dsh-mobile 0.3.2 → 0.3.3

package/lib/index.mjs

@@ -1246,7 +1246,10 @@ const EXTENSION_LIMITS = Object.freeze({
 	manifest: 65536,
 	script: 1048576,
 	css: 524288,
-	asset: 8388608
+	asset: 8388608,
+	assetFiles: 256,
+	assetBytes: 33554432,
+	assetDepth: 8
 });
 /** A misbehaving host activation must not wedge the local watcher forever. */
 const HOST_ACTIVATION_TIMEOUT_MS = 5e3;
@@ -1331,7 +1334,7 @@ function normalizeRelativePath(value, field) {
 	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
 	return normalized;
 }
-async function regularFile$1(path, maximum, field) {
+async function regularFile$2(path, maximum, field) {
 	let info;
 	try {
 		info = await lstat(path);
@@ -1352,7 +1355,7 @@ async function containedPath(root, relativePath, maximum, field) {
 	const targetReal = await realpath(target);
 	const relation = relative(rootReal, targetReal);
 	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
-	return regularFile$1(targetReal, maximum, field);
+	return regularFile$2(targetReal, maximum, field);
 }
 async function optionalFile(root, name, maximum, field) {
 	try {
@@ -1390,7 +1393,9 @@ async function assetSnapshot(extensionRootReal) {
 	const assetsReal = await realpath(assetsPath);
 	assertRealPathWithin(extensionRootReal, assetsReal, "assets");
 	const snapshots = /* @__PURE__ */ new Map();
-	const visit = async (directoryReal, prefix) => {
+	let totalBytes = 0;
+	const visit = async (directoryReal, prefix, depth) => {
+		if (depth > EXTENSION_LIMITS.assetDepth) throw new MobileExtensionError("invalid_extension", "asset tree exceeds its depth limit");
 		assertRealPathWithin(extensionRootReal, directoryReal, "asset directory");
 		const handle = await opendir(directoryReal);
 		const entries = [];
@@ -1408,11 +1413,13 @@ async function assetSnapshot(extensionRootReal) {
 			assertRealPathWithin(extensionRootReal, targetReal, "asset");
 			const key = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
 			if (info.isDirectory()) {
-				await visit(targetReal, key);
+				await visit(targetReal, key, depth + 1);
 				continue;
 			}
 			if (!info.isFile() || info.size > EXTENSION_LIMITS.asset) throw new MobileExtensionError("invalid_extension", "asset must be a regular file within its size limit");
 			const body = await readFile(targetReal);
+			totalBytes += body.byteLength;
+			if (snapshots.size >= EXTENSION_LIMITS.assetFiles || totalBytes > EXTENSION_LIMITS.assetBytes) throw new MobileExtensionError("invalid_extension", "asset tree exceeds its aggregate limit");
 			snapshots.set(key, Object.freeze({
 				body,
 				digest: createHash("sha256").update(body).digest("hex"),
@@ -1420,12 +1427,12 @@ async function assetSnapshot(extensionRootReal) {
 			}));
 		}
 	};
-	await visit(assetsReal, "");
+	await visit(assetsReal, "", 0);
 	return snapshots;
 }
 async function extensionFingerprint(directory) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$1(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifestBody = await readFile(manifestFile.path);
 	const manifest = parseExtensionManifest(JSON.parse(manifestBody.toString("utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
@@ -1915,7 +1922,7 @@ async function abortAndDisposeLocal(entries) {
 }
 async function loadLocalExtension(directory, context, known, parentSignal) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$1(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
 	const scriptBody = known === void 0 ? await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js").then((path) => path === void 0 ? void 0 : readFile(path)) : known.scriptBody;
@@ -3309,8 +3316,10 @@ var MobileAccessGateway = class {
 		}
 	}
 	async sendExtensionResponse(response, result, head) {
+		const status = result.status ?? 200;
+		if (!Number.isSafeInteger(status) || status < 200 || status > 599) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid HTTP status", 500);
 		const contentType = result.contentType ?? "application/octet-stream";
-		if (!/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\s\S]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
+		if (contentType.length > 1024 || !/^[\x20-\x7e]+$/u.test(contentType) || !/^[\w!#$&+.^-]+\/[\w!#$&+.^-]+(?:;[\x20-\x7e]*)?$/u.test(contentType)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid content type", 500);
 		const safeHeaders = {};
 		for (const [name, value] of Object.entries(result.headers ?? {})) {
 			if (!/^(?:content-disposition|cache-control|etag)$/iu.test(name) || /[\r\n]/u.test(value)) continue;
@@ -3320,7 +3329,7 @@ var MobileAccessGateway = class {
 		if (typeof result.body === "string" || result.body instanceof Uint8Array) {
 			const body = typeof result.body === "string" ? Buffer.from(result.body) : Buffer.from(result.body);
 			if (body.byteLength > 4194304) throw new MobileExtensionError("extension_result_too_large", "extension response is too large", 500);
-			response.writeHead(result.status ?? 200, {
+			response.writeHead(status, {
 				...safeHeaders,
 				"Content-Type": contentType,
 				"Content-Length": body.byteLength
@@ -3329,7 +3338,7 @@ var MobileAccessGateway = class {
 			else response.end(body);
 			return;
 		}
-		response.writeHead(result.status ?? 200, {
+		response.writeHead(status, {
 			...safeHeaders,
 			"Content-Type": contentType
 		});
@@ -4160,6 +4169,1184 @@ var MemoryDeviceStore = class {
 	}
 };
 //#endregion
+//#region src/frp-component.ts
+const FRP_VERSION = "0.70.1";
+const MAX_ARCHIVE_ENTRIES = 128;
+const MAX_ARCHIVE_LIST_BYTES = 262144;
+/** Pinned official FRP release metadata for supported desktop targets. */
+const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		platform: "win32",
+		arch: "x64",
+		archiveName: "frp.zip",
+		executableName: "frpc.exe",
+		downloadBytes: 13924309,
+		downloadSha256: "531f3cd3cc41c0b4f077b54fe6b7dd83c0ff727e7f0bf412a4c78fa279165de5",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_amd64.zip`
+	},
+	{
+		platform: "win32",
+		arch: "arm64",
+		archiveName: "frp.zip",
+		executableName: "frpc.exe",
+		downloadBytes: 12204751,
+		downloadSha256: "74d3acaf0f03ee190dd0462f9b49861dca50b0559c5488af4b36572fc951fcca",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_arm64.zip`
+	},
+	{
+		platform: "linux",
+		arch: "x64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 13924042,
+		downloadSha256: "333da23d1b9009d7c01638e9ba38cf4600f7d37d393f854e96ee1396adefa9a6",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_amd64.tar.gz`
+	},
+	{
+		platform: "linux",
+		arch: "arm64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 12371290,
+		downloadSha256: "3990f396a9a490ee7f0e5f355287750ed41520064ed999eab443b5e9a78d773d",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_arm64.tar.gz`
+	},
+	{
+		platform: "darwin",
+		arch: "x64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 13951979,
+		downloadSha256: "cbf69cf26e5553e914e97d37f5d4367fa30f5f531d073a889465af4719281e25",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_amd64.tar.gz`
+	},
+	{
+		platform: "darwin",
+		arch: "arm64",
+		archiveName: "frp.tar.gz",
+		executableName: "frpc",
+		downloadBytes: 12670664,
+		downloadSha256: "cfa733b5a261c1647edee3c1fc4133d2542989b28f5602e81d47fc821d25c55f",
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_arm64.tar.gz`
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
+function inside$1(parent, child) {
+	const candidate = relative(parent, child);
+	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
+}
+async function regularFile$1(file) {
+	try {
+		const entry = await lstat(file);
+		return entry.isFile() && !entry.isSymbolicLink();
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function replaceDirectory(target, candidate) {
+	const backup = `${target}.previous-${randomBytes(12).toString("hex")}`;
+	let previous = false;
+	try {
+		try {
+			await rename(target, backup);
+			previous = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		try {
+			await rename(candidate, target);
+		} catch (error) {
+			if (previous) try {
+				await rename(backup, target);
+			} catch (restoreError) {
+				throw new AggregateError([error, restoreError], "frp_component_replace_failed");
+			}
+			throw error;
+		}
+		if (previous) await rm(backup, {
+			recursive: true,
+			force: true
+		});
+	} finally {
+		await rm(candidate, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function sha256$1(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+async function runCapture(file, args) {
+	return new Promise((resolveRun, reject) => {
+		execFile(file, [...args], {
+			windowsHide: true,
+			timeout: 12e4,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolveRun(stdout);
+			else reject(error);
+		});
+	});
+}
+function validatedArchiveEntry(rawEntry) {
+	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("frp_archive_path_invalid");
+	const segments = rawEntry.replace(/\/$/u, "").split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("frp_archive_path_invalid");
+	return segments;
+}
+/** Select exactly one nested frpc executable from a safe archive listing. */
+function selectFrpExecutableEntry(entries, executableName) {
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("frp_archive_entries_invalid");
+	let executableEntry;
+	for (const entry of entries) {
+		const segments = validatedArchiveEntry(entry);
+		if (segments.length >= 2 && segments.at(-1) === executableName) {
+			if (executableEntry !== void 0) throw new Error("frp_archive_executable_ambiguous");
+			executableEntry = entry.replace(/\/$/u, "");
+		}
+	}
+	if (executableEntry === void 0) throw new Error("frp_archive_executable_missing");
+	return executableEntry;
+}
+async function defaultExtractArtifact$1(archive, destination, executableName) {
+	const tar = process.platform === "win32" ? "tar.exe" : "tar";
+	const executableEntry = selectFrpExecutableEntry((await runCapture(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await runCapture(tar, [
+		"-xf",
+		archive,
+		"-C",
+		unpacked,
+		executableEntry
+	]);
+	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
+	if (!await regularFile$1(extracted)) throw new Error("frp_archive_executable_invalid");
+	await copyFile(extracted, join(destination, executableName));
+}
+async function defaultFetchArtifact$1(artifact, signal) {
+	const response = await fetch(artifact.downloadUrl, {
+		redirect: "follow",
+		signal
+	});
+	if (!response.ok) throw new Error(`frp_download_http_${String(response.status)}`);
+	const finalUrl = new URL(response.url);
+	const officialHost = finalUrl.hostname === "github.com" || finalUrl.hostname.endsWith(".githubusercontent.com");
+	if (finalUrl.protocol !== "https:" || !officialHost) throw new Error("frp_download_origin_invalid");
+	const lengthHeader = response.headers.get("content-length");
+	const declaredLength = lengthHeader === null ? void 0 : Number(lengthHeader);
+	if (declaredLength !== void 0 && (!Number.isFinite(declaredLength) || declaredLength !== artifact.downloadBytes)) throw new Error("frp_download_size_mismatch");
+	if (response.body === null) throw new Error("frp_download_empty");
+	const chunks = [];
+	let received = 0;
+	const reader = response.body.getReader();
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		received += result.value.byteLength;
+		if (received > artifact.downloadBytes) {
+			await reader.cancel();
+			throw new Error("frp_download_size_mismatch");
+		}
+		chunks.push(result.value);
+	}
+	if (received !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
+	const bytes = new Uint8Array(received);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function defaultInspectExecutable(executable) {
+	return (await runCapture(executable, ["--version"])).trim();
+}
+/** Owns the optional official frpc binary inside the DSH Mobile state directory. */
+var FrpComponentManager = class {
+	executable;
+	componentRoot;
+	componentStorage;
+	logRoot;
+	stagingRoot;
+	artifact;
+	fetchArtifact;
+	extractArtifact;
+	inspectExecutable;
+	installed = false;
+	installedBytes = 0;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		const stateDirectory = resolve(options.stateDirectory);
+		if (!isAbsolute(stateDirectory)) throw new Error("frp state directory must be absolute");
+		const platform = options.platform ?? process.platform;
+		const arch = options.arch ?? process.arch;
+		this.artifact = FRP_COMPONENT_RELEASES[`${platform}-${arch}`];
+		this.componentRoot = join(stateDirectory, "components", "frp");
+		this.componentStorage = join(this.componentRoot, FRP_VERSION);
+		this.executable = join(this.componentStorage, platform === "win32" ? "frpc.exe" : "frpc");
+		this.logRoot = join(stateDirectory, "logs", "frp");
+		this.stagingRoot = join(stateDirectory, "staging", "frp");
+		for (const child of [
+			this.componentRoot,
+			this.componentStorage,
+			this.logRoot,
+			this.stagingRoot
+		]) if (!inside$1(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
+		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
+	}
+	/** Inspect the managed executable without relying on global FRP installations. */
+	async initialize() {
+		this.installed = await regularFile$1(this.executable);
+		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
+		if (this.installed) try {
+			if (await this.inspectExecutable(this.executable) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+			this.errorCode = void 0;
+		} catch {
+			this.installed = false;
+			this.errorCode = "frp_component_invalid";
+		}
+	}
+	/** Return component metadata without exposing configuration or credentials. */
+	status() {
+		return Object.freeze({
+			supported: this.artifact !== void 0,
+			installed: this.installed,
+			version: FRP_VERSION,
+			downloadBytes: this.artifact?.downloadBytes ?? 0,
+			installedBytes: this.installedBytes,
+			sourceUrl: this.artifact?.downloadUrl ?? "https://github.com/fatedier/frp/releases",
+			releasePage: `https://github.com/fatedier/frp/releases/tag/v${FRP_VERSION}`,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Download, verify, and extract only frpc after explicit confirmation. */
+	install() {
+		return this.enqueue(async () => {
+			const artifact = this.artifact;
+			if (artifact === void 0) throw new Error("frp_component_unsupported");
+			await mkdir(this.stagingRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 12e4);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(artifact, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
+				if (sha256$1(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
+				const archive = join(staging, artifact.archiveName);
+				await writeFile(archive, bytes, {
+					flag: "wx",
+					mode: 384
+				});
+				await this.extractArtifact(archive, staging, artifact.executableName);
+				const extracted = join(staging, artifact.executableName);
+				if (!await regularFile$1(extracted)) throw new Error("frp_executable_missing");
+				await chmod(extracted, 448);
+				if (await this.inspectExecutable(extracted) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+				await mkdir(candidate, {
+					recursive: true,
+					mode: 448
+				});
+				const candidateExecutable = join(candidate, artifact.executableName);
+				await copyFile(extracted, candidateExecutable);
+				await chmod(candidateExecutable, 448);
+				await replaceDirectory(this.componentStorage, candidate);
+				this.installed = true;
+				this.installedBytes = (await stat(this.executable)).size;
+				this.errorCode = void 0;
+			} finally {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+			}
+		});
+	}
+	/** Remove all FRP executable, staging, and log files owned by DSH Mobile. */
+	purge() {
+		return this.enqueue(async () => {
+			await Promise.all([
+				rm(this.componentRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.logRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stagingRoot, {
+					recursive: true,
+					force: true
+				})
+			]);
+			this.installed = false;
+			this.installedBytes = 0;
+			this.errorCode = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+//#endregion
+//#region src/frp-template.ts
+/** Loopback-only HTTP vhost port used between Caddy and frps. */
+const FRP_VHOST_HTTP_PORT = 7080;
+function publicDnsHostname(value) {
+	return value.length <= 253 && value.includes(".") && !/^[0-9.]+$/u.test(value) && !value.includes(":") && value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/** Build the only supported frps and Caddy configuration from validated user inputs. */
+function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
+	if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+	let url;
+	try {
+		url = new URL(publicOrigin);
+	} catch {
+		throw new Error("frp_template_input_invalid");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
+	return [
+		"# frps.toml",
+		`bindPort = ${String(serverPort)}`,
+		"proxyBindAddr = \"127.0.0.1\"",
+		`vhostHTTPPort = ${String(FRP_VHOST_HTTP_PORT)}`,
+		"auth.method = \"token\"",
+		`auth.token = ${JSON.stringify(token)}`,
+		"",
+		"# Caddyfile",
+		`${url.hostname} {`,
+		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		"}",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/frp-config.ts
+const MAX_SETTINGS_BYTES = 8192;
+function hostname$1(value) {
+	if (value.length > 253 || !value.includes(".")) return false;
+	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/** Validate the FRP server hostname or IP address. */
+function validateFrpServerAddress(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
+	const normalized = value.toLowerCase().replace(/\.$/u, "");
+	if (isIP(normalized) === 0 && !hostname$1(normalized)) throw new Error("frp_server_address_invalid");
+	return normalized;
+}
+/** Validate the FRP control port. */
+function validateFrpServerPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("frp_server_port_invalid");
+	return Number(value);
+}
+/** Validate a high-entropy FRP token before durable storage. */
+function validateFrpToken(value) {
+	if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
+	return value;
+}
+/** Validate the public HTTPS origin used by Caddy and Android pairing. */
+function validateFrpPublicOrigin(value) {
+	if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("frp_public_origin_invalid");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(url.hostname) !== 0 || !hostname$1(url.hostname)) throw new Error("frp_public_origin_invalid");
+	return url.origin;
+}
+/** Parse FRP settings at the loopback request and filesystem boundaries. */
+function parseFrpSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_settings_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"version",
+		"serverAddress",
+		"serverPort",
+		"token",
+		"publicOrigin"
+	].includes(String(key)))) throw new Error("frp_settings_invalid");
+	if (record.version !== void 0 && record.version !== 1) throw new Error("frp_settings_invalid");
+	return Object.freeze({
+		version: 1,
+		serverAddress: validateFrpServerAddress(record.serverAddress),
+		serverPort: validateFrpServerPort(record.serverPort),
+		token: validateFrpToken(record.token),
+		publicOrigin: validateFrpPublicOrigin(record.publicOrigin)
+	});
+}
+function tomlString(value) {
+	return JSON.stringify(value);
+}
+/** Build the single-purpose frpc configuration for the current loopback gateway. */
+function createFrpcToml(settings, localPort) {
+	if (!Number.isSafeInteger(localPort) || localPort < 1 || localPort > 65535) throw new Error("frp_local_port_invalid");
+	const hostnameValue = new URL(settings.publicOrigin).hostname;
+	return [
+		`serverAddr = ${tomlString(settings.serverAddress)}`,
+		`serverPort = ${String(settings.serverPort)}`,
+		"auth.method = \"token\"",
+		`auth.token = ${tomlString(settings.token)}`,
+		"transport.tls.enable = true",
+		"",
+		"[[proxies]]",
+		"name = \"dsh-mobile\"",
+		"type = \"http\"",
+		"localIP = \"127.0.0.1\"",
+		`localPort = ${String(localPort)}`,
+		`customDomains = [${tomlString(hostnameValue)}]`,
+		"transport.useEncryption = true",
+		"transport.useCompression = true",
+		""
+	].join("\n");
+}
+/** Build the matching restricted frps and Caddy templates for one VPS. */
+function createFrpServerTemplate(settings) {
+	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin);
+}
+async function atomicPrivateWrite(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("frp_config_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+/** Owns private FRP settings and generation-specific frpc configuration. */
+var FrpConfigStore = class {
+	stateRoot;
+	settingsFile;
+	runtimeConfigFile;
+	settingsValue;
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("frp config state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "settings.json");
+		this.runtimeConfigFile = join(this.stateRoot, "frpc.toml");
+	}
+	/** Load private settings while rejecting links, oversized files, and unknown fields. */
+	async initialize() {
+		let entry;
+		try {
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+			this.errorCode = "frp_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseFrpSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+			this.errorCode = void 0;
+		} catch {
+			this.settingsValue = void 0;
+			this.errorCode = "frp_config_invalid";
+		}
+	}
+	/** Return configuration metadata without exposing the FRP token. */
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			configured: settings !== void 0,
+			...settings === void 0 ? {} : {
+				serverAddress: settings.serverAddress,
+				serverPort: settings.serverPort,
+				publicOrigin: settings.publicOrigin
+			},
+			vhostHttpPort: FRP_VHOST_HTTP_PORT,
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Return private settings only to the provider lifecycle. */
+	settings() {
+		return this.settingsValue;
+	}
+	/** Atomically replace private FRP settings. */
+	async configure(value) {
+		const settings = parseFrpSettings(value);
+		await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		await rm(this.runtimeConfigFile, { force: true });
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	/** Materialize the private generation-specific frpc configuration. */
+	async writeRuntimeConfig(localPort) {
+		const settings = this.settingsValue;
+		if (settings === void 0) throw new Error("frp_config_missing");
+		await atomicPrivateWrite(this.runtimeConfigFile, createFrpcToml(settings, localPort));
+		return this.runtimeConfigFile;
+	}
+	/** Remove only configuration files owned by the FRP provider. */
+	async purge() {
+		await rm(this.stateRoot, {
+			recursive: true,
+			force: true
+		});
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/remote.ts
+const REMOTE_PROVIDERS = [
+	"tailscale",
+	"cpolar",
+	"frp"
+];
+function aggregateErrors(errors, message) {
+	if (errors.length === 0) return void 0;
+	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
+	return new AggregateError(errors, message);
+}
+/** Settle independent remote cleanup work before reporting any collected failure. */
+async function settleRemoteResources(steps, message = "remote resource cleanup failed") {
+	const failure = aggregateErrors((await Promise.allSettled(steps.map(async (step) => step()))).filter((result) => result.status === "rejected").map((result) => result.reason), message);
+	if (failure !== void 0) throw failure;
+}
+/**
+* Serialize all provider mutations and preserve the single-provider invariant.
+* Operations read the selected controller only after reaching the front of the queue.
+*/
+var RemoteProviderCoordinator = class {
+	controllers;
+	store;
+	selectedValue;
+	queue = Promise.resolve();
+	constructor(selected, controllers, store) {
+		this.controllers = controllers;
+		this.store = store;
+		this.selectedValue = selected;
+	}
+	/** Return the durable provider currently selected by the desktop UI. */
+	get selected() {
+		return this.selectedValue;
+	}
+	/** Return the controller selected when this method is called. */
+	controller() {
+		return this.controllers[this.selectedValue];
+	}
+	/** Run a provider-owned mutation after all earlier provider work settles. */
+	mutate(operation) {
+		return this.enqueue(() => operation(this.controller()));
+	}
+	/** Disable the previous provider, persist the new selection, and retain rollback on write failure. */
+	select(provider) {
+		return this.enqueue(async () => {
+			if (provider === this.selectedValue) return;
+			const previous = this.controllers[this.selectedValue];
+			const restore = previous.status().enabled;
+			if (restore) await previous.setEnabled(false);
+			try {
+				await this.store.save({
+					version: 1,
+					provider
+				});
+				this.selectedValue = provider;
+			} catch (error) {
+				if (restore) try {
+					await previous.setEnabled(true);
+				} catch (restoreError) {
+					throw new AggregateError([error, restoreError], "remote provider selection rollback failed");
+				}
+				throw error;
+			}
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(() => this.runAndEnforce(operation), () => this.runAndEnforce(operation));
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	async runAndEnforce(operation) {
+		let value;
+		let operationError;
+		try {
+			value = await operation();
+		} catch (error) {
+			operationError = error;
+		}
+		const results = await Promise.allSettled(REMOTE_PROVIDERS.filter((provider) => provider !== this.selectedValue).map((provider) => this.controllers[provider].setEnabled(false)));
+		const failure = aggregateErrors([...operationError === void 0 ? [] : [operationError], ...results.filter((result) => result.status === "rejected").map((result) => result.reason)], "remote provider operation failed");
+		if (failure !== void 0) throw failure;
+		return value;
+	}
+};
+/** Stop an owned provider process and do not report completion before its close event. */
+async function terminateRemoteProcess(child, gracefulTimeoutMs = 1500, forcedTimeoutMs = 1500) {
+	if (child.exitCode !== null || child.signalCode !== null) return;
+	await new Promise((resolveClose, rejectClose) => {
+		let gracefulTimer;
+		let forcedTimer;
+		let settled = false;
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			if (gracefulTimer !== void 0) clearTimeout(gracefulTimer);
+			if (forcedTimer !== void 0) clearTimeout(forcedTimer);
+			child.off("close", onClose);
+			if (error === void 0) resolveClose();
+			else rejectClose(error);
+		};
+		const onClose = () => {
+			finish();
+		};
+		child.once("close", onClose);
+		try {
+			child.kill("SIGTERM");
+		} catch (error) {
+			finish(error instanceof Error ? error : new Error(String(error)));
+			return;
+		}
+		if (settled) return;
+		gracefulTimer = setTimeout(() => {
+			try {
+				if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			} catch (error) {
+				finish(error instanceof Error ? error : new Error(String(error)));
+				return;
+			}
+			if (settled) return;
+			forcedTimer = setTimeout(() => {
+				finish(/* @__PURE__ */ new Error("remote_process_stop_timeout"));
+			}, forcedTimeoutMs);
+			forcedTimer.unref();
+		}, gracefulTimeoutMs);
+		gracefulTimer.unref();
+	});
+}
+/** Validate the provider selection loaded across the filesystem boundary. */
+function parseRemoteProviderState(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
+	const record = value;
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "frp" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	return Object.freeze({
+		version: 1,
+		provider: record.provider
+	});
+}
+/** Atomic selection store whose absent-file state uses the configured default. */
+var JsonRemoteProviderStore = class {
+	file;
+	defaultProvider;
+	constructor(file, defaultProvider) {
+		this.file = file;
+		this.defaultProvider = defaultProvider;
+	}
+	async load() {
+		let stat;
+		try {
+			stat = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return Object.freeze({
+				version: 1,
+				provider: this.defaultProvider
+			});
+			throw error;
+		}
+		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("remote provider state must be a regular file no larger than 4 KiB");
+		await restrictPrivateFile(this.file);
+		let parsed;
+		try {
+			parsed = JSON.parse(await readFile(this.file, "utf8"));
+		} catch (error) {
+			throw new Error("remote provider state is not valid JSON", { cause: error });
+		}
+		return parseRemoteProviderState(parsed);
+	}
+	async save(state) {
+		const validated = parseRemoteProviderState(state);
+		const directory = dirname(this.file);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			const current = await lstat(this.file);
+			if (!current.isFile() || current.isSymbolicLink()) throw new Error("remote provider state target must remain a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await rename(temporary, this.file);
+			await restrictPrivateFile(this.file);
+		} catch (error) {
+			await rm(temporary, { force: true });
+			throw error;
+		}
+	}
+};
+/** Resolve the first-run provider without letting environment values bypass validation. */
+function configuredRemoteProvider(environment) {
+	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
+	if (value !== "tailscale" && value !== "cpolar" && value !== "frp") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, or frp");
+	return value;
+}
+//#endregion
+//#region src/frp.ts
+const START_TIMEOUT_MS$1 = 45e3;
+const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
+const DISCOVERY_RETRY_MS = 1e3;
+const MAX_DISCOVERY_BYTES = 16384;
+const VHOST_PROBE_TIMEOUT_MS = 1500;
+function publicStatus$2(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+async function defaultVerifyConfig(executable, configFile) {
+	await new Promise((resolveRun, reject) => {
+		execFile(executable, [
+			"verify",
+			"-c",
+			configFile
+		], {
+			windowsHide: true,
+			timeout: 3e4,
+			maxBuffer: 65536
+		}, (error) => {
+			if (error === null) resolveRun();
+			else reject(error);
+		});
+	});
+}
+function defaultLaunchClient(executable, configFile) {
+	return spawn(executable, ["-c", configFile], {
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+}
+async function defaultProbeVhostExposure(serverAddress, port) {
+	return new Promise((resolveProbe) => {
+		const socket = connect({
+			host: serverAddress,
+			port
+		});
+		let finished = false;
+		const finish = (exposed) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			socket.destroy();
+			resolveProbe(exposed);
+		};
+		const timer = setTimeout(() => {
+			finish(false);
+		}, VHOST_PROBE_TIMEOUT_MS);
+		timer.unref();
+		socket.once("connect", () => {
+			finish(true);
+		});
+		socket.once("error", () => {
+			finish(false);
+		});
+	});
+}
+async function boundedResponseBytes(response) {
+	if (response.body === null) throw new Error("frp_discovery_invalid");
+	const declaredLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declaredLength) && declaredLength > MAX_DISCOVERY_BYTES) throw new Error("frp_discovery_invalid");
+	const reader = response.body.getReader();
+	const chunks = [];
+	let received = 0;
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		received += result.value.byteLength;
+		if (received > MAX_DISCOVERY_BYTES) {
+			await reader.cancel();
+			throw new Error("frp_discovery_invalid");
+		}
+		chunks.push(result.value);
+	}
+	const bytes = new Uint8Array(received);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
+}
+async function defaultProbeDiscovery(origin, expectedInstanceId, signal) {
+	const requestController = new AbortController();
+	const abort = () => {
+		requestController.abort();
+	};
+	signal.addEventListener("abort", abort, { once: true });
+	const timeout = setTimeout(abort, DISCOVERY_REQUEST_TIMEOUT_MS);
+	timeout.unref();
+	try {
+		const response = await fetch(`${origin}/mobile-access/discovery`, {
+			method: "GET",
+			redirect: "error",
+			cache: "no-store",
+			signal: requestController.signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return false;
+		let value;
+		try {
+			value = JSON.parse(new TextDecoder().decode(await boundedResponseBytes(response)));
+		} catch {
+			throw new Error("frp_discovery_invalid");
+		}
+		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_discovery_invalid");
+		const actual = value.instanceId;
+		if (typeof actual !== "string") throw new Error("frp_discovery_invalid");
+		if (actual !== expectedInstanceId) throw new Error("frp_discovery_mismatch");
+		return true;
+	} finally {
+		clearTimeout(timeout);
+		signal.removeEventListener("abort", abort);
+	}
+}
+/** Owns frpc, its generation-specific configuration, and the remote gateway. */
+var FrpController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	generation = 0;
+	latest = publicStatus$2({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	startupAbort;
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable)) throw new Error("frpc executable path must be absolute");
+		if (!/^[a-f0-9]{64}$/u.test(options.instanceId)) throw new Error("FRP instance ID is invalid");
+	}
+	/** Restore the remembered FRP switch without changing LAN or other providers. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the active FRP-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return publicStatus$2(this.latest);
+	}
+	/** Enable or disable FRP without changing LAN or another provider. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart FRP while retaining its private server settings and devices. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable FRP without deleting its explicitly managed component or settings. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("FRP controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop all FRP resources without changing the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$2(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let executableEntry;
+		try {
+			executableEntry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_component_missing"
+			});
+			return;
+		}
+		if (!executableEntry.isFile() || executableEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_component_invalid"
+			});
+			return;
+		}
+		const settings = this.options.config.settings();
+		if (settings === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "frp_config_missing"
+			});
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin: settings.publicOrigin
+		});
+		let exposed;
+		try {
+			exposed = await (this.options.probeVhostExposure ?? defaultProbeVhostExposure)(settings.serverAddress, FRP_VHOST_HTTP_PORT);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "frp_vhost_probe_failed"
+			});
+			return;
+		}
+		if (exposed) {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "frp_vhost_publicly_reachable"
+			});
+			return;
+		}
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(settings.publicOrigin);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: "gateway_start_failed"
+			});
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		let configFile;
+		try {
+			configFile = await this.options.config.writeRuntimeConfig(gateway.address().port);
+			await (this.options.verifyConfig ?? defaultVerifyConfig)(this.options.executable, configFile);
+		} catch {
+			await this.failGeneration(generation, "frp_config_verify_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
+		let child;
+		try {
+			child = (this.options.launchClient ?? defaultLaunchClient)(this.options.executable, configFile);
+		} catch {
+			await this.failGeneration(generation, "frp_launch_failed");
+			return;
+		}
+		this.child = child;
+		child.stdout.resume();
+		child.stderr.resume();
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "frp_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "frp_stopped" : "frp_exited"));
+		});
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin: settings.publicOrigin
+		});
+		const controller = new AbortController();
+		this.startupAbort = controller;
+		this.waitForDiscovery(generation, settings.publicOrigin, controller.signal);
+	}
+	async waitForDiscovery(generation, origin, signal) {
+		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$1);
+		const probe = this.options.probeDiscovery ?? defaultProbeDiscovery;
+		while (!signal.aborted && Date.now() < deadline) {
+			try {
+				if (await probe(origin, this.options.instanceId, signal)) {
+					await this.enqueue(async () => {
+						if (generation !== this.generation || signal.aborted || !this.enabled) return;
+						this.startupAbort = void 0;
+						this.publish({
+							enabled: true,
+							state: "ready",
+							origin
+						});
+					});
+					return;
+				}
+			} catch (error) {
+				if (signal.aborted) return;
+				if (error instanceof Error && (error.message === "frp_discovery_mismatch" || error.message === "frp_discovery_invalid")) {
+					await this.enqueue(() => this.failGeneration(generation, error.message));
+					return;
+				}
+			}
+			await new Promise((resolveWait) => {
+				let finished = false;
+				const finish = () => {
+					if (finished) return;
+					finished = true;
+					clearTimeout(timer);
+					signal.removeEventListener("abort", finish);
+					resolveWait();
+				};
+				const timer = setTimeout(finish, this.options.retryIntervalMs ?? DISCOVERY_RETRY_MS);
+				timer.unref();
+				signal.addEventListener("abort", finish, { once: true });
+			});
+		}
+		if (!signal.aborted) await this.enqueue(() => this.failGeneration(generation, "frp_start_timeout"));
+	}
+	async failGeneration(generation, code) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		this.startupAbort?.abort();
+		this.startupAbort = void 0;
+		const child = this.child;
+		this.child = void 0;
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await settleRemoteResources([
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close(),
+			() => rm(this.options.config.runtimeConfigFile, { force: true })
+		], "FRP resource cleanup failed");
+	}
+};
+//#endregion
 //#region src/diagnostics.ts
 const execFile$2 = promisify(execFile);
 const REMOTE_ERROR_GUIDANCE = Object.freeze({
@@ -4180,6 +5367,18 @@ const REMOTE_ERROR_GUIDANCE = Object.freeze({
 	cpolar_start_timeout: "检查网络后点击“重新连接”。",
 	cpolar_stopped: "点击“重新连接”。",
 	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	frp_component_missing: "先安装 FRP 官方组件。",
+	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
+	frp_config_missing: "先保存自建 FRP 连接配置。",
+	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
+	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
+	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
+	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
+	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
+	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
+	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
+	frp_stopped: "点击“重新连接”。",
+	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
 	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
 });
 function check(id, status, reason, label, detail, action, facts) {
@@ -4257,7 +5456,7 @@ function defaultFirewallProbe(platform = process.platform) {
 function remoteDiagnosticTimeoutMs(origin) {
 	const hostname = new URL(origin).hostname.toLowerCase();
 	if (hostname.endsWith(".ts.net") || hostname.includes(".cpolar.")) return 1e4;
-	return 5e3;
+	return 1e4;
 }
 async function defaultRemoteProbe(origin) {
 	if (origin === void 0) return { state: "not-applicable" };
@@ -4748,28 +5947,12 @@ var FunnelController = class {
 		this.clearStartTimer();
 		const child = this.child;
 		this.child = void 0;
-		child?.stdin.end();
-		if (child !== void 0 && child.exitCode === null) {
-			child.kill("SIGTERM");
-			await new Promise((resolveClose) => {
-				let completed = false;
-				const finish = () => {
-					if (completed) return;
-					completed = true;
-					clearTimeout(timer);
-					resolveClose();
-				};
-				const timer = setTimeout(() => {
-					if (child.exitCode === null) child.kill("SIGKILL");
-					finish();
-				}, 1500);
-				timer.unref();
-				child.once("close", finish);
-			});
-		}
 		const gateway = this.gatewayValue;
 		this.gatewayValue = void 0;
-		await gateway?.close();
+		await settleRemoteResources([async () => {
+			child?.stdin.end();
+			if (child !== void 0 && child.exitCode === null) await terminateRemoteProcess(child);
+		}, () => gateway?.close()], "Funnel resource cleanup failed");
 	}
 	clearStartTimer() {
 		if (this.startTimer === void 0) return;
@@ -5140,30 +6323,15 @@ var CpolarController = class {
 		this.startupTimer = void 0;
 		const reservation = this.reservation;
 		this.reservation = void 0;
-		await reservation?.release();
 		const child = this.child;
 		this.child = void 0;
-		if (child !== void 0 && child.exitCode === null) {
-			child.kill("SIGTERM");
-			await new Promise((resolveClose) => {
-				let completed = false;
-				const finish = () => {
-					if (completed) return;
-					completed = true;
-					clearTimeout(timer);
-					resolveClose();
-				};
-				const timer = setTimeout(() => {
-					if (child.exitCode === null) child.kill("SIGKILL");
-					finish();
-				}, 1500);
-				timer.unref();
-				child.once("close", finish);
-			});
-		}
 		const gateway = this.gatewayValue;
 		this.gatewayValue = void 0;
-		await gateway?.close();
+		await settleRemoteResources([
+			() => reservation?.release(),
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close()
+		], "cpolar resource cleanup failed");
 	}
 };
 //#endregion
@@ -5435,80 +6603,376 @@ var CpolarComponentManager = class {
 	}
 };
 //#endregion
-//#region src/remote.ts
-/** Validate the provider selection loaded across the filesystem boundary. */
-function parseRemoteProviderState(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
-	const record = value;
-	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+//#region src/release-update.ts
+const PACKAGE_NAME = "dsh-mobile";
+const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
+const GITHUB_LATEST_URL = "https://github.com/saya-ch/dsh-mobile/releases/latest";
+const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
+const STATUS_CACHE_MS = 6e5;
+const REQUEST_TIMEOUT_MS = 8e3;
+const UPDATE_TIMEOUT_MS = 12e4;
+const UPDATE_TERMINATION_GRACE_MS = 1500;
+const NUMERIC_VERSION_IDENTIFIER = "(?:0|[1-9]\\d*)";
+const WILDCARD_VERSION_IDENTIFIER = "(?:[xX*])";
+const RANGE_VERSION = `(?:${`${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?`}|${`(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}))?))?)`})`;
+const COMPARATOR = new RegExp(`^(?:<=|>=|<|>|=|~|\\^)?${RANGE_VERSION}$`, "u");
+const HYPHEN_RANGE = new RegExp(`^${RANGE_VERSION} +[-] +${RANGE_VERSION}$`, "u");
+const DIST_TAG = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
+function parseSemver(value) {
+	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
+	if (match === null) return void 0;
+	const core = [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+	if (core.some((part) => !Number.isSafeInteger(part))) return void 0;
+	const prerelease = match[4] === void 0 ? [] : match[4].split(".").map((part) => /^\d+$/u.test(part) ? Number(part) : part);
+	if (prerelease.some((part) => typeof part === "number" && !Number.isSafeInteger(part))) return void 0;
 	return Object.freeze({
-		version: 1,
-		provider: record.provider
+		core,
+		prerelease: Object.freeze(prerelease)
 	});
 }
-/** Atomic selection store whose absent-file state uses the configured default. */
-var JsonRemoteProviderStore = class {
-	file;
-	defaultProvider;
-	constructor(file, defaultProvider) {
-		this.file = file;
-		this.defaultProvider = defaultProvider;
+/** Compare two strict SemVer strings, including prerelease precedence. */
+function comparePluginVersions(left, right) {
+	const a = parseSemver(left);
+	const b = parseSemver(right);
+	if (a === void 0 || b === void 0) return void 0;
+	for (let index = 0; index < a.core.length; index += 1) {
+		const difference = a.core[index] - b.core[index];
+		if (difference !== 0) return Math.sign(difference);
+	}
+	if (a.prerelease.length === 0 || b.prerelease.length === 0) return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+	const length = Math.max(a.prerelease.length, b.prerelease.length);
+	for (let index = 0; index < length; index += 1) {
+		const leftPart = a.prerelease[index];
+		const rightPart = b.prerelease[index];
+		if (leftPart === void 0 || rightPart === void 0) return leftPart === void 0 ? -1 : 1;
+		if (leftPart === rightPart) continue;
+		if (typeof leftPart === "number" && typeof rightPart === "number") return Math.sign(leftPart - rightPart);
+		if (typeof leftPart === "number") return -1;
+		if (typeof rightPart === "number") return 1;
+		return leftPart < rightPart ? -1 : 1;
+	}
+	return 0;
+}
+function isComparatorSet(value) {
+	if (HYPHEN_RANGE.test(value)) return true;
+	const comparators = value.replace(/(<=|>=|<|>|=|~|\^) +/gu, "$1").split(/ +/u);
+	return comparators.length > 0 && comparators.every((comparator) => COMPARATOR.test(comparator));
+}
+function isNpmVersionRange(value) {
+	if (!/^[0-9xX*<>=~^|.+\- ]+$/u.test(value)) return false;
+	const alternatives = value.split(/ *\|\| */u);
+	return alternatives.length > 0 && alternatives.every((alternative) => alternative !== "" && isComparatorSet(alternative));
+}
+/** Return whether pnpm may safely replace this profile dependency from an npm version, range, or tag. */
+function isRegistryPluginSpec(value) {
+	if (typeof value !== "string" || value.trim() !== value || value === "" || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+	if (/\.(?:tgz|tar(?:\.gz)?)$/iu.test(value)) return false;
+	return parseSemver(value) !== void 0 || isNpmVersionRange(value) || DIST_TAG.test(value);
+}
+/** Resolve the DSH profile named by the current launcher arguments. */
+function launchedProfileName(argv) {
+	for (let index = 0; index < argv.length; index += 1) {
+		if (argv[index] === "--profile") {
+			const candidate = argv[index + 1];
+			if (candidate !== void 0 && /^[\w.-]+$/u.test(candidate)) return candidate;
+		}
+		const match = /^--profile=([\w.-]+)$/u.exec(argv[index] ?? "");
+		if (match?.[1] !== void 0) return match[1];
 	}
-	async load() {
-		let stat;
-		try {
-			stat = await lstat(this.file);
-		} catch (error) {
-			if (error.code === "ENOENT") return Object.freeze({
-				version: 1,
-				provider: this.defaultProvider
+	return "web";
+}
+async function profileDependencySpec(profileDirectory) {
+	try {
+		const value = JSON.parse(await readFile(join(profileDirectory, "package.json"), "utf8")).dependencies?.[PACKAGE_NAME];
+		return typeof value === "string" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+async function fetchNpmVersion(fetcher) {
+	const response = await fetcher(NPM_LATEST_URL, {
+		headers: {
+			accept: "application/json",
+			"user-agent": "dsh-mobile-release-check"
+		},
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) return void 0;
+	const payload = await response.json();
+	return typeof payload.version === "string" && parseSemver(payload.version) !== void 0 ? payload.version : void 0;
+}
+function githubReleaseVersion(location, responseUrl) {
+	let url;
+	try {
+		url = new URL(location ?? responseUrl, GITHUB_LATEST_URL);
+	} catch {
+		return;
+	}
+	if (url.origin !== "https://github.com" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	if (!url.pathname.startsWith("/saya-ch/dsh-mobile/releases/tag/v")) return void 0;
+	let version;
+	try {
+		version = decodeURIComponent(url.pathname.slice(34));
+	} catch {
+		return;
+	}
+	return parseSemver(version) === void 0 ? void 0 : version;
+}
+function androidReleaseDownloadUrl(version) {
+	if (version === void 0) return GITHUB_RELEASES_URL;
+	const tag = `v${version}`;
+	return `https://github.com/saya-ch/dsh-mobile/releases/download/${encodeURIComponent(tag)}/dsh-mobile-android-${encodeURIComponent(tag)}.apk`;
+}
+async function fetchAndroidVersion(fetcher) {
+	const response = await fetcher(GITHUB_LATEST_URL, {
+		method: "GET",
+		redirect: "manual",
+		headers: {
+			accept: "text/html",
+			"user-agent": "dsh-mobile-release-check"
+		},
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	return githubReleaseVersion(response.headers.get("location"), response.url);
+}
+async function readProfileInstalledVersion(profileDirectory) {
+	try {
+		const manifestPath = createRequire(join(profileDirectory, "package.json")).resolve(`${PACKAGE_NAME}/package.json`);
+		const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+		return typeof manifest.version === "string" ? manifest.version : void 0;
+	} catch {
+		return;
+	}
+}
+function childCompletion(child) {
+	return new Promise((resolveCompletion, rejectCompletion) => {
+		child.once("error", rejectCompletion);
+		child.once("close", (code, signal) => {
+			resolveCompletion({
+				code,
+				signal
 			});
-			throw error;
+		});
+	});
+}
+function createDeadline(timeoutMs) {
+	let timer;
+	return {
+		promise: new Promise((resolveTimeout) => {
+			timer = setTimeout(resolveTimeout, timeoutMs);
+			timer.unref();
+		}),
+		cancel: () => {
+			if (timer !== void 0) clearTimeout(timer);
+			timer = void 0;
 		}
-		if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4096) throw new Error("remote provider state must be a regular file no larger than 4 KiB");
-		await restrictPrivateFile(this.file);
-		let parsed;
+	};
+}
+async function taskkillProcessTree(pid) {
+	if ((await childCompletion(spawn("taskkill.exe", [
+		"/PID",
+		String(pid),
+		"/T",
+		"/F"
+	], {
+		shell: false,
+		windowsHide: true,
+		stdio: "ignore"
+	}))).code !== 0) throw new Error("plugin_update_tree_termination_failed");
+}
+async function completionWithin(completion, timeoutMs) {
+	let timer;
+	try {
+		return await Promise.race([completion.then(() => true, () => true), new Promise((resolveTimeout) => {
+			timer = setTimeout(() => {
+				resolveTimeout(false);
+			}, timeoutMs);
+			timer.unref();
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+function processMissing(error) {
+	return error.code === "ESRCH";
+}
+async function terminateProcessTree(child, completion, platform) {
+	if (child.exitCode !== null || child.signalCode !== null) return;
+	const pid = child.pid;
+	if (pid === void 0) {
+		child.kill("SIGKILL");
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		return;
+	}
+	if (platform === "win32") {
 		try {
-			parsed = JSON.parse(await readFile(this.file, "utf8"));
+			await taskkillProcessTree(pid);
 		} catch (error) {
-			throw new Error("remote provider state is not valid JSON", { cause: error });
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new AggregateError([error, /* @__PURE__ */ new Error("plugin_update_tree_termination_timeout")], "plugin update tree termination failed");
+			throw error;
 		}
-		return parseRemoteProviderState(parsed);
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) {
+			if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL");
+			if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		}
+		return;
 	}
-	async save(state) {
-		const validated = parseRemoteProviderState(state);
-		const directory = dirname(this.file);
-		await mkdir(directory, {
-			recursive: true,
-			mode: 448
+	try {
+		process.kill(-pid, "SIGTERM");
+	} catch (error) {
+		if (!processMissing(error)) throw error;
+		if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+		return;
+	}
+	if (await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) return;
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch (error) {
+		if (!processMissing(error)) throw error;
+	}
+	if (!await completionWithin(completion, UPDATE_TERMINATION_GRACE_MS)) throw new Error("plugin_update_tree_termination_timeout");
+}
+function startUpdateProcess(request) {
+	const child = spawn(request.command, [...request.args], {
+		cwd: request.cwd,
+		detached: request.detached,
+		shell: request.shell,
+		windowsHide: true,
+		stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		]
+	});
+	const completion = childCompletion(child);
+	return {
+		completion,
+		...child.stderr === null ? {} : { stderr: child.stderr },
+		terminateTree: async () => terminateProcessTree(child, completion, request.platform)
+	};
+}
+function updateFailure(cause) {
+	return cause === void 0 ? /* @__PURE__ */ new Error("plugin_update_failed") : new Error("plugin_update_failed", { cause });
+}
+async function runPnpmUpdate(profileDirectory, version, runtime = {}) {
+	if (parseSemver(version) === void 0) throw new Error("plugin_update_unavailable");
+	const platform = runtime.platform ?? process.platform;
+	const packageSpec = `${PACKAGE_NAME}@${version}`;
+	const managed = (runtime.start ?? startUpdateProcess)({
+		command: platform === "win32" ? runtime.windowsCommandInterpreter ?? process.env.ComSpec ?? "cmd.exe" : "pnpm",
+		args: platform === "win32" ? [
+			"/d",
+			"/s",
+			"/c",
+			"pnpm.cmd",
+			"add",
+			packageSpec
+		] : ["add", packageSpec],
+		cwd: profileDirectory,
+		detached: platform !== "win32",
+		platform,
+		shell: false
+	});
+	let diagnostics = "";
+	managed.stderr?.on("data", (chunk) => {
+		if (diagnostics.length < 4096) diagnostics += Buffer.from(chunk).toString("utf8").slice(0, 4096 - diagnostics.length);
+	});
+	const completion = managed.completion.then((result) => ({
+		kind: "exit",
+		result
+	}), (error) => ({
+		kind: "error",
+		error
+	}));
+	const deadline = (runtime.deadline ?? createDeadline)(runtime.timeoutMs ?? UPDATE_TIMEOUT_MS);
+	const first = await Promise.race([completion, deadline.promise.then(() => ({ kind: "timeout" }))]);
+	deadline.cancel();
+	if (first.kind === "error") throw updateFailure(first.error);
+	if (first.kind === "exit") {
+		if (first.result.code === 0) return;
+		const detail = diagnostics.trim() || `pnpm exited with ${first.result.signal ?? String(first.result.code)}`;
+		throw updateFailure(new Error(detail));
+	}
+	let terminationError;
+	try {
+		await managed.terminateTree();
+	} catch (error) {
+		terminationError = error;
+	}
+	if (terminationError !== void 0) throw updateFailure(terminationError);
+	const stopped = await completion;
+	if (stopped.kind === "error") throw updateFailure(stopped.error);
+	throw updateFailure(/* @__PURE__ */ new Error("plugin update timed out"));
+}
+/** Cached npm/GitHub release lookup and guarded profile-local package update. */
+var PluginReleaseManager = class {
+	profileDirectory;
+	installedVersion;
+	fetcher;
+	runner;
+	installedVersionReader;
+	now;
+	cache;
+	activeUpdate;
+	constructor(options) {
+		this.profileDirectory = options.profileDirectory;
+		this.installedVersion = options.installedVersion ?? DSH_MOBILE_VERSION;
+		this.fetcher = options.fetch ?? globalThis.fetch;
+		this.runner = options.runUpdate ?? ((profileDirectory, version) => runPnpmUpdate(profileDirectory, version, options.updateProcess));
+		this.installedVersionReader = options.readInstalledVersion ?? readProfileInstalledVersion;
+		this.now = options.now ?? Date.now;
+	}
+	/** Read cached release metadata and suppress external lookup failures. */
+	async status(force = false) {
+		if (!force && this.cache !== void 0 && this.cache.expiresAt > this.now()) return this.cache.status;
+		const updateSupported = isRegistryPluginSpec(await profileDependencySpec(this.profileDirectory));
+		const [npmResult, androidResult] = await Promise.allSettled([fetchNpmVersion(this.fetcher), fetchAndroidVersion(this.fetcher)]);
+		const latestVersion = npmResult.status === "fulfilled" ? npmResult.value : void 0;
+		const androidVersion = androidResult.status === "fulfilled" ? androidResult.value : void 0;
+		const comparison = latestVersion === void 0 ? void 0 : comparePluginVersions(latestVersion, this.installedVersion);
+		const status = Object.freeze({
+			installedVersion: this.installedVersion,
+			...latestVersion === void 0 ? {} : { latestVersion },
+			updateAvailable: updateSupported && comparison === 1,
+			updateSupported,
+			...androidVersion === void 0 ? {} : { androidVersion },
+			androidDownloadUrl: androidReleaseDownloadUrl(androidVersion)
 		});
+		this.cache = {
+			expiresAt: this.now() + STATUS_CACHE_MS,
+			status
+		};
+		return status;
+	}
+	/** Install the latest npm release into the active profile, then require a DSH restart. */
+	async update() {
+		if (this.activeUpdate !== void 0) return this.activeUpdate;
+		this.activeUpdate = this.updateOnce();
 		try {
-			const current = await lstat(this.file);
-			if (!current.isFile() || current.isSymbolicLink()) throw new Error("remote provider state target must remain a regular file");
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
-		}
-		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
-		try {
-			await writeFile(temporary, `${JSON.stringify(validated)}\n`, {
-				encoding: "utf8",
-				flag: "wx",
-				mode: 384
-			});
-			await rename(temporary, this.file);
-			await restrictPrivateFile(this.file);
-		} catch (error) {
-			await rm(temporary, { force: true });
-			throw error;
+			return await this.activeUpdate;
+		} finally {
+			this.activeUpdate = void 0;
 		}
 	}
+	async updateOnce() {
+		const status = await this.status(true);
+		if (!status.updateSupported) throw new Error("plugin_update_unsupported");
+		if (!status.updateAvailable || status.latestVersion === void 0) throw new Error("plugin_update_unavailable");
+		await this.runner(this.profileDirectory, status.latestVersion);
+		const installed = await this.installedVersionReader(this.profileDirectory);
+		if (installed !== status.latestVersion) throw new Error("plugin_update_failed");
+		this.cache = void 0;
+		return Object.freeze({
+			installedVersion: installed,
+			restartRequired: true
+		});
+	}
 };
-/** Resolve the first-run provider without letting environment values bypass validation. */
-function configuredRemoteProvider(environment) {
-	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
-	if (value !== "tailscale" && value !== "cpolar") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale or cpolar");
-	return value;
-}
 promisify(execFile);
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
@@ -5721,6 +7185,17 @@ const inject = [
 	"commands",
 	"connection"
 ];
+/** Run cleanup steps in ownership order and report every failure after all steps settle. */
+async function settleCleanupSteps(steps) {
+	const errors = [];
+	for (const step of steps) try {
+		await step();
+	} catch (error) {
+		errors.push(error);
+	}
+	if (errors.length === 1 && errors[0] instanceof Error) throw errors[0];
+	if (errors.length > 0) throw new AggregateError(errors, "DSH Mobile cleanup failed");
+}
 function upstreamAuthenticatedUrl(ctx, upstreamOrigin) {
 	const connection = ctx.connection;
 	return typeof connection?.authenticatedUrl === "function" ? connection.authenticatedUrl(upstreamOrigin.origin) : void 0;
@@ -5738,6 +7213,16 @@ function mapAdminError(error) {
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
 	if (error instanceof Error && error.message === "cpolar_authtoken_invalid") return new HttpError(400, "cpolar_authtoken_invalid");
 	if (error instanceof Error && error.message.startsWith("cpolar_")) return new HttpError(409, error.message);
+	if (error instanceof Error && [
+		"frp_server_address_invalid",
+		"frp_server_port_invalid",
+		"frp_token_invalid",
+		"frp_public_origin_invalid",
+		"frp_settings_invalid"
+	].includes(error.message)) return new HttpError(400, error.message);
+	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message === "plugin_update_failed") return new HttpError(500, error.message);
+	if (error instanceof Error && error.message.startsWith("plugin_update_")) return new HttpError(409, error.message);
 	return new HttpError(500, "internal_error");
 }
 const SETUP_KEYS = /* @__PURE__ */ new Set([
@@ -5829,7 +7314,7 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		discovery: false
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent) {
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, frpComponent, frpConfiguration) {
 	return {
 		provider,
 		running: status.enabled,
@@ -5850,6 +7335,13 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				running: providerStatuses.cpolar.enabled,
 				state: providerStatuses.cpolar.state,
 				component: cpolarComponent
+			},
+			frp: {
+				bundled: false,
+				running: providerStatuses.frp.enabled,
+				state: providerStatuses.frp.state,
+				component: frpComponent,
+				configuration: frpConfiguration
 			}
 		}
 	};
@@ -5865,10 +7357,17 @@ async function apply(ctx, config) {
 	const instanceId = await stableInstanceId(loaded, template);
 	const stateDirectory = dirname(template.stateFile);
 	const remoteDirectory = join(stateDirectory, "remote");
+	const configuredDshHome = process.env.DSH_HOME?.trim();
+	const dshHome = configuredDshHome === void 0 || configuredDshHome === "" ? dirname(stateDirectory) : resolve(configuredDshHome);
+	const releaseManager = new PluginReleaseManager({ profileDirectory: join(dshHome, "profiles", launchedProfileName(process.argv.slice(2))) });
 	const remoteProviderStore = new JsonRemoteProviderStore(join(remoteDirectory, "provider.json"), configuredRemoteProvider(process.env));
-	let remoteProvider = (await remoteProviderStore.load()).provider;
+	const initialRemoteProvider = (await remoteProviderStore.load()).provider;
 	const cpolarComponent = new CpolarComponentManager({ stateDirectory });
 	await cpolarComponent.initialize();
+	const frpComponent = new FrpComponentManager({ stateDirectory });
+	await frpComponent.initialize();
+	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"));
+	await frpConfig.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
 		id: "computer-images",
@@ -5930,7 +7429,7 @@ async function apply(ctx, config) {
 	const lanController = new MobileAccessGatewayController(new JsonMobileAccessControlStore(parseControlFile(config.controlFile), config.initiallyEnabled), startRuntime);
 	const remoteDeviceFile = join(remoteDirectory, "devices.json");
 	const legacyCpolarDeviceFile = join(remoteDirectory, "cpolar", "devices.json");
-	if (remoteProvider === "cpolar") try {
+	if (initialRemoteProvider === "cpolar") try {
 		await lstat(remoteDeviceFile);
 	} catch (error) {
 		if (error.code !== "ENOENT") throw error;
@@ -5948,6 +7447,7 @@ async function apply(ctx, config) {
 	};
 	const tailscaleStore = new JsonMobileAccessControlStore(join(remoteDirectory, "control.json"), false);
 	const cpolarStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cpolar", "control.json"), false);
+	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -5962,29 +7462,22 @@ async function apply(ctx, config) {
 			configFile: cpolarComponent.configFile,
 			region: "cn",
 			createGateway: createRemoteGateway
+		}),
+		frp: new FrpController({
+			store: frpStore,
+			executable: frpComponent.executable,
+			config: frpConfig,
+			instanceId,
+			createGateway: createRemoteGateway
 		})
 	};
-	const remoteController = () => remoteControllers[remoteProvider];
-	const remotePayload = () => remoteControlPayload(remoteProvider, remoteController().status(), remoteController().gateway(), {
+	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
+	const remoteController = () => remoteProviders.controller();
+	const remotePayload = () => remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
 		tailscale: remoteControllers.tailscale.status(),
-		cpolar: remoteControllers.cpolar.status()
-	}, cpolarComponent.status());
-	const selectRemoteProvider = async (provider) => {
-		if (provider === remoteProvider) return;
-		const previous = remoteControllers[remoteProvider];
-		const restore = previous.status().enabled;
-		if (restore) await previous.setEnabled(false);
-		try {
-			await remoteProviderStore.save({
-				version: 1,
-				provider
-			});
-			remoteProvider = provider;
-		} catch (error) {
-			if (restore) await previous.setEnabled(true);
-			throw error;
-		}
-	};
+		cpolar: remoteControllers.cpolar.status(),
+		frp: remoteControllers.frp.status()
+	}, cpolarComponent.status(), frpComponent.status(), frpConfig.status());
 	const lanPayload = () => ({
 		running: lanController.isRunning(),
 		origin: lanGateway?.address().origin,
@@ -6015,7 +7508,7 @@ async function apply(ctx, config) {
 				...networkError === void 0 ? {} : { networkError }
 			},
 			remote: {
-				provider: remoteProvider,
+				provider: remoteProviders.selected,
 				running: remote.enabled,
 				state: remote.state,
 				...remote.origin === void 0 ? {} : { origin: remote.origin },
@@ -6040,6 +7533,15 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await diagnosticsPayload(), false);
 					return;
 				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/release`) {
+					sendJson(response, 200, await releaseManager.status(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/release/update`) {
+					await readJsonObject(request, 4096);
+					sendJson(response, 200, await releaseManager.update(), false);
+					return;
+				}
 				if (request.method === "POST" && lanControl) {
 					const body = await readJsonObject(request, 4096);
 					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
@@ -6053,47 +7555,75 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
 					const body = await readJsonObject(request, 4096);
-					if (body.provider !== "tailscale" && body.provider !== "cpolar") throw new HttpError(400, "bad_request");
-					await selectRemoteProvider(body.provider);
+					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "frp") throw new HttpError(400, "bad_request");
+					await remoteProviders.select(body.provider);
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await cpolarComponent.install();
+					await remoteProviders.mutate(async () => cpolarComponent.install());
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/configure`) {
 					const body = await readJsonObject(request, 4096);
-					await cpolarComponent.configure(body.authtoken);
+					await remoteProviders.mutate(async () => cpolarComponent.configure(body.authtoken));
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/purge`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await remoteControllers.cpolar.setEnabled(false);
-					await cpolarComponent.purge();
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cpolar.setEnabled(false);
+						await cpolarComponent.purge();
+					});
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
-				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/control`) {
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => frpComponent.install());
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/configure`) {
 					const body = await readJsonObject(request, 4096);
-					if (typeof body.running !== "boolean") throw new HttpError(400, "bad_request");
-					await remoteController().setEnabled(body.running);
+					await remoteProviders.mutate(async () => {
+						await frpConfig.configure(body);
+						if (remoteControllers.frp.status().enabled) await remoteControllers.frp.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.frp.setEnabled(false);
+						await Promise.all([frpComponent.purge(), frpConfig.purge()]);
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/control`) {
+					const running = (await readJsonObject(request, 4096)).running;
+					if (typeof running !== "boolean") throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async (controller) => controller.setEnabled(running));
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reconnect`) {
 					await readJsonObject(request, 4096);
-					await remoteController().reconnect();
+					await remoteProviders.mutate(async (controller) => controller.reconnect());
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/reset`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await remoteController().reset();
-					await rm(remoteDeviceFile, { force: true });
+					await remoteProviders.mutate(async (controller) => {
+						await controller.reset();
+						await rm(remoteDeviceFile, { force: true });
+					});
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
@@ -6152,36 +7682,54 @@ async function apply(ctx, config) {
 		try {
 			await mobileAccess.startLocal(template.extensionsDir, ctx);
 			await lanController.initialize();
-			if (remoteProvider === "tailscale") await cpolarStore.save({
-				version: 1,
-				enabled: false
-			});
-			else await tailscaleStore.save({
+			const stores = {
+				tailscale: tailscaleStore,
+				cpolar: cpolarStore,
+				frp: frpStore
+			};
+			await Promise.all(Object.keys(stores).filter((provider) => provider !== remoteProviders.selected).map((provider) => stores[provider].save({
 				version: 1,
 				enabled: false
-			});
-			await remoteControllers.tailscale.initialize();
-			await remoteControllers.cpolar.initialize();
+			})));
+			for (const provider of [
+				"tailscale",
+				"cpolar",
+				"frp"
+			]) await remoteControllers[provider].initialize();
 		} catch (error) {
-			unregister();
-			disposeMobileCommand();
-			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
-			await lanController.close();
-			await mobileAccess.stopLocal();
-			unregisterBuiltin();
+			try {
+				await settleCleanupSteps([
+					unregister,
+					disposeMobileCommand,
+					async () => {
+						const failures = (await Promise.allSettled(Object.values(remoteControllers).map((controller) => controller.close()))).filter((result) => result.status === "rejected").map((result) => result.reason);
+						if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
+					},
+					() => lanController.close(),
+					() => mobileAccess.stopLocal(),
+					unregisterBuiltin
+				]);
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "DSH Mobile initialization and cleanup failed");
+			}
 			throw error;
 		}
 		return async () => {
-			unregister();
-			disposeMobileCommand();
-			await Promise.all([remoteControllers.tailscale.close(), remoteControllers.cpolar.close()]);
-			await lanController.close();
-			await mobileAccess.stopLocal();
-			unregisterBuiltin();
+			await settleCleanupSteps([
+				unregister,
+				disposeMobileCommand,
+				async () => {
+					const failures = (await Promise.allSettled(Object.values(remoteControllers).map((controller) => controller.close()))).filter((result) => result.status === "rejected").map((result) => result.reason);
+					if (failures.length > 0) throw new AggregateError(failures, "remote provider cleanup failed");
+				},
+				() => lanController.close(),
+				() => mobileAccess.stopLocal(),
+				unregisterBuiltin
+			]);
 		};
-	}, "dsh-mobile: independent LAN and selectable remote access with /mobile command");
+	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, DEVICE_COOKIE, EXTENSION_LIMITS, JsonDeviceStore, JsonMobileAccessControlStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, createMobileAccessService, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseGatewayConfig, parseMobileAccessControlState, resolveAuthority, rewriteMobileIndex };
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, SUPPORTED_DSH_VERSIONS, WS_PATHS, addressAllowed, apply, assertExtensionId, assertSupportedDshVersion, configuredRemoteProvider, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
 
 //# sourceMappingURL=index.mjs.map