dsh-mobile 0.4.1 → 0.4.2

package/lib/index.mjs

@@ -116,8 +116,10 @@ var AccessController = class {
 	async initialize() {
 		if (this.initialized || this.closing) throw new Error("access controller cannot be initialized again");
 		const snapshot = await this.store.load();
-		if (snapshot.devices.length > this.options.maxDevices) throw new Error("device state exceeds configured maxDevices");
-		this.devices = [...snapshot.devices];
+		const devices = snapshot.devices.filter((device) => device.revokedAt === void 0);
+		if (devices.length > this.options.maxDevices) throw new Error("device state exceeds configured maxDevices");
+		if (devices.length !== snapshot.devices.length) await this.store.save(this.snapshot(devices));
+		this.devices = devices;
 		this.initialized = true;
 	}
 	requireInitialized() {
@@ -312,18 +314,12 @@ var AccessController = class {
 	logout(authorization) {
 		this.removeSession(authorization.sessionKey, "logout");
 	}
-	/** Persist revocation, then end every Session owned by that device. */
+	/** Durably delete the device, then end every Session owned by that device. */
 	async revokeDevice(deviceId) {
 		this.requireInitialized();
 		return this.exclusive(async () => {
-			const index = this.devices.findIndex((device) => device.id === deviceId);
-			const device = this.devices[index];
-			if (device === void 0 || device.revokedAt !== void 0) return false;
-			const next = [...this.devices];
-			next[index] = Object.freeze({
-				...device,
-				revokedAt: this.now()
-			});
+			const next = this.devices.filter((device) => device.id !== deviceId);
+			if (next.length === this.devices.length) return false;
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
 			for (const [key, session] of this.sessions) if (session.deviceId === deviceId) this.removeSession(key, "revoked");
@@ -644,6 +640,7 @@ const Config = z.object({
 	customCssFile: z.string().hidden(),
 	customScriptFile: z.string().hidden(),
 	mobileLayoutFile: z.string().hidden(),
+	mobileCompatibilityFile: z.string().hidden(),
 	instanceId: z.string().hidden(),
 	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
@@ -769,6 +766,7 @@ function parseGatewayConfig(raw) {
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
 		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
+		mobileCompatibilityFile: value.mobileCompatibilityFile === void 0 ? fileURLToPath(new URL("./mobile-compat.js", import.meta.url)) : absoluteFile(value.mobileCompatibilityFile, "mobileCompatibilityFile"),
 		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
 			throw new Error("instanceId must be a lowercase SHA-256 value");
 		})(),
@@ -1310,6 +1308,50 @@ function assertLocalAdminTrust(request, requireBrowserOrigin) {
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 }
 //#endregion
+//#region src/mobile-compat-bootstrap.ts
+const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
+/**
+* Read one attribute out of a tag body.
+*
+* A plain `/\snonce\s*=/` search can be fooled by a value that merely contains the
+* text, and cannot tell a double-quoted attribute from a single-quoted one. Walking
+* `name=value` pairs consumes each quoted value whole, so the attribute that is
+* actually present is the one returned.
+*/
+function attributeValue(tag, name) {
+	for (const match of tag.matchAll(/([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*("[^"]*"|'[^']*')/gu)) {
+		const attribute = match[1];
+		const raw = match[2];
+		if (attribute === void 0 || raw === void 0) continue;
+		if (attribute.toLowerCase() === name) return raw.slice(1, -1);
+	}
+}
+/** Character ranges covered by an HTML comment, where markup is inert text. */
+function commentRanges(html) {
+	return [...html.matchAll(/<!--[\s\S]*?-->/gu)].map((match) => [match.index, match.index + match[0].length]);
+}
+/**
+* Load the compatibility bundle synchronously, before the first DSH script.
+*
+* Returns the HTML unchanged when there is no script to anchor to. The bundle is an
+* enhancement for WebViews without Iterator helpers, so a document this function
+* cannot place it in must still be served: throwing here took the entire dedicated
+* mobile frontend down with a 502.
+*/
+function ensureMobileCompatibility(html) {
+	const comments = commentRanges(html);
+	const isInert = (at) => comments.some(([start, end]) => at >= start && at < end);
+	const scripts = [...html.matchAll(/<script\b[^>]*>/giu)].filter((match) => !isInert(match.index));
+	if (scripts.length === 0) return html;
+	if (scripts.some((match) => attributeValue(match[0], "src") === MOBILE_COMPAT_PATH)) return html;
+	const first = scripts[0];
+	if (first === void 0) return html;
+	const nonce = attributeValue(first[0], "nonce")?.replace(/["'<>\s]/gu, "") ?? "";
+	const attribute = nonce === "" ? "" : ` nonce="${nonce}"`;
+	const script = `<script src="${MOBILE_COMPAT_PATH}"${attribute}><\/script>`;
+	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
+}
+//#endregion
 //#region src/version.ts
 const manifest = createRequire(import.meta.url)("../package.json");
 /** Version of the installed DSH Mobile plugin package. */
@@ -1492,7 +1534,7 @@ function normalizeRelativePath(value, field) {
 	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
 	return normalized;
 }
-async function regularFile$2(path, maximum, field) {
+async function regularFile$3(path, maximum, field) {
 	let info;
 	try {
 		info = await lstat(path);
@@ -1513,7 +1555,7 @@ async function containedPath(root, relativePath, maximum, field) {
 	const targetReal = await realpath(target);
 	const relation = relative(rootReal, targetReal);
 	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
-	return regularFile$2(targetReal, maximum, field);
+	return regularFile$3(targetReal, maximum, field);
 }
 async function optionalFile(root, name, maximum, field) {
 	try {
@@ -1590,7 +1632,7 @@ async function assetSnapshot(extensionRootReal) {
 }
 async function extensionFingerprint(directory) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$3(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifestBody = await readFile(manifestFile.path);
 	const manifest = parseExtensionManifest(JSON.parse(manifestBody.toString("utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
@@ -2086,7 +2128,7 @@ async function abortAndDisposeLocal(entries) {
 }
 async function loadLocalExtension(directory, context, known, parentSignal) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$3(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
 	const scriptBody = known === void 0 ? await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js").then((path) => path === void 0 ? void 0 : readFile(path)) : known.scriptBody;
@@ -2521,7 +2563,7 @@ function rewriteMobileIndexWithBatch(html) {
 	}
 	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment[0]}${JSON.stringify(parsed)};`;
 	return Object.freeze({
-		html: ensureMobileViewport(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`),
+		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`)),
 		...mobileBatch === void 0 ? {} : { batch: mobileBatch }
 	});
 }
@@ -2946,6 +2988,15 @@ var MobileAccessGateway = class {
 	server;
 	discoverySocket;
 	discoveryTimer;
+	/**
+	* Why broadcast discovery is unavailable, if it is. Windows keeps separate TCP and
+	* UDP port-exclusion tables, so the port the OS handed the TCP listener can be
+	* refused for UDP. That degradation is survivable but must stay observable: without
+	* it, "the phone cannot find this computer" has no diagnosable cause on the host.
+	*/
+	discoveryError;
+	/** Names of the bundled mobile assets that could not be read, if any. */
+	mobileAssetError;
 	bonjour;
 	pairingCaCertificate;
 	listenerPort;
@@ -3021,6 +3072,9 @@ var MobileAccessGateway = class {
 				if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey) || fingerprint !== this.config.instanceId) throw new Error("pairingCaFile must be the self-signed CA identified by instanceId");
 				this.pairingCaCertificate = certificate.raw.toString("base64");
 			}
+			const missingAssets = [];
+			for (const [label, file] of [["compatibility", this.config.mobileCompatibilityFile], ["layout", this.config.mobileLayoutFile]]) if (!(await lstat(file).catch(() => void 0))?.isFile()) missingAssets.push(label);
+			this.mobileAssetError = missingAssets.length === 0 ? void 0 : `mobile_assets_missing_${missingAssets.join("_")}`;
 			const handler = (request, response) => {
 				this.handleExternalRequest(request, response).catch((error) => {
 					const mapped = mapError(error);
@@ -3093,24 +3147,35 @@ var MobileAccessGateway = class {
 			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
 			socket.send(announcement, remote.port, remote.address, () => void 0);
 		});
-		await new Promise((resolve, reject) => {
-			const failed = (error) => {
-				reject(error);
+		const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
+		if (await new Promise((resolve) => {
+			const onBindError = (error) => {
+				socket.off("error", onBindError);
+				this.discoveryError = Object.freeze({
+					code: typeof error.code === "string" ? error.code : "unknown",
+					message: typeof error.message === "string" ? error.message : String(error)
+				});
+				resolve(false);
 			};
-			socket.once("error", failed);
-			const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
+			socket.once("error", onBindError);
 			socket.bind(port, bindHost, () => {
-				socket.off("error", failed);
+				socket.off("error", onBindError);
 				socket.setBroadcast(true);
-				resolve();
+				resolve(true);
 			});
-		});
-		const announce = () => {
-			for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
-		};
-		announce();
-		this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
-		this.discoveryTimer.unref();
+		})) {
+			const announce = () => {
+				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
+			};
+			announce();
+			this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
+			this.discoveryTimer.unref();
+		} else {
+			this.discoverySocket = void 0;
+			try {
+				socket.close();
+			} catch {}
+		}
 		const deviceName = discoveryDeviceName();
 		const bonjour = new Bonjour({ disableIPv6: true });
 		this.bonjour = bonjour;
@@ -3176,6 +3241,21 @@ var MobileAccessGateway = class {
 			origin
 		});
 	}
+	/**
+	* Report which discovery channels this gateway actually owns.
+	*
+	* Broadcast discovery degrades on its own when its UDP port cannot be bound, so
+	* callers need to tell "discovery is off" from "discovery was never attempted".
+	* mDNS is published independently and is unaffected by that failure.
+	*/
+	discoveryStatus() {
+		return Object.freeze({
+			broadcast: this.discoverySocket !== void 0 && this.discoveryTimer !== void 0,
+			mdns: this.bonjour !== void 0,
+			...this.discoveryError === void 0 ? {} : { errorCode: `discovery_broadcast_${this.discoveryError.code}` },
+			...this.mobileAssetError === void 0 ? {} : { mobileAssetsErrorCode: this.mobileAssetError }
+		});
+	}
 	requirePolicy() {
 		if (this.policy === void 0 || this.closing) throw new HttpError(503, "unavailable");
 		return this.policy;
@@ -3414,6 +3494,10 @@ var MobileAccessGateway = class {
 			file: this.config.mobileLayoutFile,
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
+		} : target.decodedPathname === MOBILE_COMPAT_PATH ? {
+			file: this.config.mobileCompatibilityFile,
+			contentType: "text/javascript; charset=utf-8",
+			fallback: void 0
 		} : void 0 : void 0;
 		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST" && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
@@ -4402,7 +4486,8 @@ var MobileAccessGateway = class {
 								connections: this.connectedSockets.size,
 								activeRequests: this.activeRequests.size,
 								webSockets: this.activeWebSockets.size
-							}
+							},
+							discovery: this.discoveryStatus()
 						}, false);
 						return;
 					}
@@ -4693,11 +4778,11 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_darwin_arm64.tar.gz`
 	}
 ].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
-function inside$1(parent, child) {
+function inside$2(parent, child) {
 	const candidate = relative(parent, child);
 	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
 }
-async function regularFile$1(file) {
+async function regularFile$2(file) {
 	try {
 		const entry = await lstat(file);
 		return entry.isFile() && !entry.isSymbolicLink();
@@ -4737,7 +4822,7 @@ async function replaceDirectory(target, candidate) {
 		});
 	}
 }
-function sha256$1(bytes) {
+function sha256$2(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
 async function runCapture(file, args) {
@@ -4789,10 +4874,10 @@ async function defaultExtractArtifact$1(archive, destination, executableName) {
 		executableEntry
 	]);
 	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
-	if (!await regularFile$1(extracted)) throw new Error("frp_archive_executable_invalid");
+	if (!await regularFile$2(extracted)) throw new Error("frp_archive_executable_invalid");
 	await copyFile(extracted, join(destination, executableName));
 }
-async function defaultFetchArtifact$1(artifact, signal) {
+async function defaultFetchArtifact$2(artifact, signal) {
 	const response = await fetch(artifact.downloadUrl, {
 		redirect: "follow",
 		signal
@@ -4861,14 +4946,14 @@ var FrpComponentManager = class {
 			this.componentStorage,
 			this.logRoot,
 			this.stagingRoot
-		]) if (!inside$1(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
-		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+		]) if (!inside$2(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$2;
 		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
 		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
 	}
 	/** Inspect the managed executable without relying on global FRP installations. */
 	async initialize() {
-		this.installed = await regularFile$1(this.executable);
+		this.installed = await regularFile$2(this.executable);
 		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
 		if (this.installed) try {
 			if (await this.inspectExecutable(this.executable) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
@@ -4915,7 +5000,7 @@ var FrpComponentManager = class {
 					clearTimeout(timeout);
 				}
 				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
-				if (sha256$1(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
+				if (sha256$2(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
 				const archive = join(staging, artifact.archiveName);
 				await writeFile(archive, bytes, {
 					flag: "wx",
@@ -4923,7 +5008,7 @@ var FrpComponentManager = class {
 				});
 				await this.extractArtifact(archive, staging, artifact.executableName);
 				const extracted = join(staging, artifact.executableName);
-				if (!await regularFile$1(extracted)) throw new Error("frp_executable_missing");
+				if (!await regularFile$2(extracted)) throw new Error("frp_executable_missing");
 				await chmod(extracted, 448);
 				if (await this.inspectExecutable(extracted) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
@@ -5179,8 +5264,8 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
 }
 //#endregion
 //#region src/frp-config.ts
-const MAX_SETTINGS_BYTES = 8192;
-function hostname$1(value) {
+const MAX_SETTINGS_BYTES$1 = 8192;
+function hostname$2(value) {
 	if (value.length > 253 || !value.includes(".")) return false;
 	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
 }
@@ -5188,7 +5273,7 @@ function hostname$1(value) {
 function validateFrpServerAddress(value) {
 	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
 	const normalized = value.toLowerCase().replace(/\.$/u, "");
-	if (isIP(normalized) === 0 && !hostname$1(normalized)) throw new Error("frp_server_address_invalid");
+	if (isIP(normalized) === 0 && !hostname$2(normalized)) throw new Error("frp_server_address_invalid");
 	return normalized;
 }
 /** Validate the FRP control port. */
@@ -5211,7 +5296,7 @@ function validateFrpPublicOrigin(value) {
 		throw new Error("frp_public_origin_invalid");
 	}
 	const publicHost = url.hostname;
-	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$1(publicHost)) throw new Error("frp_public_origin_invalid");
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$2(publicHost)) throw new Error("frp_public_origin_invalid");
 	if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
 	return url.origin;
 }
@@ -5290,7 +5375,7 @@ function createFrpcToml(settings, localPort) {
 function createFrpServerTemplate(settings) {
 	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin);
 }
-async function atomicPrivateWrite(file, body) {
+async function atomicPrivateWrite$2(file, body) {
 	const directory = dirname(file);
 	await mkdir(directory, {
 		recursive: true,
@@ -5338,7 +5423,7 @@ var FrpConfigStore = class {
 			if (error.code === "ENOENT") return;
 			throw error;
 		}
-		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES$1) {
 			this.errorCode = "frp_config_invalid";
 			return;
 		}
@@ -5373,7 +5458,7 @@ var FrpConfigStore = class {
 	/** Atomically replace private FRP settings. */
 	async configure(value) {
 		const settings = parseFrpSettings(value);
-		await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		await atomicPrivateWrite$2(this.settingsFile, `${JSON.stringify(settings)}\n`);
 		await rm(this.runtimeConfigFile, { force: true });
 		this.settingsValue = settings;
 		this.errorCode = void 0;
@@ -5383,7 +5468,7 @@ var FrpConfigStore = class {
 	async writeRuntimeConfig(localPort) {
 		const settings = this.settingsValue;
 		if (settings === void 0) throw new Error("frp_config_missing");
-		await atomicPrivateWrite(this.runtimeConfigFile, createFrpcToml(settings, localPort));
+		await atomicPrivateWrite$2(this.runtimeConfigFile, createFrpcToml(settings, localPort));
 		return this.runtimeConfigFile;
 	}
 	/** Remove only configuration files owned by the FRP provider. */
@@ -5399,11 +5484,13 @@ var FrpConfigStore = class {
 };
 //#endregion
 //#region src/remote.ts
-const REMOTE_PROVIDERS = [
+const REMOTE_PROVIDERS = Object.freeze([
 	"tailscale",
 	"cpolar",
-	"frp"
-];
+	"cloudflared",
+	"frp",
+	"origin"
+]);
 function aggregateErrors(errors, message) {
 	if (errors.length === 0) return void 0;
 	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
@@ -5529,7 +5616,7 @@ async function terminateRemoteProcess(child, gracefulTimeoutMs = 1500, forcedTim
 function parseRemoteProviderState(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
 	const record = value;
-	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "frp" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "cloudflared" && record.provider !== "frp" && record.provider !== "origin" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
 	return Object.freeze({
 		version: 1,
 		provider: record.provider
@@ -5595,17 +5682,17 @@ var JsonRemoteProviderStore = class {
 /** Resolve the first-run provider without letting environment values bypass validation. */
 function configuredRemoteProvider(environment) {
 	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
-	if (value !== "tailscale" && value !== "cpolar" && value !== "frp") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, or frp");
+	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, or origin");
 	return value;
 }
 //#endregion
 //#region src/frp.ts
-const START_TIMEOUT_MS$1 = 45e3;
+const START_TIMEOUT_MS$2 = 45e3;
 const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
 const DISCOVERY_RETRY_MS = 1e3;
 const MAX_DISCOVERY_BYTES = 16384;
 const VHOST_PROBE_TIMEOUT_MS = 1500;
-function publicStatus$2(status) {
+function publicStatus$3(status) {
 	return Object.freeze({
 		enabled: status.enabled,
 		state: status.state,
@@ -5741,7 +5828,7 @@ var FrpController = class {
 	child;
 	gatewayValue;
 	generation = 0;
-	latest = publicStatus$2({
+	latest = publicStatus$3({
 		enabled: false,
 		state: "off"
 	});
@@ -5769,7 +5856,7 @@ var FrpController = class {
 	}
 	/** Return state safe for the desktop control UI. */
 	status() {
-		return publicStatus$2(this.latest);
+		return publicStatus$3(this.latest);
 	}
 	/** Enable or disable FRP without changing LAN or another provider. */
 	async setEnabled(enabled) {
@@ -5835,7 +5922,7 @@ var FrpController = class {
 		return task;
 	}
 	publish(status) {
-		this.latest = publicStatus$2(status);
+		this.latest = publicStatus$3(status);
 		try {
 			this.options.onStatus?.(this.status());
 		} catch {}
@@ -5950,7 +6037,7 @@ var FrpController = class {
 		this.waitForDiscovery(generation, settings.publicOrigin, controller.signal);
 	}
 	async waitForDiscovery(generation, origin, signal) {
-		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$1);
+		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$2);
 		const probe = this.options.probeDiscovery ?? defaultProbeDiscovery;
 		while (!signal.aborted && Date.now() < deadline) {
 			try {
@@ -6017,180 +6104,1488 @@ var FrpController = class {
 	}
 };
 //#endregion
-//#region src/task-events.ts
-const TASK_EVENT_DEBOUNCE_MS = 1e3;
-function turnNumber(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
-}
-function turnData(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
-		turn: 0,
-		completed: false
-	};
-	const record = value;
-	const reason = record.reason;
-	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
-	return {
-		turn: turnNumber(record.turn),
-		completed
-	};
-}
+//#region src/origin-proxy-config.ts
+const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
+const MAX_SETTINGS_BYTES = 8192;
 /**
-* Subscribe to completed root turns. Subagent turns are skipped so one task
-* announces once, and rapid turn boundaries collapse into a single event.
-* Returns a disposer that also drops pending debounces.
+* Ports a user-space listener can actually hold on every supported platform. Below
+* this the bind needs privileges on Linux and macOS and fails with EACCES, which
+* surfaces as a generic start failure rather than a rejected choice.
 */
-function watchTaskCompletions(ctx, options) {
-	const debounceMs = options.debounceMs ?? 1e3;
-	const pending = /* @__PURE__ */ new Map();
-	const disposeListener = ctx.on("session/event", (session, event) => {
-		if (event.type !== "turn/end") return;
-		const { turn, completed } = turnData(event.data);
-		if (!completed) return;
-		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
-		const sessionId = String(session.id);
-		options.log?.("task-completed-observed", {
-			sessionId,
-			turn
-		});
-		const previous = pending.get(sessionId);
-		if (previous !== void 0) clearTimeout(previous);
-		pending.set(sessionId, setTimeout(() => {
-			pending.delete(sessionId);
-			options.log?.("task-completed-announced", {
-				sessionId,
-				turn
-			});
-			options.onTaskCompleted(Object.freeze({
-				sessionId,
-				turn
-			}));
-		}, debounceMs));
-	});
-	return () => {
-		disposeListener();
-		for (const timer of pending.values()) clearTimeout(timer);
-		pending.clear();
-	};
+const MIN_ORIGIN_LISTEN_PORT = 1024;
+/** The LAN gateway's HTTPS port, held for as long as DSH runs. */
+const RESERVED_LAN_GATEWAY_PORT$1 = 3443;
+/** DSH's own WebServer port; the plugin cannot function while it is taken. */
+const RESERVED_DSH_WEB_PORT = 3080;
+const PRIVATE_NETWORKS = [
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16"
+].map(parseCidr);
+const TRUSTED_NETWORKS = [...PRIVATE_NETWORKS, parseCidr("127.0.0.0/8")];
+/** Require a public HTTPS origin; custom external ports are supported. */
+function validateOriginPublicOrigin(value) {
+	if (typeof value !== "string" || value.length > 512 || /[\s\u0000-\u001f\u007f\\@?#]/u.test(value)) throw new Error("origin_public_origin_invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("origin_public_origin_invalid");
+	}
+	const host = url.hostname;
+	const validHostname = host.length <= 253 && host.includes(".") && host.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label)) && ![
+		"localhost",
+		"local",
+		"lan",
+		"home",
+		"internal",
+		"home.arpa"
+	].some((suffix) => host === suffix || host.endsWith("." + suffix));
+	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
+	return url.origin;
 }
-/** One subscription feeding every live gateway; gateways register on start. */
-var TaskEventHub = class {
-	sinks = /* @__PURE__ */ new Set();
-	/** Register a sink; returns its disposer. */
-	add(sink) {
-		this.sinks.add(sink);
-		return () => {
-			this.sinks.delete(sink);
-		};
-	}
-	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
-	broadcast(event) {
-		for (const sink of [...this.sinks]) try {
-			sink.broadcastTaskEvent(event);
-		} catch {}
-	}
-	/** Visible for tests. */
-	get size() {
-		return this.sinks.size;
+/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+function validateOriginListenHost(value) {
+	if (typeof value !== "string" || isIP(value) !== 4 || !isLoopbackAddress(value) && !addressAllowed(value, PRIVATE_NETWORKS)) throw new Error("origin_listen_host_invalid");
+	return value;
+}
+function validateOriginListenPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
+	if (value === RESERVED_LAN_GATEWAY_PORT$1 || value === RESERVED_DSH_WEB_PORT) throw new Error("origin_listen_port_reserved");
+	return Number(value);
+}
+/** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
+function validateOriginAllowedCidrs(value, listenHost) {
+	const input = value === void 0 && isLoopbackAddress(listenHost) ? ["127.0.0.0/8"] : value;
+	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
+	const cidrs = [];
+	for (const entry of input) {
+		if (typeof entry !== "string" || entry.length > 64 || isIP(entry.split("/")[0] ?? "") !== 4) throw new Error("origin_allowed_cidrs_invalid");
+		try {
+			const cidr = parseCidr(entry);
+			if (cidr.bits !== 32 || !TRUSTED_NETWORKS.some((range) => cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
+			cidrs.push(cidr.source);
+		} catch {
+			throw new Error("origin_allowed_cidrs_invalid");
+		}
 	}
-};
-//#endregion
-//#region src/diagnostics.ts
-const REMOTE_ERROR_GUIDANCE = Object.freeze({
-	component_missing: "重新安装完整插件包。",
-	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
-	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
-	funnel_start_failed: "重新打开授权页并允许 Funnel。",
-	funnel_start_timeout: "检查网络后点击“重新连接”。",
-	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
-	sidecar_launch_failed: "重新安装完整插件包后重试。",
-	sidecar_stopped: "点击“重新连接”。",
-	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	control_channel_failed: "点击“重新连接”。",
-	cpolar_component_missing: "先安装 cpolar 官方组件。",
-	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
-	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
-	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
-	cpolar_start_timeout: "检查网络后点击“重新连接”。",
-	cpolar_stopped: "点击“重新连接”。",
-	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
-	frp_component_missing: "先安装 FRP 官方组件。",
-	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
-	frp_config_missing: "先保存自建 FRP 连接配置。",
-	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
-	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
-	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
-	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
-	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
-	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
-	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
-	frp_stopped: "点击“重新连接”。",
-	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
-	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
-});
-function check(id, status, reason, label, detail, action, facts) {
+	if (!isLoopbackAddress(listenHost) && !cidrs.some((cidr) => !isLoopbackAddress(cidr.split("/")[0]))) throw new Error("origin_allowed_cidrs_invalid");
+	return Object.freeze([...new Set(cidrs)]);
+}
+/** Validate both saved settings and local administrative requests. */
+function parseOriginSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("origin_settings_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"version",
+		"publicOrigin",
+		"listenHost",
+		"listenPort",
+		"allowedCidrs"
+	].includes(String(key))) || record.version !== void 0 && record.version !== 1) throw new Error("origin_settings_invalid");
+	const listenHost = validateOriginListenHost(record.listenHost === void 0 ? "127.0.0.1" : record.listenHost);
 	return Object.freeze({
-		id,
-		status,
-		reason,
-		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
-		label,
-		detail,
-		...action === void 0 ? {} : { action }
+		version: 1,
+		publicOrigin: validateOriginPublicOrigin(record.publicOrigin),
+		listenHost,
+		listenPort: validateOriginListenPort(record.listenPort === void 0 ? DEFAULT_ORIGIN_LISTEN_PORT : record.listenPort),
+		allowedCidrs: validateOriginAllowedCidrs(record.allowedCidrs, listenHost)
 	});
 }
-function maskLanOrigin(origin) {
-	if (origin === void 0) return "未分配";
+async function atomicPrivateWrite$1(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
 	try {
-		const url = new URL(origin);
-		const octets = url.hostname.split(".");
-		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
-		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
-	} catch {
-		return "地址格式无效";
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("origin_config_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
 	}
-}
-function remoteSuffix(origin) {
-	if (origin === void 0) return "未分配";
+	const temporary = join(directory, "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
 	try {
-		const hostname = new URL(origin).hostname;
-		if (hostname.endsWith(".ts.net")) return "*.ts.net";
-		for (const suffix of [
-			".cpolar.cn",
-			".cpolar.io",
-			".cpolar.top",
-			".cpolar.com"
-		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
-		return "公共 HTTPS 地址";
-	} catch {
-		return "地址格式无效";
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
 	}
 }
-function defaultFirewallProbe(platform = process.platform) {
-	return async (port) => {
-		if (platform !== "win32") return { state: "not-applicable" };
-		if (port === void 0) return { state: "unknown" };
-		const script = [
-			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
-			"$ready = $true",
-			"$specs | ForEach-Object {",
-			"  $spec = $_",
-			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
-			"  if ($null -eq $rule) { $ready = $false; return }",
-			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
-			`  $matching = @($filters | Where-Object { $_.Protocol -eq $spec.Protocol -and ($_.LocalPort -eq 'Any' -or $_.LocalPort -eq '${String(port)}') })`,
-			"  if ($matching.Count -eq 0) { $ready = $false }",
-			"}",
-			"if ($ready) { 'ready' } else { 'missing' }"
-		].join("; ");
+/** Owns only origin settings; shared paired-device storage is never removed. */
+var OriginConfigStore = class {
+	stateRoot;
+	settingsFile;
+	settingsValue;
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("origin config state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "settings.json");
+	}
+	async initialize() {
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		let entry;
 		try {
-			return { state: (await execFileText("powershell.exe", [
-				"-NoProfile",
-				"-NonInteractive",
-				"-Command",
-				script
-			], {
-				encoding: "utf8",
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+			this.errorCode = "origin_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseOriginSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+		} catch {
+			this.errorCode = "origin_config_invalid";
+		}
+	}
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			configured: settings !== void 0,
+			...settings === void 0 ? {} : {
+				publicOrigin: settings.publicOrigin,
+				listenHost: settings.listenHost,
+				listenPort: settings.listenPort,
+				allowedCidrs: settings.allowedCidrs,
+				backendOrigin: "http://" + settings.listenHost + ":" + String(settings.listenPort)
+			},
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	settings() {
+		return this.settingsValue;
+	}
+	async configure(value) {
+		const settings = parseOriginSettings(value);
+		await atomicPrivateWrite$1(this.settingsFile, JSON.stringify(settings) + "\n");
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	async purge() {
+		await rm(this.settingsFile, { force: true });
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/origin-proxy.ts
+/** Owns an authenticated HTTP gateway, with no tunnel process or public network probes. */
+var OriginController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	gatewayValue;
+	latest = Object.freeze({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	async initialize() {
+		await this.enqueue(async () => {
+			if (this.disposed) throw new Error("origin_controller_unavailable");
+			if (this.initialized) return;
+			this.enabled = (await this.options.store.load()).enabled;
+			this.initialized = true;
+			if (this.enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+	}
+	gateway() {
+		return this.gatewayValue;
+	}
+	status() {
+		return this.latest;
+	}
+	async setEnabled(enabled) {
+		this.assertAvailable();
+		await this.enqueue(async () => {
+			this.assertAvailable();
+			if (this.enabled === enabled && (!enabled || this.gatewayValue !== void 0)) return;
+			if (!enabled) await this.stop();
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			this.enabled = enabled;
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	async reconnect() {
+		this.assertAvailable();
+		await this.enqueue(async () => {
+			this.assertAvailable();
+			if (!this.enabled) {
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+				this.enabled = true;
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Reset the switch, retaining both settings and shared remote device pairings. */
+	async reset() {
+		return this.setEnabled(false);
+	}
+	/** Stop the listener without changing the durable switch. */
+	async close() {
+		this.disposed = true;
+		await this.enqueue(async () => {
+			await this.stop();
+			this.publish({
+				enabled: this.enabled,
+				state: "off"
+			});
+		});
+	}
+	assertAvailable() {
+		if (!this.initialized || this.disposed) throw new Error("origin_controller_unavailable");
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = Object.freeze({ ...status });
+		try {
+			this.options.onStatus?.(this.latest);
+		} catch {}
+	}
+	async start() {
+		const settings = this.options.config.settings();
+		if (settings === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: this.options.config.status().errorCode ?? "origin_config_missing"
+			});
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin: settings.publicOrigin
+		});
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(settings);
+		} catch (error) {
+			const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: code === "EADDRINUSE" ? "origin_listen_port_in_use" : code === "EADDRNOTAVAIL" ? "origin_listen_address_unavailable" : "origin_gateway_start_failed"
+			});
+			return;
+		}
+		this.gatewayValue = gateway;
+		if (this.disposed) {
+			await this.stop();
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin: settings.publicOrigin,
+			backendOrigin: "http://" + settings.listenHost + ":" + String(gateway.address().port)
+		});
+	}
+	async stop() {
+		const gateway = this.gatewayValue;
+		if (gateway === void 0) return;
+		await gateway.close();
+		this.gatewayValue = void 0;
+		this.publish({
+			enabled: this.enabled,
+			state: "off"
+		});
+	}
+};
+//#endregion
+//#region src/component-download.ts
+/**
+* Hosts a pinned GitHub release download may redirect to.
+*
+* `github.com/<owner>/<repo>/releases/download/<tag>/<asset>` does not serve the bytes itself: it
+* answers 302 with a signed URL on a release-asset host. A fetch configured with
+* `redirect: 'error'` fails that hop as `TypeError: fetch failed` (cause: `unexpected redirect`)
+* before a single byte is transferred, which is exactly how the cloudflared component could never
+* install. Following one validated hop keeps the origin restriction while allowing the shape
+* every GitHub release download uses.
+*/
+const RELEASE_ASSET_HOSTS = Object.freeze(["release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
+/** Follow one redirect hop after checking its scheme and host. A second hop is refused. */
+async function followValidatedRedirect(response, request) {
+	const location = response.headers.get("location");
+	if (location === null) throw new Error(`${request.errorPrefix}_download_redirect_missing`);
+	let target;
+	try {
+		target = new URL(location, request.url);
+	} catch {
+		throw new Error(`${request.errorPrefix}_download_redirect_invalid`);
+	}
+	const hosts = request.redirectHosts ?? RELEASE_ASSET_HOSTS;
+	if (target.protocol !== "https:" || !hosts.includes(target.hostname)) throw new Error(`${request.errorPrefix}_download_redirect_rejected`);
+	return fetch(target, {
+		redirect: "error",
+		signal: request.signal
+	});
+}
+/** Attempts per install. A 55 MB transfer through a TUN proxy can reset mid-stream: the first
+* real run in the development environment failed after 1.5 MB and succeeded on the next attempt,
+* which is exactly the confusing "nothing happened" the user saw. */
+const DOWNLOAD_ATTEMPTS = 2;
+const RETRY_DELAY_MS = 750;
+/** Whether a failure is a transport problem worth a second attempt rather than a verdict. */
+function isRetryable(error) {
+	if (error instanceof TypeError) return true;
+	if (error instanceof Error && /_download_http_5\d\d$/u.test(error.message)) return true;
+	return false;
+}
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+async function attemptDownload(request) {
+	const first = await fetch(request.url, {
+		redirect: "manual",
+		signal: request.signal
+	});
+	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
+	if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
+	const declared = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	return bytes;
+}
+/**
+* Download a pinned artifact, following at most one validated redirect, and check its exact length.
+* A transport failure is retried once; a length or redirect verdict is not. The caller still
+* verifies the SHA-256 before publishing anything.
+* @param request - the pinned URL, its exact byte length and the caller's error prefix.
+* @returns the artifact bytes.
+*/
+async function downloadPinnedArtifact(request) {
+	let lastError;
+	for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt += 1) try {
+		return await attemptDownload(request);
+	} catch (error) {
+		lastError = error;
+		if (attempt === DOWNLOAD_ATTEMPTS || !isRetryable(error)) throw error;
+		await delay(RETRY_DELAY_MS);
+	}
+	throw lastError;
+}
+//#endregion
+//#region src/cloudflared-component.ts
+/**
+* Pinned cloudflared Windows component fetched only after an explicit user action.
+*
+* Unlike the cpolar archive this artifact IS the executable: there is nothing to
+* unpack, so the download digest and the installed digest are the same pair.
+* `--no-autoupdate` is passed at runtime as well, so the pinned bytes stay the
+* bytes that were verified.
+*/
+const CLOUDFLARED_COMPONENT_RELEASE = Object.freeze({
+	version: "2026.9.1",
+	platform: "win32",
+	arch: "x64",
+	downloadUrl: "https://github.com/cloudflare/cloudflared/releases/download/2026.9.1/cloudflared-windows-amd64.exe",
+	downloadBytes: 54976432,
+	downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
+	downloadPage: "https://github.com/cloudflare/cloudflared/releases",
+	termsUrl: "https://www.cloudflare.com/website-terms/"
+});
+function inside$1(parent, child) {
+	const candidate = relative(parent, child);
+	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
+}
+async function sha256$1(file) {
+	return createHash("sha256").update(await readFile(file)).digest("hex");
+}
+async function regularFile$1(file, expectedBytes) {
+	try {
+		const stat = await lstat(file);
+		return stat.isFile() && !stat.isSymbolicLink() && (expectedBytes === void 0 || stat.size === expectedBytes);
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function defaultFetchArtifact$1(url, signal) {
+	return downloadPinnedArtifact({
+		url,
+		expectedBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
+		errorPrefix: "cloudflared",
+		signal
+	});
+}
+/** Owns the optional cloudflared binary inside DSH Mobile state. */
+var CloudflaredComponentManager = class {
+	executable;
+	componentRoot;
+	componentStorage;
+	stateRoot;
+	logRoot;
+	stagingRoot;
+	platform;
+	arch;
+	fetchArtifact;
+	installed = false;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		const stateDirectory = resolve(options.stateDirectory);
+		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared state directory must be absolute");
+		this.platform = options.platform ?? process.platform;
+		this.arch = options.arch ?? process.arch;
+		this.componentRoot = join(stateDirectory, "components", "cloudflared");
+		this.componentStorage = join(this.componentRoot, CLOUDFLARED_COMPONENT_RELEASE.version);
+		this.executable = join(this.componentStorage, "cloudflared.exe");
+		this.stateRoot = join(stateDirectory, "state", "cloudflared");
+		this.logRoot = join(stateDirectory, "logs", "cloudflared");
+		this.stagingRoot = join(stateDirectory, "staging", "cloudflared");
+		for (const child of [
+			this.componentRoot,
+			this.componentStorage,
+			this.stateRoot,
+			this.logRoot,
+			this.stagingRoot
+		]) if (!inside$1(stateDirectory, child)) throw new Error("cloudflared component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+	}
+	/** Inspect the managed binary without using any global cloudflared state. */
+	async initialize() {
+		this.installed = await regularFile$1(this.executable, CLOUDFLARED_COMPONENT_RELEASE.downloadBytes);
+		if (this.installed && await sha256$1(this.executable) !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) {
+			this.installed = false;
+			this.errorCode = "cloudflared_component_invalid";
+		}
+	}
+	/** Return a safe status that never includes machine-specific account data. */
+	status() {
+		return Object.freeze({
+			supported: this.platform === CLOUDFLARED_COMPONENT_RELEASE.platform && this.arch === CLOUDFLARED_COMPONENT_RELEASE.arch,
+			installed: this.installed,
+			version: CLOUDFLARED_COMPONENT_RELEASE.version,
+			downloadBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
+			installedBytes: CLOUDFLARED_COMPONENT_RELEASE.downloadBytes,
+			sourceUrl: CLOUDFLARED_COMPONENT_RELEASE.downloadUrl,
+			downloadPage: CLOUDFLARED_COMPONENT_RELEASE.downloadPage,
+			termsUrl: CLOUDFLARED_COMPONENT_RELEASE.termsUrl,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Download, verify, and install the pinned cloudflared executable after explicit confirmation. */
+	install() {
+		return this.enqueue(async () => {
+			if (this.platform !== CLOUDFLARED_COMPONENT_RELEASE.platform || this.arch !== CLOUDFLARED_COMPONENT_RELEASE.arch) throw new Error("cloudflared_component_unsupported");
+			await mkdir(this.stagingRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 3e5);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(CLOUDFLARED_COMPONENT_RELEASE.downloadUrl, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (bytes.byteLength !== CLOUDFLARED_COMPONENT_RELEASE.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
+				if (createHash("sha256").update(bytes).digest("hex") !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
+				const staged = join(staging, "cloudflared.exe");
+				await writeFile(staged, bytes, {
+					flag: "wx",
+					mode: 384
+				});
+				await chmod(staged, 448);
+				if (!await regularFile$1(staged, CLOUDFLARED_COMPONENT_RELEASE.downloadBytes) || await sha256$1(staged) !== CLOUDFLARED_COMPONENT_RELEASE.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
+				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+				await mkdir(candidate, {
+					recursive: true,
+					mode: 448
+				});
+				await copyFile(staged, join(candidate, "cloudflared.exe"));
+				await chmod(join(candidate, "cloudflared.exe"), 448);
+				await rm(this.componentStorage, {
+					recursive: true,
+					force: true
+				});
+				await rename(candidate, this.componentStorage);
+				this.installed = true;
+				this.errorCode = void 0;
+			} finally {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+			}
+		});
+	}
+	/** Remove every cloudflared file owned by DSH Mobile without touching global state. */
+	purge() {
+		return this.enqueue(async () => {
+			await Promise.all([
+				rm(this.componentRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stateRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.logRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stagingRoot, {
+					recursive: true,
+					force: true
+				})
+			]);
+			this.installed = false;
+			this.errorCode = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+//#endregion
+//#region src/cloudflared.ts
+const MAX_LOG_BUFFER_BYTES$1 = 65536;
+/**
+* A quick tunnel has to be allocated and registered with the Cloudflare edge
+* before the public hostname appears. That is slower than a cpolar control
+* handshake but still bounded; 60 s keeps a genuinely stalled client from
+* looking healthy for longer than a user will wait.
+*/
+const START_TIMEOUT_MS$1 = 6e4;
+const CLOUDFLARED_HOST_SUFFIX = ".trycloudflare.com";
+/**
+* Subdomains Cloudflare reserves for its own control plane.
+*
+* The quick-tunnel banner prints `https://api.trycloudflare.com` (the registration API) before it
+* prints the tunnel's own hostname, and that address satisfies a bare suffix check. Adopting it
+* would put the API host in the pairing QR code, where the phone gets `{"code":10005","message":
+* "Method Not Allowed"}` instead of DSH. A quick tunnel is always one random label under the
+* suffix, so the reserved single labels are refused outright.
+*/
+const RESERVED_CLOUDFLARED_LABELS = Object.freeze([
+	"api",
+	"www",
+	"update",
+	"login"
+]);
+function publicStatus$2(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+/**
+* Whether a hostname is a quick-tunnel host: exactly one random label under the provider suffix,
+* never one of the reserved control-plane labels.
+*/
+function isCloudflaredHost(hostname) {
+	const lower = hostname.toLowerCase();
+	if (!lower.endsWith(CLOUDFLARED_HOST_SUFFIX)) return false;
+	const label = lower.slice(0, -18);
+	return label !== "" && !label.includes(".") && !RESERVED_CLOUDFLARED_LABELS.includes(label);
+}
+/**
+* Extract a validated public HTTPS origin from one cloudflared output line.
+*
+* Quick tunnels print the public hostname inside a decorated banner, so the
+* candidate is taken from the line and then re-parsed as a URL: a lookalike such
+* as `https://x.trycloudflare.com.evil.test` fails the hostname check instead of
+* being truncated into an accepted origin.
+*/
+function parseCloudflaredOrigin(line) {
+	if (!line.toLowerCase().includes("trycloudflare.com")) return void 0;
+	const match = /https?:\/\/[^\s"'|<>]+/u.exec(line);
+	if (match === null) return void 0;
+	const candidate = match[0].replace(/[),.;:]+$/u, "");
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		throw new Error("invalid_cloudflared_origin");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || !isCloudflaredHost(url.hostname) || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new Error("invalid_cloudflared_origin");
+	return url.origin;
+}
+/**
+* Whether one cloudflared log line reports an established edge connection.
+*
+* A named tunnel prints no banner, so registration is the only signal that the
+* connector reached Cloudflare and the public hostname can serve traffic. Both
+* the current and the older wording are accepted; anything else is ignored so a
+* chatty log line cannot be mistaken for readiness.
+*/
+function isCloudflaredRegistration(line) {
+	return /registered tunnel connection/iu.test(line) || /connection\s+[0-9a-f][0-9a-f-]{7,}\s+registered/iu.test(line);
+}
+async function reserveLoopbackPort$1(requestedPort) {
+	const server = createServer((socket) => {
+		socket.destroy();
+	});
+	await new Promise((resolveListen, reject) => {
+		server.once("error", reject);
+		server.listen(requestedPort ?? 0, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolveListen();
+		});
+	});
+	const address = server.address();
+	if (address === null || typeof address === "string") {
+		server.close();
+		throw new Error("cloudflared_port_reservation_failed");
+	}
+	let released = false;
+	return {
+		port: address.port,
+		release: async () => {
+			if (released) return;
+			released = true;
+			await new Promise((resolveClose) => {
+				server.close(() => resolveClose());
+			});
+		}
+	};
+}
+function spawnCloudflaredProcess(executable, args, environment) {
+	return spawn(executable, [...args], {
+		env: environment,
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+}
+function withoutProxyEnvironment$1(environment) {
+	const blocked = /* @__PURE__ */ new Set([
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY",
+		"NO_PROXY"
+	]);
+	return Object.fromEntries(Object.entries(environment).filter(([name]) => !blocked.has(name.toUpperCase())));
+}
+/**
+* Owns an installed cloudflared client and a provider-specific DSH remote gateway.
+*
+* Quick tunnels allocate a random hostname and a random forward port on every
+* start. Named tunnels instead read an account token and a stable public
+* hostname from the tunnel store, forward to the configured loopback port, and
+* learn readiness from the connector's registration line rather than a banner.
+*/
+var CloudflaredController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	reservation;
+	generation = 0;
+	buffer = "";
+	mode = "quick";
+	namedOrigin;
+	latest = publicStatus$2({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	startupTimer;
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable)) throw new Error("cloudflared executable path must be absolute");
+	}
+	/** Restore the remembered cloudflared switch independently from LAN and other providers. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the active cloudflared-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return publicStatus$2(this.latest);
+	}
+	/** Enable or disable cloudflared without changing LAN or other provider state. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart cloudflared and allocate a fresh quick tunnel. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable cloudflared without deleting the installed component. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop owned resources without changing the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$2(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let executableEntry;
+		try {
+			executableEntry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cloudflared_component_missing"
+			});
+			return;
+		}
+		if (!executableEntry.isFile() || executableEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cloudflared_component_invalid"
+			});
+			return;
+		}
+		const settings = this.options.tunnel.settings();
+		const named = settings.mode === "named" ? settings : void 0;
+		this.mode = settings.mode;
+		this.namedOrigin = named === void 0 ? void 0 : `https://${named.hostname}`;
+		let reservation;
+		try {
+			reservation = await reserveLoopbackPort$1(named?.port);
+		} catch (error) {
+			const conflict = error?.code === "EADDRINUSE";
+			this.publish({
+				enabled: true,
+				state: "error",
+				errorCode: conflict ? named === void 0 ? "cloudflared_port_unavailable" : "cloudflared_tunnel_port_unavailable" : "cloudflared_port_reservation_failed"
+			});
+			return;
+		}
+		this.reservation = reservation;
+		this.buffer = "";
+		this.publish({
+			enabled: true,
+			state: "starting"
+		});
+		if (named !== void 0) {
+			const origin = this.namedOrigin;
+			this.publish({
+				enabled: true,
+				state: "connecting",
+				origin
+			});
+			await reservation.release();
+			if (this.reservation === reservation) this.reservation = void 0;
+			let gateway;
+			try {
+				gateway = await this.options.createGateway(origin, reservation.port);
+			} catch (error) {
+				const conflict = error?.code === "EADDRINUSE";
+				this.publish({
+					enabled: true,
+					state: "error",
+					errorCode: conflict ? "cloudflared_tunnel_port_unavailable" : "gateway_start_failed"
+				});
+				return;
+			}
+			if (generation !== this.generation || !this.enabled || this.disposed) {
+				await gateway.close();
+				return;
+			}
+			this.gatewayValue = gateway;
+		}
+		const args = named === void 0 ? [
+			"tunnel",
+			"--url",
+			`http://127.0.0.1:${String(reservation.port)}`,
+			"--no-autoupdate"
+		] : [
+			"tunnel",
+			"--no-autoupdate",
+			"run"
+		];
+		const environment = withoutProxyEnvironment$1(process.env);
+		if (named !== void 0) environment.TUNNEL_TOKEN = named.token;
+		const child = (this.options.spawnProcess ?? spawnCloudflaredProcess)(this.options.executable, args, environment);
+		this.child = child;
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.stderr.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "cloudflared_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "cloudflared_stopped" : "cloudflared_exited"));
+		});
+		this.startupTimer = setTimeout(() => {
+			this.enqueue(() => this.failGeneration(generation, "cloudflared_start_timeout"));
+		}, this.options.startupTimeoutMs ?? START_TIMEOUT_MS$1);
+		this.startupTimer.unref();
+	}
+	consume(generation, chunk) {
+		if (generation !== this.generation) return;
+		this.buffer += chunk;
+		if (Buffer.byteLength(this.buffer, "utf8") > MAX_LOG_BUFFER_BYTES$1 && !this.buffer.includes("\n")) {
+			this.enqueue(() => this.failGeneration(generation, "cloudflared_invalid_output"));
+			return;
+		}
+		while (true) {
+			const newline = this.buffer.indexOf("\n");
+			if (newline < 0) return;
+			const line = this.buffer.slice(0, newline).replace(/\r$/u, "");
+			this.buffer = this.buffer.slice(newline + 1);
+			if (this.mode === "named") {
+				if (isCloudflaredRegistration(line)) this.enqueue(() => this.confirmNamedReady(generation));
+				continue;
+			}
+			let origin;
+			try {
+				origin = parseCloudflaredOrigin(line);
+			} catch {
+				this.enqueue(() => this.failGeneration(generation, "cloudflared_invalid_origin"));
+				return;
+			}
+			if (origin !== void 0) this.enqueue(() => this.attachGateway(generation, origin));
+		}
+	}
+	/** Mark a named tunnel ready once the connector has registered with the edge. */
+	async confirmNamedReady(generation) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		if (this.gatewayValue === void 0 || this.latest.state === "ready") return;
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			...this.namedOrigin === void 0 ? {} : { origin: this.namedOrigin }
+		});
+	}
+	async attachGateway(generation, origin) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		const current = this.gatewayValue;
+		if (current !== void 0) {
+			if (current.address().origin === origin) return;
+			await this.rotateGateway(generation, origin, current);
+			return;
+		}
+		const reservation = this.reservation;
+		if (reservation === void 0) return;
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		await reservation.release();
+		if (this.reservation === reservation) this.reservation = void 0;
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(origin, reservation.port);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	/** Replace the gateway authority when a quick tunnel restarts on a new hostname. */
+	async rotateGateway(generation, origin, current) {
+		const listenPort = current.address().port;
+		if (this.gatewayValue === current) this.gatewayValue = void 0;
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		try {
+			await current.close();
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) return;
+		let replacement;
+		try {
+			replacement = await this.options.createGateway(origin, listenPort);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) {
+			await replacement.close();
+			return;
+		}
+		this.gatewayValue = replacement;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	async failGeneration(generation, code) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		const reservation = this.reservation;
+		this.reservation = void 0;
+		const child = this.child;
+		this.child = void 0;
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await settleRemoteResources([
+			() => reservation?.release(),
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close()
+		], "cloudflared resource cleanup failed");
+	}
+};
+//#endregion
+//#region src/cloudflared-tunnel.ts
+const MAX_CONFIG_BYTES = 8192;
+const QUICK_TUNNEL_SUFFIX = ".trycloudflare.com";
+/** Cloudflare's own tunnel-routing domain; it can never be a public hostname. */
+const TUNNEL_ROUTING_SUFFIX = ".cfargotunnel.com";
+/**
+* The bare registrable names behind those suffixes. A suffix test alone accepts
+* them, yet Cloudflare owns both apexes outright, so neither can ever be routed to
+* a customer tunnel.
+*/
+const RESERVED_APEX_NAMES = Object.freeze([QUICK_TUNNEL_SUFFIX.slice(1), TUNNEL_ROUTING_SUFFIX.slice(1)]);
+/** Ports below this need privileges on every supported platform. */
+const MIN_PORT = 1024;
+const MAX_PORT = 65535;
+/**
+* The LAN gateway's HTTPS port, held by the plugin for as long as DSH runs. It is
+* never available to a tunnel, so a configuration naming it must be refused up
+* front rather than failing later as a generic "port in use".
+*/
+const RESERVED_LAN_GATEWAY_PORT = 3443;
+const MAX_TOKEN_LENGTH = 4096;
+function hostname$1(value) {
+	if (value.length > 253 || !value.includes(".")) return false;
+	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/**
+* Validate the public hostname Cloudflare routes to this tunnel.
+*
+* The name must be a real DNS name, not an IP literal or a wildcard, and it
+* cannot sit under Cloudflare's own control-plane suffixes: `trycloudflare.com`
+* belongs to quick tunnels, and a `cfargotunnel.com` name is the routing target
+* rather than a routable public address.
+*/
+function validateCloudflaredTunnelHostname(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253) throw new Error("cloudflared_tunnel_hostname_invalid");
+	const normalized = value.toLowerCase().replace(/\.$/u, "");
+	if (isIP(normalized) !== 0 || !hostname$1(normalized) || normalized.includes("*") || RESERVED_APEX_NAMES.includes(normalized) || normalized.endsWith(QUICK_TUNNEL_SUFFIX) || normalized.endsWith(TUNNEL_ROUTING_SUFFIX)) throw new Error("cloudflared_tunnel_hostname_invalid");
+	return normalized;
+}
+/** Validate the stable loopback port Cloudflare's ingress forwards to. */
+function validateCloudflaredTunnelPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < MIN_PORT || Number(value) > MAX_PORT) throw new Error("cloudflared_tunnel_port_invalid");
+	if (value === RESERVED_LAN_GATEWAY_PORT) throw new Error("cloudflared_tunnel_port_reserved");
+	return Number(value);
+}
+/**
+* Validate a connector token before durable storage.
+*
+* A token is a base64url-encoded JSON blob that carries the account, tunnel id
+* and tunnel secret; the provider passes it through the environment rather than
+* the command line, and it is never returned to any client.
+*/
+function validateCloudflaredTunnelToken(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length < 32 || value.length > MAX_TOKEN_LENGTH || !/^[A-Za-z0-9_=+/-]+$/u.test(value)) throw new Error("cloudflared_tunnel_token_invalid");
+	return value;
+}
+/** Parse tunnel settings at the request and filesystem boundaries. */
+function parseCloudflaredTunnelSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("cloudflared_tunnel_settings_invalid");
+	const record = value;
+	const allowed = [
+		"version",
+		"mode",
+		"token",
+		"hostname",
+		"port"
+	];
+	if (Reflect.ownKeys(record).some((key) => !allowed.includes(String(key)))) throw new Error("cloudflared_tunnel_settings_invalid");
+	if (record.version !== void 0 && record.version !== 1) throw new Error("cloudflared_tunnel_settings_invalid");
+	const mode = record.mode ?? "quick";
+	if (mode === "quick") {
+		if (record.token !== void 0 || record.hostname !== void 0 || record.port !== void 0) throw new Error("cloudflared_tunnel_settings_invalid");
+		return Object.freeze({
+			version: 1,
+			mode: "quick"
+		});
+	}
+	if (mode !== "named") throw new Error("cloudflared_tunnel_settings_invalid");
+	return Object.freeze({
+		version: 1,
+		mode: "named",
+		token: validateCloudflaredTunnelToken(record.token),
+		hostname: validateCloudflaredTunnelHostname(record.hostname),
+		port: validateCloudflaredTunnelPort(record.port)
+	});
+}
+/**
+* Merge a partial panel request with the saved named-tunnel settings so a blank
+* field keeps its stored value. The token in particular is write-only, so the
+* panel submits an empty string to mean "keep the existing connector token".
+*/
+function mergeSavedCloudflaredTunnelSettings(partial, saved) {
+	const requested = partial.mode ?? saved?.mode ?? "quick";
+	if (requested !== "quick" && requested !== "named") throw new Error("cloudflared_tunnel_settings_invalid");
+	if (requested === "quick") return parseCloudflaredTunnelSettings({
+		version: 1,
+		mode: "quick"
+	});
+	const previous = saved?.mode === "named" ? saved : void 0;
+	const token = partial.token === "" || partial.token === void 0 ? previous?.token : partial.token;
+	const hostname = partial.hostname === "" || partial.hostname === void 0 ? previous?.hostname : partial.hostname;
+	const port = partial.port === void 0 || partial.port === "" ? previous?.port : partial.port;
+	if (token === void 0 || hostname === void 0 || port === void 0) throw new Error("cloudflared_tunnel_config_missing");
+	return parseCloudflaredTunnelSettings({
+		version: 1,
+		mode: "named",
+		token,
+		hostname,
+		port
+	});
+}
+async function atomicPrivateWrite(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("cloudflared_tunnel_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+/** Owns the private cloudflared tunnel configuration for one DSH installation. */
+var CloudflaredTunnelStore = class {
+	stateRoot;
+	settingsFile;
+	settingsValue = Object.freeze({
+		version: 1,
+		mode: "quick"
+	});
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared tunnel state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "tunnel.json");
+	}
+	/** Load private settings while rejecting links, oversized files and unknown fields. */
+	async initialize() {
+		let entry;
+		try {
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_CONFIG_BYTES) {
+			this.errorCode = "cloudflared_tunnel_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseCloudflaredTunnelSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+			this.errorCode = void 0;
+		} catch {
+			this.settingsValue = Object.freeze({
+				version: 1,
+				mode: "quick"
+			});
+			this.errorCode = "cloudflared_tunnel_config_invalid";
+		}
+	}
+	/** Return configuration metadata without exposing the connector token. */
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			mode: settings.mode,
+			configured: settings.mode === "named",
+			...settings.mode === "named" ? {
+				hostname: settings.hostname,
+				port: settings.port
+			} : {},
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Return private settings only to the provider lifecycle. */
+	settings() {
+		return this.settingsValue;
+	}
+	/** Atomically replace the tunnel configuration. */
+	async configure(value) {
+		const settings = parseCloudflaredTunnelSettings(value);
+		if (settings.mode === "quick") await rm(this.settingsFile, { force: true });
+		else await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	/** Forget a named tunnel and its connector token. */
+	async purge() {
+		await rm(this.settingsFile, { force: true });
+		this.settingsValue = Object.freeze({
+			version: 1,
+			mode: "quick"
+		});
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/task-events.ts
+const TASK_EVENT_DEBOUNCE_MS = 1e3;
+function turnNumber(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function turnData(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
+		turn: 0,
+		completed: false
+	};
+	const record = value;
+	const reason = record.reason;
+	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
+	return {
+		turn: turnNumber(record.turn),
+		completed
+	};
+}
+/**
+* Subscribe to completed root turns. Subagent turns are skipped so one task
+* announces once, and rapid turn boundaries collapse into a single event.
+* Returns a disposer that also drops pending debounces.
+*/
+function watchTaskCompletions(ctx, options) {
+	const debounceMs = options.debounceMs ?? 1e3;
+	const pending = /* @__PURE__ */ new Map();
+	const disposeListener = ctx.on("session/event", (session, event) => {
+		if (event.type !== "turn/end") return;
+		const { turn, completed } = turnData(event.data);
+		if (!completed) return;
+		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
+		const sessionId = String(session.id);
+		options.log?.("task-completed-observed", {
+			sessionId,
+			turn
+		});
+		const previous = pending.get(sessionId);
+		if (previous !== void 0) clearTimeout(previous);
+		pending.set(sessionId, setTimeout(() => {
+			pending.delete(sessionId);
+			options.log?.("task-completed-announced", {
+				sessionId,
+				turn
+			});
+			options.onTaskCompleted(Object.freeze({
+				sessionId,
+				turn
+			}));
+		}, debounceMs));
+	});
+	return () => {
+		disposeListener();
+		for (const timer of pending.values()) clearTimeout(timer);
+		pending.clear();
+	};
+}
+/** One subscription feeding every live gateway; gateways register on start. */
+var TaskEventHub = class {
+	sinks = /* @__PURE__ */ new Set();
+	/** Register a sink; returns its disposer. */
+	add(sink) {
+		this.sinks.add(sink);
+		return () => {
+			this.sinks.delete(sink);
+		};
+	}
+	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
+	broadcast(event) {
+		for (const sink of [...this.sinks]) try {
+			sink.broadcastTaskEvent(event);
+		} catch {}
+	}
+	/** Visible for tests. */
+	get size() {
+		return this.sinks.size;
+	}
+};
+//#endregion
+//#region src/diagnostics.ts
+const REMOTE_ERROR_GUIDANCE = Object.freeze({
+	component_missing: "重新安装完整插件包。",
+	funnel_permission_required: "继续完成 Tailscale Funnel 授权。",
+	funnel_https_required: "继续完成 Tailscale HTTPS 授权。",
+	funnel_start_failed: "重新打开授权页并允许 Funnel。",
+	funnel_start_timeout: "检查网络后点击“重新连接”。",
+	tailscale_dns_missing: "确认 Tailscale 登录仍有效后重新连接。",
+	sidecar_launch_failed: "重新安装完整插件包后重试。",
+	sidecar_stopped: "点击“重新连接”。",
+	sidecar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	control_channel_failed: "点击“重新连接”。",
+	cpolar_component_missing: "先安装 cpolar 官方组件。",
+	cpolar_component_invalid: "彻底移除 cpolar 组件后重新安装。",
+	cpolar_config_missing: "保存 cpolar Authtoken 后重试。",
+	cpolar_config_invalid: "重新保存 cpolar Authtoken。",
+	cpolar_start_timeout: "检查网络后点击“重新连接”。",
+	cpolar_stopped: "点击“重新连接”。",
+	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_component_missing: "先安装 cloudflared 官方组件。",
+	cloudflared_component_invalid: "彻底移除 cloudflared 组件后重新安装。",
+	cloudflared_port_unavailable: "无法分配本机远程网关端口，请重试。",
+	cloudflared_launch_failed: "重新安装 cloudflared 官方组件后重试。",
+	cloudflared_start_timeout: "检查网络后点击“重新连接”。",
+	cloudflared_stopped: "点击“重新连接”。",
+	cloudflared_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_invalid_output: "cloudflared 返回了无法识别的状态。",
+	cloudflared_invalid_origin: "cloudflared 返回的公网地址未通过校验。",
+	origin_config_missing: "先保存自有反向代理配置。",
+	origin_config_invalid: "重新保存自有反向代理配置。",
+	origin_listen_port_in_use: "更换 HTTP 后端端口；不要使用局域网的 3443、DSH 自身的 3080，或已被 cloudflared 隧道占用的 3444。",
+	origin_listen_address_unavailable: "监听地址不属于当前电脑，请重新选择本机的私网 IPv4 地址。",
+	origin_gateway_start_failed: "检查 HTTP 后端监听地址和端口后重新连接。",
+	frp_component_missing: "先安装 FRP 官方组件。",
+	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
+	frp_config_missing: "先保存自建 FRP 连接配置。",
+	frp_config_verify_failed: "检查服务器地址、端口、Token 和公开域名。",
+	frp_vhost_publicly_reachable: "将 frps 的 HTTP vhost 监听限制到 127.0.0.1。",
+	frp_vhost_probe_failed: "确认 VPS 地址可解析后重新连接。",
+	frp_launch_failed: "重新安装 FRP 官方组件后重试。",
+	frp_start_timeout: "确认 frps、Caddy 和域名解析正常后重新连接。",
+	frp_discovery_mismatch: "公开域名连接到了另一台电脑，请核对 Caddy 与 frps 配置。",
+	frp_discovery_invalid: "公开域名返回了非 DSH Mobile 响应。",
+	frp_stopped: "点击“重新连接”。",
+	frp_exited: "检查 VPS 配置后重新连接；仍失败时复制诊断报告。",
+	gateway_start_failed: "确认 DSH 正在运行后重新连接。"
+});
+function check(id, status, reason, label, detail, action, facts) {
+	return Object.freeze({
+		id,
+		status,
+		reason,
+		...facts === void 0 ? {} : { facts: Object.freeze(facts) },
+		label,
+		detail,
+		...action === void 0 ? {} : { action }
+	});
+}
+function maskLanOrigin(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const url = new URL(origin);
+		const octets = url.hostname.split(".");
+		const host = octets.length === 4 ? `${octets[0]}.${octets[1]}.${octets[2]}.x` : "局域网地址";
+		return `${url.protocol}//${host}${url.port === "" ? "" : `:${url.port}`}`;
+	} catch {
+		return "地址格式无效";
+	}
+}
+function remoteSuffix(origin) {
+	if (origin === void 0) return "未分配";
+	try {
+		const hostname = new URL(origin).hostname;
+		if (hostname.endsWith(".ts.net")) return "*.ts.net";
+		if (hostname.endsWith(".trycloudflare.com")) return "*.trycloudflare.com";
+		for (const suffix of [
+			".cpolar.cn",
+			".cpolar.io",
+			".cpolar.top",
+			".cpolar.com"
+		]) if (hostname.endsWith(suffix)) return `*${suffix}`;
+		return "公共 HTTPS 地址";
+	} catch {
+		return "地址格式无效";
+	}
+}
+function defaultFirewallProbe(platform = process.platform) {
+	return async (port) => {
+		if (platform !== "win32") return { state: "not-applicable" };
+		if (port === void 0) return { state: "unknown" };
+		const script = [
+			"$specs = @(@{ Name = 'DSH Mobile HTTPS'; Protocol = 'TCP' }, @{ Name = 'DSH Mobile Discovery'; Protocol = 'UDP' })",
+			"$ready = $true",
+			"$specs | ForEach-Object {",
+			"  $spec = $_",
+			"  $rule = Get-NetFirewallRule -DisplayName $spec.Name -ErrorAction SilentlyContinue | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' -and $_.Action -eq 'Allow' } | Select-Object -First 1",
+			"  if ($null -eq $rule) { $ready = $false; return }",
+			"  $filters = @($rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue)",
+			`  $matching = @($filters | Where-Object { $_.Protocol -eq $spec.Protocol -and ($_.LocalPort -eq 'Any' -or $_.LocalPort -eq '${String(port)}') })`,
+			"  if ($matching.Count -eq 0) { $ready = $false }",
+			"}",
+			"if ($ready) { 'ready' } else { 'missing' }"
+		].join("; ");
+		try {
+			return { state: (await execFileText("powershell.exe", [
+				"-NoProfile",
+				"-NonInteractive",
+				"-Command",
+				script
+			], {
+				encoding: "utf8",
 				timeout: 3e3,
 				windowsHide: true
 			})).stdout.trim() === "ready" ? "ready" : "missing" };
@@ -6247,7 +7642,7 @@ function reportLine(entry) {
 /** Run bounded read-only checks and return a report safe to paste into an issue. */
 async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	const checks = [];
-	const remoteProbe = snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
+	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
 	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
 	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
 	if (snapshot.lan.configured === false) checks.push(check("network", "error", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "返回局域网页选择网卡并完成配置。"));
@@ -6264,6 +7659,7 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
 	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
 	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
+	else if (snapshot.remote.provider === "origin" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-origin-ready", "远程通道", "私网 HTTP 后端已就绪；未检测公网 HTTPS、证书或 WebSocket 连通性。", "在手机上经反向代理验证连接；代理须保留原始 Host（含端口）并支持 WebSocket。", { provider: "origin" }));
 	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
 		const endpointSuffix = remoteSuffix(snapshot.remote.origin);
 		const facts = {
@@ -8173,16 +9569,12 @@ async function run(file, args) {
 	});
 }
 async function defaultFetchArtifact(url, signal) {
-	const response = await fetch(url, {
-		redirect: "error",
+	return downloadPinnedArtifact({
+		url,
+		expectedBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
+		errorPrefix: "cpolar",
 		signal
 	});
-	if (!response.ok) throw new Error(`cpolar_download_http_${String(response.status)}`);
-	const length = Number(response.headers.get("content-length"));
-	if (Number.isFinite(length) && length !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
-	const bytes = new Uint8Array(await response.arrayBuffer());
-	if (bytes.byteLength !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
-	return bytes;
 }
 async function defaultExtractArtifact(archive, destination) {
 	if (process.platform !== "win32") throw new Error("cpolar_component_unsupported");
@@ -9290,6 +10682,7 @@ function mapAdminError(error) {
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
 	if (error instanceof Error && error.message === "cpolar_authtoken_invalid") return new HttpError(400, "cpolar_authtoken_invalid");
 	if (error instanceof Error && error.message.startsWith("cpolar_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message.startsWith("cloudflared_")) return new HttpError(409, error.message);
 	if (error instanceof Error && [
 		"frp_server_address_invalid",
 		"frp_server_port_invalid",
@@ -9298,6 +10691,15 @@ function mapAdminError(error) {
 		"frp_settings_invalid"
 	].includes(error.message)) return new HttpError(400, error.message);
 	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && [
+		"origin_settings_invalid",
+		"origin_public_origin_invalid",
+		"origin_listen_host_invalid",
+		"origin_listen_port_invalid",
+		"origin_listen_port_reserved",
+		"origin_allowed_cidrs_invalid"
+	].includes(error.message)) return new HttpError(400, error.message);
+	if (error instanceof Error && error.message.startsWith("origin_")) return new HttpError(409, error.message);
 	if (error instanceof Error && error.message.startsWith("vps_")) return new HttpError(409, error.message);
 	if (error instanceof Error && error.message === "plugin_update_failed") return new HttpError(500, error.message);
 	if (error instanceof Error && error.message.startsWith("plugin_update_")) return new HttpError(409, error.message);
@@ -9406,12 +10808,23 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		discovery: false
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, frpComponent, frpConfiguration) {
+/** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
+function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort) {
+	const validated = parseOriginSettings(settings);
+	if (listenPort !== 0) validateOriginListenPort(listenPort);
+	return Object.freeze({
+		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort),
+		listenHost: validated.listenHost,
+		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
+	});
+}
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration) {
 	return {
 		provider,
 		running: status.enabled,
 		state: status.state,
 		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.backendOrigin === void 0 ? {} : { backendOrigin: status.backendOrigin },
 		...status.loginUrl === void 0 ? {} : { loginUrl: status.loginUrl },
 		...status.setupUrl === void 0 ? {} : { setupUrl: status.setupUrl },
 		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode },
@@ -9428,12 +10841,25 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				state: providerStatuses.cpolar.state,
 				component: cpolarComponent
 			},
+			cloudflared: {
+				bundled: false,
+				running: providerStatuses.cloudflared.enabled,
+				state: providerStatuses.cloudflared.state,
+				component: cloudflaredComponent,
+				configuration: cloudflaredConfiguration
+			},
 			frp: {
 				bundled: false,
 				running: providerStatuses.frp.enabled,
 				state: providerStatuses.frp.state,
 				component: frpComponent,
 				configuration: frpConfiguration
+			},
+			origin: {
+				bundled: true,
+				running: providerStatuses.origin.enabled,
+				state: providerStatuses.origin.state,
+				configuration: originConfiguration
 			}
 		}
 	};
@@ -9464,10 +10890,16 @@ async function apply(ctx, config) {
 	const initialRemoteProvider = (await remoteProviderStore.load()).provider;
 	const cpolarComponent = new CpolarComponentManager({ stateDirectory });
 	await cpolarComponent.initialize();
+	const cloudflaredComponent = new CloudflaredComponentManager({ stateDirectory });
+	await cloudflaredComponent.initialize();
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"));
 	await frpConfig.initialize();
+	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"));
+	await originConfig.initialize();
+	const cloudflaredTunnel = new CloudflaredTunnelStore(join(remoteDirectory, "cloudflared"));
+	await cloudflaredTunnel.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
 		id: "computer-images",
@@ -9561,9 +10993,22 @@ async function apply(ctx, config) {
 		await candidate.start();
 		return candidate;
 	};
+	const createOriginGateway = async (settings) => {
+		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		try {
+			await candidate.start();
+		} catch (error) {
+			await candidate.close();
+			throw error;
+		}
+		return candidate;
+	};
 	const tailscaleStore = new JsonMobileAccessControlStore(join(remoteDirectory, "control.json"), false);
 	const cpolarStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cpolar", "control.json"), false);
+	const cloudflaredStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cloudflared", "control.json"), false);
 	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
+	const originStore = new JsonMobileAccessControlStore(join(remoteDirectory, "origin", "control.json"), false);
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -9578,21 +11023,28 @@ async function apply(ctx, config) {
 			configFile: cpolarComponent.configFile,
 			createGateway: createRemoteGateway
 		}),
+		cloudflared: new CloudflaredController({
+			store: cloudflaredStore,
+			executable: cloudflaredComponent.executable,
+			tunnel: cloudflaredTunnel,
+			createGateway: createRemoteGateway
+		}),
 		frp: new FrpController({
 			store: frpStore,
 			executable: frpComponent.executable,
 			config: frpConfig,
 			instanceId,
 			createGateway: createRemoteGateway
+		}),
+		origin: new OriginController({
+			store: originStore,
+			config: originConfig,
+			createGateway: createOriginGateway
 		})
 	};
 	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
 	const remoteController = () => remoteProviders.controller();
-	for (const provider of [
-		"tailscale",
-		"cpolar",
-		"frp"
-	]) {
+	for (const provider of REMOTE_PROVIDERS) {
 		const controller = remoteControllers[provider];
 		taskEventHub.add({ broadcastTaskEvent: (event) => {
 			controller.gateway()?.broadcastTaskEvent(event);
@@ -9601,8 +11053,10 @@ async function apply(ctx, config) {
 	const remotePayload = () => remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
 		tailscale: remoteControllers.tailscale.status(),
 		cpolar: remoteControllers.cpolar.status(),
-		frp: remoteControllers.frp.status()
-	}, cpolarComponent.status(), frpComponent.status(), frpConfig.status());
+		cloudflared: remoteControllers.cloudflared.status(),
+		frp: remoteControllers.frp.status(),
+		origin: remoteControllers.origin.status()
+	}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status());
 	const lanPayload = () => ({
 		...loaded.kind === "unconfigured" ? {
 			configured: preparedLanSetup !== void 0,
@@ -9737,11 +11191,29 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
 					const body = await readJsonObject(request, 4096);
-					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "frp") throw new HttpError(400, "bad_request");
+					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "cloudflared" && body.provider !== "frp" && body.provider !== "origin") throw new HttpError(400, "bad_request");
 					await remoteProviders.select(body.provider);
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/origin/configure`) {
+					const body = await readJsonObject(request, 8192);
+					await remoteProviders.mutate(async () => {
+						await originConfig.configure(body);
+						if (remoteControllers.origin.status().enabled) await remoteControllers.origin.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/origin/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.origin.setEnabled(false);
+						await originConfig.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					await remoteProviders.mutate(async () => cpolarComponent.install());
@@ -9763,6 +11235,46 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("cloudflared component install started");
+					try {
+						await remoteProviders.mutate(async () => cloudflaredComponent.install());
+						logger.info("cloudflared component install completed");
+					} catch (error) {
+						logger.error("cloudflared component install failed: %s", error instanceof Error ? error.stack ?? error.message : String(error));
+						throw error;
+					}
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cloudflared.setEnabled(false);
+						await cloudflaredComponent.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/tunnel`) {
+					const body = await readJsonObject(request, 8192);
+					await remoteProviders.mutate(async () => {
+						await cloudflaredTunnel.configure(mergeSavedCloudflaredTunnelSettings(body, cloudflaredTunnel.settings()));
+						if (remoteControllers.cloudflared.status().enabled) await remoteControllers.cloudflared.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/tunnel/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cloudflared.setEnabled(false);
+						await cloudflaredTunnel.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					logger.info("frpc component install started");
@@ -9981,17 +11493,18 @@ async function apply(ctx, config) {
 			const stores = {
 				tailscale: tailscaleStore,
 				cpolar: cpolarStore,
-				frp: frpStore
+				cloudflared: cloudflaredStore,
+				frp: frpStore,
+				origin: originStore
 			};
 			await Promise.all(Object.keys(stores).filter((provider) => provider !== remoteProviders.selected).map((provider) => stores[provider].save({
 				version: 1,
 				enabled: false
 			})));
-			for (const provider of [
-				"tailscale",
-				"cpolar",
-				"frp"
-			]) await remoteControllers[provider].initialize();
+			for (const provider of REMOTE_PROVIDERS) await remoteControllers[provider].initialize();
+			const lanDiscovery = lanGateway?.discoveryStatus();
+			if (lanDiscovery !== void 0 && !lanDiscovery.broadcast) logger.warn("broadcast discovery is unavailable (%s); mDNS is still published, so pair manually or free the UDP port", lanDiscovery.errorCode ?? "unknown_cause");
+			if (lanDiscovery?.mobileAssetsErrorCode !== void 0) logger.warn("a bundled mobile asset is missing (%s); the phone frontend will serve without it", lanDiscovery.mobileAssetsErrorCode);
 		} catch (error) {
 			try {
 				await settleCleanupSteps([
@@ -10028,6 +11541,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isCloudflaredRegistration, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map