dsh-zen-remote 2.3.5 → 2.3.7

package/AGENTS.md

@@ -16,7 +16,7 @@
 | `src/config.ts` | 配置模型：四层回退（env > 插件行 > `lan-gate.config.json` > 默认值）、loader 的 `Config` schema（全 volatile）、`resolveRole` |
 | `src/http.ts` | host 路由共用的 JSON 响应封装与同源 POST 门 |
 | `src/admin-routes.ts` | 设置页管理后端 `/_dsh/zen-remote/admin/*`：代调网关本机 API（配对 / 设备 / 测试推送）+ 共享开关 |
-| `src/client-routes.ts` | 子客户端路由 `/_dsh/zen-remote/client/*`：remote-status（两角色都挂，host 只应答这一条、其余 404）、配对代理、设置页诊断、plain-HTTP 转发 `client/http/*`（改动摘要 / diff） |
+| `src/client-routes.ts` | 子客户端路由 `/_dsh/zen-remote/client/*`：remote-status（两角色都挂，host 只应答这一条、其余 404）、配对代理、设置页诊断、plain-HTTP 转发 `client/http/*`（改动摘要 / diff）、`debug-report`（脱敏诊断报告，via 墙先于分派，CU-3） |
 | `src/client-pairing.ts` | 子客户端配对纯逻辑：服务端地址归一化（http 仅限内网段）、claim/探针结果分类 |
 | `src/share-store.ts` | 共享会话表（`~/.dsh/zen-remote-shares.json`，持久化，重启恢复），中继访问控制的事实来源 |
 | `src/activity.ts` | 会话活动统计 + 闲置休眠扫描（`idleHours`，运行中/等待中不计时） |
@@ -37,6 +37,8 @@
 | `src/client-data/plugin-bridge.ts` | 设置页纯函数（PB-5）：桥接状态 → 文案键、整机数据同意表的切换（只动一键）；浏览器半边，不 import 主包 |
 | `src/fetch-route-intercept.ts` | 子客户端本机拦截的第二半：包装宿主连接服务 `fetchRoutes` 表的上传与导出两项——远程会话的非图片附件经 `relay/v1/upload` 流式转服务端（超限本地拒、失败回宿主自己的 200 失败信封）、虚拟 id 的导出后台 403（形态检测、懒装重试、卸载守卫） |
 | `src/virtual-id.ts` | `zr~<serverId>~<id>` 虚拟 id 算术（纯函数、零依赖；client-data 半边许可 import 它做 zr~ 判定，先例 remote-drop.ts / remote-status.ts） |
+| `src/log-ring.ts` | 诊断导出用内存日志环（CU-1）：上限 300 条、进程内不落盘；index.ts 两分支的 logWarn/logInfo 收口双写（ctx.logger + 环），生命周期事件（row apply/reload、网关 spawn/exit、relay online/offline、fetch-route 安装含 via）push 进环 |
+| `src/debug-report.ts` + `src/debug-redact.ts` | 诊断报告装配与脱敏器（CU-2，纯逻辑零 DSH import）：装配 getter 注入拼 `_meta/config/status/gateway/logs` 五板块、配置按字段名挑选（秘密构造性缺席）；脱敏器 URL 走**哨兵摘出-还原**（userinfo→`<token>@`、host→地址类型、端口与 path 保留、query 长值单独 token 化）、家目录折叠先于 token 趟；`scripts/check-debug-report.mjs` 真值表钉住全部形态（含哨兵伪造） |
 | `src/merge-streams.ts` | 三条全局流/列表的本地 + 远程合并状态机（侧边栏远程分组） |
 | `src/fingerprint.ts` | DSH 接口指纹：规范化描述符 → 分组 JSON Schema 哈希，供握手比对 |
 | `src/restart-fields.ts` / `restart-watcher.ts` | 需重启字段的指纹监测，变化即重载插件行 |
@@ -83,10 +85,18 @@ tag 名与 `package.json` 版本一致性 → `pnpm publish`（npm Trusted Publi
 OIDC 无令牌，provenance 自动生成）→ **建 GitHub Release**。
 
 Release 那步刻意排在 npm 之后：它宣告的是「这个版本已经发出去了」，npm 失败就
-不该留下一个指向不存在版本的发布页。发布说明用 `--generate-notes` 按上一个 tag
-以来的提交自动生成，所以**提交信息就是 changelog**，不另外维护文件。这一步可重入
-（先 `gh release view` 查在不在，在就跳过），重跑失败的 workflow 不会因为
-Release 已存在而挂掉。
+不该留下一个指向不存在版本的发布页。正文来源见下方 CHANGELOG 段（该版本的那一
+段 + 自上一版本以来的全部提交）；这一步可重入（先 `gh release view` 查在不在，
+在就跳过），重跑失败的 workflow 不会因为 Release 已存在而挂掉。checkout 带
+`fetch-depth: 0`（提交列表要全历史）。
+
+CHANGELOG（2026-11-02 起有 `CHANGELOG.md`）：只记用户可感知的变化，未发布段落
+攒着待发内容；**发版前**把「未发布」标题改成该版本号 + 日期，随 `npm version
+patch` 的 version commit 一起提交（脚本只同步 README 徽章，CHANGELOG 是手动步）。
+此前「提交信息就是 changelog、不另维护文件」的约定作废。GitHub Release 正文
+**就是 CHANGELOG 里该版本的那一段**（workflow 用同一条 awk 提取，缺段会在 npm
+发布前被守卫挡下），其下自动附「自上一版本以来的全部提交」（git log 现算，
+不再用 `--generate-notes`——它无法与 --notes-file 共存，且正文来源要可预测）。
 
 需要人工配置的只有一处：npmjs.com 的包设置里登记可信发布者
 `KyoMio/dsh-zen-remote` + 文件名 `publish.yml`。GitHub Release 那步用的是

package/CHANGELOG.md

@@ -0,0 +1,71 @@
+# 更新日志
+
+只记用户可感知的变化；每个 Release 的正文即本文件对应版本段，其下附逐提交
+完整列表，见
+[GitHub Releases](https://github.com/KyoMio/dsh-zen-remote/releases)（tag 驱动自动生成）。
+界面半边的细节叙事另见 [`docs/interface.md`](docs/interface.md) 的「更新日志」一节。
+
+## 2.3.7（2026-11-02）
+
+### 新增
+
+- **远程附件守卫扩展到回形针与粘贴**（issue #49）：此前只有拖拽会把「带子客户端
+  本机路径的非图片文件」从宿主的零拷贝捷径里拦下、改走字节上传，现在回形针选择器
+  与编辑器粘贴同样命中；拖入 / 粘贴**文件夹**时整批拦下并提示；附带 fetch-route
+  懒装重试与卸载守卫。
+- **导出诊断信息**：插件设置区块底部一键下载 `zen-remote-debug-<role>-<时间戳>.json`
+  （版本与角色 / 配置形态 / 诊断聚合 / host 另含网关摘要 / 近 300 条插件事件），
+  两层脱敏（配置按字段名挑选 + 统一脱敏器），可直接附到 GitHub issue；
+  经网关打开时拒绝导出，报告只能在本机生成。
+
+### 修复
+
+- **宽幅平板独立 PWA 顶部安全区**（≥1024px：iPad 横屏、12.9/13 吋 iPad 竖屏恰为
+  1024、安卓平板）：网关对所有非 desktop 设备注入 `viewport-fit=cover`，但安全区
+  补偿止步于 1023px 断点，顶部控件被压进状态栏、难以点按。新增
+  `(min-width: 1024px) and (display-mode: standalone)` 双门控规则补齐上下两个安全区
+  （锚定官方 AppFrame，`border-box` + `--mnav-sat`/`--mnav-sab`）；桌面浏览器与
+  桌面 App 构造性 no-op，≥1024px 桌面逐像素不变的硬约束不受影响。
+- **平板 PWA 整页可拖动弹回**：壳级 `overscroll-behavior` 此前只写在 body 且仅
+  纵轴，视口级橡皮筋在 768px 以上仍然活着。现 html/body 双写、双向杀掉；
+  内部滚动区不受影响，只是边缘滚动不再链到整页。
+
+## 2.3.6（2026-10-31）
+
+- 插件桥：支持 json-body WebSocket 帧的会话 id 定位与改写（`/sidebar/ws/sidechat`）。
+- 中继：观察 `agent/created` 的父会话，同步未通告的 sidechat / 子代理摘要。
+- 手机端：turn-tail 的 24h 时钟不再折行；信息卡合并 turns / steps 计数并显示 tok/s 速度。
+
+## 2.3.5（2026-10-30）
+
+- turn-fold：纯签名推理步不再留下空行（适配 DSH 0.2.1-rc.5）。
+- 安全与维护：新增 SECURITY.md 与 Dependabot（`@deepseek-ai/*` 闭包手动管理）、
+  测试以 `vm` 替代 `eval`；中继背压用例改为按余量驻留，修掉 CI 上的两连假失败。
+
+## 2.3.4（2026-10-28）
+
+- 插件桥 v2 声明补全（PB-22 ~ PB-25）：`deny` 路由对一切远程上下文统一 503 拒答；
+  `rewriteIds` 新增创建型 `{ fields }` 声明，深扫改写范围扩到「请求自带 ∪ 已知会话
+  清单」；路径段 / json-body 定位路由进入协作校验链（逐命中共享校验、请求体体积
+  上限、隧道升级前置校验）。
+
+## 2.3.3（2026-10-27）
+
+- 适配 dsh-better-sidebar 0.28.2；接受 DSH 0.2.2-alpha peer 并钉该版本的会话指纹。
+
+## 2.3.2（2026-10-26）
+
+- 发版重跑，无代码变化（仅版本号与 README 徽章）。
+
+## 2.3.1（2026-10-26）
+
+- 配置向导：三步配置向导上线（README 安装 / 向导快速上手重排并配截图）；Caddy
+  预编译发行版与国内镜像自动探测、cloudflared / Caddy 的连接与停滞超时、模式切换
+  停进程与状态清理；CI 每日预编译 Caddy + cloudflared 全平台产物并自动跟踪上游。
+- 安全：网关在 `0.0.0.0` 上拒绝未反代的公网 IP 直连；Caddy / Tunnel 模式把 host
+  重置回 `127.0.0.1`。
+- Windows：修复 Caddy 裸二进制下载、Cloudflare Tunnel UUID CNAME 校验、向导保存
+  CF token 前先切回 host 角色、重命名回退，以及网关 spawn 时绕开 `node.cmd`
+  批处理包装。
+
+更早版本（≤ 2.2.9）见 [GitHub Releases](https://github.com/KyoMio/dsh-zen-remote/releases)。

package/README.md

@@ -66,7 +66,7 @@ dsh plugin --profile web add dsh-zen-remote
 // ~/.dsh/profiles/desktop/package.json
 {
   "dependencies": {
-    "dsh-zen-remote": "^2.3.5"        // for local development: "link:/path/to/dsh-zen-remote"
+    "dsh-zen-remote": "^2.3.7"        // for local development: "link:/path/to/dsh-zen-remote"
   }
 }
 ```
@@ -209,7 +209,7 @@ Notifications fire only when **you are actually needed**, along two independent
   - Automatic LAN / Tailscale IPv4 discovery and local network probing, backed by the gateway's private-IP wall (`403 public-direct-forbidden`) against accidental public exposure
   - Dedicated **Manage Devices** modal and automatic sidebar cleanup on client unpair/revocation
 - **Cross-Desktop Remote Sessions (Client)**:
-  - Full-featured remote sessions in the sidebar: history, streaming, approvals/questions, server model catalog, file tree, changes summary/diff, server-side terminal, windowed artifact downloads, server-side LibreOffice PDF preview, up to 500 MiB file uploads, and drag-and-drop file upload interception
+  - Full-featured remote sessions in the sidebar: history, streaming, approvals/questions, server model catalog, file tree, changes summary/diff, server-side terminal, windowed artifact downloads, server-side LibreOffice PDF preview, up to 500 MiB file uploads, and drag-and-drop file upload interception; in remote sessions, non-image files added via the paperclip picker or pasted are likewise converted to byte uploads instead of unreadable local-path references
 - **Plugin Bridge**:
   - Cooperative plugins and built-in adapters (such as `dsh-better-sidebar`) route their panel requests in remote sessions to the host machine (with explicit owner consent for whole-machine data). See [Plugin Bridge Guide](docs/plugin-bridge.md).
 

package/README.zh-CN.md

@@ -66,7 +66,7 @@ dsh plugin --profile web add dsh-zen-remote
 // ~/.dsh/profiles/desktop/package.json
 {
   "dependencies": {
-    "dsh-zen-remote": "^2.3.5"        // 本地开发换成 "link:/path/to/dsh-zen-remote"
+    "dsh-zen-remote": "^2.3.7"        // 本地开发换成 "link:/path/to/dsh-zen-remote"
   }
 }
 ```
@@ -210,7 +210,7 @@ cd ~/.dsh/profiles/desktop && pnpm install
   - 独立「已配对设备管理」弹窗，以及客户端解配/吊销时自动归档清理侧边栏残留会话
 - **跨桌面端远程会话（桌面客户端）**：
   - 侧边栏远程工作区分组，支持完整对话流、审批/提问抢答同步、服务端模型目录同步、文件树与改动 diff、服务端远程终端
-  - 交付物分段流式下载到本机、服务端 LibreOffice 渲染 Office 文档 PDF 预览、最大 500 MiB 非图片大文件流式上传与拖拽文件自动转上传
+  - 交付物分段流式下载到本机、服务端 LibreOffice 渲染 Office 文档 PDF 预览、最大 500 MiB 非图片大文件流式上传与拖拽文件自动转上传；远程会话中回形针与粘贴的非图片文件同样自动转字节上传（不再留下读不到的本机路径引用）
 - **第三方插件桥（Plugin Bridge）**：
   - 协作插件登记桥接声明或通过内置适配器（如 `dsh-better-sidebar`），即可在子客户端的远程会话中直接读写主服务端的数据面板（整机数据需服务端主人在设置页逐插件授权）。详见 [插件桥文档](docs/plugin-bridge.md)。
 

package/docs/interface.md

@@ -23,6 +23,8 @@ v1.0.0（fork 自 [mexiaosqwq/dsh-web-mobile](https://github.com/mexiaosqwq/dsh-
 - **经网关打开时只读**：手机或其它浏览器经网关打开设置页可以看，但生成配对码、改角色、吊销这些管理动作被拒绝（带 `x-zen-remote-via` 标记的请求一律拒绝 POST）——设备丢了也没法用它再配出新设备；
 - 角色判定读的是 configForms 行文档里的已保存角色；行文档答不上来时回退探测 `/_dsh/mobile-nav/client-config`（该路由两角色都注册，报的是合并后的生效角色）。
 
+- **导出诊断信息（2.4，区块最底部，两角色都有）**：一键下载 `zen-remote-debug-<role>-<时间戳>.json`，可直接附到 GitHub issue——五个板块（`_meta` 版本与角色 / `config` 配置形态 / `status` 全部诊断聚合 / host 角色另含 `gateway` 网关摘要 / `logs` 近 300 条插件事件），浏览器端再并入附件入口守卫的分入口计数与当前会话信号。两层脱敏：配置**按字段名挑选**（deviceToken 等秘密构造性缺席），全部文本再过统一脱敏器（绝对路径只留叶子、家目录折叠为 `~`、URL 主机名降级为地址类型但端口保留、token 形态串打码、`zr~` id 截断）；对话内容与附件在任何一层都不进报告。经网关打开时该路由被 via 墙拒绝——报告只能在本机导出（`GET /_dsh/zen-remote/client/debug-report`，CU-3）。
+
 - **插件桥（2.1）**：远程共享组之后多一个小节「插件桥」——主服务端区块里逐插件列出已登记的名字与版本：只含会话数据的标注「随会话共享转发」；含整机数据的给开关「允许转发整机数据」（缺省关），旁注「打开后，已配对的桌面应用端可在远程会话里读取该插件的整机数据」。开关走与其它字段同一条 staged 表单通道（提交整张 `pluginBridgeConsent` 表，只动该插件的键），保存后列表自动重拉（数据来自 `GET /_dsh/zen-remote/admin/plugin-bridge`，经网关打开时拒绝）。子客户端区块的诊断组里逐插件一行「名字 · 本机版本 · 状态」，状态文案：已桥接 / 服务端未安装 / 版本不同（服务端 x.y.z）/ 声明不一致 / 服务端主人未允许整机数据 / 中继离线 / 服务端 zen-remote 版本过旧；本机改道未启用时另加一行「本机改道未启用：<原因>」。文案与判定逻辑都是纯函数（`src/client-data/plugin-bridge.ts`）。
 
 ### 主服务端：共享部件
@@ -96,7 +98,7 @@ v1.0.0（fork 自 [mexiaosqwq/dsh-web-mobile](https://github.com/mexiaosqwq/dsh-
 
 ### 会话信息卡
 
-会话页头部的 ⓘ 打开一张底部信息卡，把原来占位置的统计栏收纳进来：轮数/步数/首字延迟/模型耗时/工具耗时/token 与缓存命中六格统计、Chat/Trajectory 切换、以及导出日志/重命名/Fork 会话/归档四个操作。
+会话页头部的 ⓘ 打开一张底部信息卡，把原来占位置的统计栏收纳进来：轮次/步数、输出速度、首字延迟、模型耗时、工具耗时、缓存命中与 Token 收支六格统计、Chat/Trajectory 切换、以及导出日志/重命名/Fork 会话/归档四个操作。
 
 ### 回合过程折叠
 
@@ -135,13 +137,15 @@ PWA，再进来就是冷启动。插件自己的边缘手势也触发不了—
 
 安全上的几句话：这条 HTTP 路由只接受同源请求，文件名清洗后只取叶子名，写入路径校验不允许越出工作目录，单文件默认上限 20MB（可在 profile 里的插件行用 `maxUploadBytes` 调整）。远程访问时，这条路由和其它请求一样在网关半边的配对墙之后。
 
-### 远程会话拖拽附件（2.2.6）
+### 附件入口守卫（drop / 回形针 / 粘贴，2.2.6 起拖拽、2.4 起三入口）
+
+桌面端把文件从访达拖进会话输入区、或经回形针选择、或往编辑器里粘贴文件时，宿主有一条「同机零拷贝」捷径：Electron 的 `__DSH_HOST_PATHS__` 能读出文件的磁盘路径，`addFiles` 对**带路径的非图片**文件不传字节、直接插一条 `@本机绝对路径` 的引用。远程会话里这个路径是**子客户端机器**的路径，服务端的会话永远读不到，引用落地就是坏的（issue #49：拖拽之外，回形针与粘贴走的是同一条捷径）。浏览器半边在 document 上装了 **capture 阶段**的三个守卫（`src/client/effects/remote-drop.ts`，判定纯函数在 `src/client-data/remote-drop.ts`）：`drop` 事件、composer 隐藏选择器的 `change`（结构特征判定：`input[type=file][multiple][hidden]` 且**无 accept 属性**——导入/恢复类选择器通常带 accept 或可见，不在此列）、编辑器 `paste`（仅当事件目标在 `[contenteditable="true"]` 内，设置页/搜索框不归它管）。当前会话是 `zr~` 虚拟 id 时，把文件重包装成不带磁盘路径的 `File`（`new File([f], …)`，Electron 对 JS 构造的 File 返回空路径），塞进新的 `DataTransfer` 后在 document 上重派发一个合成 drop 事件——宿主自己的 drop 管道（mask 清理、busy 拒绝、目录判定、addFiles 分支）原样接手，把它当普通浏览器拖拽走字节上传，下游由既有的 fetch-route 拦截经中继转服务端暂存。合成事件 `isTrusted === false`，拦截器自己不会再处理它，天然防自重入。
 
-桌面端把文件从访达拖进会话输入区时，宿主有一条「同机零拷贝」捷径：Electron 的 `__DSH_HOST_PATHS__` 能读出拖入文件的磁盘路径，`addFiles` 于是不传字节、直接插一条 `@本机绝对路径` 的引用。远程会话里这个路径是**子客户端机器**的路径，服务端的会话永远读不到，引用落地就是坏的。2.2.6 起浏览器半边在 document 上装了一个 **capture 阶段**的 drop 拦截（`src/client/effects/remote-drop.ts`，判定纯函数在 `src/client-data/remote-drop.ts`）：当前会话是 `zr~` 虚拟 id 时，把拖入的文件重包装成不带磁盘路径的 `File`（`new File([f], …)`，Electron 对 JS 构造的 File 返回空路径），塞进新的 `DataTransfer` 后在 document 上重派发一个合成 drop 事件——宿主自己的 drop 管道（mask 清理、busy 拒绝、目录判定、addFiles 分支）原样接手，把它当普通浏览器拖拽走字节上传，下游由既有的 fetch-route 拦截经中继转服务端暂存。合成事件 `isTrusted === false`，拦截器自己不会再处理它，天然防自重入。
+三重触发门，任一不满足就零干预（`passthrough`）：`__DSH_HOST_PATHS__` 存在（手机 / 纯浏览器宿主本来就走上传，不装拦截）、当前会话是远程虚拟 id（当前会话读 `localStorage['dsh.sessions.current']`，事件发生时现场读；读不到按本机会话处理——误判方向安全：最坏把本机拖拽当成远程多传了字节，不会丢数据）、事件是受信的。**干预条件分入口**：拖拽沿用「有文件即拦」的 2.2.6 语义；回形针与粘贴只在批次里**至少一个文件带路径且非图片**（正是零拷贝坏分支）时才拦——无路径文件、纯图片、纯文本一律放行，不碰本来就能用的流程。拖入/粘贴**文件夹**时整批拦下（文件夹没法用单文件上传修），出一条 3 秒自动消失的提示（locale key `remoteDropFolderBlocked`）；目录判定优先于改道，`webkitGetAsEntry` 不可用时视为无文件夹（与宿主同一默认）。回形针改道时还会清掉 `input.value`（否则同文件二次选择不触发 change）。重包装或 `DataTransfer.items.add` 抛错时放行原事件回归现状——宁坏勿丢。
 
-三重触发门，任一不满足就零干预（`passthrough`）：`__DSH_HOST_PATHS__` 存在（手机 / 纯浏览器宿主本来就走上传，不装拦截）、当前会话是远程虚拟 id（当前会话读 `localStorage['dsh.sessions.current']`，事件发生时现场读；读不到按本机会话处理——误判方向安全：最坏把本机拖拽当成远程多传了字节，不会丢数据）、事件是受信的。拖入**文件夹**时整批拦下（文件夹没法用单文件上传修），出一条 3 秒自动消失的提示（locale key `remoteDropFolderBlocked`）。`webkitGetAsEntry` 不可用时视为无文件夹（与宿主同一默认）。重包装或 `DataTransfer.items.add` 抛错时放行原事件回归现状——宁坏勿丢。
+误伤边界（无 accept 特征门的已知局限）：第三方插件若也有「隐藏 + 多选 + 无 accept」的选择器，且恰逢远程会话为当前会话，其选中的带路径非图片文件会被改道进远程上传——最坏结果是文件进了远程会话（立即可见、可重来），不丢数据；特征门已把面收窄到最小。宿主改掉 InputBar 结构时症状是回形针/粘贴回到路径 chip 现状（拖拽不受影响），靠计数与真机验收兜底。
 
-降级：`DragEvent` 不可用或 `DataTransfer` 不可构造时**整体不装**，行为与未安装本功能完全一致。诊断：设置页（子客户端角色）诊断区新增「远程拖拽守卫」一行，显示安装状态与拦截 / 重派发 / 拦下文件夹 / 放行 / 重包失败五个计数（`remoteDropDiagnostics()`，浏览器端计数，渲染时现读）。
+降级：`DragEvent` 不可用或 `DataTransfer` 不可构造时**整体不装**，行为与未安装本功能完全一致。诊断：设置页（子客户端角色）诊断区「附件入口守卫」一行，显示安装状态与拦截 / 重派发 / 拦下文件夹 / 放行 / 重包失败五个计数，以及按 drop / 回形针 / 粘贴 分入口的拦截与放行计数（`remoteDropDiagnostics()`，浏览器端计数，渲染时现读）。计数口径分入口：回形针与粘贴在本机会话不进计数（远程门先于计数）；拖拽沿用 2.2.6 行为，本机拖拽仍记一次放行。
 
 ### 分享图
 
@@ -165,6 +169,8 @@ PWA，再进来就是冷启动。插件自己的边缘手势也触发不了—
 
 页面各表面的安全区留白统一收进两个可注入的 CSS 变量（`--mnav-sat`/`--mnav-sab`），平时读 `env(safe-area-inset-*)`，调试参数在时可以整体假冒——这是后面两层缓解的基础。
 
+这套补偿原本止步于 1023px 断点，但网关对一切非 desktop 设备都注入 `viewport-fit=cover`，于是**宽幅平板的独立 PWA（≥1024px：iPad 横屏、12.9/13 吋 iPad 竖屏恰好 1024、安卓平板）**会画进状态栏下方而无人买单——顶部控件被系统区压住、难以点按。现由 `misc.css.ts` 一条 `(min-width: 1024px) and (display-mode: standalone)` 双门控的规则补偿：锚点是官方 AppFrame（`[data-shell-overlay]` 的直接父层，与 `findFrame()` 同源），`border-box` + 上下两个变量。桌面浏览器（display-mode 不匹配）、桌面 App（整个样式表被 `dshDesktop` 门挡掉、也拿不到 cover）与一切 `env()` 为 0 的环境构造性 no-op，≥1024px 桌面逐像素不变的硬约束不受影响；规则由 `scripts/check-tablet-safe-area.mjs` 钉住。
+
 在这套变量之上，iOS 26.x 的 Safari/PWA 上出现了一个已知系统缺陷：独立（加到主屏）PWA 第一次弹出软键盘后，布局视口会永久性地比屏幕矮一截（`innerHeight`/`visualViewport.height`/`100dvh` 一起变小），直到整个 app 被彻底退出重开。这不是本插件的 bug，社区已有记录（[参考文章](https://dev.to/cederhook/fixing-the-ios-standalone-pwa-keyboard-bug-that-shrinks-your-viewport-for-good-63d)），本插件只做了两层缓解，不是根治：
 
 1. **视口下沉检测**——检测到系统在底部裁掉一截可视区域时，把底部安全区补偿归零，避免在已经空白的系统条上再叠一层空白；
@@ -385,7 +391,7 @@ PWA，再进来就是冷启动。插件自己的边缘手势也触发不了—
 ## 兼容插件
 
 - [dsh-better-sidebar](https://github.com/omdsh-dev/DSH-better-sidebar)(0.19+:它的全部 tab 都在 DSH 0.1.5 官方右侧栏里,手机上宿主自己切全屏,本插件在会话页头部给它留入口位、左缘回退手势收它、文件树里点 @ 引用后自动收起——面板全屏盖住会话页,草稿变化看不见,收起本身就是点击反馈;≤ 0.18 自绘右栏的老版本:全宽抽屉 + 安全区 + 底部关闭 pill,只在 DSH < 0.1.5 上还会走到)——本机实测 **0.19.1**(老版规则实测 0.15.0)
-- dsh-better-sidebar 的**远程会话处理**(PB-12 起分两档):**0.25.0、0.26.0、0.26.1、0.28.0-alpha.0、0.28.0、0.28.1 与 0.28.2** 七版由 zen-remote 的内置适配器(`src/adapters/dsh-better-sidebar/`)**代理**——它的文件浏览、编辑器、git 变动、任务等界面在远程会话里读写的是主服务端的数据(整机数据,需主服务端主人在设置页同意;`open.external` 远程拒绝、`settings.*` 与 `/sidebar/bundle` 留本机、侧聊转发（子会话继承父会话共享）;0.26 新方法已一并接入(`fs.readPage` 分页读、`sidechat.dequeue` 撤回排队消息、`sidechat.model`/`sidechat.models` 线程切模型、`/sidebar/write` 编辑器保存;0.28.1 再添 `git.history` 分页提交历史读;0.28.2 接口面不变,只把 detached 会话的 cwd 改为读存储 header(不再整份解码会话日志);`ws/sidechat` 推送不桥接,远程侧聊走 0.26 自带的 15s 兜底轮询,正确性无损))。**其他版本维持隐藏**:那些版本的界面都带 `{sessionId, cwd}` 语境调它自己的 `/sidebar/api/*` 接口,远程会话里这些请求落到子客户端本机——文件树会显示本机同名文件、编辑会真的写本机文件;远程会话(`html[data-zr-remote-session="1"]`)里按插件自己的挂载/渲染标记隐藏这些界面,选择器在 `src/client/styles/remote-session.css.ts`,未安装时一条都不命中。因为它接管了宿主的「文件」标签,未桥接的远程会话里暂时没有侧栏文件浏览;聊天或交付物里的文件链接(`dsh-resource://file/**`)会被它的编辑器注册抢先接住,展开一个空的右栏(根治要等 zen-remote 自己的远程文件树)。隐藏档的定位仍是**隐藏而非代理**:插件组件保持挂载并继续静默发只读请求,但所有写控件都在被隐藏的界面里,不会误写本机。PB-14 起显示规则按桥接状态生效:已桥接(0.25.0/0.26.0 且主服务端同意)时远程会话里**照常显示**(面板数据经适配器来自主服务端,隐藏规则全部让位);未桥接时维持隐藏,已打开的 tab 空态改为一行说明占位(better-sidebar 未在远程会话桥接——中英双语,随浏览器语言),空白工作台浮动按钮一并隐藏
+- dsh-better-sidebar 的**远程会话处理**(PB-12 起分两档):**0.25.0、0.26.0、0.26.1、0.28.0-alpha.0、0.28.0、0.28.1 与 0.28.2** 七版由 zen-remote 的内置适配器(`src/adapters/dsh-better-sidebar/`)**代理**——它的文件浏览、编辑器、git 变动、任务等界面在远程会话里读写的是主服务端的数据(整机数据,需主服务端主人在设置页同意;`open.external` 远程拒绝、`settings.*` 与 `/sidebar/bundle` 留本机、侧聊转发（子会话继承父会话共享）;0.26 新方法已一并接入(`fs.readPage` 分页读、`sidechat.dequeue` 撤回排队消息、`sidechat.model`/`sidechat.models` 线程切模型、`/sidebar/write` 编辑器保存;0.28.1 再添 `git.history` 分页提交历史读;0.28.2 接口面不变,只把 detached 会话的 cwd 改为读存储 header(不再整份解码会话日志);`ws/sidechat` 侧聊推送也已桥接(PB-26b:升级 URL 不带参数、会话 id 在连接后的 JSON 帧里,客户端把 watch 帧里的虚拟 id 还原成真实 id 才转发,插件推送的 `threadId` 换算回虚拟 id 才给浏览器,未共享的线程 id 在两侧都会被拒、连接即断)))。**其他版本维持隐藏**:那些版本的界面都带 `{sessionId, cwd}` 语境调它自己的 `/sidebar/api/*` 接口,远程会话里这些请求落到子客户端本机——文件树会显示本机同名文件、编辑会真的写本机文件;远程会话(`html[data-zr-remote-session="1"]`)里按插件自己的挂载/渲染标记隐藏这些界面,选择器在 `src/client/styles/remote-session.css.ts`,未安装时一条都不命中。因为它接管了宿主的「文件」标签,未桥接的远程会话里暂时没有侧栏文件浏览;聊天或交付物里的文件链接(`dsh-resource://file/**`)会被它的编辑器注册抢先接住,展开一个空的右栏(根治要等 zen-remote 自己的远程文件树)。隐藏档的定位仍是**隐藏而非代理**:插件组件保持挂载并继续静默发只读请求,但所有写控件都在被隐藏的界面里,不会误写本机。PB-14 起显示规则按桥接状态生效:已桥接(0.25.0/0.26.0 且主服务端同意)时远程会话里**照常显示**(面板数据经适配器来自主服务端,隐藏规则全部让位);未桥接时维持隐藏,已打开的 tab 空态改为一行说明占位(better-sidebar 未在远程会话桥接——中英双语,随浏览器语言),空白工作台浮动按钮一并隐藏
 - [@nanmicoder/dsh-agent-teams](https://github.com/NanmiCoder/dsh-agent-teams)(AgentTeams 活动浮层:手机端挪到会话头部下方、避开安全区,会话列表页隐藏;子代理会话头部保留可点的父会话面包屑用于切回)——本机实测 **0.1.9**
 - [@ychris12138/dsh-usage-stats](https://github.com/Ychris12138/dsh-usage-stats)(用量与余额,主屏 chips 行可直接打开;旧包名 `dsh-usage-stats` 已废弃,两个名字同时留在 profile 里会因重复的 `usage-stats` 行让 DSH 起不来)——本机实测 **0.2.9**
 - [@opendsh/dsh-plugin-scheduled-tasks](https://github.com/Ceelog/dsh-plugins)(定时任务,主屏 chips 行自动收割入口)——本机实测 **0.2.3**

package/docs/plugin-bridge.md

@@ -63,7 +63,7 @@ export function apply(ctx: Context) {
 
 声明里出现未知字段直接报错（防拼错）。`methods`、`maxBody`、`upgrade` 与 2.4 的四个字段（`locator`/`prefix`/`deny`/`rewriteIds`）只在**显式给出**时进摘要——2.1 时代（没有这些字段）的声明，摘要与当年完全一致，升级不破坏已桥接状态。2.1 只匹配 **exact 路径**；2.4 起声明 `prefix: true` 的路由额外命中其子路径（见上表）。
 
-两个字段同写时 `deny` 优先：远程命中的请求先被 `route-denied` 拒下，`rewriteIds` 的改写不可达（本地请求两边都不触发，响应原样交回）。`upgrade` 路由上的 `rewriteIds` 在隧道半边被忽略——隧道搬运的是不透明字节，无从改写；同一声明路由被当作普通 HTTP 请求命中时照常生效。
+两个字段同写时 `deny` 优先：远程命中的请求先被 `route-denied` 拒下，`rewriteIds` 的改写不可达（本地请求两边都不触发，响应原样交回）。`upgrade` 路由上的 `rewriteIds`：query 定位的升级路由在隧道半边被忽略——隧道搬运的是不透明字节，无从改写（同一声明路由被当作普通 HTTP 请求命中时照常生效）；json-body 定位的升级路由（PB-26b）则照常作用在**下行文本帧**上——帧先解 JSON、深扫或按位改写后重新封帧再给浏览器。
 
 ## 你的插件要守的约定
 
@@ -107,7 +107,7 @@ content-type: application/json; charset=utf-8
 
 ## WebSocket 路由（2.2 起）
 
-路由声明 `upgrade: true` 后即成为 WebSocket 升级端点：远程会话里浏览器对该路径的 `new WebSocket(...)` 由子客户端本机接住，经中继的**字节隧道**接到服务端本机插件——升级请求头（`sec-websocket-key` / `sec-websocket-version`，及可选的 `sec-websocket-protocol` / `sec-websocket-extensions`）与双向字节各自**原样搬运，两端都不解析 WebSocket 帧**：101 响应、每个帧、关闭字节都是不透明字节，真正的握手由插件路由在服务端本机完成。三路由的协议形状见 `docs/remote-access.md` 的「插件桥」一节；决策记录见 `docs/adr/0002`。
+路由声明 `upgrade: true` 后即成为 WebSocket 升级端点：远程会话里浏览器对该路径的 `new WebSocket(...)` 由子客户端本机接住，经中继的**字节隧道**接到服务端本机插件——升级请求头（`sec-websocket-key` / `sec-websocket-version`，及可选的 `sec-websocket-protocol` / `sec-websocket-extensions`）与双向字节各自**原样搬运，两端都不解析 WebSocket 帧**：101 响应、每个帧、关闭字节都是不透明字节，真正的握手由插件路由在服务端本机完成。例外（PB-26b）：`locator: { in: 'json-body' }` 的升级路由（会话 id 在连接后的 JSON 文本帧里，握手本身是不带体的 GET）逐帧处理——客户端把每个文本帧的虚拟 id 还原成真实 id 再按序转发，服务端对每个文本帧按共享表核对后才交给插件，`rewriteIds` 声明（或适配器的响应钩子）也会作用在下行文本帧上；query 定位的升级路由保持不透明字节直通。三路由的协议形状见 `docs/remote-access.md` 的「插件桥」一节；决策记录见 `docs/adr/0002`。
 
 浏览器侧没有新接口：拿到的仍是原生 `WebSocket`，感知不到隧道。升级无法转发时（未桥接、会话不可达等原因）浏览器看到的就是一次握手失败——子客户端在 socket 上回答与 HTTP 改道相同的 503 `zr-plugin-unbridged` 形状（reason 取值见上表），表现为 `error` / `close` 事件。
 

package/docs/remote-access.en.md

@@ -335,7 +335,7 @@ The `/v1/http` route is a second allowlist, keyed by **route name** (not part of
 - Terminals are deliberate (a desktop client is a trusted device): what opens is a **server-side** PTY running as the server user, without the agent sandbox or approval restrictions; closing the session's remote access kills its terminal streams with it;
 - `workspaceFiles/read` and friends are not contained to the session directory (DSH itself does not contain them) — anything the server process can read is readable, under the same trusted-device premise as terminals;
 - The plugin bridge's whole-machine data requires the server owner's per-plugin consent — the toggles in the settings page's Plugin bridge section, everything OFF by default; the loopback carries the operator's cookie, so a bridged plugin sees the same permissions the local browser sees. The bridge's boundary is therefore the DECLARED route set (exact equality, plus a `prefix: true` route's sub-paths under the PB-23b raw-byte tail red line) plus the share table — there is **no** parameter-level scanning;
-- **Adapters (better-sidebar)**: beyond cooperative declarations, zen-remote ships a built-in adapter for `dsh-better-sidebar` **the seven versions 0.25.0 through 0.28.2** (`src/adapters/` — non-cooperative third-party plugins are bridged by it, with prefix/path-segment route matching and session-id rewriting in JSON bodies and path segments). A prefix hit's tail passes the shape red line: `?`/`#`/`..` (encoded forms included) or whitespace answers 400 `bad-request` (PB-23b, the same rule as the cooperative segment). **Consenting to its whole-machine toggle hands the paired desktop client whole-disk file read/write on the server, git write operations (commit, push, revert, …), and model spend through commit-message generation** — the product decision is "both directions forward, no path fencing", and a server owner should treat that toggle as terminal-grade trust in the paired machine; `open.external` (launching processes on the host) refuses for remote sessions, `settings.*` and `/sidebar/bundle` stay on the sub-client's own machine; the two WebSockets (`/sidebar/ws/fs-watch` file-tree watch, `/sidebar/ws/agent-opens` open push) bridge over the byte tunnel (frames pass through untouched — the browser never reads the session id inside a push); side chat (`sidechat.*`) forwards — its child sessions carry `meta.parentSession`, so they inherit the parent's share through the ancestor chain, and the `childId` in `sidechat.start`'s answer is virtualized before it reaches the browser; 0.28's (alpha.0 and stable) `changes.ops` long-poll (`wait: true`, parks up to 25 s — past the relay's 15 s header wait) has `wait` stripped on the server, so a remote session's "this round's files" view polls on 0.26's 2.5 s cadence; 0.26's `ws/sidechat` push socket is **not** bridged — remote side chat falls back to 0.26's built-in 15s polling, correctness intact, only the push cadence degrades to polling; `sidechat.models` shows the **sub-client's own** model catalog in the picker while the choice goes through `sidechat.model` and takes effect on the **server** — when the two machines' catalogs differ, what the server actually applies is authoritative;
+- **Adapters (better-sidebar)**: beyond cooperative declarations, zen-remote ships a built-in adapter for `dsh-better-sidebar` **the seven versions 0.25.0 through 0.28.2** (`src/adapters/` — non-cooperative third-party plugins are bridged by it, with prefix/path-segment route matching and session-id rewriting in JSON bodies and path segments). A prefix hit's tail passes the shape red line: `?`/`#`/`..` (encoded forms included) or whitespace answers 400 `bad-request` (PB-23b, the same rule as the cooperative segment). **Consenting to its whole-machine toggle hands the paired desktop client whole-disk file read/write on the server, git write operations (commit, push, revert, …), and model spend through commit-message generation** — the product decision is "both directions forward, no path fencing", and a server owner should treat that toggle as terminal-grade trust in the paired machine; `open.external` (launching processes on the host) refuses for remote sessions, `settings.*` and `/sidebar/bundle` stay on the sub-client's own machine; the three WebSockets (`/sidebar/ws/fs-watch` file-tree watch, `/sidebar/ws/agent-opens` open push, `/sidebar/ws/sidechat` side-chat push) bridge over the byte tunnel — the first two carry the session id in their upgrade URL's query and their frames pass through untouched (the browser never reads the session id inside a push); `ws/sidechat`'s upgrade URL carries NO parameter at all — the ids ride the JSON text frames sent after the handshake (`{"op":"watch","threadIds":[…]}`), through the per-frame gate (PB-26b): the client rewrites every virtual id in a watch frame back to its real form before forwarding (an empty array = unsubscribe-all, passes verbatim), the server share-checks EVERY text frame before the plugin sees one (an unshared thread id never reaches the plugin — the connection dies), and the plugin's pushed `{"threadId":…}` top-level id is virtualized before it reaches the browser (better-sidebar's subscription comparison demands the exact virtual id); side chat (`sidechat.*`) forwards — its child sessions carry `meta.parentSession`, so they inherit the parent's share through the ancestor chain, and the `childId` in `sidechat.start`'s answer is virtualized before it reaches the browser; 0.28's (alpha.0 and stable) `changes.ops` long-poll (`wait: true`, parks up to 25 s — past the relay's 15 s header wait) has `wait` stripped on the server, so a remote session's "this round's files" view polls on 0.26's 2.5 s cadence; `sidechat.models` shows the **sub-client's own** model catalog in the picker while the choice goes through `sidechat.model` and takes effect on the **server** — when the two machines' catalogs differ, what the server actually applies is authoritative;
 - Concurrent streams are budgeted per device (32), and so are invokes kept in flight at once — past the per-device cap the invoke answers 429 `too-many-invokes`. Error codes shaped `*/internal` (`gateway/internal` and friends) are returned as the bare code with no message — that kind of message quotes server-side internals. Event answers are matched against the subscription and device they were forwarded to. Approval/question forwarding is **first come, first served**: whichever of the server's own UI and the sub-client answers first wins; the later answer is refused by the gateway and the client syncs to "already handled". The relay **never answers on the client's behalf**: an unshared session's approval/question events are not forwarded at all, and with the server's own UI offline too, the approval simply keeps waiting — the gateway re-delivers still-pending events to the next `$events` subscriber. A wait, never a rejection (an abstention would fail every pending approval of the session at once and break the push → wake → approve flow). Notification-type events (EMIT frames: session-list summaries, account expirations and other server-wide state) of an unshared session are never forwarded.
 
 
@@ -345,7 +345,7 @@ The `/v1/http` route is a second allowlist, keyed by **route name** (not part of
 | --- | --- | --- | --- |
 | New (has the 0.26 adapter) | 0.26 | 0.26 | Fully bridged; every new feature works |
 | New | 0.25 | 0.25 | Bridged as before; behavior identical to the previous release |
-| New | 0.25 | 0.26 | Bridged; the 0.26-only methods and `/sidebar/write` get 404 from the 0.25 server, `ws/sidechat` is refused so side chat falls back to 15s polling — single-feature degradation: core side chat works, no mis-routing, nothing written locally |
+| New | 0.25 | 0.26 | Bridged; the 0.26-only methods and `/sidebar/write` get 404 from the 0.25 server, and `ws/sidechat` dies on open (the 0.25 server has no such upgrade route) so side chat falls back to 15s polling — single-feature degradation: core side chat works, no mis-routing, nothing written locally |
 | New | 0.26 | 0.25 | Bridged; the UI never sends the new requests — equivalent to the 0.25 experience |
 | Old (≤ 2.2.1) | 0.26 | any | Not in the adapter's version table → unbridged (hidden treatment) |
 | Old | 0.25 | 0.26 | Bridged as 0.25; new methods are refused with the adapter's `adapter-method-unknown`, and `/sidebar/write` carrying a virtual id errors against the local plugin (no file written) — single-feature degradation |
@@ -388,7 +388,7 @@ A bridged plugin's panel request, rerouted by the sub-client's local backend (th
 
 ### The plugin bridge's WebSocket byte tunnel: `POST /v1/plugin-tunnel/{open,send,close}`
 
-Routes declared `upgrade: true` travel over these three (the declaration side is in `docs/plugin-bridge.md`). The relay **never parses WebSocket**: the server→browser direction is **one NDJSON streaming response**, the browser→server direction is **ordered chunked POSTs**, and both directions are opaque bytes — the real upgrade handshake (the 101 and every frame) is produced by the plugin route on the server machine and crosses the tunnel untouched (`docs/adr/0002`).
+Routes declared `upgrade: true` travel over these three (the declaration side is in `docs/plugin-bridge.md`). The relay **never parses WebSocket**: the server→browser direction is **one NDJSON streaming response**, the browser→server direction is **ordered chunked POSTs**, and both directions are opaque bytes — the real upgrade handshake (the 101 and every frame) is produced by the plugin route on the server machine and crosses the tunnel untouched (`docs/adr/0002`). One exception (PB-26b): a `locator: { in: 'json-body' }` upgrade route (better-sidebar's `ws/sidechat`) has a body-less GET for its handshake and carries its ids in the post-connection JSON text frames, so the share table has no packet to open at open time — such a tunnel's **upstream direction is split into RFC 6455 frames**, every text frame located and share-checked one by one (an unshared id answers 403 `not-shared` and tears the tunnel down; the frame NEVER reaches the plugin; an empty unsubscribe-all array and id-less frames pass), and the verified frames cross verbatim; the downstream direction stays opaque. Query-locator upgrade routes keep zero parsing overhead and unchanged behavior.
 
 | Route | Headers | Body | Success answer |
 | --- | --- | --- | --- |
@@ -472,6 +472,12 @@ npm test   # boots a mock upstream, runs the gateway/auth/push suites: proxy+inj
 
 ---
 
+## Troubleshooting: attach the debug report before screenshots
+
+When filing a GitHub issue, first click **Export diagnostics** at the very bottom of the plugin settings page **on the machine that misbehaves** and attach the downloaded JSON. It carries versions, role, config shapes (no addresses, no tokens), every interception/redirect diagnostic counter, the upload-redirect probe (`installedVia` tells whether the fetch-route wrap came in via inject or the fallback), and the last ~300 plugin event log lines (event codes and id shapes only — never conversation content), all passed through two redaction layers (absolute paths keep only their leaf, URL hostnames degrade to an address class, token-shaped runs are masked). Exporting from both the server and the sub-client is ideal. Remote devices **cannot** fetch this report through the gateway (refused by the via wall) — it exports locally only.
+
+---
+
 ## Layout
 
 | Path | Role |

package/docs/remote-access.md

@@ -372,7 +372,7 @@ sudo cloudflared service install      # 通了再装成常驻服务
 - 终端是有意开放的（桌面应用端是可信设备）：开的是**服务端**的 PTY，以服务端用户身份运行、不受智能体沙箱与审批限制；关闭会话的远程时终端流一并终止；
 - `workspaceFiles/read` 等文件预览接口不限制在会话目录内（DSH 自身就不限制），服务端进程可读的文件都能读——信任前提与终端相同；
 - 插件桥的整机数据需要主服务端主人逐插件同意——设置页「插件桥」里的开关，缺省全部关闭；回环执行带操作者 cookie，插件接口看到的权限与本机浏览器相同，因此桥接的边界就是声明登记的路径（exact 相等，`prefix: true` 路由含其子路径，前缀尾巴还要过 PB-23b 的原样字节形状红线）加会话共享表，**不做**参数级扫描；
-- **适配器（better-sidebar）**：协作声明之外，zen-remote 为 `dsh-better-sidebar` **0.25.0 至 0.28.2 的七个版本**内置了一个适配器（`src/adapters/`，不配合的第三方插件由它代为桥接，路由按前缀/路径段匹配、会话 id 在 JSON 体与路径段里改写）。前缀命中的尾巴过形状红线：`?`/`#`/`..`（含编码形态）或空白一律 400 `bad-request`（PB-23b，与协作段同一条）。**同意它的整机数据开关，等于让已配对的桌面应用端读写主服务端整盘文件、执行 git 写操作（提交、推送、回滚……），并通过提交信息生成消耗主服务端的模型额度**——产品上的决定就是「读写都接、不加路径围栏」，主服务端主人应当把它当成给对方一台本机终端级别的信任来开；`open.external`（在宿主机起进程）对远程会话拒绝，`settings.*` 与 `/sidebar/bundle` 留在子客户端本机；两条 WebSocket（`/sidebar/ws/fs-watch` 文件树监视、`/sidebar/ws/agent-opens` 打开推送）经字节隧道桥接（帧原样透传，浏览器不消费推送里的会话 id）；侧聊（`sidechat.*`）转发——侧聊子会话带 `meta.parentSession`，按祖先链自动继承父会话的共享，`sidechat.start` 响应里的 `childId` 会换算成虚拟 id 回给浏览器；0.28（alpha.0 与正式版）的 `changes.ops` 长轮询（`wait: true`，最长挂 25 秒，超过中继 15 秒的响应头等待）在服务端去掉 `wait`，远程会话的「本轮文件」退回 0.26 的 2.5 秒轮询；0.26 新增的 `ws/sidechat` 侧聊推送**不桥接**——远程侧聊走 0.26 自带的 15s 兜底轮询，正确性无损，只是推送降级为轮询节奏；`sidechat.models` 的模型选择器显示的是**子客户端本机**的模型目录，而选择经 `sidechat.model` 作用在**服务端**——两机目录不一致时以服务端实际生效为准；
+- **适配器（better-sidebar）**：协作声明之外，zen-remote 为 `dsh-better-sidebar` **0.25.0 至 0.28.2 的七个版本**内置了一个适配器（`src/adapters/`，不配合的第三方插件由它代为桥接，路由按前缀/路径段匹配、会话 id 在 JSON 体与路径段里改写）。前缀命中的尾巴过形状红线：`?`/`#`/`..`（含编码形态）或空白一律 400 `bad-request`（PB-23b，与协作段同一条）。**同意它的整机数据开关，等于让已配对的桌面应用端读写主服务端整盘文件、执行 git 写操作（提交、推送、回滚……），并通过提交信息生成消耗主服务端的模型额度**——产品上的决定就是「读写都接、不加路径围栏」，主服务端主人应当把它当成给对方一台本机终端级别的信任来开；`open.external`（在宿主机起进程）对远程会话拒绝，`settings.*` 与 `/sidebar/bundle` 留在子客户端本机；三条 WebSocket（`/sidebar/ws/fs-watch` 文件树监视、`/sidebar/ws/agent-opens` 打开推送、`/sidebar/ws/sidechat` 侧聊推送）经字节隧道桥接——前两条的升级 URL 带会话 query，帧原样透传（浏览器不消费推送里的会话 id）；`ws/sidechat` 的升级 URL 不带任何参数，会话 id 在连接建立后的 JSON 文本帧里（`{"op":"watch","threadIds":[…]}`），走逐帧闸门（PB-26b）：客户端把 watch 帧里的虚拟 id 逐个还原成真实 id 再转发（空数组 = 全部退订，原样放行），服务端对每个文本帧先按共享表核对、通过才交给插件（未共享的线程 id 到不了插件，连接即断），插件推回的 `{"threadId":…}` 顶层 id 换算回虚拟 id 才给浏览器（better-sidebar 的订阅比对要求虚拟 id 精确匹配）；侧聊（`sidechat.*`）转发——侧聊子会话带 `meta.parentSession`，按祖先链自动继承父会话的共享，`sidechat.start` 响应里的 `childId` 会换算成虚拟 id 回给浏览器；0.28（alpha.0 与正式版）的 `changes.ops` 长轮询（`wait: true`，最长挂 25 秒，超过中继 15 秒的响应头等待）在服务端去掉 `wait`，远程会话的「本轮文件」退回 0.26 的 2.5 秒轮询；`sidechat.models` 的模型选择器显示的是**子客户端本机**的模型目录，而选择经 `sidechat.model` 作用在**服务端**——两机目录不一致时以服务端实际生效为准；
 - 每台设备并发流数有上限（32）、同时在途的 invoke 数也有上限（32，超出 429 `too-many-invokes`）；`*/internal` 形状的错误码（`gateway/internal` 等）只回码不带消息——那类消息引用的是服务端内部细节。事件应答按「转发时的订阅 + 设备」核对归属。审批/提问的转发是**先到先得**：服务端自己的界面和子客户端谁先应答谁生效，后答的一方被网关拒绝、同步成「已处理」。中继**不代答**：未共享会话的审批/提问事件不会被转发，服务端界面也不在线时这个审批就一直等待——网关会把仍未应答的事件转交给下一个连上来的订阅，等，而不是替你拒绝（代答会把整批待审批一次性判死，砸掉「推送 → 唤醒 → 审批」链路）。未共享会话的**通知类**事件（EMIT 帧：会话列表摘要、账号到期之类的服务端全局状态）一律不转发；唯一的例外是已共享会话（含其子会话）的 `api-session/status`——它只描述单个会话的运行/空闲，逐帧按共享表判定，子客户端靠它在主机侧一轮开始或结束时同步运行状态徽标（断线期间的翻转由重连后补拉列表纠正）。
 
 
@@ -382,7 +382,7 @@ sudo cloudflared service install      # 通了再装成常驻服务
 | --- | --- | --- | --- |
 | 新（含 0.26 适配） | 0.26 | 0.26 | 全量桥接，新功能全可用 |
 | 新 | 0.25 | 0.25 | 照常桥接，行为与旧版一致 |
-| 新 | 0.25 | 0.26 | 桥接；0.26 新方法与 `/sidebar/write` 被 0.25 服务端 404、`ws/sidechat` 被拒后走 15s 轮询——单功能降级，核心侧聊通，不误路由不写本机 |
+| 新 | 0.25 | 0.26 | 桥接；0.26 新方法与 `/sidebar/write` 被 0.25 服务端 404，`ws/sidechat` 因 0.25 服务端没有该升级路由而开而即断、退回 15s 轮询——单功能降级，核心侧聊通，不误路由不写本机 |
 | 新 | 0.26 | 0.25 | 桥接；UI 不发新请求，等同 0.25 体验 |
 | 旧（≤ 2.2.1） | 0.26 | 任意 | 不在适配器版本表 → 未桥接隐藏档 |
 | 旧 | 0.25 | 0.26 | 按 0.25 桥接；新方法被适配器以 `adapter-method-unknown` 拒绝，`/sidebar/write` 带虚拟 id 落本机插件报错（不写文件）——单功能降级 |
@@ -425,7 +425,7 @@ sudo cloudflared service install      # 通了再装成常驻服务
 
 ### 插件桥的 WebSocket 字节隧道：`POST /v1/plugin-tunnel/{open,send,close}`
 
-声明 `upgrade: true` 的插件路由走这三条路由（声明侧见 `docs/plugin-bridge.md`）。中继**不解析 WebSocket**：服务端→浏览器方向是**一条 NDJSON 流式响应**，浏览器→服务端方向是**按序分块的普通 POST**，双向都是不透明字节——真正的升级握手（101 与每个帧）由插件路由在服务端本机完成，字节原样穿过隧道（`docs/adr/0002`）。
+声明 `upgrade: true` 的插件路由走这三条路由（声明侧见 `docs/plugin-bridge.md`）。中继**不解析 WebSocket**：服务端→浏览器方向是**一条 NDJSON 流式响应**，浏览器→服务端方向是**按序分块的普通 POST**，双向都是不透明字节——真正的升级握手（101 与每个帧）由插件路由在服务端本机完成，字节原样穿过隧道（`docs/adr/0002`）。唯一例外（PB-26b）：`locator: { in: 'json-body' }` 的升级路由（如 better-sidebar 的 `ws/sidechat`）的升级握手是不带体的 GET、会话 id 在连接后的 JSON 文本帧里，共享表没有开包可查——这类隧道的**上行方向按 RFC 6455 切帧**，每个文本帧先定位其会话 id、逐个按共享表核对（未共享的 id 回 403 `not-shared` 并拆隧道，帧绝不交给插件；空数组退订与无 id 帧放行），通过后帧原样写入上游；下行方向仍是不透明字节。query 定位的升级路由零解析开销，行为不变。
 
 | 路由 | 请求头 | 请求体 | 成功回答 |
 | --- | --- | --- | --- |
@@ -509,6 +509,12 @@ npm test   # 起 mock 上游，跑 gateway/auth/push 三组测试：反代与注
 
 ---
 
+## 🩺 排障：先要诊断包，再要截图
+
+反馈问题（GitHub issue）时，先在**出问题那台机器**的插件设置页最底部点「导出诊断信息」，把下载的 JSON 直接附上——它包含版本、角色、配置形态（不含地址与令牌）、全部拦截/改道诊断计数、上传改道探针（`installedVia` 能看出 fetch-route 是经 inject 还是兜底装的）、近 300 条插件事件日志（只记事件码与 id 形态，不含对话内容），并经过两层脱敏（绝对路径只留叶子、URL 主机名降级为地址类型、token 形态串打码）。主服务端与子客户端各导一份效果最好。远程设备经网关**拿不到**这份报告（via 墙拒绝）——它只能在本机导出。
+
+---
+
 ## 🗂️ 项目结构
 
 | 路径 | 作用 |

package/lan-gate.mjs

@@ -136,10 +136,17 @@ export function apply(ctx, config) {
         handle = null
         return
       }
+      // CU-1：spawn 成功回报（配置端口；网关遇端口被占会自行重试，最终端口
+      // 以 /lan-gate/status 为准）。可选回调，缺省或抛错都不影响子进程。
+      try { config?.gatewayEvent?.('spawn', { port: values.port }) } catch (e) { /* ignore */ }
       handle.done.then((outcome) => {
         console.log(`[dsh-zen-remote-gateway] gateway exited code=${outcome.exitCode} signal=${outcome.signal}`)
+        // CU-1：子进程生命周期回报给主入口的日志环（诊断导出用）。回调是可选
+        // 的（旧式独立加载没有它），且绝不能影响子进程自身的收尾。
+        try { config?.gatewayEvent?.('exit', { code: outcome.exitCode, signal: outcome.signal }) } catch (e) { /* ignore */ }
       }).catch((err) => {
         console.error(`[dsh-zen-remote-gateway] spawn failed: ${String(err && err.message || err)}`)
+        try { config?.gatewayEvent?.('exit', { error: String(err && err.message || err) }) } catch (e) { /* ignore */ }
       })
       if (timer) {
         // 子进程输出读两拍（T17b-fix）：1.5s 的一拍是老习惯，但网关遇到端口

package/lib/adapters/dsh-better-sidebar/index.js

@@ -15,8 +15,11 @@
  * model spend (commit-message generation), documented as such; NO path
  * fencing; `open.external` refuses for a remote session; `settings.*` and
  * `/sidebar/bundle` stay local; the adapter registers as whole-machine
- * data (consent per plugin, default off). PB-15: the 0.26.0 WebSocket
- * `/sidebar/ws/sidechat` is deliberately NOT declared (not bridged).
+ * data (consent per plugin, default off). PB-15 left the 0.26.0 WebSocket
+ * `/sidebar/ws/sidechat` undeclared; PB-26b bridges it — its ids ride the
+ * post-handshake JSON frames (`{"op":"watch","threadIds":[...]}`), which
+ * the json-body upgrade gate locates, classifies and rewrites frame by
+ * frame on both halves.
  *
  * The `cwd` handling is the one subtle part: better-sidebar resolves a
  * request's working directory as the session's own `header.cwd` first and
@@ -143,6 +146,16 @@ export const dshBetterSidebarAdapter = {
         // file paths, not session ids).
         { path: '/sidebar/ws/agent-opens', match: 'exact', methods: ['GET'], upgrade: true, locator: { in: 'query', name: 'sessionId' } },
         { path: '/sidebar/ws/fs-watch', match: 'exact', methods: ['GET'], upgrade: true, locator: { in: 'query', name: 'sessionId' } },
+        // The side-chat push feed (PB-26b; lib/index.js's third registerUpgrade):
+        // the upgrade URL carries NO query — the browser's first frame after the
+        // handshake is `{"op":"watch","threadIds":[...]}` and the plugin pushes
+        // `{"threadId":"..."}` per event. The json-body locator rides the FRAME
+        // gate: the client half classifies and rewrites every watch frame (an
+        // empty list — unsubscribe-all — crosses untouched), the server's send
+        // gate share-checks each frame before the plugin sees it, and the
+        // client.response hook below virtualizes the pushed threadId so the
+        // browser's `wantedRef.includes(frame.threadId)` comparison fires.
+        { path: '/sidebar/ws/sidechat', match: 'exact', methods: ['GET'], upgrade: true, locator: { in: 'json-body', fields: ['threadIds'] } },
     ],
     client: {
         request: (ctx) => {
@@ -158,6 +171,22 @@ export const dshBetterSidebarAdapter = {
             return { allow: true };
         },
         response: (ctx) => {
+            // PB-26b: the sidechat ws PUSH frames name their thread on the TOP
+            // level — `{"threadId":"<real id>"}`. The browser compares
+            // `wantedRef.current.includes(frame.threadId)` against the VIRTUAL ids
+            // it watched, so a real id here would silently miss every push; the
+            // virtualized form rides in its place. A frame with no usable tid (a
+            // non-object, or an id that is already virtual) crosses untouched.
+            if (ctx.pathname === '/sidebar/ws/sidechat') {
+                if (ctx.body !== null && typeof ctx.body === 'object' && !Array.isArray(ctx.body)) {
+                    const record = ctx.body;
+                    const tid = record.threadId;
+                    if (typeof tid === 'string' && tid !== '' && !ctx.isVirtual(tid)) {
+                        return { ...record, threadId: ctx.virtualize(tid) };
+                    }
+                }
+                return ctx.body;
+            }
             const name = apiMethodOf(ctx.pathname);
             if (name === '')
                 return ctx.body;

package/lib/adapters/dsh-better-sidebar/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/dsh-better-sidebar/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEnE;;kCAEkC;AAClC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE1C,mEAAmE;AACnE,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;AAErF,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACpD,MAAM,EAAE,oBAAoB;IAC5B,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,mEAAmE;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,+DAA+D;IAC/D,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACxF,2EAA2E;IAC3E,yEAAyE;IACzE,8EAA8E;IAC9E,6CAA6C;IAC7C,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,QAAQ,EAAE;QACR,gBAAgB,EAAE,uBAAuB;QACzC,kBAAkB,EAAE,0CAA0C;QAC9D,kBAAkB,EAAE,kDAAkD;QACtE,kBAAkB,EAAE,0CAA0C;KAC/D;IACD,MAAM,EAAE;QACN;YACE,iEAAiE;YACjE,8DAA8D;YAC9D,iCAAiC;YACjC,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE;YAC/E,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,EAAE;oBAAE,OAAO,SAAS,CAAA;gBACjC,mEAAmE;gBACnE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,oEAAoE;gBACpE,yCAAyC;gBACzC,IAAI,IAAI,KAAK,eAAe,IAAI,gBAAgB,KAAK,SAAS,IAAI,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC9F,OAAO,yBAAyB,CAAA;gBAClC,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;SACF;QACD,uEAAuE;QACvE,qEAAqE;QACrE,uDAAuD;QACvD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACxG,iDAAiD;QACjD,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QAC3G,uEAAuE;QACvE,6BAA6B;QAC7B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACtI,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,yBAAyB;QACzB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACrI,qEAAqE;QACrE,kEAAkE;QAClE,oEAAoE;QACpE,uEAAuE;QACvE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvG,gEAAgE;QAChE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACxH,wEAAwE;QACxE,gEAAgE;QAChE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjI,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;KAC/H;IACD,MAAM,EAAE;QACN,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,iEAAiE;YACjE,iEAAiE;YACjE,sDAAsD;YACtD,IAAI,IAAI,KAAK,eAAe;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAA;YACxF,qEAAqE;YACrE,IAAI,IAAI,KAAK,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;YACjH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;QACD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAA;YAChC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAA;YACrE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,6BAA6B;YAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAChH,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;oBAC/C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBACzC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvH,MAAM,MAAM,GAAG,GAAG,CAAC,IAA+B,CAAA;gBAClD,wEAAwE;gBACxE,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,aAAa,IAAI,MAAM,IAAI,MAAM,CAAA;gBACjF,IAAI,KAAK,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;oBAC9B,OAAO,QAAQ,CAAC,GAAG,CAAA;oBACnB,IAAI,SAAS;wBAAE,OAAO,QAAQ,CAAC,IAAI,CAAA;oBACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;KACF;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/dsh-better-sidebar/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAEnE;;kCAEkC;AAClC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE1C,mEAAmE;AACnE,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;AAErF,MAAM,CAAC,MAAM,uBAAuB,GAAkB;IACpD,MAAM,EAAE,oBAAoB;IAC5B,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,mEAAmE;IACnE,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,kEAAkE;IAClE,qEAAqE;IACrE,+DAA+D;IAC/D,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;IACxF,2EAA2E;IAC3E,yEAAyE;IACzE,8EAA8E;IAC9E,6CAA6C;IAC7C,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,QAAQ,EAAE;QACR,gBAAgB,EAAE,uBAAuB;QACzC,kBAAkB,EAAE,0CAA0C;QAC9D,kBAAkB,EAAE,kDAAkD;QACtE,kBAAkB,EAAE,0CAA0C;KAC/D;IACD,MAAM,EAAE;QACN;YACE,iEAAiE;YACjE,8DAA8D;YAC9D,iCAAiC;YACjC,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE;YAC/E,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;gBAClC,IAAI,IAAI,KAAK,EAAE;oBAAE,OAAO,SAAS,CAAA;gBACjC,mEAAmE;gBACnE,4DAA4D;gBAC5D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,oEAAoE;gBACpE,yCAAyC;gBACzC,IAAI,IAAI,KAAK,eAAe,IAAI,gBAAgB,KAAK,SAAS,IAAI,SAAS,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC9F,OAAO,yBAAyB,CAAA;gBAClC,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC;SACF;QACD,uEAAuE;QACvE,qEAAqE;QACrE,uDAAuD;QACvD,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACxG,iDAAiD;QACjD,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QAC3G,uEAAuE;QACvE,6BAA6B;QAC7B,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACtI,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,yBAAyB;QACzB,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACrI,qEAAqE;QACrE,kEAAkE;QAClE,oEAAoE;QACpE,uEAAuE;QACvE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvG,gEAAgE;QAChE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACxH,wEAAwE;QACxE,gEAAgE;QAChE,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,gCAAgC;QAChC,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjI,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QAC9H,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE;KACvI;IACD,MAAM,EAAE;QACN,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,iEAAiE;YACjE,iEAAiE;YACjE,sDAAsD;YACtD,IAAI,IAAI,KAAK,eAAe;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAA;YACxF,qEAAqE;YACrE,IAAI,IAAI,KAAK,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;YACjH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;QACD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,mEAAmE;YACnE,2DAA2D;YAC3D,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gBAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClF,MAAM,MAAM,GAAG,GAAG,CAAC,IAA+B,CAAA;oBAClD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAA;oBAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjE,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAA;oBACrD,CAAC;gBACH,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,CAAA;YACjB,CAAC;YACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACtC,IAAI,IAAI,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAA;YAChC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAA;YACrE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;KACF;IACD,MAAM,EAAE;QACN,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACf,kEAAkE;YAClE,kEAAkE;YAClE,8DAA8D;YAC9D,6BAA6B;YAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,QAAQ,KAAK,iBAAiB,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;gBAChH,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;oBAClC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;oBAC/C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBACzC,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YACxB,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvH,MAAM,MAAM,GAAG,GAAG,CAAC,IAA+B,CAAA;gBAClD,wEAAwE;gBACxE,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,aAAa,IAAI,MAAM,IAAI,MAAM,CAAA;gBACjF,IAAI,KAAK,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,CAAA;oBAC9B,OAAO,QAAQ,CAAC,GAAG,CAAA;oBACnB,IAAI,SAAS;wBAAE,OAAO,QAAQ,CAAC,IAAI,CAAA;oBACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,CAAC;KACF;CACF,CAAA"}

package/lib/client-pairing.js

@@ -28,6 +28,16 @@ function isHttpAllowedHost(hostname) {
         return isAllowedIpv6(hostname);
     return isAllowedIpv4(hostname);
 }
+/**
+ * Whether one hostname sits in a private/loopback network — the same verdict
+ * {@link isHttpAllowedHost} applies inside `normalizeServerUrl`, exported for
+ * the debug report's serverUrl shaper (CU-2): the one place outside the
+ * normalizer that needs the private-network fact, kept here so the address
+ * classes can never drift apart from what pairing actually accepts.
+ */
+export function isPrivateNetworkHost(hostname) {
+    return isHttpAllowedHost(hostname);
+}
 /** Dotted-quad check against the allowed ranges. The hostname comes from a
  * parsed URL, so it is already canonical (the WHATWG parser folds exotic
  * spellings like `010.0x0A.0.3` into plain decimal before we ever see it). */

package/lib/client-pairing.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-pairing.js","sourceRoot":"","sources":["../src/client-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAExD;8EAC8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAU5D;;;gEAGgE;AAChE,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC1D,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED;;8EAE8E;AAC9E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,0BAA0B;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,iBAAiB;IACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;mEAEmE;AACnE,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,OAAO,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,CAAA;AACrF,CAAC;AAED;;0EAE0E;AAC1E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAwB,EAAE;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC7C,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACtE,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAClH,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;IACrH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAChD,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACnD,CAAC;AAqBD,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,IAAa;IACjE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9E,CAAC,CAAC,IAA+B;QACjC,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC1D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;SAClC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAA;IAC9G,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;YAClG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AAC1C,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,aAAa,CAAA;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjG,CAAC,CAAE,MAAM,CAAC,IAAgC;YAC1C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACrH,CAAC,CAAE,IAAI,CAAC,KAAiC;YACzC,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAAE,OAAO,YAAY,CAAA;QACnF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACnG,CAAC,CAAE,MAAM,CAAC,IAAgC,CAAC,MAAM;YACjD,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,YAAY,CAAA;IAClD,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"client-pairing.js","sourceRoot":"","sources":["../src/client-pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAExD;8EAC8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAU5D;;;gEAGgE;AAChE,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAC1D,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAA;AACpC,CAAC;AAED;;8EAE8E;AAC9E,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,KAAK,GAAG,GAAG;YAAE,OAAO,KAAK,CAAA;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAA;IACxD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,0BAA0B;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IACjE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,iBAAiB;IACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA,CAAC,gBAAgB;IAClE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;mEAEmE;AACnE,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACtG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACvB,OAAO,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,CAAA;AACrF,CAAC;AAED;;0EAE0E;AAC1E,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAwB,EAAE;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC7C,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3E,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACtE,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAClH,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;IAC7F,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;IACrH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACtC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAChD,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACnD,CAAC;AAqBD,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,IAAa;IACjE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9E,CAAC,CAAC,IAA+B;QACjC,CAAC,CAAC,EAAE,CAAA;IACN,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;QAC1D,OAAO;YACL,EAAE,EAAE,IAAI;YACR,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;SAClC,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACxC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAA;IAC9G,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC1F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC;YAClG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;YAClC,CAAC,CAAC,CAAC,CAAA;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAA;IACpD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;AAC1C,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,aAAa,CAAA;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACjG,CAAC,CAAE,MAAM,CAAC,IAAgC;YAC1C,CAAC,CAAC,SAAS,CAAA;QACb,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YACrH,CAAC,CAAE,IAAI,CAAC,KAAiC;YACzC,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;YAAE,OAAO,YAAY,CAAA;QACnF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACnG,CAAC,CAAE,MAAM,CAAC,IAAgC,CAAC,MAAM;YACjD,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,YAAY,CAAA;IAClD,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC"}