dsh-mobile 0.3.7 → 0.3.9

package/lib/index.mjs

@@ -7,7 +7,7 @@ import { connect, createServer, isIP } from "node:net";
 import { chmod, copyFile, lstat, mkdir, mkdtemp, opendir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
-import { homedir, hostname, networkInterfaces } from "node:os";
+import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
 import { createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2 } from "node:https";
 import { Transform, finished } from "node:stream";
@@ -16,9 +16,10 @@ import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
-import { Service } from "@deepseek-ai/cordis";
+import { Logger, Service } from "@deepseek-ai/cordis";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { lookup } from "node:dns/promises";
+import { createWriteStream } from "node:fs";
 import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
@@ -463,6 +464,59 @@ function isLoopbackAddress(address) {
 		return false;
 	}
 }
+/**
+* IPv4 ranges that are never a public VPS endpoint (IANA special-purpose,
+* private, shared, loopback, link-local, documentation, benchmark, multicast,
+* and reserved space). Kept in sync with Android `RemoteHostPolicy`.
+*/
+const NON_ROUTABLE_IPV4_RANGES = Object.freeze([
+	[0n, 8],
+	[167772160n, 8],
+	[1681915904n, 10],
+	[2130706432n, 8],
+	[2851995648n, 16],
+	[2886729728n, 12],
+	[3221225472n, 24],
+	[3221225984n, 24],
+	[3223307264n, 24],
+	[3224682752n, 24],
+	[3227017984n, 24],
+	[3232235520n, 16],
+	[3232706560n, 24],
+	[3323068416n, 15],
+	[3325256704n, 24],
+	[3405803776n, 24],
+	[3758096384n, 4],
+	[4026531840n, 4]
+]);
+function parseStrictIpv4Octets(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	const octets = [];
+	for (const part of parts) {
+		if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part)) return void 0;
+		const octet = Number(part);
+		if (octet > 255) return void 0;
+		octets.push(octet);
+	}
+	return octets;
+}
+/**
+* Whether a dotted-quad IPv4 literal is globally routable and therefore usable
+* as a public VPS / remote HTTPS endpoint. Rejects documentation addresses such
+* as 203.0.113.10 alongside private, shared, and reserved space.
+*/
+function isGloballyRoutableIpv4(address) {
+	const octets = parseStrictIpv4Octets(address);
+	if (octets === void 0) return false;
+	const value = BigInt(octets[0]) << 24n | BigInt(octets[1]) << 16n | BigInt(octets[2]) << 8n | BigInt(octets[3]);
+	return !NON_ROUTABLE_IPV4_RANGES.some(([network, prefix]) => {
+		if (prefix === 0) return true;
+		const hostBits = BigInt(32 - prefix);
+		const mask = (1n << 32n) - 1n ^ (1n << hostBits) - 1n;
+		return (value & mask) === network;
+	});
+}
 /** Parse a bare host or host:port authority without accepting URL components. */
 function parseAuthority(source) {
 	if (source.trim() !== source || source.length === 0 || /[/?#@\\]/u.test(source)) throw new Error(`invalid public authority ${JSON.stringify(source)}`);
@@ -529,14 +583,21 @@ var RequestTrustPolicy = class {
 	canonicalOrigin(header) {
 		if (header === void 0) return void 0;
 		let normalized;
-		try {
-			const parsed = new URL(header);
-			if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || parsed.username !== "" || parsed.password !== "") return;
-			normalized = parsed.origin.toLowerCase();
-		} catch {
-			return;
+		for (const part of header.split(",")) {
+			const trimmed = part.trim();
+			if (trimmed === "undefined") continue;
+			let candidate;
+			try {
+				const parsed = new URL(trimmed);
+				if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "" || parsed.username !== "" || parsed.password !== "") return;
+				candidate = parsed.origin.toLowerCase();
+			} catch {
+				return;
+			}
+			if (!this.origins.has(candidate) || normalized !== void 0) return void 0;
+			normalized = candidate;
 		}
-		return this.origins.has(normalized) ? normalized : void 0;
+		return normalized;
 	}
 };
 //#endregion
@@ -607,7 +668,7 @@ function parseUpstream(value) {
 	if (url.protocol !== "http:" || !isLoopbackAddress(url.hostname) || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.port === "") throw new Error("upstreamOrigin must be an HTTP loopback origin with an explicit port and no path or credentials");
 	return url;
 }
-function parsePublicOrigin(value) {
+function parsePublicOrigin$1(value) {
 	if (value === void 0) return void 0;
 	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error("publicOrigin must be an HTTPS origin");
 	let url;
@@ -640,7 +701,7 @@ function parseTls(value, listenHost) {
 function parseGatewayConfig(raw) {
 	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("mobile-access config must be an object");
 	const value = raw;
-	const publicOrigin = parsePublicOrigin(value.publicOrigin);
+	const publicOrigin = parsePublicOrigin$1(value.publicOrigin);
 	if (publicOrigin !== void 0 && value.listenPort !== void 0) throw new Error("publicOrigin cannot be combined with listenPort");
 	if (publicOrigin !== void 0 && value.publicAuthorities !== void 0) throw new Error("publicOrigin cannot be combined with publicAuthorities");
 	const listenHost = value.listenHost ?? (publicOrigin === void 0 ? "127.0.0.1" : "0.0.0.0");
@@ -1128,8 +1189,8 @@ function assertExternalTrust(request, policy, requireOrigin) {
 	const origin = request.headers.origin;
 	if (origin !== void 0 && !policy.acceptsOrigin(origin)) throw new HttpError(403, "forbidden");
 	const site = request.headers["sec-fetch-site"];
-	if (site !== void 0 && site !== "same-origin" && site !== "none") throw new HttpError(403, "forbidden");
-	if (requireOrigin && (!policy.acceptsOrigin(origin) || site !== "same-origin")) throw new HttpError(403, "forbidden");
+	if (site !== void 0 && site !== "same-origin" && site !== "same-site" && site !== "cross-site" && site !== "none") throw new HttpError(403, "forbidden");
+	if (requireOrigin && !policy.acceptsOrigin(origin)) throw new HttpError(403, "forbidden");
 }
 function localAuthority(header) {
 	if (header === void 0 || /[/?#@\\]/u.test(header)) return void 0;
@@ -4195,7 +4256,7 @@ var MemoryDeviceStore = class {
 };
 //#endregion
 //#region src/frp-component.ts
-const FRP_VERSION = "0.70.1";
+const FRP_VERSION$1 = "0.70.1";
 const MAX_ARCHIVE_ENTRIES = 128;
 const MAX_ARCHIVE_LIST_BYTES = 262144;
 /** Pinned official FRP release metadata for supported desktop targets. */
@@ -4207,7 +4268,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc.exe",
 		downloadBytes: 13924309,
 		downloadSha256: "531f3cd3cc41c0b4f077b54fe6b7dd83c0ff727e7f0bf412a4c78fa279165de5",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_amd64.zip`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_windows_amd64.zip`
 	},
 	{
 		platform: "win32",
@@ -4216,7 +4277,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc.exe",
 		downloadBytes: 12204751,
 		downloadSha256: "74d3acaf0f03ee190dd0462f9b49861dca50b0559c5488af4b36572fc951fcca",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_windows_arm64.zip`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_windows_arm64.zip`
 	},
 	{
 		platform: "linux",
@@ -4225,7 +4286,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc",
 		downloadBytes: 13924042,
 		downloadSha256: "333da23d1b9009d7c01638e9ba38cf4600f7d37d393f854e96ee1396adefa9a6",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_amd64.tar.gz`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_linux_amd64.tar.gz`
 	},
 	{
 		platform: "linux",
@@ -4234,7 +4295,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc",
 		downloadBytes: 12371290,
 		downloadSha256: "3990f396a9a490ee7f0e5f355287750ed41520064ed999eab443b5e9a78d773d",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_arm64.tar.gz`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_linux_arm64.tar.gz`
 	},
 	{
 		platform: "darwin",
@@ -4243,7 +4304,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc",
 		downloadBytes: 13951979,
 		downloadSha256: "cbf69cf26e5553e914e97d37f5d4367fa30f5f531d073a889465af4719281e25",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_amd64.tar.gz`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_darwin_amd64.tar.gz`
 	},
 	{
 		platform: "darwin",
@@ -4252,7 +4313,7 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		executableName: "frpc",
 		downloadBytes: 12670664,
 		downloadSha256: "cfa733b5a261c1647edee3c1fc4133d2542989b28f5602e81d47fc821d25c55f",
-		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_darwin_arm64.tar.gz`
+		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_darwin_arm64.tar.gz`
 	}
 ].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
 function inside$1(parent, child) {
@@ -4414,7 +4475,7 @@ var FrpComponentManager = class {
 		const arch = options.arch ?? process.arch;
 		this.artifact = FRP_COMPONENT_RELEASES[`${platform}-${arch}`];
 		this.componentRoot = join(stateDirectory, "components", "frp");
-		this.componentStorage = join(this.componentRoot, FRP_VERSION);
+		this.componentStorage = join(this.componentRoot, FRP_VERSION$1);
 		this.executable = join(this.componentStorage, platform === "win32" ? "frpc.exe" : "frpc");
 		this.logRoot = join(stateDirectory, "logs", "frp");
 		this.stagingRoot = join(stateDirectory, "staging", "frp");
@@ -4433,7 +4494,7 @@ var FrpComponentManager = class {
 		this.installed = await regularFile$1(this.executable);
 		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
 		if (this.installed) try {
-			if (await this.inspectExecutable(this.executable) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+			if (await this.inspectExecutable(this.executable) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
 			this.errorCode = void 0;
 		} catch {
 			this.installed = false;
@@ -4445,11 +4506,11 @@ var FrpComponentManager = class {
 		return Object.freeze({
 			supported: this.artifact !== void 0,
 			installed: this.installed,
-			version: FRP_VERSION,
+			version: FRP_VERSION$1,
 			downloadBytes: this.artifact?.downloadBytes ?? 0,
 			installedBytes: this.installedBytes,
 			sourceUrl: this.artifact?.downloadUrl ?? "https://github.com/fatedier/frp/releases",
-			releasePage: `https://github.com/fatedier/frp/releases/tag/v${FRP_VERSION}`,
+			releasePage: `https://github.com/fatedier/frp/releases/tag/v${FRP_VERSION$1}`,
 			storagePath: this.componentRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
 		});
@@ -4487,7 +4548,7 @@ var FrpComponentManager = class {
 				const extracted = join(staging, artifact.executableName);
 				if (!await regularFile$1(extracted)) throw new Error("frp_executable_missing");
 				await chmod(extracted, 448);
-				if (await this.inspectExecutable(extracted) !== FRP_VERSION) throw new Error("frp_component_version_mismatch");
+				if (await this.inspectExecutable(extracted) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
@@ -4540,33 +4601,98 @@ var FrpComponentManager = class {
 //#region src/frp-template.ts
 /** Loopback-only HTTP vhost port used between Caddy and frps. */
 const FRP_VHOST_HTTP_PORT = 7080;
+/** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
+const FRP_CADDY_SNIPPET_PATH = "/etc/caddy/dsh-mobile-dsh.caddy";
+/** First line of the owned snippet; also the legacy whole-file marker. */
+const FRP_CADDY_SNIPPET_MARKER = "# Managed by DSH Mobile - snippet, safe to delete";
+/** Exact line the main Caddyfile must contain (uncommented) for the site to load. */
+const FRP_CADDY_IMPORT_LINE = `import ${FRP_CADDY_SNIPPET_PATH}`;
+/** Directory holding the public-IPv4 certificates installed by certbot. */
+const FRP_CADDY_IP_CERT_DIR = "/var/lib/caddy/dsh-mobile-certs";
+function publicIpv4Address(value) {
+	const parts = value.split(".");
+	return parts.length === 4 && parts.every((part) => /^(?:0|[1-9][0-9]{0,2})$/u.test(part) && Number(part) <= 255);
+}
 function publicDnsHostname(value) {
 	return value.length <= 253 && value.includes(".") && !/^[0-9.]+$/u.test(value) && !value.includes(":") && value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
 }
-/** Build the only supported frps and Caddy configuration from validated user inputs. */
-function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
-	if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+function parsePublicOrigin(publicOrigin) {
 	let url;
 	try {
 		url = new URL(publicOrigin);
 	} catch {
 		throw new Error("frp_template_input_invalid");
 	}
-	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicIpv4Address(url.hostname) && !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
+	return url.hostname;
+}
+/** Build the Caddy site for one public host (without markers or import wiring). */
+function createCaddySite(publicHost, certDir = FRP_CADDY_IP_CERT_DIR) {
+	if (publicIpv4Address(publicHost)) return [
+		"{",
+		`  default_sni ${publicHost}`,
+		"}",
+		"",
+		`http://${publicHost} {`,
+		`  redir https://${publicHost}{uri} permanent`,
+		"}",
+		"",
+		`https://${publicHost} {`,
+		`  tls ${certDir}/fullchain.pem ${certDir}/privkey.pem`,
+		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		"}",
+		""
+	].join("\n");
+	if (!publicDnsHostname(publicHost)) throw new Error("frp_template_input_invalid");
 	return [
-		"# frps.toml",
+		`${publicHost} {`,
+		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		"}",
+		""
+	].join("\n");
+}
+/** Manual certbot steps for a public-IPv4 origin (Caddy cannot issue IP certificates itself). */
+function manualIpCertificateGuide(publicHost) {
+	return [
+		"# Public-IPv4 manual HTTPS: Caddy cannot issue IP certificates by itself.",
+		"# On the VPS (Ubuntu/Debian, port 80 reachable from the internet), run once as root:",
+		"#   apt-get install -y python3-venv",
+		"#   python3 -m venv /opt/dsh-mobile/certbot-venv",
+		"#   /opt/dsh-mobile/certbot-venv/bin/pip install 'certbot==5.8.0'",
+		"#   systemctl stop caddy || true",
+		`#   /opt/dsh-mobile/certbot-venv/bin/certbot certonly --standalone --preferred-profile shortlived --ip-address ${publicHost} --agree-tos --register-unsafely-without-email --non-interactive --keep-until-expiring`,
+		"#   install -d -m 0750 -o caddy -g caddy /var/lib/caddy/dsh-mobile-certs",
+		`#   install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/fullchain.pem /var/lib/caddy/dsh-mobile-certs/fullchain.pem`,
+		`#   install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/privkey.pem /var/lib/caddy/dsh-mobile-certs/privkey.pem`,
+		"#   systemctl start caddy",
+		"# The site below already references those paths. Certificates last about 6 days: re-run certonly before expiry.",
+		"#"
+	].join("\n");
+}
+/** Build the only supported frps config and Caddy snippet from validated user inputs. */
+function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
+	if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+	const publicHost = parsePublicOrigin(publicOrigin);
+	const lines = [
+		"# frps.toml — save as /etc/dsh-mobile/frps.toml, then start the frps service.",
 		`bindPort = ${String(serverPort)}`,
 		"proxyBindAddr = \"127.0.0.1\"",
 		`vhostHTTPPort = ${String(FRP_VHOST_HTTP_PORT)}`,
 		"auth.method = \"token\"",
 		`auth.token = ${JSON.stringify(token)}`,
 		"",
-		"# Caddyfile",
-		`${url.hostname} {`,
-		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
-		"}",
+		`# Caddy — save the site below as ${FRP_CADDY_SNIPPET_PATH},`,
+		"# then make sure your Caddyfile contains exactly this line at the TOP of the file",
+		"# (create the file with just this line if needed; globals must precede sites):",
+		`#   ${FRP_CADDY_IMPORT_LINE}`,
+		"# finally run: caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
+		"# Uninstall later removes only this snippet file and the import line; your own Caddy content is kept.",
+		`${FRP_CADDY_SNIPPET_MARKER}`,
+		createCaddySite(publicHost).trimEnd(),
 		""
-	].join("\n");
+	];
+	if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
+	return lines.join("\n");
 }
 //#endregion
 //#region src/frp-config.ts
@@ -4601,7 +4727,9 @@ function validateFrpPublicOrigin(value) {
 	} catch {
 		throw new Error("frp_public_origin_invalid");
 	}
-	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(url.hostname) !== 0 || !hostname$1(url.hostname)) throw new Error("frp_public_origin_invalid");
+	const publicHost = url.hostname;
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$1(publicHost)) throw new Error("frp_public_origin_invalid");
+	if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
 	return url.origin;
 }
 /** Parse FRP settings at the loopback request and filesystem boundaries. */
@@ -4624,6 +4752,32 @@ function parseFrpSettings(value) {
 		publicOrigin: validateFrpPublicOrigin(record.publicOrigin)
 	});
 }
+/**
+* Merge a partial VPS request body with the saved configuration so a blank
+* field keeps its saved value ("已保存时可留空"). Every merged field is still
+* validated; with nothing saved and nothing supplied the result reports a
+* missing configuration instead of silently deploying blanks.
+*/
+function mergeSavedFrpSettings(partial, saved) {
+	const merged = {
+		serverAddress: partial.serverAddress === "" || partial.serverAddress === void 0 ? saved?.serverAddress : partial.serverAddress,
+		serverPort: typeof partial.serverPort === "number" && Number.isSafeInteger(partial.serverPort) && partial.serverPort >= 1 ? partial.serverPort : saved?.serverPort,
+		token: partial.token === "" || partial.token === void 0 ? saved?.token : partial.token,
+		publicOrigin: partial.publicOrigin === "" || partial.publicOrigin === void 0 ? saved?.publicOrigin : partial.publicOrigin
+	};
+	if (merged.serverAddress === void 0 && merged.serverPort === void 0 && merged.token === void 0 && merged.publicOrigin === void 0) throw new Error("frp_config_missing");
+	return parseFrpSettings(merged);
+}
+/** Merge a VPS target (address and control port) with the saved configuration. */
+function mergeSavedFrpTarget(partial, saved) {
+	const serverAddress = partial.serverAddress === "" || partial.serverAddress === void 0 ? saved?.serverAddress : partial.serverAddress;
+	const serverPort = typeof partial.serverPort === "number" && Number.isSafeInteger(partial.serverPort) && partial.serverPort >= 1 ? partial.serverPort : saved?.serverPort;
+	if (serverAddress === void 0 || serverPort === void 0) throw new Error("frp_config_missing");
+	return Object.freeze({
+		serverAddress: validateFrpServerAddress(serverAddress),
+		serverPort: validateFrpServerPort(serverPort)
+	});
+}
 function tomlString(value) {
 	return JSON.stringify(value);
 }
@@ -5010,6 +5164,7 @@ async function defaultProbeVhostExposure(serverAddress, port) {
 			port
 		});
 		let finished = false;
+		let received = "";
 		const finish = (exposed) => {
 			if (finished) return;
 			finished = true;
@@ -5022,7 +5177,14 @@ async function defaultProbeVhostExposure(serverAddress, port) {
 		}, VHOST_PROBE_TIMEOUT_MS);
 		timer.unref();
 		socket.once("connect", () => {
-			finish(true);
+			socket.write("GET /dsh-mobile-exposure-probe HTTP/1.1\r\nHost: invalid.example\r\nConnection: close\r\n\r\n");
+		});
+		socket.on("data", (chunk) => {
+			received = `${received}${chunk.toString("latin1")}`.slice(0, 32);
+			if (/^HTTP\/1\.[01] [1-5][0-9]{2}/u.test(received)) finish(true);
+		});
+		socket.once("close", () => {
+			finish(false);
 		});
 		socket.once("error", () => {
 			finish(false);
@@ -5588,12 +5750,28 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 }
 //#endregion
 //#region src/mobile-guide.ts
+/** Compose the guide with the current customization state injected. */
+function buildMobileGuide(state) {
+	const styleLine = state.hasCustomCss ? "存在（当前生效的自定义样式）" : "不存在（使用内置默认样式）";
+	const scriptLine = state.hasCustomJs ? "存在（当前生效的自定义脚本）" : "不存在（无自定义脚本）";
+	const extensionLines = state.extensions.length === 0 ? "（无）" : state.extensions.map((entry) => `- ${entry.id}（${entry.name} v${entry.version}）`).join("\n");
+	const failureLine = state.failedExtensionCount > 0 ? `注意：${state.failedExtensionCount} 个扩展的电脑端 host 激活失败，如改动相关扩展请先检查其 host.mjs 与 extension.json。` : "";
+	return `${`## 手机端当前状态（改名前必读，避免覆盖已有定制）
+
+- 定制目录：${state.directory}（所有改动只允许在这里进行）
+- mobile.css：${styleLine}
+- mobile.js：${scriptLine}
+- 已安装扩展：
+${extensionLines}
+${failureLine}
+
+“恢复默认”操作说明：当用户要求恢复默认 / 还原初始外观时，删除 mobile.css 与 mobile.js 两个文件（删除后手机端自动回到内置默认外观，无需创建占位文件），并按需删除 extensions/ 下的扩展目录。\n\n`}${MOBILE_CUSTOMIZATION_GUIDE_BODY}`;
+}
 /**
-* Instructions handed to the DSH agent when the user runs `/mobile <task>`.
-* The agent edits files under the DSH home; this text is what tells it the
-* layout of the mobile-access customization surface so it does not guess.
+* Static body of the customization guide. Kept separate from the injected
+* state snapshot so the two concerns stay easy to edit independently.
 */
-const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机端。DSH Mobile 是一个把电脑上的 DeepSeek Harness 带到手机浏览器的插件，手机端界面和能力都来自本机文件。
+const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手机端。DSH Mobile 是一个把电脑上的 DeepSeek Harness 带到手机浏览器的插件，手机端界面和能力都来自本机文件。
 
 所有改动只允许在 $DSH_HOME/mobile-access/ 目录内进行，绝不修改 DeepSeek Harness 的源码或其他目录。$DSH_HOME 是 DeepSeek Harness 的配置目录（通常为 ~/.dsh），先确认它的实际路径再操作。
 
@@ -5618,7 +5796,994 @@ const MOBILE_CUSTOMIZATION_GUIDE = `你在为用户定制 DSH Mobile 的手机
 - host.mjs 拥有电脑用户的完整权限，绝不能放入不可信代码，也不要让手机端无条件执行任意命令
 - 所有改动只限 $DSH_HOME/mobile-access/，不要动 DeepSeek Harness 源码
 
-请执行用户需求：外观或交互类改 mobile.css / mobile.js；需要电脑能力的创建或修改扩展。完成后简要说明改了什么、手机端会有什么变化。`;
+完成前请自检：
+- 改动涉及 mobile.js 或扩展的 mobile.js / host.mjs 时，先做语法检查再保存（如 node --check <file>），确保没有语法错误
+- 创建或修改扩展后，确认 extension.json 的 schemaVersion 为 1、id 与目录名一致、且 id 只含小写字母数字和连字符
+- 扩展的 host.mjs 若在完成前无法激活，先修正而不是留下损坏的扩展
+- 完成后检查自己实际写入了哪些文件，向用户简要说明改了什么、手机端会有什么变化`;
+//#endregion
+//#region src/vps-deploy.ts
+const FRP_VERSION = "0.70.1";
+const SSH_TIMEOUT_MS = 3e5;
+const LINUX_ARTIFACTS = Object.freeze({
+	x64: Object.freeze({
+		directory: `frp_${FRP_VERSION}_linux_amd64`,
+		url: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_amd64.tar.gz`,
+		sha256: "333da23d1b9009d7c01638e9ba38cf4600f7d37d393f854e96ee1396adefa9a6"
+	}),
+	arm64: Object.freeze({
+		directory: `frp_${FRP_VERSION}_linux_arm64`,
+		url: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/frp_${FRP_VERSION}_linux_arm64.tar.gz`,
+		sha256: "3990f396a9a490ee7f0e5f355287750ed41520064ed999eab443b5e9a78d773d"
+	})
+});
+var VpsSshError = class extends Error {
+	stdout;
+	stderr;
+	constructor(message, stdout, stderr, options) {
+		super(message, options);
+		this.stdout = stdout;
+		this.stderr = stderr;
+	}
+};
+function shellQuote(value) {
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+/**
+* Reject loopback, private, and other non-routable IPv4 literals as VPS SSH
+* targets. A self-hosted deployment always addresses a public server; the
+* shared frpc settings stay permissive so local loopback test rigs keep working.
+*/
+function assertPublicSshTarget(serverAddress) {
+	if (isIP(serverAddress) === 4 && !isGloballyRoutableIpv4(serverAddress)) throw new Error("vps_server_not_public");
+}
+/**
+* Validate a VPS address for every operation that opens a network connection
+* to it (scan, deploy, cleanup). IPv6 is unsupported by the SSH flow and
+* loopback/private targets are never valid VPS endpoints.
+*/
+function validateVpsServerTarget(serverAddress) {
+	const address = validateFrpServerAddress(serverAddress);
+	if (isIP(address) !== 0 && address.includes(":")) throw new Error("vps_ipv6_ssh_not_supported");
+	assertPublicSshTarget(address);
+	return address;
+}
+function validSshUser(value) {
+	if (typeof value !== "string" || value.length < 1 || value.length > 64 || !/^[a-z_][a-z0-9_.-]*[$]?$/iu.test(value)) throw new Error("vps_ssh_user_invalid");
+	return value;
+}
+function validSshPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("vps_ssh_port_invalid");
+	return Number(value);
+}
+function validSshKeyPath(value) {
+	if (value === void 0 || value === "") return void 0;
+	if (typeof value !== "string" || !isAbsolute(value) || value.length > 4096 || /[\u0000-\u001f\u007f]/u.test(value)) throw new Error("vps_ssh_key_invalid");
+	return resolve(value);
+}
+function parseVpsDeploymentInput(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("vps_deploy_input_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"sshUser",
+		"sshPort",
+		"sshKeyPath",
+		"hostFingerprints"
+	].includes(String(key)))) throw new Error("vps_deploy_input_invalid");
+	const sshKeyPath = validSshKeyPath(record.sshKeyPath);
+	return Object.freeze({
+		sshUser: validSshUser(record.sshUser),
+		sshPort: validSshPort(record.sshPort),
+		...sshKeyPath === void 0 ? {} : { sshKeyPath },
+		hostFingerprints: Object.freeze(parseVpsHostFingerprints(record.hostFingerprints))
+	});
+}
+/** Validate user-confirmed SHA256 host-key fingerprints (`SHA256:…`). */
+function parseVpsHostFingerprints(value) {
+	if (!Array.isArray(value) || value.length < 1 || value.length > 8) throw new Error("vps_host_key_unconfirmed");
+	const fingerprints = [];
+	for (const entry of value) {
+		if (typeof entry !== "string" || !/^SHA256:[A-Za-z0-9+/]{40,60}={0,2}$/u.test(entry) || entry.length > 96) throw new Error("vps_host_key_unconfirmed");
+		fingerprints.push(entry);
+	}
+	return [...new Set(fingerprints)];
+}
+const SUPPORTED_HOST_KEY_TYPES = /* @__PURE__ */ new Set([
+	"ssh-rsa",
+	"ecdsa-sha2-nistp256",
+	"ecdsa-sha2-nistp384",
+	"ecdsa-sha2-nistp521",
+	"ssh-ed25519"
+]);
+/** Format a raw host public key the way OpenSSH displays it (`SHA256:…` without padding). */
+function fingerprintHostPublicKey(keyType, base64Key) {
+	if (!SUPPORTED_HOST_KEY_TYPES.has(keyType)) throw new Error("vps_host_key_unsupported_type");
+	if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(base64Key) || base64Key.length < 24 || base64Key.length > 1024) throw new Error("vps_host_key_invalid");
+	const raw = Buffer.from(base64Key, "base64");
+	if (raw.length < 16 || raw.length > 768) throw new Error("vps_host_key_invalid");
+	return `SHA256:${createHash("sha256").update(raw).digest("base64").replace(/=+$/u, "")}`;
+}
+function parseKeyscanOutput(output) {
+	const keys = [];
+	for (const line of output.split(/\r?\n/u)) {
+		const trimmed = line.trim();
+		if (trimmed === "" || trimmed.startsWith("#")) continue;
+		const match = /^(?:\S+\s+)?(ssh-rsa|ecdsa-sha2-nistp\d+|ssh-ed25519)\s+([A-Za-z0-9+/]+={0,2})(\s|$)/u.exec(trimmed);
+		if (match?.[1] === void 0 || match[2] === void 0) throw new Error("vps_host_key_invalid");
+		keys.push({
+			keyType: match[1],
+			base64Key: match[2]
+		});
+	}
+	return keys;
+}
+/** Base SSH options shared by long deployment sessions. Keepalives survive NAT
+*  middleboxes during minute-long apt/pip phases; host identity stays pinned. */
+function sshSessionOptions(knownHostsFile) {
+	return [
+		"-o",
+		"BatchMode=yes",
+		"-o",
+		"ConnectTimeout=15",
+		"-o",
+		"ServerAliveInterval=15",
+		"-o",
+		"ServerAliveCountMax=8",
+		"-o",
+		"StrictHostKeyChecking=yes",
+		`-o UserKnownHostsFile=${knownHostsFile}`
+	];
+}
+/** Lenient scan probe: garbage fails the whole fetch, comment-only output falls back. */
+function tryParseKeyscanOutput(output) {
+	try {
+		return parseKeyscanOutput(output);
+	} catch {
+		return;
+	}
+}
+async function gitBundledKeyscan() {
+	if (process.platform !== "win32") return void 0;
+	const programFiles = process.env["ProgramFiles"] ?? "C:\\Program Files";
+	const candidate = join(programFiles, "Git", "usr", "bin", "ssh-keyscan.exe");
+	try {
+		if (!(await lstat(candidate)).isFile()) return void 0;
+	} catch {
+		return;
+	}
+	return candidate;
+}
+async function defaultRunKeyscan(input, serverAddress) {
+	const keyscan = process.platform === "win32" ? "ssh-keyscan.exe" : "ssh-keyscan";
+	const args = [
+		"-T",
+		"10",
+		"-p",
+		String(input.sshPort),
+		"-t",
+		"rsa,ecdsa,ed25519",
+		serverAddress
+	];
+	const first = await runProcess(keyscan, args, void 0, 3e4).catch(() => void 0);
+	if (first !== void 0 && tryParseKeyscanOutput(first.stdout)?.length) return first.stdout;
+	const bundled = await gitBundledKeyscan();
+	if (bundled !== void 0) {
+		const second = await runProcess(bundled, args, void 0, 3e4).catch(() => void 0);
+		if (second !== void 0 && tryParseKeyscanOutput(second.stdout)?.length) return second.stdout;
+	}
+	return first?.stdout ?? "";
+}
+/**
+* Read the server's public host keys over an authenticated connection with a
+* throwaway known_hosts file. Fallback for keyscan binaries that cannot
+* negotiate with modern servers; output feeds the same confirm-and-pin pipeline.
+*/
+async function defaultRunSshFetch(input, serverAddress) {
+	const ssh = process.platform === "win32" ? "ssh.exe" : "ssh";
+	const sshUser = validSshUser(input.sshUser);
+	const sshPort = validSshPort(input.sshPort);
+	const sshKeyPath = validSshKeyPath(input.sshKeyPath);
+	const { stdout } = await runProcess(ssh, [
+		"-o",
+		"BatchMode=yes",
+		"-o",
+		"ConnectTimeout=15",
+		"-o",
+		"StrictHostKeyChecking=no",
+		`-o UserKnownHostsFile=${process.platform === "win32" ? "NUL" : "/dev/null"}`,
+		...sshKeyPath === void 0 ? [] : ["-i", sshKeyPath],
+		"-p",
+		String(sshPort),
+		`${sshUser}@${serverAddress}`,
+		"cat /etc/ssh/ssh_host_*_key.pub"
+	], void 0, 3e4).catch((error) => {
+		throw new VpsSshError("vps_host_key_unavailable", "", error instanceof Error ? error.message : String(error));
+	});
+	const lines = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const match = /^(ssh-rsa|ecdsa-sha2-nistp\d+|ssh-ed25519)\s+([A-Za-z0-9+/]+={0,2})(\s|$)/u.exec(line.trim());
+		if (match?.[1] !== void 0 && match[2] !== void 0) lines.push(`${serverAddress} ${match[1]} ${match[2]}`);
+	}
+	return lines.length === 0 ? stdout : `${lines.join("\n")}\n`;
+}
+/**
+* Scan host keys with keyscan first, then fall back to an authenticated read
+* when the local keyscan binary cannot negotiate with the server. Both paths
+* feed the same confirm-and-pin pipeline, so a fallback never weakens the
+* user-confirmation gate.
+*/
+async function scanHostKeys(input, serverAddress, options) {
+	const scanned = await (options.runKeyscan ?? defaultRunKeyscan)({
+		sshUser: input.sshUser,
+		sshPort: input.sshPort
+	}, serverAddress).catch(() => "");
+	if (tryParseKeyscanOutput(scanned)?.length) return scanned;
+	options.log?.("host-keys-keyscan-empty", { serverAddress });
+	const fetched = await (options.runSshFetch ?? defaultRunSshFetch)(input, serverAddress);
+	if (tryParseKeyscanOutput(fetched)?.length) {
+		options.log?.("host-keys-ssh-fallback", { serverAddress });
+		return fetched;
+	}
+	throw new Error("vps_host_key_unavailable");
+}
+/**
+* Fetch the server's current host keys and return them with OpenSSH-style
+* fingerprints for the user to confirm out of band (for example against the
+* VPS console) before any destructive or authenticated deployment step.
+*/
+async function fetchVpsHostKeys(serverAddress, input, options = {}) {
+	const address = validateVpsServerTarget(serverAddress);
+	const keys = parseKeyscanOutput(await scanHostKeys({
+		sshUser: validSshUser(input.sshUser),
+		sshPort: validSshPort(input.sshPort),
+		sshKeyPath: input.sshKeyPath
+	}, address, options));
+	if (keys.length === 0) throw new Error("vps_host_key_unavailable");
+	const seen = /* @__PURE__ */ new Set();
+	const hostKeys = [];
+	for (const key of keys) {
+		const fingerprint = fingerprintHostPublicKey(key.keyType, key.base64Key);
+		if (seen.has(fingerprint)) continue;
+		seen.add(fingerprint);
+		hostKeys.push(Object.freeze({
+			keyType: key.keyType,
+			fingerprint
+		}));
+	}
+	options.log?.("host-keys-fetched", {
+		serverAddress: address,
+		keyTypes: hostKeys.length
+	});
+	return Object.freeze(hostKeys);
+}
+/**
+* Verify that every host key the server currently presents was confirmed by the
+* user, then return a pinned known_hosts body. Fails closed on rotation,
+* replacement, or unexpected extra keys.
+*/
+function buildPinnedKnownHosts(serverAddress, sshPort, keyscanOutput, confirmedFingerprints) {
+	const address = validateFrpServerAddress(serverAddress);
+	const port = validSshPort(sshPort);
+	const confirmed = new Set(parseVpsHostFingerprints([...confirmedFingerprints]));
+	const keys = parseKeyscanOutput(keyscanOutput);
+	if (keys.length === 0) throw new Error("vps_host_key_unavailable");
+	const host = port === 22 ? address : `[${address}]:${port}`;
+	const lines = [];
+	for (const key of keys) {
+		const fingerprint = fingerprintHostPublicKey(key.keyType, key.base64Key);
+		if (!confirmed.has(fingerprint)) throw new Error("vps_host_key_mismatch");
+		lines.push(`${host} ${key.keyType} ${key.base64Key}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+function safeOutput(value, token) {
+	return (token === "" ? value : value.replaceAll(token, "<redacted>")).replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/gu, "").slice(0, 8192).trim();
+}
+function parseChecks(stdout, stderr, token) {
+	const checks = [];
+	for (const line of stdout.split(/\r?\n/u)) {
+		const match = /^DSH_MOBILE_CHECK\s+([a-z0-9_-]+)\s+(ok|warning|error)\s+(.+)$/iu.exec(line);
+		if (match !== null) checks.push(Object.freeze({
+			id: match[1],
+			status: match[2].toLowerCase(),
+			detail: safeOutput(match[3], token)
+		}));
+	}
+	if (checks.length === 0 && stderr.trim() !== "") checks.push(Object.freeze({
+		id: "remote-command",
+		status: "error",
+		detail: safeOutput(stderr, token) || "VPS 返回了未分类错误。"
+	}));
+	return Object.freeze(checks);
+}
+/**
+* One-line failure detail for transport-level failures: prefer the failed
+* remote check, otherwise use the last stderr line (a `set -eu` abort has no
+* check line) instead of dumping the whole transcript into the UI.
+*/
+function failureDetail(stdout, stderr, token) {
+	const failed = parseChecks(`${stdout}\n${stderr}`, "", token).find((check) => check.status === "error");
+	if (failed !== void 0) return failed.detail;
+	for (const stream of [stderr, stdout]) {
+		const lines = stream.split(/\r?\n/u).map((line) => line.trim()).filter((line) => line !== "");
+		const last = lines[lines.length - 1];
+		if (last !== void 0) return safeOutput(last, token);
+	}
+	return "";
+}
+function deploymentScript(settings) {
+	const amd64 = LINUX_ARTIFACTS.x64;
+	const arm64 = LINUX_ARTIFACTS.arm64;
+	const config = [
+		"bindAddr = \"0.0.0.0\"",
+		`bindPort = ${String(settings.serverPort)}`,
+		"proxyBindAddr = \"127.0.0.1\"",
+		"vhostHTTPPort = 7080",
+		"auth.method = \"token\"",
+		`auth.token = ${JSON.stringify(settings.token)}`,
+		""
+	].join("\n");
+	const publicHost = new URL(settings.publicOrigin).hostname;
+	const publicIp = isGloballyRoutableIpv4(publicHost);
+	const caddySite = createCaddySite(publicHost);
+	const caddySnippet = `${FRP_CADDY_SNIPPET_MARKER}\n${caddySite.trimEnd()}\n`;
+	const ipCertificateSetup = publicIp ? `
+export DEBIAN_FRONTEND=noninteractive
+apt-get install -y python3-venv
+if [ ! -x /opt/dsh-mobile/certbot-venv/bin/certbot ]; then
+  python3 -m venv /opt/dsh-mobile/certbot-venv
+  /opt/dsh-mobile/certbot-venv/bin/pip install --disable-pip-version-check 'certbot==5.8.0'
+fi
+systemctl stop caddy.service || true
+if ! /opt/dsh-mobile/certbot-venv/bin/certbot certonly --standalone --preferred-profile shortlived --ip-address ${publicHost} --agree-tos --register-unsafely-without-email --non-interactive --keep-until-expiring; then
+  systemctl start caddy.service || true
+  fail "公网 IP HTTPS 证书申请失败；请确认 80/tcp 可从公网访问。"
+fi
+install -d -m 0750 -o caddy -g caddy /var/lib/caddy/dsh-mobile-certs
+install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/fullchain.pem /var/lib/caddy/dsh-mobile-certs/fullchain.pem
+install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/privkey.pem /var/lib/caddy/dsh-mobile-certs/privkey.pem
+cat > /usr/local/sbin/dsh-mobile-cert-renew <<'DSH_MOBILE_CERT_RENEW'
+#!/bin/sh
+set -eu
+systemctl stop caddy.service
+trap 'systemctl start caddy.service' EXIT
+/opt/dsh-mobile/certbot-venv/bin/certbot renew --cert-name ${publicHost} --preferred-profile shortlived --non-interactive
+install -d -m 0750 -o caddy -g caddy /var/lib/caddy/dsh-mobile-certs
+install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/fullchain.pem /var/lib/caddy/dsh-mobile-certs/fullchain.pem
+install -m 0640 -o caddy -g caddy /etc/letsencrypt/live/${publicHost}/privkey.pem /var/lib/caddy/dsh-mobile-certs/privkey.pem
+DSH_MOBILE_CERT_RENEW
+chmod 0755 /usr/local/sbin/dsh-mobile-cert-renew
+cat > /etc/systemd/system/dsh-mobile-cert-renew.service <<'DSH_MOBILE_CERT_SERVICE'
+[Unit]
+Description=Renew DSH Mobile public IP TLS certificate
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/dsh-mobile-cert-renew
+DSH_MOBILE_CERT_SERVICE
+cat > /etc/systemd/system/dsh-mobile-cert-renew.timer <<'DSH_MOBILE_CERT_TIMER'
+[Unit]
+Description=Daily DSH Mobile public IP TLS certificate renewal check
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=2h
+Persistent=true
+Unit=dsh-mobile-cert-renew.service
+
+[Install]
+WantedBy=timers.target
+DSH_MOBILE_CERT_TIMER
+check certificate ok "Let's Encrypt 公网 IP 证书已安装并启用每日自动续期。"
+` : "";
+	return `#!/bin/sh
+set -eu
+umask 077
+
+fail() { echo "DSH_MOBILE_CHECK remote-command error $1" >&2; exit 1; }
+check() { echo "DSH_MOBILE_CHECK $1 $2 $3"; }
+
+# Serialize concurrent deploys: two writers racing sed -i on the Caddyfile
+# can duplicate the import line and break validation. Uninstall takes the
+# same lock, so deploy and cleanup also exclude each other.
+if command -v flock >/dev/null 2>&1; then
+  exec 9>/tmp/dsh-mobile-deploy.lock
+  flock -n 9 || fail "已有部署或清理正在进行，请稍后再试。"
+fi
+
+[ "$(id -u)" = "0" ] || fail "请使用 root SSH 账号。"
+command -v systemctl >/dev/null 2>&1 || fail "VPS 不支持 systemd。"
+command -v tar >/dev/null 2>&1 || fail "VPS 缺少 tar。"
+command -v curl >/dev/null 2>&1 || fail "VPS 缺少 curl。"
+command -v sha256sum >/dev/null 2>&1 || fail "VPS 缺少 sha256sum。"
+command -v useradd >/dev/null 2>&1 || fail "VPS 缺少 useradd。"
+
+if [ -r /etc/os-release ]; then . /etc/os-release; else fail "无法识别 VPS 系统。"; fi
+case "\${ID:-}" in
+  debian|ubuntu) ;;
+  *) fail "首版 VPS 部署只支持 Debian/Ubuntu。" ;;
+esac
+check os ok "\${PRETTY_NAME:-Debian/Ubuntu}"
+
+if command -v ss >/dev/null 2>&1 && ss -ltnH | awk '{print $4}' | grep -Eq '(^|:)${String(settings.serverPort)}$'; then
+  systemctl is-active --quiet dsh-mobile-frps.service || fail "端口 ${String(settings.serverPort)} 已被占用。"
+fi
+
+if ! command -v caddy >/dev/null 2>&1; then
+  export DEBIAN_FRONTEND=noninteractive
+  # A previous interrupted run may have left these files unreadable because
+  # the deployment uses umask 077. APT reads repositories as the _apt user.
+  chmod 0644 /usr/share/keyrings/caddy-stable-archive-keyring.gpg 2>/dev/null || true
+  chmod 0644 /etc/apt/sources.list.d/caddy-stable.list 2>/dev/null || true
+  apt-get update
+  apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl gnupg
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | gpg --dearmor --yes -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+  curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' -o /etc/apt/sources.list.d/caddy-stable.list
+  chmod 0644 /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/sources.list.d/caddy-stable.list
+  apt-get update
+  apt-get install -y caddy
+fi
+check caddy ok "Caddy 已安装。"
+
+# The site lives in our own snippet file; the main Caddyfile only gains one
+# import line, so existing user content is never rewritten or merged.
+caddy_import='${FRP_CADDY_IMPORT_LINE}'
+install -d -m 0755 /etc/caddy
+caddyfile_ready=false
+if [ ! -e /etc/caddy/Caddyfile ]; then
+  printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
+  chmod 0644 /etc/caddy/Caddyfile
+  caddyfile_ready=true
+elif grep -Eq '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile; then
+  # The snippet may carry global options (IP mode default_sni), which must
+  # precede all site blocks after import inlining: rebuild the file with a
+  # single import on top. Removal uses grep -v with the exact gate pattern
+  # above (not sed -i, whose in-place delete proved unreliable here), and the
+  # result is verified to carry exactly one import before replacing the file.
+  {
+    printf '%s\n' "$caddy_import"
+    grep -Ev '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile || true
+  } > /etc/caddy/Caddyfile.dsh-new
+  [ "$(grep -Ec '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile.dsh-new)" = 1 ] \
+    || fail "Caddyfile import 整理失败，未做任何修改。"
+  cat /etc/caddy/Caddyfile.dsh-new > /etc/caddy/Caddyfile
+  rm -f /etc/caddy/Caddyfile.dsh-new
+  chmod 0644 /etc/caddy/Caddyfile
+  caddyfile_ready=true
+elif [ ! -s /etc/caddy/Caddyfile ]; then
+  printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
+  chmod 0644 /etc/caddy/Caddyfile
+  caddyfile_ready=true
+elif grep -q '^# DSH Mobile removed its site' /etc/caddy/Caddyfile; then
+  # Leftover placeholder from our own uninstall: drop only that line, then
+  # ensure the import exists exactly once (same grep -v + count discipline).
+  grep -Ev '^# DSH Mobile removed its site.*$' /etc/caddy/Caddyfile > /etc/caddy/Caddyfile.dsh-new || true
+  grep -Eq '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile.dsh-new \
+    || printf '%s\n' "$caddy_import" >> /etc/caddy/Caddyfile.dsh-new
+  [ "$(grep -Ec '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile.dsh-new)" = 1 ] \
+    || fail "Caddyfile import 整理失败，未做任何修改。"
+  cat /etc/caddy/Caddyfile.dsh-new > /etc/caddy/Caddyfile
+  rm -f /etc/caddy/Caddyfile.dsh-new
+  chmod 0644 /etc/caddy/Caddyfile
+  caddyfile_ready=true
+else
+  caddy_hash="$(sha256sum /etc/caddy/Caddyfile | awk '{print $1}')"
+  if [ "$caddy_hash" = '66177d46fa761acb07208065db9b0274cb1b12c02ac43b9bfc9857b698b1ccfe' ]; then
+    printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
+    chmod 0644 /etc/caddy/Caddyfile
+    caddyfile_ready=true
+  elif grep -q '^# Managed by DSH Mobile$' /etc/caddy/Caddyfile; then
+    # Legacy whole-file layout: the entire file is ours by construction.
+    printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
+    chmod 0644 /etc/caddy/Caddyfile
+    caddyfile_ready=true
+  elif grep -q '^:80[[:space:]]*{' /etc/caddy/Caddyfile \
+    && grep -q 'root [*] /usr/share/caddy' /etc/caddy/Caddyfile \
+    && grep -q '^[[:space:]]*file_server[[:space:]]*$' /etc/caddy/Caddyfile; then
+    printf '%s\n' "$caddy_import" > /etc/caddy/Caddyfile
+    chmod 0644 /etc/caddy/Caddyfile
+    caddyfile_ready=true
+  fi
+fi
+if [ "$caddyfile_ready" != true ]; then
+  fail "已有 Caddyfile，请先备份，然后加一行 ${FRP_CADDY_IMPORT_LINE}，或手动合并站点。"
+fi
+
+${ipCertificateSetup}
+
+arch="$(uname -m)"
+case "$arch" in
+  x86_64|amd64) url=${shellQuote(amd64.url)}; expected=${shellQuote(amd64.sha256)}; directory=${shellQuote(amd64.directory)} ;;
+  aarch64|arm64) url=${shellQuote(arm64.url)}; expected=${shellQuote(arm64.sha256)}; directory=${shellQuote(arm64.directory)} ;;
+  *) fail "只支持 Linux x86_64 和 arm64。" ;;
+esac
+
+tmp="$(mktemp -d /tmp/dsh-mobile-frp.XXXXXX)"
+cleanup() { rm -rf "$tmp"; [ -z "\${DSH_MOBILE_FRP_ARCHIVE:-}" ] || rm -f "$DSH_MOBILE_FRP_ARCHIVE"; }
+trap cleanup EXIT HUP INT TERM
+archive="$tmp/frp.tar.gz"
+if [ -n "\${DSH_MOBILE_FRP_ARCHIVE:-}" ]; then
+  [ -f "$DSH_MOBILE_FRP_ARCHIVE" ] || fail "上传的 frps 安装包不存在。"
+  cp "$DSH_MOBILE_FRP_ARCHIVE" "$archive"
+else
+  curl --fail --location --proto '=https' --tlsv1.2 --output "$archive" "$url"
+fi
+actual="$(sha256sum "$archive" | awk '{print $1}')"
+[ "$actual" = "$expected" ] || fail "frps 下载校验失败。"
+tar -xzf "$archive" -C "$tmp" "$directory/frps"
+
+install -d -m 0755 /usr/local/libexec/dsh-mobile/frp/${FRP_VERSION}
+install -m 0755 "$tmp/$directory/frps" /usr/local/libexec/dsh-mobile/frp/${FRP_VERSION}/frps
+# The account must exist before anything references its group below.
+dsh_mobile_created=false
+if ! id -u dsh-mobile >/dev/null 2>&1; then
+  useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin --no-create-home dsh-mobile
+  dsh_mobile_created=true
+fi
+install -d -m 0750 -o root -g dsh-mobile /etc/dsh-mobile
+if [ "$dsh_mobile_created" = true ]; then
+  # Ownership record: uninstall removes the account only when this deployment created it.
+  touch /etc/dsh-mobile/.owns-account
+  check account ok "已创建 dsh-mobile 系统用户。"
+else
+  check account ok "复用已有的 dsh-mobile 系统用户（卸载时将保留）。"
+fi
+cat > /etc/dsh-mobile/frps.toml <<'DSH_MOBILE_FRPS_CONFIG'
+${config}DSH_MOBILE_FRPS_CONFIG
+chown root:dsh-mobile /etc/dsh-mobile/frps.toml
+chmod 0640 /etc/dsh-mobile/frps.toml
+
+cat > /etc/systemd/system/dsh-mobile-frps.service <<'DSH_MOBILE_FRPS_UNIT'
+[Unit]
+Description=DSH Mobile self-hosted FRP server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=dsh-mobile
+Group=dsh-mobile
+ExecStart=/usr/local/libexec/dsh-mobile/frp/${FRP_VERSION}/frps -c /etc/dsh-mobile/frps.toml
+Restart=on-failure
+RestartSec=5s
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+
+[Install]
+WantedBy=multi-user.target
+DSH_MOBILE_FRPS_UNIT
+
+cat > ${FRP_CADDY_SNIPPET_PATH} <<'DSH_MOBILE_CADDY_SNIPPET'
+${caddySnippet}DSH_MOBILE_CADDY_SNIPPET
+chmod 0644 ${FRP_CADDY_SNIPPET_PATH}
+caddy validate --config /etc/caddy/Caddyfile
+systemctl daemon-reload
+# Restart (not just start) so a redeploy over a running previous generation
+# actually picks up the new frps token and config instead of keeping the old
+# process alive with stale credentials.
+systemctl enable dsh-mobile-frps.service
+systemctl restart dsh-mobile-frps.service
+systemctl enable --now caddy.service
+${publicIp ? "systemctl enable --now dsh-mobile-cert-renew.timer" : ""}
+systemctl reload caddy.service || systemctl restart caddy.service
+
+if command -v ufw >/dev/null 2>&1 && ufw status | grep -q '^Status: active'; then
+  ufw allow ${String(settings.serverPort)}/tcp comment 'DSH Mobile FRP control' >/dev/null
+  ufw allow 80/tcp comment 'DSH Mobile HTTPS redirect' >/dev/null
+  ufw allow 443/tcp comment 'DSH Mobile HTTPS' >/dev/null
+  check firewall ok "UFW 已放行 FRP 控制端口和 HTTPS。"
+else
+  check firewall warning "未修改系统防火墙；请确认 ${String(settings.serverPort)}/tcp、80/tcp、443/tcp 已放行。"
+fi
+
+systemctl is-active --quiet dsh-mobile-frps.service || fail "frps 服务启动失败。"
+systemctl is-active --quiet caddy.service || fail "Caddy 服务启动失败。"
+check frps ok "frps ${FRP_VERSION} 已启动，7080 仅绑定回环地址。"
+check caddy ok "Caddy 已加载 ${publicHost}。"
+echo DSH_MOBILE_DEPLOYMENT_OK
+`;
+}
+async function runProcess(command, args, stdin, timeoutMs = SSH_TIMEOUT_MS) {
+	return new Promise((resolveRun, rejectRun) => {
+		const child = spawn(command, args, {
+			windowsHide: true,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		const append = (current, chunk) => `${current}${chunk.toString("utf8")}`.slice(-98304);
+		const timer = setTimeout(() => {
+			child.kill();
+			rejectRun(new VpsSshError("vps_ssh_timeout", stdout, stderr));
+		}, timeoutMs);
+		timer.unref();
+		child.stdout.on("data", (chunk) => {
+			stdout = append(stdout, Buffer.from(chunk));
+		});
+		child.stderr.on("data", (chunk) => {
+			stderr = append(stderr, Buffer.from(chunk));
+		});
+		child.once("error", (error) => {
+			clearTimeout(timer);
+			rejectRun(new VpsSshError("vps_ssh_unavailable", stdout, stderr, { cause: error }));
+		});
+		child.once("close", (code) => {
+			clearTimeout(timer);
+			if (code !== 0) rejectRun(new VpsSshError(stderr.includes("Permission denied") ? "vps_ssh_auth_failed" : "vps_deploy_failed", stdout, stderr));
+			else resolveRun({
+				stdout,
+				stderr
+			});
+		});
+		child.stdin.end(stdin, "utf8");
+	});
+}
+async function downloadArtifact(artifact, file) {
+	await runProcess(process.platform === "win32" ? "curl.exe" : "curl", [
+		...process.platform === "win32" ? ["--ipv4"] : [],
+		"--fail",
+		"--location",
+		"--silent",
+		"--show-error",
+		"--connect-timeout",
+		"15",
+		"--max-time",
+		"180",
+		"--proto",
+		"=https",
+		"--tlsv1.2",
+		"--output",
+		file,
+		artifact.url
+	], void 0, 2e5);
+	const bytes = await readFile(file);
+	if (createHash("sha256").update(bytes).digest("hex") !== artifact.sha256) throw new Error("vps_download_hash_mismatch");
+	return bytes.byteLength;
+}
+async function defaultRunSsh(input, serverAddress, script, knownHostsFile, log) {
+	const ssh = process.platform === "win32" ? "ssh.exe" : "ssh";
+	const scp = process.platform === "win32" ? "scp.exe" : "scp";
+	const common = sshSessionOptions(knownHostsFile);
+	if (input.sshKeyPath !== void 0) common.push("-i", input.sshKeyPath);
+	const target = `${input.sshUser}@${serverAddress}`;
+	const architecture = (await runProcess(ssh, [
+		...common,
+		"-p",
+		String(input.sshPort),
+		target,
+		"uname -m"
+	])).stdout.trim();
+	const artifact = architecture === "x86_64" || architecture === "amd64" ? LINUX_ARTIFACTS.x64 : architecture === "aarch64" || architecture === "arm64" ? LINUX_ARTIFACTS.arm64 : void 0;
+	if (artifact === void 0) throw new Error("vps_arch_unsupported");
+	log?.("architecture", { architecture });
+	const localDirectory = await mkdtemp(join(tmpdir(), "dsh-mobile-frp-"));
+	const localArchive = join(localDirectory, "frp.tar.gz");
+	const remoteArchive = `/tmp/dsh-mobile-frp-${randomBytes(12).toString("hex")}.tar.gz`;
+	try {
+		log?.("download-start", {
+			source: "local",
+			architecture
+		});
+		const bytes = await downloadArtifact(artifact, localArchive);
+		log?.("download-complete", {
+			source: "local",
+			bytes
+		});
+		const scpResult = await runProcess(scp, [
+			...common,
+			"-P",
+			String(input.sshPort),
+			localArchive,
+			`${target}:${remoteArchive}`
+		]);
+		log?.("upload-complete", {
+			bytes,
+			stderrBytes: Buffer.byteLength(scpResult.stderr)
+		});
+		const remoteCommand = input.sshUser === "root" ? `env DSH_MOBILE_FRP_ARCHIVE=${shellQuote(remoteArchive)} sh -s` : `sudo -n env DSH_MOBILE_FRP_ARCHIVE=${shellQuote(remoteArchive)} sh -s`;
+		return await runProcess(ssh, [
+			...common,
+			"-p",
+			String(input.sshPort),
+			target,
+			remoteCommand
+		], script);
+	} finally {
+		await rm(localDirectory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function deployVps(settings, input, options = {}) {
+	const serverPort = validateFrpServerPort(settings.serverPort);
+	const token = validateFrpToken(settings.token);
+	const publicOrigin = validateFrpPublicOrigin(settings.publicOrigin);
+	const serverAddress = validateVpsServerTarget(settings.serverAddress);
+	const parsedInput = parseVpsDeploymentInput(input);
+	if (parsedInput.sshKeyPath !== void 0) {
+		const entry = await lstat(parsedInput.sshKeyPath).catch(() => void 0);
+		if (entry === void 0 || !entry.isFile() || entry.isSymbolicLink()) throw new Error("vps_ssh_key_invalid");
+	}
+	const keyscanOutput = await scanHostKeys({
+		sshUser: parsedInput.sshUser,
+		sshPort: parsedInput.sshPort,
+		sshKeyPath: parsedInput.sshKeyPath
+	}, serverAddress, options);
+	const knownHostsBody = buildPinnedKnownHosts(serverAddress, parsedInput.sshPort, keyscanOutput, parsedInput.hostFingerprints);
+	options.log?.("host-keys-verified", { serverAddress });
+	const runSsh = options.runSsh ?? (async (sshInput, host, scriptBody) => {
+		const workDirectory = await mkdtemp(join(tmpdir(), "dsh-mobile-known-hosts-"));
+		try {
+			const knownHostsFile = join(workDirectory, "known_hosts");
+			await writeFile(knownHostsFile, knownHostsBody, {
+				encoding: "utf8",
+				mode: 384
+			});
+			return await defaultRunSsh(sshInput, host, scriptBody, knownHostsFile, options.log);
+		} finally {
+			await rm(workDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	});
+	options.log?.("validated", {
+		serverAddress,
+		serverPort,
+		publicOrigin,
+		sshUser: parsedInput.sshUser,
+		sshPort: parsedInput.sshPort,
+		keyProvided: parsedInput.sshKeyPath !== void 0
+	});
+	let result;
+	try {
+		options.log?.("ssh-start", {
+			serverAddress,
+			sshPort: parsedInput.sshPort
+		});
+		result = await runSsh(parsedInput, serverAddress, deploymentScript({
+			...settings,
+			serverAddress,
+			serverPort,
+			token,
+			publicOrigin
+		}));
+		options.log?.("ssh-complete", {
+			stdoutBytes: Buffer.byteLength(result.stdout),
+			stderrBytes: Buffer.byteLength(result.stderr)
+		});
+	} catch (error) {
+		if (error instanceof VpsSshError) {
+			const detail = failureDetail(error.stdout, error.stderr, token);
+			options.log?.("ssh-failed", {
+				code: error.message,
+				detail: detail || "no remote output"
+			});
+			throw new Error(detail === "" ? error.message : `${error.message}:${detail}`, { cause: error });
+		}
+		options.log?.("ssh-failed", { code: error instanceof Error ? error.message : "unknown" });
+		throw error;
+	}
+	const checks = parseChecks(result.stdout, result.stderr, token);
+	for (const check of checks) options.log?.("remote-check", {
+		id: check.id,
+		status: check.status,
+		detail: check.detail
+	});
+	if (!result.stdout.includes("DSH_MOBILE_DEPLOYMENT_OK")) {
+		if (checks.length === 0) throw new Error("vps_deploy_failed");
+		throw new Error(`vps_deploy_failed:${checks.map((check) => check.detail).join(" ")}`);
+	}
+	return Object.freeze({
+		version: 1,
+		deployed: true,
+		serverAddress,
+		publicOrigin,
+		checks
+	});
+}
+function validCertName(value) {
+	if (value === void 0 || value === "") return void 0;
+	if (typeof value !== "string" || value.length > 253 || !/^[a-z0-9.-]+$/u.test(value)) throw new Error("vps_cert_name_invalid");
+	return value.toLowerCase();
+}
+/**
+* Build a reviewable uninstall script that removes only DSH Mobile-owned
+* server artifacts: its systemd units, config, binaries, venv, renew helper,
+* managed Caddy site, owned UFW rules, and optionally its IP certificate.
+* Existing non-DSH-Mobile Caddy content and firewall rules are never touched.
+*/
+function createVpsUninstallScript(input) {
+	const serverPort = validateFrpServerPort(input.serverPort);
+	const certName = validCertName(input.certName);
+	return `#!/bin/sh
+# DSH Mobile VPS uninstall. Review before running: only files, services, and
+# firewall rules created by the DSH Mobile deployment are removed.
+set -eu
+umask 077
+
+fail() { echo "DSH_MOBILE_CHECK remote-command error $1" >&2; exit 1; }
+check() { echo "DSH_MOBILE_CHECK $1 $2 $3"; }
+
+# Same lock as the deploy script: cleanup and deployment exclude each other
+# so their Caddyfile surgeries never interleave.
+if command -v flock >/dev/null 2>&1; then
+  exec 9>/tmp/dsh-mobile-deploy.lock
+  flock -n 9 || fail "已有部署或清理正在进行，请稍后再试。"
+fi
+
+[ "$(id -u)" = "0" ] || fail "请使用 root SSH 账号。"
+command -v systemctl >/dev/null 2>&1 || fail "VPS 不支持 systemd。"
+
+# Ownership is decided before deleting anything: only an account created by a
+# DSH Mobile deployment (marker written at useradd time) may be removed below.
+owns_account=false
+if [ -f /etc/dsh-mobile/.owns-account ]; then owns_account=true; fi
+
+systemctl disable --now dsh-mobile-cert-renew.timer >/dev/null 2>&1 || true
+systemctl disable --now dsh-mobile-frps.service >/dev/null 2>&1 || true
+rm -f /etc/systemd/system/dsh-mobile-frps.service
+rm -f /etc/systemd/system/dsh-mobile-cert-renew.service
+rm -f /etc/systemd/system/dsh-mobile-cert-renew.timer
+systemctl daemon-reload
+check services ok "已停止并删除 dsh-mobile-frps 服务与证书续期定时器。"
+${certName === void 0 ? "" : `
+if [ -x /opt/dsh-mobile/certbot-venv/bin/certbot ]; then
+  /opt/dsh-mobile/certbot-venv/bin/certbot delete --cert-name ${shellQuote(certName)} --non-interactive || true
+fi
+`}
+rm -rf /etc/dsh-mobile
+rm -rf /usr/local/libexec/dsh-mobile
+rm -rf /opt/dsh-mobile/certbot-venv
+rm -f /usr/local/sbin/dsh-mobile-cert-renew
+rm -rf /var/lib/caddy/dsh-mobile-certs
+rm -f ${FRP_CADDY_SNIPPET_PATH}
+check files ok "已删除 DSH Mobile 配置、二进制与证书文件。"
+
+if grep -Eq '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile 2>/dev/null; then
+  # Rebuild without our import line (grep -v with the gate pattern, verified
+  # to remove every copy), keeping all user content byte-identical otherwise.
+  grep -Ev '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile > /etc/caddy/Caddyfile.dsh-new || true
+  if grep -Eq '^[[:space:]]*import[[:space:]]+/etc/caddy/dsh-mobile-dsh\.caddy([[:space:]]|$)' /etc/caddy/Caddyfile.dsh-new; then
+    rm -f /etc/caddy/Caddyfile.dsh-new
+    fail "Caddyfile import 移除失败，未做任何修改。"
+  fi
+  cat /etc/caddy/Caddyfile.dsh-new > /etc/caddy/Caddyfile
+  rm -f /etc/caddy/Caddyfile.dsh-new
+  if [ ! -s /etc/caddy/Caddyfile ]; then
+    printf '# DSH Mobile removed its site; the remaining Caddyfile was empty.\n' > /etc/caddy/Caddyfile
+    chmod 0644 /etc/caddy/Caddyfile
+  fi
+  if command -v caddy >/dev/null 2>&1; then
+    caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy.service || systemctl restart caddy.service || true
+  fi
+  check caddy ok "已移除 DSH Mobile 站点引入；其余 Caddy 配置保持原样。"
+elif [ -f /etc/caddy/Caddyfile ] && grep -q '^# Managed by DSH Mobile$' /etc/caddy/Caddyfile; then
+  # Legacy whole-file layout (pre-snippet releases): the entire file is ours.
+  printf '# DSH Mobile removed its site. Restore your own Caddyfile or reinstall the Caddy defaults.\\n' > /etc/caddy/Caddyfile
+  chmod 0644 /etc/caddy/Caddyfile
+  if command -v caddy >/dev/null 2>&1; then
+    caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy.service || systemctl restart caddy.service || true
+  fi
+  check caddy ok "已清空旧版 DSH Mobile 管理的 Caddy 站点；请按需恢复自己的配置。"
+else
+  check caddy ok "Caddyfile 非 DSH Mobile 管理，保持原样。"
+fi
+
+if command -v ufw >/dev/null 2>&1 && ufw status 2>/dev/null | grep -q '^Status: active'; then
+  for rule in $(ufw status numbered 2>/dev/null | grep 'DSH Mobile' | sed -E 's/^\\[ *([0-9]+)\\].*/\\1/' | sort -rn); do
+    yes | ufw delete "$rule" >/dev/null 2>&1 || true
+  done
+  check firewall ok "已删除带 DSH Mobile 标记的 UFW 规则（FRP 控制端口 ${String(serverPort)}、80、443）。"
+else
+  check firewall ok "UFW 未启用或无需调整。"
+fi
+
+if [ "$owns_account" = true ]; then
+  if id dsh-mobile >/dev/null 2>&1; then
+    if pgrep -u dsh-mobile >/dev/null 2>&1; then
+      fail "dsh-mobile 用户仍有运行中的进程，已保留该用户；请先停止相关进程后重试。"
+    fi
+    userdel dsh-mobile || fail "删除 dsh-mobile 系统用户失败。"
+    check account ok "已删除本次部署创建的 dsh-mobile 系统用户。"
+  else
+    check account ok "dsh-mobile 系统用户已不存在，无需删除。"
+  fi
+else
+  check account ok "dsh-mobile 系统用户非本次部署创建，已保留。"
+fi
+
+echo DSH_MOBILE_UNINSTALL_OK
+`;
+}
+async function runRemoteScript(input, serverAddress, script, environment, knownHostsFile, log) {
+	const ssh = process.platform === "win32" ? "ssh.exe" : "ssh";
+	const parsedInput = parseVpsDeploymentInput(input);
+	const common = sshSessionOptions(knownHostsFile);
+	if (parsedInput.sshKeyPath !== void 0) common.push("-i", parsedInput.sshKeyPath);
+	const target = `${parsedInput.sshUser}@${serverAddress}`;
+	const remoteCommand = parsedInput.sshUser === "root" ? "sh -s" : "sudo -n sh -s";
+	const envPrefix = Object.entries(environment).map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ");
+	log?.("uninstall-ssh-start", { serverAddress });
+	return await runProcess(ssh, [
+		...common,
+		"-p",
+		String(parsedInput.sshPort),
+		target,
+		`${envPrefix} ${remoteCommand}`.trim()
+	], script);
+}
+/** Remove DSH Mobile-owned server artifacts over a pinned SSH connection. */
+async function uninstallVps(serverAddress, uninstall, input, options = {}) {
+	const address = validateVpsServerTarget(serverAddress);
+	const parsedInput = parseVpsDeploymentInput(input);
+	const keyscanOutput = await scanHostKeys({
+		sshUser: parsedInput.sshUser,
+		sshPort: parsedInput.sshPort,
+		sshKeyPath: parsedInput.sshKeyPath
+	}, address, options);
+	const knownHostsBody = buildPinnedKnownHosts(address, parsedInput.sshPort, keyscanOutput, parsedInput.hostFingerprints);
+	options.log?.("host-keys-verified", { serverAddress: address });
+	const script = createVpsUninstallScript(uninstall);
+	options.log?.("uninstall-start", { serverAddress: address });
+	const runRemote = options.runRemoteScript ?? (async (sshInput, host, scriptBody) => {
+		const workDirectory = await mkdtemp(join(tmpdir(), "dsh-mobile-known-hosts-"));
+		try {
+			const knownHostsFile = join(workDirectory, "known_hosts");
+			await writeFile(knownHostsFile, knownHostsBody, {
+				encoding: "utf8",
+				mode: 384
+			});
+			return await runRemoteScript(sshInput, host, scriptBody, {}, knownHostsFile, options.log);
+		} finally {
+			await rm(workDirectory, {
+				recursive: true,
+				force: true
+			});
+		}
+	});
+	let result;
+	try {
+		result = await runRemote(parsedInput, address, script);
+	} catch (error) {
+		if (error instanceof VpsSshError) {
+			const detail = failureDetail(error.stdout, error.stderr, "");
+			const code = error.message === "vps_deploy_failed" ? "vps_uninstall_failed" : error.message;
+			options.log?.("uninstall-failed", {
+				code,
+				detail: detail || "no remote output"
+			});
+			throw new Error(detail === "" ? code : `${code}:${detail}`, { cause: error });
+		}
+		options.log?.("uninstall-failed", { code: error instanceof Error ? error.message : "unknown" });
+		throw error;
+	}
+	const checks = parseChecks(result.stdout, result.stderr, "");
+	for (const check of checks) options.log?.("remote-check", {
+		id: check.id,
+		status: check.status,
+		detail: check.detail
+	});
+	if (!result.stdout.includes("DSH_MOBILE_UNINSTALL_OK")) {
+		if (checks.length === 0) throw new Error("vps_uninstall_failed");
+		throw new Error(`vps_uninstall_failed:${checks.map((check) => check.detail).join(" ")}`);
+	}
+	return Object.freeze({
+		version: 1,
+		removed: true,
+		serverAddress: address,
+		checks
+	});
+}
 //#endregion
 //#region src/funnel.ts
 const MAX_PROTOCOL_LINE_BYTES = 16384;
@@ -7008,6 +8173,52 @@ var PluginReleaseManager = class {
 	}
 };
 //#endregion
+//#region src/file-logger.ts
+const MAX_LOG_BYTES = 5242880;
+/** Install a plugin-scoped Cordis exporter backed by a private UTF-8 log file. */
+async function installMobileFileLogger(ctx, stateDirectory) {
+	const directory = join(stateDirectory, "logs");
+	const file = join(directory, "dsh-mobile.log");
+	const previous = `${file}.1`;
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const entry = await lstat(file).catch(() => void 0);
+	if (entry !== void 0 && entry.isFile() && !entry.isSymbolicLink() && entry.size >= MAX_LOG_BYTES) {
+		await rm(previous, { force: true });
+		await rename(file, previous);
+	}
+	const stream = createWriteStream(file, {
+		flags: "a",
+		encoding: "utf8",
+		mode: 384
+	});
+	const exporter = {
+		colors: false,
+		maxLength: 16384,
+		levels: {
+			default: -1,
+			"dsh-mobile": 3
+		},
+		export(message) {
+			if (message.name !== "dsh-mobile") return;
+			const record = {
+				timestamp: new Date(message.ts).toISOString(),
+				level: message.type,
+				logger: message.name,
+				message: Logger.format(exporter, message)
+			};
+			stream.write(`${JSON.stringify(record)}\n`);
+		}
+	};
+	ctx.logger.exporter(exporter);
+	ctx.effect(() => () => {
+		stream.end();
+	}, "dsh-mobile file logger");
+	return file;
+}
+//#endregion
 //#region src/managed-setup.ts
 const VIRTUAL_INTERFACE_MARKERS = [
 	"bridge",
@@ -7248,6 +8459,7 @@ function installedDshVersion() {
 function mapAdminError(error) {
 	if (error instanceof HttpError) return error;
 	const code = error.code;
+	if (error instanceof Error && error.message.includes("spawn UNKNOWN")) return new HttpError(409, "frp_component_launch_failed");
 	if (code === "EADDRNOTAVAIL") return new HttpError(409, "network_address_changed");
 	if (code === "EADDRINUSE") return new HttpError(409, "listen_port_in_use");
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
@@ -7261,6 +8473,7 @@ function mapAdminError(error) {
 		"frp_settings_invalid"
 	].includes(error.message)) return new HttpError(400, error.message);
 	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message.startsWith("vps_")) return new HttpError(409, error.message);
 	if (error instanceof Error && error.message === "plugin_update_failed") return new HttpError(500, error.message);
 	if (error instanceof Error && error.message.startsWith("plugin_update_")) return new HttpError(409, error.message);
 	return new HttpError(500, "internal_error");
@@ -7277,6 +8490,15 @@ const SETUP_KEYS = /* @__PURE__ */ new Set([
 	"pairingCaFile",
 	"tls"
 ]);
+/** True when path names a regular file (not a directory or symlink). */
+async function existsRegularFile(path) {
+	try {
+		const info = await lstat(path);
+		return info.isFile() && !info.isSymbolicLink();
+	} catch {
+		return false;
+	}
+}
 function withoutSetupKeys(config) {
 	const merged = { ...config };
 	for (const key of SETUP_KEYS) if (key !== "version") delete merged[key];
@@ -7321,10 +8543,10 @@ async function loadSetup(config) {
 		}
 	};
 }
-function loopbackTemplate(loaded) {
+function loopbackTemplate(loaded, webServerPort) {
 	return parseGatewayConfig({
 		...withoutSetupKeys(loaded.config),
-		...loaded.kind === "managed" ? { upstreamOrigin: loaded.setup.upstreamOrigin } : loaded.config.upstreamOrigin === void 0 ? {} : { upstreamOrigin: loaded.config.upstreamOrigin },
+		...loaded.kind === "managed" ? { upstreamOrigin: loaded.setup.upstreamOrigin } : { upstreamOrigin: loaded.config.upstreamOrigin ?? `http://127.0.0.1:${String(webServerPort)}` },
 		listenHost: "127.0.0.1",
 		listenPort: 0,
 		publicAuthorities: ["127.0.0.1"],
@@ -7391,10 +8613,13 @@ async function apply(ctx, config) {
 	const dshVersion = installedDshVersion();
 	const loaded = await loadSetup(config);
 	const mobileAccess = createMobileAccessService(ctx);
-	const template = loopbackTemplate(loaded);
+	const template = loopbackTemplate(loaded, ctx.webServer.port);
 	const upstreamLoginUrl = upstreamAuthenticatedUrl(ctx, template.upstreamOrigin);
 	const instanceId = await stableInstanceId(loaded, template);
 	const stateDirectory = dirname(template.stateFile);
+	const logFile = await installMobileFileLogger(ctx, stateDirectory);
+	const logger = ctx.logger("dsh-mobile");
+	logger.info("logging initialized file=%s", logFile);
 	const remoteDirectory = join(stateDirectory, "remote");
 	const configuredDshHome = process.env.DSH_HOME?.trim();
 	const releaseManager = new PluginReleaseManager({ profileDirectory: releaseProfileDirectory(ctx, configuredDshHome === void 0 || configuredDshHome === "" ? dirname(stateDirectory) : resolve(configuredDshHome), process.argv.slice(2)) });
@@ -7621,7 +8846,14 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
-					await remoteProviders.mutate(async () => frpComponent.install());
+					logger.info("frpc component install started");
+					try {
+						await remoteProviders.mutate(async () => frpComponent.install());
+						logger.info("frpc component install completed");
+					} catch (error) {
+						logger.error("frpc component install failed: %s", error instanceof Error ? error.stack ?? error.message : String(error));
+						throw error;
+					}
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
@@ -7634,6 +8866,86 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/vps/host-keys`) {
+					const body = await readJsonObject(request, 8192);
+					const serverAddress = typeof body.serverAddress === "string" ? body.serverAddress : "";
+					logger.info("vps host keys requested host=%s sshUser=%s sshPort=%d", serverAddress, String(body.sshUser), Number(body.sshPort));
+					const hostKeys = await fetchVpsHostKeys(serverAddress, {
+						sshUser: body.sshUser,
+						sshPort: body.sshPort,
+						...body.sshKeyPath === void 0 || body.sshKeyPath === "" ? {} : { sshKeyPath: body.sshKeyPath }
+					}, { log(event, fields) {
+						logger.info("vps host keys event=%s fields=%o", event, fields);
+					} });
+					for (const key of hostKeys) logger.info("vps host key host=%s type=%s fingerprint=%s", serverAddress, key.keyType, key.fingerprint);
+					sendJson(response, 200, {
+						...remotePayload(),
+						vpsHostKeys: hostKeys
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/vps/deploy`) {
+					const body = await readJsonObject(request, 8192);
+					if (body.confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("vps deploy requested host=%s port=%d sshUser=%s sshPort=%d keyProvided=%s fingerprints=%s", String(body.serverAddress), Number(body.serverPort), String(body.sshUser), Number(body.sshPort), body.sshKeyPath === void 0 ? "false" : "true", Array.isArray(body.hostFingerprints) ? String(body.hostFingerprints.length) : "none");
+					const deployment = await remoteProviders.mutate(async () => {
+						const settings = mergeSavedFrpSettings(body, frpConfig.settings());
+						const result = await deployVps(settings, parseVpsDeploymentInput({
+							sshUser: body.sshUser,
+							sshPort: body.sshPort,
+							...body.sshKeyPath === void 0 ? {} : { sshKeyPath: body.sshKeyPath },
+							hostFingerprints: body.hostFingerprints
+						}), { log(event, fields) {
+							logger.info("vps deploy event=%s fields=%o", event, fields);
+						} });
+						await frpConfig.configure(settings);
+						logger.info("vps deploy completed host=%s origin=%s checks=%d", settings.serverAddress, settings.publicOrigin, result.checks.length);
+						return result;
+					});
+					sendJson(response, 200, {
+						...remotePayload(),
+						vpsDeployment: deployment
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/vps/uninstall-script`) {
+					const body = await readJsonObject(request, 4096);
+					const script = createVpsUninstallScript({
+						serverPort: mergeSavedFrpTarget(body, frpConfig.settings()).serverPort,
+						...body.certName === void 0 || body.certName === "" ? {} : { certName: body.certName }
+					});
+					sendJson(response, 200, {
+						...remotePayload(),
+						vpsUninstallScript: script
+					}, false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/vps/uninstall`) {
+					const body = await readJsonObject(request, 8192);
+					if (body.confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("vps uninstall requested host=%s sshUser=%s sshPort=%d", String(body.serverAddress), String(body.sshUser), Number(body.sshPort));
+					const removal = await remoteProviders.mutate(async () => {
+						const savedTarget = mergeSavedFrpTarget(body, frpConfig.settings());
+						const result = await uninstallVps(savedTarget.serverAddress, {
+							serverPort: savedTarget.serverPort,
+							...body.certName === void 0 || body.certName === "" ? {} : { certName: body.certName }
+						}, parseVpsDeploymentInput({
+							sshUser: body.sshUser,
+							sshPort: body.sshPort,
+							...body.sshKeyPath === void 0 ? {} : { sshKeyPath: body.sshKeyPath },
+							hostFingerprints: body.hostFingerprints
+						}), { log(event, fields) {
+							logger.info("vps uninstall event=%s fields=%o", event, fields);
+						} });
+						logger.info("vps uninstall completed host=%s checks=%d", result.serverAddress, result.checks.length);
+						return result;
+					});
+					sendJson(response, 200, {
+						...remotePayload(),
+						vpsUninstall: removal
+					}, false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/purge`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					await remoteProviders.mutate(async () => {
@@ -7693,16 +9005,27 @@ async function apply(ctx, config) {
 			name: "mobile",
 			description: "按需求修改 DSH Mobile 的手机端界面或添加电脑端能力",
 			input: { hint: "<要做什么>" },
-			handler: ({ agent, rawInput }) => {
+			handler: async ({ agent, rawInput }) => {
 				const task = rawInput.trim();
 				if (task === "") return {
 					kind: "error",
 					text: "请带上需求，例如：/mobile 把手机端改成深色主题"
 				};
+				const guide = buildMobileGuide({
+					directory: stateDirectory,
+					hasCustomCss: await existsRegularFile(template.customCssFile),
+					hasCustomJs: await existsRegularFile(template.customScriptFile),
+					extensions: mobileAccess.manifest().map((entry) => ({
+						id: entry.id,
+						name: entry.name,
+						version: entry.version
+					})),
+					failedExtensionCount: mobileAccess.status().failed
+				});
 				agent.steer(createUserMessage({
 					content: [{
 						type: "text",
-						text: `${MOBILE_CUSTOMIZATION_GUIDE}\n\n用户需求：${task}`
+						text: `${guide}\n\n用户需求：${task}`
 					}],
 					source: {
 						kind: "plugin",
@@ -7768,6 +9091,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isLoopbackAddress, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
+export { AUTH_PREFIX, AccessController, AccessError, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, WS_PATHS, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken };
 
 //# sourceMappingURL=index.mjs.map