dsh-mobile 0.5.4 → 0.6.0

package/lib/index.mjs

@@ -70,14 +70,14 @@ var BoundedRateLimiter = class {
 function opaqueToken() {
 	return randomBytes(32).toString("base64url");
 }
-function digest(value) {
+function digest$1(value) {
 	return createHash("sha256").update(value, "utf8").digest();
 }
 function digestHex(value) {
-	return digest(value).toString("hex");
+	return digest$1(value).toString("hex");
 }
 function matchesDigest(value, expected) {
-	return timingSafeEqual(digest(value), expected);
+	return timingSafeEqual(digest$1(value), expected);
 }
 function normalizeLabel(value) {
 	const label = (value ?? "Mobile device").normalize("NFC").trim();
@@ -175,7 +175,7 @@ var AccessController = class {
 		const record = Object.freeze({
 			key,
 			deviceId,
-			csrfDigest: digest(csrfToken),
+			csrfDigest: digest$1(csrfToken),
 			createdAt: now,
 			expiresAt: Math.min(now + this.options.sessionTtlMs, deviceExpiresAt)
 		});
@@ -196,7 +196,7 @@ var AccessController = class {
 			const token = opaqueToken();
 			const expiresAt = this.now() + ttl;
 			this.pairingWindow = Object.freeze({
-				digest: digest(token),
+				digest: digest$1(token),
 				expiresAt
 			});
 			return Object.freeze({
@@ -289,7 +289,7 @@ var AccessController = class {
 	}
 	requireDevice(deviceToken, now) {
 		if (deviceToken.length > 512) throw new AccessError(401, "authentication_failed");
-		const tokenDigest = digest(deviceToken);
+		const tokenDigest = digest$1(deviceToken);
 		const device = this.devices.find((candidate) => timingSafeEqual(Buffer.from(candidate.tokenDigest, "hex"), tokenDigest));
 		if (device === void 0) throw new AccessError(401, "authentication_failed");
 		if (device.revokedAt !== void 0) throw new AccessError(401, "device_revoked");
@@ -904,6 +904,7 @@ const Config = z.object({
 	maxWebSockets: z.natural(),
 	maxBodyBytes: z.natural(),
 	upstreamTimeoutMs: z.natural(),
+	upstreamApiTimeoutMs: z.natural(),
 	rateLimitWindowMs: z.natural(),
 	maxPairingAttempts: z.natural(),
 	maxRateLimitKeys: z.natural()
@@ -1052,6 +1053,7 @@ function parseGatewayConfig(raw) {
 		maxWebSockets: integer(value.maxWebSockets, "maxWebSockets", 16, 1, 256),
 		maxBodyBytes: integer(value.maxBodyBytes, "maxBodyBytes", 167772160, 1024, 268435456),
 		upstreamTimeoutMs: integer(value.upstreamTimeoutMs, "upstreamTimeoutMs", 3e4, 1e3, 3e5),
+		upstreamApiTimeoutMs: integer(value.upstreamApiTimeoutMs, "upstreamApiTimeoutMs", 0, 0, 2147483647),
 		rateLimitWindowMs: integer(value.rateLimitWindowMs, "rateLimitWindowMs", 6e4, 1e3, 36e5),
 		maxPairingAttempts: integer(value.maxPairingAttempts, "maxPairingAttempts", 8, 1, 100),
 		maxRateLimitKeys: integer(value.maxRateLimitKeys, "maxRateLimitKeys", 256, 1, 4096)
@@ -1133,6 +1135,180 @@ async function restrictPrivateFile(file, mode = 384) {
 	});
 }
 //#endregion
+//#region src/client-module-preferences.ts
+const MAX_RECORD_BYTES = 1048576;
+/** Validate untrusted JSON selections; graph membership is checked by the Gateway. */
+function parseExcludedClientModules(value) {
+	if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || id.length === 0 || id.trim() !== id || /[\u0000-\u001f\u007f]/u.test(id))) throw new Error("excluded_client_modules_invalid");
+	const ids = value;
+	if (new Set(ids).size !== ids.length) throw new Error("excluded_client_modules_invalid");
+	return Object.freeze([...ids]);
+}
+function deviceKey(deviceId) {
+	if (!/^[a-f\d]{32}$/u.test(deviceId)) throw new Error("client_module_device_invalid");
+}
+function parseRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("client_module_preferences_invalid");
+	const record = value;
+	if (record.version !== 1 || record.devices === null || typeof record.devices !== "object" || Array.isArray(record.devices) || Object.keys(record).some((key) => ![
+		"version",
+		"computer",
+		"devices"
+	].includes(key))) throw new Error("client_module_preferences_invalid");
+	const devices = {};
+	for (const [id, excluded] of Object.entries(record.devices)) {
+		deviceKey(id);
+		devices[id] = parseExcludedClientModules(excluded);
+	}
+	return Object.freeze({
+		version: 1,
+		devices: Object.freeze(devices),
+		...record.computer === void 0 ? {} : { computer: parseExcludedClientModules(record.computer) }
+	});
+}
+/** Atomic, serialized preferences shared by the LAN and remote Gateway instances. */
+var ClientModulePreferenceStore = class {
+	file;
+	defaults;
+	value = Object.freeze({
+		version: 1,
+		devices: Object.freeze({})
+	});
+	initialization;
+	queue = Promise.resolve();
+	constructor(file, defaults) {
+		this.file = file;
+		if (!isAbsolute(file)) throw new Error("client module preference path must be absolute");
+		this.defaults = parseExcludedClientModules(defaults);
+	}
+	/** Read existing state once. Missing state is not written during initialization. */
+	initialize() {
+		this.initialization ??= this.load();
+		return this.initialization;
+	}
+	async load() {
+		let information;
+		try {
+			information = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		if (!information.isFile() || information.isSymbolicLink() || information.size > MAX_RECORD_BYTES) throw new Error("client module preferences must be a regular file no larger than 1 MiB");
+		this.value = parseRecord(JSON.parse(await readFile(this.file, "utf8")));
+	}
+	selection(deviceId) {
+		if (deviceId !== void 0) deviceKey(deviceId);
+		const computer = this.value.computer ?? this.defaults;
+		const device = deviceId === void 0 ? void 0 : this.value.devices[deviceId];
+		return Object.freeze({
+			excludedClientModules: device ?? computer,
+			defaultExcludedClientModules: computer,
+			source: device !== void 0 ? "device" : this.value.computer !== void 0 ? "computer" : "plugin"
+		});
+	}
+	exclusive(action) {
+		const operation = this.queue.then(action);
+		this.queue = operation.then(() => void 0, () => void 0);
+		return operation;
+	}
+	/** Resolve one device override, otherwise the computer or plugin default. */
+	async read(deviceId) {
+		await this.initialize();
+		return this.exclusive(async () => this.selection(deviceId));
+	}
+	/** Revalidate against the current boot manifest inside the serialized mutation. */
+	async configure(excluded, deviceId, validate) {
+		const ids = parseExcludedClientModules(excluded);
+		if (deviceId !== void 0) deviceKey(deviceId);
+		await this.initialize();
+		return this.exclusive(async () => {
+			await validate(ids);
+			const next = deviceId === void 0 ? {
+				...this.value,
+				computer: ids
+			} : {
+				...this.value,
+				devices: {
+					...this.value.devices,
+					[deviceId]: ids
+				}
+			};
+			await this.save(next);
+			return this.selection(deviceId);
+		});
+	}
+	/** Remove only the selected override; retain all other device selections. */
+	async reset(deviceId, validate) {
+		if (deviceId !== void 0) deviceKey(deviceId);
+		await this.initialize();
+		return this.exclusive(async () => {
+			const devices = { ...this.value.devices };
+			if (deviceId !== void 0) delete devices[deviceId];
+			const next = {
+				version: 1,
+				devices,
+				...deviceId === void 0 || this.value.computer === void 0 ? {} : { computer: this.value.computer }
+			};
+			await validate(deviceId === void 0 ? this.defaults : this.value.computer ?? this.defaults);
+			await this.save(next);
+			return this.selection(deviceId);
+		});
+	}
+	/** Remove exactly the revoked device's record without evaluating its obsolete graph. */
+	removeDevice(deviceId) {
+		return this.removeDevices([deviceId]);
+	}
+	/** Remove an explicit set of revoked identities, not every record in the shared store. */
+	async removeDevices(deviceIds) {
+		for (const deviceId of deviceIds) deviceKey(deviceId);
+		await this.initialize();
+		await this.exclusive(async () => {
+			if (!deviceIds.some((id) => this.value.devices[id] !== void 0)) return;
+			const devices = { ...this.value.devices };
+			for (const deviceId of deviceIds) delete devices[deviceId];
+			await this.save({
+				...this.value,
+				devices
+			});
+		});
+	}
+	async save(record) {
+		const valid = parseRecord(record);
+		const body = `${JSON.stringify(valid)}\n`;
+		if (Buffer.byteLength(body) > MAX_RECORD_BYTES) throw new Error("client_module_preferences_limit");
+		const directory = dirname(this.file);
+		if (await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		}) !== void 0) await restrictPrivateFile(directory, 448);
+		try {
+			const existing = await lstat(this.file);
+			if (!existing.isFile() || existing.isSymbolicLink()) throw new Error("client module preference target must be a regular file");
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		const temporary = join(directory, `.${basename(this.file)}.${randomBytes(12).toString("hex")}.tmp`);
+		try {
+			await writeFile(temporary, body, {
+				encoding: "utf8",
+				flag: "wx",
+				mode: 384
+			});
+			await restrictPrivateFile(temporary);
+			await rename(temporary, this.file);
+			this.value = valid;
+		} catch (error) {
+			try {
+				await rm(temporary, { force: true });
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "client module preference write and temporary cleanup failed");
+			}
+			throw error;
+		}
+	}
+};
+//#endregion
 //#region src/control.ts
 /** Keeps one runtime aligned with a changing network selection. */
 var FollowingMobileAccessRuntime = class {
@@ -1380,6 +1556,88 @@ var MobileAccessGatewayController = class {
 		return run;
 	}
 };
+//#endregion
+//#region src/client-module-recovery.ts
+const CLIENT_MODULE_RECOVERY_COPY = {
+	zh: {
+		title: "移动页面模块需要调整",
+		explanation: "电脑上的插件或依赖关系已变化，之前保存的模块选择无法加载当前页面。",
+		scope: "可为本设备加载全部模块并重新打开 DSH。不会修改电脑默认设置、其他设备或已安装的插件。",
+		action: "为本设备加载全部模块并重试",
+		working: "正在更新本设备的模块选择…",
+		failed: "未能恢复。请确认电脑和远程通道仍在线，然后重试。"
+	},
+	en: {
+		title: "Mobile page modules need attention",
+		explanation: "The computer’s plugins or dependencies have changed. The saved module selection can no longer load this page.",
+		scope: "Load all modules for this device and reopen DSH. Computer defaults, other devices, and installed plugins are unchanged.",
+		action: "Load all modules for this device and retry",
+		working: "Updating this device’s module selection…",
+		failed: "Could not restore the page. Check that the computer and remote connection are online, then retry."
+	},
+	it: {
+		title: "I moduli della pagina mobile richiedono attenzione",
+		explanation: "I plugin o le dipendenze del computer sono cambiati. La selezione salvata non può più caricare questa pagina.",
+		scope: "Carica tutti i moduli per questo dispositivo e riapri DSH. I predefiniti del computer, gli altri dispositivi e i plugin installati non cambiano.",
+		action: "Carica tutti i moduli per questo dispositivo e riprova",
+		working: "Aggiornamento dei moduli per questo dispositivo…",
+		failed: "Ripristino non riuscito. Verifica che il computer e la connessione remota siano online, poi riprova."
+	}
+};
+/** Render an explicit device-only recovery action without interpolating graph diagnostics or credentials.
+* @param locale - Negotiated browser display language.
+* @returns An owned HTML page which changes no selection until the user activates its button.
+*/
+function renderClientModuleRecoveryPage(locale) {
+	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
+	return `<!doctype html>
+<html lang="${locale === "zh" ? "zh-CN" : locale}">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<meta name="color-scheme" content="light dark"><title>${copy.title}</title>
+<style>
+body{margin:0;background:Canvas;color:CanvasText;font:16px/1.5 system-ui,sans-serif}
+main{box-sizing:border-box;max-width:640px;margin:32px auto;padding:24px max(24px,env(safe-area-inset-left)) 24px max(24px,env(safe-area-inset-right));overflow-wrap:anywhere}
+h1{font-size:24px;line-height:1.3}button{min-height:48px;max-width:100%;padding:12px 20px;border:1px solid ButtonText;border-radius:12px;background:ButtonFace;color:ButtonText;font:inherit;cursor:pointer}
+button:focus-visible{outline:2px solid Highlight;outline-offset:3px}button:disabled{opacity:.6;cursor:wait}#recovery-status{min-height:1.5em}
+</style></head>
+<body><main><h1>${copy.title}</h1><p>${copy.explanation}</p><p>${copy.scope}</p>
+<button id="load-all-modules" type="button">${copy.action}</button><p id="recovery-status" role="status" aria-live="polite"></p>
+</main><script>${renderClientModuleRecoveryScript(locale)}<\/script></body></html>
+`;
+}
+/** Render the fixed same-origin action; CSRF values are read from the active browser cookie only at user activation.
+* @param locale - Negotiated browser display language.
+* @returns JavaScript that preserves selections on failure and reloads only after an authorized save succeeds.
+*/
+function renderClientModuleRecoveryScript(locale) {
+	const copy = CLIENT_MODULE_RECOVERY_COPY[locale];
+	return `(() => {
+  const button = document.getElementById('load-all-modules')
+  const status = document.getElementById('recovery-status')
+  button.addEventListener('click', async () => {
+    if (button.disabled) return
+    button.disabled = true
+    status.textContent = ${JSON.stringify(copy.working)}
+    try {
+      const values = document.cookie.split(';').map(value => value.trim())
+      const host = values.filter(value => value.startsWith('__Host-dsh_ma_csrf='))
+      const candidates = host.length === 0 ? values.filter(value => value.startsWith('dsh_ma_csrf=')) : host
+      if (candidates.length !== 1) throw new Error('csrf_unavailable')
+      const csrf = candidates[0].slice(candidates[0].indexOf('=') + 1)
+      const response = await fetch('/mobile-access/client-modules', {
+        method: 'POST', credentials: 'same-origin', redirect: 'error', cache: 'no-store',
+        headers: { 'content-type': 'application/json', 'x-dsh-mobile-csrf': csrf },
+        body: JSON.stringify({ excludedClientModules: [] }),
+      })
+      if (!response.ok) throw new Error('recovery_failed')
+      location.reload()
+    } catch {
+      status.textContent = ${JSON.stringify(copy.failed)}
+      button.disabled = false
+    }
+  })
+})()`;
+}
 function unwrapBrackets(hostname) {
 	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
 }
@@ -1621,10 +1879,8 @@ function commentRanges(html) {
 /**
 * Load the compatibility bundle synchronously, before the first DSH script.
 *
-* Returns the HTML unchanged when there is no script to anchor to. The bundle is an
-* enhancement for WebViews without Iterator helpers, so a document this function
-* cannot place it in must still be served: throwing here took the entire dedicated
-* mobile frontend down with a 502.
+* Returns the HTML unchanged when there is no executable script to anchor to.
+* The bundle supplies missing browser APIs before the page's scripts execute.
 */
 function ensureMobileCompatibility(html) {
 	const comments = commentRanges(html);
@@ -2233,6 +2489,12 @@ function normalizeRoutePath(value) {
 	if (normalizedInput.split("/").some((part) => part === ".." || part === ".")) throw new MobileExtensionError("invalid_route", "extension route path is invalid");
 	return normalizedInput === "/" ? "/" : normalizedInput.replace(/\/+$/u, "");
 }
+/** Validate and snapshot an optional per-operation timeout override. */
+function operationTimeout(value, code) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 3e5) throw new MobileExtensionError(code, "operation timeoutMs is invalid");
+	return value;
+}
 function validateDefinition(definition) {
 	const manifest = parseExtensionManifest({
 		schemaVersion: definition.schemaVersion,
@@ -2242,9 +2504,17 @@ function validateDefinition(definition) {
 		...definition.description === void 0 ? {} : { description: definition.description }
 	});
 	const actionNames = /* @__PURE__ */ new Set();
+	const actions = {};
 	for (const [name, action] of Object.entries(definition.actions ?? {})) {
 		if (!/^[a-z][a-z0-9-]{0,63}$/u.test(name) || action === null || typeof action !== "object" || typeof action.run !== "function" || actionNames.has(name)) throw new MobileExtensionError("invalid_action", `invalid action ${name}`);
 		actionNames.add(name);
+		const actionTimeout = operationTimeout(action.timeoutMs, "invalid_action");
+		const actionInput = action.input;
+		actions[name] = Object.freeze({
+			...actionInput === void 0 ? {} : { input: actionInput },
+			run: action.run.bind(action),
+			...actionTimeout === void 0 ? {} : { timeoutMs: actionTimeout }
+		});
 	}
 	const routeNames = /* @__PURE__ */ new Set();
 	const routes = (definition.routes ?? []).map((route) => {
@@ -2258,11 +2528,14 @@ function validateDefinition(definition) {
 			"PATCH",
 			"DELETE"
 		].includes(method)) throw new MobileExtensionError("invalid_route", "unsupported extension route method");
-		const normalized = {
-			...route,
+		const routeTimeout = operationTimeout(route.timeoutMs, "invalid_route");
+		const normalized = Object.freeze({
 			method,
-			path: normalizeRoutePath(route.path)
-		};
+			path: normalizeRoutePath(route.path),
+			...route.kind === void 0 ? {} : { kind: route.kind },
+			handle: route.handle.bind(route),
+			...routeTimeout === void 0 ? {} : { timeoutMs: routeTimeout }
+		});
 		const key = routeKey(normalized);
 		if (routeNames.has(key)) throw new MobileExtensionError("duplicate_route", `duplicate route ${key}`);
 		routeNames.add(key);
@@ -2270,7 +2543,7 @@ function validateDefinition(definition) {
 	});
 	return Object.freeze({
 		...manifest,
-		...definition.actions === void 0 ? {} : { actions: Object.freeze({ ...definition.actions }) },
+		...definition.actions === void 0 ? {} : { actions: Object.freeze(actions) },
 		...routes.length === 0 ? {} : { routes: Object.freeze(routes) }
 	});
 }
@@ -2315,6 +2588,8 @@ var MobileAccessService = class extends Service {
 	local = /* @__PURE__ */ new Map();
 	retired = /* @__PURE__ */ new Map();
 	failures = /* @__PURE__ */ new Map();
+	/** Extensions with caller-detached, still-unresolved operations. */
+	abandoned = /* @__PURE__ */ new Map();
 	contentListeners = /* @__PURE__ */ new Set();
 	contentHash = createHash("sha256").update("").digest("hex");
 	localRoot;
@@ -2434,30 +2709,65 @@ var MobileAccessService = class extends Service {
 			name: asset.name
 		};
 	}
+	/** Reject new dispatches to an extension whose abandoned work is unresolved. */
+	requireAdmission(id) {
+		if ((this.abandoned.get(id) ?? 0) > 0) throw new MobileExtensionError("extension_busy", `extension ${id} has unresolved abandoned work`, 503);
+	}
+	/** Account for one operation until its underlying work actually settles. */
+	trackOperation(id, operation) {
+		operation.settled.then(() => {
+			if (operation.detached()) {
+				const remaining = (this.abandoned.get(id) ?? 1) - 1;
+				if (remaining <= 0) this.abandoned.delete(id);
+				else this.abandoned.set(id, remaining);
+			}
+		}).catch(() => void 0);
+	}
 	/** Invoke one action after parsing its input and binding the request lifetime. */
 	async invoke(id, actionName, input, context, generation) {
 		const extension = this.extension(id, generation);
 		if (extension === void 0) throw new MobileExtensionError("extension_not_found", "extension not found", 404);
 		const action = ("host" in extension ? extension.host : extension).actions?.[actionName];
 		if (action === void 0) throw new MobileExtensionError("action_not_found", "action not found", 404);
-		let parsed;
+		if ("host" in extension) extension.controller.signal.throwIfAborted();
+		context.signal.throwIfAborted();
+		this.requireAdmission(id);
+		const external = "host" in extension ? combineSignalLifetime(extension.controller.signal, context.signal) : void 0;
+		let operation;
 		try {
-			parsed = parseActionInput(action.input, input);
-		} catch {
-			throw new MobileExtensionError("invalid_action_input", "action input is invalid", 400);
-		}
-		const lifetime = "host" in extension ? combineSignalLifetime(extension.controller.signal, context.signal) : void 0;
-		const signal = lifetime?.signal ?? context.signal;
-		try {
-			return await action.run({
-				...context,
-				signal
-			}, parsed);
+			operation = startBoundedOperation((signal) => {
+				let parsed;
+				try {
+					parsed = parseActionInput(action.input, input);
+				} catch {
+					throw new MobileExtensionError("invalid_action_input", "action input is invalid", 400);
+				}
+				return Promise.resolve(parsed).then((value) => {
+					signal.throwIfAborted();
+					return action.run({
+						...context,
+						signal
+					}, value);
+				}, () => {
+					throw new MobileExtensionError("invalid_action_input", "action input is invalid", 400);
+				});
+			}, {
+				external: external?.signal ?? context.signal,
+				timeoutMs: action.timeoutMs ?? 3e4,
+				timeoutError: () => new MobileExtensionError("extension_action_timeout", `extension ${id} action ${actionName} timed out`, 500),
+				onDetach: () => {
+					this.abandoned.set(id, (this.abandoned.get(id) ?? 0) + 1);
+				}
+			});
+			this.trackOperation(id, operation);
+			return await operation.caller;
 		} catch (error) {
+			if (error instanceof OperationCancelled) throw error.reason;
 			if (error instanceof MobileExtensionError) throw error;
 			throw new MobileExtensionError("extension_failed", "extension action failed", 500);
 		} finally {
-			lifetime?.cleanup();
+			operation?.release();
+			external?.cleanup();
 		}
 	}
 	/** Match one route and invoke it with a generation-bound abort signal. */
@@ -2469,25 +2779,47 @@ var MobileAccessService = class extends Service {
 			return (candidate.kind ?? "exact") === "exact" ? candidate.path === pathname : pathname === candidate.path || pathname.startsWith(`${candidate.path}/`);
 		});
 		if (route === void 0) throw new MobileExtensionError("route_not_found", "route not found", 404);
-		const lifetime = "host" in extension ? combineSignalLifetime(extension.controller.signal, request.signal) : void 0;
-		let releaseLifetime = true;
+		if ("host" in extension) extension.controller.signal.throwIfAborted();
+		request.signal.throwIfAborted();
+		this.requireAdmission(id);
+		const external = "host" in extension ? combineSignalLifetime(extension.controller.signal, request.signal) : void 0;
+		let operation;
+		let holdForStream = false;
 		try {
-			const routeRequest = lifetime === void 0 ? request : {
+			operation = startBoundedOperation((signal) => route.handle({
 				...request,
-				signal: lifetime.signal
-			};
-			const result = await route.handle(routeRequest);
+				signal
+			}), {
+				external: external?.signal ?? request.signal,
+				timeoutMs: route.timeoutMs ?? 3e4,
+				timeoutError: () => new MobileExtensionError("extension_route_timeout", `extension ${id} route ${method} ${pathname} timed out`, 500),
+				onDetach: () => {
+					this.abandoned.set(id, (this.abandoned.get(id) ?? 0) + 1);
+				}
+			});
+			this.trackOperation(id, operation);
+			operation.settled.then(() => {
+				disposeLateExtensionResponse(operation?.lateValue());
+			}).catch(() => void 0);
+			const result = await operation.caller;
 			if (result === null || typeof result !== "object" || typeof result.body !== "string" && !(result.body instanceof Uint8Array) && !isReadable(result.body)) throw new MobileExtensionError("invalid_route_response", "extension returned an invalid response", 500);
-			if (lifetime !== void 0 && isReadable(result.body)) {
-				releaseLifetime = false;
-				releaseSignalLifetimeWhenStreamSettles(result.body, lifetime.cleanup);
+			if (isReadable(result.body)) {
+				holdForStream = true;
+				releaseSignalLifetimeWhenStreamSettles(result.body, () => {
+					operation?.release();
+					external?.cleanup();
+				});
 			}
 			return result;
 		} catch (error) {
+			if (error instanceof OperationCancelled) throw error.reason;
 			if (error instanceof MobileExtensionError) throw error;
 			throw new MobileExtensionError("extension_failed", "extension route failed", 500);
 		} finally {
-			if (releaseLifetime) lifetime?.cleanup();
+			if (!holdForStream) {
+				operation?.release();
+				external?.cleanup();
+			}
 		}
 	}
 	/** Start the local directory watcher; an absent directory is intentionally inert. */
@@ -2658,6 +2990,16 @@ var MobileAccessService = class extends Service {
 function isReadable(value) {
 	return value !== null && typeof value === "object" && typeof value.pipe === "function";
 }
+/** Destroy a route response that arrived after its caller detached; must never throw or emit unhandled stream errors. */
+function disposeLateExtensionResponse(value) {
+	try {
+		if (value === null || typeof value !== "object") return;
+		const body = value.body;
+		if (!isReadable(body) || typeof body.once !== "function" || typeof body.destroy !== "function") return;
+		body.once("error", () => void 0);
+		body.destroy();
+	} catch {}
+}
 function releaseSignalLifetimeWhenStreamSettles(stream, cleanup) {
 	let stopObserving;
 	stopObserving = finished(stream, () => {
@@ -2680,6 +3022,77 @@ async function settleBounded(pending, timeoutMs) {
 	})]);
 	if (timer !== void 0) clearTimeout(timer);
 }
+/** Sentinel distinguishing caller detachment (deadline or external cancel) from a host error. */
+var OperationCancelled = class {
+	reason;
+	constructor(reason) {
+		this.reason = reason;
+	}
+};
+function startBoundedOperation(start, options) {
+	const deadline = new AbortController();
+	const combined = options.external === void 0 ? {
+		signal: deadline.signal,
+		cleanup: () => void 0
+	} : combineSignalLifetime(options.external, deadline.signal);
+	let detached = false;
+	let workState;
+	let lateFulfilled;
+	let notifySettled;
+	let callerTimer;
+	let onExternal;
+	const settled = new Promise((resolve) => {
+		notifySettled = resolve;
+	});
+	const detach = (reject, reason) => {
+		if (detached || workState !== void 0) return;
+		detached = true;
+		if (callerTimer !== void 0) clearTimeout(callerTimer);
+		if (onExternal !== void 0) options.external?.removeEventListener("abort", onExternal);
+		options.onDetach?.();
+		deadline.abort(reason);
+		reject(new OperationCancelled(reason));
+	};
+	const caller = new Promise((resolve, reject) => {
+		callerTimer = setTimeout(() => detach(reject, options.timeoutError()), options.timeoutMs);
+		onExternal = () => {
+			detach(reject, combined.signal.reason);
+		};
+		options.external?.addEventListener("abort", onExternal, { once: true });
+		(async () => {
+			try {
+				const value = await start(combined.signal);
+				workState = "fulfilled";
+				if (callerTimer !== void 0) clearTimeout(callerTimer);
+				if (onExternal !== void 0) options.external?.removeEventListener("abort", onExternal);
+				if (detached) combined.cleanup();
+				if (detached) lateFulfilled = value;
+				else resolve(value);
+				notifySettled?.();
+			} catch (error) {
+				workState = "rejected";
+				if (callerTimer !== void 0) clearTimeout(callerTimer);
+				if (onExternal !== void 0) options.external?.removeEventListener("abort", onExternal);
+				if (detached) combined.cleanup();
+				if (!detached) reject(error);
+				notifySettled?.();
+			}
+		})();
+	});
+	let released = false;
+	return {
+		caller,
+		settled,
+		detached: () => detached,
+		lateValue: () => detached && workState === "fulfilled" ? lateFulfilled : void 0,
+		release: () => {
+			if (!released) {
+				released = true;
+				combined.cleanup();
+			}
+		}
+	};
+}
 async function abortAndDisposeLocal(entries) {
 	const pending = [];
 	for (const entry of entries) {
@@ -2867,6 +3280,7 @@ function renderPairPage(locale) {
 <html lang="${copy.lang}">
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
+<style>input,textarea{font-size:16px}</style>
 <title>${copy.pairTitle}</title>
 <main>
   <h1>${copy.pairHeading}</h1>
@@ -3160,32 +3574,60 @@ var ExcludedClientModulesError = class extends Error {
 		super(`excludedClientModules: ${message}`);
 	}
 };
-/** Validate graph edges before removing application rows from both manifest views. */
-function excludeMobileBootEntries(entries, batches, excludedIds) {
-	if (excludedIds.length === 0) return;
-	const excluded = new Set(excludedIds);
-	if (excluded.size !== excludedIds.length) throw new ExcludedClientModulesError("duplicate module ids");
-	const byId = new Map(entries.map((entry) => [entry.id, entry]));
+/** A graph-selection conflict with a bounded diagnostic safe for authenticated callers. */
+var ClientModuleConflictError = class extends HttpError {
+	detail;
+	constructor(detail) {
+		super(409, "excluded_client_modules_invalid");
+		this.detail = detail.replace(/[\u0000-\u001f\u007f]/gu, " ").replace(/(?:https?:\/\/|[a-z]:[\\/])\S+/giu, "[redacted]").slice(0, 512);
+	}
+};
+function requiredClientModule(entry, phase) {
+	return MOBILE_BOOT_CORE_MODULES.has(entry.id) || entry.immediately === true || phase !== "application";
+}
+function clientModuleDependencies(entry) {
+	const dependencies = /* @__PURE__ */ new Set();
+	for (const [field, edges] of [["inject", entry.inject], ["external", entry.external]]) {
+		if (edges !== void 0 && (!Array.isArray(edges) || edges.some((id) => typeof id !== "string"))) throw new ExcludedClientModulesError(`upstream module ${entry.id} has malformed ${field} dependencies`);
+		for (const dependency of edges ?? []) dependencies.add(dependency.endsWith("/client") ? dependency.slice(0, -7) : dependency);
+	}
+	return Object.freeze([...dependencies]);
+}
+function clientModulePhases(entries, batches) {
 	const phases = /* @__PURE__ */ new Map();
 	for (const batch of batches) for (const id of batch.entries) {
 		if (phases.has(id)) throw new ExcludedClientModulesError(`upstream module ${id} belongs to multiple batches`);
 		phases.set(id, batch.phase);
 	}
 	for (const entry of entries) if (!phases.has(entry.id)) throw new ExcludedClientModulesError(`upstream module ${entry.id} belongs to no batch`);
+	return phases;
+}
+/** Read only installed module ids and declared edges from the same boot parser used for serving. */
+function describeMobileClientModules(html) {
+	const plan = parseMobileBootPlan(html);
+	const ids = new Set(plan.entries.map((entry) => entry.id));
+	const phases = plan.batches === void 0 ? /* @__PURE__ */ new Map() : clientModulePhases(plan.entries, plan.batches);
+	return Object.freeze(plan.entries.map((entry) => Object.freeze({
+		id: entry.id,
+		required: requiredClientModule(entry, phases.get(entry.id)),
+		dependencies: Object.freeze(clientModuleDependencies(entry).filter((id) => ids.has(id)))
+	})));
+}
+/** Validate graph edges before removing application rows from both manifest views. */
+function excludeMobileBootEntries(entries, batches, excludedIds) {
+	if (excludedIds.length === 0) return;
+	const excluded = new Set(excludedIds);
+	if (excluded.size !== excludedIds.length) throw new ExcludedClientModulesError("duplicate module ids");
+	const byId = new Map(entries.map((entry) => [entry.id, entry]));
+	const phases = clientModulePhases(entries, batches);
 	for (const id of excluded) {
 		const entry = byId.get(id);
 		if (entry === void 0) throw new ExcludedClientModulesError(`module ${id} is not installed in this DSH client graph`);
-		if (MOBILE_BOOT_CORE_MODULES.has(id) || entry.immediately === true || phases.get(id) !== "application") throw new ExcludedClientModulesError(`module ${id} is required for mobile boot or belongs to a bootstrap batch`);
+		if (requiredClientModule(entry, phases.get(id))) throw new ExcludedClientModulesError(`module ${id} is required for mobile boot or belongs to a bootstrap batch`);
 	}
 	for (const entry of entries) {
 		if (excluded.has(entry.id)) continue;
-		for (const [field, edges] of [["inject", entry.inject], ["external", entry.external]]) {
-			if (edges !== void 0 && (!Array.isArray(edges) || edges.some((id) => typeof id !== "string"))) throw new ExcludedClientModulesError(`upstream module ${entry.id} has malformed ${field} dependencies`);
-			for (const dependency of edges ?? []) {
-				const packageId = dependency.endsWith("/client") ? dependency.slice(0, -7) : dependency;
-				if (excluded.has(packageId)) throw new ExcludedClientModulesError(`module ${entry.id} still depends on excluded module ${packageId}; exclude the dependent too or keep ${packageId}`);
-			}
-		}
+		for (const packageId of clientModuleDependencies(entry)) if (excluded.has(packageId)) throw new ExcludedClientModulesError(`module ${entry.id} still depends on excluded module ${packageId}; exclude the dependent too or keep ${packageId}`);
 	}
 	entries.splice(0, entries.length, ...entries.filter((entry) => !excluded.has(entry.id)));
 	for (const batch of batches) batch.entries = batch.entries.filter((id) => !excluded.has(id));
@@ -3830,13 +4272,18 @@ var MobileAccessGateway = class {
 	removeExtensionContentListener;
 	renewLimiter;
 	probeLimiter;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded) {
+	clientModulePreferences;
+	clientModuleOperations = /* @__PURE__ */ new Set();
+	clientModuleTasks = /* @__PURE__ */ new Set();
+	clientModuleRevocations = /* @__PURE__ */ new Set();
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
 		this.extraWebSocketPaths = extraWebSocketPaths;
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
+		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
 		this.access = new AccessController(store, {
@@ -3853,6 +4300,11 @@ var MobileAccessGateway = class {
 		this.probeLimiter = new BoundedRateLimiter(Math.min(1e3, config.maxDevices * 4), config.rateLimitWindowMs, config.maxRateLimitKeys);
 		this.removeSessionListener = this.access.onSessionEnded((authorization, reason) => {
 			if (reason === "revoked") {
+				const cleanup = this.clientModulePreferences.removeDevice(authorization.deviceId).catch(() => {
+					process.emitWarning("Unable to remove revoked device client preferences", { code: "DSH_MOBILE_PREFERENCE_CLEANUP_FAILED" });
+				});
+				this.clientModuleRevocations.add(cleanup);
+				cleanup.finally(() => this.clientModuleRevocations.delete(cleanup));
 				if (!this.pendingDeviceRevocations.has(authorization.deviceId)) {
 					this.pendingDeviceRevocations.add(authorization.deviceId);
 					this.broadcastDeviceRevoked(authorization.deviceId);
@@ -3873,6 +4325,7 @@ var MobileAccessGateway = class {
 		this.started = true;
 		await this.access.initialize();
 		try {
+			await this.clientModulePreferences.initialize();
 			if (this.config.pairingCaFile !== void 0) {
 				const certificate = new X509Certificate(await readFile(this.config.pairingCaFile));
 				const fingerprint = certificate.fingerprint256.replaceAll(":", "").toLowerCase();
@@ -4376,6 +4829,7 @@ var MobileAccessGateway = class {
 		}
 		const computerImages = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-images`;
 		const computerImage = request.method === "GET" && target.decodedPathname === `/mobile-access/computer-image`;
+		const clientModules = target.decodedPathname === `${AUTH_PREFIX}/client-modules`;
 		const requestedExtension = extensionTarget(target.decodedPathname);
 		const requestedMobileBootBatch = mobileBootBatchKey(target.decodedPathname);
 		const customAsset = request.method === "GET" ? target.decodedPathname === `/mobile-access/custom.css` ? {
@@ -4395,7 +4849,7 @@ var MobileAccessGateway = class {
 			contentType: "text/javascript; charset=utf-8",
 			fallback: void 0
 		} : void 0 : void 0;
-		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
+		if (customAsset === void 0 && requestedMobileBootBatch === void 0 && !computerImages && !computerImage && !clientModules && extensionTarget(target.decodedPathname) === void 0 && (target.decodedPathname === "/mobile-access" || target.decodedPathname.startsWith(`/mobile-access/`))) throw new HttpError(404, "not_found");
 		if (![
 			"GET",
 			"HEAD",
@@ -4424,6 +4878,44 @@ var MobileAccessGateway = class {
 			throw error;
 		}
 		if (isMutation) this.requireCsrf(request, authorization);
+		if (clientModules) {
+			if (target.search !== "") throw new HttpError(400, "bad_request");
+			if (request.method !== "GET" && request.method !== "POST") throw new HttpError(405, "method_not_allowed");
+			const operation = this.allocateRequest(authorization, response, {});
+			const onClose = () => {
+				operation.abort();
+				operation.release();
+			};
+			response.once("close", onClose);
+			try {
+				let kind = "describe";
+				let excluded;
+				if (request.method === "POST") {
+					const body = await readJsonObject(request, this.config.maxBodyBytes);
+					const keys = Object.keys(body);
+					if (keys.length !== 1) throw new HttpError(400, "bad_request");
+					if (keys[0] === "reset" && body.reset === true) kind = "reset";
+					else if (keys[0] === "excludedClientModules") {
+						kind = "configure";
+						excluded = body.excludedClientModules;
+					} else throw new HttpError(400, "bad_request");
+				}
+				const view = await this.clientModulePreferenceOperation(kind, excluded, authorization.deviceId, operation.signal);
+				operation.signal.throwIfAborted();
+				sendJson(response, 200, view, this.tlsEnabled);
+			} catch (error) {
+				if (operation.signal.aborted) return;
+				if (error instanceof ClientModuleConflictError) sendJson(response, 409, {
+					error: error.code,
+					detail: error.detail
+				}, this.tlsEnabled);
+				else throw error;
+			} finally {
+				response.removeListener("close", onClose);
+				operation.release();
+			}
+			return;
+		}
 		const extension = requestedExtension;
 		if (extension !== void 0) {
 			await this.handleExtensionRequest(extension, target, request, response, authorization);
@@ -4594,6 +5086,7 @@ var MobileAccessGateway = class {
 			const operation = this.allocateRequest(authorization, response, {});
 			const abort = new AbortController();
 			response.once("close", () => {
+				operation.release();
 				abort.abort();
 			});
 			const generationSignal = extensions.signal(targetInfo.id, generation);
@@ -4639,6 +5132,7 @@ var MobileAccessGateway = class {
 			const operation = this.allocateRequest(authorization, response, {});
 			const abort = new AbortController();
 			response.once("close", () => {
+				operation.release();
 				abort.abort();
 			});
 			const generationSignal = extensions.signal(targetInfo.id, generation);
@@ -4742,7 +5236,7 @@ var MobileAccessGateway = class {
 				});
 				this.upstreamAuthRequest = upstreamRequest;
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
-					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
@@ -4770,33 +5264,125 @@ var MobileAccessGateway = class {
 			this.upstreamAuthRequest = void 0;
 		}
 	}
-	async proxyMobileIndex(request$2, response, authorization) {
-		const holder = {};
-		const operation = this.allocateRequest(authorization, response, holder);
+	/** List installed modules and resolve the next-open selection.
+	* @param deviceId - Authenticated device identity; omitted for computer defaults.
+	* @param callerSignal - Cancels catalog fetching when the admin request closes.
+	* @returns The installed catalog and effective module selection.
+	*/
+	describeClientModules(deviceId, callerSignal) {
+		return this.clientModulePreferenceOperation("describe", void 0, deviceId, callerSignal);
+	}
+	/** Persist a validated device override or computer default.
+	* @param excluded - Untrusted module IDs to validate against the current boot graph.
+	* @param deviceId - Authenticated device identity; omitted for computer defaults.
+	* @param callerSignal - Cancels fetching and validation, not an atomic write already started.
+	* @returns The catalog and saved selection without reloading clients.
+	*/
+	configureClientModules(excluded, deviceId, callerSignal) {
+		return this.clientModulePreferenceOperation("configure", excluded, deviceId, callerSignal);
+	}
+	/** Reset one override without reloading connected clients.
+	* @param deviceId - Authenticated device identity; omitted to reset computer defaults.
+	* @param callerSignal - Cancels fetching and validation, not an atomic write already started.
+	* @returns The catalog and inherited selection.
+	*/
+	resetClientModules(deviceId, callerSignal) {
+		return this.clientModulePreferenceOperation("reset", void 0, deviceId, callerSignal);
+	}
+	async clientModulePreferenceOperation(kind, excluded, deviceId, callerSignal) {
+		if (this.closing || !this.started) throw new HttpError(503, "unavailable");
+		const controller = new AbortController();
+		const abort = () => controller.abort();
+		if (callerSignal?.aborted === true) controller.abort();
+		callerSignal?.addEventListener("abort", abort, { once: true });
+		this.clientModuleOperations.add(controller);
+		const task = (async () => {
+			let html = "";
+			const validate = async (selection) => {
+				html = (await this.fetchAuthenticatedUpstreamIndex(controller.signal)).html;
+				try {
+					parseMobileBootPlan(html, selection);
+				} catch (error) {
+					if (error instanceof ExcludedClientModulesError) throw new ClientModuleConflictError(error.message);
+					throw new HttpError(502, "upstream_unavailable");
+				}
+				controller.signal.throwIfAborted();
+			};
+			let selection;
+			if (kind === "configure") {
+				let ids;
+				try {
+					ids = parseExcludedClientModules(excluded);
+				} catch {
+					throw new HttpError(400, "excluded_client_modules_invalid");
+				}
+				selection = await this.clientModulePreferences.configure(ids, deviceId, validate);
+			} else if (kind === "reset") selection = await this.clientModulePreferences.reset(deviceId, validate);
+			else {
+				html = (await this.fetchAuthenticatedUpstreamIndex(controller.signal)).html;
+				selection = await this.clientModulePreferences.read(deviceId);
+			}
+			controller.signal.throwIfAborted();
+			try {
+				const plan = parseMobileBootPlan(html);
+				return Object.freeze({
+					entries: describeMobileClientModules(html),
+					...selection,
+					...plan.batches === void 0 ? {
+						excludedClientModules: Object.freeze([]),
+						defaultExcludedClientModules: Object.freeze([])
+					} : {},
+					reloadRequired: true
+				});
+			} catch (error) {
+				if (error instanceof HttpError) throw error;
+				throw new HttpError(502, "upstream_unavailable");
+			}
+		})();
+		this.clientModuleTasks.add(task);
 		try {
-			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
-			const upstreamCookie = await this.upstreamCookieHeader();
-			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
-			upstreamHeaders["accept-encoding"] = "identity";
+			return await task;
+		} finally {
+			callerSignal?.removeEventListener("abort", abort);
+			this.clientModuleOperations.delete(controller);
+			this.clientModuleTasks.delete(task);
+		}
+	}
+	async fetchAuthenticatedUpstreamIndex(signal, incoming) {
+		signal.throwIfAborted();
+		let upstreamRequest;
+		const abort = () => {
+			upstreamRequest?.destroy(requestAbortedError());
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		try {
+			const headers = incoming === void 0 ? {
+				host: this.config.upstreamOrigin.host,
+				accept: "text/html",
+				"accept-encoding": "identity"
+			} : sanitizeRequestHeaders(incoming, this.config.upstreamOrigin);
+			const upstreamCookie = await waitForRequestTask(this.upstreamCookieHeader(), signal);
+			signal.throwIfAborted();
+			if (upstreamCookie !== void 0) headers.cookie = upstreamCookie;
+			headers["accept-encoding"] = "identity";
 			const proxied = await new Promise((resolve, reject) => {
-				const upstreamRequest = request({
+				upstreamRequest = request({
 					protocol: "http:",
 					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 					port: Number(this.config.upstreamOrigin.port),
 					method: "GET",
 					path: "/",
-					headers: upstreamHeaders,
+					headers,
 					agent: false
 				});
-				holder.request = upstreamRequest;
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
-					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+					upstreamRequest?.destroy(new HttpError(504, "upstream_timeout"));
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
 				upstreamRequest.end();
 			});
-			if ((proxied.statusCode ?? 502) !== 200) throw new HttpError(502, "upstream_unavailable");
+			if (proxied.statusCode !== 200) throw new HttpError(502, "upstream_unavailable");
 			const chunks = [];
 			let bytes = 0;
 			for await (const chunk of proxied) {
@@ -4805,15 +5391,40 @@ var MobileAccessGateway = class {
 				if (bytes > 4194304) throw new HttpError(502, "upstream_unavailable");
 				chunks.push(buffer);
 			}
+			signal.throwIfAborted();
+			return {
+				html: Buffer.concat(chunks).toString("utf8"),
+				headers: proxied.headers
+			};
+		} catch (error) {
+			if (signal.aborted || error instanceof HttpError) throw error;
+			throw new HttpError(502, "upstream_unavailable");
+		} finally {
+			signal.removeEventListener("abort", abort);
+			upstreamRequest?.destroy();
+		}
+	}
+	async proxyMobileIndex(request, response, authorization) {
+		const holder = {};
+		const operation = this.allocateRequest(authorization, response, holder);
+		const onClose = () => {
+			operation.abort();
+			operation.release();
+		};
+		response.once("close", onClose);
+		try {
+			const index = await this.fetchAuthenticatedUpstreamIndex(operation.signal, request);
+			const preference = await this.clientModulePreferences.read(authorization.deviceId);
+			const excludedClientModules = preference.excludedClientModules;
 			let body;
 			try {
-				const html = Buffer.concat(chunks).toString("utf8");
-				const plan = parseMobileBootPlan(html, this.config.excludedClientModules);
-				const options = plan.rewrittenBatchEntries === void 0 ? { excludedClientModules: this.config.excludedClientModules } : {
-					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries)),
-					excludedClientModules: this.config.excludedClientModules
+				const html = index.html;
+				const plan = parseMobileBootPlan(html, excludedClientModules);
+				const options = plan.rewrittenBatchEntries === void 0 ? { excludedClientModules } : {
+					...await this.resolveMobileBootSizes(plan.rewrittenBatchEntries.flatMap((batch) => batch.entries), operation.signal),
+					excludedClientModules
 				};
-				const cookies = browserAuthCookies(request$2.headers.cookie);
+				const cookies = browserAuthCookies(request.headers.cookie);
 				const csrfCookie = this.tlsEnabled && cookies.has("__Host-dsh_ma_session") ? HOST_CSRF_COOKIE : CSRF_COOKIE;
 				const rewritten = rewriteMobileIndexWithBatch(html, {
 					...options,
@@ -4828,6 +5439,18 @@ var MobileAccessGateway = class {
 						this.lastModuleExclusionError = detail;
 						process.emitWarning(detail, { code: "DSH_MOBILE_MODULE_EXCLUSION_INVALID" });
 					}
+					if (preference.source === "device" || preference.source === "computer") {
+						operation.signal.throwIfAborted();
+						const locale = resolveAuthPageLocale(headerValue(request.headers, "accept-language"));
+						const recovery = Buffer.from(renderClientModuleRecoveryPage(locale));
+						setSecurityHeaders(response, this.tlsEnabled);
+						response.writeHead(200, {
+							"Content-Type": "text/html; charset=utf-8",
+							"Content-Length": recovery.byteLength
+						});
+						response.end(recovery);
+						return;
+					}
 					sendJson(response, 409, {
 						error: "excluded_client_modules_invalid",
 						detail
@@ -4836,7 +5459,8 @@ var MobileAccessGateway = class {
 				}
 				throw new HttpError(502, "upstream_unavailable");
 			}
-			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
+			operation.signal.throwIfAborted();
+			const headers = sanitizeResponseHeaders(index.headers, this.config.upstreamOrigin);
 			delete headers["content-length"];
 			delete headers["content-encoding"];
 			delete headers.etag;
@@ -4853,6 +5477,7 @@ var MobileAccessGateway = class {
 			if (response.headersSent) response.destroy();
 			else throw new HttpError(502, "upstream_unavailable");
 		} finally {
+			response.removeListener("close", onClose);
 			operation.release();
 		}
 	}
@@ -4873,16 +5498,17 @@ var MobileAccessGateway = class {
 	* could not be probed, keeps its own upstream `/plugins` row: a merged batch
 	* cannot carry it, and an unknown bundle must not risk the whole batch.
 	*/
-	async resolveMobileBootSizes(planEntries) {
+	async resolveMobileBootSizes(planEntries, signal) {
 		const sizes = /* @__PURE__ */ new Map();
 		const passThrough = /* @__PURE__ */ new Set();
 		const candidates = planEntries.filter((entry) => entry.id !== MOBILE_LAYOUT_MODULE && upstreamPluginBundleUrl(entry.url, this.config.upstreamOrigin) !== void 0);
 		let cursor = 0;
 		const worker = async () => {
 			while (cursor < candidates.length) {
+				signal?.throwIfAborted();
 				const index = cursor++;
 				const source = candidates[index].url;
-				const size = await this.upstreamBundleSize(source);
+				const size = await this.upstreamBundleSize(source, signal);
 				if (size === void 0 || size >= MAX_MOBILE_BOOT_ENTRY_BYTES) passThrough.add(source);
 				else sizes.set(source, size);
 			}
@@ -4899,14 +5525,20 @@ var MobileAccessGateway = class {
 	* counts bytes; it aborts instantly past the per-entry cap. Measurements are
 	* cached for a short window.
 	*/
-	async upstreamBundleSize(source) {
+	async upstreamBundleSize(source, signal) {
+		signal?.throwIfAborted();
 		const target = upstreamPluginBundleUrl(source, this.config.upstreamOrigin);
 		if (target === void 0) return void 0;
 		const cached = this.bootEntrySizeCache.get(source);
 		if (cached !== void 0 && Date.now() - cached.at < MOBILE_BOOT_SIZE_CACHE_TTL_MS) return cached.size;
-		const upstreamCookie = await this.upstreamCookieHeader();
 		let upstreamRequest;
+		const abort = () => {
+			upstreamRequest?.destroy(requestAbortedError());
+		};
+		signal?.addEventListener("abort", abort, { once: true });
 		try {
+			const upstreamCookie = signal === void 0 ? await this.upstreamCookieHeader() : await waitForRequestTask(this.upstreamCookieHeader(), signal);
+			signal?.throwIfAborted();
 			const proxied = await new Promise((resolve, reject) => {
 				upstreamRequest = request({
 					protocol: "http:",
@@ -4952,9 +5584,11 @@ var MobileAccessGateway = class {
 				at: Date.now()
 			});
 			return size;
-		} catch {
+		} catch (error) {
+			if (signal?.aborted === true) throw error;
 			return;
 		} finally {
+			signal?.removeEventListener("abort", abort);
 			upstreamRequest?.destroy();
 		}
 	}
@@ -5121,6 +5755,7 @@ var MobileAccessGateway = class {
 		}
 	}
 	allocateRequest(authorization, response, upstream) {
+		if (this.closing || response.destroyed || response.writableEnded) throw requestAbortedError();
 		if (this.activeRequests.size >= this.config.maxActiveRequests) throw new HttpError(429, "busy");
 		const id = this.nextOperationId++;
 		const controller = new AbortController();
@@ -5148,72 +5783,88 @@ var MobileAccessGateway = class {
 		};
 	}
 	/**
-	* Proxy one request upstream. Pass-through client bundles (`GET /plugins`)
-	* receive bounded transient retries — the upstream resets a fraction of fresh
-	* connections — matching the resilience the merged-batch assembly already has.
-	* A request is only retried before any byte reached the client.
+	* Proxy one request, retrying transient failures for plugin and asset GETs.
+	* Only bodyless GETs can be replayed, before response headers reach the client.
+	* One request slot and cancellation signal cover attempts and backoff together.
+	* API requests and requests with bodies are forwarded once.
 	*/
 	async proxyHttp(request, response, authorization) {
-		if (!(request.method === "GET" && request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true)) {
-			try {
-				await this.proxyHttpOnce(request, response, authorization);
-			} catch (error) {
-				if (error instanceof HttpError) throw error;
-				if (response.headersSent) response.destroy();
-				else throw new HttpError(502, "upstream_unavailable");
-			}
-			return;
-		}
-		const delay = (attempt) => new Promise((resolve) => setTimeout(resolve, MOBILE_BOOT_RETRY_DELAY_MS * attempt));
-		for (let attempt = 1; attempt <= MOBILE_BOOT_UPSTREAM_ATTEMPTS; attempt++) try {
-			await this.proxyHttpOnce(request, response, authorization);
-			return;
-		} catch (error) {
-			if (response.headersSent) {
-				response.destroy();
-				return;
-			}
-			if (error instanceof HttpError || !isTransientUpstreamError(error)) throw error instanceof HttpError ? error : new HttpError(502, "upstream_unavailable");
-			if (attempt === MOBILE_BOOT_UPSTREAM_ATTEMPTS) throw new HttpError(502, "upstream_unavailable");
-			await delay(attempt);
-		}
-		throw new HttpError(502, "upstream_unavailable");
-	}
-	async proxyHttpOnce(request$3, response, authorization) {
-		const declared = request$3.headers["content-length"];
+		const declared = request.headers["content-length"];
 		if (declared !== void 0 && (!/^\d+$/u.test(declared) || Number(declared) > this.config.maxBodyBytes)) throw new HttpError(413, "payload_too_large");
+		const replayable = request.method === "GET" && request.headers["transfer-encoding"] === void 0 && (declared === void 0 || Number(declared) === 0) && (request.url?.split("?", 1)[0]?.startsWith("/plugins/") === true || request.url?.split("?", 1)[0]?.startsWith("/assets/") === true);
 		const holder = {};
 		const operation = this.allocateRequest(authorization, response, holder);
-		let bodyDone;
+		const onClose = () => {
+			operation.release();
+			operation.abort();
+		};
+		response.once("close", onClose);
+		if (replayable) request.resume();
 		try {
-			const upstreamHeaders = sanitizeRequestHeaders(request$3, this.config.upstreamOrigin);
-			const upstreamCookie = await this.upstreamCookieHeader();
-			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
+			const attempts = replayable ? MOBILE_BOOT_UPSTREAM_ATTEMPTS : 1;
+			for (let attempt = 1; attempt <= attempts; attempt++) {
+				operation.signal.throwIfAborted();
+				try {
+					await this.proxyHttpOnce(request, response, holder, operation.signal, replayable);
+					return;
+				} catch (error) {
+					if (operation.signal.aborted || response.destroyed) return;
+					if (response.headersSent) {
+						response.destroy();
+						return;
+					}
+					if (error instanceof HttpError || !isTransientUpstreamError(error)) throw error instanceof HttpError ? error : new HttpError(502, "upstream_unavailable");
+					if (attempt === attempts) throw new HttpError(502, "upstream_unavailable");
+					await waitForAbortableDelay(MOBILE_BOOT_RETRY_DELAY_MS * attempt, operation.signal);
+				}
+			}
+		} catch (error) {
+			if (!operation.signal.aborted) throw error;
+		} finally {
+			response.removeListener("close", onClose);
+			operation.release();
+		}
+	}
+	async proxyHttpOnce(request$2, response, holder, signal, replayable) {
+		let bodyDone;
+		try {
+			const upstreamHeaders = sanitizeRequestHeaders(request$2, this.config.upstreamOrigin);
+			if (request$2.headers["transfer-encoding"] !== void 0) upstreamHeaders["transfer-encoding"] = request$2.headers["transfer-encoding"];
+			const upstreamCookie = await this.upstreamCookieHeader();
+			signal.throwIfAborted();
+			if (upstreamCookie !== void 0) upstreamHeaders.cookie = upstreamCookie;
 			const proxied = await new Promise((resolve, reject) => {
 				const upstreamRequest = request({
 					protocol: "http:",
 					hostname: stripIpv6Brackets(this.config.upstreamOrigin.hostname),
 					port: Number(this.config.upstreamOrigin.port),
-					method: request$3.method,
-					path: request$3.url,
+					method: request$2.method,
+					path: request$2.url,
 					headers: upstreamHeaders,
 					agent: false
 				});
 				holder.request = upstreamRequest;
 				upstreamRequest.setTimeout(this.config.upstreamTimeoutMs, () => {
-					upstreamRequest.destroy(/* @__PURE__ */ new Error("upstream timeout"));
+					upstreamRequest.destroy(new HttpError(504, "upstream_timeout"));
+				});
+				const pathname = parseRequestTarget(request$2.url).decodedPathname;
+				if (pathname === "/api" || pathname.startsWith("/api/")) upstreamRequest.once("finish", () => {
+					upstreamRequest.setTimeout(this.config.upstreamApiTimeoutMs);
 				});
 				upstreamRequest.once("response", resolve);
 				upstreamRequest.once("error", reject);
-				bodyDone = pipeline(request$3, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
-				bodyDone.catch(reject);
+				if (replayable) upstreamRequest.end();
+				else {
+					bodyDone = pipeline(request$2, new ByteLimitTransform(this.config.maxBodyBytes), upstreamRequest);
+					bodyDone.catch(reject);
+				}
 			});
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
 			const statusCode = proxied.statusCode ?? 502;
-			const cacheControl = revisionedStaticCacheControl(request$3, statusCode);
+			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
-			const compressed = shouldCompressResponse(request$3, proxied);
+			const compressed = shouldCompressResponse(request$2, proxied);
 			if (compressed) {
 				delete headers["accept-ranges"];
 				delete headers["content-length"];
@@ -5230,7 +5881,7 @@ var MobileAccessGateway = class {
 			if (response.headersSent) response.destroy();
 			throw error;
 		} finally {
-			operation.release();
+			delete holder.request;
 		}
 	}
 	abortSessionResources(sessionKey) {
@@ -5579,12 +6230,19 @@ var MobileAccessGateway = class {
 						const body = await readJsonObject(request, MAX_CONTROL_BODY_BYTES);
 						if (typeof body.deviceId !== "string" || !/^[a-f\d]{32}$/u.test(body.deviceId)) throw new HttpError(400, "bad_request");
 						if (!await this.access.revokeDevice(body.deviceId)) throw new HttpError(404, "not_found");
+						await this.clientModulePreferences.removeDevice(body.deviceId).catch(() => {
+							process.emitWarning("Unable to remove revoked device client preferences", { code: "DSH_MOBILE_PREFERENCE_CLEANUP_FAILED" });
+						});
 						sendJson(response, 200, { revoked: true }, false);
 						return;
 					}
 					if (request.method === "POST" && target.decodedPathname === `${prefix}/devices/reset`) {
 						if ((await readJsonObject(request, MAX_CONTROL_BODY_BYTES)).confirm !== true) throw new HttpError(400, "bad_request");
+						const removed = this.access.listDevices().map((device) => device.id);
 						await this.access.resetDevices();
+						await this.clientModulePreferences.removeDevices(removed).catch(() => {
+							process.emitWarning("Unable to remove revoked device client preferences", { code: "DSH_MOBILE_PREFERENCE_CLEANUP_FAILED" });
+						});
 						sendJson(response, 200, { reset: true }, false);
 						return;
 					}
@@ -5605,6 +6263,7 @@ var MobileAccessGateway = class {
 	}
 	async performClose() {
 		this.closing = true;
+		for (const controller of this.clientModuleOperations) controller.abort();
 		if (this.extensionChangeTimer !== void 0) clearInterval(this.extensionChangeTimer);
 		this.extensionChangeTimer = void 0;
 		this.removeExtensionContentListener();
@@ -5637,6 +6296,8 @@ var MobileAccessGateway = class {
 			});
 		}
 		await accessClose;
+		await Promise.allSettled(this.clientModuleTasks);
+		await Promise.allSettled(this.clientModuleRevocations);
 		this.activeRequests.clear();
 		this.activeWebSockets.clear();
 		this.connectedSockets.clear();
@@ -5777,8 +6438,8 @@ var MemoryDeviceStore = class {
 //#endregion
 //#region src/frp-component.ts
 const FRP_VERSION$1 = "0.70.1";
-const MAX_ARCHIVE_ENTRIES = 128;
-const MAX_ARCHIVE_LIST_BYTES = 262144;
+const MAX_ARCHIVE_ENTRIES$1 = 128;
+const MAX_ARCHIVE_LIST_BYTES$1 = 262144;
 /** Pinned official FRP release metadata for supported desktop targets. */
 const FRP_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 	{
@@ -5883,12 +6544,12 @@ async function replaceDirectory(target, candidate) {
 function sha256$2(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
-async function runCapture(file, args) {
+async function runCapture$1(file, args) {
 	return new Promise((resolveRun, reject) => {
 		execFile(file, [...args], {
 			windowsHide: true,
 			timeout: 12e4,
-			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES$1,
 			encoding: "utf8"
 		}, (error, stdout) => {
 			if (error === null) resolveRun(stdout);
@@ -5896,7 +6557,7 @@ async function runCapture(file, args) {
 		});
 	});
 }
-function validatedArchiveEntry(rawEntry) {
+function validatedArchiveEntry$1(rawEntry) {
 	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("frp_archive_path_invalid");
 	const segments = rawEntry.replace(/\/$/u, "").split("/");
 	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("frp_archive_path_invalid");
@@ -5904,10 +6565,10 @@ function validatedArchiveEntry(rawEntry) {
 }
 /** Select exactly one nested frpc executable from a safe archive listing. */
 function selectFrpExecutableEntry(entries, executableName) {
-	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("frp_archive_entries_invalid");
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES$1) throw new Error("frp_archive_entries_invalid");
 	let executableEntry;
 	for (const entry of entries) {
-		const segments = validatedArchiveEntry(entry);
+		const segments = validatedArchiveEntry$1(entry);
 		if (segments.length >= 2 && segments.at(-1) === executableName) {
 			if (executableEntry !== void 0) throw new Error("frp_archive_executable_ambiguous");
 			executableEntry = entry.replace(/\/$/u, "");
@@ -5916,22 +6577,22 @@ function selectFrpExecutableEntry(entries, executableName) {
 	if (executableEntry === void 0) throw new Error("frp_archive_executable_missing");
 	return executableEntry;
 }
-async function defaultExtractArtifact$1(archive, destination, executableName) {
+async function defaultExtractArtifact$2(archive, destination, executableName) {
 	const tar = process.platform === "win32" ? "tar.exe" : "tar";
-	const executableEntry = selectFrpExecutableEntry((await runCapture(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
+	const executableEntry = selectFrpExecutableEntry((await runCapture$1(tar, ["-tf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), executableName);
 	const unpacked = join(destination, "archive");
 	await mkdir(unpacked, {
 		recursive: true,
 		mode: 448
 	});
-	await runCapture(tar, [
+	await runCapture$1(tar, [
 		"-xf",
 		archive,
 		"-C",
 		unpacked,
 		executableEntry
 	]);
-	const extracted = join(unpacked, ...validatedArchiveEntry(executableEntry));
+	const extracted = join(unpacked, ...validatedArchiveEntry$1(executableEntry));
 	if (!await regularFile$2(extracted)) throw new Error("frp_archive_executable_invalid");
 	await copyFile(extracted, join(destination, executableName));
 }
@@ -5971,7 +6632,7 @@ async function defaultFetchArtifact$2(artifact, signal) {
 	return bytes;
 }
 async function defaultInspectExecutable(executable) {
-	return (await runCapture(executable, ["--version"])).trim();
+	return (await runCapture$1(executable, ["--version"])).trim();
 }
 /** Owns the optional official frpc binary inside the DSH Mobile state directory. */
 var FrpComponentManager = class {
@@ -6006,7 +6667,7 @@ var FrpComponentManager = class {
 			this.stagingRoot
 		]) if (!inside$2(stateDirectory, child)) throw new Error("frp component path escaped its state directory");
 		this.fetchArtifact = options.fetchArtifact ?? defaultFetchArtifact$2;
-		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$2;
 		this.inspectExecutable = options.inspectExecutable ?? defaultInspectExecutable;
 	}
 	/** Inspect the managed executable without relying on global FRP installations. */
@@ -6345,6 +7006,14 @@ function resolveFrpVhostHttpPort(settings) {
 function resolveFrpPublicPort(settings) {
 	return settings.publicPort ?? 33080;
 }
+/** Public HTTPS endpoint the user opens, independent of the frps control address. */
+function resolveFrpEntryProbe(settings) {
+	const origin = new URL(frpEntryOrigin(settings));
+	return {
+		host: origin.hostname,
+		port: origin.port === "" ? 443 : Number(origin.port)
+	};
+}
 /** HTTPS origin users actually open; the self-signed TCP entry is not on 443. */
 function frpEntryOrigin(settings) {
 	if (!isFrpSelfSignedIngress(settings)) return settings.publicOrigin;
@@ -7127,7 +7796,8 @@ function parseManagedSetup(value) {
 		"networkInterface",
 		"listenPort",
 		"upstreamOrigin",
-		"tls"
+		"tls",
+		"extraAllowedCidrs"
 	].includes(key))) throw new Error("mobile setup file has an unsupported format");
 	if (!Number.isSafeInteger(record.listenPort) || record.listenPort < 1024 || record.listenPort > 65535) throw new Error("mobile setup listenPort must be from 1024 through 65535");
 	if (typeof record.tls !== "object" || record.tls === null || Array.isArray(record.tls)) throw new Error("mobile setup tls must be an object");
@@ -7144,6 +7814,7 @@ function parseManagedSetup(value) {
 		networkInterface: requiredString(record.networkInterface, "mobile setup networkInterface"),
 		listenPort: record.listenPort,
 		upstreamOrigin: requiredString(record.upstreamOrigin, "mobile setup upstreamOrigin"),
+		...record.extraAllowedCidrs === void 0 ? {} : { extraAllowedCidrs: parseAdditionalTrustedNetworks(record.extraAllowedCidrs) },
 		tls: Object.freeze({
 			mode: "managed",
 			caCertFile: requiredString(tls.caCertFile, "mobile setup tls.caCertFile"),
@@ -7153,6 +7824,43 @@ function parseManagedSetup(value) {
 		})
 	});
 }
+/** Validate explicitly trusted networks without adding implicit VPN or private ranges.
+* @param value - CIDR strings submitted by the computer administrator.
+* @returns Deduplicated validated CIDRs in input order.
+*/
+function parseAdditionalTrustedNetworks(value) {
+	if (!Array.isArray(value)) throw new Error("extraAllowedCidrs must be an array of CIDR strings");
+	const sources = value.map((entry) => {
+		if (typeof entry !== "string" || entry.trim() === "") throw new Error("extraAllowedCidrs must be an array of CIDR strings");
+		return entry.trim();
+	});
+	const entries = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const cidr of sources) {
+		const parsed = parseCidr(cidr);
+		const key = `${parsed.bits}:${parsed.network}:${parsed.prefix}`;
+		if (seen.has(key)) continue;
+		seen.add(key);
+		entries.push(cidr);
+	}
+	return Object.freeze(entries);
+}
+/** Save extra trusted networks without replacing the interface or pairing identity.
+* @param setupFile - Existing managed setup file.
+* @param values - Explicitly selected additional networks.
+* @returns The saved managed setup.
+*/
+async function saveManagedTrustedNetworks(setupFile, values) {
+	const extraAllowedCidrs = parseAdditionalTrustedNetworks(values);
+	const setup = parseManagedSetup(JSON.parse(await readFile(setupFile, "utf8")));
+	const next = Object.freeze({
+		...setup,
+		extraAllowedCidrs
+	});
+	await atomicWrite(setupFile, `${JSON.stringify(next, null, 2)}\n`);
+	await restrictPrivateFile(setupFile);
+	return next;
+}
 function privateIpv4(value) {
 	const parts = value.split(".").map(Number);
 	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) && (parts[0] === 10 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31 || parts[0] === 192 && parts[1] === 168);
@@ -7293,10 +8001,18 @@ async function atomicWrite(file, contents) {
 		recursive: true,
 		mode: 448
 	});
-	const temporary = join(directory, `.${basename(file)}.${process.pid}.tmp`);
-	await writeFile(temporary, contents, { mode: 384 });
-	await rename(temporary, file);
-	await restrictPrivateFile(file);
+	const temporary = join(directory, `.${basename(file)}.${randomBytes(12).toString("hex")}.tmp`);
+	try {
+		await writeFile(temporary, contents, {
+			mode: 384,
+			flag: "wx"
+		});
+		await restrictPrivateFile(temporary);
+		await rename(temporary, file);
+		await restrictPrivateFile(file);
+	} finally {
+		await rm(temporary, { force: true });
+	}
 }
 /** Create a long-lived CA or migrate the legacy self-signed server certificate as that CA. */
 async function ensureManagedCa(setup, legacy) {
@@ -7435,7 +8151,7 @@ async function materializeManagedSetup(setup, table) {
 	return {
 		publicOrigin: `https://${network.address}:${String(setup.listenPort)}`,
 		listenHost: network.address,
-		allowedCidrs: [network.cidr],
+		allowedCidrs: parseAdditionalTrustedNetworks([network.cidr, ...setup.extraAllowedCidrs ?? []]),
 		instanceId: ca.fingerprint256.replaceAll(":", "").toLowerCase(),
 		pairingCaFile: setup.tls.caCertFile,
 		tls: {
@@ -7718,6 +8434,17 @@ var RemoteProviderCoordinator = class {
 	mutate(operation) {
 		return this.enqueue(() => operation(this.controller()));
 	}
+	/** Apply one operation only while its intended provider remains selected.
+	* @param provider - Provider the caller explicitly chose.
+	* @param operation - Configuration and activation performed in the same queue item.
+	* @returns The operation result, or a rejection when another selection won the queue.
+	*/
+	mutateSelected(provider, operation) {
+		return this.enqueue(async () => {
+			if (provider !== this.selectedValue) throw new Error("remote_provider_changed");
+			return operation(this.controller());
+		});
+	}
 	/** Disable the previous provider, persist the new selection, and retain rollback on write failure. */
 	select(provider) {
 		return this.enqueue(async () => {
@@ -8909,6 +9636,10 @@ async function downloadPinnedArtifact(request) {
 }
 //#endregion
 //#region src/cloudflared-component.ts
+/** Upper bound for `tar -t` output; a pinned release listing is a few lines. */
+const MAX_ARCHIVE_LIST_BYTES = 1048576;
+const MAX_ARCHIVE_ENTRIES = 256;
+const DOWNLOAD_TIMEOUT_MS = 3e5;
 const CLOUDFLARED_VERSION = "2026.9.1";
 /** Pinned official cloudflared release metadata for supported desktop targets. */
 const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
@@ -8919,7 +9650,9 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-windows-amd64.exe`,
 		downloadBytes: 54976432,
 		downloadSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712",
-		executableName: "cloudflared.exe"
+		executableName: "cloudflared.exe",
+		executableBytes: 54976432,
+		executableSha256: "2837888cc0f5d58f15b6dc478376de90b4d3ba5241c7947455d1e0a0df429712"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
@@ -8928,7 +9661,9 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-amd64`,
 		downloadBytes: 39838488,
 		downloadSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc",
-		executableName: "cloudflared"
+		executableName: "cloudflared",
+		executableBytes: 39838488,
+		executableSha256: "03f1f25d1cc93b9ad6c60569d44060bc4f17ed97075760ed8cfca4b12dcd68cc"
 	},
 	{
 		version: CLOUDFLARED_VERSION,
@@ -8937,7 +9672,39 @@ const CLOUDFLARED_COMPONENT_RELEASES = Object.freeze(Object.fromEntries([
 		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-arm64`,
 		downloadBytes: 37466252,
 		downloadSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3",
-		executableName: "cloudflared"
+		executableName: "cloudflared",
+		executableBytes: 37466252,
+		executableSha256: "3d97437c71848bd8df68041e12436b484a661d95073ea1937f01a845ce88faa3"
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "darwin",
+		arch: "x64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-amd64.tgz`,
+		downloadBytes: 21118723,
+		downloadSha256: "ff0d3b51d5ff70eceef89d6b32145fee985018a2174596a5dbe405e2766e2ac4",
+		executableName: "cloudflared",
+		executableBytes: 41731488,
+		executableSha256: "1ea07ae775b03236bd6be18ca1848d6bdc4af2f4f3bce398823b5a36e5761b75",
+		archive: {
+			format: "tgz",
+			member: "cloudflared"
+		}
+	},
+	{
+		version: CLOUDFLARED_VERSION,
+		platform: "darwin",
+		arch: "arm64",
+		downloadUrl: `https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-darwin-arm64.tgz`,
+		downloadBytes: 19217478,
+		downloadSha256: "c27ab8fd0aa489449e3d201eb02f957ef460a13b613662928b1b23394bf1bcfe",
+		executableName: "cloudflared",
+		executableBytes: 38893072,
+		executableSha256: "9a0b19f67dc7a3011bc6b972c7ce06a5fcea8784ac6bd599ffa382ea4aeb5a6e",
+		archive: {
+			format: "tgz",
+			member: "cloudflared"
+		}
 	}
 ].map((release) => [`${release.platform}-${release.arch}`, Object.freeze(release)])));
 /**
@@ -8964,6 +9731,60 @@ async function regularFile$1(file, expectedBytes) {
 		throw error;
 	}
 }
+async function runCapture(file, args) {
+	return new Promise((resolveRun, reject) => {
+		execFile(file, [...args], {
+			windowsHide: true,
+			timeout: 12e4,
+			maxBuffer: MAX_ARCHIVE_LIST_BYTES,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolveRun(stdout);
+			else reject(error);
+		});
+	});
+}
+/** Reject absolute, traversing, or Windows-shaped archive members. */
+function validatedArchiveEntry(rawEntry) {
+	if (rawEntry.length === 0 || rawEntry.includes("\\") || rawEntry.includes("\0") || rawEntry.startsWith("/") || /^[a-zA-Z]:/u.test(rawEntry)) throw new Error("cloudflared_archive_path_invalid");
+	const segments = rawEntry.replace(/\/$/u, "").split("/");
+	if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) throw new Error("cloudflared_archive_path_invalid");
+	return segments;
+}
+/** Select exactly one archive member named `member`, wherever it sits in the tree. */
+function selectCloudflaredArchiveEntry(entries, member) {
+	if (entries.length === 0 || entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("cloudflared_archive_entries_invalid");
+	let selected;
+	for (const entry of entries) if (validatedArchiveEntry(entry).at(-1) === member) {
+		if (selected !== void 0) throw new Error("cloudflared_archive_executable_ambiguous");
+		selected = entry.replace(/\/$/u, "");
+	}
+	if (selected === void 0) throw new Error("cloudflared_archive_executable_missing");
+	return selected;
+}
+/**
+* Unpack the pinned member out of a `.tgz` using the system `tar`, which ships
+* with Windows 10+, macOS, and every supported Linux base.
+*/
+async function defaultExtractArtifact$1(archive, destination, member) {
+	const tar = process.platform === "win32" ? "tar.exe" : "tar";
+	const selected = selectCloudflaredArchiveEntry((await runCapture(tar, ["-tzf", archive])).split(/\r?\n/u).filter((entry) => entry.length > 0), member);
+	const unpacked = join(destination, "archive");
+	await mkdir(unpacked, {
+		recursive: true,
+		mode: 448
+	});
+	await runCapture(tar, [
+		"-xzf",
+		archive,
+		"-C",
+		unpacked,
+		selected
+	]);
+	const extracted = join(unpacked, ...validatedArchiveEntry(selected));
+	if (!await regularFile$1(extracted)) throw new Error("cloudflared_archive_executable_invalid");
+	await copyFile(extracted, join(destination, member));
+}
 async function defaultFetchArtifact$1(url, signal, expectedBytes) {
 	return downloadPinnedArtifact({
 		url,
@@ -8988,6 +9809,7 @@ var CloudflaredComponentManager = class {
 	arch;
 	release;
 	fetchArtifact;
+	extractArtifact;
 	installed = false;
 	errorCode;
 	queue = Promise.resolve();
@@ -9012,12 +9834,14 @@ var CloudflaredComponentManager = class {
 		]) if (!inside$1(stateDirectory, child)) throw new Error("cloudflared component path escaped its state directory");
 		const release = this.release;
 		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => defaultFetchArtifact$1(url, signal, release?.downloadBytes ?? 0));
+		this.extractArtifact = options.extractArtifact ?? defaultExtractArtifact$1;
 	}
 	/** Inspect the managed binary without using any global cloudflared state. */
 	async initialize() {
 		const release = this.release;
-		this.installed = release !== void 0 && await regularFile$1(this.executable, release.downloadBytes);
-		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.downloadSha256) {
+		this.errorCode = void 0;
+		this.installed = release !== void 0 && await regularFile$1(this.executable, release.executableBytes);
+		if (this.installed && release !== void 0 && await sha256$1(this.executable) !== release.executableSha256) {
 			this.installed = false;
 			this.errorCode = "cloudflared_component_invalid";
 		}
@@ -9030,7 +9854,7 @@ var CloudflaredComponentManager = class {
 			installed: this.installed,
 			version: release.version,
 			downloadBytes: release.downloadBytes,
-			installedBytes: release.downloadBytes,
+			installedBytes: release.executableBytes,
 			sourceUrl: release.downloadUrl,
 			downloadPage: DOWNLOAD_PAGE$1,
 			termsUrl: TERMS_URL$1,
@@ -9052,7 +9876,7 @@ var CloudflaredComponentManager = class {
 				const controller = new AbortController();
 				const timeout = setTimeout(() => {
 					controller.abort();
-				}, 3e5);
+				}, DOWNLOAD_TIMEOUT_MS);
 				timeout.unref();
 				let bytes;
 				try {
@@ -9063,12 +9887,24 @@ var CloudflaredComponentManager = class {
 				if (bytes.byteLength !== release.downloadBytes) throw new Error("cloudflared_download_size_mismatch");
 				if (createHash("sha256").update(bytes).digest("hex") !== release.downloadSha256) throw new Error("cloudflared_download_hash_mismatch");
 				const staged = join(staging, release.executableName);
-				await writeFile(staged, bytes, {
+				if (release.archive === void 0) await writeFile(staged, bytes, {
 					flag: "wx",
 					mode: 384
 				});
+				else {
+					const downloaded = join(staging, `${release.executableName}.download`);
+					await writeFile(downloaded, bytes, {
+						flag: "wx",
+						mode: 384
+					});
+					try {
+						await this.extractArtifact(downloaded, staging, release.archive.member);
+					} finally {
+						await rm(downloaded, { force: true });
+					}
+				}
 				await chmod(staged, 448);
-				if (!await regularFile$1(staged, release.downloadBytes) || await sha256$1(staged) !== release.downloadSha256) throw new Error("cloudflared_executable_hash_mismatch");
+				if (!await regularFile$1(staged, release.executableBytes) || await sha256$1(staged) !== release.executableSha256) throw new Error("cloudflared_executable_hash_mismatch");
 				const candidate = join(this.componentRoot, `.install-${randomBytes(12).toString("hex")}`);
 				await mkdir(candidate, {
 					recursive: true,
@@ -9643,7 +10479,7 @@ var CloudflaredController = class {
 };
 //#endregion
 //#region src/cloudflared-tunnel.ts
-const MAX_CONFIG_BYTES = 8192;
+const MAX_CONFIG_BYTES$1 = 8192;
 const QUICK_TUNNEL_SUFFIX = ".trycloudflare.com";
 /** Cloudflare's own tunnel-routing domain; it can never be a public hostname. */
 const TUNNEL_ROUTING_SUFFIX = ".cfargotunnel.com";
@@ -9802,7 +10638,7 @@ var CloudflaredTunnelStore = class {
 			if (error.code === "ENOENT") return;
 			throw error;
 		}
-		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_CONFIG_BYTES) {
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_CONFIG_BYTES$1) {
 			this.errorCode = "cloudflared_tunnel_config_invalid";
 			return;
 		}
@@ -10440,6 +11276,7 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
    - 目录：$DSH_HOME/mobile-access/extensions/<id>/，id 用小写字母数字和连字符（如 media-remote）
    - extension.json：{"schemaVersion":1,"id":"<id>","name":"显示名","version":"0.1.0","description":"说明"}
    - host.mjs：电脑端 Node.js 代码（可信本地代码，可读写文件、执行命令）。导出默认函数 (api) => { ... }，用 api.action('名称', { input, run }) 注册动作、api.route({ method, path, handle }) 注册路由、api.effect(fn) 注册清理。input 可以直接使用 api.schema.object(...) 等 Schemastery schema，也可以传入带 parse(value) 的适配器；两种形式都会在动作执行前校验并规范化输入。
+   - 动作与路由的执行有时间预算：默认 30 秒（输入校验也计入），可用 api.action('名称', { input, run, timeoutMs }) 或 api.route({ ..., timeoutMs }) 按操作覆盖（1–300000 的整数毫秒）。超时或调用方取消后，调用方收到 500 extension_action_timeout / extension_route_timeout（或取消原因）；这只表示调用方不再等待，底层代码可能仍在运行并已产生副作用，请在 run / handle 中响应 signal 实现协作式取消。路由的预算到 handle() 返回响应为止，不影响已返回流的存活。若某扩展存在调用方已离开（超时或取消）但仍未结束的操作，后续对该扩展的新调用会收到 503 extension_busy，直到该操作真正结束。
    - mobile.js：手机端脚本，用 window.dshMobile.define({ apiVersion:1, id:'<id>', activate(api) { ... } })，activate 返回清理函数
    - mobile.css：手机端样式（可选）
    - assets/：手机端静态资源（可选）
@@ -10448,6 +11285,7 @@ const MOBILE_CUSTOMIZATION_GUIDE_BODY = `你在为用户定制 DSH Mobile 的手
 
 安全约束：
 - host.mjs 拥有电脑用户的完整权限，绝不能放入不可信代码，也不要让手机端无条件执行任意命令
+- host.mjs 的同步阻塞（如 while (true) {} 或长时间同步循环）会卡死整个电脑端网关进程，超时与取消机制都无法打断；绝不编写同步阻塞代码
 - 所有改动只限 $DSH_HOME/mobile-access/，不要动 DeepSeek Harness 源码
 
 完成前请自检：
@@ -12631,139 +13469,1098 @@ var CpolarComponentManager = class {
 	}
 };
 //#endregion
-//#region src/release-update.ts
-const PACKAGE_NAME = "dsh-mobile";
-const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
-const GITHUB_LATEST_URL = "https://github.com/saya-ch/dsh-mobile/releases/latest";
-const GITHUB_API_LATEST_URL = "https://api.github.com/repos/saya-ch/dsh-mobile/releases/latest";
-const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
-const RELEASE_NOTES_MAX_CHARS = 4e3;
-const STATUS_CACHE_MS = 6e5;
-const REQUEST_TIMEOUT_MS = 8e3;
-const UPDATE_TIMEOUT_MS = 12e4;
-const UPDATE_TERMINATION_GRACE_MS = 1500;
-const NUMERIC_VERSION_IDENTIFIER = "(?:0|[1-9]\\d*)";
-const WILDCARD_VERSION_IDENTIFIER = "(?:[xX*])";
-const RANGE_VERSION = `(?:${`${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?`}|${`(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}))?))?)`})`;
-const COMPARATOR = new RegExp(`^(?:<=|>=|<|>|=|~|\\^)?${RANGE_VERSION}$`, "u");
-const HYPHEN_RANGE = new RegExp(`^${RANGE_VERSION} +[-] +${RANGE_VERSION}$`, "u");
-const DIST_TAG = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
-function parseSemver(value) {
-	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
-	if (match === null) return void 0;
-	const core = [
-		Number(match[1]),
-		Number(match[2]),
-		Number(match[3])
-	];
-	if (core.some((part) => !Number.isSafeInteger(part))) return void 0;
-	const prerelease = match[4] === void 0 ? [] : match[4].split(".").map((part) => /^\d+$/u.test(part) ? Number(part) : part);
-	if (prerelease.some((part) => typeof part === "number" && !Number.isSafeInteger(part))) return void 0;
-	return Object.freeze({
-		core,
-		prerelease: Object.freeze(prerelease)
-	});
-}
-/** Compare two strict SemVer strings, including prerelease precedence. */
-function comparePluginVersions(left, right) {
-	const a = parseSemver(left);
-	const b = parseSemver(right);
-	if (a === void 0 || b === void 0) return void 0;
-	for (let index = 0; index < a.core.length; index += 1) {
-		const difference = a.core[index] - b.core[index];
-		if (difference !== 0) return Math.sign(difference);
-	}
-	if (a.prerelease.length === 0 || b.prerelease.length === 0) return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
-	const length = Math.max(a.prerelease.length, b.prerelease.length);
-	for (let index = 0; index < length; index += 1) {
-		const leftPart = a.prerelease[index];
-		const rightPart = b.prerelease[index];
-		if (leftPart === void 0 || rightPart === void 0) return leftPart === void 0 ? -1 : 1;
-		if (leftPart === rightPart) continue;
-		if (typeof leftPart === "number" && typeof rightPart === "number") return Math.sign(leftPart - rightPart);
-		if (typeof leftPart === "number") return -1;
-		if (typeof rightPart === "number") return 1;
-		return leftPart < rightPart ? -1 : 1;
-	}
-	return 0;
-}
-function isComparatorSet(value) {
-	if (HYPHEN_RANGE.test(value)) return true;
-	const comparators = value.replace(/(<=|>=|<|>|=|~|\^) +/gu, "$1").split(/ +/u);
-	return comparators.length > 0 && comparators.every((comparator) => COMPARATOR.test(comparator));
-}
-function isNpmVersionRange(value) {
-	if (!/^[0-9xX*<>=~^|.+\- ]+$/u.test(value)) return false;
-	const alternatives = value.split(/ *\|\| */u);
-	return alternatives.length > 0 && alternatives.every((alternative) => alternative !== "" && isComparatorSet(alternative));
-}
-/** Return whether pnpm may safely replace this profile dependency from an npm version, range, or tag. */
-function isRegistryPluginSpec(value) {
-	if (typeof value !== "string" || value.trim() !== value || value === "" || /[\u0000-\u001f\u007f]/u.test(value)) return false;
-	if (/\.(?:tgz|tar(?:\.gz)?)$/iu.test(value)) return false;
-	return parseSemver(value) !== void 0 || isNpmVersionRange(value) || DIST_TAG.test(value);
-}
-/** Resolve the DSH profile named by the current launcher arguments. */
-function launchedProfileName(argv) {
-	for (let index = 0; index < argv.length; index += 1) {
-		if (argv[index] === "--profile") {
-			const candidate = argv[index + 1];
-			if (candidate !== void 0 && /^[\w.-]+$/u.test(candidate)) return candidate;
+//#region src/caddy-files.ts
+/** Refuse link-shaped ancestors within the owned state root before filesystem operations. */
+async function assertCaddyParents(root, target) {
+	const parent = resolve(root);
+	const candidate = resolve(target);
+	const offset = relative(parent, candidate);
+	if (!isAbsolute(root) || offset !== "" && (offset.startsWith("..") || isAbsolute(offset))) throw new Error("caddy_path_invalid");
+	const paths = [parent];
+	let cursor = parent;
+	for (const segment of relative(parent, dirname(candidate)).split(/[\\/]/u).filter(Boolean)) {
+		cursor = join(cursor, segment);
+		paths.push(cursor);
+	}
+	for (const path of paths) {
+		let entry;
+		try {
+			entry = await lstat(path);
+		} catch (error) {
+			if (error.code === "ENOENT") continue;
+			throw error;
 		}
-		const match = /^--profile=([\w.-]+)$/u.exec(argv[index] ?? "");
-		if (match?.[1] !== void 0) return match[1];
+		if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
 	}
-	return "web";
 }
-/** Resolve the launcher-owned Desktop profile, or the CLI profile outside Desktop. */
-function releaseProfileDirectory(ctx, dshHome, argv) {
-	const desktopProfiles = ctx.get("desktopProfiles");
-	const desktopDirectory = desktopProfiles?.current?.dir;
-	if (typeof desktopDirectory === "string" && isAbsolute(desktopDirectory)) return desktopDirectory;
-	if (desktopProfiles !== void 0 || ctx.get("desktopRuntime") !== void 0) return void 0;
-	return join(dshHome, "profiles", launchedProfileName(argv));
+/** Create a private real directory, never traversing a link owned by the component. */
+async function ensureCaddyDirectory(root, directory) {
+	await assertCaddyParents(root, directory);
+	await mkdir(directory, {
+		recursive: true,
+		mode: 448
+	});
+	const entry = await lstat(directory);
+	if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
+	await restrictPrivateFile(directory, 448);
 }
-async function profileDependencySpec(profileDirectory) {
+/** Atomically replace one private configuration file under a real owned directory. */
+async function writeCaddyPrivateFile(root, file, body) {
+	await ensureCaddyDirectory(root, dirname(file));
 	try {
-		const value = JSON.parse(await readFile(join(profileDirectory, "package.json"), "utf8")).dependencies?.[PACKAGE_NAME];
-		return typeof value === "string" ? value : void 0;
-	} catch {
-		return;
+		const entry = await lstat(file);
+		if (!entry.isFile() || entry.isSymbolicLink()) throw new Error("caddy_config_target_invalid");
+	} catch (error) {
+		if (error.code !== "ENOENT") throw error;
+	}
+	const temporary = join(dirname(file), "." + basename(file) + "." + randomBytes(12).toString("hex") + ".tmp");
+	try {
+		await writeFile(temporary, body, {
+			encoding: "utf8",
+			flag: "wx",
+			mode: 384
+		});
+		await restrictPrivateFile(temporary);
+		await rename(temporary, file);
+	} finally {
+		await rm(temporary, { force: true });
 	}
 }
-async function fetchNpmVersion(fetcher) {
-	const response = await fetcher(NPM_LATEST_URL, {
-		headers: {
-			accept: "application/json",
-			"user-agent": "dsh-mobile-release-check"
-		},
-		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
-	});
-	if (!response.ok) return void 0;
-	const payload = await response.json();
-	return typeof payload.version === "string" && parseSemver(payload.version) !== void 0 ? payload.version : void 0;
-}
-function githubReleaseVersion(location, responseUrl) {
-	let url;
+/** Delete only owned entries; junctions and symlinks are unlinked, never descended into. */
+async function removeCaddyTree(root, target) {
+	await assertCaddyParents(root, target);
+	let entry;
 	try {
-		url = new URL(location ?? responseUrl, GITHUB_LATEST_URL);
-	} catch {
+		entry = await lstat(target);
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+	if (entry.isSymbolicLink()) {
+		await unlink(target);
 		return;
 	}
-	if (url.origin !== "https://github.com" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
-	if (!url.pathname.startsWith("/saya-ch/dsh-mobile/releases/tag/v")) return void 0;
-	let version;
-	try {
-		version = decodeURIComponent(url.pathname.slice(34));
-	} catch {
+	if (!entry.isDirectory()) {
+		await unlink(target);
 		return;
 	}
-	return parseSemver(version) === void 0 ? void 0 : version;
+	for (const name of await readdir(target)) await removeCaddyTree(root, join(target, name));
+	await rmdir(target);
 }
-function androidReleaseDownloadUrl(version) {
-	if (version === void 0) return GITHUB_RELEASES_URL;
-	const tag = `v${version}`;
-	return `https://github.com/saya-ch/dsh-mobile/releases/download/${encodeURIComponent(tag)}/dsh-mobile-android-${encodeURIComponent(tag)}.apk`;
+//#endregion
+//#region src/caddy-component.ts
+const CADDY_VERSION = "2.11.6";
+const CADDY_DNS_PLUGIN_VERSION = "v0.4.3";
+const CADDY_DOWNLOAD_PAGE = "https://caddyserver.com/download";
+const CADDY_COMPONENT_RELEASES = Object.freeze({});
+Object.freeze({
+	version: CADDY_VERSION,
+	dnsPluginVersion: CADDY_DNS_PLUGIN_VERSION
+});
+function isCaddyDnsProvider(value) {
+	return value === "tencentcloud";
+}
+async function digest(file) {
+	return createHash("sha256").update(await readFile(file)).digest("hex");
+}
+/** Minimal process environment for version/module checks, without ambient API credentials or proxy overrides. */
+function caddyInspectionEnvironment(environment = process.env) {
+	const result = {};
+	for (const name of [
+		"SystemRoot",
+		"WINDIR",
+		"TEMP",
+		"TMP",
+		"LANG",
+		"LC_ALL"
+	]) if (environment[name] !== void 0) result[name] = environment[name];
+	return result;
+}
+async function inspect(executable) {
+	const options = {
+		env: caddyInspectionEnvironment(),
+		timeout: 15e3,
+		maxBuffer: 262144
+	};
+	return {
+		version: (await execFileText(executable, ["version"], options)).stdout.trim(),
+		modules: (await execFileText(executable, ["list-modules", "--versions"], options)).stdout
+	};
+}
+/** Owns only the optional pinned executable; runtime configuration belongs to CaddyConfigStore. */
+var CaddyComponentManager = class {
+	executable;
+	componentRoot;
+	componentStorage;
+	logRoot;
+	stateDirectory;
+	stagingRoot;
+	artifact;
+	fetchArtifact;
+	inspectExecutable;
+	promote;
+	installed = false;
+	errorCode;
+	queue = Promise.resolve();
+	constructor(options) {
+		if (!isAbsolute(options.stateDirectory)) throw new Error("caddy state directory must be absolute");
+		this.stateDirectory = resolve(options.stateDirectory);
+		const platform = options.platform ?? process.platform;
+		const arch = options.arch ?? process.arch;
+		const artifact = options.artifact ?? CADDY_COMPONENT_RELEASES[`${platform}-${arch}`];
+		if (artifact !== void 0 && (artifact.platform !== platform || artifact.arch !== arch || !/^https:\/\//u.test(artifact.downloadUrl) || !/^[a-f0-9]{64}$/u.test(artifact.downloadSha256) || !/^[a-f0-9]{64}$/u.test(artifact.executableSha256) || artifact.downloadBytes < 1 || artifact.executableBytes < 1 || !/^[a-z0-9.-]+$/u.test(artifact.executableName))) throw new Error("caddy_artifact_invalid");
+		this.artifact = artifact;
+		this.componentRoot = join(this.stateDirectory, "components", "caddy");
+		this.componentStorage = join(this.componentRoot, artifact?.version ?? "2.11.6");
+		this.executable = join(this.componentStorage, artifact?.executableName ?? (platform === "win32" ? "caddy.exe" : "caddy"));
+		this.logRoot = join(this.stateDirectory, "caddy", "logs");
+		this.stagingRoot = join(this.stateDirectory, "staging", "caddy");
+		this.fetchArtifact = options.fetchArtifact ?? ((url, signal) => downloadPinnedArtifact({
+			url,
+			signal,
+			expectedBytes: artifact?.downloadBytes ?? 0,
+			errorPrefix: "caddy"
+		}));
+		this.inspectExecutable = options.inspectExecutable ?? inspect;
+		this.promote = options.promoteDirectory ?? rename;
+	}
+	/** Recheck a pinned executable before launching; no unverified local binary can run. */
+	async ensureExecutable() {
+		const artifact = this.artifact;
+		if (artifact === void 0) throw new Error("caddy_component_unavailable");
+		await assertCaddyParents(this.stateDirectory, this.executable);
+		const entry = await lstat(this.executable);
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size !== artifact.executableBytes || await digest(this.executable) !== artifact.executableSha256) throw new Error("caddy_component_invalid");
+		await this.verifyMetadata(this.executable, artifact);
+	}
+	async initialize() {
+		this.installed = false;
+		this.errorCode = void 0;
+		if (this.artifact === void 0) {
+			this.errorCode = "caddy_component_unavailable";
+			return;
+		}
+		try {
+			await this.ensureExecutable();
+			this.installed = true;
+		} catch (error) {
+			if (error.code !== "ENOENT") this.errorCode = "caddy_component_invalid";
+		}
+	}
+	status() {
+		const artifact = this.artifact;
+		return Object.freeze({
+			supported: artifact !== void 0,
+			installed: this.installed,
+			version: artifact?.version ?? "2.11.6",
+			downloadBytes: artifact?.downloadBytes ?? 0,
+			installedBytes: this.installed ? artifact?.executableBytes ?? 0 : 0,
+			sourceUrl: artifact?.downloadUrl ?? "https://caddyserver.com/download",
+			downloadPage: CADDY_DOWNLOAD_PAGE,
+			storagePath: this.componentRoot,
+			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
+		});
+	}
+	/** Explicit installation verifies bytes and reported modules before preserving-old promotion. */
+	install() {
+		return this.enqueue(async () => {
+			const artifact = this.artifact;
+			if (artifact === void 0) throw new Error("caddy_component_unavailable");
+			await ensureCaddyDirectory(this.stateDirectory, this.stagingRoot);
+			await ensureCaddyDirectory(this.stateDirectory, this.componentRoot);
+			const staging = await mkdtemp(join(this.stagingRoot, "install-"));
+			const candidate = join(this.componentRoot, ".install-" + randomBytes(12).toString("hex"));
+			const backup = join(this.componentRoot, ".previous-" + randomBytes(12).toString("hex"));
+			let previous = false;
+			let promoted = false;
+			try {
+				const controller = new AbortController();
+				const timeout = setTimeout(() => {
+					controller.abort();
+				}, 6e5);
+				timeout.unref();
+				let bytes;
+				try {
+					bytes = await this.fetchArtifact(artifact.downloadUrl, controller.signal);
+				} finally {
+					clearTimeout(timeout);
+				}
+				if (bytes.byteLength !== artifact.downloadBytes) throw new Error("caddy_download_size_mismatch");
+				if (createHash("sha256").update(bytes).digest("hex") !== artifact.downloadSha256) throw new Error("caddy_download_hash_mismatch");
+				await ensureCaddyDirectory(this.stateDirectory, candidate);
+				const executable = join(candidate, artifact.executableName);
+				await writeFile(executable, bytes, {
+					flag: "wx",
+					mode: 448
+				});
+				await chmod(executable, 448);
+				if (bytes.byteLength !== artifact.executableBytes || await digest(executable) !== artifact.executableSha256) throw new Error("caddy_executable_hash_mismatch");
+				await this.verifyMetadata(executable, artifact);
+				try {
+					const entry = await lstat(this.componentStorage);
+					if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error("caddy_path_invalid");
+					await rename(this.componentStorage, backup);
+					previous = true;
+				} catch (error) {
+					if (error.code !== "ENOENT") throw error;
+				}
+				try {
+					await this.promote(candidate, this.componentStorage);
+					promoted = true;
+				} catch (error) {
+					if (previous) {
+						await rename(backup, this.componentStorage);
+						previous = false;
+					}
+					throw error;
+				}
+				this.installed = true;
+				this.errorCode = void 0;
+			} finally {
+				await removeCaddyTree(this.stateDirectory, staging);
+				await removeCaddyTree(this.stateDirectory, candidate);
+				if (previous && promoted) await removeCaddyTree(this.stateDirectory, backup);
+			}
+		});
+	}
+	/** Remove optional component files; callers stop the controller and purge runtime configuration separately. */
+	purge() {
+		return this.enqueue(async () => {
+			await removeCaddyTree(this.stateDirectory, this.componentRoot);
+			await removeCaddyTree(this.stateDirectory, this.stagingRoot);
+			this.installed = false;
+			this.errorCode = this.artifact === void 0 ? "caddy_component_unavailable" : void 0;
+		});
+	}
+	async verifyMetadata(executable, artifact) {
+		const info = await this.inspectExecutable(executable);
+		if (!info.version.startsWith("v" + artifact.version + " ")) throw new Error("caddy_executable_version_mismatch");
+		const nonstandard = info.modules.split(/\r?\n/u).filter((line) => line.startsWith("dns.providers."));
+		if (nonstandard.length !== 1 || nonstandard[0] !== "dns.providers.tencentcloud " + artifact.dnsPluginVersion || !info.modules.includes("Non-standard modules: 1")) throw new Error("caddy_executable_modules_mismatch");
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task.then(() => this.status());
+	}
+};
+const MAX_CONFIG_BYTES = 16384;
+/** Inject only the DNS credentials needed by the managed child. */
+function caddyCredentialEnvironment(provider, credentials) {
+	if (!isCaddyDnsProvider(provider)) throw new Error("caddy_dns_provider_invalid");
+	return {
+		TENCENTCLOUD_SECRET_ID: credentials.secretId,
+		TENCENTCLOUD_SECRET_KEY: credentials.secretKey
+	};
+}
+/** Validate saved or administrative settings, including ports reserved by DSH. */
+function parseCaddySettings(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("caddy_settings_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => ![
+		"version",
+		"publicOrigin",
+		"dnsProvider",
+		"listenPort"
+	].includes(String(key))) || record.version !== void 0 && record.version !== 1) throw new Error("caddy_settings_invalid");
+	if (!isCaddyDnsProvider(record.dnsProvider)) throw new Error("caddy_dns_provider_invalid");
+	const listenPort = record.listenPort ?? 8443;
+	if (!Number.isSafeInteger(listenPort) || Number(listenPort) < 1024 || Number(listenPort) > 65535) throw new Error("caddy_listen_port_invalid");
+	if ([
+		3444,
+		3443,
+		3080
+	].includes(Number(listenPort))) throw new Error("caddy_listen_port_reserved");
+	const publicOrigin = validateOriginPublicOrigin(record.publicOrigin);
+	if (isIP(new URL(publicOrigin).hostname) !== 0) throw new Error("caddy_domain_required");
+	return Object.freeze({
+		version: 1,
+		publicOrigin,
+		dnsProvider: record.dnsProvider,
+		listenPort: Number(listenPort)
+	});
+}
+function parseCredentials(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("caddy_credentials_invalid");
+	const record = value;
+	if (Reflect.ownKeys(record).some((key) => key !== "secretId" && key !== "secretKey")) throw new Error("caddy_credentials_invalid");
+	const { secretId, secretKey } = record;
+	if (typeof secretId !== "string" || typeof secretKey !== "string" || secretId.length === 0 || secretKey.length === 0 || secretId.length > 512 || secretKey.length > 512 || /[\s\u0000-\u001f\u007f]/u.test(secretId + secretKey)) throw new Error("caddy_credentials_invalid");
+	return Object.freeze({
+		secretId,
+		secretKey
+	});
+}
+/** Render a single TLS site, with no admin API, config autosave, or embedded DNS secrets. */
+function renderCaddyfile(settings, stateDirectory, backendPort = 3444) {
+	const validated = parseCaddySettings(settings);
+	if (!Number.isSafeInteger(backendPort) || backendPort < 1 || backendPort > 65535) throw new Error("caddy_backend_port_invalid");
+	const root = resolve(stateDirectory, "caddy");
+	const dataDirectory = join(root, "data").replaceAll("\\", "/");
+	const hostname = new URL(validated.publicOrigin).hostname;
+	return [
+		"{",
+		"	admin off",
+		"	persist_config off",
+		"	auto_https disable_redirects",
+		`\tstorage file_system ${JSON.stringify(dataDirectory)}`,
+		"	log {",
+		"		output discard",
+		"	}",
+		"}",
+		"",
+		`https://${hostname}:${String(validated.listenPort)} {`,
+		"	tls {",
+		"		dns tencentcloud {",
+		"			secret_id {env.TENCENTCLOUD_SECRET_ID}",
+		"			secret_key {env.TENCENTCLOUD_SECRET_KEY}",
+		"		}",
+		"	}",
+		`\treverse_proxy 127.0.0.1:${String(backendPort)} {`,
+		"		header_up Host {http.request.hostport}",
+		"		transport http {",
+		"			keepalive off",
+		"			dial_timeout 5s",
+		"		}",
+		"	}",
+		"}",
+		""
+	].join("\n");
+}
+/** Owns one atomic configuration record and every Caddy-created private file. */
+var CaddyConfigStore = class {
+	stateDirectory;
+	rootDirectory;
+	settingsFile;
+	envFile;
+	caddyfile;
+	dataDirectory;
+	configDirectory;
+	logsDirectory;
+	settingsValue;
+	credentialsValue;
+	errorCodeValue;
+	queue = Promise.resolve();
+	constructor(stateDirectory) {
+		this.stateDirectory = stateDirectory;
+		if (!isAbsolute(stateDirectory)) throw new Error("caddy config state directory must be absolute");
+		this.rootDirectory = resolve(stateDirectory, "caddy");
+		this.settingsFile = join(this.rootDirectory, "config.json");
+		this.envFile = this.settingsFile;
+		this.caddyfile = join(this.rootDirectory, "Caddyfile");
+		this.dataDirectory = join(this.rootDirectory, "data");
+		this.configDirectory = join(this.rootDirectory, "xdg-config");
+		this.logsDirectory = join(this.rootDirectory, "logs");
+	}
+	settings() {
+		return this.settingsValue;
+	}
+	credentials() {
+		return this.credentialsValue;
+	}
+	errorCode() {
+		return this.errorCodeValue;
+	}
+	status() {
+		const settings = this.settingsValue;
+		return Object.freeze({
+			configured: settings !== void 0 && this.credentialsValue !== void 0,
+			credentialsConfigured: this.credentialsValue !== void 0,
+			storagePath: this.rootDirectory,
+			...settings === void 0 ? {} : {
+				publicOrigin: settings.publicOrigin,
+				listenPort: settings.listenPort,
+				dnsProvider: settings.dnsProvider
+			},
+			...this.errorCodeValue === void 0 ? {} : { errorCode: this.errorCodeValue }
+		});
+	}
+	async initialize() {
+		await this.enqueue(async () => {
+			this.settingsValue = void 0;
+			this.credentialsValue = void 0;
+			this.errorCodeValue = void 0;
+			await assertCaddyParents(this.stateDirectory, this.settingsFile);
+			let entry;
+			try {
+				entry = await lstat(this.settingsFile);
+			} catch (error) {
+				if (error.code === "ENOENT") return;
+				throw error;
+			}
+			if (!entry.isFile() || entry.isSymbolicLink() || entry.size > MAX_CONFIG_BYTES) {
+				this.errorCodeValue = "caddy_config_invalid";
+				return;
+			}
+			await restrictPrivateFile(this.settingsFile);
+			try {
+				const record = JSON.parse(await readFile(this.settingsFile, "utf8"));
+				if (typeof record !== "object" || record === null || Array.isArray(record)) throw new Error("invalid");
+				const values = record;
+				if (Reflect.ownKeys(values).some((key) => key !== "settings" && key !== "credentials")) throw new Error("invalid");
+				const settings = parseCaddySettings(values.settings);
+				const credentials = parseCredentials(values.credentials);
+				this.settingsValue = settings;
+				this.credentialsValue = credentials;
+			} catch {
+				this.errorCodeValue = "caddy_config_invalid";
+			}
+		});
+	}
+	/** Atomically save validated settings and credentials; omitted or both-blank secrets retain saved ones. */
+	configure(value, credentialInput) {
+		return this.enqueue(async () => {
+			const settings = parseCaddySettings(value);
+			const blank = typeof credentialInput === "object" && credentialInput !== null && !Array.isArray(credentialInput) && credentialInput.secretId === "" && credentialInput.secretKey === "" && Reflect.ownKeys(credentialInput).every((key) => key === "secretId" || key === "secretKey");
+			const credentials = credentialInput === void 0 || blank ? this.credentialsValue : parseCredentials(credentialInput);
+			if (credentials === void 0) throw new Error("caddy_credentials_missing");
+			await writeCaddyPrivateFile(this.stateDirectory, this.settingsFile, JSON.stringify({
+				settings,
+				credentials
+			}) + "\n");
+			this.settingsValue = settings;
+			this.credentialsValue = credentials;
+			this.errorCodeValue = void 0;
+		});
+	}
+	/** Write derived runtime files after authoritative settings are available. */
+	prepareCaddyfile(backendPort) {
+		return this.enqueue(async () => {
+			const settings = this.settingsValue;
+			if (settings === void 0 || this.credentialsValue === void 0) throw new Error("caddy_config_missing");
+			for (const directory of [
+				this.dataDirectory,
+				this.configDirectory,
+				this.logsDirectory
+			]) await ensureCaddyDirectory(this.stateDirectory, directory);
+			await writeCaddyPrivateFile(this.stateDirectory, this.caddyfile, renderCaddyfile(settings, this.stateDirectory, backendPort));
+		});
+	}
+	/** Remove credentials, certificates, private keys, configuration, logs, and runtime cache. */
+	purge() {
+		return this.enqueue(async () => {
+			await removeCaddyTree(this.stateDirectory, this.rootDirectory);
+			this.settingsValue = void 0;
+			this.credentialsValue = void 0;
+			this.errorCodeValue = void 0;
+		});
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+};
+//#endregion
+//#region src/caddy.ts
+/** Private directories override Caddy's platform defaults; ambient API keys and admin/proxy overrides are omitted. */
+function caddyProcessEnvironment(config, settings, environment = process.env) {
+	const credentials = config.credentials();
+	if (credentials === void 0) throw new Error("caddy_credentials_missing");
+	return {
+		...caddyInspectionEnvironment(environment),
+		...caddyCredentialEnvironment(settings.dnsProvider, credentials),
+		HOME: config.rootDirectory,
+		USERPROFILE: config.rootDirectory,
+		APPDATA: config.configDirectory,
+		LOCALAPPDATA: config.dataDirectory,
+		XDG_DATA_HOME: config.dataDirectory,
+		XDG_CONFIG_HOME: config.configDirectory
+	};
+}
+function spawnCaddy(executable, args, environment) {
+	return spawn(executable, [...args], {
+		env: environment,
+		shell: false,
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		windowsHide: true
+	});
+}
+async function validate(executable, caddyfile, environment, signal) {
+	try {
+		await execFileText(executable, [
+			"adapt",
+			"--config",
+			caddyfile,
+			"--adapter",
+			"caddyfile"
+		], {
+			env: environment,
+			signal,
+			timeout: 15e3,
+			maxBuffer: 262144
+		});
+	} catch {
+		throw new Error("caddy_config_validation_failed");
+	}
+}
+/** Owns Caddy and a loopback Gateway until both have stopped; ready requires verified public TLS and instance identity. */
+var CaddyController = class {
+	options;
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	child;
+	gatewayValue;
+	generation = 0;
+	startupAbort;
+	latest = Object.freeze({
+		enabled: false,
+		state: "off"
+	});
+	queue = Promise.resolve();
+	closeTask;
+	constructor(options) {
+		this.options = options;
+	}
+	initialize() {
+		return this.enqueue(async () => {
+			if (this.initialized) return;
+			if (this.disposed) throw new Error("caddy_controller_unavailable");
+			this.enabled = (await this.options.store.load()).enabled;
+			this.initialized = true;
+			if (this.enabled) await this.start();
+		});
+	}
+	gateway() {
+		return this.latest.state === "ready" ? this.gatewayValue : void 0;
+	}
+	status() {
+		return this.latest;
+	}
+	/** Cancel a readiness attempt before its owning coordinator waits for queued teardown. */
+	cancelPendingStart() {
+		this.startupAbort?.abort();
+	}
+	setEnabled(enabled) {
+		if (!enabled) this.startupAbort?.abort();
+		return this.enqueue(async () => {
+			this.assertAvailable();
+			if (this.enabled === enabled && (!enabled || this.latest.state === "ready")) return;
+			if (!enabled) await this.stop();
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			this.enabled = enabled;
+			if (enabled) await this.start();
+			else this.publish({
+				enabled: false,
+				state: "off"
+			});
+		}).then(() => this.status());
+	}
+	reconnect() {
+		this.startupAbort?.abort();
+		return this.enqueue(async () => {
+			this.assertAvailable();
+			await this.stop();
+			await this.options.store.save({
+				version: 1,
+				enabled: true
+			});
+			this.enabled = true;
+			await this.start();
+		}).then(() => this.status());
+	}
+	reset() {
+		return this.setEnabled(false);
+	}
+	close() {
+		this.disposed = true;
+		this.startupAbort?.abort();
+		this.closeTask ??= this.enqueue(async () => {
+			await this.stop();
+			this.publish({
+				enabled: this.enabled,
+				state: "off"
+			});
+		}).catch((error) => {
+			this.closeTask = void 0;
+			throw error;
+		});
+		return this.closeTask;
+	}
+	assertAvailable() {
+		if (!this.initialized || this.disposed) throw new Error("caddy_controller_unavailable");
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+	publish(status) {
+		this.latest = Object.freeze(status);
+		try {
+			this.options.onStatus?.(this.latest);
+		} catch {}
+	}
+	async start() {
+		const generation = ++this.generation;
+		const startup = new AbortController();
+		this.startupAbort = startup;
+		const settings = this.options.config.settings();
+		if (settings === void 0 || this.options.config.credentials() === void 0) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "caddy_config_missing"
+			});
+			this.startupAbort = void 0;
+			return;
+		}
+		if (!this.options.component.status().supported) {
+			this.publish({
+				enabled: true,
+				state: "unavailable",
+				errorCode: "caddy_component_unavailable"
+			});
+			this.startupAbort = void 0;
+			return;
+		}
+		this.publish({
+			enabled: true,
+			state: "starting",
+			origin: settings.publicOrigin
+		});
+		let childFailure;
+		const deadline = setTimeout(() => {
+			startup.abort();
+		}, this.options.startupTimeoutMs ?? 12e4);
+		deadline.unref();
+		try {
+			await this.options.component.ensureExecutable();
+			if (startup.signal.aborted || this.disposed) throw new Error("caddy_start_cancelled");
+			const gateway = await this.options.createGateway(settings);
+			this.gatewayValue = gateway;
+			if (startup.signal.aborted || this.disposed) throw new Error("caddy_start_cancelled");
+			await this.options.config.prepareCaddyfile(gateway.address().port);
+			const environment = caddyProcessEnvironment(this.options.config, settings);
+			await (this.options.validateConfig ?? validate)(this.options.component.executable, this.options.config.caddyfile, environment, startup.signal);
+			if (startup.signal.aborted || this.disposed) throw new Error("caddy_start_cancelled");
+			const child = (this.options.spawnProcess ?? spawnCaddy)(this.options.component.executable, [
+				"run",
+				"--config",
+				this.options.config.caddyfile,
+				"--adapter",
+				"caddyfile"
+			], environment);
+			this.child = child;
+			child.stdout.resume();
+			child.stderr.resume();
+			child.stdin.end();
+			const failed = (code) => {
+				if (generation !== this.generation || this.child !== child) return;
+				childFailure = code;
+				startup.abort();
+				if (this.latest.state === "ready") this.enqueue(async () => {
+					if (generation !== this.generation) return;
+					await this.stop();
+					if (this.enabled && !this.disposed) this.publish({
+						enabled: true,
+						state: "error",
+						errorCode: code
+					});
+				}).catch(() => {
+					this.publish({
+						enabled: this.enabled,
+						state: "error",
+						errorCode: "caddy_cleanup_failed"
+					});
+				});
+			};
+			child.once("error", () => {
+				failed("caddy_launch_failed");
+			});
+			child.once("close", () => {
+				failed("caddy_exited");
+			});
+			const probe = this.options.probeDiscovery ?? ((origin, expected, signal) => defaultProbeDiscovery({ origin }, expected, signal));
+			while (true) {
+				if (startup.signal.aborted || this.disposed) throw new Error(childFailure ?? "caddy_start_timeout");
+				let ready = false;
+				try {
+					ready = await probe(settings.publicOrigin, this.options.instanceId, startup.signal);
+				} catch (error) {
+					if (error instanceof Error && (error.message === "frp_discovery_mismatch" || error.message === "frp_discovery_invalid")) throw new Error("caddy_public_identity_invalid");
+				}
+				if (startup.signal.aborted || this.disposed || generation !== this.generation) throw new Error(childFailure ?? "caddy_start_timeout");
+				if (ready) break;
+				await this.waitForProbe(startup.signal);
+			}
+			this.publish({
+				enabled: true,
+				state: "ready",
+				origin: settings.publicOrigin,
+				backendOrigin: "http://127.0.0.1:" + String(gateway.address().port)
+			});
+		} catch (error) {
+			++this.generation;
+			await this.stopResources();
+			if (!this.disposed) this.publish({
+				enabled: this.enabled,
+				state: "error",
+				errorCode: childFailure ?? (error instanceof Error && error.message.startsWith("caddy_") ? error.message : error.code === "EADDRINUSE" ? "caddy_backend_port_in_use" : "caddy_start_failed")
+			});
+		} finally {
+			clearTimeout(deadline);
+			if (this.startupAbort === startup) this.startupAbort = void 0;
+		}
+	}
+	waitForProbe(signal) {
+		if (signal.aborted) return Promise.resolve();
+		return new Promise((resolve) => {
+			const done = () => {
+				clearTimeout(timer);
+				signal.removeEventListener("abort", done);
+				resolve();
+			};
+			const timer = setTimeout(done, this.options.probeIntervalMs ?? 1e3);
+			timer.unref();
+			signal.addEventListener("abort", done, { once: true });
+		});
+	}
+	async stop() {
+		++this.generation;
+		this.startupAbort?.abort();
+		await this.stopResources();
+	}
+	async stopResources() {
+		const child = this.child;
+		const gateway = this.gatewayValue;
+		await settleRemoteResources([async () => {
+			if (child !== void 0) {
+				await (this.options.terminateProcess ?? terminateRemoteProcess)(child);
+				if (this.child === child) this.child = void 0;
+			}
+		}, async () => {
+			if (gateway !== void 0) {
+				await gateway.close();
+				if (this.gatewayValue === gateway) this.gatewayValue = void 0;
+			}
+		}], "caddy cleanup failed");
+	}
+};
+//#endregion
+//#region src/managed-origin.ts
+/** Children never independently restore a durable enabled switch. */
+function createVolatileRemoteControlStore() {
+	let value = {
+		version: 1,
+		enabled: false
+	};
+	return {
+		load: async () => value,
+		save: async (state) => {
+			value = Object.freeze({ ...state });
+		}
+	};
+}
+function parseMode(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("origin_mode_invalid");
+	const record = value;
+	if (record.version !== 1 || record.mode !== "external" && record.mode !== "managed" || Reflect.ownKeys(record).some((key) => key !== "version" && key !== "mode")) throw new Error("origin_mode_invalid");
+	return Object.freeze({
+		version: 1,
+		mode: record.mode
+	});
+}
+/** Persist only origin's upstream mode, defaulting to the existing external-proxy behavior. */
+var JsonOriginModeStore = class {
+	file;
+	constructor(file) {
+		this.file = file;
+		if (!isAbsolute(file)) throw new Error("origin mode file must be absolute");
+	}
+	async load() {
+		await assertCaddyParents(dirname(this.file), this.file);
+		let entry;
+		try {
+			entry = await lstat(this.file);
+		} catch (error) {
+			if (error.code === "ENOENT") return {
+				version: 1,
+				mode: "external"
+			};
+			throw error;
+		}
+		if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 1024) throw new Error("origin_mode_invalid");
+		await restrictPrivateFile(this.file);
+		return parseMode(JSON.parse(await readFile(this.file, "utf8")));
+	}
+	async save(value) {
+		await writeCaddyPrivateFile(dirname(this.file), this.file, JSON.stringify(parseMode(value)) + "\n");
+	}
+};
+/** One origin-provider owner selects exactly one upstream; external settings and shared device records remain untouched. */
+var ManagedOriginController = class {
+	options;
+	selected = "external";
+	enabled = false;
+	initialized = false;
+	disposed = false;
+	queue = Promise.resolve();
+	closeTask;
+	constructor(options) {
+		this.options = options;
+	}
+	mode() {
+		return this.selected;
+	}
+	status() {
+		return Object.freeze({
+			...this.controller().status(),
+			enabled: this.enabled,
+			mode: this.selected
+		});
+	}
+	gateway() {
+		return this.enabled ? this.controller().gateway() : void 0;
+	}
+	initialize() {
+		return this.enqueue(async () => {
+			if (this.initialized) return;
+			if (this.disposed) throw new Error("origin_controller_unavailable");
+			this.selected = (await this.options.modeStore.load()).mode;
+			this.enabled = (await this.options.store.load()).enabled;
+			await this.options.external.initialize();
+			await this.options.managed.initialize();
+			await this.options.external.setEnabled(false);
+			await this.options.managed.setEnabled(false);
+			this.initialized = true;
+			if (this.enabled && !this.disposed) await this.controller().setEnabled(true);
+		});
+	}
+	selectMode(mode) {
+		if (mode !== this.selected) this.options.managed.cancelPendingStart?.();
+		return this.enqueue(async () => {
+			this.assertAvailable();
+			if (mode !== "external" && mode !== "managed") throw new Error("origin_mode_invalid");
+			if (mode === this.selected) return;
+			const previous = this.controller();
+			await previous.setEnabled(false);
+			try {
+				await this.options.modeStore.save({
+					version: 1,
+					mode
+				});
+			} catch (error) {
+				if (this.enabled && !this.disposed) await previous.setEnabled(true);
+				throw error;
+			}
+			this.selected = mode;
+			if (this.enabled && !this.disposed) try {
+				await this.controller().setEnabled(true);
+			} catch (error) {
+				await this.stopBoth();
+				throw error;
+			}
+		}).then(() => this.status());
+	}
+	setEnabled(enabled) {
+		if (!enabled) this.options.managed.cancelPendingStart?.();
+		return this.enqueue(async () => {
+			this.assertAvailable();
+			if (!enabled) await this.stopBoth();
+			await this.options.store.save({
+				version: 1,
+				enabled
+			});
+			this.enabled = enabled;
+			if (enabled && !this.disposed) try {
+				await this.controller().setEnabled(true);
+			} catch (error) {
+				await this.stopBoth();
+				throw error;
+			}
+		}).then(() => this.status());
+	}
+	reconnect() {
+		this.options.managed.cancelPendingStart?.();
+		return this.enqueue(async () => {
+			this.assertAvailable();
+			await this.stopBoth();
+			await this.options.store.save({
+				version: 1,
+				enabled: true
+			});
+			this.enabled = true;
+			if (!this.disposed) try {
+				await this.controller().reconnect();
+			} catch (error) {
+				await this.stopBoth();
+				throw error;
+			}
+		}).then(() => this.status());
+	}
+	reset() {
+		return this.setEnabled(false);
+	}
+	close() {
+		this.disposed = true;
+		this.closeTask ??= settleRemoteResources([() => this.options.external.close(), () => this.options.managed.close()]).then(() => this.queue).catch((error) => {
+			this.closeTask = void 0;
+			throw error;
+		});
+		return this.closeTask;
+	}
+	controller() {
+		return this.options[this.selected];
+	}
+	assertAvailable() {
+		if (!this.initialized || this.disposed) throw new Error("origin_controller_unavailable");
+	}
+	stopBoth() {
+		return settleRemoteResources([async () => {
+			await this.options.external.setEnabled(false);
+		}, async () => {
+			await this.options.managed.setEnabled(false);
+		}]);
+	}
+	enqueue(operation) {
+		const task = this.queue.then(operation, operation);
+		this.queue = task.then(() => void 0, () => void 0);
+		return task;
+	}
+};
+//#endregion
+//#region src/release-update.ts
+const PACKAGE_NAME = "dsh-mobile";
+const NPM_LATEST_URL = "https://registry.npmjs.org/dsh-mobile/latest";
+const GITHUB_LATEST_URL = "https://github.com/saya-ch/dsh-mobile/releases/latest";
+const GITHUB_API_LATEST_URL = "https://api.github.com/repos/saya-ch/dsh-mobile/releases/latest";
+const GITHUB_RELEASES_URL = "https://github.com/saya-ch/dsh-mobile/releases";
+const RELEASE_NOTES_MAX_CHARS = 4e3;
+const STATUS_CACHE_MS = 6e5;
+const REQUEST_TIMEOUT_MS = 8e3;
+const UPDATE_TIMEOUT_MS = 12e4;
+const UPDATE_TERMINATION_GRACE_MS = 1500;
+const NUMERIC_VERSION_IDENTIFIER = "(?:0|[1-9]\\d*)";
+const WILDCARD_VERSION_IDENTIFIER = "(?:[xX*])";
+const RANGE_VERSION = `(?:${`${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}\\.${NUMERIC_VERSION_IDENTIFIER}(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?`}|${`(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}(?:\\.(?:${WILDCARD_VERSION_IDENTIFIER}|${NUMERIC_VERSION_IDENTIFIER}))?))?)`})`;
+const COMPARATOR = new RegExp(`^(?:<=|>=|<|>|=|~|\\^)?${RANGE_VERSION}$`, "u");
+const HYPHEN_RANGE = new RegExp(`^${RANGE_VERSION} +[-] +${RANGE_VERSION}$`, "u");
+const DIST_TAG = /^[A-Za-z][A-Za-z0-9._-]{0,127}$/u;
+function parseSemver(value) {
+	const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/u.exec(value);
+	if (match === null) return void 0;
+	const core = [
+		Number(match[1]),
+		Number(match[2]),
+		Number(match[3])
+	];
+	if (core.some((part) => !Number.isSafeInteger(part))) return void 0;
+	const prerelease = match[4] === void 0 ? [] : match[4].split(".").map((part) => /^\d+$/u.test(part) ? Number(part) : part);
+	if (prerelease.some((part) => typeof part === "number" && !Number.isSafeInteger(part))) return void 0;
+	return Object.freeze({
+		core,
+		prerelease: Object.freeze(prerelease)
+	});
+}
+/** Compare two strict SemVer strings, including prerelease precedence. */
+function comparePluginVersions(left, right) {
+	const a = parseSemver(left);
+	const b = parseSemver(right);
+	if (a === void 0 || b === void 0) return void 0;
+	for (let index = 0; index < a.core.length; index += 1) {
+		const difference = a.core[index] - b.core[index];
+		if (difference !== 0) return Math.sign(difference);
+	}
+	if (a.prerelease.length === 0 || b.prerelease.length === 0) return a.prerelease.length === b.prerelease.length ? 0 : a.prerelease.length === 0 ? 1 : -1;
+	const length = Math.max(a.prerelease.length, b.prerelease.length);
+	for (let index = 0; index < length; index += 1) {
+		const leftPart = a.prerelease[index];
+		const rightPart = b.prerelease[index];
+		if (leftPart === void 0 || rightPart === void 0) return leftPart === void 0 ? -1 : 1;
+		if (leftPart === rightPart) continue;
+		if (typeof leftPart === "number" && typeof rightPart === "number") return Math.sign(leftPart - rightPart);
+		if (typeof leftPart === "number") return -1;
+		if (typeof rightPart === "number") return 1;
+		return leftPart < rightPart ? -1 : 1;
+	}
+	return 0;
+}
+function isComparatorSet(value) {
+	if (HYPHEN_RANGE.test(value)) return true;
+	const comparators = value.replace(/(<=|>=|<|>|=|~|\^) +/gu, "$1").split(/ +/u);
+	return comparators.length > 0 && comparators.every((comparator) => COMPARATOR.test(comparator));
+}
+function isNpmVersionRange(value) {
+	if (!/^[0-9xX*<>=~^|.+\- ]+$/u.test(value)) return false;
+	const alternatives = value.split(/ *\|\| */u);
+	return alternatives.length > 0 && alternatives.every((alternative) => alternative !== "" && isComparatorSet(alternative));
+}
+/** Return whether pnpm may safely replace this profile dependency from an npm version, range, or tag. */
+function isRegistryPluginSpec(value) {
+	if (typeof value !== "string" || value.trim() !== value || value === "" || /[\u0000-\u001f\u007f]/u.test(value)) return false;
+	if (/\.(?:tgz|tar(?:\.gz)?)$/iu.test(value)) return false;
+	return parseSemver(value) !== void 0 || isNpmVersionRange(value) || DIST_TAG.test(value);
+}
+/** Resolve the DSH profile named by the current launcher arguments. */
+function launchedProfileName(argv) {
+	for (let index = 0; index < argv.length; index += 1) {
+		if (argv[index] === "--profile") {
+			const candidate = argv[index + 1];
+			if (candidate !== void 0 && /^[\w.-]+$/u.test(candidate)) return candidate;
+		}
+		const match = /^--profile=([\w.-]+)$/u.exec(argv[index] ?? "");
+		if (match?.[1] !== void 0) return match[1];
+	}
+	return "web";
+}
+/** Resolve the launcher-owned Desktop profile, or the CLI profile outside Desktop. */
+function releaseProfileDirectory(ctx, dshHome, argv) {
+	const desktopProfiles = ctx.get("desktopProfiles");
+	const desktopDirectory = desktopProfiles?.current?.dir;
+	if (typeof desktopDirectory === "string" && isAbsolute(desktopDirectory)) return desktopDirectory;
+	if (desktopProfiles !== void 0 || ctx.get("desktopRuntime") !== void 0) return void 0;
+	return join(dshHome, "profiles", launchedProfileName(argv));
+}
+async function profileDependencySpec(profileDirectory) {
+	try {
+		const value = JSON.parse(await readFile(join(profileDirectory, "package.json"), "utf8")).dependencies?.[PACKAGE_NAME];
+		return typeof value === "string" ? value : void 0;
+	} catch {
+		return;
+	}
+}
+async function fetchNpmVersion(fetcher) {
+	const response = await fetcher(NPM_LATEST_URL, {
+		headers: {
+			accept: "application/json",
+			"user-agent": "dsh-mobile-release-check"
+		},
+		signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+	});
+	if (!response.ok) return void 0;
+	const payload = await response.json();
+	return typeof payload.version === "string" && parseSemver(payload.version) !== void 0 ? payload.version : void 0;
+}
+function githubReleaseVersion(location, responseUrl) {
+	let url;
+	try {
+		url = new URL(location ?? responseUrl, GITHUB_LATEST_URL);
+	} catch {
+		return;
+	}
+	if (url.origin !== "https://github.com" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return void 0;
+	if (!url.pathname.startsWith("/saya-ch/dsh-mobile/releases/tag/v")) return void 0;
+	let version;
+	try {
+		version = decodeURIComponent(url.pathname.slice(34));
+	} catch {
+		return;
+	}
+	return parseSemver(version) === void 0 ? void 0 : version;
+}
+function androidReleaseDownloadUrl(version) {
+	if (version === void 0) return GITHUB_RELEASES_URL;
+	const tag = `v${version}`;
+	return `https://github.com/saya-ch/dsh-mobile/releases/download/${encodeURIComponent(tag)}/dsh-mobile-android-${encodeURIComponent(tag)}.apk`;
 }
 async function fetchAndroidVersion(fetcher) {
 	const response = await fetcher(GITHUB_LATEST_URL, {
@@ -13324,7 +15121,8 @@ async function loadSetup(config) {
 	if (record.version === 2) return {
 		kind: "managed",
 		config: withoutSetupKeys(config),
-		setup: parseManagedSetup(record)
+		setup: parseManagedSetup(record),
+		setupFile: resolve(config.setupFile)
 	};
 	if (record.version !== 1 || Reflect.ownKeys(record).some((key) => typeof key !== "string" || !SETUP_KEYS.has(key))) throw new Error("mobile setup file has an unsupported format");
 	const { version: _version, ...setup } = record;
@@ -13432,7 +15230,7 @@ function originGatewayConfig(template, settings, stateFile, instanceId, listenPo
 		allowedCidrs: Object.freeze(validated.allowedCidrs.map(parseCidr))
 	});
 }
-function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration) {
+function remoteControlPayload(provider, status, gateway, providerStatuses, cpolarComponent, cloudflaredComponent, cloudflaredConfiguration, frpComponent, frpConfiguration, originConfiguration, caddyComponentStatus) {
 	return {
 		provider,
 		running: status.enabled,
@@ -13473,7 +15271,8 @@ function remoteControlPayload(provider, status, gateway, providerStatuses, cpola
 				bundled: true,
 				running: providerStatuses.origin.enabled,
 				state: providerStatuses.origin.state,
-				configuration: originConfiguration
+				configuration: originConfiguration,
+				component: caddyComponentStatus
 			}
 		}
 	};
@@ -13513,6 +15312,10 @@ async function apply(ctx, config) {
 	await frpConfig.initialize();
 	const originConfig = new OriginConfigStore(join(remoteDirectory, "origin", "config"));
 	await originConfig.initialize();
+	const caddyComponent = new CaddyComponentManager({ stateDirectory });
+	await caddyComponent.initialize();
+	const caddyConfig = new CaddyConfigStore(stateDirectory);
+	await caddyConfig.initialize();
 	const cloudflaredTunnel = new CloudflaredTunnelStore(join(remoteDirectory, "cloudflared"));
 	await cloudflaredTunnel.initialize();
 	const unregisterBuiltin = mobileAccess.registerExtension({
@@ -13548,8 +15351,13 @@ async function apply(ctx, config) {
 	const webSocketPaths = new WebSocketPathStore(join(stateDirectory, "websocket-paths.json"));
 	await webSocketPaths.load();
 	const blockedUpgradePaths = new BlockedUpgradePathLog();
+	const clientModulePreferences = new ClientModulePreferenceStore(join(stateDirectory, "client-modules.json"), template.excludedClientModules);
+	await clientModulePreferences.initialize();
 	let lanGateway;
 	let preparedLanSetup;
+	let trustedNetworksRestartRequired = false;
+	let trustedNetworksWrite = Promise.resolve();
+	let adminClosing = false;
 	const startGateway = async (candidateConfig) => {
 		const resolved = parseGatewayConfig({
 			...candidateConfig,
@@ -13557,7 +15365,7 @@ async function apply(ctx, config) {
 		});
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, (source, code) => {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
-		});
+		}, clientModulePreferences);
 		await candidate.start();
 		lanGateway = candidate;
 		const removeTaskSink = taskEventHub.add(candidate);
@@ -13613,7 +15421,7 @@ async function apply(ctx, config) {
 	}
 	const createRemoteGateway = async (publicOrigin, listenPort = 0) => {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, instanceId, listenPort);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		await candidate.start();
 		return candidate;
 	};
@@ -13629,7 +15437,7 @@ async function apply(ctx, config) {
 		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
 		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile);
 		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -13640,7 +15448,7 @@ async function apply(ctx, config) {
 	};
 	const createOriginGateway = async (settings) => {
 		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, instanceId);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -13654,6 +15462,23 @@ async function apply(ctx, config) {
 	const cloudflaredStore = new JsonMobileAccessControlStore(join(remoteDirectory, "cloudflared", "control.json"), false);
 	const frpStore = new JsonMobileAccessControlStore(join(remoteDirectory, "frp", "control.json"), false);
 	const originStore = new JsonMobileAccessControlStore(join(remoteDirectory, "origin", "control.json"), false);
+	const caddyController = new CaddyController({
+		store: createVolatileRemoteControlStore(),
+		component: caddyComponent,
+		config: caddyConfig,
+		instanceId,
+		createGateway: (settings) => createRemoteGateway(settings.publicOrigin)
+	});
+	const originController = new ManagedOriginController({
+		store: originStore,
+		modeStore: new JsonOriginModeStore(join(remoteDirectory, "origin", "upstream.json")),
+		external: new OriginController({
+			store: createVolatileRemoteControlStore(),
+			config: originConfig,
+			createGateway: createOriginGateway
+		}),
+		managed: caddyController
+	});
 	const remoteControllers = {
 		tailscale: new FunnelController({
 			store: tailscaleStore,
@@ -13692,11 +15517,7 @@ async function apply(ctx, config) {
 				await gateway.refreshProvidedTls();
 			}
 		}),
-		origin: new OriginController({
-			store: originStore,
-			config: originConfig,
-			createGateway: createOriginGateway
-		})
+		origin: originController
 	};
 	const remoteProviders = new RemoteProviderCoordinator(initialRemoteProvider, remoteControllers, remoteProviderStore);
 	const remoteController = () => remoteProviders.controller();
@@ -13706,13 +15527,18 @@ async function apply(ctx, config) {
 			controller.gateway()?.broadcastTaskEvent(event);
 		} });
 	}
-	const remotePayload = () => remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
-		tailscale: remoteControllers.tailscale.status(),
-		cpolar: remoteControllers.cpolar.status(),
-		cloudflared: remoteControllers.cloudflared.status(),
-		frp: remoteControllers.frp.status(),
-		origin: remoteControllers.origin.status()
-	}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status());
+	const remotePayload = () => ({
+		...remoteControlPayload(remoteProviders.selected, remoteController().status(), remoteController().gateway(), {
+			tailscale: remoteControllers.tailscale.status(),
+			cpolar: remoteControllers.cpolar.status(),
+			cloudflared: remoteControllers.cloudflared.status(),
+			frp: remoteControllers.frp.status(),
+			origin: remoteControllers.origin.status()
+		}, cpolarComponent.status(), cloudflaredComponent.status(), cloudflaredTunnel.status(), frpComponent.status(), frpConfig.status(), originConfig.status(), caddyComponent.status()),
+		originMode: originController.mode(),
+		caddyConfiguration: caddyConfig.status(),
+		caddyState: caddyController.status()
+	});
 	const lanPayload = () => ({
 		...loaded.kind === "unconfigured" ? {
 			configured: preparedLanSetup !== void 0,
@@ -13743,6 +15569,15 @@ async function apply(ctx, config) {
 			windowsFirewall: process.platform === "win32"
 		};
 	};
+	const trustedNetworksPayload = async () => {
+		if (loaded.kind !== "managed") return { supported: false };
+		return {
+			supported: true,
+			extraAllowedCidrs: parseManagedSetup(JSON.parse(await readFile(loaded.setupFile, "utf8"))).extraAllowedCidrs ?? [],
+			restartRequired: trustedNetworksRestartRequired,
+			windowsFirewall: process.platform === "win32"
+		};
+	};
 	const diagnosticsPayload = async () => {
 		let interfaceName;
 		let networkError;
@@ -13808,6 +15643,7 @@ async function apply(ctx, config) {
 			try {
 				const target = parseRequestTarget(request.url);
 				assertLocalAdminTrust(request, request.method === "POST", () => authenticateDesktopAdmin(request));
+				if (adminClosing) throw new HttpError(503, "unavailable");
 				if (target.search !== "") throw new HttpError(400, "bad_request");
 				const lanControl = target.decodedPathname === `/api/mobile-access/control` || target.decodedPathname === `/api/mobile-access/lan/control`;
 				if (request.method === "GET" && lanControl) {
@@ -13818,6 +15654,59 @@ async function apply(ctx, config) {
 					sendJson(response, 200, await lanSetupPayload(), false);
 					return;
 				}
+				if (target.decodedPathname === `/api/mobile-access/client-modules`) {
+					const gateway = lanGateway ?? remoteController().gateway();
+					if (gateway === void 0) throw new HttpError(409, "mobile_access_not_running");
+					const operation = new AbortController();
+					const abort = () => {
+						operation.abort();
+					};
+					response.once("close", abort);
+					try {
+						if (request.method === "GET") {
+							sendJson(response, 200, await gateway.describeClientModules(void 0, operation.signal), false);
+							return;
+						}
+						if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
+						const body = await readJsonObject(request, template.maxBodyBytes);
+						if (Object.keys(body).length !== 1 || Object.keys(body).some((key) => key !== "reset" && key !== "excludedClientModules")) throw new HttpError(400, "bad_request");
+						sendJson(response, 200, body.reset === true ? await gateway.resetClientModules(void 0, operation.signal) : await gateway.configureClientModules(body.excludedClientModules, void 0, operation.signal), false);
+					} catch (error) {
+						if (!(error instanceof ClientModuleConflictError)) throw error;
+						sendJson(response, 409, {
+							error: "excluded_client_modules_invalid",
+							detail: error.detail
+						}, false);
+					} finally {
+						response.removeListener("close", abort);
+						operation.abort();
+					}
+					return;
+				}
+				if (target.decodedPathname === `/api/mobile-access/lan/trusted-networks`) {
+					if (request.method === "GET") {
+						sendJson(response, 200, await trustedNetworksPayload(), false);
+						return;
+					}
+					if (request.method !== "POST") throw new HttpError(405, "method_not_allowed");
+					if (loaded.kind !== "managed") throw new HttpError(409, "lan_trusted_networks_unavailable");
+					const body = await readJsonObject(request, 4096);
+					let values;
+					try {
+						values = parseAdditionalTrustedNetworks(body.extraAllowedCidrs);
+					} catch {
+						throw new HttpError(400, "lan_trusted_networks_invalid");
+					}
+					const write = trustedNetworksWrite.then(async () => {
+						if (adminClosing) throw new HttpError(503, "unavailable");
+						await saveManagedTrustedNetworks(loaded.setupFile, values);
+						trustedNetworksRestartRequired = true;
+					});
+					trustedNetworksWrite = write.catch(() => void 0);
+					await write;
+					sendJson(response, 200, await trustedNetworksPayload(), false);
+					return;
+				}
 				if (request.method === "GET" && target.decodedPathname === `/api/mobile-access/diagnostics`) {
 					sendJson(response, 200, await diagnosticsPayload(), false);
 					return;
@@ -13945,6 +15834,63 @@ async function apply(ctx, config) {
 					sendJson(response, 200, remotePayload(), false);
 					return;
 				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/caddy/component/install`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					logger.info("caddy component install started");
+					try {
+						await remoteProviders.mutate(async () => caddyComponent.install());
+						logger.info("caddy component install completed");
+					} catch (error) {
+						logger.error("caddy component install failed: %s", error instanceof Error ? error.stack ?? error.message : String(error));
+						throw error;
+					}
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/caddy/settings`) {
+					const body = await readJsonObject(request, 8192);
+					if (body.connect !== void 0 && typeof body.connect !== "boolean") throw new HttpError(400, "bad_request");
+					const configure = async () => {
+						if (body.connect === true && !caddyComponent.status().installed) throw new HttpError(409, "caddy_component_unavailable");
+						await caddyConfig.configure(body.settings, {
+							secretId: body.secretId ?? "",
+							secretKey: body.secretKey ?? ""
+						});
+						if (body.connect === true) {
+							await originController.setEnabled(false);
+							await originController.selectMode("managed");
+							await originController.reconnect();
+						} else if (originController.mode() === "managed" && originController.status().enabled) await originController.reconnect();
+					};
+					if (body.connect === true) await remoteProviders.mutateSelected("origin", configure);
+					else await remoteProviders.mutate(configure);
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/origin/mode`) {
+					const body = await readJsonObject(request, 4096);
+					if (body.mode !== "external" && body.mode !== "managed") throw new HttpError(400, "bad_request");
+					const mode = body.mode;
+					if (mode === "managed" && !caddyComponent.status().installed) throw new HttpError(409, "caddy_component_unavailable");
+					await remoteProviders.mutate(async () => {
+						await originController.selectMode(mode);
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
+				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/caddy/component/purge`) {
+					if ((await readJsonObject(request, 4096)).confirm !== true) throw new HttpError(400, "bad_request");
+					await remoteProviders.mutate(async () => {
+						if (originController.mode() === "managed") {
+							await originController.setEnabled(false);
+							await originController.selectMode("external");
+						}
+						await caddyComponent.purge();
+						await caddyConfig.purge();
+					});
+					sendJson(response, 200, remotePayload(), false);
+					return;
+				}
 				if (request.method === "POST" && target.decodedPathname === `/api/mobile-access/remote/cloudflared/tunnel`) {
 					const body = await readJsonObject(request, 8192);
 					await remoteProviders.mutate(async () => {
@@ -14003,7 +15949,8 @@ async function apply(ctx, config) {
 					const settings = frpConfig.settings();
 					if (settings === void 0) throw new HttpError(409, "frp_config_missing");
 					const check = await frpIngressSelfCheck(settings, remoteDeviceFile);
-					const [frpsReachable, entryReachable] = await Promise.all([probeTcpReachable(settings.serverAddress, settings.serverPort), probeTcpReachable(settings.serverAddress, resolveFrpPublicPort(settings))]);
+					const entry = resolveFrpEntryProbe(settings);
+					const [frpsReachable, entryReachable] = await Promise.all([probeTcpReachable(settings.serverAddress, settings.serverPort), probeTcpReachable(entry.host, entry.port)]);
 					sendJson(response, 200, {
 						...remotePayload(),
 						frpSelfCheck: {
@@ -14171,6 +16118,10 @@ async function apply(ctx, config) {
 	};
 	await ctx.effect(async () => {
 		const unregister = ctx.webServer.register(adminRoute);
+		const stopAdmin = () => {
+			adminClosing = true;
+			unregister();
+		};
 		const disposeMobileCommand = ctx.commands.register({
 			name: "mobile",
 			description: "定制手机界面或添加电脑能力",
@@ -14227,7 +16178,8 @@ async function apply(ctx, config) {
 		} catch (error) {
 			try {
 				await settleCleanupSteps([
-					unregister,
+					stopAdmin,
+					() => trustedNetworksWrite,
 					disposeMobileCommand,
 					disposeTaskEvents,
 					async () => {
@@ -14245,7 +16197,8 @@ async function apply(ctx, config) {
 		}
 		return async () => {
 			await settleCleanupSteps([
-				unregister,
+				stopAdmin,
+				() => trustedNetworksWrite,
 				disposeMobileCommand,
 				disposeTaskEvents,
 				async () => {
@@ -14260,6 +16213,6 @@ async function apply(ctx, config) {
 	}, "dsh-mobile: independent LAN and selectable remote providers with /mobile command");
 }
 //#endregion
-export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CSRF_COOKIE, CSRF_HEADER, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
+export { AUTH_PREFIX, AccessController, AccessError, BlockedUpgradePathLog, BoundedRateLimiter, CERT_EXPIRING_DAYS, CLOUDFLARED_COMPONENT_RELEASE, CLOUDFLARED_COMPONENT_RELEASES, CSRF_COOKIE, CSRF_HEADER, ClientModuleConflictError, ClientModulePreferenceStore, CloudflaredComponentManager, CloudflaredController, CloudflaredTunnelStore, Config, DEFAULT_ORIGIN_LISTEN_PORT, FRP_VHOST_HTTP_PORT as DEFAULT_VHOST_HTTP_PORT, FRP_VHOST_HTTP_PORT, DEVICE_COOKIE, EXTENSION_LIMITS, FRP_ATTACH_DISCOVERY_PATH, FRP_ATTACH_LOCAL_DECLARATION, FRP_ATTACH_SELF_SIGNED_DECLARATION, FRP_ATTACH_VPS_DECLARATION, FRP_CADDY_IMPORT_LINE, FRP_CADDY_SNIPPET_MARKER, FRP_CADDY_SNIPPET_PATH, FRP_COMPONENT_RELEASES, FRP_DEFAULT_PROXY_NAME, FRP_DEFAULT_PUBLIC_PORT, FRP_RESERVED_PORTS, FrpComponentManager, FrpConfigStore, FrpController, JsonDeviceStore, JsonMobileAccessControlStore, JsonRemoteProviderStore, LOCAL_ADMIN_PREFIX, MAX_BLOCKED_UPGRADE_PATHS, MAX_EXTRA_WEBSOCKET_PATHS, MAX_WEBSOCKET_PATH_LENGTH, MemoryDeviceStore, MobileAccessGateway, MobileAccessGatewayController, MobileAccessService, MobileExtensionError, OriginConfigStore, OriginController, REMOTE_PROVIDERS, RequestTrustPolicy, SESSION_COOKIE, TASK_EVENT_DEBOUNCE_MS, TaskEventHub, WS_PATHS, WebSocketPathStore, addressAllowed, apply, assertExtensionId, configuredRemoteProvider, createCaddySite, createFrpAttachPlan, createFrpAttachTemplate, createFrpAttachTemplateParts, createFrpServerTemplate, createFrpcToml, createMobileAccessService, createRestrictedFrpServerTemplate, ensureFrpIngressCertificate, evaluateCertificateLifetime, frpAttachVpsParts, frpIngressPaths, frpIngressSelfCheck, frpProxyName, inject, isCloudflaredRegistration, isFrpSelfSignedIngress, isGloballyRoutableIpv4, isLoopbackAddress, issueServerCertificate, mergeSavedCloudflaredTunnelSettings, mergeSavedFrpSettings, mergeSavedFrpTarget, name, normalizeWebSocketPaths, originGatewayConfig, parseAuthority, parseCidr, parseCloudflaredOrigin, parseCloudflaredTunnelSettings, parseControlFile, parseDeviceSnapshot, parseExtensionManifest, parseFrpSettings, parseGatewayConfig, parseMobileAccessControlState, parseOriginSettings, parseRemoteProviderState, probeOriginCertificate, readCertificateRenewal, resolveAuthority, resolveFrpEntryTls, resolveFrpMode, resolveFrpPublicPort, resolveFrpVhostHttpPort, rewriteMobileIndex, validateAttachSettings, validateCloudflaredTunnelHostname, validateCloudflaredTunnelPort, validateCloudflaredTunnelToken, validateFrpEntryTls, validateFrpMode, validateFrpProxyName, validateFrpPublicOrigin, validateFrpPublicPort, validateFrpServerAddress, validateFrpServerPort, validateFrpToken, validateFrpVhostHttpPort, validateOriginAllowedCidrs, validateOriginListenHost, validateOriginListenPort, validateOriginPublicOrigin, validateWebSocketPath, watchTaskCompletions };
 
 //# sourceMappingURL=index.mjs.map