@swimmingliu/autovpn 1.5.5 → 1.6.1

package/dist/cli/main.js

@@ -207,7 +207,8 @@ export async function runCliShell(argv, options = {}) {
             const serverFactory = options.createServer ?? createAutoVpnServer;
             const runtime = createServerRuntime({
                 projectRoot: serveOptions.projectRoot,
-                env
+                env,
+                proxy: serveOptions.proxy
             });
             const server = await serverFactory({
                 ...serveOptions,
@@ -217,7 +218,13 @@ export async function runCliShell(argv, options = {}) {
             });
             io.writeStdout(`AutoVPN server listening on ${server.origin}\n`);
             if (serveOptions.auth.enabled) {
-                io.writeStdout(`Open ${server.origin}/?token=${encodeURIComponent(serveOptions.auth.token)}\n`);
+                if (serveOptions.auth.password) {
+                    io.writeStdout(`Open ${server.origin}/\n`);
+                    io.writeStdout(`Password: ${serveOptions.auth.password}\n`);
+                }
+                else {
+                    io.writeStdout(`Open ${server.origin}/?token=${encodeURIComponent(serveOptions.auth.token)}\n`);
+                }
             }
             else {
                 io.writeStderr('autovpn: warning: server authentication is disabled\n');

package/dist/cli/native-commands.js

@@ -160,6 +160,8 @@ export async function runNativeCommand(argv, context) {
                     resumeLatest: true,
                     skipDeploy: Boolean(sourceOptions.skip_deploy),
                     skipVerify: Boolean(sourceOptions.skip_verify),
+                    useProxy: Boolean(sourceOptions.use_proxy),
+                    proxyUrl: String(sourceOptions.proxy_url ?? ''),
                     outputFormat: outputFormat(argv)
                 }, jobOptions(context));
                 context.io.writeStdout(jsonLine(publicStartedPayload(job)));

package/dist/jobs/commands.js

@@ -45,6 +45,32 @@ function spawnDetached(command, args, job, options) {
         fs.closeSync(stderrFd);
     }
 }
+function markArtifactStopped(job) {
+    const artifactDir = String(job.artifact_dir ?? '');
+    if (!artifactDir) {
+        return;
+    }
+    const reportPath = path.join(artifactDir, 'pipeline_report.json');
+    if (!fs.existsSync(reportPath)) {
+        return;
+    }
+    try {
+        const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+        const stageStatus = { ...(report.stage_status ?? {}) };
+        for (const [stage, status] of Object.entries(stageStatus)) {
+            if (status === 'running') {
+                stageStatus[stage] = 'failed';
+            }
+        }
+        report.stage_status = stageStatus;
+        report.run_status = 'stopped';
+        report.error = report.error || 'Stopped by user';
+        fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`, 'utf8');
+    }
+    catch {
+        // Best-effort cleanup so stopping a job never fails because its report is corrupt.
+    }
+}
 export async function startDetachedRun(command, options = {}) {
     const outputFormat = command.outputFormat ?? 'jsonl';
     const jobStore = createJobStore(command.projectRoot, options);
@@ -59,6 +85,8 @@ export async function startDetachedRun(command, options = {}) {
             resume_latest: Boolean(command.resumeLatest),
             skip_deploy: Boolean(command.skipDeploy),
             skip_verify: Boolean(command.skipVerify),
+            use_proxy: Boolean(command.useProxy),
+            proxy_url: command.proxyUrl ?? '',
             output_format: outputFormat
         }
     });
@@ -66,6 +94,12 @@ export async function startDetachedRun(command, options = {}) {
     pushFlag(runArgs, command.resumeLatest, '--resume-latest');
     pushFlag(runArgs, command.skipDeploy, '--skip-deploy');
     pushFlag(runArgs, command.skipVerify, '--skip-verify');
+    if (command.useProxy) {
+        runArgs.push('--proxy');
+        if (command.proxyUrl) {
+            runArgs.push(command.proxyUrl);
+        }
+    }
     job.command = [resolved.command, ...resolved.args, ...runArgs];
     const child = spawnDetached(resolved.command, [...resolved.args, ...runArgs], job, options);
     job.pid = Number(child.pid ?? 0);
@@ -148,6 +182,7 @@ export async function stopManagedJob(projectRoot, jobId, options = {}) {
         throw new Error(`refusing to stop pid ${pid}: command does not match AutoVPN job`);
     }
     await terminateProcessGroup(pid, options);
+    markArtifactStopped(job);
     job.status = 'stopped';
     job.finished_at = options.now?.() ?? new Date().toISOString().replace(/\.\d{3}Z$/, '+00:00');
     job.exit_code = 1;

package/dist/jobs/process.js

@@ -37,6 +37,9 @@ function defaultSignalProcess(target, signal, options) {
     }
     process.kill(target, signal);
 }
+function isNoSuchProcess(error) {
+    return error?.code === 'ESRCH';
+}
 function defaultSleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -54,22 +57,37 @@ export async function terminateProcessGroup(pid, options = {}) {
     const target = signalTarget(pid, platform);
     if (!isAlive(pid))
         return;
-    if (signalProcess) {
-        signalProcess(target, 'SIGTERM');
+    try {
+        if (signalProcess) {
+            signalProcess(target, 'SIGTERM');
+        }
+        else {
+            defaultSignalProcess(target, 'SIGTERM', options);
+        }
     }
-    else {
-        defaultSignalProcess(target, 'SIGTERM', options);
+    catch (error) {
+        if (isNoSuchProcess(error)) {
+            return;
+        }
+        throw error;
     }
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline && isAlive(pid)) {
         await sleep(100);
     }
     if (isAlive(pid)) {
-        if (signalProcess) {
-            signalProcess(target, 'SIGKILL');
+        try {
+            if (signalProcess) {
+                signalProcess(target, 'SIGKILL');
+            }
+            else {
+                defaultSignalProcess(target, 'SIGKILL', options);
+            }
         }
-        else {
-            defaultSignalProcess(target, 'SIGKILL', options);
+        catch (error) {
+            if (!isNoSuchProcess(error)) {
+                throw error;
+            }
         }
     }
 }

package/dist/jobs/read.js

@@ -55,6 +55,10 @@ function reconcileFromPipelineReport(job) {
         if (!['success', 'failed', 'stopped'].includes(runStatus)) {
             return undefined;
         }
+        const stageStatus = (report.stage_status ?? {});
+        if (Object.values(stageStatus).some((status) => String(status) === 'running')) {
+            return undefined;
+        }
         return {
             status: runStatus,
             finished_at: job.finished_at || nowIso(),

package/dist/pipeline/extract.js

@@ -142,10 +142,121 @@ async function fetchWithTimeout(fetchImpl, url, timeoutMs) {
         clearTimeout(timer);
     }
 }
+function isEnabled(value) {
+    return ['1', 'true', 'yes', 'on'].includes(String(value ?? '').trim().toLowerCase());
+}
+function resolveUpstreamProxyUrl(env) {
+    if (!isEnabled(env.VPN_AUTOMATION_USE_UPSTREAM_PROXY)) {
+        return '';
+    }
+    const value = String(env.VPN_AUTOMATION_UPSTREAM_PROXY ?? 'http://127.0.0.1:7897').trim();
+    return ['', 'off', 'none', 'false', '0'].includes(value.toLowerCase()) ? '' : value;
+}
+function isTlsFailure(error) {
+    const text = error instanceof Error
+        ? `${error.name}: ${error.message}`.toLowerCase()
+        : String(error).toLowerCase();
+    if (text.includes('ssl') || text.includes('tls') || text.includes('certificate')) {
+        return true;
+    }
+    const cause = error instanceof Error ? error.cause : undefined;
+    if (cause) {
+        return isTlsFailure(cause);
+    }
+    return false;
+}
+function defaultCurlFetch(url, proxyUrl, spawn = defaultSpawn) {
+    const args = [
+        '--fail',
+        '--silent',
+        '--show-error',
+        '--location',
+        '--max-time',
+        '20',
+        '--connect-timeout',
+        '10',
+        '--insecure',
+        '--http1.1',
+        '--config',
+        '-'
+    ];
+    if (proxyUrl) {
+        args.push('--proxy', proxyUrl);
+    }
+    else {
+        args.push('--noproxy', '*');
+    }
+    const child = spawn('curl', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += String(chunk);
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += String(chunk);
+    });
+    const completion = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve(stdout);
+                return;
+            }
+            reject(new Error((stderr || stdout || 'curl TLS fallback failed').trim()));
+        });
+    });
+    child.stdin?.write(`url = ${JSON.stringify(url)}\n`);
+    child.stdin?.end();
+    return completion;
+}
+function emitExtractEvent(options, type, payload) {
+    options.eventCallback?.(type, payload);
+}
+async function fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy) {
+    try {
+        const response = await fetchWithTimeout(fetchImpl, url, 20_000);
+        if (response.ok === false || Number(response.status ?? 200) >= 400) {
+            throw new Error(`HTTP ${Number(response.status ?? 0)}`);
+        }
+        const text = await response.text();
+        emitExtractEvent(options, 'extract_request_result', {
+            source_name: input.source_name,
+            iteration: attempt,
+            success: true,
+            via: 'direct'
+        });
+        return { text, via: 'direct' };
+    }
+    catch (error) {
+        const shouldRetry = Boolean(upstreamProxy) || isTlsFailure(error);
+        emitExtractEvent(options, 'extract_request_result', {
+            source_name: input.source_name,
+            iteration: attempt,
+            success: false,
+            via: 'direct',
+            error: error instanceof Error ? `${error.constructor.name}: ${error.message}` : String(error),
+            will_retry: shouldRetry
+        });
+        if (!shouldRetry) {
+            throw error;
+        }
+        const curlFetch = options.curlFetch ?? ((targetUrl, proxyUrl) => defaultCurlFetch(targetUrl, proxyUrl, options.spawn));
+        const text = await curlFetch(url, upstreamProxy);
+        const via = upstreamProxy ? 'upstream_proxy_curl_tls_fallback' : 'direct_curl_tls_fallback';
+        emitExtractEvent(options, 'extract_request_result', {
+            source_name: input.source_name,
+            iteration: attempt,
+            success: true,
+            via
+        });
+        return { text, via };
+    }
+}
 async function fetchSourceLinksInNode(input, options) {
     const source = input.source;
     const maxIterations = Math.max(0, Math.trunc(numberOrDefault(source.max_iterations, 0)));
-    const minIterations = Math.max(0, Math.trunc(numberOrDefault(source.min_iterations, 0)));
+    const configuredMinIterations = Math.max(0, Math.trunc(numberOrDefault(source.min_iterations, 0)));
+    const minIterations = configuredMinIterations > maxIterations ? 0 : configuredMinIterations;
     const plateauLimit = Math.max(1, Math.trunc(numberOrDefault(source.plateau_limit, 1)));
     const failureLimit = Math.max(1, Math.trunc(numberOrDefault(source.failure_limit, 1)));
     const maxRuntimeSeconds = Math.max(0, numberOrDefault(source.max_runtime_seconds, 0));
@@ -169,6 +280,13 @@ async function fetchSourceLinksInNode(input, options) {
     let successes = 0;
     let failures = 0;
     const startedAt = Date.now();
+    const upstreamProxy = resolveUpstreamProxyUrl(options.env ?? process.env);
+    emitExtractEvent(options, 'extract_source_started', {
+        source_name: input.source_name,
+        requested_iterations: maxIterations,
+        min_iterations: minIterations,
+        resume_from_iteration: startIteration
+    });
     for (let iteration = startIteration - 1; iteration < maxIterations; iteration += 1) {
         const attempt = iteration + 1;
         if (maxRuntimeSeconds > 0 && attempt > minIterations && (Date.now() - startedAt) / 1000 >= maxRuntimeSeconds) {
@@ -176,11 +294,25 @@ async function fetchSourceLinksInNode(input, options) {
         }
         try {
             const url = buildRuntimeSourceUrl(source, iteration);
-            const response = await fetchWithTimeout(fetchImpl, url, 20_000);
-            if (response.ok === false || Number(response.status ?? 200) >= 400) {
-                throw new Error(`HTTP ${Number(response.status ?? 0)}`);
+            const response = await fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy);
+            let plaintext = '';
+            try {
+                plaintext = decryptPayload(response.text.trim(), source.key);
+                emitExtractEvent(options, 'extract_decrypt_result', {
+                    source_name: input.source_name,
+                    iteration: attempt,
+                    success: true
+                });
+            }
+            catch (decryptError) {
+                emitExtractEvent(options, 'extract_decrypt_result', {
+                    source_name: input.source_name,
+                    iteration: attempt,
+                    success: false,
+                    error: decryptError instanceof Error ? `${decryptError.constructor.name}: ${decryptError.message}` : String(decryptError)
+                });
+                throw decryptError;
             }
-            const plaintext = decryptPayload((await response.text()).trim(), source.key);
             const extracted = extractLinksFromPlaintext(input.source_name, plaintext);
             successes += 1;
             failures = 0;
@@ -193,6 +325,14 @@ async function fetchSourceLinksInNode(input, options) {
                 links.push(link);
                 newItems += 1;
             }
+            emitExtractEvent(options, 'extract_iteration', {
+                source_name: input.source_name,
+                iteration: attempt,
+                requested_iterations: maxIterations,
+                new_items: newItems,
+                extracted_links: extracted.length,
+                total_links: links.length
+            });
             plateau = newItems === 0 ? plateau + 1 : 0;
             if (plateau >= plateauLimit && attempt >= minIterations) {
                 break;
@@ -200,7 +340,7 @@ async function fetchSourceLinksInNode(input, options) {
         }
         catch (error) {
             failures += 1;
-            if (failures >= failureLimit && attempt >= minIterations) {
+            if (failures >= failureLimit) {
                 break;
             }
             if (attempt >= maxIterations) {
@@ -208,6 +348,13 @@ async function fetchSourceLinksInNode(input, options) {
             }
         }
     }
+    emitExtractEvent(options, 'extract_source_completed', {
+        source_name: input.source_name,
+        requested_iterations: maxIterations,
+        successful_iterations: successes,
+        failed_iterations: failures,
+        raw_links: links.length
+    });
     return {
         source_name: input.source_name,
         requested_iterations: maxIterations,

package/dist/pipeline/orchestrator.js

@@ -169,7 +169,7 @@ async function seedRetryArtifact(sourceArtifactDir, retryArtifactDir, stage, ret
         source_counts: { ...(sourceReport.source_counts ?? {}) },
         deployment: { ...(sourceReport.deployment ?? {}) },
         retry_context: retryContext,
-        run_status: 'success',
+        run_status: 'running',
         error: ''
     };
     await copyIfExists(path.join(sourceArtifactDir, 'vpn_node_raw.txt'), path.join(retryArtifactDir, 'vpn_node_raw.txt'));
@@ -205,7 +205,9 @@ function pipelineSummaryFromReport(artifactDir, report) {
         source_counts: { ...(report.source_counts ?? {}) },
         deployment: { ...(report.deployment ?? {}) },
         retry_context: { ...(report.retry_context ?? {}) },
-        run_status: String(report.run_status ?? 'success') === 'failed' ? 'failed' : 'success',
+        run_status: ['running', 'success', 'failed', 'stopped'].includes(String(report.run_status ?? ''))
+            ? String(report.run_status)
+            : 'running',
         error: String(report.error ?? '')
     };
 }
@@ -328,7 +330,7 @@ export async function runNodePipeline(options, context = {}) {
         source_counts: {},
         deployment: {},
         retry_context: {},
-        run_status: 'success',
+        run_status: 'running',
         error: ''
     };
     const emit = (type, payload = {}) => {
@@ -356,19 +358,26 @@ export async function runNodePipeline(options, context = {}) {
         await setStage('doctor', 'success');
         const profile = await readProfile(projectRoot, env);
         await setStage('extract', 'running');
-        const extractResults = [];
-        for (const [sourceName, source] of enabledSources(profile)) {
+        const sourcesToRun = enabledSources(profile);
+        const extractResults = await Promise.all(sourcesToRun.map(async ([sourceName, source]) => {
             const result = context.stages?.extract
                 ? await context.stages.extract({ source_name: sourceName, source })
-                : await fetchSourceLinksWithBackend({ source_name: sourceName, source }, { cwd: projectRoot, env: runtimeStageEnv });
-            extractResults.push(result);
+                : await fetchSourceLinksWithBackend({ source_name: sourceName, source }, {
+                    cwd: projectRoot,
+                    env: runtimeStageEnv,
+                    eventCallback: (type, payload) => emit(type, payload)
+                });
             summary.source_counts[result.source_name] = {
                 raw_links: result.links.length,
                 successful_iterations: result.successful_iterations,
                 failed_iterations: result.failed_iterations
             };
-        }
+            return result;
+        }));
         const rawLinks = extractResults.flatMap((result) => result.links);
+        if (sourcesToRun.length > 0 && rawLinks.length === 0 && extractResults.some((result) => result.requested_iterations > 0 || result.failed_iterations > 0)) {
+            throw new Error('No links extracted from configured sources');
+        }
         summary.counts.raw_links = rawLinks.length;
         await writeLines(artifactDir, 'vpn_node_raw.txt', rawLinks);
         await setStage('extract', 'success');
@@ -478,6 +487,7 @@ export async function runNodePipeline(options, context = {}) {
         emit('run_failed', { error: summary.error });
         throw error;
     }
+    summary.run_status = 'success';
     await writeReport();
     emit('summary', summary);
     return summary;

package/dist/server/http.js

@@ -1,43 +1,38 @@
 import http from 'node:http';
+import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath, URL } from 'node:url';
 import QRCode from 'qrcode';
 import { renderWebAdapterScript } from './web-adapter.js';
 import { redactText } from '../runtime/redaction.js';
-const SENSITIVE_KEYS = new Set([
-    'key',
-    'token',
-    'api_token',
-    'cloudflare_api_token',
-    'cloudflare_global_key',
-    'subscription_url',
-    'verify_subscription_url',
-    'secret_query',
-    'pages_secret_admin',
-    'share_project_sub_value'
+const LABELED_SECRET_KEYS = new Map([
+    ['cloudflare_api_token', '<Cloudflare Token>'],
+    ['cloudflare_global_key', '<Cloudflare Token>'],
+    ['pages_secret_admin', '<Pages Secret ADMIN>']
 ]);
-function redactPayload(value, parentKey = '') {
+function redactPayload(value, parentKey = '', mode = 'full') {
     if (typeof value === 'string') {
-        if (SENSITIVE_KEYS.has(parentKey.toLowerCase())) {
-            return value ? '<redacted>' : '';
+        const label = LABELED_SECRET_KEYS.get(parentKey.toLowerCase());
+        if (label) {
+            return value ? label : '';
         }
-        return redactText(value);
+        return mode === 'config' ? value : redactText(value);
     }
     if (value === null || ['number', 'boolean'].includes(typeof value)) {
         return value;
     }
     if (Array.isArray(value)) {
-        return value.map((item) => redactPayload(item, parentKey));
+        return value.map((item) => redactPayload(item, parentKey, mode));
     }
     if (typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactPayload(item, key)]));
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactPayload(item, key, mode)]));
     }
     return null;
 }
-function writeJson(response, statusCode, payload) {
+function writeJson(response, statusCode, payload, mode = 'full') {
     response.writeHead(statusCode, { 'Content-Type': 'application/json; charset=utf-8' });
-    response.end(JSON.stringify(redactPayload(payload)));
+    response.end(JSON.stringify(redactPayload(payload, '', mode)));
 }
 function contentType(filePath) {
     if (filePath.endsWith('.html'))
@@ -56,8 +51,9 @@ function rendererRoot() {
     return path.resolve(fileURLToPath(new URL('../web/renderer', import.meta.url)));
 }
 async function writeStaticFile(response, statusCode, filePath, body) {
+    const payload = body ?? await fs.readFile(filePath);
     response.writeHead(statusCode, { 'Content-Type': contentType(filePath) });
-    response.end(body ?? await fs.readFile(filePath));
+    response.end(payload);
 }
 async function serveRendererIndex(response) {
     const indexPath = path.join(rendererRoot(), 'index.html');
@@ -72,10 +68,6 @@ async function serveRendererAsset(url, response) {
         await serveRendererIndex(response);
         return true;
     }
-    if (url.pathname === '/web-adapter.js') {
-        await writeStaticFile(response, 200, 'web-adapter.js', renderWebAdapterScript());
-        return true;
-    }
     const decodedPath = decodeURIComponent(url.pathname.replace(/^\/+/, ''));
     if (!decodedPath || decodedPath.includes('..') || path.isAbsolute(decodedPath)) {
         return false;
@@ -93,15 +85,23 @@ async function serveRendererAsset(url, response) {
         return false;
     }
 }
+function timingSafeEqualText(left, right) {
+    const leftBuffer = Buffer.from(left);
+    const rightBuffer = Buffer.from(right);
+    return leftBuffer.length === rightBuffer.length && crypto.timingSafeEqual(leftBuffer, rightBuffer);
+}
 function isAuthorized(request, url, auth) {
     if (!auth.enabled) {
         return true;
     }
     const authorization = request.headers.authorization ?? '';
-    if (authorization === `Bearer ${auth.token}`) {
+    if (authorization.startsWith('Bearer ') && timingSafeEqualText(authorization.slice(7), auth.token)) {
         return true;
     }
-    return url.searchParams.get('token') === auth.token;
+    return timingSafeEqualText(url.searchParams.get('token') ?? '', auth.token);
+}
+function clientIp(request) {
+    return request.socket.remoteAddress || 'unknown';
 }
 async function readJsonBody(request) {
     const chunks = [];
@@ -122,13 +122,47 @@ async function readJsonBody(request) {
     return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) ? parsed : {};
 }
 export async function createAutoVpnServer(options) {
+    const authFailures = new Map();
     const server = http.createServer(async (request, response) => {
         const url = new URL(request.url ?? '/', `http://${request.headers.host ?? `${options.host}:${options.port}`}`);
-        if (url.pathname.startsWith('/api/') && !isAuthorized(request, url, options.auth)) {
-            writeJson(response, 401, { ok: false, error: 'unauthorized' });
+        const ip = clientIp(request);
+        const authState = authFailures.get(ip);
+        if (authState?.banned) {
+            writeJson(response, 403, { ok: false, error: 'ip_banned' });
             return;
         }
         try {
+            if (request.method === 'POST' && url.pathname === '/api/auth/login') {
+                const password = String((await readJsonBody(request)).password ?? '');
+                if (!options.auth.enabled || !options.auth.password || timingSafeEqualText(password, options.auth.password)) {
+                    authFailures.delete(ip);
+                    writeJson(response, 200, { ok: true, token: options.auth.token });
+                    return;
+                }
+                const nextFailures = (authState?.failures ?? 0) + 1;
+                if (nextFailures >= options.auth.maxAttempts) {
+                    authFailures.set(ip, { failures: nextFailures, banned: true });
+                    writeJson(response, 403, { ok: false, error: 'ip_banned' });
+                    return;
+                }
+                authFailures.set(ip, { failures: nextFailures, banned: false });
+                writeJson(response, 401, {
+                    ok: false,
+                    error: 'invalid_password',
+                    attemptsRemaining: options.auth.maxAttempts - nextFailures
+                });
+                return;
+            }
+            if (request.method === 'GET' && url.pathname === '/web-adapter.js') {
+                await writeStaticFile(response, 200, 'web-adapter.js', renderWebAdapterScript({
+                    passwordEnabled: Boolean(options.auth.enabled && options.auth.password)
+                }));
+                return;
+            }
+            if (url.pathname.startsWith('/api/') && !isAuthorized(request, url, options.auth)) {
+                writeJson(response, 401, { ok: false, error: 'unauthorized' });
+                return;
+            }
             if (request.method === 'GET' && url.pathname === '/api/health') {
                 writeJson(response, 200, {
                     status: 'ok',
@@ -139,12 +173,12 @@ export async function createAutoVpnServer(options) {
                 return;
             }
             if (request.method === 'GET' && url.pathname === '/api/state') {
-                writeJson(response, 200, await options.runtime.loadState());
+                writeJson(response, 200, await options.runtime.loadState(), 'config');
                 return;
             }
             if (request.method === 'POST' && url.pathname === '/api/profile') {
                 const body = await readJsonBody(request);
-                writeJson(response, 200, await options.runtime.saveProfile?.(body) ?? { ok: false, error: 'profile_save_unavailable' });
+                writeJson(response, 200, await options.runtime.saveProfile?.(body) ?? { ok: false, error: 'profile_save_unavailable' }, 'config');
                 return;
             }
             if (request.method === 'POST' && url.pathname === '/api/qr') {

package/dist/server/options.js

@@ -11,6 +11,23 @@ function isLoopbackHost(host) {
 function defaultRandomToken() {
     return crypto.randomBytes(18).toString('base64url');
 }
+function defaultRandomPassword() {
+    return crypto.randomBytes(9).toString('base64url');
+}
+const DEFAULT_PROXY_URL = 'http://127.0.0.1:7897';
+function optionalFlagValue(argv, flag) {
+    for (let index = 0; index < argv.length; index += 1) {
+        const value = argv[index];
+        if (value.startsWith(`${flag}=`)) {
+            return value.slice(flag.length + 1);
+        }
+        if (value === flag) {
+            const next = argv[index + 1] ?? '';
+            return next && !next.startsWith('--') ? next : '';
+        }
+    }
+    return '';
+}
 export function parseServeOptions(argv, context) {
     const host = readOptionValue(argv, '--host') ?? context.env.AUTOVPN_SERVER_HOST ?? '127.0.0.1';
     const portText = readOptionValue(argv, '--port') ?? context.env.AUTOVPN_SERVER_PORT ?? '8765';
@@ -19,16 +36,33 @@ export function parseServeOptions(argv, context) {
         throw new CliUsageError('serve --port must be an integer from 1 to 65535');
     }
     const token = readOptionValue(argv, '--token') ?? context.env.AUTOVPN_SERVER_TOKEN ?? '';
+    const password = readOptionValue(argv, '--password')
+        ?? context.env.AUTOVPN_SERVER_PASSWORD
+        ?? (context.randomPassword ?? defaultRandomPassword)();
+    const maxAttemptsText = readOptionValue(argv, '--max-auth-attempts') ?? context.env.AUTOVPN_SERVER_MAX_AUTH_ATTEMPTS ?? '5';
+    const maxAttempts = Number(maxAttemptsText);
+    if (!Number.isInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > 100) {
+        throw new CliUsageError('serve --max-auth-attempts must be an integer from 1 to 100');
+    }
     const noAuth = hasFlag(argv, '--no-auth');
-    if (!isLoopbackHost(host) && !token && !noAuth) {
-        throw new CliUsageError('serve requires --token or --no-auth when binding to non-loopback host');
+    if (!isLoopbackHost(host) && !token && !password && !noAuth) {
+        throw new CliUsageError('serve requires --token, --password, or --no-auth when binding to non-loopback host');
     }
     return {
         host,
         port,
         projectRoot: path.resolve(resolveProjectRoot(argv, context.cwd)),
+        proxy: {
+            enabled: hasFlag(argv, '--proxy') || argv.some((value) => value.startsWith('--proxy=')),
+            url: optionalFlagValue(argv, '--proxy') || DEFAULT_PROXY_URL
+        },
         auth: noAuth
-            ? { enabled: false, token: '' }
-            : { enabled: true, token: token || (context.randomToken ?? defaultRandomToken)() }
+            ? { enabled: false, token: '', password: '', maxAttempts }
+            : {
+                enabled: true,
+                token: token || (context.randomToken ?? defaultRandomToken)(),
+                password,
+                maxAttempts
+            }
     };
 }