dsh-mobile 0.1.3 → 0.2.0

package/lib/index.mjs

@@ -3,20 +3,21 @@ import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomB
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
-import { connect, isIP } from "node:net";
-import { chmod, lstat, mkdir, opendir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { connect, createServer, isIP } from "node:net";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, opendir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces } from "node:os";
-import { createServer, request } from "node:http";
-import { createServer as createServer$1 } from "node:https";
+import { createServer as createServer$1, request } from "node:http";
+import { createServer as createServer$2 } from "node:https";
 import { Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
 import { Service } from "@deepseek-ai/cordis";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
 import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
@@ -683,6 +684,8 @@ function parseGatewayConfig(raw) {
 		})(),
 		...value.pairingCaFile === void 0 ? {} : { pairingCaFile: absoluteFile(value.pairingCaFile, "pairingCaFile") },
 		tls,
+		publicTls: tls.mode === "provided",
+		discovery: true,
 		pairingTtlMs: integer(value.pairingTtlMs, "pairingTtlMs", 12e4, 1e4, 6e5),
 		deviceTtlMs,
 		sessionTtlMs,
@@ -716,6 +719,47 @@ function assertSupportedDshVersion(version) {
 	throw new Error(`unsupported DeepSeek Harness version ${typeof version === "string" ? version : "(unknown)"}; supported versions: ${SUPPORTED_DSH_VERSIONS.join(", ")}`);
 }
 //#endregion
+//#region src/private-file.ts
+const execFile$2 = promisify(execFile);
+let userSidTask;
+async function currentWindowsUserSid() {
+	userSidTask ??= execFile$2("whoami.exe", [
+		"/user",
+		"/fo",
+		"csv",
+		"/nh"
+	], {
+		encoding: "utf8",
+		windowsHide: true
+	}).then(({ stdout }) => {
+		const match = /,"(S-\d(?:-\d+)+)"\s*$/u.exec(stdout.trim());
+		if (match?.[1] === void 0) throw new Error("unable to resolve the current Windows user SID");
+		return match[1];
+	});
+	return userSidTask;
+}
+/** Restrict a sensitive regular file to the current user and Windows administrators. */
+async function restrictPrivateFile(file, mode = 384) {
+	await chmod(file, mode);
+	if (process.platform !== "win32") return;
+	const userSid = await currentWindowsUserSid();
+	await execFile$2("icacls.exe", [
+		file,
+		"/inheritance:r",
+		"/grant:r",
+		`*${userSid}:(F)`,
+		"*S-1-5-18:(F)",
+		"*S-1-5-32-544:(F)",
+		"/remove:g",
+		"*S-1-1-0",
+		"*S-1-5-11",
+		"*S-1-5-32-545"
+	], {
+		encoding: "utf8",
+		windowsHide: true
+	});
+}
+//#endregion
 //#region src/control.ts
 /** Keeps one runtime aligned with a changing network selection. */
 var FollowingMobileAccessRuntime = class {
@@ -801,6 +845,7 @@ var JsonMobileAccessControlStore = class {
 			throw error;
 		}
 		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("mobile-access control state must be a regular file no larger than 4 KiB");
+		await restrictPrivateFile(this.file);
 		let parsed;
 		try {
 			parsed = JSON.parse(await readFile(this.file, "utf8"));
@@ -829,8 +874,8 @@ var JsonMobileAccessControlStore = class {
 				flag: "wx",
 				mode: 384
 			});
-			await chmod(temporary, 384);
 			await rename(temporary, this.file);
+			await restrictPrivateFile(this.file);
 		} catch (error) {
 			try {
 				await rm(temporary, { force: true });
@@ -1118,7 +1163,8 @@ function resolveComputerImagePath(path) {
 	return resolve(path);
 }
 /** List folders and supported image files without following symbolic links. */
-async function listComputerImages(path) {
+async function listComputerImages(path, signal) {
+	signal?.throwIfAborted();
 	const target = resolveComputerImagePath(path);
 	const rows = [];
 	let truncated = false;
@@ -1126,6 +1172,7 @@ async function listComputerImages(path) {
 	try {
 		directory = await opendir(target);
 		for await (const entry of directory) {
+			signal?.throwIfAborted();
 			if (entry.isSymbolicLink()) continue;
 			const kind = entry.isDirectory() ? "directory" : IMAGE_TYPES[extname(entry.name).toLowerCase()] === void 0 ? void 0 : "image";
 			if (kind === void 0) continue;
@@ -1139,7 +1186,8 @@ async function listComputerImages(path) {
 				path: resolve(target, entry.name)
 			});
 		}
-	} catch {
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
 		throw new HttpError(404, "directory_unavailable");
 	} finally {
 		await directory?.close().catch(() => void 0);
@@ -1154,7 +1202,8 @@ async function listComputerImages(path) {
 	});
 }
 /** Read one bounded regular image file selected by an authenticated device. */
-async function readComputerImage(path) {
+async function readComputerImage(path, signal) {
+	signal?.throwIfAborted();
 	const target = resolveComputerImagePath(path);
 	const contentType = IMAGE_TYPES[extname(target).toLowerCase()];
 	if (contentType === void 0) throw new HttpError(415, "unsupported_file_type");
@@ -1168,11 +1217,12 @@ async function readComputerImage(path) {
 	if (info.size > MAX_IMAGE_BYTES) throw new HttpError(413, "file_too_large");
 	try {
 		return {
-			body: await readFile(target),
+			body: await readFile(target, { signal }),
 			contentType,
 			name: basename(target)
 		};
-	} catch {
+	} catch (error) {
+		if (signal?.aborted) throw signal.reason;
 		throw new HttpError(404, "file_unavailable");
 	}
 }
@@ -1249,7 +1299,7 @@ function normalizeRelativePath(value, field) {
 	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
 	return normalized;
 }
-async function regularFile(path, maximum, field) {
+async function regularFile$1(path, maximum, field) {
 	let info;
 	try {
 		info = await lstat(path);
@@ -1270,7 +1320,7 @@ async function containedPath(root, relativePath, maximum, field) {
 	const targetReal = await realpath(target);
 	const relation = relative(rootReal, targetReal);
 	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
-	return regularFile(targetReal, maximum, field);
+	return regularFile$1(targetReal, maximum, field);
 }
 async function optionalFile(root, name, maximum, field) {
 	try {
@@ -1286,7 +1336,7 @@ async function optionalBytes(root, name, maximum, field) {
 	return path === void 0 ? Buffer.alloc(0) : readFile(path);
 }
 async function extensionFingerprint(directory) {
-	const manifestFile = await regularFile(join(directory, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$1(join(directory, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifestBody = await readFile(manifestFile.path);
 	const manifest = parseExtensionManifest(JSON.parse(manifestBody.toString("utf8")));
 	if (manifest.id !== basename(resolve(directory))) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
@@ -1429,20 +1479,22 @@ var MobileAccessService = class extends Service {
 		return this.local.get(id)?.controller.signal;
 	}
 	/** Read a local client entry after validating that it remains inside its directory. */
-	async readClientFile(id, kind) {
+	async readClientFile(id, kind, signal) {
+		signal?.throwIfAborted();
 		const active = this.local.get(id);
 		if (active === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		const path = kind === "script" ? active.scriptFile : active.styleFile;
 		if (path === void 0) throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
-		const file = await regularFile(path, kind === "script" ? EXTENSION_LIMITS.script : EXTENSION_LIMITS.css, kind);
-		const body = await readFile(file.path);
+		const file = await regularFile$1(path, kind === "script" ? EXTENSION_LIMITS.script : EXTENSION_LIMITS.css, kind);
+		const body = await readFile(file.path, { signal });
 		return {
 			body,
 			digest: createHash("sha256").update(body).digest("hex")
 		};
 	}
 	/** Read a local static asset after containment and size checks. */
-	async readAsset(id, assetPath) {
+	async readAsset(id, assetPath, signal) {
+		signal?.throwIfAborted();
 		const active = this.local.get(id);
 		if (active === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		let file;
@@ -1452,7 +1504,7 @@ var MobileAccessService = class extends Service {
 			if (error.code === "ENOENT") throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
 			throw error;
 		}
-		const body = await readFile(file.path);
+		const body = await readFile(file.path, { signal });
 		return {
 			body,
 			digest: createHash("sha256").update(body).digest("hex"),
@@ -1607,7 +1659,7 @@ async function loadLocalExtension(directory, context, known) {
 	const root = resolve(directory);
 	const rootStat = await lstat(root);
 	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new MobileExtensionError("invalid_extension", "extension directory must be real");
-	const manifestFile = await regularFile(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$1(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
 	const scriptFile = await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js");
@@ -1691,6 +1743,8 @@ function createMobileAccessService(ctx) {
 //#region src/gateway.ts
 const MAX_CONTROL_BODY_BYTES = 16384;
 const MAX_HEADER_BYTES = 16384;
+const MOBILE_HISTORY_PAGE_MESSAGES = 10;
+const SESSION_HISTORY_PATH = "/api/session.history";
 const DISCOVERY_QUERY = Buffer.from("DSH_MOBILE_DISCOVER_V1", "ascii");
 const DISCOVERY_PROTOCOL = 1;
 const DISCOVERY_INTERVAL_MS = 3e3;
@@ -2002,6 +2056,61 @@ function sanitizeResponseHeaders(headers, upstream) {
 	}
 	return clean;
 }
+function acceptsGzip(header) {
+	if (header === void 0) return false;
+	let wildcard;
+	for (const entry of header.split(",")) {
+		const [rawName, ...parameters] = entry.split(";");
+		const name = rawName?.trim().toLowerCase();
+		if (name === void 0 || name === "") continue;
+		let quality = 1;
+		for (const parameter of parameters) {
+			const match = /^\s*q\s*=\s*(0(?:\.\d+)?|1(?:\.0+)?)\s*$/iu.exec(parameter);
+			if (match !== null) quality = Number(match[1]);
+		}
+		if (name === "gzip") return quality > 0;
+		if (name === "*") wildcard = quality > 0;
+	}
+	return wildcard ?? false;
+}
+function isCompressibleContentType(value) {
+	const contentType = Array.isArray(value) ? value[0] : value;
+	if (contentType === void 0) return false;
+	const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+	return mediaType.startsWith("text/") || /^(?:application\/(?:javascript|json|xml|x-javascript)|image\/svg\+xml)$/u.test(mediaType);
+}
+function shouldCompressResponse(request, response) {
+	const pathname = request.url?.split("?", 1)[0] ?? "";
+	return (request.method === "GET" && (pathname.startsWith("/plugins/") || pathname.startsWith("/assets/")) || request.method === "POST" && pathname === SESSION_HISTORY_PATH) && response.statusCode === 200 && request.headers.range === void 0 && response.headers["content-range"] === void 0 && response.headers["content-encoding"] === void 0 && acceptsGzip(request.headers["accept-encoding"]) && isCompressibleContentType(response.headers["content-type"]);
+}
+function isJsonRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mobileHistoryRequestBody(request, body) {
+	if (request.method !== "POST" || request.url?.split("?", 1)[0] !== SESSION_HISTORY_PATH) return body;
+	let parsed;
+	try {
+		parsed = JSON.parse(body.toString("utf8"));
+	} catch {
+		return body;
+	}
+	if (!isJsonRecord(parsed) || parsed.method !== "session.history" || !isJsonRecord(parsed.payload)) return body;
+	const requested = parsed.payload.maxMessages;
+	if (typeof requested === "number" && Number.isInteger(requested) && requested > 0 && requested <= MOBILE_HISTORY_PAGE_MESSAGES) return body;
+	return Buffer.from(JSON.stringify({
+		...parsed,
+		payload: {
+			...parsed.payload,
+			maxMessages: MOBILE_HISTORY_PAGE_MESSAGES
+		}
+	}));
+}
+function addVaryAcceptEncoding(headers) {
+	const existing = headers.vary;
+	const values = (Array.isArray(existing) ? existing.map((value) => String(value)) : existing === void 0 ? [] : [String(existing)]).flatMap((value) => value.split(",").map((part) => part.trim()).filter(Boolean));
+	if (!values.some((value) => value.toLowerCase() === "accept-encoding")) values.push("Accept-Encoding");
+	headers.vary = values.join(", ");
+}
 function requestCookies(request) {
 	const cookies = parseCookies(request.headers.cookie);
 	if (cookies === void 0) throw new HttpError(401, "authentication_failed");
@@ -2118,6 +2227,7 @@ var MobileAccessGateway = class {
 	config;
 	extensions;
 	access;
+	listenerTlsEnabled;
 	tlsEnabled;
 	policy;
 	server;
@@ -2138,7 +2248,8 @@ var MobileAccessGateway = class {
 	constructor(config, store, extensions) {
 		this.config = config;
 		this.extensions = extensions;
-		this.tlsEnabled = config.tls.mode === "provided";
+		this.listenerTlsEnabled = config.tls.mode === "provided";
+		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
 			pairingTtlMs: config.pairingTtlMs,
 			deviceTtlMs: config.deviceTtlMs,
@@ -2173,7 +2284,7 @@ var MobileAccessGateway = class {
 					else sendFailure(response, mapped.status, mapped.code, this.tlsEnabled);
 				});
 			};
-			const server = this.tlsEnabled ? createServer$1(await tlsOptions(this.config), handler) : createServer({ maxHeaderSize: MAX_HEADER_BYTES }, handler);
+			const server = this.listenerTlsEnabled ? createServer$2(await tlsOptions(this.config), handler) : createServer$1({ maxHeaderSize: MAX_HEADER_BYTES }, handler);
 			this.server = server;
 			server.maxHeadersCount = 64;
 			server.maxConnections = this.config.maxConnections;
@@ -2186,6 +2297,9 @@ var MobileAccessGateway = class {
 					return;
 				}
 				this.connectedSockets.add(socket);
+				socket.on("error", () => {
+					socket.destroy();
+				});
 				socket.once("close", () => {
 					this.connectedSockets.delete(socket);
 				});
@@ -2216,7 +2330,7 @@ var MobileAccessGateway = class {
 			if (address === null || typeof address === "string") throw new Error("gateway listener has no TCP address");
 			this.listenerPort = address.port;
 			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
-			await this.startDiscovery(address.port);
+			if (this.config.discovery) await this.startDiscovery(address.port);
 		} catch (error) {
 			await this.closeFailedStart();
 			throw error;
@@ -2544,54 +2658,69 @@ var MobileAccessGateway = class {
 			return;
 		}
 		if (customAsset !== void 0) {
-			let body;
-			let mtime;
+			const operation = this.allocateRequest(authorization, response, {});
 			try {
-				body = await readFile(customAsset.file);
+				let body;
+				let mtime;
 				try {
-					mtime = (await stat(customAsset.file)).mtime;
-				} catch {}
-			} catch (error) {
-				if (error.code !== "ENOENT") throw error;
-				if (customAsset.fallback === void 0) throw new HttpError(503, "mobile_frontend_unavailable");
-				body = Buffer.from(customAsset.fallback);
-			}
-			if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
-			const etag = createHash("sha256").update(body).digest("hex");
-			const ifNoneMatch = headerValue(request.headers, "if-none-match");
-			if (ifNoneMatch !== void 0 && ifNoneMatch === etag) {
+					body = await readFile(customAsset.file, { signal: operation.signal });
+					try {
+						mtime = (await stat(customAsset.file)).mtime;
+					} catch {}
+				} catch (error) {
+					if (error.code !== "ENOENT") throw error;
+					if (customAsset.fallback === void 0) throw new HttpError(503, "mobile_frontend_unavailable");
+					body = Buffer.from(customAsset.fallback);
+				}
+				if (body.byteLength > 262144) throw new HttpError(413, "payload_too_large");
+				const etag = createHash("sha256").update(body).digest("hex");
+				const ifNoneMatch = headerValue(request.headers, "if-none-match");
+				if (ifNoneMatch !== void 0 && ifNoneMatch === etag) {
+					setSecurityHeaders(response, this.tlsEnabled);
+					response.writeHead(304);
+					response.end();
+					return;
+				}
 				setSecurityHeaders(response, this.tlsEnabled);
-				response.writeHead(304);
-				response.end();
+				const responseHeaders = {
+					"Content-Type": customAsset.contentType,
+					"Content-Length": body.byteLength,
+					"ETag": etag
+				};
+				if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
+				response.writeHead(200, responseHeaders);
+				response.end(body);
 				return;
+			} finally {
+				operation.release();
 			}
-			setSecurityHeaders(response, this.tlsEnabled);
-			const responseHeaders = {
-				"Content-Type": customAsset.contentType,
-				"Content-Length": body.byteLength,
-				"ETag": etag
-			};
-			if (mtime !== void 0) responseHeaders["Last-Modified"] = mtime.toUTCString();
-			response.writeHead(200, responseHeaders);
-			response.end(body);
-			return;
 		}
 		if (computerImages) {
-			const query = new URL(target.raw, this.address().origin).searchParams;
-			sendJson(response, 200, await listComputerImages(query.get("path")), this.tlsEnabled);
-			return;
+			const operation = this.allocateRequest(authorization, response, {});
+			try {
+				const query = new URL(target.raw, this.address().origin).searchParams;
+				sendJson(response, 200, await listComputerImages(query.get("path"), operation.signal), this.tlsEnabled);
+				return;
+			} finally {
+				operation.release();
+			}
 		}
 		if (computerImage) {
-			const query = new URL(target.raw, this.address().origin).searchParams;
-			const image = await readComputerImage(query.get("path"));
-			setSecurityHeaders(response, this.tlsEnabled);
-			response.writeHead(200, {
-				"Content-Type": image.contentType,
-				"Content-Length": image.body.byteLength,
-				"Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(image.name)}`
-			});
-			response.end(image.body);
-			return;
+			const operation = this.allocateRequest(authorization, response, {});
+			try {
+				const query = new URL(target.raw, this.address().origin).searchParams;
+				const image = await readComputerImage(query.get("path"), operation.signal);
+				setSecurityHeaders(response, this.tlsEnabled);
+				response.writeHead(200, {
+					"Content-Type": image.contentType,
+					"Content-Length": image.body.byteLength,
+					"Content-Disposition": `inline; filename*=UTF-8''${encodeURIComponent(image.name)}`
+				});
+				response.end(image.body);
+				return;
+			} finally {
+				operation.release();
+			}
 		}
 		const stockFrontend = new URL(target.raw, this.address().origin).searchParams.get("frontend") === "stock";
 		const acceptsHtml = request.headers.accept?.split(",").some((value) => value.trim().split(";", 1)[0] === "text/html") ?? false;
@@ -2608,46 +2737,57 @@ var MobileAccessGateway = class {
 		if (request.method !== "GET" && request.method !== "HEAD") this.requireCsrf(request, authorization);
 		if (targetInfo.kind === "manifest") {
 			if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
-			const body = Buffer.from(JSON.stringify({
-				protocol: 1,
-				extensions: extensions.manifest()
-			}));
-			const etag = createHash("sha256").update(body).update(extensions.contentDigest()).digest("hex");
-			if (headerValue(request.headers, "if-none-match") === etag) {
+			const operation = this.allocateRequest(authorization, response, {});
+			try {
+				operation.signal.throwIfAborted();
+				const body = Buffer.from(JSON.stringify({
+					protocol: 1,
+					extensions: extensions.manifest()
+				}));
+				const etag = createHash("sha256").update(body).update(extensions.contentDigest()).digest("hex");
+				if (headerValue(request.headers, "if-none-match") === etag) {
+					setSecurityHeaders(response, this.tlsEnabled);
+					response.writeHead(304);
+					response.end();
+					return;
+				}
 				setSecurityHeaders(response, this.tlsEnabled);
-				response.writeHead(304);
-				response.end();
+				response.writeHead(200, {
+					"Content-Type": "application/json; charset=utf-8",
+					"Content-Length": body.byteLength,
+					ETag: etag
+				});
+				if (request.method === "HEAD") response.end();
+				else response.end(body);
 				return;
+			} finally {
+				operation.release();
 			}
-			setSecurityHeaders(response, this.tlsEnabled);
-			response.writeHead(200, {
-				"Content-Type": "application/json; charset=utf-8",
-				"Content-Length": body.byteLength,
-				ETag: etag
-			});
-			if (request.method === "HEAD") response.end();
-			else response.end(body);
-			return;
 		}
 		if (targetInfo.kind === "script" || targetInfo.kind === "style" || targetInfo.kind === "asset") {
 			if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
-			const file = targetInfo.kind === "script" ? await extensions.readClientFile(targetInfo.id, "script") : targetInfo.kind === "style" ? await extensions.readClientFile(targetInfo.id, "style") : await extensions.readAsset(targetInfo.id, targetInfo.path ?? "");
-			if (headerValue(request.headers, "if-none-match") === file.digest) {
+			const operation = this.allocateRequest(authorization, response, {});
+			try {
+				const file = targetInfo.kind === "script" ? await extensions.readClientFile(targetInfo.id, "script", operation.signal) : targetInfo.kind === "style" ? await extensions.readClientFile(targetInfo.id, "style", operation.signal) : await extensions.readAsset(targetInfo.id, targetInfo.path ?? "", operation.signal);
+				if (headerValue(request.headers, "if-none-match") === file.digest) {
+					setSecurityHeaders(response, this.tlsEnabled);
+					response.writeHead(304);
+					response.end();
+					return;
+				}
+				const contentType = targetInfo.kind === "script" ? "text/javascript; charset=utf-8" : targetInfo.kind === "style" ? "text/css; charset=utf-8" : extensionContentType(targetInfo.path ?? "");
 				setSecurityHeaders(response, this.tlsEnabled);
-				response.writeHead(304);
-				response.end();
+				response.writeHead(200, {
+					"Content-Type": contentType,
+					"Content-Length": file.body.byteLength,
+					ETag: file.digest
+				});
+				if (request.method === "HEAD") response.end();
+				else response.end(file.body);
 				return;
+			} finally {
+				operation.release();
 			}
-			const contentType = targetInfo.kind === "script" ? "text/javascript; charset=utf-8" : targetInfo.kind === "style" ? "text/css; charset=utf-8" : extensionContentType(targetInfo.path ?? "");
-			setSecurityHeaders(response, this.tlsEnabled);
-			response.writeHead(200, {
-				"Content-Type": contentType,
-				"Content-Length": file.body.byteLength,
-				ETag: file.digest
-			});
-			if (request.method === "HEAD") response.end();
-			else response.end(file.body);
-			return;
 		}
 		if (targetInfo.kind === "action") {
 			if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
@@ -2819,7 +2959,9 @@ var MobileAccessGateway = class {
 	allocateRequest(authorization, response, upstream) {
 		if (this.activeRequests.size >= this.config.maxActiveRequests) throw new HttpError(429, "busy");
 		const id = this.nextOperationId++;
+		const controller = new AbortController();
 		const abort = () => {
+			controller.abort();
 			upstream.request?.destroy();
 			if (!response.destroyed) response.destroy();
 		};
@@ -2832,6 +2974,7 @@ var MobileAccessGateway = class {
 		}));
 		return {
 			id,
+			signal: controller.signal,
 			release: () => {
 				const entry = this.activeRequests.get(id);
 				if (entry !== void 0) clearTimeout(entry.timer);
@@ -2846,6 +2989,9 @@ var MobileAccessGateway = class {
 		const operation = this.allocateRequest(authorization, response, holder);
 		let bodyDone;
 		try {
+			const bufferedBody = request$2.method === "POST" && request$2.url?.split("?", 1)[0] === SESSION_HISTORY_PATH ? mobileHistoryRequestBody(request$2, await readBoundedBody(request$2, this.config.maxBodyBytes)) : void 0;
+			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			if (bufferedBody !== void 0) upstreamHeaders["content-length"] = String(bufferedBody.byteLength);
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
 					protocol: "http:",
@@ -2853,7 +2999,7 @@ var MobileAccessGateway = class {
 					port: Number(this.config.upstreamOrigin.port),
 					method: request$2.method,
 					path: request$2.url,
-					headers: sanitizeRequestHeaders(request$2, this.config.upstreamOrigin),
+					headers: upstreamHeaders,
 					agent: false
 				});
 				holder.request = upstreamRequest;
@@ -2862,12 +3008,25 @@ var MobileAccessGateway = class {
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
-				bodyDone = pipeline(request$2, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+				if (bufferedBody === void 0) bodyDone = pipeline(request$2, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+				else {
+					upstreamRequest.end(bufferedBody);
+					bodyDone = Promise.resolve();
+				}
 				bodyDone.catch(reject);
 			});
 			setSecurityHeaders(response, this.tlsEnabled);
-			response.writeHead(proxied.statusCode ?? 502, sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin));
-			await Promise.all([bodyDone, pipeline(proxied, response)]);
+			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			const compressed = shouldCompressResponse(request$2, proxied);
+			if (compressed) {
+				delete headers["accept-ranges"];
+				delete headers["content-length"];
+				delete headers.etag;
+				headers["content-encoding"] = "gzip";
+				addVaryAcceptEncoding(headers);
+			}
+			response.writeHead(proxied.statusCode ?? 502, headers);
+			await Promise.all([bodyDone, compressed ? pipeline(proxied, createGzip(), response) : pipeline(proxied, response)]);
 		} catch (error) {
 			holder.request?.destroy();
 			await bodyDone?.catch(() => void 0);
@@ -2983,6 +3142,8 @@ var MobileAccessGateway = class {
 			client.destroy();
 			upstream.destroy();
 		};
+		client.on("error", closeBoth);
+		upstream.on("error", closeBoth);
 		const timer = setTimeout(closeBoth, Math.max(1, authorization.expiresAt - Date.now()));
 		timer.unref();
 		const record = Object.freeze({
@@ -3008,8 +3169,16 @@ var MobileAccessGateway = class {
 		upstream.setTimeout(this.config.upstreamTimeoutMs, closeBoth);
 		try {
 			await new Promise((resolve, reject) => {
-				upstream.once("connect", resolve);
-				upstream.once("error", reject);
+				const connected = () => {
+					upstream.off("error", failed);
+					resolve();
+				};
+				const failed = (error) => {
+					upstream.off("connect", connected);
+					reject(error);
+				};
+				upstream.once("connect", connected);
+				upstream.once("error", failed);
 			});
 			const requestLines = [
 				`GET ${target.raw} HTTP/1.1`,
@@ -3042,16 +3211,16 @@ var MobileAccessGateway = class {
 		}
 	}
 	/** Loopback-only DSH WebServer route for opening pairing and managing devices. */
-	localAdminRoute() {
+	localAdminRoute(prefix = LOCAL_ADMIN_PREFIX) {
 		return {
 			kind: "prefix",
-			path: LOCAL_ADMIN_PREFIX,
+			path: prefix,
 			handler: async (request, response) => {
 				try {
 					const target = parseRequestTarget(request.url);
 					assertLocalAdminTrust(request, request.method === "POST");
 					if (target.search !== "") throw new HttpError(400, "bad_request");
-					if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/status`) {
+					if (request.method === "GET" && target.decodedPathname === `${prefix}/status`) {
 						sendJson(response, 200, {
 							gateway: this.address(),
 							pairing: this.access.pairingStatus(),
@@ -3064,18 +3233,19 @@ var MobileAccessGateway = class {
 						}, false);
 						return;
 					}
-					if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/devices`) {
+					if (request.method === "GET" && target.decodedPathname === `${prefix}/devices`) {
 						sendJson(response, 200, { devices: this.access.listDevices() }, false);
 						return;
 					}
-					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/pairing/open`) {
+					if (request.method === "POST" && target.decodedPathname === `${prefix}/pairing/open`) {
 						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 						if (body.ttlMs !== void 0 && typeof body.ttlMs !== "number") throw new HttpError(400, "bad_request");
 						const opened = await this.access.openPairing(body.ttlMs);
-						const pairUrl = `${this.address().origin}/mobile-access/pair#token=${opened.token}`;
+						const pairUrl = `${this.address().origin}/mobile-access/pair#instance=${this.config.instanceId}&token=${opened.token}`;
+						const appPairUrl = pairUrl;
 						let qrSvg = "";
 						try {
-							qrSvg = await QRCode.toString(pairUrl, {
+							qrSvg = await QRCode.toString(appPairUrl, {
 								type: "svg",
 								margin: 1
 							});
@@ -3084,18 +3254,19 @@ var MobileAccessGateway = class {
 							...opened,
 							appKey: `dsh1.${this.config.instanceId}.${opened.token}`,
 							pairUrl,
+							appPairUrl,
 							qrSvg
 						}, false);
 						return;
 					}
-					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/devices/revoke`) {
+					if (request.method === "POST" && target.decodedPathname === `${prefix}/devices/revoke`) {
 						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 						if (typeof body.deviceId !== "string" || !/^[a-f\d]{32}$/u.test(body.deviceId)) throw new HttpError(400, "bad_request");
 						if (!await this.access.revokeDevice(body.deviceId)) throw new HttpError(404, "not_found");
 						sendJson(response, 200, { revoked: true }, false);
 						return;
 					}
-					if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/devices/reset`) {
+					if (request.method === "POST" && target.decodedPathname === `${prefix}/devices/reset`) {
 						if ((await readJsonObject(request, MAX_CONTROL_BODY_BYTES)).confirm !== true) throw new HttpError(400, "bad_request");
 						await this.access.resetDevices();
 						sendJson(response, 200, { reset: true }, false);
@@ -3219,6 +3390,7 @@ var JsonDeviceStore = class {
 			throw error;
 		}
 		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576) throw new Error("device state must be a regular file no larger than 1 MiB");
+		await restrictPrivateFile(this.file);
 		let parsed;
 		try {
 			parsed = JSON.parse(await readFile(this.file, "utf8"));
@@ -3248,7 +3420,7 @@ var JsonDeviceStore = class {
 				mode: 384
 			});
 			await rename(temporary, this.file);
-			await chmod(this.file, 384);
+			await restrictPrivateFile(this.file);
 		} catch (error) {
 			try {
 				await rm(temporary, { force: true });
@@ -3312,6 +3484,1105 @@ const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机
 - 所有改动只限 $DSH_HOME/mobile-access/，不要动 DeepSeek Harness 源码
 
 请执行用户需求：外观或交互类改 mobile.css / mobile.js；需要电脑能力的创建或修改扩展。完成后简要说明改了什么、手机端会有什么变化。`;
+//#endregion
+//#region src/funnel.ts
+const MAX_PROTOCOL_LINE_BYTES = 16384;
+function publicStatus$1(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.loginUrl === void 0 ? {} : { loginUrl: status.loginUrl },
+		...status.setupUrl === void 0 ? {} : { setupUrl: status.setupUrl },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+const FUNNEL_SETUP_URLS = /* @__PURE__ */ new Set(["https://tailscale.com/s/no-funnel", "https://tailscale.com/s/https"]);
+function parseSetupUrl(value) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || value.length > 2048) throw new Error("invalid_sidecar_protocol");
+	const url = new URL(value);
+	const normalized = url.toString().replace(/\/$/u, "");
+	const officialInteractive = url.protocol === "https:" && url.hostname === "login.tailscale.com" && url.port === "" && url.username === "" && url.password === "";
+	if (!FUNNEL_SETUP_URLS.has(normalized) && !officialInteractive) throw new Error("invalid_sidecar_protocol");
+	return officialInteractive ? url.toString() : normalized;
+}
+function parseOrigin(value) {
+	if (typeof value !== "string" || value.length > 512) throw new Error("invalid_funnel_origin");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("invalid_funnel_origin");
+	}
+	if (url.protocol !== "https:" || !url.hostname.endsWith(".ts.net") || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new Error("invalid_funnel_origin");
+	return url.origin;
+}
+/** Parse one sidecar protocol line while restricting every browser-opened URL. */
+function parseFunnelEvent(line) {
+	if (Buffer.byteLength(line, "utf8") === 0 || Buffer.byteLength(line, "utf8") > MAX_PROTOCOL_LINE_BYTES) throw new Error("invalid_sidecar_protocol");
+	let value;
+	try {
+		value = JSON.parse(line);
+	} catch {
+		throw new Error("invalid_sidecar_protocol");
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("invalid_sidecar_protocol");
+	const record = value;
+	if (record.version !== 1 || typeof record.type !== "string") throw new Error("invalid_sidecar_protocol");
+	if (record.type === "login") {
+		if (typeof record.url !== "string" || record.url.length > 2048) throw new Error("invalid_sidecar_protocol");
+		const url = new URL(record.url);
+		if (url.protocol !== "https:" || url.hostname !== "login.tailscale.com") throw new Error("invalid_sidecar_protocol");
+		return Object.freeze({
+			version: 1,
+			type: "login",
+			url: url.toString()
+		});
+	}
+	if (record.type === "ready" || record.type === "serving") return Object.freeze({
+		version: 1,
+		type: record.type,
+		origin: parseOrigin(record.origin)
+	});
+	if (record.type === "error") {
+		if (typeof record.code !== "string" || !/^[a-z][a-z0-9_]{0,63}$/u.test(record.code)) throw new Error("invalid_sidecar_protocol");
+		const setupUrl = parseSetupUrl(record.url);
+		return Object.freeze({
+			version: 1,
+			type: "error",
+			code: record.code,
+			...setupUrl === void 0 ? {} : { url: setupUrl }
+		});
+	}
+	throw new Error("invalid_sidecar_protocol");
+}
+function withoutProvisioningSecrets(environment) {
+	const blocked = /* @__PURE__ */ new Set([
+		"TS_AUTHKEY",
+		"TAILSCALE_AUTHKEY",
+		"TS_OAUTH_CLIENT_SECRET"
+	]);
+	return Object.fromEntries(Object.entries(environment).filter(([name]) => !blocked.has(name.toUpperCase())));
+}
+/** Owns the source-built tsnet sidecar, remote gateway, and persisted remote switch. */
+var FunnelController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	generation = 0;
+	buffer = "";
+	latest = publicStatus$1({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable) || !isAbsolute(options.stateDirectory)) throw new Error("Funnel paths must be absolute");
+	}
+	/** Restore the remote switch without coupling it to LAN availability. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the currently attached authenticated remote gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the local desktop control UI. */
+	status() {
+		return publicStatus$1(this.latest);
+	}
+	/** Enable or disable Funnel without changing the LAN listener. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart a failed or interrupted Funnel session while retaining sign-in state. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable Funnel and remove only its private Tailscale node state. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("Funnel controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			await rm(resolve(this.options.stateDirectory), {
+				recursive: true,
+				force: true
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop all remote resources without modifying the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$1(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let entry;
+		try {
+			entry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "component_missing"
+			});
+			return;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "component_invalid"
+			});
+			return;
+		}
+		this.buffer = "";
+		this.publish({
+			enabled: true,
+			state: "starting"
+		});
+		const child = spawn(this.options.executable, [
+			"--state-dir",
+			resolve(this.options.stateDirectory),
+			"--hostname",
+			this.options.hostname
+		], {
+			env: withoutProvisioningSecrets(process.env),
+			shell: false,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		this.child = child;
+		child.stderr.resume();
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "sidecar_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "sidecar_stopped" : "sidecar_exited"));
+		});
+	}
+	consume(generation, chunk) {
+		if (generation !== this.generation) return;
+		this.buffer += chunk;
+		if (Buffer.byteLength(this.buffer, "utf8") > MAX_PROTOCOL_LINE_BYTES && !this.buffer.includes("\n")) {
+			this.enqueue(() => this.failGeneration(generation, "invalid_sidecar_protocol"));
+			return;
+		}
+		while (true) {
+			const newline = this.buffer.indexOf("\n");
+			if (newline < 0) return;
+			const line = this.buffer.slice(0, newline).replace(/\r$/u, "");
+			this.buffer = this.buffer.slice(newline + 1);
+			let event;
+			try {
+				event = parseFunnelEvent(line);
+			} catch {
+				this.enqueue(() => this.failGeneration(generation, "invalid_sidecar_protocol"));
+				return;
+			}
+			this.enqueue(() => this.handleEvent(generation, event));
+		}
+	}
+	async handleEvent(generation, event) {
+		if (generation !== this.generation || !this.enabled) return;
+		if (event.type === "login") {
+			this.publish({
+				enabled: true,
+				state: "needs-login",
+				loginUrl: event.url
+			});
+			return;
+		}
+		if (event.type === "error") {
+			await this.failGeneration(generation, event.code ?? "funnel_failed", event.url);
+			return;
+		}
+		const origin = parseOrigin(event.origin);
+		if (event.type === "ready") {
+			let gateway;
+			try {
+				await this.gatewayValue?.close();
+				this.gatewayValue = void 0;
+				gateway = await this.options.createGateway(origin);
+			} catch {
+				await this.failGeneration(generation, "gateway_start_failed");
+				return;
+			}
+			if (generation !== this.generation || !this.enabled) {
+				await gateway.close();
+				return;
+			}
+			this.gatewayValue = gateway;
+			const address = gateway.address();
+			const child = this.child;
+			if (child === void 0) {
+				await this.failGeneration(generation, "sidecar_stopped");
+				return;
+			}
+			child.stdin.write(`${JSON.stringify({
+				version: 1,
+				type: "serve",
+				target: `http://${address.host}:${String(address.port)}`
+			})}\n`, (error) => {
+				if (error !== null && error !== void 0) this.enqueue(() => this.failGeneration(generation, "control_channel_failed"));
+			});
+			this.publish({
+				enabled: true,
+				state: "connecting",
+				origin
+			});
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	async failGeneration(generation, code, setupUrl) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code,
+			...setupUrl === void 0 ? {} : { setupUrl }
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		const child = this.child;
+		this.child = void 0;
+		child?.stdin.end();
+		if (child !== void 0 && child.exitCode === null) {
+			child.kill("SIGTERM");
+			await new Promise((resolveClose) => {
+				let completed = false;
+				const finish = () => {
+					if (completed) return;
+					completed = true;
+					clearTimeout(timer);
+					resolveClose();
+				};
+				const timer = setTimeout(() => {
+					if (child.exitCode === null) child.kill("SIGKILL");
+					finish();
+				}, 1500);
+				timer.unref();
+				child.once("close", finish);
+			});
+		}
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await gateway?.close();
+	}
+};
+/** Locate the current platform's bundled Funnel executable, with one local development override. */
+function funnelExecutable(importMetaUrl, environment = process.env) {
+	const override = environment.DSH_MOBILE_FUNNEL_SIDECAR;
+	if (override !== void 0) {
+		if (!isAbsolute(override)) throw new Error("DSH_MOBILE_FUNNEL_SIDECAR must be an absolute path");
+		return resolve(override);
+	}
+	const suffix = process.platform === "win32" ? ".exe" : "";
+	const file = `dsh-mobile-funnel-${process.platform}-${process.arch}${suffix}`;
+	return resolve(fileURLToPath(new URL(`../bin/${file}`, importMetaUrl)));
+}
+//#endregion
+//#region src/cpolar.ts
+const MAX_LOG_BUFFER_BYTES = 65536;
+const START_TIMEOUT_MS = 45e3;
+const CPOLAR_HOST_SUFFIXES = Object.freeze([
+	".cpolar.cn",
+	".cpolar.io",
+	".cpolar.top",
+	".cpolar.com"
+]);
+function publicStatus(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+function isCpolarHost(hostname) {
+	return CPOLAR_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix));
+}
+/** Extract a validated public HTTPS origin from one cpolar log line. */
+function parseCpolarOrigin(line) {
+	if (!line.includes("Tunnel established at ")) return void 0;
+	const match = /Tunnel established at (https:\/\/[^"\s]+)/u.exec(line);
+	if (match === null) return void 0;
+	let url;
+	try {
+		url = new URL(match[1]);
+	} catch {
+		throw new Error("invalid_cpolar_origin");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || !isCpolarHost(url.hostname) || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new Error("invalid_cpolar_origin");
+	return url.origin;
+}
+async function reserveLoopbackPort() {
+	const server = createServer((socket) => {
+		socket.destroy();
+	});
+	await new Promise((resolveListen, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolveListen();
+		});
+	});
+	const address = server.address();
+	if (address === null || typeof address === "string") {
+		server.close();
+		throw new Error("cpolar_port_reservation_failed");
+	}
+	let released = false;
+	return {
+		port: address.port,
+		release: async () => {
+			if (released) return;
+			released = true;
+			await new Promise((resolveClose) => {
+				server.close(() => resolveClose());
+			});
+		}
+	};
+}
+function withoutProxyEnvironment(environment) {
+	const blocked = /* @__PURE__ */ new Set([
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY",
+		"NO_PROXY"
+	]);
+	return Object.fromEntries(Object.entries(environment).filter(([name]) => !blocked.has(name.toUpperCase())));
+}
+/** Owns an installed cpolar client and a provider-specific DSH remote gateway. */
+var CpolarController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	reservation;
+	generation = 0;
+	buffer = "";
+	latest = publicStatus({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	startupTimer;
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable) || !isAbsolute(options.configFile)) throw new Error("cpolar paths must be absolute");
+		if (options.region !== void 0 && !/^[a-z][a-z0-9_]{0,31}$/u.test(options.region)) throw new Error("cpolar region is invalid");
+	}
+	/** Restore the remembered cpolar switch independently from LAN and Funnel state. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the active cpolar-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return publicStatus(this.latest);
+	}
+	/** Enable or disable cpolar without changing LAN or Tailscale state. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart cpolar while retaining its account configuration and DSH device store. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable cpolar without modifying the user's cpolar account or global tunnels. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("cpolar controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop owned resources without changing the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let executableEntry;
+		try {
+			executableEntry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cpolar_component_missing"
+			});
+			return;
+		}
+		if (!executableEntry.isFile() || executableEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cpolar_component_invalid"
+			});
+			return;
+		}
+		let configEntry;
+		try {
+			configEntry = await lstat(this.options.configFile);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cpolar_config_missing"
+			});
+			return;
+		}
+		if (!configEntry.isFile() || configEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cpolar_config_invalid"
+			});
+			return;
+		}
+		let reservation;
+		try {
+			reservation = await reserveLoopbackPort();
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "error",
+				errorCode: "cpolar_port_unavailable"
+			});
+			return;
+		}
+		this.reservation = reservation;
+		this.buffer = "";
+		this.publish({
+			enabled: true,
+			state: "starting"
+		});
+		const args = [
+			"http",
+			`-config=${resolve(this.options.configFile)}`,
+			`-region=${this.options.region ?? "cn"}`,
+			"-inspect-addr=false",
+			"-redirect-https=true",
+			"-log=stdout",
+			"-log-level=INFO",
+			String(reservation.port)
+		];
+		const child = spawn(this.options.executable, args, {
+			env: withoutProxyEnvironment(process.env),
+			shell: false,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			windowsHide: true
+		});
+		this.child = child;
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.stderr.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "cpolar_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "cpolar_stopped" : "cpolar_exited"));
+		});
+		this.startupTimer = setTimeout(() => {
+			this.enqueue(() => this.failGeneration(generation, "cpolar_start_timeout"));
+		}, START_TIMEOUT_MS);
+		this.startupTimer.unref();
+	}
+	consume(generation, chunk) {
+		if (generation !== this.generation) return;
+		this.buffer += chunk;
+		if (Buffer.byteLength(this.buffer, "utf8") > MAX_LOG_BUFFER_BYTES && !this.buffer.includes("\n")) {
+			this.enqueue(() => this.failGeneration(generation, "cpolar_invalid_output"));
+			return;
+		}
+		while (true) {
+			const newline = this.buffer.indexOf("\n");
+			if (newline < 0) return;
+			const line = this.buffer.slice(0, newline).replace(/\r$/u, "");
+			this.buffer = this.buffer.slice(newline + 1);
+			let origin;
+			try {
+				origin = parseCpolarOrigin(line);
+			} catch {
+				this.enqueue(() => this.failGeneration(generation, "cpolar_invalid_origin"));
+				return;
+			}
+			if (origin !== void 0) this.enqueue(() => this.attachGateway(generation, origin));
+		}
+	}
+	async attachGateway(generation, origin) {
+		if (generation !== this.generation || !this.enabled || this.gatewayValue !== void 0) return;
+		const reservation = this.reservation;
+		if (reservation === void 0) return;
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		await reservation.release();
+		if (this.reservation === reservation) this.reservation = void 0;
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(origin, reservation.port);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	async failGeneration(generation, code) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		const reservation = this.reservation;
+		this.reservation = void 0;
+		await reservation?.release();
+		const child = this.child;
+		this.child = void 0;
+		if (child !== void 0 && child.exitCode === null) {
+			child.kill("SIGTERM");
+			await new Promise((resolveClose) => {
+				let completed = false;
+				const finish = () => {
+					if (completed) return;
+					completed = true;
+					clearTimeout(timer);
+					resolveClose();
+				};
+				const timer = setTimeout(() => {
+					if (child.exitCode === null) child.kill("SIGKILL");
+					finish();
+				}, 1500);
+				timer.unref();
+				child.once("close", finish);
+			});
+		}
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await gateway?.close();
+	}
+};
+//#endregion
+//#region src/cpolar-component.ts
+/** Pinned cpolar Windows component fetched only after an explicit user action. */
+const CPOLAR_COMPONENT_RELEASE = Object.freeze({
+	version: "3.3.18",
+	platform: "win32",
+	arch: "x64",
+	downloadUrl: "https://www.cpolar.com/static/downloads/releases/3.3.18/cpolar-stable-windows-amd64-setup.zip",
+	downloadBytes: 7603505,
+	downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
+	executableBytes: 19637680,
+	executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
+	downloadPage: "https://www.cpolar.com/download",
+	signupUrl: "https://dashboard.cpolar.com/signup",
+	dashboardUrl: "https://dashboard.cpolar.com/auth",
+	termsUrl: "https://www.cpolar.com/tos"
+});
+function inside(parent, child) {
+	const candidate = relative(parent, child);
+	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
+}
+async function sha256(file) {
+	return createHash("sha256").update(await readFile(file)).digest("hex");
+}
+async function regularFile(file, expectedBytes) {
+	try {
+		const stat = await lstat(file);
+		return stat.isFile() && !stat.isSymbolicLink() && (expectedBytes === void 0 || stat.size === expectedBytes);
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function run(file, args) {
+	await new Promise((resolveRun, reject) => {
+		execFile(file, [...args], {
+			windowsHide: true,
+			timeout: 12e4
+		}, (error) => {
+			if (error === null) resolveRun();
+			else reject(error);
+		});
+	});
+}
+async function defaultFetchArtifact(url, signal) {
+	const response = await fetch(url, {
+		redirect: "error",
+		signal
+	});
+	if (!response.ok) throw new Error(`cpolar_download_http_${String(response.status)}`);
+	const length = Number(response.headers.get("content-length"));
+	if (Number.isFinite(length) && length !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
+	return bytes;
+}
+async function defaultExtractArtifact(archive, destination) {
+	if (process.platform !== "win32") throw new Error("cpolar_component_unsupported");
+	const unpacked = join(destination, "archive");
+	const administrative = join(destination, "administrative");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await mkdir(administrative, {
+		recursive: true,
+		mode: 448
+	});
+	await run("tar.exe", [
+		"-xf",
+		archive,
+		"-C",
+		unpacked
+	]);
+	const msiRelative = (await readdir(unpacked, { recursive: true })).find((entry) => entry.toLowerCase().endsWith(".msi"));
+	if (msiRelative === void 0) throw new Error("cpolar_installer_missing");
+	await run("msiexec.exe", [
+		"/a",
+		join(unpacked, msiRelative),
+		"/qn",
+		`TARGETDIR=${administrative}`
+	]);
+	const executableRelative = (await readdir(administrative, { recursive: true })).find((entry) => basename(entry).toLowerCase() === "cpolar.exe");
+	if (executableRelative === void 0) throw new Error("cpolar_executable_missing");
+	await copyFile(join(administrative, executableRelative), join(destination, "cpolar.exe"));
+}
+/** Validate a cpolar Authtoken before it crosses the durable-file boundary. */
+function validateCpolarAuthtoken(value) {
+	if (typeof value !== "string" || value.length < 20 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("cpolar_authtoken_invalid");
+	return value;
+}
+/** Owns the optional cpolar binary and account configuration inside DSH Mobile state. */
+var CpolarComponentManager = class {
+	executable;
+	configFile;
+	componentRoot;
+	componentStorage;
+	stateRoot;
+	logRoot;
+	stagingRoot;
+	platform;
+	arch;
+	fetchArtifact;
+	extractArtifact;
+	installed = false;
+	configured = false;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		const stateDirectory = resolve(options.stateDirectory);
+		if (!isAbsolute(stateDirectory)) throw new Error("cpolar state directory must be absolute");
+		this.platform = options.platform ?? process.platform;
+		this.arch = options.arch ?? process.arch;
+		this.componentRoot = join(stateDirectory, "components", "cpolar");
+		this.componentStorage = join(this.componentRoot, CPOLAR_COMPONENT_RELEASE.version);
+		this.executable = join(this.componentStorage, "cpolar.exe");
+		this.stateRoot = join(stateDirectory, "state", "cpolar");
+		this.configFile = join(this.stateRoot, "cpolar.yml");
+		this.logRoot = join(stateDirectory, "logs", "cpolar");
+		this.stagingRoot = join(stateDirectory, "staging", "cpolar");
+		for (const child of [
+			this.componentRoot,
+			this.componentStorage,
+			this.stateRoot,
+			this.logRoot,
+			this.stagingRoot
+		]) if (!inside(stateDirectory, child)) throw new Error("cpolar component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact;
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact;
+	}
+	/** Inspect the managed binary and configuration without using global cpolar state. */
+	async initialize() {
+		this.installed = await regularFile(this.executable, CPOLAR_COMPONENT_RELEASE.executableBytes);
+		if (this.installed && await sha256(this.executable) !== CPOLAR_COMPONENT_RELEASE.executableSha256) {
+			this.installed = false;
+			this.errorCode = "cpolar_component_invalid";
+		}
+		this.configured = await regularFile(this.configFile);
+		if (this.configured) await restrictPrivateFile(this.configFile);
+	}
+	/** Return a safe status that never includes the account token. */
+	status() {
+		return Object.freeze({
+			supported: this.platform === CPOLAR_COMPONENT_RELEASE.platform && this.arch === CPOLAR_COMPONENT_RELEASE.arch,
+			installed: this.installed,
+			configured: this.configured,
+			version: CPOLAR_COMPONENT_RELEASE.version,
+			downloadBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
+			installedBytes: CPOLAR_COMPONENT_RELEASE.executableBytes,
+			sourceUrl: CPOLAR_COMPONENT_RELEASE.downloadUrl,
+			downloadPage: CPOLAR_COMPONENT_RELEASE.downloadPage,
+			signupUrl: CPOLAR_COMPONENT_RELEASE.signupUrl,
+			dashboardUrl: CPOLAR_COMPONENT_RELEASE.dashboardUrl,
+			termsUrl: CPOLAR_COMPONENT_RELEASE.termsUrl,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Download, verify, and administratively extract cpolar after explicit confirmation. */
+	install() {
+		return this.enqueue(async () => {
+			if (this.platform !== CPOLAR_COMPONENT_RELEASE.platform || this.arch !== CPOLAR_COMPONENT_RELEASE.arch) throw new Error("cpolar_component_unsupported");
+			await mkdir(this.stagingRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 12e4);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(CPOLAR_COMPONENT_RELEASE.downloadUrl, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (createHash("sha256").update(bytes).digest("hex") !== CPOLAR_COMPONENT_RELEASE.downloadSha256) throw new Error("cpolar_download_hash_mismatch");
+				const archive = join(staging, "cpolar.zip");
+				await writeFile(archive, bytes, {
+					flag: "wx",
+					mode: 384
+				});
+				await this.extractArtifact(archive, staging);
+				const extracted = join(staging, "cpolar.exe");
+				if (!await regularFile(extracted, CPOLAR_COMPONENT_RELEASE.executableBytes) || await sha256(extracted) !== CPOLAR_COMPONENT_RELEASE.executableSha256) throw new Error("cpolar_executable_hash_mismatch");
+				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+				await mkdir(candidate, {
+					recursive: true,
+					mode: 448
+				});
+				await copyFile(extracted, join(candidate, "cpolar.exe"));
+				await chmod(join(candidate, "cpolar.exe"), 448);
+				await rm(this.componentStorage, {
+					recursive: true,
+					force: true
+				});
+				await rename(candidate, this.componentStorage);
+				this.installed = true;
+				this.errorCode = void 0;
+			} finally {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+			}
+		});
+	}
+	/** Store only the cpolar token in a private, self-update-disabled configuration. */
+	configure(authtoken) {
+		return this.enqueue(async () => {
+			const token = validateCpolarAuthtoken(authtoken);
+			await mkdir(this.stateRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const temporary = join(this.stateRoot, `.cpolar.${randomBytes(12).toString("hex")}.tmp`);
+			const body = `authtoken: ${JSON.stringify(token)}\nconsole_ui: false\nupdate: false\ninspect_db_size: -1\n`;
+			try {
+				await writeFile(temporary, body, {
+					encoding: "utf8",
+					flag: "wx",
+					mode: 384
+				});
+				await rename(temporary, this.configFile);
+				await restrictPrivateFile(this.configFile);
+			} catch (error) {
+				await rm(temporary, { force: true });
+				throw error;
+			}
+			this.configured = true;
+			this.errorCode = void 0;
+		});
+	}
+	/** Remove every cpolar file owned by DSH Mobile without touching global state. */
+	purge() {
+		return this.enqueue(async () => {
+			await Promise.all([
+				rm(this.componentRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stateRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.logRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stagingRoot, {
+					recursive: true,
+					force: true
+				})
+			]);
+			this.installed = false;
+			this.configured = false;
+			this.errorCode = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+//#endregion
+//#region src/remote.ts
+/** Validate the provider selection loaded across the filesystem boundary. */
+function parseRemoteProviderState(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
+	const record = value;
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	return Object.freeze({
+		version: 1,
+		provider: record.provider
+	});
+}
+/** Atomic selection store whose absent-file state uses the configured default. */
+var JsonRemoteProviderStore = class {
+	file;
+	defaultProvider;
+	constructor(file, defaultProvider) {
+		this.file = file;
+		this.defaultProvider = defaultProvider;
+	}
+	async load() {
+		let stat;
+		try {
+			stat = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return Object.freeze({
+				version: 1,
+				provider: this.defaultProvider
+			});
+			throw error;
+		}
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("remote provider state must be a regular file no larger than 4 KiB");
+		await restrictPrivateFile(this.file);
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("remote provider state is not valid JSON", { cause: error });
+		}
+		return parseRemoteProviderState(parsed);
+	}
+	async save(state) {
+		const validated = parseRemoteProviderState(state);
+		const directory = dirname(this.file);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("remote provider state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, this.file);
+			await restrictPrivateFile(this.file);
+		} catch (error) {
+			await rm(temporary, { force: true });
+			throw error;
+		}
+	}
+};
+/** Resolve the first-run provider without letting environment values bypass validation. */
+function configuredRemoteProvider(environment) {
+	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
+	if (value !== "tailscale" && value !== "cpolar") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale or cpolar");
+	return value;
+}
 promisify(execFile);
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
@@ -3445,11 +4716,12 @@ async function atomicWrite(file, contents) {
 	});
 	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
 	await writeFile(temporary, contents, { mode: 384 });
-	await chmod(temporary, 384);
 	await rename(temporary, file);
+	await restrictPrivateFile(file);
 }
 /** Sign and atomically install a server leaf for the interface's current address. */
 async function refreshManagedServerCertificate(setup, address) {
+	await Promise.all([restrictPrivateFile(setup.tls.caCertFile), restrictPrivateFile(setup.tls.caKeyFile)]);
 	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
 	assertMatchingCa(caCert, caKey);
 	const now = /* @__PURE__ */ new Date();
@@ -3530,6 +4802,8 @@ function mapAdminError(error) {
 	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
 	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
+	if (error instanceof Error && error.message === "cpolar_authtoken_invalid") return new HttpError(400, "cpolar_authtoken_invalid");
+	if (error instanceof Error && error.message.startsWith("cpolar_")) return new HttpError(409, error.message);
 	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
@@ -3588,11 +4862,77 @@ async function loadSetup(config) {
 		}
 	};
 }
+function loopbackTemplate(loaded) {
+	return parseGatewayConfig({
+		...withoutSetupKeys(loaded.config),
+		...loaded.kind === "managed" ? { upstreamOrigin: loaded.setup.upstreamOrigin } : loaded.config.upstreamOrigin === void 0 ? {} : { upstreamOrigin: loaded.config.upstreamOrigin },
+		listenHost: "127.0.0.1",
+		listenPort: 0,
+		publicAuthorities: ["127.0.0.1"],
+		allowedCidrs: ["127.0.0.0/8"],
+		tls: { mode: "disabled" }
+	});
+}
+async function stableInstanceId(loaded, template) {
+	if (loaded.kind !== "managed") return loaded.config.instanceId ?? template.instanceId;
+	return new X509Certificate(await readFile(loaded.setup.tls.caCertFile)).fingerprint256.replaceAll(":", "").toLowerCase();
+}
+function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, listenPort = 0) {
+	const origin = new URL(publicOrigin);
+	if (origin.protocol !== "https:" || origin.username !== "" || origin.password !== "" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error("remote public origin must be an HTTPS origin");
+	const publicAuthority = origin.port === "" ? `${origin.hostname}:443` : origin.host;
+	const { pairingCaFile: _pairingCaFile, ...shared } = template;
+	return Object.freeze({
+		...shared,
+		listenHost: "127.0.0.1",
+		listenPort,
+		authorities: Object.freeze([parseAuthority(publicAuthority)]),
+		allowedCidrs: Object.freeze([parseCidr("127.0.0.0/8")]),
+		stateFile,
+		instanceId,
+		tls: Object.freeze({ mode: "disabled" }),
+		publicTls: true,
+		discovery: false
+	});
+}
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent) {
+	return {
+		provider,
+		running: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.loginUrl === void 0 ? {} : { loginUrl: status.loginUrl },
+		...status.setupUrl === void 0 ? {} : { setupUrl: status.setupUrl },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode },
+		...gateway === void 0 ? {} : { extensions: gateway.extensionStatus() },
+		providers: {
+			tailscale: {
+				bundled: true,
+				running: providerStatuses.tailscale.enabled,
+				state: providerStatuses.tailscale.state
+			},
+			cpolar: {
+				bundled: false,
+				running: providerStatuses.cpolar.enabled,
+				state: providerStatuses.cpolar.state,
+				component: cpolarComponent
+			}
+		}
+	};
+}
 /** Mount the resident control route and its optional authenticated LAN gateway. */
 async function apply(ctx, config) {
 	assertSupportedDshVersion(installedDshVersion());
 	const loaded = await loadSetup(config);
 	const mobileAccess = createMobileAccessService(ctx);
+	const template = loopbackTemplate(loaded);
+	const instanceId = await stableInstanceId(loaded, template);
+	const stateDirectory = dirname(template.stateFile);
+	const remoteDirectory = join(stateDirectory, "remote");
+	const remoteProviderStore = new JsonRemoteProviderStore(join(remoteDirectory, "provider.json"), configuredRemoteProvider(process.env));
+	let remoteProvider = (await remoteProviderStore.load()).provider;
+	const cpolarComponent = new CpolarComponentManager({ stateDirectory });
+	await cpolarComponent.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
 		id: "computer-images",
@@ -3623,22 +4963,15 @@ async function apply(ctx, config) {
 			}
 		}]
 	});
-	let gateway;
+	let lanGateway;
 	const startGateway = async (candidateConfig) => {
 		const resolved = parseGatewayConfig(candidateConfig);
-		await mobileAccess.startLocal(resolved.extensionsDir, ctx);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess);
-		try {
-			await candidate.start();
-		} catch (error) {
-			await mobileAccess.stopLocal();
-			throw error;
-		}
-		gateway = candidate;
+		await candidate.start();
+		lanGateway = candidate;
 		return { close: async () => {
-			if (gateway === candidate) gateway = void 0;
+			if (lanGateway === candidate) lanGateway = void 0;
 			await candidate.close();
-			await mobileAccess.stopLocal();
 		} };
 	};
 	const startRuntime = async () => {
@@ -3658,7 +4991,69 @@ async function apply(ctx, config) {
 		await following.initialize(2e3);
 		return following;
 	};
-	const controller = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
+	const lanController = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
+	const remoteDeviceFile = join(remoteDirectory, "devices.json");
+	const legacyCpolarDeviceFile = join(remoteDirectory, "cpolar", "devices.json");
+	if (remoteProvider === "cpolar") try {
+		await lstat(remoteDeviceFile);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		try {
+			await copyFile(legacyCpolarDeviceFile, remoteDeviceFile);
+		} catch (copyError) {
+			if (copyError.code !== "ENOENT") throw copyError;
+		}
+	}
+	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
+		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess);
+		await candidate.start();
+		return candidate;
+	};
+	const tailscaleStore = new JsonMobileAccessControlStore(join(remoteDirectory, "control.json"), false);
+	const cpolarStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cpolar", "control.json"), false);
+	const remoteControllers = {
+		tailscale: new FunnelController({
+			store: tailscaleStore,
+			executable: funnelExecutable(import.meta.url),
+			stateDirectory: join(remoteDirectory, "tailscale"),
+			hostname: `dsh-${instanceId.slice(0, 12)}`,
+			createGateway: createRemoteGateway
+		}),
+		cpolar: new CpolarController({
+			store: cpolarStore,
+			executable: cpolarComponent.executable,
+			configFile: cpolarComponent.configFile,
+			region: "cn",
+			createGateway: createRemoteGateway
+		})
+	};
+	const remoteController = () => remoteControllers[remoteProvider];
+	const remotePayload = () => remoteControlPayload(remoteProvider, remoteController().status(), remoteController().gateway(), {
+		tailscale: remoteControllers.tailscale.status(),
+		cpolar: remoteControllers.cpolar.status()
+	}, cpolarComponent.status());
+	const selectRemoteProvider = async (provider) => {
+		if (provider === remoteProvider) return;
+		const previous = remoteControllers[remoteProvider];
+		const restore = previous.status().enabled;
+		if (restore) await previous.setEnabled(false);
+		try {
+			await remoteProviderStore.save({
+				version: 1,
+				provider
+			});
+			remoteProvider = provider;
+		} catch (error) {
+			if (restore) await previous.setEnabled(true);
+			throw error;
+		}
+	};
+	const lanPayload = () => ({
+		running: lanController.isRunning(),
+		origin: lanGateway?.address().origin,
+		...lanGateway === void 0 ? {} : { extensions: lanGateway.extensionStatus() }
+	});
 	const adminRoute = {
 		kind: "prefix",
 		path: LOCAL_ADMIN_PREFIX,
@@ -3667,26 +5062,81 @@ async function apply(ctx, config) {
 				const target = parseRequestTarget(request.url);
 				assertLocalAdminTrust(request, request.method === "POST");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
-				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/control`) {
-					sendJson(response, 200, {
-						running: controller.isRunning(),
-						origin: gateway?.address().origin,
-						...gateway === void 0 ? {} : { extensions: gateway.extensionStatus() }
-					}, false);
+				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;
+				if (request.method === "GET" && lanControl) {
+					sendJson(response, 200, lanPayload(), false);
+					return;
+				}
+				if (request.method === "POST" && lanControl) {
+					const body = await readJsonObject(request, 4096);
+					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
+					await lanController.setRunning(body.running);
+					sendJson(response, 200, lanPayload(), false);
+					return;
+				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/control`) {
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
+					const body = await readJsonObject(request, 4096);
+					if (body.provider !== "tailscale" && body.provider !== "cpolar") throw new HttpError(400, "bad_request");
+					await selectRemoteProvider(body.provider);
+					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
-				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/control`) {
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await cpolarComponent.install();
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/configure`) {
+					const body = await readJsonObject(request, 4096);
+					await cpolarComponent.configure(body.authtoken);
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteControllers.cpolar.setEnabled(false);
+					await cpolarComponent.purge();
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/control`) {
 					const body = await readJsonObject(request, 4096);
 					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					await controller.setRunning(body.running);
-					sendJson(response, 200, {
-						running: controller.isRunning(),
-						origin: gateway?.address().origin,
-						...gateway === void 0 ? {} : { extensions: gateway.extensionStatus() }
-					}, false);
+					await remoteController().setEnabled(body.running);
+					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
-				const active = gateway;
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reconnect`) {
+					await readJsonObject(request, 4096);
+					await remoteController().reconnect();
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reset`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteController().reset();
+					await rm(remoteDeviceFile, { force: true });
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (target.decodedPathname.startsWith(`/api/mobile-access/remote/`)) {
+					const active = remoteController().gateway();
+					if (active === void 0) throw new HttpError(409, "gateway_stopped");
+					await active.localAdminRoute(`${LOCAL_ADMIN_PREFIX}/remote`).handler(request, response);
+					return;
+				}
+				if (target.decodedPathname.startsWith(`/api/mobile-access/lan/`)) {
+					const active = lanGateway;
+					if (active === void 0) throw new HttpError(409, "gateway_stopped");
+					await active.localAdminRoute(`${LOCAL_ADMIN_PREFIX}/lan`).handler(request, response);
+					return;
+				}
+				const active = lanGateway;
 				if (active === void 0) throw new HttpError(409, "gateway_stopped");
 				await active.localAdminRoute().handler(request, response);
 			} catch (error) {
@@ -3727,20 +5177,36 @@ async function apply(ctx, config) {
 			}
 		});
 		try {
-			await controller.initialize();
+			await mobileAccess.startLocal(template.extensionsDir, ctx);
+			await lanController.initialize();
+			if (remoteProvider === "tailscale") await cpolarStore.save({
+				version: 1,
+				enabled: false
+			});
+			else await tailscaleStore.save({
+				version: 1,
+				enabled: false
+			});
+			await remoteControllers.tailscale.initialize();
+			await remoteControllers.cpolar.initialize();
 		} catch (error) {
 			unregister();
 			disposeMobileCommand();
+			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
+			await lanController.close();
+			await mobileAccess.stopLocal();
 			unregisterBuiltin();
 			throw error;
 		}
 		return async () => {
 			unregister();
 			disposeMobileCommand();
-			await controller.close();
+			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
+			await lanController.close();
+			await mobileAccess.stopLocal();
 			unregisterBuiltin();
 		};
-	}, "dsh-mobile: local control, authenticated LAN gateway, and /mobile command");
+	}, "dsh-mobile: independent LAN and selectable remote access with /mobile command");
 }
 //#endregion
 export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, EXTENSION_LIMITS, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, createMobileAccessService, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority, rewriteMobileIndex };