dsh-mobile 0.4.4 → 0.4.6

package/lib/client.js

@@ -562,7 +562,7 @@ window.__ModuleLoader__.load({
 			selfHostedConnections: "Self-hosted connection",
 			advanced: "Advanced",
 			frpName: "Self-hosted FRP",
-			frpDescription: "A restricted FRP channel for this DSH gateway only. You manage the VPS and public domain.",
+			frpDescription: "A restricted FRP channel for this DSH gateway only. You manage the VPS and public address.",
 			prepareFrp: "Configure self-hosted FRP",
 			frpStep1Title: "1 · Connection details",
 			frpStep1Text: "Enter the VPS address, frps control port, shared token, and public HTTPS origin.",
@@ -649,7 +649,7 @@ window.__ModuleLoader__.load({
 			selfHostedConnections: "Connessione autogestita",
 			advanced: "Avanzato",
 			frpName: "FRP autogestito",
-			frpDescription: "Canale FRP limitato al solo gateway DSH. VPS e dominio pubblico restano sotto il tuo controllo.",
+			frpDescription: "Canale FRP limitato al solo gateway DSH. VPS e indirizzo pubblico restano sotto il tuo controllo.",
 			prepareFrp: "Configura FRP autogestito",
 			frpStep1Title: "1 · Dati di connessione",
 			frpStep1Text: "Inserisci indirizzo VPS, porta di controllo frps, token condiviso e origine HTTPS pubblica.",
@@ -985,7 +985,12 @@ window.__ModuleLoader__.load({
 				phone: "The computer cannot determine whether the router isolates the phone.",
 				phoneAction: "Confirm the phone and computer use the same network, then disable guest-network or AP isolation.",
 				reportTitle: "DSH Mobile diagnostic report",
-				generated: "Generated"
+				generated: "Generated",
+				certificateOk: "The FRP entry certificate is valid.",
+				certificateExpiring: "The FRP entry certificate expires soon.",
+				certificateExpired: "The FRP entry certificate has expired.",
+				certificateUnknown: "The FRP entry certificate could not be read.",
+				certificateAction: "Reconnect the FRP channel to re-issue the certificate, or follow the attach runbook on the VPS."
 			},
 			it: {
 				versions: "Sono indicate le versioni installate di plugin e DSH e la versione minima dell’app Android.",
@@ -1008,7 +1013,12 @@ window.__ModuleLoader__.load({
 				phone: "Il computer non può stabilire se il router isola il telefono.",
 				phoneAction: "Verifica che telefono e computer usino la stessa rete, poi disattiva rete ospiti o isolamento AP.",
 				reportTitle: "Report diagnostico DSH Mobile",
-				generated: "Generato"
+				generated: "Generato",
+				certificateOk: "Il certificato di ingresso FRP è valido.",
+				certificateExpiring: "Il certificato di ingresso FRP scade a breve.",
+				certificateExpired: "Il certificato di ingresso FRP è scaduto.",
+				certificateUnknown: "Impossibile leggere il certificato di ingresso FRP.",
+				certificateAction: "Riconnetti il canale FRP per rigenerare il certificato, oppure segui il runbook attach sul VPS."
 			},
 			zh: {
 				versions: "已显示插件、DSH 和 Android App 最低版本。",
@@ -1031,7 +1041,12 @@ window.__ModuleLoader__.load({
 				phone: "电脑无法判断路由器是否隔离了手机。",
 				phoneAction: "确认手机与电脑使用同一网络，并关闭访客网络或 AP 隔离。",
 				reportTitle: "DSH Mobile 诊断报告",
-				generated: "生成时间"
+				generated: "生成时间",
+				certificateOk: "FRP 入口证书有效。",
+				certificateExpiring: "FRP 入口证书即将过期。",
+				certificateExpired: "FRP 入口证书已过期。",
+				certificateUnknown: "无法读取 FRP 入口证书。",
+				certificateAction: "重新连接 FRP 通道即可重新签发证书，或按接入清单在 VPS 侧处理。"
 			}
 		};
 		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
@@ -1379,7 +1394,9 @@ window.__ModuleLoader__.load({
 				"remote-off": ["Remote access through {provider} is currently off.", ""],
 				"remote-origin-ready": ["The private HTTP backend is listening; public HTTPS is not verified.", "Verify your reverse proxy, public certificate, external Host including port, and WebSocket access from your phone. Keep the HTTP backend private."],
 				"remote-ready": ["{provider} endpoint {endpointSuffix} is reachable in about {latencyMs} ms.", ""],
+				"remote-ready-via-proxy": ["The computer reached {provider} endpoint {endpointSuffix} through its configured proxy in about {latencyMs} ms; phone reachability is not verified.", "Test the connection from the phone’s network."],
 				"remote-rate-limited": ["{provider} endpoint {endpointSuffix} is reachable, but this check observed rate limiting.", "Try again later; older sessions load on demand to reduce traffic."],
+				"remote-rate-limited-via-proxy": ["The computer reached {provider} endpoint {endpointSuffix} through its proxy, but the service rate-limited this check; phone reachability is not verified.", "Try again later and test from the phone’s network."],
 				"remote-fake-ip": ["The Tailscale address is intercepted by the current VPN or DNS proxy, so TLS was not established.", "Switch VPN node or proxy mode; if it still fails, use cpolar."],
 				"remote-unreachable": ["{provider} reports ready, but endpoint {endpointSuffix} is not reachable.", "Reconnect, then check the provider status if it still fails."],
 				"remote-needs-login": ["Tailscale is waiting for login to finish.", "Return to Remote access and continue login."],
@@ -1401,7 +1418,9 @@ window.__ModuleLoader__.load({
 				"remote-off": ["L’accesso remoto tramite {provider} è disattivato.", ""],
 				"remote-origin-ready": ["Il backend HTTP privato è in ascolto; HTTPS pubblico non è verificato.", "Verifica dal telefono reverse proxy, certificato pubblico, Host esterno inclusa la porta e accesso WebSocket. Mantieni privato il backend HTTP."],
 				"remote-ready": ["L’endpoint {provider} {endpointSuffix} è raggiungibile in circa {latencyMs} ms.", ""],
+				"remote-ready-via-proxy": ["Il computer ha raggiunto l’endpoint {provider} {endpointSuffix} tramite il proxy configurato in circa {latencyMs} ms; la raggiungibilità dal telefono non è verificata.", "Prova la connessione dalla rete del telefono."],
 				"remote-rate-limited": ["L’endpoint {provider} {endpointSuffix} è raggiungibile, ma il controllo ha rilevato una limitazione temporanea.", "Riprova più tardi; le sessioni precedenti vengono caricate su richiesta per ridurre il traffico."],
+				"remote-rate-limited-via-proxy": ["Il computer ha raggiunto l’endpoint {provider} {endpointSuffix} tramite proxy, ma il servizio ha limitato questo controllo; la raggiungibilità dal telefono non è verificata.", "Riprova più tardi e verifica dalla rete del telefono."],
 				"remote-fake-ip": ["L’indirizzo Tailscale è intercettato dalla VPN o dal proxy DNS corrente e TLS non è stato stabilito.", "Cambia nodo VPN o modalità proxy; se il problema continua, usa cpolar."],
 				"remote-unreachable": ["{provider} risulta pronto, ma l’endpoint {endpointSuffix} non è raggiungibile.", "Riconnettiti; se il problema continua, controlla lo stato del provider."],
 				"remote-needs-login": ["Tailscale attende il completamento dell’accesso.", "Torna ad Accesso remoto e continua l’accesso."],
@@ -1423,7 +1442,9 @@ window.__ModuleLoader__.load({
 				"remote-off": ["{provider} 远程访问当前未启用。", ""],
 				"remote-origin-ready": ["私有 HTTP 后端已监听；尚未验证公网 HTTPS。", "请用手机核对反向代理、公网证书、含端口的外部 Host 及 WebSocket 访问。HTTP 后端必须留在私网。"],
 				"remote-ready": ["{provider} 端点 {endpointSuffix} 可达，往返约 {latencyMs} ms。", ""],
+				"remote-ready-via-proxy": ["电脑经已配置代理访问 {provider} 端点 {endpointSuffix}，约 {latencyMs} ms；尚未验证手机网络是否可达。", "请用手机当前网络实际连接测试。"],
 				"remote-rate-limited": ["{provider} 端点 {endpointSuffix} 可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。"],
+				"remote-rate-limited-via-proxy": ["电脑经代理访问 {provider} 端点 {endpointSuffix} 时遇到限流；尚未验证手机网络是否可达。", "稍后重试，并用手机当前网络实际连接测试。"],
 				"remote-fake-ip": ["Tailscale 地址被当前 VPN 或 DNS 代理接管，TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。"],
 				"remote-unreachable": ["{provider} 显示已就绪，但端点 {endpointSuffix} 暂不可达。", "点击重新连接；仍失败时检查提供方状态。"],
 				"remote-needs-login": ["Tailscale 正在等待完成登录。", "返回远程访问并继续登录。"],
@@ -1432,18 +1453,171 @@ window.__ModuleLoader__.load({
 				"phone-network-unknown": ["电脑无法判断路由器是否隔离了手机。", "确认手机与电脑使用同一网络，并关闭访客网络或 AP 隔离。"]
 			}
 		};
-		//#endregion
-		//#region src/frp-template.ts
-		/** Loopback-only HTTP vhost port used between Caddy and frps. */
-		const FRP_VHOST_HTTP_PORT = 7080;
+		Object.assign(MOBILE_CONTROL_MESSAGES.en, {
+			frpMode: "Provisioning mode",
+			frpModeDeploy: "Deploy frps here (managed)",
+			frpModeAttach: "Use my existing frps (no SSH, no changes)",
+			frpModeHint: "Attach manages frpc and, if selected, local ingress certificates. It never installs, edits, or restarts your frps.",
+			frpEntryTls: "Entry certificate",
+			frpEntryTlsPublic: "Public-CA certificate (Caddy, recommended)",
+			frpEntryTlsSelfSigned: "Self-signed passthrough (no public certificate at all)",
+			frpVhostHttpPort: "frps vhostHTTPPort",
+			frpVhostHttpPortHint: "The loopback plaintext vhost port of your own frps (upstream default 7080).",
+			frpPublicPort: "Public entry port",
+			frpPublicPortHint: "Raw TCP proxy port used as the public HTTPS entry (default 33080, never 3080/3443/3444).",
+			frpAttachPlan: "Copy attach runbook",
+			frpAttachPlanCopied: "Attach runbook copied: local frpc.toml plus the VPS checklist.",
+			frpAttachPlanFailed: "Could not build the attach runbook: {error}",
+			frpAttachCertOk: "Ingress certificate valid for {days} more days; the plugin checks whether its leaf needs renewal.",
+			frpAttachCertExpiring: "Ingress certificate expires in {days} days; the plugin will try to renew the leaf under the existing CA.",
+			frpAttachCertExpired: "Ingress certificate has expired. Reconnect and check the certificate error.",
+			frpAttachCertUnknown: "Ingress certificate is missing or unreadable. Check the certificate error before reconnecting.",
+			frpAttachCaOk: "Ingress CA valid for {days} more days.",
+			frpAttachCaExpiring: "Ingress CA expires in {days} days; replacing it will require pairing every phone again.",
+			frpAttachSelfCheck: "Run self-check",
+			frpAttachFrpsReachable: "frps control TCP port reachable",
+			frpAttachFrpsUnreachable: "frps control TCP port unreachable",
+			frpAttachEntryReachable: "public entry TCP port reachable (identity not checked)",
+			frpAttachEntryUnreachable: "public entry TCP port unreachable",
+			frpAttachModeRequiresVhostPort: "Attach mode needs the real vhostHTTPPort of your frps; the plugin will not guess 7080.",
+			frpAttachCertUnknownError: "The self-signed ingress certificate is missing or unreadable; inspect the local certificate files before reconnecting.",
+			frpEntryTlsInvalid: "This entry certificate mode cannot be provisioned with the selected mode.",
+			frpSelfSignedRequiresPublicIpv4: "Self-signed TCP ingress requires a public IPv4 address. Use a public-CA HTTPS entry for a domain.",
+			frpIngressCaExpired: "The local ingress CA has expired. Remove the FRP component from this panel, configure it again, and re-pair every phone.",
+			frpIngressCaInvalid: "The local ingress CA is missing or damaged. Inspect the files; if rebuilding it, use this panel’s FRP cleanup and re-pair every phone.",
+			frpIngressCaChanged: "The ingress CA differs from the saved fingerprint, so the channel stopped. Inspect the files; if rebuilding it, clean up FRP and re-pair every phone.",
+			frpIngressRenewalFailed: "The ingress certificate could not be renewed. Check the FRP certificate files and reconnect; do not replace the CA silently.",
+			frpAttachStepWriteSnippet: "Create the Caddy snippet",
+			frpAttachStepAddImport: "Add the import line and reload Caddy",
+			frpAttachStepIssueCert: "Issue the public-IP certificate",
+			frpAttachStepCertTimer: "Confirm the renewal timer",
+			frpAttachStepVerifyHttps: "Verify the public HTTPS entry",
+			frpAttachStepOpenPort: "Open the public entry port",
+			frpAttachStepVerifyFrps: "Confirm your frps is ready",
+			frpAttachStepVerifyEntry: "Verify the tunnel end to end",
+			frpAttachToken: "Copy frpc.toml with token",
+			frpAttachTokenCopied: "The plaintext frpc.toml is copied. It contains the shared token and stays in the clipboard until you clear it — do not paste it anywhere public.",
+			frpAttachTokenFailed: "Could not copy the frpc.toml with its token: {error}",
+			frpAttachTokenReenter: "Re-enter the shared token first. The plugin never returns a saved token to this page.",
+			frpStep2TitleAttach: "2 · Check your VPS",
+			frpStep2TextAttach: "Check your existing frps and copy a VPS checklist; the plugin does not change the server.",
+			frpStep4TextAttach: "Save the local client configuration and verify that the public endpoint reaches this computer.",
+			frpAppRequirementSelfSigned: "Self-signed ingress requires an Android app that can pin a remote CA. Older apps without this feature cannot use this entry.",
+			frpConfigurationMissingAttach: "Enter your existing frps details, install frpc locally, then save and verify the connection.",
+			purgeFrpConfirmSelfSigned: "Stop FRP and delete its local frpc, token, configuration, certificates, private keys, identity record, staging files, and logs? Every phone paired through this self-signed entry must be paired again. Your VPS is unchanged."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.it, {
+			frpMode: "Modalità di provisioning",
+			frpModeDeploy: "Installa frps qui (gestito)",
+			frpModeAttach: "Usa il mio frps esistente (niente SSH, nessuna modifica)",
+			frpModeHint: "La modalità attach gestisce frpc e, se scelti, i certificati locali. Non installa, modifica o riavvia il tuo frps.",
+			frpEntryTls: "Certificato di ingresso",
+			frpEntryTlsPublic: "Certificato da CA pubblica (Caddy, consigliato)",
+			frpEntryTlsSelfSigned: "Passthrough autofirmato (nessun certificato pubblico)",
+			frpVhostHttpPort: "vhostHTTPPort di frps",
+			frpVhostHttpPortHint: "Porta vhost in chiaro su loopback del tuo frps (predefinita 7080).",
+			frpPublicPort: "Porta pubblica di ingresso",
+			frpPublicPortHint: "Porta del proxy TCP grezzo usata come ingresso HTTPS pubblico (predefinita 33080, mai 3080/3443/3444).",
+			frpAttachPlan: "Copia il runbook attach",
+			frpAttachPlanCopied: "Runbook attach copiato: frpc.toml locale più la checklist VPS.",
+			frpAttachPlanFailed: "Impossibile creare il runbook attach: {error}",
+			frpAttachCertOk: "Certificato di ingresso valido per altri {days} giorni; il plugin verifica se la foglia va rinnovata.",
+			frpAttachCertExpiring: "Il certificato di ingresso scade tra {days} giorni; il plugin proverà a rinnovare la foglia con la CA esistente.",
+			frpAttachCertExpired: "Il certificato di ingresso è scaduto. Riconnettiti e controlla l’errore del certificato.",
+			frpAttachCertUnknown: "Certificato di ingresso mancante o illeggibile. Controlla l’errore prima di riconnetterti.",
+			frpAttachCaOk: "CA di ingresso valida per altri {days} giorni.",
+			frpAttachCaExpiring: "La CA di ingresso scade tra {days} giorni; sostituirla richiederà una nuova associazione di ogni telefono.",
+			frpAttachSelfCheck: "Esegui autoverifica",
+			frpAttachFrpsReachable: "porta TCP di controllo frps raggiungibile",
+			frpAttachFrpsUnreachable: "porta TCP di controllo frps non raggiungibile",
+			frpAttachEntryReachable: "porta TCP pubblica raggiungibile (identità non verificata)",
+			frpAttachEntryUnreachable: "porta TCP pubblica non raggiungibile",
+			frpAttachModeRequiresVhostPort: "La modalità attach richiede il vhostHTTPPort reale del tuo frps; il plugin non presume 7080.",
+			frpAttachCertUnknownError: "Il certificato di ingresso autofirmato manca o è illeggibile; controlla i file locali prima di riconnetterti.",
+			frpEntryTlsInvalid: "Questa modalità di certificato non è compatibile con la modalità selezionata.",
+			frpSelfSignedRequiresPublicIpv4: "L’ingresso TCP autofirmato richiede un IPv4 pubblico. Per un dominio usa un ingresso HTTPS con CA pubblica.",
+			frpIngressCaExpired: "La CA locale è scaduta. Rimuovi FRP da questo pannello, riconfiguralo e associa di nuovo ogni telefono.",
+			frpIngressCaInvalid: "La CA locale manca o è danneggiata. Controlla i file; se la ricrei, usa la pulizia FRP del pannello e associa di nuovo ogni telefono.",
+			frpIngressCaChanged: "La CA non corrisponde all’impronta salvata, quindi il canale è stato fermato. Controlla i file; se la ricrei, pulisci FRP e associa di nuovo i telefoni.",
+			frpIngressRenewalFailed: "Impossibile rinnovare il certificato di ingresso. Controlla i file e riconnettiti senza sostituire la CA automaticamente.",
+			frpAttachStepWriteSnippet: "Crea lo snippet Caddy",
+			frpAttachStepAddImport: "Aggiungi la riga import e ricarica Caddy",
+			frpAttachStepIssueCert: "Emetti il certificato per l’IP pubblico",
+			frpAttachStepCertTimer: "Verifica il timer di rinnovo",
+			frpAttachStepVerifyHttps: "Verifica l’ingresso HTTPS pubblico",
+			frpAttachStepOpenPort: "Apri la porta pubblica di ingresso",
+			frpAttachStepVerifyFrps: "Verifica che il tuo frps sia pronto",
+			frpAttachStepVerifyEntry: "Verifica il tunnel end-to-end",
+			frpAttachToken: "Copia frpc.toml con token",
+			frpAttachTokenCopied: "frpc.toml in chiaro copiato. Contiene il token condiviso e resta negli appunti finché non li svuoti: non incollarlo in luoghi pubblici.",
+			frpAttachTokenFailed: "Impossibile copiare frpc.toml con il token: {error}",
+			frpAttachTokenReenter: "Inserisci di nuovo il token condiviso. Il plugin non restituisce mai un token salvato a questa pagina.",
+			frpStep2TitleAttach: "2 · Controlla il VPS",
+			frpStep2TextAttach: "Controlla il tuo frps e copia la checklist VPS; il plugin non modifica il server.",
+			frpStep4TextAttach: "Salva la configurazione locale e verifica che l’ingresso pubblico raggiunga questo computer.",
+			frpAppRequirementSelfSigned: "L’ingresso autofirmato richiede un’app Android capace di fissare una CA remota. Le vecchie versioni senza questa funzione non possono usarlo.",
+			frpConfigurationMissingAttach: "Inserisci i dati del tuo frps, installa frpc localmente, poi salva e verifica la connessione.",
+			purgeFrpConfirmSelfSigned: "Arrestare FRP e cancellare frpc, token, configurazione, certificati, chiavi private, identità, file temporanei e log locali? Ogni telefono associato a questo ingresso autofirmato dovrà essere associato di nuovo. Il VPS non cambia."
+		});
+		Object.assign(MOBILE_CONTROL_MESSAGES.zh, {
+			frpMode: "置备方式",
+			frpModeDeploy: "由插件部署 frps（托管）",
+			frpModeAttach: "接入我已有的 frps（零 SSH，不改动）",
+			frpModeHint: "接入模式只管理本机 frpc 与按需生成的入口证书，不会安装、修改或重启你已有的 frps。",
+			frpEntryTls: "入口证书档",
+			frpEntryTlsPublic: "公开 CA 证书（Caddy，推荐）",
+			frpEntryTlsSelfSigned: "自签穿透（完全不用公开证书）",
+			frpVhostHttpPort: "frps 的 vhostHTTPPort",
+			frpVhostHttpPortHint: "你自己 frps 的回环明文 vhost 端口（上游默认 7080）。",
+			frpPublicPort: "公网入口端口",
+			frpPublicPortHint: "作为公网 HTTPS 入口的 TCP 透传端口（默认 33080，不得为 3080/3443/3444）。",
+			frpAttachPlan: "复制接入清单",
+			frpAttachPlanCopied: "接入清单已复制：本机 frpc.toml 与 VPS 侧待办。",
+			frpAttachPlanFailed: "生成接入清单失败：{error}",
+			frpAttachCertOk: "入口证书还有 {days} 天有效期；插件会检查是否需要续签叶子证书。",
+			frpAttachCertExpiring: "入口证书 {days} 天后到期；插件会尝试沿用现有 CA 续签叶子证书。",
+			frpAttachCertExpired: "入口证书已过期，请重新连接并查看具体证书错误。",
+			frpAttachCertUnknown: "入口证书缺失或不可读，请先查看具体证书错误。",
+			frpAttachCaOk: "入口 CA 还有 {days} 天有效期。",
+			frpAttachCaExpiring: "入口 CA {days} 天后到期；更换 CA 后所有手机需重新配对。",
+			frpAttachSelfCheck: "运行自检",
+			frpAttachFrpsReachable: "frps 控制 TCP 端口可达",
+			frpAttachFrpsUnreachable: "frps 控制 TCP 端口不可达",
+			frpAttachEntryReachable: "公网入口 TCP 端口可达（未验证身份）",
+			frpAttachEntryUnreachable: "公网入口 TCP 端口不可达",
+			frpAttachModeRequiresVhostPort: "接入模式必须填写你 frps 真实的 vhostHTTPPort，插件不会替你假定 7080。",
+			frpAttachCertUnknownError: "自签入口证书缺失或不可读，请检查本机证书文件后再连接。",
+			frpEntryTlsInvalid: "当前置备方式无法使用该入口证书档。",
+			frpSelfSignedRequiresPublicIpv4: "自签 TCP 入口需要公网 IPv4 地址；域名请使用受公共 CA 信任的 HTTPS 入口。",
+			frpIngressCaExpired: "本机入口 CA 已过期。请在此面板彻底清理 FRP 并重新配置，所有手机需重新配对。",
+			frpIngressCaInvalid: "本机入口 CA 缺失或损坏。请检查证书文件；如需重建，在此面板清理 FRP 后重新配对。",
+			frpIngressCaChanged: "入口 CA 与保存的指纹不符，通道已停止。请核查证书文件；如需重建，清理 FRP 后重新配对。",
+			frpIngressRenewalFailed: "入口证书续签失败。请检查 FRP 证书文件并重新连接，不要静默更换 CA。",
+			frpAttachStepWriteSnippet: "新增 Caddy 片段",
+			frpAttachStepAddImport: "加入 import 行并重载 Caddy",
+			frpAttachStepIssueCert: "为公网 IP 签发证书",
+			frpAttachStepCertTimer: "确认续期定时器",
+			frpAttachStepVerifyHttps: "验证公网 HTTPS 入口",
+			frpAttachStepOpenPort: "放行公网入口端口",
+			frpAttachStepVerifyFrps: "确认既有 frps 已就绪",
+			frpAttachStepVerifyEntry: "端到端验证隧道",
+			frpAttachToken: "复制含 Token 的 frpc.toml",
+			frpAttachTokenCopied: "含 Token 的 frpc.toml（明文）已复制：它会留在系统剪贴板中，请勿粘贴到公开位置。",
+			frpAttachTokenFailed: "复制含 Token 的 frpc.toml 失败：{error}",
+			frpAttachTokenReenter: "请先重新输入共享 Token。插件不会把已保存的 Token 返回页面。",
+			frpStep2TitleAttach: "2 · 核对既有服务器",
+			frpStep2TextAttach: "核对既有 frps 配置并复制 VPS 操作清单；插件不会改动服务器。",
+			frpStep4TextAttach: "保存本机 frpc 配置，并验证公开入口确实连接到这台电脑。",
+			frpAppRequirementSelfSigned: "自签入口需要支持远程 CA 固定的 Android App；不具备此功能的旧版 App 无法使用。",
+			frpConfigurationMissingAttach: "填写既有 frps 信息，在本机安装 frpc，然后保存并验证连接。",
+			purgeFrpConfirmSelfSigned: "要停止 FRP 并删除本机 frpc、Token、配置、证书、私钥、身份记录、临时文件和日志吗？通过此自签入口配对的手机都需重新配对；VPS 不会改变。"
+		});
 		/** Caddy snippet owned entirely by DSH Mobile; the main Caddyfile only imports it. */
 		const FRP_CADDY_SNIPPET_PATH = "/etc/caddy/dsh-mobile-dsh.caddy";
 		/** First line of the owned snippet; also the legacy whole-file marker. */
 		const FRP_CADDY_SNIPPET_MARKER = "# Managed by DSH Mobile - snippet, safe to delete";
 		/** Exact line the main Caddyfile must contain (uncommented) for the site to load. */
 		const FRP_CADDY_IMPORT_LINE = `import ${FRP_CADDY_SNIPPET_PATH}`;
-		/** Directory holding the public-IPv4 certificates installed by certbot. */
-		const FRP_CADDY_IP_CERT_DIR = "/var/lib/caddy/dsh-mobile-certs";
 		function publicIpv4Address(value) {
 			const parts = value.split(".");
 			return parts.length === 4 && parts.every((part) => /^(?:0|[1-9][0-9]{0,2})$/u.test(part) && Number(part) <= 255);
@@ -1461,8 +1635,31 @@ window.__ModuleLoader__.load({
 			if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicIpv4Address(url.hostname) && !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
 			return url.hostname;
 		}
-		/** Build the Caddy site for one public host (without markers or import wiring). */
-		function createCaddySite(publicHost, certDir = FRP_CADDY_IP_CERT_DIR) {
+		function resolveVhostHttpPort(options) {
+			const port = options.vhostHttpPort ?? 7080;
+			if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error("frp_template_input_invalid");
+			return port;
+		}
+		/**
+		* A self-signed entry deliberately never reaches Caddy: the tunnel is a raw TCP
+		* passthrough and the DSH gateway is the TLS endpoint. Refuse loudly instead of
+		* emitting a Caddy site that would need the gateway's private CA on the VPS.
+		*/
+		function rejectSelfSignedCaddySite(options) {
+			if (options.entryTls === "self-signed") throw new Error("frp_entry_tls_invalid");
+		}
+		/**
+		* Build the Caddy site for one public host (without markers or import wiring).
+		*
+		* The second parameter accepts either a bare certificate directory (the legacy
+		* signature) or a full {@link CaddySiteOptions} object, so existing callers keep
+		* working unchanged.
+		*/
+		function createCaddySite(publicHost, options = {}) {
+			const resolved = typeof options === "string" ? { certDir: options } : options;
+			rejectSelfSignedCaddySite(resolved);
+			const certDir = resolved.certDir ?? "/var/lib/caddy/dsh-mobile-certs";
+			const vhostHttpPort = resolveVhostHttpPort(resolved);
 			if (publicIpv4Address(publicHost)) return [
 				"{",
 				`  default_sni ${publicHost}`,
@@ -1474,14 +1671,14 @@ window.__ModuleLoader__.load({
 				"",
 				`https://${publicHost} {`,
 				`  tls ${certDir}/fullchain.pem ${certDir}/privkey.pem`,
-				`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+				`  reverse_proxy 127.0.0.1:${String(vhostHttpPort)}`,
 				"}",
 				""
 			].join("\n");
 			if (!publicDnsHostname(publicHost)) throw new Error("frp_template_input_invalid");
 			return [
 				`${publicHost} {`,
-				`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+				`  reverse_proxy 127.0.0.1:${String(vhostHttpPort)}`,
 				"}",
 				""
 			].join("\n");
@@ -1504,15 +1701,24 @@ window.__ModuleLoader__.load({
 				"#"
 			].join("\n");
 		}
-		/** Build the only supported frps config and Caddy snippet from validated user inputs. */
-		function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
+		/**
+		* Build the only supported frps config and Caddy snippet from validated user inputs.
+		*
+		* Default `options` reproduce the upstream artefact byte for byte; `attach` mode
+		* passes the user's real vhost port, and `self-signed` is rejected because that
+		* mode publishes a raw TCP proxy instead of an HTTP vhost.
+		*/
+		function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin, options = {}) {
 			if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+			rejectSelfSignedCaddySite(options);
+			const vhostHttpPort = resolveVhostHttpPort(options);
+			const certDir = options.certDir ?? "/var/lib/caddy/dsh-mobile-certs";
 			const publicHost = parsePublicOrigin(publicOrigin);
 			const lines = [
 				"# frps.toml — save as /etc/dsh-mobile/frps.toml, then start the frps service.",
 				`bindPort = ${String(serverPort)}`,
 				"proxyBindAddr = \"127.0.0.1\"",
-				`vhostHTTPPort = ${String(FRP_VHOST_HTTP_PORT)}`,
+				`vhostHTTPPort = ${String(vhostHttpPort)}`,
 				"auth.method = \"token\"",
 				`auth.token = ${JSON.stringify(token)}`,
 				"",
@@ -1523,12 +1729,528 @@ window.__ModuleLoader__.load({
 				"# finally run: caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
 				"# Uninstall later removes only this snippet file and the import line; your own Caddy content is kept.",
 				`${FRP_CADDY_SNIPPET_MARKER}`,
-				createCaddySite(publicHost).trimEnd(),
+				createCaddySite(publicHost, {
+					certDir,
+					vhostHttpPort
+				}).trimEnd(),
 				""
 			];
 			if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
 			return lines.join("\n");
 		}
+		//#endregion
+		//#region src/ip.ts
+		/**
+		* Browser-safe IP literal classification.
+		*
+		* `node:net` cannot be imported from the browser Client face, so the pure
+		* predicate lives here instead. Semantics are deliberately identical to
+		* `net.isIP`: strict dotted-quad IPv4 (no leading zeros, no signs, no
+		* whitespace), IPv6 with at most one `::`, at most four hex digits per group,
+		* an optional dotted-quad tail in the final position, and an optional
+		* non-empty zone id after a single `%`.
+		*
+		* This module is dependency-free and side-effect-free on purpose: it is the
+		* single classification source shared by every face of the plugin — the Node
+		* side (`config.ts`, `cloudflared-tunnel.ts`, `origin-proxy-config.ts`,
+		* `vps-deploy.ts`, `gateway.ts`, `network.ts`, `frp-config.ts`) and the browser
+		* Client face that cannot reach `node:net` — so both classify a given literal
+		* identically. Callers rely on the strict reading above and never post-process
+		* the literal afterwards, so changing the accept/reject boundary here changes
+		* it everywhere, which is the intended contract.
+		*/
+		/** Strict dotted-quad IPv4: POSIX `inet_pton` rules, so `01.1.1.1` is rejected. */
+		function isStrictIpv4(value) {
+			const parts = value.split(".");
+			if (parts.length !== 4) return false;
+			for (const part of parts) {
+				if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part)) return false;
+				if (Number(part) > 255) return false;
+			}
+			return true;
+		}
+		/**
+		* Count the 16-bit groups one side of an IPv6 address occupies.
+		*
+		* A dotted-quad tail counts as two groups and is accepted only where the caller
+		* allows it — that is, only in the final label of the whole address.
+		*
+		* @returns the group count, or `-1` when any label is malformed.
+		*/
+		function countIpv6Groups(labels, allowDottedQuad) {
+			let groups = 0;
+			for (let index = 0; index < labels.length; index += 1) {
+				const label = labels[index];
+				if (label.includes(".")) {
+					if (index !== labels.length - 1 || !allowDottedQuad || !isStrictIpv4(label)) return -1;
+					groups += 2;
+					continue;
+				}
+				if (!/^[\da-f]{1,4}$/iu.test(label)) return -1;
+				groups += 1;
+			}
+			return groups;
+		}
+		/**
+		* Classify an IP literal.
+		*
+		* @param value - candidate address; non-strings are never an IP.
+		* @returns `4` for IPv4, `6` for IPv6, `0` when the value is neither.
+		*/
+		function isIP(value) {
+			if (typeof value !== "string") return 0;
+			if (isStrictIpv4(value)) return 4;
+			let text = value;
+			const zone = text.indexOf("%");
+			if (zone !== -1) {
+				const suffix = text.slice(zone + 1);
+				if (suffix.length === 0 || suffix.includes("%")) return 0;
+				text = text.slice(0, zone);
+			}
+			if (text.length === 0) return 0;
+			const halves = text.split("::");
+			if (halves.length > 2) return 0;
+			if (halves.length === 1) return countIpv6Groups(text.split(":"), true) === 8 ? 6 : 0;
+			const leftText = halves[0];
+			const rightText = halves[1];
+			const left = leftText === "" ? [] : leftText.split(":");
+			const right = rightText === "" ? [] : rightText.split(":");
+			const leftGroups = countIpv6Groups(left, false);
+			const rightGroups = countIpv6Groups(right, right.length > 0);
+			if (leftGroups < 0 || rightGroups < 0) return 0;
+			return leftGroups + rightGroups >= 8 ? 0 : 6;
+		}
+		//#endregion
+		//#region src/network.ts
+		/**
+		* IPv4 ranges that are never a public VPS endpoint (IANA special-purpose,
+		* private, shared, loopback, link-local, documentation, benchmark, multicast,
+		* and reserved space). Kept in sync with Android `RemoteHostPolicy`.
+		*/
+		const NON_ROUTABLE_IPV4_RANGES = Object.freeze([
+			[0n, 8],
+			[167772160n, 8],
+			[1681915904n, 10],
+			[2130706432n, 8],
+			[2851995648n, 16],
+			[2886729728n, 12],
+			[3221225472n, 24],
+			[3221225984n, 24],
+			[3223307264n, 24],
+			[3224682752n, 24],
+			[3227017984n, 24],
+			[3232235520n, 16],
+			[3232706560n, 24],
+			[3323068416n, 15],
+			[3325256704n, 24],
+			[3405803776n, 24],
+			[3758096384n, 4],
+			[4026531840n, 4]
+		]);
+		function parseStrictIpv4Octets(address) {
+			const parts = address.split(".");
+			if (parts.length !== 4) return void 0;
+			const octets = [];
+			for (const part of parts) {
+				if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part)) return void 0;
+				const octet = Number(part);
+				if (octet > 255) return void 0;
+				octets.push(octet);
+			}
+			return octets;
+		}
+		/**
+		* Whether a dotted-quad IPv4 literal is globally routable and therefore usable
+		* as a public VPS / remote HTTPS endpoint. Rejects documentation addresses such
+		* as 203.0.113.10 alongside private, shared, and reserved space.
+		*/
+		function isGloballyRoutableIpv4(address) {
+			const octets = parseStrictIpv4Octets(address);
+			if (octets === void 0) return false;
+			const value = BigInt(octets[0]) << 24n | BigInt(octets[1]) << 16n | BigInt(octets[2]) << 8n | BigInt(octets[3]);
+			return !NON_ROUTABLE_IPV4_RANGES.some(([network, prefix]) => {
+				if (prefix === 0) return true;
+				const hostBits = BigInt(32 - prefix);
+				const mask = (1n << 32n) - 1n ^ (1n << hostBits) - 1n;
+				return (value & mask) === network;
+			});
+		}
+		/** Ports owned by other DSH Mobile listeners; the public entry may never reuse them. */
+		const FRP_RESERVED_PORTS = Object.freeze([
+			3080,
+			3443,
+			3444
+		]);
+		/** Every key `settings.json` may contain. Unknown keys stay rejected. */
+		const FRP_SETTINGS_KEYS = /* @__PURE__ */ new Set([
+			"version",
+			"serverAddress",
+			"serverPort",
+			"token",
+			"publicOrigin",
+			"mode",
+			"entryTls",
+			"vhostHttpPort",
+			"publicPort"
+		]);
+		function hostname(value) {
+			if (value.length > 253 || !value.includes(".")) return false;
+			return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
+		}
+		/** Validate the FRP server hostname or IP address. */
+		function validateFrpServerAddress(value) {
+			if (typeof value !== "string" || value !== value.trim() || value.length === 0 || value.length > 253 || /[\s\u0000-\u001f\u007f/\\@?#]/u.test(value)) throw new Error("frp_server_address_invalid");
+			const normalized = value.toLowerCase().replace(/\.$/u, "");
+			if (isIP(normalized) === 0 && !hostname(normalized)) throw new Error("frp_server_address_invalid");
+			return normalized;
+		}
+		/** Validate the FRP control port. */
+		function validateFrpServerPort(value) {
+			if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("frp_server_port_invalid");
+			return Number(value);
+		}
+		/** Validate a high-entropy FRP token before durable storage. */
+		function validateFrpToken(value) {
+			if (typeof value !== "string" || value.length < 16 || value.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(value)) throw new Error("frp_token_invalid");
+			return value;
+		}
+		/** Validate the public HTTPS origin used by Caddy and Android pairing. */
+		function validateFrpPublicOrigin(value) {
+			if (typeof value !== "string" || value.length > 512) throw new Error("frp_public_origin_invalid");
+			let url;
+			try {
+				url = new URL(value);
+			} catch {
+				throw new Error("frp_public_origin_invalid");
+			}
+			const publicHost = url.hostname;
+			if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || isIP(publicHost) !== 4 && !hostname(publicHost)) throw new Error("frp_public_origin_invalid");
+			if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
+			return url.origin;
+		}
+		/** Validate the provisioning mode. */
+		function validateFrpMode(value) {
+			if (value !== "deploy" && value !== "attach") throw new Error("frp_settings_invalid");
+			return value;
+		}
+		/** Validate the entry TLS mode. */
+		function validateFrpEntryTls(value) {
+			if (value !== "public-ip-cert" && value !== "self-signed") throw new Error("frp_entry_tls_invalid");
+			return value;
+		}
+		function validatePort(value, rejectReserved) {
+			if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("frp_settings_invalid");
+			const port = Number(value);
+			if (rejectReserved && FRP_RESERVED_PORTS.includes(port)) throw new Error("frp_settings_invalid");
+			return port;
+		}
+		/** Validate the loopback vhost port of the target frps. */
+		function validateFrpVhostHttpPort(value) {
+			return validatePort(value, false);
+		}
+		/** Validate the public entry port of the self-signed TCP proxy. */
+		function validateFrpPublicPort(value) {
+			return validatePort(value, true);
+		}
+		/** Effective provisioning mode; an absent field keeps the upstream behaviour. */
+		function resolveFrpMode(settings) {
+			return settings.mode ?? "deploy";
+		}
+		/** Effective entry TLS mode; an absent field keeps the upstream behaviour. */
+		function resolveFrpEntryTls(settings) {
+			return settings.entryTls ?? "public-ip-cert";
+		}
+		/** Effective loopback vhost port; an absent field keeps the upstream behaviour. */
+		function resolveFrpVhostHttpPort(settings) {
+			return settings.vhostHttpPort ?? 7080;
+		}
+		/** Effective public entry port of the self-signed passthrough. */
+		function resolveFrpPublicPort(settings) {
+			return settings.publicPort ?? 33080;
+		}
+		/** True when the gateway terminates TLS itself behind a raw frps TCP proxy. */
+		function isFrpSelfSignedIngress(settings) {
+			return resolveFrpEntryTls(settings) === "self-signed";
+		}
+		/**
+		* Parse FRP settings at the loopback request and filesystem boundaries.
+		*
+		* Optional keys are kept only when supplied, so a legacy `settings.json` still
+		* round-trips byte for byte and every default stays the upstream behaviour.
+		* Two cross-field rules are enforced here because neither can be recovered later:
+		* the self-signed entry is a TCP passthrough and therefore attach-only, and
+		* attach mode with a public-CA entry must state the user's real vhost port —
+		* silently assuming 7080 would disable the plaintext-exposure gate.
+		*/
+		function parseFrpSettings(value) {
+			if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_settings_invalid");
+			const record = value;
+			if (Reflect.ownKeys(record).some((key) => !FRP_SETTINGS_KEYS.has(String(key)))) throw new Error("frp_settings_invalid");
+			if (record.version !== void 0 && record.version !== 1) throw new Error("frp_settings_invalid");
+			const mode = record.mode === void 0 ? void 0 : validateFrpMode(record.mode);
+			const entryTls = record.entryTls === void 0 ? void 0 : validateFrpEntryTls(record.entryTls);
+			const vhostHttpPort = record.vhostHttpPort === void 0 ? void 0 : validateFrpVhostHttpPort(record.vhostHttpPort);
+			const publicPort = record.publicPort === void 0 ? void 0 : validateFrpPublicPort(record.publicPort);
+			const resolvedMode = mode ?? "deploy";
+			const resolvedEntryTls = entryTls ?? "public-ip-cert";
+			if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
+			if (resolvedMode === "attach" && resolvedEntryTls === "public-ip-cert" && vhostHttpPort === void 0) throw new Error("frp_attach_mode_requires_vhost_port");
+			const publicOrigin = validateFrpPublicOrigin(record.publicOrigin);
+			if (resolvedEntryTls === "self-signed" && isIP(new URL(publicOrigin).hostname) !== 4) throw new Error("frp_self_signed_requires_public_ipv4");
+			return Object.freeze({
+				version: 1,
+				serverAddress: validateFrpServerAddress(record.serverAddress),
+				serverPort: validateFrpServerPort(record.serverPort),
+				token: validateFrpToken(record.token),
+				publicOrigin,
+				...mode === void 0 ? {} : { mode },
+				...entryTls === void 0 ? {} : { entryTls },
+				...vhostHttpPort === void 0 ? {} : { vhostHttpPort },
+				...publicPort === void 0 ? {} : { publicPort }
+			});
+		}
+		function tomlString(value) {
+			return JSON.stringify(value);
+		}
+		/**
+		* Build the single-purpose frpc configuration for the current loopback gateway.
+		*
+		* The default (public-CA) entry is an HTTP vhost behind Caddy and is emitted byte
+		* for byte as before. The self-signed entry cannot use a vhost at all: frps only
+		* forwards raw TCP, and the gateway terminates TLS on that connection.
+		*/
+		function createFrpcToml(settings, localPort) {
+			if (!Number.isSafeInteger(localPort) || localPort < 1 || localPort > 65535) throw new Error("frp_local_port_invalid");
+			const header = [
+				`serverAddr = ${tomlString(settings.serverAddress)}`,
+				`serverPort = ${String(settings.serverPort)}`,
+				"auth.method = \"token\"",
+				`auth.token = ${tomlString(settings.token)}`,
+				"transport.tls.enable = true",
+				"",
+				"[[proxies]]",
+				"name = \"dsh-mobile\""
+			];
+			if (isFrpSelfSignedIngress(settings)) return [
+				...header,
+				"type = \"tcp\"",
+				"localIP = \"127.0.0.1\"",
+				`localPort = ${String(localPort)}`,
+				`remotePort = ${String(resolveFrpPublicPort(settings))}`,
+				"transport.useEncryption = true",
+				"transport.useCompression = true",
+				""
+			].join("\n");
+			const hostnameValue = new URL(settings.publicOrigin).hostname;
+			return [
+				...header,
+				"type = \"http\"",
+				"localIP = \"127.0.0.1\"",
+				`localPort = ${String(localPort)}`,
+				`customDomains = [${tomlString(hostnameValue)}]`,
+				"transport.useEncryption = true",
+				"transport.useCompression = true",
+				""
+			].join("\n");
+		}
+		//#endregion
+		//#region src/frp-attach.ts
+		/** Default proof path used to confirm the public entry answered from this computer. */
+		const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
+		/** Declaration printed above the VPS half of an attach template. */
+		const FRP_ATTACH_VPS_DECLARATION = "# 本模板不安装、不改动、不重启你的 frps；只新增 Caddy 片段与证书。frps 侧需你自行确认 vhostHTTPPort=<N> 与 proxyBindAddr=\"127.0.0.1\"。";
+		/** Declaration printed above the local half of an attach template. */
+		const FRP_ATTACH_LOCAL_DECLARATION = "# 本机只写入 frpc.toml 并启动 frpc：不安装、不改动本机 frps，也不改动 DSH 自身配置。";
+		/** Declaration for the self-signed passthrough, which keeps its CA on this computer. */
+		const FRP_ATTACH_SELF_SIGNED_DECLARATION = "# 自签穿透档不使用 Caddy 或公开证书：frps 只做 TCP 透传，由本机 DSH 网关终止 TLS；服务端证书会在运行时续签，CA 到期需重新配对。";
+		/**
+		* One-line notice printed above the masked frpc.toml preview.
+		*
+		* It states both facts a reader cannot verify from the text itself: the real
+		* file is written with 0600 permissions, and an unmasked copy would survive in
+		* the system clipboard.
+		*/
+		function frpAttachTokenMaskNotice(configFile) {
+			return `# 预览已打码：真正的 frpc.toml 已由插件以 0600 权限写入 ${configFile}；明文 token 不打码会随复制进入系统剪贴板，故此处只显示占位符。`;
+		}
+		/** One-line notice printed above an explicitly revealed frpc.toml preview. */
+		const FRP_ATTACH_TOKEN_REVEAL_NOTICE = "# 明文 token 已按你的显式操作显示：复制后即进入系统剪贴板并长期留存，请勿粘贴到公开位置。";
+		/** Matches the single `auth.token` assignment of a generated frpc.toml. */
+		const FRPC_TOKEN_ASSIGNMENT = /^auth\.token\s*=\s*"(?:[^"\\]|\\.)*"/mu;
+		/**
+		* Replace the `auth.token` value of a rendered frpc.toml with a fixed placeholder.
+		*
+		* Only the preview and clipboard paths call this: the file written to disk keeps
+		* the real token, because frpc has to read it. The mapping never fails open — a
+		* token line that cannot be masked raises instead of leaking the secret.
+		*/
+		function redactFrpcTomlToken(frpcToml) {
+			if (!/(^|\n)auth\.token/u.test(frpcToml)) return frpcToml;
+			const masked = frpcToml.replace(FRPC_TOKEN_ASSIGNMENT, `auth.token = "***"`);
+			if (!masked.includes(`auth.token = "***"`)) throw new Error("frp_token_mask_failed");
+			return masked;
+		}
+		/**
+		* The frpc.toml exactly as the panel displays or copies it.
+		*
+		* `options.revealToken` is the only way to obtain the plaintext variant; the
+		* default is the masked text. `createFrpcToml` itself is untouched, so the file
+		* the provider writes stays byte-for-byte identical to the upstream output.
+		*/
+		function createFrpAttachFrpcToml(settings, options = {}) {
+			const frpcToml = createFrpcToml(settings, attachLocalPort(options));
+			return options.revealToken === true ? frpcToml : redactFrpcTomlToken(frpcToml);
+		}
+		const DEFAULT_ATTACH_CONFIG_FILE = "<DSH Mobile 私有目录>/remote/frp/config/frpc.toml";
+		function attachConfigFile(options) {
+			const file = options.configFile;
+			if (file === void 0 || file === "") return DEFAULT_ATTACH_CONFIG_FILE;
+			return file;
+		}
+		function attachLocalPort(options) {
+			const port = options.localPort ?? 3443;
+			if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error("frp_local_port_invalid");
+			return port;
+		}
+		/**
+		* Reject every attach request that could not be carried out safely before any
+		* artefact is produced. Attach never installs frps, so it must know the user's
+		* real vhost port (unless the self-signed passthrough removes the vhost entirely).
+		*/
+		function validateAttachSettings(settings, options = {}) {
+			if (resolveFrpMode(settings) !== "attach") throw new Error("frp_settings_invalid");
+			if (isFrpSelfSignedIngress(settings)) {
+				if (settings.mode !== "attach") throw new Error("frp_entry_tls_invalid");
+				resolveFrpPublicPort(settings);
+				return;
+			}
+			const vhostHttpPort = options.vhostHttpPort ?? settings.vhostHttpPort;
+			if (vhostHttpPort === void 0) throw new Error("frp_attach_mode_requires_vhost_port");
+			if (!Number.isSafeInteger(vhostHttpPort) || vhostHttpPort < 1 || vhostHttpPort > 65535) throw new Error("frp_settings_invalid");
+		}
+		/** Strip the leading `# ` of a guide block so it can be pasted as runnable shell. */
+		function guideCommands(guide) {
+			return guide.split("\n").map((line) => line.replace(/^#\s?/u, "").trimEnd()).filter((line) => line !== "");
+		}
+		/**
+		* Derive every VPS-side value once so the copied runbook and the panel plan can
+		* never drift apart.
+		*/
+		function frpAttachVpsParts(settings, options = {}) {
+			validateAttachSettings(settings, options);
+			const publicHost = new URL(settings.publicOrigin).hostname;
+			if (isFrpSelfSignedIngress(settings)) return Object.freeze({
+				publicHost,
+				selfSigned: true,
+				publicPort: resolveFrpPublicPort(settings),
+				snippet: "",
+				certGuide: Object.freeze([])
+			});
+			const vhostHttpPort = options.vhostHttpPort ?? resolveFrpVhostHttpPort(settings);
+			const certDir = options.certDir;
+			const site = createCaddySite(publicHost, {
+				vhostHttpPort,
+				...certDir === void 0 ? {} : { certDir }
+			});
+			return Object.freeze({
+				publicHost,
+				selfSigned: false,
+				vhostHttpPort,
+				snippet: `${FRP_CADDY_SNIPPET_MARKER}\n${site.trimEnd()}\n`,
+				certGuide: Object.freeze(isIP(publicHost) === 4 ? guideCommands(manualIpCertificateGuide(publicHost)) : [])
+			});
+		}
+		/**
+		* Build the attach artefact for an existing frps.
+		*
+		* The result is deliberately split in two: the VPS half contains only what the
+		* user's own server needs (Caddy snippet + import + certificate guidance, or a
+		* single firewall rule for the self-signed passthrough), and the local half
+		* contains the generated frpc.toml plus its `frpc verify` self-check. Neither
+		* half installs, rewrites, or restarts the user's frps.
+		*/
+		function createFrpAttachTemplateParts(settings, options = {}) {
+			const parts = frpAttachVpsParts(settings, options);
+			const configFile = attachConfigFile(options);
+			const revealed = options.revealToken === true;
+			const frpcToml = createFrpAttachFrpcToml(settings, options);
+			const local = [
+				"# ---- (b) 本机侧（在这台电脑上执行）----",
+				FRP_ATTACH_LOCAL_DECLARATION,
+				revealed ? FRP_ATTACH_TOKEN_REVEAL_NOTICE : frpAttachTokenMaskNotice(configFile),
+				`# frpc.toml 全文（插件同样会以 0600 权限写入 ${configFile}）`,
+				frpcToml.trimEnd(),
+				"",
+				"# 启动前自检：",
+				`frpc verify -c "${configFile}"`,
+				""
+			].join("\n");
+			if (parts.selfSigned) {
+				const publicPort = parts.publicPort ?? resolveFrpPublicPort(settings);
+				const vps = [
+					"# ---- (a) VPS 侧（在你的服务器上执行，共 3 项）----",
+					FRP_ATTACH_SELF_SIGNED_DECLARATION,
+					"#",
+					"# 1) 放行公网入口端口（就是这台电脑网关的 HTTPS 入口，TCP 透传不解密）：",
+					`ufw allow ${String(publicPort)}/tcp`,
+					`ufw status | grep ${String(publicPort)}`,
+					"# 若使用 firewalld / 云厂商安全组，请放行同样的 TCP 端口。",
+					"# 前提：现有 frps 的 TCP 代理已监听公网地址；若 proxyBindAddr=127.0.0.1，放行防火墙仍无法从公网访问。",
+					"# 插件不会修改你现有的 frps；不满足此前提时请改选受信任证书入口。",
+					"#",
+					"# 2) 确认你既有的 frps 已就绪（无需修改它的配置）：",
+					"systemctl is-active frps || true",
+					`ss -lnt | grep -E ':(${String(settings.serverPort)}|${String(publicPort)})\\b' || true`,
+					"#",
+					"# 3) frpc 启动后，用 -k 检查连通性；此命令不验证身份，App 配对后会固定网关 CA：",
+					`curl -k -sS -o /dev/null -w '%{http_code}\\n' https://${parts.publicHost}:${String(publicPort)}${FRP_ATTACH_DISCOVERY_PATH}`,
+					"# 期望输出 200。",
+					""
+				].join("\n");
+				return Object.freeze({
+					mode: "attach",
+					vps,
+					local,
+					text: `${vps}${local}`
+				});
+			}
+			const vps = [
+				"# ---- (a) VPS 侧（在你的服务器上执行）----",
+				FRP_ATTACH_VPS_DECLARATION,
+				"#",
+				`# 1) 保存 Caddy 片段到 ${FRP_CADDY_SNIPPET_PATH}（只新增这一个文件）：`,
+				`cat > ${FRP_CADDY_SNIPPET_PATH} <<'DSH_MOBILE_CADDY_SNIPPET'`,
+				parts.snippet.trimEnd(),
+				"DSH_MOBILE_CADDY_SNIPPET",
+				"#",
+				"# 2) 确认 Caddyfile 顶部含下面这一行（全局块必须在前；没有则加到文件最上方）：",
+				`#   ${FRP_CADDY_IMPORT_LINE}`,
+				"caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
+				"#",
+				...parts.certGuide.length === 0 ? ["# 3) 域名 HTTPS：确认 DNS 指向 VPS，开放 80/443；Caddy 会自动申请和续期证书。"] : [
+					"# 3) 公网 IP 的 HTTPS 证书（Caddy 不能为 IP 自动签发，故用 certbot 签发）：",
+					...parts.certGuide.map((line) => `#   ${line}`),
+					"#",
+					"# 4) 确认证书续期任务，并在续期后将新证书安装到 Caddy：",
+					"systemctl list-timers certbot.timer --all || true"
+				],
+				"#",
+				"# 端到端验证（公网入口为 443，与 frps 的 vhost 端口无关）：",
+				`curl -sS -o /dev/null -w '%{http_code}\\n' https://${parts.publicHost}${FRP_ATTACH_DISCOVERY_PATH}`,
+				"# 期望输出 200。",
+				""
+			].join("\n");
+			return Object.freeze({
+				mode: "attach",
+				vps,
+				local,
+				text: `${vps}${local}`
+			});
+		}
+		/** Combined attach artefact, ready for the clipboard. */
+		function createFrpAttachTemplate(settings, options = {}) {
+			return createFrpAttachTemplateParts(settings, options).text;
+		}
 		/** Wire bounds mirrored by the Android notification policy. */
 		const TASK_NOTIFY_LIMITS = Object.freeze({
 			title: 80,
@@ -1851,8 +2573,10 @@ window.__ModuleLoader__.load({
  .dsh-mobile-settings_rowText { flex:1; min-width:0; display:flex; flex-direction:column; gap:4px; padding-right:48px; }
  .dsh-mobile-settings_title { color:var(--dsw-alias-label-primary); font-size:14px; font-weight:400; line-height:22px; }
  .dsh-mobile-settings_desc { color:var(--dsw-alias-label-tertiary); font-size:12px; font-weight:400; line-height:18px; }
- .dsh-mobile-settings_selector { display:inline-flex; align-items:center; justify-content:center; min-width:max-content; height:36px; padding:0 14px; border:0; border-radius:18px; background:var(--dsw-alias-bg-module-platform); color:var(--dsw-alias-label-primary); font:inherit; font-size:14px; line-height:22px; cursor:pointer; }
+ .dsh-mobile-settings_selector { display:inline-flex; align-items:center; justify-content:center; min-width:max-content; min-height:48px; padding:0 14px; border:0; border-radius:24px; background:var(--dsw-alias-bg-module-platform); color:var(--dsw-alias-label-primary); font:inherit; font-size:14px; line-height:22px; cursor:pointer; }
  .dsh-mobile-settings_selector:hover:not(:disabled) { background:var(--dsw-alias-interactive-bg-hover); }
+ .dsh-mobile-settings_selector:active:not(:disabled) { background:var(--dsw-alias-interactive-bg-active,var(--dsw-alias-interactive-bg-hover)); }
+ .dsh-mobile-settings_selector:focus-visible { outline:2px solid var(--dsw-alias-label-primary-bluish,#2563eb); outline-offset:2px; }
  .dsh-mobile-settings_selector:disabled { cursor:wait; opacity:.55; }
 @media ${NATIVE_MOBILE_OVERLAY_QUERY} {
   html.dsh-native-mobile-active,html.dsh-native-mobile-active body { width:100%; height:100%; overflow:hidden; }
@@ -1923,7 +2647,7 @@ window.__ModuleLoader__.load({
    [data-dsh-mobile-settings-options] > * { width:100% !important; min-width:0 !important; }
    [data-dsh-mobile-settings-options] [data-slot="settings.general.item"] > [class*="_row"] { flex-direction:column !important; align-items:stretch !important; gap:12px !important; }
   [data-dsh-mobile-settings-options] [data-slot="settings.general.item"] [class*="_rowText"] { width:100% !important; padding-right:0 !important; }
-  [data-dsh-mobile-settings-options] [data-slot="settings.general.item"] [class*="_selector"] { box-sizing:border-box !important; align-self:flex-start !important; justify-content:space-between !important; min-width:0 !important; min-height:44px !important; max-width:100% !important; }
+  [data-dsh-mobile-settings-options] [data-slot="settings.general.item"] [class*="_selector"] { box-sizing:border-box !important; align-self:flex-start !important; justify-content:space-between !important; min-width:0 !important; min-height:48px !important; max-width:100% !important; }
   [data-dsh-mobile-settings-options] :is(input,select,textarea,button) { max-width:100%; }
   [data-dsh-mobile-settings-options] :is(input,select,textarea) { box-sizing:border-box; width:100%; min-width:0; }
   [data-dsh-mobile-settings-options] [class*="_head"] { min-width:0; flex-wrap:wrap; }
@@ -2904,6 +3628,90 @@ window.__ModuleLoader__.load({
 				onClick: invoke
 			}, state === "busy" ? copy.busy : state === "error" ? copy.retry : copy.action));
 		}
+		function mobileTaskNotificationCopy(locale) {
+			if (locale === "zh") return {
+				title: "任务通知",
+				description: "在 Android 系统中开启任务完成和待确认提醒。",
+				action: "通知设置",
+				busy: "正在打开…",
+				success: "请在系统提示或设置中确认任务通知权限。",
+				reopen: "重新打开",
+				error: "无法打开通知设置，请重试。",
+				retry: "重试"
+			};
+			if (locale === "it") return {
+				title: "Notifiche delle attività",
+				description: "Attiva gli avvisi Android per le attività completate o in attesa di conferma.",
+				action: "Impostazioni notifiche",
+				busy: "Apertura…",
+				success: "Conferma il permesso nella richiesta o nelle impostazioni di sistema.",
+				reopen: "Riapri",
+				error: "Impossibile aprire le impostazioni delle notifiche. Riprova.",
+				retry: "Riprova"
+			};
+			return {
+				title: "Task notifications",
+				description: "Enable Android reminders for completed tasks and pending confirmation.",
+				action: "Notification settings",
+				busy: "Opening…",
+				success: "Confirm notification access in the system prompt or settings.",
+				reopen: "Open again",
+				error: "Could not open notification settings. Try again.",
+				retry: "Retry"
+			};
+		}
+		/** Render the Android-only notification permission entry in DSH General settings. */
+		function MobileTaskNotificationRow() {
+			const [nativeReady, setNativeReady] = (0, react.useState)(false);
+			const [state, setState] = (0, react.useState)("idle");
+			(0, react.useEffect)(() => {
+				let disposed = false;
+				const checkNativeAction = () => {
+					const bridge = window.__DSH_MOBILE_NATIVE__;
+					if (bridge === void 0) {
+						setNativeReady(false);
+						return;
+					}
+					Promise.resolve().then(() => bridge.capabilities()).then((capabilities) => {
+						if (!disposed) setNativeReady(capabilities.includes("notification.settings"));
+					}, () => {
+						if (!disposed) setNativeReady(false);
+					});
+				};
+				checkNativeAction();
+				window.addEventListener("dsh-mobile-native-ready", checkNativeAction);
+				return () => {
+					disposed = true;
+					window.removeEventListener("dsh-mobile-native-ready", checkNativeAction);
+				};
+			}, []);
+			if (!nativeReady) return null;
+			const locale = selectedMobileControlLocale();
+			const copy = mobileTaskNotificationCopy(locale);
+			const invoke = () => {
+				const bridge = window.__DSH_MOBILE_NATIVE__;
+				if (bridge === void 0 || state === "busy") return;
+				setState("busy");
+				bridge.invoke("notification.settings", {}).then(() => {
+					setState("success");
+				}, () => {
+					setState("error");
+				});
+			};
+			return (0, react.createElement)("div", {
+				className: "dsh-mobile-settings_row",
+				lang: locale
+			}, (0, react.createElement)("div", { className: "dsh-mobile-settings_rowText" }, (0, react.createElement)("div", { className: "dsh-mobile-settings_title" }, copy.title), (0, react.createElement)("div", {
+				className: "dsh-mobile-settings_desc",
+				"aria-live": "polite"
+			}, state === "success" ? copy.success : state === "error" ? copy.error : copy.description)), (0, react.createElement)("button", {
+				type: "button",
+				className: "dsh-mobile-settings_selector",
+				disabled: state === "busy",
+				"aria-busy": state === "busy" ? "true" : void 0,
+				onClick: invoke
+			}, state === "busy" ? copy.busy : state === "success" ? copy.reopen : state === "error" ? copy.retry : copy.action));
+		}
 		const CONTROL_REQUEST_TIMEOUT_MS = 15e3;
 		const LONG_CONTROL_REQUEST_TIMEOUT_MS = 21e4;
 		const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
@@ -2973,6 +3781,50 @@ window.__ModuleLoader__.load({
 		function createFrpServerTemplateForClipboard(serverPort, token, publicOrigin) {
 			return createRestrictedFrpServerTemplate(serverPort, token, publicOrigin);
 		}
+		/**
+		* Validate the panel form with the same parser the host uses, so a runbook can
+		* never describe a topology the provider would later refuse to start.
+		*/
+		function attachClipboardSettings(form) {
+			return parseFrpSettings({
+				serverAddress: form.serverAddress,
+				serverPort: form.serverPort,
+				token: form.token,
+				publicOrigin: form.publicOrigin,
+				mode: "attach",
+				entryTls: form.entryTls,
+				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
+			});
+		}
+		/**
+		* Build the copy-only attach runbook locally, so the shared token never leaves
+		* the browser: the panel only ever copies text out. The text is masked by
+		* default; `options.revealToken` is the explicit opt-in.
+		*/
+		function createFrpAttachTemplateForClipboard(form, options = {}) {
+			return createFrpAttachTemplate(attachClipboardSettings(form), options);
+		}
+		/**
+		* The frpc.toml exactly as the plugin writes it (0600), for the panel's explicit
+		* reveal action only. Every other path keeps the token masked.
+		*/
+		function createFrpAttachFrpcTomlForClipboard(form, options = {}) {
+			return createFrpAttachFrpcToml(attachClipboardSettings(form), options);
+		}
+		/**
+		* Attach-mode validation for the panel. The parser is the single source of
+		* truth, so the panel reports exactly the codes the host would return instead of
+		* duplicating the rules (and drifting from them).
+		*/
+		function frpAttachFormErrorCode(form) {
+			try {
+				createFrpAttachTemplateForClipboard(form);
+				return;
+			} catch (error) {
+				return error instanceof Error ? error.message : "frp_settings_invalid";
+			}
+		}
 		const ORIGIN_ERROR_MESSAGE_KEYS = {
 			origin_public_origin_invalid: "originPublicOriginInvalid",
 			origin_listen_host_invalid: "originListenHostInvalid",
@@ -2988,74 +3840,141 @@ window.__ModuleLoader__.load({
 			origin_listen_address_unavailable: "originAddressUnavailable",
 			origin_gateway_start_failed: "originStartFailed"
 		};
+		/** Provider failure codes shared by status, failed requests, and diagnostics. */
+		const REMOTE_ERROR_MESSAGE_KEYS = {
+			funnel_permission_required: "funnelPermission",
+			funnel_https_required: "funnelHttps",
+			funnel_start_failed: "funnelStart",
+			funnel_start_timeout: "funnelTimeout",
+			tailscale_dns_missing: "tailscaleDnsMissing",
+			gateway_start_failed: "gatewayStartFailed",
+			control_channel_failed: "controlChannelFailed",
+			cpolar_component_missing: "cpolarMissing",
+			cpolar_component_invalid: "cpolarInvalid",
+			cpolar_config_missing: "cpolarConfigMissing",
+			cpolar_config_invalid: "cpolarConfigInvalid",
+			cpolar_port_unavailable: "cpolarPortUnavailable",
+			cpolar_launch_failed: "cpolarLaunchFailed",
+			cpolar_start_timeout: "cpolarTimeout",
+			cpolar_stopped: "cpolarStopped",
+			cpolar_exited: "cpolarExited",
+			cpolar_invalid_output: "cpolarOutputInvalid",
+			cpolar_invalid_origin: "cpolarOriginInvalid",
+			cloudflared_component_missing: "cloudflaredMissing",
+			cloudflared_component_invalid: "cloudflaredInvalid",
+			cloudflared_port_unavailable: "cloudflaredPortUnavailable",
+			cloudflared_launch_failed: "cloudflaredLaunchFailed",
+			cloudflared_start_timeout: "cloudflaredTimeout",
+			cloudflared_stopped: "cloudflaredStopped",
+			cloudflared_exited: "cloudflaredExited",
+			cloudflared_invalid_output: "cloudflaredOutputInvalid",
+			cloudflared_invalid_origin: "cloudflaredOriginInvalid",
+			cloudflared_tunnel_port_unavailable: "cloudflaredTunnelPortUnavailable",
+			cloudflared_tunnel_hostname_invalid: "cloudflaredTunnelHostnameInvalid",
+			cloudflared_tunnel_port_invalid: "cloudflaredTunnelPortInvalid",
+			cloudflared_tunnel_port_reserved: "cloudflaredTunnelPortReserved",
+			cloudflared_tunnel_token_invalid: "cloudflaredTunnelTokenInvalid",
+			cloudflared_tunnel_settings_invalid: "cloudflaredTunnelSettingsInvalid",
+			cloudflared_tunnel_config_missing: "cloudflaredTunnelConfigMissing",
+			cloudflared_tunnel_config_invalid: "cloudflaredTunnelInvalid",
+			cloudflared_tunnel_target_invalid: "cloudflaredTunnelTargetInvalid",
+			cloudflared_component_unsupported: "cloudflaredComponentUnsupported",
+			cloudflared_download_hash_mismatch: "cloudflaredDownloadHashMismatch",
+			cloudflared_download_size_mismatch: "cloudflaredDownloadSizeMismatch",
+			cloudflared_executable_hash_mismatch: "cloudflaredExecutableHashMismatch",
+			cloudflared_download_redirect_missing: "cloudflaredDownloadRedirectMissing",
+			cloudflared_download_redirect_invalid: "cloudflaredDownloadRedirectInvalid",
+			cloudflared_download_redirect_rejected: "cloudflaredDownloadRedirectRejected",
+			cloudflared_port_reservation_failed: "cloudflaredPortReservationFailed",
+			frp_component_missing: "frpMissing",
+			frp_component_invalid: "frpInvalid",
+			frp_config_missing: "frpConfigMissing",
+			frp_config_verify_failed: "frpConfigVerifyFailed",
+			frp_vhost_publicly_reachable: "frpVhostPublic",
+			frp_vhost_probe_failed: "frpVhostProbeFailed",
+			frp_launch_failed: "frpLaunchFailed",
+			frp_start_timeout: "frpTimeout",
+			frp_discovery_mismatch: "frpDiscoveryMismatch",
+			frp_discovery_invalid: "frpDiscoveryInvalid",
+			frp_stopped: "frpStopped",
+			frp_exited: "frpExited",
+			frp_attach_mode_requires_vhost_port: "frpAttachModeRequiresVhostPort",
+			frp_attach_cert_unknown: "frpAttachCertUnknownError",
+			frp_entry_tls_invalid: "frpEntryTlsInvalid",
+			frp_self_signed_requires_public_ipv4: "frpSelfSignedRequiresPublicIpv4",
+			frp_ingress_ca_expired: "frpIngressCaExpired",
+			frp_ingress_ca_invalid: "frpIngressCaInvalid",
+			frp_ingress_ca_changed: "frpIngressCaChanged",
+			frp_ingress_renewal_failed: "frpIngressRenewalFailed",
+			...ORIGIN_ERROR_MESSAGE_KEYS
+		};
+		const DIAGNOSTIC_CONTROLLER_ACTION_OVERRIDES = {
+			component_missing: "remoteUnavailableTailscale",
+			sidecar_launch_failed: "remoteUnavailableTailscale",
+			sidecar_stopped: "controlChannelFailed",
+			sidecar_exited: "controlChannelFailed"
+		};
+		/** Only codes with a specific diagnostic action use the status message key. */
+		const DIAGNOSTIC_CONTROLLER_ACTION_CODES = /* @__PURE__ */ new Set([
+			...Object.keys(ORIGIN_ERROR_MESSAGE_KEYS),
+			"funnel_permission_required",
+			"funnel_https_required",
+			"funnel_start_failed",
+			"funnel_start_timeout",
+			"tailscale_dns_missing",
+			"control_channel_failed",
+			"gateway_start_failed",
+			"cpolar_component_missing",
+			"cpolar_component_invalid",
+			"cpolar_config_missing",
+			"cpolar_config_invalid",
+			"cpolar_start_timeout",
+			"cpolar_stopped",
+			"cpolar_exited",
+			"cloudflared_component_missing",
+			"cloudflared_component_invalid",
+			"cloudflared_component_unsupported",
+			"cloudflared_port_unavailable",
+			"cloudflared_port_reservation_failed",
+			"cloudflared_launch_failed",
+			"cloudflared_start_timeout",
+			"cloudflared_stopped",
+			"cloudflared_exited",
+			"cloudflared_invalid_origin",
+			"cloudflared_tunnel_port_unavailable",
+			"cloudflared_tunnel_config_invalid",
+			"cloudflared_tunnel_target_invalid",
+			"cloudflared_download_hash_mismatch",
+			"cloudflared_download_size_mismatch",
+			"cloudflared_executable_hash_mismatch",
+			"frp_component_missing",
+			"frp_component_invalid",
+			"frp_config_missing",
+			"frp_config_verify_failed",
+			"frp_vhost_publicly_reachable",
+			"frp_vhost_probe_failed",
+			"frp_launch_failed",
+			"frp_start_timeout",
+			"frp_discovery_mismatch",
+			"frp_discovery_invalid",
+			"frp_stopped",
+			"frp_exited",
+			"frp_attach_mode_requires_vhost_port",
+			"frp_attach_cert_unknown",
+			"frp_entry_tls_invalid",
+			"frp_self_signed_requires_public_ipv4",
+			"frp_ingress_ca_expired",
+			"frp_ingress_ca_invalid",
+			"frp_ingress_ca_changed",
+			"frp_ingress_renewal_failed"
+		]);
+		/** Resolve the next-step text for a remote-controller diagnostic. */
+		function diagnosticControllerAction(code, locale, fallback) {
+			if (typeof code !== "string") return fallback;
+			const key = DIAGNOSTIC_CONTROLLER_ACTION_OVERRIDES[code] ?? (DIAGNOSTIC_CONTROLLER_ACTION_CODES.has(code) ? REMOTE_ERROR_MESSAGE_KEYS[code] : void 0);
+			return key === void 0 ? fallback : controlTranslator(locale)(key);
+		}
 		function installControl() {
-			/**
-			* Provider failure codes to message keys.
-			*
-			* Kept as keys rather than translated text so the same table can serve both the
-			* status repaint and a failed request: a server rejection carries its code in
-			* `error.message`, and showing that raw would print `Error: cloudflared_...` in
-			* every language while the translated sentence sat unreachable.
-			*/
-			const REMOTE_ERROR_MESSAGE_KEYS = {
-				funnel_permission_required: "funnelPermission",
-				funnel_https_required: "funnelHttps",
-				funnel_start_failed: "funnelStart",
-				funnel_start_timeout: "funnelTimeout",
-				tailscale_dns_missing: "tailscaleDnsMissing",
-				gateway_start_failed: "gatewayStartFailed",
-				control_channel_failed: "controlChannelFailed",
-				cpolar_component_missing: "cpolarMissing",
-				cpolar_component_invalid: "cpolarInvalid",
-				cpolar_config_missing: "cpolarConfigMissing",
-				cpolar_config_invalid: "cpolarConfigInvalid",
-				cpolar_port_unavailable: "cpolarPortUnavailable",
-				cpolar_launch_failed: "cpolarLaunchFailed",
-				cpolar_start_timeout: "cpolarTimeout",
-				cpolar_stopped: "cpolarStopped",
-				cpolar_exited: "cpolarExited",
-				cpolar_invalid_output: "cpolarOutputInvalid",
-				cpolar_invalid_origin: "cpolarOriginInvalid",
-				cloudflared_component_missing: "cloudflaredMissing",
-				cloudflared_component_invalid: "cloudflaredInvalid",
-				cloudflared_port_unavailable: "cloudflaredPortUnavailable",
-				cloudflared_launch_failed: "cloudflaredLaunchFailed",
-				cloudflared_start_timeout: "cloudflaredTimeout",
-				cloudflared_stopped: "cloudflaredStopped",
-				cloudflared_exited: "cloudflaredExited",
-				cloudflared_invalid_output: "cloudflaredOutputInvalid",
-				cloudflared_invalid_origin: "cloudflaredOriginInvalid",
-				cloudflared_tunnel_port_unavailable: "cloudflaredTunnelPortUnavailable",
-				cloudflared_tunnel_hostname_invalid: "cloudflaredTunnelHostnameInvalid",
-				cloudflared_tunnel_port_invalid: "cloudflaredTunnelPortInvalid",
-				cloudflared_tunnel_port_reserved: "cloudflaredTunnelPortReserved",
-				cloudflared_tunnel_token_invalid: "cloudflaredTunnelTokenInvalid",
-				cloudflared_tunnel_settings_invalid: "cloudflaredTunnelSettingsInvalid",
-				cloudflared_tunnel_config_missing: "cloudflaredTunnelConfigMissing",
-				cloudflared_tunnel_config_invalid: "cloudflaredTunnelInvalid",
-				cloudflared_tunnel_target_invalid: "cloudflaredTunnelTargetInvalid",
-				cloudflared_component_unsupported: "cloudflaredComponentUnsupported",
-				cloudflared_download_hash_mismatch: "cloudflaredDownloadHashMismatch",
-				cloudflared_download_size_mismatch: "cloudflaredDownloadSizeMismatch",
-				cloudflared_executable_hash_mismatch: "cloudflaredExecutableHashMismatch",
-				cloudflared_download_redirect_missing: "cloudflaredDownloadRedirectMissing",
-				cloudflared_download_redirect_invalid: "cloudflaredDownloadRedirectInvalid",
-				cloudflared_download_redirect_rejected: "cloudflaredDownloadRedirectRejected",
-				cloudflared_port_reservation_failed: "cloudflaredPortReservationFailed",
-				frp_component_missing: "frpMissing",
-				frp_component_invalid: "frpInvalid",
-				frp_config_missing: "frpConfigMissing",
-				frp_config_verify_failed: "frpConfigVerifyFailed",
-				frp_vhost_publicly_reachable: "frpVhostPublic",
-				frp_vhost_probe_failed: "frpVhostProbeFailed",
-				frp_launch_failed: "frpLaunchFailed",
-				frp_start_timeout: "frpTimeout",
-				frp_discovery_mismatch: "frpDiscoveryMismatch",
-				frp_discovery_invalid: "frpDiscoveryInvalid",
-				frp_stopped: "frpStopped",
-				frp_exited: "frpExited",
-				...ORIGIN_ERROR_MESSAGE_KEYS
-			};
 			/** The table above, translated, for the status repaint. */
 			const translatedRemoteErrors = () => Object.fromEntries(Object.entries(REMOTE_ERROR_MESSAGE_KEYS).map(([code, key]) => [code, t(key)]));
 			/**
@@ -3515,11 +4434,58 @@ window.__ModuleLoader__.load({
 			frpOrigin.autocomplete = "off";
 			frpOrigin.spellcheck = false;
 			frpOrigin.placeholder = t("frpPublicOriginPlaceholder");
+			const frpModeLabel = element("label", "dsh-mobile-control__field");
+			frpModeLabel.textContent = t("frpMode");
+			const frpMode = element("select");
+			for (const [value, label] of [["deploy", t("frpModeDeploy")], ["attach", t("frpModeAttach")]]) {
+				const option = element("option");
+				option.value = value;
+				option.textContent = label;
+				frpMode.append(option);
+			}
+			const frpModeHint = element("p", "dsh-mobile-control__frp-hint");
+			frpModeHint.textContent = t("frpModeHint");
+			frpModeLabel.append(frpMode, frpModeHint);
+			const frpEntryTlsLabel = element("label", "dsh-mobile-control__field");
+			frpEntryTlsLabel.textContent = t("frpEntryTls");
+			const frpEntryTls = element("select");
+			for (const [value, label] of [["public-ip-cert", t("frpEntryTlsPublic")], ["self-signed", t("frpEntryTlsSelfSigned")]]) {
+				const option = element("option");
+				option.value = value;
+				option.textContent = label;
+				frpEntryTls.append(option);
+			}
+			frpEntryTlsLabel.append(frpEntryTls);
+			const frpVhostLabel = element("label", "dsh-mobile-control__field");
+			frpVhostLabel.textContent = t("frpVhostHttpPort");
+			const frpVhostPort = element("input");
+			frpVhostPort.type = "number";
+			frpVhostPort.inputMode = "numeric";
+			frpVhostPort.min = "1";
+			frpVhostPort.max = "65535";
+			frpVhostPort.placeholder = "7080";
+			const frpVhostHint = element("p", "dsh-mobile-control__frp-hint");
+			frpVhostHint.id = "dsh-mobile-frp-vhost-hint";
+			frpVhostHint.textContent = t("frpVhostHttpPortHint");
+			frpVhostPort.setAttribute("aria-describedby", frpVhostHint.id);
+			frpVhostLabel.append(frpVhostPort, frpVhostHint);
+			const frpPublicPortLabel = element("label", "dsh-mobile-control__field");
+			frpPublicPortLabel.textContent = t("frpPublicPort");
+			const frpPublicPort = element("input");
+			frpPublicPort.type = "number";
+			frpPublicPort.inputMode = "numeric";
+			frpPublicPort.min = "1";
+			frpPublicPort.max = "65535";
+			frpPublicPort.value = "33080";
+			frpPublicPort.placeholder = "33080";
+			const frpPublicPortHint = element("p", "dsh-mobile-control__frp-hint");
+			frpPublicPortHint.textContent = t("frpPublicPortHint");
+			frpPublicPortLabel.append(frpPublicPort, frpPublicPortHint);
 			frpServerLabel.append(frpServer);
 			frpPortLabel.append(frpPort);
 			frpTokenLabel.append(frpToken);
 			frpOriginLabel.append(frpOrigin);
-			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpOriginLabel);
+			frpFields.append(frpServerLabel, frpPortLabel, frpTokenLabel, frpOriginLabel, frpModeLabel, frpEntryTlsLabel, frpVhostLabel, frpPublicPortLabel);
 			frpStep1.append(frpStep1Title, frpStep1Text, frpFields);
 			const frpStep2 = element("section", "dsh-mobile-control__frp-step");
 			const frpStep2Title = element("strong");
@@ -3529,6 +4495,21 @@ window.__ModuleLoader__.load({
 			const frpCopyTemplate = element("button", "dsh-mobile-control__secondary dsh-mobile-control__frp-action");
 			frpCopyTemplate.type = "button";
 			frpCopyTemplate.textContent = t("copyServerTemplate");
+			const frpCopyAttachPlan = element("button", "dsh-mobile-control__secondary dsh-mobile-control__frp-action");
+			frpCopyAttachPlan.type = "button";
+			frpCopyAttachPlan.textContent = t("frpAttachPlan");
+			frpCopyAttachPlan.hidden = true;
+			const frpCopyAttachToken = element("button", "dsh-mobile-control__secondary dsh-mobile-control__frp-action");
+			frpCopyAttachToken.type = "button";
+			frpCopyAttachToken.textContent = t("frpAttachToken");
+			frpCopyAttachToken.hidden = true;
+			const frpSelfCheckButton = element("button", "dsh-mobile-control__secondary dsh-mobile-control__frp-action");
+			frpSelfCheckButton.type = "button";
+			frpSelfCheckButton.textContent = t("frpAttachSelfCheck");
+			frpSelfCheckButton.hidden = true;
+			const frpSelfCheckStatus = element("p", "dsh-mobile-control__component-status");
+			frpSelfCheckStatus.textContent = "";
+			frpSelfCheckStatus.hidden = true;
 			const vpsDeployText = element("p");
 			vpsDeployText.textContent = t("vpsDeployText");
 			const vpsChangesTitle = element("p");
@@ -3582,7 +4563,7 @@ window.__ModuleLoader__.load({
 			const vpsUninstall = element("button", "dsh-mobile-control__danger dsh-mobile-control__frp-action");
 			vpsUninstall.type = "button";
 			vpsUninstall.textContent = t("vpsUninstall");
-			frpStep2.append(frpStep2Title, frpStep2Text, frpCopyTemplate, vpsDeployText, vpsChangesTitle, vpsChanges, vpsDeployFields, vpsDeploy, vpsDeployStatus, vpsCopyUninstall, vpsUninstall);
+			frpStep2.append(frpStep2Title, frpStep2Text, frpCopyTemplate, frpCopyAttachPlan, frpCopyAttachToken, frpSelfCheckButton, frpSelfCheckStatus, vpsDeployText, vpsChangesTitle, vpsChanges, vpsDeployFields, vpsDeploy, vpsDeployStatus, vpsCopyUninstall, vpsUninstall);
 			const frpStep3 = element("section", "dsh-mobile-control__frp-step");
 			const frpStep3Title = element("strong");
 			frpStep3Title.textContent = t("frpStep3Title");
@@ -4099,6 +5080,14 @@ window.__ModuleLoader__.load({
 			let configuredFrpServer = "";
 			let configuredFrpPort = 7e3;
 			let configuredFrpOrigin = "";
+			let configuredFrpVhostPort = 7080;
+			let configuredFrpPublicPort = 33080;
+			let frpConfiguredMode = "deploy";
+			let frpConfiguredEntryTls = "public-ip-cert";
+			let frpModeDraft = false;
+			let frpEntryTlsDraft = false;
+			let frpVhostDraft = false;
+			let frpAttachVhostExplicit = false;
 			let providerInfoPinned = false;
 			let providerInfoHovered = false;
 			let previousAccessView = "lan";
@@ -4513,6 +5502,48 @@ window.__ModuleLoader__.load({
 				if (frpOrigin.value === "" && configuredFrpOrigin !== "") frpOrigin.value = configuredFrpOrigin;
 				frpStorage.textContent = frpStoragePath;
 				frpStorage.title = frpStoragePath;
+				const configuredFrpMode = frpConfiguration.mode === "attach" ? "attach" : "deploy";
+				const configuredFrpEntryTls = frpConfiguration.entryTls === "self-signed" ? "self-signed" : "public-ip-cert";
+				if (frpConfigured) {
+					frpConfiguredMode = configuredFrpMode;
+					frpConfiguredEntryTls = configuredFrpEntryTls;
+				}
+				if (frpConfigured && !frpModeDraft) frpMode.value = configuredFrpMode;
+				if (frpConfigured && !frpEntryTlsDraft) frpEntryTls.value = configuredFrpEntryTls;
+				if (typeof frpConfiguration.vhostHttpPort === "number") configuredFrpVhostPort = frpConfiguration.vhostHttpPort;
+				if (typeof frpConfiguration.publicPort === "number") configuredFrpPublicPort = frpConfiguration.publicPort;
+				if (!frpVhostDraft) {
+					if (frpMode.value === "attach" && configuredFrpMode === "attach" && configuredFrpEntryTls === "public-ip-cert") {
+						frpVhostPort.value = String(configuredFrpVhostPort);
+						frpAttachVhostExplicit = true;
+					} else frpVhostPort.value = frpMode.value === "deploy" ? String(configuredFrpVhostPort) : "";
+				}
+				if (frpPublicPort.value === "" || frpPublicPort.value === "33080") frpPublicPort.value = String(configuredFrpPublicPort);
+				const attachSelected = frpMode.value === "attach";
+				const selfSignedSelected = attachSelected && frpEntryTls.value === "self-signed";
+				frpStep2Title.textContent = t(attachSelected ? "frpStep2TitleAttach" : "frpStep2Title");
+				frpStep2Text.textContent = t(attachSelected ? "frpStep2TextAttach" : "frpStep2Text");
+				frpStep4Text.textContent = t(attachSelected ? "frpStep4TextAttach" : "frpStep4Text");
+				frpAppRequirement.textContent = t(selfSignedSelected ? "frpAppRequirementSelfSigned" : "frpAppRequirement");
+				frpCopyTemplate.hidden = attachSelected;
+				frpCopyAttachPlan.hidden = !attachSelected;
+				frpCopyAttachToken.hidden = !attachSelected;
+				frpSelfCheckButton.hidden = !frpConfigured;
+				frpVhostPort.disabled = selfSignedSelected;
+				frpVhostLabel.hidden = selfSignedSelected;
+				frpVhostPort.required = attachSelected && !selfSignedSelected;
+				frpVhostHint.textContent = frpVhostPort.required ? t("frpAttachModeRequiresVhostPort") : t("frpVhostHttpPortHint");
+				frpEntryTls.disabled = !attachSelected;
+				frpEntryTlsLabel.hidden = !attachSelected;
+				frpPublicPortLabel.hidden = !selfSignedSelected;
+				vpsDeployText.hidden = attachSelected;
+				vpsChangesTitle.hidden = attachSelected;
+				vpsChanges.hidden = attachSelected;
+				vpsDeployFields.hidden = attachSelected;
+				vpsDeploy.hidden = attachSelected;
+				vpsDeployStatus.hidden = attachSelected;
+				vpsCopyUninstall.hidden = attachSelected;
+				vpsUninstall.hidden = attachSelected;
 				frpInstall.hidden = frpInstalled || !frpSupported;
 				frpInstall.textContent = frpDownloadBytes > 0 ? t("installWithSize", { size: formatMegabytes(frpDownloadBytes) }) : t("installFrpc");
 				frpInstall.disabled = remoteProviderBusy;
@@ -4522,7 +5553,7 @@ window.__ModuleLoader__.load({
 				vpsUninstall.disabled = vpsDeploy.disabled;
 				frpPurge.hidden = !frpInstalled && !frpConfigured;
 				frpComponentStatus.textContent = !frpSupported ? t("frpUnsupported") : frpInstalled ? t("frpComponentReady", { version: frpVersion }) : t("frpNotInstalled");
-				frpConfigurationStatus.textContent = frpConfigured ? t("frpConfigurationReady") : t("frpConfigurationMissing");
+				frpConfigurationStatus.textContent = frpConfigured ? t("frpConfigurationReady") : t(attachSelected ? "frpConfigurationMissingAttach" : "frpConfigurationMissing");
 				frpOverview.hidden = !frpConfigured;
 				frpOverviewEndpoint.textContent = configuredFrpOrigin === "" ? configuredFrpServer : `${configuredFrpOrigin} · ${configuredFrpServer}:${String(configuredFrpPort)}`;
 				frpToken.placeholder = frpConfigured ? locale === "zh" ? "已安全保存；留空保持不变" : locale === "it" ? "Salvato; lascia vuoto per mantenerlo" : "Saved securely; leave blank to keep it" : t("frpTokenPlaceholder");
@@ -4623,6 +5654,36 @@ window.__ModuleLoader__.load({
 				}
 				if (!needsFunnelSetup) remoteSetupPending = false;
 			};
+			frpMode.addEventListener("change", () => {
+				frpModeDraft = true;
+				if (frpMode.value === "attach") {
+					if (!frpAttachVhostExplicit) {
+						frpVhostPort.value = "";
+						frpVhostDraft = true;
+					}
+				} else {
+					frpEntryTls.value = "public-ip-cert";
+					frpEntryTlsDraft = true;
+					if (frpVhostPort.value === "") frpVhostPort.value = String(configuredFrpVhostPort);
+					frpVhostDraft = true;
+				}
+				frpVhostPort.removeAttribute("aria-invalid");
+				renderRemote(latestRemoteState);
+			});
+			frpEntryTls.addEventListener("change", () => {
+				frpEntryTlsDraft = true;
+				if (frpMode.value === "attach" && frpEntryTls.value === "public-ip-cert" && !frpAttachVhostExplicit) {
+					frpVhostPort.value = "";
+					frpVhostDraft = true;
+				}
+				frpVhostPort.removeAttribute("aria-invalid");
+				renderRemote(latestRemoteState);
+			});
+			frpVhostPort.addEventListener("input", () => {
+				frpVhostDraft = true;
+				if (frpMode.value === "attach") frpAttachVhostExplicit = frpVhostPort.value.trim() !== "";
+				frpVhostPort.removeAttribute("aria-invalid");
+			});
 			let remoteLoadInFlight = false;
 			const loadRemote = () => {
 				if (remoteLoadInFlight || originFormBusy) return;
@@ -4885,11 +5946,33 @@ window.__ModuleLoader__.load({
 				});
 			});
 			const validFrpServer = (value) => value === value.trim() && value.length > 0 && value.length <= 253 && !/[\s\u0000-\u001f\u007f/\\@?#]/u.test(value);
-			const frpForm = () => ({
-				serverAddress: String(frpServer.value ?? "").trim(),
-				serverPort: Number(frpPort.value),
-				token: String(frpToken.value ?? ""),
-				publicOrigin: String(frpOrigin.value ?? "").trim()
+			const frpForm = () => {
+				const vhostHttpPort = Number(frpVhostPort.value);
+				const publicPort = Number(frpPublicPort.value);
+				const mode = frpMode.value === "attach" ? "attach" : "deploy";
+				return {
+					serverAddress: String(frpServer.value ?? "").trim(),
+					serverPort: Number(frpPort.value),
+					token: String(frpToken.value ?? ""),
+					publicOrigin: String(frpOrigin.value ?? "").trim(),
+					mode,
+					entryTls: frpEntryTls.value === "self-signed" ? "self-signed" : "public-ip-cert",
+					...Number.isSafeInteger(vhostHttpPort) && vhostHttpPort >= 1 ? { vhostHttpPort } : {},
+					...Number.isSafeInteger(publicPort) && publicPort >= 1 ? { publicPort } : {}
+				};
+			};
+			/**
+			* Attach-mode artefacts are built locally, so the token never reaches the host
+			* API and the runbook can be produced before anything is saved.
+			*/
+			const attachClipboardForm = (form) => ({
+				serverAddress: form.serverAddress,
+				serverPort: form.serverPort,
+				token: form.token === "" && frpConfigured ? "0123456789abcdef" : form.token,
+				publicOrigin: form.publicOrigin,
+				entryTls: form.entryTls,
+				...form.entryTls === "self-signed" || form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
+				...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
 			});
 			const validFrpForm = (form) => {
 				if (!validFrpServer(form.serverAddress)) return false;
@@ -4912,6 +5995,127 @@ window.__ModuleLoader__.load({
 					remoteStatus.textContent = t("templateCopyFailed");
 				});
 			});
+			const frpAttachErrorText = (code) => t(REMOTE_ERROR_MESSAGE_KEYS[code] ?? "frpInputInvalid");
+			const showFrpAttachError = (code) => {
+				const message = frpAttachErrorText(code);
+				if (code === "frp_attach_mode_requires_vhost_port") {
+					frpVhostPort.setAttribute("aria-invalid", "true");
+					frpVhostHint.textContent = message;
+					frpVhostPort.focus();
+				}
+				remoteStatus.textContent = message;
+			};
+			frpCopyAttachPlan.addEventListener("click", () => {
+				const form = frpForm();
+				if (!validFrpServer(form.serverAddress) || !Number.isSafeInteger(form.serverPort) || form.serverPort < 1 || form.serverPort > 65535 || form.publicOrigin === "") {
+					remoteStatus.textContent = t("frpInputInvalid");
+					return;
+				}
+				if (form.token !== "") {
+					const attachForm = attachClipboardForm(form);
+					const code = frpAttachFormErrorCode(attachForm);
+					if (code !== void 0) {
+						showFrpAttachError(code);
+						return;
+					}
+					navigator.clipboard.writeText(createFrpAttachTemplateForClipboard(attachForm)).then(() => {
+						remoteStatus.textContent = t("frpAttachPlanCopied");
+					}, () => {
+						remoteStatus.textContent = t("frpAttachPlanFailed", { error: t("templateCopyFailed") });
+					});
+					return;
+				}
+				if (!frpConfigured) {
+					remoteStatus.textContent = t("frpInputInvalid");
+					return;
+				}
+				remoteProviderBusy = true;
+				frpCopyAttachPlan.disabled = true;
+				controlRequestJson("/api/mobile-access/remote/frp/attach-plan", {
+					method: "POST",
+					body: JSON.stringify(form)
+				}).then((data) => {
+					const text = typeof data.frpAttachTemplate === "string" ? data.frpAttachTemplate : "";
+					if (text === "") throw new Error("frp_settings_invalid");
+					return navigator.clipboard.writeText(text).then(() => {
+						remoteStatus.textContent = t("frpAttachPlanCopied");
+					});
+				}, (error) => {
+					remoteStatus.textContent = frpAttachErrorText(String(error));
+				}).catch((error) => {
+					remoteStatus.textContent = t("frpAttachPlanFailed", { error: String(error) });
+				}).finally(() => {
+					remoteProviderBusy = false;
+					frpCopyAttachPlan.disabled = false;
+				});
+			});
+			/** Copy a token-bearing frpc.toml only from the token the user just typed. */
+			frpCopyAttachToken.addEventListener("click", () => {
+				const form = frpForm();
+				if (!validFrpServer(form.serverAddress) || !Number.isSafeInteger(form.serverPort) || form.serverPort < 1 || form.serverPort > 65535 || form.publicOrigin === "") {
+					remoteStatus.textContent = t("frpInputInvalid");
+					return;
+				}
+				if (form.token !== "") {
+					const attachForm = attachClipboardForm(form);
+					const code = frpAttachFormErrorCode(attachForm);
+					if (code !== void 0) {
+						showFrpAttachError(code);
+						return;
+					}
+					navigator.clipboard.writeText(createFrpAttachFrpcTomlForClipboard(attachForm, { revealToken: true })).then(() => {
+						remoteStatus.textContent = t("frpAttachTokenCopied");
+					}, () => {
+						remoteStatus.textContent = t("frpAttachTokenFailed", { error: t("templateCopyFailed") });
+					});
+					return;
+				}
+				frpToken.focus();
+				remoteStatus.textContent = t("frpAttachTokenReenter");
+			});
+			const certificateStatusText = (status) => {
+				if (status === void 0) return "";
+				const state = typeof status.state === "string" ? status.state : "unknown";
+				const days = typeof status.daysRemaining === "number" ? String(status.daysRemaining) : "0";
+				if (state === "ok") return t("frpAttachCertOk", { days });
+				if (state === "expiring") return t("frpAttachCertExpiring", { days });
+				if (state === "expired") return t("frpAttachCertExpired");
+				return t("frpAttachCertUnknown");
+			};
+			const caStatusText = (status) => {
+				if (status === void 0) return "";
+				const state = typeof status.state === "string" ? status.state : "unknown";
+				const days = typeof status.daysRemaining === "number" ? String(status.daysRemaining) : "0";
+				if (state === "ok") return t("frpAttachCaOk", { days });
+				if (state === "expiring") return t("frpAttachCaExpiring", { days });
+				if (state === "expired") return t("frpIngressCaExpired");
+				return t("frpIngressCaInvalid");
+			};
+			frpSelfCheckButton.addEventListener("click", () => {
+				if (remoteProviderBusy) return;
+				remoteProviderBusy = true;
+				frpSelfCheckButton.disabled = true;
+				frpSelfCheckStatus.hidden = false;
+				frpSelfCheckStatus.textContent = t("loadingStatus");
+				controlRequestJson("/api/mobile-access/remote/frp/self-check").then((data) => {
+					const check = data.frpSelfCheck !== null && typeof data.frpSelfCheck === "object" ? data.frpSelfCheck : {};
+					const lines = [];
+					const caCertificate = check.caCertificate !== null && typeof check.caCertificate === "object" ? check.caCertificate : void 0;
+					const caText = caStatusText(caCertificate);
+					if (caText !== "") lines.push(caText);
+					const certificate = check.certificate !== null && typeof check.certificate === "object" ? check.certificate : void 0;
+					const certificateText = certificateStatusText(certificate);
+					if (certificateText !== "") lines.push(certificateText);
+					lines.push(check.frpsReachable === true ? t("frpAttachFrpsReachable") : t("frpAttachFrpsUnreachable"));
+					if (check.entryTls === "self-signed") lines.push(check.entryReachable === true ? t("frpAttachEntryReachable") : t("frpAttachEntryUnreachable"));
+					frpSelfCheckStatus.textContent = lines.join(" · ");
+				}, (error) => {
+					frpSelfCheckStatus.textContent = t("requestFailed", { error: String(error) });
+				}).finally(() => {
+					remoteProviderBusy = false;
+					frpSelfCheckButton.disabled = false;
+				});
+			});
 			const validVpsSshUser = (value) => /^[a-z_][a-z0-9_.-]*[$]?$/iu.test(value) && value.length <= 64;
 			const validVpsSshKey = (value) => value === "" || /^[a-zA-Z]:[\\/]/u.test(value) || value.startsWith("/");
 			const vpsFormStorageKey = "dsh-mobile.frp-vps-form.v1";
@@ -4947,7 +6151,11 @@ window.__ModuleLoader__.load({
 					serverAddress: form.serverAddress === "" ? configuredFrpServer : form.serverAddress,
 					serverPort: Number.isSafeInteger(form.serverPort) && form.serverPort >= 1 ? form.serverPort : configuredFrpPort,
 					token: form.token,
-					publicOrigin: form.publicOrigin === "" ? configuredFrpOrigin : form.publicOrigin
+					publicOrigin: form.publicOrigin === "" ? configuredFrpOrigin : form.publicOrigin,
+					mode: form.mode,
+					entryTls: form.entryTls,
+					...form.vhostHttpPort === void 0 ? {} : { vhostHttpPort: form.vhostHttpPort },
+					...form.publicPort === void 0 ? {} : { publicPort: form.publicPort }
 				};
 			};
 			const validVpsFrpForm = () => {
@@ -5187,10 +6395,14 @@ window.__ModuleLoader__.load({
 			frpConfigure.addEventListener("click", () => {
 				if (remoteProviderBusy || !frpInstalled) return;
 				const form = frpForm();
-				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin;
-				if (!unchanged && !validFrpForm(form)) {
-					remoteStatus.textContent = t("frpInputInvalid");
-					return;
+				const unchanged = frpConfigured && form.token === "" && form.serverAddress === configuredFrpServer && form.serverPort === configuredFrpPort && form.publicOrigin === configuredFrpOrigin && form.mode === (frpConfiguredMode === "attach" ? "attach" : "deploy") && form.entryTls === (frpConfiguredEntryTls === "self-signed" ? "self-signed" : "public-ip-cert") && (form.vhostHttpPort ?? configuredFrpVhostPort) === configuredFrpVhostPort && (form.publicPort ?? configuredFrpPublicPort) === configuredFrpPublicPort;
+				if (!unchanged) {
+					const code = form.mode === "attach" ? frpAttachFormErrorCode(attachClipboardForm(form)) : validFrpForm(form) ? void 0 : "frp_settings_invalid";
+					if (code !== void 0) {
+						if (form.mode === "attach") showFrpAttachError(code);
+						else remoteStatus.textContent = t("frpInputInvalid");
+						return;
+					}
 				}
 				remoteProviderBusy = true;
 				frpConfigure.disabled = true;
@@ -5217,7 +6429,7 @@ window.__ModuleLoader__.load({
 				});
 			});
 			frpPurge.addEventListener("click", () => {
-				if (remoteProviderBusy || !window.confirm(t("purgeFrpConfirm"))) return;
+				if (remoteProviderBusy || !window.confirm(t(frpConfiguredMode === "attach" && frpConfiguredEntryTls === "self-signed" ? "purgeFrpConfirmSelfSigned" : "purgeFrpConfirm"))) return;
 				remoteProviderBusy = true;
 				frpPurge.disabled = true;
 				remoteStatus.textContent = t("purgingFrp");
@@ -5518,9 +6730,10 @@ window.__ModuleLoader__.load({
 				const localizedEntryCopy = (entry) => {
 					const serverCopy = diagnosticServerCopy(entry);
 					const reason = typeof entry.reason === "string" ? entry.reason : "";
-					const templates = DIAGNOSTIC_REASON_MESSAGES[locale][reason];
-					if (templates === void 0) return serverCopy;
 					const facts = entry.facts !== null && typeof entry.facts === "object" ? entry.facts : {};
+					const copyReason = facts.viaProxy === true && (reason === "remote-ready" || reason === "remote-rate-limited") ? `${reason}-via-proxy` : reason;
+					const templates = DIAGNOSTIC_REASON_MESSAGES[locale][copyReason];
+					if (templates === void 0) return serverCopy;
 					const providerNames = {
 						tailscale: "Tailscale Funnel",
 						cpolar: "cpolar",
@@ -5548,58 +6761,7 @@ window.__ModuleLoader__.load({
 							versions.minimumAndroidApp
 						].every((value) => typeof value === "string")) detail += ` plugin ${String(versions.plugin)}, DSH ${String(versions.dsh)}, Android ${String(versions.minimumAndroidApp)}.`;
 					}
-					if (reason === "remote-controller-error") {
-						const actionKey = {
-							...ORIGIN_ERROR_MESSAGE_KEYS,
-							component_missing: "remoteUnavailableTailscale",
-							funnel_permission_required: "funnelPermission",
-							funnel_https_required: "funnelHttps",
-							funnel_start_failed: "funnelStart",
-							funnel_start_timeout: "funnelTimeout",
-							tailscale_dns_missing: "tailscaleDnsMissing",
-							sidecar_launch_failed: "remoteUnavailableTailscale",
-							sidecar_stopped: "controlChannelFailed",
-							sidecar_exited: "controlChannelFailed",
-							control_channel_failed: "controlChannelFailed",
-							cpolar_component_missing: "cpolarMissing",
-							cpolar_component_invalid: "cpolarInvalid",
-							cpolar_config_missing: "cpolarConfigMissing",
-							cpolar_config_invalid: "cpolarConfigInvalid",
-							cpolar_start_timeout: "cpolarTimeout",
-							cpolar_stopped: "cpolarStopped",
-							cpolar_exited: "cpolarExited",
-							cloudflared_component_missing: "cloudflaredMissing",
-							cloudflared_component_invalid: "cloudflaredInvalid",
-							cloudflared_component_unsupported: "cloudflaredComponentUnsupported",
-							cloudflared_port_unavailable: "cloudflaredPortUnavailable",
-							cloudflared_port_reservation_failed: "cloudflaredPortReservationFailed",
-							cloudflared_launch_failed: "cloudflaredLaunchFailed",
-							cloudflared_start_timeout: "cloudflaredTimeout",
-							cloudflared_stopped: "cloudflaredStopped",
-							cloudflared_exited: "cloudflaredExited",
-							cloudflared_invalid_origin: "cloudflaredOriginInvalid",
-							cloudflared_tunnel_port_unavailable: "cloudflaredTunnelPortUnavailable",
-							cloudflared_tunnel_config_invalid: "cloudflaredTunnelInvalid",
-							cloudflared_tunnel_target_invalid: "cloudflaredTunnelTargetInvalid",
-							cloudflared_download_hash_mismatch: "cloudflaredDownloadHashMismatch",
-							cloudflared_download_size_mismatch: "cloudflaredDownloadSizeMismatch",
-							cloudflared_executable_hash_mismatch: "cloudflaredExecutableHashMismatch",
-							frp_component_missing: "frpMissing",
-							frp_component_invalid: "frpInvalid",
-							frp_config_missing: "frpConfigMissing",
-							frp_config_verify_failed: "frpConfigVerifyFailed",
-							frp_vhost_publicly_reachable: "frpVhostPublic",
-							frp_vhost_probe_failed: "frpVhostProbeFailed",
-							frp_launch_failed: "frpLaunchFailed",
-							frp_start_timeout: "frpTimeout",
-							frp_discovery_mismatch: "frpDiscoveryMismatch",
-							frp_discovery_invalid: "frpDiscoveryInvalid",
-							frp_stopped: "frpStopped",
-							frp_exited: "frpExited",
-							gateway_start_failed: "gatewayStartFailed"
-						}[values.controllerCode ?? ""];
-						if (actionKey !== void 0) action = t(actionKey);
-					}
+					if (reason === "remote-controller-error") action = diagnosticControllerAction(facts.controllerCode, locale, action);
 					return {
 						detail,
 						action
@@ -7033,7 +8195,7 @@ window.__ModuleLoader__.load({
    style rule of its own. */
 .dsh-mobile-control__cpolar-setup{margin:0 0 12px;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__cpolar-setup[hidden],.dsh-mobile-control__cpolar-account[hidden],.dsh-mobile-control__details[hidden],.dsh-mobile-control__view.is-remote .dsh-mobile-control__actions[hidden],.dsh-mobile-control__danger[hidden]{display:none}.dsh-mobile-control__component-status,.dsh-mobile-control__component-note{margin:0 0 10px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.55}.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__primary{width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:600 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__cpolar-account{margin-top:10px}.dsh-mobile-control__link-row{display:flex;flex-wrap:wrap;gap:6px 12px;margin:0 0 10px}.dsh-mobile-control__text-link{color:var(--dsw-alias-label-primary-bluish,#2563eb);font-size:11px;text-decoration:none}.dsh-mobile-control__text-link:hover{text-decoration:underline}.dsh-mobile-control__token-label{display:flex;flex-direction:column;gap:5px;margin:0 0 8px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__token{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-3,var(--dsw-alias-bg-layer-2,#fff));color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__cpolar-connect{display:flex;align-items:center;justify-content:center;box-sizing:border-box;width:100%;min-height:44px;padding:10px 14px;border-radius:12px;font:650 13px/1.2 system-ui;cursor:pointer;transition:background-color 160ms ease,border-color 160ms ease,opacity 160ms ease}.dsh-mobile-control__cpolar-connect:hover:not(:disabled){border-color:#1d4ed8;background:#1d4ed8}.dsh-mobile-control__cpolar-connect:active:not(:disabled){border-color:#1e40af;background:#1e40af}.dsh-mobile-control__cpolar-connect:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__details{margin:10px 0 0;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb);padding-top:9px}.dsh-mobile-control__details>summary{min-height:36px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:30px;cursor:pointer}.dsh-mobile-control__details-body{display:flex;flex-wrap:wrap;align-items:center;gap:7px 12px;padding:4px 0}.dsh-mobile-control__details-body p{flex:1 0 100%;margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__storage{display:block;flex:1 0 100%;max-width:100%;overflow:hidden;padding:7px 8px;border-radius:8px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-secondary,#475569);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__danger{flex:1 0 100%;min-height:44px;margin-top:3px;padding:7px 10px;border:1px solid var(--dsw-alias-state-error-primary,#dc2626);border-radius:9px;background:transparent;color:var(--dsw-alias-label-primary,#dc2626);font:12px/1.3 system-ui;cursor:pointer}
 .dsh-mobile-control__danger:hover:not(:disabled),.dsh-mobile-control__device-revoke:hover{background:var(--dsw-alias-interactive-bg-hover-danger,rgb(220 38 38 / 8%))}
-.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
+.dsh-mobile-control__frp-setup{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:13px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-setup[hidden]{display:none}.dsh-mobile-control__frp-step{padding:11px 0}.dsh-mobile-control__frp-step + .dsh-mobile-control__frp-step{border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}.dsh-mobile-control__frp-step>strong{display:block;margin-bottom:3px;font-size:12px;line-height:1.4}.dsh-mobile-control__frp-step>p{margin:0 0 9px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes{margin:0 0 9px;padding:0;list-style:none;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__frp-changes li{position:relative;margin:0;padding-left:12px}.dsh-mobile-control__frp-changes li+li{margin-top:5px}.dsh-mobile-control__frp-changes li::before{content:"•";position:absolute;left:2px;color:var(--dsw-alias-label-tertiary,#98a1ad)}.dsh-mobile-control__frp-step>.dsh-mobile-control__frp-requirement{padding:8px 9px;border-radius:9px;background:var(--dsw-alias-bg-layer-1,#f3f5f8);color:var(--dsw-alias-label-primary,#384152);font-size:11px}.dsh-mobile-control__frp-fields{display:grid;grid-template-columns:minmax(0,1fr) 96px;gap:8px}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(5),.dsh-mobile-control__frp-fields>.dsh-mobile-control__field:nth-child(6){grid-column:1/-1}.dsh-mobile-control__frp-fields>.dsh-mobile-control__field[hidden]{display:none}.dsh-mobile-control__frp-fields select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__frp-fields select:disabled{cursor:not-allowed;opacity:.55}.dsh-mobile-control__frp-hint{margin:0;color:var(--dsw-alias-label-secondary,#606873);font-size:11px;line-height:1.5}.dsh-mobile-control__field{display:flex;min-width:0;flex-direction:column;gap:5px;color:var(--dsw-alias-label-secondary,#606873);font-size:11px}.dsh-mobile-control__field:nth-child(3),.dsh-mobile-control__field:nth-child(4){grid-column:1/-1}.dsh-mobile-control__field input{box-sizing:border-box;width:100%;min-height:44px;padding:9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:16px/1.4 system-ui}.dsh-mobile-control__frp-action{box-sizing:border-box;width:100%;min-height:44px;padding:9px 12px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__frp-action:disabled{cursor:not-allowed;opacity:.5}.dsh-mobile-control__remote-workspace{margin:0;padding:12px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f7f8fa)}.dsh-mobile-control__stage-header{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-bottom:9px}.dsh-mobile-control__stage-header .dsh-mobile-control__section-title{margin:0}.dsh-mobile-control__stage-meta{display:flex;min-width:0;align-items:center;justify-content:flex-end;gap:5px}.dsh-mobile-control__stage-value{max-width:115px;overflow:hidden;color:var(--dsw-alias-label-primary,#16181d);font:650 11px/1.3 system-ui;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__state-badge{flex:none;padding:3px 7px;border-radius:999px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-secondary,#606873);font:650 11px/1.25 system-ui}.dsh-mobile-control__state-badge.is-ready{background:var(--dsw-alias-state-success-tertiary,#e6f7f0);color:var(--dsw-alias-label-primary,#087454)}.dsh-mobile-control__state-badge.is-busy{background:var(--dsw-alias-state-business-tertiary,#e8f0ff);color:var(--dsw-alias-label-primary,#1d4ed8)}.dsh-mobile-control__state-badge.is-attention{background:var(--dsw-alias-state-warn-tertiary,#fff4dc);color:var(--dsw-alias-label-primary,#935100)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__status{box-sizing:border-box;margin:0 0 10px;padding:9px 10px;border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);font-size:11px;line-height:1.45}.dsh-mobile-control__provider-setup-body{margin:0 0 10px}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup{margin:0}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__cpolar-setup>.dsh-mobile-control__section-title,.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__frp-setup>.dsh-mobile-control__section-title{display:none}.dsh-mobile-control__provider-setup-body>.dsh-mobile-control__details{margin:0;padding:9px 10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__actions{margin-top:2px}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__qr{margin:10px 0 0}.dsh-mobile-control__remote-workspace>.dsh-mobile-control__manage-row{margin-top:10px;padding-top:10px;border-top:1px solid var(--dsw-alias-border-l2,#e1e5eb)}
 .dsh-mobile-control__frp-overview{display:grid;grid-template-columns:32px minmax(0,1fr);align-items:center;gap:10px;margin:0 0 10px;padding:10px;border:1px solid var(--dsw-alias-state-success-primary,#a9dfc9);border-radius:11px;background:var(--dsw-alias-state-success-tertiary,#edf9f4)}.dsh-mobile-control__frp-overview[hidden]{display:none}.dsh-mobile-control__frp-overview-mark{display:grid;width:32px;height:32px;place-items:center;border-radius:50%;background:#087454;color:#fff;font:700 15px/1 system-ui}.dsh-mobile-control__frp-overview-body{display:flex;min-width:0;flex-direction:column;gap:2px}.dsh-mobile-control__frp-overview-body strong{color:var(--dsw-alias-label-primary,#075d46);font-size:12px;line-height:1.35}.dsh-mobile-control__frp-overview-body span{overflow:hidden;color:var(--dsw-alias-label-secondary,#357061);font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__frp-group{margin:8px 0 0;overflow:hidden;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__frp-group>summary{box-sizing:border-box;min-height:44px;padding:12px 34px 10px 12px;color:var(--dsw-alias-label-primary,#16181d);font:650 12px/1.4 system-ui;cursor:pointer}.dsh-mobile-control__frp-group[open]>summary{border-bottom:1px solid var(--dsw-alias-border-l2,#e1e5eb);background:var(--dsw-alias-bg-layer-2,#fff)}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step{padding:12px}.dsh-mobile-control__frp-group>.dsh-mobile-control__frp-step>strong:first-child{display:none}.dsh-mobile-control__frp-group .dsh-mobile-control__frp-step{border-top:0}.dsh-mobile-control__frp-setup>.dsh-mobile-control__frp-step{margin-bottom:8px;padding:10px;border:1px solid var(--dsw-alias-border-l2,#dbe1e8);border-radius:11px;background:var(--dsw-alias-bg-layer-1,#f8fafc)}.dsh-mobile-control__tunnel{margin:0 0 10px}.dsh-mobile-control__tunnel[hidden]{display:none}
 .dsh-mobile-control__lan-setup{box-sizing:border-box;margin:0 0 12px;padding:14px;border:1px solid #6f96db;border-radius:15px;background:var(--dsw-alias-bg-layer-1,#f5f8ff)}.dsh-mobile-control__lan-setup[hidden],.dsh-mobile-control__lan-setup-form[hidden]{display:none}.dsh-mobile-control__lan-setup>.dsh-mobile-control__section-title{margin-bottom:5px}.dsh-mobile-control__lan-setup>.dsh-mobile-control__intro{margin-bottom:12px}.dsh-mobile-control__lan-setup-form{display:grid;gap:9px}.dsh-mobile-control__lan-setup .dsh-mobile-control__field select{box-sizing:border-box;width:100%;min-height:44px;padding:9px 32px 9px 10px;border:1px solid var(--dsw-alias-border-l3,#cfd5dd);border-radius:10px;background:var(--dsw-alias-bg-layer-2,#fff);color:var(--dsw-alias-label-primary,#16181d);font:14px/1.4 system-ui}.dsh-mobile-control__lan-setup .dsh-mobile-control__component-note{margin:0}.dsh-mobile-control__lan-setup-actions{display:grid;grid-template-columns:1fr 1.35fr;gap:8px}.dsh-mobile-control__lan-setup-actions button{box-sizing:border-box;min-width:0;min-height:44px;padding:9px 10px;border-radius:10px;font:650 12px/1.3 system-ui;cursor:pointer}.dsh-mobile-control__lan-setup-actions button:disabled{cursor:wait;opacity:.55}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status{margin:10px 0 0;line-height:1.5}.dsh-mobile-control__lan-setup>.dsh-mobile-control__status:empty{display:none}
 .dsh-mobile-control__access{display:flex;align-items:baseline;gap:6px;min-width:0;margin:0 0 12px}.dsh-mobile-control__access[hidden]{display:none}.dsh-mobile-control__access-label{flex:none;color:var(--dsw-alias-label-secondary,#606873);white-space:nowrap}.dsh-mobile-control__access-label::after{content:"："}.dsh-mobile-control__access-link{min-width:0;overflow:hidden;color:var(--dsw-alias-label-primary-bluish,#2563eb);text-decoration:none;text-overflow:ellipsis;white-space:nowrap}.dsh-mobile-control__access-link:hover{text-decoration:underline}.dsh-mobile-control__qr{display:flex;justify-content:center;margin:0 0 12px}.dsh-mobile-control__qr[hidden]{display:none}.dsh-mobile-control__qr img{border-radius:12px;background:#fff;padding:8px}
@@ -7068,11 +8230,22 @@ window.__ModuleLoader__.load({
 				style.textContent = desktopAdmin ? CONTROL_STYLES : NATIVE_MOBILE_STYLES;
 				document.head.append(style);
 				if (!desktopAdmin) {
-					const removeSettingsAction = ctx.slots.inject("settings.general.item", () => ctx.slots.register({
-						name: "settings.general.item",
-						id: "dsh-mobile-switch-computer",
-						order: 100
-					}, MobileSwitchComputerRow));
+					const removeSettingsAction = ctx.slots.inject("settings.general.item", () => {
+						const removeSwitchComputer = ctx.slots.register({
+							name: "settings.general.item",
+							id: "dsh-mobile-switch-computer",
+							order: 100
+						}, MobileSwitchComputerRow);
+						const removeTaskNotifications = ctx.slots.register({
+							name: "settings.general.item",
+							id: "dsh-mobile-task-notifications",
+							order: 110
+						}, MobileTaskNotificationRow);
+						return () => {
+							removeTaskNotifications();
+							removeSwitchComputer();
+						};
+					});
 					const removeCustom = installCustomAssets();
 					const removeSurface = installDshLanguageBoundSurface(installNativeMobileSurface);
 					return () => {
@@ -7141,7 +8314,10 @@ window.__ModuleLoader__.load({
 		exports.clientReleaseInfo = clientReleaseInfo;
 		exports.combineClientSignalLifetime = combineClientSignalLifetime;
 		exports.combineClientSignals = combineClientSignals;
+		exports.createFrpAttachFrpcTomlForClipboard = createFrpAttachFrpcTomlForClipboard;
+		exports.createFrpAttachTemplateForClipboard = createFrpAttachTemplateForClipboard;
 		exports.createFrpServerTemplateForClipboard = createFrpServerTemplateForClipboard;
+		exports.diagnosticControllerAction = diagnosticControllerAction;
 		exports.diagnosticEntriesForRender = diagnosticEntriesForRender;
 		exports.diagnosticOverallForChecks = diagnosticOverallForChecks;
 		exports.diagnosticServerCopy = diagnosticServerCopy;
@@ -7150,6 +8326,7 @@ window.__ModuleLoader__.load({
 		exports.extensionGenerationHeaders = extensionGenerationHeaders;
 		exports.extensionRouteUrl = extensionRouteUrl;
 		exports.failClosedExtensionGenerationReplacement = failClosedExtensionGenerationReplacement;
+		exports.frpAttachFormErrorCode = frpAttachFormErrorCode;
 		exports.handleMissingExtensionManifest = handleMissingExtensionManifest;
 		exports.inject = inject;
 		exports.installDshLanguageBoundSurface = installDshLanguageBoundSurface;