dsh-mobile 0.3.1 → 0.3.3

package/lib/index.mjs

@@ -11,7 +11,7 @@ import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces } from "node:os";
 import { createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2 } from "node:https";
-import { Transform } from "node:stream";
+import { Transform, finished } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
@@ -1246,18 +1246,40 @@ const EXTENSION_LIMITS = Object.freeze({
 	manifest: 65536,
 	script: 1048576,
 	css: 524288,
-	asset: 8388608
+	asset: 8388608,
+	assetFiles: 256,
+	assetBytes: 33554432,
+	assetDepth: 8
 });
 /** A misbehaving host activation must not wedge the local watcher forever. */
 const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
-async function withActivationTimeout(promise, id) {
+/** The previous Host outlives the hidden-page refresh interval and one timed refresh. */
+const RETIRED_GENERATION_TTL_MS = 6e5;
+/** Extension teardown is advisory and must never stop watcher progress. */
+const HOST_TEARDOWN_TIMEOUT_MS = 2e3;
+async function withActivationTimeout(promise, id, signal) {
 	let timer;
+	let onAbort;
 	try {
-		return await Promise.race([promise, new Promise((_, reject) => {
-			timer = setTimeout(() => reject(new MobileExtensionError("host_load_timeout", `extension ${id} activation timed out`, 500)), HOST_ACTIVATION_TIMEOUT_MS);
-		})]);
+		return await Promise.race([
+			promise,
+			new Promise((_, reject) => {
+				timer = setTimeout(() => reject(new MobileExtensionError("host_load_timeout", `extension ${id} activation timed out`, 500)), HOST_ACTIVATION_TIMEOUT_MS);
+			}),
+			new Promise((_, reject) => {
+				const abort = () => {
+					reject(new MobileExtensionError("host_activation_closed", `extension ${id} activation is closed`, 409));
+				};
+				if (signal.aborted) abort();
+				else {
+					onAbort = abort;
+					signal.addEventListener("abort", abort, { once: true });
+				}
+			})
+		]);
 	} finally {
 		if (timer !== void 0) clearTimeout(timer);
+		if (onAbort !== void 0) signal.removeEventListener("abort", onAbort);
 	}
 }
 /** A controlled business failure returned by an extension action or route. */
@@ -1312,7 +1334,7 @@ function normalizeRelativePath(value, field) {
 	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
 	return normalized;
 }
-async function regularFile$1(path, maximum, field) {
+async function regularFile$2(path, maximum, field) {
 	let info;
 	try {
 		info = await lstat(path);
@@ -1333,7 +1355,7 @@ async function containedPath(root, relativePath, maximum, field) {
 	const targetReal = await realpath(target);
 	const relation = relative(rootReal, targetReal);
 	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
-	return regularFile$1(targetReal, maximum, field);
+	return regularFile$2(targetReal, maximum, field);
 }
 async function optionalFile(root, name, maximum, field) {
 	try {
@@ -1346,21 +1368,96 @@ async function optionalFile(root, name, maximum, field) {
 }
 async function optionalBytes(root, name, maximum, field) {
 	const path = await optionalFile(root, name, maximum, field);
-	return path === void 0 ? Buffer.alloc(0) : readFile(path);
+	return path === void 0 ? void 0 : readFile(path);
+}
+function assertRealPathWithin(rootReal, targetReal, field) {
+	const relation = relative(rootReal, targetReal);
+	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
+}
+async function realExtensionRoot(directory) {
+	const root = resolve(directory);
+	const info = await lstat(root);
+	if (!info.isDirectory() || info.isSymbolicLink()) throw new MobileExtensionError("invalid_extension", "extension directory must be real");
+	return realpath(root);
+}
+async function assetSnapshot(extensionRootReal) {
+	const assetsPath = join(extensionRootReal, "assets");
+	let assetsInfo;
+	try {
+		assetsInfo = await lstat(assetsPath);
+	} catch (error) {
+		if (error.code === "ENOENT") return /* @__PURE__ */ new Map();
+		throw error;
+	}
+	if (!assetsInfo.isDirectory() || assetsInfo.isSymbolicLink()) throw new MobileExtensionError("invalid_extension", "assets must be a real directory");
+	const assetsReal = await realpath(assetsPath);
+	assertRealPathWithin(extensionRootReal, assetsReal, "assets");
+	const snapshots = /* @__PURE__ */ new Map();
+	let totalBytes = 0;
+	const visit = async (directoryReal, prefix, depth) => {
+		if (depth > EXTENSION_LIMITS.assetDepth) throw new MobileExtensionError("invalid_extension", "asset tree exceeds its depth limit");
+		assertRealPathWithin(extensionRootReal, directoryReal, "asset directory");
+		const handle = await opendir(directoryReal);
+		const entries = [];
+		try {
+			for await (const entry of handle) entries.push(entry);
+		} finally {
+			await handle.close().catch(() => void 0);
+		}
+		entries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+		for (const entry of entries) {
+			const path = join(directoryReal, entry.name);
+			const info = await lstat(path);
+			if (info.isSymbolicLink()) throw new MobileExtensionError("invalid_extension_path", "asset escapes extension directory");
+			const targetReal = await realpath(path);
+			assertRealPathWithin(extensionRootReal, targetReal, "asset");
+			const key = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
+			if (info.isDirectory()) {
+				await visit(targetReal, key, depth + 1);
+				continue;
+			}
+			if (!info.isFile() || info.size > EXTENSION_LIMITS.asset) throw new MobileExtensionError("invalid_extension", "asset must be a regular file within its size limit");
+			const body = await readFile(targetReal);
+			totalBytes += body.byteLength;
+			if (snapshots.size >= EXTENSION_LIMITS.assetFiles || totalBytes > EXTENSION_LIMITS.assetBytes) throw new MobileExtensionError("invalid_extension", "asset tree exceeds its aggregate limit");
+			snapshots.set(key, Object.freeze({
+				body,
+				digest: createHash("sha256").update(body).digest("hex"),
+				name: entry.name
+			}));
+		}
+	};
+	await visit(assetsReal, "", 0);
+	return snapshots;
 }
 async function extensionFingerprint(directory) {
-	const manifestFile = await regularFile$1(join(directory, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const root = await realExtensionRoot(directory);
+	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifestBody = await readFile(manifestFile.path);
 	const manifest = parseExtensionManifest(JSON.parse(manifestBody.toString("utf8")));
-	if (manifest.id !== basename(resolve(directory))) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
-	const [host, script, style] = await Promise.all([
-		optionalBytes(directory, "host.mjs", EXTENSION_LIMITS.script, "host.mjs"),
-		optionalBytes(directory, "mobile.js", EXTENSION_LIMITS.script, "mobile.js"),
-		optionalBytes(directory, "mobile.css", EXTENSION_LIMITS.css, "mobile.css")
+	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
+	const [host, script, style, assets] = await Promise.all([
+		optionalBytes(root, "host.mjs", EXTENSION_LIMITS.script, "host.mjs"),
+		optionalBytes(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js"),
+		optionalBytes(root, "mobile.css", EXTENSION_LIMITS.css, "mobile.css"),
+		assetSnapshot(root)
 	]);
+	const digest = createHash("sha256").update(`manifest:${manifestBody.byteLength}:`).update(createHash("sha256").update(manifestBody).digest());
+	for (const [name, body] of [
+		["host", host],
+		["script", script],
+		["style", style]
+	]) {
+		digest.update(`\0${name}:${body?.byteLength ?? -1}:`);
+		if (body !== void 0) digest.update(createHash("sha256").update(body).digest());
+	}
+	for (const [name, asset] of assets) digest.update(`\0asset:${Buffer.byteLength(name)}:${name}:${asset.body.byteLength}:${asset.digest}`);
 	return {
 		manifest,
-		digest: createHash("sha256").update(manifestBody).update(host).update(script).update(style).digest("hex")
+		digest: digest.digest("hex"),
+		assets,
+		...script === void 0 ? {} : { scriptBody: script },
+		...style === void 0 ? {} : { styleBody: style }
 	};
 }
 function routeKey(route) {
@@ -1415,20 +1512,49 @@ function validateDefinition(definition) {
 		...routes.length === 0 ? {} : { routes: Object.freeze(routes) }
 	});
 }
-function combineSignals(first, second) {
-	if (first.aborted || second.aborted) return AbortSignal.abort(first.aborted ? first.reason : second.reason);
-	return AbortSignal.any([first, second]);
+function combineSignalLifetime(first, second) {
+	if (first.aborted || second.aborted) {
+		const aborted = new AbortController();
+		aborted.abort(first.aborted ? first.reason : second.reason);
+		return {
+			signal: aborted.signal,
+			cleanup: () => void 0
+		};
+	}
+	const controller = new AbortController();
+	const cleanup = () => {
+		first.removeEventListener("abort", abortFirst);
+		second.removeEventListener("abort", abortSecond);
+	};
+	const abortFirst = () => {
+		cleanup();
+		controller.abort(first.reason);
+	};
+	const abortSecond = () => {
+		cleanup();
+		controller.abort(second.reason);
+	};
+	first.addEventListener("abort", abortFirst, { once: true });
+	second.addEventListener("abort", abortSecond, { once: true });
+	return {
+		signal: controller.signal,
+		cleanup
+	};
 }
 /** Host registry and service consumed by both npm plugins and local extensions. */
 var MobileAccessService = class extends Service {
 	registered = /* @__PURE__ */ new Map();
 	local = /* @__PURE__ */ new Map();
+	retired = /* @__PURE__ */ new Map();
 	failures = /* @__PURE__ */ new Map();
-	contentHash = "";
+	contentListeners = /* @__PURE__ */ new Set();
+	contentHash = createHash("sha256").update("").digest("hex");
 	localRoot;
 	localContext;
 	localTimer;
 	localRefreshing;
+	localRefreshAbort;
+	localLifecycle = 0;
 	localClosed = true;
 	constructor(ctx) {
 		super(ctx, "mobileAccess");
@@ -1454,9 +1580,21 @@ var MobileAccessService = class extends Service {
 	contentDigest() {
 		return this.contentHash;
 	}
+	/** Subscribe to committed extension generation changes. */
+	onContentChanged(listener) {
+		this.contentListeners.add(listener);
+		return () => {
+			this.contentListeners.delete(listener);
+		};
+	}
 	updateContentHash() {
 		const parts = [...[...this.registered.values()].map((entry) => entry.definition.id), ...[...this.local.values()].map((active) => `${active.manifest.id}:${active.digest}`)];
-		this.contentHash = createHash("sha256").update(parts.sort().join("|")).digest("hex");
+		const next = createHash("sha256").update(parts.sort().join("|")).digest("hex");
+		if (next === this.contentHash) return;
+		this.contentHash = next;
+		for (const listener of this.contentListeners) try {
+			listener();
+		} catch {}
 	}
 	/** Return the current client-facing manifest, deterministically sorted by id. */
 	manifest() {
@@ -1470,8 +1608,9 @@ var MobileAccessService = class extends Service {
 		});
 		for (const active of this.local.values()) entries.set(active.manifest.id, {
 			...active.manifest,
-			...active.scriptFile === void 0 ? {} : { scriptUrl: `/mobile-access/extensions/${active.manifest.id}/mobile.js` },
-			...active.styleFile === void 0 ? {} : { styleUrl: `/mobile-access/extensions/${active.manifest.id}/mobile.css` },
+			generation: active.digest,
+			...active.scriptBody === void 0 ? {} : { scriptUrl: `/mobile-access/extensions/${active.manifest.id}/mobile.js?generation=${active.digest}` },
+			...active.styleBody === void 0 ? {} : { styleUrl: `/mobile-access/extensions/${active.manifest.id}/mobile.css?generation=${active.digest}` },
 			assetsUrl: `/mobile-access/extensions/${active.manifest.id}/assets/`
 		});
 		return [...entries.values()].sort((left, right) => left.id.localeCompare(right.id));
@@ -1484,49 +1623,52 @@ var MobileAccessService = class extends Service {
 		});
 	}
 	/** Locate one active extension. */
-	extension(id) {
+	extension(id, generation) {
+		if (generation !== void 0) {
+			const current = this.local.get(id);
+			if (current?.digest === generation) return current;
+			const previous = this.retired.get(id)?.active;
+			return previous?.digest === generation ? previous : void 0;
+		}
 		return this.local.get(id) ?? this.registered.get(id)?.definition;
 	}
 	/** Return the active local generation signal for gateway cancellation wiring. */
-	signal(id) {
-		return this.local.get(id)?.controller.signal;
+	signal(id, generation) {
+		const extension = this.extension(id, generation);
+		return extension !== void 0 && "host" in extension ? extension.controller.signal : void 0;
 	}
 	/** Read a local client entry after validating that it remains inside its directory. */
-	async readClientFile(id, kind, signal) {
+	async readClientFile(id, kind, signal, generation) {
 		signal?.throwIfAborted();
-		const active = this.local.get(id);
-		if (active === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
-		const path = kind === "script" ? active.scriptFile : active.styleFile;
-		if (path === void 0) throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
-		const file = await regularFile$1(path, kind === "script" ? EXTENSION_LIMITS.script : EXTENSION_LIMITS.css, kind);
-		const body = await readFile(file.path, { signal });
+		const selected = this.extension(id, generation);
+		const active = selected !== void 0 && "host" in selected ? selected : void 0;
+		if (active === void 0) throw new MobileExtensionError("extension_generation_not_found", "extension generation not found", 404);
+		const snapshot = kind === "script" ? active.scriptBody : active.styleBody;
+		if (snapshot === void 0) throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
+		const body = Buffer.from(snapshot);
 		return {
 			body,
 			digest: createHash("sha256").update(body).digest("hex")
 		};
 	}
-	/** Read a local static asset after containment and size checks. */
-	async readAsset(id, assetPath, signal) {
+	/** Read a generation-pinned static asset from its validated snapshot. */
+	async readAsset(id, assetPath, signal, generation) {
 		signal?.throwIfAborted();
-		const active = this.local.get(id);
-		if (active === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
-		let file;
-		try {
-			file = await containedPath(join(active.directory, "assets"), assetPath, EXTENSION_LIMITS.asset, "asset");
-		} catch (error) {
-			if (error.code === "ENOENT") throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
-			throw error;
-		}
-		const body = await readFile(file.path, { signal });
+		const selected = this.extension(id, generation);
+		const active = selected !== void 0 && "host" in selected ? selected : void 0;
+		if (active === void 0) throw new MobileExtensionError("extension_generation_not_found", "extension generation not found", 404);
+		const normalized = normalizeRelativePath(assetPath, "asset");
+		const asset = active.assets.get(normalized);
+		if (asset === void 0) throw new MobileExtensionError("extension_asset_not_found", "extension asset not found", 404);
 		return {
-			body,
-			digest: createHash("sha256").update(body).digest("hex"),
-			name: basename(file.path)
+			body: Buffer.from(asset.body),
+			digest: asset.digest,
+			name: asset.name
 		};
 	}
 	/** Invoke one action after parsing its input and binding the request lifetime. */
-	async invoke(id, actionName, input, context) {
-		const extension = this.extension(id);
+	async invoke(id, actionName, input, context, generation) {
+		const extension = this.extension(id, generation);
 		if (extension === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		const action = ("host" in extension ? extension.host : extension).actions?.[actionName];
 		if (action === void 0) throw new MobileExtensionError("action_not_found", "action not found", 404);
@@ -1536,7 +1678,8 @@ var MobileAccessService = class extends Service {
 		} catch {
 			throw new MobileExtensionError("invalid_action_input", "action input is invalid", 400);
 		}
-		const signal = "host" in extension ? combineSignals(extension.controller.signal, context.signal) : context.signal;
+		const lifetime = "host" in extension ? combineSignalLifetime(extension.controller.signal, context.signal) : void 0;
+		const signal = lifetime?.signal ?? context.signal;
 		try {
 			return await action.run({
 				...context,
@@ -1545,39 +1688,53 @@ var MobileAccessService = class extends Service {
 		} catch (error) {
 			if (error instanceof MobileExtensionError) throw error;
 			throw new MobileExtensionError("extension_failed", "extension action failed", 500);
+		} finally {
+			lifetime?.cleanup();
 		}
 	}
 	/** Match one route and invoke it with a generation-bound abort signal. */
-	async route(id, method, pathname, request) {
-		const extension = this.extension(id);
+	async route(id, method, pathname, request, generation) {
+		const extension = this.extension(id, generation);
 		if (extension === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		const route = ("host" in extension ? extension.host : extension).routes?.find((candidate) => {
 			if (candidate.method !== method) return false;
 			return (candidate.kind ?? "exact") === "exact" ? candidate.path === pathname : pathname === candidate.path || pathname.startsWith(`${candidate.path}/`);
 		});
 		if (route === void 0) throw new MobileExtensionError("route_not_found", "route not found", 404);
+		const lifetime = "host" in extension ? combineSignalLifetime(extension.controller.signal, request.signal) : void 0;
+		let releaseLifetime = true;
 		try {
-			const routeRequest = "host" in extension ? {
+			const routeRequest = lifetime === void 0 ? request : {
 				...request,
-				signal: combineSignals(extension.controller.signal, request.signal)
-			} : request;
+				signal: lifetime.signal
+			};
 			const result = await route.handle(routeRequest);
 			if (result === null || typeof result !== "object" || typeof result.body !== "string" && !(result.body instanceof Uint8Array) && !isReadable(result.body)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid response", 500);
+			if (lifetime !== void 0 && isReadable(result.body)) {
+				releaseLifetime = false;
+				releaseSignalLifetimeWhenStreamSettles(result.body, lifetime.cleanup);
+			}
 			return result;
 		} catch (error) {
 			if (error instanceof MobileExtensionError) throw error;
 			throw new MobileExtensionError("extension_failed", "extension route failed", 500);
+		} finally {
+			if (releaseLifetime) lifetime?.cleanup();
 		}
 	}
 	/** Start the local directory watcher; an absent directory is intentionally inert. */
 	async startLocal(root, context) {
-		if (this.localRoot !== void 0 && resolve(this.localRoot) !== resolve(root)) await this.stopLocal();
+		const targetRoot = resolve(root);
+		if (this.localRoot !== void 0 && resolve(this.localRoot) !== targetRoot) await this.stopLocal();
 		if (this.localTimer !== void 0) clearInterval(this.localTimer);
-		this.localRoot = resolve(root);
+		const lifecycle = ++this.localLifecycle;
+		this.localRoot = targetRoot;
 		this.localContext = context;
 		this.localClosed = false;
 		await mkdir(this.localRoot, { recursive: true });
+		if (this.localClosed || this.localLifecycle !== lifecycle || this.localRoot !== targetRoot || this.localContext !== context) return;
 		await this.refreshLocal();
+		if (this.localClosed || this.localLifecycle !== lifecycle || this.localRoot !== targetRoot || this.localContext !== context) return;
 		this.localTimer = setInterval(() => {
 			this.refreshLocal();
 		}, 2e3);
@@ -1586,23 +1743,43 @@ var MobileAccessService = class extends Service {
 	/** Stop the watcher and abort every local host generation. */
 	async stopLocal() {
 		this.localClosed = true;
+		const lifecycle = ++this.localLifecycle;
 		if (this.localTimer !== void 0) clearInterval(this.localTimer);
 		this.localTimer = void 0;
-		const previous = [...this.local.values()];
+		const refreshing = this.localRefreshing;
+		this.localRefreshAbort?.abort();
+		const previous = [...this.local.values(), ...[...this.retired.values()].map((entry) => entry.active)];
+		this.local.clear();
+		for (const entry of this.retired.values()) clearTimeout(entry.timer);
+		this.retired.clear();
+		this.failures.clear();
+		this.updateContentHash();
+		await Promise.allSettled([abortAndDisposeLocal(previous), ...refreshing === void 0 ? [] : [refreshing]]);
+		if (this.localLifecycle !== lifecycle) return;
+		const late = [...this.local.values(), ...[...this.retired.values()].map((entry) => entry.active)];
 		this.local.clear();
+		for (const entry of this.retired.values()) clearTimeout(entry.timer);
+		this.retired.clear();
 		this.failures.clear();
-		await disposeLocal(previous);
+		this.updateContentHash();
+		await abortAndDisposeLocal(late);
+		if (this.localTimer !== void 0) clearInterval(this.localTimer);
+		this.localTimer = void 0;
 	}
 	/** Refresh all local extensions atomically; failures keep the previous snapshot. */
 	refreshLocal() {
 		if (this.localRefreshing !== void 0) return this.localRefreshing;
-		this.localRefreshing = this.stageAndCommit().finally(() => {
-			this.localRefreshing = void 0;
+		const controller = new AbortController();
+		this.localRefreshAbort = controller;
+		const refreshing = this.stageAndCommit(controller.signal).finally(() => {
+			if (this.localRefreshing === refreshing) this.localRefreshing = void 0;
+			if (this.localRefreshAbort === controller) this.localRefreshAbort = void 0;
 		});
-		return this.localRefreshing;
+		this.localRefreshing = refreshing;
+		return refreshing;
 	}
-	async stageAndCommit() {
-		if (this.localClosed || this.localRoot === void 0 || this.localContext === void 0) return;
+	async stageAndCommit(signal) {
+		if (this.localClosed || signal.aborted || this.localRoot === void 0 || this.localContext === void 0) return;
 		let names = [];
 		try {
 			const directory = await opendir(this.localRoot);
@@ -1620,19 +1797,29 @@ var MobileAccessService = class extends Service {
 		let failingName = "local";
 		try {
 			for (const name of names) {
+				signal.throwIfAborted();
 				failingName = name;
 				const directory = join(this.localRoot, name);
 				const fingerprint = await extensionFingerprint(directory);
-				const previous = this.local.get(fingerprint.manifest.id);
-				if (previous?.directory === resolve(directory) && previous.digest === fingerprint.digest) staged.push(previous);
+				const current = this.local.get(fingerprint.manifest.id);
+				const retired = this.retired.get(fingerprint.manifest.id)?.active;
+				const previous = current?.digest === fingerprint.digest ? current : retired?.digest === fingerprint.digest ? retired : void 0;
+				if (previous?.digest === fingerprint.digest) staged.push(previous);
 				else {
-					const fresh = await loadLocalExtension(directory, this.localContext, fingerprint);
+					const fresh = await loadLocalExtension(directory, this.localContext, fingerprint, signal);
+					try {
+						signal.throwIfAborted();
+						if ((await extensionFingerprint(directory)).digest !== fingerprint.digest) throw new MobileExtensionError("extension_changed_during_activation", `extension ${fingerprint.manifest.id} changed during activation`, 409);
+					} catch (error) {
+						await abortAndDisposeLocal([fresh]);
+						throw error;
+					}
 					staged.push(fresh);
 					stagedFresh.push(fresh);
 				}
 			}
-			if (this.localClosed || this.localRoot === void 0 || this.localContext === void 0) {
-				await disposeLocal(stagedFresh);
+			if (this.localClosed || signal.aborted || this.localRoot === void 0 || this.localContext === void 0) {
+				await abortAndDisposeLocal(stagedFresh);
 				return;
 			}
 			const duplicate = /* @__PURE__ */ new Set();
@@ -1641,42 +1828,106 @@ var MobileAccessService = class extends Service {
 				duplicate.add(entry.manifest.id);
 			}
 			const previous = [...this.local.values()];
+			for (const entry of staged) {
+				const retired = this.retired.get(entry.manifest.id);
+				if (retired?.active === entry) {
+					clearTimeout(retired.timer);
+					this.retired.delete(entry.manifest.id);
+				}
+			}
+			const stagedIds = new Set(staged.map((entry) => entry.manifest.id));
+			const removed = [];
+			for (const entry of previous) {
+				if (staged.includes(entry)) continue;
+				if (stagedIds.has(entry.manifest.id)) {
+					this.retire(entry);
+					continue;
+				}
+				removed.push(entry);
+				const retired = this.retired.get(entry.manifest.id);
+				if (retired !== void 0) {
+					clearTimeout(retired.timer);
+					this.retired.delete(entry.manifest.id);
+					removed.push(retired.active);
+				}
+			}
 			this.local.clear();
 			for (const entry of staged) this.local.set(entry.manifest.id, entry);
 			for (const entry of staged) this.failures.delete(entry.manifest.id);
 			for (const name of names) this.failures.delete(name);
 			for (const failure of this.failures.keys()) if (failure !== "local" && !names.includes(failure)) this.failures.delete(failure);
 			this.failures.delete("local");
-			await disposeLocal(previous.filter((entry) => !staged.includes(entry)));
+			if (removed.length > 0) abortAndDisposeLocal(removed);
 			this.updateContentHash();
 		} catch (error) {
-			await disposeLocal(stagedFresh);
+			await abortAndDisposeLocal(stagedFresh);
+			if (this.localClosed || signal.aborted) return;
 			const message = error instanceof Error ? error.message : String(error);
 			this.failures.set(failingName, message);
 			if (!(error instanceof MobileExtensionError)) this.ctx.logger.warn(error instanceof Error ? error : new Error(String(error)));
 		}
 	}
+	retire(active) {
+		const previous = this.retired.get(active.manifest.id);
+		if (previous?.active === active) return;
+		if (previous !== void 0) {
+			clearTimeout(previous.timer);
+			this.retired.delete(active.manifest.id);
+			abortAndDisposeLocal([previous.active]);
+		}
+		const timer = setTimeout(() => {
+			if (this.retired.get(active.manifest.id)?.active !== active) return;
+			this.retired.delete(active.manifest.id);
+			abortAndDisposeLocal([active]);
+		}, RETIRED_GENERATION_TTL_MS);
+		timer.unref();
+		this.retired.set(active.manifest.id, {
+			active,
+			timer
+		});
+	}
 };
 function isReadable(value) {
 	return value !== null && typeof value === "object" && typeof value.pipe === "function";
 }
-async function disposeLocal(entries) {
+function releaseSignalLifetimeWhenStreamSettles(stream, cleanup) {
+	let stopObserving;
+	stopObserving = finished(stream, () => {
+		stopObserving?.();
+		cleanup();
+	});
+}
+function invokeCleanups(cleanups) {
+	const pending = [];
+	for (const cleanup of [...cleanups].reverse()) try {
+		pending.push(Promise.resolve(cleanup()));
+	} catch {}
+	return pending;
+}
+async function settleBounded(pending, timeoutMs) {
+	if (pending.length === 0) return;
+	let timer;
+	await Promise.race([Promise.allSettled(pending), new Promise((resolveTimeout) => {
+		timer = setTimeout(resolveTimeout, timeoutMs);
+	})]);
+	if (timer !== void 0) clearTimeout(timer);
+}
+async function abortAndDisposeLocal(entries) {
+	const pending = [];
 	for (const entry of entries) {
 		entry.controller.abort();
-		for (const cleanup of [...entry.cleanups].reverse()) try {
-			await cleanup();
-		} catch {}
+		pending.push(...invokeCleanups(entry.cleanups));
 	}
+	await settleBounded(pending, HOST_TEARDOWN_TIMEOUT_MS);
 }
-async function loadLocalExtension(directory, context, known) {
-	const root = resolve(directory);
-	const rootStat = await lstat(root);
-	if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new MobileExtensionError("invalid_extension", "extension directory must be real");
-	const manifestFile = await regularFile$1(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+async function loadLocalExtension(directory, context, known, parentSignal) {
+	const root = await realExtensionRoot(directory);
+	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
-	const scriptFile = await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js");
-	const styleFile = await optionalFile(root, "mobile.css", EXTENSION_LIMITS.css, "mobile.css");
+	const scriptBody = known === void 0 ? await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js").then((path) => path === void 0 ? void 0 : readFile(path)) : known.scriptBody;
+	const styleBody = known === void 0 ? await optionalFile(root, "mobile.css", EXTENSION_LIMITS.css, "mobile.css").then((path) => path === void 0 ? void 0 : readFile(path)) : known.styleBody;
+	const assets = known?.assets ?? await assetSnapshot(root);
 	const hostFile = await optionalFile(root, "host.mjs", EXTENSION_LIMITS.script, "host.mjs");
 	const controller = new AbortController();
 	const actions = {};
@@ -1684,43 +1935,60 @@ async function loadLocalExtension(directory, context, known) {
 	const cleanups = [];
 	const pendingEffects = [];
 	let activationOpen = true;
+	const onParentAbort = () => {
+		controller.abort(parentSignal?.reason);
+	};
+	if (parentSignal?.aborted === true) onParentAbort();
+	else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+	const ensureActivationOpen = () => {
+		if (!activationOpen || controller.signal.aborted) throw new MobileExtensionError("host_activation_closed", `extension ${manifest.id} activation is closed`, 409);
+	};
 	const api = {
 		manifest,
 		context,
 		schema: z,
 		signal: controller.signal,
 		action(name, spec) {
+			ensureActivationOpen();
 			if (actions[name] !== void 0) throw new MobileExtensionError("duplicate_action", `duplicate action ${name}`);
 			actions[name] = spec;
 		},
 		route(spec) {
+			ensureActivationOpen();
 			routes.push(spec);
 		},
 		effect(setup) {
+			ensureActivationOpen();
 			const result = setup();
 			if (result instanceof Promise) pendingEffects.push(result.then(async (cleanup) => {
 				if (typeof cleanup !== "function") return;
 				if (activationOpen) cleanups.push(cleanup);
 				else await cleanup();
 			}));
-			else if (typeof result === "function") cleanups.push(result);
+			else if (typeof result === "function") {
+				if (activationOpen) cleanups.push(result);
+				else Promise.resolve(result()).catch(() => void 0);
+			}
 		}
 	};
 	try {
 		const activate = async () => {
+			controller.signal.throwIfAborted();
 			if (hostFile !== void 0) {
 				const digest = createHash("sha256").update(await readFile(hostFile)).digest("hex");
+				controller.signal.throwIfAborted();
 				let imported;
 				try {
 					imported = await import(`${pathToFileURL(hostFile).href}?dsh_generation=${digest}`);
 				} catch {
 					throw new MobileExtensionError("host_load_failed", `could not load ${manifest.id}/host.mjs`, 500);
 				}
+				controller.signal.throwIfAborted();
 				if (imported.default !== void 0) await imported.default(api);
 			}
 			await Promise.all(pendingEffects);
 		};
-		await withActivationTimeout(activate(), manifest.id);
+		await withActivationTimeout(activate(), manifest.id, controller.signal);
 		const host = validateDefinition({
 			...manifest,
 			actions,
@@ -1731,8 +1999,9 @@ async function loadLocalExtension(directory, context, known) {
 		return Object.freeze({
 			manifest,
 			directory: root,
-			...scriptFile === void 0 ? {} : { scriptFile },
-			...styleFile === void 0 ? {} : { styleFile },
+			...scriptBody === void 0 ? {} : { scriptBody },
+			...styleBody === void 0 ? {} : { styleBody },
+			assets,
 			host,
 			controller,
 			cleanups: Object.freeze(cleanups),
@@ -1740,12 +2009,12 @@ async function loadLocalExtension(directory, context, known) {
 		});
 	} catch (error) {
 		activationOpen = false;
-		await withActivationTimeout(Promise.allSettled(pendingEffects), manifest.id).catch(() => void 0);
 		controller.abort();
-		for (const cleanup of [...cleanups].reverse()) try {
-			await cleanup();
-		} catch {}
+		const cleanupPromises = invokeCleanups(cleanups.splice(0));
+		await settleBounded([...pendingEffects, ...cleanupPromises], HOST_TEARDOWN_TIMEOUT_MS);
 		throw error;
+	} finally {
+		parentSignal?.removeEventListener("abort", onParentAbort);
 	}
 }
 /** Construct the service in a Cordis plugin without importing DSH internals. */
@@ -1772,6 +2041,8 @@ const UPSTREAM_AUTH_REFRESH_MARGIN_MS = 6e4;
 const UPSTREAM_COOKIE_PAIR = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+=[\x21-\x3A\x3C-\x7E]*$/u;
 const CUSTOM_STYLE_FALLBACK = "/* Add mobile overrides in the DSH home mobile-access/mobile.css file. */\n";
 const CUSTOM_SCRIPT_FALLBACK = "window.dshMobile?.register(() => undefined)\n";
+const EXTENSION_CHANGE_POLL_MS = 2e3;
+const EXTENSION_EVENT_HEARTBEAT_MS = 15e3;
 const MOBILE_CLIENT_MODULE = "dsh-mobile";
 const CONNECTION_MODULE = "@deepseek-ai/dsh-client-connection";
 const RUNTIME_MODULE = "@deepseek-ai/dsh-client-runtime";
@@ -2247,6 +2518,7 @@ function discoveryBroadcastTargets(cidrs) {
 function extensionTarget(pathname) {
 	const prefix = `${AUTH_PREFIX}/extensions`;
 	if (pathname === prefix || pathname === `${prefix}/` || pathname === `${prefix}/manifest`) return { kind: "manifest" };
+	if (pathname === `${prefix}/events`) return { kind: "events" };
 	if (!pathname.startsWith(`${prefix}/`)) return void 0;
 	const parts = pathname.slice(prefix.length + 1).split("/");
 	const id = parts.shift();
@@ -2276,12 +2548,21 @@ function extensionTarget(pathname) {
 		path: `/${parts.join("/")}`.replace(/\/{2,}/gu, "/")
 	};
 }
+const EXTENSION_GENERATION_HEADER = "x-dsh-mobile-extension-generation";
+function extensionGeneration(value) {
+	if (value === void 0) return void 0;
+	if (!/^[a-f\d]{64}$/u.test(value)) throw new HttpError(400, "invalid_extension_generation");
+	return value;
+}
 function mobileBootBatchKey(pathname) {
 	return new RegExp(`^${MOBILE_BOOT_BATCH_PREFIX.replaceAll("/", "\\/")}([a-f\\d]{64})\\.js$`, "u").exec(pathname)?.[1];
 }
-async function readBoundedBody(request, maximum) {
+function assertBoundedContentLength(request, maximum) {
 	const declared = request.headers["content-length"];
 	if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > maximum)) throw new HttpError(413, "payload_too_large");
+}
+async function readBoundedBody(request, maximum) {
+	assertBoundedContentLength(request, maximum);
 	const chunks = [];
 	let total = 0;
 	for await (const chunk of request) {
@@ -2343,6 +2624,11 @@ var MobileAccessGateway = class {
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
 	mobileBootBatches = /* @__PURE__ */ new Map();
+	extensionEventListeners = /* @__PURE__ */ new Set();
+	extensionEventRevision = 0;
+	extensionChangeTimer;
+	extensionChangeTask;
+	legacyCustomDigest = "";
 	upstreamCookie;
 	upstreamCookieExpiresAt = 0;
 	upstreamCookieTask;
@@ -2352,6 +2638,7 @@ var MobileAccessGateway = class {
 	started = false;
 	closeTask;
 	removeSessionListener;
+	removeExtensionContentListener;
 	renewLimiter;
 	constructor(config, store, extensions, upstreamAuthenticatedUrl) {
 		this.config = config;
@@ -2373,6 +2660,9 @@ var MobileAccessGateway = class {
 		this.removeSessionListener = this.access.onSessionEnded((authorization) => {
 			this.abortSessionResources(authorization.sessionKey);
 		});
+		this.removeExtensionContentListener = this.extensions?.onContentChanged(() => {
+			this.broadcastExtensionChange();
+		}) ?? (() => void 0);
 	}
 	/** Initialize durable state, validate TLS, and bind the externally reachable listener. */
 	async start() {
@@ -2440,6 +2730,11 @@ var MobileAccessGateway = class {
 			this.listenerPort = address.port;
 			this.policy = new RequestTrustPolicy(this.config.authorities, address.port, this.config.allowedCidrs, this.tlsEnabled);
 			if (this.config.discovery) await this.startDiscovery(address.port);
+			await this.pollLegacyCustomChanges();
+			this.extensionChangeTimer = setInterval(() => {
+				this.pollLegacyCustomChanges();
+			}, EXTENSION_CHANGE_POLL_MS);
+			this.extensionChangeTimer.unref();
 		} catch (error) {
 			await this.closeFailedStart();
 			throw error;
@@ -2499,6 +2794,9 @@ var MobileAccessGateway = class {
 		}), "utf8");
 	}
 	async closeFailedStart() {
+		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
+		this.extensionChangeTimer = void 0;
+		this.removeExtensionContentListener();
 		if (this.discoveryTimer !== void 0) clearInterval(this.discoveryTimer);
 		this.discoveryTimer = void 0;
 		await this.closeBonjour();
@@ -2859,6 +3157,11 @@ var MobileAccessGateway = class {
 	async handleExtensionRequest(targetInfo, target, request, response, authorization) {
 		const extensions = this.extensions;
 		if (extensions === void 0) throw new HttpError(404, "not_found");
+		if (targetInfo.kind === "events") {
+			if (request.method !== "GET" || target.search !== "") throw new HttpError(request.method === "GET" ? 400 : 405, request.method === "GET" ? "bad_request" : "method_not_allowed");
+			this.openExtensionEventStream(request, response, authorization);
+			return;
+		}
 		if (targetInfo.kind === "manifest") {
 			if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
 			const operation = this.allocateRequest(authorization, response, {});
@@ -2906,9 +3209,10 @@ var MobileAccessGateway = class {
 		}
 		if (targetInfo.kind === "script" || targetInfo.kind === "style" || targetInfo.kind === "asset") {
 			if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
+			const generation = extensionGeneration(new URLSearchParams(target.search).get("generation") ?? void 0);
 			const operation = this.allocateRequest(authorization, response, {});
 			try {
-				const file = targetInfo.kind === "script" ? await extensions.readClientFile(targetInfo.id, "script", operation.signal) : targetInfo.kind === "style" ? await extensions.readClientFile(targetInfo.id, "style", operation.signal) : await extensions.readAsset(targetInfo.id, targetInfo.path ?? "", operation.signal);
+				const file = targetInfo.kind === "script" ? await extensions.readClientFile(targetInfo.id, "script", operation.signal, generation) : targetInfo.kind === "style" ? await extensions.readClientFile(targetInfo.id, "style", operation.signal, generation) : await extensions.readAsset(targetInfo.id, targetInfo.path ?? "", operation.signal, generation);
 				if (headerValue(request.headers, "if-none-match") === file.digest) {
 					setSecurityHeaders(response, this.tlsEnabled);
 					response.writeHead(304);
@@ -2931,23 +3235,26 @@ var MobileAccessGateway = class {
 		}
 		if (targetInfo.kind === "action") {
 			if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
-			const body = await readJsonObject(request, 1048576);
+			const maximum = 1048576;
+			assertBoundedContentLength(request, maximum);
+			const generation = extensionGeneration(headerValue(request.headers, EXTENSION_GENERATION_HEADER));
 			const operation = this.allocateRequest(authorization, response, {});
 			const abort = new AbortController();
 			response.once("close", () => {
 				abort.abort();
 			});
-			const generationSignal = extensions.signal(targetInfo.id);
+			const generationSignal = extensions.signal(targetInfo.id, generation);
 			const onGenerationAbort = () => {
 				abort.abort();
 				if (!response.destroyed) response.destroy();
 			};
 			generationSignal?.addEventListener("abort", onGenerationAbort, { once: true });
 			try {
+				const body = await readJsonObject(request, maximum);
 				const result = await extensions.invoke(targetInfo.id, targetInfo.action, body, {
 					signal: abort.signal,
 					deviceId: authorization.deviceId
-				});
+				}, generation);
 				let serialized;
 				try {
 					serialized = Buffer.from(JSON.stringify(result));
@@ -2973,19 +3280,22 @@ var MobileAccessGateway = class {
 				"PATCH",
 				"DELETE"
 			].includes(method)) throw new HttpError(405, "method_not_allowed");
-			const body = method === "GET" || method === "HEAD" ? Buffer.alloc(0) : await readBoundedBody(request, this.config.maxBodyBytes);
+			const hasBody = method !== "GET" && method !== "HEAD";
+			if (hasBody) assertBoundedContentLength(request, this.config.maxBodyBytes);
+			const generation = extensionGeneration(headerValue(request.headers, EXTENSION_GENERATION_HEADER));
 			const operation = this.allocateRequest(authorization, response, {});
 			const abort = new AbortController();
 			response.once("close", () => {
 				abort.abort();
 			});
-			const generationSignal = extensions.signal(targetInfo.id);
+			const generationSignal = extensions.signal(targetInfo.id, generation);
 			const onGenerationAbort = () => {
 				abort.abort();
 				if (!response.destroyed) response.destroy();
 			};
 			generationSignal?.addEventListener("abort", onGenerationAbort, { once: true });
 			try {
+				const body = hasBody ? await readBoundedBody(request, this.config.maxBodyBytes) : Buffer.alloc(0);
 				const parsed = new URL(target.raw, this.address().origin);
 				const routeRequest = {
 					method,
@@ -2996,7 +3306,7 @@ var MobileAccessGateway = class {
 					signal: abort.signal,
 					deviceId: authorization.deviceId
 				};
-				const result = await extensions.route(targetInfo.id, method, targetInfo.path, routeRequest);
+				const result = await extensions.route(targetInfo.id, method, targetInfo.path, routeRequest, generation);
 				await this.sendExtensionResponse(response, result, request.method === "HEAD");
 			} finally {
 				generationSignal?.removeEventListener("abort", onGenerationAbort);
@@ -3006,8 +3316,10 @@ var MobileAccessGateway = class {
 		}
 	}
 	async sendExtensionResponse(response, result, head) {
+		const status = result.status ?? 200;
+		if (!Number.isSafeInteger(status) || status < 200 || status > 599) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid HTTP status", 500);
 		const contentType = result.contentType ?? "application/octet-stream";
-		if (!/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\s\S]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
+		if (contentType.length > 1024 || !/^[\x20-\x7e]+$/u.test(contentType) || !/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\x20-\x7e]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
 		const safeHeaders = {};
 		for (const [name, value] of Object.entries(result.headers ?? {})) {
 			if (!/^(?:content-disposition|cache-control|etag)$/iu.test(name) || /[\r\n]/u.test(value)) continue;
@@ -3017,7 +3329,7 @@ var MobileAccessGateway = class {
 		if (typeof result.body === "string" || result.body instanceof Uint8Array) {
 			const body = typeof result.body === "string" ? Buffer.from(result.body) : Buffer.from(result.body);
 			if (body.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension response is too large", 500);
-			response.writeHead(result.status ?? 200, {
+			response.writeHead(status, {
 				...safeHeaders,
 				"Content-Type": contentType,
 				"Content-Length": body.byteLength
@@ -3026,7 +3338,7 @@ var MobileAccessGateway = class {
 			else response.end(body);
 			return;
 		}
-		response.writeHead(result.status ?? 200, {
+		response.writeHead(status, {
 			...safeHeaders,
 			"Content-Type": contentType
 		});
@@ -3382,6 +3694,66 @@ var MobileAccessGateway = class {
 			socket.upstream.destroy();
 		}
 	}
+	broadcastExtensionChange() {
+		if (this.closing) return;
+		this.extensionEventRevision += 1;
+		for (const listener of this.extensionEventListeners) listener(this.extensionEventRevision);
+	}
+	pollLegacyCustomChanges() {
+		if (this.extensionChangeTask !== void 0) return this.extensionChangeTask;
+		const digestFile = async (path, fallback) => {
+			try {
+				const info = await stat(path);
+				if (!info.isFile() || info.size > 262144) return `invalid:${String(info.size)}:${String(info.mtimeMs)}`;
+				return createHash("sha256").update(await readFile(path)).digest("hex");
+			} catch (error) {
+				if (error.code === "ENOENT") return createHash("sha256").update(fallback).digest("hex");
+				return `error:${String(error.code ?? "unknown")}`;
+			}
+		};
+		const task = Promise.all([digestFile(this.config.customScriptFile, CUSTOM_SCRIPT_FALLBACK), digestFile(this.config.customCssFile, CUSTOM_STYLE_FALLBACK)]).then((parts) => {
+			const next = createHash("sha256").update(parts.join("|")).digest("hex");
+			if (this.legacyCustomDigest !== "" && next !== this.legacyCustomDigest) this.broadcastExtensionChange();
+			this.legacyCustomDigest = next;
+		}).finally(() => {
+			if (this.extensionChangeTask === task) this.extensionChangeTask = void 0;
+		});
+		this.extensionChangeTask = task;
+		return task;
+	}
+	openExtensionEventStream(request, response, authorization) {
+		const operation = this.allocateRequest(authorization, response, {});
+		let closed = false;
+		let heartbeat;
+		const close = () => {
+			if (closed) return;
+			closed = true;
+			if (heartbeat !== void 0) clearInterval(heartbeat);
+			this.extensionEventListeners.delete(send);
+			request.removeListener("aborted", close);
+			response.removeListener("close", close);
+			operation.release();
+		};
+		const send = (revision) => {
+			if (closed || response.destroyed || response.writableEnded) return;
+			response.write(`id: ${String(revision)}\nevent: extensions-changed\ndata: {\"revision\":${String(revision)}}\n\n`);
+		};
+		setSecurityHeaders(response, this.tlsEnabled);
+		response.writeHead(200, {
+			"Content-Type": "text/event-stream; charset=utf-8",
+			"Cache-Control": "no-store",
+			Connection: "keep-alive",
+			"X-Accel-Buffering": "no"
+		});
+		response.write("retry: 2000\n: ready\n\n");
+		this.extensionEventListeners.add(send);
+		heartbeat = setInterval(() => {
+			if (!closed && !response.destroyed && !response.writableEnded) response.write(": heartbeat\n\n");
+		}, EXTENSION_EVENT_HEARTBEAT_MS);
+		heartbeat.unref();
+		request.once("aborted", close);
+		response.once("close", close);
+	}
 	async readUpgradeResponse(upstream, expectedAccept) {
 		return new Promise((resolve, reject) => {
 			let buffer = Buffer.alloc(0);
@@ -3629,6 +4001,9 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
+		this.extensionChangeTimer = void 0;
+		this.removeExtensionContentListener();
 		this.upstreamAuthRequest?.destroy();
 		this.upstreamAuthRequest = void 0;
 		this.removeSessionListener();
@@ -3794,165 +4169,1375 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
-//#region src/diagnostics.ts
-const execFile$2 = promisify(execFile);
-const REMOTE_ERROR_GUIDANCE = Object.freeze({
-	component_missing: "重新安装完整插件包。",
-	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
-	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
-	funnel_start_failed: "重新打开授权页并允许 Funnel。",
-	funnel_start_timeout: "检查网络后点击“重新连接”。",
-	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
-	sidecar_launch_failed: "重新安装完整插件包后重试。",
-	sidecar_stopped: "点击“重新连接”。",
-	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	control_channel_failed: "点击“重新连接”。",
-	cpolar_component_missing: "先安装 cpolar 官方组件。",
-	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
-	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
-	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
-	cpolar_start_timeout: "检查网络后点击“重新连接”。",
-	cpolar_stopped: "点击“重新连接”。",
-	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
-});
-function check(id, status, label, detail, action) {
-	return Object.freeze({
-		id,
-		status,
-		label,
-		detail,
-		...action === void 0 ? {} : { action }
-	});
+//#region src/frp-component.ts
+const FRP_VERSION = "0.70.1";
+const MAX_ARCHIVE_ENTRIES = 128;
+const MAX_ARCHIVE_LIST_BYTES = 262144;
+/** Pinned official FRP release metadata for supported desktop targets. */
+const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		platform: "win32",
+		arch: "x64",
+		archiveName: "frp.zip",
+		executableName: "frpc.exe",
+		downloadBytes: 13924309,
+		downloadSha256: "531f3cd3cc41c0b4f077b54fe6b7dd83c0ff727e7f0bf412a4c78fa279165de5",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_amd64.zip`
+	},
+	{
+		platform: "win32",
+		arch: "arm64",
+		archiveName: "frp.zip",
+		executableName: "frpc.exe",
+		downloadBytes: 12204751,
+		downloadSha256: "74d3acaf0f03ee190dd0462f9b49861dca50b0559c5488af4b36572fc951fcca",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_arm64.zip`
+	},
+	{
+		platform: "linux",
+		arch: "x64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 13924042,
+		downloadSha256: "333da23d1b9009d7c01638e9ba38cf4600f7d37d393f854e96ee1396adefa9a6",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_amd64.tar.gz`
+	},
+	{
+		platform: "linux",
+		arch: "arm64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 12371290,
+		downloadSha256: "3990f396a9a490ee7f0e5f355287750ed41520064ed999eab443b5e9a78d773d",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_arm64.tar.gz`
+	},
+	{
+		platform: "darwin",
+		arch: "x64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 13951979,
+		downloadSha256: "cbf69cf26e5553e914e97d37f5d4367fa30f5f531d073a889465af4719281e25",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_amd64.tar.gz`
+	},
+	{
+		platform: "darwin",
+		arch: "arm64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 12670664,
+		downloadSha256: "cfa733b5a261c1647edee3c1fc4133d2542989b28f5602e81d47fc821d25c55f",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_arm64.tar.gz`
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
+function inside$1(parent, child) {
+	const candidate = relative(parent, child);
+	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
 }
-function maskLanOrigin(origin) {
-	if (origin === void 0) return "未分配";
+async function regularFile$1(file) {
 	try {
-		const url = new URL(origin);
-		const octets = url.hostname.split(".");
-		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
-		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
-	} catch {
-		return "地址格式无效";
+		const entry = await lstat(file);
+		return entry.isFile() && !entry.isSymbolicLink();
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
 	}
 }
-function remoteSuffix(origin) {
-	if (origin === void 0) return "未分配";
+async function replaceDirectory(target, candidate) {
+	const backup = `${target}.previous-${randomBytes(12).toString("hex")}`;
+	let previous = false;
 	try {
-		const hostname = new URL(origin).hostname;
-		if (hostname.endsWith(".ts.net")) return "*.ts.net";
-		for (const suffix of [
-			".cpolar.cn",
-			".cpolar.io",
-			".cpolar.top",
-			".cpolar.com"
-		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
-		return "公共 HTTPS 地址";
-	} catch {
-		return "地址格式无效";
-	}
-}
-function defaultFirewallProbe(platform = process.platform) {
-	return async (port) => {
-		if (platform !== "win32") return { state: "not-applicable" };
-		if (port === void 0) return { state: "unknown" };
-		const script = [
-			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
-			"$ready = $true",
-			"$specs | ForEach-Object {",
-			"  $spec = $_",
-			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
-			"  if ($null -eq $rule) { $ready = $false; return }",
-			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
-			`  $matching = @($filters | Where-Object { $_.Protocol -eq $spec.Protocol -and ($_.LocalPort -eq 'Any' -or $_.LocalPort -eq '${String(port)}') })`,
-			"  if ($matching.Count -eq 0) { $ready = $false }",
-			"}",
-			"if ($ready) { 'ready' } else { 'missing' }"
-		].join("; ");
 		try {
-			return { state: (await execFile$2("powershell.exe", [
-				"-NoProfile",
-				"-NonInteractive",
-				"-Command",
-				script
-			], {
-				encoding: "utf8",
-				timeout: 3e3,
-				windowsHide: true
-			})).stdout.trim() === "ready" ? "ready" : "missing" };
-		} catch {
-			return { state: "unknown" };
+			await rename(target, backup);
+			previous = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
 		}
-	};
+		try {
+			await rename(candidate, target);
+		} catch (error) {
+			if (previous) try {
+				await rename(backup, target);
+			} catch (restoreError) {
+				throw new AggregateError([error, restoreError], "frp_component_replace_failed");
+			}
+			throw error;
+		}
+		if (previous) await rm(backup, {
+			recursive: true,
+			force: true
+		});
+	} finally {
+		await rm(candidate, {
+			recursive: true,
+			force: true
+		});
+	}
 }
-/** Allow remote relays enough time to answer without making diagnostics unbounded. */
-function remoteDiagnosticTimeoutMs(origin) {
-	const hostname = new URL(origin).hostname.toLowerCase();
-	if (hostname.endsWith(".ts.net") || hostname.includes(".cpolar.")) return 1e4;
-	return 5e3;
+function sha256$1(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
 }
-async function defaultRemoteProbe(origin) {
-	if (origin === void 0) return { state: "not-applicable" };
-	const hostname = new URL(origin).hostname;
-	const started = performance.now();
-	try {
-		const response = await fetch(new URL("/mobile-access/health", origin), {
-			cache: "no-store",
-			redirect: "error",
-			signal: AbortSignal.timeout(remoteDiagnosticTimeoutMs(origin))
+async function runCapture(file, args) {
+	return new Promise((resolveRun, reject) => {
+		execFile(file, [...args], {
+			windowsHide: true,
+			timeout: 12e4,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolveRun(stdout);
+			else reject(error);
 		});
-		const latencyMs = Math.max(0, Math.round(performance.now() - started));
-		if (response.status === 429) return {
-			state: "rate-limited",
-			latencyMs
-		};
-		return response.ok ? {
-			state: "ready",
-			latencyMs
-		} : {
-			state: "unreachable",
-			latencyMs
-		};
-	} catch {
-		let fakeIp = false;
-		try {
-			fakeIp = (await lookup(hostname, { all: true })).some(({ address }) => {
-				const [first, second] = address.split(".").map(Number);
-				return first === 198 && (second === 18 || second === 19);
-			});
-		} catch {}
-		return {
-			state: "unreachable",
-			...fakeIp ? { fakeIp: true } : {}
-		};
-	}
+	});
 }
-function reportLine(entry) {
-	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
+function validatedArchiveEntry(rawEntry) {
+	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("frp_archive_path_invalid");
+	const segments = rawEntry.replace(/\/$/u, "").split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("frp_archive_path_invalid");
+	return segments;
 }
-/** Run bounded read-only checks and return a report safe to paste into an issue. */
-async function collectConnectionDiagnostics(snapshot, probes = {}) {
-	const checks = [];
-	const remoteProbe = snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
-	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
-	checks.push(check("versions", "ok", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
-	if (snapshot.lan.networkError !== void 0) checks.push(check("network", "error", "局域网网卡", "已保存的网卡当前不可用。", "重新运行 dsh-mobile setup。"));
-	else if (snapshot.lan.configuredInterface !== void 0) checks.push(check("network", "ok", "局域网网卡", `正在跟随 ${snapshot.lan.interfaceName ?? snapshot.lan.configuredInterface}。`));
-	else checks.push(check("network", "info", "局域网网卡", "当前使用固定网络配置。"));
-	if (snapshot.lan.running && snapshot.lan.origin !== void 0) checks.push(check("lan", "ok", "局域网网关", `已监听 ${maskLanOrigin(snapshot.lan.origin)}，配对入口可用。`));
-	else checks.push(check("lan", "info", "局域网网关", "当前未开启。", "需要手机直连时开启局域网访问。"));
-	if (firewall.state === "ready") checks.push(check("firewall", "ok", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
-	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
-	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
-	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "远程通道", "当前未启用。"));
-	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
-		if (remoteObservation.state === "ready") checks.push(check("remote", "ok", "远程通道", `${snapshot.remote.provider} 公共地址 ${remoteSuffix(snapshot.remote.origin)} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`));
-		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "远程通道", "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。"));
-		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。"));
-		else checks.push(check("remote", "error", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。"));
-	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") checks.push(check("remote", "warning", "远程通道", snapshot.remote.state === "needs-login" ? "等待完成 Tailscale 登录。" : "仍在建立连接。", snapshot.remote.state === "needs-login" ? "返回远程页继续登录。" : "等待片刻后重新检查。"));
-	else checks.push(check("remote", "error", "远程通道", `连接未建立（${snapshot.remote.errorCode ?? snapshot.remote.state}）。`, REMOTE_ERROR_GUIDANCE[snapshot.remote.errorCode ?? ""] ?? "返回远程页点击“重新连接”。"));
-	checks.push(check("phone-network", "info", "手机网络", "电脑无法判断路由器是否隔离了手机。", "局域网仍失败时，确认手机与电脑在同一网络，并关闭访客网络或 AP 隔离。"));
+/** Select exactly one nested frpc executable from a safe archive listing. */
+function selectFrpExecutableEntry(entries, executableName) {
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("frp_archive_entries_invalid");
+	let executableEntry;
+	for (const entry of entries) {
+		const segments = validatedArchiveEntry(entry);
+		if (segments.length >= 2 && segments.at(-1) === executableName) {
+			if (executableEntry !== void 0) throw new Error("frp_archive_executable_ambiguous");
+			executableEntry = entry.replace(/\/$/u, "");
+		}
+	}
+	if (executableEntry === void 0) throw new Error("frp_archive_executable_missing");
+	return executableEntry;
+}
+async function defaultExtractArtifact$1(archive, destination, executableName) {
+	const tar = process.platform === "win32" ? "tar.exe" : "tar";
+	const executableEntry = selectFrpExecutableEntry((await runCapture(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await runCapture(tar, [
+		"-xf",
+		archive,
+		"-C",
+		unpacked,
+		executableEntry
+	]);
+	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
+	if (!await regularFile$1(extracted)) throw new Error("frp_archive_executable_invalid");
+	await copyFile(extracted, join(destination, executableName));
+}
+async function defaultFetchArtifact$1(artifact, signal) {
+	const response = await fetch(artifact.downloadUrl, {
+		redirect: "follow",
+		signal
+	});
+	if (!response.ok) throw new Error(`frp_download_http_${String(response.status)}`);
+	const finalUrl = new URL(response.url);
+	const officialHost = finalUrl.hostname === "github.com" || finalUrl.hostname.endsWith(".githubusercontent.com");
+	if (finalUrl.protocol !== "https:" || !officialHost) throw new Error("frp_download_origin_invalid");
+	const lengthHeader = response.headers.get("content-length");
+	const declaredLength = lengthHeader === null ? void 0 : Number(lengthHeader);
+	if (declaredLength !== void 0 && (!Number.isFinite(declaredLength) || declaredLength !== artifact.downloadBytes)) throw new Error("frp_download_size_mismatch");
+	if (response.body === null) throw new Error("frp_download_empty");
+	const chunks = [];
+	let received = 0;
+	const reader = response.body.getReader();
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		received += result.value.byteLength;
+		if (received > artifact.downloadBytes) {
+			await reader.cancel();
+			throw new Error("frp_download_size_mismatch");
+		}
+		chunks.push(result.value);
+	}
+	if (received !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
+	const bytes = new Uint8Array(received);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function defaultInspectExecutable(executable) {
+	return (await runCapture(executable, ["--version"])).trim();
+}
+/** Owns the optional official frpc binary inside the DSH Mobile state directory. */
+var FrpComponentManager = class {
+	executable;
+	componentRoot;
+	componentStorage;
+	logRoot;
+	stagingRoot;
+	artifact;
+	fetchArtifact;
+	extractArtifact;
+	inspectExecutable;
+	installed = false;
+	installedBytes = 0;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		const stateDirectory = resolve(options.stateDirectory);
+		if (!isAbsolute(stateDirectory)) throw new Error("frp state directory must be absolute");
+		const platform = options.platform ?? process.platform;
+		const arch = options.arch ?? process.arch;
+		this.artifact = FRP_COMPONENT_RELEASES[`${platform}-${arch}`];
+		this.componentRoot = join(stateDirectory, "components", "frp");
+		this.componentStorage = join(this.componentRoot, FRP_VERSION);
+		this.executable = join(this.componentStorage, platform === "win32" ? "frpc.exe" : "frpc");
+		this.logRoot = join(stateDirectory, "logs", "frp");
+		this.stagingRoot = join(stateDirectory, "staging", "frp");
+		for (const child of [
+			this.componentRoot,
+			this.componentStorage,
+			this.logRoot,
+			this.stagingRoot
+		]) if (!inside$1(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
+		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
+	}
+	/** Inspect the managed executable without relying on global FRP installations. */
+	async initialize() {
+		this.installed = await regularFile$1(this.executable);
+		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
+		if (this.installed) try {
+			if (await this.inspectExecutable(this.executable) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+			this.errorCode = void 0;
+		} catch {
+			this.installed = false;
+			this.errorCode = "frp_component_invalid";
+		}
+	}
+	/** Return component metadata without exposing configuration or credentials. */
+	status() {
+		return Object.freeze({
+			supported: this.artifact !== void 0,
+			installed: this.installed,
+			version: FRP_VERSION,
+			downloadBytes: this.artifact?.downloadBytes ?? 0,
+			installedBytes: this.installedBytes,
+			sourceUrl: this.artifact?.downloadUrl ?? "https://github.com/fatedier/frp/releases",
+			releasePage: `https://github.com/fatedier/frp/releases/tag/v${FRP_VERSION}`,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Download, verify, and extract only frpc after explicit confirmation. */
+	install() {
+		return this.enqueue(async () => {
+			const artifact = this.artifact;
+			if (artifact === void 0) throw new Error("frp_component_unsupported");
+			await mkdir(this.stagingRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 12e4);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(artifact, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
+				if (sha256$1(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
+				const archive = join(staging, artifact.archiveName);
+				await writeFile(archive, bytes, {
+					flag: "wx",
+					mode: 384
+				});
+				await this.extractArtifact(archive, staging, artifact.executableName);
+				const extracted = join(staging, artifact.executableName);
+				if (!await regularFile$1(extracted)) throw new Error("frp_executable_missing");
+				await chmod(extracted, 448);
+				if (await this.inspectExecutable(extracted) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+				await mkdir(candidate, {
+					recursive: true,
+					mode: 448
+				});
+				const candidateExecutable = join(candidate, artifact.executableName);
+				await copyFile(extracted, candidateExecutable);
+				await chmod(candidateExecutable, 448);
+				await replaceDirectory(this.componentStorage, candidate);
+				this.installed = true;
+				this.installedBytes = (await stat(this.executable)).size;
+				this.errorCode = void 0;
+			} finally {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+			}
+		});
+	}
+	/** Remove all FRP executable, staging, and log files owned by DSH Mobile. */
+	purge() {
+		return this.enqueue(async () => {
+			await Promise.all([
+				rm(this.componentRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.logRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stagingRoot, {
+					recursive: true,
+					force: true
+				})
+			]);
+			this.installed = false;
+			this.installedBytes = 0;
+			this.errorCode = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+//#endregion
+//#region src/frp-template.ts
+/** Loopback-only HTTP vhost port used between Caddy and frps. */
+const FRP_VHOST_HTTP_PORT = 7080;
+function publicDnsHostname(value) {
+	return value.length <= 253 && value.includes(".") && !/^[0-9.]+$/u.test(value) && !value.includes(":") && value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/** Build the only supported frps and Caddy configuration from validated user inputs. */
+function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
+	if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+	let url;
+	try {
+		url = new URL(publicOrigin);
+	} catch {
+		throw new Error("frp_template_input_invalid");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
+	return [
+		"# frps.toml",
+		`bindPort = ${String(serverPort)}`,
+		"proxyBindAddr = \"127.0.0.1\"",
+		`vhostHTTPPort = ${String(FRP_VHOST_HTTP_PORT)}`,
+		"auth.method = \"token\"",
+		`auth.token = ${JSON.stringify(token)}`,
+		"",
+		"# Caddyfile",
+		`${url.hostname} {`,
+		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		"}",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/frp-config.ts
+const MAX_SETTINGS_BYTES = 8192;
+function hostname$1(value) {
+	if (value.length > 253 || !value.includes(".")) return false;
+	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/** Validate the FRP server hostname or IP address. */
+function validateFrpServerAddress(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
+	const normalized = value.toLowerCase().replace(/\.$/u, "");
+	if (isIP(normalized) === 0 && !hostname$1(normalized)) throw new Error("frp_server_address_invalid");
+	return normalized;
+}
+/** Validate the FRP control port. */
+function validateFrpServerPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("frp_server_port_invalid");
+	return Number(value);
+}
+/** Validate a high-entropy FRP token before durable storage. */
+function validateFrpToken(value) {
+	if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
+	return value;
+}
+/** Validate the public HTTPS origin used by Caddy and Android pairing. */
+function validateFrpPublicOrigin(value) {
+	if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("frp_public_origin_invalid");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(url.hostname) !== 0 || !hostname$1(url.hostname)) throw new Error("frp_public_origin_invalid");
+	return url.origin;
+}
+/** Parse FRP settings at the loopback request and filesystem boundaries. */
+function parseFrpSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_settings_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"version",
+		"serverAddress",
+		"serverPort",
+		"token",
+		"publicOrigin"
+	].includes(String(key)))) throw new Error("frp_settings_invalid");
+	if (record.version !== void 0 && record.version !== 1) throw new Error("frp_settings_invalid");
+	return Object.freeze({
+		version: 1,
+		serverAddress: validateFrpServerAddress(record.serverAddress),
+		serverPort: validateFrpServerPort(record.serverPort),
+		token: validateFrpToken(record.token),
+		publicOrigin: validateFrpPublicOrigin(record.publicOrigin)
+	});
+}
+function tomlString(value) {
+	return JSON.stringify(value);
+}
+/** Build the single-purpose frpc configuration for the current loopback gateway. */
+function createFrpcToml(settings, localPort) {
+	if (!Number.isSafeInteger(localPort) || localPort < 1 || localPort > 65535) throw new Error("frp_local_port_invalid");
+	const hostnameValue = new URL(settings.publicOrigin).hostname;
+	return [
+		`serverAddr = ${tomlString(settings.serverAddress)}`,
+		`serverPort = ${String(settings.serverPort)}`,
+		"auth.method = \"token\"",
+		`auth.token = ${tomlString(settings.token)}`,
+		"transport.tls.enable = true",
+		"",
+		"[[proxies]]",
+		"name = \"dsh-mobile\"",
+		"type = \"http\"",
+		"localIP = \"127.0.0.1\"",
+		`localPort = ${String(localPort)}`,
+		`customDomains = [${tomlString(hostnameValue)}]`,
+		"transport.useEncryption = true",
+		"transport.useCompression = true",
+		""
+	].join("\n");
+}
+/** Build the matching restricted frps and Caddy templates for one VPS. */
+function createFrpServerTemplate(settings) {
+	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin);
+}
+async function atomicPrivateWrite(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("frp_config_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+/** Owns private FRP settings and generation-specific frpc configuration. */
+var FrpConfigStore = class {
+	stateRoot;
+	settingsFile;
+	runtimeConfigFile;
+	settingsValue;
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("frp config state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "settings.json");
+		this.runtimeConfigFile = join(this.stateRoot, "frpc.toml");
+	}
+	/** Load private settings while rejecting links, oversized files, and unknown fields. */
+	async initialize() {
+		let entry;
+		try {
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+			this.errorCode = "frp_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseFrpSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+			this.errorCode = void 0;
+		} catch {
+			this.settingsValue = void 0;
+			this.errorCode = "frp_config_invalid";
+		}
+	}
+	/** Return configuration metadata without exposing the FRP token. */
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			configured: settings !== void 0,
+			...settings === void 0 ? {} : {
+				serverAddress: settings.serverAddress,
+				serverPort: settings.serverPort,
+				publicOrigin: settings.publicOrigin
+			},
+			vhostHttpPort: FRP_VHOST_HTTP_PORT,
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Return private settings only to the provider lifecycle. */
+	settings() {
+		return this.settingsValue;
+	}
+	/** Atomically replace private FRP settings. */
+	async configure(value) {
+		const settings = parseFrpSettings(value);
+		await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		await rm(this.runtimeConfigFile, { force: true });
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	/** Materialize the private generation-specific frpc configuration. */
+	async writeRuntimeConfig(localPort) {
+		const settings = this.settingsValue;
+		if (settings === void 0) throw new Error("frp_config_missing");
+		await atomicPrivateWrite(this.runtimeConfigFile, createFrpcToml(settings, localPort));
+		return this.runtimeConfigFile;
+	}
+	/** Remove only configuration files owned by the FRP provider. */
+	async purge() {
+		await rm(this.stateRoot, {
+			recursive: true,
+			force: true
+		});
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/remote.ts
+const REMOTE_PROVIDERS = [
+	"tailscale",
+	"cpolar",
+	"frp"
+];
+function aggregateErrors(errors, message) {
+	if (errors.length === 0) return void 0;
+	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
+	return new AggregateError(errors, message);
+}
+/** Settle independent remote cleanup work before reporting any collected failure. */
+async function settleRemoteResources(steps, message = "remote resource cleanup failed") {
+	const failure = aggregateErrors((await Promise.allSettled(steps.map(async (step) => step()))).filter((result) => result.status === "rejected").map((result) => result.reason), message);
+	if (failure !== void 0) throw failure;
+}
+/**
+* Serialize all provider mutations and preserve the single-provider invariant.
+* Operations read the selected controller only after reaching the front of the queue.
+*/
+var RemoteProviderCoordinator = class {
+	controllers;
+	store;
+	selectedValue;
+	queue = Promise.resolve();
+	constructor(selected, controllers, store) {
+		this.controllers = controllers;
+		this.store = store;
+		this.selectedValue = selected;
+	}
+	/** Return the durable provider currently selected by the desktop UI. */
+	get selected() {
+		return this.selectedValue;
+	}
+	/** Return the controller selected when this method is called. */
+	controller() {
+		return this.controllers[this.selectedValue];
+	}
+	/** Run a provider-owned mutation after all earlier provider work settles. */
+	mutate(operation) {
+		return this.enqueue(() => operation(this.controller()));
+	}
+	/** Disable the previous provider, persist the new selection, and retain rollback on write failure. */
+	select(provider) {
+		return this.enqueue(async () => {
+			if (provider === this.selectedValue) return;
+			const previous = this.controllers[this.selectedValue];
+			const restore = previous.status().enabled;
+			if (restore) await previous.setEnabled(false);
+			try {
+				await this.store.save({
+					version: 1,
+					provider
+				});
+				this.selectedValue = provider;
+			} catch (error) {
+				if (restore) try {
+					await previous.setEnabled(true);
+				} catch (restoreError) {
+					throw new AggregateError([error, restoreError], "remote provider selection rollback failed");
+				}
+				throw error;
+			}
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(() => this.runAndEnforce(operation), () => this.runAndEnforce(operation));
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	async runAndEnforce(operation) {
+		let value;
+		let operationError;
+		try {
+			value = await operation();
+		} catch (error) {
+			operationError = error;
+		}
+		const results = await Promise.allSettled(REMOTE_PROVIDERS.filter((provider) => provider !== this.selectedValue).map((provider) => this.controllers[provider].setEnabled(false)));
+		const failure = aggregateErrors([...operationError === void 0 ? [] : [operationError], ...results.filter((result) => result.status === "rejected").map((result) => result.reason)], "remote provider operation failed");
+		if (failure !== void 0) throw failure;
+		return value;
+	}
+};
+/** Stop an owned provider process and do not report completion before its close event. */
+async function terminateRemoteProcess(child, gracefulTimeoutMs = 1500, forcedTimeoutMs = 1500) {
+	if (child.exitCode !== null || child.signalCode !== null) return;
+	await new Promise((resolveClose, rejectClose) => {
+		let gracefulTimer;
+		let forcedTimer;
+		let settled = false;
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			if (gracefulTimer !== void 0) clearTimeout(gracefulTimer);
+			if (forcedTimer !== void 0) clearTimeout(forcedTimer);
+			child.off("close", onClose);
+			if (error === void 0) resolveClose();
+			else rejectClose(error);
+		};
+		const onClose = () => {
+			finish();
+		};
+		child.once("close", onClose);
+		try {
+			child.kill("SIGTERM");
+		} catch (error) {
+			finish(error instanceof Error ? error : new Error(String(error)));
+			return;
+		}
+		if (settled) return;
+		gracefulTimer = setTimeout(() => {
+			try {
+				if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			} catch (error) {
+				finish(error instanceof Error ? error : new Error(String(error)));
+				return;
+			}
+			if (settled) return;
+			forcedTimer = setTimeout(() => {
+				finish(/* @__PURE__ */ new Error("remote_process_stop_timeout"));
+			}, forcedTimeoutMs);
+			forcedTimer.unref();
+		}, gracefulTimeoutMs);
+		gracefulTimer.unref();
+	});
+}
+/** Validate the provider selection loaded across the filesystem boundary. */
+function parseRemoteProviderState(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
+	const record = value;
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "frp" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	return Object.freeze({
+		version: 1,
+		provider: record.provider
+	});
+}
+/** Atomic selection store whose absent-file state uses the configured default. */
+var JsonRemoteProviderStore = class {
+	file;
+	defaultProvider;
+	constructor(file, defaultProvider) {
+		this.file = file;
+		this.defaultProvider = defaultProvider;
+	}
+	async load() {
+		let stat;
+		try {
+			stat = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return Object.freeze({
+				version: 1,
+				provider: this.defaultProvider
+			});
+			throw error;
+		}
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("remote provider state must be a regular file no larger than 4 KiB");
+		await restrictPrivateFile(this.file);
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("remote provider state is not valid JSON", { cause: error });
+		}
+		return parseRemoteProviderState(parsed);
+	}
+	async save(state) {
+		const validated = parseRemoteProviderState(state);
+		const directory = dirname(this.file);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("remote provider state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, this.file);
+			await restrictPrivateFile(this.file);
+		} catch (error) {
+			await rm(temporary, { force: true });
+			throw error;
+		}
+	}
+};
+/** Resolve the first-run provider without letting environment values bypass validation. */
+function configuredRemoteProvider(environment) {
+	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
+	if (value !== "tailscale" && value !== "cpolar" && value !== "frp") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, or frp");
+	return value;
+}
+//#endregion
+//#region src/frp.ts
+const START_TIMEOUT_MS$1 = 45e3;
+const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
+const DISCOVERY_RETRY_MS = 1e3;
+const MAX_DISCOVERY_BYTES = 16384;
+const VHOST_PROBE_TIMEOUT_MS = 1500;
+function publicStatus$2(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+async function defaultVerifyConfig(executable, configFile) {
+	await new Promise((resolveRun, reject) => {
+		execFile(executable, [
+			"verify",
+			"-c",
+			configFile
+		], {
+			windowsHide: true,
+			timeout: 3e4,
+			maxBuffer: 65536
+		}, (error) => {
+			if (error === null) resolveRun();
+			else reject(error);
+		});
+	});
+}
+function defaultLaunchClient(executable, configFile) {
+	return spawn(executable, ["-c", configFile], {
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+}
+async function defaultProbeVhostExposure(serverAddress, port) {
+	return new Promise((resolveProbe) => {
+		const socket = connect({
+			host: serverAddress,
+			port
+		});
+		let finished = false;
+		const finish = (exposed) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			socket.destroy();
+			resolveProbe(exposed);
+		};
+		const timer = setTimeout(() => {
+			finish(false);
+		}, VHOST_PROBE_TIMEOUT_MS);
+		timer.unref();
+		socket.once("connect", () => {
+			finish(true);
+		});
+		socket.once("error", () => {
+			finish(false);
+		});
+	});
+}
+async function boundedResponseBytes(response) {
+	if (response.body === null) throw new Error("frp_discovery_invalid");
+	const declaredLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declaredLength) && declaredLength > MAX_DISCOVERY_BYTES) throw new Error("frp_discovery_invalid");
+	const reader = response.body.getReader();
+	const chunks = [];
+	let received = 0;
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		received += result.value.byteLength;
+		if (received > MAX_DISCOVERY_BYTES) {
+			await reader.cancel();
+			throw new Error("frp_discovery_invalid");
+		}
+		chunks.push(result.value);
+	}
+	const bytes = new Uint8Array(received);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function defaultProbeDiscovery(origin, expectedInstanceId, signal) {
+	const requestController = new AbortController();
+	const abort = () => {
+		requestController.abort();
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	const timeout = setTimeout(abort, DISCOVERY_REQUEST_TIMEOUT_MS);
+	timeout.unref();
+	try {
+		const response = await fetch(`${origin}/mobile-access/discovery`, {
+			method: "GET",
+			redirect: "error",
+			cache: "no-store",
+			signal: requestController.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return false;
+		let value;
+		try {
+			value = JSON.parse(new TextDecoder().decode(await boundedResponseBytes(response)));
+		} catch {
+			throw new Error("frp_discovery_invalid");
+		}
+		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_discovery_invalid");
+		const actual = value.instanceId;
+		if (typeof actual !== "string") throw new Error("frp_discovery_invalid");
+		if (actual !== expectedInstanceId) throw new Error("frp_discovery_mismatch");
+		return true;
+	} finally {
+		clearTimeout(timeout);
+		signal.removeEventListener("abort", abort);
+	}
+}
+/** Owns frpc, its generation-specific configuration, and the remote gateway. */
+var FrpController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	generation = 0;
+	latest = publicStatus$2({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	startupAbort;
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable)) throw new Error("frpc executable path must be absolute");
+		if (!/^[a-f0-9]{64}$/u.test(options.instanceId)) throw new Error("FRP instance ID is invalid");
+	}
+	/** Restore the remembered FRP switch without changing LAN or other providers. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the active FRP-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return publicStatus$2(this.latest);
+	}
+	/** Enable or disable FRP without changing LAN or another provider. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart FRP while retaining its private server settings and devices. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable FRP without deleting its explicitly managed component or settings. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop all FRP resources without changing the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$2(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let executableEntry;
+		try {
+			executableEntry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_component_missing"
+			});
+			return;
+		}
+		if (!executableEntry.isFile() || executableEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_component_invalid"
+			});
+			return;
+		}
+		const settings = this.options.config.settings();
+		if (settings === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_config_missing"
+			});
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin: settings.publicOrigin
+		});
+		let exposed;
+		try {
+			exposed = await (this.options.probeVhostExposure ?? defaultProbeVhostExposure)(settings.serverAddress, FRP_VHOST_HTTP_PORT);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "frp_vhost_probe_failed"
+			});
+			return;
+		}
+		if (exposed) {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "frp_vhost_publicly_reachable"
+			});
+			return;
+		}
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(settings.publicOrigin);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "gateway_start_failed"
+			});
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		let configFile;
+		try {
+			configFile = await this.options.config.writeRuntimeConfig(gateway.address().port);
+			await (this.options.verifyConfig ?? defaultVerifyConfig)(this.options.executable, configFile);
+		} catch {
+			await this.failGeneration(generation, "frp_config_verify_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
+		let child;
+		try {
+			child = (this.options.launchClient ?? defaultLaunchClient)(this.options.executable, configFile);
+		} catch {
+			await this.failGeneration(generation, "frp_launch_failed");
+			return;
+		}
+		this.child = child;
+		child.stdout.resume();
+		child.stderr.resume();
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "frp_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "frp_stopped" : "frp_exited"));
+		});
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin: settings.publicOrigin
+		});
+		const controller = new AbortController();
+		this.startupAbort = controller;
+		this.waitForDiscovery(generation, settings.publicOrigin, controller.signal);
+	}
+	async waitForDiscovery(generation, origin, signal) {
+		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$1);
+		const probe = this.options.probeDiscovery ?? defaultProbeDiscovery;
+		while (!signal.aborted && Date.now() < deadline) {
+			try {
+				if (await probe(origin, this.options.instanceId, signal)) {
+					await this.enqueue(async () => {
+						if (generation !== this.generation || signal.aborted || !this.enabled) return;
+						this.startupAbort = void 0;
+						this.publish({
+							enabled: true,
+							state: "ready",
+							origin
+						});
+					});
+					return;
+				}
+			} catch (error) {
+				if (signal.aborted) return;
+				if (error instanceof Error && (error.message === "frp_discovery_mismatch" || error.message === "frp_discovery_invalid")) {
+					await this.enqueue(() => this.failGeneration(generation, error.message));
+					return;
+				}
+			}
+			await new Promise((resolveWait) => {
+				let finished = false;
+				const finish = () => {
+					if (finished) return;
+					finished = true;
+					clearTimeout(timer);
+					signal.removeEventListener("abort", finish);
+					resolveWait();
+				};
+				const timer = setTimeout(finish, this.options.retryIntervalMs ?? DISCOVERY_RETRY_MS);
+				timer.unref();
+				signal.addEventListener("abort", finish, { once: true });
+			});
+		}
+		if (!signal.aborted) await this.enqueue(() => this.failGeneration(generation, "frp_start_timeout"));
+	}
+	async failGeneration(generation, code) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		this.startupAbort?.abort();
+		this.startupAbort = void 0;
+		const child = this.child;
+		this.child = void 0;
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await settleRemoteResources([
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close(),
+			() => rm(this.options.config.runtimeConfigFile, { force: true })
+		], "FRP resource cleanup failed");
+	}
+};
+//#endregion
+//#region src/diagnostics.ts
+const execFile$2 = promisify(execFile);
+const REMOTE_ERROR_GUIDANCE = Object.freeze({
+	component_missing: "重新安装完整插件包。",
+	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
+	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
+	funnel_start_failed: "重新打开授权页并允许 Funnel。",
+	funnel_start_timeout: "检查网络后点击“重新连接”。",
+	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
+	sidecar_launch_failed: "重新安装完整插件包后重试。",
+	sidecar_stopped: "点击“重新连接”。",
+	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	control_channel_failed: "点击“重新连接”。",
+	cpolar_component_missing: "先安装 cpolar 官方组件。",
+	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
+	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
+	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
+	cpolar_start_timeout: "检查网络后点击“重新连接”。",
+	cpolar_stopped: "点击“重新连接”。",
+	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	frp_component_missing: "先安装 FRP 官方组件。",
+	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
+	frp_config_missing: "先保存自建 FRP 连接配置。",
+	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
+	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
+	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
+	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
+	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
+	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
+	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
+	frp_stopped: "点击“重新连接”。",
+	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
+	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
+});
+function check(id, status, reason, label, detail, action, facts) {
+	return Object.freeze({
+		id,
+		status,
+		reason,
+		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
+		label,
+		detail,
+		...action === void 0 ? {} : { action }
+	});
+}
+function maskLanOrigin(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const url = new URL(origin);
+		const octets = url.hostname.split(".");
+		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
+		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
+	} catch {
+		return "地址格式无效";
+	}
+}
+function remoteSuffix(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const hostname = new URL(origin).hostname;
+		if (hostname.endsWith(".ts.net")) return "*.ts.net";
+		for (const suffix of [
+			".cpolar.cn",
+			".cpolar.io",
+			".cpolar.top",
+			".cpolar.com"
+		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
+		return "公共 HTTPS 地址";
+	} catch {
+		return "地址格式无效";
+	}
+}
+function defaultFirewallProbe(platform = process.platform) {
+	return async (port) => {
+		if (platform !== "win32") return { state: "not-applicable" };
+		if (port === void 0) return { state: "unknown" };
+		const script = [
+			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
+			"$ready = $true",
+			"$specs | ForEach-Object {",
+			"  $spec = $_",
+			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
+			"  if ($null -eq $rule) { $ready = $false; return }",
+			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
+			`  $matching = @($filters | Where-Object { $_.Protocol -eq $spec.Protocol -and ($_.LocalPort -eq 'Any' -or $_.LocalPort -eq '${String(port)}') })`,
+			"  if ($matching.Count -eq 0) { $ready = $false }",
+			"}",
+			"if ($ready) { 'ready' } else { 'missing' }"
+		].join("; ");
+		try {
+			return { state: (await execFile$2("powershell.exe", [
+				"-NoProfile",
+				"-NonInteractive",
+				"-Command",
+				script
+			], {
+				encoding: "utf8",
+				timeout: 3e3,
+				windowsHide: true
+			})).stdout.trim() === "ready" ? "ready" : "missing" };
+		} catch {
+			return { state: "unknown" };
+		}
+	};
+}
+/** Allow remote relays enough time to answer without making diagnostics unbounded. */
+function remoteDiagnosticTimeoutMs(origin) {
+	const hostname = new URL(origin).hostname.toLowerCase();
+	if (hostname.endsWith(".ts.net") || hostname.includes(".cpolar.")) return 1e4;
+	return 1e4;
+}
+async function defaultRemoteProbe(origin) {
+	if (origin === void 0) return { state: "not-applicable" };
+	const hostname = new URL(origin).hostname;
+	const started = performance.now();
+	try {
+		const response = await fetch(new URL("/mobile-access/health", origin), {
+			cache: "no-store",
+			redirect: "error",
+			signal: AbortSignal.timeout(remoteDiagnosticTimeoutMs(origin))
+		});
+		const latencyMs = Math.max(0, Math.round(performance.now() - started));
+		if (response.status === 429) return {
+			state: "rate-limited",
+			latencyMs
+		};
+		return response.ok ? {
+			state: "ready",
+			latencyMs
+		} : {
+			state: "unreachable",
+			latencyMs
+		};
+	} catch {
+		let fakeIp = false;
+		try {
+			fakeIp = (await lookup(hostname, { all: true })).some(({ address }) => {
+				const [first, second] = address.split(".").map(Number);
+				return first === 198 && (second === 18 || second === 19);
+			});
+		} catch {}
+		return {
+			state: "unreachable",
+			...fakeIp ? { fakeIp: true } : {}
+		};
+	}
+}
+function reportLine(entry) {
+	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
+}
+/** Run bounded read-only checks and return a report safe to paste into an issue. */
+async function collectConnectionDiagnostics(snapshot, probes = {}) {
+	const checks = [];
+	const remoteProbe = snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
+	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
+	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
+	if (snapshot.lan.networkError !== void 0) checks.push(check("network", "error", "network-unavailable", "局域网网卡", "已保存的网卡当前不可用。", "重新运行 dsh-mobile setup。"));
+	else if (snapshot.lan.configuredInterface !== void 0) {
+		const interfaceName = snapshot.lan.interfaceName ?? snapshot.lan.configuredInterface;
+		checks.push(check("network", "ok", "network-interface", "局域网网卡", `正在跟随 ${interfaceName}。`, void 0, { interfaceName }));
+	} else checks.push(check("network", "info", "network-fixed", "局域网网卡", "当前使用固定网络配置。"));
+	if (snapshot.lan.running && snapshot.lan.origin !== void 0) {
+		const endpointSuffix = maskLanOrigin(snapshot.lan.origin);
+		checks.push(check("lan", "ok", "lan-ready", "局域网网关", `已监听 ${endpointSuffix}，配对入口可用。`, void 0, { endpointSuffix }));
+	} else checks.push(check("lan", "info", "lan-off", "局域网网关", "当前未开启。", "需要手机直连时开启局域网访问。"));
+	if (firewall.state === "ready") checks.push(check("firewall", "ok", "firewall-ready", "Windows 防火墙", "局域网 TCP 与发现规则已启用。"));
+	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
+	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
+	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
+	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
+		const endpointSuffix = remoteSuffix(snapshot.remote.origin);
+		const facts = {
+			provider: snapshot.remote.provider,
+			endpointSuffix,
+			...remoteObservation.latencyMs === void 0 ? {} : { latencyMs: remoteObservation.latencyMs }
+		};
+		if (remoteObservation.state === "ready") checks.push(check("remote", "ok", "remote-ready", "远程通道", `${snapshot.remote.provider} 公共地址 ${endpointSuffix} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`, void 0, facts));
+		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "remote-rate-limited", "远程通道", "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。", facts));
+		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。", facts));
+		else checks.push(check("remote", "error", "remote-unreachable", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。", facts));
+	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") {
+		const needsLogin = snapshot.remote.state === "needs-login";
+		checks.push(check("remote", "warning", needsLogin ? "remote-needs-login" : "remote-connecting", "远程通道", needsLogin ? "等待完成 Tailscale 登录。" : "仍在建立连接。", needsLogin ? "返回远程页继续登录。" : "等待片刻后重新检查。", { provider: snapshot.remote.provider }));
+	} else {
+		const controllerCode = snapshot.remote.errorCode ?? snapshot.remote.state;
+		checks.push(check("remote", "error", "remote-controller-error", "远程通道", `连接未建立（${controllerCode}）。`, REMOTE_ERROR_GUIDANCE[controllerCode] ?? "返回远程页点击“重新连接”。", {
+			provider: snapshot.remote.provider,
+			controllerCode
+		}));
+	}
+	checks.push(check("phone-network", "info", "phone-network-unknown", "手机网络", "电脑无法判断路由器是否隔离了手机。", "局域网仍失败时，确认手机与电脑在同一网络，并关闭访客网络或 AP 隔离。"));
 	const overall = checks.some((entry) => entry.status === "error") ? "error" : checks.some((entry) => entry.status === "warning") ? "attention" : "ok";
 	const summary = overall === "ok" ? "连接基础检查正常。" : overall === "attention" ? "发现需要留意的项目。" : "发现会影响连接的问题。";
 	const report = [
@@ -4002,7 +5587,7 @@ const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机
    - mobile.js：手机端脚本，用 window.dshMobile.define({ apiVersion:1, id:'<id>', activate(api) { ... } })，activate 返回清理函数
    - mobile.css：手机端样式（可选）
    - assets/：手机端静态资源（可选）
-   - mobile.js 里用 api.host.invoke('动作名', 输入) 调 host.mjs 的 action，api.host.fetch('/路由路径') 调 route
+   - mobile.js 里用 api.host.invoke('动作名', 输入) 调 host.mjs 的 action，api.host.fetch('/路由路径') 调 route，api.host.assetUrl('相对路径') 生成与当前版本绑定的资源地址
    - 也可以先用命令生成模板：dsh plugin --profile web exec dsh-mobile extension create <id> --name "<名称>"，再在模板上改
 
 安全约束：
@@ -4362,28 +5947,12 @@ var FunnelController = class {
 		this.clearStartTimer();
 		const child = this.child;
 		this.child = void 0;
-		child?.stdin.end();
-		if (child !== void 0 && child.exitCode === null) {
-			child.kill("SIGTERM");
-			await new Promise((resolveClose) => {
-				let completed = false;
-				const finish = () => {
-					if (completed) return;
-					completed = true;
-					clearTimeout(timer);
-					resolveClose();
-				};
-				const timer = setTimeout(() => {
-					if (child.exitCode === null) child.kill("SIGKILL");
-					finish();
-				}, 1500);
-				timer.unref();
-				child.once("close", finish);
-			});
-		}
 		const gateway = this.gatewayValue;
 		this.gatewayValue = void 0;
-		await gateway?.close();
+		await settleRemoteResources([async () => {
+			child?.stdin.end();
+			if (child !== void 0 && child.exitCode === null) await terminateRemoteProcess(child);
+		}, () => gateway?.close()], "Funnel resource cleanup failed");
 	}
 	clearStartTimer() {
 		if (this.startTimer === void 0) return;
@@ -4754,30 +6323,15 @@ var CpolarController = class {
 		this.startupTimer = void 0;
 		const reservation = this.reservation;
 		this.reservation = void 0;
-		await reservation?.release();
 		const child = this.child;
 		this.child = void 0;
-		if (child !== void 0 && child.exitCode === null) {
-			child.kill("SIGTERM");
-			await new Promise((resolveClose) => {
-				let completed = false;
-				const finish = () => {
-					if (completed) return;
-					completed = true;
-					clearTimeout(timer);
-					resolveClose();
-				};
-				const timer = setTimeout(() => {
-					if (child.exitCode === null) child.kill("SIGKILL");
-					finish();
-				}, 1500);
-				timer.unref();
-				child.once("close", finish);
-			});
-		}
 		const gateway = this.gatewayValue;
 		this.gatewayValue = void 0;
-		await gateway?.close();
+		await settleRemoteResources([
+			() => reservation?.release(),
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close()
+		], "cpolar resource cleanup failed");
 	}
 };
 //#endregion
@@ -5049,80 +6603,376 @@ var CpolarComponentManager = class {
 	}
 };
 //#endregion
-//#region src/remote.ts
-/** Validate the provider selection loaded across the filesystem boundary. */
-function parseRemoteProviderState(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
-	const record = value;
-	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+//#region src/release-update.ts
+const PACKAGE_NAME = "dsh-mobile";
+const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
+const GITHUB_LATEST_URL = "https://github.com/saya-ch/dsh-mobile/releases/latest";
+const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
+const STATUS_CACHE_MS = 6e5;
+const REQUEST_TIMEOUT_MS = 8e3;
+const UPDATE_TIMEOUT_MS = 12e4;
+const UPDATE_TERMINATION_GRACE_MS = 1500;
+const NUMERIC_VERSION_IDENTIFIER = "(?:0|[1-9]\\d*)";
+const WILDCARD_VERSION_IDENTIFIER = "(?:[xX*])";
+const RANGE_VERSION = `(?:${`${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?`}|${`(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}))?))?)`})`;
+const COMPARATOR = new RegExp(`^(?:<=|>=|<|>|=|~|\\^)?${RANGE_VERSION}$`, "u");
+const HYPHEN_RANGE = new RegExp(`^${RANGE_VERSION} +[-] +${RANGE_VERSION}$`, "u");
+const DIST_TAG = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
+function parseSemver(value) {
+	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
+	if (match === null) return void 0;
+	const core = [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+	if (core.some((part) => !Number.isSafeInteger(part))) return void 0;
+	const prerelease = match[4] === void 0 ? [] : match[4].split(".").map((part) => /^\d+$/u.test(part) ? Number(part) : part);
+	if (prerelease.some((part) => typeof part === "number" && !Number.isSafeInteger(part))) return void 0;
 	return Object.freeze({
-		version: 1,
-		provider: record.provider
+		core,
+		prerelease: Object.freeze(prerelease)
 	});
 }
-/** Atomic selection store whose absent-file state uses the configured default. */
-var JsonRemoteProviderStore = class {
-	file;
-	defaultProvider;
-	constructor(file, defaultProvider) {
-		this.file = file;
-		this.defaultProvider = defaultProvider;
+/** Compare two strict SemVer strings, including prerelease precedence. */
+function comparePluginVersions(left, right) {
+	const a = parseSemver(left);
+	const b = parseSemver(right);
+	if (a === void 0 || b === void 0) return void 0;
+	for (let index = 0; index < a.core.length; index += 1) {
+		const difference = a.core[index] - b.core[index];
+		if (difference !== 0) return Math.sign(difference);
+	}
+	if (a.prerelease.length === 0 || b.prerelease.length === 0) return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+	const length = Math.max(a.prerelease.length, b.prerelease.length);
+	for (let index = 0; index < length; index += 1) {
+		const leftPart = a.prerelease[index];
+		const rightPart = b.prerelease[index];
+		if (leftPart === void 0 || rightPart === void 0) return leftPart === void 0 ? -1 : 1;
+		if (leftPart === rightPart) continue;
+		if (typeof leftPart === "number" && typeof rightPart === "number") return Math.sign(leftPart - rightPart);
+		if (typeof leftPart === "number") return -1;
+		if (typeof rightPart === "number") return 1;
+		return leftPart < rightPart ? -1 : 1;
+	}
+	return 0;
+}
+function isComparatorSet(value) {
+	if (HYPHEN_RANGE.test(value)) return true;
+	const comparators = value.replace(/(<=|>=|<|>|=|~|\^) +/gu, "$1").split(/ +/u);
+	return comparators.length > 0 && comparators.every((comparator) => COMPARATOR.test(comparator));
+}
+function isNpmVersionRange(value) {
+	if (!/^[0-9xX*<>=~^|.+\- ]+$/u.test(value)) return false;
+	const alternatives = value.split(/ *\|\| */u);
+	return alternatives.length > 0 && alternatives.every((alternative) => alternative !== "" && isComparatorSet(alternative));
+}
+/** Return whether pnpm may safely replace this profile dependency from an npm version, range, or tag. */
+function isRegistryPluginSpec(value) {
+	if (typeof value !== "string" || value.trim() !== value || value === "" || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+	if (/\.(?:tgz|tar(?:\.gz)?)$/iu.test(value)) return false;
+	return parseSemver(value) !== void 0 || isNpmVersionRange(value) || DIST_TAG.test(value);
+}
+/** Resolve the DSH profile named by the current launcher arguments. */
+function launchedProfileName(argv) {
+	for (let index = 0; index < argv.length; index += 1) {
+		if (argv[index] === "--profile") {
+			const candidate = argv[index + 1];
+			if (candidate !== void 0 && /^[\w.-]+$/u.test(candidate)) return candidate;
+		}
+		const match = /^--profile=([\w.-]+)$/u.exec(argv[index] ?? "");
+		if (match?.[1] !== void 0) return match[1];
 	}
-	async load() {
-		let stat;
-		try {
-			stat = await lstat(this.file);
-		} catch (error) {
-			if (error.code === "ENOENT") return Object.freeze({
-				version: 1,
-				provider: this.defaultProvider
+	return "web";
+}
+async function profileDependencySpec(profileDirectory) {
+	try {
+		const value = JSON.parse(await readFile(join(profileDirectory, "package.json"), "utf8")).dependencies?.[PACKAGE_NAME];
+		return typeof value === "string" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+async function fetchNpmVersion(fetcher) {
+	const response = await fetcher(NPM_LATEST_URL, {
+		headers: {
+			accept: "application/json",
+			"user-agent": "dsh-mobile-release-check"
+		},
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) return void 0;
+	const payload = await response.json();
+	return typeof payload.version === "string" && parseSemver(payload.version) !== void 0 ? payload.version : void 0;
+}
+function githubReleaseVersion(location, responseUrl) {
+	let url;
+	try {
+		url = new URL(location ?? responseUrl, GITHUB_LATEST_URL);
+	} catch {
+		return;
+	}
+	if (url.origin !== "https://github.com" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	if (!url.pathname.startsWith("/saya-ch/dsh-mobile/releases/tag/v")) return void 0;
+	let version;
+	try {
+		version = decodeURIComponent(url.pathname.slice(34));
+	} catch {
+		return;
+	}
+	return parseSemver(version) === void 0 ? void 0 : version;
+}
+function androidReleaseDownloadUrl(version) {
+	if (version === void 0) return GITHUB_RELEASES_URL;
+	const tag = `v${version}`;
+	return `https://github.com/saya-ch/dsh-mobile/releases/download/${encodeURIComponent(tag)}/dsh-mobile-android-${encodeURIComponent(tag)}.apk`;
+}
+async function fetchAndroidVersion(fetcher) {
+	const response = await fetcher(GITHUB_LATEST_URL, {
+		method: "GET",
+		redirect: "manual",
+		headers: {
+			accept: "text/html",
+			"user-agent": "dsh-mobile-release-check"
+		},
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	return githubReleaseVersion(response.headers.get("location"), response.url);
+}
+async function readProfileInstalledVersion(profileDirectory) {
+	try {
+		const manifestPath = createRequire(join(profileDirectory, "package.json")).resolve(`${PACKAGE_NAME}/package.json`);
+		const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+		return typeof manifest.version === "string" ? manifest.version : void 0;
+	} catch {
+		return;
+	}
+}
+function childCompletion(child) {
+	return new Promise((resolveCompletion, rejectCompletion) => {
+		child.once("error", rejectCompletion);
+		child.once("close", (code, signal) => {
+			resolveCompletion({
+				code,
+				signal
 			});
-			throw error;
+		});
+	});
+}
+function createDeadline(timeoutMs) {
+	let timer;
+	return {
+		promise: new Promise((resolveTimeout) => {
+			timer = setTimeout(resolveTimeout, timeoutMs);
+			timer.unref();
+		}),
+		cancel: () => {
+			if (timer !== void 0) clearTimeout(timer);
+			timer = void 0;
 		}
-		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("remote provider state must be a regular file no larger than 4 KiB");
-		await restrictPrivateFile(this.file);
-		let parsed;
+	};
+}
+async function taskkillProcessTree(pid) {
+	if ((await childCompletion(spawn("taskkill.exe", [
+		"/PID",
+		String(pid),
+		"/T",
+		"/F"
+	], {
+		shell: false,
+		windowsHide: true,
+		stdio: "ignore"
+	}))).code !== 0) throw new Error("plugin_update_tree_termination_failed");
+}
+async function completionWithin(completion, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([completion.then(() => true, () => true), new Promise((resolveTimeout) => {
+			timer = setTimeout(() => {
+				resolveTimeout(false);
+			}, timeoutMs);
+			timer.unref();
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+function processMissing(error) {
+	return error.code === "ESRCH";
+}
+async function terminateProcessTree(child, completion, platform) {
+	if (child.exitCode !== null || child.signalCode !== null) return;
+	const pid = child.pid;
+	if (pid === void 0) {
+		child.kill("SIGKILL");
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		return;
+	}
+	if (platform === "win32") {
 		try {
-			parsed = JSON.parse(await readFile(this.file, "utf8"));
+			await taskkillProcessTree(pid);
 		} catch (error) {
-			throw new Error("remote provider state is not valid JSON", { cause: error });
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new AggregateError([error, /* @__PURE__ */ new Error("plugin_update_tree_termination_timeout")], "plugin update tree termination failed");
+			throw error;
 		}
-		return parseRemoteProviderState(parsed);
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) {
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		}
+		return;
 	}
-	async save(state) {
-		const validated = parseRemoteProviderState(state);
-		const directory = dirname(this.file);
-		await mkdir(directory, {
-			recursive: true,
-			mode: 448
+	try {
+		process.kill(-pid, "SIGTERM");
+	} catch (error) {
+		if (!processMissing(error)) throw error;
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		return;
+	}
+	if (await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) return;
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch (error) {
+		if (!processMissing(error)) throw error;
+	}
+	if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+}
+function startUpdateProcess(request) {
+	const child = spawn(request.command, [...request.args], {
+		cwd: request.cwd,
+		detached: request.detached,
+		shell: request.shell,
+		windowsHide: true,
+		stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		]
+	});
+	const completion = childCompletion(child);
+	return {
+		completion,
+		...child.stderr === null ? {} : { stderr: child.stderr },
+		terminateTree: async () => terminateProcessTree(child, completion, request.platform)
+	};
+}
+function updateFailure(cause) {
+	return cause === void 0 ? /* @__PURE__ */ new Error("plugin_update_failed") : new Error("plugin_update_failed", { cause });
+}
+async function runPnpmUpdate(profileDirectory, version, runtime = {}) {
+	if (parseSemver(version) === void 0) throw new Error("plugin_update_unavailable");
+	const platform = runtime.platform ?? process.platform;
+	const packageSpec = `${PACKAGE_NAME}@${version}`;
+	const managed = (runtime.start ?? startUpdateProcess)({
+		command: platform === "win32" ? runtime.windowsCommandInterpreter ?? process.env.ComSpec ?? "cmd.exe" : "pnpm",
+		args: platform === "win32" ? [
+			"/d",
+			"/s",
+			"/c",
+			"pnpm.cmd",
+			"add",
+			packageSpec
+		] : ["add", packageSpec],
+		cwd: profileDirectory,
+		detached: platform !== "win32",
+		platform,
+		shell: false
+	});
+	let diagnostics = "";
+	managed.stderr?.on("data", (chunk) => {
+		if (diagnostics.length < 4096) diagnostics += Buffer.from(chunk).toString("utf8").slice(0, 4096 - diagnostics.length);
+	});
+	const completion = managed.completion.then((result) => ({
+		kind: "exit",
+		result
+	}), (error) => ({
+		kind: "error",
+		error
+	}));
+	const deadline = (runtime.deadline ?? createDeadline)(runtime.timeoutMs ?? UPDATE_TIMEOUT_MS);
+	const first = await Promise.race([completion, deadline.promise.then(() => ({ kind: "timeout" }))]);
+	deadline.cancel();
+	if (first.kind === "error") throw updateFailure(first.error);
+	if (first.kind === "exit") {
+		if (first.result.code === 0) return;
+		const detail = diagnostics.trim() || `pnpm exited with ${first.result.signal ?? String(first.result.code)}`;
+		throw updateFailure(new Error(detail));
+	}
+	let terminationError;
+	try {
+		await managed.terminateTree();
+	} catch (error) {
+		terminationError = error;
+	}
+	if (terminationError !== void 0) throw updateFailure(terminationError);
+	const stopped = await completion;
+	if (stopped.kind === "error") throw updateFailure(stopped.error);
+	throw updateFailure(/* @__PURE__ */ new Error("plugin update timed out"));
+}
+/** Cached npm/GitHub release lookup and guarded profile-local package update. */
+var PluginReleaseManager = class {
+	profileDirectory;
+	installedVersion;
+	fetcher;
+	runner;
+	installedVersionReader;
+	now;
+	cache;
+	activeUpdate;
+	constructor(options) {
+		this.profileDirectory = options.profileDirectory;
+		this.installedVersion = options.installedVersion ?? DSH_MOBILE_VERSION;
+		this.fetcher = options.fetch ?? globalThis.fetch;
+		this.runner = options.runUpdate ?? ((profileDirectory, version) => runPnpmUpdate(profileDirectory, version, options.updateProcess));
+		this.installedVersionReader = options.readInstalledVersion ?? readProfileInstalledVersion;
+		this.now = options.now ?? Date.now;
+	}
+	/** Read cached release metadata and suppress external lookup failures. */
+	async status(force = false) {
+		if (!force && this.cache !== void 0 && this.cache.expiresAt > this.now()) return this.cache.status;
+		const updateSupported = isRegistryPluginSpec(await profileDependencySpec(this.profileDirectory));
+		const [npmResult, androidResult] = await Promise.allSettled([fetchNpmVersion(this.fetcher), fetchAndroidVersion(this.fetcher)]);
+		const latestVersion = npmResult.status === "fulfilled" ? npmResult.value : void 0;
+		const androidVersion = androidResult.status === "fulfilled" ? androidResult.value : void 0;
+		const comparison = latestVersion === void 0 ? void 0 : comparePluginVersions(latestVersion, this.installedVersion);
+		const status = Object.freeze({
+			installedVersion: this.installedVersion,
+			...latestVersion === void 0 ? {} : { latestVersion },
+			updateAvailable: updateSupported && comparison === 1,
+			updateSupported,
+			...androidVersion === void 0 ? {} : { androidVersion },
+			androidDownloadUrl: androidReleaseDownloadUrl(androidVersion)
 		});
+		this.cache = {
+			expiresAt: this.now() + STATUS_CACHE_MS,
+			status
+		};
+		return status;
+	}
+	/** Install the latest npm release into the active profile, then require a DSH restart. */
+	async update() {
+		if (this.activeUpdate !== void 0) return this.activeUpdate;
+		this.activeUpdate = this.updateOnce();
 		try {
-			const current = await lstat(this.file);
-			if (!current.isFile() || current.isSymbolicLink()) throw new Error("remote provider state target must remain a regular file");
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
-		try {
-			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
-				encoding: "utf8",
-				flag: "wx",
-				mode: 384
-			});
-			await rename(temporary, this.file);
-			await restrictPrivateFile(this.file);
-		} catch (error) {
-			await rm(temporary, { force: true });
-			throw error;
+			return await this.activeUpdate;
+		} finally {
+			this.activeUpdate = void 0;
 		}
 	}
+	async updateOnce() {
+		const status = await this.status(true);
+		if (!status.updateSupported) throw new Error("plugin_update_unsupported");
+		if (!status.updateAvailable || status.latestVersion === void 0) throw new Error("plugin_update_unavailable");
+		await this.runner(this.profileDirectory, status.latestVersion);
+		const installed = await this.installedVersionReader(this.profileDirectory);
+		if (installed !== status.latestVersion) throw new Error("plugin_update_failed");
+		this.cache = void 0;
+		return Object.freeze({
+			installedVersion: installed,
+			restartRequired: true
+		});
+	}
 };
-/** Resolve the first-run provider without letting environment values bypass validation. */
-function configuredRemoteProvider(environment) {
-	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
-	if (value !== "tailscale" && value !== "cpolar") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale or cpolar");
-	return value;
-}
 promisify(execFile);
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
@@ -5335,6 +7185,17 @@ const inject = [
 	"commands",
 	"connection"
 ];
+/** Run cleanup steps in ownership order and report every failure after all steps settle. */
+async function settleCleanupSteps(steps) {
+	const errors = [];
+	for (const step of steps) try {
+		await step();
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length === 1 && errors[0] instanceof Error) throw errors[0];
+	if (errors.length > 0) throw new AggregateError(errors, "DSH Mobile cleanup failed");
+}
 function upstreamAuthenticatedUrl(ctx, upstreamOrigin) {
 	const connection = ctx.connection;
 	return typeof connection?.authenticatedUrl === "function" ? connection.authenticatedUrl(upstreamOrigin.origin) : void 0;
@@ -5352,6 +7213,16 @@ function mapAdminError(error) {
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
 	if (error instanceof Error && error.message === "cpolar_authtoken_invalid") return new HttpError(400, "cpolar_authtoken_invalid");
 	if (error instanceof Error && error.message.startsWith("cpolar_")) return new HttpError(409, error.message);
+	if (error instanceof Error && [
+		"frp_server_address_invalid",
+		"frp_server_port_invalid",
+		"frp_token_invalid",
+		"frp_public_origin_invalid",
+		"frp_settings_invalid"
+	].includes(error.message)) return new HttpError(400, error.message);
+	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message === "plugin_update_failed") return new HttpError(500, error.message);
+	if (error instanceof Error && error.message.startsWith("plugin_update_")) return new HttpError(409, error.message);
 	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
@@ -5443,7 +7314,7 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		discovery: false
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent) {
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, frpComponent, frpConfiguration) {
 	return {
 		provider,
 		running: status.enabled,
@@ -5464,6 +7335,13 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				running: providerStatuses.cpolar.enabled,
 				state: providerStatuses.cpolar.state,
 				component: cpolarComponent
+			},
+			frp: {
+				bundled: false,
+				running: providerStatuses.frp.enabled,
+				state: providerStatuses.frp.state,
+				component: frpComponent,
+				configuration: frpConfiguration
 			}
 		}
 	};
@@ -5479,10 +7357,17 @@ async function apply(ctx, config) {
 	const instanceId = await stableInstanceId(loaded, template);
 	const stateDirectory = dirname(template.stateFile);
 	const remoteDirectory = join(stateDirectory, "remote");
+	const configuredDshHome = process.env.DSH_HOME?.trim();
+	const dshHome = configuredDshHome === void 0 || configuredDshHome === "" ? dirname(stateDirectory) : resolve(configuredDshHome);
+	const releaseManager = new PluginReleaseManager({ profileDirectory: join(dshHome, "profiles", launchedProfileName(process.argv.slice(2))) });
 	const remoteProviderStore = new JsonRemoteProviderStore(join(remoteDirectory, "provider.json"), configuredRemoteProvider(process.env));
-	let remoteProvider = (await remoteProviderStore.load()).provider;
+	const initialRemoteProvider = (await remoteProviderStore.load()).provider;
 	const cpolarComponent = new CpolarComponentManager({ stateDirectory });
 	await cpolarComponent.initialize();
+	const frpComponent = new FrpComponentManager({ stateDirectory });
+	await frpComponent.initialize();
+	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"));
+	await frpConfig.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
 		id: "computer-images",
@@ -5544,7 +7429,7 @@ async function apply(ctx, config) {
 	const lanController = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
 	const remoteDeviceFile = join(remoteDirectory, "devices.json");
 	const legacyCpolarDeviceFile = join(remoteDirectory, "cpolar", "devices.json");
-	if (remoteProvider === "cpolar") try {
+	if (initialRemoteProvider === "cpolar") try {
 		await lstat(remoteDeviceFile);
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
@@ -5562,6 +7447,7 @@ async function apply(ctx, config) {
 	};
 	const tailscaleStore = new JsonMobileAccessControlStore(join(remoteDirectory, "control.json"), false);
 	const cpolarStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cpolar", "control.json"), false);
+	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -5576,29 +7462,22 @@ async function apply(ctx, config) {
 			configFile: cpolarComponent.configFile,
 			region: "cn",
 			createGateway: createRemoteGateway
+		}),
+		frp: new FrpController({
+			store: frpStore,
+			executable: frpComponent.executable,
+			config: frpConfig,
+			instanceId,
+			createGateway: createRemoteGateway
 		})
 	};
-	const remoteController = () => remoteControllers[remoteProvider];
-	const remotePayload = () => remoteControlPayload(remoteProvider, remoteController().status(), remoteController().gateway(), {
+	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
+	const remoteController = () => remoteProviders.controller();
+	const remotePayload = () => remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
 		tailscale: remoteControllers.tailscale.status(),
-		cpolar: remoteControllers.cpolar.status()
-	}, cpolarComponent.status());
-	const selectRemoteProvider = async (provider) => {
-		if (provider === remoteProvider) return;
-		const previous = remoteControllers[remoteProvider];
-		const restore = previous.status().enabled;
-		if (restore) await previous.setEnabled(false);
-		try {
-			await remoteProviderStore.save({
-				version: 1,
-				provider
-			});
-			remoteProvider = provider;
-		} catch (error) {
-			if (restore) await previous.setEnabled(true);
-			throw error;
-		}
-	};
+		cpolar: remoteControllers.cpolar.status(),
+		frp: remoteControllers.frp.status()
+	}, cpolarComponent.status(), frpComponent.status(), frpConfig.status());
 	const lanPayload = () => ({
 		running: lanController.isRunning(),
 		origin: lanGateway?.address().origin,
@@ -5629,7 +7508,7 @@ async function apply(ctx, config) {
 				...networkError === void 0 ? {} : { networkError }
 			},
 			remote: {
-				provider: remoteProvider,
+				provider: remoteProviders.selected,
 				running: remote.enabled,
 				state: remote.state,
 				...remote.origin === void 0 ? {} : { origin: remote.origin },
@@ -5654,6 +7533,15 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await diagnosticsPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/release`) {
+					sendJson(response, 200, await releaseManager.status(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/release/update`) {
+					await readJsonObject(request, 4096);
+					sendJson(response, 200, await releaseManager.update(), false);
+					return;
+				}
 				if (request.method === "POST" && lanControl) {
 					const body = await readJsonObject(request, 4096);
 					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
@@ -5667,47 +7555,75 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
 					const body = await readJsonObject(request, 4096);
-					if (body.provider !== "tailscale" && body.provider !== "cpolar") throw new HttpError(400, "bad_request");
-					await selectRemoteProvider(body.provider);
+					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "frp") throw new HttpError(400, "bad_request");
+					await remoteProviders.select(body.provider);
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await cpolarComponent.install();
+					await remoteProviders.mutate(async () => cpolarComponent.install());
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/configure`) {
 					const body = await readJsonObject(request, 4096);
-					await cpolarComponent.configure(body.authtoken);
+					await remoteProviders.mutate(async () => cpolarComponent.configure(body.authtoken));
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/purge`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await remoteControllers.cpolar.setEnabled(false);
-					await cpolarComponent.purge();
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cpolar.setEnabled(false);
+						await cpolarComponent.purge();
+					});
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
-				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/control`) {
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => frpComponent.install());
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/configure`) {
 					const body = await readJsonObject(request, 4096);
-					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					await remoteController().setEnabled(body.running);
+					await remoteProviders.mutate(async () => {
+						await frpConfig.configure(body);
+						if (remoteControllers.frp.status().enabled) await remoteControllers.frp.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.frp.setEnabled(false);
+						await Promise.all([frpComponent.purge(), frpConfig.purge()]);
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/control`) {
+					const running = (await readJsonObject(request, 4096)).running;
+					if (typeof running !== "boolean") throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async (controller) => controller.setEnabled(running));
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reconnect`) {
 					await readJsonObject(request, 4096);
-					await remoteController().reconnect();
+					await remoteProviders.mutate(async (controller) => controller.reconnect());
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reset`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await remoteController().reset();
-					await rm(remoteDeviceFile, { force: true });
+					await remoteProviders.mutate(async (controller) => {
+						await controller.reset();
+						await rm(remoteDeviceFile, { force: true });
+					});
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
@@ -5766,36 +7682,54 @@ async function apply(ctx, config) {
 		try {
 			await mobileAccess.startLocal(template.extensionsDir, ctx);
 			await lanController.initialize();
-			if (remoteProvider === "tailscale") await cpolarStore.save({
-				version: 1,
-				enabled: false
-			});
-			else await tailscaleStore.save({
+			const stores = {
+				tailscale: tailscaleStore,
+				cpolar: cpolarStore,
+				frp: frpStore
+			};
+			await Promise.all(Object.keys(stores).filter((provider) => provider !== remoteProviders.selected).map((provider) => stores[provider].save({
 				version: 1,
 				enabled: false
-			});
-			await remoteControllers.tailscale.initialize();
-			await remoteControllers.cpolar.initialize();
+			})));
+			for (const provider of [
+				"tailscale",
+				"cpolar",
+				"frp"
+			]) await remoteControllers[provider].initialize();
 		} catch (error) {
-			unregister();
-			disposeMobileCommand();
-			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
-			await lanController.close();
-			await mobileAccess.stopLocal();
-			unregisterBuiltin();
+			try {
+				await settleCleanupSteps([
+					unregister,
+					disposeMobileCommand,
+					async () => {
+						const failures = (await Promise.allSettled(Object.values(remoteControllers).map((controller) => controller.close()))).filter((result) => result.status === "rejected").map((result) => result.reason);
+						if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
+					},
+					() => lanController.close(),
+					() => mobileAccess.stopLocal(),
+					unregisterBuiltin
+				]);
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "DSH Mobile initialization and cleanup failed");
+			}
 			throw error;
 		}
 		return async () => {
-			unregister();
-			disposeMobileCommand();
-			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
-			await lanController.close();
-			await mobileAccess.stopLocal();
-			unregisterBuiltin();
+			await settleCleanupSteps([
+				unregister,
+				disposeMobileCommand,
+				async () => {
+					const failures = (await Promise.allSettled(Object.values(remoteControllers).map((controller) => controller.close()))).filter((result) => result.status === "rejected").map((result) => result.reason);
+					if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
+				},
+				() => lanController.close(),
+				() => mobileAccess.stopLocal(),
+				unregisterBuiltin
+			]);
 		};
-	}, "dsh-mobile: independent LAN and selectable remote access with /mobile command");
+	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, EXTENSION_LIMITS, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, createMobileAccessService, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority, rewriteMobileIndex };
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, configuredRemoteProvider, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
 
 //# sourceMappingURL=index.mjs.map