dsh-mobile 0.4.5 → 0.4.7

package/lib/index.mjs

@@ -1,26 +1,27 @@
 import { createRequire } from "node:module";
 import { X509Certificate, createHash, createPrivateKey, createPublicKey, randomBytes, timingSafeEqual } from "node:crypto";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, relative, resolve, win32 } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import z from "@deepseek-ai/schemastery";
-import { connect, createServer, isIP } from "node:net";
-import { chmod, copyFile, lstat, mkdir, mkdtemp, opendir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { connect, createServer } from "node:net";
+import { chmod, copyFile, lstat, mkdir, mkdtemp, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
 import { createServer as createServer$1, request } from "node:http";
-import { createServer as createServer$2 } from "node:https";
-import { Transform, finished } from "node:stream";
+import { createServer as createServer$2, request as request$1 } from "node:https";
+import { Readable, Transform, finished } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { promisify } from "node:util";
 import { createGzip, gzip } from "node:zlib";
 import Bonjour from "bonjour-service";
 import * as QRCode from "qrcode";
 import { Logger, Service } from "@deepseek-ai/cordis";
+import { connect as connect$1 } from "node:tls";
+import { generate } from "selfsigned";
 import { boundContextSummary, createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { lookup } from "node:dns/promises";
 import { createWriteStream } from "node:fs";
-import { generate } from "selfsigned";
 //#region src/access.ts
 /** Stable error categories converted to deliberately terse HTTP responses. */
 var AccessError = class extends Error {
@@ -384,6 +385,88 @@ var AccessController = class {
 	}
 };
 //#endregion
+//#region src/ip.ts
+/**
+* Browser-safe IP literal classification.
+*
+* `node:net` cannot be imported from the browser Client face, so the pure
+* predicate lives here instead. Semantics are deliberately identical to
+* `net.isIP`: strict dotted-quad IPv4 (no leading zeros, no signs, no
+* whitespace), IPv6 with at most one `::`, at most four hex digits per group,
+* an optional dotted-quad tail in the final position, and an optional
+* non-empty zone id after a single `%`.
+*
+* This module is dependency-free and side-effect-free on purpose: it is the
+* single classification source shared by every face of the plugin — the Node
+* side (`config.ts`, `cloudflared-tunnel.ts`, `origin-proxy-config.ts`,
+* `vps-deploy.ts`, `gateway.ts`, `network.ts`, `frp-config.ts`) and the browser
+* Client face that cannot reach `node:net` — so both classify a given literal
+* identically. Callers rely on the strict reading above and never post-process
+* the literal afterwards, so changing the accept/reject boundary here changes
+* it everywhere, which is the intended contract.
+*/
+/** Strict dotted-quad IPv4: POSIX `inet_pton` rules, so `01.1.1.1` is rejected. */
+function isStrictIpv4(value) {
+	const parts = value.split(".");
+	if (parts.length !== 4) return false;
+	for (const part of parts) {
+		if (!/^(?:0|[1-9][0-9]{0,2})$/u.test(part)) return false;
+		if (Number(part) > 255) return false;
+	}
+	return true;
+}
+/**
+* Count the 16-bit groups one side of an IPv6 address occupies.
+*
+* A dotted-quad tail counts as two groups and is accepted only where the caller
+* allows it — that is, only in the final label of the whole address.
+*
+* @returns the group count, or `-1` when any label is malformed.
+*/
+function countIpv6Groups(labels, allowDottedQuad) {
+	let groups = 0;
+	for (let index = 0; index < labels.length; index += 1) {
+		const label = labels[index];
+		if (label.includes(".")) {
+			if (index !== labels.length - 1 || !allowDottedQuad || !isStrictIpv4(label)) return -1;
+			groups += 2;
+			continue;
+		}
+		if (!/^[\da-f]{1,4}$/iu.test(label)) return -1;
+		groups += 1;
+	}
+	return groups;
+}
+/**
+* Classify an IP literal.
+*
+* @param value - candidate address; non-strings are never an IP.
+* @returns `4` for IPv4, `6` for IPv6, `0` when the value is neither.
+*/
+function isIP(value) {
+	if (typeof value !== "string") return 0;
+	if (isStrictIpv4(value)) return 4;
+	let text = value;
+	const zone = text.indexOf("%");
+	if (zone !== -1) {
+		const suffix = text.slice(zone + 1);
+		if (suffix.length === 0 || suffix.includes("%")) return 0;
+		text = text.slice(0, zone);
+	}
+	if (text.length === 0) return 0;
+	const halves = text.split("::");
+	if (halves.length > 2) return 0;
+	if (halves.length === 1) return countIpv6Groups(text.split(":"), true) === 8 ? 6 : 0;
+	const leftText = halves[0];
+	const rightText = halves[1];
+	const left = leftText === "" ? [] : leftText.split(":");
+	const right = rightText === "" ? [] : rightText.split(":");
+	const leftGroups = countIpv6Groups(left, false);
+	const rightGroups = countIpv6Groups(right, right.length > 0);
+	if (leftGroups < 0 || rightGroups < 0) return 0;
+	return leftGroups + rightGroups >= 8 ? 0 : 6;
+}
+//#endregion
 //#region src/network.ts
 function parseIpv4$1(address) {
 	const parts = address.split(".");
@@ -624,6 +707,43 @@ var RequestTrustPolicy = class {
 		return normalized;
 	}
 };
+/**
+* Open a plain TCP connection only to learn whether something is listening.
+*
+* Used by the on-demand self-check so the panel can tell "frps is up" from
+* "frps is not listening". A transparent proxy can acknowledge any connect, so
+* this result is advisory and never authorises a security decision on its own.
+*/
+async function probeTcpReachable(host, port, timeoutMs = 1500) {
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return false;
+	return new Promise((resolveProbe) => {
+		let finished = false;
+		const socket = connect({
+			host,
+			port
+		});
+		const finish = (reachable) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			socket.destroy();
+			resolveProbe(reachable);
+		};
+		const timer = setTimeout(() => {
+			finish(false);
+		}, timeoutMs);
+		timer.unref();
+		socket.once("connect", () => {
+			finish(true);
+		});
+		socket.once("error", () => {
+			finish(false);
+		});
+		socket.once("close", () => {
+			finish(false);
+		});
+	});
+}
 //#endregion
 //#region src/config.ts
 /** Loader-facing defaults; {@link parseGatewayConfig} enforces cross-field security rules. */
@@ -641,6 +761,7 @@ const Config = z.object({
 	customScriptFile: z.string().hidden(),
 	mobileLayoutFile: z.string().hidden(),
 	mobileCompatibilityFile: z.string().hidden(),
+	excludedClientModules: z.array(String).default([]),
 	instanceId: z.string().hidden(),
 	pairingCaFile: z.string().hidden(),
 	initiallyEnabled: z.boolean().hidden().required(),
@@ -677,6 +798,13 @@ function absoluteFile(value, name) {
 	if (typeof value !== "string" || value.length === 0 || !isAbsolute(value)) throw new Error(`${name} must be an absolute file path`);
 	return resolve(value);
 }
+function excludedClientModules(value) {
+	if (value === void 0) return Object.freeze([]);
+	if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.length === 0 || id.trim() !== id)) throw new Error("excludedClientModules must be an array of exact, non-empty client module ids");
+	const ids = value;
+	if (new Set(ids).size !== ids.length) throw new Error("excludedClientModules must not contain duplicate ids");
+	return Object.freeze([...ids]);
+}
 /** Resolve the hidden runtime-control file independently from gateway configuration. */
 function parseControlFile(value) {
 	return absoluteFile(value, "controlFile");
@@ -767,6 +895,7 @@ function parseGatewayConfig(raw) {
 		customScriptFile: value.customScriptFile === void 0 ? join(dirname(absoluteFile(value.stateFile, "stateFile")), "mobile.js") : absoluteFile(value.customScriptFile, "customScriptFile"),
 		mobileLayoutFile: value.mobileLayoutFile === void 0 ? fileURLToPath(new URL("./mobile-layout.js", import.meta.url)) : absoluteFile(value.mobileLayoutFile, "mobileLayoutFile"),
 		mobileCompatibilityFile: value.mobileCompatibilityFile === void 0 ? fileURLToPath(new URL("./mobile-compat.js", import.meta.url)) : absoluteFile(value.mobileCompatibilityFile, "mobileCompatibilityFile"),
+		excludedClientModules: excludedClientModules(value.excludedClientModules),
 		instanceId: value.instanceId === void 0 ? createHash("sha256").update(absoluteFile(value.stateFile, "stateFile")).digest("hex") : /^[a-f\d]{64}$/u.test(value.instanceId) ? value.instanceId : (() => {
 			throw new Error("instanceId must be a lowercase SHA-256 value");
 		})(),
@@ -817,8 +946,13 @@ function execFileText(file, args, options = {}) {
 //#endregion
 //#region src/private-file.ts
 let userSidTask;
+function windowsSystemTool(name) {
+	const systemRoot = process.env.SystemRoot ?? process.env.WINDIR;
+	if (systemRoot === void 0 || !win32.isAbsolute(systemRoot)) throw new Error("Windows system root is unavailable");
+	return win32.join(systemRoot, "System32", name);
+}
 async function currentWindowsUserSid() {
-	userSidTask ??= execFileText("whoami.exe", [
+	userSidTask ??= execFileText(windowsSystemTool("whoami.exe"), [
 		"/user",
 		"/fo",
 		"csv",
@@ -841,11 +975,12 @@ async function currentWindowsUserSid() {
 async function restrictPrivateFile(file, mode = 384) {
 	await chmod(file, mode);
 	if (process.platform !== "win32") return;
-	await execFileText("icacls.exe", [
+	const userSid = await currentWindowsUserSid();
+	await execFileText(windowsSystemTool("icacls.exe"), [
 		file,
 		"/inheritance:r",
 		"/grant:r",
-		`*${await currentWindowsUserSid()}:(F)`,
+		`*${userSid}:(F)`,
 		"*S-1-5-18:(F)",
 		"*S-1-5-32-544:(F)",
 		"/remove:g",
@@ -2488,6 +2623,17 @@ const SIDEBAR_MODULE = "@deepseek-ai/dsh-client-ui-sidebar";
 const SETTINGS_MODULE = "@deepseek-ai/dsh-client-ui-settings";
 const API_GATEWAY_MODULE = "@deepseek-ai/dsh-api-gateway";
 const API_REMOTES_MODULE = "@deepseek-ai/dsh-api-remotes";
+const MOBILE_BOOT_CORE_MODULES = /* @__PURE__ */ new Set([
+	MOBILE_CLIENT_MODULE,
+	MOBILE_LAYOUT_MODULE,
+	CONNECTION_MODULE,
+	RUNTIME_MODULE,
+	RENDERER_MODULE,
+	SIDEBAR_MODULE,
+	SETTINGS_MODULE,
+	API_GATEWAY_MODULE,
+	API_REMOTES_MODULE
+]);
 const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 	slots: RUNTIME_MODULE,
 	dependencies: Object.freeze([RUNTIME_MODULE, "@deepseek-ai/dsh-client-ui-theme"])
@@ -2502,6 +2648,57 @@ const MOBILE_LAYOUT_DEPENDENCY_PROFILES = Object.freeze([Object.freeze({
 })]);
 const MOBILE_CSRF_FETCH_BOOTSTRAP = `(()=>{const nativeFetch=window.fetch.bind(window);window.fetch=(input,init)=>{const source=input instanceof Request?input:undefined;const method=String(init?.method??source?.method??'GET').toUpperCase();if(method==='GET'||method==='HEAD')return nativeFetch(input,init);const raw=typeof input==='string'?input:input instanceof URL?input.href:source?.url;if(raw===undefined||new URL(raw,location.href).origin!==location.origin)return nativeFetch(input,init);const headers=new Headers(init?.headers??source?.headers);if(!headers.has(${JSON.stringify(CSRF_HEADER)})){const prefix=${JSON.stringify(`${CSRF_COOKIE}=`)};const token=document.cookie.split(';').map(value=>value.trim()).find(value=>value.startsWith(prefix))?.slice(prefix.length);if(token!==undefined)headers.set(${JSON.stringify(CSRF_HEADER)},token)}return nativeFetch(input,{...init,headers})};})();`;
 const MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP = `(()=>{if(window.__DSH_TRANSPORT__!==undefined)throw new Error('DSH Mobile cannot replace an existing transport override');window.__DSH_TRANSPORT__={fetch:(input,init)=>window.fetch(input,init),ownsHost:true}})();`;
+/** Use this page's gateway health, rather than OS internet validation, for DSH reconnects. */
+const MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP = `(()=>{
+  const view=globalThis;
+  const port=view.navigator;
+  const nativeFetch=typeof view.fetch==='function'?view.fetch.bind(view):undefined;
+  let reachable=true;
+  let checking=false;
+  let replaying=false;
+  let disposed=false;
+  let epoch=0;
+  let retryTimer;
+  let activeController;
+  const clearRetry=()=>{if(retryTimer!==undefined){view.clearTimeout(retryTimer);retryTimer=undefined}};
+  const scheduleRetry=()=>{if(!disposed&&!reachable&&retryTimer===undefined){retryTimer=view.setTimeout(()=>{retryTimer=undefined;check()},5000)}};
+  const check=()=>{
+    if(checking||disposed||nativeFetch===undefined)return;
+    checking=true;
+    const current=++epoch;
+    const controller=new AbortController();
+    activeController=controller;
+    const timer=view.setTimeout(()=>controller.abort(),2000);
+    void nativeFetch('/mobile-access/health',{cache:'no-store',credentials:'same-origin',signal:controller.signal})
+      .then(response=>response.ok,()=>false)
+      .then(ok=>{
+        if(disposed||current!==epoch)return;
+        if(ok){
+          const wasOffline=!reachable;
+          reachable=true;
+          clearRetry();
+          if(wasOffline)view.dispatchEvent(new Event('online'));
+          return;
+        }
+        const wasOnline=reachable;
+        reachable=false;
+        if(wasOnline){
+          replaying=true;
+          try{view.dispatchEvent(new Event('offline'))}finally{replaying=false}
+        }
+        scheduleRetry();
+      })
+      .finally(()=>{view.clearTimeout(timer);activeController=undefined;checking=false});
+  };
+  if(port!==undefined&&typeof Object.defineProperty==='function'){
+    try{Object.defineProperty(port,'onLine',{configurable:true,get:()=>reachable})}catch{/* A frozen navigator retains its native value. */}
+  }
+  if(typeof view.addEventListener==='function'){
+    view.addEventListener('offline',event=>{if(replaying||nativeFetch===undefined)return;event.stopImmediatePropagation();check()},true);
+    view.addEventListener('online',()=>{++epoch;reachable=true;clearRetry()},true);
+    view.addEventListener('pagehide',()=>{disposed=true;++epoch;clearRetry();activeController?.abort()},true);
+  }
+})();`;
 const gzipBuffer = promisify(gzip);
 function ensureMobileViewport(html) {
 	const match = /<meta\b(?=[^>]*\bname\s*=\s*["']viewport["'])[^>]*>/iu.exec(html);
@@ -2542,13 +2739,49 @@ function revisionedMobileBatchPath(entries) {
 		path: `${MOBILE_BOOT_BATCH_PREFIX}${key}.js`
 	};
 }
+var ExcludedClientModulesError = class extends Error {
+	constructor(message) {
+		super(`excludedClientModules: ${message}`);
+	}
+};
+/** Validate graph edges before removing application rows from both manifest views. */
+function excludeMobileBootEntries(entries, batches, excludedIds) {
+	if (excludedIds.length === 0) return;
+	const excluded = new Set(excludedIds);
+	if (excluded.size !== excludedIds.length) throw new ExcludedClientModulesError("duplicate module ids");
+	const byId = new Map(entries.map((entry) => [entry.id, entry]));
+	const phases = /* @__PURE__ */ new Map();
+	for (const batch of batches) for (const id of batch.entries) {
+		if (phases.has(id)) throw new ExcludedClientModulesError(`upstream module ${id} belongs to multiple batches`);
+		phases.set(id, batch.phase);
+	}
+	for (const entry of entries) if (!phases.has(entry.id)) throw new ExcludedClientModulesError(`upstream module ${entry.id} belongs to no batch`);
+	for (const id of excluded) {
+		const entry = byId.get(id);
+		if (entry === void 0) throw new ExcludedClientModulesError(`module ${id} is not installed in this DSH client graph`);
+		if (MOBILE_BOOT_CORE_MODULES.has(id) || entry.immediately === true || phases.get(id) !== "application") throw new ExcludedClientModulesError(`module ${id} is required for mobile boot or belongs to a bootstrap batch`);
+	}
+	for (const entry of entries) {
+		if (excluded.has(entry.id)) continue;
+		for (const [field, edges] of [["inject", entry.inject], ["external", entry.external]]) {
+			if (edges !== void 0 && (!Array.isArray(edges) || edges.some((id) => typeof id !== "string"))) throw new ExcludedClientModulesError(`upstream module ${entry.id} has malformed ${field} dependencies`);
+			for (const dependency of edges ?? []) {
+				const packageId = dependency.endsWith("/client") ? dependency.slice(0, -7) : dependency;
+				if (excluded.has(packageId)) throw new ExcludedClientModulesError(`module ${entry.id} still depends on excluded module ${packageId}; exclude the dependent too or keep ${packageId}`);
+			}
+		}
+	}
+	entries.splice(0, entries.length, ...entries.filter((entry) => !excluded.has(entry.id)));
+	for (const batch of batches) batch.entries = batch.entries.filter((id) => !excluded.has(id));
+	batches.splice(0, batches.length, ...batches.filter((batch) => batch.entries.length > 0));
+}
 /**
 * Parse one upstream boot manifest and rewire the layout entry onto the
-* gateway-owned layout module. The layout entry's URL and revision become the
-* local `mobile-layout.js` path; the dedicated frontend is authenticated in the
-* gateway, so the requested layout needs no upstream address.
+* gateway-owned layout module. Optional exclusions remove application entries
+* and identify every affected batch for reassembly. The dedicated frontend is
+* authenticated in the gateway, so the layout needs no upstream address.
 */
-function parseMobileBootPlan(html) {
+function parseMobileBootPlan(html, excludedClientModules = []) {
 	const assignment = /(?:window\.__DSH_BOOT__|globalThis\["__DSH_BOOT__"\])\s*=\s*/u.exec(html);
 	if (assignment?.index === void 0) throw new Error("upstream DSH index has no boot manifest");
 	const replaceStart = assignment.index;
@@ -2567,14 +2800,17 @@ function parseMobileBootPlan(html) {
 	layout[0].url = MOBILE_LAYOUT_PATH;
 	layout[0].rev = `dsh-mobile-layout-${DSH_MOBILE_VERSION}`;
 	const parsedBatches = parsed.batches;
-	if (parsedBatches === void 0) return Object.freeze({
-		parsed,
-		entries,
-		slotProvider: dependencyProfile.slots,
-		assignment: assignment[0],
-		replaceStart,
-		replaceEnd: scriptEnd
-	});
+	if (parsedBatches === void 0) {
+		if (excludedClientModules.length > 0) throw new ExcludedClientModulesError("this DSH version has no batched boot manifest; disable exclusions or update DSH");
+		return Object.freeze({
+			parsed,
+			entries,
+			slotProvider: dependencyProfile.slots,
+			assignment: assignment[0],
+			replaceStart,
+			replaceEnd: scriptEnd
+		});
+	}
 	if (!Array.isArray(parsedBatches)) throw new Error("upstream DSH boot manifest batches are malformed");
 	const batches = parsedBatches;
 	const entryById = new Map(entries.map((entry) => [entry.id, entry]));
@@ -2586,15 +2822,26 @@ function parseMobileBootPlan(html) {
 	}
 	if (layoutBatches.length !== 1 || layoutBatches[0]?.phase !== "application") throw new Error("upstream DSH boot manifest has no unique application layout batch");
 	const layoutBatch = layoutBatches[0];
-	const planEntries = layoutBatch.entries.map((id) => {
-		const entry = entryById.get(id);
-		if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
-		return Object.freeze({
-			id,
-			url: entry.url,
-			rev: entry.rev
-		});
-	});
+	const originalApplicationBatches = batches.filter((batch) => batch.phase === "application").map((batch) => ({
+		...batch,
+		entries: [...batch.entries]
+	}));
+	excludeMobileBootEntries(entries, batches, excludedClientModules);
+	const affectedBatchUrls = new Set(originalApplicationBatches.filter((batch) => batch.entries.some((id) => excludedClientModules.includes(id))).map((batch) => batch.url));
+	const rewrittenBatchEntries = batches.filter((batch) => batch === layoutBatch || batch.phase === "application" && affectedBatchUrls.has(batch.url)).map((batch) => ({
+		batch,
+		entries: [...batch.entries].sort((left, right) => left < right ? -1 : left > right ? 1 : 0).map((id) => {
+			const entry = entryById.get(id);
+			if (entry === void 0 || typeof entry.url !== "string" || typeof entry.rev !== "string") throw new Error("upstream DSH boot manifest batches are malformed");
+			return Object.freeze({
+				id,
+				url: entry.url,
+				rev: entry.rev
+			});
+		})
+	}));
+	const planEntries = rewrittenBatchEntries.find((candidate) => candidate.batch === layoutBatch)?.entries;
+	if (planEntries === void 0) throw new Error("upstream DSH boot manifest lost the application layout batch");
 	return Object.freeze({
 		parsed,
 		entries,
@@ -2604,7 +2851,9 @@ function parseMobileBootPlan(html) {
 		replaceStart,
 		replaceEnd: scriptEnd,
 		layoutBatch,
-		planEntries
+		planEntries,
+		originalApplicationBatches,
+		rewrittenBatchEntries
 	});
 }
 /**
@@ -2663,30 +2912,62 @@ function splitMobileBootBatch(entries, sizes, passThrough) {
 		rows
 	};
 }
+function escapeMobilePreloadAttribute(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("\"", "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function mobileApplicationPreload(url) {
+	return `<link rel="preload" as="script" href="${escapeMobilePreloadAttribute(url)}">`;
+}
+function preloadAttribute(tag, name) {
+	const match = new RegExp(`(?:^|\\s)${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, "iu").exec(tag);
+	return match?.[1] ?? match?.[2];
+}
+/** Replace only DSH's application-script preloads; bootstrap and unrelated links are untouched. */
+function rewriteMobileApplicationPreloads(html, replacements) {
+	if (replacements.size === 0) return html;
+	const escaped = new Map([...replacements].map(([url, markup]) => [escapeMobilePreloadAttribute(url), markup]));
+	return html.replace(/<link\b[^>]*>/giu, (tag) => {
+		if (!preloadAttribute(tag, "rel")?.split(/\s+/u).includes("preload") || preloadAttribute(tag, "as") !== "script") return tag;
+		return escaped.get(preloadAttribute(tag, "href") ?? "") ?? tag;
+	});
+}
 function rewriteMobileIndexWithBatch(html, options = {}) {
-	const plan = parseMobileBootPlan(html);
+	const plan = parseMobileBootPlan(html, options.excludedClientModules);
 	const remoteSettings = orderAuthenticatedSettings(plan.entries, plan.slotProvider);
 	let batches = [];
-	if (plan.batches !== void 0 && plan.layoutBatch !== void 0 && plan.planEntries !== void 0) {
-		const split = splitMobileBootBatch(plan.planEntries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set());
-		const at = plan.batches.indexOf(plan.layoutBatch);
-		if (at < 0) throw new Error("upstream DSH boot manifest has no unique application layout batch");
-		plan.batches.splice(at, 1, ...split.rows);
-		batches = Object.freeze(split.plans);
+	let preloadReplacements = /* @__PURE__ */ new Map();
+	if (plan.batches !== void 0 && plan.rewrittenBatchEntries !== void 0) {
+		const rewrites = plan.rewrittenBatchEntries.map(({ batch, entries }) => ({
+			batch,
+			split: splitMobileBootBatch(entries, options.sizes ?? /* @__PURE__ */ new Map(), options.passThrough ?? /* @__PURE__ */ new Set())
+		}));
+		if (rewrites.reduce((count, item) => count + item.split.plans.length, 0) > MAX_MOBILE_BOOT_BATCHES) throw new Error(`upstream DSH mobile boot requires more than ${String(MAX_MOBILE_BOOT_BATCHES)} merged batches`);
+		for (const { batch, split } of rewrites) {
+			const at = plan.batches.indexOf(batch);
+			if (at < 0) throw new Error("upstream DSH boot manifest lost an application batch");
+			plan.batches.splice(at, 1, ...split.rows);
+			batches = [...batches, ...split.plans];
+		}
+		for (const original of plan.originalApplicationBatches ?? []) {
+			const replacement = rewrites.find((item) => item.batch.url === original.url);
+			preloadReplacements.set(original.url, replacement === void 0 ? plan.batches.some((batch) => batch.url === original.url) ? mobileApplicationPreload(original.url) : "" : replacement.split.rows.map((row) => mobileApplicationPreload(row.url)).join(""));
+		}
+		batches = Object.freeze(batches);
 		plan.parsed.rev = createHash("sha256").update(JSON.stringify({
 			entries: plan.entries,
 			batches: plan.batches
 		})).digest("hex").slice(0, 16);
 	}
-	const replacement = `${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const replacement = `${MOBILE_GATEWAY_REACHABILITY_BOOTSTRAP}${remoteSettings ? MOBILE_AUTHENTICATED_TRANSPORT_BOOTSTRAP : ""}${MOBILE_CSRF_FETCH_BOOTSTRAP}window.__DSH_MOBILE_FRONTEND__="dedicated";${plan.assignment}${JSON.stringify(plan.parsed)};`;
+	const rewritten = `${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`;
 	return Object.freeze({
-		html: ensureMobileViewport(ensureMobileCompatibility(`${html.slice(0, plan.replaceStart)}${replacement}${html.slice(plan.replaceEnd)}`)),
+		html: ensureMobileViewport(ensureMobileCompatibility(rewriteMobileApplicationPreloads(rewritten, preloadReplacements))),
 		batches
 	});
 }
-/** Replace only DSH's layout client module while retaining its complete plugin graph. */
-function rewriteMobileIndex(html) {
-	return rewriteMobileIndexWithBatch(html).html;
+/** Rewrite the dedicated mobile graph; exclusions are opt-in and leave stock DSH unchanged. */
+function rewriteMobileIndex(html, excludedClientModules = []) {
+	return rewriteMobileIndexWithBatch(html, { excludedClientModules }).html;
 }
 var ByteLimitTransform = class extends Transform {
 	maximum;
@@ -3130,6 +3411,7 @@ var MobileAccessGateway = class {
 	mdnsError;
 	/** Names of the bundled mobile assets that could not be read, if any. */
 	mobileAssetError;
+	lastModuleExclusionError;
 	bonjour;
 	pairingCaCertificate;
 	listenerPort;
@@ -3277,6 +3559,15 @@ var MobileAccessGateway = class {
 			throw error;
 		}
 	}
+	/** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
+	async refreshProvidedTls() {
+		if (!this.listenerTlsEnabled || this.config.tls.mode !== "provided") throw new Error("gateway does not terminate provided TLS");
+		const server = this.server;
+		if (server === void 0 || !this.started || this.closing) throw new Error("gateway is not running");
+		const options = await tlsOptions(this.config);
+		if (this.server !== server || this.closing) throw new Error("gateway is not running");
+		server.setSecureContext(options);
+	}
 	async startDiscovery(port) {
 		const socket = createSocket("udp4");
 		this.discoverySocket = socket;
@@ -4052,11 +4343,11 @@ var MobileAccessGateway = class {
 			this.upstreamAuthRequest = void 0;
 		}
 	}
-	async proxyMobileIndex(request$1, response, authorization) {
+	async proxyMobileIndex(request$2, response, authorization) {
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
 		try {
-			const upstreamHeaders = sanitizeRequestHeaders(request$1, this.config.upstreamOrigin);
+			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
 			const upstreamCookie = await this.upstreamCookieHeader();
 			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
 			upstreamHeaders["accept-encoding"] = "identity";
@@ -4090,11 +4381,26 @@ var MobileAccessGateway = class {
 			let body;
 			try {
 				const html = Buffer.concat(chunks).toString("utf8");
-				const plan = parseMobileBootPlan(html);
-				const rewritten = rewriteMobileIndexWithBatch(html, plan.planEntries === void 0 ? {} : await this.resolveMobileBootSizes(plan.planEntries));
+				const plan = parseMobileBootPlan(html, this.config.excludedClientModules);
+				const rewritten = rewriteMobileIndexWithBatch(html, plan.rewrittenBatchEntries === void 0 ? { excludedClientModules: this.config.excludedClientModules } : {
+					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries)),
+					excludedClientModules: this.config.excludedClientModules
+				});
 				for (const batch of rewritten.batches) this.rememberMobileBootBatch(batch);
 				body = Buffer.from(rewritten.html);
-			} catch {
+			} catch (error) {
+				if (error instanceof ExcludedClientModulesError) {
+					const detail = error.message.replace(/[\r\n]/gu, " ").slice(0, 512);
+					if (detail !== this.lastModuleExclusionError) {
+						this.lastModuleExclusionError = detail;
+						process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
+					}
+					sendJson(response, 409, {
+						error: "excluded_client_modules_invalid",
+						detail
+					}, this.tlsEnabled);
+					return;
+				}
 				throw new HttpError(502, "upstream_unavailable");
 			}
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
@@ -4440,15 +4746,15 @@ var MobileAccessGateway = class {
 		}
 		throw new HttpError(502, "upstream_unavailable");
 	}
-	async proxyHttpOnce(request$2, response, authorization) {
-		const declared = request$2.headers["content-length"];
+	async proxyHttpOnce(request$3, response, authorization) {
+		const declared = request$3.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
 		let bodyDone;
 		try {
-			const bufferedBody = request$2.method === "POST" && request$2.url?.split("?", 1)[0] === SESSION_HISTORY_PATH ? mobileHistoryRequestBody(request$2, await readBoundedBody(request$2, this.config.maxBodyBytes)) : void 0;
-			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			const bufferedBody = request$3.method === "POST" && request$3.url?.split("?", 1)[0] === SESSION_HISTORY_PATH ? mobileHistoryRequestBody(request$3, await readBoundedBody(request$3, this.config.maxBodyBytes)) : void 0;
+			const upstreamHeaders = sanitizeRequestHeaders(request$3, this.config.upstreamOrigin);
 			const upstreamCookie = await this.upstreamCookieHeader();
 			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
 			if (bufferedBody !== void 0) upstreamHeaders["content-length"] = String(bufferedBody.byteLength);
@@ -4457,8 +4763,8 @@ var MobileAccessGateway = class {
 					protocol: "http:",
 					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 					port: Number(this.config.upstreamOrigin.port),
-					method: request$2.method,
-					path: request$2.url,
+					method: request$3.method,
+					path: request$3.url,
 					headers: upstreamHeaders,
 					agent: false
 				});
@@ -4468,7 +4774,7 @@ var MobileAccessGateway = class {
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
-				if (bufferedBody === void 0) bodyDone = pipeline(request$2, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+				if (bufferedBody === void 0) bodyDone = pipeline(request$3, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
 				else {
 					upstreamRequest.end(bufferedBody);
 					bodyDone = Promise.resolve();
@@ -4478,9 +4784,9 @@ var MobileAccessGateway = class {
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
 			const statusCode = proxied.statusCode ?? 502;
-			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
+			const cacheControl = revisionedStaticCacheControl(request$3, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
-			const compressed = shouldCompressResponse(request$2, proxied);
+			const compressed = shouldCompressResponse(request$3, proxied);
 			if (compressed) {
 				delete headers["accept-ranges"];
 				delete headers["content-length"];
@@ -4810,7 +5116,10 @@ var MobileAccessGateway = class {
 						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 						if (body.ttlMs !== void 0 && typeof body.ttlMs !== "number") throw new HttpError(400, "bad_request");
 						const opened = await this.access.openPairing(body.ttlMs);
-						const pairUrl = `${this.address().origin}/mobile-access/pair#instance=${this.config.instanceId}&token=${opened.token}`;
+						const requiresRemoteCa = this.config.pairingCaFile !== void 0 && !this.config.discovery;
+						const appKey = `dsh${requiresRemoteCa ? "2" : "1"}.${this.config.instanceId}.${opened.token}`;
+						const fragment = requiresRemoteCa ? `key=${appKey}` : `instance=${this.config.instanceId}&token=${opened.token}`;
+						const pairUrl = `${this.address().origin}/mobile-access/pair#${fragment}`;
 						const appPairUrl = pairUrl;
 						let qrSvg = "";
 						try {
@@ -4821,7 +5130,7 @@ var MobileAccessGateway = class {
 						} catch {}
 						sendJson(response, 201, {
 							...opened,
-							appKey: `dsh1.${this.config.instanceId}.${opened.token}`,
+							appKey,
 							pairUrl,
 							appPairUrl,
 							qrSvg
@@ -5486,8 +5795,6 @@ const FRP_CADDY_SNIPPET_PATH = "/etc/caddy/dsh-mobile-dsh.caddy";
 const FRP_CADDY_SNIPPET_MARKER = "# Managed by DSH Mobile - snippet, safe to delete";
 /** Exact line the main Caddyfile must contain (uncommented) for the site to load. */
 const FRP_CADDY_IMPORT_LINE = `import ${FRP_CADDY_SNIPPET_PATH}`;
-/** Directory holding the public-IPv4 certificates installed by certbot. */
-const FRP_CADDY_IP_CERT_DIR = "/var/lib/caddy/dsh-mobile-certs";
 function publicIpv4Address(value) {
 	const parts = value.split(".");
 	return parts.length === 4 && parts.every((part) => /^(?:0|[1-9][0-9]{0,2})$/u.test(part) && Number(part) <= 255);
@@ -5505,8 +5812,31 @@ function parsePublicOrigin(publicOrigin) {
 	if (url.protocol !== "https:" || url.port !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.username !== "" || url.password !== "" || !publicIpv4Address(url.hostname) && !publicDnsHostname(url.hostname)) throw new Error("frp_template_input_invalid");
 	return url.hostname;
 }
-/** Build the Caddy site for one public host (without markers or import wiring). */
-function createCaddySite(publicHost, certDir = FRP_CADDY_IP_CERT_DIR) {
+function resolveVhostHttpPort(options) {
+	const port = options.vhostHttpPort ?? 7080;
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error("frp_template_input_invalid");
+	return port;
+}
+/**
+* A self-signed entry deliberately never reaches Caddy: the tunnel is a raw TCP
+* passthrough and the DSH gateway is the TLS endpoint. Refuse loudly instead of
+* emitting a Caddy site that would need the gateway's private CA on the VPS.
+*/
+function rejectSelfSignedCaddySite(options) {
+	if (options.entryTls === "self-signed") throw new Error("frp_entry_tls_invalid");
+}
+/**
+* Build the Caddy site for one public host (without markers or import wiring).
+*
+* The second parameter accepts either a bare certificate directory (the legacy
+* signature) or a full {@link CaddySiteOptions} object, so existing callers keep
+* working unchanged.
+*/
+function createCaddySite(publicHost, options = {}) {
+	const resolved = typeof options === "string" ? { certDir: options } : options;
+	rejectSelfSignedCaddySite(resolved);
+	const certDir = resolved.certDir ?? "/var/lib/caddy/dsh-mobile-certs";
+	const vhostHttpPort = resolveVhostHttpPort(resolved);
 	if (publicIpv4Address(publicHost)) return [
 		"{",
 		`  default_sni ${publicHost}`,
@@ -5518,14 +5848,14 @@ function createCaddySite(publicHost, certDir = FRP_CADDY_IP_CERT_DIR) {
 		"",
 		`https://${publicHost} {`,
 		`  tls ${certDir}/fullchain.pem ${certDir}/privkey.pem`,
-		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		`  reverse_proxy 127.0.0.1:${String(vhostHttpPort)}`,
 		"}",
 		""
 	].join("\n");
 	if (!publicDnsHostname(publicHost)) throw new Error("frp_template_input_invalid");
 	return [
 		`${publicHost} {`,
-		`  reverse_proxy 127.0.0.1:${String(FRP_VHOST_HTTP_PORT)}`,
+		`  reverse_proxy 127.0.0.1:${String(vhostHttpPort)}`,
 		"}",
 		""
 	].join("\n");
@@ -5548,15 +5878,24 @@ function manualIpCertificateGuide(publicHost) {
 		"#"
 	].join("\n");
 }
-/** Build the only supported frps config and Caddy snippet from validated user inputs. */
-function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
+/**
+* Build the only supported frps config and Caddy snippet from validated user inputs.
+*
+* Default `options` reproduce the upstream artefact byte for byte; `attach` mode
+* passes the user's real vhost port, and `self-signed` is rejected because that
+* mode publishes a raw TCP proxy instead of an HTTP vhost.
+*/
+function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin, options = {}) {
 	if (!Number.isSafeInteger(serverPort) || serverPort < 1 || serverPort > 65535 || token.length < 16 || token.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(token)) throw new Error("frp_template_input_invalid");
+	rejectSelfSignedCaddySite(options);
+	const vhostHttpPort = resolveVhostHttpPort(options);
+	const certDir = options.certDir ?? "/var/lib/caddy/dsh-mobile-certs";
 	const publicHost = parsePublicOrigin(publicOrigin);
 	const lines = [
 		"# frps.toml — save as /etc/dsh-mobile/frps.toml, then start the frps service.",
 		`bindPort = ${String(serverPort)}`,
 		"proxyBindAddr = \"127.0.0.1\"",
-		`vhostHTTPPort = ${String(FRP_VHOST_HTTP_PORT)}`,
+		`vhostHTTPPort = ${String(vhostHttpPort)}`,
 		"auth.method = \"token\"",
 		`auth.token = ${JSON.stringify(token)}`,
 		"",
@@ -5567,7 +5906,10 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
 		"# finally run: caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
 		"# Uninstall later removes only this snippet file and the import line; your own Caddy content is kept.",
 		`${FRP_CADDY_SNIPPET_MARKER}`,
-		createCaddySite(publicHost).trimEnd(),
+		createCaddySite(publicHost, {
+			certDir,
+			vhostHttpPort
+		}).trimEnd(),
 		""
 	];
 	if (publicIpv4Address(publicHost)) lines.push(manualIpCertificateGuide(publicHost), "");
@@ -5576,6 +5918,26 @@ function createRestrictedFrpServerTemplate(serverPort, token, publicOrigin) {
 //#endregion
 //#region src/frp-config.ts
 const MAX_SETTINGS_BYTES$1 = 8192;
+/** Public entry port used by the self-signed TCP passthrough (never 443 by requirement). */
+const FRP_DEFAULT_PUBLIC_PORT = 33080;
+/** Ports owned by other DSH Mobile listeners; the public entry may never reuse them. */
+const FRP_RESERVED_PORTS = Object.freeze([
+	3080,
+	3443,
+	3444
+]);
+/** Every key `settings.json` may contain. Unknown keys stay rejected. */
+const FRP_SETTINGS_KEYS = /* @__PURE__ */ new Set([
+	"version",
+	"serverAddress",
+	"serverPort",
+	"token",
+	"publicOrigin",
+	"mode",
+	"entryTls",
+	"vhostHttpPort",
+	"publicPort"
+]);
 function hostname$2(value) {
 	if (value.length > 253 || !value.includes(".")) return false;
 	return value.split(".").every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(label));
@@ -5611,24 +5973,90 @@ function validateFrpPublicOrigin(value) {
 	if (isIP(publicHost) === 4 && !isGloballyRoutableIpv4(publicHost)) throw new Error("frp_public_origin_invalid");
 	return url.origin;
 }
-/** Parse FRP settings at the loopback request and filesystem boundaries. */
+/** Validate the provisioning mode. */
+function validateFrpMode(value) {
+	if (value !== "deploy" && value !== "attach") throw new Error("frp_settings_invalid");
+	return value;
+}
+/** Validate the entry TLS mode. */
+function validateFrpEntryTls(value) {
+	if (value !== "public-ip-cert" && value !== "self-signed") throw new Error("frp_entry_tls_invalid");
+	return value;
+}
+function validatePort(value, rejectReserved) {
+	if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 65535) throw new Error("frp_settings_invalid");
+	const port = Number(value);
+	if (rejectReserved && FRP_RESERVED_PORTS.includes(port)) throw new Error("frp_settings_invalid");
+	return port;
+}
+/** Validate the loopback vhost port of the target frps. */
+function validateFrpVhostHttpPort(value) {
+	return validatePort(value, false);
+}
+/** Validate the public entry port of the self-signed TCP proxy. */
+function validateFrpPublicPort(value) {
+	return validatePort(value, true);
+}
+/** Effective provisioning mode; an absent field keeps the upstream behaviour. */
+function resolveFrpMode(settings) {
+	return settings.mode ?? "deploy";
+}
+/** Effective entry TLS mode; an absent field keeps the upstream behaviour. */
+function resolveFrpEntryTls(settings) {
+	return settings.entryTls ?? "public-ip-cert";
+}
+/** Effective loopback vhost port; an absent field keeps the upstream behaviour. */
+function resolveFrpVhostHttpPort(settings) {
+	return settings.vhostHttpPort ?? 7080;
+}
+/** Effective public entry port of the self-signed passthrough. */
+function resolveFrpPublicPort(settings) {
+	return settings.publicPort ?? 33080;
+}
+/** HTTPS origin users actually open; the self-signed TCP entry is not on 443. */
+function frpEntryOrigin(settings) {
+	if (!isFrpSelfSignedIngress(settings)) return settings.publicOrigin;
+	return `https://${new URL(settings.publicOrigin).hostname}:${String(resolveFrpPublicPort(settings))}`;
+}
+/** True when the gateway terminates TLS itself behind a raw frps TCP proxy. */
+function isFrpSelfSignedIngress(settings) {
+	return resolveFrpEntryTls(settings) === "self-signed";
+}
+/**
+* Parse FRP settings at the loopback request and filesystem boundaries.
+*
+* Optional keys are kept only when supplied, so a legacy `settings.json` still
+* round-trips byte for byte and every default stays the upstream behaviour.
+* Two cross-field rules are enforced here because neither can be recovered later:
+* the self-signed entry is a TCP passthrough and therefore attach-only, and
+* attach mode with a public-CA entry must state the user's real vhost port —
+* silently assuming 7080 would disable the plaintext-exposure gate.
+*/
 function parseFrpSettings(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_settings_invalid");
 	const record = value;
-	if (Reflect.ownKeys(record).some((key) => ![
-		"version",
-		"serverAddress",
-		"serverPort",
-		"token",
-		"publicOrigin"
-	].includes(String(key)))) throw new Error("frp_settings_invalid");
+	if (Reflect.ownKeys(record).some((key) => !FRP_SETTINGS_KEYS.has(String(key)))) throw new Error("frp_settings_invalid");
 	if (record.version !== void 0 && record.version !== 1) throw new Error("frp_settings_invalid");
+	const mode = record.mode === void 0 ? void 0 : validateFrpMode(record.mode);
+	const entryTls = record.entryTls === void 0 ? void 0 : validateFrpEntryTls(record.entryTls);
+	const vhostHttpPort = record.vhostHttpPort === void 0 ? void 0 : validateFrpVhostHttpPort(record.vhostHttpPort);
+	const publicPort = record.publicPort === void 0 ? void 0 : validateFrpPublicPort(record.publicPort);
+	const resolvedMode = mode ?? "deploy";
+	const resolvedEntryTls = entryTls ?? "public-ip-cert";
+	if (resolvedEntryTls === "self-signed" && resolvedMode !== "attach") throw new Error("frp_entry_tls_invalid");
+	if (resolvedMode === "attach" && resolvedEntryTls === "public-ip-cert" && vhostHttpPort === void 0) throw new Error("frp_attach_mode_requires_vhost_port");
+	const publicOrigin = validateFrpPublicOrigin(record.publicOrigin);
+	if (resolvedEntryTls === "self-signed" && isIP(new URL(publicOrigin).hostname) !== 4) throw new Error("frp_self_signed_requires_public_ipv4");
 	return Object.freeze({
 		version: 1,
 		serverAddress: validateFrpServerAddress(record.serverAddress),
 		serverPort: validateFrpServerPort(record.serverPort),
 		token: validateFrpToken(record.token),
-		publicOrigin: validateFrpPublicOrigin(record.publicOrigin)
+		publicOrigin,
+		...mode === void 0 ? {} : { mode },
+		...entryTls === void 0 ? {} : { entryTls },
+		...vhostHttpPort === void 0 ? {} : { vhostHttpPort },
+		...publicPort === void 0 ? {} : { publicPort }
 	});
 }
 /**
@@ -5638,11 +6066,24 @@ function parseFrpSettings(value) {
 * missing configuration instead of silently deploying blanks.
 */
 function mergeSavedFrpSettings(partial, saved) {
+	const pick = (key) => {
+		const supplied = partial[key];
+		if (supplied === "" || supplied === void 0) return saved?.[key];
+		return supplied;
+	};
+	const mode = pick("mode");
+	const entryTls = pick("entryTls");
+	const vhostHttpPort = pick("vhostHttpPort");
+	const publicPort = pick("publicPort");
 	const merged = {
 		serverAddress: partial.serverAddress === "" || partial.serverAddress === void 0 ? saved?.serverAddress : partial.serverAddress,
 		serverPort: typeof partial.serverPort === "number" && Number.isSafeInteger(partial.serverPort) && partial.serverPort >= 1 ? partial.serverPort : saved?.serverPort,
 		token: partial.token === "" || partial.token === void 0 ? saved?.token : partial.token,
-		publicOrigin: partial.publicOrigin === "" || partial.publicOrigin === void 0 ? saved?.publicOrigin : partial.publicOrigin
+		publicOrigin: partial.publicOrigin === "" || partial.publicOrigin === void 0 ? saved?.publicOrigin : partial.publicOrigin,
+		...mode === "" || mode === void 0 ? {} : { mode },
+		...entryTls === "" || entryTls === void 0 ? {} : { entryTls },
+		...vhostHttpPort === "" || vhostHttpPort === void 0 ? {} : { vhostHttpPort },
+		...publicPort === "" || publicPort === void 0 ? {} : { publicPort }
 	};
 	if (merged.serverAddress === void 0 && merged.serverPort === void 0 && merged.token === void 0 && merged.publicOrigin === void 0) throw new Error("frp_config_missing");
 	return parseFrpSettings(merged);
@@ -5660,11 +6101,16 @@ function mergeSavedFrpTarget(partial, saved) {
 function tomlString(value) {
 	return JSON.stringify(value);
 }
-/** Build the single-purpose frpc configuration for the current loopback gateway. */
+/**
+* Build the single-purpose frpc configuration for the current loopback gateway.
+*
+* The default (public-CA) entry is an HTTP vhost behind Caddy and is emitted byte
+* for byte as before. The self-signed entry cannot use a vhost at all: frps only
+* forwards raw TCP, and the gateway terminates TLS on that connection.
+*/
 function createFrpcToml(settings, localPort) {
 	if (!Number.isSafeInteger(localPort) || localPort < 1 || localPort > 65535) throw new Error("frp_local_port_invalid");
-	const hostnameValue = new URL(settings.publicOrigin).hostname;
-	return [
+	const header = [
 		`serverAddr = ${tomlString(settings.serverAddress)}`,
 		`serverPort = ${String(settings.serverPort)}`,
 		"auth.method = \"token\"",
@@ -5672,7 +6118,21 @@ function createFrpcToml(settings, localPort) {
 		"transport.tls.enable = true",
 		"",
 		"[[proxies]]",
-		"name = \"dsh-mobile\"",
+		"name = \"dsh-mobile\""
+	];
+	if (isFrpSelfSignedIngress(settings)) return [
+		...header,
+		"type = \"tcp\"",
+		"localIP = \"127.0.0.1\"",
+		`localPort = ${String(localPort)}`,
+		`remotePort = ${String(resolveFrpPublicPort(settings))}`,
+		"transport.useEncryption = true",
+		"transport.useCompression = true",
+		""
+	].join("\n");
+	const hostnameValue = new URL(settings.publicOrigin).hostname;
+	return [
+		...header,
 		"type = \"http\"",
 		"localIP = \"127.0.0.1\"",
 		`localPort = ${String(localPort)}`,
@@ -5684,7 +6144,10 @@ function createFrpcToml(settings, localPort) {
 }
 /** Build the matching restricted frps and Caddy templates for one VPS. */
 function createFrpServerTemplate(settings) {
-	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin);
+	return createRestrictedFrpServerTemplate(settings.serverPort, settings.token, settings.publicOrigin, {
+		vhostHttpPort: resolveFrpVhostHttpPort(settings),
+		entryTls: resolveFrpEntryTls(settings)
+	});
 }
 async function atomicPrivateWrite$2(file, body) {
 	const directory = dirname(file);
@@ -5747,9 +6210,17 @@ var FrpConfigStore = class {
 			this.errorCode = "frp_config_invalid";
 		}
 	}
-	/** Return configuration metadata without exposing the FRP token. */
+	/**
+	* Return configuration metadata without exposing the FRP token.
+	*
+	* The optional keys appear only when the saved configuration departs from the
+	* upstream defaults, so the pre-existing field set is unchanged for every
+	* legacy configuration.
+	*/
 	status() {
 		const settings = this.settingsValue;
+		const mode = settings === void 0 ? void 0 : resolveFrpMode(settings);
+		const entryTls = settings === void 0 ? void 0 : resolveFrpEntryTls(settings);
 		return Object.freeze({
 			configured: settings !== void 0,
 			...settings === void 0 ? {} : {
@@ -5757,9 +6228,12 @@ var FrpConfigStore = class {
 				serverPort: settings.serverPort,
 				publicOrigin: settings.publicOrigin
 			},
-			vhostHttpPort: FRP_VHOST_HTTP_PORT,
+			vhostHttpPort: settings === void 0 ? FRP_VHOST_HTTP_PORT : resolveFrpVhostHttpPort(settings),
 			storagePath: this.stateRoot,
-			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode },
+			...mode === void 0 || mode === "deploy" ? {} : { mode },
+			...entryTls === void 0 || entryTls === "public-ip-cert" ? {} : { entryTls },
+			...settings?.publicPort === void 0 ? {} : { publicPort: settings.publicPort }
 		});
 	}
 	/** Return private settings only to the provider lifecycle. */
@@ -5794,41 +6268,1067 @@ var FrpConfigStore = class {
 	}
 };
 //#endregion
-//#region src/remote.ts
-const REMOTE_PROVIDERS = Object.freeze([
-	"tailscale",
-	"cpolar",
-	"cloudflared",
-	"frp",
-	"origin"
-]);
-function aggregateErrors(errors, message) {
-	if (errors.length === 0) return void 0;
-	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
-	return new AggregateError(errors, message);
+//#region src/frp-attach.ts
+/** Default proof path used to confirm the public entry answered from this computer. */
+const FRP_ATTACH_DISCOVERY_PATH = "/mobile-access/discovery";
+/** Declaration printed above the VPS half of an attach template. */
+const FRP_ATTACH_VPS_DECLARATION = "# 本模板不安装、不改动、不重启你的 frps；只新增 Caddy 片段与证书。frps 侧需你自行确认 vhostHTTPPort=<N> 与 proxyBindAddr=\"127.0.0.1\"。";
+/** Declaration printed above the local half of an attach template. */
+const FRP_ATTACH_LOCAL_DECLARATION = "# 本机只写入 frpc.toml 并启动 frpc：不安装、不改动本机 frps，也不改动 DSH 自身配置。";
+/** Declaration for the self-signed passthrough, which keeps its CA on this computer. */
+const FRP_ATTACH_SELF_SIGNED_DECLARATION = "# 自签穿透档不使用 Caddy 或公开证书：frps 只做 TCP 透传，由本机 DSH 网关终止 TLS；服务端证书会在运行时续签，CA 到期需重新配对。";
+/**
+* One-line notice printed above the masked frpc.toml preview.
+*
+* It states both facts a reader cannot verify from the text itself: the real
+* file is written with 0600 permissions, and an unmasked copy would survive in
+* the system clipboard.
+*/
+function frpAttachTokenMaskNotice(configFile) {
+	return `# 预览已打码：真正的 frpc.toml 已由插件以 0600 权限写入 ${configFile}；明文 token 不打码会随复制进入系统剪贴板，故此处只显示占位符。`;
 }
-/** Settle independent remote cleanup work before reporting any collected failure. */
-async function settleRemoteResources(steps, message = "remote resource cleanup failed") {
-	const failure = aggregateErrors((await Promise.allSettled(steps.map(async (step) => step()))).filter((result) => result.status === "rejected").map((result) => result.reason), message);
-	if (failure !== void 0) throw failure;
+/** One-line notice printed above an explicitly revealed frpc.toml preview. */
+const FRP_ATTACH_TOKEN_REVEAL_NOTICE = "# 明文 token 已按你的显式操作显示：复制后即进入系统剪贴板并长期留存，请勿粘贴到公开位置。";
+/** Matches the single `auth.token` assignment of a generated frpc.toml. */
+const FRPC_TOKEN_ASSIGNMENT = /^auth\.token\s*=\s*"(?:[^"\\]|\\.)*"/mu;
+/**
+* Replace the `auth.token` value of a rendered frpc.toml with a fixed placeholder.
+*
+* Only the preview and clipboard paths call this: the file written to disk keeps
+* the real token, because frpc has to read it. The mapping never fails open — a
+* token line that cannot be masked raises instead of leaking the secret.
+*/
+function redactFrpcTomlToken(frpcToml) {
+	if (!/(^|\n)auth\.token/u.test(frpcToml)) return frpcToml;
+	const masked = frpcToml.replace(FRPC_TOKEN_ASSIGNMENT, `auth.token = "***"`);
+	if (!masked.includes(`auth.token = "***"`)) throw new Error("frp_token_mask_failed");
+	return masked;
 }
 /**
-* Serialize all provider mutations and preserve the single-provider invariant.
-* Operations read the selected controller only after reaching the front of the queue.
+* The frpc.toml exactly as the panel displays or copies it.
+*
+* `options.revealToken` is the only way to obtain the plaintext variant; the
+* default is the masked text. `createFrpcToml` itself is untouched, so the file
+* the provider writes stays byte-for-byte identical to the upstream output.
 */
-var RemoteProviderCoordinator = class {
-	controllers;
-	store;
-	selectedValue;
-	queue = Promise.resolve();
-	constructor(selected, controllers, store) {
-		this.controllers = controllers;
-		this.store = store;
-		this.selectedValue = selected;
+function createFrpAttachFrpcToml(settings, options = {}) {
+	const frpcToml = createFrpcToml(settings, attachLocalPort(options));
+	return options.revealToken === true ? frpcToml : redactFrpcTomlToken(frpcToml);
+}
+const DEFAULT_ATTACH_CONFIG_FILE = "<DSH Mobile 私有目录>/remote/frp/config/frpc.toml";
+function attachConfigFile(options) {
+	const file = options.configFile;
+	if (file === void 0 || file === "") return DEFAULT_ATTACH_CONFIG_FILE;
+	return file;
+}
+function attachLocalPort(options) {
+	const port = options.localPort ?? 3443;
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error("frp_local_port_invalid");
+	return port;
+}
+/**
+* Reject every attach request that could not be carried out safely before any
+* artefact is produced. Attach never installs frps, so it must know the user's
+* real vhost port (unless the self-signed passthrough removes the vhost entirely).
+*/
+function validateAttachSettings(settings, options = {}) {
+	if (resolveFrpMode(settings) !== "attach") throw new Error("frp_settings_invalid");
+	if (isFrpSelfSignedIngress(settings)) {
+		if (settings.mode !== "attach") throw new Error("frp_entry_tls_invalid");
+		resolveFrpPublicPort(settings);
+		return;
 	}
-	/** Return the durable provider currently selected by the desktop UI. */
-	get selected() {
-		return this.selectedValue;
+	const vhostHttpPort = options.vhostHttpPort ?? settings.vhostHttpPort;
+	if (vhostHttpPort === void 0) throw new Error("frp_attach_mode_requires_vhost_port");
+	if (!Number.isSafeInteger(vhostHttpPort) || vhostHttpPort < 1 || vhostHttpPort > 65535) throw new Error("frp_settings_invalid");
+}
+/** Strip the leading `# ` of a guide block so it can be pasted as runnable shell. */
+function guideCommands(guide) {
+	return guide.split("\n").map((line) => line.replace(/^#\s?/u, "").trimEnd()).filter((line) => line !== "");
+}
+/**
+* Derive every VPS-side value once so the copied runbook and the panel plan can
+* never drift apart.
+*/
+function frpAttachVpsParts(settings, options = {}) {
+	validateAttachSettings(settings, options);
+	const publicHost = new URL(settings.publicOrigin).hostname;
+	if (isFrpSelfSignedIngress(settings)) return Object.freeze({
+		publicHost,
+		selfSigned: true,
+		publicPort: resolveFrpPublicPort(settings),
+		snippet: "",
+		certGuide: Object.freeze([])
+	});
+	const vhostHttpPort = options.vhostHttpPort ?? resolveFrpVhostHttpPort(settings);
+	const certDir = options.certDir;
+	const site = createCaddySite(publicHost, {
+		vhostHttpPort,
+		...certDir === void 0 ? {} : { certDir }
+	});
+	return Object.freeze({
+		publicHost,
+		selfSigned: false,
+		vhostHttpPort,
+		snippet: `${FRP_CADDY_SNIPPET_MARKER}\n${site.trimEnd()}\n`,
+		certGuide: Object.freeze(isIP(publicHost) === 4 ? guideCommands(manualIpCertificateGuide(publicHost)) : [])
+	});
+}
+/**
+* Build the attach artefact for an existing frps.
+*
+* The result is deliberately split in two: the VPS half contains only what the
+* user's own server needs (Caddy snippet + import + certificate guidance, or a
+* single firewall rule for the self-signed passthrough), and the local half
+* contains the generated frpc.toml plus its `frpc verify` self-check. Neither
+* half installs, rewrites, or restarts the user's frps.
+*/
+function createFrpAttachTemplateParts(settings, options = {}) {
+	const parts = frpAttachVpsParts(settings, options);
+	const configFile = attachConfigFile(options);
+	const revealed = options.revealToken === true;
+	const frpcToml = createFrpAttachFrpcToml(settings, options);
+	const local = [
+		"# ---- (b) 本机侧（在这台电脑上执行）----",
+		FRP_ATTACH_LOCAL_DECLARATION,
+		revealed ? FRP_ATTACH_TOKEN_REVEAL_NOTICE : frpAttachTokenMaskNotice(configFile),
+		`# frpc.toml 全文（插件同样会以 0600 权限写入 ${configFile}）`,
+		frpcToml.trimEnd(),
+		"",
+		"# 启动前自检：",
+		`frpc verify -c "${configFile}"`,
+		""
+	].join("\n");
+	if (parts.selfSigned) {
+		const publicPort = parts.publicPort ?? resolveFrpPublicPort(settings);
+		const vps = [
+			"# ---- (a) VPS 侧（在你的服务器上执行，共 3 项）----",
+			FRP_ATTACH_SELF_SIGNED_DECLARATION,
+			"#",
+			"# 1) 放行公网入口端口（就是这台电脑网关的 HTTPS 入口，TCP 透传不解密）：",
+			`ufw allow ${String(publicPort)}/tcp`,
+			`ufw status | grep ${String(publicPort)}`,
+			"# 若使用 firewalld / 云厂商安全组，请放行同样的 TCP 端口。",
+			"# 前提：现有 frps 的 TCP 代理已监听公网地址；若 proxyBindAddr=127.0.0.1，放行防火墙仍无法从公网访问。",
+			"# 插件不会修改你现有的 frps；不满足此前提时请改选受信任证书入口。",
+			"#",
+			"# 2) 确认你既有的 frps 已就绪（无需修改它的配置）：",
+			"systemctl is-active frps || true",
+			`ss -lnt | grep -E ':(${String(settings.serverPort)}|${String(publicPort)})\\b' || true`,
+			"#",
+			"# 3) frpc 启动后，用 -k 检查连通性；此命令不验证身份，App 配对后会固定网关 CA：",
+			`curl -k -sS -o /dev/null -w '%{http_code}\\n' https://${parts.publicHost}:${String(publicPort)}${FRP_ATTACH_DISCOVERY_PATH}`,
+			"# 期望输出 200。",
+			""
+		].join("\n");
+		return Object.freeze({
+			mode: "attach",
+			vps,
+			local,
+			text: `${vps}${local}`
+		});
+	}
+	const vps = [
+		"# ---- (a) VPS 侧（在你的服务器上执行）----",
+		FRP_ATTACH_VPS_DECLARATION,
+		"#",
+		`# 1) 保存 Caddy 片段到 ${FRP_CADDY_SNIPPET_PATH}（只新增这一个文件）：`,
+		`cat > ${FRP_CADDY_SNIPPET_PATH} <<'DSH_MOBILE_CADDY_SNIPPET'`,
+		parts.snippet.trimEnd(),
+		"DSH_MOBILE_CADDY_SNIPPET",
+		"#",
+		"# 2) 确认 Caddyfile 顶部含下面这一行（全局块必须在前；没有则加到文件最上方）：",
+		`#   ${FRP_CADDY_IMPORT_LINE}`,
+		"caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
+		"#",
+		...parts.certGuide.length === 0 ? ["# 3) 域名 HTTPS：确认 DNS 指向 VPS，开放 80/443；Caddy 会自动申请和续期证书。"] : [
+			"# 3) 公网 IP 的 HTTPS 证书（Caddy 不能为 IP 自动签发，故用 certbot 签发）：",
+			...parts.certGuide.map((line) => `#   ${line}`),
+			"#",
+			"# 4) 确认证书续期任务，并在续期后将新证书安装到 Caddy：",
+			"systemctl list-timers certbot.timer --all || true"
+		],
+		"#",
+		"# 端到端验证（公网入口为 443，与 frps 的 vhost 端口无关）：",
+		`curl -sS -o /dev/null -w '%{http_code}\\n' https://${parts.publicHost}${FRP_ATTACH_DISCOVERY_PATH}`,
+		"# 期望输出 200。",
+		""
+	].join("\n");
+	return Object.freeze({
+		mode: "attach",
+		vps,
+		local,
+		text: `${vps}${local}`
+	});
+}
+/** Combined attach artefact, ready for the clipboard. */
+function createFrpAttachTemplate(settings, options = {}) {
+	return createFrpAttachTemplateParts(settings, options).text;
+}
+//#endregion
+//#region src/frp-attach-plan.ts
+const DEFAULT_PLAN_CONFIG_FILE = "<DSH Mobile 私有目录>/remote/frp/config/frpc.toml";
+function planConfigFile(options) {
+	const file = options.configFile;
+	return file === void 0 || file === "" ? DEFAULT_PLAN_CONFIG_FILE : file;
+}
+/**
+* Build the copy-only attach plan. It performs no network access, no SSH, and no
+* filesystem write: the caller renders or copies the steps and the local frpc
+* configuration is written by the ordinary provider lifecycle.
+*/
+function createFrpAttachPlan(settings, options = {}) {
+	const parts = frpAttachVpsParts(settings, options);
+	const configFile = planConfigFile(options);
+	const localPort = options.localPort ?? 3443;
+	const frpcToml = createFrpAttachFrpcToml(settings, {
+		...options,
+		localPort
+	});
+	const tokenMasked = options.revealToken !== true;
+	const verifyCommand = `frpc verify -c "${configFile}"`;
+	const commonWarnings = ["本机探测 ≠ 公网验证：请在外部（手机流量或另一台机器）再执行一次 VPS 侧清单里的 curl 验证。", "插件不会安装、不会改动、不会重启你既有的 frps，也不会改动 Caddyfile 里的其他内容。"];
+	if (isFrpSelfSignedIngress(settings)) {
+		const publicPort = parts.publicPort ?? 0;
+		const publicHost = parts.publicHost;
+		return Object.freeze({
+			mode: "attach",
+			entryTls: resolveFrpEntryTls(settings),
+			publicPort,
+			local: Object.freeze({
+				frpcToml,
+				tokenMasked,
+				verifyCommand,
+				configFile,
+				declaration: FRP_ATTACH_LOCAL_DECLARATION
+			}),
+			vps: Object.freeze([
+				Object.freeze({
+					id: "open-public-port",
+					title: "frpAttachStepOpenPort",
+					label: `放行公网入口端口 ${String(publicPort)}/tcp`,
+					commands: Object.freeze([`ufw allow ${String(publicPort)}/tcp`, `ufw status | grep ${String(publicPort)}`]),
+					optional: false,
+					verifyHint: `ufw status 中应出现 ${String(publicPort)}/tcp ALLOW；云厂商安全组也需放行同一 TCP 端口。`
+				}),
+				Object.freeze({
+					id: "verify-frps",
+					title: "frpAttachStepVerifyFrps",
+					label: "确认既有 frps 已就绪（不改动它的配置）",
+					commands: Object.freeze(["systemctl is-active frps || true", `ss -lnt | grep -E ':(${String(settings.serverPort)}|${String(publicPort)})\\b' || true`]),
+					optional: false,
+					verifyHint: `frps 控制端口 ${String(settings.serverPort)} 应监听；入口 ${String(publicPort)} 的 Local Address 不应是 127.0.0.1。若仅回环监听，防火墙放行也无法公网访问。`
+				}),
+				Object.freeze({
+					id: "verify-entry",
+					title: "frpAttachStepVerifyEntry",
+					label: "frpc 启动后端到端验证（自签证书需 -k）",
+					commands: Object.freeze([`curl -k -sS -o /dev/null -w '%{http_code}\\n' https://${publicHost}:${String(publicPort)}${FRP_ATTACH_DISCOVERY_PATH}`]),
+					optional: false,
+					verifyHint: "期望输出 200；curl -k 仅验证连通性，不验证服务器身份；App 配对后会固定网关 CA。返回 000 时检查端口与转发。"
+				})
+			]),
+			warnings: Object.freeze([
+				...commonWarnings,
+				FRP_ATTACH_SELF_SIGNED_DECLARATION,
+				"现有 frps 的 TCP 代理必须已监听公网地址；若 proxyBindAddr=127.0.0.1，单靠开放防火墙端口无法连通，请改选公网证书 + Caddy 模式。插件不会修改你的 frps。",
+				"手机浏览器访问自签入口会提示证书不受信任 —— 请用 App 扫码配对；App 已固定网关 CA，不需要公开证书。",
+				"切勿把网关 listenHost 改成 0.0.0.0：公网入口由 frps 的 TCP 代理提供，网关只监听 127.0.0.1。"
+			])
+		});
+	}
+	const vhostHttpPort = parts.vhostHttpPort ?? 0;
+	const publicHost = parts.publicHost;
+	const certGuide = parts.certGuide;
+	const certificateSteps = certGuide.length === 0 ? [] : [Object.freeze({
+		id: "issue-ip-cert",
+		title: "frpAttachStepIssueCert",
+		label: "为公网 IP 签发受信任证书（certbot）",
+		commands: Object.freeze([...certGuide]),
+		optional: false,
+		verifyHint: `证书应落到 /etc/letsencrypt/live/${publicHost}/ 并安装到 Caddy 证书目录。`
+	}), Object.freeze({
+		id: "enable-cert-timer",
+		title: "frpAttachStepCertTimer",
+		label: "确认 certbot 续期定时器并更新 Caddy 证书文件",
+		commands: Object.freeze(["systemctl list-timers certbot.timer --all || true"]),
+		optional: false,
+		verifyHint: "公网 IP 证书有效期较短；续期后还须将新证书安装到 Caddy 并重载。"
+	})];
+	return Object.freeze({
+		mode: "attach",
+		entryTls: resolveFrpEntryTls(settings),
+		vhostHttpPort,
+		local: Object.freeze({
+			frpcToml,
+			tokenMasked,
+			verifyCommand,
+			configFile,
+			declaration: FRP_ATTACH_LOCAL_DECLARATION
+		}),
+		vps: Object.freeze([
+			Object.freeze({
+				id: "write-snippet",
+				title: "frpAttachStepWriteSnippet",
+				label: `新增 Caddy 片段 ${FRP_CADDY_SNIPPET_PATH}`,
+				commands: Object.freeze([
+					`cat > ${FRP_CADDY_SNIPPET_PATH} <<'DSH_MOBILE_CADDY_SNIPPET'`,
+					parts.snippet.trimEnd(),
+					"DSH_MOBILE_CADDY_SNIPPET"
+				]),
+				optional: false,
+				verifyHint: `片段内容里的反代目标是 127.0.0.1:${String(vhostHttpPort)}，即你 frps 的 vhostHTTPPort。`
+			}),
+			Object.freeze({
+				id: "add-import",
+				title: "frpAttachStepAddImport",
+				label: "在 Caddyfile 顶部加入 import 行并重载",
+				commands: Object.freeze([`# 确认 /etc/caddy/Caddyfile 顶部包含：${FRP_CADDY_IMPORT_LINE}`, "caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy"]),
+				optional: false,
+				verifyHint: "caddy validate 通过且 reload 无报错；Caddyfile 中你自己原有的站点内容保持不变。"
+			}),
+			...certificateSteps,
+			Object.freeze({
+				id: "verify-https",
+				title: "frpAttachStepVerifyHttps",
+				label: "端到端验证公网 HTTPS 入口",
+				commands: Object.freeze([`curl -sS -o /dev/null -w '%{http_code}\\n' https://${publicHost}${FRP_ATTACH_DISCOVERY_PATH}`]),
+				optional: true,
+				verifyHint: certGuide.length === 0 ? "期望输出 200；证书错误时检查 DNS、80/443 端口和 Caddy 日志。" : "期望输出 200；证书错误时检查 certbot 证书是否安装并重载 Caddy。"
+			})
+		]),
+		warnings: Object.freeze([
+			...commonWarnings,
+			FRP_ATTACH_VPS_DECLARATION,
+			`你 frps 的明文 vhost 必须只监听 127.0.0.1（proxyBindAddr）且 vhostHTTPPort=${String(vhostHttpPort)}；插件启动前会探测该端口，若公网可达将直接拒绝启动。`
+		])
+	});
+}
+//#endregion
+//#region src/cert-renewal.ts
+/** Days left below which the entry certificate is reported as expiring. */
+const CERT_EXPIRING_DAYS = 2;
+const DAY_MS = 864e5;
+/** Evaluate one `notAfter` timestamp against the current clock. */
+function evaluateCertificateLifetime(notAfter, now = Date.now()) {
+	if (!Number.isFinite(notAfter) || !Number.isFinite(now)) return Object.freeze({
+		state: "unknown",
+		errorCode: "frp_attach_cert_unknown"
+	});
+	const daysRemaining = Math.floor((notAfter - now) / DAY_MS);
+	if (notAfter <= now) return Object.freeze({
+		state: "expired",
+		notAfter,
+		daysRemaining
+	});
+	if (daysRemaining <= 2) return Object.freeze({
+		state: "expiring",
+		notAfter,
+		daysRemaining
+	});
+	return Object.freeze({
+		state: "ok",
+		notAfter,
+		daysRemaining
+	});
+}
+function statusFromCertificate(certificate, now) {
+	const lifetime = evaluateCertificateLifetime(Date.parse(certificate.validTo), now);
+	return Object.freeze({
+		...lifetime,
+		subject: certificate.subject,
+		issuer: certificate.issuer
+	});
+}
+/**
+* Read one PEM certificate from disk and report only its lifetime.
+*
+* A missing or unreadable file yields `unknown` with the stable
+* `frp_attach_cert_unknown` code so the panel can explain how to re-issue it.
+*/
+async function readCertificateRenewal(file, now = Date.now()) {
+	try {
+		return statusFromCertificate(new X509Certificate(await readFile(file)), now);
+	} catch {
+		return Object.freeze({
+			state: "unknown",
+			errorCode: "frp_attach_cert_unknown"
+		});
+	}
+}
+/**
+* Ask a live TLS endpoint for its leaf certificate and report its lifetime.
+*
+* Verification is intentionally skipped: this is a read-only lifetime probe for
+* an endpoint whose trust anchor is already pinned elsewhere, and a self-signed
+* leaf is the expected answer for the passthrough entry.
+*/
+async function probeOriginCertificate(host, port, timeoutMs = 5e3) {
+	if (!Number.isSafeInteger(port) || port < 1 || port > 65535) return Object.freeze({
+		state: "unknown",
+		errorCode: "frp_attach_cert_unknown"
+	});
+	return new Promise((resolveProbe) => {
+		let finished = false;
+		const socket = connect$1({
+			host,
+			port,
+			rejectUnauthorized: false,
+			servername: void 0
+		});
+		const finish = (status) => {
+			if (finished) return;
+			finished = true;
+			clearTimeout(timer);
+			socket.destroy();
+			resolveProbe(status);
+		};
+		const timer = setTimeout(() => {
+			finish(Object.freeze({
+				state: "unknown",
+				errorCode: "frp_attach_cert_unknown"
+			}));
+		}, timeoutMs);
+		timer.unref();
+		socket.once("secureConnect", () => {
+			const certificate = socket.getPeerX509Certificate();
+			finish(certificate === void 0 ? Object.freeze({
+				state: "unknown",
+				errorCode: "frp_attach_cert_unknown"
+			}) : statusFromCertificate(certificate, Date.now()));
+		});
+		socket.once("error", () => {
+			finish(Object.freeze({
+				state: "unknown",
+				errorCode: "frp_attach_cert_unknown"
+			}));
+		});
+		socket.once("close", () => {
+			finish(Object.freeze({
+				state: "unknown",
+				errorCode: "frp_attach_cert_unknown"
+			}));
+		});
+	});
+}
+//#endregion
+//#region src/managed-setup.ts
+const VIRTUAL_INTERFACE_MARKERS = [
+	"bridge",
+	"docker",
+	"hyper-v",
+	"mihomo",
+	"radmin",
+	"tailscale",
+	"tap",
+	"tun",
+	"utun",
+	"vbox",
+	"veth",
+	"virtual",
+	"vmware",
+	"vpn",
+	"vethernet",
+	"wsl",
+	"zerotier"
+];
+/** Route inspection is advisory; never let a system command hold setup open indefinitely. */
+const ROUTE_COMMAND_TIMEOUT_MS = 5e3;
+function requiredString(value, name) {
+	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
+	return value;
+}
+/** Validate the durable managed setup before it controls network and filesystem operations. */
+function parseManagedSetup(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
+	const record = value;
+	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
+		"version",
+		"networkInterface",
+		"listenPort",
+		"upstreamOrigin",
+		"tls"
+	].includes(key))) throw new Error("mobile setup file has an unsupported format");
+	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
+	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
+	const tls = record.tls;
+	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
+		"mode",
+		"caCertFile",
+		"caKeyFile",
+		"certFile",
+		"keyFile"
+	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
+	return Object.freeze({
+		version: 2,
+		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
+		listenPort: record.listenPort,
+		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		tls: Object.freeze({
+			mode: "managed",
+			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
+			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
+			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
+			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
+		})
+	});
+}
+function privateIpv4(value) {
+	const parts = value.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
+}
+function networkCidr(address, cidr) {
+	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
+	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
+	return `${[
+		24,
+		16,
+		8,
+		0
+	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
+}
+/** List current private IPv4 candidates with their interface identity. */
+function availableLanNetworks(table = networkInterfaces()) {
+	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
+		name,
+		address: entry.address,
+		cidr: networkCidr(entry.address, entry.cidr)
+	})));
+	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
+}
+function likelyVirtualInterface(name) {
+	const normalized = name.toLowerCase().replaceAll(/[^a-z0-9]+/gu, " ");
+	return VIRTUAL_INTERFACE_MARKERS.some((marker) => normalized.includes(marker.replaceAll("-", " "))) || /^(?:br|wg)\d*\b/u.test(normalized);
+}
+async function runRouteCommand(file, args) {
+	return (await execFileText(file, [...args], {
+		encoding: "utf8",
+		timeout: ROUTE_COMMAND_TIMEOUT_MS
+	})).stdout;
+}
+function uniqueLines(output) {
+	return [...new Set(output.split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean))];
+}
+/** Return operating-system default-route interfaces in routing preference order. */
+async function preferredLanInterfaceNames(platform = process.platform, run = runRouteCommand) {
+	try {
+		if (platform === "win32") return uniqueLines(await run("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			[
+				"$routes = Get-NetRoute -AddressFamily IPv4 -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop",
+				"$ranked = $routes | Where-Object { $_.State -eq 'Alive' -and $_.NextHop -ne '0.0.0.0' } | ForEach-Object {",
+				"  $route = $_",
+				"  $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
+				"  $ip = Get-NetIPInterface -AddressFamily IPv4 -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
+				"  if ($adapter -and $ip -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true) {",
+				"    [pscustomobject]@{ Name = $route.InterfaceAlias; Metric = [int]$route.RouteMetric + [int]$ip.InterfaceMetric }",
+				"  }",
+				"}",
+				"$ranked | Sort-Object Metric | Select-Object -ExpandProperty Name -Unique"
+			].join("; ")
+		]));
+		if (platform === "linux") {
+			const routes = uniqueLines(await run("ip", [
+				"-o",
+				"-4",
+				"route",
+				"show",
+				"default"
+			])).map((line) => ({
+				name: /(?:^|\s)dev\s+(\S+)/u.exec(line)?.[1],
+				metric: Number(/(?:^|\s)metric\s+(\d+)/u.exec(line)?.[1] ?? 0)
+			})).filter((route) => route.name !== void 0 && !likelyVirtualInterface(route.name)).sort((left, right) => left.metric - right.metric);
+			return [...new Set(routes.map((route) => route.name))];
+		}
+		if (platform === "darwin") {
+			const name = /^\s*interface:\s*(\S+)\s*$/mu.exec(await run("route", [
+				"-n",
+				"get",
+				"default"
+			]))?.[1];
+			return name === void 0 || likelyVirtualInterface(name) ? [] : [name];
+		}
+	} catch {}
+	return [];
+}
+/** Select an active LAN, optionally by address or by a previously saved interface name. */
+function selectLanNetwork(requestedAddress, requestedInterface, table, preferredInterfaces = []) {
+	const candidates = availableLanNetworks(table);
+	if (requestedAddress !== void 0) {
+		const match = candidates.find((candidate) => candidate.address === requestedAddress);
+		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
+		return match;
+	}
+	if (requestedInterface !== void 0) {
+		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
+		if (matches.length === 1) return matches[0];
+		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
+		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	}
+	if (candidates.length === 1) return candidates[0];
+	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
+	for (const name of preferredInterfaces) {
+		const matches = candidates.filter((candidate) => candidate.name === name);
+		if (matches.length === 1) return matches[0];
+	}
+	const physicalCandidates = candidates.filter((candidate) => !likelyVirtualInterface(candidate.name));
+	if (physicalCandidates.length === 1) return physicalCandidates[0];
+	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
+}
+/**
+* True when the failure came from LAN selection (the configured network is
+* gone, nothing is up, or several are) rather than from config/TLS code.
+* Callers use it to degrade (warn + stay down) instead of failing boot.
+* Pinned to the selectLanNetwork message contract — keep in sync.
+*/
+function isNetworkSelectionError(error) {
+	const message = error instanceof Error ? error.message : String(error ?? "");
+	return message.includes("is not connected") || message.includes("no active private LAN address was found") || message.includes("more than one LAN address is active") || message.includes("has more than one private IPv4 address") || message.includes("is not an active private LAN address");
+}
+function assertMatchingCa(certPem, keyPem) {
+	const certificate = new X509Certificate(certPem);
+	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
+	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
+		format: "der",
+		type: "spki"
+	});
+	const certificatePublic = certificate.publicKey.export({
+		format: "der",
+		type: "spki"
+	});
+	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
+	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
+	return certificate;
+}
+/** Read an existing managed CA without ever generating a replacement identity. */
+async function readManagedCa(setup) {
+	const [certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	return assertMatchingCa(certPem, keyPem);
+}
+async function atomicWrite(file, contents) {
+	const directory = dirname(file);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
+	await writeFile(temporary, contents, { mode: 384 });
+	await rename(temporary, file);
+	await restrictPrivateFile(file);
+}
+/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
+async function ensureManagedCa(setup, legacy) {
+	let certPem;
+	let keyPem;
+	try {
+		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+		let migrated = false;
+		if (legacy !== void 0) try {
+			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
+			assertMatchingCa(certPem, keyPem);
+			migrated = true;
+		} catch (legacyError) {
+			if (legacyError.code !== "ENOENT") throw legacyError;
+		}
+		if (!migrated) {
+			const now = /* @__PURE__ */ new Date();
+			const notAfter = new Date(now);
+			notAfter.setFullYear(notAfter.getFullYear() + 5);
+			const generated = await generate([{
+				name: "commonName",
+				value: "DeepSeek Harness Mobile CA"
+			}], {
+				keyType: "ec",
+				curve: "P-256",
+				algorithm: "sha256",
+				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+				notAfterDate: notAfter,
+				extensions: [{
+					name: "basicConstraints",
+					cA: true,
+					critical: true
+				}, {
+					name: "keyUsage",
+					digitalSignature: true,
+					keyCertSign: true,
+					cRLSign: true,
+					critical: true
+				}]
+			});
+			certPem = generated.cert;
+			keyPem = generated.private;
+		}
+		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	}
+	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
+	await Promise.all([restrictPrivateFile(setup.caCertFile), restrictPrivateFile(setup.caKeyFile)]);
+	return assertMatchingCa(certPem, keyPem);
+}
+function subjectAltNames(target) {
+	const names = [];
+	for (const ip of target.ipAddresses ?? []) names.push({
+		type: 7,
+		ip
+	});
+	for (const dns of target.dnsNames ?? []) names.push({
+		type: 2,
+		value: dns
+	});
+	if (names.length === 0) throw new Error("managed TLS leaf needs at least one server name");
+	return names;
+}
+/**
+* Sign one server leaf with an existing self-signed CA and install it privately.
+*
+* Both the LAN listener and the self-signed FRP ingress use this one path, so a
+* certificate can never be produced by two divergent code paths. IP entries are
+* required for console addresses (`type: 7`), DNS entries (`type: 2`) cover named
+* hosts; the Android client accepts either through its pinned CA.
+*/
+async function issueServerCertificate(authority, target, output, lifetimeDays = 397) {
+	const altNames = subjectAltNames(target);
+	await Promise.all([restrictPrivateFile(authority.caCertFile), restrictPrivateFile(authority.caKeyFile)]);
+	const [caCert, caKey] = await Promise.all([readFile(authority.caCertFile, "utf8"), readFile(authority.caKeyFile, "utf8")]);
+	assertMatchingCa(caCert, caKey);
+	const now = /* @__PURE__ */ new Date();
+	const notAfter = new Date(now);
+	notAfter.setDate(notAfter.getDate() + lifetimeDays);
+	const server = await generate([{
+		name: "commonName",
+		value: target.commonName
+	}], {
+		keyType: "ec",
+		curve: "P-256",
+		algorithm: "sha256",
+		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
+		notAfterDate: notAfter,
+		ca: {
+			cert: caCert,
+			key: caKey
+		},
+		extensions: [
+			{
+				name: "basicConstraints",
+				cA: false,
+				critical: true
+			},
+			{
+				name: "keyUsage",
+				digitalSignature: true,
+				critical: true
+			},
+			{
+				name: "extKeyUsage",
+				serverAuth: true
+			},
+			{
+				name: "subjectAltName",
+				altNames
+			}
+		]
+	});
+	await Promise.all([atomicWrite(output.certFile, server.cert), atomicWrite(output.keyFile, server.private)]);
+}
+/** Sign and atomically install a server leaf for the interface's current address. */
+async function refreshManagedServerCertificate(setup, address) {
+	await issueServerCertificate({
+		caCertFile: setup.tls.caCertFile,
+		caKeyFile: setup.tls.caKeyFile
+	}, {
+		commonName: "DeepSeek Harness Mobile",
+		ipAddresses: [address]
+	}, {
+		certFile: setup.tls.certFile,
+		keyFile: setup.tls.keyFile
+	});
+}
+/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
+async function materializeManagedSetup(setup, table) {
+	const network = selectLanNetwork(void 0, setup.networkInterface, table);
+	await refreshManagedServerCertificate(setup, network.address);
+	const ca = new X509Certificate(await readFile(setup.tls.caCertFile, "utf8"));
+	return {
+		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
+		listenHost: network.address,
+		allowedCidrs: [network.cidr],
+		instanceId: ca.fingerprint256.replaceAll(":", "").toLowerCase(),
+		pairingCaFile: setup.tls.caCertFile,
+		tls: {
+			mode: "provided",
+			certFile: setup.tls.certFile,
+			keyFile: setup.tls.keyFile
+		}
+	};
+}
+//#endregion
+//#region src/frp-ingress.ts
+/** Private ingress directory, always a sibling of the remote device file. */
+function frpIngressPaths(stateFile) {
+	const directory = join(dirname(stateFile), "ingress");
+	return Object.freeze({
+		directory,
+		caCertFile: join(directory, "ca.pem"),
+		caKeyFile: join(directory, "ca-key.pem"),
+		certFile: join(directory, "server.pem"),
+		keyFile: join(directory, "server-key.pem"),
+		statusFile: join(dirname(stateFile), "ingress-identity.json")
+	});
+}
+async function regularFileExists(file) {
+	try {
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
+		return true;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function readIngressIdentity(file) {
+	if (!await regularFileExists(file)) return void 0;
+	try {
+		const parsed = JSON.parse(await readFile(file, "utf8"));
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("invalid identity");
+		const record = parsed;
+		if (record.version !== 1 || typeof record.caFingerprint !== "string" || !/^[a-f0-9]{64}$/u.test(record.caFingerprint)) throw new Error("invalid identity");
+		return record.caFingerprint;
+	} catch (error) {
+		throw new Error("frp_ingress_ca_invalid", { cause: error });
+	}
+}
+async function writeIngressIdentity(file, fingerprint) {
+	const temporary = join(dirname(file), `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, `${JSON.stringify({
+			version: 1,
+			caFingerprint: fingerprint
+		})}\n`, {
+			flag: "wx",
+			mode: 384
+		});
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} finally {
+		try {
+			await unlink(temporary);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+}
+function coversPublicIp(certificate, address) {
+	return (certificate.subjectAltName ?? "").split(",").some((entry) => entry.trim() === `IP Address:${address}`);
+}
+/**
+* Materialize the CA and leaf the gateway terminates TLS with.
+*
+* The CA remains stable for paired phones; an expired CA must be re-paired, not
+* replaced silently. The leaf is re-signed when expiring or no longer valid for
+* the public IPv4, and the running gateway reloads it after a renewal check.
+*/
+async function ensureFrpIngressCertificate(settings, stateFile, now = Date.now(), expectedCaFingerprint) {
+	if (resolveFrpMode(settings) !== "attach" || !isFrpSelfSignedIngress(settings)) throw new Error("frp_entry_tls_invalid");
+	const paths = frpIngressPaths(stateFile);
+	try {
+		const directory = await lstat(paths.directory);
+		if (!directory.isDirectory() || directory.isSymbolicLink()) throw new Error("frp_ingress_directory_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const previousFingerprint = await readIngressIdentity(paths.statusFile);
+	const [caCertExists, caKeyExists, leafCertExists, leafKeyExists] = await Promise.all([
+		regularFileExists(paths.caCertFile),
+		regularFileExists(paths.caKeyFile),
+		regularFileExists(paths.certFile),
+		regularFileExists(paths.keyFile)
+	]);
+	if (caCertExists !== caKeyExists || !caCertExists && (previousFingerprint !== void 0 || leafCertExists || leafKeyExists)) throw new Error("frp_ingress_ca_invalid");
+	if (caCertExists && (await readCertificateRenewal(paths.caCertFile, now)).state === "expired") throw new Error("frp_ingress_ca_expired");
+	if (previousFingerprint === void 0) {
+		await mkdir(dirname(paths.statusFile), {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			await writeFile(paths.statusFile, "{\"version\":1,\"pending\":true}\n", {
+				flag: "wx",
+				mode: 384
+			});
+			await restrictPrivateFile(paths.statusFile);
+		} catch (error) {
+			throw new Error("frp_ingress_ca_invalid", { cause: error });
+		}
+	}
+	const caFiles = {
+		mode: "managed",
+		caCertFile: paths.caCertFile,
+		caKeyFile: paths.caKeyFile,
+		certFile: paths.certFile,
+		keyFile: paths.keyFile
+	};
+	let ca;
+	try {
+		ca = expectedCaFingerprint === void 0 ? await ensureManagedCa(caFiles) : await readManagedCa(caFiles);
+	} catch (error) {
+		throw new Error("frp_ingress_ca_invalid", { cause: error });
+	}
+	const caFingerprint = ca.fingerprint256.replaceAll(":", "").toLowerCase();
+	if (previousFingerprint !== void 0 && caFingerprint !== previousFingerprint) throw new Error("frp_ingress_ca_changed");
+	if (expectedCaFingerprint !== void 0 && caFingerprint !== expectedCaFingerprint) throw new Error("frp_ingress_ca_changed");
+	if (previousFingerprint === void 0) await writeIngressIdentity(paths.statusFile, caFingerprint);
+	const publicHost = new URL(settings.publicOrigin).hostname;
+	let leaf;
+	try {
+		leaf = new X509Certificate(await readFile(paths.certFile));
+	} catch {
+		leaf = void 0;
+	}
+	if (!(leaf !== void 0 && Date.parse(leaf.validTo) > now + 864e5 && coversPublicIp(leaf, publicHost) && leaf.verify(ca.publicKey))) {
+		await issueServerCertificate({
+			caCertFile: paths.caCertFile,
+			caKeyFile: paths.caKeyFile
+		}, {
+			commonName: "DSH Mobile FRP ingress",
+			ipAddresses: [publicHost]
+		}, {
+			certFile: paths.certFile,
+			keyFile: paths.keyFile
+		});
+		leaf = new X509Certificate(await readFile(paths.certFile));
+	}
+	const signed = leaf ?? (() => {
+		throw new Error("frp_attach_cert_unknown");
+	})();
+	return Object.freeze({
+		paths,
+		ca,
+		leaf: signed,
+		caFingerprint,
+		status: await readCertificateRenewal(paths.certFile, now)
+	});
+}
+/**
+* Build the read-only self-check payload shown in the desktop panel.
+*
+* No secret ever leaves this function: the CA is reported by fingerprint only,
+* and the token is never read.
+*/
+async function frpIngressSelfCheck(settings, stateFile) {
+	const paths = frpIngressPaths(stateFile);
+	const base = {
+		mode: resolveFrpMode(settings),
+		entryTls: resolveFrpEntryTls(settings),
+		vhostHttpPort: resolveFrpVhostHttpPort(settings),
+		publicPort: resolveFrpPublicPort(settings),
+		publicOrigin: settings.publicOrigin,
+		entryOrigin: frpEntryOrigin(settings),
+		serverAddress: settings.serverAddress,
+		serverPort: settings.serverPort,
+		inbound: {
+			listenHost: "127.0.0.1",
+			allowedCidrs: Object.freeze(["127.0.0.0/8"])
+		}
+	};
+	if (!isFrpSelfSignedIngress(settings)) return Object.freeze(base);
+	let caFingerprint;
+	try {
+		caFingerprint = new X509Certificate(await readFile(paths.caCertFile)).fingerprint256.replaceAll(":", "").toLowerCase();
+	} catch {
+		caFingerprint = void 0;
+	}
+	return Object.freeze({
+		...base,
+		...caFingerprint === void 0 ? {} : { caFingerprint },
+		certificate: await readCertificateRenewal(paths.certFile),
+		caCertificate: await readCertificateRenewal(paths.caCertFile)
+	});
+}
+/** Remove only the five files owned by the local self-signed FRP entry. */
+async function purgeFrpIngressCertificates(stateFile) {
+	const paths = frpIngressPaths(stateFile);
+	try {
+		const marker = await lstat(paths.statusFile);
+		if (!marker.isFile() && !marker.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
+		await unlink(paths.statusFile);
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	let directory;
+	try {
+		directory = await lstat(paths.directory);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	if (directory.isSymbolicLink()) {
+		await unlink(paths.directory);
+		return;
+	}
+	if (!directory.isDirectory()) throw new Error("frp_ingress_directory_invalid");
+	for (const file of [
+		paths.caCertFile,
+		paths.caKeyFile,
+		paths.certFile,
+		paths.keyFile
+	]) {
+		let entry;
+		try {
+			entry = await lstat(file);
+		} catch (error) {
+			if (error.code === "ENOENT") continue;
+			throw error;
+		}
+		if (!entry.isFile() && !entry.isSymbolicLink()) throw new Error("frp_ingress_file_invalid");
+		await unlink(file);
+	}
+	try {
+		await rmdir(paths.directory);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+}
+//#endregion
+//#region src/remote.ts
+const REMOTE_PROVIDERS = Object.freeze([
+	"tailscale",
+	"cpolar",
+	"cloudflared",
+	"frp",
+	"origin"
+]);
+function aggregateErrors(errors, message) {
+	if (errors.length === 0) return void 0;
+	if (errors.length === 1 && errors[0] instanceof Error) return errors[0];
+	return new AggregateError(errors, message);
+}
+/** Settle independent remote cleanup work before reporting any collected failure. */
+async function settleRemoteResources(steps, message = "remote resource cleanup failed") {
+	const failure = aggregateErrors((await Promise.allSettled(steps.map(async (step) => step()))).filter((result) => result.status === "rejected").map((result) => result.reason), message);
+	if (failure !== void 0) throw failure;
+}
+/**
+* Serialize all provider mutations and preserve the single-provider invariant.
+* Operations read the selected controller only after reaching the front of the queue.
+*/
+var RemoteProviderCoordinator = class {
+	controllers;
+	store;
+	selectedValue;
+	queue = Promise.resolve();
+	constructor(selected, controllers, store) {
+		this.controllers = controllers;
+		this.store = store;
+		this.selectedValue = selected;
+	}
+	/** Return the durable provider currently selected by the desktop UI. */
+	get selected() {
+		return this.selectedValue;
 	}
 	/** Return the controller selected when this method is called. */
 	controller() {
@@ -6003,6 +7503,7 @@ const DISCOVERY_REQUEST_TIMEOUT_MS = 5e3;
 const DISCOVERY_RETRY_MS = 1e3;
 const MAX_DISCOVERY_BYTES = 16384;
 const VHOST_PROBE_TIMEOUT_MS = 1500;
+const INGRESS_CERT_CHECK_MS = 432e5;
 function publicStatus$3(status) {
 	return Object.freeze({
 		enabled: status.enabled,
@@ -6097,38 +7598,108 @@ async function boundedResponseBytes(response) {
 	}
 	return bytes;
 }
-async function defaultProbeDiscovery(origin, expectedInstanceId, signal) {
-	const requestController = new AbortController();
-	const abort = () => {
-		requestController.abort();
-	};
-	signal.addEventListener("abort", abort, { once: true });
-	const timeout = setTimeout(abort, DISCOVERY_REQUEST_TIMEOUT_MS);
-	timeout.unref();
-	try {
-		const response = await fetch(`${origin}/mobile-access/discovery`, {
+/** Web view over an HTTPS response so the byte cap applies to both paths alike. */
+function discoveryResponse(message) {
+	const headers = new Headers();
+	const declaredLength = message.headers["content-length"];
+	if (declaredLength !== void 0) headers.set("content-length", declaredLength);
+	return new Response(Readable.toWeb(message), {
+		status: message.statusCode ?? 200,
+		headers
+	});
+}
+/**
+* Perform one discovery request against the public entry.
+*
+* `node:https` carries this request instead of the global `fetch` for a single
+* reason: only here can the trust anchor be stated. The self-signed entry
+* presents a leaf the plugin's own ingress CA signed, so the default chain
+* always fails there (`UNABLE_TO_VERIFY_LEAF_SIGNATURE`) even though the
+* transport itself is healthy. The anchor is *added* to the trust store — never
+* `rejectUnauthorized: false` — so the peer must still prove its identity, and
+* the verified name stays the host of the origin, which is the name the app
+* dials as well (Node matches IP literals against `IP Address:` SANs).
+*
+* A non-200 answer resolves `undefined` for retry; discovery requires a body.
+* transport, TLS, and timeout failures reject so the caller keeps retrying.
+* The request stays cancellable until the bounded response body has completed.
+*/
+function requestDiscovery(target, signal) {
+	if (signal.aborted) return Promise.reject(/* @__PURE__ */ new Error("frp_discovery_aborted"));
+	const url = new URL(`${target.origin}/mobile-access/discovery`);
+	if (url.protocol !== "https:" || url.hostname === "") return Promise.reject(/* @__PURE__ */ new Error("frp_discovery_invalid"));
+	return new Promise((resolveRequest, rejectRequest) => {
+		let settled = false;
+		let request;
+		const release = () => {
+			clearTimeout(timeout);
+			signal.removeEventListener("abort", onAbort);
+		};
+		const fail = (error) => {
+			if (settled) return;
+			settled = true;
+			release();
+			request?.destroy();
+			rejectRequest(error);
+		};
+		const succeed = (value) => {
+			if (settled) return;
+			settled = true;
+			release();
+			resolveRequest(value);
+		};
+		const onAbort = () => {
+			fail(/* @__PURE__ */ new Error("frp_discovery_aborted"));
+		};
+		const timeout = setTimeout(() => {
+			fail(/* @__PURE__ */ new Error("frp_discovery_timeout"));
+		}, DISCOVERY_REQUEST_TIMEOUT_MS);
+		timeout.unref();
+		signal.addEventListener("abort", onAbort, { once: true });
+		request = request$1({
+			host: url.hostname,
+			port: url.port === "" ? 443 : Number(url.port),
+			path: url.pathname,
 			method: "GET",
-			redirect: "error",
-			cache: "no-store",
-			signal: requestController.signal,
-			headers: { accept: "application/json" }
+			headers: { accept: "application/json" },
+			...target.trustAnchorPem === void 0 ? {} : { ca: target.trustAnchorPem },
+			agent: false
+		}, (message) => {
+			if ((message.statusCode ?? 0) !== 200) {
+				succeed(void 0);
+				message.destroy();
+				return;
+			}
+			boundedResponseBytes(discoveryResponse(message)).then(succeed, fail);
 		});
-		if (!response.ok) return false;
-		let value;
-		try {
-			value = JSON.parse(new TextDecoder().decode(await boundedResponseBytes(response)));
-		} catch {
-			throw new Error("frp_discovery_invalid");
-		}
-		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_discovery_invalid");
-		const actual = value.instanceId;
-		if (typeof actual !== "string") throw new Error("frp_discovery_invalid");
-		if (actual !== expectedInstanceId) throw new Error("frp_discovery_mismatch");
-		return true;
-	} finally {
-		clearTimeout(timeout);
-		signal.removeEventListener("abort", abort);
+		request.once("error", (error) => {
+			fail(error instanceof Error ? error : /* @__PURE__ */ new Error("frp_discovery_request_failed"));
+		});
+		request.end();
+	});
+}
+/**
+* Read the public discovery advertisement and compare it with the expected
+* identity.
+*
+* `frp_discovery_invalid` (malformed body) and `frp_discovery_mismatch` (the
+* entry advertises another identity) stay immediate failures; transport, TLS,
+* and timeout problems reject so the caller retries until its deadline.
+*/
+async function defaultProbeDiscovery(target, expectedInstanceId, signal) {
+	const bytes = await requestDiscovery(target, signal);
+	if (bytes === void 0) return false;
+	let value;
+	try {
+		value = JSON.parse(new TextDecoder().decode(bytes));
+	} catch {
+		throw new Error("frp_discovery_invalid");
 	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("frp_discovery_invalid");
+	const actual = value.instanceId;
+	if (typeof actual !== "string") throw new Error("frp_discovery_invalid");
+	if (actual !== expectedInstanceId) throw new Error("frp_discovery_mismatch");
+	return true;
 }
 /** Owns frpc, its generation-specific configuration, and the remote gateway. */
 var FrpController = class {
@@ -6145,10 +7716,12 @@ var FrpController = class {
 	});
 	queue = Promise.resolve();
 	startupAbort;
+	ingressCertificateTimer;
 	constructor(options) {
 		this.options = options;
 		if (!isAbsolute(options.executable)) throw new Error("frpc executable path must be absolute");
 		if (!/^[a-f0-9]{64}$/u.test(options.instanceId)) throw new Error("FRP instance ID is invalid");
+		if (options.ingressCertificateCheckMs !== void 0 && (!Number.isSafeInteger(options.ingressCertificateCheckMs) || options.ingressCertificateCheckMs < 1 || options.ingressCertificateCheckMs > 2147483647)) throw new Error("frp_ingress_check_interval_invalid");
 	}
 	/** Restore the remembered FRP switch without changing LAN or other providers. */
 	async initialize() {
@@ -6268,41 +7841,45 @@ var FrpController = class {
 			});
 			return;
 		}
+		const entryOrigin = frpEntryOrigin(settings);
 		this.publish({
 			enabled: true,
 			state: "starting",
-			origin: settings.publicOrigin
+			origin: entryOrigin
 		});
-		let exposed;
-		try {
-			exposed = await (this.options.probeVhostExposure ?? defaultProbeVhostExposure)(settings.serverAddress, FRP_VHOST_HTTP_PORT);
-		} catch {
-			this.publish({
-				enabled: true,
-				state: "error",
-				origin: settings.publicOrigin,
-				errorCode: "frp_vhost_probe_failed"
-			});
-			return;
-		}
-		if (exposed) {
-			this.publish({
-				enabled: true,
-				state: "error",
-				origin: settings.publicOrigin,
-				errorCode: "frp_vhost_publicly_reachable"
-			});
-			return;
+		if (!isFrpSelfSignedIngress(settings)) {
+			let exposed;
+			try {
+				exposed = await (this.options.probeVhostExposure ?? defaultProbeVhostExposure)(settings.serverAddress, resolveFrpVhostHttpPort(settings));
+			} catch {
+				this.publish({
+					enabled: true,
+					state: "error",
+					origin: entryOrigin,
+					errorCode: "frp_vhost_probe_failed"
+				});
+				return;
+			}
+			if (exposed) {
+				this.publish({
+					enabled: true,
+					state: "error",
+					origin: entryOrigin,
+					errorCode: "frp_vhost_publicly_reachable"
+				});
+				return;
+			}
 		}
 		let gateway;
 		try {
-			gateway = await this.options.createGateway(settings.publicOrigin);
-		} catch {
+			gateway = await this.options.createGateway(settings.publicOrigin, settings);
+		} catch (error) {
+			const code = error instanceof Error && error.message.startsWith("frp_") ? error.message : "gateway_start_failed";
 			this.publish({
 				enabled: true,
 				state: "error",
-				origin: settings.publicOrigin,
-				errorCode: "gateway_start_failed"
+				origin: entryOrigin,
+				errorCode: code
 			});
 			return;
 		}
@@ -6341,26 +7918,66 @@ var FrpController = class {
 		this.publish({
 			enabled: true,
 			state: "connecting",
-			origin: settings.publicOrigin
+			origin: entryOrigin
 		});
+		let check;
+		try {
+			check = await this.discoveryCheck(settings);
+		} catch (error) {
+			const code = error instanceof Error && error.message.startsWith("frp_") ? error.message : "frp_ingress_ca_invalid";
+			await this.failGeneration(generation, code);
+			return;
+		}
+		if (generation !== this.generation || !this.enabled) return;
 		const controller = new AbortController();
 		this.startupAbort = controller;
-		this.waitForDiscovery(generation, settings.publicOrigin, controller.signal);
+		this.waitForDiscovery(generation, check, gateway.config.instanceId, settings, gateway, controller.signal);
+	}
+	/**
+	* Derive the self-check target and trust anchor for the effective entry.
+	*
+	* The public-CA entry is reached on the saved origin itself: Caddy terminates
+	* TLS on 443 with a publicly trusted certificate, so the probe must keep the
+	* system trust store and the origin URL untouched. The self-signed entry is a
+	* raw TCP passthrough on `publicPort` whose leaf chains to the ingress CA the
+	* app pins from `pairingCaFile`; probing `publicOrigin` there would knock on
+	* 443 — where nothing listens — with a chain the system cannot verify. Both
+	* facts used to be implicit, and together they kept the channel out of `ready`
+	* until `frp_start_timeout`.
+	*/
+	async discoveryCheck(settings) {
+		if (!isFrpSelfSignedIngress(settings)) return {
+			publicOrigin: settings.publicOrigin,
+			targetOrigin: settings.publicOrigin
+		};
+		const targetOrigin = frpEntryOrigin(settings);
+		const trustAnchorPem = await this.options.resolveDiscoveryTrustAnchor?.(settings);
+		if (this.options.resolveDiscoveryTrustAnchor !== void 0 && trustAnchorPem === void 0) throw new Error("frp_ingress_ca_invalid");
+		return Object.freeze({
+			publicOrigin: targetOrigin,
+			targetOrigin,
+			...trustAnchorPem === void 0 ? {} : { trustAnchorPem }
+		});
 	}
-	async waitForDiscovery(generation, origin, signal) {
+	async waitForDiscovery(generation, check, advertisedInstanceId, settings, gateway, signal) {
 		const deadline = Date.now() + (this.options.startTimeoutMs ?? START_TIMEOUT_MS$2);
 		const probe = this.options.probeDiscovery ?? defaultProbeDiscovery;
+		const target = Object.freeze({
+			origin: check.targetOrigin,
+			...check.trustAnchorPem === void 0 ? {} : { trustAnchorPem: check.trustAnchorPem }
+		});
 		while (!signal.aborted && Date.now() < deadline) {
 			try {
-				if (await probe(origin, this.options.instanceId, signal)) {
+				if (await probe(target, advertisedInstanceId, signal)) {
 					await this.enqueue(async () => {
 						if (generation !== this.generation || signal.aborted || !this.enabled) return;
 						this.startupAbort = void 0;
 						this.publish({
 							enabled: true,
 							state: "ready",
-							origin
+							origin: check.publicOrigin
 						});
+						this.scheduleIngressCertificateCheck(generation, settings, gateway);
 					});
 					return;
 				}
@@ -6387,6 +8004,33 @@ var FrpController = class {
 		}
 		if (!signal.aborted) await this.enqueue(() => this.failGeneration(generation, "frp_start_timeout"));
 	}
+	scheduleIngressCertificateCheck(generation, settings, gateway) {
+		const maintain = this.options.maintainIngressCertificate;
+		if (!isFrpSelfSignedIngress(settings) || maintain === void 0) return;
+		const timer = setTimeout(() => {
+			if (this.ingressCertificateTimer !== timer) return;
+			this.ingressCertificateTimer = void 0;
+			this.enqueue(async () => {
+				if (generation !== this.generation || !this.enabled || this.disposed || this.gatewayValue !== gateway) return;
+				try {
+					await maintain(settings, gateway);
+				} catch (error) {
+					const code = error instanceof Error && error.message.startsWith("frp_") ? error.message : "frp_ingress_renewal_failed";
+					await this.failGeneration(generation, code);
+					return;
+				}
+				if (generation === this.generation && this.enabled && !this.disposed && this.gatewayValue === gateway) this.scheduleIngressCertificateCheck(generation, settings, gateway);
+			}).catch(() => {
+				if (generation === this.generation && this.enabled && !this.disposed) this.publish({
+					enabled: true,
+					state: "error",
+					errorCode: "frp_ingress_renewal_failed"
+				});
+			});
+		}, this.options.ingressCertificateCheckMs ?? INGRESS_CERT_CHECK_MS);
+		timer.unref();
+		this.ingressCertificateTimer = timer;
+	}
 	async failGeneration(generation, code) {
 		if (generation !== this.generation) return;
 		await this.stopProcessAndGateway();
@@ -6401,6 +8045,8 @@ var FrpController = class {
 		await this.stopProcessAndGateway();
 	}
 	async stopProcessAndGateway() {
+		clearTimeout(this.ingressCertificateTimer);
+		this.ingressCertificateTimer = void 0;
 		this.startupAbort?.abort();
 		this.startupAbort = void 0;
 		const child = this.child;
@@ -7981,21 +9627,212 @@ function defaultFirewallProbe(platform = process.platform) {
 		}
 	};
 }
-/** Allow remote relays enough time to answer without making diagnostics unbounded. */
-function remoteDiagnosticTimeoutMs(origin) {
-	const hostname = new URL(origin).hostname.toLowerCase();
-	if (hostname.endsWith(".ts.net") || hostname.includes(".cpolar.")) return 1e4;
-	return 1e4;
+/** Reserve one six-second window per egress so the desktop's 15-second request can finish. */
+function remoteDiagnosticTimeoutMs(_origin) {
+	return 6e3;
+}
+const TUNNEL_HEADER_LIMIT_BYTES = 65536;
+function proxyExcludedByNoProxy(target, raw) {
+	const text = raw.trim().toLowerCase();
+	if (text === "") return false;
+	const hostname = target.hostname.toLowerCase();
+	const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+	const targetPort = target.port === "" ? target.protocol === "https:" ? 443 : 80 : Number(target.port);
+	for (const entry of text.split(/[\s,]+/)) {
+		let value = entry;
+		if (value === "") continue;
+		if (value === "*") return true;
+		if (value.includes("/")) continue;
+		let port;
+		if (value.startsWith("[")) {
+			const bracket = value.indexOf("]");
+			if (bracket < 0) continue;
+			const tail = value.slice(bracket + 1);
+			if (tail !== "") {
+				if (!/^:\d+$/u.test(tail)) continue;
+				port = Number(tail.slice(1));
+			}
+			value = value.slice(1, bracket);
+		} else if ((value.match(/:/gu) ?? []).length === 1) {
+			const separator = value.lastIndexOf(":");
+			const suffix = value.slice(separator + 1);
+			if (!/^\d+$/u.test(suffix)) continue;
+			port = Number(suffix);
+			value = value.slice(0, separator);
+		}
+		if (port !== void 0 && port !== targetPort) continue;
+		if (value.startsWith("*.")) value = value.slice(2);
+		else if (value.startsWith(".")) value = value.slice(1);
+		if (value === "") continue;
+		if (host === value || host.endsWith(`.${value}`)) return true;
+	}
+	return false;
+}
+/**
+* Resolve the relay egress configured in the environment for `origin`.
+*
+* Honors `HTTPS_PROXY` (then `ALL_PROXY`, then the generic `HTTP_PROXY`) for an
+* HTTPS target, and `http_proxy`/`HTTP_PROXY`/`ALL_PROXY` for a plain one, unless
+* `NO_PROXY`/`no_proxy` covers the host. Only a plain `http://<host>:<port>`
+* relay is usable: SOCKS or a TLS-to-proxy configuration would need a different
+* tunnel, so absent that the probe keeps its direct semantics.
+*/
+function configuredProxyFor(origin, env = process.env) {
+	let target;
+	try {
+		target = new URL(origin);
+	} catch {
+		return;
+	}
+	if (proxyExcludedByNoProxy(target, env.NO_PROXY ?? env.no_proxy ?? "")) return void 0;
+	const candidates = target.protocol === "https:" ? [
+		env.https_proxy ?? env.HTTPS_PROXY,
+		env.all_proxy ?? env.ALL_PROXY,
+		env.http_proxy ?? env.HTTP_PROXY
+	] : [env.http_proxy ?? env.HTTP_PROXY, env.all_proxy ?? env.ALL_PROXY];
+	for (const candidate of candidates) {
+		if (typeof candidate !== "string" || candidate.trim() === "") continue;
+		try {
+			const proxy = new URL(candidate.trim());
+			if (proxy.protocol !== "http:" || proxy.hostname === "") continue;
+			return proxy;
+		} catch {
+			continue;
+		}
+	}
+}
+/** One reachability probe through an HTTP relay: CONNECT, TLS, then a status line. */
+async function relayProbeThroughProxy(target, proxy, budgetMs = remoteDiagnosticTimeoutMs(target.origin)) {
+	const started = performance.now();
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let hopRequest;
+		let rawSocket;
+		let secureSocket;
+		let timer;
+		const finish = (outcome) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			secureSocket?.destroy();
+			rawSocket?.end();
+			rawSocket?.destroy();
+			hopRequest?.destroy();
+			if (outcome.error !== void 0) reject(outcome.error);
+			else resolve(outcome.value ?? {
+				status: 0,
+				latencyMs: 0
+			});
+		};
+		timer = setTimeout(() => {
+			finish({ error: /* @__PURE__ */ new Error("proxy_tunnel_timeout") });
+		}, Math.max(1, budgetMs));
+		timer.unref();
+		const hopPort = target.port === "" ? target.protocol === "https:" ? 443 : 80 : Number(target.port);
+		const hopPath = `${target.hostname}:${hopPort}`;
+		const headers = {
+			host: hopPath,
+			"proxy-connection": "keep-alive"
+		};
+		if (proxy.username !== "") headers["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`, "utf8").toString("base64")}`;
+		hopRequest = request({
+			host: proxy.hostname,
+			port: proxy.port === "" ? 80 : Number(proxy.port),
+			method: "CONNECT",
+			path: hopPath,
+			headers,
+			agent: false
+		});
+		hopRequest.once("connect", (response, socket) => {
+			if (settled) {
+				socket.destroy();
+				return;
+			}
+			rawSocket = socket;
+			if (response.statusCode !== 200) {
+				finish({ error: /* @__PURE__ */ new Error(`proxy_tunnel_rejected_${response.statusCode ?? "unknown"}`) });
+				return;
+			}
+			const secure = connect$1({
+				socket,
+				servername: target.hostname,
+				rejectUnauthorized: true
+			});
+			secureSocket = secure;
+			secure.once("secureConnect", () => {
+				if (settled) return;
+				secure.write([
+					`GET ${target.pathname}${target.search} HTTP/1.1`,
+					`Host: ${target.host}`,
+					"User-Agent: dsh-mobile-diagnostics",
+					"Accept-Encoding: identity",
+					"Connection: close",
+					"",
+					""
+				].join("\r\n"));
+			});
+			let buffered = Buffer.alloc(0);
+			secure.on("data", (chunk) => {
+				buffered = Buffer.concat([buffered, chunk]);
+				if (buffered.byteLength > TUNNEL_HEADER_LIMIT_BYTES) {
+					finish({ error: /* @__PURE__ */ new Error("proxy_tunnel_oversized_response") });
+					return;
+				}
+				const end = buffered.indexOf("\r\n\r\n");
+				if (end < 0) return;
+				const statusLine = /^HTTP\/\d(?:\.\d)?\s+(\d{3})/u.exec(buffered.subarray(0, end).toString("latin1"))?.[1];
+				const status = Number.parseInt(statusLine ?? "", 10);
+				if (!Number.isSafeInteger(status) || status < 100) {
+					finish({ error: /* @__PURE__ */ new Error("proxy_tunnel_invalid_response") });
+					return;
+				}
+				finish({ value: {
+					status,
+					latencyMs: Math.max(0, Math.round(performance.now() - started))
+				} });
+			});
+			secure.once("error", (error) => {
+				finish({ error });
+			});
+			secure.once("close", () => {
+				finish({ error: /* @__PURE__ */ new Error("proxy_tunnel_closed") });
+			});
+		});
+		hopRequest.once("error", (error) => {
+			finish({ error });
+		});
+		hopRequest.end();
+	});
+}
+/** Bounded supplementary DNS context for a failed direct attempt. */
+async function unreachableWithDnsContext(hostname, budgetMs) {
+	let fakeIp = false;
+	let timer;
+	try {
+		fakeIp = (await Promise.race([lookup(hostname, { all: true }), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => {
+				reject(/* @__PURE__ */ new Error("dns_context_timeout"));
+			}, Math.max(1, budgetMs));
+			timer.unref();
+		})])).some(({ address }) => {
+			const [first, second] = address.split(".").map(Number);
+			return first === 198 && (second === 18 || second === 19);
+		});
+	} catch {} finally {
+		clearTimeout(timer);
+	}
+	return {
+		state: "unreachable",
+		...fakeIp ? { fakeIp: true } : {}
+	};
 }
-async function defaultRemoteProbe(origin) {
-	if (origin === void 0) return { state: "not-applicable" };
-	const hostname = new URL(origin).hostname;
+async function fetchRemoteHealth(target, budgetMs) {
 	const started = performance.now();
 	try {
-		const response = await fetch(new URL("/mobile-access/health", origin), {
+		const response = await fetch(target, {
 			cache: "no-store",
 			redirect: "error",
-			signal: AbortSignal.timeout(remoteDiagnosticTimeoutMs(origin))
+			signal: AbortSignal.timeout(Math.max(1, budgetMs - 500))
 		});
 		const latencyMs = Math.max(0, Math.round(performance.now() - started));
 		if (response.status === 429) return {
@@ -8010,19 +9847,53 @@ async function defaultRemoteProbe(origin) {
 			latencyMs
 		};
 	} catch {
-		let fakeIp = false;
-		try {
-			fakeIp = (await lookup(hostname, { all: true })).some(({ address }) => {
-				const [first, second] = address.split(".").map(Number);
-				return first === 198 && (second === 18 || second === 19);
-			});
-		} catch {}
-		return {
-			state: "unreachable",
-			...fakeIp ? { fakeIp: true } : {}
+		return unreachableWithDnsContext(target.hostname, Math.max(1, budgetMs - (performance.now() - started)));
+	}
+}
+/**
+* Answer "is the public endpoint reachable" from the machine's own egress.
+*
+* A direct attempt stays authoritative first. When it fails and the environment
+* configures an HTTP relay that `NO_PROXY` does not exclude, one tunnelled
+* attempt runs: a self-managed Funnel origin otherwise resolves to this
+* machine's tailnet address, where nothing serves the funnel port locally, so
+* the direct measurement reports an outage while the relay's egress — the same
+* public path a phone takes — still succeeds. When both fail, the original
+* direct observation (including its Fake-IP context) stands unchanged.
+*/
+async function probeRemoteHealth(origin, options = {}) {
+	if (origin === void 0) return { state: "not-applicable" };
+	let target;
+	try {
+		target = new URL("/mobile-access/health", origin);
+	} catch {
+		return { state: "not-applicable" };
+	}
+	const budgetMs = remoteDiagnosticTimeoutMs(origin);
+	const observation = await (options.direct ?? fetchRemoteHealth)(target, budgetMs);
+	if (observation.state !== "unreachable") return observation;
+	const relay = configuredProxyFor(origin, options.env ?? process.env);
+	if (relay === void 0) return observation;
+	const tunnel = options.tunnel ?? relayProbeThroughProxy;
+	try {
+		const { status, latencyMs } = await tunnel(target, relay, budgetMs);
+		if (status === 429) return {
+			state: "rate-limited",
+			latencyMs,
+			viaProxy: true
 		};
+		return status >= 200 && status < 300 ? {
+			state: "ready",
+			latencyMs,
+			viaProxy: true
+		} : observation;
+	} catch {
+		return observation;
 	}
 }
+async function defaultRemoteProbe(origin) {
+	return probeRemoteHealth(origin);
+}
 function reportLine(entry) {
 	return `[${entry.status.toUpperCase()}] ${entry.label}: ${entry.detail}${entry.action === void 0 ? "" : ` ${entry.action}`}`;
 }
@@ -8052,10 +9923,11 @@ async function collectConnectionDiagnostics(snapshot, probes = {}) {
 		const facts = {
 			provider: snapshot.remote.provider,
 			endpointSuffix,
-			...remoteObservation.latencyMs === void 0 ? {} : { latencyMs: remoteObservation.latencyMs }
+			...remoteObservation.latencyMs === void 0 ? {} : { latencyMs: remoteObservation.latencyMs },
+			...remoteObservation.viaProxy === true ? { viaProxy: true } : {}
 		};
-		if (remoteObservation.state === "ready") checks.push(check("remote", "ok", "remote-ready", "远程通道", `${snapshot.remote.provider} 公共地址 ${endpointSuffix} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`, void 0, facts));
-		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "remote-rate-limited", "远程通道", "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。", facts));
+		if (remoteObservation.state === "ready") checks.push(check("remote", remoteObservation.viaProxy === true ? "warning" : "ok", "remote-ready", "远程通道", remoteObservation.viaProxy === true ? `电脑经代理可访问 ${endpointSuffix}，但尚未验证手机能否连接。` : `${snapshot.remote.provider} 公共地址 ${endpointSuffix} 可达，往返约 ${String(remoteObservation.latencyMs ?? 0)} ms。`, remoteObservation.viaProxy === true ? "请在手机上测试远程连接。" : void 0, facts));
+		else if (remoteObservation.state === "rate-limited") checks.push(check("remote", "warning", "remote-rate-limited", "远程通道", remoteObservation.viaProxy === true ? "电脑经代理访问时观察到限流，尚未验证手机能否连接。" : "公共地址可达，但本次检查观察到服务限流。", "稍后重试；旧会话会按需加载以减少流量。", facts));
 		else if (snapshot.remote.provider === "tailscale" && remoteObservation.fakeIp === true) checks.push(check("remote", "error", "remote-fake-ip", "远程通道", "Tailscale 地址被当前 VPN 或 DNS 代理接管，但 TLS 链路未建立。", "切换 VPN 节点或代理模式；仍失败时改用 cpolar。", facts));
 		else checks.push(check("remote", "error", "remote-unreachable", "远程通道", "提供方显示已就绪，但公共地址暂不可达。", "点击“重新连接”；仍失败时检查提供方状态。", facts));
 	} else if (snapshot.remote.state === "starting" || snapshot.remote.state === "connecting" || snapshot.remote.state === "needs-login") {
@@ -10618,394 +12490,76 @@ var PluginReleaseManager = class {
 		return status;
 	}
 	/** Install the latest npm release into the active profile, then require a DSH restart. */
-	async update() {
-		if (this.activeUpdate !== void 0) return this.activeUpdate;
-		this.activeUpdate = this.updateOnce();
-		try {
-			return await this.activeUpdate;
-		} finally {
-			this.activeUpdate = void 0;
-		}
-	}
-	async updateOnce() {
-		const profileDirectory = this.profileDirectory;
-		if (profileDirectory === void 0) throw new Error("plugin_update_unsupported");
-		const status = await this.status(true);
-		if (!status.updateSupported) throw new Error("plugin_update_unsupported");
-		if (!status.updateAvailable || status.latestVersion === void 0) throw new Error("plugin_update_unavailable");
-		await this.runner(profileDirectory, status.latestVersion);
-		const installed = await this.installedVersionReader(profileDirectory);
-		if (installed !== status.latestVersion) throw new Error("plugin_update_failed");
-		this.cache = void 0;
-		return Object.freeze({
-			installedVersion: installed,
-			restartRequired: true
-		});
-	}
-};
-//#endregion
-//#region src/file-logger.ts
-const MAX_LOG_BYTES = 5242880;
-/** Install a plugin-scoped Cordis exporter backed by a private UTF-8 log file. */
-async function installMobileFileLogger(ctx, stateDirectory) {
-	const directory = join(stateDirectory, "logs");
-	const file = join(directory, "dsh-mobile.log");
-	const previous = `${file}.1`;
-	await mkdir(directory, {
-		recursive: true,
-		mode: 448
-	});
-	const entry = await lstat(file).catch(() => void 0);
-	if (entry !== void 0 && entry.isFile() && !entry.isSymbolicLink() && entry.size >= MAX_LOG_BYTES) {
-		await rm(previous, { force: true });
-		await rename(file, previous);
-	}
-	const stream = createWriteStream(file, {
-		flags: "a",
-		encoding: "utf8",
-		mode: 384
-	});
-	const exporter = {
-		colors: false,
-		maxLength: 16384,
-		levels: {
-			default: -1,
-			"dsh-mobile": 3
-		},
-		export(message) {
-			if (message.name !== "dsh-mobile") return;
-			const record = {
-				timestamp: new Date(message.ts).toISOString(),
-				level: message.type,
-				logger: message.name,
-				message: Logger.format(exporter, message)
-			};
-			stream.write(`${JSON.stringify(record)}\n`);
-		}
-	};
-	ctx.logger.exporter(exporter);
-	ctx.effect(() => () => {
-		stream.end();
-	}, "dsh-mobile file logger");
-	return file;
-}
-//#endregion
-//#region src/managed-setup.ts
-const VIRTUAL_INTERFACE_MARKERS = [
-	"bridge",
-	"docker",
-	"hyper-v",
-	"mihomo",
-	"radmin",
-	"tailscale",
-	"tap",
-	"tun",
-	"utun",
-	"vbox",
-	"veth",
-	"virtual",
-	"vmware",
-	"vpn",
-	"vethernet",
-	"wsl",
-	"zerotier"
-];
-/** Route inspection is advisory; never let a system command hold setup open indefinitely. */
-const ROUTE_COMMAND_TIMEOUT_MS = 5e3;
-function requiredString(value, name) {
-	if (typeof value !== "string" || value.length === 0) throw new Error(`${name} must be a non-empty string`);
-	return value;
-}
-/** Validate the durable managed setup before it controls network and filesystem operations. */
-function parseManagedSetup(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("mobile setup file must be an object");
-	const record = value;
-	if (record.version !== 2 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || ![
-		"version",
-		"networkInterface",
-		"listenPort",
-		"upstreamOrigin",
-		"tls"
-	].includes(key))) throw new Error("mobile setup file has an unsupported format");
-	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
-	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
-	const tls = record.tls;
-	if (tls.mode !== "managed" || Reflect.ownKeys(tls).some((key) => typeof key !== "string" || ![
-		"mode",
-		"caCertFile",
-		"caKeyFile",
-		"certFile",
-		"keyFile"
-	].includes(key))) throw new Error("mobile setup tls has an unsupported format");
-	return Object.freeze({
-		version: 2,
-		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
-		listenPort: record.listenPort,
-		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
-		tls: Object.freeze({
-			mode: "managed",
-			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
-			caKeyFile: requiredString(tls.caKeyFile, "mobile setup tls.caKeyFile"),
-			certFile: requiredString(tls.certFile, "mobile setup tls.certFile"),
-			keyFile: requiredString(tls.keyFile, "mobile setup tls.keyFile")
-		})
-	});
-}
-function privateIpv4(value) {
-	const parts = value.split(".").map(Number);
-	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
-}
-function networkCidr(address, cidr) {
-	const prefix = Number(cidr.slice(cidr.lastIndexOf("/") + 1));
-	const network = (address.split(".").reduce((total, part) => (total << 8 | Number(part)) >>> 0, 0) & (prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0)) >>> 0;
-	return `${[
-		24,
-		16,
-		8,
-		0
-	].map((shift) => network >>> shift & 255).join(".")}/${String(prefix)}`;
-}
-/** List current private IPv4 candidates with their interface identity. */
-function availableLanNetworks(table = networkInterfaces()) {
-	const candidates = Object.entries(table).flatMap(([name, entries]) => (entries ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal && privateIpv4(entry.address) && entry.cidr !== null).map((entry) => ({
-		name,
-		address: entry.address,
-		cidr: networkCidr(entry.address, entry.cidr)
-	})));
-	return [...new Map(candidates.map((entry) => [`${entry.name}\0${entry.address}`, entry])).values()];
-}
-function likelyVirtualInterface(name) {
-	const normalized = name.toLowerCase().replaceAll(/[^a-z0-9]+/gu, " ");
-	return VIRTUAL_INTERFACE_MARKERS.some((marker) => normalized.includes(marker.replaceAll("-", " "))) || /^(?:br|wg)\d*\b/u.test(normalized);
-}
-async function runRouteCommand(file, args) {
-	return (await execFileText(file, [...args], {
-		encoding: "utf8",
-		timeout: ROUTE_COMMAND_TIMEOUT_MS
-	})).stdout;
-}
-function uniqueLines(output) {
-	return [...new Set(output.split(/\r?\n/gu).map((line) => line.trim()).filter(Boolean))];
-}
-/** Return operating-system default-route interfaces in routing preference order. */
-async function preferredLanInterfaceNames(platform = process.platform, run = runRouteCommand) {
-	try {
-		if (platform === "win32") return uniqueLines(await run("powershell.exe", [
-			"-NoProfile",
-			"-NonInteractive",
-			"-Command",
-			[
-				"$routes = Get-NetRoute -AddressFamily IPv4 -DestinationPrefix '0.0.0.0/0' -ErrorAction Stop",
-				"$ranked = $routes | Where-Object { $_.State -eq 'Alive' -and $_.NextHop -ne '0.0.0.0' } | ForEach-Object {",
-				"  $route = $_",
-				"  $adapter = Get-NetAdapter -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
-				"  $ip = Get-NetIPInterface -AddressFamily IPv4 -InterfaceIndex $route.InterfaceIndex -ErrorAction SilentlyContinue",
-				"  if ($adapter -and $ip -and $adapter.Status -eq 'Up' -and $adapter.HardwareInterface -eq $true -and $adapter.Virtual -ne $true) {",
-				"    [pscustomobject]@{ Name = $route.InterfaceAlias; Metric = [int]$route.RouteMetric + [int]$ip.InterfaceMetric }",
-				"  }",
-				"}",
-				"$ranked | Sort-Object Metric | Select-Object -ExpandProperty Name -Unique"
-			].join("; ")
-		]));
-		if (platform === "linux") {
-			const routes = uniqueLines(await run("ip", [
-				"-o",
-				"-4",
-				"route",
-				"show",
-				"default"
-			])).map((line) => ({
-				name: /(?:^|\s)dev\s+(\S+)/u.exec(line)?.[1],
-				metric: Number(/(?:^|\s)metric\s+(\d+)/u.exec(line)?.[1] ?? 0)
-			})).filter((route) => route.name !== void 0 && !likelyVirtualInterface(route.name)).sort((left, right) => left.metric - right.metric);
-			return [...new Set(routes.map((route) => route.name))];
-		}
-		if (platform === "darwin") {
-			const name = /^\s*interface:\s*(\S+)\s*$/mu.exec(await run("route", [
-				"-n",
-				"get",
-				"default"
-			]))?.[1];
-			return name === void 0 || likelyVirtualInterface(name) ? [] : [name];
-		}
-	} catch {}
-	return [];
-}
-/** Select an active LAN, optionally by address or by a previously saved interface name. */
-function selectLanNetwork(requestedAddress, requestedInterface, table, preferredInterfaces = []) {
-	const candidates = availableLanNetworks(table);
-	if (requestedAddress !== void 0) {
-		const match = candidates.find((candidate) => candidate.address === requestedAddress);
-		if (match === void 0) throw new Error(`--address ${requestedAddress} is not an active private LAN address`);
-		return match;
-	}
-	if (requestedInterface !== void 0) {
-		const matches = candidates.filter((candidate) => candidate.name === requestedInterface);
-		if (matches.length === 1) return matches[0];
-		if (matches.length === 0) throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} is not connected`);
-		throw new Error(`saved LAN interface ${JSON.stringify(requestedInterface)} has more than one private IPv4 address`);
+	async update() {
+		if (this.activeUpdate !== void 0) return this.activeUpdate;
+		this.activeUpdate = this.updateOnce();
+		try {
+			return await this.activeUpdate;
+		} finally {
+			this.activeUpdate = void 0;
+		}
 	}
-	if (candidates.length === 1) return candidates[0];
-	if (candidates.length === 0) throw new Error("no active private LAN address was found; connect to Wi-Fi or Ethernet");
-	for (const name of preferredInterfaces) {
-		const matches = candidates.filter((candidate) => candidate.name === name);
-		if (matches.length === 1) return matches[0];
+	async updateOnce() {
+		const profileDirectory = this.profileDirectory;
+		if (profileDirectory === void 0) throw new Error("plugin_update_unsupported");
+		const status = await this.status(true);
+		if (!status.updateSupported) throw new Error("plugin_update_unsupported");
+		if (!status.updateAvailable || status.latestVersion === void 0) throw new Error("plugin_update_unavailable");
+		await this.runner(profileDirectory, status.latestVersion);
+		const installed = await this.installedVersionReader(profileDirectory);
+		if (installed !== status.latestVersion) throw new Error("plugin_update_failed");
+		this.cache = void 0;
+		return Object.freeze({
+			installedVersion: installed,
+			restartRequired: true
+		});
 	}
-	const physicalCandidates = candidates.filter((candidate) => !likelyVirtualInterface(candidate.name));
-	if (physicalCandidates.length === 1) return physicalCandidates[0];
-	throw new Error(`more than one LAN address is active; rerun with --address and one of: ${candidates.map((entry) => `${entry.name}=${entry.address}`).join(", ")}`);
-}
-/**
-* True when the failure came from LAN selection (the configured network is
-* gone, nothing is up, or several are) rather than from config/TLS code.
-* Callers use it to degrade (warn + stay down) instead of failing boot.
-* Pinned to the selectLanNetwork message contract — keep in sync.
-*/
-function isNetworkSelectionError(error) {
-	const message = error instanceof Error ? error.message : String(error ?? "");
-	return message.includes("is not connected") || message.includes("no active private LAN address was found") || message.includes("more than one LAN address is active") || message.includes("has more than one private IPv4 address") || message.includes("is not an active private LAN address");
-}
-function assertMatchingCa(certPem, keyPem) {
-	const certificate = new X509Certificate(certPem);
-	if (!certificate.ca || certificate.subject !== certificate.issuer || !certificate.verify(certificate.publicKey)) throw new Error("managed TLS CA must be a self-signed CA certificate");
-	const privatePublic = createPublicKey(createPrivateKey(keyPem)).export({
-		format: "der",
-		type: "spki"
-	});
-	const certificatePublic = certificate.publicKey.export({
-		format: "der",
-		type: "spki"
-	});
-	if (!privatePublic.equals(certificatePublic)) throw new Error("managed TLS CA certificate and key do not match");
-	if (Date.parse(certificate.validFrom) > Date.now() || Date.parse(certificate.validTo) <= Date.now()) throw new Error("managed TLS CA certificate is not currently valid");
-	return certificate;
-}
-async function atomicWrite(file, contents) {
-	const directory = dirname(file);
+};
+//#endregion
+//#region src/file-logger.ts
+const MAX_LOG_BYTES = 5242880;
+/** Install a plugin-scoped Cordis exporter backed by a private UTF-8 log file. */
+async function installMobileFileLogger(ctx, stateDirectory) {
+	const directory = join(stateDirectory, "logs");
+	const file = join(directory, "dsh-mobile.log");
+	const previous = `${file}.1`;
 	await mkdir(directory, {
 		recursive: true,
 		mode: 448
 	});
-	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
-	await writeFile(temporary, contents, { mode: 384 });
-	await rename(temporary, file);
-	await restrictPrivateFile(file);
-}
-/** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
-async function ensureManagedCa(setup, legacy) {
-	let certPem;
-	let keyPem;
-	try {
-		[certPem, keyPem] = await Promise.all([readFile(setup.caCertFile, "utf8"), readFile(setup.caKeyFile, "utf8")]);
-	} catch (error) {
-		if (error.code !== "ENOENT") throw error;
-		let migrated = false;
-		if (legacy !== void 0) try {
-			[certPem, keyPem] = await Promise.all([readFile(legacy.certFile, "utf8"), readFile(legacy.keyFile, "utf8")]);
-			assertMatchingCa(certPem, keyPem);
-			migrated = true;
-		} catch (legacyError) {
-			if (legacyError.code !== "ENOENT") throw legacyError;
-		}
-		if (!migrated) {
-			const now = /* @__PURE__ */ new Date();
-			const notAfter = new Date(now);
-			notAfter.setFullYear(notAfter.getFullYear() + 5);
-			const generated = await generate([{
-				name: "commonName",
-				value: "DeepSeek Harness Mobile CA"
-			}], {
-				keyType: "ec",
-				curve: "P-256",
-				algorithm: "sha256",
-				notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
-				notAfterDate: notAfter,
-				extensions: [{
-					name: "basicConstraints",
-					cA: true,
-					critical: true
-				}, {
-					name: "keyUsage",
-					digitalSignature: true,
-					keyCertSign: true,
-					cRLSign: true,
-					critical: true
-				}]
-			});
-			certPem = generated.cert;
-			keyPem = generated.private;
-		}
-		if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
-		await Promise.all([atomicWrite(setup.caCertFile, certPem), atomicWrite(setup.caKeyFile, keyPem)]);
+	const entry = await lstat(file).catch(() => void 0);
+	if (entry !== void 0 && entry.isFile() && !entry.isSymbolicLink() && entry.size >= MAX_LOG_BYTES) {
+		await rm(previous, { force: true });
+		await rename(file, previous);
 	}
-	if (certPem === void 0 || keyPem === void 0) throw new Error("managed TLS CA creation did not produce key material");
-	await Promise.all([restrictPrivateFile(setup.caCertFile), restrictPrivateFile(setup.caKeyFile)]);
-	return assertMatchingCa(certPem, keyPem);
-}
-/** Sign and atomically install a server leaf for the interface's current address. */
-async function refreshManagedServerCertificate(setup, address) {
-	await Promise.all([restrictPrivateFile(setup.tls.caCertFile), restrictPrivateFile(setup.tls.caKeyFile)]);
-	const [caCert, caKey] = await Promise.all([readFile(setup.tls.caCertFile, "utf8"), readFile(setup.tls.caKeyFile, "utf8")]);
-	assertMatchingCa(caCert, caKey);
-	const now = /* @__PURE__ */ new Date();
-	const notAfter = new Date(now);
-	notAfter.setDate(notAfter.getDate() + 397);
-	const server = await generate([{
-		name: "commonName",
-		value: "DeepSeek Harness Mobile"
-	}], {
-		keyType: "ec",
-		curve: "P-256",
-		algorithm: "sha256",
-		notBeforeDate: /* @__PURE__ */ new Date(now.getTime() - 3e5),
-		notAfterDate: notAfter,
-		ca: {
-			cert: caCert,
-			key: caKey
-		},
-		extensions: [
-			{
-				name: "basicConstraints",
-				cA: false,
-				critical: true
-			},
-			{
-				name: "keyUsage",
-				digitalSignature: true,
-				critical: true
-			},
-			{
-				name: "extKeyUsage",
-				serverAuth: true
-			},
-			{
-				name: "subjectAltName",
-				altNames: [{
-					type: 7,
-					ip: address
-				}]
-			}
-		]
+	const stream = createWriteStream(file, {
+		flags: "a",
+		encoding: "utf8",
+		mode: 384
 	});
-	await Promise.all([atomicWrite(setup.tls.certFile, server.cert), atomicWrite(setup.tls.keyFile, server.private)]);
-}
-/** Resolve the saved interface to the ordinary gateway config consumed by the Host plugin. */
-async function materializeManagedSetup(setup, table) {
-	const network = selectLanNetwork(void 0, setup.networkInterface, table);
-	await refreshManagedServerCertificate(setup, network.address);
-	const ca = new X509Certificate(await readFile(setup.tls.caCertFile, "utf8"));
-	return {
-		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
-		listenHost: network.address,
-		allowedCidrs: [network.cidr],
-		instanceId: ca.fingerprint256.replaceAll(":", "").toLowerCase(),
-		pairingCaFile: setup.tls.caCertFile,
-		tls: {
-			mode: "provided",
-			certFile: setup.tls.certFile,
-			keyFile: setup.tls.keyFile
+	const exporter = {
+		colors: false,
+		maxLength: 16384,
+		levels: {
+			default: -1,
+			"dsh-mobile": 3
+		},
+		export(message) {
+			if (message.name !== "dsh-mobile") return;
+			const record = {
+				timestamp: new Date(message.ts).toISOString(),
+				level: message.type,
+				logger: message.name,
+				message: Logger.format(exporter, message)
+			};
+			stream.write(`${JSON.stringify(record)}\n`);
 		}
 	};
+	ctx.logger.exporter(exporter);
+	ctx.effect(() => () => {
+		stream.end();
+	}, "dsh-mobile file logger");
+	return file;
 }
 //#endregion
 //#region src/lan-setup.ts
@@ -11269,6 +12823,56 @@ function remoteGatewayConfig(template, publicOrigin, stateFile, instanceId, list
 		discovery: false
 	});
 }
+/**
+* Gateway config for the self-signed FRP ingress.
+*
+* Unlike {@link remoteGatewayConfig}, the gateway itself is the TLS endpoint:
+* frps only forwards raw TCP, so the listener speaks HTTPS with the leaf that
+* `pairingCaFile` signed, and the pairing CA is deliberately retained so the
+* gateway can serve `GET /mobile-access/ca.cer` for the app to pin. The listener
+* stays on loopback because the public entry is the frps TCP proxy, never a
+* direct bind.
+*/
+function frpIngressGatewayConfig(template, settings, stateFile, ingress, listenPort = 0) {
+	if (!isFrpSelfSignedIngress(settings)) throw new Error("frp_entry_tls_invalid");
+	const publicAuthority = `${new URL(settings.publicOrigin).hostname}:${String(resolveFrpPublicPort(settings))}`;
+	const { pairingCaFile: _templateCaFile, ...shared } = template;
+	return Object.freeze({
+		...shared,
+		listenHost: "127.0.0.1",
+		listenPort,
+		authorities: Object.freeze([parseAuthority(publicAuthority)]),
+		allowedCidrs: Object.freeze([parseCidr("127.0.0.0/8")]),
+		stateFile,
+		instanceId: ingress.caFingerprint,
+		pairingCaFile: ingress.paths.caCertFile,
+		tls: Object.freeze({
+			mode: "provided",
+			certFile: ingress.paths.certFile,
+			keyFile: ingress.paths.keyFile
+		}),
+		publicTls: true,
+		discovery: false
+	});
+}
+/**
+* CA the FRP start-up self-check must pin, read from the ingress directory.
+*
+* The self-signed entry presents a leaf signed by this CA, which is absent from
+* the system trust store, so the probe must anchor it exactly as the app does
+* when it pins `pairingCaFile`. The public-CA entry answers with a publicly
+* trusted certificate and therefore returns `undefined` (system trust store).
+* An unreadable self-signed CA fails explicitly: falling back to the system
+* trust store would hide a broken pairing identity behind a start timeout.
+*/
+async function readFrpIngressTrustAnchor(settings, stateFile) {
+	if (!isFrpSelfSignedIngress(settings)) return void 0;
+	try {
+		return await readFile(frpIngressPaths(stateFile).caCertFile, "utf8");
+	} catch (error) {
+		throw new Error("frp_ingress_ca_invalid", { cause: error });
+	}
+}
 /** Reuse remote HTTPS policy while binding a separately validated private HTTP origin. */
 function originGatewayConfig(template, settings, stateFile, instanceId, listenPort = settings.listenPort) {
 	const validated = parseOriginSettings(settings);
@@ -11463,6 +13067,27 @@ async function apply(ctx, config) {
 		await candidate.start();
 		return candidate;
 	};
+	/**
+	* Gateway factory for the FRP provider.
+	*
+	* The public-CA entry keeps the ordinary Caddy-fronted remote gateway. The
+	* self-signed entry terminates TLS inside the gateway, so it first materializes
+	* a leaf the pairing CA signed for the public IPv4 and then binds the ingress
+	* configuration that keeps that CA pinned.
+	*/
+	const createFrpGateway = async (publicOrigin, settings) => {
+		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
+		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile);
+		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		try {
+			await candidate.start();
+		} catch (error) {
+			await candidate.close();
+			throw error;
+		}
+		return candidate;
+	};
 	const createOriginGateway = async (settings) => {
 		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
@@ -11504,7 +13129,18 @@ async function apply(ctx, config) {
 			executable: frpComponent.executable,
 			config: frpConfig,
 			instanceId,
-			createGateway: createRemoteGateway
+			createGateway: createFrpGateway,
+			/**
+			* Hand the start-up self-check the CA the app itself pins.
+			*
+			* Only this module knows where the ingress material lives, so the anchor is
+			* read here from the ingress directory instead of being guessed downstream.
+			*/
+			resolveDiscoveryTrustAnchor: (settings) => readFrpIngressTrustAnchor(settings, remoteDeviceFile),
+			maintainIngressCertificate: async (settings, gateway) => {
+				await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), gateway.config.instanceId);
+				await gateway.refreshProvidedTls();
+			}
 		}),
 		origin: new OriginController({
 			store: originStore,
@@ -11566,6 +13202,25 @@ async function apply(ctx, config) {
 			networkError = "network_interface_unavailable";
 		}
 		const remote = remoteController().status();
+		const frpOrigin = remote.origin;
+		const frpSettings = remoteProviders.selected === "frp" ? frpConfig.settings() : void 0;
+		const frpGateway = remoteControllers.frp.gateway();
+		const pinnedFrpProbe = frpSettings !== void 0 && isFrpSelfSignedIngress(frpSettings) && frpGateway !== void 0 && frpOrigin !== void 0 ? async () => {
+			try {
+				const trustAnchorPem = await readFrpIngressTrustAnchor(frpSettings, remoteDeviceFile);
+				if (trustAnchorPem === void 0) return { state: "unreachable" };
+				const started = performance.now();
+				return await defaultProbeDiscovery({
+					origin: frpOrigin,
+					trustAnchorPem
+				}, frpGateway.config.instanceId, AbortSignal.timeout(5500)) ? {
+					state: "ready",
+					latencyMs: Math.max(0, Math.round(performance.now() - started))
+				} : { state: "unreachable" };
+			} catch {
+				return { state: "unreachable" };
+			}
+		} : void 0;
 		return collectConnectionDiagnostics({
 			dshVersion,
 			lan: {
@@ -11589,7 +13244,7 @@ async function apply(ctx, config) {
 				...remote.origin === void 0 ? {} : { origin: remote.origin },
 				...remote.errorCode === void 0 ? {} : { errorCode: remote.errorCode }
 			}
-		});
+		}, pinnedFrpProbe === void 0 ? {} : { remote: pinnedFrpProbe });
 	};
 	const adminRoute = {
 		kind: "prefix",
@@ -11767,6 +13422,34 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/frp/attach-plan`) {
+					const settings = mergeSavedFrpSettings(await readJsonObject(request, 8192), frpConfig.settings());
+					const options = { configFile: frpConfig.runtimeConfigFile };
+					logger.info("frp attach plan requested mode=%s entryTls=%s vhostHttpPort=%d", settings.mode ?? "deploy", settings.entryTls ?? "public-ip-cert", resolveFrpVhostHttpPort(settings));
+					sendJson(response, 200, {
+						...remotePayload(),
+						frpAttachPlan: createFrpAttachPlan(settings, options),
+						frpAttachTemplate: createFrpAttachTemplate(settings, options)
+					}, false);
+					return;
+				}
+				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/frp/self-check`) {
+					const settings = frpConfig.settings();
+					if (settings === void 0) throw new HttpError(409, "frp_config_missing");
+					const check = await frpIngressSelfCheck(settings, remoteDeviceFile);
+					const [frpsReachable, entryReachable] = await Promise.all([probeTcpReachable(settings.serverAddress, settings.serverPort), probeTcpReachable(settings.serverAddress, resolveFrpPublicPort(settings))]);
+					sendJson(response, 200, {
+						...remotePayload(),
+						frpSelfCheck: {
+							...check,
+							frpsReachable,
+							entryReachable,
+							frpc: remoteController().status(),
+							component: frpComponent.status()
+						}
+					}, false);
+					return;
+				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/remote/websocket-paths`) {
 					sendJson(response, 200, { paths: webSocketPaths.list() }, false);
 					return;
@@ -11867,7 +13550,11 @@ async function apply(ctx, config) {
 					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
 					await remoteProviders.mutate(async () => {
 						await remoteControllers.frp.setEnabled(false);
-						await Promise.all([frpComponent.purge(), frpConfig.purge()]);
+						await Promise.all([
+							frpComponent.purge(),
+							frpConfig.purge(),
+							purgeFrpIngressCertificates(remoteDeviceFile)
+						]);
 					});
 					sendJson(response, 200, remotePayload(), false);
 					return;
@@ -12010,6 +13697,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, inject, isCloudflaredRegistration, isGloballyRoutableIpv4, isLoopbackAddress, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, resolveAuthority, rewriteMobileIndex, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpPublicOrigin, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map