dsh-mobile 0.4.1 → 0.4.3

package/lib/index.mjs

@@ -116,8 +116,10 @@ var AccessController = class {
 	async initialize() {
 		if (this.initialized || this.closing) throw new Error("access controller cannot be initialized again");
 		const snapshot = await this.store.load();
-		if (snapshot.devices.length > this.options.maxDevices) throw new Error("device state exceeds configured maxDevices");
-		this.devices = [...snapshot.devices];
+		const devices = snapshot.devices.filter((device) => device.revokedAt === void 0);
+		if (devices.length > this.options.maxDevices) throw new Error("device state exceeds configured maxDevices");
+		if (devices.length !== snapshot.devices.length) await this.store.save(this.snapshot(devices));
+		this.devices = devices;
 		this.initialized = true;
 	}
 	requireInitialized() {
@@ -312,18 +314,12 @@ var AccessController = class {
 	logout(authorization) {
 		this.removeSession(authorization.sessionKey, "logout");
 	}
-	/** Persist revocation, then end every Session owned by that device. */
+	/** Durably delete the device, then end every Session owned by that device. */
 	async revokeDevice(deviceId) {
 		this.requireInitialized();
 		return this.exclusive(async () => {
-			const index = this.devices.findIndex((device) => device.id === deviceId);
-			const device = this.devices[index];
-			if (device === void 0 || device.revokedAt !== void 0) return false;
-			const next = [...this.devices];
-			next[index] = Object.freeze({
-				...device,
-				revokedAt: this.now()
-			});
+			const next = this.devices.filter((device) => device.id !== deviceId);
+			if (next.length === this.devices.length) return false;
 			await this.store.save(this.snapshot(next));
 			this.devices = next;
 			for (const [key, session] of this.sessions) if (session.deviceId === deviceId) this.removeSession(key, "revoked");
@@ -644,6 +640,7 @@ const Config = z.object({
 	customCssFile: z.string().hidden(),
 	customScriptFile: z.string().hidden(),
 	mobileLayoutFile: z.string().hidden(),
+	mobileCompatibilityFile: z.string().hidden(),
 	instanceId: z.string().hidden(),
 	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
@@ -769,6 +766,7 @@ function parseGatewayConfig(raw) {
 		customCssFile: value.customCssFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.css") : absoluteFile(value.customCssFile, "customCssFile"),
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
 		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
+		mobileCompatibilityFile: value.mobileCompatibilityFile === void 0 ? fileURLToPath(new URL("./mobile-compat.js", import.meta.url)) : absoluteFile(value.mobileCompatibilityFile, "mobileCompatibilityFile"),
 		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
 			throw new Error("instanceId must be a lowercase SHA-256 value");
 		})(),
@@ -879,6 +877,17 @@ var FollowingMobileAccessRuntime = class {
 	async initialize(refreshIntervalMs) {
 		await this.refresh();
 		if (refreshIntervalMs === void 0) return;
+		this.beginPolling(refreshIntervalMs);
+	}
+	/**
+	* Arm the refresh poller without requiring an initial selection.
+	* Boot-degraded path: the first selection already failed (e.g. the saved
+	* LAN is down), but later refreshes must still get their chance so a
+	* returning network recovers without a restart. Failures keep flowing to
+	* onRefreshError; close() stays the single teardown.
+	*/
+	beginPolling(refreshIntervalMs) {
+		if (this.timer !== void 0) return;
 		this.timer = setInterval(() => {
 			this.refresh().catch(this.onRefreshError);
 		}, refreshIntervalMs);
@@ -1310,6 +1319,50 @@ function assertLocalAdminTrust(request, requireBrowserOrigin) {
 	if (requireBrowserOrigin && site !== void 0 && site !== "same-origin") throw new HttpError(403, "forbidden");
 }
 //#endregion
+//#region src/mobile-compat-bootstrap.ts
+const MOBILE_COMPAT_PATH = `${AUTH_PREFIX}/compat.js`;
+/**
+* Read one attribute out of a tag body.
+*
+* A plain `/\snonce\s*=/` search can be fooled by a value that merely contains the
+* text, and cannot tell a double-quoted attribute from a single-quoted one. Walking
+* `name=value` pairs consumes each quoted value whole, so the attribute that is
+* actually present is the one returned.
+*/
+function attributeValue(tag, name) {
+	for (const match of tag.matchAll(/([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*("[^"]*"|'[^']*')/gu)) {
+		const attribute = match[1];
+		const raw = match[2];
+		if (attribute === void 0 || raw === void 0) continue;
+		if (attribute.toLowerCase() === name) return raw.slice(1, -1);
+	}
+}
+/** Character ranges covered by an HTML comment, where markup is inert text. */
+function commentRanges(html) {
+	return [...html.matchAll(/<!--[\s\S]*?-->/gu)].map((match) => [match.index, match.index + match[0].length]);
+}
+/**
+* Load the compatibility bundle synchronously, before the first DSH script.
+*
+* Returns the HTML unchanged when there is no script to anchor to. The bundle is an
+* enhancement for WebViews without Iterator helpers, so a document this function
+* cannot place it in must still be served: throwing here took the entire dedicated
+* mobile frontend down with a 502.
+*/
+function ensureMobileCompatibility(html) {
+	const comments = commentRanges(html);
+	const isInert = (at) => comments.some(([start, end]) => at >= start && at < end);
+	const scripts = [...html.matchAll(/<script\b[^>]*>/giu)].filter((match) => !isInert(match.index));
+	if (scripts.length === 0) return html;
+	if (scripts.some((match) => attributeValue(match[0], "src") === MOBILE_COMPAT_PATH)) return html;
+	const first = scripts[0];
+	if (first === void 0) return html;
+	const nonce = attributeValue(first[0], "nonce")?.replace(/["'<>\s]/gu, "") ?? "";
+	const attribute = nonce === "" ? "" : ` nonce="${nonce}"`;
+	const script = `<script src="${MOBILE_COMPAT_PATH}"${attribute}><\/script>`;
+	return `${html.slice(0, first.index)}${script}${html.slice(first.index)}`;
+}
+//#endregion
 //#region src/version.ts
 const manifest = createRequire(import.meta.url)("../package.json");
 /** Version of the installed DSH Mobile plugin package. */
@@ -1492,7 +1545,7 @@ function normalizeRelativePath(value, field) {
 	if (normalized.split("/").some((part) => part === "" || part === "." || part === "..")) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
 	return normalized;
 }
-async function regularFile$2(path, maximum, field) {
+async function regularFile$3(path, maximum, field) {
 	let info;
 	try {
 		info = await lstat(path);
@@ -1513,7 +1566,7 @@ async function containedPath(root, relativePath, maximum, field) {
 	const targetReal = await realpath(target);
 	const relation = relative(rootReal, targetReal);
 	if (relation === "" || relation.startsWith("..") || isAbsolute(relation)) throw new MobileExtensionError("invalid_extension_path", `${field} escapes extension directory`);
-	return regularFile$2(targetReal, maximum, field);
+	return regularFile$3(targetReal, maximum, field);
 }
 async function optionalFile(root, name, maximum, field) {
 	try {
@@ -1590,7 +1643,7 @@ async function assetSnapshot(extensionRootReal) {
 }
 async function extensionFingerprint(directory) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$3(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifestBody = await readFile(manifestFile.path);
 	const manifest = parseExtensionManifest(JSON.parse(manifestBody.toString("utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
@@ -2086,7 +2139,7 @@ async function abortAndDisposeLocal(entries) {
 }
 async function loadLocalExtension(directory, context, known, parentSignal) {
 	const root = await realExtensionRoot(directory);
-	const manifestFile = await regularFile$2(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
+	const manifestFile = await regularFile$3(join(root, "extension.json"), EXTENSION_LIMITS.manifest, "extension.json");
 	const manifest = known?.manifest ?? parseExtensionManifest(JSON.parse(await readFile(manifestFile.path, "utf8")));
 	if (manifest.id !== basename(root)) throw new MobileExtensionError("invalid_manifest", "extension id must match its directory name");
 	const scriptBody = known === void 0 ? await optionalFile(root, "mobile.js", EXTENSION_LIMITS.script, "mobile.js").then((path) => path === void 0 ? void 0 : readFile(path)) : known.scriptBody;
@@ -2382,6 +2435,19 @@ const MOBILE_LAYOUT_PATH = `${AUTH_PREFIX}/mobile-layout.js`;
 const MOBILE_BOOT_BATCH_PREFIX = `${AUTH_PREFIX}/mobile-boot/`;
 const MAX_MOBILE_BOOT_BATCH_BYTES = 33554432;
 const MAX_MOBILE_BOOT_ENTRY_BYTES = 8388608;
+/**
+* Per-merged-batch byte budget. One upstream application batch can carry dozens
+* of client bundles whose combined size exceeds the hard batch cap; the layout
+* batch is therefore chunked into multiple merged batches, each kept safely
+* below {@link MAX_MOBILE_BOOT_BATCH_BYTES} so assembly can never reject it.
+*/
+const MOBILE_BOOT_CHUNK_BYTES = 16777216;
+/** Bytes the assembly emits after each entry (`body` plus `\n;\n`). */
+const MOBILE_BOOT_SEPARATOR_BYTES = 3;
+/** Freshness window for cached upstream bundle byte sizes. */
+const MOBILE_BOOT_SIZE_CACHE_TTL_MS = 3e4;
+/** Marker header distinguishing size probes from ordinary proxied bundle fetches. */
+const MOBILE_BOOT_SIZE_PROBE_HEADER = "x-dsh-mobile-size-probe";
 const MAX_MOBILE_BOOT_BATCHES = 8;
 const MOBILE_BOOT_UPSTREAM_ATTEMPTS = 4;
 const MOBILE_BOOT_RETRY_DELAY_MS = 150;
@@ -2466,11 +2532,17 @@ function revisionedMobileBatchPath(entries) {
 		path: `${MOBILE_BOOT_BATCH_PREFIX}${key}.js`
 	};
 }
-function rewriteMobileIndexWithBatch(html) {
+/**
+* Parse one upstream boot manifest and rewire the layout entry onto the
+* gateway-owned layout module. The layout entry's URL and revision become the
+* local `mobile-layout.js` path; the dedicated frontend is authenticated in the
+* gateway, so the requested layout needs no upstream address.
+*/
+function parseMobileBootPlan(html) {
 	const assignment = /(?:window\.__DSH_BOOT__|globalThis\["__DSH_BOOT__"\])\s*=\s*/u.exec(html);
 	if (assignment?.index === void 0) throw new Error("upstream DSH index has no boot manifest");
-	const start = assignment.index;
-	const valueStart = start + assignment[0].length;
+	const replaceStart = assignment.index;
+	const valueStart = replaceStart + assignment[0].length;
 	const scriptEnd = html.indexOf("<\/script>", valueStart);
 	if (scriptEnd < 0) throw new Error("upstream DSH boot manifest script is incomplete");
 	const source = html.slice(valueStart, scriptEnd).trim().replace(/;$/u, "");
@@ -2484,45 +2556,122 @@ function rewriteMobileIndexWithBatch(html) {
 	if (dependencyProfile === void 0) throw new Error("upstream DSH layout module has unsupported dependencies");
 	layout[0].url = MOBILE_LAYOUT_PATH;
 	layout[0].rev = `dsh-mobile-layout-${DSH_MOBILE_VERSION}`;
-	const remoteSettings = orderAuthenticatedSettings(entries, dependencyProfile.slots);
-	let mobileBatch;
-	if (parsed.batches !== void 0) {
-		if (!Array.isArray(parsed.batches)) throw new Error("upstream DSH boot manifest batches are malformed");
-		const batches = parsed.batches;
-		const entryById = new Map(entries.map((entry) => [entry.id, entry]));
-		if (entryById.size !== entries.length) throw new Error("upstream DSH boot manifest has duplicate entries");
-		const layoutBatches = [];
-		for (const batch of batches) {
-			if (batch === null || typeof batch !== "object" || batch.phase !== "bootstrap" && batch.phase !== "application" || typeof batch.url !== "string" || typeof batch.rev !== "string" || !Array.isArray(batch.entries) || batch.entries.length === 0 || batch.entries.some((id) => typeof id !== "string" || !entryById.has(id))) throw new Error("upstream DSH boot manifest batches are malformed");
-			if (batch.entries.includes(MOBILE_LAYOUT_MODULE)) layoutBatches.push(batch);
-		}
-		if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
-		const layoutBatch = layoutBatches[0];
-		const planEntries = layoutBatch.entries.map((id) => {
-			const entry = entryById.get(id);
-			if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
-			return Object.freeze({
-				id,
+	const parsedBatches = parsed.batches;
+	if (parsedBatches === void 0) return Object.freeze({
+		parsed,
+		entries,
+		slotProvider: dependencyProfile.slots,
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd
+	});
+	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
+	const batches = parsedBatches;
+	const entryById = new Map(entries.map((entry) => [entry.id, entry]));
+	if (entryById.size !== entries.length) throw new Error("upstream DSH boot manifest has duplicate entries");
+	const layoutBatches = [];
+	for (const batch of batches) {
+		if (batch === null || typeof batch !== "object" || batch.phase !== "bootstrap" && batch.phase !== "application" || typeof batch.url !== "string" || typeof batch.rev !== "string" || !Array.isArray(batch.entries) || batch.entries.length === 0 || batch.entries.some((id) => typeof id !== "string" || !entryById.has(id))) throw new Error("upstream DSH boot manifest batches are malformed");
+		if (batch.entries.includes(MOBILE_LAYOUT_MODULE)) layoutBatches.push(batch);
+	}
+	if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
+	const layoutBatch = layoutBatches[0];
+	const planEntries = layoutBatch.entries.map((id) => {
+		const entry = entryById.get(id);
+		if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
+		return Object.freeze({
+			id,
+			url: entry.url,
+			rev: entry.rev
+		});
+	});
+	return Object.freeze({
+		parsed,
+		entries,
+		batches,
+		slotProvider: dependencyProfile.slots,
+		assignment: assignment[0],
+		replaceStart,
+		replaceEnd: scriptEnd,
+		layoutBatch,
+		planEntries
+	});
+}
+/**
+* Partition one upstream application batch into merged batches plus pass-through
+* rows. Every entry whose bundle is at or above the per-entry cap keeps its own
+* upstream `/plugins` row (the gateway proxies it verbatim), because a merged
+* batch cannot carry it. The remaining entries are greedily packed into merged
+* batches under {@link MOBILE_BOOT_CHUNK_BYTES}; the layout module always merges,
+* since its body is the gateway-owned layout file, never an upstream fetch.
+*/
+function splitMobileBootBatch(entries, sizes, passThrough) {
+	const rows = [];
+	const plans = [];
+	let chunk;
+	const flush = () => {
+		if (chunk === void 0 || chunk.entries.length === 0) return;
+		const revision = revisionedMobileBatchPath(chunk.entries);
+		rows.push({
+			phase: "application",
+			url: revision.path,
+			rev: revision.key,
+			entries: chunk.ids
+		});
+		plans.push(Object.freeze({
+			key: revision.key,
+			path: revision.path,
+			entries: Object.freeze(chunk.entries)
+		}));
+		chunk = void 0;
+	};
+	for (const entry of entries) {
+		const size = sizes.get(entry.url);
+		if ((passThrough.has(entry.url) || size !== void 0 && size >= MAX_MOBILE_BOOT_ENTRY_BYTES) && entry.id !== MOBILE_LAYOUT_MODULE) {
+			rows.push({
+				phase: "application",
 				url: entry.url,
-				rev: entry.rev
+				rev: entry.rev,
+				entries: [entry.id]
 			});
-		});
-		const revision = revisionedMobileBatchPath(planEntries);
-		layoutBatch.url = revision.path;
-		layoutBatch.rev = revision.key;
-		mobileBatch = Object.freeze({
-			...revision,
-			entries: Object.freeze(planEntries)
-		});
-		parsed.rev = createHash("sha256").update(JSON.stringify({
-			entries,
-			batches
+			continue;
+		}
+		const bytes = (size ?? 0) + MOBILE_BOOT_SEPARATOR_BYTES;
+		if (chunk !== void 0 && chunk.entries.length > 0 && chunk.bytes + bytes > MOBILE_BOOT_CHUNK_BYTES) flush();
+		chunk ??= {
+			ids: [],
+			entries: [],
+			bytes: 0
+		};
+		chunk.ids.push(entry.id);
+		chunk.entries.push(entry);
+		chunk.bytes += bytes;
+	}
+	flush();
+	return {
+		plans,
+		rows
+	};
+}
+function rewriteMobileIndexWithBatch(html, options = {}) {
+	const plan = parseMobileBootPlan(html);
+	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
+	let batches = [];
+	if (plan.batches !== void 0 && plan.layoutBatch !== void 0 && plan.planEntries !== void 0) {
+		const split = splitMobileBootBatch(plan.planEntries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set());
+		const at = plan.batches.indexOf(plan.layoutBatch);
+		if (at < 0) throw new Error("upstream DSH boot manifest has no unique application layout batch");
+		plan.batches.splice(at, 1, ...split.rows);
+		batches = Object.freeze(split.plans);
+		plan.parsed.rev = createHash("sha256").update(JSON.stringify({
+			entries: plan.entries,
+			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${assignment[0]}${JSON.stringify(parsed)};`;
+	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
 	return Object.freeze({
-		html: ensureMobileViewport(`${html.slice(0, start)}${replacement}${html.slice(scriptEnd)}`),
-		...mobileBatch === void 0 ? {} : { batch: mobileBatch }
+		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`)),
+		batches
 	});
 }
 /** Replace only DSH's layout client module while retaining its complete plugin graph. */
@@ -2946,6 +3095,15 @@ var MobileAccessGateway = class {
 	server;
 	discoverySocket;
 	discoveryTimer;
+	/**
+	* Why broadcast discovery is unavailable, if it is. Windows keeps separate TCP and
+	* UDP port-exclusion tables, so the port the OS handed the TCP listener can be
+	* refused for UDP. That degradation is survivable but must stay observable: without
+	* it, "the phone cannot find this computer" has no diagnosable cause on the host.
+	*/
+	discoveryError;
+	/** Names of the bundled mobile assets that could not be read, if any. */
+	mobileAssetError;
 	bonjour;
 	pairingCaCertificate;
 	listenerPort;
@@ -2953,6 +3111,8 @@ var MobileAccessGateway = class {
 	activeRequests = /* @__PURE__ */ new Map();
 	activeWebSockets = /* @__PURE__ */ new Map();
 	mobileBootBatches = /* @__PURE__ */ new Map();
+	/** Cached upstream bundle byte sizes (HEAD probes), keyed by resource URL. */
+	bootEntrySizeCache = /* @__PURE__ */ new Map();
 	extensionEventListeners = /* @__PURE__ */ new Set();
 	extensionEventRevision = 0;
 	taskEventListeners = /* @__PURE__ */ new Set();
@@ -3021,6 +3181,9 @@ var MobileAccessGateway = class {
 				if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey) || fingerprint !== this.config.instanceId) throw new Error("pairingCaFile must be the self-signed CA identified by instanceId");
 				this.pairingCaCertificate = certificate.raw.toString("base64");
 			}
+			const missingAssets = [];
+			for (const [label, file] of [["compatibility", this.config.mobileCompatibilityFile], ["layout", this.config.mobileLayoutFile]]) if (!(await lstat(file).catch(() => void 0))?.isFile()) missingAssets.push(label);
+			this.mobileAssetError = missingAssets.length === 0 ? void 0 : `mobile_assets_missing_${missingAssets.join("_")}`;
 			const handler = (request, response) => {
 				this.handleExternalRequest(request, response).catch((error) => {
 					const mapped = mapError(error);
@@ -3093,24 +3256,35 @@ var MobileAccessGateway = class {
 			if (this.closing || !message.equals(DISCOVERY_QUERY) || !addressAllowed(remote.address, this.config.allowedCidrs)) return;
 			socket.send(announcement, remote.port, remote.address, () => void 0);
 		});
-		await new Promise((resolve, reject) => {
-			const failed = (error) => {
-				reject(error);
+		const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
+		if (await new Promise((resolve) => {
+			const onBindError = (error) => {
+				socket.off("error", onBindError);
+				this.discoveryError = Object.freeze({
+					code: typeof error.code === "string" ? error.code : "unknown",
+					message: typeof error.message === "string" ? error.message : String(error)
+				});
+				resolve(false);
 			};
-			socket.once("error", failed);
-			const bindHost = isIP(this.config.listenHost) === 4 && isLoopbackAddress(this.config.listenHost) ? this.config.listenHost : "0.0.0.0";
+			socket.once("error", onBindError);
 			socket.bind(port, bindHost, () => {
-				socket.off("error", failed);
+				socket.off("error", onBindError);
 				socket.setBroadcast(true);
-				resolve();
+				resolve(true);
 			});
-		});
-		const announce = () => {
-			for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
-		};
-		announce();
-		this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
-		this.discoveryTimer.unref();
+		})) {
+			const announce = () => {
+				for (const target of discoveryBroadcastTargets(this.config.allowedCidrs)) socket.send(announcement, port, target, () => void 0);
+			};
+			announce();
+			this.discoveryTimer = setInterval(announce, DISCOVERY_INTERVAL_MS);
+			this.discoveryTimer.unref();
+		} else {
+			this.discoverySocket = void 0;
+			try {
+				socket.close();
+			} catch {}
+		}
 		const deviceName = discoveryDeviceName();
 		const bonjour = new Bonjour({ disableIPv6: true });
 		this.bonjour = bonjour;
@@ -3176,6 +3350,21 @@ var MobileAccessGateway = class {
 			origin
 		});
 	}
+	/**
+	* Report which discovery channels this gateway actually owns.
+	*
+	* Broadcast discovery degrades on its own when its UDP port cannot be bound, so
+	* callers need to tell "discovery is off" from "discovery was never attempted".
+	* mDNS is published independently and is unaffected by that failure.
+	*/
+	discoveryStatus() {
+		return Object.freeze({
+			broadcast: this.discoverySocket !== void 0 && this.discoveryTimer !== void 0,
+			mdns: this.bonjour !== void 0,
+			...this.discoveryError === void 0 ? {} : { errorCode: `discovery_broadcast_${this.discoveryError.code}` },
+			...this.mobileAssetError === void 0 ? {} : { mobileAssetsErrorCode: this.mobileAssetError }
+		});
+	}
 	requirePolicy() {
 		if (this.policy === void 0 || this.closing) throw new HttpError(503, "unavailable");
 		return this.policy;
@@ -3414,6 +3603,10 @@ var MobileAccessGateway = class {
 			file: this.config.mobileLayoutFile,
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
+		} : target.decodedPathname === MOBILE_COMPAT_PATH ? {
+			file: this.config.mobileCompatibilityFile,
+			contentType: "text/javascript; charset=utf-8",
+			fallback: void 0
 		} : void 0 : void 0;
 		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (request.method !== "GET" && request.method !== "HEAD" && request.method !== "POST" && requestedExtension?.kind !== "route") throw new HttpError(405, "method_not_allowed");
@@ -3820,8 +4013,10 @@ var MobileAccessGateway = class {
 			}
 			let body;
 			try {
-				const rewritten = rewriteMobileIndexWithBatch(Buffer.concat(chunks).toString("utf8"));
-				if (rewritten.batch !== void 0) this.rememberMobileBootBatch(rewritten.batch);
+				const html = Buffer.concat(chunks).toString("utf8");
+				const plan = parseMobileBootPlan(html);
+				const rewritten = rewriteMobileIndexWithBatch(html, plan.planEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.planEntries));
+				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
 				body = Buffer.from(rewritten.html);
 			} catch {
 				throw new HttpError(502, "upstream_unavailable");
@@ -3857,6 +4052,98 @@ var MobileAccessGateway = class {
 			this.mobileBootBatches.delete(oldest);
 		}
 	}
+	/**
+	* Determine which layout-batch entries can share a merged boot batch and which
+	* must pass through. An entry at or above the per-entry cap, or one whose size
+	* could not be probed, keeps its own upstream `/plugins` row: a merged batch
+	* cannot carry it, and an unknown bundle must not risk the whole batch.
+	*/
+	async resolveMobileBootSizes(planEntries) {
+		const sizes = /* @__PURE__ */ new Map();
+		const passThrough = /* @__PURE__ */ new Set();
+		const candidates = planEntries.filter((entry) => entry.id !== MOBILE_LAYOUT_MODULE && entry.url.startsWith("/plugins/"));
+		let cursor = 0;
+		const worker = async () => {
+			while (cursor < candidates.length) {
+				const index = cursor++;
+				const source = candidates[index].url;
+				const size = await this.upstreamBundleSize(source);
+				if (size === void 0 || size >= MAX_MOBILE_BOOT_ENTRY_BYTES) passThrough.add(source);
+				else sizes.set(source, size);
+			}
+		};
+		await Promise.all(Array.from({ length: Math.min(8, candidates.length) }, worker));
+		return {
+			sizes,
+			passThrough
+		};
+	}
+	/**
+	* Measure one upstream bundle by reading its body. The upstream serves
+	* `/plugins` bundles as chunked streams without a Content-Length, so a probe
+	* counts bytes; it aborts instantly past the per-entry cap. Measurements are
+	* cached for a short window.
+	*/
+	async upstreamBundleSize(source) {
+		if (!source.startsWith("/plugins/") || source.includes("#")) return void 0;
+		const cached = this.bootEntrySizeCache.get(source);
+		if (cached !== void 0 && Date.now() - cached.at < MOBILE_BOOT_SIZE_CACHE_TTL_MS) return cached.size;
+		const target = new URL(source, this.config.upstreamOrigin);
+		if (target.origin !== this.config.upstreamOrigin.origin) return void 0;
+		const upstreamCookie = await this.upstreamCookieHeader();
+		let upstreamRequest;
+		try {
+			const proxied = await new Promise((resolve, reject) => {
+				upstreamRequest = request({
+					protocol: "http:",
+					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
+					port: Number(this.config.upstreamOrigin.port),
+					method: "GET",
+					path: `${target.pathname}${target.search}`,
+					headers: {
+						host: this.config.upstreamOrigin.host,
+						accept: "text/javascript",
+						"accept-encoding": "identity",
+						[MOBILE_BOOT_SIZE_PROBE_HEADER]: "1",
+						...upstreamCookie === void 0 ? {} : { cookie: upstreamCookie }
+					},
+					agent: false
+				});
+				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
+					upstreamRequest?.destroy(upstreamTimeoutError());
+				});
+				upstreamRequest.once("response", resolve);
+				upstreamRequest.once("error", reject);
+				upstreamRequest.end();
+			});
+			if (proxied.statusCode !== 200) {
+				proxied.resume();
+				return;
+			}
+			const size = await new Promise((resolve, reject) => {
+				let bytes = 0;
+				proxied.on("data", (chunk) => {
+					bytes += chunk.length;
+					if (bytes > MAX_MOBILE_BOOT_ENTRY_BYTES) {
+						proxied.destroy();
+						resolve(void 0);
+					}
+				});
+				proxied.once("end", () => resolve(bytes));
+				proxied.once("error", reject);
+			});
+			if (size === void 0) return void 0;
+			this.bootEntrySizeCache.set(source, {
+				size,
+				at: Date.now()
+			});
+			return size;
+		} catch {
+			return;
+		} finally {
+			upstreamRequest?.destroy();
+		}
+	}
 	async serveMobileBootBatch(key, request, response, authorization) {
 		if (request.method !== "GET" && request.method !== "HEAD") throw new HttpError(405, "method_not_allowed");
 		const stored = this.mobileBootBatches.get(key);
@@ -3938,7 +4225,7 @@ var MobileAccessGateway = class {
 			}
 		};
 		await Promise.all(Array.from({ length: Math.min(3, plan.entries.length) }, worker));
-		if (bodies.reduce((bytes, body) => bytes + body.byteLength + 2, 0) > MAX_MOBILE_BOOT_BATCH_BYTES) throw new HttpError(502, "upstream_unavailable");
+		if (bodies.reduce((bytes, body) => bytes + body.byteLength + MOBILE_BOOT_SEPARATOR_BYTES, 0) > MAX_MOBILE_BOOT_BATCH_BYTES) throw new HttpError(502, "upstream_unavailable");
 		return Buffer.concat(bodies.flatMap((body) => [body, Buffer.from("\n;\n")]));
 	}
 	/**
@@ -4047,7 +4334,39 @@ var MobileAccessGateway = class {
 			}
 		};
 	}
-	async proxyHttp(request$2, response, authorization) {
+	/**
+	* Proxy one request upstream. Pass-through client bundles (`GET /plugins`)
+	* receive bounded transient retries — the upstream resets a fraction of fresh
+	* connections — matching the resilience the merged-batch assembly already has.
+	* A request is only retried before any byte reached the client.
+	*/
+	async proxyHttp(request, response, authorization) {
+		if (!(request.method === "GET" && request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true)) {
+			try {
+				await this.proxyHttpOnce(request, response, authorization);
+			} catch (error) {
+				if (error instanceof HttpError) throw error;
+				if (response.headersSent) response.destroy();
+				else throw new HttpError(502, "upstream_unavailable");
+			}
+			return;
+		}
+		const delay = (attempt) => new Promise((resolve) => setTimeout(resolve, MOBILE_BOOT_RETRY_DELAY_MS * attempt));
+		for (let attempt = 1; attempt <= MOBILE_BOOT_UPSTREAM_ATTEMPTS; attempt++) try {
+			await this.proxyHttpOnce(request, response, authorization);
+			return;
+		} catch (error) {
+			if (response.headersSent) {
+				response.destroy();
+				return;
+			}
+			if (error instanceof HttpError || !isTransientUpstreamError(error)) throw error instanceof HttpError ? error : new HttpError(502, "upstream_unavailable");
+			if (attempt === MOBILE_BOOT_UPSTREAM_ATTEMPTS) throw new HttpError(502, "upstream_unavailable");
+			await delay(attempt);
+		}
+		throw new HttpError(502, "upstream_unavailable");
+	}
+	async proxyHttpOnce(request$2, response, authorization) {
 		const declared = request$2.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const holder = {};
@@ -4101,7 +4420,7 @@ var MobileAccessGateway = class {
 			await bodyDone?.catch(() => void 0);
 			if (error instanceof HttpError) throw error;
 			if (response.headersSent) response.destroy();
-			else throw new HttpError(502, "upstream_unavailable");
+			throw error;
 		} finally {
 			operation.release();
 		}
@@ -4402,7 +4721,8 @@ var MobileAccessGateway = class {
 								connections: this.connectedSockets.size,
 								activeRequests: this.activeRequests.size,
 								webSockets: this.activeWebSockets.size
-							}
+							},
+							discovery: this.discoveryStatus()
 						}, false);
 						return;
 					}
@@ -4693,11 +5013,11 @@ const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION$1}/frp_${FRP_VERSION$1}_darwin_arm64.tar.gz`
 	}
 ].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
-function inside$1(parent, child) {
+function inside$2(parent, child) {
 	const candidate = relative(parent, child);
 	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
 }
-async function regularFile$1(file) {
+async function regularFile$2(file) {
 	try {
 		const entry = await lstat(file);
 		return entry.isFile() && !entry.isSymbolicLink();
@@ -4737,7 +5057,7 @@ async function replaceDirectory(target, candidate) {
 		});
 	}
 }
-function sha256$1(bytes) {
+function sha256$2(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
 async function runCapture(file, args) {
@@ -4789,10 +5109,10 @@ async function defaultExtractArtifact$1(archive, destination, executableName) {
 		executableEntry
 	]);
 	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
-	if (!await regularFile$1(extracted)) throw new Error("frp_archive_executable_invalid");
+	if (!await regularFile$2(extracted)) throw new Error("frp_archive_executable_invalid");
 	await copyFile(extracted, join(destination, executableName));
 }
-async function defaultFetchArtifact$1(artifact, signal) {
+async function defaultFetchArtifact$2(artifact, signal) {
 	const response = await fetch(artifact.downloadUrl, {
 		redirect: "follow",
 		signal
@@ -4861,14 +5181,14 @@ var FrpComponentManager = class {
 			this.componentStorage,
 			this.logRoot,
 			this.stagingRoot
-		]) if (!inside$1(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
-		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$1;
+		]) if (!inside$2(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
+		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$2;
 		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
 		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
 	}
 	/** Inspect the managed executable without relying on global FRP installations. */
 	async initialize() {
-		this.installed = await regularFile$1(this.executable);
+		this.installed = await regularFile$2(this.executable);
 		this.installedBytes = this.installed ? (await stat(this.executable)).size : 0;
 		if (this.installed) try {
 			if (await this.inspectExecutable(this.executable) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
@@ -4915,7 +5235,7 @@ var FrpComponentManager = class {
 					clearTimeout(timeout);
 				}
 				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("frp_download_size_mismatch");
-				if (sha256$1(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
+				if (sha256$2(bytes) !== artifact.downloadSha256) throw new Error("frp_download_hash_mismatch");
 				const archive = join(staging, artifact.archiveName);
 				await writeFile(archive, bytes, {
 					flag: "wx",
@@ -4923,7 +5243,7 @@ var FrpComponentManager = class {
 				});
 				await this.extractArtifact(archive, staging, artifact.executableName);
 				const extracted = join(staging, artifact.executableName);
-				if (!await regularFile$1(extracted)) throw new Error("frp_executable_missing");
+				if (!await regularFile$2(extracted)) throw new Error("frp_executable_missing");
 				await chmod(extracted, 448);
 				if (await this.inspectExecutable(extracted) !== FRP_VERSION$1) throw new Error("frp_component_version_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
@@ -5179,8 +5499,8 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
 }
 //#endregion
 //#region src/frp-config.ts
-const MAX_SETTINGS_BYTES = 8192;
-function hostname$1(value) {
+const MAX_SETTINGS_BYTES$1 = 8192;
+function hostname$2(value) {
 	if (value.length > 253 || !value.includes(".")) return false;
 	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
 }
@@ -5188,7 +5508,7 @@ function hostname$1(value) {
 function validateFrpServerAddress(value) {
 	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
 	const normalized = value.toLowerCase().replace(/\.$/u, "");
-	if (isIP(normalized) === 0 && !hostname$1(normalized)) throw new Error("frp_server_address_invalid");
+	if (isIP(normalized) === 0 && !hostname$2(normalized)) throw new Error("frp_server_address_invalid");
 	return normalized;
 }
 /** Validate the FRP control port. */
@@ -5211,7 +5531,7 @@ function validateFrpPublicOrigin(value) {
 		throw new Error("frp_public_origin_invalid");
 	}
 	const publicHost = url.hostname;
-	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$1(publicHost)) throw new Error("frp_public_origin_invalid");
+	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname$2(publicHost)) throw new Error("frp_public_origin_invalid");
 	if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
 	return url.origin;
 }
@@ -5290,7 +5610,7 @@ function createFrpcToml(settings, localPort) {
 function createFrpServerTemplate(settings) {
 	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin);
 }
-async function atomicPrivateWrite(file, body) {
+async function atomicPrivateWrite$2(file, body) {
 	const directory = dirname(file);
 	await mkdir(directory, {
 		recursive: true,
@@ -5338,7 +5658,7 @@ var FrpConfigStore = class {
 			if (error.code === "ENOENT") return;
 			throw error;
 		}
-		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES$1) {
 			this.errorCode = "frp_config_invalid";
 			return;
 		}
@@ -5373,7 +5693,7 @@ var FrpConfigStore = class {
 	/** Atomically replace private FRP settings. */
 	async configure(value) {
 		const settings = parseFrpSettings(value);
-		await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		await atomicPrivateWrite$2(this.settingsFile, `${JSON.stringify(settings)}\n`);
 		await rm(this.runtimeConfigFile, { force: true });
 		this.settingsValue = settings;
 		this.errorCode = void 0;
@@ -5383,7 +5703,7 @@ var FrpConfigStore = class {
 	async writeRuntimeConfig(localPort) {
 		const settings = this.settingsValue;
 		if (settings === void 0) throw new Error("frp_config_missing");
-		await atomicPrivateWrite(this.runtimeConfigFile, createFrpcToml(settings, localPort));
+		await atomicPrivateWrite$2(this.runtimeConfigFile, createFrpcToml(settings, localPort));
 		return this.runtimeConfigFile;
 	}
 	/** Remove only configuration files owned by the FRP provider. */
@@ -5399,11 +5719,13 @@ var FrpConfigStore = class {
 };
 //#endregion
 //#region src/remote.ts
-const REMOTE_PROVIDERS = [
+const REMOTE_PROVIDERS = Object.freeze([
 	"tailscale",
 	"cpolar",
-	"frp"
-];
+	"cloudflared",
+	"frp",
+	"origin"
+]);
 function aggregateErrors(errors, message) {
 	if (errors.length === 0) return void 0;
 	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
@@ -5529,7 +5851,7 @@ async function terminateRemoteProcess(child, gracefulTimeoutMs = 1500, forcedTim
 function parseRemoteProviderState(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("remote provider state must be an object");
 	const record = value;
-	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "frp" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
+	if (record.version !== 1 || record.provider !== "tailscale" && record.provider !== "cpolar" && record.provider !== "cloudflared" && record.provider !== "frp" && record.provider !== "origin" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "provider")) throw new Error("remote provider state has an unsupported format");
 	return Object.freeze({
 		version: 1,
 		provider: record.provider
@@ -5595,17 +5917,17 @@ var JsonRemoteProviderStore = class {
 /** Resolve the first-run provider without letting environment values bypass validation. */
 function configuredRemoteProvider(environment) {
 	const value = environment.DSH_MOBILE_REMOTE_PROVIDER ?? "tailscale";
-	if (value !== "tailscale" && value !== "cpolar" && value !== "frp") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, or frp");
+	if (value !== "tailscale" && value !== "cpolar" && value !== "cloudflared" && value !== "frp" && value !== "origin") throw new Error("DSH_MOBILE_REMOTE_PROVIDER must be tailscale, cpolar, cloudflared, frp, or origin");
 	return value;
 }
 //#endregion
 //#region src/frp.ts
-const START_TIMEOUT_MS$1 = 45e3;
+const START_TIMEOUT_MS$2 = 45e3;
 const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
 const DISCOVERY_RETRY_MS = 1e3;
 const MAX_DISCOVERY_BYTES = 16384;
 const VHOST_PROBE_TIMEOUT_MS = 1500;
-function publicStatus$2(status) {
+function publicStatus$3(status) {
 	return Object.freeze({
 		enabled: status.enabled,
 		state: status.state,
@@ -5741,7 +6063,7 @@ var FrpController = class {
 	child;
 	gatewayValue;
 	generation = 0;
-	latest = publicStatus$2({
+	latest = publicStatus$3({
 		enabled: false,
 		state: "off"
 	});
@@ -5769,7 +6091,7 @@ var FrpController = class {
 	}
 	/** Return state safe for the desktop control UI. */
 	status() {
-		return publicStatus$2(this.latest);
+		return publicStatus$3(this.latest);
 	}
 	/** Enable or disable FRP without changing LAN or another provider. */
 	async setEnabled(enabled) {
@@ -5835,7 +6157,7 @@ var FrpController = class {
 		return task;
 	}
 	publish(status) {
-		this.latest = publicStatus$2(status);
+		this.latest = publicStatus$3(status);
 		try {
 			this.options.onStatus?.(this.status());
 		} catch {}
@@ -5950,7 +6272,7 @@ var FrpController = class {
 		this.waitForDiscovery(generation, settings.publicOrigin, controller.signal);
 	}
 	async waitForDiscovery(generation, origin, signal) {
-		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$1);
+		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$2);
 		const probe = this.options.probeDiscovery ?? defaultProbeDiscovery;
 		while (!signal.aborted && Date.now() < deadline) {
 			try {
@@ -6017,80 +6339,1436 @@ var FrpController = class {
 	}
 };
 //#endregion
-//#region src/task-events.ts
-const TASK_EVENT_DEBOUNCE_MS = 1e3;
-function turnNumber(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
-}
-function turnData(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
-		turn: 0,
-		completed: false
-	};
-	const record = value;
-	const reason = record.reason;
-	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
-	return {
-		turn: turnNumber(record.turn),
-		completed
-	};
-}
+//#region src/origin-proxy-config.ts
+const DEFAULT_ORIGIN_LISTEN_PORT = 3444;
+const MAX_SETTINGS_BYTES = 8192;
 /**
-* Subscribe to completed root turns. Subagent turns are skipped so one task
-* announces once, and rapid turn boundaries collapse into a single event.
-* Returns a disposer that also drops pending debounces.
+* Ports a user-space listener can actually hold on every supported platform. Below
+* this the bind needs privileges on Linux and macOS and fails with EACCES, which
+* surfaces as a generic start failure rather than a rejected choice.
 */
-function watchTaskCompletions(ctx, options) {
-	const debounceMs = options.debounceMs ?? 1e3;
-	const pending = /* @__PURE__ */ new Map();
-	const disposeListener = ctx.on("session/event", (session, event) => {
-		if (event.type !== "turn/end") return;
-		const { turn, completed } = turnData(event.data);
-		if (!completed) return;
-		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
-		const sessionId = String(session.id);
-		options.log?.("task-completed-observed", {
-			sessionId,
-			turn
-		});
-		const previous = pending.get(sessionId);
-		if (previous !== void 0) clearTimeout(previous);
-		pending.set(sessionId, setTimeout(() => {
-			pending.delete(sessionId);
-			options.log?.("task-completed-announced", {
-				sessionId,
-				turn
-			});
-			options.onTaskCompleted(Object.freeze({
-				sessionId,
-				turn
-			}));
-		}, debounceMs));
+const MIN_ORIGIN_LISTEN_PORT = 1024;
+/** The LAN gateway's HTTPS port, held for as long as DSH runs. */
+const RESERVED_LAN_GATEWAY_PORT$1 = 3443;
+/** DSH's own WebServer port; the plugin cannot function while it is taken. */
+const RESERVED_DSH_WEB_PORT = 3080;
+const PRIVATE_NETWORKS = [
+	"10.0.0.0/8",
+	"172.16.0.0/12",
+	"192.168.0.0/16"
+].map(parseCidr);
+const TRUSTED_NETWORKS = [...PRIVATE_NETWORKS, parseCidr("127.0.0.0/8")];
+/** Require a public HTTPS origin; custom external ports are supported. */
+function validateOriginPublicOrigin(value) {
+	if (typeof value !== "string" || value.length > 512 || /[\s\u0000-\u001f\u007f\\@?#]/u.test(value)) throw new Error("origin_public_origin_invalid");
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("origin_public_origin_invalid");
+	}
+	const host = url.hostname;
+	const validHostname = host.length <= 253 && host.includes(".") && host.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label)) && ![
+		"localhost",
+		"local",
+		"lan",
+		"home",
+		"internal",
+		"home.arpa"
+	].some((suffix) => host === suffix || host.endsWith("." + suffix));
+	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
+	return url.origin;
+}
+/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+function validateOriginListenHost(value) {
+	if (typeof value !== "string" || isIP(value) !== 4 || !isLoopbackAddress(value) && !addressAllowed(value, PRIVATE_NETWORKS)) throw new Error("origin_listen_host_invalid");
+	return value;
+}
+function validateOriginListenPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
+	if (value === RESERVED_LAN_GATEWAY_PORT$1 || value === RESERVED_DSH_WEB_PORT) throw new Error("origin_listen_port_reserved");
+	return Number(value);
+}
+/** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
+function validateOriginAllowedCidrs(value, listenHost) {
+	const input = value === void 0 && isLoopbackAddress(listenHost) ? ["127.0.0.0/8"] : value;
+	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
+	const cidrs = [];
+	for (const entry of input) {
+		if (typeof entry !== "string" || entry.length > 64 || isIP(entry.split("/")[0] ?? "") !== 4) throw new Error("origin_allowed_cidrs_invalid");
+		try {
+			const cidr = parseCidr(entry);
+			if (cidr.bits !== 32 || !TRUSTED_NETWORKS.some((range) => cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
+			cidrs.push(cidr.source);
+		} catch {
+			throw new Error("origin_allowed_cidrs_invalid");
+		}
+	}
+	if (!isLoopbackAddress(listenHost) && !cidrs.some((cidr) => !isLoopbackAddress(cidr.split("/")[0]))) throw new Error("origin_allowed_cidrs_invalid");
+	return Object.freeze([...new Set(cidrs)]);
+}
+/** Validate both saved settings and local administrative requests. */
+function parseOriginSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("origin_settings_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"version",
+		"publicOrigin",
+		"listenHost",
+		"listenPort",
+		"allowedCidrs"
+	].includes(String(key))) || record.version !== void 0 && record.version !== 1) throw new Error("origin_settings_invalid");
+	const listenHost = validateOriginListenHost(record.listenHost === void 0 ? "127.0.0.1" : record.listenHost);
+	return Object.freeze({
+		version: 1,
+		publicOrigin: validateOriginPublicOrigin(record.publicOrigin),
+		listenHost,
+		listenPort: validateOriginListenPort(record.listenPort === void 0 ? DEFAULT_ORIGIN_LISTEN_PORT : record.listenPort),
+		allowedCidrs: validateOriginAllowedCidrs(record.allowedCidrs, listenHost)
 	});
-	return () => {
-		disposeListener();
-		for (const timer of pending.values()) clearTimeout(timer);
-		pending.clear();
-	};
 }
-/** One subscription feeding every live gateway; gateways register on start. */
-var TaskEventHub = class {
-	sinks = /* @__PURE__ */ new Set();
-	/** Register a sink; returns its disposer. */
-	add(sink) {
-		this.sinks.add(sink);
-		return () => {
-			this.sinks.delete(sink);
-		};
+async function atomicPrivateWrite$1(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("origin_config_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
 	}
-	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
-	broadcast(event) {
-		for (const sink of [...this.sinks]) try {
-			sink.broadcastTaskEvent(event);
-		} catch {}
+	const temporary = join(directory, "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
 	}
-	/** Visible for tests. */
-	get size() {
+}
+/** Owns only origin settings; shared paired-device storage is never removed. */
+var OriginConfigStore = class {
+	stateRoot;
+	settingsFile;
+	settingsValue;
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("origin config state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "settings.json");
+	}
+	async initialize() {
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		let entry;
+		try {
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_SETTINGS_BYTES) {
+			this.errorCode = "origin_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseOriginSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+		} catch {
+			this.errorCode = "origin_config_invalid";
+		}
+	}
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			configured: settings !== void 0,
+			...settings === void 0 ? {} : {
+				publicOrigin: settings.publicOrigin,
+				listenHost: settings.listenHost,
+				listenPort: settings.listenPort,
+				allowedCidrs: settings.allowedCidrs,
+				backendOrigin: "http://" + settings.listenHost + ":" + String(settings.listenPort)
+			},
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	settings() {
+		return this.settingsValue;
+	}
+	async configure(value) {
+		const settings = parseOriginSettings(value);
+		await atomicPrivateWrite$1(this.settingsFile, JSON.stringify(settings) + "\n");
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	async purge() {
+		await rm(this.settingsFile, { force: true });
+		this.settingsValue = void 0;
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/origin-proxy.ts
+/** Owns an authenticated HTTP gateway, with no tunnel process or public network probes. */
+var OriginController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	gatewayValue;
+	latest = Object.freeze({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	async initialize() {
+		await this.enqueue(async () => {
+			if (this.disposed) throw new Error("origin_controller_unavailable");
+			if (this.initialized) return;
+			this.enabled = (await this.options.store.load()).enabled;
+			this.initialized = true;
+			if (this.enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+	}
+	gateway() {
+		return this.gatewayValue;
+	}
+	status() {
+		return this.latest;
+	}
+	async setEnabled(enabled) {
+		this.assertAvailable();
+		await this.enqueue(async () => {
+			this.assertAvailable();
+			if (this.enabled === enabled && (!enabled || this.gatewayValue !== void 0)) return;
+			if (!enabled) await this.stop();
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			this.enabled = enabled;
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	async reconnect() {
+		this.assertAvailable();
+		await this.enqueue(async () => {
+			this.assertAvailable();
+			if (!this.enabled) {
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+				this.enabled = true;
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Reset the switch, retaining both settings and shared remote device pairings. */
+	async reset() {
+		return this.setEnabled(false);
+	}
+	/** Stop the listener without changing the durable switch. */
+	async close() {
+		this.disposed = true;
+		await this.enqueue(async () => {
+			await this.stop();
+			this.publish({
+				enabled: this.enabled,
+				state: "off"
+			});
+		});
+	}
+	assertAvailable() {
+		if (!this.initialized || this.disposed) throw new Error("origin_controller_unavailable");
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = Object.freeze({ ...status });
+		try {
+			this.options.onStatus?.(this.latest);
+		} catch {}
+	}
+	async start() {
+		const settings = this.options.config.settings();
+		if (settings === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: this.options.config.status().errorCode ?? "origin_config_missing"
+			});
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin: settings.publicOrigin
+		});
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(settings);
+		} catch (error) {
+			const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+			this.publish({
+				enabled: true,
+				state: "error",
+				origin: settings.publicOrigin,
+				errorCode: code === "EADDRINUSE" ? "origin_listen_port_in_use" : code === "EADDRNOTAVAIL" ? "origin_listen_address_unavailable" : "origin_gateway_start_failed"
+			});
+			return;
+		}
+		this.gatewayValue = gateway;
+		if (this.disposed) {
+			await this.stop();
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin: settings.publicOrigin,
+			backendOrigin: "http://" + settings.listenHost + ":" + String(gateway.address().port)
+		});
+	}
+	async stop() {
+		const gateway = this.gatewayValue;
+		if (gateway === void 0) return;
+		await gateway.close();
+		this.gatewayValue = void 0;
+		this.publish({
+			enabled: this.enabled,
+			state: "off"
+		});
+	}
+};
+//#endregion
+//#region src/component-download.ts
+/**
+* Hosts a pinned GitHub release download may redirect to.
+*
+* `github.com/<owner>/<repo>/releases/download/<tag>/<asset>` does not serve the bytes itself: it
+* answers 302 with a signed URL on a release-asset host. A fetch configured with
+* `redirect: 'error'` fails that hop as `TypeError: fetch failed` (cause: `unexpected redirect`)
+* before a single byte is transferred, which is exactly how the cloudflared component could never
+* install. Following one validated hop keeps the origin restriction while allowing the shape
+* every GitHub release download uses.
+*/
+const RELEASE_ASSET_HOSTS = Object.freeze(["release-assets.githubusercontent.com", "objects.githubusercontent.com"]);
+/** Follow one redirect hop after checking its scheme and host. A second hop is refused. */
+async function followValidatedRedirect(response, request) {
+	const location = response.headers.get("location");
+	if (location === null) throw new Error(`${request.errorPrefix}_download_redirect_missing`);
+	let target;
+	try {
+		target = new URL(location, request.url);
+	} catch {
+		throw new Error(`${request.errorPrefix}_download_redirect_invalid`);
+	}
+	const hosts = request.redirectHosts ?? RELEASE_ASSET_HOSTS;
+	if (target.protocol !== "https:" || !hosts.includes(target.hostname)) throw new Error(`${request.errorPrefix}_download_redirect_rejected`);
+	return fetch(target, {
+		redirect: "error",
+		signal: request.signal
+	});
+}
+/** Attempts per install. A 55 MB transfer through a TUN proxy can reset mid-stream: the first
+* real run in the development environment failed after 1.5 MB and succeeded on the next attempt,
+* which is exactly the confusing "nothing happened" the user saw. */
+const DOWNLOAD_ATTEMPTS = 2;
+const RETRY_DELAY_MS = 750;
+/** Whether a failure is a transport problem worth a second attempt rather than a verdict. */
+function isRetryable(error) {
+	if (error instanceof TypeError) return true;
+	if (error instanceof Error && /_download_http_5\d\d$/u.test(error.message)) return true;
+	return false;
+}
+function delay(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+async function attemptDownload(request) {
+	const first = await fetch(request.url, {
+		redirect: "manual",
+		signal: request.signal
+	});
+	const response = first.status >= 300 && first.status < 400 ? await followValidatedRedirect(first, request) : first;
+	if (!response.ok) throw new Error(`${request.errorPrefix}_download_http_${String(response.status)}`);
+	const declared = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength !== request.expectedBytes) throw new Error(`${request.errorPrefix}_download_size_mismatch`);
+	return bytes;
+}
+/**
+* Download a pinned artifact, following at most one validated redirect, and check its exact length.
+* A transport failure is retried once; a length or redirect verdict is not. The caller still
+* verifies the SHA-256 before publishing anything.
+* @param request - the pinned URL, its exact byte length and the caller's error prefix.
+* @returns the artifact bytes.
+*/
+async function downloadPinnedArtifact(request) {
+	let lastError;
+	for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt += 1) try {
+		return await attemptDownload(request);
+	} catch (error) {
+		lastError = error;
+		if (attempt === DOWNLOAD_ATTEMPTS || !isRetryable(error)) throw error;
+		await delay(RETRY_DELAY_MS);
+	}
+	throw lastError;
+}
+//#endregion
+//#region src/cloudflared-component.ts
+const CLOUDFLARED_VERSION = "2026.9.1";
+/** Pinned official cloudflared release metadata for supported desktop targets. */
+const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "win32",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-windows-amd64.exe`,
+		downloadBytes: 54976432,
+		downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
+		executableName: "cloudflared.exe"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "linux",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-amd64`,
+		downloadBytes: 39838488,
+		downloadSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
+		executableName: "cloudflared"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "linux",
+		arch: "arm64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64`,
+		downloadBytes: 37466252,
+		downloadSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
+		executableName: "cloudflared"
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
+/**
+* Canonical release metadata. New code should select from
+* {@link CLOUDFLARED_COMPONENT_RELEASES} by platform and architecture; this
+* alias preserves the original Windows x64 entry for existing callers.
+*/
+const CLOUDFLARED_COMPONENT_RELEASE = CLOUDFLARED_COMPONENT_RELEASES["win32-x64"];
+const DOWNLOAD_PAGE$1 = "https://github.com/cloudflare/cloudflared/releases";
+const TERMS_URL$1 = "https://www.cloudflare.com/website-terms/";
+function inside$1(parent, child) {
+	const candidate = relative(parent, child);
+	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
+}
+async function sha256$1(file) {
+	return createHash("sha256").update(await readFile(file)).digest("hex");
+}
+async function regularFile$1(file, expectedBytes) {
+	try {
+		const stat = await lstat(file);
+		return stat.isFile() && !stat.isSymbolicLink() && (expectedBytes === void 0 || stat.size === expectedBytes);
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function defaultFetchArtifact$1(url, signal, expectedBytes) {
+	return downloadPinnedArtifact({
+		url,
+		expectedBytes,
+		errorPrefix: "cloudflared",
+		signal
+	});
+}
+/** Select the pinned artifact for one host, or undefined where unsupported. */
+function lookupRelease(platform, arch) {
+	return CLOUDFLARED_COMPONENT_RELEASES[`${platform}-${arch}`];
+}
+/** Owns the optional cloudflared binary inside DSH Mobile state. */
+var CloudflaredComponentManager = class {
+	executable;
+	componentRoot;
+	componentStorage;
+	stateRoot;
+	logRoot;
+	stagingRoot;
+	platform;
+	arch;
+	release;
+	fetchArtifact;
+	installed = false;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		const stateDirectory = resolve(options.stateDirectory);
+		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared state directory must be absolute");
+		this.platform = options.platform ?? process.platform;
+		this.arch = options.arch ?? process.arch;
+		this.release = lookupRelease(this.platform, this.arch);
+		this.componentRoot = join(stateDirectory, "components", "cloudflared");
+		this.componentStorage = join(this.componentRoot, this.release?.version ?? CLOUDFLARED_VERSION);
+		this.executable = join(this.componentStorage, this.release?.executableName ?? "cloudflared");
+		this.stateRoot = join(stateDirectory, "state", "cloudflared");
+		this.logRoot = join(stateDirectory, "logs", "cloudflared");
+		this.stagingRoot = join(stateDirectory, "staging", "cloudflared");
+		for (const child of [
+			this.componentRoot,
+			this.componentStorage,
+			this.stateRoot,
+			this.logRoot,
+			this.stagingRoot
+		]) if (!inside$1(stateDirectory, child)) throw new Error("cloudflared component path escaped its state directory");
+		const release = this.release;
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact$1(url, signal, release?.downloadBytes ?? 0));
+	}
+	/** Inspect the managed binary without using any global cloudflared state. */
+	async initialize() {
+		const release = this.release;
+		this.installed = release !== void 0 && await regularFile$1(this.executable, release.downloadBytes);
+		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.downloadSha256) {
+			this.installed = false;
+			this.errorCode = "cloudflared_component_invalid";
+		}
+	}
+	/** Return a safe status that never includes machine-specific account data. */
+	status() {
+		const release = this.release ?? CLOUDFLARED_COMPONENT_RELEASE;
+		return Object.freeze({
+			supported: this.release !== void 0,
+			installed: this.installed,
+			version: release.version,
+			downloadBytes: release.downloadBytes,
+			installedBytes: release.downloadBytes,
+			sourceUrl: release.downloadUrl,
+			downloadPage: DOWNLOAD_PAGE$1,
+			termsUrl: TERMS_URL$1,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Download, verify, and install the pinned cloudflared executable after explicit confirmation. */
+	install() {
+		return this.enqueue(async () => {
+			const release = this.release;
+			if (release === void 0) throw new Error("cloudflared_component_unsupported");
+			await mkdir(this.stagingRoot, {
+				recursive: true,
+				mode: 448
+			});
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 3e5);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(release.downloadUrl, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (bytes.byteLength !== release.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
+				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
+				const staged = join(staging, release.executableName);
+				await writeFile(staged, bytes, {
+					flag: "wx",
+					mode: 384
+				});
+				await chmod(staged, 448);
+				if (!await regularFile$1(staged, release.downloadBytes) || await sha256$1(staged) !== release.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
+				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
+				await mkdir(candidate, {
+					recursive: true,
+					mode: 448
+				});
+				await copyFile(staged, join(candidate, release.executableName));
+				await chmod(join(candidate, release.executableName), 448);
+				await rm(this.componentStorage, {
+					recursive: true,
+					force: true
+				});
+				await rename(candidate, this.componentStorage);
+				this.installed = true;
+				this.errorCode = void 0;
+			} finally {
+				await rm(staging, {
+					recursive: true,
+					force: true
+				});
+			}
+		});
+	}
+	/** Remove every cloudflared file owned by DSH Mobile without touching global state. */
+	purge() {
+		return this.enqueue(async () => {
+			await Promise.all([
+				rm(this.componentRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stateRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.logRoot, {
+					recursive: true,
+					force: true
+				}),
+				rm(this.stagingRoot, {
+					recursive: true,
+					force: true
+				})
+			]);
+			this.installed = false;
+			this.errorCode = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+//#endregion
+//#region src/cloudflared.ts
+const MAX_LOG_BUFFER_BYTES$1 = 65536;
+/**
+* A quick tunnel has to be allocated and registered with the Cloudflare edge
+* before the public hostname appears. That is slower than a cpolar control
+* handshake but still bounded; 60 s keeps a genuinely stalled client from
+* looking healthy for longer than a user will wait.
+*/
+const START_TIMEOUT_MS$1 = 6e4;
+/**
+* How many startup-timeout rounds a named tunnel may wait through while its
+* connector process is still alive. A rebooted PC often autostarts DSH before
+* Wi-Fi / VPN / DNS is usable; cloudflared retries the edge on its own, so
+* killing it after a single 60 s window turns a slow boot into a manual
+* reconnect loop. An exited connector (bad token, bad config) still fails fast
+* on the first round.
+*/
+const NAMED_STARTUP_ROUNDS = 5;
+const CLOUDFLARED_HOST_SUFFIX = ".trycloudflare.com";
+/**
+* Subdomains Cloudflare reserves for its own control plane.
+*
+* The quick-tunnel banner prints `https://api.trycloudflare.com` (the registration API) before it
+* prints the tunnel's own hostname, and that address satisfies a bare suffix check. Adopting it
+* would put the API host in the pairing QR code, where the phone gets `{"code":10005","message":
+* "Method Not Allowed"}` instead of DSH. A quick tunnel is always one random label under the
+* suffix, so the reserved single labels are refused outright.
+*/
+const RESERVED_CLOUDFLARED_LABELS = Object.freeze([
+	"api",
+	"www",
+	"update",
+	"login"
+]);
+function publicStatus$2(status) {
+	return Object.freeze({
+		enabled: status.enabled,
+		state: status.state,
+		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode }
+	});
+}
+/**
+* Whether a hostname is a quick-tunnel host: exactly one random label under the provider suffix,
+* never one of the reserved control-plane labels.
+*/
+function isCloudflaredHost(hostname) {
+	const lower = hostname.toLowerCase();
+	if (!lower.endsWith(CLOUDFLARED_HOST_SUFFIX)) return false;
+	const label = lower.slice(0, -18);
+	return label !== "" && !label.includes(".") && !RESERVED_CLOUDFLARED_LABELS.includes(label);
+}
+/**
+* Extract a validated public HTTPS origin from one cloudflared output line.
+*
+* Quick tunnels print the public hostname inside a decorated banner, so the
+* candidate is taken from the line and then re-parsed as a URL: a lookalike such
+* as `https://x.trycloudflare.com.evil.test` fails the hostname check instead of
+* being truncated into an accepted origin.
+*/
+function parseCloudflaredOrigin(line) {
+	if (!line.toLowerCase().includes("trycloudflare.com")) return void 0;
+	const match = /https?:\/\/[^\s"'|<>]+/u.exec(line);
+	if (match === null) return void 0;
+	const candidate = match[0].replace(/[),.;:]+$/u, "");
+	let url;
+	try {
+		url = new URL(candidate);
+	} catch {
+		throw new Error("invalid_cloudflared_origin");
+	}
+	if (url.protocol !== "https:" || url.port !== "" || !isCloudflaredHost(url.hostname) || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "") throw new Error("invalid_cloudflared_origin");
+	return url.origin;
+}
+/**
+* Whether one cloudflared log line reports an established edge connection.
+*
+* A named tunnel prints no banner, so registration is the only signal that the
+* connector reached Cloudflare and the public hostname can serve traffic. Both
+* the current and the older wording are accepted; anything else is ignored so a
+* chatty log line cannot be mistaken for readiness.
+*/
+function isCloudflaredRegistration(line) {
+	return /registered tunnel connection/iu.test(line) || /connection\s+[0-9a-f][0-9a-f-]{7,}\s+registered/iu.test(line);
+}
+async function reserveLoopbackPort$1(requestedPort) {
+	const server = createServer((socket) => {
+		socket.destroy();
+	});
+	await new Promise((resolveListen, reject) => {
+		server.once("error", reject);
+		server.listen(requestedPort ?? 0, "127.0.0.1", () => {
+			server.off("error", reject);
+			resolveListen();
+		});
+	});
+	const address = server.address();
+	if (address === null || typeof address === "string") {
+		server.close();
+		throw new Error("cloudflared_port_reservation_failed");
+	}
+	let released = false;
+	return {
+		port: address.port,
+		release: async () => {
+			if (released) return;
+			released = true;
+			await new Promise((resolveClose) => {
+				server.close(() => resolveClose());
+			});
+		}
+	};
+}
+function spawnCloudflaredProcess(executable, args, environment) {
+	return spawn(executable, [...args], {
+		env: environment,
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+}
+function withoutProxyEnvironment$1(environment) {
+	const blocked = /* @__PURE__ */ new Set([
+		"HTTP_PROXY",
+		"HTTPS_PROXY",
+		"ALL_PROXY",
+		"NO_PROXY"
+	]);
+	return Object.fromEntries(Object.entries(environment).filter(([name]) => !blocked.has(name.toUpperCase())));
+}
+/**
+* Owns an installed cloudflared client and a provider-specific DSH remote gateway.
+*
+* Quick tunnels allocate a random hostname and a random forward port on every
+* start. Named tunnels instead read an account token and a stable public
+* hostname from the tunnel store, forward to the configured loopback port, and
+* learn readiness from the connector's registration line rather than a banner.
+*/
+var CloudflaredController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	reservation;
+	generation = 0;
+	buffer = "";
+	mode = "quick";
+	namedOrigin;
+	latest = publicStatus$2({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	startupTimer;
+	startupRounds = 0;
+	constructor(options) {
+		this.options = options;
+		if (!isAbsolute(options.executable)) throw new Error("cloudflared executable path must be absolute");
+	}
+	/** Restore the remembered cloudflared switch independently from LAN and other providers. */
+	async initialize() {
+		const state = await this.options.store.load();
+		this.enabled = state.enabled;
+		this.initialized = true;
+		if (this.enabled) await this.start();
+		else this.publish({
+			enabled: false,
+			state: "off"
+		});
+	}
+	/** Return the active cloudflared-backed DSH gateway. */
+	gateway() {
+		return this.gatewayValue;
+	}
+	/** Return state safe for the desktop control UI. */
+	status() {
+		return publicStatus$2(this.latest);
+	}
+	/** Enable or disable cloudflared without changing LAN or other provider state. */
+	async setEnabled(enabled) {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			if (this.enabled === enabled && (enabled === false || this.child !== void 0)) return;
+			if (!enabled) await this.stop();
+			this.enabled = enabled;
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Restart cloudflared and allocate a fresh quick tunnel. */
+	async reconnect() {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			if (!this.enabled) {
+				this.enabled = true;
+				await this.options.store.save({
+					version: 1,
+					enabled: true
+				});
+			}
+			await this.stop();
+			await this.start();
+		});
+		return this.status();
+	}
+	/** Disable cloudflared without deleting the installed component. */
+	async reset() {
+		if (!this.initialized || this.disposed) throw new Error("cloudflared controller is unavailable");
+		await this.enqueue(async () => {
+			await this.stop();
+			this.enabled = false;
+			await this.options.store.save({
+				version: 1,
+				enabled: false
+			});
+			this.publish({
+				enabled: false,
+				state: "off"
+			});
+		});
+		return this.status();
+	}
+	/** Stop owned resources without changing the remembered switch. */
+	async close() {
+		if (this.disposed) return;
+		this.disposed = true;
+		await this.enqueue(() => this.stop());
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = publicStatus$2(status);
+		try {
+			this.options.onStatus?.(this.status());
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		let executableEntry;
+		try {
+			executableEntry = await lstat(this.options.executable);
+		} catch {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cloudflared_component_missing"
+			});
+			return;
+		}
+		if (!executableEntry.isFile() || executableEntry.isSymbolicLink()) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "cloudflared_component_invalid"
+			});
+			return;
+		}
+		const settings = this.options.tunnel.settings();
+		const named = settings.mode === "named" ? settings : void 0;
+		this.mode = settings.mode;
+		this.namedOrigin = named === void 0 ? void 0 : `https://${named.hostname}`;
+		let reservation;
+		try {
+			reservation = await reserveLoopbackPort$1(named?.port);
+		} catch (error) {
+			const conflict = error?.code === "EADDRINUSE";
+			this.publish({
+				enabled: true,
+				state: "error",
+				errorCode: conflict ? named === void 0 ? "cloudflared_port_unavailable" : "cloudflared_tunnel_port_unavailable" : "cloudflared_port_reservation_failed"
+			});
+			return;
+		}
+		this.reservation = reservation;
+		this.buffer = "";
+		this.startupRounds = 0;
+		this.publish({
+			enabled: true,
+			state: "starting"
+		});
+		if (named !== void 0) {
+			const origin = this.namedOrigin;
+			this.publish({
+				enabled: true,
+				state: "connecting",
+				origin
+			});
+			await reservation.release();
+			if (this.reservation === reservation) this.reservation = void 0;
+			let gateway;
+			try {
+				gateway = await this.options.createGateway(origin, reservation.port);
+			} catch (error) {
+				const conflict = error?.code === "EADDRINUSE";
+				this.publish({
+					enabled: true,
+					state: "error",
+					errorCode: conflict ? "cloudflared_tunnel_port_unavailable" : "gateway_start_failed"
+				});
+				return;
+			}
+			if (generation !== this.generation || !this.enabled || this.disposed) {
+				await gateway.close();
+				return;
+			}
+			this.gatewayValue = gateway;
+		}
+		const args = named === void 0 ? [
+			"tunnel",
+			"--url",
+			`http://127.0.0.1:${String(reservation.port)}`,
+			"--no-autoupdate"
+		] : [
+			"tunnel",
+			"--no-autoupdate",
+			"run"
+		];
+		const environment = withoutProxyEnvironment$1(process.env);
+		if (named !== void 0) environment.TUNNEL_TOKEN = named.token;
+		const child = (this.options.spawnProcess ?? spawnCloudflaredProcess)(this.options.executable, args, environment);
+		this.child = child;
+		child.stdout.setEncoding("utf8");
+		child.stderr.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.stderr.on("data", (chunk) => {
+			this.consume(generation, String(chunk));
+		});
+		child.once("error", () => {
+			this.enqueue(() => this.failGeneration(generation, "cloudflared_launch_failed"));
+		});
+		child.once("close", (code) => {
+			if (generation !== this.generation || this.child !== child) return;
+			this.child = void 0;
+			if (this.enabled) this.enqueue(() => this.failGeneration(generation, code === 0 ? "cloudflared_stopped" : "cloudflared_exited"));
+		});
+		this.armStartupTimer(generation);
+	}
+	armStartupTimer(generation) {
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = setTimeout(() => {
+			this.enqueue(() => this.checkStartupTimeout(generation));
+		}, this.options.startupTimeoutMs ?? START_TIMEOUT_MS$1);
+		this.startupTimer.unref();
+	}
+	/**
+	* Give a live named connector more time instead of killing it: it retries the
+	* edge on its own and usually registers once the rebooted network is usable.
+	* A dead connector, or an exhausted budget, fails the generation as before.
+	*/
+	async checkStartupTimeout(generation) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		if (this.latest.state === "ready") return;
+		const childAlive = this.child !== void 0 && this.child.exitCode === null;
+		const budget = this.options.maxStartupRounds ?? NAMED_STARTUP_ROUNDS;
+		if (this.mode === "named" && childAlive && this.startupRounds + 1 < budget) {
+			this.startupRounds += 1;
+			this.armStartupTimer(generation);
+			return;
+		}
+		await this.failGeneration(generation, "cloudflared_start_timeout");
+	}
+	consume(generation, chunk) {
+		if (generation !== this.generation) return;
+		this.buffer += chunk;
+		if (Buffer.byteLength(this.buffer, "utf8") > MAX_LOG_BUFFER_BYTES$1 && !this.buffer.includes("\n")) {
+			this.enqueue(() => this.failGeneration(generation, "cloudflared_invalid_output"));
+			return;
+		}
+		while (true) {
+			const newline = this.buffer.indexOf("\n");
+			if (newline < 0) return;
+			const line = this.buffer.slice(0, newline).replace(/\r$/u, "");
+			this.buffer = this.buffer.slice(newline + 1);
+			if (this.mode === "named") {
+				if (isCloudflaredRegistration(line)) this.enqueue(() => this.confirmNamedReady(generation));
+				continue;
+			}
+			let origin;
+			try {
+				origin = parseCloudflaredOrigin(line);
+			} catch {
+				this.enqueue(() => this.failGeneration(generation, "cloudflared_invalid_origin"));
+				return;
+			}
+			if (origin !== void 0) this.enqueue(() => this.attachGateway(generation, origin));
+		}
+	}
+	/** Mark a named tunnel ready once the connector has registered with the edge. */
+	async confirmNamedReady(generation) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		if (this.gatewayValue === void 0 || this.latest.state === "ready") return;
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			...this.namedOrigin === void 0 ? {} : { origin: this.namedOrigin }
+		});
+	}
+	async attachGateway(generation, origin) {
+		if (generation !== this.generation || !this.enabled || this.disposed) return;
+		const current = this.gatewayValue;
+		if (current !== void 0) {
+			if (current.address().origin === origin) return;
+			await this.rotateGateway(generation, origin, current);
+			return;
+		}
+		const reservation = this.reservation;
+		if (reservation === void 0) return;
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		await reservation.release();
+		if (this.reservation === reservation) this.reservation = void 0;
+		let gateway;
+		try {
+			gateway = await this.options.createGateway(origin, reservation.port);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) {
+			await gateway.close();
+			return;
+		}
+		this.gatewayValue = gateway;
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	/** Replace the gateway authority when a quick tunnel restarts on a new hostname. */
+	async rotateGateway(generation, origin, current) {
+		const listenPort = current.address().port;
+		if (this.gatewayValue === current) this.gatewayValue = void 0;
+		this.publish({
+			enabled: true,
+			state: "connecting",
+			origin
+		});
+		try {
+			await current.close();
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) return;
+		let replacement;
+		try {
+			replacement = await this.options.createGateway(origin, listenPort);
+		} catch {
+			await this.failGeneration(generation, "gateway_start_failed");
+			return;
+		}
+		if (generation !== this.generation || !this.enabled || this.disposed || this.child === void 0) {
+			await replacement.close();
+			return;
+		}
+		this.gatewayValue = replacement;
+		this.publish({
+			enabled: true,
+			state: "ready",
+			origin
+		});
+	}
+	async failGeneration(generation, code) {
+		if (generation !== this.generation) return;
+		await this.stopProcessAndGateway();
+		if (this.enabled) this.publish({
+			enabled: true,
+			state: "error",
+			errorCode: code
+		});
+	}
+	async stop() {
+		++this.generation;
+		await this.stopProcessAndGateway();
+	}
+	async stopProcessAndGateway() {
+		if (this.startupTimer !== void 0) clearTimeout(this.startupTimer);
+		this.startupTimer = void 0;
+		const reservation = this.reservation;
+		this.reservation = void 0;
+		const child = this.child;
+		this.child = void 0;
+		const gateway = this.gatewayValue;
+		this.gatewayValue = void 0;
+		await settleRemoteResources([
+			() => reservation?.release(),
+			() => child !== void 0 && child.exitCode === null ? terminateRemoteProcess(child) : void 0,
+			() => gateway?.close()
+		], "cloudflared resource cleanup failed");
+	}
+};
+//#endregion
+//#region src/cloudflared-tunnel.ts
+const MAX_CONFIG_BYTES = 8192;
+const QUICK_TUNNEL_SUFFIX = ".trycloudflare.com";
+/** Cloudflare's own tunnel-routing domain; it can never be a public hostname. */
+const TUNNEL_ROUTING_SUFFIX = ".cfargotunnel.com";
+/**
+* The bare registrable names behind those suffixes. A suffix test alone accepts
+* them, yet Cloudflare owns both apexes outright, so neither can ever be routed to
+* a customer tunnel.
+*/
+const RESERVED_APEX_NAMES = Object.freeze([QUICK_TUNNEL_SUFFIX.slice(1), TUNNEL_ROUTING_SUFFIX.slice(1)]);
+/** Ports below this need privileges on every supported platform. */
+const MIN_PORT = 1024;
+const MAX_PORT = 65535;
+/**
+* The LAN gateway's HTTPS port, held by the plugin for as long as DSH runs. It is
+* never available to a tunnel, so a configuration naming it must be refused up
+* front rather than failing later as a generic "port in use".
+*/
+const RESERVED_LAN_GATEWAY_PORT = 3443;
+const MAX_TOKEN_LENGTH = 4096;
+function hostname$1(value) {
+	if (value.length > 253 || !value.includes(".")) return false;
+	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+}
+/**
+* Validate the public hostname Cloudflare routes to this tunnel.
+*
+* The name must be a real DNS name, not an IP literal or a wildcard, and it
+* cannot sit under Cloudflare's own control-plane suffixes: `trycloudflare.com`
+* belongs to quick tunnels, and a `cfargotunnel.com` name is the routing target
+* rather than a routable public address.
+*/
+function validateCloudflaredTunnelHostname(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253) throw new Error("cloudflared_tunnel_hostname_invalid");
+	const normalized = value.toLowerCase().replace(/\.$/u, "");
+	if (isIP(normalized) !== 0 || !hostname$1(normalized) || normalized.includes("*") || RESERVED_APEX_NAMES.includes(normalized) || normalized.endsWith(QUICK_TUNNEL_SUFFIX) || normalized.endsWith(TUNNEL_ROUTING_SUFFIX)) throw new Error("cloudflared_tunnel_hostname_invalid");
+	return normalized;
+}
+/** Validate the stable loopback port Cloudflare's ingress forwards to. */
+function validateCloudflaredTunnelPort(value) {
+	if (!Number.isSafeInteger(value) || Number(value) < MIN_PORT || Number(value) > MAX_PORT) throw new Error("cloudflared_tunnel_port_invalid");
+	if (value === RESERVED_LAN_GATEWAY_PORT) throw new Error("cloudflared_tunnel_port_reserved");
+	return Number(value);
+}
+/**
+* Validate a connector token before durable storage.
+*
+* A token is a base64url-encoded JSON blob that carries the account, tunnel id
+* and tunnel secret; the provider passes it through the environment rather than
+* the command line, and it is never returned to any client.
+*/
+function validateCloudflaredTunnelToken(value) {
+	if (typeof value !== "string" || value !== value.trim() || value.length < 32 || value.length > MAX_TOKEN_LENGTH || !/^[A-Za-z0-9_=+/-]+$/u.test(value)) throw new Error("cloudflared_tunnel_token_invalid");
+	return value;
+}
+/** Parse tunnel settings at the request and filesystem boundaries. */
+function parseCloudflaredTunnelSettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("cloudflared_tunnel_settings_invalid");
+	const record = value;
+	const allowed = [
+		"version",
+		"mode",
+		"token",
+		"hostname",
+		"port"
+	];
+	if (Reflect.ownKeys(record).some((key) => !allowed.includes(String(key)))) throw new Error("cloudflared_tunnel_settings_invalid");
+	if (record.version !== void 0 && record.version !== 1) throw new Error("cloudflared_tunnel_settings_invalid");
+	const mode = record.mode ?? "quick";
+	if (mode === "quick") {
+		if (record.token !== void 0 || record.hostname !== void 0 || record.port !== void 0) throw new Error("cloudflared_tunnel_settings_invalid");
+		return Object.freeze({
+			version: 1,
+			mode: "quick"
+		});
+	}
+	if (mode !== "named") throw new Error("cloudflared_tunnel_settings_invalid");
+	return Object.freeze({
+		version: 1,
+		mode: "named",
+		token: validateCloudflaredTunnelToken(record.token),
+		hostname: validateCloudflaredTunnelHostname(record.hostname),
+		port: validateCloudflaredTunnelPort(record.port)
+	});
+}
+/**
+* Merge a partial panel request with the saved named-tunnel settings so a blank
+* field keeps its stored value. The token in particular is write-only, so the
+* panel submits an empty string to mean "keep the existing connector token".
+*/
+function mergeSavedCloudflaredTunnelSettings(partial, saved) {
+	const requested = partial.mode ?? saved?.mode ?? "quick";
+	if (requested !== "quick" && requested !== "named") throw new Error("cloudflared_tunnel_settings_invalid");
+	if (requested === "quick") return parseCloudflaredTunnelSettings({
+		version: 1,
+		mode: "quick"
+	});
+	const previous = saved?.mode === "named" ? saved : void 0;
+	const token = partial.token === "" || partial.token === void 0 ? previous?.token : partial.token;
+	const hostname = partial.hostname === "" || partial.hostname === void 0 ? previous?.hostname : partial.hostname;
+	const port = partial.port === void 0 || partial.port === "" ? previous?.port : partial.port;
+	if (token === void 0 || hostname === void 0 || port === void 0) throw new Error("cloudflared_tunnel_config_missing");
+	return parseCloudflaredTunnelSettings({
+		version: 1,
+		mode: "named",
+		token,
+		hostname,
+		port
+	});
+}
+async function atomicPrivateWrite(file, body) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		const current = await lstat(file);
+		if (!current.isFile() || current.isSymbolicLink()) throw new Error("cloudflared_tunnel_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} catch (error) {
+		await rm(temporary, { force: true });
+		throw error;
+	}
+}
+/** Owns the private cloudflared tunnel configuration for one DSH installation. */
+var CloudflaredTunnelStore = class {
+	stateRoot;
+	settingsFile;
+	settingsValue = Object.freeze({
+		version: 1,
+		mode: "quick"
+	});
+	errorCode;
+	constructor(stateDirectory) {
+		if (!isAbsolute(stateDirectory)) throw new Error("cloudflared tunnel state directory must be absolute");
+		this.stateRoot = resolve(stateDirectory);
+		this.settingsFile = join(this.stateRoot, "tunnel.json");
+	}
+	/** Load private settings while rejecting links, oversized files and unknown fields. */
+	async initialize() {
+		let entry;
+		try {
+			entry = await lstat(this.settingsFile);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_CONFIG_BYTES) {
+			this.errorCode = "cloudflared_tunnel_config_invalid";
+			return;
+		}
+		await restrictPrivateFile(this.settingsFile);
+		try {
+			this.settingsValue = parseCloudflaredTunnelSettings(JSON.parse(await readFile(this.settingsFile, "utf8")));
+			this.errorCode = void 0;
+		} catch {
+			this.settingsValue = Object.freeze({
+				version: 1,
+				mode: "quick"
+			});
+			this.errorCode = "cloudflared_tunnel_config_invalid";
+		}
+	}
+	/** Return configuration metadata without exposing the connector token. */
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			mode: settings.mode,
+			configured: settings.mode === "named",
+			...settings.mode === "named" ? {
+				hostname: settings.hostname,
+				port: settings.port
+			} : {},
+			storagePath: this.stateRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Return private settings only to the provider lifecycle. */
+	settings() {
+		return this.settingsValue;
+	}
+	/** Atomically replace the tunnel configuration. */
+	async configure(value) {
+		const settings = parseCloudflaredTunnelSettings(value);
+		if (settings.mode === "quick") await rm(this.settingsFile, { force: true });
+		else await atomicPrivateWrite(this.settingsFile, `${JSON.stringify(settings)}\n`);
+		this.settingsValue = settings;
+		this.errorCode = void 0;
+		return this.status();
+	}
+	/** Forget a named tunnel and its connector token. */
+	async purge() {
+		await rm(this.settingsFile, { force: true });
+		this.settingsValue = Object.freeze({
+			version: 1,
+			mode: "quick"
+		});
+		this.errorCode = void 0;
+		return this.status();
+	}
+};
+//#endregion
+//#region src/task-events.ts
+const TASK_EVENT_DEBOUNCE_MS = 1e3;
+function turnNumber(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function turnData(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {
+		turn: 0,
+		completed: false
+	};
+	const record = value;
+	const reason = record.reason;
+	const completed = typeof reason === "string" ? reason === "completed" : reason !== null && typeof reason === "object" && reason.kind === "completed";
+	return {
+		turn: turnNumber(record.turn),
+		completed
+	};
+}
+/**
+* Subscribe to completed root turns. Subagent turns are skipped so one task
+* announces once, and rapid turn boundaries collapse into a single event.
+* Returns a disposer that also drops pending debounces.
+*/
+function watchTaskCompletions(ctx, options) {
+	const debounceMs = options.debounceMs ?? 1e3;
+	const pending = /* @__PURE__ */ new Map();
+	const disposeListener = ctx.on("session/event", (session, event) => {
+		if (event.type !== "turn/end") return;
+		const { turn, completed } = turnData(event.data);
+		if (!completed) return;
+		if (session.header?.parentSession !== void 0 && session.header?.parentSession !== null) return;
+		const sessionId = String(session.id);
+		options.log?.("task-completed-observed", {
+			sessionId,
+			turn
+		});
+		const previous = pending.get(sessionId);
+		if (previous !== void 0) clearTimeout(previous);
+		pending.set(sessionId, setTimeout(() => {
+			pending.delete(sessionId);
+			options.log?.("task-completed-announced", {
+				sessionId,
+				turn
+			});
+			options.onTaskCompleted(Object.freeze({
+				sessionId,
+				turn
+			}));
+		}, debounceMs));
+	});
+	return () => {
+		disposeListener();
+		for (const timer of pending.values()) clearTimeout(timer);
+		pending.clear();
+	};
+}
+/** One subscription feeding every live gateway; gateways register on start. */
+var TaskEventHub = class {
+	sinks = /* @__PURE__ */ new Set();
+	/** Register a sink; returns its disposer. */
+	add(sink) {
+		this.sinks.add(sink);
+		return () => {
+			this.sinks.delete(sink);
+		};
+	}
+	/** Fan out to a snapshot so a failing sink cannot break its siblings. */
+	broadcast(event) {
+		for (const sink of [...this.sinks]) try {
+			sink.broadcastTaskEvent(event);
+		} catch {}
+	}
+	/** Visible for tests. */
+	get size() {
 		return this.sinks.size;
 	}
 };
@@ -6114,6 +7792,20 @@ const REMOTE_ERROR_GUIDANCE = Object.freeze({
 	cpolar_start_timeout: "检查网络后点击“重新连接”。",
 	cpolar_stopped: "点击“重新连接”。",
 	cpolar_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_component_missing: "先安装 cloudflared 官方组件。",
+	cloudflared_component_invalid: "彻底移除 cloudflared 组件后重新安装。",
+	cloudflared_port_unavailable: "无法分配本机远程网关端口，请重试。",
+	cloudflared_launch_failed: "重新安装 cloudflared 官方组件后重试。",
+	cloudflared_start_timeout: "检查网络后点击“重新连接”。",
+	cloudflared_stopped: "点击“重新连接”。",
+	cloudflared_exited: "点击“重新连接”；仍失败时复制诊断报告。",
+	cloudflared_invalid_output: "cloudflared 返回了无法识别的状态。",
+	cloudflared_invalid_origin: "cloudflared 返回的公网地址未通过校验。",
+	origin_config_missing: "先保存自有反向代理配置。",
+	origin_config_invalid: "重新保存自有反向代理配置。",
+	origin_listen_port_in_use: "更换 HTTP 后端端口；不要使用局域网的 3443、DSH 自身的 3080，或已被 cloudflared 隧道占用的 3444。",
+	origin_listen_address_unavailable: "监听地址不属于当前电脑，请重新选择本机的私网 IPv4 地址。",
+	origin_gateway_start_failed: "检查 HTTP 后端监听地址和端口后重新连接。",
 	frp_component_missing: "先安装 FRP 官方组件。",
 	frp_component_invalid: "彻底清理 FRP 组件后重新安装。",
 	frp_config_missing: "先保存自建 FRP 连接配置。",
@@ -6155,6 +7847,7 @@ function remoteSuffix(origin) {
 	try {
 		const hostname = new URL(origin).hostname;
 		if (hostname.endsWith(".ts.net")) return "*.ts.net";
+		if (hostname.endsWith(".trycloudflare.com")) return "*.trycloudflare.com";
 		for (const suffix of [
 			".cpolar.cn",
 			".cpolar.io",
@@ -6247,7 +7940,7 @@ function reportLine(entry) {
 /** Run bounded read-only checks and return a report safe to paste into an issue. */
 async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	const checks = [];
-	const remoteProbe = snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
+	const remoteProbe = snapshot.remote.provider !== "origin" && snapshot.remote.running && snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0 ? (probes.remote ?? defaultRemoteProbe)(snapshot.remote.origin) : Promise.resolve({ state: "not-applicable" });
 	const [firewall, remoteObservation] = await Promise.all([(probes.firewall ?? defaultFirewallProbe())(snapshot.lan.port), remoteProbe]);
 	checks.push(check("versions", "ok", "versions-current", "版本兼容", `插件 ${DSH_MOBILE_VERSION}，DSH ${snapshot.dshVersion}，Android App 最低 ${MINIMUM_ANDROID_APP_VERSION}。`));
 	if (snapshot.lan.configured === false) checks.push(check("network", "error", "lan-setup-required", "局域网配置", "尚未完成局域网初始化。", "返回局域网页选择网卡并完成配置。"));
@@ -6264,6 +7957,7 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 	else if (firewall.state === "missing") checks.push(check("firewall", "warning", "firewall-missing", "Windows 防火墙", "未找到完整的局域网放行规则。", "以管理员身份重新运行 dsh-mobile setup。"));
 	else if (firewall.state === "unknown") checks.push(check("firewall", "info", "firewall-unknown", "Windows 防火墙", "系统未允许插件读取防火墙状态。", "若手机找不到电脑，以管理员身份重新运行 setup。"));
 	if (!snapshot.remote.running || snapshot.remote.state === "off") checks.push(check("remote", "info", "remote-off", "远程通道", "当前未启用。", void 0, { provider: snapshot.remote.provider }));
+	else if (snapshot.remote.provider === "origin" && snapshot.remote.state === "ready") checks.push(check("remote", "info", "remote-origin-ready", "远程通道", "私网 HTTP 后端已就绪；未检测公网 HTTPS、证书或 WebSocket 连通性。", "在手机上经反向代理验证连接；代理须保留原始 Host（含端口）并支持 WebSocket。", { provider: "origin" }));
 	else if (snapshot.remote.state === "ready" && snapshot.remote.origin !== void 0) {
 		const endpointSuffix = remoteSuffix(snapshot.remote.origin);
 		const facts = {
@@ -8130,21 +9824,56 @@ var CpolarController = class {
 };
 //#endregion
 //#region src/cpolar-component.ts
-/** Pinned cpolar Windows component fetched only after an explicit user action. */
-const CPOLAR_COMPONENT_RELEASE = Object.freeze({
-	version: "3.3.18",
-	platform: "win32",
-	arch: "x64",
-	downloadUrl: "https://www.cpolar.com/static/downloads/releases/3.3.18/cpolar-stable-windows-amd64-setup.zip",
-	downloadBytes: 7603505,
-	downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
-	executableBytes: 19637680,
-	executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
-	downloadPage: "https://www.cpolar.com/download",
-	signupUrl: "https://dashboard.cpolar.com/signup",
-	dashboardUrl: "https://dashboard.cpolar.com/auth",
-	termsUrl: "https://www.cpolar.com/tos"
-});
+const CPOLAR_VERSION = "3.3.18";
+/** Pinned official cpolar release metadata for supported desktop targets. */
+const CPOLAR_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
+	{
+		version: CPOLAR_VERSION,
+		platform: "win32",
+		arch: "x64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-windows-amd64-setup.zip`,
+		downloadBytes: 7603505,
+		downloadSha256: "fb8cf60289058ee26079f995d2eeea0b21768a742d90c93015afe96e83428830",
+		executableName: "cpolar.exe",
+		executableBytes: 19637680,
+		executableSha256: "b2d865ee505e842d22ceca5493a872efa893a79b079a7a8ee2bd3aa5343a5c41",
+		archiveKind: "msi-zip"
+	},
+	{
+		version: CPOLAR_VERSION,
+		platform: "linux",
+		arch: "x64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-linux-amd64.tar.gz`,
+		downloadBytes: 7404781,
+		downloadSha256: "5cd3320c4369928ccb509c4f5fa2ec3b86151ead77e1b77c1694aa64c43e32e7",
+		executableName: "cpolar",
+		executableBytes: 19328632,
+		executableSha256: "c076e1109372a3f88031841c5989030e49b6871b54aee3260c796da9122dec05",
+		archiveKind: "tar.gz"
+	},
+	{
+		version: CPOLAR_VERSION,
+		platform: "linux",
+		arch: "arm64",
+		downloadUrl: `https://www.cpolar.com/static/downloads/releases/${CPOLAR_VERSION}/cpolar-stable-linux-arm64.tar.gz`,
+		downloadBytes: 6855666,
+		downloadSha256: "8a61a97983f18ae5ffb4b8bac4c9b3d8e2399a6ee101844e7b0b30d7f326157c",
+		executableName: "cpolar",
+		executableBytes: 19017169,
+		executableSha256: "8d76a1b7e518df45f387f107c7a428079c67ecd9b971a2915c53b947ea9b443a",
+		archiveKind: "tar.gz"
+	}
+].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
+/**
+* Canonical release metadata. New code should select from
+* {@link CPOLAR_COMPONENT_RELEASES} by platform and architecture; this alias
+* preserves the original Windows x64 entry for existing callers.
+*/
+const CPOLAR_COMPONENT_RELEASE = CPOLAR_COMPONENT_RELEASES["win32-x64"];
+const DOWNLOAD_PAGE = "https://www.cpolar.com/download";
+const SIGNUP_URL = "https://dashboard.cpolar.com/signup";
+const DASHBOARD_URL = "https://dashboard.cpolar.com/auth";
+const TERMS_URL = "https://www.cpolar.com/tos";
 function inside(parent, child) {
 	const candidate = relative(parent, child);
 	return candidate !== "" && !candidate.startsWith("..") && !isAbsolute(candidate);
@@ -8172,19 +9901,15 @@ async function run(file, args) {
 		});
 	});
 }
-async function defaultFetchArtifact(url, signal) {
-	const response = await fetch(url, {
-		redirect: "error",
+async function defaultFetchArtifact(url, signal, expectedBytes) {
+	return downloadPinnedArtifact({
+		url,
+		expectedBytes,
+		errorPrefix: "cpolar",
 		signal
 	});
-	if (!response.ok) throw new Error(`cpolar_download_http_${String(response.status)}`);
-	const length = Number(response.headers.get("content-length"));
-	if (Number.isFinite(length) && length !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
-	const bytes = new Uint8Array(await response.arrayBuffer());
-	if (bytes.byteLength !== CPOLAR_COMPONENT_RELEASE.downloadBytes) throw new Error("cpolar_download_size_mismatch");
-	return bytes;
 }
-async function defaultExtractArtifact(archive, destination) {
+async function extractWindowsMsi(archive, destination, executableName) {
 	if (process.platform !== "win32") throw new Error("cpolar_component_unsupported");
 	const unpacked = join(destination, "archive");
 	const administrative = join(destination, "administrative");
@@ -8210,9 +9935,29 @@ async function defaultExtractArtifact(archive, destination) {
 		"/qn",
 		`TARGETDIR=${administrative}`
 	]);
-	const executableRelative = (await readdir(administrative, { recursive: true })).find((entry) => basename(entry).toLowerCase() === "cpolar.exe");
+	const executableRelative = (await readdir(administrative, { recursive: true })).find((entry) => basename(entry).toLowerCase() === executableName.toLowerCase());
+	if (executableRelative === void 0) throw new Error("cpolar_executable_missing");
+	await copyFile(join(administrative, executableRelative), join(destination, executableName));
+}
+async function extractLinuxTarball(archive, destination, executableName) {
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await run(process.platform === "win32" ? "tar.exe" : "tar", [
+		"-xzf",
+		archive,
+		"-C",
+		unpacked
+	]);
+	const executableRelative = (await readdir(unpacked, { recursive: true })).find((entry) => basename(entry).toLowerCase() === executableName.toLowerCase());
 	if (executableRelative === void 0) throw new Error("cpolar_executable_missing");
-	await copyFile(join(administrative, executableRelative), join(destination, "cpolar.exe"));
+	await copyFile(join(unpacked, executableRelative), join(destination, executableName));
+}
+async function defaultExtractArtifact(archive, destination, release) {
+	if (release.archiveKind === "tar.gz") return extractLinuxTarball(archive, destination, release.executableName);
+	return extractWindowsMsi(archive, destination, release.executableName);
 }
 /** Validate a cpolar Authtoken before it crosses the durable-file boundary. */
 function validateCpolarAuthtoken(value) {
@@ -8230,6 +9975,7 @@ var CpolarComponentManager = class {
 	stagingRoot;
 	platform;
 	arch;
+	release;
 	fetchArtifact;
 	extractArtifact;
 	installed = false;
@@ -8241,9 +9987,10 @@ var CpolarComponentManager = class {
 		if (!isAbsolute(stateDirectory)) throw new Error("cpolar state directory must be absolute");
 		this.platform = options.platform ?? process.platform;
 		this.arch = options.arch ?? process.arch;
+		this.release = CPOLAR_COMPONENT_RELEASES[`${this.platform}-${this.arch}`];
 		this.componentRoot = join(stateDirectory, "components", "cpolar");
-		this.componentStorage = join(this.componentRoot, CPOLAR_COMPONENT_RELEASE.version);
-		this.executable = join(this.componentStorage, "cpolar.exe");
+		this.componentStorage = join(this.componentRoot, this.release?.version ?? CPOLAR_VERSION);
+		this.executable = join(this.componentStorage, this.release?.executableName ?? "cpolar");
 		this.stateRoot = join(stateDirectory, "state", "cpolar");
 		this.configFile = join(this.stateRoot, "cpolar.yml");
 		this.logRoot = join(stateDirectory, "logs", "cpolar");
@@ -8255,13 +10002,18 @@ var CpolarComponentManager = class {
 			this.logRoot,
 			this.stagingRoot
 		]) if (!inside(stateDirectory, child)) throw new Error("cpolar component path escaped its state directory");
-		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact;
-		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact;
+		const release = this.release;
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact(url, signal, release?.downloadBytes ?? 0));
+		this.extractArtifact = options.extractArtifact ?? ((archive, destination) => {
+			if (release === void 0) throw new Error("cpolar_component_unsupported");
+			return defaultExtractArtifact(archive, destination, release);
+		});
 	}
 	/** Inspect the managed binary and configuration without using global cpolar state. */
 	async initialize() {
-		this.installed = await regularFile(this.executable, CPOLAR_COMPONENT_RELEASE.executableBytes);
-		if (this.installed && await sha256(this.executable) !== CPOLAR_COMPONENT_RELEASE.executableSha256) {
+		const release = this.release;
+		this.installed = release !== void 0 && await regularFile(this.executable, release.executableBytes);
+		if (this.installed && release !== void 0 && await sha256(this.executable) !== release.executableSha256) {
 			this.installed = false;
 			this.errorCode = "cpolar_component_invalid";
 		}
@@ -8270,18 +10022,19 @@ var CpolarComponentManager = class {
 	}
 	/** Return a safe status that never includes the account token. */
 	status() {
+		const release = this.release ?? CPOLAR_COMPONENT_RELEASE;
 		return Object.freeze({
-			supported: this.platform === CPOLAR_COMPONENT_RELEASE.platform && this.arch === CPOLAR_COMPONENT_RELEASE.arch,
+			supported: this.release !== void 0,
 			installed: this.installed,
 			configured: this.configured,
-			version: CPOLAR_COMPONENT_RELEASE.version,
-			downloadBytes: CPOLAR_COMPONENT_RELEASE.downloadBytes,
-			installedBytes: CPOLAR_COMPONENT_RELEASE.executableBytes,
-			sourceUrl: CPOLAR_COMPONENT_RELEASE.downloadUrl,
-			downloadPage: CPOLAR_COMPONENT_RELEASE.downloadPage,
-			signupUrl: CPOLAR_COMPONENT_RELEASE.signupUrl,
-			dashboardUrl: CPOLAR_COMPONENT_RELEASE.dashboardUrl,
-			termsUrl: CPOLAR_COMPONENT_RELEASE.termsUrl,
+			version: release.version,
+			downloadBytes: release.downloadBytes,
+			installedBytes: release.executableBytes,
+			sourceUrl: release.downloadUrl,
+			downloadPage: DOWNLOAD_PAGE,
+			signupUrl: SIGNUP_URL,
+			dashboardUrl: DASHBOARD_URL,
+			termsUrl: TERMS_URL,
 			storagePath: this.componentRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
 		});
@@ -8289,7 +10042,8 @@ var CpolarComponentManager = class {
 	/** Download, verify, and administratively extract cpolar after explicit confirmation. */
 	install() {
 		return this.enqueue(async () => {
-			if (this.platform !== CPOLAR_COMPONENT_RELEASE.platform || this.arch !== CPOLAR_COMPONENT_RELEASE.arch) throw new Error("cpolar_component_unsupported");
+			const release = this.release;
+			if (release === void 0) throw new Error("cpolar_component_unsupported");
 			await mkdir(this.stagingRoot, {
 				recursive: true,
 				mode: 448
@@ -8303,26 +10057,26 @@ var CpolarComponentManager = class {
 				timeout.unref();
 				let bytes;
 				try {
-					bytes = await this.fetchArtifact(CPOLAR_COMPONENT_RELEASE.downloadUrl, controller.signal);
+					bytes = await this.fetchArtifact(release.downloadUrl, controller.signal);
 				} finally {
 					clearTimeout(timeout);
 				}
-				if (createHash("sha256").update(bytes).digest("hex") !== CPOLAR_COMPONENT_RELEASE.downloadSha256) throw new Error("cpolar_download_hash_mismatch");
-				const archive = join(staging, "cpolar.zip");
+				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cpolar_download_hash_mismatch");
+				const archive = join(staging, release.archiveKind === "tar.gz" ? "cpolar.tar.gz" : "cpolar.zip");
 				await writeFile(archive, bytes, {
 					flag: "wx",
 					mode: 384
 				});
 				await this.extractArtifact(archive, staging);
-				const extracted = join(staging, "cpolar.exe");
-				if (!await regularFile(extracted, CPOLAR_COMPONENT_RELEASE.executableBytes) || await sha256(extracted) !== CPOLAR_COMPONENT_RELEASE.executableSha256) throw new Error("cpolar_executable_hash_mismatch");
+				const extracted = join(staging, release.executableName);
+				if (!await regularFile(extracted, release.executableBytes) || await sha256(extracted) !== release.executableSha256) throw new Error("cpolar_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
 					mode: 448
 				});
-				await copyFile(extracted, join(candidate, "cpolar.exe"));
-				await chmod(join(candidate, "cpolar.exe"), 448);
+				await copyFile(extracted, join(candidate, release.executableName));
+				await chmod(join(candidate, release.executableName), 448);
 				await rm(this.componentStorage, {
 					recursive: true,
 					force: true
@@ -9012,6 +10766,16 @@ function selectLanNetwork(requestedAddress, requestedInterface, table, preferred
 	if (physicalCandidates.length === 1) return physicalCandidates[0];
 	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
 }
+/**
+* True when the failure came from LAN selection (the configured network is
+* gone, nothing is up, or several are) rather than from config/TLS code.
+* Callers use it to degrade (warn + stay down) instead of failing boot.
+* Pinned to the selectLanNetwork message contract — keep in sync.
+*/
+function isNetworkSelectionError(error) {
+	const message = error instanceof Error ? error.message : String(error ?? "");
+	return message.includes("is not connected") || message.includes("no active private LAN address was found") || message.includes("more than one LAN address is active") || message.includes("has more than one private IPv4 address") || message.includes("is not an active private LAN address");
+}
 function assertMatchingCa(certPem, keyPem) {
 	const certificate = new X509Certificate(certPem);
 	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
@@ -9290,6 +11054,7 @@ function mapAdminError(error) {
 	if (error instanceof Error && error.message.startsWith("saved LAN interface ")) return new HttpError(409, "network_interface_unavailable");
 	if (error instanceof Error && error.message === "cpolar_authtoken_invalid") return new HttpError(400, "cpolar_authtoken_invalid");
 	if (error instanceof Error && error.message.startsWith("cpolar_")) return new HttpError(409, error.message);
+	if (error instanceof Error && error.message.startsWith("cloudflared_")) return new HttpError(409, error.message);
 	if (error instanceof Error && [
 		"frp_server_address_invalid",
 		"frp_server_port_invalid",
@@ -9298,6 +11063,15 @@ function mapAdminError(error) {
 		"frp_settings_invalid"
 	].includes(error.message)) return new HttpError(400, error.message);
 	if (error instanceof Error && error.message.startsWith("frp_")) return new HttpError(409, error.message);
+	if (error instanceof Error && [
+		"origin_settings_invalid",
+		"origin_public_origin_invalid",
+		"origin_listen_host_invalid",
+		"origin_listen_port_invalid",
+		"origin_listen_port_reserved",
+		"origin_allowed_cidrs_invalid"
+	].includes(error.message)) return new HttpError(400, error.message);
+	if (error instanceof Error && error.message.startsWith("origin_")) return new HttpError(409, error.message);
 	if (error instanceof Error && error.message.startsWith("vps_")) return new HttpError(409, error.message);
 	if (error instanceof Error && error.message === "plugin_update_failed") return new HttpError(500, error.message);
 	if (error instanceof Error && error.message.startsWith("plugin_update_")) return new HttpError(409, error.message);
@@ -9406,12 +11180,23 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		discovery: false
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, frpComponent, frpConfiguration) {
+/** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
+function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort) {
+	const validated = parseOriginSettings(settings);
+	if (listenPort !== 0) validateOriginListenPort(listenPort);
+	return Object.freeze({
+		...remoteGatewayConfig(template, validated.publicOrigin, stateFile, instanceId, listenPort),
+		listenHost: validated.listenHost,
+		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
+	});
+}
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration) {
 	return {
 		provider,
 		running: status.enabled,
 		state: status.state,
 		...status.origin === void 0 ? {} : { origin: status.origin },
+		...status.backendOrigin === void 0 ? {} : { backendOrigin: status.backendOrigin },
 		...status.loginUrl === void 0 ? {} : { loginUrl: status.loginUrl },
 		...status.setupUrl === void 0 ? {} : { setupUrl: status.setupUrl },
 		...status.errorCode === void 0 ? {} : { errorCode: status.errorCode },
@@ -9428,12 +11213,25 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				state: providerStatuses.cpolar.state,
 				component: cpolarComponent
 			},
+			cloudflared: {
+				bundled: false,
+				running: providerStatuses.cloudflared.enabled,
+				state: providerStatuses.cloudflared.state,
+				component: cloudflaredComponent,
+				configuration: cloudflaredConfiguration
+			},
 			frp: {
 				bundled: false,
 				running: providerStatuses.frp.enabled,
 				state: providerStatuses.frp.state,
 				component: frpComponent,
 				configuration: frpConfiguration
+			},
+			origin: {
+				bundled: true,
+				running: providerStatuses.origin.enabled,
+				state: providerStatuses.origin.state,
+				configuration: originConfiguration
 			}
 		}
 	};
@@ -9464,10 +11262,16 @@ async function apply(ctx, config) {
 	const initialRemoteProvider = (await remoteProviderStore.load()).provider;
 	const cpolarComponent = new CpolarComponentManager({ stateDirectory });
 	await cpolarComponent.initialize();
+	const cloudflaredComponent = new CloudflaredComponentManager({ stateDirectory });
+	await cloudflaredComponent.initialize();
 	const frpComponent = new FrpComponentManager({ stateDirectory });
 	await frpComponent.initialize();
 	const frpConfig = new FrpConfigStore(join(remoteDirectory, "frp", "config"));
 	await frpConfig.initialize();
+	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"));
+	await originConfig.initialize();
+	const cloudflaredTunnel = new CloudflaredTunnelStore(join(remoteDirectory, "cloudflared"));
+	await cloudflaredTunnel.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
 		schemaVersion: 1,
 		id: "computer-images",
@@ -9533,7 +11337,14 @@ async function apply(ctx, config) {
 		}, (error) => {
 			process.emitWarning(`DSH Mobile could not follow the current LAN address: ${error instanceof Error ? error.message : String(error)}`, { code: "DSH_MOBILE_NETWORK_REFRESH" });
 		});
-		await following.initialize(2e3);
+		try {
+			await following.initialize(2e3);
+		} catch (error) {
+			if (!isNetworkSelectionError(error)) throw error;
+			const detail = error instanceof Error ? error.message : String(error);
+			process.emitWarning(`DSH Mobile: ${detail}; mobile access stays dormant until the network returns or setup is re-run — DSH itself keeps running.`, { code: "DSH_MOBILE_NETWORK_UNAVAILABLE" });
+			following.beginPolling(2e3);
+		}
 		return following;
 	};
 	const lanControlFile = parseControlFile(config.controlFile);
@@ -9561,9 +11372,22 @@ async function apply(ctx, config) {
 		await candidate.start();
 		return candidate;
 	};
+	const createOriginGateway = async (settings) => {
+		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		try {
+			await candidate.start();
+		} catch (error) {
+			await candidate.close();
+			throw error;
+		}
+		return candidate;
+	};
 	const tailscaleStore = new JsonMobileAccessControlStore(join(remoteDirectory, "control.json"), false);
 	const cpolarStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cpolar", "control.json"), false);
+	const cloudflaredStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cloudflared", "control.json"), false);
 	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
+	const originStore = new JsonMobileAccessControlStore(join(remoteDirectory, "origin", "control.json"), false);
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -9578,21 +11402,28 @@ async function apply(ctx, config) {
 			configFile: cpolarComponent.configFile,
 			createGateway: createRemoteGateway
 		}),
+		cloudflared: new CloudflaredController({
+			store: cloudflaredStore,
+			executable: cloudflaredComponent.executable,
+			tunnel: cloudflaredTunnel,
+			createGateway: createRemoteGateway
+		}),
 		frp: new FrpController({
 			store: frpStore,
 			executable: frpComponent.executable,
 			config: frpConfig,
 			instanceId,
 			createGateway: createRemoteGateway
+		}),
+		origin: new OriginController({
+			store: originStore,
+			config: originConfig,
+			createGateway: createOriginGateway
 		})
 	};
 	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
 	const remoteController = () => remoteProviders.controller();
-	for (const provider of [
-		"tailscale",
-		"cpolar",
-		"frp"
-	]) {
+	for (const provider of REMOTE_PROVIDERS) {
 		const controller = remoteControllers[provider];
 		taskEventHub.add({ broadcastTaskEvent: (event) => {
 			controller.gateway()?.broadcastTaskEvent(event);
@@ -9601,8 +11432,10 @@ async function apply(ctx, config) {
 	const remotePayload = () => remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
 		tailscale: remoteControllers.tailscale.status(),
 		cpolar: remoteControllers.cpolar.status(),
-		frp: remoteControllers.frp.status()
-	}, cpolarComponent.status(), frpComponent.status(), frpConfig.status());
+		cloudflared: remoteControllers.cloudflared.status(),
+		frp: remoteControllers.frp.status(),
+		origin: remoteControllers.origin.status()
+	}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status());
 	const lanPayload = () => ({
 		...loaded.kind === "unconfigured" ? {
 			configured: preparedLanSetup !== void 0,
@@ -9737,11 +11570,29 @@ async function apply(ctx, config) {
 				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/provider`) {
 					const body = await readJsonObject(request, 4096);
-					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "frp") throw new HttpError(400, "bad_request");
+					if (body.provider !== "tailscale" && body.provider !== "cpolar" && body.provider !== "cloudflared" && body.provider !== "frp" && body.provider !== "origin") throw new HttpError(400, "bad_request");
 					await remoteProviders.select(body.provider);
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/origin/configure`) {
+					const body = await readJsonObject(request, 8192);
+					await remoteProviders.mutate(async () => {
+						await originConfig.configure(body);
+						if (remoteControllers.origin.status().enabled) await remoteControllers.origin.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/origin/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.origin.setEnabled(false);
+						await originConfig.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cpolar/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					await remoteProviders.mutate(async () => cpolarComponent.install());
@@ -9763,6 +11614,46 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("cloudflared component install started");
+					try {
+						await remoteProviders.mutate(async () => cloudflaredComponent.install());
+						logger.info("cloudflared component install completed");
+					} catch (error) {
+						logger.error("cloudflared component install failed: %s", error instanceof Error ? error.stack ?? error.message : String(error));
+						throw error;
+					}
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cloudflared.setEnabled(false);
+						await cloudflaredComponent.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/tunnel`) {
+					const body = await readJsonObject(request, 8192);
+					await remoteProviders.mutate(async () => {
+						await cloudflaredTunnel.configure(mergeSavedCloudflaredTunnelSettings(body, cloudflaredTunnel.settings()));
+						if (remoteControllers.cloudflared.status().enabled) await remoteControllers.cloudflared.reconnect();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/tunnel/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						await remoteControllers.cloudflared.setEnabled(false);
+						await cloudflaredTunnel.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/component/install`) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					logger.info("frpc component install started");
@@ -9981,17 +11872,18 @@ async function apply(ctx, config) {
 			const stores = {
 				tailscale: tailscaleStore,
 				cpolar: cpolarStore,
-				frp: frpStore
+				cloudflared: cloudflaredStore,
+				frp: frpStore,
+				origin: originStore
 			};
 			await Promise.all(Object.keys(stores).filter((provider) => provider !== remoteProviders.selected).map((provider) => stores[provider].save({
 				version: 1,
 				enabled: false
 			})));
-			for (const provider of [
-				"tailscale",
-				"cpolar",
-				"frp"
-			]) await remoteControllers[provider].initialize();
+			for (const provider of REMOTE_PROVIDERS) await remoteControllers[provider].initialize();
+			const lanDiscovery = lanGateway?.discoveryStatus();
+			if (lanDiscovery !== void 0 && !lanDiscovery.broadcast) logger.warn("broadcast discovery is unavailable (%s); mDNS is still published, so pair manually or free the UDP port", lanDiscovery.errorCode ?? "unknown_cause");
+			if (lanDiscovery?.mobileAssetsErrorCode !== void 0) logger.warn("a bundled mobile asset is missing (%s); the phone frontend will serve without it", lanDiscovery.mobileAssetsErrorCode);
 		} catch (error) {
 			try {
 				await settleCleanupSteps([
@@ -10028,6 +11920,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CSRF_COOKIE, CSRF_HEADER, Config, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, parseAuthority, parseCidr, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isCloudflaredRegistration, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map