dsh-zen-remote 2.3.6 → 2.3.8

package/src/client/styles/misc.css.ts

@@ -125,4 +125,42 @@ export const MISC_CSS = `  /* ---------- hero composer on mobile ----------
     display: none !important;
   }
 }
+
+/* ---------- tablet standalone PWA: pay the safe area above 1023px ---------- */
+/* The gateway serves viewport-fit=cover to every non-desktop device (see
+   coverViewport in lan-gate-server), phone-chrome only manages the meta at
+   <=1023px, and every compensation rule in layout.css lives behind the same
+   1023px breakpoint and the data-mobile-nav frame marker MobileNavOverlay
+   only sets there. A wide tablet's home-screen PWA — iPad landscape, the
+   12.9"/13" iPad portrait at exactly 1024, Android tablets — therefore
+   painted under the status bar with nothing paying the inset: the top row
+   of controls sat in the system area and was hard to tap.
+
+   Anchor: the official AppFrame (ui-layout AppFrame.tsx) is the direct
+   parent of the [data-shell-overlay] layer — the same element
+   MobileNavOverlay's findFrame() resolves — and the frame already pads
+   ITSELF for the Windows titlebar (padding-top: --dsh-windows-titlebar-height
+   in AppFrame.module.css), so padding the frame is the host's own pattern
+   for system bars.
+
+   Structural no-op everywhere else, by construction:
+   - display-mode: standalone matches only an installed PWA; desktop
+     browsers report browser.
+   - The Electron app never receives this stylesheet at all (the
+     isDesktopShell gate in client/index.tsx) and never gets cover.
+   - env() insets are hard 0 in every desktop browser, so even a browser
+     that somehow matched the media query computes 0px padding; on iPads
+     the bottom inset is 0 too (no home indicator) — the bottom line only
+     ever pays out on Android tablets with a gesture/nav bar.
+   box-sizing is load-bearing (the S2.1 lesson, see the frame rule in
+   layout.css): the official frame is height:100% content-box, and padding
+   without border-box would grow it past the viewport instead of reserving
+   the strip. Pinned by scripts/check-tablet-safe-area.mjs. */
+@media (min-width: 1024px) and (display-mode: standalone) {
+  :has(> [data-shell-overlay]) {
+    box-sizing: border-box !important;
+    padding-top: var(--mnav-sat) !important;
+    padding-bottom: var(--mnav-sab) !important;
+  }
+}
 `

package/src/client-data/remote-drop.ts

@@ -125,3 +125,106 @@ export function decideRemoteDrop(input: RemoteDropInput): RemoteDropDecision {
 export function rewrapFiles(files: Iterable<File>): File[] {
   return Array.from(files, (file) => new File([file], file.name, { type: file.type, lastModified: file.lastModified }))
 }
+
+// ---------------------------------------------------------------------------
+// AU-1: the intake decision — the same three gates extended to the picker
+// (hidden file input's `change`) and paste entries. issue #49: the drop guard
+// alone left those two entries on the zero-copy path chip, so a REMOTE
+// session's attachment named a file on the sub-client's disk. The decision
+// keeps the drop semantics frozen in `decideRemoteDrop` (its truth table is a
+// regression pin) and answers the two new entries here, where the fix's
+// minimal-intervention rule can be expressed: only a file that CARRIES a path
+// and is NOT an image takes the bad zero-copy branch (addFiles), so only
+// those are worth intercepting — pathless and image files already upload
+// bytes and must stay untouched.
+// ---------------------------------------------------------------------------
+
+/** Which entry an intake item arrived through. `drop` keeps the redispatch
+ * semantics of {@link decideRemoteDrop} (any file intervenes); `picker` /
+ * `paste` intervene only on the path-carrying non-image files. */
+export type RemoteIntakeEntry = 'drop' | 'picker' | 'paste'
+
+/** One intake item, reduced to what the decision needs. `hasPath` is the
+ * bridge's `pathFor(file) !== ''` — the same fact the host's zero-copy
+ * branch keys on; `isImage` is `file.type` starting with `image/` (the
+ * host's own image classification). A `paste` item with no file behind it
+ * never becomes a descriptor (the effect only collects `kind: 'file'`
+ * clipboard items), so plain-text paste arrives as an EMPTY list. */
+export interface RemoteIntakeDescriptor {
+  entry: RemoteIntakeEntry
+  isDirectory: boolean
+  hasPath: boolean
+  isImage: boolean
+}
+
+/** Everything the intake decision may look at — the same three gates as
+ * {@link decideRemoteDrop}, injectable so no DOM is needed. */
+export interface RemoteIntakeInput {
+  /** `__DSH_HOST_PATHS__` exists — the Electron preload's zero-copy bridge. */
+  hasHostPaths: boolean
+  /** The currently open session id, or `undefined` when no signal. */
+  currentSessionId: string | undefined
+  /** `event.isTrusted` — the re-entry guard for our redispatched events. */
+  trusted: boolean
+  /** Descriptor per collected file. `undefined` means the caller could not
+   * even enumerate the items — with no inventory there is nothing safe to
+   * judge, so this passes through (today's behavior). */
+  items: readonly RemoteIntakeDescriptor[] | undefined
+}
+
+export type RemoteIntakeAction = 'passthrough' | 'redirect' | 'block-directories'
+
+/** Stable machine-readable why, one per branch, ordered by the gate sequence
+ * in {@link decideRemoteIntake}. */
+export type RemoteIntakeReason =
+  | 'untrusted-event'
+  | 'no-host-paths'
+  | 'not-remote-session'
+  | 'no-entry-api'
+  | 'contains-directory'
+  | 'no-files'
+  | 'no-path-or-image-only'
+  | 'remote-path-files'
+
+export interface RemoteIntakeDecision {
+  action: RemoteIntakeAction
+  reason: RemoteIntakeReason
+}
+
+/**
+ * The three gates, then the intervention rule. The gates are decideRemoteDrop's
+ * verbatim (all must affirmatively pass — a missing signal reads as local and
+ * never intervenes); the rule after them:
+ * 1. `items === undefined` — no inventory, pass through (`no-entry-api`;
+ *    deciding blind could eat a working flow);
+ * 2. any directory — `block-directories`, ahead of every redirect: a folder
+ *    cannot be fixed by single-file upload, the whole intake is stopped with
+ *    a toast (same semantics as the drop branch);
+ * 3. no items at all — passthrough (`no-files`; the plain-text paste shape);
+ * 4. otherwise — `redirect` when ANY item is a `drop` item (the frozen
+ *    "any file intervenes" semantics) or carries a path while not being an
+ *    image (the zero-copy bad branch — exactly what issue #49 broke on);
+ *    `no-path-or-image-only` passthrough when none does.
+ *
+ * Drop-entry parity pin: a `drop` item's intervention semantics here are
+ * kept EQUIVALENT to `decideRemoteDrop` — same gates, directory rule and
+ * "any file intervenes" — with exactly ONE deliberate divergence: when
+ * `items === undefined`, `decideRemoteDrop` redispatches (a drop always has
+ * a Files payload worth re-shaping) while this function passes through
+ * (`no-entry-api` — an intake caller that cannot even enumerate its items
+ * must not be intercepted blind). If either function's gate sequence or
+ * drop-entry rule changes, update the other in the same commit; the truth
+ * tables in scripts/check-remote-drop.mjs pin both sides.
+ */
+export function decideRemoteIntake(input: RemoteIntakeInput): RemoteIntakeDecision {
+  if (!input.trusted) return { action: 'passthrough', reason: 'untrusted-event' }
+  if (!input.hasHostPaths) return { action: 'passthrough', reason: 'no-host-paths' }
+  if (!isRemoteSessionId(input.currentSessionId)) return { action: 'passthrough', reason: 'not-remote-session' }
+  if (input.items === undefined) return { action: 'passthrough', reason: 'no-entry-api' }
+  if (input.items.some((item) => item.isDirectory)) return { action: 'block-directories', reason: 'contains-directory' }
+  if (input.items.length === 0) return { action: 'passthrough', reason: 'no-files' }
+  const intervenes = input.items.some((item) => item.entry === 'drop' || (item.hasPath && !item.isImage))
+  return intervenes
+    ? { action: 'redirect', reason: 'remote-path-files' }
+    : { action: 'passthrough', reason: 'no-path-or-image-only' }
+}

package/src/client-data/settings-form.ts

@@ -97,6 +97,9 @@ export const CLIENT_CLAIM_ROUTE = '/_dsh/zen-remote/client/claim'
 export const CLIENT_STATUS_ROUTE = '/_dsh/zen-remote/client/status'
 /** T43: one immediate reconnect — answered 409 unless the client is offline. */
 export const CLIENT_RECONNECT_ROUTE = '/_dsh/zen-remote/client/reconnect'
+/** CU-4: the redacted diagnostic report (GET, both roles, machine-local only
+ * — a gateway-forwarded fetch is refused server-side). */
+export const CLIENT_DEBUG_REPORT_ROUTE = '/_dsh/zen-remote/client/debug-report'
 
 /** The lightweight client-facing config route (host half, both roles): the
  * settings page's FALLBACK role probe (T17) — it registers wherever a

package/src/client-pairing.ts

@@ -39,6 +39,17 @@ function isHttpAllowedHost(hostname: string): boolean {
   return isAllowedIpv4(hostname)
 }
 
+/**
+ * Whether one hostname sits in a private/loopback network — the same verdict
+ * {@link isHttpAllowedHost} applies inside `normalizeServerUrl`, exported for
+ * the debug report's serverUrl shaper (CU-2): the one place outside the
+ * normalizer that needs the private-network fact, kept here so the address
+ * classes can never drift apart from what pairing actually accepts.
+ */
+export function isPrivateNetworkHost(hostname: string): boolean {
+  return isHttpAllowedHost(hostname)
+}
+
 /** Dotted-quad check against the allowed ranges. The hostname comes from a
  * parsed URL, so it is already canonical (the WHATWG parser folds exotic
  * spellings like `010.0x0A.0.3` into plain decimal before we ever see it). */

package/src/client-routes.ts

@@ -25,10 +25,13 @@
  */
 
 import type { IncomingMessage, ServerResponse } from 'node:http'
+import { homedir } from 'node:os'
 import type { AdminAdmission } from './admin-routes.js'
 import { classifyClaimResponse, classifyProbe, CLAIM_PATH, normalizeServerUrl, RELAY_PING_PATH } from './client-pairing.js'
 import type { ClaimOutcome, ProbeState } from './client-pairing.js'
-import { unwrapVolatile } from './config.js'
+import { readFileConfig, resolveConfig, unwrapVolatile } from './config.js'
+import { assembleDebugReport } from './debug-report.js'
+import type { LogRingEntry } from './log-ring.js'
 import type { FetchRouteInterceptDiagnostics } from './fetch-route-intercept.js'
 import type { CurrentSessionRead, InterceptDiagnostics } from './intercept.js'
 import type { PluginRouteInterceptDiagnostics } from './plugin-route-intercept.js'
@@ -37,6 +40,7 @@ import type { BridgeStatus } from './plugin-bridge.js'
 import { RELAY_HTTP_ROUTES } from './relay-access.js'
 import { relayCredentialsDigest, RelayError } from './relay-client.js'
 import type { RelayClient, RelayHttpResult } from './relay-client.js'
+import { resolveDshVersion } from './relay-server.js'
 import { fromVirtual } from './virtual-id.js'
 
 /** Prefix all client routes live under (one webServer prefix registration). */
@@ -80,6 +84,15 @@ export const CLIENT_NETWORK_HINT_ROUTE = `${CLIENT_ROUTE_PREFIX}/network-hint`
  * closed:{}}` conclusion. It carries no token and no server address. */
 export const CLIENT_REMOTE_STATUS_ROUTE = `${CLIENT_ROUTE_PREFIX}/remote-status`
 
+/** GET: the redacted diagnostic report (CU-3, SPEC 方案 C) — `_meta`,
+ * `config`, `status`, optional `gateway`, `logs` plates, assembled by
+ * {@link assembleDebugReport} and safe to paste into a GitHub issue. Mounted
+ * on BOTH roles (each answers its own report); a request that arrived
+ * through the gateway is refused BEFORE dispatch (the wizard's via wall) —
+ * diagnostics are a machine-local export, and the gateway must never be able
+ * to fetch this machine's report for its own device table either. */
+export const CLIENT_DEBUG_REPORT_ROUTE = `${CLIENT_ROUTE_PREFIX}/debug-report`
+
 /** POST `{sessionId: <虚拟 id>}`: close one remote session from THIS machine
  * (T34) — the backend forwards the ORIGINAL id through the relay's
  * `POST relay/v1/unshare`, so the server closes it with reason `'client'`. */
@@ -172,6 +185,20 @@ export interface ClientHandlerOptions {
    * a client handler WITHOUT the sink answers the same 404 (no sink, no
    * route). */
   onCurrentSession?: (read: CurrentSessionRead) => void
+  /** CU-3, the debug-report route's inputs — all optional; the route answers
+   * its 404-shaped refusal without them (an unwired composition must not
+   * pretend to have diagnostics). Wired on BOTH role mounts.
+   *
+   * The log ring's snapshot (CU-1), oldest first. */
+  getLogSnapshot?: () => readonly LogRingEntry[]
+  /** The gateway child's summary plate (HOST mount only): liveness, port,
+   * device and share counts — counts, never tokens. May be async (it probes
+   * the gateway's own status). */
+  getGatewaySummary?: () => Record<string, unknown> | Promise<Record<string, unknown>>
+  /** The profile context's display name, when the composition has one. */
+  getProfileName?: () => string | undefined
+  /** This package's own version, read at module load in src/index.ts. */
+  getPluginVersion?: () => string
 }
 
 export type ClientHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>
@@ -396,6 +423,103 @@ function remoteStatusStateOf(relay: RelayClient | undefined): 'online' | 'offlin
   }
 }
 
+/**
+ * The status route's body, computed exactly as the CLIENT_STATUS_ROUTE
+ * branch always has — extracted (CU-3) so the debug-report route can embed
+ * the same diagnostics aggregation without a second implementation. All
+ * reads are live per call: volatile row fields, the interception getters,
+ * the relay client's current state. May await one bounded probe or connect
+ * (never longer than the probe timeout).
+ */
+async function statusBodyOf(options: ClientHandlerOptions): Promise<Record<string, unknown>> {
+  const fetchImpl: FetchLike = options.fetchImpl ?? ((url, init) => fetch(url, init))
+  // The typert interception's view (T23b-1) rides on EVERY status
+  // answer, whatever the connection state — the settings surface needs
+  // it to explain a refused install even while unpaired. The interface
+  // compat verdict (T42) appears once there is something to report: a
+  // stored comparison from the relay client's last handshake, or any
+  // incompatible call the interceptor recorded. Absent otherwise —
+  // nothing to show, and the settings block presence-gates on exactly
+  // that.
+  const intercept = options.getIntercept?.()
+  const fetchRouteIntercept = options.getFetchRouteIntercept?.()
+  const serviceProbe = options.getServiceProbe?.()
+  const pluginRouteIntercept = options.getPluginRouteIntercept?.()
+  const compatRelay = options.getRelayClient?.()
+  const compat =
+    compatRelay?.compat !== undefined || (intercept?.incompatibleCalls.length ?? 0) > 0
+      ? {
+          identical: compatRelay?.compat?.identical ?? [],
+          different: compatRelay?.compat?.different ?? [],
+          unavailable: compatRelay?.compat?.unavailable ?? [],
+          incompatibleCalls: intercept?.incompatibleCalls ?? [],
+        }
+      : undefined
+  const withDiagnostics = (body: Record<string, unknown>): Record<string, unknown> => {
+    // PB-2: the per-plugin bridge verdict rides EVERY status answer —
+    // the settings surface explains a not-bridged plugin whatever the
+    // connection state (unpaired reads all-offline, the honest verdict).
+    let next: Record<string, unknown> = { ...body, pluginBridge: options.getPluginBridgeStatus?.() ?? [] }
+    if (intercept !== undefined) next = { ...next, intercept }
+    if (fetchRouteIntercept !== undefined) next = { ...next, fetchRouteIntercept }
+    if (serviceProbe !== undefined) next = { ...next, serviceProbe }
+    if (pluginRouteIntercept !== undefined) next = { ...next, pluginRouteIntercept }
+    return compat === undefined ? next : { ...next, compat }
+  }
+  // The ROW decides its own two shapes first, per request (both fields
+  // are volatile { get() } wrappers — only the row object apply()
+  // received is a live source): without both credentials nothing is
+  // paired, and a stored address that no longer normalizes must never
+  // see the token (T16-fix).
+  const row = options.getRowConfig()
+  const record = row !== null && typeof row === 'object' && !Array.isArray(row) ? row as Record<string, unknown> : {}
+  const serverUrl = stringOrEmpty(unwrapVolatile(record.serverUrl)).trim()
+  const token = stringOrEmpty(unwrapVolatile(record.deviceToken))
+  if (token === '' || serverUrl === '') {
+    return withDiagnostics({ state: 'unpaired' })
+  }
+  const normalized = normalizeServerUrl(serverUrl)
+  if (!normalized.ok) {
+    return withDiagnostics({ state: 'invalid-url' })
+  }
+  const relay = options.getRelayClient?.()
+  if (relay === undefined) {
+    // T16 shape: no relay client wired — the ping probe is the answer.
+    const state = await probe(fetchImpl, normalized.url, token)
+    return withDiagnostics({ state, serverUrl: normalized.url })
+  }
+  // The cached verdict is trusted only over the EXACT credentials the
+  // handshake earned it with: an online state whose digest no longer
+  // matches the row (address edited, re-pair) is an answer about a
+  // DIFFERENT server and falls through to a live connect instead
+  // (T23a-fix). The token never enters this body — the digest is a
+  // one-way sha256 prefix computed on both sides.
+  if (
+    relay.state === 'online' &&
+    relay.handshakeInfo !== undefined &&
+    relay.lastHandshakeDigest !== undefined &&
+    relay.lastHandshakeDigest === relayCredentialsDigest(normalized.url, token)
+  ) {
+    return withDiagnostics(deviceStatusBody(relay.state, relay.handshakeInfo, normalized.url, relay.deviceNameSyncing))
+  }
+  // Everything else — never connected, offline, connecting, revoked,
+  // stale credentials — gets ONE live connect bounded by the probe
+  // timeout; its FRESH result is the answer, never the possibly stale
+  // cached state. A failed attempt additionally carries the relay
+  // client's reconnect machinery readout (T43): when the next
+  // automatic retry fires and which code failed last — both free of
+  // credential material by contract.
+  try {
+    const info = await withProbeTimeout(relay.connect())
+    return withDiagnostics(deviceStatusBody('online', info, normalized.url, relay.deviceNameSyncing))
+  } catch (error) {
+    const body: Record<string, unknown> = { state: probeStateOfRelayError(error), serverUrl: normalized.url }
+    if (relay.nextRetryAt !== null && relay.nextRetryAt !== undefined) body.nextRetryAt = relay.nextRetryAt
+    if (relay.lastError !== undefined) body.lastError = relay.lastError
+    return withDiagnostics(body)
+  }
+}
+
 /**
  * Build the client route handler for one plugin row. The returned handler
  * owns the full response lifecycle of every request under
@@ -416,10 +540,24 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
     const route = new URL(req.url ?? '/', 'http://dsh.internal').pathname
     const method = req.method ?? 'GET'
     try {
-      // The host mount's least-exposure wall (T41a-fix2): only remote-status
-      // exists here, and it sits BEHIND the admission wall like every other
-      // route. The shape of the refusal matches the unknown-path fallthrough.
-      if (options.remoteStatusOnly === true && route !== CLIENT_REMOTE_STATUS_ROUTE) {
+      // CU-3: the debug-report route's via wall, BEFORE any dispatch (the
+      // wizard's rule): a request wearing the gateway's marker arrived from
+      // a remote device, and a forwarded request presents as same-origin
+      // (the gateway rewrites Origin/Host) — the marker is the only honest
+      // signal. The report is a machine-local export; the gateway must
+      // never be able to fetch this machine's diagnostics either.
+      if (route === CLIENT_DEBUG_REPORT_ROUTE && req.headers['x-zen-remote-via'] !== undefined) {
+        responseJson(res, 403, {
+          ok: false,
+          error: { code: 'via-gateway', message: '诊断报告只能在本机导出' },
+        })
+        return
+      }
+      // The host mount's least-exposure wall (T41a-fix2): remote-status and
+      // the debug report (CU-3, both roles answer their own) exist here,
+      // and both sit BEHIND the admission wall like every other route. The
+      // shape of the refusal matches the unknown-path fallthrough.
+      if (options.remoteStatusOnly === true && route !== CLIENT_REMOTE_STATUS_ROUTE && route !== CLIENT_DEBUG_REPORT_ROUTE) {
         responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown client route' } })
         return
       }
@@ -485,95 +623,63 @@ export function createClientHandler(options: ClientHandlerOptions): ClientHandle
           responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET' } })
           return
         }
-        // The typert interception's view (T23b-1) rides on EVERY status
-        // answer, whatever the connection state — the settings surface needs
-        // it to explain a refused install even while unpaired. The interface
-        // compat verdict (T42) appears once there is something to report: a
-        // stored comparison from the relay client's last handshake, or any
-        // incompatible call the interceptor recorded. Absent otherwise —
-        // nothing to show, and the settings block presence-gates on exactly
-        // that.
-        const intercept = options.getIntercept?.()
-        const fetchRouteIntercept = options.getFetchRouteIntercept?.()
-        const serviceProbe = options.getServiceProbe?.()
-        const pluginRouteIntercept = options.getPluginRouteIntercept?.()
-        const compatRelay = options.getRelayClient?.()
-        const compat =
-          compatRelay?.compat !== undefined || (intercept?.incompatibleCalls.length ?? 0) > 0
-            ? {
-                identical: compatRelay?.compat?.identical ?? [],
-                different: compatRelay?.compat?.different ?? [],
-                unavailable: compatRelay?.compat?.unavailable ?? [],
-                incompatibleCalls: intercept?.incompatibleCalls ?? [],
-              }
-            : undefined
-        const withDiagnostics = (body: Record<string, unknown>): Record<string, unknown> => {
-          // PB-2: the per-plugin bridge verdict rides EVERY status answer —
-          // the settings surface explains a not-bridged plugin whatever the
-          // connection state (unpaired reads all-offline, the honest verdict).
-          let next: Record<string, unknown> = { ...body, pluginBridge: options.getPluginBridgeStatus?.() ?? [] }
-          if (intercept !== undefined) next = { ...next, intercept }
-          if (fetchRouteIntercept !== undefined) next = { ...next, fetchRouteIntercept }
-          if (serviceProbe !== undefined) next = { ...next, serviceProbe }
-          if (pluginRouteIntercept !== undefined) next = { ...next, pluginRouteIntercept }
-          return compat === undefined ? next : { ...next, compat }
-        }
-        // The ROW decides its own two shapes first, per request (both fields
-        // are volatile { get() } wrappers — only the row object apply()
-        // received is a live source): without both credentials nothing is
-        // paired, and a stored address that no longer normalizes must never
-        // see the token (T16-fix).
-        const row = options.getRowConfig()
-        const record = row !== null && typeof row === 'object' && !Array.isArray(row) ? row as Record<string, unknown> : {}
-        const serverUrl = stringOrEmpty(unwrapVolatile(record.serverUrl)).trim()
-        const token = stringOrEmpty(unwrapVolatile(record.deviceToken))
-        if (token === '' || serverUrl === '') {
-          responseJson(res, 200, withDiagnostics({ state: 'unpaired' }))
-          return
-        }
-        const normalized = normalizeServerUrl(serverUrl)
-        if (!normalized.ok) {
-          responseJson(res, 200, withDiagnostics({ state: 'invalid-url' }))
-          return
-        }
-        const relay = options.getRelayClient?.()
-        if (relay === undefined) {
-          // T16 shape: no relay client wired — the ping probe is the answer.
-          const state = await probe(fetchImpl, normalized.url, token)
-          responseJson(res, 200, withDiagnostics({ state, serverUrl: normalized.url }))
+        responseJson(res, 200, await statusBodyOf(options))
+        return
+      }
+      if (route === CLIENT_DEBUG_REPORT_ROUTE) {
+        // Unwired composition (no log ring handed over): the same shape an
+        // unknown path gets — an old host must not pretend to have a report.
+        const logs = options.getLogSnapshot?.()
+        if (logs === undefined) {
+          responseJson(res, 404, { ok: false, error: { code: 'not-found', message: 'Unknown client route' } })
           return
         }
-        // The cached verdict is trusted only over the EXACT credentials the
-        // handshake earned it with: an online state whose digest no longer
-        // matches the row (address edited, re-pair) is an answer about a
-        // DIFFERENT server and falls through to a live connect instead
-        // (T23a-fix). The token never enters this body — the digest is a
-        // one-way sha256 prefix computed on both sides.
-        if (
-          relay.state === 'online' &&
-          relay.handshakeInfo !== undefined &&
-          relay.lastHandshakeDigest !== undefined &&
-          relay.lastHandshakeDigest === relayCredentialsDigest(normalized.url, token)
-        ) {
-          responseJson(res, 200, withDiagnostics(deviceStatusBody(relay.state, relay.handshakeInfo, normalized.url, relay.deviceNameSyncing)))
+        if (method !== 'GET') {
+          res.setHeader('Allow', 'GET')
+          responseJson(res, 405, { ok: false, error: { code: 'method-not-allowed', message: 'Use GET' } })
           return
         }
-        // Everything else — never connected, offline, connecting, revoked,
-        // stale credentials — gets ONE live connect bounded by the probe
-        // timeout; its FRESH result is the answer, never the possibly stale
-        // cached state. A failed attempt additionally carries the relay
-        // client's reconnect machinery readout (T43): when the next
-        // automatic retry fires and which code failed last — both free of
-        // credential material by contract.
-        try {
-          const info = await withProbeTimeout(relay.connect())
-          responseJson(res, 200, withDiagnostics(deviceStatusBody('online', info, normalized.url, relay.deviceNameSyncing)))
-        } catch (error) {
-          const body: Record<string, unknown> = { state: probeStateOfRelayError(error), serverUrl: normalized.url }
-          if (relay.nextRetryAt !== null && relay.nextRetryAt !== undefined) body.nextRetryAt = relay.nextRetryAt
-          if (relay.lastError !== undefined) body.lastError = relay.lastError
-          responseJson(res, 200, withDiagnostics(body))
-        }
+        // The picked config summary (CU-2's construction layer): field by
+        // NAME, never a spread — deviceToken and the other secret row fields
+        // are structurally absent; the assembler's deep redactor is the
+        // second layer behind this. serverUrl travels to the assembler raw
+        // and comes out as a shape (scheme + address class + port).
+        const row = options.getRowConfig()
+        const record = row !== null && typeof row === 'object' && !Array.isArray(row) ? row as Record<string, unknown> : {}
+        const values = resolveConfig(record, readFileConfig(), process.env).values
+        const rawMaxUpload: unknown = unwrapVolatile(record.maxUploadBytes)
+        const maxUploadBytes = typeof rawMaxUpload === 'number' && Number.isFinite(rawMaxUpload) && rawMaxUpload > 0
+          ? rawMaxUpload
+          : undefined
+        const rawProfile = options.getProfileName?.()
+        const report = assembleDebugReport({
+          meta: {
+            generatedAt: new Date().toISOString(),
+            pluginVersion: options.getPluginVersion?.() ?? 'unknown',
+            dshVersion: resolveDshVersion(),
+            platform: `${process.platform} ${process.arch}`,
+            role: String(values.role),
+            ...(rawProfile === undefined ? {} : { profileName: rawProfile }),
+          },
+          configSummary: {
+            role: values.role,
+            host: values.host,
+            port: values.port,
+            idleHours: values.idleHours,
+            maxUploadBytes,
+            autoShareNewSessions: values.autoShareNewSessions,
+            pluginBridgeConsent: values.pluginBridgeConsent,
+            pushSummary: values.pushSummary,
+            pushTurnEnd: values.pushTurnEnd,
+            pushTool: values.pushTool,
+            serverUrl: stringOrEmpty(unwrapVolatile(record.serverUrl)).trim(),
+          },
+          statusBody: await statusBodyOf(options),
+          ...(options.getGatewaySummary === undefined ? {} : { gatewaySummary: await options.getGatewaySummary() }),
+          logs,
+          home: homedir(),
+        })
+        responseJson(res, 200, report)
         return
       }
       if (route === CLIENT_RECONNECT_ROUTE) {