard.card.migrateStep1': 'Turn off DNSSEC at your domain registrar (if active) and ensure nameserver changes are unlocked',
+  'wizard.card.migrateStep2': 'In the Cloudflare dashboard, go to "Domains → Overview" and select "Onboard a domain"',
+  'wizard.card.migrateStep3': 'Enter your apex domain (e.g. example.com), scan DNS records, click Continue, and select the Free plan',
+  'wizard.card.migrateStep4': 'Review the scanned DNS records, continue, and copy the two assigned Cloudflare nameservers',
+  'wizard.card.migrateStep5': 'At your domain registrar, replace the existing nameservers with the two Cloudflare nameservers',
+  'wizard.card.migrateStep6': 'Once the domain status becomes "Active" on the Domains page, return here and click "Recheck Domain"',
+  'wizard.card.migrateRecheck': 'Recheck Domain',
+  'wizard.card.proxyCheck': 'Configured — Verify Now',
+  'wizard.card.portForwardTitle': 'Router Port Forwarding',
+  'wizard.card.portForwardStep1': 'Sign in to your router admin page (typically 192.168.1.1 or 192.168.0.1)',
+  'wizard.card.portForwardStep2': 'Open "Port Forwarding / Virtual Server / NAT"',
+  'wizard.card.portForwardStep3': 'Add a TCP rule: external port {port} → this machine\u2019s LAN IP on port {port}',
+  'wizard.card.portForwardStep4': 'Save the rule and test the public URL over mobile data (with Wi-Fi turned off)',
+  'wizard.portForwardEntry': 'Non-443 port: router port forwarding guide',
+  'wizard.migrateEntry': 'Domain not on Cloudflare yet?',
+  'wizard.ingress': 'Ingress service',
+  'wizard.caddy.start': 'Start Caddy',
+  'wizard.caddy.starting': 'Downloading & starting…',
+  'wizard.caddy.stop': 'Stop',
+  'wizard.caddy.running': 'Caddy running',
+  'wizard.caddy.stopped': 'Caddy stopped',
+  'wizard.caddy.neverStarted': 'Caddy not started',
+  'wizard.caddy.startOk': 'Caddy started',
+  'wizard.caddy.startFailed': 'Caddy failed to start: {reason}',
+  'wizard.caddy.failDownload': 'auto-download failed — install Caddy manually and retry',
+  'wizard.caddy.failValidate': 'generated config failed validation',
+  'wizard.caddy.failAlreadyRunning': 'already running',
+  'wizard.caddy.failMissingToken': 'save your Cloudflare API token in the previous step first',
+  'wizard.caddy.failNoDomain': 'save a valid domain in the previous step first',
+  'wizard.caddy.failBadConfig': 'invalid configuration: {detail}',
+  'wizard.caddy.failSpawn': 'failed to start Caddy process',
+  'wizard.token.saved': 'Saved locally',
+  'wizard.token.saveFailed': 'Failed to save token — please retry',
+  'wizard.tunnel.setup': 'Create & Start Tunnel',
+  'wizard.tunnel.stop': 'Stop',
+  'wizard.tunnel.running': 'Tunnel running',
+  'wizard.tunnel.stopped': 'Tunnel stopped',
+  'wizard.tunnel.neverStarted': 'Tunnel not started',
+  'wizard.tunnel.ok': 'Cloudflare tunnel is active and running',
+  'wizard.tunnel.conflict': 'A tunnel with this name already exists — select one to reuse:',
+  'wizard.tunnel.useExisting': 'Reuse tunnel',
+  'wizard.tunnel.zoneNotFound': 'Domain zone not found under this token — make sure the domain is active on this Cloudflare account',
+  'wizard.tunnel.dnsConflict': 'A CNAME record for this domain already points to {detail} — remove it in Cloudflare DNS first',
+  'wizard.tunnel.auth': 'Cloudflare authentication failed — check token permissions',
+  'wizard.tunnel.network': 'Could not reach Cloudflare API',
+  'wizard.tunnel.api': 'Cloudflare API error: {detail}',
+  'wizard.tunnel.spawnFailed': 'cloudflared failed to start: {detail}',
+  'wizard.tunnel.noToken': 'Save your Cloudflare API token in the previous step first',
+  'wizard.tunnel.badDomain': 'Invalid domain format',
+  'wizard.tunnel.checking': 'Configuring tunnel & starting (downloading cloudflared on first run)…',
+  'wizard.check.okOnCf': 'Domain is active on Cloudflare',
+  'wizard.check.okNotOnCf': 'Domain not found on Cloudflare — add it to Cloudflare first',
+  'wizard.check.failed': 'Domain check failed: {reason}',
+  'wizard.overview.roleLabel': 'Current Role',
+  'wizard.overview.gatewayLabel': 'Local Gateway',
+  'wizard.overview.gatewayReady': 'Running · port {port}',
+  'wizard.overview.gatewayDown': 'Unreachable',
+  'wizard.overview.ingressLabel': 'Access Method & URL',
+  'wizard.overview.devicesLabel': 'Paired Devices',
+  'wizard.overview.devicesSummary': 'Phone/Web {web} · Desktop {desktop}',
+  'wizard.overview.devicesNone': 'No paired devices yet',
+  'wizard.overview.clientCredLabel': 'Local Credential',
+  'wizard.overview.clientConnLabel': 'Server Connection',
+  'wizard.overview.clientServerLabel': 'Remote Server URL',
+  'wizard.overview.startSetup': 'Start Setup Wizard',
+  'wizard.overview.reconfigure': 'Reconfigure Wizard',
+  'wizard.overview.pairPhone': 'Pair Phone (QR)',
+  'wizard.overview.pairDesktop': 'Pair Desktop Client',
+  'wizard.overview.clientDetail': 'Connection & Pairing Wizard',
+  'wizard.overview.emptyIntro': 'Remote access is not configured yet. Click the button on the right to launch the step-by-step wizard for server access or desktop client pairing.',
+  'wizard.modal.title': 'Remote Access & Pairing Wizard',
+  'wizard.modal.stepTag': 'Step {num}',
+  'wizard.modal.step1Desc': 'Choose whether this machine acts as the server or a desktop client, and select how devices connect',
+  'wizard.modal.step2Desc': 'Fill in the connection URL, domain, or pairing code for your selected plan',
+  'wizard.modal.step3Desc': 'Verify connectivity and pair your phone or desktop client',
+  'wizard.modal.selectedPlan': 'Selected plan: {plan}',
+  'wizard.modal.cancel': 'Cancel',
+  'wizard.modal.saveAndNext': 'Save & Verify',
+  'wizard.modal.finish': 'Done',
+  'wizard.light.probing': 'Checking…',
+  'wizard.overview.manageDevices': 'Manage Devices',
+  'wizard.devicesModal.title': 'Paired Devices',
+  'wizard.devicesModal.subtitle': 'View and manage paired phone/web and desktop client devices — rename, switch layout, or revoke access',
+  'wizard.devicesModal.retest': 'Retest Connectivity',
 }
 
 /** Key domain of the `mobileNav` namespace (zh is the source of truth). */